OpenWrt Forum Archive

Topic: Netgear R6100 (AR9XXXX + Qualcomm)

The content of this topic has been archived between 29 Mar 2018 and 17 Apr 2018. There are no obvious gaps in this topic, but there may still be some posts missing at the end.

Hey Kids,

This router looks very much like the WNDR4300, (and WNDR3700)

For completeness's sake, this router has an FCCID of PY312400225

I cobbled together a serial cable and put it on the breakout header to get the boot info.
Here's the bit at the beginning of it.

U-Boot 1.1.4 (Jun 27 2013 - 10:48:26)

U-boot dni29 V0.9 for DNI HW ID: 29764434 flash 128MB RAM 128MB 1st Radio 2x2 2nd Radio 2x2


DRAM:  128 MB
Atheros on-chip NAND FLash Controller Driver, Version 0.1 (c) 2010 Atheros Communications, Ltd.
Ath Nand ID[87ff1178]: 2c:f1:80:95:04
ONFI MICRON      MT29F1G08ABAEAWP
Micron NAND 128MiB 3,3V 8-bit [128MB]
====== NAND Parameters ======
sc = 0x87ff1158 bbt = 0x87f68008 bbt_size = 0x100 nf_ctrl = 0x344
page = 0x800 block = 0x20000 oob = 0x40
size = 128MB
Setting 0xb8116290 to 0x48902d0f
Using default environment

In:    serial
Out:   serial
Err:   serial
 131072 bytes read: OK
Net:   ag934x_enet_initialize...
 4096 bytes read: OK
Fetching MAC Address from 0x87fe82f8
 4096 bytes read: OK
Fetching MAC Address from 0x87fe82f8
 wasp  reset mask:c02300
WASP ----> S27 PHY
: cfg1 0x80000000 cfg2 0x7114
eth0: 44:94:fc:98:0b:c3
s27 reg init
athrs27_phy_setup ATHR_PHY_CONTROL 0 :1000
athrs27_phy_setup ATHR_PHY_SPEC_STAUS 0 :10
eth0 up
WASP ----> S27 PHY
WASP ----> S27 PHY
: cfg1 0xf cfg2 0x7214
eth1: 44:94:fc:98:0b:c2
s27 reg init lan
ATHRS27: resetting s27
ATHRS27: s27 reset done
athrs27_phy_setup ATHR_PHY_CONTROL 1 :1000
athrs27_phy_setup ATHR_PHY_SPEC_STAUS 1 :10
athrs27_phy_setup ATHR_PHY_CONTROL 2 :1000
athrs27_phy_setup ATHR_PHY_SPEC_STAUS 2 :10
athrs27_phy_setup ATHR_PHY_CONTROL 3 :1000
athrs27_phy_setup ATHR_PHY_SPEC_STAUS 3 :10
athrs27_phy_setup ATHR_PHY_CONTROL 4 :1000
athrs27_phy_setup ATHR_PHY_SPEC_STAUS 4 :10
eth1 up
eth0, eth1
Hit any key to stop autoboot:  2 ^H^H^H 1 ^H^H^H 0


And here it is running, apparently, a custom version of OpenWRT, in ths stock firmware!

Loading from device 0: ath-nand (offset 0x1a0000)

** check kernel image **
   Verifying Checksum ... OK

** check rootfs image **
   Verifying Checksum ... OK
## Booting image at 81000000 ...
   Image Name:   MIPS OpenWrt Linux-2.6.31
   Created:      2013-06-04  10:51:12 UTC
   Image Type:   MIPS Linux Kernel Image (lzma compressed)
   Data Size:    1179456 Bytes =  1.1 MB
   Load Address: 80002000
   Entry Point:  80269860
   Verifying Checksum ... OK
   Uncompressing Kernel Image ... OK

Starting kernel ...

Booting Atheros AR934x

Is it common practice for big corporations like Netgear to basically just use OpenWRT and then not release their sources?

Just for the FYI, the pinout for the serial header on this router is:

Pin1 -> vcc
pin2 -> TX
pin3 -> RX
pin4 -> GND

I am going to see if I can build a custom openWRT firmware for this device using the u-boot menu to upload new test images.


