Atheros ART bypass

I'm playing with ath9k driver to bypass the ART without editing the art partition.
I modified the driver to read the dump from a file inside /etc/config.
I know it's not a good idea read a file from kernel mode, but this is mainly a POC for people interested about this topic.
Here my mods and a short guide to try it https://gist.github.com/BigNerd95/f06f14d46fa76ccaf519940592428c53

With my mod the driver reads the /etc/config/my_eeprom instead reading the art partition.
So you can edit the file my_eeprom with your favorite values.
If the driver doesn't find my_eeprom file, it will read the default values from the art partition.

I'm testing other ways to modify the driver values without hardcoding them inside it
(like passing values to the driver when it is loaded by insmod)

Have a question:

  • This method is valid for what radio model ?
  • step 2 (make package/kernel/mac80211/compile) not work on lastest trunk.

Tks.

I tested it on Atheros AR9341 on a TP-LINK WR841ND v8
But i think it should work on any card supported by ath9k driver.

To build your image please follow this guide
https://lede-project.org/docs/guide-developer/quickstart-build-images

Just measured the volt/meter with an instrument (thanks to a my friend)
At ~50 cm of distance from the antennas:
18 dBm: 8 volt/meter
25 dBm: 17 volt/meter
31 dBm: >30 volt/meter

So my mod seems it's working fine :smile:

I have test on wzr-hp-ag300h & wbmr but not work, dmesg output not have "reading eeprom". I have 841nv8, will test soon.
root@AG300H:~# dmesg |grep ath
[ 12.751372] ath: phy0: Ignoring endianness difference in EEPROM magic bytes.
[ 12.759959] ath: EEPROM regdomain: 0x0
[ 12.759969] ath: EEPROM indicates default country code should be used
[ 12.759977] ath: doing EEPROM country->regdmn map search
[ 12.759992] ath: country maps to regdmn code: 0x3a
[ 12.760001] ath: Country alpha2 being used: US
[ 12.760009] ath: Regpair used: 0x3a

There are 4 different type of eeprom:

  • ar5416_eeprom_def
  • ar5416_eeprom_4k
  • ar9287_eeprom
  • ar9300_eeprom

My mod is for ar9300_eeprom
Maybe your router has a different eeprom.

You can check which of these functions:

  • ath9k_hw_def_fill_eeprom (file: eeprom_def.c)
  • ath9k_hw_4k_fill_eeprom (file: eeprom_4k.c)
  • ath9k_hw_ar9287_fill_eeprom (file: eeprom_9287.c)

is called by adding a printk("READING HERE");

I made a different mod to pass a custom country name when loading driver.


The driver will read the eeprom but the country code is overridden by the user parameter.
This mod should work with any Atheros.
(Guide in comment)

I made another mod to bypass ART max tx power.

Sry, I don't know where to add this ?

At the top of these functions

Please do not bypass max TX power limits. They are there for a reason.

I have checked on various TP-Link routers, and their ART contains various limits for the max TX power from 17dBm to 27dBm, changing from model to model and even between devices. The exact value you find on your given router represents the absolute maximum power it can output on its antenna without distortion, overheating and throwing interference all over the band.

They are calibrated on each channel and modulation one by one at the factory. Higher order modulations also command a lower TX power compared to the global maximum you set.

If what you get does not suit your needs, you must purchase a different router or wireless card. And of course always obey the regulations that apply to the country of operation.

I think a lot of limits are there only for commercial reasons...
Companies make one hw and then sell it at different price only changing some sw limits

1 Like

Hello.

Thanks for sharing your thoughts on the issue. As this question has been coming up every year for decades now, I decided to create a detailed FAQ entry for it:

https://openwrt.org/docs/guide-user/network/wifi/transmit.power.limits#conspiracy_theories_regarding_manufacturers_segmenting_the_market

I've also uploaded the table of power capabilities of some common chipsets I've mentioned previously:

https://openwrt.org/docs/guide-user/network/wifi/chipset.capabilities

I'm open to any constructive addition or further questions, so we can clarify this topic as much as possible.

You can make some very simple measurements at home to verify the validity of all raised issues.

My best regards,

Hi

I have query. I have used this to get ART bypass and get the 5GHz band enabled. The 5GHz band is enabled now after executing your steps. Trying to configure AR934x device in client mode, and trying to connect to a 5GHz router. But even though the 5GHz router is listed in "iwinfo" scan, not able to successfully connect to it. Is there any other things to be done other than these steps.

Thanks

Does your device have a 5 GHz RF chain?

If not, it isn't going to work, even if the chip is operating at 5 GHz.

