Discussion in 'Tomato Firmware' started by flying, Sep 22, 2015.
where i can find toastman tenda ac15 files ?
I think wds fuction is not working.
Can anyone check please ?
I was interested in installing Tomato for this router so that I can put it in AP mode, but it appears to be that the 5GHz band doesn't have very good range, which is a dealbreaker for me. Does anyone know if it is possible to put this router in AP mode without using Tomato?
Just got my router today and frustrated with the lack of thorough firmware esp with port forwarding. Can anyone post the link to the newest firmware? sorry found it - is "tomato-TendaAC15-9008.5Toastman-ARM-VPN-64K.trx" the most up to date? whats the default login info for wifi? root/admin Thanks
Hi, I just tried to enable and format jffs from Admin menu, but it keeps showing "stopped". Does this feature work on AC15?
By the way, is there any updates on 5GHz signal strength issue?
Has the community given up on the 5GHz?
I am running Toastman 9008.8 on a couple of Tenda AC15 routers and both seem to work well other than the reported 5 Ghz signal strength problem.
What I have noticed that seem odd on both routers is whenever I add Virtual Wireless Interface wl0.1 it is always assigned the same MAC Address as Wireless Interface eth2.
Thinking it might have been something I had caused since I had inadvertent restored a configuration for one router onto the other router or maybe the other way around, who knows, I reset one of the routers by holding down the reset button while applying power. After about 30 seconds or so I was back at Tenda's CFE page or whatever that is called.
I then installed the original firmware that @marto12 developed from @Shibby 132 as I recall. It does the same thing as show below.
Note that eth2 / 5 Ghz and Wireless Interface wl0.1 which is 2 Ghz have the same MAC Address.
Everything seems to work but is this normal?
i guess it is. that's why im downgrade to the Tenda's lates firmware. 5ghz signal is greats!
@shibby20 This Tenda AC15 (AC1900) router is working quite well on your firmware with the modifications @marto12 made to make it compatible. Could you please check out his work and merge this into your codebase so that we will have official builds of Tomato by Shibby for this router? I would like to upgrade my router to the new v140. He supplied his diffs file in the Google Drive folder linked in the quote below. Thanks!
WikiDevi link for quick reference if you need it: https://wikidevi.com/wiki/Tenda_AC15
With Tenda AC15 Firmware V15.03.1.17_EN the 5G appears to work well. It always shows full bars in the area around the router. With tomato-TendaAC15-138-VPN-64K.bin I get half of the full bars on iphone, computer, etc. I changed the transmit power to 0 which is the hardware default. Any ideas on how the Tenda firmware fixed the 5G problem or least gives the appearance of full bars near the router?
@kille72 has added support for this router in its fork for Tomato by Shibby multivan, maybe someone will test it out, who has Tenda ac15
I'll flash one now - let you know how I get in a few days..
Thanks for the notice. I flashed the latest version (not the linked beta), and so far so good! Didn't even clear NVRAM. Maybe I should!
Sounds good! Give us a little review when you're ready
Still waiting for review
First things first: thank you for supporting AC15!
quick and dirty test:
Installed it yesterday, this went smooth although it complained that there are two conflicting Interfaces (br0 and br1 if I recall correctly), I deleted br1 in the Basic section and it acceptedt the changes. I did a comparison on two Computers - Macbook Air 2011 with line of sight to the router, ca. 5 m distance and iMac about 10 m away, no direct line of sight, Signal has to go through two walls. On the Air both 2.4 an 5 Signal was OK and negotiated Speeds (according to MacOs Taskbar) were similar to original FW. The iMac on the other could not connect to 5 at all and 2.4 Signal was weaker. I had to revert to original FW - I had crucial work that had to be done on the iMac.
Coming from Tomato on WL-500gP V1 and RT-N10 I was so happy to see the beleved interface again... I am also keen on switchng from PPTP to OpenVpn for my VPN
will Keep an eye on future builds and test further
I have two of these Tenda AC15 Routers running Toastman firmware. Don't remember the version but it was his latest and they work remarkably well and are stable. Only issue is the 5 Ghz band range as is well know to all.
Picked up another one to use as a spare and loaded kille72 2017.2 version using the instructions by Techie002 in post 2 of this thread. Went off without a hitch.
Router has only been running about an hour but all seems well. I setup three subnets and two VLANs and have one vlan port tagged for two subnets (bro and br1) as on my other routers. They seem OK so far as I can tell.
