OpenWrt Forum Archive

Topic: Updated reghack for CC 15.05.1

The content of this topic has been archived on 6 May 2018. There are no obvious gaps in this topic, but there may still be some posts missing at the end.

Hello,

with the recent release of Chaos Calmer 15.05.1, jow's reghack no longer patches all the embedded regulatory domains in cfg80211.ko.

<jow_laptop> it doesn't catch all instances anymore because the marker rules changed slightly

I researched what the changes are and added the new patterns to the source code, which you can find below (look for "March 2016 addition"). I would highly appreciate it if someone could supply precompiled binaries, as I have a slow connection and cannot setup a Linux cross-compiling environment.

/*
 * reghack - Utility to binary-patch the embedded mac80211 regulatory rules.
 *
 *   Copyright (C) 2012-2014 Jo-Philipp Wich <xm@subsignal.org>
 *
 *  Licensed under the Apache License, Version 2.0 (the "License");
 *  you may not use this file except in compliance with the License.
 *  You may obtain a copy of the License at
 *
 *      http://www.apache.org/licenses/LICENSE-2.0
 *
 *  Unless required by applicable law or agreed to in writing, software
 *  distributed under the License is distributed on an "AS IS" BASIS,
 *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 *  See the License for the specific language governing permissions and
 *  limitations under the License.
 */

#include <stdio.h>
#include <stdint.h>
#include <stdlib.h>
#include <unistd.h>
#include <fcntl.h>
#include <string.h>
#include <byteswap.h>
#include <limits.h>
#include <arpa/inet.h>
#include <sys/stat.h>
#include <sys/mman.h>


static int need_byteswap = 0;

enum nl80211_dfs_regions {
    NL80211_DFS_UNSET = 0,
    NL80211_DFS_FCC = 1
};

struct ieee80211_freq_range {
    uint32_t start_freq_khz;
    uint32_t end_freq_khz;
    uint32_t max_bandwidth_khz;
};

struct ieee80211_power_rule {
    uint32_t max_antenna_gain;
    uint32_t max_eirp;
};

struct ieee80211_reg_rule {
    struct ieee80211_freq_range freq_range;
    struct ieee80211_power_rule power_rule;
    uint32_t flags;
    uint32_t dfs_cac_ms;
};

struct ieee80211_regdomain {
    uint32_t n_reg_rules;
    char alpha2[2];
    enum nl80211_dfs_regions dfs_region;
    struct ieee80211_reg_rule reg_rules[1];
};

#define MHZ_TO_KHZ(freq) ((freq) * 1000)
#define KHZ_TO_MHZ(freq) ((freq) / 1000)
#define DBI_TO_MBI(gain) ((gain) * 100)
#define MBI_TO_DBI(gain) ((gain) / 100)
#define DBM_TO_MBM(gain) ((gain) * 100)
#define MBM_TO_DBM(gain) ((gain) / 100)

#define REG_RULE(start, end, bw, gain, eirp, reg_flags) \
{                           \
    .freq_range.start_freq_khz = MHZ_TO_KHZ(start), \
    .freq_range.end_freq_khz = MHZ_TO_KHZ(end), \
    .freq_range.max_bandwidth_khz = MHZ_TO_KHZ(bw), \
    .power_rule.max_antenna_gain = DBI_TO_MBI(gain),\
    .power_rule.max_eirp = DBM_TO_MBM(eirp),    \
    .flags = reg_flags,             \
    .dfs_cac_ms = 0, \
}

#define REG_MATCH(code, num, dfs, rule) \
{ \
    .alpha2 = code, \
    .dfs_region = dfs, \
    .n_reg_rules = num, \
    .reg_rules = { \
        rule \
    } \
}


struct search_regdomain {
    const char *desc;
    struct ieee80211_regdomain reg;
};