Hi,
Thanks for the info . I am using Atheros AR9344 SOC..
Can you please let me know if this chipset has 5G RF chain.
This is the "iw list" dump

**Wiphy phy0**
**        max # scan SSIDs: 4**
**        max scan IEs length: 2257 bytes**
**        max # sched scan SSIDs: 0**
**        max # match sets: 0**
**        max # scan plans: 1**
**        max scan plan interval: -1**
**        max scan plan iterations: 0**
**        Retry short limit: 7**
**        Retry long limit: 4**
**        Coverage class: 0 (up to 0m)**
**        Device supports AP-side u-APSD.**
**        Device supports T-DLS.**
**        Available Antennas: TX 0x3 RX 0x3**
**        Configured Antennas: TX 0x3 RX 0x3**
**        Supported interface modes:**
**                 * IBSS**
**                 * managed**
**                 * AP**
**                 * AP/VLAN**
**                 * monitor**
**                 * mesh point**
**                 * P2P-client**
**                 * P2P-GO**
**                 * outside context of a BSS**
**        Band 1:**
**                Capabilities: 0x11ef**
**                        RX LDPC**
**                        HT20/HT40**
**                        SM Power Save disabled**
**                        RX HT20 SGI**
**                        RX HT40 SGI**
**                        TX STBC**
**                        RX STBC 1-stream**
**                        Max AMSDU length: 3839 bytes**
**                        DSSS/CCK HT40**
**                Maximum RX AMPDU length 65535 bytes (exponent: 0x003)**
**                Minimum RX AMPDU time spacing: 8 usec (0x06)**
**                HT TX/RX MCS rate indexes supported: 0-15**
**                Frequencies:**
**                        * 2412 MHz [1] (21.0 dBm)**
**                        * 2417 MHz [2] (21.0 dBm)**
**                        * 2422 MHz [3] (21.0 dBm)**
**                        * 2427 MHz [4] (21.0 dBm)**
**                        * 2432 MHz [5] (21.0 dBm)**
**                        * 2437 MHz [6] (21.0 dBm)**
**                        * 2442 MHz [7] (21.0 dBm)**
**                        * 2447 MHz [8] (21.0 dBm)**
**                        * 2452 MHz [9] (21.0 dBm)**
**                        * 2457 MHz [10] (21.0 dBm)**
**                        * 2462 MHz [11] (21.0 dBm)**
**                        * 2467 MHz [12] (disabled)**
**                        * 2472 MHz [13] (disabled)**
**                        * 2484 MHz [14] (disabled)**
**        Band 2:**
**                Capabilities: 0x11ef**
**                        RX LDPC**
**                        HT20/HT40**
**                        SM Power Save disabled**
**                        RX HT20 SGI**
**                        RX HT40 SGI**
**                        TX STBC**
**                        RX STBC 1-stream**
**                        Max AMSDU length: 3839 bytes**
**                        DSSS/CCK HT40**
**                Maximum RX AMPDU length 65535 bytes (exponent: 0x003)**
**                Minimum RX AMPDU time spacing: 8 usec (0x06)**
**                HT TX/RX MCS rate indexes supported: 0-15**
**                Frequencies:**
**                        * 5180 MHz [36] (13.0 dBm)**
**                        * 5200 MHz [40] (13.0 dBm)**
**                        * 5220 MHz [44] (13.0 dBm)**
**                        * 5240 MHz [48] (13.0 dBm)**
**                        * 5260 MHz [52] (13.0 dBm) (no IR, radar detection)**
**                        * 5280 MHz [56] (13.0 dBm) (no IR, radar detection)**
**                        * 5300 MHz [60] (13.0 dBm) (no IR, radar detection)**
**                        * 5320 MHz [64] (13.0 dBm) (no IR, radar detection)**
**                        * 5500 MHz [100] (13.0 dBm) (no IR, radar detection)**
**                        * 5520 MHz [104] (13.0 dBm) (no IR, radar detection)**
**                        * 5540 MHz [108] (13.0 dBm) (no IR, radar detection)**
**                        * 5560 MHz [112] (13.0 dBm) (no IR, radar detection)**
**                        * 5580 MHz [116] (13.0 dBm) (no IR, radar detection)**
**                        * 5600 MHz [120] (13.0 dBm) (no IR, radar detection)**
**                        * 5620 MHz [124] (13.0 dBm) (no IR, radar detection)**
**                        * 5640 MHz [128] (13.0 dBm) (no IR, radar detection)**
**                        * 5660 MHz [132] (13.0 dBm) (no IR, radar detection)**
**                        * 5680 MHz [136] (13.0 dBm) (no IR, radar detection)**
**                        * 5700 MHz [140] (13.0 dBm) (no IR, radar detection)**
**                        * 5745 MHz [149] (13.0 dBm)**
**                        * 5765 MHz [153] (13.0 dBm)**
**                        * 5785 MHz [157] (13.0 dBm)**
**                        * 5805 MHz [161] (13.0 dBm)**
**                        * 5825 MHz [165] (13.0 dBm)**
**        valid interface combinations:**
**                 * #{ managed } <= 2048, #{ AP, mesh point } <= 8, #{ P2P-client, P2P-GO } <= 1, #{ IBSS } <= 1,**
**                   total <= 2048, #channels <= 1, STA/AP BI must match, radar detect widths: { 20 MHz (no HT), 20 MHz, 40 MHz }**

**        HT Capability overrides:**
**                 * MCS: ff ff ff ff ff ff ff ff ff ff**
**                 * maximum A-MSDU length**
**                 * supported channel width**
**                 * short GI for 40 MHz**
**                 * max A-MPDU length exponent**
**                 * min MPDU start spacing**

It is not the chip, but the board. If it doesn't have the proper amplifiers and filters for 5 GHz, at best you'll not be able to connect. At worst, you could fry the RF output of the chip.

Note that the 2.4 GHz and 5 GHz RF connections aren't even on the same pins:
image