Wireless 5 Ghz is about the same and since I think the drivers are same as Toastman and Shibby the range seems to be limited as expected.
I have noticed on both Shibby and Toastman versions that when multiple SSID and Subnets are assigned that one or more of the interfaces will end up with the same MAC address. This occurs in this firmware as well. I have to go into Advanced, MAC address and change one of the duplicates to a unique address. Really not a problem if you know about it. This is probably what happened to JuiCe_pl in the previous post.
Overall looking good.
Somewhat of a newbie here. Picked up the AC15 from microcenter. Just wanted to make sure I'm on the latest and greatest - I flashed Marto's bin file, then flashed the trx file from kille72's 2017.2.
All seems to be working. I'm on the latest tomato version compatible for this router now right?
I am using AC18 which has the similar spec with AC15, but the AC18 cannot boot up with TOMATO (both AC15 and AC68U ver). Could someone port TOMATO for AC18 also? If it is possible, what kind of information should I provide? Thanks.
thanks for your support Kille72 please do add how to go back to factory firmware.
Use the same method you used to load Tomato (through the router's CFE), and be sure to clear NVRAM while there too.
I would like to thank you for supporting this router. Compared to the older modified Shibby firmware I had before, I have experienced the following differences with this firmware:
+ TomatoAnon works.
+ UI seems more snappy and responsive.
+ Better support.
+ Newer code.
– Can't access most of the memory file system via SAMBA anymore (the root$ share). Returns Access is Denied on all the subfolders. I used to add custom L7 filters via the etc folder. The flip side of this is that I learned how to write a script that generated those files automatically at startup.
– The UI is slightly less unified; specifically, the "Applying settings" indicator on some of the pages doesn't fit in with the overall theme of the firmware as well as before.
These unique Tomato compatibility bugs remain:
5 GHz signal strength is extremely weak (as in barely usable at all). It is approximately 25 dB weaker than expected. Despite this, the 5 GHz band does work well, but only at close range.
2.4 GHz signal strength is slightly lower than with Tenda firmware. In both cases, I have tinkered extensively with the settings exposed by the GUI and have been unable to reproduce the transmit power achieved by the Tenda firmware—although I will mention that with Country set to #a and Transmit Power set to 400mW, this router has above average 2.4 GHz range. Just not quite as high as with the Tenda firmware.
And these outstanding Tomato firmware flaws remain:
Apple devices don't stay associated for long when in sleep mode. Something is wrong with how Tomato implements APSD Mode that causes them to disconnect after a few minutes. Increasing Beacon Interval and/or DTIM Interval seems to make it worse. I like to use 1000 and 10. 500 and 1 seems to be a good compromise, below which it doesn't seem to get measurably better.
Devices that gradually move out of range (like someone leaving a house with their smartphone) stay associated forever, showing frozen signal strength (RSSI) and TX/RX speeds under Device List.
Every once in awhile, the router slips into "guest mode" where all wireless clients are isolated from each other. I have experienced this problem on pretty much every router I've used that runs firmware based on Tomato—including ASUS stock firmware. To restore normal connectivity, one can reboot the router. This is annoying, and usually manifests by Windows File and Printer Sharing breaking, which 99.9% of users probably would never notice. Trying to ping from one device to other devices on the network confirms that there is no cross-device connectivity, only connectivity to the Internet. Some routers seem more prone to this than others. The Linksys E1200 and E1500 routers almost never do it. The Tenda AC15 and ASUS RT-N12/D1 router rarely do it. The Tenda N80 router does it quite often, usually within the first couple days of uptime. And ASUS RT-AC88U is a basket case.
Overall, even as it is, the Tenda AC15 is definitely, by far the best value for a 2.4 GHz router that one can buy. I recently tried upgrading to a ASUS RT-AC88U. In the 2.4 GHz band, the Tenda AC15 router is faster, has better range, and much better reliability/low packet loss. The Asus RT-AC88U is a complete disappointment. The only thing it did better was 5 GHz coverage.
I wish this excellent router (and the AC18—another excellent router for that matter) would receive better support from Tomato, and that perhaps these bugs can be fixed. These two Tenda routers are outstanding pieces of hardware at a value price, but shipped with cheap software.
I just wanted to report on my successful implementation of Tomato on my Tenda AC15.
