Linksys RE6350 Development - Need Help

For Developers
1

Ok, so I have a couple of these little extenders, and I want to see if I can port OpenWRT to it. Here is my documentation so far:

Disassembly

See Photos Here: https://photos.app.goo.gl/Pq5FZme7brABStMk6

  • There is a single screw hiding under the label at the bottom edge. Be wary when disassembling.
  • There are clips all around the edge. There are two on each edge, so 8 in total (2 clips x4 edges)
  • Once apart, there are 4 screws, 2 at the bottom, 1 at the top middle, and one on the left side.
  • The part underneath I think is just a power supply. The main board is the top part.
  • The main board has two plastic pins holding the heat spreader on. Remove carefully, a set of small needle-nosed pliers should help. It may stick a bit, just pull gently with your fingers.

Info

The main board (In High Def!)

Google Photos

Main componenets:

The Main CPU is fully supported already by OpenWRT, and the second chip is a coprocessor usually included when the main CPU is used in a router/extender. My guess is it is to add a second WiFi "card" to the chip, so it can act as an extender. The main chip appears to be able to act on its own if you only needed one radio.

The third one is just a 512Mb DDR2 RAM module.

If you look at the highlighted pieces, there appears to be a mystery switch (with no switch attached) and two junction headers, J1 and J10.
I'm guessing J1 is a Serial Header, J10 might be a USB or an extra Serial header.

Inked0708212027_LI
Inked0708212027_LI1134×1512 918 KB

Also, I traced the antenna lines, and one runs to the main processor, and the other runs to the co-processor, possibly confirming my theory of the second chip acting as a separate WiFi "card" so the extender can operate properly.

Conclusion

I'm pretty sure this board could almost run OpenWRT right away, except for a few pin assignments and port adjustments. I just need some help on that front. If anyone is willing to help me out, just post here and I'm sure we can figure this device out and add it to the growing list of compatible devices.

P.S.: If any of you guys want or need High-Res pics of the board for tracing purposes, let me know. I can borrow a T3i and get the pics taken.

Also, On Saturday Im gonna see if I can use my USB Serial dongle to connect to this device and see what it's running. Hope I can figure it out!

2

Stock firmware source is available at https://downloads.linksys.com/downloads/gpl/RE6350_v1.0.00.004.tar.gz which may provide clues for creating a DTS file.

3

Thanks. Ill look into it.

4 
[04020D07][04020D06]
DDR Calibration DQS reg = 00008888


U-Boot 1.1.3 (Jan 23 2017 - 14:32:47)

Board: Ralink APSoC DRAM:  64 MB
relocate_code Pointer at: 83f1c000

LINUX started...

 THIS IS ASIC

Using USB to Serial at 57600 baud

Currently cannot get past this to a prompt.

5

Any ideas on how to get to a linux or Uboot prompt? All I get is the above message "This is ASIC'

6

In the source code for the firmware, I found the file Uboot\include\configs\rt2880.h and added the following lines at line 101:

// Adding access to Uboot Console
#define CONFIG_AUTOBOOT_KEYED
#define CONFIG_AUTOBOOT_PROMPT "autoboot in %d seconds\n"
#define CONFIG_AUTOBOOT_STOP_STR "s"

Now if I can compile this, I should be able to interrupt the UBoot and gain me a UBoot console.

7

So it turns out this device uses the same boot password as the RE6500.

From the RE6500 setup page:

Boot without reset held down. Watch the console for U-Boot, and in particular, this line:
relocate_code Pointer at: 83f20000
Now press and hold reset, and type
1234567890 RET 4 RET
You have to type that 4 really fast.

(RET is the Return or Ener key)

8

So i killed it trying to backup the SPI chip. If anyone else wants to try adding support for these, they are pretty cheap on ebay. You can try it out. Be my guest.