If anyone is interested, I can provide the full boot log from this device.

any update ? recently ,i have some R6100 and working to build a firmware to use it.

It's listed in Netgear GPL downloads, don't know if it was at the time author posted.

Look at the kernel, it's 2.6. Just like with e.g. the WNDR3700, it's an old OpenWrt version.

Any updates on this?

Did any of you manage to get the 5G radio going with the ath10k kernel module? I just get syslogs spammed and eventually kernel panics

Edit: There's another thread mentioning this as well – Netgear R6100 801.11ac NOT working on Chaos Calmer final release

(Last edited by johndoe on 22 Oct 2015, 01:21)

For anyone else having difficulties. The firmware shipped with ath10k fails to recognize the device and causes a firmware crash. A fix has been added to the CT Firmware for ath10k found here http://www.candelatech.com/ath10k.php

>A fix has been added to the CT Firmware for ath10k found here http://www.candelatech.com/ath10k.php
Unfortunately, does not work in any way on my R6100:

[   14.320000] PCI: Enabling device 0000:00:00.0 (0000 -> 0002)
[   14.330000] ath10k_pci 0000:00:00.0: pci irq legacy interrupts 0 irq_mode 0 reset_mode 0
[   14.550000] ath10k_pci 0000:00:00.0: Direct firmware load for ath10k/cal-pci-0000:00:00.0.bin failed with error -2
[   14.560000] ath10k_pci 0000:00:00.0: Falling back to user helper
[   14.660000] firmware ath10k!cal-pci-0000:00:00.0.bin: firmware_loading_store: map pages failed
[   14.670000] ath10k_pci 0000:00:00.0: Direct firmware load for ath10k/QCA988X/hw2.0/firmware-4.bin failed with error -2
[   14.680000] ath10k_pci 0000:00:00.0: Falling back to user helper
[   14.780000] firmware ath10k!QCA988X!hw2.0!firmware-4.bin: firmware_loading_store: map pages failed
[   14.790000] ath10k_pci 0000:00:00.0: could not fetch firmware file 'ath10k/QCA988X/hw2.0/firmware-4.bin': -11
[   14.800000] ath10k_pci 0000:00:00.0: Direct firmware load for ath10k/QCA988X/hw2.0/firmware-3.bin failed with error -2
[   14.810000] ath10k_pci 0000:00:00.0: Falling back to user helper
[   14.900000] firmware ath10k!QCA988X!hw2.0!firmware-3.bin: firmware_loading_store: map pages failed
[   14.910000] ath10k_pci 0000:00:00.0: could not fetch firmware file 'ath10k/QCA988X/hw2.0/firmware-3.bin': -11
[   14.920000] ath10k_pci 0000:00:00.0: Direct firmware load for ath10k/QCA988X/hw2.0/firmware-2.bin failed with error -2
[   14.930000] ath10k_pci 0000:00:00.0: Falling back to user helper
[   15.030000] firmware ath10k!QCA988X!hw2.0!firmware-2.bin: firmware_loading_store: map pages failed
[   15.040000] ath10k_pci 0000:00:00.0: could not fetch firmware file 'ath10k/QCA988X/hw2.0/firmware-2.bin': -11
[   15.050000] ath10k_pci 0000:00:00.0: Direct firmware load for ath10k/QCA988X/hw2.0/firmware.bin failed with error -2
[   15.060000] ath10k_pci 0000:00:00.0: Falling back to user helper
[   15.160000] firmware ath10k!QCA988X!hw2.0!firmware.bin: firmware_loading_store: map pages failed
[   15.160000] ath10k_pci 0000:00:00.0: could not fetch firmware (-11)
[   15.170000] ath10k_pci 0000:00:00.0: could not fetch firmware files (-11)
[   15.180000] ath10k_pci 0000:00:00.0: could not probe fw (-11)

This is with keeping the firmware name to "firmware-5.bin" as instructed on http://www.candelatech.com/ath10k-10.2.php

To me that looks like it never ever tries to load "firmware-5.bin". I am using OpenWRT stock "kmod-ath10k" module

