Hello all,
I just bought a wdr4300 V1.6 router and I'm really happy with the increased speeds.
I had a wrt150n before. This is a nice upgrade.
I managed to first install 15.05. Everything went smooth, managed to configure everything, but I noticed on the 2.4GHz interface I can't get past the 17dBm power setting. I have as an option also 18/19/20dBm. On either of those the TX power remains at 17dBm. Channel is set at 6, and BW at 40MHz as I live in a more remote area. I think I'm the only one with wifi in a 500 meter radius. Also I tried turning the 5GHz interface off. I played with the country codes, tried Germany, US and Canada. Still no joy.
I've read online that some managed to set it to 20dBm, in various firmwares (stock, dd-wrt, openwrt), but mine caps at 17dBm.
This happened in 15.05, 15.05.1, and now I'm on 49975 with no change.

root@OW:~# iwinfo wlan0 txpower
   0 dBm (   1 mW)
   1 dBm (   1 mW)
   2 dBm (   1 mW)
   3 dBm (   1 mW)
   4 dBm (   2 mW)
   5 dBm (   3 mW)
   6 dBm (   3 mW)
   7 dBm (   5 mW)
   8 dBm (   6 mW)
   9 dBm (   7 mW)
  10 dBm (  10 mW)
  11 dBm (  12 mW)
  12 dBm (  15 mW)
  13 dBm (  19 mW)
  14 dBm (  25 mW)
  15 dBm (  31 mW)
  16 dBm (  39 mW)
* 17 dBm (  50 mW)
  18 dBm (  63 mW)
  19 dBm (  79 mW)
  20 dBm ( 100 mW)

Tried to set it via terminal with

iw dev wlan0 set txpower fixed 2000

and via luci. Also tried the reghack thing, no change.

5GHz works nice at 17dBm:

root@OW:~# iwinfo wlan1 txpower
   0 dBm (   1 mW)
   1 dBm (   1 mW)
   2 dBm (   1 mW)
   3 dBm (   1 mW)
   4 dBm (   2 mW)
   5 dBm (   3 mW)
   6 dBm (   3 mW)
   7 dBm (   5 mW)
   8 dBm (   6 mW)
   9 dBm (   7 mW)
  10 dBm (  10 mW)
  11 dBm (  12 mW)
  12 dBm (  15 mW)
  13 dBm (  19 mW)
  14 dBm (  25 mW)
  15 dBm (  31 mW)
  16 dBm (  39 mW)
* 17 dBm (  50 mW)

One other issue is that my computer connects on 20MHz instead of 40Mhz on the 2.4GHz interface. I don't know why. Tried with noscan '1' but still 20MHz.

root@OW:~# cat /etc/config/wireless 

config wifi-device 'radio0'
    option type 'mac80211'
    option hwmode '11g'
    option path 'platform/ar934x_wmac'
    option country 'DE'
    option noscan '1'
    option txpower '20'
    option channel '6'
    option htmode 'HT40'

config wifi-iface
    option device 'radio0'
    option network 'lan'
    option mode 'ap'
    option encryption 'psk2'
    option ssid '2.4GHz'
    option key 'password'

config wifi-device 'radio1'
    option type 'mac80211'
    option hwmode '11a'
    option path 'pci0000:00/0000:00:00.0'
    option htmode 'HT40'
    option country 'DE'
    option channel '136'
    option txpower '17'

config wifi-iface
    option device 'radio1'
    option network 'lan'
    option mode 'ap'
    option encryption 'psk2'
    option ssid '5GHz'
    option key 'password'

