ASUS RT-N66U 5GHz WiFi support and memory expansion - need help!

I'm not sure if I'll find support for this old device, but I'd love to hear from enthusiasts in this thread. Objectively, everyone knows about ASUS's WiFi issues with Broadcom chips. (I find this surprising, but from a marketing perspective, the ability to install an open-source firmware is an undeniable advantage. However, that's not the focus of this discussion.) So, there is a B43 driver that doesn't support the second chip operating in the 5 GHz band and doesn't support the first chip well, limiting its capabilities to 802.11b/g protocols. A

fter looking at the b43 driver code for the bcm47xx platform, I saw a abyss. void. vacuum.. No patches. Nothing at all.

After paying attention to how the support is organized in the related bcm63xx platform, I made some caricatures and got the chips to work conditionally in the 2.4 GHz range. Obviously, I don't have enough knowledge about the native SPROM structure to make the chips work properly.

The success is that the firmware correctly identifies the chip addresses and connects the correct partitions of my SPROM, which probably contains incorrect data.

I ask the community to help me!

A few notes:

1. I am not a professional developer and I often have difficulties with programming. Sorry.

2. I`m use the Rooter build system so that I can later use advanced LTE modems. But I do not see any differences in native OpenWrt in terms of working with the device.

3. My code contains comments in Russian, sorry, it's more convenient for me.

Relevant links to the files and patches I created:

I added the logs of downloading different firmware versions to the ASUS RT-N66U page https://openwrt.org/toh/asus/rt-n66u

Can you diff iw phy outputs between "default" OpenWrt and your patched version? (I am just checking on you)

What you have to do is to supplant your patches in a branch of your own clone of OpenWrt source tree, then make a pull request. A bit of challenge 1st time but we can get you there....

1 Like

All files are new. They are not present in the default OpenWrt. The driver has been abandoned for a long time. You need to understand that this is not a Pull Request object. From my perspective, these are satirical sketches))) It takes a lot of work to make it work.

Try to re-base them on top of 6.12 ? If driver had no changes for last 5 years hopefully it is just some line numbers switching.

Yes, this is true, but I don't want to switch to a newer version because I'm using Rooter. I'm very satisfied with everything. You can take my files and experiment with them freely. If you share a positive experience, I'd appreciate it.

Been years since I used any broadcom device.
Can you set router aside, back up rooter config and try to get wifi part working on a normal OpenWrt. In principle rooter configs (the ones generated by their initial detection) should work also on OpenWrt, just needing one or other modem package. But OK, first check if wifi4 is not magically appearing in latest (24.10.5 or 25.12.0-rcX) OpenWrt.

This is not a problem. Magic only happens in movies and books, not in real life.

https://openwrt.org/toh/asus/rt-n66u#openwrt_bootlog

That basically says no 5ghz chance without upstream additions.
What is in iw phy of 2.4ghz part? (HT TX/RX MCS rate indexes supported: 0-15)
Do not add more than oem proprietary driver logs. No chance such will make into OpenWrt

I didn't understand the question... Both chips are dual-band. Theoretically, both could work, but there are also LNA/FEM and band-pass filters. They significantly attenuate the signal from the "wrong" band.

echo " _______ " > /etc/banner
echo " | |.-----.-----| |_ .-----..----." >> /etc/banner
echo " | || _ | _ | || -|| |" >> /etc/banner
echo " |
| _\ |||__||___||| " >> /etc/banner
echo " *** C E L L U L A R F R E E D O M ***" >> /etc/banner
echo " -----------------------------------------------------" >> /etc/banner
echo " $DISTRIB_DESCRIPTION" >> /etc/banner
echo " -----------------------------------------------------" >> /etc/banner


OpenWrt 23.05.5, r24106-10cc5fcd00

=== WARNING! =====================================

There is no root password defined on this device!
Use the "passwd" command to set up a new password
in order to prevent unauthorized SSH logins.

