With Chaos Calmer, tx power (in Luci web interface) cannot be set higher than 19 dBm for 2.4GHz and 15 dBm for 5GHz, resulting in a loss of range vs. stock firmware. I have done the reghack thing to no avail. Regulatory domain is set to Netherlands NL. Any hints on how to get full tx power?

Check the Wi-Fi channels. Different channels allow for different TX powers. An excerpt of iw list on my own WDR3600 follows.

(snip)
        Frequencies:
            * 5180 MHz [36] (15.0 dBm)
            * 5200 MHz [40] (15.0 dBm)
            * 5220 MHz [44] (15.0 dBm)
            * 5240 MHz [48] (15.0 dBm)
            * 5260 MHz [52] (15.0 dBm)
            * 5280 MHz [56] (15.0 dBm)
            * 5300 MHz [60] (15.0 dBm)
            * 5320 MHz [64] (15.0 dBm)
            * 5500 MHz [100] (15.0 dBm)
            * 5520 MHz [104] (19.0 dBm)
            * 5540 MHz [108] (19.0 dBm)
            * 5560 MHz [112] (19.0 dBm)
            * 5580 MHz [116] (19.0 dBm)
            * 5600 MHz [120] (15.0 dBm)
            * 5620 MHz [124] (15.0 dBm)
            * 5640 MHz [128] (15.0 dBm)
            * 5660 MHz [132] (15.0 dBm)
            * 5680 MHz [136] (15.0 dBm)
            * 5700 MHz [140] (15.0 dBm)
            * 5745 MHz [149] (disabled)
            * 5765 MHz [153] (disabled)
            * 5785 MHz [157] (disabled)
            * 5805 MHz [161] (disabled)
            * 5825 MHz [165] (disabled)
(snip)
        Frequencies:
            * 2412 MHz [1] (19.0 dBm)
            * 2417 MHz [2] (21.0 dBm)
            * 2422 MHz [3] (21.0 dBm)
            * 2427 MHz [4] (21.0 dBm)
            * 2432 MHz [5] (21.0 dBm)
            * 2437 MHz [6] (21.0 dBm)
            * 2442 MHz [7] (21.0 dBm)
            * 2447 MHz [8] (21.0 dBm)
            * 2452 MHz [9] (21.0 dBm)
            * 2457 MHz [10] (21.0 dBm)
            * 2462 MHz [11] (18.0 dBm)
            * 2467 MHz [12] (22.0 dBm)
            * 2472 MHz [13] (22.0 dBm)
            * 2484 MHz [14] (18.0 dBm)
(snip)

Thanks for your reply. I am in NL (EU) so the max output power should be (according to ETSI) 20 dBm for 2.4 GHz and 23 dBm for 5 GHz channels 36-48 (which are preferable because no DFS or TPC is required on those).

That is why I ran reghack but the restrictions are actually not lifted in OpenWRT yet in stock firmware they are (more information to follow when I am at home).

I believe the hardware in the WDR3600 can only support those power levels. Have you measured the power levels higher with the stock firmware?

WDR3600/4300 can reach 23dbm without problems, more with distortion
to enable it you need hacked ART partition and modified regdb

