Linksys EA3500 / EA4500: Tricks, How-to's, Issues

I've been playing with EA3500/EA4500's for 2~3 years. Just like to share my discoveries, progressively, with those who still find them adorable :smile:. They are one of most flash-friendly routers, with 2 boot partitions and USB booting capability. The 2+multiple booting allows users to play all sorts of tricks. Really hard to brick it and easy to test new code/settings. Feel free to add your tricks or issues and comment on mine.

How-to's

  1. How to boot EA4500 from a USB drive: Dual+Multi Booting EA4500
  2. How to enable USB booting on EA3500
  3. Restore Linksys Stock Firmware on EA3500

Issues

  1. Linksys EA3500/EA4500 suffers endless reboots: Radio1 (5GHz) crashes in mac80211
  2. hostapd: WPA: group key handshake failed (RSN) after 4 tries, wlan1: AP-STA-DISCONNTED
  3. Can't install (initial flash) LEDE 17.01.x or OpenWRT 18.06.x on Linksys EA3500
  4. 5 GHz radio drops/refuses connections after Scan on EA3500

Here is a step-by-step instruction for Linksys EA4500, making it a triple boot device:

  1. Linksys stock firmware
  2. Stable OpenWRT release
  3. Latest and greatest snapshot, and more snapshots to your heart's desire

Prepare a bootable USB drive on your favorite Linux machine. I did it in Ubuntu 18.04:

Downloads$ wget https://downloads.openwrt.org/snapshots/targets/kirkwood/generic/openwrt-kirkwood-linksys_viper-squashfs-sysupgrade.bin
Downloads$ tar -xf openwrt-kirkwood-linksys_viper-squashfs-sysupgrade.bin && cd sysupgrade-linksys-viper
sysupgrade-linksys-viper$ sudo mke2fs -t ext2 -L ea4500 /dev/sdb1
sysupgrade-linksys-viper$ udisksctl mount --block-device /dev/disk/by-label/ea4500
sysupgrade-linksys-viper$ sudo sh -c "mkdir /media/$USER/ea4500/boot; cp -p kernel /media/$USER/ea4500/boot/; chown root.root /media/$USER/ea4500/boot/kernel"
sysupgrade-linksys-viper$ sudo unsquashfs -f -d /media/$USER/ea4500/ root
sysupgrade-linksys-viper$ udisksctl unmount --block-device /dev/disk/by-label/ea4500

Enable USB Booting
Once OpenWRT is flashed via Linksys Web UI, carefully enable the U-Boot to boot from the USB drive if present. For EA4500, make sure a few U-Boot variables are set as follows:

root@OpenWrt:~# fw_printenv loadaddr
loadaddr=0x02000000
root@OpenWrt:~# fw_printenv console
console=console=ttyS0,115200
root@OpenWrt:~# fw_printenv mtdparts
mtdparts=mtdparts=nand_mtd:512k(uboot)ro,128k@512k(u_env),128k@640k(s_env),26m@2m(kernel),26m@2m(rootfs)fs,26m@28m(alt_kernel),26m@28m(alt_rootfs)fs,74m@54m(syscfg)
root@OpenWrt:~# fw_printenv usb_fs_bootargs_root
usb_fs_bootargs_root=root=/dev/sda1 rw rootfstype=ext2
root@OpenWrt:~# fw_printenv nandboot
nandboot=nand read.e 0x2000000 0x200000 0x300000; setenv bootargs $(console) $(mtdparts) $(fs_bootargs_root) serial_number=$(sn) uuid=$(uuid) hw_version=$(hw) device_mac=$(mac) factory_date=$(date) wps_pin=$(wps); bootm 0x2000000;
root@OpenWrt:~# fw_printenv altnandboot
altnandboot=nand read.e 0x2000000 0x1c00000 0x300000; setenv bootargs $(console) $(mtdparts) $(alt_fs_bootargs_root) serial_number=$(sn) uuid=$(uuid) hw_version=$(hw) device_mac=$(mac) factory_date=$(date) wps_pin=$(wps); bootm 0x2000000;