>To me that looks like it never ever tries to load "firmware-5.bin".
If I rename the above "firmware-5.bin" (from  http://www.candelatech.com/ath10k-10.2.php) to "firmware-4.bin", at least the firmware gets loaded, but crashes:

[ 1411.180000] ath10k_pci 0000:00:00.0: firmware crashed! (uuid 3721a391-0e65-4c0f-81a8-a22870c24954)
[ 1411.190000] ath10k_pci 0000:00:00.0: qca988x hw2.0 (0x4100016c, 0x043222ff) fw 10.2.4.97-1-ct-com-F-001-b0f9b0 api 4 htt 2.1 wmi 5 cal otp max_sta 128
[ 1411.200000] ath10k_pci 0000:00:00.0: debug 0 debugfs 1 tracing 0 dfs 1 testmode 1
[ 1411.210000] ath10k_pci 0000:00:00.0: firmware register dump:
[ 1411.220000] ath10k_pci 0000:00:00.0: [00]: 0x4100016C 0x00000000 0x0098E1CD 0x00000000
[ 1411.230000] ath10k_pci 0000:00:00.0: [04]: 0x00000000 0x00060324 0x00000000 0x00000000
[ 1411.240000] ath10k_pci 0000:00:00.0: [08]: 0x00000000 0x00000000 0x00000000 0x00000000
[ 1411.240000] ath10k_pci 0000:00:00.0: [12]: 0x00000000 0x00000000 0x00000000 0x00000000
[ 1411.250000] ath10k_pci 0000:00:00.0: [16]: 0x009C1953 0x0094085D 0x00000000 0x0098E1CD
[ 1411.260000] ath10k_pci 0000:00:00.0: [20]: 0x809430B8 0x00401A40 0x00000001 0x00000002
[ 1411.270000] ath10k_pci 0000:00:00.0: [24]: 0x80940975 0x00401A60 0x0000001F 0x00403BEC
[ 1411.280000] ath10k_pci 0000:00:00.0: [28]: 0x409406B9 0x00401A80 0x0000001F 0x004208DC
[ 1411.280000] ath10k_pci 0000:00:00.0: [32]: 0x00000000 0x00401AA0 0x00050024 0x00000002
[ 1411.290000] ath10k_pci 0000:00:00.0: [36]: 0x00000000 0x00000000 0x00000000 0x00000000
[ 1411.300000] ath10k_pci 0000:00:00.0: [40]: 0x00000000 0x00000000 0x00000000 0x00000000
[ 1411.310000] ath10k_pci 0000:00:00.0: [44]: 0x00000000 0x00000000 0x00000000 0x00000000
[ 1411.320000] ath10k_pci 0000:00:00.0: [48]: 0x00000000 0x00000000 0x00000000 0x00000000
[ 1411.320000] ath10k_pci 0000:00:00.0: [52]: 0x00000000 0x00000000 0x00000000 0x00000000
[ 1411.330000] ath10k_pci 0000:00:00.0: [56]: 0x00000000 0x00000000 0x00000000 0x00000000
[ 1411.340000] ath10k_pci 0000:00:00.0: failed to request monitor vdev 1 start: -143
[ 1411.350000] ath10k_pci 0000:00:00.0: failed to start monitor vdev: -143
[ 1411.360000] ath10k_pci 0000:00:00.0: failed to request wmi monitor vdev 1 removal: -143
[ 1411.360000] ath10k_pci 0000:00:00.0: failed to recalc montior: -143
[ 1411.370000] ath10k_pci 0000:00:00.0: device successfully recovered
[ 1411.480000] ieee80211 phy0: Hardware restart was requested
[ 1411.720000] ath10k_pci 0000:00:00.0: otp stream is empty, using board.bin contents

On Linux embedded I am a novice, so I don't really understand why the firmware's name must or should be "firmware-5.bin": hard coded file names in the driver ? So maybe the OpenWRT stock driver "kmod-ath10k" is not compatible with Candelatech's update firmware "firmware-5-ct-full-community.bin" ?

