Aether Link V1 — Autonomous Embedded Linux Node

Hardware Target: JioFi-4 Portable Hotspot Router (Model: JMR1140)
SoC: Qualcomm Snapdragon MDM9607 (ARM Cortex-A7 @ 1.3 GHz)
PMIC: Qualcomm PM8019
RAM: 256 MB LPDDR2 (154 MB kernel-accessible)
NAND Storage: 128 MB Raw NAND (FM6BD2G2GCA, Micron/Winbond compatible)
MicroSD Expansion: Up to 64 GB Class 10 UHS-I (/dev/mmcblk0)
WLAN Controller: Realtek RTL8189ES SDIO (024c:8179, 2.4 GHz 802.11b/g/n)
OS Stack: Mainline Linux 6.12.1 + Alpine Linux Edge (OpenRC)
Status: EXPERIMENTAL / ACTIVE DEVELOPMENT

---

Caution

EXPERIMENTAL HARDWARE REFLASHING — RISK OF BRICK
This project involves low-level Qualcomm NAND partitioning, Little Kernel (lk2nd), and custom device trees. Writing to the wrong NAND MTD partition can permanently halt SBL1 and trap the device in Qualcomm Emergency Download (EDL) mode (05c6:9008 / 1ecb:02e1). Always maintain a full, verified raw NAND backup before executing any flash script.

---

1. Overview & Project Objective

Aether Link V1 repurposes the inexpensive, carrier-locked JioFi-4 (JMR1140) Qualcomm MDM9607 mobile hotspot into an autonomous, ultra-low-power, headless Linux edge server.

By replacing the vendor Android/Busybox firmware with mainline Linux 6.12.1 and pivoting the root filesystem to a fast MicroSD card running Alpine Linux Edge, the device becomes a self-contained Linux node with dual networking (USB Ethernet debug bridge + Wi-Fi station) and SSH remote management.

---

2. Working Mechanisms & Boot Architecture

┌────────────────────────────────────────────────────────────────────────┐
│                        COLD POWER-ON SEQUENCE                          │
├────────────────────────────────────────────────────────────────────────┤
│ 1. Qualcomm PBL (Primary Boot Loader in ROM)                           │
│       │                                                                │
│ 2. SBL1 (Secondary Boot Loader)                                        │
│       │                                                                │
│ 3. Little Kernel / lk2nd (Aboot on NAND partition "boot" /dev/mtd8)    │
│       │                                                                │
│ 4. Mainline Linux 6.12.1 Kernel (zImage + QCDT dt.img)                 │
│       ├── Watchdog defuser starts immediately (clears 0x0b017008)      │
│       ├── SDC1 TLMM mux register 0x01111000 bit 1 asserted             │
│       └── Realtek RTL8189ES SDIO card enumerates on sdhc_1 (mmc1)      │
│       │                                                                │
│ 5. Built-in Initramfs (Aether Link V1 bootstrap)                       │
│       ├── USB Gadget enumerates: Vendor "Aether", Product "Link V1"    │
│       ├── Mounts clean tmpfs on /run and /tmp                          │
│       ├── Waits for MicroSD card partition /dev/mmcblk0p2              │
│       └── switch_root to Alpine Linux /sbin/init                       │
│       │                                                                │
│ 6. Alpine Linux OpenRC (PID 1)                                         │
│       ├── boot/modules: loads 8189es.ko (wlan0 up)                     │
│       ├── boot/wpa_supplicant: associates to Wi-Fi SSID                │
│       ├── boot/wpa_cli: triggers udhcpc upon CONNECTED                 │
│       ├── boot/networking: obtains DHCP lease (e.g. 192.168.1.43)      │
│       ├── default/chronyd: synchronizes wall-clock NTP time            │
│       └── default/dropbear: SSH daemon listening on wlan0 & usb0       │
└────────────────────────────────────────────────────────────────────────┘

Key Engineering Mechanisms:

1. Watchdog Defusal Loop:
   The PM8019 / MDM9607 chipset features a hard KPSS hardware watchdog at register 0x0b017008. If not cleared every 2 seconds, the PMIC cuts system power. The Aether bootstrap initiates a background defuser loop immediately in early userspace:

   while true; do devmem 0x0b017008 32 0; sleep 2; done &

2. SDC1 TLMM Pin Multiplexing (0x01111000):
   The MDM9607 pinmux register 0x01111000 controls whether physical SDC1 pads connect to the SDHC1 controller (bit 1 = 1) or general EBI2 GPIOs (bit 1 = 0). Upstream Linux leaves bit 1 cleared. We assert 0x1C210843 in pinctrl-mdm9607.c and initramfs init to allow the Realtek RTL8189ES SDIO Wi-Fi card to enumerate on mmc1.

3. Realtek RTL8189ES Kernel 6.12+ Pointer Fix:
   In modern Linux kernels, register_netdev() verifies the wdev pointer. In os_dep/linux/ioctl_cfg80211.c, pnetdev->ieee80211_ptr = wdev; must be assigned before register_netdev() to prevent -ENODEV (-19) interface failures.

4. NAND Boot Partition Ceiling:
   The raw NAND boot partition is strictly 8,388,608 bytes (8.00 MB). The production boot image aether-boot-wifi.img is compiled to ~7.5 MB, fitting safely inside the physical boundary.

5. Storage Decoupling:
   The NAND flash holds only the kernel, QCDT device tree table, and bootstrap initramfs. The entire writable operating system (packages, configurations, logs) lives on the MicroSD card (/dev/mmcblk0p2), preventing NAND flash wear and eliminating write-cycle exhaustion.

---

3. Human Developer Quickstart Guide

Prerequisites

• Target Device: JioFi-4 (JMR1140) portable router.
• MicroSD Card: 8 GB to 64 GB Class 10 MicroSD card.
• Cable: Micro-USB data cable (verify data lines are wired).
• Workstation: Linux machine with python3, fastboot, adb, parted, e2fsprogs, and rsync.

---

Step 1: Prepare the MicroSD Card

Insert your MicroSD card into your Linux PC and run the deployment script:

cd scripts
sudo ./deploy_alpine.sh /dev/sdX   # Replace /dev/sdX with your actual SD card block device

This formats the card with two partitions:

• p1 (512 MB, FAT32): Reserved boot/recovery partition.
• p2 (Remaining, ext4): Alpine Linux Edge root filesystem with pre-installed OpenRC, Dropbear SSH, and networking daemons.

Configure your Wi-Fi credentials on the newly created ext4 rootfs partition:

sudo nano /media/user/aether-rootfs/etc/wpa_supplicant/wpa_supplicant.conf

Update ssid and psk to match your network.

---

Step 2: Flash the Boot Image via EDL Mode

1. Power off the JioFi puck.
2. Hold down Power + WPS simultaneously and plug in the USB cable to enter Qualcomm EDL mode.
3. Confirm connection with lsusb:

   lsusb
   # Expected: 1ecb:02e1 AMTelecom QHSUSB__BULK  (or 05c6:9008 Qualcomm)

4. Flash the boot image to the NAND boot partition:

   cd scripts
   sudo ./flash_nand_edl.sh

---

Step 3: First Boot & Remote Access

1. Insert the prepared MicroSD card into the puck's internal card slot.
2. Insert battery and power on the device.
3. Connect the USB cable to your workstation. Within 15 seconds, the USB Ethernet gadget will appear:
   • Puck IP: 192.168.2.1
   • Workstation IP: 192.168.2.2 (configured automatically via link-local or manual assignment)

Connect via SSH over USB:

./scripts/ssh_usb.sh
# or: ssh root@192.168.2.1

Once Wi-Fi associates with your router, connect directly over your LAN:

