-
Notifications
You must be signed in to change notification settings - Fork 0
Expand file tree
/
Copy pathBUILD-CERTIFICATE.txt
More file actions
72 lines (60 loc) · 4.02 KB
/
Copy pathBUILD-CERTIFICATE.txt
File metadata and controls
72 lines (60 loc) · 4.02 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
================================================================
AR9271 Custom Firmware — First Sovereign Build
Path 1/3 WiFi Stack Mastery
================================================================
Chip : Qualcomm Atheros AR9271 802.11n USB
Dongle : TP-Link branded, ath9k_htc-compatible
USB ID : 0cf3:9271
EEPROM regdomain : 0x809c (country code CN per ath0 logs)
Inventory ref : INV-028
Build target : htc_9271.fw (firmware-RAM resident)
Size : 51008 bytes (identical slot to vendor 1.4.0)
Build SHA256 : fbabfc46ee68eda41355e0c5f40360237fe153d942354963fdaceaeb20d9d2a4
Vanilla HEAD SHA256 : ec2676eb299e9d0cac90df12ad076b300acdac085b0ca4e088febb7f35ef7cea
(without sovereign signature, for reference)
Embedded signature : SOVEREIGN-BUILD:mateusz-wala:2026-05-11:ar9271-firmware-recompile-path1
Signature location : wlan/if_ath.c (static const char with __attribute__((used)))
Verify command : strings htc_9271.fw | grep -i sovereign
Timestamp : 2026-05-11 21:21 CEST
Operator : Mateusz Wala (syriusm@gmail.com)
Source repo : qca/open-ath9k-htc-firmware (HEAD: e888634, 2023-11-03)
Source location : ~/Projekty/ath9k-htc-firmware/
Output location : ~/Projekty/ath9k-htc-firmware/target_firmware/htc_9271.fw
Build environment : Docker debian:11 (bullseye)
GCC 10.2.1 (Debian 10.2.1-6) — matches repo requirements
Reason: host GCC 16.1.1 too new, GMP 6.2.0 K&R-style
functions fail "long long reliability test 1"
Toolchain : xtensa-elf-gcc 10.2.0 (target: bare-metal xtensa)
Toolchain build : ~/Projekty/ath9k-htc-firmware/toolchain/inst/bin/
Toolchain config : AR9271 k2-core (XCHAL_HAVE_DIV32=0, MUL32_HIGH=1,
XSHAL_USE_ABSOLUTE_LITERALS=1) per local/patches/gcc.patch
Bootstrap libs : binutils 2.35 + GCC 10.2.0 + GMP 6.2.0 + MPFR 4.1.0 + MPC 1.1.0
Live test : LOAD SUCCESS via use_dev_fw=1 mechanism
Test script : _workshop/test-sovereign-fw.sh (auto-rollback)
Test evidence : dmesg shows transferred 51008B + HTC init 33 credits +
FW Version: 1.4 + AR9271 Rev:1 + wlan_ap interface up
dmesg quote :
[15767.941398] usb 1-7: ath9k_htc: Firmware ath9k_htc/htc_9271-1.dev.0.fw requested
[15769.028664] usb 1-7: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.dev.0.fw, size: 51008
[15769.275417] ath9k_htc 1-7:1.0: ath9k_htc: HTC initialized with 33 credits
[15769.501790] ath9k_htc 1-7:1.0: ath9k_htc: FW Version: 1.4
[15769.505162] ieee80211 phy17: Atheros AR9271 Rev:1
[15769.510881] ath9k_htc 1-7:1.0 wlan_ap: renamed from wlan0
Safety : Production firmware htc_9271-1.4.0.fw NEVER touched.
Custom build uses use_dev_fw=1 → separate path.
Auto-rollback: rmmod + modprobe (default) + restart
hostapd-balkon. Verified clean rollback in 42s.
What was learned :
- AR9271 firmware is THIN (USB protocol, low-level MAC, WMI handler).
Most policy (LED, retry, regulatory) lives in kernel ath9k_htc, not FW.
- TX power is EEPROM-driven, not firmware-driven. For TX boost: Path 2
(CH341A EEPROM reflash) needed.
- Realistic firmware modifications: embedded signatures, debug strings,
frame injection logic (PR #163 cloudswei/ctlframe_injection 2023 = 3 lines).
Significance : First permanent verifiable firmware build by Mateusz
Wala. Signature visible in binary via `strings`,
cryptographic SHA256 unique. Cannot be forged without
rebuilding from source using same Xtensa toolchain.
================================================================
"Built it, signed it, loaded it on the live chip — twice."
================================================================