Interesting... Using the 10.1 firmware ("firmware-2.bin") from http://www.candelatech.com/ath10k-10.1.php, 5G now works now on my R6100:

[   15.820000] ath10k_pci 0000:00:00.0: qca988x hw2.0 (0x4100016c, 0x043222ff) fw 10.1.467-ct-com-full-015-5e361c api 2 htt 2.1 wmi 2 cal otp max_sta 128
[   15.830000] ath10k_pci 0000:00:00.0: debug 0 debugfs 1 tracing 0 dfs 1 testmode 1

There are some repeating messages, which I don't understand :-)
[   25.900000] ath10k_pci 0000:00:00.0: otp stream is empty, using board.bin contents
[ 2210.480000] ath10k_pci 0000:00:00.0: otp stream is empty, using board.bin contents
[ 2499.210000] ath10k_pci 0000:00:00.0: otp stream is empty, using board.bin contents

Kind of "...works, no idea why..."

I'm trying to set up the R6100 for the 5G radio, but no luck so far.
I assume that to use the firmware from Candela Tech, it's needed to first install the OpenWrt package 'kmod-ath10k', so I did that.

Then I try to replace the file in /lib/firmware/ath10k/QCA988X/hw2.0/ with the one from Candela, but that doesn't match. Candela says to use firmware-2.bin, but I have firmware-4.bin from the package. I tried to use the file from Candela and rename it to firmware-4.bin (Ath10k CT 10.1), but it doesn't work. They don't recommend Ath10k CT 10.2.4, which provides a file named firmware-5.bin, but I also tried, no more luck.

Or maybe it's installed correctly and it's a problem of configuring it. Here is the dmesg log I get replacing firmware-4.bin from the OpenWrt package with firmware-2.bin from Candela:

# rmmod ath10k_pci
# modprobe ath10k_pci
# dmesg | grep ath10k
[...] ath10k_pci 0000:00:00.0: pci irq legacy interrupts 0 irq_mode 0 reset_mode 0
[...] ath10k_pci 0000:00:00.0: Direct firmware load for ath10k/cal-pci-0000:00:00.0.bin failed with error -2
[...] ath10k_pci 0000:00:00.0: Falling back to user helper
[...] firmware ath10k!cal-pci-0000:00:00.0.bin: firmware_loading_store: map pages failed
[...] ath10k_pci 0000:00:00.0: Unknown FW IE: 30
[...] ath10k_pci 0000:00:00.0: otp stream is empty, using board.bin contents
[...] ath10k_pci 0000:00:00.0: qca988x hw2.0 (0x4100016c, 0x043222ff) fw 10.1.467-ct-com-full-015-5e361c api 4 htt 2.1 wmi 2 cal otp max_sta 128
[...] ath10k_pci 0000:00:00.0: debug 0 debugfs 1 tracing 0 dfs 1 testmode 1

It seems like the problem described above has been fixed in 15.05.1. My AC radio (Qualcomm Atheros QCA9880 802.11nac (radio1)) has worked since upgrading OpenWRT.

Great work! Really appreciate it!

Indeed, it works out of the box with 15.05.1 and kmod-ath10k!

Forgive me, as I am new to this. I am able to successfully flash 15.05 to my R6100. When I build 15.05.1 myself, I do not see the image for this router in the build directory but I see images for other routers with this chipset. I chose the correct model in menconfig. What am I missing here?

(Last edited by jahway603 on 18 May 2016, 20:05)

*bump due to spammer*

Are you looking in the correct location?  I believe this firmware image would be in a nand subdirectory.

rayknight wrote:

Are you looking in the correct location?  I believe this firmware image would be in a nand subdirectory.

After building I look in openwrt/bin/ar71xx and can't find a bin image for the R6100. Should I be looking somewhere else?

I may be wrong, but I believe it would be in openwrt/bin/ar71xx/nand directory.

rayknight wrote:

I may be wrong, but I believe it would be in openwrt/bin/ar71xx/nand directory.

I don't see a nand directory there and I chose my R6100 nand router in menuconfig. I see others in this thread successfully using 15.05.1 and I want to build my own.

