Joined: 18 Mar 2014 Posts: 12904 Location: Netherlands
Posted: Sun Mar 13, 2016 9:22 Post subject: Linksys EA6900 Install Guide
Although a long time DDWRT user, my first router an original WRT54GS is still functioning at my summer residence, I am an average/advanced computer user.
I purchased a Linksys EA6900 after I learned it was supported by DDWRT, and yes it is running smoothly at the moment but it took a lot of effort and time.
I have tried to summarize the Linksys EA6900 thread which is at the moment 61 pages, but there are some loose ends which are indicated in the Install Guide see, my next post.
Joined: 18 Mar 2014 Posts: 12904 Location: Netherlands
Posted: Sun Mar 13, 2016 9:34 Post subject:
Linksys EA6900 Install Guide
Note: this is for the EA6900 V1.0 and V1.1.
The V2 appears to be a Mediatek router and is not supported (yet).
The Linksys EA 6900 is a dual core Arm Cortex A9 based router clocked at 800 MHZ. Version 1.0 was introduced in 2013, version 1.1 in 2014. This Router is comparable with the likes of the ASUS RT-AC68U and sports 128 MB flash NAND and 256 MB Ram memory it has 3 external antennas for a 3x3 Wi-Fi mimo, gigabit Ethernet and a USB 3.0 port.
This router is supported by DD-WRT, but there are some caveats. This routers has a "bug" in the CFE (a CFE is comparable to the BIOS of a PC). Due to this "bug" NVRAM size cannot go over 32 KB.
Furthermore models with newer firmware, which are purchased after mid 2016, are possibly locked down and cannot be upgraded with 3rd party firmware like DDWRT.
If you have a very simple set up, NVRAM size will stay below 32 KB. There are however workarounds to beat or mitigate this bug which are described below.
If you intend to flash your router, first read the sticky threads in the forum: http://www.dd-wrt.com/phpBB2/viewforum.php?f=1 especially the Peacock thread, this gives general information how to flash etc.
For DD-wrt 1/2:
[browserofchoice] 192.168.1.1 for linksyssmartwifi.com, check both boxes.
password=admin (if it never loads one of the screens unplug router, reboot computer, plug back in)
Troubleshooting tab, diagnostics tab, restore previous firmware button
If it asks for a file, give it linksys-ea6900-webflash.bin and skip to the next paragraph
If not, hold off on clicking yes. Open two cmd prompts. In one type Ping 192.168.1.1 -t
press enter on this one to let it ping, at the end it should say ttl=64
In the other just type tftp -i 192.168.1.1 put "C:\linksys-ea6900-webflash.bin"
(linksys-ea6900-webflash.bin being the file which is used for initial flashing, see below))
Back to the router webui click yes and the router will reboot.
Wait until the 4th or 5th line of ttl=100 in the ping cmd window to press enter on the tftp cmd window
If the tftp window says success after 45s or so continue to cfe
Otherwise if ttl=64 unplug the router and replug to try to tftp again when ttl=100 in the ping window
(up arrow in the cmd window to retry old commands)
Another possible solution is to downgrade linksys firmware as reported by @Bronzemaxell at page 7 of this thread: http://www.dd-wrt.com/phpBB2/viewtopic.php?t=291230&postdays=0&postorder=asc&start=90
Timing is critical so you probably need a lot of retries but it is confirmed to work.
The linksys stock firmware for downgrading is attached to this post (FW_EA6900_1.1.42.161129_prod_DDWRT_upgrade.img). The procedure for downgrading is also covered in the attached DDWRT EA6900 Upgrade CFE instructions By Crashman and EGC.doc file
Before flashing always reset to factory defaults, do not use the 30-30-30 method for resetting or the "erase nvram" command, this can brick your router, use reset to factory defaults from the webGUI.
So Reset to factory defaults first via the Linksys webGUI and flash the initial DD WRT build from the Linksys webGUI.
