Linksys EA9350 V3 / MR5500 (linksys-jamaica)

From postmarketOS Wiki
Note pmOS can't run on its internal storage.However, it's possible to boot pmOS from Usb Stick .
Linksys EA9350 V3 /
MR5500
gnome running on it with USB GPU and mainline
gnome running on it with USB GPU and mainline
Manufacturer Linksys
Name EA9350 V3 /
MR5500
Codename linksys-jamaica
Released 20XX
Type router
Hardware
Chipset Qualcomm IPQ5018
CPU Dual-core Cortex-53
Storage 256MB Raw NAND
Memory 512MB
Architecture armv7
Software
Original software Linux
postmarketOS
Category testing
Pre-built images no
Features
Flashing
Broken
Internal storage
Broken
SD card
Multimedia
Camera Flash
Connectivity
WiFi
Broken
Bluetooth
Broken
Ethernet
Broken
NFC
Miscellaneous
FDE
USB-A
Partial
HDMI/DP
Sensors
Magnetometer
Ambient Light
Proximity
Hall Effect
Haptics
Barometer
Note This port is only tested on the EA9350 V3 variant. If you get it working on the MR5500 variant then please let us know. Thanks!

There are 2 variants:

  • EA9350 V3 : According to linksys , It is a isp rotuer of PCCW isp in HK.Also this port is made for EA9350 V3.
  • MR5500 : Seem to be identical to EA9350 V3 but with different bootloader.

Note that these instructions are only expected to work on the EA9350 V3 variant.

Also Linksys MX5500 (linksys-dominica) and Linksys EA9350 V3 / MR5500 (linksys-jamaica) are based on Reference Board mp03.1.dts.

Aarch64

Linksys MX5500/MX2000 are also based the ipq5018 Soc.They seem to has better bootloader then EA9350 V3.MX5500/MX2000's bootloader seem able to boot Aarch64 kernel but EA9350 V3's bootloader cant. Also MR5500 seem to be identical to EA9350 V3 but with 64 bit bootloader.

Installation

Icon WARNING: DO NOT PLUG multiple USB devices into the router during boot.

Currently, only installing pmOS to a USB drive is supported.

Use pmbootstrap to build your own image, like so:

$ pmbootstrap init
$ pmbootstrap install --sdcard=/dev/sdX # change 'sdX' with the path of your USB drive

After creating your pmOS image, connect to your device via UART.

Next, intercept U-Boot when it's booting. You should get a shell.

Note U-Boot will run commands that are saved in the bootcmd environment variable. By default bootcmd contains commands to load the stock os.

Run these commands to modify the default boot behavior for making pmOS automatically boot when the device is powered on and a pmOS USB stick is plugged in:

IPQ5018# setenv bootstockos "${bootcmd}"
IPQ5018# setenv bootcmd "usb start;fatload usb 0 ${loadaddr} boot-image.itb;bootm ${loadaddr};run bootstockos"
IPQ5018# saveenv

Run the following commands to reboot after you have modified the default boot behavior:

IPQ5018# reset

You can still boot into the stock firmware by unplugging the pmOS USB stick even after you have modified the default boot behavior or you can manually boot pmOS if you don't want to modify the default boot behavior.

Run these commands to manually boot pmOS:

IPQ5018# usb start
IPQ5018# fatload usb 0 ${loadaddr} boot-image.itb
IPQ5018# bootm ${loadaddr}

Functionality

UART

You can find a UART header on the front of the PCB.

UART pin location on motherboard

Colour Pin
Purple Rx
Yellow Tx
Black GND

USB

Mainline lacks of usb3 phy driver. It currently only has usb 2 phy driver. Therefore some usb3 device dont work. However it is possible to get those device to work by plugging them via a usb 2 hub.

USB Power

GPIO pin 17 needs to be active low in order to turn USB power on. The kernel will not set the GPIO pin to active low when it boots, so there is a initramfs hook for setting that up every time pmOS boots.

How to manually turn off USB power:

# "base" (512) + 17 = 529
echo 1 >  /sys/class/gpio/gpio529/value

How to manually turn on USB power:

# "base" (512) + 17 = 529
echo 0 >  /sys/class/gpio/gpio529/value

Ethernet

Mainline lacks of ethernet driver.

Internal Storage

Mainline lacks of the driver.

WiFi

Mainline lacks of wifi driver.