2.4GHz N is great, and very configurable/tweakable. 5Ghz is ok.
Very nice design. And very functional. I had to enable CTF (Cut-Through Forwarding) to see Gigabit internet speeds. Before that, I was limited to about 260Mbps.
Thank you, devs, for all of your contribution to these communities!!
you can test https://exotic.se/tomato-arm/Test/
Does anybody have a full dump of the SPI? I got an AC15 for a few bucks, but it is stuck with just the power light on - I am suspecting someone's flash attempt going south (?) None of the reset attempts was successful - no CFE available...
Thanks in advance,
not the flash issue... moved it to a functional unit, booted as it should.
kinda waste of time, whateva, still fun : o ]
Flashed kille72's build today without much issue (took a few attempts in CFE though, kept timing out).
I thought I'd do a quick , non-scientific speed test while I was there, since this is my first experience with ARM, codel, and CTF. All QoS rules were deleted to remove any other processing bias. All tests with DHCP (non-pppoe). Measured in the router's bandwidth page & using Windows 10 SMB.
QoS Enabled, 250mbit , 50% sirq usage
QoS Disabled, 327 mbit , 50% sirq usage
CTF Enabled , about 900 Mbit, 50% sirq usage
This is a good result for the price of the device
Try the beta kille & pedro https://mega.nz/#F!QywknIpa!5JwWNIfEwCOKXqXG0AOh4w
Running the latest beta (2017.3b9-pedro) now. Right away I noticed that the signal strength indicators have been scaled to read higher with the same RSSI, and there's a new option in the Virtual Wireless section. For the moment, it seems to be working well. Time will tell! Probably the most annoying issue I'm having with the router right now is that from time to time, it goes in to Guest mode (isolated wireless clients). When it does this, the throughput to the Internet also drops to a couple Mb/s when it should be 8 Mb/s. Rebooting the router immediately solves the problem. It crops up randomly and I'm not sure what's triggering it, although I know that pretty much every router I've used with Tomato has had the issue in some form and severity.
Anyone notice that Shibby's sites are down? http://anon.groov.pl/ and http://tomato.groov.pl/ are both unreachable as I write this.
@pomidor1 @kille72 @pedro311 Just wanted to let you guys know that the 2.4 GHz WiFi has been extremely stable on 2017.3b9-pedro. iPhones/iPads stay associated when sleeping, other devices don't randomly drop and reconnect from time to time (instantly when awake, minutes/hours later if sleeping), and the router very accurately tracks associated/disassociated devices as they move in and out of range. Very pleased with these developments! Now this router's WiFi is more solid (and strong) than pretty much anything else on the market, and combined with very powerful software with a great GUI at that. I wish we could some of your bugfixes over on the MIPS builds for devices like the Linksys E1500!
I'm still keeping a wary eye out for the longtime guest/isolation bug that randomly pops up from time to time on pretty much any device running Tomato. I believe I've had it happen once on the AC15 since upgrading to 2017.3b9-pedro, but it hasn't happened since.
P. S. Upgrading to 2017.3b13-kille72 now...
I'm just a loyal fan @kille72, @pedro311, @M_ars @marto12,@Toastman. Because of its heavy and free work, this hardware strong router can delight many users with its alternative software. Thank you once again
I will take Tenda AC18, maybe I would buy it, if someone made port tomato on it, please ;-)
Is there any hope of getting the ac15 on DDWRT?
May be it will intrested for somebody
I have got login/pass for telnet (port 23) access to Tenda AC15 standart firmware.
Confirmed this works on the latest Tenda AC15 Firmware dated August 9, 2017. Not sure what to do with it, but it does give Telnet access.
Lets you change the root password and the new password works until a reboot. Back to Fireitup at that point, which is probably normal.
May be it will intrested for somebody:
In standart Tenda firmware you can Backup all flash (full 16mb., include boot and settings) very sumply. It's worked for me.
"192.168.0.1/cgi-bin/DownloadFlash" and Save file. May be it will be usefull for restore dead router.
Please check your nvram setting for 5Ghz module use Telnet: "nvram get 1:boardflags2", "nvram get 1:boardflags3"
I think, 5Ghz Power Amplifaer maybe OFF in Tomato.
