Linksys EA9500 V1

The Linksys EA9500 is a Broadcom BCM4709C0 (1.4 GHz, 2 cores) MU-MIMO Tri-Band WiFi router, which has one 2.4GHz and two 5GHz WiFi Interfaces, making it an interesting choice for wireless backhaul or repeater applications. The radios support MCS 0-9 (up through 1024 QAM) for devices and paths that are compatible with those high-density modulations.

Note: The first 5 GHz radio (BCM4366) is default limited to ch. 48 and below. The second 5 GHz radio (the other BCM4366) is default limited between ch. 100 and 140.

It has eight 1G LAN ports, one 1G WAN port, both USB 3.0 and USB 2.0 interfaces and eight external antennas.

It is powered by an external 12V, 5A power adapter.

An experimental build is available, based on OpenWRT master of 10/08/2021, using the latest Broadcom driver (vs 10.10.122.301).

 cat /proc/mtd:
 dev: size erasesize name
 mtd0: 00080000 00020000 "boot"
 mtd1: 00180000 00020000 "nvram"
 mtd2: 01d00000 00020000 "linux"
 mtd3: 01ad2504 00020000 "rootfs"
 mtd4: 03300000 00020000 "linux2"
 mtd5: 030d245c 00020000 "rootfs2"
 mtd6: 02e00000 00020000 "brcmnand"

First flash this from Linksys UI: https://www.dropbox.com/s/tff1c9yomamsgh0/openwrt-EA9500-Non-US-20201219.zip?dl=0 (maintained by @npcomplete13)

Once in OpenWrt, flash to both partitions using these instructions:

• Download a Full Build version:
• Copy the file “openwrt-bcm53xx-generic-linksys_ea9500-squashfs.trx” onto a flash drive and plug it into the router. Alternatively, you can `scp` it to the router `/tmp/` folder, with WinSCP or through `scp` linux command.
• Open an SSH session into your router, using Putty software (e.g.) @ 192.168.1.1
• Mount the USB drive using: (not applicable if you'd use `scp` to transfer the firmware into the router)

  mount /dev/sda1 /mnt/

• Locate the file name using

  ls /mnt/

• Assuming “openwrt-bcm53xx-generic-linksys_ea9500-squashfs.trx” is the file name, flash using below commands.

  mtd write /mnt/openwrt-bcm53xx-generic-linksys_ea9500-squashfs.trx firmware
  mtd write /mnt/openwrt-bcm53xx-generic-linksys_ea9500-squashfs.trx failsafe
  nvram set bootpartition=0 && nvram set partialboots=0 && nvram commit

• Reboot to make sure you have openwrt.

Linksys secure-signs the firmware for this router, hence it is not possible to install using Factory UI. So, this router requires a serial cable connected to the router.

On boot, interrupt the boot by Ctrl+C and enter CFE prompt. Make sure tftp server is running. Download tftpd sever from here 562. Detailed instructions here 1.4k. Disassembly instructions here 890

From CFE prompt execute following. Where 192.168.1.10 is where your tftp server is running.

  flash -noheader 192.168.1.10:/openwrt.trx nflash0.trx

Also you may want to reset partial boots and boot partition using

  nvram set bootpartition=0 && nvram set partialboots=0 && nvram commit

NOTE: This router has two copies of firmware. The router switches between one or the other after three consecutive partial boots. You can force a partial boot by turning off router 10 seconds after booting. Once you have installed Openwrt on one partition, leave the second partition on Factory firmware.Tthis way you can dual boot into Openwrt or Factory.

• Open an SSH session into you router (@192.168.1.1):

  cd /tmp/
  wget https://downloads.openwrt.org/snapshots/targets/bcm53xx/generic/openwrt-bcm53xx-generic-linksys_ea9500-squashfs.trx
  mtd write openwrt-bcm53xx-generic-linksys_ea9500-squashfs.trx firmware
  nvram set partialboots=0 && nvram commit

• Reboot to make sure you have openwrt.

• Download the *.trx file from the firmware selector page
• Browse to http://192.168.1.1/cgi-bin/luci/mini/system/upgrade/ LuCI Upgrade URL
• Upload image file (*.trx) to LuCI
• Wait for reboot

→ generic.debrick

The EA9500 is a dual firmware device. meaning that there are 2 firmware partitions and Linksys firmware is copied to both partitions at the factory. When you install/update the Linksys firmware, or install/update OpenWrt, the new firmware is always written to the other partition. Upon restarting the EA9500, it will subsequently try to boot from the newly installed firmware image from other partition.

If the device fails to boot after install or upgrade:

1. Switch On and wait 15 seconds
2. Switch Off and wait 10 seconds
3. Repeat steps 1 and 2, three times, then go to 4.
4. U-boot will switch automatically to the previous working firmware. You should be able to access your router on LAN, after some minutes to fully complete the boot process.

Although being a manual procedure, the above method can be used to toggle between the two firmwares on demand.

Warning: If you install/update OpenWrt more than once, both partitions will be overwritten with OpenWrt firmwares, and you won't be able to revert back to Linksys OEM firmware using above method.

→ Basic configuration After flashing, proceed with this.
Set up your Internet connection, configure wireless, configure USB port, etc.

                                    CPU
                             ┌───────────────┐  
                             │ CORE0 │ CORE1 │ 
                             └───┼────┼─┼────┘
                                 │    │ │
                                 └─┐ ┌┘┌┘
                        ┌──────────┼─┼─┼─┐
                        │0 1 2 3 4 5 7 8*│ BCM53012
                        └┼─┼─┼─┼─┼───────┘
                         │ │ │ │ └───────────────────────┐
                         │ │ │ └──────────────────┐      │
          ┌──────────────┼┐│ └───────────────┐    │      │
BCM53125  │0 1 2 3 4 5 7 8│└───────────┐     │    │      │
          └┼─┼─┼─┼─┼──────┘            │     │    │      │
           │ │ │ │ └────────────┐      │     │    │      │
        ┌──┘ │ │ └────────┐     │      │     │    │      │         CPU0    CPU0   CPU1
        │    │ └────┐     │     │      │     │    │      │           │      │      │
        │    └┐     │     │     │      │     │    │      │           │      │      │
     ┌──┼─────┼─────┼─────┼─────┼──────┼─────┼────┼──────┼──┐   ┌────┼──────┼──────┼────┐
     │ Lan1  Lan5  Lan2  Lan6  Lan3  Lan7  Lan4  Lan8 │ Wan │   │ Wlan0 │ Wlan1 │ Wlan2 │
     └──────────────────────────────────────────────────────┘   └───────────────────────┘

The default network configuration is:

→ hardware.button on howto use and configure the hardware button(s). Here, we merely name the buttons, so we can use them in the above Howto.

Front:
Insert photo of front of the casing

Back:
Insert photo of back of the casing

Backside label:
Insert photo of backside label

Note: This will void your warranty!

Main PCB:
Insert photo of PCB

How to connect to the Serial Port of this specific device:

• Black cable -- GND (leave unpluged until the router is powered up)
• Green cable -- TXD
• White cable -- RXD

Note that connecting a serial cable before powering on the EA9500 may occasionally hang the bootloader. If you find that this happens to you, leave the Ground connection floating (unconnected) until after you power on the router.

Not known

→ bootloader

None so far.

• Supporting efforts and lots of good info: https://forum.openwrt.org/t/build-for-linksys-ea9500/1817
• More hardware info: https://serialize.wordpress.com/2017/02/01/linksys-ea9500-stuff/