LEDs

USB LED

There are a right led under the USB port.It work.

Front PWM LED

PWM LED driver currently rely on PWM driver which the Mainline lacks.Therefore,it currently configed as gpio led in the kernel thus the brightness dont work.

# Activate LED and set the brightness to 1 (Max Brightness : 1)
echo 1 > /sys/class/leds/$COLOR/brightness
# Deactivate LED
echo 0 > /sys/class/leds/$COLOR/brightness

Color :

Color LED
white:usb USB light
blue:power Power Light (blue)
green:power Power Light (red)
red:power Power Light (green)

Downstream LED Quirk

USB LED

In the downsteam kernel from linksys, the usb led is setted to active low in the device tree.It is believed to be a mistake due to setting it to active low caused the issue below.

1. Setting the brightness of the led to 0 in the kernel should turn off the led but it make led to be lighted up.

1. Setting the brightness of the led to 1 in the kernel should turn on the led but it make led to be powered off.

Front PWM LED

One of the pin of the led is setted to active low in the device tree but the PWD LED driver seem to setted it to active high.

Also it used a quirk for hardcodeing the color of the led in the kernel.

Gallery

Partition Layout

~ # cat /proc/mtd 
dev:    size   erasesize  name
mtd0: 00080000 00020000 "0:SBL1"
mtd1: 00080000 00020000 "0:MIBIB"
mtd2: 00100000 00020000 "0:QSEE"
mtd3: 00040000 00020000 "0:DEVCFG"
mtd4: 00040000 00020000 "0:CDT"
mtd5: 00080000 00020000 "0:APPSBLENV"
mtd6: 00140000 00020000 "0:APPSBL"
mtd7: 00100000 00020000 "0:ART"
mtd8: 00080000 00020000 "0:TRAINING"
mtd9: 00080000 00020000 "u_env"
mtd10: 00040000 00020000 "s_env"
mtd11: 00040000 00020000 "devinfo"
mtd12: 05200000 00020000 "kernel"
mtd13: 04a00000 00020000 "rootfs"
mtd14: 05200000 00020000 "alt_kernel"
mtd15: 04a00000 00020000 "alt_rootfs"
mtd16: 00200000 00020000 "sysdiag"
mtd17: 04400000 00020000 "syscfg"
mtd18: 04316000 0001f000 "squashfs"
mtd19: 03c8c000 0001f000 "syscfg"

Firmware Analyst

it seem the SBL firmware is based on Qualcomm_Snapdragon_410/412_(MSM8916) firmware thus it's Booting Procedure should be smaller to 410.However there are no aboot partition on this device.

~ # cat /dev/mtd0 | grep MDM
MDM9240
MDM9340
MDM9640
MDM9245
MDM9645
MDM9209
MDM9309
MDM9609
~ # cat /dev/mtd0 | grep APQ
APQ8052
APQ8053
APQ8016
APQ8036
APQ8056
APQ8076
APQ8017
APQ8037
APQ8009
APQ8039
~ # cat /dev/mtd0 | grep MSM
MSM8940
MSM8952
MSM8953
MSM8116
MSM8216
MSM8616
MSM8916
MSM8236
MSM8636
MSM8936
MSM8956
MSM8976
MSM8217
MSM8617
MSM8917
MSM8937
MSM8208
MSM8209
MSM8609
MSM8909
MSM8939
~ # cat /dev/mtd0 | grep IPQ
IPQ5000
IPQ5010
IPQ8070
IPQ8071
IPQ8072
IPQ8172
IPQ8173
IPQ8074
IPQ8174
IPQ5016
IPQ8076
IPQ5018
IPQ0518
IPQ5028
IPQ8078
IPQ0509
IPQ8070A
IPQ8071A
IPQ8072A
IPQ8074A
IPQ8076A
IPQ8078A
~ # 

Secure Boot

The stock uboot has is_sec_boot_enabled command which seem to for checking secure boot is enabled or not.

IPQ5018# is_sec_boot_enabled
secure boot fuse is not enabled

According to that , EA9350 V3 secure boot is off thus it is possible to replace the stock bootloader by flashing unsigned bootloader/SBL that support aarch64 to it.

Maintainer

  • exkc(Hacking their Navigator(PCCW) isp router...)

Users owning this device

See Also

GPL Code Center

GPL Code Of linksys-jamaica (Archived)

MR5500 on dd wiki

EA9350 V3 FAQ