Wiphy phy0
    max # scan SSIDs: 4
    max scan IEs length: 2257 bytes
    max # sched scan SSIDs: 0
    max # match sets: 0
    Retry short limit: 7
    Retry long limit: 4
    Coverage class: 0 (up to 0m)
    Device supports AP-side u-APSD.
    Device supports T-DLS.
    Available Antennas: TX 0x3 RX 0x3
    Configured Antennas: TX 0x3 RX 0x3
    Supported interface modes:
         * IBSS
         * managed
         * AP
         * AP/VLAN
         * WDS
         * monitor
         * mesh point
         * P2P-client
         * P2P-GO
         * outside context of a BSS
    Band 1:
        Capabilities: 0x11ef
            RX LDPC
            HT20/HT40
            SM Power Save disabled
            RX HT20 SGI
            RX HT40 SGI
            TX STBC
            RX STBC 1-stream
            Max AMSDU length: 3839 bytes
            DSSS/CCK HT40
        Maximum RX AMPDU length 65535 bytes (exponent: 0x003)
        Minimum RX AMPDU time spacing: 8 usec (0x06)
        HT TX/RX MCS rate indexes supported: 0-15
        Frequencies:
            * 2412 MHz [1] (19.0 dBm)
            * 2417 MHz [2] (20.0 dBm)
            * 2422 MHz [3] (20.0 dBm)
            * 2427 MHz [4] (20.0 dBm)
            * 2432 MHz [5] (20.0 dBm)
            * 2437 MHz [6] (20.0 dBm)
            * 2442 MHz [7] (20.0 dBm)
            * 2447 MHz [8] (20.0 dBm)
            * 2452 MHz [9] (20.0 dBm)
            * 2457 MHz [10] (20.0 dBm)
            * 2462 MHz [11] (18.0 dBm)
            * 2467 MHz [12] (20.0 dBm)
            * 2472 MHz [13] (20.0 dBm)
            * 2484 MHz [14] (disabled)
    valid interface combinations:
         * #{ managed } <= 2048, #{ AP, mesh point } <= 8, #{ P2P-client, P2P-GO } <= 1, #{ IBSS } <= 1,
           total <= 2048, #channels <= 1, STA/AP BI must match, radar detect widths: { 20 MHz (no HT), 20 MHz, 40 MHz }

         * #{ WDS } <= 2048,
           total <= 2048, #channels <= 1, STA/AP BI must match
    HT Capability overrides:
         * MCS: ff ff ff ff ff ff ff ff ff ff
         * maximum A-MSDU length
         * supported channel width
         * short GI for 40 MHz
         * max A-MPDU length exponent
         * min MPDU start spacing

I want to mod the antennas so I get a decent 2.4GHz coverage in my house. I've seen Andrew Mcneil's clip on Youtube on how to add two pigtails for 2.4GHz tuned antennas, also going to mod the original antennas for 5GHz. So I'd like to extract all the juice the router can muster, without damaging it or breaking the law. Maybe add some heatsinks on the chips. What else could I try to get to 100mW on the 2.4Ghz interface?

(Last edited by bob808 on 1 Nov 2016, 02:56)

Ideas?

you need to hack art partition. if you compiled your own image with ATH_USER_REGD enabled it would not allow you to set anything over 17dBm

I used reghack at some point but to no avail.
I did not compile it myself. If I do I should not enable ATH_USER_REGD right? But then everything else should work fine?
Also, could I just "hack" the art partition as it is now? If so, using a HEX editor might do the job? Any idea on the address and value? I dumped the art partition and I have the file.

reghack wont do anything with txpower only unlock channels 12 and 13.

you should enable ATH_USER_REGD because if you don't there won't be any use of hacked art even if you can set 27dBm just as there is no use now of changing it to more than 17dBm.

for the addresses check similar topics or ar9300_eeprom-master

Right now I used the precompiled images. So I don't know what state ATH_USER_REGD is in now.
Should I compile my own with ATH_USER_REGD enabled and then search for how to hack the ART partition?

it is always disabled in images downloaded from website. there were several attempts in the past to make it enabled by default but devs didn't do it because atheros required to set it disabled by default or something like that.

yes, that's how you should do it.

Great, thanks for the info!
Any other things I should look out for while compiling? Any other recommended options on/off?

Those are incompatible, HT40 means 11n. So try "hwmode 11n" (or maybe 11ng will work, if you need compatibility with 11g devices). Please also note that your client needs to be configured to support 40MHz, if it can.

Be aware that increasing tx power does not necessarily improves the link quality. It may very well have the opposite effect.

no idea. if you have any other problem after compiling post here and somebody will guide you what to do.

