OpenWrt Forum Archive

Topic: Flashing a Linksys RE6500

The content of this topic has been archived on 15 Apr 2018. There are no obvious gaps in this topic, but there may still be some posts missing at the end.

After reading the Installing Openwrt via TFTP and some repeated resets with tcpdump and nmap I was pretty sure that my RE6500 had an tftpserver (192.168.1.1 UDP Port 69) to which I can upload my freshly compiled image(CC r46293) as described in the Wiki. Unfortunately it does not work. All I get are timeouts until the install window closes.
The Wiki entry for the Linksys RE6500 is pretty short but I guess from the mentioning of the bootload password that I need to connect to the serial port to flash an image?
The only MT7621 target  with a factory image is the DIR-860l. All other targets only have sysupgrade images. Anyone has an idea how complicated it would be to generate a suitable factory image for an RE6500?

On a side note: In the install window there a three open TCP ports: 80, 7777 and 8888. A telnet to these ports leads to this:

Server: SDK 4.1.2.0 UPnP/1.0 MiniUPnPd/1.6_MTK_v2_001

<HTML><HEAD><TITLE>501 Not Implemented</TITLE></HEAD><BODY><H1>Not Implemented</H1>The HTTP Method is not implemented by this server.</BODY></HTML>

EDIT: Ignore that, it was late and I was tired. The ports functions are rather obvious..

(Last edited by M.Bastian on 12 Jul 2015, 12:09)

After some more tests and finally a look in the Linksys U-Boot source, which I should had done first. The RE6500 tries to get a "um_factory_fw.bin" file via tftp from 192.168.1.100. Unfortunately it does not seem to work with the OpenWrt sysupgrade image.  All I got so far is an unresponsive router(activity led is off) until the next power cycle.

Since I do not have an serial converter and still have to identify the pinout(the RE6500 Wiki page is rather sparse) I'll try if I can gleam something more from the Linksys source. Building a factory image would spare so much hassle.

I would greatly appreciate it if someone with more insight could give me some hints.

(Last edited by M.Bastian on 12 Jul 2015, 12:21)

So far I have only managed to install Buildroot and update feeds. Now I don't know how to select appropriate configuration for building a factory image. It seems to me that the option for selecting mt7621 is not yet available.

Device serial port pinout:
1. the one marked with triangle - VCC
2. TX
3. RX
4. GND

Serial port speed: 56000 bps

Factory firmware boot log:

===================================================================

             MT7621   stage1 code 10:41:05 (ASIC)

             CPU=50000000 HZ BUS=12500000 HZ

==================================================================

Change MPLL source from XTAL to CR...

do MEMPLL setting..

MEMPLL Config : 0x31000000

3PLL mode + External loopback

=== XTAL-40Mhz === DDR-800Mhz ===

PLL3 FB_DL: 0x6, 1/0 = 579/445 19000000

PLL4 FB_DL: 0xf, 1/0 = 569/455 3D000000

PLL2 FB_DL: 0x14, 1/0 = 734/290 51000000

do DDR setting..[00320000]

Apply DDR2 Setting...(use default AC)

          0    8   16   24   32   40   48   56   64   72   80   88   96  104  112  120

      --------------------------------------------------------------------------------

0000:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0

0001:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0

0002:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0

0003:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0

0004:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0

0005:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0

0006:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    1    1

0007:|    0    0    0    0    0    0    0    1    1    1    1    1    1    1    1    1

0008:|    1    1    1    1    1    1    1    1    1    1    1    1    1    1    0    0

0009:|    1    1    1    1    1    1    0    0    0    0    0    0    0    0    0    0

000A:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0

000B:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0

000C:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0

000D:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0

000E:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0

000F:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0

0010:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0

0011:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0

0012:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0

0013:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0

0014:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0

0015:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0

0016:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0

0017:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0

0018:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0

0019:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0

001A:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0

001B:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0

001C:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0

001D:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0

001E:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0

001F:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0

rank 0 coarse = 8

rank 0 fine = 56

B:|    0    0    0    0    0    0    0    1    1    1    0    0    0    0    0    0

opt_dle value:8

DRAMC_R0DELDLY[018]=00002E2E

==================================================================

        RX    DQS perbit delay software calibration 

==================================================================

1.0-15 bit dq delay value

==================================================================

bit|     0  1  2  3  4  5  6  7  8  9

--------------------------------------

0 |    10 7 10 11 9 7 9 6 7 9 

10 |    9 11 7 11 8 10 

--------------------------------------



==================================================================

2.dqs window

x=pass dqs delay value (min~max)center 

y=0-7bit DQ of every group

input delay:DQS0 =46 DQS1 = 46

==================================================================

bit    DQS0     bit      DQS1

0  (1~88)44  8  (1~86)43

1  (2~88)45  9  (1~88)44

2  (1~88)44  10  (1~88)44

3  (1~88)44  11  (1~85)43

4  (1~91)46  12  (1~88)44

5  (1~86)43  13  (1~87)44

6  (1~88)44  14  (1~91)46

7  (1~88)44  15  (1~88)44

==================================================================

3.dq delay value last

==================================================================

bit|    0  1  2  3  4  5  6  7  8   9

--------------------------------------

0 |    12 8 12 13 9 10 11 8 10 11 

10 |    11 14 9 13 8 12 

==================================================================

==================================================================

     TX  perbyte calibration 

==================================================================

DQS loop = 15, cmp_err_1 = ffff0000 

dqs_perbyte_dly.last_dqsdly_pass[0]=15,  finish count=1 

dqs_perbyte_dly.last_dqsdly_pass[1]=15,  finish count=2 

DQ loop=15, cmp_err_1 = ffff0000

dqs_perbyte_dly.last_dqdly_pass[0]=15,  finish count=1 

dqs_perbyte_dly.last_dqdly_pass[1]=15,  finish count=2 

byte:0, (DQS,DQ)=(8,8)

byte:1, (DQS,DQ)=(8,8)

20,data:88

[EMI] DRAMC calibration passed




===================================================================

             MT7621   stage1 code done 

             CPU=50000000 HZ BUS=12500000 HZ

===================================================================



U-Boot 1.1.3 (Jun  2 2015 - 15:52:13)

Board: Ralink APSoC DRAM:  64 MB
relocate_code Pointer at: 83f20000

LINUX started..©H¨˘!%MIS ASIC
<0><0><0><0><0><0><0><0><0><0><0><0>

Thank you for the serial pinout! I don't yet have a converter and I doubt I have time to investigate futher until next weekend.