static const struct search_regdomain search_regdomains[] = {
    /* cfg80211.ko matches */
    {
        .desc = "core world5 regdomain in cfg80211/reg.o",
        .reg  = REG_MATCH("00", 5, NL80211_DFS_UNSET, REG_RULE(2402, 2472, 40, 6, 20, 0))
    }, {
        .desc = "core world6 regdomain in cfg80211/reg.o",
        .reg  = REG_MATCH("00", 6, NL80211_DFS_UNSET, REG_RULE(2402, 2472, 40, 6, 20, 0))
    }, {
        .desc = "embedded 00 regdomain in cfg80211/regdb.o",
        .reg  = REG_MATCH("00", 5, NL80211_DFS_UNSET, REG_RULE(2402, 2472, 40, 3, 20, 0))
    }, {
        .desc = "embedded 00 regdomain in cfg80211/regdb.o",
        .reg  = REG_MATCH("00", 6, NL80211_DFS_UNSET, REG_RULE(2402, 2472, 40, 3, 20, 0))
    }, {
        .desc = "embedded 00 regdomain in cfg80211/regdb.o",
        .reg  = REG_MATCH("00", 8, NL80211_DFS_UNSET, REG_RULE(2402, 2472, 40, 0, 20, 0))
    }, {
        .desc = "embedded US regdomain in cfg80211/regdb.o",
        .reg  = REG_MATCH("US", 6, NL80211_DFS_UNSET, REG_RULE(2402, 2472, 40, 3, 27, 0))
    }, {
        .desc = "embedded US regdomain in cfg80211/regdb.o",
        .reg  = REG_MATCH("US", 7, NL80211_DFS_UNSET, REG_RULE(2402, 2472, 40, 3, 27, 0))
    }, {
        .desc = "embedded US regdomain in cfg80211/regdb.o",
        .reg  = REG_MATCH("US", 7, NL80211_DFS_FCC, REG_RULE(2402, 2472, 40, 3, 27, 0))
    }, {
        /* March 2016 addition */
        .desc = "core world8(?) regdomain in cfg80211/reg.o (new rule)",
        .reg  = REG_MATCH("00", 8, NL80211_DFS_UNSET, REG_RULE(2402, 2472, 40, 6, 20, 0))
    },

    /* regdb.txt matches */
    {
        .desc = "embedded 00 regdomain in cfg80211/regdb.o",
        .reg  = REG_MATCH("00", 6, NL80211_DFS_UNSET, REG_RULE(2402, 2472, 40, 0, 20, 0))
    }, {
        .desc = "embedded US regdomain in cfg80211/regdb.o",
        .reg  = REG_MATCH("US", 5, NL80211_DFS_FCC, REG_RULE(2402, 2472, 40, 0, 30, 0))
    }, {
        /* March 2016 addition */
        .desc = "embedded US regdomain in cfg80211/regdb.o (new rule)",
        .reg  = REG_MATCH("US", 6, NL80211_DFS_FCC, REG_RULE(2402, 2472, 40, 0, 30, 0))
    },

    /* ath.ko matches */
    {
        .desc = "ath world regdomain with 3 rules in ath/regd.o",
        .reg  = REG_MATCH("99", 3, NL80211_DFS_UNSET, REG_RULE(2402, 2472, 40, 0, 20, 0))
    }, {
        .desc = "ath world regdomain with 4 rules in ath/regd.o",
        .reg  = REG_MATCH("99", 4, NL80211_DFS_UNSET, REG_RULE(2402, 2472, 40, 0, 20, 0))
    }, {
        .desc = "ath world regdomain with 5 rules in ath/regd.o",
        .reg  = REG_MATCH("99", 5, NL80211_DFS_UNSET, REG_RULE(2402, 2472, 40, 0, 20, 0))
    }
};


struct search_insn {
    const char *desc;
    const uint16_t machine;
    const uint32_t search;
    const uint32_t replace;
    const uint32_t mask;
    int step;
};

static const struct search_insn search_insns[] = {
    /* radar frequency check */
    {
        .desc    = "ath_is_radar_freq() MIPS opcode in ath/regd.o",
        .machine = 0x0008,     /* MIPS */
        .search  = 0x2400eb74, /* addiu rX, rY, -5260 */
        .replace = 0x24000000, /* addiu rX, rY, 0    */
        .mask    = 0xfc00ffff,
        .step    = 4
    },
    {
        .desc    = "ath_is_radar_freq() PPC opcode in ath/regd.o",
        .machine = 0x0014,     /* PPC */
        .search  = 0x3800eb74, /* addi rX, rY, -5260 */
        .replace = 0x38000000, /* addi rX, rY, 0 */
        .mask    = 0xfc00ffff,
        .step    = 4
    },
    {
        .desc    = "ath_is_radar_freq() x86 opcode in ath/regd.o (1/2)",
        .machine = 0x0003,    /* x86 */
        .search  = 0x0000148c,    /* 5260 */
        .replace = 0x00000000,  /* 0 */
        .mask    = 0x0000ffff,
        .step    = 1
    },
    {
        .desc    = "ath_is_radar_freq() x86 opcode in ath/regd.o (2/2)",
        .machine = 0x0003,    /* x86 */
        .search  = 0xffffeb74,    /* -5260 */
        .replace = 0x00000000,  /* 0 */
        .mask    = 0xffffffff,
        .step    = 1
    },
    {
        .desc    = "ath_is_radar_freq() x86-64 opcode in ath/regd.o (1/2)",
        .machine = 0x003e,    /* x86-64 */
        .search  = 0x0000148c,    /* 5260 */
        .replace = 0x00000000,  /* 0 */
        .mask    = 0x0000ffff,
        .step    = 1
    },
    {
        .desc    = "ath_is_radar_freq() x86-64 opcode in ath/regd.o (2/2)",
        .machine = 0x003e,    /* x86-64 */
        .search  = 0xffffeb74,    /* -5260 */
        .replace = 0x00000000,  /* 0 */
        .mask    = 0xffffffff,
        .step    = 1
    }
};