For AC15 hardware its settings must be:
But for ASUS hardware:
---- cut ----
# 0 = control 2GHz PAs with the digital PA control signals / 1 = control 2GHz PAs with the analog PA VERF LDO outputs
# 0 = control 5GHz PAs with the digital PA control signals / 1 = control 5GHz PAs with the analog PA VERF LDO outputs
---- end cut ----
Thank you for your input on this router so far. I agree with your hypothesis that the power amplifier for 5 GHz simply isn't turned on. But I checked on my router, and the NVRAM settings already matched your first set of numbers. I tried the ASUS numbers and a couple others, restarting the WiFi driver each time, with no detectable changes. Any other ideas? I'm sitting here with -50 dB on 2.4 GHz and -82 on 5 GHz. Not very usable! With the Tenda firmware, the 5 GHz signal is nearly as stong as the 2.4 GHz signal.
I have question about ac15: i can flash tomato in bin format from OFW and flash OFW in tomato in trx format. But i cant flash anything from CFE, during firmware upload from browser i've got connection drop, i can wait some time and i can reconnect to CFE and still i drop connection when i try to upload anything, even OFW.....
Whats going on? I've tried other browser and it does same, i tried other PC and it was same......
How do you know that the connection is dropping rather then the firmware upgrade going normally? It takes about five minutes for the router to flash the new firmware and reboot, during which the CFE is non-responsive. If you interrupt the router during this time, the flash will be unsuccessful. Also, have you set your PC to use a static IP address? (Step #2 in my first post.) If it's set to dynamic/auto and happens to get a compatible IP address while the router is online, when the router goes offline Windows will try to get an IP address when the connection comes back up. After not hearing from the DHCP server (which the CFE doesn't have) for a minute or two, Windows will switch its IP address to one in the default IP pool (169.254.*.*), which would cause your connection to the CFE to drop.
Double-check that you're using a static IP on your PC, disable your antivirus/antispyware software, redownload and extract the firmware file(s), attempt the firmware upgrade from Firefox, and give the router five minutes to upgrade itself and reboot.
Yes, i have set static IP (i tried now 192.168.1.10 it doesnt mater if it is .2 or .10, netmask 255.255.255.0), i tried different browsers (internet explorer, chrome, firefox). Tried disabling firewall and antivirus software. And always flashing ends same way. When i browse for firmware file and click Upload, i have progress in chrome status bar - transferring X% - it always hang at certain number while uploading file, then after a while i have connection drop. After it hangs there's no activity on that LAN port, excluding led flashing while refreshing CFE page. After like under a minute i can refresh straight to CFE, after power cycle it boots to old firmware with old settings. IDK is it HW failure? Everything is working fine except CFE flashing...
I experienced the same issue. It has been failing in the middle of upload with message "Peer reset the connection". I suspected that CFE server implementation is buggy and underlying functionality is slower than the the upload rate. I tried to slow down the upload from 1024 kbps to 16 kbps. I discovered that even very slow speeds like 16kpbs doesn't work correctly. I was getting random point of failure even with the same speed. So my theory about slow back end was abandoned. The best I've got was 87% of completeness on 512 kbps which actually seemed to be the most viable. After that I tried 256 kbps. I skipped it over during previous attempts and voila it worked! Currently I am running my Tenda AC 15 with tomato-TendaAC15-ARM--2017.3-kille72--VPN-64K.trx via CFE web.
It seems that some speed were too fast some too slow.
So if you want to use CFE web you should use 256 kpbs upload speed.
How to achieve it? Easily via Chrome. Go to developer mode ctrl + shift + i and add a new throttling setup.
Let me know whether it works in your case too.
Thanks for help, maybe it will be helpful in future.
It looks like it fixed itself. I discovered i was using crossover cable, i changed it for straight one - there was same behavior... I restarted PC NIC and probably then problem was fixed. Actually earlier there wasn't connection drop, but connection reset. After a while i've got:
"Upload completed. System is going to reboot.
Please wait a few moments."
Tried few more times and it works now.... Weird.
@kille72, @Sean B.: I have managed to dump the factory CFE on the Tenda AC15, running the latest factory firmware and reset to defaults after upgrading. This router has never run Tomato before. I got the files below by Telneting into the router and copying the files to the webroot folder, where I then downloaded them:
Tenda AC15 factory CFE values.txt (extracted from mtd1.bin)
Tenda AC15 factory mtd0.bin (16 MiB, full ROM?)