What I know so far is that an image upload through tftp will not be flashed, just loaded into ram. I confirmed that with the latest Linksys Firmware (1.03, I have 10.2 installed) So all you can get is an unresponsive box or an emergency firmware update page until the next power cycle.

I also inspected the original Linksys firmware with 'binwalk' and it looks more or less(it is missing the Squashfs filesystem part) like an openwrt sysupgrade image.

The following in target/linux/ramips/image/Makefile is doing nothing at all:

define MkImage
        $(eval imagename=$(if $(4),$(4),ZZMIPS OpenWrt Linux-$(LINUX_VERSION)))
        -mkimage -A mips -O linux -T kernel -C $(1) -a $(loadaddr-y) -e $(loadaddr-y) \
                -n "ZZ$(imagename)" \
                -d $(2) $(3)
endef

If you want to manipulate the kernel entry point:

define Device/re6500
  DTS := RE6500
  KERNEL_ENTRY := 0x8000D1D0
endef

(Last edited by M.Bastian on 14 Jul 2015, 22:44)

I finally have access to the serial console. Unfortunately I have no access to the bootloader menu. I tried (mostly wth minicom: 57600, 8n1, no flow control) a few common keys, key combinations and even the bootloader password from the Wiki but no luck so far. A look into the Linksys provided GPL source didn't provide anything obvious(at least for me).
Of course it might be that my Tx line is not working but I rather doubt it. I'll dig out an old Linksys E2000 to be sure. The only other thing I could try is to compile an initramfs image to boot via tftp.

I would be very grateful for any advice.

EDIT: My Tx is indeed not working.  Compiling and booting from an initramfs image allowed me to install the CC RC3 sysupgrade image.

(Last edited by M.Bastian on 18 Jul 2015, 17:45)

Hi, guys!

After a month of trying, finally I have successfully flashed my RE6500 with OpenWRT...BUT...unfortunately, it is not working well sad

Now is the time to say that I did this with manual flashing of the flash SPI memory of the extender. As you already found out, I did too, the factory boot-loader's console is locked and cannot be unlocked. Also, the factory firmware of the extender is doing checking every time you are trying to upload a non-linksys firmware. After a few days of trying to upload OpenWRT BIN file with different "magic" bits, I always fail. And at last, I decided to try the plan "B". As you already know, DIR-860L B1 is using the same SoC, but the difference is the flash memory, it is 16MB double the size of the RE6500 (8MB) which means that the you are not able to put the bigger BIN file in to your RE6500. So, I decided to put a bigger flash SPI chip on my RE6500, so I could be able to put a bigger build for testing.

That's the list of the supported memories for this SoC (info provided by the factory boot-loader):

AT25DF321   AT26DF161   FL016AIF    FL064AIF    MX25L1605D  MX25L3205D  MX25L6405D  MX25L12805D MX25L25635E S25FL256S   S25FL128P   S25FL164K   S25FL132K   S25FL129P   S25FL032P   S25FL064P   F25L64QA    F25L32QA    EN25F16 EN25F32 EN25Q32 EN25F64 EN25Q64 W25Q32BV    W25Q64BV    W25Q128BV   GD25Q32B    GD25Q64B    GD25Q128C

Some more inforamtion from the factory boot-loader:

   Load Boot Loader code then write to Flash via TFTP. 
   0x80200000  0x80100000   
   Please Input new ones /or Ctrl-C to discard
   Input device IP    ipaddr  (%s)
   Input server IP    serverip    192.168.1.1 192.168.1.100       
   Input Uboot filename   uboot.bin       
   Input Linux Kernel filename    uImage  0x80A00000  bootfile    um_factory_fw.bin

bootcmd=tftp bootdelay=5 baudrate=57600 ethaddr="00:AA:BB:CC:DD:10" stdin=serial stdout=serial stderr=serial filesize=6fd900 fileaddr=80A00000 ipaddr=10.10.10.123 serverip=10.10.10.3 autostart=no bootfile=meidai_uImage

I decided to use MX25L12835F which is not in the list, but it is working fine. It size is 16MB (128Mbits). I bought an USB BIOS programming device from eBay which supports 25XXX series SPI chips.
http://s27.postimg.org/5q4fgpqfn/MX25_L12835_F.png
http://s9.postimg.org/hbq9x3ygv/usb_bios_programmer.jpg



The only think you have to do is flash your chip (or erase your old one) with a new U-boot loader. Download this one from OpenWRT PandoraBox Project website (it is already tested and working fine): http://downloads.openwrt.org.cn/PandoraBox/MT7621A-EVB/u-boot/u-boot-mt7621a-spi-128m-2014-06-05.bin

http://s4.postimg.org/4xfmplarx/flashing.jpg



After solder the already flashed chip to the board of the extender, it starts working instantly. The new U-boot loader has a built-in TFTP Client and Server, also Web Server which is starting on IP 192.168.1.1 NETMASK 255.255.255.0. The console is UNLOCKED, so you are free to use it.