static void check_endianess(unsigned char *elf_hdr)
{
    int self_is_be = (htonl(42) == 42);
    int elf_is_be  = (elf_hdr[5] == 2);

    if (self_is_be != elf_is_be)
    {
        need_byteswap = 1;
        printf("Byte swapping needed (utility %s endian, module %s endian)\n",
               self_is_be ? "big" : "low",
               elf_is_be  ? "big" : "low");
    }
}

static void bswap_rule(struct ieee80211_reg_rule *r)
{
    r->freq_range.start_freq_khz    = bswap_32(r->freq_range.start_freq_khz);
    r->freq_range.end_freq_khz      = bswap_32(r->freq_range.end_freq_khz);
    r->freq_range.max_bandwidth_khz = bswap_32(r->freq_range.max_bandwidth_khz);

    r->power_rule.max_antenna_gain  = bswap_32(r->power_rule.max_antenna_gain);
    r->power_rule.max_eirp          = bswap_32(r->power_rule.max_eirp);

    r->flags                        = bswap_32(r->flags);
}

static int patch_regdomain(struct ieee80211_regdomain *pos,
                           const struct ieee80211_regdomain *comp)
{
    /* This is what the rules above get replaced with */
    struct ieee80211_reg_rule r2 = REG_RULE(2400, 2483, 40, 0, 30, 0);
    struct ieee80211_reg_rule r5 = REG_RULE(5140, 5860, 160, 0, 30, 0);
    struct ieee80211_regdomain pattern = *comp;

    if (need_byteswap)
    {
        bswap_rule(&pattern.reg_rules[0]);
        pattern.dfs_region = bswap_32(pattern.dfs_region);
        pattern.n_reg_rules = bswap_32(pattern.n_reg_rules);
    }

    if (!memcmp(pos, &pattern, sizeof(pattern)))
    {
        pos->reg_rules[0] = r2;
        pos->reg_rules[1] = r5;
        pos->n_reg_rules = 2;
        pos->dfs_region = 0;

        if (need_byteswap)
        {
            bswap_rule(&pos->reg_rules[0]);
            bswap_rule(&pos->reg_rules[1]);
            pos->n_reg_rules = bswap_32(pos->n_reg_rules);
        }

        return 0;
    }

    return 1;
}


static uint16_t check_ath_ko(unsigned char *elf_hdr, const char *filename)
{
    uint16_t type = *(uint16_t *)(elf_hdr + 18);
    const char *file = strrchr(filename, '/');

    if (!file)
        file = filename;
    else
        file++;

    if (need_byteswap)
        type = bswap_16(type);

    if (!strcmp(file, "ath.ko"))
        return type;

    return 0;
}

static int patch_insn(uint32_t *pos, const struct search_insn *insn)
{
    uint32_t cmp = need_byteswap ? bswap_32(*pos) : *pos;

    if ((cmp & insn->mask) == insn->search)
    {
        *pos = need_byteswap ? bswap_32(insn->replace | (cmp & ~insn->mask))
                             : insn->replace | (cmp & ~insn->mask);

        return 0;
    }

    return 1;
}


static int tryopen(const char *path, int *size, void **map)
{
    int fd;
    struct stat s;

    if (stat(path, &s))
    {
        perror("stat()");
        return -1;
    }

    if ((fd = open(path, O_RDWR)) == -1)
    {
        perror("open()");
        return -2;
    }

    *size = s.st_size;
    *map = mmap(NULL, *size, PROT_READ | PROT_WRITE, MAP_SHARED, fd, 0);

    if (*map == MAP_FAILED)
    {
        close(fd);
        perror("mmap()");
        return -3;
    }

    return fd;
}

int main(int argc, char **argv)
{
    int i, j, fd, sz;
    int found = 0;
    uint16_t ath_ko_machine = 0;

    void *map;
    char *tmp = NULL, cmd[PATH_MAX * 2 + 4];

    if (argc < 2)
    {
        printf("Usage: %s module.ko\n", argv[0]);
        exit(1);
    }

    fd = tryopen(argv[1], &sz, &map);

    if (fd == -3)
    {
        printf("Memory mapping failed (missing fs support?), retrying from tmpfs\n");