Then, add or change the following U-Boot variables:

root@OpenWrt:~# cat << EOF > /tmp/env.vars
nandboot         run openwrt_usb_boot; $(fw_printenv -n nandboot)
altnandboot      run openwrt_usb_boot; $(fw_printenv -n altnandboot)
openwrt_usb_boot usb start; mw \${loadaddr} 0 8; ext2load usb 0:1 \${loadaddr} /boot/kernel; setenv bootargs \${console} \${mtdparts} \${usb_fs_bootargs_root} rootdelay=10; bootm \${loadaddr}; usb stop
bootcmd          run nandboot
EOF
root@OpenWrt:~# fw_setenv -s /tmp/env.vars

Switch Boot Partitions

  • Plugging in a bootable USB boots from the USB drive. Otherwise...
  • fw_setenv boot_part 1 runs nandboot, boots the 1st partition
  • fw_setenv boot_part 2 runs altnandboot, boots the 2nd

Notes

  1. The bootcmd is actually a non-factor for EA4500 because the auto recovery scheme sets it to run nandboot and altnandboot on the fly, depending a few variables . One of them is a count of failed boots and this
root@OpenWrt:~# fw_printenv boot_part
boot_part=1
  1. If a USB hub is used, the bootable drive has to be plugged in as the first device.

A step-by-step instruction for Linksys EA3500, making it a triple boot device:

  1. Linksys stock firmware
  2. Stable OpenWRT release
  3. Latest and greatest snapshot, and more snapshots to your heart's desire

Prepare a bootable USB drive on your favorite Linux machine. I did it in Ubuntu 18.04:

Downloads$ wget https://downloads.openwrt.org/snapshots/targets/kirkwood/generic/openwrt-kirkwood-linksys_audi-squashfs-sysupgrade.bin
Downloads$ tar -xfopenwrt-kirkwood-linksys_audi-squashfs-sysupgrade.bin && cd sysupgrade-linksys-audi
sysupgrade-linksys-audi$ sudo mke2fs -t ext2 -L ea3500 /dev/sdb1
sysupgrade-linksys-audi$ udisksctl mount --block-device /dev/disk/by-label/ea3500
sysupgrade-linksys-audi$ sudo sh -c "mkdir /media/$USER/ea3500/boot; cp -p kernel /media/$USER/ea3500/boot/; chown root.root /media/$USER/ea3500/boot/kernel"
sysupgrade-linksys-audi$ sudo unsquashfs -f -d /media/$USER/ea3500/ root
sysupgrade-linksys-audi$ udisksctl unmount --block-device /dev/disk/by-label/ea3500

Enable USB Booting
Once OpenWRT is flashed via Linksys Web UI (see note 3 below), carefully enable the U-Boot to boot from the USB drive if present. For EA3500, make sure a few U-Boot variables are set as follows:

root@OpenWrt:~# fw_printenv loadaddr
loadaddr=0x02000000
root@OpenWrt:~# fw_printenv console
console=console=ttyS0,115200
root@OpenWrt:~# fw_printenv mtdparts
mtdparts=mtdparts=nand_mtd:512k(uboot)ro,128k@512k(u_env),128k@640k(s_env),26m@2m(kernel),26m@2m(rootfs)fs,26m@28m(alt_kernel),26m@28m(alt_rootfs)fs,74m@54m(syscfg)
root@OpenWrt:~# fw_printenv usb_fs_bootargs_root
usb_fs_bootargs_root=root=/dev/sda1 rw rootfstype=ext2
root@OpenWrt:~# fw_printenv nandboot
nandboot=nand read.e 0x2000000 0x200000 0x300000; setenv bootargs $(console) $(mtdparts) $(fs_bootargs_root) serial_number=$(sn) uuid=$(uuid) hw_version=$(hw) device_mac=$(mac) factory_date=$(date) wps_pin=$(wps); bootm 0x2000000;
root@OpenWrt:~# fw_printenv altnandboot
altnandboot=nand read.e 0x2000000 0x1c00000 0x300000; setenv bootargs $(console) $(mtdparts) $(alt_fs_bootargs_root) serial_number=$(sn) uuid=$(uuid) hw_version=$(hw) device_mac=$(mac) factory_date=$(date) wps_pin=$(wps); bootm 0x2000000;