As this router has a dual boot setup you should probably repeat this procedure so that both partitions have the DD-WRT firmware, otherwise the router will revert back to stock firmware if there is a lock up. (for further reading see: https://wiki.dd-wrt.com/wiki/index.php/Linksys_EA6900)
If everything works you can flash the latest build, either the builds made by BrainSlayer which can be found at: ftp://ftp.dd-wrt.com/betas/2016/, go to the latest build and search for the Linksys EA 6900, or you can use the modified builds from Kong (recommended, Kong and Brainslayer use the same repository but Kong only supports a subset of routers see: http://ddwrt-kong.clonevince.fr/Supported%20Models).
Kong’s latest builds can be found at: http://ddwrt-kong.clonevince.fr/40270/ you must use the dd-wrt.v24-K3_AC_ARM_STD.bin which is the large file at the bottom of that page.
Earlier version of Kong’s builds can be found at: http://ddwrt-kong.clonevince.fr/ thanks to CloneVince. NOTE: This section was edited since Kong's main repo no longer has any DD-WRT files since July/August 2019 -kp69
How to mitigate the 32KB bug
The first method is to try to stay under 32KB NVRAM size by disabling the services you do not need, on the services tab disable ttraf Daemon, do not use SSH (the generated key uses a lot of NVRAM, if you have to use SSH reset to factory defaults afterwards). Only keep Telnet enabled. If you do not use 5GHz disable this also.
The second method removes empty NVRAM variables. You can remove the empty NVRAM variables by telnetting into your router (the login username is always: root) and execute the following two commands:
for line in `nvram show | grep =$ `; do var=${line%*=}; nvram unset $var; done nvram commit
If you use WireGuard this can remove the WG keys as those end in =. Then use this (experimental) script:
for line in $(nvram show | grep '=$' | grep -v '=.*=' ); do var=${line%*=}; nvram unset $var; done
You can set the first line: “for line in `nvram show | grep =$ `; do var=${line%*=}; nvram unset $var; done” without the quotes in your startup script at the Administration/Commands tab so that after a reboot your NVRAM size stays low.
(If you try to run it directly from the Administration/Commands tab then you will get an error, because the special characters must then be preceded with escape characters)
The third method is flashing an alternative CFE build by XVortex with this CFE you can use more than 32 KB for your NVRAM settings. There are some drawbacks though, flashing with this CFE alters your router considerably, among other things the partition scheme is altered, resembling an Asus RT-AC68U (partition scheme can be checked with the following command from telnet: cat /proc/mtd) so you lose the dual boot setup.
You may also lose a USB 3.0 port (confirmationwanted).
There is also some controversy about the wireless MAC addresses there are reports that the wireless MAC addresses are the same for 2.4 and 5 GHZ (of course WAN and LAN have a different address). Although being the same both wireless LAN’s are reported to work, so perhaps it is not a problem (confirmation wanted, possible problems with throughput, AP isolation/Bridging, VLAN?).
By resetting with the WPS button (see below), the appropriate MAC addresses are restored and the WL0 and WL1 have different MAC addresses.
The original procedure for flashing the XVortex CFE (thanks to @Cybrnook) is no longer in operation (thanks to @wurts_leg on page 11 for pointing this out and finding alternative sources).
So attached you can find the procedure for upgrading the CFE:DDWRT EA6900 Upgrade CFE instructions By Crashman and EGC.doc
This procedure is a modification from the guide of @Crashman ( https://www.linksysinfo.org/index.php?threads/xvortex-or-advancedtomato-on-ea6900-v1-v1-1-without-32k-bug-renew.74084/ )
Stable builds
There is no such thing as a "stable" build, all builds are beta. Stability is also dependent on the configuration/settings you use, so what is rock solid for me can be unstable for you.
That said, some builds are more "stable" than others.
The last builds using linux Kernel 3 from Kong are regarded as very stable.
I have never had problems with Kong's build 29620M, so if you are looking for a "stable" build, that is the one I recommend, but 29300M is also regarded as very stable.
The first K4 build which was stable for me was Kong's 30430M.
Further builds with good mileage (all kong's builds): Kong 30465M, Kong 30700M, 30840M, 30910M (openVPN 2.3), 31160M (openVPN 2.4), 31525M, 31870M, 32170M, 33435M, 33525M, 33770M (KRACK patch), 34320 (reset to default), 35030M, 35530M (03/25/2018), 35550M 03/28/2018
When using stock CFE with dual boot you can control which partition you want to boot from see page 9 of this thread.