        tmp = tmpnam(NULL);

        sprintf(cmd, "cp %s %s", argv[1], tmp);
        system(cmd);

        fd = tryopen(tmp, &sz, &map);
    }

    if (fd < 0)
    {
        if (tmp)
            unlink(tmp);

        exit(1);
    }

    check_endianess(map);
    ath_ko_machine = check_ath_ko(map, argv[1]);

    if (ath_ko_machine)
    {
        for (j = 0; j < sizeof(search_insns)/sizeof(search_insns[0]); j++)
        {
            if (search_insns[j].machine != ath_ko_machine)
                continue;

            for (i = 0; i < (sz - sizeof(search_regdomains[0].reg)); i += search_insns[j].step)
            {
                if (!patch_insn(map + i, &search_insns[j]))
                {
                    printf("Patching @ 0x%08x: %s\n", i, search_insns[j].desc);
                    found = 1;
                }
            }
        }
    }

    for (i = 0; i < (sz - sizeof(search_regdomains[0].reg)); i += sizeof(uint32_t))
    {
        for (j = 0; j < (sizeof(search_regdomains)/sizeof(search_regdomains[0])); j++)
        {
            if (!patch_regdomain(map + i, &search_regdomains[j].reg))
            {
                printf("Patching @ 0x%08x: %s\n", i, search_regdomains[j].desc);
                found = 1;
            }
        }
    }

    if (munmap(map, sz))
    {
        perror("munmap()");
        exit(1);
    }

    if (tmp)
    {
        if (found)
        {
            sprintf(cmd, "cp %s %s", tmp, argv[1]);
            system(cmd);
        }

        unlink(tmp);
    }

    close(fd);

    if (!found)
    {
        printf("Unable to find regulatory rules (already patched?)\n");
        exit(1);
    }

    return 0;
}

Thanx, it worked perfectly on 3 netgears WNDR3700-3800.
I did not crosscompile. I have toolchain on target platform.

@bolvan -- are they MIPS? Can you share the binary please?

Thanks for testing, bolvan! I would also appreciate it if you could supply the binary.

johndoe wrote:

Thanks for testing, bolvan! I would also appreciate it if you could supply the binary.

uploading ipk's for arm sunxi and ar71xx mips
they are static compiled and should not depend on version of libc
I also prepared ready to build package definition to be copied to $buildroot/package
easy to build with an SDK
https://www.sendspace.com/file/dqkkuo
Unfortunately i'm on x86 linux but SDK requires amd64. So the only option for me is to compile toolchains for every other arch.

(Last edited by bolvan on 22 Mar 2016, 17:29)

@bolvan -- the zip file seems to be 168b long and empty inside.

Yes, all there is inside is an empty directory called reghack2, so I'm guessing something was botched during the compression process. Looking forward to a fixed archive. Thanks in advance smile

bolvan wrote:

Forgot "-r" for zip. https://www.sendspace.com/file/35md36

Spasibo! Extracted the binary and ran it over DD build on Archer C7 v2 and it seems to be running fine.

What's the easiest way to install this and to verify that it worked? 

opkg install reghack2_1_ar71xx.ipk
?

Thank you in advance.

After install,

reghack2 /lib/modules/*/ath.ko
reghack2 /lib/modules/*/cfg80211.ko

I have patched my router (routerstation pro with 1xR2SHPn(19dBm), 1xR5SHPn(10dBm), 1xR52H(25dBm)) I did not see any errors looks like it worked however I still can not change the TX Power on any of the cards any more. They should be able to go much higher up to 32dBm I believe . I have tried both US and 00

Firmware Ver: OpenWrt Chaos Calmer 15.05.1 / LuCI 15.05-149-g0d8bbd2 Release (git-15.363.78009-956be55)

Am I doing something wrong?

Install output:

# opkg install reghack2_1_ar71xx.ipk 
Installing reghack2 (1) to root...
Configuring reghack2.
# reghack2 /lib/modules/*/ath.ko
Patching @ 0x00000308: ath_is_radar_freq() MIPS opcode in ath/regd.o
Patching @ 0x00000414: ath_is_radar_freq() MIPS opcode in ath/regd.o
Patching @ 0x000034cc: ath world regdomain with 5 rules in ath/regd.o
Patching @ 0x0000356c: ath world regdomain with 4 rules in ath/regd.o
Patching @ 0x000035f0: ath world regdomain with 4 rules in ath/regd.o
Patching @ 0x00003674: ath world regdomain with 5 rules in ath/regd.o
# reghack2 /lib/modules/*/cfg80211.ko
Patching @ 0x00027da4: core world8(?) regdomain in cfg80211/reg.o (new rule)
Patching @ 0x000296f0: embedded US regdomain in cfg80211/regdb.o (new rule)
Patching @ 0x0002f0e8: embedded 00 regdomain in cfg80211/regdb.o
#reboot 

