I'm trying to do some comparison testing of OpenWRT DD vs the factory firmware on the 1900acs.

I've got dd up on the device but I can't seem to revert back to the factory firmware. 

The wiki says to use the normal flash firmware procedure from Luci with the factory image.   When I try that however, the upload goes really, really slow. 1% every 5 or 6 seconds.  So slow that the upload times out before the upload completes.

Any ideas/suggestions?

I have similar problem. I would like to go back to factory firmware but instructions from wiki page are not working for me.

I got stuck in the process and after ~half an hour I just powered off the router. After few restarts router was accessible again.

Probably using mtd will be a solution, but I'm not sure yet how to do it. Maybe someone more experienced can help us?

Just to be little bit more precise about what I am not sure:

I tried to follow instructions which I found at http://wiki.openwrt.org/doc/techref/mtd:

wget http://cache-www.belkin.com/support/dl/FW_WRT1900ACS_1.0.0.168229_prod.img
mtd -r write /tmp/FW_WRT1900ACS_1.0.0.168229_prod.img firmware
Could not open mtd device: firmware
Can't open device for writing!

I am not sure what to try next without bricking the router. I would really like to avoid using usb to ttl cable

I'm working with r47278

EDIT:
===========
I checked /proc/mtd and there is no "firmware" device defined. No wonder then that that there is no easy way to revert factory firmware.

cat /proc/mtd
dev:    size   erasesize  name
mtd0: 00200000 00020000 "u-boot"
mtd1: 00040000 00020000 "u_env"
mtd2: 00040000 00020000 "s_env"
mtd3: 00100000 00020000 "devinfo"
mtd4: 02800000 00020000 "kernel1"
mtd5: 02200000 00020000 "rootfs1"
mtd6: 02800000 00020000 "kernel2"
mtd7: 02200000 00020000 "ubi"
mtd8: 02600000 00020000 "syscfg"
mtd9: 00680000 00020000 "unused_area"

Any ideas about what to do next with this issue? How to define "firmware" device or to which of existing devices write linksys firmware?

(Last edited by machnic on 28 Oct 2015, 23:17)

There's other stuff that also seems to be broken (at least in my build its broken).  I can't even flash a different OpenWRT version.

Deep in the sysupgrade scrips it tries to call 'fw_printenv' but fw_printenv errors with:

Cannot parse config file: No such file or directory

From what I see so far its looking for /etc/fw_env.config but that file does not exist.  I though it might just be my build but I  uncompressed the CC image and its not in that image either so perhaps that's not actually used.

Using the info from /proc/mtd I tried creating one with it set to /dev/mtd1 but fw_printenv complains the CRC does not match and its using defaults.

Can you upgrade to a different OpenWRT image?

I suppose we need some sort of chime in by a dev who knows how upgrade stuff is supposed to work.  Right now I don't have very much understanding.  I'll have to go look at the code for other mvebu devices and try to understand how its supposed to work

No, I'm also not able to upgrade to a different OpenWRT image

ok so not just something in my build.  I guess we should file a bug.

I've created a ticket

https://dev.openwrt.org/ticket/20827

Please add in what info you have.  I could not tell if you were using the CC build or your own trunk build.

Did you try sysupgrade (http://wiki.openwrt.org/doc/techref/sysupgrade)?
What you could do, is use sysupgrade on cli, to flash a newer or older -sysupgrade build.

i'd even expect that flashing to a cobra version (Wrt1900AC-V2) should work as the hardware is (nearly?) identical. From there you could use luci to revert back to stock.

I don't own a Linksys shelby, so I can't test the procedure. All advice is ofcourse for your own risk.

Ok, first things first:

I followed instructions from wiki page for WRT1900ACS (http://wiki.openwrt.org/toh/linksys/wrt1900acs) and chose
official trunk snapshot release from openwrt downloads page (https://downloads.openwrt.org/snapshots … u/generic/). To be precise, I'm using DESIGNATED DRIVER (Bleeding Edge, r47278)

When I wrote that I'm also not able to upgrade to a different OpenWRT image, I already tried to do it with sysupgrade command. After my first attemp to change firmware thru luci when my router got stuck, I decided to switch to terminal and be able to see what exactly is going wrong. I wanted to try with Kaloz snapshot available at https://downloads.openwrt.org/people/kaloz/ which is a second recommended version and then try to flash original linksys firmware using luci.

