Linksys WRT AC Series

The Linksys WRT AC series routers are high performance, multi-core, dual-partition, 802.11ac, with OEM firmware based on OpenWrt. The overall look of the devices is a throwback to the venerable WRT54G.

The WRT AC series of routers uses a dual firmware flash layout. This means that two separate firmware partitions are included on the device and are flashed in an alternating fashion.

If booting from the primary partition, the secondary (or alternate) partition will be flashed on next sysupgrade, and booting is toggled to happen from that partition. The same logic applies to secondary-→primary. Note that this means there is no permanent “OEM partition” and “OpenWrt partition”. Both firmwares follow the same round-robin logic, where partition usage changes at each sysupgrade. The current firmware always remains as the fallback, and the new firmware is flashed to the other partition.

See the Flash Layout section on each device page for more details, or options to switch between partitions below.

A LuCI plugin has been developed for managing dual firmware devices called luci-app-advanced-reboot.

1. Login to Linksys WebUI (Default IP: 192.168.1.1; Password: admin)
2. Connectivity → Manual Update
   
   
3. Select factory image [.img]
   1. Once flash completes, router will reboot
      
      
4. If the image selected
   1. Has LuCI pre-installed:
      1. Login to WebUI
         
         
   2. Does not have LuCI pre-installed:
      1. Login with SSH
         1. Linux/BSD: SSH client built in
         2. Windows: SSH client built in
      2. Installing LuCI on uHTTPd
         
      3. Login to WebUI

LuCI

1. Login to the OpenWrt WebUI (Default IP: 192.168.1.1)
   
   
2. System → Backup/Flash Firmware → Flash New Firmware Image → Choose File
   1. Select Sysupgrade bin file [.bin]
      
      
3. Untick Keep Settings, then select Flash Image

CLI

1. Login to OpenWrt via SSH
   1. Linux/BSD: SSH client built in
   2. Windows: SSH client built in
2. Download/Upload firmware image to router
   1. Download via SSH terminal:
      

      cd /tmp && opkg update && opkg install wget && wget <Image-Link>

      -- OR --
      

   2. Upload via Client Machine Terminal:

      scp -r -i "C:\OpenWrt.ppk" -2 -scp -P 22 "D:\Path\To\Firmware.img" root@192.168.1.1:/tmp

      1. For PuTTY, change: scp to pscp -scp
         
         
      • -scp = force use of SCP protocol
      • -r = copy directories recursively
      • -i = private key file for user authentication
      • -2 = force use of particular SSH protocol version ^[2]
      • -p = connect to specified port
        
        
3. Flash image
   1. SSH terminal:
      

      cd /tmp && sysupgrade -n -v <image-name>

      • -n = do not save configuration over reflash
      • -v = more verbose

LuCI

1. Due to missing/incompatible metadata in OEM images, sysupgrade must be forced via the command line

CLI

1. Login to OpenWrt via SSH
   1. Linux/BSD: SSH client built in
   2. Windows: SSH client built in
2. Download/Upload firmware image to router
   1. Download via SSH terminal:
      

      cd /tmp && opkg update && opkg install wget && wget <Image-Link>

      -- OR --
      

   2. Upload via Client Machine Terminal:

      scp -r -i "C:\OpenWrt.ppk" -2 -scp -P 22 "D:\Path\To\Firmware.img" root@192.168.1.1:/tmp

      1. For PuTTY, change: scp to pscp -scp
         
         
      • -scp = force use of SCP protocol
      • -r = copy directories recursively
      • -i = private key file for user authentication
      • -2 = force use of particular SSH protocol version ^[2]
      • -p = connect to specified port
        
        
3. Flash image
   1. SSH terminal:
      

      cd /tmp && sysupgrade -F -n -v <image-name>

      • -F = force write, required to bypass metadata check
      • -n = do not save configuration over reflash
      • -v = more verbose

1. Terminal root access:

   sudo -i

2. Download kwboot & kwboot-patched:
   
   
3. Set kwboot as executable:

   Chmod 755 kwboot

4. Connect USB-TTL to router and PC (don’t power on router) & issue:

   dmesg | grep USB

   1. Make note of the number after /dev/ttyUSB (usually 0), then:

      chmod 666 /dev/ttyUSB0

5. Boot router using UART image and power on router:

   ./kwboot -t /dev/ttyUSB0 -b WRT1200AC_uboot_v2.0.13.bin -p

   OR

   ./kwboot-patched -f -t -p -b WRT1200AC_uboot_v2.0.13.bin -B 115200 /dev/ttyUSB0

   • Turn router on at the same time you press [ENTER] for the kwboot command
     • You may need to power cycle the router a few times before the script poll succeeds, as the timing is crucial
       