./scripts/ssh_wifi.sh
# or: ssh root@192.168.1.43

---

4. AI Agent Operational Protocol & Invariants

Autonomous agents interacting with this repository or active device sessions must strictly follow these rules:

1. Partition Safety (CRITICAL):

   • boot partition: Strictly /dev/mtd8.
   • efs2 (Modem NVRAM): Strictly /dev/mtd2. NEVER write or format mtd2.
   • rpm (Resource Power Manager): Strictly /dev/mtd4. NEVER touch mtd4. Erasing mtd4 triggers SBL1 error 303e at boot_flash_trans_nand.c Line 435 and bricks the device.
   • misc (Boot Control Block): Strictly /dev/mtd11.

2. Watchdog Invariant:
   Never terminate, kill, or replace the background devmem 0x0b017008 process. Terminating it causes an unconditional hardware reboot within 2000ms.

3. Runlevel & /run Filesystem:
   /run must be mounted as tmpfs. Never allow OpenRC state files to persist across reboots, as stale PID files will prevent network daemons from starting.

4. Kexec Memory Handoff:
   When performing a warm kexec jump (kexec -e), unbind SDHC1 before the kernel transition:

   echo "7824900.sdhci" > /sys/bus/platform/drivers/sdhci_msm/unbind
   sleep 1
   kexec -e

---

5. Directory Layout

aether-link/
├── README.md                      # Master technical reference
├── release_images/                # Verified production flash binaries
│   ├── aether-boot-wifi.img       # Production NAND boot image (7.5 MB)
│   ├── dt.img                     # QCDT device tree table (26 KB)
│   ├── qcom-mdm9607-jio-jmr1140.dtb # Compiled device tree blob (24 KB)
│   ├── zImage                     # Mainline Linux 6.12.1 kernel with initramfs
│   ├── 8189es.ko                  # RTL8189ES Wi-Fi driver module (2.2 MB)
│   └── SHA256SUMS                 # Checksum verification table
├── device_tree/
│   ├── qcom-mdm9607-jio-jmr1140.dts # Production DTS source with pinmux
│   └── lk2nd_dtb.dts              # Little Kernel device tree source
├── kernel_config/
│   └── config-6.12.1-mdm9607      # Working Linux 6.12.1 .config
├── kernel_patches/
│   ├── 0001-kernel-6.12.1-mdm9607-changes.patch
│   ├── 0001-watchdog-defusal.patch
│   ├── 0002-sdc1-tlmm-muxing.patch
│   ├── 0003-pm8019-regulators.patch
│   └── 0004-mtd-nandc-mdm9607.patch
├── initramfs_source/              # Minimal recovery bootstrap initramfs
│   └── init                       # Early bootstrap & MicroSD pivot script
├── live_rootfs_overlay/           # Template configurations for MicroSD rootfs
│   └── etc/
│       ├── fstab                  # tmpfs configurations
│       ├── network/interfaces     # usb0 + wlan0 network configurations
│       ├── wpa_supplicant/        # Wi-Fi station setup templates
│       └── local.d/               # Boot-time initialization scripts
├── ota/                           # SWUpdate OTA update framework
└── scripts/
    ├── deploy_alpine.sh           # MicroSD card partitioner & rootfs installer
    ├── flash_nand_edl.sh          # Sahara / EDL flasher
    ├── build_boot_image.sh        # Kernel + QCDT boot image generator
    ├── build_qcdt.py              # Qualcomm device tree table packager
    ├── ssh_usb.sh                 # Quick SSH bridge over USB (192.168.2.1)
    ├── ssh_wifi.sh                # Quick SSH bridge over Wi-Fi
    └── sahara/                    # Low-level Qualcomm protocol utilities

---

6. License & Disclaimer

This project is licensed under the MIT License.
All Qualcomm device tree bindings and kernel patches fall under their respective upstream GPL-2.0 licenses.

Disclaimer: This repository is an independent research project. It is not affiliated with, sponsored by, or endorsed by Reliance Jio, Qualcomm, or Realtek.