Adding OpenWrt support for Linksys MR6350

Hello,

I am looking for help on making the EA6530 OpenWrt image (openwrt-19.07.5-ipq40xx-generic-linksys_ea6350v3-squashfs-factory.bin) work on MR6530 node. It seems that the issue comes from the difference in the NAND memory size. EA6530 has 128MB flash memory, and MR6530 has 256MB. It would be great if someone with OpenWrt configuration and image cooking experience checks the details below and provides me any advise. Thank you!

The details:
Reading in the forums that Linksys EA and MR series are almost identical I decided to give a try of the EA6350 OpenWrt image on my MR6350. It was hard to perform this operation. First I realized there is no option for manual firmware update in the stock Linksys UI. Searching in the forums I found I could do it via a special URL - http://x.x.x.x/fwupdate.html (where x.x.x.x represents the IP address of my node). The firmware was uploaded successfuly, however after reboot the router halted for a while. Then it performed a selfreboot and booted the orginal Linksys image from its recovery partition (these routers have two partitions for redundancy).Now the routers always boots the Linksys stock image. Looking further in the forums in the topics for similar routers I discoverd that the router has serial connector inside. I managed to connect it to my notebook (using Arduino board inbetween). In the console I managed to interrupt the boot process. There I typed a command to force booting the OpenWrt partition: "(IPQ40xx) # run bootpart1". Looking at the booting process I saw it crashes with the following messages:
.
.
[ 81.262552] Registering SWP/SWPB emulation handler
81.277567] VFS: Cannot open root device "mtd:squashfs" or unknown-block(0,0): error -2
[ 81.277598] Please append a correct "root=" boot option; here are the available partitions:
[ 81.284486] Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(0,0)
[ 81.292720] CPU1: stopping
.
.
.

And here are the whole boot logs:

EA6350v3 OpenWrt Boot Log on MR6350 node:
EA6350v3 OpenWrt Boot Log on MR6350 node

MR6350 OEM Boot Log:
MR6350 OEM Boot Log

Reading the posts on similar topics in the forum, I decided it might be helpful to request the GPL sources from Linksys. I did it few weeks ago and they recently published it. If someone wants to help in making OpenWRT available on MR6350 and needs these sources - they are here.

1 Like

I also have an MR6350, have you had any luck?

Unfortunately no.
It should not be too difficult but the last few months I spent most of my time on another project.
Also the main driver to try OpenWRT was the hope for VLAN support, which I need in order to split my IPTV and Internet service. I applied a temporary solution by installing an old L2 switch in front of the MR6350. At some point I will make a second try with OpenWRT and eventually get rid of the switch, but it is no urgent at the moment. I will write here if I achieve it.

The photo from FCC ID.io for MR6530 (page 6) indicates that MR6530 has IPQ4019, instead of IPQ4018 in EA6350. EA8300 has IPQ4019 and the same amount of flash and RAM (256mb/256mb). Shouldn't EA8300's firmware be a closer match than EA6350?

I tried you're suggestion and flashed my MR6350 with the image for the EA8300 but no luck. Image flashed ok but the router rebooted with no assigned IP address so I re-flashed the stock image. Still hoping someone creates a working image for this device.

I was hoping EA8300's firmware would get it closer to a working state but apparently not. I am not a developer and the most challenging task I had done with OpenWrt was compiling and building image for an x86 system. With my limited OpenWrt knowledge I think the key is the DTS file, which describes the router's hardware components and how they they are connected. I don't have a MR6350 yet but am very interested in getting one to replace my EA7500v1 simply because of its low power consumption (12V/1.5A).

1 Like

I just bought an MR6350 off eBay and am waiting for delivery. My plan is to use it as a vehicle to understand some of OpenWrt internals. May not go anywhere but the router is cheap enough to play with. By the way, I saw there is a snapshot (could be release candidate, don't quite remember) for MR9000 and wonder if anyone has tried it. MR9000 is three-band and very similar to EA8300/MR8300.

News flash: MR9000's firmware works to some extent!

Received my MR6350 this morning and spent all afternoon with it. The only way I can flash firmware on it is the "TFTP + serial method" as document in OpenWrt's table of hardware Linksys EA7500v1. The firmware to flash must bear the filename "fiat.img", which I found from U-Boot printenv. I first flashed EA8300 firmware on it but it didn't go anywhere - stuck in a "PHY0/1/2/3 single test" loop. I then flashed @reka's 21.02.0-rc3 MR9000 firmware (posting #47 of this thread), which allowed access with LuCI webUI and SSH but a reboot would lose the capability. The last firmware I flashed was @NoTengoBattery's Optimized build 3.0.0-rc3 for IPQ40xx. With @NoTengoBattery's build I configured MR6350 as a wireless AP and it actually worked. I had radio0 (2.4GHz) in the Client mode and radio1 (5GHz) in the AP mode which is not an ideal configuration because my main router's 5GHz is using channel 149 which is not in radio1' supported channels. So some work is needed here to move those higher-frequency channels currently allocated to radio2 to radio1 since MR6350 doesn't have radio2. One thing I noticed was the reset button didn't work - a GPIO pin thing, I believe.