Now you are able to upload whatever you want into the flash. If that doesn't work for you. You can use the built-in TFTP Client or Server (I am usually using the client). But you have to connect the console to your RS232 COM port of your PC, or use an USB adapter with step-down voltage converter. There is few project for building such an adapter. One I found in the dd-wrt forum, with Nokia DKU-5 cable (tested by me, working fine), or using 2 x 100 Ohm resistors as a step-down converter and connect it directly to the COM port of the PC (also already tested by me and works fine).

http://s28.postimg.org/3xuiiqjkd/rs232_ste_down_adapter_1.jpg
http://s4.postimg.org/zduqf7b2l/rs232_ste_down_adapter_2.jpg
http://s1.postimg.org/x6kq6uqsf/rs232_ste_down_adapter_3.jpg
http://s2.postimg.org/ujwxjidgp/rs232_ste_down_adapter_4.jpg
http://s21.postimg.org/56x6bsh13/rs232_ste_down_adapter_5.jpg



Now is the time to say that YOUR PINOUT IS INCORRECT. Here is the right one:

http://s1.postimg.org/rq6nq7mse/RE6500_pinout.jpg



Here is the final result of replacing the flash memory of the extender:
The old chip: http://s16.postimg.org/r3h9ugs04/RE6500_old_spi_mx25_L6405.jpg
The new chip: http://s13.postimg.org/s9dnfpvza/RE6500_new_spi_MX25_L12835_F.jpg



For using the console open Hyper Terminal or use Putty, or some other SSH client, with settings TTY, 57600, 8N1, no flow control. After the console is connected press on some of the option buttons as fallow:
Please choose the operation:

   1: Load system code to SDRAM via TFTP.

   2: Load system code then write to Flash via TFTP.

   3: Boot system code via Flash (default).

   4: Entr boot command line interface.

   7: Load Boot Loader code then write to Flash via Serial.

   9: Load Boot Loader code then write to Flash via TFTP.

    0

   

3: System Boot system code via Flash. <--- That's the default option

If you brick your router, in most cases you will have to use the console to start the TFTP. The built-in Web Server of the U-boot is starting only if it is not able to load the code from the firmware or there is no firmware at all.

The very first Release Candidate for RE6500 you can download from the OpenWRT Chaos Calmer Project webpage:
http://downloads.openwrt.org/chaos_calmer/15.05-rc3/ramips/mt7621/openwrt-15.05-rc3-ramips-mt7621-re6500-squashfs-sysupgrade.bin

The reason I used the bigger SPI memory is to test the other releases for this SoC MT7621A, because they are big as almost 14MB. So, if you decide to test them, you can download the PandoraBox release for PBM-M1 or the Firefly release FireWRT, but all of them have weak wi-fi signal and sometimes - unstable streaming. PandowaBox release has a lot of additional packages for download and services. FireWRT looks good and stable, but really lite as of included options (for example there is no WPA2 support yet, not working Wi-Fi channel option, etc.), also is very small almost 4MB which means it can fit even in the stock flash memory of RE6500. Here are the links:
http://downloads.openwrt.org.cn/PandoraBox/PandoraBox-PBR-M1/PandoraBox-ralink-mt7621-pbr-m1-squashfs-sysupgrade-r1087-20150627.bin
https://drive.google.com/folderview?id=0B7HO8lbGgAqAfjNJTHV5TGZLR2VwNlJBcnJaMzdOZmhSVlFrbmxrd1Q4dWVfRUJIU0I2WWM&usp=drive_web

After successfully installed of the OpenWRT built for RE6500 you will see this boot log messages in the console:

 
 ===================================================================
              MT7621   stage1 code 13:14:00 (ASIC)
              CPU=50000000 HZ BUS=12500000 HZ
 ==================================================================
 Change MPLL source from XTAL to CR...
 do MEMPLL setting..
 MEMPLL Config : 0x31000000
 3PLL mode + External loopback
 === XTAL-40Mhz === DDR-800Mhz ===
 PLL2 FB_DL: 0x7, 1/0 = 522/502 1D000000
 PLL3 FB_DL: 0xb, 1/0 = 620/404 2D000000
 PLL4 FB_DL: 0x12, 1/0 = 625/399 49000000
 do DDR setting..[00320000]
 Apply DDR2 Setting...(use default AC)
           0    8   16   24   32   40   48   56   64   72   80   88   96  104  112  120
       --------------------------------------------------------------------------------
 0000:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
 0001:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
 0002:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
 0003:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
 0004:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
 0005:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
 0006:|    0    0    0    0    0    0    0    0    0    0    0    0    0    1    1    1
 0007:|    0    0    0    0    0    0    1    1    1    1    1    1    1    1    1    1
 0008:|    1    1    1    1    1    1    1    1    1    1    1    1    0    0    0    0
 0009:|    1    1    1    1    0    0    0    0    0    0    0    0    0    0    0    0
 000A:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
 000B:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
 000C:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
 000D:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
 000E:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
 000F:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
 0010:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
 0011:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
 0012:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
 0013:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
 0014:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
 0015:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
 0016:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
 0017:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
 0018:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
 0019:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
 001A:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
 001B:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
 001C:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
 001D:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
 001E:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
 001F:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
 rank 0 coarse = 8
 rank 0 fine = 48
 B:|    0    0    0    0    0    0    1    1    1    0    0    0    0    0    0    0
 opt_dle value:7
 DRAMC_R0DELDLY[018]=00002B2C
 ==================================================================
         RX    DQS perbit delay software calibration 
 ==================================================================
 1.0-15 bit dq delay value
 ==================================================================
 bit|     0  1  2  3  4  5  6  7  8  9
 --------------------------------------
 0 |    9 7 9 11 9 9 9 6 6 7 
 10 |    8 9 7 9 6 8 
 --------------------------------------
 
