Linksys WRT AC Series

The Linksys WRT AC series routers are high performance, dual-core, dual-partition, 802.11ac, with OEM firmware based on OpenWrt. The overall look of the devices is a throwback to the venerable WRT54G.

This series uses Marvell Armada based SoCs from the Marvell Embedded Business Unit (mvebu). See specific devices below:

WRT1200AC v1/v2, WRT1900AC v1, WRT1900AC v2, WRT1900ACS v1/v2, WRT3200ACM, WRT32X

The WRT AC series of routers uses a dual firmware flash layout. This means that two separate firmware partitions are included on the device and are flashed in an alternating fashion.

If booting from the primary partition, the secondary (or alternate) partition will be flashed on next sysupgrade, and booting is toggled to happen from that partition. The same logic applies to secondary-→primary. Note that this means there is no permanent “OEM partition” and “OpenWrt partition”. Both firmwares follow the same round-robin logic, where partition usage changes at each sysupgrade. The current firmware always remains as the fallback, and the new firmware is flashed to the other partition.

See the Flash Layout section on each device page for more details, or options to switch between partitions below.

It is recommended to install the LuCI package developed for managing dual firmware luci-app-advanced-reboot.

1. Login to Linksys WebUI (Default IP: 192.168.1.1; Password: admin)
2. Connectivity → Manual Update
   
   
3. Select factory image [.img]
   1. Once flash completes, router will reboot
      
      
4. If the image selected
   1. Has LuCI pre-installed:
      1. Login to WebUI
         
         
   2. Does not have LuCI pre-installed:
      1. Login with SSH
         1. Linux/BSD: SSH client built in
         2. Windows: SSH client built in
      2. Installing LuCI on uHTTPd
         
      3. Login to WebUI

LuCI

1. Login to the OpenWrt WebUI (Default IP: 192.168.1.1)
   
   
2. System → Backup/Flash Firmware → Flash New Firmware Image → Choose File
   1. Select Sysupgrade bin file [.bin]
      
      
3. Untick Keep Settings, then select Flash Image

CLI

1. Login to OpenWrt via SSH
   1. Linux/BSD: SSH client built in
   2. Windows: SSH client built in
2. Download/Upload firmware image to router
   1. Download via SSH terminal:
      

      cd /tmp && opkg update && opkg install wget && wget <Image-Link>

      -- OR --
      

   2. Upload via Client Machine Terminal:

      scp -r -i "C:\OpenWrt.ppk" -2 -scp -P 22 "D:\Path\To\Firmware.img" root@192.168.1.1:/tmp

      1. For PuTTY, change: scp to pscp -scp
         
         
      • -scp = force use of SCP protocol
      • -r = copy directories recursively
      • -i = private key file for user authentication
      • -2 = force use of particular SSH protocol version ^[2]
      • -p = connect to specified port
        
        
3. Flash image
   1. SSH terminal:
      

      cd /tmp && sysupgrade -n -v <image-name>

      • -n = do not save configuration over reflash
      • -v = more verbose

LuCI

1. Due to missing/incompatible metadata in OEM images, sysupgrade must be forced via the command line

CLI

1. Login to OpenWrt via SSH
   1. Linux/BSD: SSH client built in
   2. Windows: SSH client built in
2. Download/Upload firmware image to router
   1. Download via SSH terminal:
      

      cd /tmp && opkg update && opkg install wget && wget <Image-Link>

      -- OR --
      

   2. Upload via Client Machine Terminal:

      scp -r -i "C:\OpenWrt.ppk" -2 -scp -P 22 "D:\Path\To\Firmware.img" root@192.168.1.1:/tmp

      1. For PuTTY, change: scp to pscp -scp
         
         
      • -scp = force use of SCP protocol
      • -r = copy directories recursively
      • -i = private key file for user authentication
      • -2 = force use of particular SSH protocol version ^[2]
      • -p = connect to specified port
        
        
3. Flash image
   1. SSH terminal:
      

      cd /tmp && sysupgrade -F -n -v <image-name>

      • -F = force write, required to bypass metadata check
      • -n = do not save configuration over reflash
      • -v = more verbose

1. Terminal root access:

   sudo -i

2. Download kwboot & kwboot-patched:
   
   
3. Set kwboot as executable:

   Chmod 755 kwboot

4. Connect USB-TTL to router and PC (don’t power on router) & issue:

   dmesg | grep USB

   1. Make note of the number after /dev/ttyUSB (usually 0), then:

      chmod 666 /dev/ttyUSB0

5. Boot router using UART image and power on router:

   ./kwboot -t /dev/ttyUSB0 -b WRT1200AC_uboot_v2.0.13.bin -p

   OR

   ./kwboot-patched -f -t -p -b WRT1200AC_uboot_v2.0.13.bin -B 115200 /dev/ttyUSB0

   • Turn router on at the same time you press [ENTER] for the kwboot command
     • You may need to power cycle the router a few times before the script poll succeeds, as the timing is crucial
       
       
6. After the transfer finishes, you should be at the Marvell >> prompt:
   1. If you are not:
      1. Power Off Router → Disconnect USB-TTL Cable from PC → Go Back to Step 4
   2. If you are:
      1. Set up TFTP server on PC (such as Ubuntu’s tftpd package)
      2. Put WRT1200AC_uboot_v2.0.13.bin in it’s tftpboot/ directory
         
