Linksys WRT AC Series
Introduction
The Linksys WRT AC series routers are high performance, dual-core, dual-partition, 802.11ac, with OEM firmware based on OpenWrt. The overall look of the devices is a throwback to the venerable WRT54G.
Supported Hardware
This series uses Marvell Armada based SoCs from the Marvell Embedded Business Unit (mvebu). See specific devices below:
WRT1200AC v1/v2, WRT1900AC v1, WRT1900AC v2, WRT1900ACS v1/v2, WRT3200ACM, WRT32X
Dual Firmware Flashing
The WRT AC series of routers uses a dual firmware flash layout. This means that two separate firmware partitions are included on the device and are flashed in an alternating fashion.
If booting from the primary partition, the secondary (or alternate) partition will be flashed on next sysupgrade, and booting is toggled to happen from that partition. The same logic applies to secondary-→primary. Note that this means there is no permanent “OEM partition” and “OpenWrt partition”. Both firmwares follow the same round-robin logic, where partition usage changes at each sysupgrade. The current firmware always remains as the fallback, and the new firmware is flashed to the other partition.
See the Flash Layout section on each device page for more details, or options to switch between partitions below.
It is recommended to install the LuCI package developed for managing dual firmware luci-app-advanced-reboot.
Flashing Firmware
OEM install
- Login to Linksys WebUI (Default IP: 192.168.1.1; Password: admin)
- Connectivity → Manual Update
- Select factory image [.img]
- Once flash completes, router will reboot
- If the image selected
- Has LuCI pre-installed:
- Does not have LuCI pre-installed:
-
- Linux/BSD: SSH client built in
- Windows: SSH client built in
-
Sysupgrade
LuCI
- System → Backup/Flash Firmware → Flash New Firmware Image → Choose File
- Select Sysupgrade bin file [.bin]
- Untick Keep Settings, then select Flash Image
CLI
- Login to OpenWrt via SSH
- Linux/BSD: SSH client built in
- Windows: SSH client built in
- Download/Upload firmware image to router
- Download via SSH terminal:
cd /tmp && opkg update && opkg install wget && wget <Image-Link>
-- OR --
- Upload via Client Machine Terminal:
scp -r -i "C:\OpenWrt.ppk" -2 -scp -P 22 "D:\Path\To\Firmware.img" root@192.168.1.1:/tmp
- For PuTTY, change:
scp
topscp -scp
-scp
= force use of SCP protocol-r
= copy directories recursively-i
= private key file for user authentication-2
= force use of particular SSH protocol version [2]-p
= connect to specified port
- Flash image
- SSH terminal:
cd /tmp && sysupgrade -n -v <image-name>
-n
= do not save configuration over reflash-v
= more verbose
Return to OEM
LuCI
- Due to missing/incompatible metadata in OEM images, sysupgrade must be forced via the command line
CLI
- Login to OpenWrt via SSH
- Linux/BSD: SSH client built in
- Windows: SSH client built in
- Download/Upload firmware image to router
- Download via SSH terminal:
cd /tmp && opkg update && opkg install wget && wget <Image-Link>
-- OR --
- Upload via Client Machine Terminal:
scp -r -i "C:\OpenWrt.ppk" -2 -scp -P 22 "D:\Path\To\Firmware.img" root@192.168.1.1:/tmp
- For PuTTY, change:
scp
topscp -scp
-scp
= force use of SCP protocol-r
= copy directories recursively-i
= private key file for user authentication-2
= force use of particular SSH protocol version [2]-p
= connect to specified port
- Flash image
- SSH terminal:
cd /tmp && sysupgrade -F -n -v <image-name>
-F
= force write, required to bypass metadata check-n
= do not save configuration over reflash-v
= more verbose
Firmware Recovery
If the firmware has an issue, chances are you can recover it easily due to the Dual Firmware partition layout, by switching to the alternate firmware. For this reason, it is recommended to always keep a known working firmware on the other partition (either OEM or OpenWrt).