(Last edited by v1s on 28 May 2016, 13:43)

@v1s to see the current dBm txpower

iw dev wlan0 info
iw dev wlan1 info

to see maximum dBm txpower for each channel

iw list
iw reg get

(Last edited by wrt2000 on 26 May 2016, 19:06)

Here is the out put of those commands if it helps.

root@NULL:~# iw dev wlan0 info
Interface wlan0
    ifindex 8
    wdev 0x2
    addr 00:0c:42:xx:xx:x1
    type managed
    wiphy 0
    channel 10 (2457 MHz), width: 20 MHz, center1: 2457 MHz
# iw dev wlan1 info
Interface wlan1
    ifindex 5
    wdev 0x100000001
    addr 4c:5e:0c:xx:xx:x2
    type managed
    wiphy 1
# iw list
Wiphy phy2
    max # scan SSIDs: 4
    max scan IEs length: 2257 bytes
    Retry short limit: 7
    Retry long limit: 4
    Coverage class: 0 (up to 0m)
    Device supports AP-side u-APSD.
    Device supports T-DLS.
    Available Antennas: TX 0x3 RX 0x3
    Configured Antennas: TX 0x3 RX 0x3
    Supported interface modes:
         * IBSS
         * managed
         * AP
         * AP/VLAN
         * WDS
         * monitor
         * mesh point
         * P2P-client
         * P2P-GO
    Band 1:
        Capabilities: 0x11ce
            HT20/HT40
            SM Power Save disabled
            RX HT40 SGI
            TX STBC
            RX STBC 1-stream
            Max AMSDU length: 3839 bytes
            DSSS/CCK HT40
        Maximum RX AMPDU length 65535 bytes (exponent: 0x003)
        Minimum RX AMPDU time spacing: 8 usec (0x06)
        HT TX/RX MCS rate indexes supported: 0-15
        Frequencies:
            * 2412 MHz [1] (25.0 dBm)
            * 2417 MHz [2] (25.0 dBm)
            * 2422 MHz [3] (25.0 dBm)
            * 2427 MHz [4] (25.0 dBm)
            * 2432 MHz [5] (25.0 dBm)
            * 2437 MHz [6] (25.0 dBm)
            * 2442 MHz [7] (25.0 dBm)
            * 2447 MHz [8] (25.0 dBm)
            * 2452 MHz [9] (25.0 dBm)
            * 2457 MHz [10] (25.0 dBm)
            * 2462 MHz [11] (25.0 dBm)
            * 2467 MHz [12] (25.0 dBm)
            * 2472 MHz [13] (25.0 dBm)
            * 2484 MHz [14] (disabled)
    Band 2:
        Capabilities: 0x11ce
            HT20/HT40
            SM Power Save disabled
            RX HT40 SGI
            TX STBC
            RX STBC 1-stream
            Max AMSDU length: 3839 bytes
            DSSS/CCK HT40
        Maximum RX AMPDU length 65535 bytes (exponent: 0x003)
        Minimum RX AMPDU time spacing: 8 usec (0x06)
        HT TX/RX MCS rate indexes supported: 0-15
        Frequencies:
            * 5180 MHz [36] (25.0 dBm)
            * 5200 MHz [40] (25.0 dBm)
            * 5220 MHz [44] (25.0 dBm)
            * 5240 MHz [48] (25.0 dBm)
            * 5260 MHz [52] (25.0 dBm)
            * 5280 MHz [56] (25.0 dBm)
            * 5300 MHz [60] (25.0 dBm)
            * 5320 MHz [64] (25.0 dBm)
            * 5500 MHz [100] (25.0 dBm)
            * 5520 MHz [104] (25.0 dBm)
            * 5540 MHz [108] (25.0 dBm)
            * 5560 MHz [112] (25.0 dBm)
            * 5580 MHz [116] (25.0 dBm)
            * 5600 MHz [120] (25.0 dBm)
            * 5620 MHz [124] (25.0 dBm)
            * 5640 MHz [128] (25.0 dBm)
            * 5660 MHz [132] (25.0 dBm)
            * 5680 MHz [136] (25.0 dBm)
            * 5700 MHz [140] (25.0 dBm)
            * 5745 MHz [149] (25.0 dBm)
            * 5765 MHz [153] (25.0 dBm)
            * 5785 MHz [157] (25.0 dBm)
            * 5805 MHz [161] (25.0 dBm)
            * 5825 MHz [165] (25.0 dBm)
    valid interface combinations:
         * #{ managed } <= 2048, #{ AP, mesh point } <= 8, #{ P2P-client, P2P-GO } <= 1, #{ IBSS } <= 1,
           total <= 2048, #channels <= 1, STA/AP BI must match
         * #{ WDS } <= 2048,
           total <= 2048, #channels <= 1, STA/AP BI must match
         * #{ IBSS, AP, mesh point } <= 1,
           total <= 1, #channels <= 1, STA/AP BI must match, radar detect widths: { 20 MHz (no HT), 20 MHz, 40 MHz }