root@router:~# iw list | grep dBm
            * 5180 MHz [36] (30.0 dBm)
            * 5200 MHz [40] (30.0 dBm)
            * 5220 MHz [44] (30.0 dBm)
            * 5240 MHz [48] (30.0 dBm)
            * 5260 MHz [52] (30.0 dBm) (radar detection)
            * 5280 MHz [56] (30.0 dBm) (radar detection)
            * 5300 MHz [60] (30.0 dBm) (radar detection)
            * 5320 MHz [64] (30.0 dBm) (radar detection)
            * 5660 MHz [132] (30.0 dBm) (radar detection)
            * 5680 MHz [136] (30.0 dBm) (radar detection)
            * 5700 MHz [140] (30.0 dBm) (radar detection)
            * 5745 MHz [149] (30.0 dBm)
            * 5765 MHz [153] (30.0 dBm)
            * 5785 MHz [157] (30.0 dBm)
            * 5805 MHz [161] (30.0 dBm)
            * 5825 MHz [165] (30.0 dBm)
            * 2412 MHz [1] (30.0 dBm)
            * 2417 MHz [2] (30.0 dBm)
            * 2422 MHz [3] (30.0 dBm)
            * 2427 MHz [4] (30.0 dBm)
            * 2432 MHz [5] (30.0 dBm)
            * 2437 MHz [6] (30.0 dBm)
            * 2442 MHz [7] (30.0 dBm)
            * 2447 MHz [8] (30.0 dBm)
            * 2452 MHz [9] (30.0 dBm)
            * 2457 MHz [10] (30.0 dBm)
            * 2462 MHz [11] (30.0 dBm)
            * 2467 MHz [12] (30.0 dBm)
            * 2472 MHz [13] (30.0 dBm)
            * 2484 MHz [14] (30.0 dBm)

ok, all files and instructions below can be used only at yr own risk

ART - https://mega.nz/#!GMA2ibRB!0ImpV9wexTBq … irMmqFQz04
DD snapshot compiled with unlocked ART, modified regdb (for 00 and US regions, other regions untouched) and with ATH_USER_REGD - https://mega.nz/#!CZ5AibbL!xnqIDdKL9_Ya … GvIUeB30K0

0. Backup all of yr mtd partitions
dd if=/dev/mtd0 of=/tmp/uboot.bin
dd if=/dev/mtd4 of=/tmp/orig_art.bin
dd if=/dev/mtd5 of=/tmp/fw.bin
and copy it from /tmp to any safe location
1. use luci to backup your settings and flash modded fw
2. put new art.bin to /tmp and flash it
mtd write /tmp/art.bin /dev/mtd4
3. Verify it - mtd verify /tmp/art.bin /dev/mtd4
if everything is ok - reboot
4. check if yr wireless can up and run and tx levels up to 30dBm available (with 00 or US regions)

5. you can build yr own fw with ath_user_regd to use your country region code with openwrt, prebuilt image built without this option, but you can try (if yr hw is locked to US or NL it will reach 22dBm i hope) or you can restore yr backup (use "mtd write" to restore mtd5)

(Last edited by stas2z on 17 Nov 2015, 00:22)

Do you have the binaries to do the same for other ath art?
Not only does this wdr4300 have weak power many other routers have the same issue
But for routers like wdr4900v1 tx rx power is like 30dbm and both are certified units.
You would think they have some sort of double standards for this.

(Last edited by alphasparc on 17 Nov 2015, 08:09)

Im not sure it's double standards, cause all depends of chipset specs (with built in amps) or amps specs.
3600/4300 5ghz amp spec tells it's from 19dbm for ht40 N to 23 dbm with legacy g ht20, but i tested it with ht40 and 23dBm is ok, also 25dBm works almost the same, any values more cause speed loss. For 2.4 i didn't checked datasheet, but seen other devices with the same chip working wine with 22dBm and hope it's safe to use such value. Increasing it can cause distortion or hw damage.
But several devices probably have different amps can reach 30dBm or more so don't claim tp-link for this, it's just only HW difference.

And no, i don't have any other arts or tools, cuz ive made this one myself for my own wdr3600 using xxd and okteta .

(Last edited by stas2z on 17 Nov 2015, 08:21)

Thanks gd to know
How do you isolate the values and locate the offsets?
From my experience with tplink my favourite is still wr1043ndv1
The wifi range is simply incredible

(Last edited by alphasparc on 17 Nov 2015, 08:24)

Yeah, im also an owner of 1043v1 working as giga switch and guest network host and comparsion it with the weak wdr3600 was one of the reasons to do this hack

Firstly i checked several art partitions from different regions, and after only with analyze/modify/test. Also driver sources and pepe2k's ar9300-eeprom tool sources helped a lot.