Output after using sysupgrade:

/tmp# /sbin/sysupgrade openwrt-mvebu-armada-385-linksys-shelby-squashfs-sysupgrade.tar 
Saving config files...
killall: watchdog: no process killed
Sending TERM to remaining processes ... crond uhttpd ntpd udhcpc odhcp6c dnsmasq ubusd askfirst logd rpcd netifd odhcpd 
Sending KILL to remaining processes ... askfirst 
Switching to ramdisk...
Performing system upgrade...
Cannot parse config file: No such file or directory
Cannot parse config file: No such file or directory
Error: environment not initialized
cannot find target partition

So as far as I understand the whole process, problem is more or less the same as when I tried to use mtd command:

• In case of sysupgrade the place where upgrade should be installed is not defined

• In case of using mtd there is no "firmware" or "linux" device defined and those are the only places/examples to put different firmware used at wiki page for mtd (http://wiki.openwrt.org/doc/techref/mtd)

The questions are:

• Which of existing devices defined in /proc/mtd shall I pass as parameter of mtd command or how the content of /proc/mtd should be modified to be able to flash the original linksys firmware back?

• I assume that even though WRT1900AC has less memory, content of /proc/mtd is organized in analogical way. Does anyone know how exactly updates are performed in case of WRT1900AC?

(Last edited by machnic on 30 Oct 2015, 19:50)

I managed to go back to original firmware.

This post and two next gave me an answer to my questions.

In short:
Instead of one device "firmware" or "linux" defined in /proc/mtd, in WRT1900AC and WRT1900ACS we have two of them: "kernel1" and "kernel2" which are redundant. When current firmware is running on first, upgrade should be flashed on second. Then there is a possibility to go back if something will go wrong. After flashing it's needed to switch to second flash.

More words:
I found a script /lib/upgrade/linksys.sh which is doing it automatically, but somehow it didn't work for us when we tried to revert to factory firmware thru luci.

Description of how to determine which "kernel" we are currently using is available under the link above.

/proc/mtd in my case looked like that:

root@OpenWrt:~# cat /proc/mtd
dev:    size   erasesize  name
mtd0: 00200000 00020000 "u-boot"
mtd1: 00040000 00020000 "u_env"
mtd2: 00040000 00020000 "s_env"
mtd3: 00100000 00020000 "devinfo"
mtd4: 02800000 00020000 "kernel1"
mtd5: 02200000 00020000 "rootfs1"
mtd6: 02800000 00020000 "kernel2"
mtd7: 02200000 00020000 "ubi"
mtd8: 02600000 00020000 "syscfg"
mtd9: 00680000 00020000 "unused_area"

Following the instructions I chose to flash new firmware to "kernel1". Then I went to /tmp and used wget do download original firmware from linksys website. At the end I used mtd to flash the data.

root@OpenWrt:~# cd /tmp
root@OpenWrt:/tmp# wget http://cache-www.belkin.com/support/dl/FW_WRT1900ACS_1.0.0.168229_prod.img
Connecting to cache-www.belkin.com (54.231.112.128:80)
FW_WRT1900ACS_1.0.0. 100% |**************************************************************************************************************************************************************| 29952k  0:00:00 ETA
root@OpenWrt:/tmp# mtd -r write FW_WRT1900ACS_1.0.0.168229_prod.img kernel1
Unlocking kernel1 ...

Writing from FW_WRT1900ACS_1.0.0.168229_prod.img to kernel1 ...     
Rebooting ...
Write failed: Broken pipe

When I saw that write failed, I wasn't very happy. Especially because yet again I was not able to login via ssh, so I tried to switch to second flash. I did something similar to instructions at http://wiki.openwrt.org/toh/linksys/wrt … e_recovery
In my case PWR led doesn't blink after pressing reset button for 15 seconds, so:

• I switched off the router

• Switched it on and switched it off again when only pwr led started to blink. I repeated that 3 times

• After 4th switching on linksys firmware was booting.

I'm wondering if I was just lucky and I only think that I know what I did, or that's the real way of going back to original firmware.

smithbone - if you will try to do it this way, please let me know if it also worked for you. If yes, then I will add some info to wiki page.