Switch router from primary to alternate partition or vice versa using any of the methods below:
LuCI
- Install
luci-app-advanced-reboot
:- SSH:
opkg update && opkg install luci-app-advanced-reboot
- WebUI:
- System → Software
- Actions → Update Lists
- Actions → Filter
luci-app-advanced-reboot
→ Find Package
- Status: Available packages
- Install
luci-app-advanced-reboot
- System → Advanced Reboot
Serial
- Connect via Serial:
reboot
- At 3 second autoboot interrupt delay, press any key
- Boot
- Primary Partition
- Armada XP
run linksysnandboot
- Armada 385
run nandboot
- Alternate Partition:
- Armada XP
run linksysaltnandboot
- Armada 385
run altnandboot
SSH
- Determine current partition:
/usr/sbin/fw_printenv -n boot_part
- Boot
- Primary Partition:
/usr/sbin/fw_setenv boot_part 1 && reboot
- Alternate Partition:
/usr/sbin/fw_setenv boot_part 2 && reboot
Power Switch
- Power off router with power switch.
- Turn power back on and power LED will light.
- As soon as all LEDs turn off (~2s), power off router with power switch
- Turn power back on and power LED will light.
- As soon as all LEDs turn off (~2s), power off router with power switch
- Turn power back on and power LED will light.
- As soon as all LEDs turn off (~2s), power off router with power switch
- Turn power back on and allow router to fully boot.
- It should now be booted to the alternate firmware partition
Explanation: There is a counter for boot attempts. The counter is increased by 1 at the start of each boot process, then is reset to 0 after a successful boot. If the counter reaches 3, the boot is considered a failure and the boot partition is switched to the other partition (A-→B or B-→A).
Thus, if you interrupt the boot process three times, the router thinks that the current firmware is faulty and switches to the other partition. Note that there is no guarantee that the other partition works. It has the contents and settings that were there when the boot was switched last time, usually at the last sysupgrade. That boot marker switch (A-→B or B-→A) happens at every sysupgrade, so likely you just have the previously used firmware there (either OEM or OpenWrt). But the marker may have been manually toggled, or auto-toggled after three failures.
Serial Port
Synopsis
Serial Port is labeled J1 on the board, utilizing a JST PH 6 pin connector with a 2.0mm pitch, operating at 3.3v
- The more common 2.54mm pitch will not fit properly.
- In a pinch, removing the plastic casing from 2.54mm female connectors allows for a stable enough connection.
- Ensure leads are insulated with electrical tape
- If flashing regularly, you may wish to invest in a USB-TTL AJ cable
- USB-TTL AJ cables require installation of a 3.5mm Jack (F) on the router
Serial Header
Pin Out | ||||||
---|---|---|---|---|---|---|
Pins | 1 | 2 | 3 | 4 | 5 | 6 |
Function | Gnd | Tx | n/a | Rx | n/a | n/a |
Bootloader
Corrupt Environment Recovery
If the U-Boot bootloader environment becomes corrupted, it can be reset or restored
Reset
Issue the following at the Marvell >>
prompt:
env default -a saveenv reset
Restore
Corrupt Bootloader Recovery
Prerequisites
Hardware
- PC running Linux
- x86 libraries if x64
- USB – TTL Cable
UART Boot Files
Instructions
- Terminal root access:
sudo -i
- Set kwboot as executable:
Chmod 755 kwboot
- Connect USB-TTL to router and PC (don’t power on router) & issue:
dmesg | grep USB
- Make note of the number after
/dev/ttyUSB
(usually 0), then:chmod 666 /dev/ttyUSB0
- Boot router using UART image and power on router:
./kwboot -t /dev/ttyUSB0 -b WRT1200AC_uboot_v2.0.13.bin -p
OR
./kwboot-patched -f -t -p -b WRT1200AC_uboot_v2.0.13.bin -B 115200 /dev/ttyUSB0
- Turn router on at the same time you press [
ENTER
] for the kwboot command- You may need to power cycle the router a few times before the script poll succeeds, as the timing is crucial
- After the transfer finishes, you should be at the
Marvell >>
prompt:- If you are not:
- Power Off Router → Disconnect USB-TTL Cable from PC → Go Back to Step 4
- If you are:
- Set up TFTP server on PC (such as Ubuntu’s
tftpd
package) - Put
WRT1200AC_uboot_v2.0.13.bin
in it’stftpboot/