For best wireless throughput you have to use the following security settings: WPA2 personal with AES encryption.
Recovery procedure
If you have the Xvortex CFE and everything fails you can try to recover your router with the ASUS recovery tool: http://dlcdnet.asus.com/pub/ASUS/wireless/RT-AC3200/Rescue_2000.zip?_ga=1.34867747.34011434.1452269489. Basically this is a TFTP based method.
To recover:
1. Unplug the wireless router from the power source.
2. Hold the Reset button at the rear panel and simultaneously replug the wireless router into the power source. Release the Reset button when the Power LED at the front panel flashes slowly, which indicates that the wireless router is in the rescue mode.
3. Set a static IP on your computer and use the following to set up your TCP/IP settings:
IP address: 192.168.1.x
Subnet mask: 255.255.255.0
4. Execute Rescue.exe from the download
5. Specify a firmware file, then click Upload
Would be nice to remove the logic where DD-WRT is built to look for that 2nd partition on the stock CFE (XVortex CFE only has one partition, hence why it's failing). Then we could flash directly from GUI.
Posted: Tue Mar 29, 2016 12:20 Post subject: bricked router
I used the guide you linked for installing a new firmware on the EA6900. Unfortunately his instructions on editing the cfe file wasn't quite as clear as yours so the 2 additional mac addresses weren't right. Now when I reboot my router it goes to the linksys screen but I can't log in. After entering admin for the password it just spins forever. If I try to go to recovery mode then I can't log in using the web interface or asus program. Is there any way to recover from this?
Joined: 18 Mar 2014 Posts: 12904 Location: Netherlands
Posted: Tue Mar 29, 2016 13:05 Post subject:
First try to reset to default:
Set PC to 192.168.1.5
Power off
Hold blue wps button
Power on
Release WPS button when the linksys light starts flashing
Open webbrowser and go to 192.168.1.1, set default name and password and log in
If that does not work do the following
Set PC to 192.168.1.5
Power off
Hold the red reset button
Power on
Release reset button when the linksys light starts flashing
Open webbrowser and go to 192.168.1.1 now you should see the mini CFE webserver, here you can upload a new firmware or reset to default
First try to reset to default:
Set PC to 192.168.1.5
Power off
Hold blue wps button
Power on
Release WPS button when the linksys light starts flashing
Open webbrowser and go to 192.168.1.1, set default name and password and log in
If that does not work do the following
Set PC to 192.168.1.5
Power off
Hold the red reset button
Power on
Release reset button when the linksys light starts flashing
Open webbrowser and go to 192.168.1.1 now you should see the mini CFE webserver, here you can upload a new firmware or reset to default
Holding the blue button gives me the linksys set up screen. If I click manual setup after entering the admin password it just sits there and never logs in.
Holding the red button gives me the slow flash for recovery mode but I can't log in to the CFE browser, trying to go to 192.168.1.1 just gives me a dead link page.
I have tried using telnet and the Asus recovery program. The only way I can get any activity is just shutting it off or holding the blue button but that give me the linksys that won't log in completely.
Nope I just flashed it once. I got to the point where the guide says you can stop here if you want to keep dd-wrt. When I restarted my router I got the linksys. I know the 2 mac addresses were wrong in the CFE because I never changed them, I just changed the top mac address.
I went through the recovery stuff on the peacock post. If I red button reset it I get ttl=100, if I blue button reset it I get ttl=64 when I ping it. I have tried using teh tftp program to reflash it using both resets but it's not working. I am not sure what firmware I should use to flash it.