 ==================================================================
 2.dqs window
 x=pass dqs delay value (min~max)center 
 y=0-7bit DQ of every group
 input delay:DQS0 =44 DQS1 = 43
 ==================================================================
 bit    DQS0     bit      DQS1
 0  (1~85)43  8  (1~82)41
 1  (1~82)41  9  (1~85)43
 2  (1~84)42  10  (1~84)42
 3  (1~86)43  11  (1~82)41
 4  (2~87)44  12  (1~86)43
 5  (1~86)43  13  (1~84)42
 6  (1~85)43  14  (1~85)43
 7  (1~86)43  15  (1~83)42
 ==================================================================
 3.dq delay value last
 ==================================================================
 bit|    0  1  2  3  4  5  6  7  8   9
 --------------------------------------
 0 |    10 10 11 12 9 10 10 7 8 7 
 10 |    9 11 7 10 6 9 
 ==================================================================
 ==================================================================
      TX  perbyte calibration 
 ==================================================================
 DQS loop = 15, cmp_err_1 = ffff0000 
 dqs_perbyte_dly.last_dqsdly_pass[0]=15,  finish count=1 
 dqs_perbyte_dly.last_dqsdly_pass[1]=15,  finish count=2 
 DQ loop=15, cmp_err_1 = ffff0000
 dqs_perbyte_dly.last_dqdly_pass[0]=15,  finish count=1 
 dqs_perbyte_dly.last_dqdly_pass[1]=15,  finish count=2 
 byte:0, (DQS,DQ)=(8,8)
 byte:1, (DQS,DQ)=(8,8)
 20,data:88
 [EMI] DRAMC calibration passed
  
 ===================================================================
              MT7621   stage1 code done 
              CPU=50000000 HZ BUS=12500000 HZ
 ===================================================================


 U-Boot 1.1.3 (Jun  5 2014 - 22:54:38)

 SoC:MediaTek MT7621 
 DRAM:  Memory Testing..65536K OK. is 64 MB
 relocate_code Pointer at: 83fb0000

 Config XHCI 40M PLL 
 flash manufacture id: c2, device id 20 18
 find flash: MX25L12805D
 *** Warning - bad CRC, using default environment

  _______________________________________________________________ 
 |    ____                 _                 ____               |
 |   |  _ \ __ _ _ __   __| | ___  _ __ __ _| __ )  _____  __   |
 |   | |_) / _` | '_ \ / _` |/ _ \| '__/ _` |  _ \ / _ \ \/ /   |
 |   |  __/ (_| | | | | (_| | (_) | | | (_| | |_) | (_) >  <    |
 |   |_|   \__,_|_| |_|\__,_|\___/|_|  \__,_|____/ \___/_/\_\   |
 |                                                              |
 |                  Ralink/MTK SDK Plantform                    |
 |                    Copyright 2005-2014                       |
 |                    Board:MTK MT7621A EVB                     |
 |                                                              |
 |                 lintel<lintel.huang@gmail.com>               |
 |______________________________________________________________|

 ============================================ 
 Ralink UBoot Version: 4.2.S.1
 -------------------------------------------- 
 ASIC 7621_MP (MAC to MT7530 Mode)
 DRAM_CONF_FROM: Auto-Detection 
 DRAM_TYPE: DDR2 
 DRAM bus: 16 bit
 Xtal Mode=3 OCP Ratio=1/4
 Flash component: SPI Flash
 Date:Jun  5 2014  Time:22:54:38
 ============================================ 
 CPU Speed: 880 MHZ
 RAM Size:64 Mbytes

 Build Date:Jun  5 2014  Time:22:54:38
 ============================================ 
 #Reset_MT7530
 set LAN/WAN WLLLL
 GPIO_MODE init:
     I2C:GPIO
     UART_F:GPIO
     WDT_RST:GPIO
 GPIO_MODE_REGs: 0x4053d

 Please choose the operation: 
    1: Load system code to SDRAM via TFTP. 
    2: Load system code then write to Flash via TFTP. 
    3: Boot system code via Flash (default).
    4: Entr boot command line interface.
    7: Load Boot Loader code then write to Flash via Serial. 
    9: Load Boot Loader code then write to Flash via TFTP. 
     0 
    
 3: System Boot system code via Flash.

 Press Reset button enter upgrade mode!
 ## Booting image at bfc50000 ...
    Image Name:   MIPS OpenWrt Linux-3.18.17
    Image Type:   MIPS Linux Kernel Image (lzma compressed)
    Data Size:    1257724 Bytes =  1.2 MB
    Load Address: 80001000
    Entry Point:  80001000
    Verifying Checksum ... OK
    Uncompressing Kernel Image ... OK
 No initrd
 ## Transferring control to Linux (at address 80001000) ...
 ## Giving linux memsize in MB, 64

 Starting kernel ...