    HT Capability overrides:
         * MCS: ff ff ff ff ff ff ff ff ff ff
         * maximum A-MSDU length
         * supported channel width
         * short GI for 40 MHz
         * max A-MPDU length exponent
         * min MPDU start spacing
Wiphy phy1
    max # scan SSIDs: 4
    max scan IEs length: 2261 bytes
    Retry short limit: 7
    Retry long limit: 4
    Coverage class: 0 (up to 0m)
    Device supports AP-side u-APSD.
    Device supports T-DLS.
    Available Antennas: TX 0x1 RX 0x1
    Configured Antennas: TX 0x1 RX 0x1
    Supported interface modes:
         * IBSS
         * managed
         * AP
         * AP/VLAN
         * WDS
         * monitor
         * mesh point
         * P2P-client
         * P2P-GO
    Band 2:
        Capabilities: 0x11ce
            HT20/HT40
            SM Power Save disabled
            RX HT40 SGI
            TX STBC
            RX STBC 1-stream
            Max AMSDU length: 3839 bytes
            DSSS/CCK HT40
        Maximum RX AMPDU length 65535 bytes (exponent: 0x003)
        Minimum RX AMPDU time spacing: 8 usec (0x06)
        HT TX/RX MCS rate indexes supported: 0-7
        Frequencies:
            * 5180 MHz [36] (10.0 dBm)
            * 5200 MHz [40] (16.0 dBm)
            * 5220 MHz [44] (16.0 dBm)
            * 5240 MHz [48] (16.0 dBm)
            * 5260 MHz [52] (16.0 dBm)
            * 5280 MHz [56] (16.0 dBm)
            * 5300 MHz [60] (16.0 dBm)
            * 5320 MHz [64] (17.0 dBm)
            * 5500 MHz [100] (17.0 dBm)
            * 5520 MHz [104] (17.0 dBm)
            * 5540 MHz [108] (17.0 dBm)
            * 5560 MHz [112] (17.0 dBm)
            * 5580 MHz [116] (17.0 dBm)
            * 5600 MHz [120] (17.0 dBm)
            * 5620 MHz [124] (17.0 dBm)
            * 5640 MHz [128] (17.0 dBm)
            * 5660 MHz [132] (17.0 dBm)
            * 5680 MHz [136] (17.0 dBm)
            * 5700 MHz [140] (17.0 dBm)
            * 5745 MHz [149] (17.0 dBm)
            * 5765 MHz [153] (17.0 dBm)
            * 5785 MHz [157] (17.0 dBm)
            * 5805 MHz [161] (17.0 dBm)
            * 5825 MHz [165] (17.0 dBm)
    valid interface combinations:
         * #{ managed } <= 2048, #{ AP, mesh point } <= 8, #{ P2P-client, P2P-GO } <= 1, #{ IBSS } <= 1,
           total <= 2048, #channels <= 1, STA/AP BI must match
         * #{ WDS } <= 2048,
           total <= 2048, #channels <= 1, STA/AP BI must match
         * #{ IBSS, AP, mesh point } <= 1,
           total <= 1, #channels <= 1, STA/AP BI must match, radar detect widths: { 20 MHz (no HT), 20 MHz, 40 MHz }