root@OpenWrt:~# iw phy
Wiphy phy1
wiphy index: 1
max # scan SSIDs: 4
max scan IEs length: 2285 bytes
max # sched scan SSIDs: 0
max # match sets: 0
Retry short limit: 7
Retry long limit: 4
Coverage class: 0 (up to 0m)
Available Antennas: TX 0x3 RX 0x3
Configured Antennas: TX 0x3 RX 0x3
Supported interface modes:
* IBSS
* managed
* AP
* AP/VLAN
* monitor
* mesh point
Band 1:
Frequencies:
* 2412 MHz [1] (20.0 dBm)
* 2417 MHz [2] (20.0 dBm)
* 2422 MHz [3] (20.0 dBm)
* 2427 MHz [4] (20.0 dBm)
* 2432 MHz [5] (20.0 dBm)
* 2437 MHz [6] (20.0 dBm)
* 2442 MHz [7] (20.0 dBm)
* 2447 MHz [8] (20.0 dBm)
* 2452 MHz [9] (20.0 dBm)
* 2457 MHz [10] (20.0 dBm)
* 2462 MHz [11] (20.0 dBm)
* 2467 MHz [12] (disabled)
* 2472 MHz [13] (disabled)
* 2484 MHz [14] (disabled)
interface combinations are not supported
HT Capability overrides:
* MCS: ff ff ff ff ff ff ff ff ff ff
* maximum A-MSDU length
* supported channel width
* short GI for 40 MHz
* max A-MPDU length exponent
* min MPDU start spacing
max # scan plans: 1
max scan plan interval: -1
max scan plan iterations: 0
Supported extended features:
* [ RRM ]: RRM
* [ FILS_STA ]: STA FILS (Fast Initial Link Setup)
* [ CQM_RSSI_LIST ]: multiple CQM_RSSI_THOLD records
* [ CONTROL_PORT_OVER_NL80211 ]: control port over nl80211
* [ TXQS ]: FQ-CoDel-enabled intermediate TXQs
* [ SCAN_RANDOM_SN ]: use random sequence numbers in scans
* [ SCAN_MIN_PREQ_CONTENT ]: use probe request with only rate IEs in scans
* [ CONTROL_PORT_NO_PREAUTH ]: disable pre-auth over nl80211 control port support
* [ DEL_IBSS_STA ]: deletion of IBSS station support
* [ SCAN_FREQ_KHZ ]: scan on kHz frequency support
* [ CONTROL_PORT_OVER_NL80211_TX_STATUS ]: tx status for nl80211 control port support
Wiphy phy0
wiphy index: 0
max # scan SSIDs: 4
max scan IEs length: 2285 bytes
max # sched scan SSIDs: 0
max # match sets: 0
Retry short limit: 7
Retry long limit: 4
Coverage class: 0 (up to 0m)
Available Antennas: TX 0x3 RX 0x3
Configured Antennas: TX 0x3 RX 0x3
Supported interface modes:
* IBSS
* managed
* AP
* AP/VLAN
* monitor
* mesh point

Band 1:
Frequencies:
* 2412 MHz [1] (20.0 dBm)
* 2417 MHz [2] (20.0 dBm)
* 2422 MHz [3] (20.0 dBm)
* 2427 MHz [4] (20.0 dBm)
* 2432 MHz [5] (20.0 dBm)
* 2437 MHz [6] (20.0 dBm)
* 2442 MHz [7] (20.0 dBm)
* 2447 MHz [8] (20.0 dBm)
* 2452 MHz [9] (20.0 dBm)
* 2457 MHz [10] (20.0 dBm)
* 2462 MHz [11] (20.0 dBm)
* 2467 MHz [12] (disabled)
* 2472 MHz [13] (disabled)
* 2484 MHz [14] (disabled)
interface combinations are not supported
HT Capability overrides:
* MCS: ff ff ff ff ff ff ff ff ff ff
* maximum A-MSDU length
* supported channel width
* short GI for 40 MHz
* max A-MPDU length exponent
* min MPDU start spacing
max # scan plans: 1
max scan plan interval: -1
max scan plan iterations: 0
Supported extended features:
* [ RRM ]: RRM
* [ FILS_STA ]: STA FILS (Fast Initial Link Setup)
* [ CQM_RSSI_LIST ]: multiple CQM_RSSI_THOLD records
* [ CONTROL_PORT_OVER_NL80211 ]: control port over nl80211
* [ TXQS ]: FQ-CoDel-enabled intermediate TXQs
* [ SCAN_RANDOM_SN ]: use random sequence numbers in scans
* [ SCAN_MIN_PREQ_CONTENT ]: use probe request with only rate IEs in scans
* [ CONTROL_PORT_NO_PREAUTH ]: disable pre-auth over nl80211 control port support
* [ DEL_IBSS_STA ]: deletion of IBSS station support
* [ SCAN_FREQ_KHZ ]: scan on kHz frequency support
* [ CONTROL_PORT_OVER_NL80211_TX_STATUS ]: tx status for nl80211 control port support
root@OpenWrt:~#include