 [    0.000000] Linux version 3.18.17 (buildbot@builder1) (gcc version 4.8.3 (OpenWrt/Linaro GCC 4.8-2014.04 r46018) ) #1 SMP Fri Jul 3 21:51:40 CEST 2015
[    0.000000] SoC Type: Mediatek MT7621 ver:1 eco:3
[    0.000000] bootconsole [early0] enabled
[    0.000000] CPU0 revision is: 0001992f (MIPS 1004Kc)
[    0.000000] MIPS: machine is Linksys RE6500
[    0.000000] Determined physical RAM map:
[    0.000000]  memory: 08000000 @ 00000000 (usable)
[    0.000000] Initrd not found or empty - disabling initrd
[    0.000000] Zone ranges:
[    0.000000]   Normal   [mem 0x00000000-0x07ffffff]
[    0.000000]   HighMem  empty
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x00000000-0x07ffffff]
[    0.000000] Initmem setup node 0 [mem 0x00000000-0x07ffffff]
[    0.000000] Detected 3 available secondary CPU(s)
[    0.000000] Primary instruction cache 32kB, VIPT, 4-way, linesize 32 bytes.
[    0.000000] Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
[    0.000000] MIPS secondary cache 256kB, 8-way, linesize 32 bytes.
[    0.000000] PERCPU: Embedded 9 pages/cpu @8110d000 s5696 r8192 d22976 u36864
[    0.000000] Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 32512
[    0.000000] Kernel command line: console=ttyS0,57600 rootfstype=squashfs,jffs2
[    0.000000] PID hash table entries: 512 (order: -1, 2048 bytes)
[    0.000000] Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)
[    0.000000] Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)
[    0.000000] Writing ErrCtl register=0005890a
[    0.000000] Readback ErrCtl register=0005890a
[    0.000000] Memory: 125764K/131072K available (2853K kernel code, 147K rwdata, 540K rodata, 160K init, 232K bss, 5308K reserved, 0K highmem)
[    0.000000] SLUB: HWalign=64, Order=0-3, MinObjects=0, CPUs=4, Nodes=1
[    0.000000] Hierarchical RCU implementation.
[    0.000000] NR_IRQS:256
[    0.000000] gic: revision 3.0
[    0.000000] CPU Clock: 880MHz
[    0.000000] Calibrating delay loop... 577.53 BogoMIPS (lpj=2887680)
[    0.060000] pid_max: default: 32768 minimum: 301
[    0.070000] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes)
[    0.080000] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes)
[    0.090000] Primary instruction cache 32kB, VIPT, 4-way, linesize 32 bytes.
[    0.090000] Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
[    0.090000] MIPS secondary cache 256kB, 8-way, linesize 32 bytes.
[    0.090000] CPU1 revision is: 0001992f (MIPS 1004Kc)
[    0.190000] Synchronize counters for CPU 1: done.
[    0.190000] Primary instruction cache 32kB, VIPT, 4-way, linesize 32 bytes.
[    0.190000] Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
[    0.190000] MIPS secondary cache 256kB, 8-way, linesize 32 bytes.
[    0.200000] CPU2 revision is: 0001992f (MIPS 1004Kc)
[    0.290000] Synchronize counters for CPU 2: done.
[    0.300000] Primary instruction cache 32kB, VIPT, 4-way, linesize 32 bytes.
[    0.300000] Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
[    0.300000] MIPS secondary cache 256kB, 8-way, linesize 32 bytes.
[    0.300000] CPU3 revision is: 0001992f (MIPS 1004Kc)
[    0.390000] Synchronize counters for CPU 3: done.
[    0.400000] Brought up 4 CPUs
[    0.410000] pinctrl core: initialized pinctrl subsystem
[    0.420000] NET: Registered protocol family 16
[    0.430000] pull PCIe RST: RALINK_RSTCTRL = 0
[    0.730000] release PCIe RST: RALINK_RSTCTRL = 7000000
[    0.740000] ***** Xtal 40MHz *****
[    0.740000] release PCIe RST: RALINK_RSTCTRL = 7000000
[    0.750000] Port 0 N_FTS = 1b102800
[    0.750000] Port 1 N_FTS = 1b102800
[    0.760000] Port 2 N_FTS = 1b102800
[    1.890000] PCIE2 no card, disable it(RST&CLK)
[    1.900000]  -> 21007f2
[    1.900000] PCIE0 enabled
[    1.910000] PCIE1 enabled
[    1.910000] PCI host bridge /pcie@1e140000 ranges:
[    1.920000]  MEM 0x0000000060000000..0x000000006fffffff
[    1.930000]   IO 0x000000001e160000..0x000000001e16ffff
[    1.970000] mt7621_gpio 1e000600.gpio: registering 32 gpios
[    1.980000] mt7621_gpio 1e000600.gpio: registering 32 gpios
[    1.990000] mt7621_gpio 1e000600.gpio: registering 32 gpios
[    2.000000] PCI host bridge to bus 0000:00
[    2.000000] pci_bus 0000:00: root bus resource [mem 0x60000000-0x6fffffff]
[    2.010000] pci_bus 0000:00: root bus resource [io  0xffffffff]
[    2.020000] pci_bus 0000:00: No busn resource found for root bus, will use [bus 00-ff]
[    2.030000] pci 0000:00:00.0: bridge configuration invalid ([bus 00-00]), reconfiguring
[    2.040000] pci 0000:00:01.0: bridge configuration invalid ([bus 00-00]), reconfiguring
[    2.050000] pci 0000:00:00.0: BAR 0: no space for [mem size 0x80000000]
[    2.060000] pci 0000:00:00.0: BAR 0: failed to assign [mem size 0x80000000]
[    2.070000] pci 0000:00:01.0: BAR 0: no space for [mem size 0x80000000]
[    2.080000] pci 0000:00:01.0: BAR 0: failed to assign [mem size 0x80000000]
[    2.090000] pci 0000:00:00.0: BAR 8: assigned [mem 0x60000000-0x600fffff]
[    2.100000] pci 0000:00:00.0: BAR 9: assigned [mem 0x60100000-0x601fffff pref]
[    2.110000] pci 0000:00:01.0: BAR 8: assigned [mem 0x60200000-0x602fffff]