If anyone see that I wrote something that is not entirely true, then also please share that info with me

(Last edited by machnic on 31 Oct 2015, 02:52)

i have this problem as well and have not found a solution just yet.  any input at all would be greatly appreciated.

my goal is to get the factory firmware flashed back onto my router, i don't feel that the openwrt firmware for this hardware revision is quite ready for prime time just yet.

You mean, that solution which worked for me, didn't work for you, you didn't dare to try or you didn't even bother to read previous posts?

i had reviewed your, and previous posts, none of which were particularly clear or certain.  you've provided more information than i've found anywhere else in my search so don't get me wrong, i appreciate the help.

how were you able to determine which kernel[1|2] partition is currently in use?

When you follow this link, you will find leitec's description of how to check which kernel/flash you are currently using:

In my case the content of /proc/mtd looked almost the same, so I also chose to write linksys firmware into "kernel1". I don't know if this is the right way to determine which kernel/flash is currently used, but it worked for me.

If anything else is not clear for you, don't hesitate to ask.

ah ha, that's the part i missed.  here's what i have:

dev:    size   erasesize  name
mtd0: 00200000 00020000 "u-boot"
mtd1: 00040000 00020000 "u_env"
mtd2: 00040000 00020000 "s_env"
mtd3: 00100000 00020000 "devinfo"
mtd4: 02800000 00020000 "kernel1"
mtd5: 02200000 00020000 "rootfs1"
mtd6: 02800000 00020000 "kernel2"
mtd7: 02200000 00020000 "ubi"
mtd8: 02600000 00020000 "syscfg"
mtd9: 00680000 00020000 "unused_area"

i'll write FW_WRT1900ACS_1.0.0.168229_prod.img to kernel1 when i have a chance later, thanks for clearing that up.

this worked great, thanks for the help.

I have not tried your method, but I believe I have figured out the problem.

The sysupgrade script does not work because fw_printenv fails.  fw_printenv fails because /etc/fw_env.config does not exist. 

fw_env.config is auto-generated by /etc/uci-defaults/30_uboot-envtools .

However that script is missing a definition for the the 1900acs board rev

board=$(mvebu_board_name)

case "$board" in
armada-385-linksys-caiman|armada-385-linksys-cobra)
        ubootenv_add_uci_config "/dev/mtd1" "0x0" "0x20000" "0x40000"
        ;;
armada-xp-linksys-mamba)
        ubootenv_add_uci_config "/dev/mtd1" "0x0" "0x40000" "0x20000"
        ;;
esac

The first line needs to be:

       armada-385-linksys-caiman|armada-385-linksys-cobra|armada-385-linksys-shelby)

After I correct that and re-run the config sysupgrade works and I can flash in new openwrt.

Update

So turns out that scripts that exit with 0 are deleted out of /etc/uci-defaults so my empty /etc/uci-defaults is probably normal.  I've got a patch now for uboot-envtools that should fix this.  I'll test it later on tonight.

(Last edited by smithbone on 2 Nov 2015, 17:18)

Fixed in r47365

So the sysupgrade bug is fixed but the original problem still exists.  When I try to upload the factory firmware via the webui it goes very slow and times out.

@smithbone

i have this problem.

my router is wrt1900ac v2

root@OpenWrt ~# cat /proc/mtd
dev:    size   erasesize  name
mtd0: 00200000 00020000 "u-boot"
mtd1: 00040000 00020000 "u_env"
mtd2: 00040000 00020000 "s_env"
mtd3: 00100000 00020000 "devinfo"
mtd4: 02800000 00020000 "kernel1"
mtd5: 02200000 00020000 "ubi"
mtd6: 02800000 00020000 "kernel2"
mtd7: 02200000 00020000 "rootfs2"
mtd8: 02600000 00020000 "syscfg"
mtd9: 00680000 00020000 "unused_area"

"/etc/uci-defaults" is empty

What should I do?

Thanks

@smithbone

Really, the easiest way is to just invest in a 5 dollar USB/TTL cable and flash. With the ACS the connection is exposed, so you don't have to pull the entire device apart (Just 2 screws).

davidc502, do you know any step-by-step tutorial how to flash WRT1900xxx using TTL?

Tried this -> nothing happened. The router restarted though, however no changes in the firmware were made

Step by step can be found on the 1900acx wiki.

https://wiki.openwrt.org/toh/linksys/wrt_ac_series