Then, add or change the following U-Boot variables:

root@OpenWrt:~# cat << EOF > /tmp/env.vars
nandboot         run openwrt_usb_boot; $(fw_printenv -n nandboot)
altnandboot      run openwrt_usb_boot; $(fw_printenv -n altnandboot)
openwrt_usb_boot usb start; mw \${loadaddr} 0 8; ext2load usb 0:1 \${loadaddr} /boot/kernel; setenv bootargs \${console} \${mtdparts} \${usb_fs_bootargs_root} rootdelay=10; bootm \${loadaddr}; usb stop
bootcmd          run nandboot
EOF
root@OpenWrt:~# fw_setenv -s /tmp/env.vars

Switch Boot Partitions

  • Plugging in a bootable USB boots from the USB drive. Otherwise...
  • fw_setenv boot_part 1 runs nandboot, boots the 1st partition
  • fw_setenv boot_part 2 runs altnandboot, boots the 2nd

Notes

  1. The bootcmd is actually a non-factor for EA3500 because the auto recovery scheme sets it to run nandboot and altnandboot on the fly, depending a few variables . One of them is a count of failed boots and this
root@OpenWrt:~# fw_printenv boot_part
boot_part=1
  1. If a USB hub is used, the bootable drive has to be plugged in as the first device
  2. Need a right OpenWRT EA3500 image to successfully flash via Linksys Web UI

To Restore Linksys Stock Firmware on EA3500, boot OpenWrt/LEDE 17.01.4, r3560-79f57e422d from a USB flash drive. Choose the partition to be flashed:

root@LEDE:~# fw_printenv boot_part
boot_part=1
             ==> to flash partition 2
root@OpenWrt:~# fw_setenv boot_part 2
             ==> to flash partition 1

root@LEDE:~# sha256sum /tmp/FW_EA3500_1.1.40.162464_prod.SSA
06106e63e6a4ddc339a9eab0e3ff8aa9ee1795f590250ed7ca769d73d377bcdb  /tmp/FW_EA3500_1.1.40.162464_prod.SSA

sysupgrade does the rest

root@LEDE:~# fw_printenv boot_part
boot_part=2
root@LEDE:~# sysupgrade -i -n -v /tmp/FW_EA3500_1.1.40.162464_prod.SSA
Image metadata not found
Keep config files over reflash (y/N):
Sending TERM to remaining processes ... ubusd askfirst logd rpcd netifd odhcpd uhttpd ntpd dnsmasq
Sending KILL to remaining processes ... askfirst
Switching to ramdisk...
Performing system upgrade...
Unlocking kernel1 ...

Writing from <stdin> to kernel1 ...  [e]
Skipping bad block at 0x00a7c00
Upgrade completed
Reboot (Y/n):
Rebooting system...

Although I haven't been able to narrow down the source of it, another issue with 5 GHz radio happened several times to me on EA3500: After performing a Scan in the Wireless page of LuCI Web Interface, the 5 GHz ssid drops/refuses connections. I have to restart the radio with the command wifi up.

OpenWRT Version: Snapshot r9614-b614954: 2018-12-18, c2c8244d.

Has anyone noticed the same behavior or not? Which version?

Hello all,

I'm have one Linksys EA 6200 and a like install OpenWRT im may #2 router, tody is set im Bridge mote and stock FW w one WRT3200 w last vs o DavidC502 openwrt and work fine.
is possible install any copy openwrt and mek my EA6200 a power and rock router? what is a besta vs o opens wrt i need donwload and install?

thaks for any help, and pleas, sorry my poor inglish,

guedes

@gu3d3s Please stick to the topic (EA3500/EA4500).
EA6200 is a completely different animal than EA3500/4500.

For questions regarding EA6200 please open a new topic.

1 Like

HI,

perfect, and sorry for i'm post in wrong place,

Hi all,
I'm trying to install OpenWRT 18.06.5 on my stock firmware of an EA3500. I have uploaded via the Firmware upload tool the current stable release "openwrt-18.06.5-kirkwood-linksys_audi-squashfs-factory.bin". After restart nothing happened. I counted three series of rapid blinking of the power LED, then the stock firmware starts back. I was trying also to get connect via ssh at root@192.168.1.1 but I receive just Connection time out. I guess my router is booting from the backup partition which contains the stock firmware.

In order to access my EA3500 I connected it to one of the WRT54GL which runs on a DDWRT firmware.