    HT Capability overrides:
         * MCS: ff ff ff ff ff ff ff ff ff ff
         * maximum A-MSDU length
         * supported channel width
         * short GI for 40 MHz
         * max A-MPDU length exponent
         * min MPDU start spacing
Wiphy phy0
    max # scan SSIDs: 4
    max scan IEs length: 2257 bytes
    Retry short limit: 7
    Retry long limit: 4
    Coverage class: 0 (up to 0m)
    Device supports AP-side u-APSD.
    Device supports T-DLS.
    Available Antennas: TX 0x1 RX 0x1
    Configured Antennas: TX 0x1 RX 0x1
    Supported interface modes:
         * IBSS
         * managed
         * AP
         * AP/VLAN
         * WDS
         * monitor
         * mesh point
         * P2P-client
         * P2P-GO
    Band 1:
        Capabilities: 0x11ce
            HT20/HT40
            SM Power Save disabled
            RX HT40 SGI
            TX STBC
            RX STBC 1-stream
            Max AMSDU length: 3839 bytes
            DSSS/CCK HT40
        Maximum RX AMPDU length 65535 bytes (exponent: 0x003)
        Minimum RX AMPDU time spacing: 8 usec (0x06)
        HT TX/RX MCS rate indexes supported: 0-7
        Frequencies:
            * 2412 MHz [1] (17.0 dBm)
            * 2417 MHz [2] (19.0 dBm)
            * 2422 MHz [3] (19.0 dBm)
            * 2427 MHz [4] (19.0 dBm)
            * 2432 MHz [5] (19.0 dBm)
            * 2437 MHz [6] (19.0 dBm)
            * 2442 MHz [7] (19.0 dBm)
            * 2447 MHz [8] (19.0 dBm)
            * 2452 MHz [9] (19.0 dBm)
            * 2457 MHz [10] (19.0 dBm)
            * 2462 MHz [11] (18.0 dBm)
            * 2467 MHz [12] (26.0 dBm)
            * 2472 MHz [13] (26.0 dBm)
            * 2484 MHz [14] (disabled)
    valid interface combinations:
         * #{ managed } <= 2048, #{ AP, mesh point } <= 8, #{ P2P-client, P2P-GO } <= 1, #{ IBSS } <= 1,
           total <= 2048, #channels <= 1, STA/AP BI must match
         * #{ WDS } <= 2048,
           total <= 2048, #channels <= 1, STA/AP BI must match
         * #{ IBSS, AP, mesh point } <= 1,
           total <= 1, #channels <= 1, STA/AP BI must match, radar detect widths: { 20 MHz (no HT), 20 MHz, 40 MHz }

    HT Capability overrides:
         * MCS: ff ff ff ff ff ff ff ff ff ff
         * maximum A-MSDU length
         * supported channel width
         * short GI for 40 MHz
         * max A-MPDU length exponent
         * min MPDU start spacing
# iw reg get
# iw reg get
country US: DFS-UNSET
    (2400 - 2483 @ 40), (N/A, 30), (N/A)
    (5140 - 5860 @ 160), (N/A, 30), (N/A)
# iw reg get
country 00: DFS-UNSET
    (2400 - 2483 @ 40), (N/A, 30), (N/A)
    (5140 - 5860 @ 160), (N/A, 30), (N/A)

(Last edited by v1s on 28 May 2016, 13:56)

Could it be because the they are using the ath9k module? Does it need patching?

The R2SHPn uses the AR9223 chipset
The R5SHPn uses the AR9220 chipset
The R52H use the AR5414 chipset

How can i install in archer c7 v2?i tri but dont install reghack2_1_ar71xx.ipk,can someone help me please?thanks.

Downloading http://wikisend.com/download/173764/reg … r71xx.ipk.
Collected errors:
* deb_extract: /tmp/opkg-bFNY9y/reghack2_1_ar71xx.ipk: invalid magic
* pkg_init_from_file: Failed to extract control file from /tmp/opkg-bFNY9y/reghack2_1_ar71xx.ipk.

(Last edited by tejos on 29 May 2016, 13:34)

Hello , i wonder this hack will work on WRT1900AC V1 /not atheros chipset/ .Maybe only second part needed /i mean "reghack2 /lib/modules/*/cfg80211.ko" /

tejos wrote:

How can i install in archer c7 v2?i tri but dont install reghack2_1_ar71xx.ipk,can someone help me please?thanks.

Downloading http://wikisend.com/download/173764/reg … r71xx.ipk.
Collected errors:
* deb_extract: /tmp/opkg-bFNY9y/reghack2_1_ar71xx.ipk: invalid magic
* pkg_init_from_file: Failed to extract control file from /tmp/opkg-bFNY9y/reghack2_1_ar71xx.ipk.

The link is down as of this writing, but since that's a file hosting service, my guess is that you were downloading an HTML document and that's why opkg failed.

If you can't or don't want to install this as a package, you can extract the binary from bolvan's upload, SCP it to /tmp, and then proceed like with the "old" reghack.

bolvan wrote:
johndoe wrote:

Thanks for testing, bolvan! I would also appreciate it if you could supply the binary.

uploading ipk's for arm sunxi and ar71xx mips
they are static compiled and should not depend on version of libc
I also prepared ready to build package definition to be copied to $buildroot/package
easy to build with an SDK
https://www.sendspace.com/file/dqkkuo
Unfortunately i'm on x86 linux but SDK requires amd64. So the only option for me is to compile toolchains for every other arch.