Tenda AC15 factory mtd1.bin (256 KiB, CFE)
Tenda AC15 factory mtd2.bin (15.8 MiB, firmware image?)
Tenda AC15 factory mtd3.bin (14.0 MiB, not sure)
Tenda AC15 factory mtd4.bin (64 KiB, all zeros)
Tenda AC15 factory mtd5.bin (64 KiB, not sure)
Tenda AC15 factory mtd6.bin (64 KiB, factory NVRAM?)
Tenda AC15 factory mtd7.bin (64 KiB, factory NVRAM?)
Tenda AC15 factory mtd8.bin (64 KiB, factory NVRAM?)
Tenda AC15 factory NVRAM.txt (nvram show > /webroot/nvram.txt)
Tenda AC15 factory wl.txt (wl > /webroot/wl.txt)
And for comparison, here's data from another Tenda AC15 running Tomato after being upgraded to the latest Tenda firmware, flashed to Tomato 2017.3, and then reset to defaults using the thorough erase. I did change a few settings (like timezone, switching 5G from 40 MHz to 80 MHz, and removing a lot of example and QoS values that bloated the NVRAM).
Tenda AC15 Tomato CFE values.txt (identical to factory)
Tenda AC15 Tomato mtd0.bin (256 KiB, CFE)
Tenda AC15 Tomato mtd1.bin (15.6 MiB, firmware image?)
Tenda AC15 Tomato mtd2.bin (14.0 MiB, not sure)
Tenda AC15 Tomato mtd3.bin (64 KiB, factory NVRAM)
Tenda AC15 Tomato NVRAM.txt (different MACs due to being a different router)
Tenda AC15 Tomato wl.txt (including version, revinfo, dump, and help)
Good job. I'll trying to track through the code and determine what values Tomato uses in comparison. If anyone that is currently running Tomato on this model would mind dumping the CFE + NVRAM it would be time saving.
Found a possible config issue. The Tenda AC15 uses a Broadcom BCM4360 radio the same as multiple other models including the EA6900, R7000, C9 etc. Except those models all use the same 2ghz and 5ghz power amps, on the 5ghz they use 3x Skyworks SE5003L1 5ghz power amp front end module ( FEM ), while the Tenda is using 3x Skyworks SKY85710-11 FEM. From what I'm seeing in the code for a board using a BCM4360 radio, both the 2ghz and 5ghz femctrl flags are set to 3.. IE:
While the stock Tenda CFE has the flags at 2ghz=3 5ghz=6, IE:
Max gain numbers are likely different as well, but considering the 5ghz output is nearly dead from what people have said on the AC15, I'm leaning twards the power amp/FEM not being switched properly ( from RX to TX circuit, or PA bypass ). Control flags are a decent possibility.
@Techie007 , when you have a moment would you run the command:
on your AC15 and post the output please.
Thank you for your expertise and input. I've got several Tenda AC15s laying around and will get back with you after the Christmas celebrations here. For now, I'll keep one on factory firmware while we try to figure these things out.
Merry Christmas everyone!
I have an AC15 on stock firmware, and ran that command. Hope it helps. Thanks for your efforts. Hopefully someone already running Tomato can dump CFE and NVRAM soon, or I'll install it temporarily. It's my only AC AP though.
~ # wl revinfo
~ # wl revinfo
@Sean B. I have collected the requested information. Logs and information for both routers/firmwares can now be found in my earlier post.
For quick comparison, the wl revinfo on Tenda firmware is as stated above by Nick, and the wl revinfo on Tomato is below:
~ # wl revinfo
Basically identical except for driverrev and ucoderev.
~ # wl revinfo
Now that you're running Tomato, lets export the binary CFE directly from the flash memory. You'll need to pull the file from the router, so mount a flash drive on the router and share it out via SMB or whatever way you prefer. Login via a telnet or ssh shell and run:
cat /dev/mtd0 > ac15-tomato.bin
Once you've pulled that file over to a computer, run:
nvram show | grep fem
It should return those two variables I mentioned before:
root@Storage:/tmp/home/root# nvram show | grep fem
size: 33330 bytes (32206 left)
If so, run:
nvram set 1:femctrl=6
And reboot. See if there's any change in 5ghz signal. At your convenience, upload that bin file here or to your preferred online storage site and post a link.