@rambler that was changed somewhere since BB and hwmode 11g is correct for N mode, maybe he could check coexistence option or something similar regarding N mode. or it might be PC driver failure (windows?)

Time flies and things change... We get older. Regretfully, such changes are not, to my knowledge, properly documented anywhere.

I'm using an iMac (recent model).

I managed to compile and install the latest build. Runs nice. I enabled ATH_USER_REGD.
I dumped my art partition, I modified it with ar9300_eeprom tool. Now I'm trying to replace the art partition but:

root@OW:/tmp# mtd -r write /tmp/art.backup art
Could not open mtd device: art
Can't open device for writing!

Of course. ART partition is read-only by default. Your options are:
- hook up serial console and learn to use it;
- install pepe2k's u-boot and learn to use it;
- compile OpenWrt, removing R/O attribute of ART partition (or get somewhere a compiled version  with write permissions).

phy#1
    Interface wlan1
        ifindex 9
        wdev 0x100000002
        addr xx:xx:xx:xx:xx:xx
        ssid 5GHz
        type AP
        channel 136 (5680 MHz), width: 40 MHz, center1: 5670 MHz
        txpower 17.00 dBm
phy#0
    Interface wlan0
        ifindex 10
        wdev 0x2
        addr xx:xx:xx:xx:xx:xx
        ssid 2.4GHz
        type AP
        channel 6 (2437 MHz), width: 40 MHz, center1: 2447 MHz
        txpower 17.00 dBm

Seems like it might be working on 40MHz, just that my computer doesn't want to connect on that, or maybe it misreports it. This is not really an issue right now.
I'm trying to experiment with different wifi antennas for good 2.4GHz coverage upstairs as well. I don't want to "set it to max power", I just want to be able to use the most the router can offer so I can test a good setup. Theoretically I'd lower the power until I see that I loose signal quality, and leave it at that. But right now I want to be able to use everything the router is able to offer in terms of power output, in a way that doesn't damage the amplifiers. I presume a 20-22dBm is a max setting for 2.4GHz. I think I read somewhere that the 5GHz has a hardware cap at 20dBm but I'm not sure. The 5GHz is not important right now as I can only use it on the first floor, and it provides good coverage already. 2.4GHz is what I want to tune.

I don't know if pepe2k released u-boot for my router. I'll check on that.
Easiest route seems to be to compile again the firmware, removing the R/O attribute of the art partition.
Any tips on where I set this?
After I rewrite the art partition, can I again install the firmware that I have right now so ART partition is not writable anymore? I don't like to have it writable, who knows...

Yes he has.

I'm not sure, I haven't done it myself. It seems you have to modify target/linux/ar71xx/files/drivers/mtd/tplinkpart.c and comment out parts[3].mask_flags = MTD_WRITEABLE; (or set it to zero). As I said, I'm not completely sure. Maybe someone else will step in and advise.

Yes, of course.

Great, thanks!
I read on some older versions I had to edit some (art)ro field removing the "ro" part, but that's not in the Makefile anymore.
I'll look up your suggestion.

I can't find a downloadable u-boot file to rewrite mine. I think I have to compile it myself? Couldn't find any 4300 resources on this matter. I'd have a read before attempting it.

Also I read this from the github README file:

But invoking u-boot-upgrade doesn't work. For one, I have to remove the write protection from the uboot partition as well, then the command spits out a not found error:

root@OW:/tmp# u-boot-upgrade
-ash: u-boot-upgrade: not found

I found an image from pope's server. I think I figured it out. I need to backup my u_boot partition, then combine my bin with the bin downloaded from pepe and then write the result back to the partition?

*edit

never mind, I managed to sort it out. There's a 14.04 build that Pepe has on GitHub, it contains the said script. So I just install that, run the script, u_boot is updated with the modded one, then I can install the latest release and keep the modded u_boot. I'll report with the results once I'm done.

**edit

Wrote the firmware with the writable art partition. Uploaded the modified art binary file to the router, then wrote the art partition with no problem. I can confirm that I can set the 2.4GHz tx to 20dBm now, and the router reports it. So now I need to play with the settings and check the power levels around the house while testing some antenna designs.
Only thing left to do is write the u_boot partition with the modded one. I'll update when I have done that as well.

