I have an old Actiontec PK5000 Qwest modem/router sitting on my shelf collecting dust. I want to install OpenWRT on it not only for curiosity purposes but also to use it as a wireless bridge across my house. I installed OpenWRT on a Netgear WNR2000 so I am familiar of the flash process, however I am a little stumped on how to flash this particular model.
Some technical details:
The PK5000 has firmware sources available at Actiontec's website. According to the makefiles and build scripts, the System-On-Chip is TI AR7 ( the board is listed as AR7WRD ). The modem router has 16K of RAM.
I can telnet into the router after it fully boots (it has to be set up first in the web interface) and can peek into the system files. The bootloader appears to be PSPBoot due on the presence of the environment file.
# cat /proc/ticfg/env
BUILD_OPS 0x301
bootloaderVersion 3.6.7.16
MEMSZ 0x04000000
FLASHSZ 0x02000000
CPUFREQ 211968000
MIPSFREQ 211968000
SYSFREQ 105984000
SerialNumber none
MAC_PORT 0
AEIBootVersion 2.0
BOOTCFG m:f:"mtd1"
PROMPT (psbl)
MODETTY0 38400,n,8,1,hw
MODETTY1 38400,n,8,1,hw
IPA 192.168.0.1
IPA_SVR 192.168.0.99
DSL_FEATURE_CNTL_0 0x00202208
DSL_PHY_CNTL_0 0x00100800
vcc_encaps0 0.0
vcc_encaps1 0.0
vcc_encaps2 0.0
vcc_encaps3 0.0
vcc_encaps4 0.0
vcc_encaps5 0.0
vcc_encaps6 0.0
vcc_encaps7 0.0
usb_vid 0x0451
usb_pid 0x6060
ProductID PK5000
HWRevision 2A
mtd2 0x90000000,0x90020000
mtd3 0x90020000,0x90040000
mtd4 0x90040000,0x90060000
mtd1 0x90080000,0x90140000
mtd0 0x90140000,0x90700000
mtd6 0x90700000,0x907c0000
mtd5 0x907c0000,0x90d80000
mtd7 0x90d80000,0x90dc0000
mtd8 0x90dc0000,0x90e00000
mtd9 0x90e00000,0x90e40000
HWA_HRNDIS 00:20:E0:10:12:08
defaults
NVS_TFTP_LOAD 0
HWA_0 00:24:7B:13:07:C4
WLAN_HWADDR 00:24:7B:13:07:C4
HWA_RNDIS 00:24:7B:13:07:C4
HWA_3 00:24:7B:13:07:C5
WLAN_HWADDR0 00:24:7B:13:07:C6
WLAN_HWADDR1 00:24:7B:13:07:C7
WLAN_HWADDR2 00:24:7B:13:07:C8
WLAN_HWADDR3 00:24:7B:13:07:C9
WPS_AP_PIN 80394310
MANUSN CPAA9441104643
WLAN_EEPROM0 021156041B06001200000701095612000000010D56A9000000026D5401AAAAAA
WLAN_EEPROM1 AAAA0000013984000100000101854C1068900105850600100001298507000000
WLAN_EEPROM2 01C1850000300001C585000000000111850000FFFF0115850000F0FF01A58500
WLAN_EEPROM3 8000000109850000800201010C03000000012184000000800181851D00030001
WLAN_EEPROM4 55090100000001E5580200000001F1580800000001D5581000000001B1580400
WLAN_EEPROM5 0000000000000000000C00C300FE0008011401260144014D014F0165019F01AF
WLAN_EEPROM6 01B70101390000110004010101000501060002010201021E000A000205020411
WLAN_EEPROM7 2244030610203031324004095449204143583130300507544920546573740108
WLAN_EEPROM8 112345419A64011F0502000037006F00A800E60004044410FA034510E803185A
WLAN_EEPROM9 4000145A2D00020E0801E6000A012D034600A201850950000E010A0122044600
WLAN_EEPROM10 9D0185090107100000400000010000050400010100000000FFFFFFFFFDFDFDFD
WLAN_EEPROM11 FBF4F4F4F40E04FDFDFDFEFFFFFFFF090000FF09090909090909090909090909
WLAN_EEPROM12 0909090909090909000009FFFFFFFEFDFDFDFE0909090909090909090909090E
WLAN_EEPROM13 0100000000000000000000000000000302A318A3180700012000000000000000
WLAN_EEPROM14 00000000000000000000000000000000000000000000000000
FactoryVersion QAPK01-3.60.3.0.9.0-PK5000
modulation 1Powering on the device while holding down the reset button for several seconds puts the device in the bootloader state where the LED power light remains a solid amber color (instead of a solid green color). Using a FTP client to connect to the router greets me with the Adam2 bootloader's FTP server, which is confusing to say the least.
ftp> open 192.168.0.1
Connected to 192.168.0.1.
220 ADAM2 FTP Server ready.
Name (192.168.0.1:user): adam2
331 Password required for adam2.
Password:
230 User adam2 successfully logged in.
Remote system type is UNIX.
ftp> quit
221-Thank you for using the FTP service on ADAM2.
221 Goodbye.I have read the documentation regarding on how to flash using the FTP method as well as the flash layout documentation but I am not entirely sure where to flash the OpenWRT image at. Some of the articles (such as the D-Link DSL-5xxT and DSL-G6xxT - ADAM2 Installation Guide) I have read suggest that the PSPBoot based routers have around four MTD partitions. mtd2 is the bootloader, mtd3 is the bootloader configuration, mtd1 hints to be the kernel, and mtd0 is the root filesystem. However the PK5000 has ten MTD partitions.
# cat /proc/mtd
dev: size erasesize name
mtd0: 005c0000 00020000 "mtd0"
mtd1: 000c0000 00020000 "mtd1"
mtd2: 00020000 00020000 "mtd2"
mtd3: 00020000 00020000 "mtd3"
mtd4: 00020000 00020000 "mtd4"
mtd5: 005c0000 00020000 "mtd5"
mtd6: 000c0000 00020000 "mtd6"
mtd7: 00040000 00020000 "mtd7"
mtd8: 00040000 00020000 "mtd8"
mtd9: 00040000 00020000 "mtd9"And based on the bootloader environment file, the MTD partitions do not seem to be nested; they are side by side according to the address ranges. mtd0 and mtd5 are listed as a squashfs, with mtd0 being the root partition. I cannot seem to find any information regarding the other MTD devices.
# cat /etc/fstab
# /etc/fstab: static file system information.
#
# <file system> <mount point> <type> <options> <dump> <pass>
/dev/root / auto defaults,errors=continue 0 0
proc /proc proc defaults 0 0
ramfs /var ramfs defaults 0 0
# ls -l /dev/
<TRUNCATED>
drwxr-xr-x 1 0 0 0 Jan 1 1970 mtdblock
<TRUNCATED>
lr-xr-xr-x 1 0 0 10 Jan 1 1970 root -> mtdblock/0
<TRUNCATED>
# mount
/dev/mtdblock/0 on / type squashfs (ro)
none on /dev type devfs (rw)
proc on /proc type proc (rw)
ramfs on /var type ramfs (rw)I am not entirely sure how to properly flash this model without better understanding of the flash layout and the bootloader. Anyone know how to properly flash this kind of device or this kind of partitioning?
And yes, I have tried using the OEM firmware update tool provided by the web interface. Unfortunately, it rejects anything other than what is provided by the ISP (CenturyLink), possibly due to missing/incorrect firmware signature.