[    2.120000] pci 0000:00:01.0: BAR 9: assigned [mem 0x60300000-0x603fffff pref]
[    2.130000] pci 0000:00:00.0: BAR 1: assigned [mem 0x60400000-0x6040ffff]
[    2.140000] pci 0000:00:01.0: BAR 1: assigned [mem 0x60410000-0x6041ffff]
[    2.150000] pci 0000:01:00.0: BAR 0: assigned [mem 0x60000000-0x600fffff 64bit]
[    2.160000] pci 0000:01:00.0: BAR 6: assigned [mem 0x60100000-0x6010ffff pref]
[    2.170000] pci 0000:00:00.0: PCI bridge to [bus 01]
[    2.170000] pci 0000:00:00.0:   bridge window [mem 0x60000000-0x600fffff]
[    2.180000] pci 0000:00:00.0:   bridge window [mem 0x60100000-0x601fffff pref]
[    2.190000] pci 0000:02:00.0: BAR 0: assigned [mem 0x60200000-0x602fffff 64bit]
[    2.200000] pci 0000:02:00.0: BAR 6: assigned [mem 0x60300000-0x6030ffff pref]
[    2.210000] pci 0000:00:01.0: PCI bridge to [bus 02]
[    2.210000] pci 0000:00:01.0:   bridge window [mem 0x60200000-0x602fffff]
[    2.220000] pci 0000:00:01.0:   bridge window [mem 0x60300000-0x603fffff pref]
[    2.230000] BAR0 at slot 0 = 0
[    2.230000] bus=0x0, slot = 0x0
[    2.240000] BAR0 at slot 1 = 0
[    2.240000] bus=0x0, slot = 0x1
[    2.250000] bus=0x1, slot = 0x0, irq=0xff
[    2.250000] bus=0x2, slot = 0x1, irq=0xff
[    2.260000] Switched to clocksource MIPS
[    2.270000] NET: Registered protocol family 2
[    2.270000] TCP established hash table entries: 1024 (order: 0, 4096 bytes)
[    2.290000] TCP bind hash table entries: 1024 (order: 1, 8192 bytes)
[    2.300000] TCP: Hash tables configured (established 1024 bind 1024)
[    2.310000] TCP: reno registered
[    2.320000] UDP hash table entries: 256 (order: 1, 8192 bytes)
[    2.330000] UDP-Lite hash table entries: 256 (order: 1, 8192 bytes)
[    2.340000] NET: Registered protocol family 1
[    2.350000] futex hash table entries: 1024 (order: 4, 65536 bytes)
[    2.370000] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    2.390000] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    2.410000] msgmni has been set to 245
[    2.410000] io scheduler noop registered
[    2.420000] io scheduler deadline registered (default)
[    2.430000] Serial: 8250/16550 driver, 16 ports, IRQ sharing enabled
[    2.450000] console [ttyS0] disabled
[    2.450000] 1e000c00.uartlite: ttyS0 at MMIO 0x1e000c00 (irq = 34, base_baud = 3125000) is a 16550A
[    2.470000] console [ttyS0] enabled
[    2.470000] console [ttyS0] enabled
[    2.490000] bootconsole [early0] disabled
[    2.490000] bootconsole [early0] disabled
[    2.500000] m25p80 spi32766.0: found mx25l12805d, expected mx25l6405d
[    2.520000] m25p80 spi32766.0: mx25l12805d (16384 Kbytes)
[    2.530000] m25p80 spi32766.0: using chunked io
[    2.540000] 4 ofpart partitions found on MTD device spi32766.0
[    2.550000] Creating 4 MTD partitions on "spi32766.0":
[    2.560000] 0x000000000000-0x000000030000 : "u-boot"
[    2.570000] 0x000000030000-0x000000040000 : "u-boot-env"
[    2.580000] 0x000000040000-0x000000050000 : "factory"
[    2.590000] 0x000000050000-0x000001000000 : "firmware"
[    2.700000] random: nonblocking pool is initialized
[    2.710000] 2 uimage-fw partitions found on MTD device firmware
[    2.730000] 0x000000050000-0x00000018313c : "kernel"
[    2.740000] 0x00000018313c-0x000001000000 : "rootfs"
[    2.750000] mtd: device 5 (rootfs) set to be root filesystem
[    2.760000] 1 squashfs-split partitions found on MTD device rootfs
[    2.770000] 0x0000003e0000-0x000001000000 : "rootfs_data"
[    2.780000] netif_napi_add() called with weight 128 on device eth%d
[    2.810000] change HW-TRAP to 0x17ccf
[    2.810000] ralink_soc_eth 1e100000.ethernet: generated random MAC address 7e:7f:77:31:aa:d2
[    2.830000] libphy: mdio: probed
[    2.850000] ralink_soc_eth 1e100000.ethernet: loaded mt7530 driver
[    2.860000] ralink_soc_eth 1e100000.ethernet eth0: ralink at 0xbe100000, irq 11
[    2.880000] mt7621_wdt 1e000100.wdt: Initialized
[    2.890000] TCP: cubic registered
[    2.890000] NET: Registered protocol family 17
[    2.900000] bridge: automatic filtering via arp/ip/ip6tables has been deprecated. Update your scripts to load br_netfilter if you need this.
[    2.930000] Bridge firewalling registered
[    2.940000] 8021q: 802.1Q VLAN Support v1.8
[    2.960000] VFS: Mounted root (squashfs filesystem) readonly on device 31:5.
[    2.970000] Freeing unused kernel memory: 160K (80378000 - 803a0000)
[    4.750000] init: Console is alive
[    4.760000] init: - watchdog -
[    6.630000] ralink_soc_eth 1e100000.ethernet eth0: port 1 link up
[    6.820000] usbcore: registered new interface driver usbfs
[    6.830000] usbcore: registered new interface driver hub
[    6.840000] usbcore: registered new device driver usb
[    6.880000] FM_OUT value: u4FmOut = 0(0x00000000)
[    6.900000] FM_OUT value: u4FmOut = 0(0x00000000)
[    6.920000] FM_OUT value: u4FmOut = 0(0x00000000)
[    6.940000] FM_OUT value: u4FmOut = 0(0x00000000)
[    6.960000] FM_OUT value: u4FmOut = 0(0x00000000)
[    6.980000] FM_OUT value: u4FmOut = 0(0x00000000)
[    7.000000] FM_OUT value: u4FmOut = 0(0x00000000)
[    7.020000] FM_OUT value: u4FmOut = 0(0x00000000)
[    7.040000] FM_OUT value: u4FmOut = 0(0x00000000)