         
7. Connect PC to router (ethernet), set PC IP to 192.168.1.254/24, and issue at the Marvell >> prompt:

   setenv serverip 192.168.1.254
   setenv netmask 255.255.255.0
   ping 192.168.1.254
   tftp 2000000 WRT1200AC_uboot_v2.0.13.bin
   nand erase 0 200000
   nand write 2000000 0 200000

8. If the above commands complete successfully, reboot router via:

   reset

   • Router should boot and stop at the Marvell >> prompt
     
     
9. Download firmware image for your device and save it to tftpboot/:
   1. Issue the following at the Marvell >> prompt:

      tftp 192.168.1.254
      get <firmware_image_name>

10. IMPORTANT:
    • After transfer completes successfully, DO NOT issue:
      • run flash_pri_image || run flash_alt_image || run update_both_images
        • These will brick the router again sending you back to Step 3
          
          
    1. Instead:

       run_linksysnandboot

       IF FAILS:

       run_linksysaltnandboot

11. Allow router to fully boot:
    1. Verify it’s up and running correctly via the WebUI
    2. Power Off Router → Disconnect USB-TTL Cable → Power Back On

Depending on the model described in Supported Hardware it has either the 88W8864 or 88W8964 wifi chip. Both use mwlwifi, a mac80211 driver that is open source with a closed source firmware. Although the driver is stable for use of 802.11ac (2.4GHz and 5GHz), some features were not implemented: MU-MIMO, 802.11s for Mesh, and 802.11w are not supported by the driver. Workarounds for common issues are described below. See also mwlwifi github.

To query driver version:

opkg list-installed | grep mwlwifi

These settings are recommended for general stability and reliability:

1. Radio settings:
   • radio0: 5GHz, mwlwifi driver, set channel to 36 or auto, WPA2, 80MHz width, country code, remaining settings leave default.
   • radio1: 2.4GHz, mwlwifi driver, WPA2, country code, remaining settings leave default.
   • radio2: disabled. Note: can be useful for IoT device or client mode connections.
2. Enable packet steering per this discussion: In LuCI this is under Network > Interfaces > Global Network Options > packet steering.
3. Enabling irqbalance will move mwlwifi from CPU0 to CPU1, however this may slightly increase wifi latency. Irqbalance is often more viable on 4core or more, per this caution.

With 23.05.3 onward WPA3 support was added for the 8864 and 8897 (includes WRT1200 and WRT1900) via mwlwifi driver 10.4.10.

For 8964 chip models (WRT3200ACM and WRT32X) WPA3 support is still not available as per the driver commit notes. Blame Marvell for an incomplete Wi-Fi driver.

Models with wlan 88W8864 (WRT1200/1900) had higher wifi latency where disabling amsdu in /etc/rc.local was shown to reduce wifi latency, albeit with a drop to peak throughput. This was resolved with the mwlwifi 10.4.10 driver update included with 23.05.3 onward, where the fix below is no longer needed.

# turn off A-MSDU frame aggregation
echo "0" >> /sys/kernel/debug/ieee80211/phy0/mwlwifi/tx_amsdu
echo "0" >> /sys/kernel/debug/ieee80211/phy1/mwlwifi/tx_amsdu

There is an issue 2709 with the mwlwifi driver connecting to some IoT devices. See bug report here: ESP8266/Embedded devices unable to connect to 2.4Ghz Radio

Workarounds:

1. Enable radio2 with the mwifiex driver (install kmod-mwifiex-sdio). Connecting ESP chip devices here may improve connectivity, however could result in other conflicts.
2. Optional: disable LDPC on radio1 (2.4GHz) may improve connectivity as per https://github.com/kaloz/mwlwifi/issues/278#issuecomment-697433463.
3. Optional: disable WMM on the interface (note: this would also disable 802.11n/ac capability tremendously slowing throughput).

When setting certain channels for the AP the interface comes up briefly and then is disabled. This only happens for DFS channels. DFS channels are listed in the output of iw list on the 5GHz radio in the frequencies section. DFS channels will have the text (radar detection) at the end of the line. Try using one of the non-DFS channels.

• There is an issue with DFS on UK channels described here.
• Original mwlwifi bug described it here but is now closed.
• Removing mwifiex may workaround the issue: opkg remove kmod-mwifiex-sdio
• There were also changes to not lock the regulatory domain to avoid undesired effects like messed up system reg domain when another adapter is present or broadcasting incorrect country code in many countries. An alternate implementation can be found here and another here.

To accommodate a wide variety of kernels compatible with the series, path values were modified.
If experiencing missing drop down values, add platform back to path in /etc/config/wireless.

radio0 2.4GHz

option  path    'platform/soc/soc:pcie-controller/pci0000:00/0000:00:02.0/0000:02:00.0'

radio1 5GHz

option  path    'platform/soc/soc:pcie-controller/pci0000:00/0000:00:03.0/0000:03:00.0'

radio0 2.4GHz

option  path    'platform/soc/soc:pcie-controller/pci0000:00/0000:00:01.0/0000:01:00.0'

radio1 5GHz

option  path    'platform/soc/soc:pcie-controller/pci0000:00/0000:00:02.0/0000:02:00.0'

Linksys GPL source code for the devices listed above: https://www.linksys.com/us/support-article?articleNum=114663