(Last edited by jahway603 on 19 May 2016, 02:50)

after seeing dd-wrt doesn't have a firmware for the netgear r6100 i found this thread.

i'd like to shake the dust off this old unit now that i see this openWRT 15.05.1 works for this hardware.

do i need two firmware images? the "CT 15.05.1" and "kmod-ath10k" or just one?
i found the https://downloads.openwrt.org/chaos_calmer/15.05.1/ , someone help me out on which to download?

tia

SrZNm wrote:

do i need two firmware images? the "CT 15.05.1" and "kmod-ath10k" or just one?
i found the https://downloads.openwrt.org/chaos_calmer/15.05.1/ , someone help me out on which to download?

tia

You do need 15.0.1, and I just installed it on my R6100.
I'm still trying to figure out all the commands to install kmod-ath10k
If someone has the commands, that would be awesome.

moulliet wrote:

You do need 15.0.1, and I just installed it on my R6100.
I'm still trying to figure out all the commands to install kmod-ath10k
If someone has the commands, that would be awesome.

thanks for reply. i forgot to "subscribe" to thread, so delay in reply.

this is a start as i've never used openwrt.  let me see if i got this correct,

we install the "CT 15.05.1" version then download and install the correct ath10k firmware from this page,

     https://wireless.wiki.kernel.org/en/use … k/firmware

and rename the firmware bin file per instructions on that page?

i'll give this a try and report back results...

moulliet wrote:
SrZNm wrote:

do i need two firmware images? the "CT 15.05.1" and "kmod-ath10k" or just one?
i found the https://downloads.openwrt.org/chaos_calmer/15.05.1/ , someone help me out on which to download?

tia

You do need 15.0.1, and I just installed it on my R6100.
I'm still trying to figure out all the commands to install kmod-ath10k
If someone has the commands, that would be awesome.

i got it to boot with :
  openwrt-15.05.1-ar71xx-nand-r6100-ubi-factory.img
  openwrt-15.05.1-ar71xx-nand-r6100-squashfs-sysupgrade.tar

trying the firmware for 5.0GHz radio,  https://wireless.wiki.kernel.org/en/use … k/firmware via the Ath10k Candela page, hasn't proved successful. 'dmesg' doesn't show that firmware driver even loading. i suspect maybe i've performed that install incorrectly.

After installing "kmod-ath10k" from OpenWrt package respository on 15.05.1, I got 5.0GHz work on my China version R6100.

OEM Firmware Version 1.2.0.4
GPL Source Code for 1.2.0.4


But there seem to be some problems.

OpenWrt Kernel Log:

... ...
[   15.240000] PCI: Enabling device 0000:00:00.0 (0000 -> 0002)
[   15.240000] ath10k_pci 0000:00:00.0: pci irq legacy interrupts 0 irq_mode 0 reset_mode 0
[   15.460000] ath10k_pci 0000:00:00.0: Direct firmware load for ath10k/cal-pci-0000:00:00.0.bin failed with error -2
[   15.470000] ath10k_pci 0000:00:00.0: Falling back to user helper
[   15.560000] firmware ath10k!cal-pci-0000:00:00.0.bin: firmware_loading_store: map pages failed
[   15.750000] ath10k_pci 0000:00:00.0: otp stream is empty, using board.bin contents
[   16.780000] ath10k_pci 0000:00:00.0: qca988x hw2.0 (0x4100016c, 0x043222ff) fw 10.2.4.45 api 4 htt 2.1 wmi 5 cal otp max_sta 128
[   16.790000] ath10k_pci 0000:00:00.0: debug 0 debugfs 1 tracing 0 dfs 1 testmode 1
... ...
[10033.360000] ath10k_pci 0000:00:00.0: otp stream is empty, using board.bin contents
... ...

OpenWrt System Log:

... ...
Sun Jun 26 14:13:17 2016 kern.warn kernel: [10033.360000] ath10k_pci 0000:00:00.0: otp stream is empty, using board.bin contents
... ...

i am new to this !
After finish reading all the informations above but i have no idea about if there's a uboot for the netgear r6100 ?
would anyone please send me some info or email at brown.wang@yahoo.com
i will very appreciate for that!
thx a lot!