Linksys WRT32X OpenWrt-based firmware & WRT3200ACM crossflash

Here is the image of the WRT32X firmware, self-compiled out of GPL sources provided yesterday as Linksys only provides sysupgrade.
I simplified, by a mile, the method I initially used with the sysupgrade file.

in U-boot console issue:

setenv mtdparts 'mtdparts=armada-nand:2048K(uboot)ro,128K(u_env),256K(s_env),256K@8064K(devinfo),123m@9m(firmware1),123m@132m(firmware2)'
setenv priKernAddr 0x0900000
setenv altKernAddr 0x8400000
setenv altFwSize 0x7b00000
setenv priFwSize 0x7b00000
setenv nandboot 'setenv bootargs console=ttyS0,115200 root=/dev/mtdblock6;nand read $defaultLoadAddr $priKernAddr $priKernSize; bootz $defaultLoadAddr'
setenv altnandboot 'setenv bootargs console=ttyS0,115200 root=/dev/mtdblock8;nand read $defaultLoadAddr $altKernAddr $altKernSize; bootz $defaultLoadAddr'

Set PC's IP to / and serve provided rango.img via TFTP and after reboot you'll be running WRT32X firmware :slight_smile:
To flash and boot served image issue in U-Boot:

run update_both_images

To reverse the process:
Download and serve via TFTP any WRT3200ACM firmware file (only full factory images), be that LEDE, OpenWrt, oficial firmware and change the name to rango.img
And use those commands respectively:

setenv mtdparts 'mtdparts=armada-nand:2048K(uboot)ro,128K(u_env),256K(s_env),256K@8064K(devinfo),1920K@8320K(sysdiag),80m@10m(kernel),74m@16m(rootfs),80m@90m(alt_kernel),74m@96m(alt_rootfs),160m@10m(ubifs),-@170m(syscfg)' 
setenv nandboot 'setenv bootargs console=ttyS0,115200 root=/dev/mtdblock6 ro rootdelay=1 rootfstype=jffs2 earlyprintk $mtdparts;nand read $defaultLoadAddr $priKernAddr $priKernSize; bootm $defaultLoadAddr' 
setenv altnandboot 'setenv bootargs console=ttyS0,115200 root=/dev/mtdblock8 ro rootdelay=1 rootfstype=jffs2 earlyprintk $mtdparts;nand read $defaultLoadAddr $altKernAddr $altKernSize; bootm $defaultLoadAddr' 
setenv priKernAddr 0x0a00000 
setenv altKernAddr 0x5a00000 
setenv altFwSize 0x5000000 
setenv priFwSize 0x5000000 
run update_both_images 

Thanks for laying the groundwork @inteliboy ! I am going to be doing this over the coming weekend.

1 Like

vcool @inteliboy :sunglasses:

As people dig into the source code, "killer Prioritization Engine (KPE)" is QoS shell script code.:wink:

And the WRT32X firmware will work on a WRT3200ACM without any issues. the only installation block is that the flash layout is different

Worked like a charm.

rango.img to download:

Initial flash to 32X process: 
Set PC's IP to / and serve provided rango.img via TFTPD (

U-boot console issue: 

setenv mtdparts 'mtdparts=armada-nand:2048K(uboot)ro,128K(u_env),256K(s_env),256K@8064K(devinfo),123m@9m(firmware1),123m@132m(firmware2)' 
setenv nandboot 'setenv bootargs console=ttyS0,115200 root=/dev/mtdblock6;nand read $defaultLoadAddr $priKernAddr $priKernSize; bootz $defaultLoadAddr' 
setenv altnandboot 'setenv bootargs console=ttyS0,115200 root=/dev/mtdblock8;nand read $defaultLoadAddr $altKernAddr $altKernSize; bootz $defaultLoadAddr' 
setenv priKernAddr 0x0900000 
setenv altKernAddr 0x8400000 
setenv altFwSize 0x7b00000 
setenv priFwSize 0x7b00000 
run update_both_images 

From SSH convert U-boot:
mtd write /uboot209.bin u-boot

Reboot into U-boot:

Reboot into U-boot: 
setenv -f silent 

this is great. (i/m getting my wrt3200acm tomorrow, and hope to make it a wrt32x asap.)
is u-boot accessible any way other than serial port?
does stock wrt3200acm firmware have ssh access?
thank you!

Nope and nope. While in theory you could issue all those setenv commands from a running OpenWrt via fw_setenv you still need to flash the firmware via u-boot console, so unfortunately you need a serial connection.

Opening the 3200ACM is cake, only the front feet screws (2 x ), and just pull it apart.