Please give me some hints or point me a topic where I can find more details about flashing an openWRT firmware on EA3500.
thanks

I no longer have my ea3500 and i don't normally advise using images just found off the web, but the ea3500 has had problems flashing from stock for quite a while and the last time i was able to do so was using the image i found at this site, so if you'd like to try it, download the factory.bin file from the site owners google drive and if it works, i'd suggest getting the sysupgrade file directly from OpenWrt and flashing it twice so both partitions have the official OpenWrt image on them, i doubt there's anything wrong with the image from that site, but better safe than sorry.

Thanks mike. I did it. I have now OpenWRT 18.06.5 on my EA3500 router. I'm not sure yet if I have both partitions with OpenWRT. I flashed one time 17.01.4 then one time 18.06.5.

You do, right now you have 17.01.4 on one partition and 18.06.5 on the other, so you'll need to flash 18.06.5 once more to have it on both partitions (when you flash from partition 1 it writes to partition 2 and vice versa).

Hello,I have the EA3500 and Im trying to use it as a repeater, on the 2Ghz Client + AP works fine, however when I try to do it on the 5Ghz it crashes or stops responding until it reverts, separately either AP or Client works fine, however when I try to use both is when I run into this issue.

another thing I noticed is after a clean install / reset I am able to run the 5Ghz Client + AP mode fine until I try to reboot, both will show enabled but it doesnt connect to the main router or advertise the AP.

I am running the latest openwrt 18.06.5, I have also tried the current beta 19.07.0-rc2

any ideas how I can get this working?

I had the same problem on my ea3500 and never bothered to look into into it unfortunately, what i ended up doing was using relayd for the repeater function and making the 2.4ghz band the client and the 5ghz band the AP on the ea3500, it may be possible to do that with wds, but i'm not sure.

yea that's how I am currently using mine but in reverse since some of the devices I connect to it don't support 5 ghz, so I set Client for the 5Ghz and AP for 2 Ghz, + relayd , but still was hoping there was a way to add on a 5ghz ap ,

whats weird is it does work on first setup so maybe its a race condition or something.

OK I did some messing around and through ssh I did kill -hup (pid of hostapd) , and it seemed to fix it but I need to see if I can automate this at reboot after a slight delay

edit:
ok I kinda got it hackish now but it works, still not sure how it will handle station disconnects ....
in /etc/rc.local i added
uci set wireless.default_radio1.disabled='1' && uci commit && wifi reload
sleep 20 && uci set wireless.default_radio1.disabled='0' && wifi reload && sleep 5 && killall -HUP hostapd && uci commit

While above does works, I found I get too much interference or something with the antennas, maybe because my main router is operating on VHT80, causing this one to be HT40, even though I set it to 20mhz it seems to still connects at HT40.

I have a few 2Ghz ip cameras, and they connect to the 2ghz AP (ea3500) and they are relayd through the 5Ghz Client (ea3500) to my main router, if I ping the cameras over time the pings get worse and worse, but once I disable the 5Ghz AP (ea3500) pings are instant again, so probably some type of interference going on, maybe fine for low usage devices, but since camera send steady stream of data its no good.

I actually noticed this same problem when setting up a 2Ghz client and 2Ghz AP so I think the antenna aren't getting set correctly or just conflicting signals

[  645.676732] ieee80211 phy1: tx rings drained
[  736.707689] ieee80211 phy1: Command RF_ANTENNA error 0x2
[  736.713048] ieee80211 phy1: failed to set # of RX antennas
[  736.728061] ieee80211 phy1: Command RF_ANTENNA error 0x2
[  736.733422] ieee80211 phy1: failed to set # of TX antennas

Has someone done a writeup of the logic used by this u-boot to decide which boot command to run and any other behaviors?

I bought one thinking I'd be able to use the full flash size, so I'm looking to cannabiize one of the three partitions (probably the mfg/sysconfig one) for extra overlay space, but what I don't want to happen is some weird combination of reboots or button presses to result in u-boot "restoring" one partition over another or something else disastrous.

Much of the fw env vars seem moot... right now even if I set the bootparts to the normal content of mfg_bootparts, Openwrt still somehow sees the last two partitions as one "syscfg" partition.

I'm using 18.06.5 on my EA3500. I have the following configuration of the wireless. Why there are 4 devices/interfaces listed here? I see no difference if I disable the first 2 controllers.

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.