       
6. After the transfer finishes, you should be at the Marvell >> prompt:
   1. If you are not:
      1. Power Off Router → Disconnect USB-TTL Cable from PC → Go Back to Step 4
   2. If you are:
      1. Set up TFTP server on PC (such as Ubuntu’s tftpd package)
      2. Put WRT1200AC_uboot_v2.0.13.bin in it’s tftpboot/ directory
         
         
7. Connect PC to router (ethernet), set PC IP to 192.168.1.254/24, and issue at the Marvell >> prompt:

   setenv serverip 192.168.1.254
   setenv netmask 255.255.255.0
   ping 192.168.1.254
   tftp 2000000 WRT1200AC_uboot_v2.0.13.bin
   nand erase 0 200000
   nand write 2000000 0 200000

8. If the above commands complete successfully, reboot router via:

   reset

   • Router should boot and stop at the Marvell >> prompt
     
     
9. Download firmware image for your device and save it to tftpboot/:
   1. Issue the following at the Marvell >> prompt:

      tftp 192.168.1.254
      get <firmware_image_name>

10. IMPORTANT:
    • After transfer completes successfully, DO NOT issue:
      • run flash_pri_image || run flash_alt_image || run update_both_images
        • These will brick the router again sending you back to Step 3
          
          
    1. Instead:

       run_linksysnandboot

       IF FAILS:

       run_linksysaltnandboot

11. Allow router to fully boot:
    1. Verify it’s up and running correctly via the WebUI
    2. Power Off Router → Disconnect USB-TTL Cable → Power Back On

Depending on the model described in Supported Hardware it has either the 88W8864 or 88W8964 wifi SoC. Both use mwlwifi, a mac80211 driver that is open source with a closed source firmware. Although the driver is stable for basic use of 802.11ac (2.4GHz and 5GHz), some features were not implemented. There is no MU-MIMO, 802.11s for Mesh, or 802.11w for WPA3 supported by the driver. Workarounds for common issues are described below. See also mwlwifi github.

To query installed version:

opkg list-installed | grep mwlwifi

These settings are recommended for general stability and reliability:

1. Radio settings:
   • radio0: 5GHz, mwlwifi driver, set channel to 36 or auto, WPA2, 80MHz width, remaining settings leave default.
   • radio1: 2.4GHz, mwlwifi driver, WPA2, remaining settings leave default.
   • radio2: disabled. If you have IoT devices using an ESP chip see below.
2. For 88W8864 wlan chip devices consider disabling amsdu as described below.
3. Enable packet steering per this discussion: In LuCI this is under Network > Interfaces > Global Network Options > packet steering.
4. Enabling irqbalance will move mwlwifi from cpu0 to cpu1. However this may increase wifi latency. This package is not always viable on 2core devices beyond benchmarking. Irqbalance is more viable on 4core and up, per this caution.

Models with wlan 88W8864 (WRT1200 and WRT1900 series only) may have higher wifi latency. Disabling amsdu in /etc/rc.local has been shown to reduce wifi latency by 20-30ms, albeit with a slight drop to peak throughput. Note this may have been resolved with the mwlwifi 10.3.9 driver update.

# turn off A-MSDU frame aggregation
echo "0" >> /sys/kernel/debug/ieee80211/phy0/mwlwifi/tx_amsdu
echo "0" >> /sys/kernel/debug/ieee80211/phy1/mwlwifi/tx_amsdu

Symptom: When setting certain channels for the interface of the AP, the interface comes up briefly and then is disabled. This only happens for DFS channels. DFS channels are listed in the output of iw list on the 5GHz radio in the frequencies section. DFS channels will have the text (radar detection) at the end of the line. Try using one of the non-DFS channels.

• There is an issue with DFS on UK channels described here.
• Original mwlwifi bug described it here but is now closed.
• Removing mwifiex may workaround the issue: opkg remove kmod-mwifiex-sdio
• There were also changes to not lock the regulatory domain to avoid undesired effects like messed up system reg domain when another adapter is present or broadcasting incorrect country code in many countries. An alternate implementation can be found here and another here.

Linksys GPL source code for the devices listed above: https://www.linksys.com/us/support-article?articleNum=114663

Divested builds are updated frequently and include security focused patches and settings. Web: divested.dev. Forum: OpenWrt Forum - divested builds.

Discontinued in 2022. PureFusion builds included a lot of common packages. Github: Releases page. Forum: OpenWrt Forum - PureFusion.

Discontinued in 2020. Davidc builds were used by a large proportion of the mvebu community. Forum: OpenWrt Forum - davidc502 builds.

How to add tags