@inteliboy and cybernook - i'm fine with serial. i break more cases trying to open them than i brick with serial access.
thanks for your help.

i successfully crossflashed my wrt3200acm to a wrt32x using these instuctions. and didnt break the case. fantastic. thank you.

1 Like

Make sure to ssh in and remove the cron job. I giggled when I saw that in there (seems OpenWRT is a bit behind to say the least, but it's still a step in the right direction).

crontab -e

there is another step to complete the conversion from wrt3200acm to wrt32X:

i edited the mtd4 dump to update to the wrt32X values:

however, mtd4 is write-protected and cannot be unlocked with the mtd tools in dd-wrt or lede

thus i think the process for complete transition of a wrt3200acm to wrt32x should also include modifying those devinfo values from the u-boot command line via serial port. as i recall, the devinfo partition can be modified using tools that are like the nvram tool:
devinfo set hw_version=48SAM204.0GA
devinfo modelNumber=WRT32X
devinfo commit
but dd-wrt/lede do not have access to the devinfo tool.

although mtd4 cannot be unlocked, mtd3 can be, and mtd4 is mapped to a segment within mtd3.

so - i editted the mtd3 partition to include the updated hw_version and modelNumber as above. i think this completes the conversion of wrt3200acm to wrt32x

I have transformed my wrt3200 in wrt32x, but the wifi performance is pretty far from expected (116 Mbits in 5GHz) with iperf in an OSX. Compared to my telco router that is making 250 Mbits.

Original software was making 450 Mbits. For now I´ve moved back to stock. I might test DD-WRT or Lede

is there any development on a lede image that can be flashed on the wrt32x platform (codename venom), or do i have to cross-flash back to wrt3200acm to use lede? i have tried using the wrt3200acm images but the sysupgrade fails. if i replace the text 'rango' with 'venom' in the image, the sysupgrade works, but the router hangs.
i'm alittle confused, becasue the stock firmware runs openwrt, so sysupgrade is available.

The WRT32X GPL code has been put back up on Linksys GPL page. Can someone let the guys/gals over at DD-WRT know as well, thank you.


Nobody knows exactly why it was removed in the first place. But it is back now.

Possibly new firmware here:

*working well on my WRT3200ACM right now by the way

/lib/firmware/mwlwifi$ cat /sys/kernel/debug/ieee80211/phy0/mwlwifi/info

driver name: mwlwifi
chip type: 88W8964
hw version: 7
driver version:
firmware version: 0x09030102
power table loaded from dts: no
firmware region code: 0x0
mac address: 60:38:e0:b4:12:62
2g: disable
5g: enable
antenna: 4 4
irq number: 105
ap macid support: 0000ffff
sta macid support: 00010000
macid used: 00000001
radio: enable
iobase0: e0e00000
iobase1: e1080000
tx limit: 1024
rx limit: 16384

Although this is the most recent sources for the WRT32X (matching their latest WRT32X firmware release as well), this seems to be the same firmware version from latest WRT3200ACM firmware release.


Firmware version:
Release date: October 27, 2017

  • Integrated WLAN driver v9.1.1.4 and FW v9.3.1.2
  • Added support for Winbond and MXIC flash
  • Fixed VPN access over PPTP
  • General bug fixes

Interesting to note, the latest firmware release for WRT32X (FW_WRT32X_1.0.170828.208) which is still available for download on Linksys server (despite link removed), the source file WRT32X_gpl_v1.0.170828.208.tar, despite having the same version number in the file name has much newer material within the sources. The firmware for 88W8964 as an example, is much newer.

The source file WRT32X_gpl_v1.0.170828.208.tar is up-to-date as far as 2017-09-20 for the sources that are included. Whereas, the latest WRT32X (FW_WRT32X_1.0.170828.208) firmware release of the same version number/name, the materials included are dated up until 2017-07-16.

So the more developer-minded folks here will understand what's included much better since that is above my skill level, but there quite likely is newer sources for kernel driver as well.

Does anyone know if these sources can be used to compiled a kernel driver for WRT3200ACM?

Hello! I used this lines to convert my wrt32x to a wrt3200acm with running lede. but a reboot fails. it seems like those env's arent persistent. surely i do "saveenv" before booting - i also checked fw_printenv and the output looks identical on mtdparts, bootargs etc...
Can you point me into a proper direction here?

Try using UsbFlash instead of NAND to load Openwrt/Lede. You only have to specify in the kernel that the Rootfs is located on the UsbFlash, not on the NAND.
How to use UsbFlash, see here -

1 Like