Need help from a moderator here. I just notice that the thread title was created with the wrong product model - MR6530 instead of MR6350. I originally found the thread by googling "openwrt mr6350" and all the postings in the thread were talking about MR6350 (The very beginning of the first posting did mention MR6530 a few times.) Can the title be corrected? I want to add some more information but am reluctant to do it now that I notice the error.

Done, topic title changed from MR6530 -> MR6350

Thanks, @tmomas.

I have found two essential things needed - IPQ4019 board/wifi data files in the stock MR6350 firmware and the dts/dtsi files from Linksys GPL MR6350 publication. The ingredients are there but need the recipes to process them. I think I might be able to adapt information in the stock dts/dtsi into OpenWrt's EA8300 dts file but still need to learn how to incorporate the board data files into the final form used by OpenWrt.

~ # ls /lib/firmware/IPQ4019/
AH    CN    FCC   IC    JP    ME    SG    hw.1
AU    EU    HK    IN    KR    PH    TH    hw_1
~ # ls /lib/firmware/IPQ4019/FCC
boardData_1_0_IPQ4019_DK04_2G.bin  boarddata_0.bin
boardData_1_0_IPQ4019_DK04_5G.bin  boarddata_1.bin
~ #

I had setup the build system (Debian 10 in VirtualBox) and did a few test EA8300 builds - mainly to figure out how menuconfig and make work - with a hacked EA8300 dts file - MR9000 dts with board name and filename changes. The firmware actually works in my MR6350 unit at about the same level of functionality that I got from @NoTengoBattery's optimized MR9000 firmware on MR6350.

This is why you need to be careful with flashing firmwares not intended for your device.

For testing the device I'm currently working on I tried the ramfs image of a router that has the same hardware. But the GPIO connections are different and the GPIO pin the firmware thinks is connected to the reset button is actually connected to an LED and so it always goes into failsafe mode.

If possible first always try using ramfs images you can load via the bootmanager. With those you can't brick the device because they never overwrite anything currently on your flash storage.

Thanks for the warning but in this case it doesn't really matter. MR6350 has two boot partitions so I take extra precaution to preserve one with the Linksys stock firmware always - only flash *factory.bin to the same boot partition that already has OpenWrt firmware and no sysupgrade whatsoever. Because it seems that MR6350 can only be flashed from bootloader (TFTP + serial method), I have the USB serial connected always. So I just do a "firstboot && reboot" from the serial console.

Just want to document how to open the box and the pin designation of the 6-pin serial port header on the PCB board..

To open the box, you need to remove 4 screws from the box bottom. The two front screws are beneath the plastic pads which you can peel of easily but the two back screws are hidden underneath the labels!. See photos.

The two punched-through holes on the labels to access the two back screws:


6-pin header viewed from the top of the box. You can see the right most pin is pin #1 (close to the metal heatsink on the right).

Header pin designation:

Pin #1 - 3.3v
Pin #2 - TX
Pin #3 - RX
Pin #4 - unknown
Pin #5 - Ground
Pin #6 - Ground

The header pin designation is the same as in EA7500v1 that I had previously hooked up my USB serial adapter except that EA7500v1 has 5 pin header though so I put a plastic tube, stripped from a wire of suitable size, on pin #6 to remind myself not to use the pin and pin #5 is ground. (Well, I couldn't find a black color wire and the close one is green-black, which is good enough for me. :)) Notice that the 3.3v pin isn't used (not connected to the USB adapter).

When I looked under the hood of MR6350 closely, I noticed something interesting:

~ # ls /lib/firmware/IPQ4019/hw_1
...
boardData_1_0_IPQ4019_DK04_2G.bin
boardData_1_0_IPQ4019_DK04_2G_neg_pwr.bin
boardData_1_0_IPQ4019_DK04_5G.bin
boardData_1_0_IPQ4019_DK04_5G_neg_pwr.bin
boardData_1_0_IPQ4019_DK05_2G.bin
boardData_1_0_IPQ4019_DK05_5G.bin
boardData_1_0_IPQ4019_DK06_2G.bin
boardData_1_0_IPQ4019_DK06_5G.bin
boardData_1_0_IPQ4019_DK07_wifi0_2G.bin
boardData_1_0_IPQ4019_DK07_wifi0_5G_HB.bin
boardData_1_0_IPQ4019_DK07_wifi1_5G_LB.bin
...
~ #

There are two 5G wifi boardData files for DK07 which both EA8300 and MR6350 are based on. The file "boardData_1_0_IPQ4019_DK07_wifi1_5G_LB.bin" seems to indicate that it is associated with radio1 (wifi1) and for lower bands (LB). This might explain why I only see channel 36 in my bootleg EA8300 firmware. I don't have an EA8300 to look under its "/lib/firmware/IPQ4019/FCC" folder to confirm my thought but I think I am on the right track with the fact that MR6350's 5G wifi boardData file in "/lib/firmware/IPQ4019/FCC" has a filename "boardData_1_0_IPQ4019_DK04_5G.bin" - not DK07 and no LB or HB. So my next task will be attacking the "board-2" file, instead of dts/dtsi files first.