[    7.060000] FM_OUT value: u4FmOut = 0(0x00000000)
[    7.120000] FM_OUT value: u4FmOut = 0(0x00000000)
[    7.140000] FM_OUT value: u4FmOut = 0(0x00000000)
[    7.160000] FM_OUT value: u4FmOut = 0(0x00000000)
[    7.180000] FM_OUT value: u4FmOut = 0(0x00000000)
[    7.200000] FM_OUT value: u4FmOut = 0(0x00000000)
[    7.220000] FM_OUT value: u4FmOut = 0(0x00000000)
[    7.240000] FM_OUT value: u4FmOut = 0(0x00000000)
[    7.260000] FM_OUT value: u4FmOut = 0(0x00000000)
[    7.280000] FM_OUT value: u4FmOut = 0(0x00000000)
[    7.300000] FM_OUT value: u4FmOut = 0(0x00000000)
[    7.450000] xhci-hcd xhci-hcd: xHCI Host Controller
[    7.460000] xhci-hcd xhci-hcd: new USB bus registered, assigned bus number 1
[    7.470000] xhci-hcd xhci-hcd: irq 30, io mem 0x1e1c0000
[    7.480000] hub 1-0:1.0: USB hub found
[    7.490000] hub 1-0:1.0: 2 ports detected
[    7.500000] xhci-hcd xhci-hcd: xHCI Host Controller
[    7.510000] xhci-hcd xhci-hcd: new USB bus registered, assigned bus number 2
[    7.520000] hub 2-0:1.0: USB hub found
[    7.530000] hub 2-0:1.0: 1 port detected
[    7.550000] MTK MSDC device init.
[    7.600000] mtk-sd: MediaTek MT6575 MSDC Driver
[    7.610000] sdhci: Secure Digital Host Controller Interface driver
[    7.620000] sdhci: Copyright(c) Pierre Ossman
[    7.630000] sdhci-pltfm: SDHCI platform and OF driver helper
[    7.640000] msdc-1 -> set mclk to 0!!! <- msdc_set_mclk() : L<641> PID<kworker/u8:1><0x17>
[    7.660000] msdc-1 -> set mclk to 0!!! <- msdc_set_mclk() : L<641> PID<kworker/u8:1><0x17>
[    7.730000] msdc-1 -> set mclk to 0!!! <- msdc_set_mclk() : L<641> PID<kworker/u8:1><0x17>
[    7.750000] msdc-1 -> set mclk to 0!!! <- msdc_set_mclk() : L<641> PID<kworker/u8:1><0x17>
[    7.750000] init: - preinit -
[    7.820000] msdc-1 -> set mclk to 0!!! <- msdc_set_mclk() : L<641> PID<kworker/u8:1><0x17>
Press the [f] key and hit [enter] to enter failsafe mode
Press the [1], [2], [3] or [4] key and hit [enter] to select the debug level
[   11.460000] jffs2: notice: (366) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found.
[   11.490000] mount_root: switching to jffs2 overlay
[   11.530000] procd: - early -
[   11.530000] procd: - watchdog -
[   12.380000] procd: - ubus -
[   13.390000] procd: - init -
Please press Enter to activate this console.
[   14.010000] NET: Registered protocol family 10
[   14.020000] ip6_tables: (C) 2000-2006 Netfilter Core Team
[   14.040000] Loading modules backported from Linux version master-2015-03-09-0-g141f155
[   14.060000] Backport generated by backports.git backports-20150129-0-gdd4a670
[   14.090000] cfg80211: Calling CRDA to update world regulatory domain
[   14.110000] cfg80211: World regulatory domain updated:
[   14.120000] cfg80211:  DFS Master region: unset
[   14.130000] cfg80211:   (start_freq - end_freq @ bandwidth), (max_antenna_gain, max_eirp), (dfs_cac_time)
[   14.140000] cfg80211:   (2402000 KHz - 2472000 KHz @ 40000 KHz), (N/A, 2000 mBm), (N/A)
[   14.160000] cfg80211:   (2457000 KHz - 2482000 KHz @ 40000 KHz), (N/A, 2000 mBm), (N/A)
[   14.180000] cfg80211:   (2474000 KHz - 2494000 KHz @ 20000 KHz), (N/A, 2000 mBm), (N/A)
[   14.190000] cfg80211:   (5170000 KHz - 5250000 KHz @ 80000 KHz), (N/A, 2000 mBm), (N/A)
[   14.210000] cfg80211:   (5250000 KHz - 5330000 KHz @ 80000 KHz, 160000 KHz AUTO), (N/A, 2000 mBm), (0 s)
[   14.230000] cfg80211:   (5490000 KHz - 5730000 KHz @ 160000 KHz), (N/A, 2000 mBm), (0 s)
[   14.240000] cfg80211:   (5735000 KHz - 5835000 KHz @ 80000 KHz), (N/A, 2000 mBm), (N/A)
[   14.260000] cfg80211:   (57240000 KHz - 63720000 KHz @ 2160000 KHz), (N/A, 0 mBm), (N/A)
[   14.280000] ASIC revision: 76120044
[   14.290000] Flash EEPROM data check failed: ffff
[   14.300000] mt76pci 0000:01:00.0: Invalid MAC address, using random address 5a:68:8a:60:29:14
[   14.330000] ROM patch already applied
[   14.340000] Firmware Version: 0.0.00
[   14.340000] Build: 1
[   14.350000] Build Time: 201410061140____
[   14.380000] Firmware running!
[   14.380000] pci device driver attached
[   14.390000] ASIC revision: 76020044
[   14.400000] Flash EEPROM data check failed: ffff
[   14.410000] mt76pci 0000:02:00.0: Invalid MAC address, using random address be:dc:a9:03:b4:6d
[   14.450000] ROM patch already applied
[   14.450000] Firmware Version: 0.0.00
[   14.460000] Build: 1
[   14.470000] Build Time: 201410061140____
[   14.500000] Firmware running!
[   14.500000] pci device driver attached
[   14.520000] hidraw: raw HID events driver (C) Jiri Kosina
[   14.540000] ip_tables: (C) 2000-2006 Netfilter Core Team
[   14.560000] nf_conntrack version 0.5.0 (1967 buckets, 7868 max)
[   14.660000] usbcore: registered new interface driver usbhid
[   14.670000] usbhid: USB HID core driver
[   14.690000] xt_time: kernel timezone is -0000
[   14.710000] PPP generic driver version 2.4.2
[   14.720000] NET: Registered protocol family 24
[   18.830000] device eth0.1 entered promiscuous mode
[   18.840000] device eth0 entered promiscuous mode
[   18.850000] br-lan: port 1(eth0.1) entered forwarding state
[   18.860000] br-lan: port 1(eth0.1) entered forwarding state
[   20.860000] br-lan: port 1(eth0.1) entered forwarding state