directory
- Connect PC to router (ethernet), set PC IP to
192.168.1.254/24
, and issue at theMarvell >>
prompt:setenv serverip 192.168.1.254 setenv netmask 255.255.255.0 ping 192.168.1.254 tftp 2000000 WRT1200AC_uboot_v2.0.13.bin nand erase 0 200000 nand write 2000000 0 200000
- If the above commands complete successfully, reboot router via:
reset
- Router should boot and stop at the
Marvell >>
prompt
- Download firmware image for your device and save it to
tftpboot/
:- Issue the following at the
Marvell >>
prompt:tftp 192.168.1.254 get <firmware_image_name>
- IMPORTANT:
- After transfer completes successfully, DO NOT issue:
run flash_pri_image
||run flash_alt_image
||run update_both_images
- These will brick the router again sending you back to Step 3
- Instead:
run_linksysnandboot
IF FAILS:
run_linksysaltnandboot
- Allow router to fully boot:
- Verify it’s up and running correctly via the WebUI
- Power Off Router → Disconnect USB-TTL Cable → Power Back On
Marvell WiFi
Depending on the model described in Supported Hardware it has either the 88W8864 or 88W8964 wifi chip. Both use mwlwifi, a mac80211 driver that is open source with a closed source firmware. Although the driver is stable for use of 802.11ac (2.4GHz and 5GHz), some features were not implemented: MU-MIMO, 802.11s for Mesh, and 802.11w are not supported by the driver. Workarounds for common issues are described below. See also mwlwifi github.
To query driver version:
opkg list-installed | grep mwlwifi
Recommendations
These settings are recommended for general stability and reliability:
- Radio settings:
- radio0: 5GHz, mwlwifi driver, set channel to 36 or auto, WPA2, 80MHz width, country code, remaining settings leave default.
- radio1: 2.4GHz, mwlwifi driver, WPA2, country code, remaining settings leave default.
- radio2: disabled. Note: can be useful for IoT device or client mode connections.
- Enable packet steering per this discussion: In LuCI this is under Network > Interfaces > Global Network Options > packet steering.
- Enabling irqbalance will move mwlwifi from CPU0 to CPU1, however this may slightly increase wifi latency. Irqbalance is often more viable on 4core or more, per this caution.
WPA3 support
With 23.05.3 onward WPA3 support was added for the 8864 and 8897 (includes WRT1200 and WRT1900) via mwlwifi driver 10.4.10.
For 8964 chip models (WRT3200ACM and WRT32X) WPA3 support is still not available as per the driver commit notes. Blame Marvell for an incomplete Wi-Fi driver.
Latency with 88W8864
Models with wlan 88W8864 (WRT1200/1900) had higher wifi latency where disabling amsdu in /etc/rc.local
was shown to reduce wifi latency, albeit with a drop to peak throughput. This was resolved with the mwlwifi 10.4.10 driver update included with 23.05.3 onward, where the fix below is no longer needed.
# turn off A-MSDU frame aggregation echo "0" >> /sys/kernel/debug/ieee80211/phy0/mwlwifi/tx_amsdu echo "0" >> /sys/kernel/debug/ieee80211/phy1/mwlwifi/tx_amsdu
ESP chip devices won't connect
There is an issue 2709 with the mwlwifi driver connecting to some IoT devices. See bug report here: ESP8266/Embedded devices unable to connect to 2.4Ghz Radio
Workarounds:
- Enable radio2 with the mwifiex driver (install kmod-mwifiex-sdio). Connecting ESP chip devices here may improve connectivity, however could result in other conflicts.
- Optional: disable LDPC on radio1 (2.4GHz) may improve connectivity as per https://github.com/kaloz/mwlwifi/issues/278#issuecomment-697433463.
- Optional: disable WMM on the interface (note: this would also disable 802.11n/ac capability tremendously slowing throughput).
DFS channels not working
When setting certain channels for the AP the interface comes up briefly and then is disabled. This only happens for DFS channels. DFS channels are listed in the output of iw list
on the 5GHz radio in the frequencies section. DFS channels will have the text (radar detection)
at the end of the line. Try using one of the non-DFS channels.
Information and potential un-official work-arounds
- There is an issue with DFS on UK channels described here.
- Original mwlwifi bug described it here but is now closed.