Joined: 18 Mar 2014 Posts: 12904 Location: Netherlands
Posted: Wed Mar 30, 2016 7:57 Post subject:
Before flashing the Xvortex CFE you had to install the initial DDWRT firmware as described in the guide (you should have done this twice because there is a dual boot partition)
This is the firmware you should try to flash now via TFTP
Before flashing the Xvortex CFE you had to install the initial DDWRT firmware as described in the guide (you should have done this twice because there is a dual boot partition)
This is the firmware you should try to flash now via TFTP
That was part of the problem, the guide didn't say anything about having to flash it twice. I would have done that but when I try to log in to the linksys again it locks up. I am assuming it's because I screwed up the mac addresses in the CFE. I ended up getting Xvortex flashed on it with tftp32 and it is at least booting up now. I haven't played with it much but what I have seen I don't really care for. It will be a dust collector on a shelf. I was just trying to get it running better as a backup for our failing router while I wait on a backordered Ubiquiti USG.
Joined: 18 Mar 2014 Posts: 12904 Location: Netherlands
Posted: Wed Mar 30, 2016 13:18 Post subject:
OK if you can telnet into your router then flash the intital DDWRT firmware and do this twice
After that flash with the modified Xvortex CFE but now with the right MAC adresses
Then flash the latest DDWRT build (I use the modified KONG builds)
After that you should be good to go ''
jrowe wrote:
egc wrote:
Before flashing the Xvortex CFE you had to install the initial DDWRT firmware as described in the guide (you should have done this twice because there is a dual boot partition)
This is the firmware you should try to flash now via TFTP
That was part of the problem, the guide didn't say anything about having to flash it twice. I would have done that but when I try to log in to the linksys again it locks up. I am assuming it's because I screwed up the mac addresses in the CFE. I ended up getting Xvortex flashed on it with tftp32 and it is at least booting up now. I haven't played with it much but what I have seen I don't really care for. It will be a dust collector on a shelf. I was just trying to get it running better as a backup for our failing router while I wait on a backordered Ubiquiti USG.
OK if you can telnet into your router then flash the intital DDWRT firmware and do this twice
After that flash with the modified Xvortex CFE but now with the right MAC adresses
Then flash the latest DDWRT build (I use the modified KONG builds)
After that you should be good to go ''
jrowe wrote:
egc wrote:
Before flashing the Xvortex CFE you had to install the initial DDWRT firmware as described in the guide (you should have done this twice because there is a dual boot partition)
This is the firmware you should try to flash now via TFTP
That was part of the problem, the guide didn't say anything about having to flash it twice. I would have done that but when I try to log in to the linksys again it locks up. I am assuming it's because I screwed up the mac addresses in the CFE. I ended up getting Xvortex flashed on it with tftp32 and it is at least booting up now. I haven't played with it much but what I have seen I don't really care for. It will be a dust collector on a shelf. I was just trying to get it running better as a backup for our failing router while I wait on a backordered Ubiquiti USG.
Do I put it in recovery mode before putting the initial ddwrt on it and what do I need to do between flashing the first and second time?
You should flash once (Brainslayer Initial Build), boot into DD-WRT. Then from within DD-WRT, flash again (Brainslayer Initial Build). You will likely get some errors as DD-WRT looks for the 2nd partition which XVortex CFE does not have, so I am not sure flashing 2 or 3 times will really help. (But then again I could be wrong)
If you REALLY want to hit both partitions with DD-WRT, you need to flash DD-WRT (Brainslayer Initial Build). Hop onto terminal, flash stock CFE (to gain access to 2nd partition). Flash DD-WRT (Brainslayer Initial Build again), reboot, then flash again (Brainslayer Initial Build), and once more for good measure back to back. Then flash the modified CFE BACK onto the device, reboot, then use OS per his instructions to update to the latest Kong.
This should get you a fall back DD-WRT flash in case it get's wonky.
Side note: the stock CFE backup I had you make will contain generic values, so you will need to add your MAC's and secret key in there as well before you flash it back.
Last edited by cybrnook on Wed Mar 30, 2016 20:18; edited 1 time in total
maybe you can chase this (passes the rings), but I know at least for OpenWRT and the linksys wrt1900ac. Those guys put together a way to explicitly execute a flash against a given partition.
Scroll down and start at "Backup Firmware Recovery" (about half way down)
They have some fancy uboot commands:
run flash_pri_image
run flash_alt_image
run update_both_image
I wonder if there is a way to pull the logic out of what they are doing and port that functionality into DD-WRT terms for the ea6900 (since I am sure the address spacing/spaces will be different).