http://s15.postimg.org/mrclazm4r/status_screen.jpg



This build for RE6500 is full with bugs and this that you have to fix or change.
1). First of all you have to install and change the default Theme of the Web GUI, because some of the features are not visible and/or you are not able to change them (for example the Wi-Fi channels and standards). So, after you successfully put a valid IP configuration of the extender in the Network > Interfaces and you are sure that there is an Internet connection, go to System > Software, past the link of the new Theme and install it. If there is no Internet connection you will see a message that "Can't open 'downloads.openwrt.org".

http://s23.postimg.org/m2dbu0o3f/wifi_screen.jpg



2). You have to enable port0 of the switch, because the Developer of this build made a mistake and enabled port4 instead of port0. So, go to Network > Switch and change port0 from "off" to "untagged", but change port4 from "Untagged" to "Off".

http://s8.postimg.org/pjvvtbfd1/switch_screen.jpg



3). In the meantime the Developer decided the default state of the radio interfaces to be "Disabled", so you have to go to Network > Wifi and enable them manually. Please, check at the Network > Interfaces, sometimes rai0 is not bridged to the LAN.


Unfortunately, not of the yet built releases has a good Wi-Fi signal at all. The maximum distance of the Wi-Fi signal is 5m (!?!), which is completely not enough. The power of the signal with the factory firmware of the RE6500 is 10 times more than this. So, I think the reason is bad driver for the both radio chips and/or bad settings used by the Developer. I have tried to flash many releases for the other 3 routers that use same SoC, but none of them is working, including the dd-wrt releases. The factory firmware for DIR-860L B1 is saying "Unknown architecture".
So if someone is able to help with finding better drivers and fix this build, I will be so happy. If not, that is going to be a bunch of crap:

http://s10.postimg.org/ehesvchco/RE6500_crap.jpg


Here is the original Linksys U-boot boot-loader, if you decide to flash it back to factory defaults:
re6500_original_bootloader.bin
And the whole original memory dump - that is including the boot-loader and the firmware (DON'T FLASH YOU ROUTER WITH THIS!):
re6500_original_dump.bin

I have some more already flashed 16 MB SPI chips left, so if you are interested, please write me a message.

(Last edited by nikigeo on 24 Jul 2015, 10:46)

nikigeo wrote:

Now is the time to say that YOUR PINOUT IS INCORRECT. Here is the right one:

http://s1.postimg.org/rq6nq7mse/RE6500_pinout.jpg

That site appears to be...a little hostile today. Certainly hostile to hot linking. In case it goes away, here's what the photo says:

J4
▷▢   <-- +3.3V
   ◯   <-- GND
   ◯   <-- TX
   ◯   <-- RX

It is the top side of the board. To the left of J4 is the heatsink. To the right of J4 are a couple of SMD caps and a 0 ohm resistor.

I'm going to try reflashing this RE6500 via the bootloader. Wish me luck!

I just figured out how to apply the bootloader password.

Boot without reset held down. Watch the console for U-Boot, and in particular, this line:

relocate_code Pointer at: 83f20000

Now press and hold reset, and type

1234567890 RET 4 RET

You have to type that 4 really fast. This is what you get:

dcache: sets:256, ways:4, linesz:32 ,total:32768

 ##### The CPU freq = 880 MHZ ####
 estimate memory size =64 Mbytes
Reset switch block
#Reset_MT7530

Please choose the operation:
   1: Load system code to SDRAM via TFTP.
   2: Load system code then write to Flash via TFTP.
   3: Boot system code via Flash (default).
   4: Entr boot command line interface.
   7: Load Boot Loader code then write to Flash via Serial.
   9: Load Boot Loader code then write to Flash via TFTP.

You choosed 3
                                                                              1
You choosed 4
                                                                              0


4: System Enter Boot Command Line Interface.

U-Boot 1.1.3 (Apr 21 2014 - 19:50:29)
MT7621 #
M.Bastian wrote:

After some more tests and finally a look in the Linksys U-Boot source, which I should had done first. The RE6500 tries to get a "um_factory_fw.bin" file via tftp from 192.168.1.100. Unfortunately it does not seem to work with the OpenWrt sysupgrade image.  All I got so far is an unresponsive router(activity led is off) until the next power cycle.

A long overdue update: Simply compile a initramfs image and copy it as "um_factory_fw.bin" into a properly configured tftp server. Sorry, I have no time to update the Wiki page, only for a quick and dirty braindump:

Get the CC Sources
Configure with: Target System (Ralink RT288x/RT3xxx),  Subtarget (MT7621 based boards),  Target Profile (Linksys RE6500),  Target Images ([\*] ramdisk)
Compile and copy: cp  <PATH_TO_OPENWRT_SRC>/bin/ramips/openwrt-ramips-mt7621-re6500-initramfs-kernel.bin <PATH_TO_TFTPBOOT_DIR>/um_factory_fw.bin
Boot your RE6500, wait, telnet to 192.168.1.1, set a password to enable ssh/scp. Copy a sysupgrade image to 192.168.1.1:/tmp and do a sysupgrade on the console. Enjoy.
IMPORTANT: Due to a faulty default config do NOT use Port 1 on the RE6500 or you won't be able to login after the tftp boot.
Btw.: The original firmware image will also boot over tftp.

(Last edited by M.Bastian on 17 Jan 2016, 16:41)

Is there anyone who could help me with the factory original bootloader file? I flashed my RE6500 with a wrong bootloader and got it bricked. The link in this post seems already expired. Any help is appreciated.

Going to try to duplicate this on the re6400. Steep learning curve... Anyone help me decipher the build instructions below?

(Last edited by purduephotog on 5 Jun 2017, 17:07)

The discussion might have continued from here.