- Removing mwifiex may workaround the issue:
opkg remove kmod-mwifiex-sdio
- There were also changes to not lock the regulatory domain to avoid undesired effects like messed up system reg domain when another adapter is present or broadcasting incorrect country code in many countries. An alternate implementation can be found here and another here.
Missing drop down values using older kernels
To accommodate a wide variety of kernels compatible with the series, path
values were modified.
If experiencing missing drop down values, add platform
back to path
in /etc/config/wireless
.
Armada XP
radio0 2.4GHz
option path 'platform/soc/soc:pcie-controller/pci0000:00/0000:00:02.0/0000:02:00.0'
radio1 5GHz
option path 'platform/soc/soc:pcie-controller/pci0000:00/0000:00:03.0/0000:03:00.0'
Armada 385
radio0 2.4GHz
option path 'platform/soc/soc:pcie-controller/pci0000:00/0000:00:01.0/0000:01:00.0'
radio1 5GHz
option path 'platform/soc/soc:pcie-controller/pci0000:00/0000:00:02.0/0000:02:00.0'
88W8964 VAP SSID broadcasts but clients can't connect
The driver rejects any packets from interfaces which are not within a mask (FD:FF:FF:FF:FF:F0) of the main interface (primary AP or STA). You should set the locally administered bit for the MAC address, and then freely set any final digit. Keep in mind that the MAC address should be unicast (not multicast) or hostapd will not start the interface. This then leaves you only with even digits for the second digit of the address (i.e. 2, 4, 6, 8, a, c, e).
To make VAPs work, it is recommended to manually set the macaddr for each wifi-iface section of your /etc/config/wireless e.g. if your primary MAC is 60:38:e0:ce:37:50, your wifi config for 3 APs (1 primary + 2 VAPs)
config 'wifi-iface' option 'device' 'radio0' option 'network' 'lan' option 'mode' 'ap' option 'ssid' 'MainAP' option 'encryption' 'psk2' option 'key' 'secret passphrase' option 'macaddr' '60:38:e0:ce:37:50' config 'wifi-iface' option 'device' 'radio0' option 'network' 'lan' option 'mode' 'ap' option 'ssid' 'GuestAP1' option 'encryption' 'psk2' option 'key' 'secret passphrase' option 'macaddr' '62:38:e0:ce:37:51' config 'wifi-iface' option 'device' 'radio0' option 'network' 'lan' option 'mode' 'ap' option 'ssid' 'GuestAP2' option 'encryption' 'psk2' option 'key' 'secret passphrase' option 'macaddr' '62:38:e0:ce:37:52'
OEM Firmware Images
Linksys OEM Firmware | |||||
---|---|---|---|---|---|
Device | Version | Repository | Changelog | Date | |
WRT1200AC | v1 | 1.0.5.187766 | Repo | txt | 2018.05.01 |
v2 | 2.0.6.191786 | txt | 2018.12.10 | ||
WRT1900AC | v1 | 1.1.10.187766 | Repo | txt | 2018.04.12 |
v2 | 2.0.8.187766 | txt | 2018.04.26 | ||
WRT1900ACS | v1 | 1.0.3.187766 | Repo | txt | 2018.04.20 |
v2 | 2.0.3.201002 | txt | 2020.05.01 | ||
WRT3200ACM | v1 | 1.0.8.199531 | Repo | txt | 2020.02.13 |
WRT32X | v1 | 1.0.180404.58 | Repo | txt | 2018.04.23 |
Linksys GPL source code for the devices listed above: https://www.linksys.com/us/support-article?articleNum=114663
Hardware Mods
USB-TTL Audio Jack Install
Troubleshooting
Serial Port
Serial Interfaces
Serial Flash
Prerequisites
Instructions
Flash Output
Community Builds
Divested
Divested builds are updated frequently and include security focused patches and settings. Web: divested.dev. Forum: OpenWrt Forum - divested builds.
PureFusion
Discontinued in 2022. PureFusion builds included a lot of common packages. Github: Releases page. Forum: OpenWrt Forum - PureFusion.
Davidc502
Discontinued in 2020. Davidc builds were used by a large proportion of the mvebu community. Forum: OpenWrt Forum - davidc502 builds.