Promises 2-antenna wifi4 2.4ghz.

3 antennas.

I still don't really understand what you're looking for…

The parts that are obvious, is that we're talking about:

  • ASUS RT-N66U
    • Broadcom BCM4706 600 MHz
    • 32 MB flash
    • 256 MB RAM
    • BCM4331 3x3 2.4 GHz WLAN
    • BCM4331 3x3 5 GHz WLAN

BCM4331 now is supported by two drivers:

  • brcmsmac
    • basically unmaintained
    • STA-only, AP mode not supported
    • 'fast', but useless for an AP/ wifi router
  • b43
    • orphaned
    • STA and AP mode supported
    • limited to 54 MBit/s, does not support HT/ VHT/ HE modes

Even if you improve the sprom handling and the related integration of the RT-N66U (and admittedly, I haven't quite gotten what you're working on exactly) into bcm47xx (which is not really seeing a flurry of development, but anything helps, I guess), what do you expect to happen with those changes? The best you could achieve (without serious driver development, which probably fail to see so far), is either getting/ keeping b43 work (2.4+5 GHz, <<54 MBit/s (~20 MBit/s in practice, if you're lucky)) - or switching over to brcmsmac, gaining performance, but losing AP mode capabilities.
Sounds to me like choosing between the black plague and cholera (but only one of those drivers supporting AP mode kind of makes the decision for you).

If you do want to do development, please do so on vanilla OpenWrt main/HEAD, no one here follows what rooter is doing (and what proprietary drivers they may include - or not), it just isn't a basis for discussion (here).

…but maybe I'm missing the crux of this topic, don't let yourself be discouraged by this.

I see 2 bits set in bitmap, 3 antennas would be 0x7
Please get iw phy from real OpenWrt 25.12 RC.

You're wrong. brcmsmac doesn't work on kernels newer than 4.xx.x, unfortunately. However, there's an error in the logs that I can't identify (I've tried). This error is even present in the 25.12.rc2 build. And by the way, even in this build, b43 drivers are used by default. The only way to make the device work is to continue developing b43, which has a lot of flaws and "software stubs." As for Rooter, this is solely your prejudice, since there is no reason to distinguish between vanilla and vanilla with add-ons for modems. If you do not include LUCI and modem packages in the build, then OpenWRT and Rooter will produce firmware images identical to the last bit)))

BusyBox v1.37.0 (2026-01-05 22:48:50 UTC) built-in shell (ash)


| |.-----.-----.-----.| | | |.----.| |_

| - || _ | -| || | | _ |
|
__|| |||||___||| ||
|__| W I R E L E S S F R E E D O M

OpenWrt 25.12.0-rc2, r32429-d76c64ad00

=== WARNING! =====================================

There is no root password defined on this device!
Use the "passwd" command to set up a new password
in order to prevent unauthorized SSH logins.

OpenWrt recently switched to the "apk" package manager!