***edit

Managed to get everything in order. Replaced art/u_boot partitions, can increase signal no problems. Am now on the latest trunk without write permissions on the art/u_boot partitions. Enough compiling for today.
Just need to find a country code that allows me to set the maximum power for 40MHz both radios at once. Some tests show that some higher power settings are not stable.
Does anyone know the theoretical hardware limit for the amplifiers on the WDR-4300 (2.4GHz & 5GHz) without the antenna gain factored in? I don't want to force over that, and even that with some cooling for sure.
Thanks once again for your help!

(Last edited by bob808 on 3 Nov 2016, 01:29)

Glad you sorted it out. The datasheet AR9341.pdf says 17 dBm on 2.4 MHz band is typical. It is probably safe to assume that the absolute maximum theoretical power for any consumer router ever designed is 23 dBm (200 mW) (incidentally, it would break the law to have more). There’re claims to the contrary on the internet; judge yourself. In practice, it’s probably more like 20 dBm (100 mW). Portable devices will deliver less than half that much. A typical laptop WiFi card will probably generate about 15 dBm (25 mW) radio power.

I will open up the router again to have another look at the power amps for both bands. They should give me an idea on the real power. Also, I want to try and separate the 2.4GHz from 5GHz antenna traces. Just need to look up the datasheet for the power amps on the 2.4GHz on the recommended filter (should be a LC filter). This shouldn't be a complicated mod, and having separate antennas would improve the performance for both bands.
I am a bit curious, you say that there is that 23dBm limit. I've seen some Alfa cards (want to play with one of those), that are 2000mW rated. Here's one at 28dBm for 11bg (~600mW) : https://www.alfa.com.tw/products_show.p … amp;ps=241
The AWUS036NHV is rated up to 32dBm (1600mW!!). Also I've seen people testing them with lab gear and staying consistent at 31dBm...

I identified the amplifiers used. They are made by Skyworks.
On the 5GHz line there are 3 x SE5005L amp chips : http://www.bdtic.com/DataSheet/Skyworks/SE5005L.pdf
On the 2.4GHz line there are 2 x SE2574BL-R amp chips: http://www.skyworksinc.com/uploads/docu … 02675A.pdf

SE5005L has a rating of 18dBm Output power for 54Mbps, and has an integrated filter, draws 200mA at max power output.
Also I see that for MCS0 HT20 - there’s a stated output of 22dBm, but that’s not 450Mbps So basically for 11a with an EVM of 3% you gain 18dBm. The compression point starts at 22-25dBm so forcing past that point it would heat the chip and loose power actually.

SE2574BL-R has a rating of 21dBm for 11b and 18.5dBm for 11g. Also has a filter included. The chip draws 165mA at 20dBm for 11b, and 140mA at 18dBm for 11g. Basically almost 1A with all amps to the max. The compression point starts at about 25dBm, so you could theoretically push these chips a bit.

I hope I read the datasheets correctly. I presume a 19dBm should be ok for both bands. More than that and you get diminishing returns.
The way to get more performance out of it at this point is to separate the 2.4GHz from the 5GHz line, and add proper antennas on both. Should make for really nice coverage this way while not being a beast.

It's hard to separate the RF-stage without adding additional loses due to impedance mismatching. You may look for good dual band antennas or make them by yourself.
Beside this, this router never will be a 2,4Ghz beast.
Instead of patching ART you can also make some minor tweaks in the sources to handle too restrictive regulations

Impedance mismatching between the two bands? That shouldn't matter as there are different chips handling the data.
Impedance mismatching between the two 2.4GHz traces, then right now they are not equal. One is longer than the other by a fair bit, and I see they didn't take any action on that on the physical layout of the traces. No squiggly traces to match the length of both lines.
I was thinking of soldering the center of the coax directly on the capacitor, on both 2.4GHz lines.

I noted the traces in the photos down below.
Clearly the traces are not equal. With equal pigtails I presume the lines would be pretty balanced. The mesh can be connected on the golden traces I presume. Removing the cap and soldering it 90 degrees offset should break the link to the 5GHz line, or just destroy the via next to the cap.