The 5xxT/G6xxT family uses an ADAM2 bootloader. That means that the installation is slighly more complex than the common one used for Broadcom (and PSPBoot-based AR7) devices. There is in-depth technical documentation on the Seatte Wireless ADAM2 page.
There are multiple safeguards that make the risk of bricking the router pretty low. The bootloader starts an FTP (FTP, not TFTP!) server on each boot, and can be accessed directly with a FTP client. It will also accept the original firmware image.
If something goes wrong, the tiupgrade.exe Windows tool can be used to restore the original firmware. For more advanced users, CICLaMaB (and its wizard) might also be useful. If things go *really* wrong, the board has a JTAG port (not tested), which should be enough to recover a completely bricked device.
Please do read:
When booting, the bootloader waits a few seconds for incoming connections to its FTP server. The address the bootloader listens to can be (and probably is) different from the one used by the device once the boot is completed. The easiest way to find it is to connect to the router with telnet, once the original firmware has completed booting.
User and passwords are both set by default to "admin".
# cat /proc/ticfg/env | grep my_ipaddress
If the IP is set it will be shown like this:
Usually, most devices use either 220.127.116.11 or 10.8.8.8. If you're upgraded the firmware in the past using tiupgrade.exe, it might have changed your IP to the one you specified in the web interface.
If it's not displayed, or to change it, it can be set with the command:
# echo "my_ipaddress 192.168.1.1" > /proc/sys/dev/adam2/environment
The flash on the device is divided into partitions. To get Openwrt to boot, we have to change some offsets.
The original firmware uses these partitions (in physical order):
|mtd0||0x90091000||0x903f0000||3452 KiB||Root filesystem|
and another "virtual" partition" that covers both mtd1 and mtd0
|mtd4||0x90010000||0x903f0000||3968 KiB||Kernel + FS|
The mtd2 partition contains the bootloader. Never touch it. If the bootloader gets corrupted, the router won't boot anymore (in that case reprogramming the entire flash with the JTAG should bring it back to life). Just to be safe, during normal usage the kernel won't allow you to overwrite it even if explicitly requested.
The mtd3 partition contains both the bootloader configuration and the original firmware settings. OpenWrt will ignore anything written in here. Don't touch it as well, or ADAM2 might get confused and unable to boot anymore.
To use OpenWrt on this unit the the partition layout need to be modified as follows (changes are in bold):
Partitions: (again, in physical ordering):
|Bootloader name||Kernel name||Start||End||Use|
|mtd1||linux||0x90010000||0x903f0000||Linux kernel (only the start address is used)|
|mtd0||rootfs||0x90010000||0x903f0000||r/o squashfs + r/w jffs2 filesystems (only the end address is used)|
|mtd3||config||0x903f0000||0x90400000||Original firmware configuration|
the "virtual" partition remains unchanged as
|Bootloader name||Kernel name||Start||End||Use|
|mtd4||rootfs_data||0x90010000||0x903f0000||Kernel + FS|
To be more precise, the kernel, once booted, will map another "virtual" partiton as /dev/mtdblock4 that will point to the newly created jffs2 partition located inside mtd3. Just ignore it for this discussion.
NOTE: the end of mtd1 and the start of mtd0 are dummy addresses; OpenWrt auto-detects the boundary between the kernel and the file system. The extra addresses are only used by firmwares based on 2.4.x kernels.
As an example, we'll use the openwrt-ar7-squashfs.bin image from the "ar7" OpenWrt port.
NOTE: The TCP/IP implementation in the bootloader is very basic and not completely standards compliant. There are some issues with recent Linux kernels that make the flashing process hang.
If your FTP client seems stuck, wait a few minutes and power off the router, the flash won't be damaged. If you're having problems, try to run your FTP client as root (so it can set different timeout parameters on the TCP socket). Windows (at least XP) and its built-in FTP command-line client is reported to work.
To reach the router during bootup, configure your computer using a static IP address on the same subnet as the bootloader (10.8.8.1/8 or 18.104.22.168/8 should be fine).
Apply power to the router. There will be a few second window where a connection can established with FTP to the address you've found before. The time window is very small, so if it doesn't work try again. It should start listening when the 4 switch lights turn off.
Username and Password are "adam2"
The commands needed to fix the partition table are:
quote "SETENV mtd1,0x90010000,0x903f0000" quote "GETENV mtd1"
Check each partition before continuing, an error here might brick the device.
When this has been completed the image can be flashed to the Kernel+FS partition mtd4
quote "MEDIA FLSH" binary debug hash put "openwrt-ar7-squashfs.bin" "openwrt-ar7-squashfs.bin mtd4" quote REBOOT quit
The router will reboot and set itself up, do not remove power as this could break it. Leave it until the status light has a steady heartbeat, then it is safe to power down.
you can not use sysupgrade to update this router, so you can use mtd:
scp openwrt-ar7-squashfs.bin 192.168.1.1:/tmp ssh 192.168.1.1 mtd -r write /tmp/openwrt-ar7-squashfs.bin linux
in case you load a non-working you can still use the FTP method to reflash with a working one