Enabling 5G wifi on Linksys WRT610N v2 results in kernel panic / reboot loop

I have a Linksys WRT610N V2 that I'd like to get functional again, it had OpenWRT on it many years ago and failed to come back from an update at some point so I've soldered on the serial pins and can connect to the console. After a bit of fiddling I was able to reset it and upgrade the firmware to 18.06.4.

Mostly the device seems fully functional however when I enable the second WiFi interface radio1 in LuCI I get a kernel panic and the device goes in to a reboot loop:

root@OpenWrt:/# [  330.126640] b43-phy1: Loading firmware version 666.2 (2011-02-23 01:15:07)
[  330.183370] Data bus error, epc == 801c7908, ra == 80254e4c
[  330.189047] Oops[#1]:
[  330.191377] CPU: 0 PID: 1959 Comm: hostapd Not tainted 4.14.131 #0
[  330.197652] task: 839b1600 task.stack: 833bc000
[  330.202257] $ 0   : 00000000 1100bc00 00000002 1100bc03
[  330.207597] $ 4   : a80003fa 8381f858 00000108 00007000
[  330.212930] $ 8   : 0000002e 00000000 00000001 833bdbf4
[  330.218263] $12   : 00000000 00000006 00000002 00000000
[  330.223595] $16   : 8381f800 8381f858 000003fa 8381fb28
[  330.228929] $20   : 8381f834 00000017 00000007 00000002
[  330.234260] $24   : 00000000 80254dec                  
[  330.239594] $28   : 833bc000 833bdb08 82c4e600 80254e4c
[  330.244927] Hi    : 00000006
[  330.247858] Lo    : a8f5c2aa
[  330.250795] epc   : 801c7908 0x801c7908
[  330.254691] ra    : 80254e4c 0x80254e4c
[  330.258585] Status: 1100bc03 KERNEL EXL IE 
[  330.262855] Cause : 4080881c (ExcCode 07)
[  330.266930] PrId  : 00019740 (MIPS 74Kc)
[  330.270913] Modules linked in: pppoe ppp_async b43 pppox ppp_generic nf_conntrack_ipv6 mac80211 iptable_nat ipt_REJECT ipt_MASQUERADE cfg80211 bgmac_bcma xt_time xt_tcpudp xt_state xt_nat xt_multipord
[  330.342789] Process hostapd (pid: 1959, threadinfo=833bc000, task=839b1600, tls=77feedc0)
[  330.351081] Stack : 804bea98 80430000 00000001 801fee90 00000000 8001ddc0 82c22c30 82c22c30
[  330.359607]         00000000 833bdb40 8043c9f8 00000001 00000001 0c080083 00000001 0c080083
[  330.368133]         00000080 00000000 00000004 80492324 00000001 830f0404 00000007 00000002
[  330.376662]         82c4e600 830f0400 00000000 00000095 00007000 83194dac 00000008 1100bc00
[  330.385188]         80492324 00000074 831cb330 00000095 00007000 833bdbc0 82c4e600 80262768
[  330.393715]         ...
[  330.396215] Call Trace:
[  330.396232] [<801fee90>] 0x801fee90
[  330.402259] [<8001ddc0>] 0x8001ddc0
[  330.405861] [<83194dac>] 0x83194dac [b43@83180000+0x579d0]
[  330.411444] [<80262768>] 0x80262768
[  330.415012] [<83194d48>] 0x83194d48 [b43@83180000+0x579d0]
[  330.420595] [<83193550>] 0x83193550 [b43@83180000+0x579d0]
[  330.426178] [<83193c98>] 0x83193c98 [b43@83180000+0x579d0]
[  330.431763] [<83197cf4>] 0x83197cf4 [b43@83180000+0x579d0]
[  330.437374] [<831944e0>] 0x831944e0 [b43@83180000+0x579d0]
[  330.442981] [<83194558>] 0x83194558 [b43@83180000+0x579d0]
[  330.448575] [<831879c4>] 0x831879c4 [b43@83180000+0x579d0]
[  330.454143] [<8026ceb4>] 0x8026ceb4
[  330.457713] [<83188414>] 0x83188414 [b43@83180000+0x579d0]
[  330.463304] [<832032d0>] 0x832032d0 [mac80211@83200000+0x68220]
[  330.469326] [<83217744>] 0x83217744 [mac80211@83200000+0x68220]
[  330.475348] [<8028b4d8>] 0x8028b4d8
[  330.478908] [<8028b824>] 0x8028b824
[  330.482469] [<8028b910>] 0x8028b910
[  330.486020] [<802a8950>] 0x802a8950
[  330.489573] [<80308bb8>] 0x80308bb8
[  330.493122] [<802a8950>] 0x802a8950
[  330.496686] [<802696a4>] 0x802696a4
[  330.500256] [<800edd14>] 0x800edd14
[  330.503813] [<8026ad00>] 0x8026ad00
[  330.507376] [<800ede04>] 0x800ede04
[  330.510924] [<8000fc98>] 0x8000fc98
[  330.514482] 
[  330.516000] Code: 03e00008  00000000  94820000 <3042ffff> 0000000f  03e00008  00000000  8c820000  0000000f 
[  330.525953] 
[  330.528210] ---[ end trace 9da935c8195ccf15 ]---
[  330.536944] Kernel panic - not syncing: Fatal exception
[  330.544502] Rebooting in 3 seconds..
[  333.543625] bcm47xx: Please stand by while rebooting the system...


