Thanks for documenting this process in detail in your GitHub page.
If someone can try & confirm in practice using sshel.inf.ua/mr9000/22.03.5 factory.bin as Intermediate firmware + changing kernsize in bootloader afterwards, I can update the OpenWrt wiki page basically by copying most of the content in MR6350 wiki over there to MR9000 wiki , as the flashing method is basically the same.
reka
May 26, 2026, 6:49am
126
Thank you for documenting your findings, but this one:
xeXistenZx:
EA8300 firmware fails due to QCA8075 vs QCA8072 switch chip difference and wrong Device Tree — this is why every version (22.x, 23.x, 24.x, 25.x) shows identical stuck behaviour
is wrong. Have a look at e.g. the FCC internal photos of the EA8300 and the MR9000, both use the QCA8075 (which is not a switch by the way but a 5-port transceiver). This makes sense because for a 5-port device like the EA8300 you wouldn't get far with a 2-port transceiver.
The reason why the MR9000 doesn't boot the EA8300 firmware is that the latter's dts-file does not define a reset for the QCA8075. For the EA8300 it works without a reset, but apparently the MR9000's bootloader pre-initializes the QCA8075 in some way which is incompatible with OpenWRT. Without a defined reset the MR9000 gets stuck when trying to initialize the transceiver.
opnwr
June 2, 2026, 6:43pm
127
@sshel OpenWrt 25.12.4 is released. Could you please upload the same for MR9000?@robimarko when can we expect the pending PR to be merged?
main ← RolandoMagico:MR9000
opened 02:44PM - 02 Apr 26 UTC
This pull request is based on
- the discussions in https://forum.openwrt.org/t/… support-for-the-linksys-mr9000
Device Specs:
- Router is similar to EA8300 but with 512MB RAM and changed GPIOs
- IPQ4019
- Quad Core CPU
- 512 MB RAM
- 256 MB FLASH
- 4 LAN ports, 1 WAN port
- 1x2.4GHz (802.11n) and 2x5GHz (802.11c) wifi
- 3 LEDs (Red, blue, green) which are routed to one indicator at the top of the case
- 2 buttons (Reset, WPS)
Disassembling the device:
- There are 4 T10 screws at the bottom of the device which must be removed
- All 4 screws are located under the rubber feet
Serial interface:
- The serial interface is already populated on the device with a 5-pin header
- Pinout from front to back: 1:GND, 2: unknown, 3: RX, 4: TX, 5: VCC
- Settings: 115200, 8N1
MAC address layout:
- Same as on MR8300
- MAC address is stored in the "devinfo" partition (entry "hw_mac_addr")
- The MAC address on the label is identical with the one in the devinfo partition
- The MAC address on the label is the WAN MAC address
- LAN MAC address is the one from the label + 1
- Wifi (2.4GHz) MAC is the one from the label + 2
- Wifi (1st 5GHz) MAC is the one from the label + 3
- Wifi (2nd 5GHz) MAC is the one from the label + 4
Migrating to OpenWrt requires multiple steps:
- Load and boot the initramfs image
- Adapt U-Boot settings to support bigger kernels
- Flash the sysupgrade image
Load and boot initramfs:
- Connect serial interface
- Set up a TFTP server on IP 192.168.1.254
- Copy openwrt-ipq40xx-generic-linksys_mr9000-initramfs-zImage.itb to TFTP server
- Rename file to C0A80101.img
- Boot up the device and stop in U-Boot
- Run the following U-Boot commands after a link has been established:
tftp
bootm
- Initramfs image is started now.
Adapt U-Boot settings to support bigger kernels:
- Run "fw_printenv" in the initramfs image after booting
- There should be an entry kernsize=300000 which indicates the maximum size for the kernel is 3MB
- Execute "fw_setenv kernsize 500000" to increase the max kernel size to 5MB
- Check that the change are applied with "fw_printenv"
Flash the sysupgrade image:
- Default sysupgrade routine either with a initramfs image containing LuCI or via command line.
Revert back to OEM firmware:
- Flash the OEM firmware via sysupgrade
- Forced update is required
Thanks for pinging me, its been merged
The great news is that the official firmware is finally coming soon.
I also created a PR to get the device supported in the next 25.12 release:
openwrt-25.12 ← RolandoMagico:openwrt-25.12-MR9000
opened 05:11AM - 05 Jun 26 UTC
This pull request is based on
- the discussions in https://forum.openwrt.org/t/… support-for-the-linksys-mr9000
Device Specs:
- Router is similar to EA8300 but with 512MB RAM and changed GPIOs
- IPQ4019
- Quad Core CPU
- 512 MB RAM
- 256 MB FLASH
- 4 LAN ports, 1 WAN port
- 1x2.4GHz (802.11n) and 2x5GHz (802.11c) wifi
- 3 LEDs (Red, blue, green) which are routed to one indicator at the top of the case
- 2 buttons (Reset, WPS)
Disassembling the device:
- There are 4 T10 screws at the bottom of the device which must be removed
- All 4 screws are located under the rubber feet
Serial interface:
- The serial interface is already populated on the device with a 5-pin header
- Pinout from front to back: 1:GND, 2: unknown, 3: RX, 4: TX, 5: VCC
- Settings: 115200, 8N1
MAC address layout:
- Same as on MR8300
- MAC address is stored in the "devinfo" partition (entry "hw_mac_addr")
- The MAC address on the label is identical with the one in the devinfo partition
- The MAC address on the label is the WAN MAC address
- LAN MAC address is the one from the label + 1
- Wifi (2.4GHz) MAC is the one from the label + 2
- Wifi (1st 5GHz) MAC is the one from the label + 3
- Wifi (2nd 5GHz) MAC is the one from the label + 4
Migrating to OpenWrt requires multiple steps:
- Load and boot the initramfs image
- Adapt U-Boot settings to support bigger kernels
- Flash the sysupgrade image
Load and boot initramfs:
- Connect serial interface
- Set up a TFTP server on IP 192.168.1.254
- Copy openwrt-ipq40xx-generic-linksys_mr9000-initramfs-zImage.itb to TFTP server
- Rename file to C0A80101.img
- Boot up the device and stop in U-Boot
- Run the following U-Boot commands after a link has been established:
tftp
bootm
- Initramfs image is started now.
Adapt U-Boot settings to support bigger kernels:
- Run "fw_printenv" in the initramfs image after booting
- There should be an entry kernsize=300000 which indicates the maximum size for the kernel is 3MB
- Execute "fw_setenv kernsize 500000" to increase the max kernel size to 5MB
- Check that the change are applied with "fw_printenv"
Flash the sysupgrade image:
- Default sysupgrade routine either with a initramfs image containing LuCI or via command line.
Revert back to OEM firmware:
- Flash the OEM firmware via sysupgrade
- Forced update is required
Main Snapshot nightly build can now be downloaded for Linksys MR9000.
Make sure to read the Device Page and modify kernsize in bootloader before flashing factory snapshot image.
Now we just need to wait for the 25.12 PR by @RolandoMagico to be merged.
At least 6 approving reviews are required by reviewers with write access.