Hi I got a question, for using this with Buildroot, do I only have to put it in $buildroot/package or are there more steps involved?

When creating a firmware I always install a few feeds and then use makeconfig to select the items. I don't know if this steps also need to be done for the reg hack.

By the way the ipk works on a WNDR4300 (Netgear), you need to select channel 6 on 2,4 Ghz to get 26 mW and put it on World, for the 5Ghz if you put it on channel 52 and World you get max 23 mW. I don't know for other router model but maybe this can put someone in the right direction.

(Last edited by bladeoner on 16 Aug 2016, 17:50)

Hi all,

I tried this hack. I can see that the power values it is showing is 30dBm but unfortunately it is not changing to any other power level than 20dBm. and I am still stuck at 100mW. When I applied the patch the first rule on cfg80211.ko showed some mismatch while the rest of the rules applied on ath.ko and cfg80211.ko. My trunk is the latest CC. Please help!!!!!!!!

(Last edited by khmtambi on 24 Oct 2016, 06:20)

bladeoner wrote:

When creating a firmware I always install a few feeds and then use makeconfig to select the items. I don't know if this steps also need to be done for the reg hack.

make package/reghack/compile V=99
look in bin/packages

khmtambi wrote:

I tried this hack. I can see that the power values it is showing is 30dBm but unfortunately it is not changing to any other power level than 20dBm.

Seeing there 30 dbm does not necessary mean hardware can support it

Worked as charm on my Archer C7 v2, big thansk to jow, johndoe, bolvan

root@OpenWrt:/tmp# opkg install reghack2_1_ar71xx.ipk 
Installing reghack2 (1) to root...
Configuring reghack2.
root@OpenWrt:/tmp# reghack2 /lib/modules/*/ath.ko
mmap(): Invalid argument
Memory mapping failed (missing fs support?), retrying from tmpfs
Patching @ 0x00000308: ath_is_radar_freq() MIPS opcode in ath/regd.o
Patching @ 0x00000414: ath_is_radar_freq() MIPS opcode in ath/regd.o
Patching @ 0x000034cc: ath world regdomain with 5 rules in ath/regd.o
Patching @ 0x0000356c: ath world regdomain with 4 rules in ath/regd.o
Patching @ 0x000035f0: ath world regdomain with 4 rules in ath/regd.o
Patching @ 0x00003674: ath world regdomain with 5 rules in ath/regd.o
root@OpenWrt:/tmp# reghack2 /lib/modules/*/cfg80211.ko
mmap(): Invalid argument
Memory mapping failed (missing fs support?), retrying from tmpfs
Patching @ 0x00027da4: core world8(?) regdomain in cfg80211/reg.o (new rule)
Patching @ 0x000296f0: embedded US regdomain in cfg80211/regdb.o (new rule)
Patching @ 0x0002f0e8: embedded 00 regdomain in cfg80211/regdb.o
root@OpenWrt:~# reboot
root@OpenWrt:~# iw reg get
country 00: DFS-UNSET
        (2400 - 2483 @ 40), (N/A, 30), (N/A)
        (5140 - 5860 @ 160), (N/A, 30), (N/A)
root@OpenWrt:~# iw list
Wiphy phy0
...
                Frequencies:
                        * 5180 MHz [36] (30.0 dBm)
                        * 5200 MHz [40] (30.0 dBm)
                        * 5220 MHz [44] (30.0 dBm)
                        * 5240 MHz [48] (30.0 dBm)
                        * 5260 MHz [52] (30.0 dBm)
                        * 5280 MHz [56] (30.0 dBm)
                        * 5300 MHz [60] (30.0 dBm)
                        * 5320 MHz [64] (30.0 dBm)
                        * 5500 MHz [100] (30.0 dBm)
                        * 5520 MHz [104] (30.0 dBm)
                        * 5540 MHz [108] (30.0 dBm)
                        * 5560 MHz [112] (30.0 dBm)
                        * 5580 MHz [116] (30.0 dBm)
                        * 5600 MHz [120] (30.0 dBm)
                        * 5620 MHz [124] (30.0 dBm)
                        * 5640 MHz [128] (30.0 dBm)
                        * 5660 MHz [132] (30.0 dBm)
                        * 5680 MHz [136] (30.0 dBm)
                        * 5700 MHz [140] (30.0 dBm)
                        * 5745 MHz [149] (30.0 dBm)
                        * 5765 MHz [153] (30.0 dBm)
                        * 5785 MHz [157] (30.0 dBm)
                        * 5805 MHz [161] (30.0 dBm)
                        * 5825 MHz [165] (30.0 dBm)

There are new for AR9220
Many thanks

The discussion might have continued from here.