CFE version 1.0.37 for BCM947XX (32bit,SP,LE)
Build Date: Fri Jul 10 15:25:09 CST 2009 (ljh@team2-complier)
Copyright (C) 2000-2008 Broadcom Corporation.

Init Arena
Init Devs.

No DPN
This is a Parallel Flash
Boot partition size = 262144(0x40000)
et0: Broadcom BCM47XX 10/100/1000 Mbps Ethernet Controller 5.10.56.51
CPU type 0x19740: 480MHz
Tot mem: 65536 KBytes

CFE mem:    0x80700000 - 0x8079DA10 (645648)
Data:       0x80732970 - 0x80736FD0 (18016)
BSS:        0x80736FD0 - 0x80737A10 (2624)
Heap:       0x80737A10 - 0x8079BA10 (409600)
Stack:      0x8079BA10 - 0x8079DA10 (8192)
Text:       0x80700000 - 0x8073296C (207212)

Boot version: v4.2
The boot is CFE

mac_init(): Find mac [98:FC:11:75:C7:D0] in location 0
Nothing...
country_init(): Find country code in location 0
The country is same
Device eth0:  hwaddr 98-FC-11-75-C7-D0, ipaddr 192.168.1.1, mask 255.255.255.0
        gateway not set, nameserver not set
Check CRC of image1
  Header CRC:    0x25B84DC8
  Calculate CRC: 0x25B84DC8
Image 1 is OK
Try to load image 1.
Loader:raw Filesys:tftp Dev:eth0 File:: Options:(null)
Loading: Failed.
Could not load :: Timeout occured
Loader:raw Filesys:raw Dev:flash0.os File: Options:(null)
Loading: .. 3832 bytes read
Entry at 0x80001000
Closing network.
Starting program at 0x80001000
[...crashes similarly during boot and loops...]

Is this likely to be hardware that's destined for the scrap heap or is this possibly a bug in the way OpenWRT is driving the 5G WiFi that I can help debug?

I can recover functionality on the device by entering failsafe mode and either running firstboot or running mount_root and disabling radio1 in /etc/config/wireless - obviously I'd like working 5G wireless though :slight_smile:

According to the device page, 5ghz isn't supported on your device -

* The b43 wireless driver doesn't support 11n modes (HT) or 5Ghz. The closed-source wl can be used for both.

Of course it does say the closed source driver works, but I don't know how to install it on OpenWrt or if it's even possible unfortunately.

edit - I guess I should have read the whole page, it looks like you can install the proprietary driver if you make your own build, which really isn't too hard, the directions are linked on the device page.

1 Like

Thanks, I didn't think to look at that given it was just sitting there in the UI I figured the driver must be working.

I'll have a go at a custom build.