OPKG Command APK Equivalent Description

opkg install apk add Install a package

opkg remove apk del Remove a package
opkg upgrade apk upgrade Upgrade all packages
opkg files apk info -L List package contents
opkg list-installed apk info List installed packages
opkg update apk update Update package lists
opkg search apk search Search for packages

For more information visit:

root@OpenWrt:~# iw phy
Wiphy phy0
wiphy index: 0
max # scan SSIDs: 4
max scan IEs length: 2285 bytes
max # sched scan SSIDs: 0
max # match sets: 0
Retry short limit: 7
Retry long limit: 4
Coverage class: 0 (up to 0m)
Available Antennas: TX 0x3 RX 0x3
Configured Antennas: TX 0x3 RX 0x3
Supported interface modes:
* IBSS
* managed
* AP
* AP/VLAN
* monitor
* mesh point
Band 1:
Frequencies:
* 2412.0 MHz [1] (20.0 dBm)
* 2417.0 MHz [2] (20.0 dBm)
* 2422.0 MHz [3] (20.0 dBm)
* 2427.0 MHz [4] (20.0 dBm)
* 2432.0 MHz [5] (20.0 dBm)
* 2437.0 MHz [6] (20.0 dBm)
* 2442.0 MHz [7] (20.0 dBm)
* 2447.0 MHz [8] (20.0 dBm)
* 2452.0 MHz [9] (20.0 dBm)
* 2457.0 MHz [10] (20.0 dBm)
* 2462.0 MHz [11] (20.0 dBm)
* 2467.0 MHz [12] (20.0 dBm) (no IR)
* 2472.0 MHz [13] (20.0 dBm) (no IR)
* 2484.0 MHz [14] (20.0 dBm) (no IR)
interface combinations are not supported
HT Capability overrides:
* MCS: ff ff ff ff ff ff ff ff ff ff
* maximum A-MSDU length
* supported channel width
* short GI for 40 MHz
* max A-MPDU length exponent
* min MPDU start spacing
max # scan plans: 1
max scan plan interval: -1
max scan plan iterations: 0
Supported extended features:
* [ RRM ]: RRM
* [ FILS_STA ]: STA FILS (Fast Initial Link Setup)
* [ CQM_RSSI_LIST ]: multiple CQM_RSSI_THOLD records
* [ CONTROL_PORT_OVER_NL80211 ]: control port over nl80211
* [ TXQS ]: FQ-CoDel-enabled intermediate TXQs
* [ SCAN_RANDOM_SN ]: use random sequence numbers in scans
* [ SCAN_MIN_PREQ_CONTENT ]: use probe request with only rate IEs in scans
* [ CONTROL_PORT_NO_PREAUTH ]: disable pre-auth over nl80211 control port support
* [ DEL_IBSS_STA ]: deletion of IBSS station support
* [ SCAN_FREQ_KHZ ]: scan on kHz frequency support

* [ CONTROL_PORT_OVER_NL80211_TX_STATUS ]: tx status for nl80211 control port support
* [ POWERED_ADDR_CHANGE ]: can change MAC address while up
root@OpenWrt:~#

1 Like

Nice, at least something already works.
Now try to supplant your patch over mainline/lts kernel.
Maybe file placement in directories is not optimal, but there are developers to teach good ways.

First, I want to get 5 GHz. This will really be a step forward. So far, I've only open the champagne bottle)) However, I don't have any ideas on how to get this. My suspicions that there's an unset flag in spom haven't been confirmed, and I've made 5-10 changes daily without success...

the main issue here is that the 2nd phy should work in 5GHz but is working in 2.4GHz, there should be a way to switch bands of the 2nd phy. I think that the solution could be found into others broadcom drivers of mainline kernel, but I didn't research….

@Demiurge67 Do I understand correctly that now you got 2.4GHz working with full mcs and 40MHz support in 2.4 band with open source driver?

I must admit that I didn't have time for a full-fledged health check. I limit myself to checking for a wifi signal on the radio- nothing more. And it's working. But the signal is very weak.

I need the help of experienced developers who are well-versed in the problems of Broadcom.

I have a few days to try to solve this problem. The colleagues who developed the b43 driver have done a lot to prevent the use of N and HT modes in the bcm4331 chip...

Nevertheless, I will not refuse the help of the esteemed community.