**NOTE** While the binary CFE will be in hex format, it will still contain some decipherable content. This may include usernames/passwords etc. If you'd prefer, send the file or download link in private message. If not comfortable sending at all, I certainly understand.
cat /dev/mtd0 > ac15-tomato.bin
nvram show | grep fem
root@Storage:/tmp/home/root# nvram show | grep fem
size: 33330 bytes (32206 left)
nvram set 1:femctrl=6
I actually have several of these routers laying around, and have two of them set aside for this debugging. One is running Tenda firmware and the other is running Tomato kille72 2017.3. Both are running near factory default settings, so I'm not concerned about any personal information getting revealed in the dumps. I had already dumped the Tomato CFE (and NVRAM) from the Tomato GUI and linked it in my earlier post. Per your request I redid that using the method of copying the /dev/mt* files directly. As expected, mt0 was binary identical to the version downloaded through the Tomato GUI. The settings are identical to the Tenda CFE as well, and the CFE binaries are extremely similar. The updated dumps are all on that edited earlier post.
Looking at the femctrl settings, they are already set correctly in all of my Tenda AC15 routers:
size: 30112 bytes (35424 left)
size: 30112 bytes (35424 left)
Thanks for going thru the trouble to get the binaries. There's no other way to confirm what really is in the CFE. For example, you can change the txpwr and ccode settings in nvram and commit them all day long. However the wl driver will not take txpwr past regulatory limit for the country code that is *defaulted* in the CFE.
And damn on the fem settings. There's likely a flag in the Tomato build code to single out the tenda that I haven't found as of yet. Can only scan through it so much before one goes cross eyed 8) . I'll continue seeing what avenues I can come up with.
Quite a lot of settings that are related either the 5ghz radio/power.. or board/regulatory information the driver may look at, are not in the tomato side. Here's a diff on the nvram outputs. Anything with the +'s is in the stock firmware and not in tomato. There's misc stuff that is just named differently or for things not in common of the 2 firmwares. But things like the boardvender= , and that large chunk of maxpa gain settings for the 5ghz radio, are all things that the driver would very likely be looking at.
And note the ccode setting. #a is a country code that is actually left over from a test mode in the driver. It doesnt return any values for " wl channels_in_country #a b" which is 5ghz. However, the code ALL ( like the stock firmware) does. " wl channels_in_country ALL b ". The ccode is directly related to regulatory allowed transmit power in the driver.
Scratch that last post for now. It was a long day an late night, realized I ran the wrong flags in diff , some of those lines may very well be in both nvram outputs just in different order. I'll go through it again when I get a moment.
I had sorted the NVRAM dumps before posting them, so that should help when comparing them. I have also run an online diff checker on the two NVRAMs to see if there was anything I could figure out. You can see that comparison here.
Based on that comparison, I went ahead and tried each of these, committing and rebooting the router each time:
Add 0:boardvendor=0x14E4 and 0/1:leddc=0xffff
0/1:ccode=#a > 0/1:ccode=ALL
1:mcsbw205ghpo=0xBA768600 > 1:mcsbw205ghpo=0x76543300 (x9 lines)
1a5ga0=0xFF4C,0x1808... > 1a5ga0=0xff2c,0x1a30... (x3 lines)
1:maxp5ga0=106,106,106,106 > 1:maxp5ga0=98,98,98,98 (x4 lines)
0:ccode=ALL > 0:ccode=#a
1:ccode=ALL > 1:ccode=#a
1:maxp5ga0=98,98,98,98> 1:maxp5ga0=150,150,150,150 (x4 lines)
The only thing that made any difference that I could tell was changing the ccode values from #a to ALL:
Changing it to ALL dropped the 2G signal strength by 10dB and made it unstable. 5G dropped by 2dB. Restoring ccode back to #a one at a time restored each radio in turn back to previous levels. I couldn't tell any difference when changing any of the other values. The router was sitting about 3 yards away from my PC in the above illustration.
Any other ideas?
Either A: It's rooted in the driver itself ( hence the different driver revisions reported between stock and tomato )
B: Attempting the different flags via NVRAM was just a easy and logical first thing to try. However, it's more than likely wl will ignore them. As I was discussing in earlier posts, wl trusts the CFE above NVRAM. Changing the required flags in NVRAM to gain more txpower from my 68P didn't do anything either, I had to make those changes to the CFE. Which makes sense, as Broadcom did not design the driver so its regulatory settings would be easy to circumvent, such as opening a shell and typing out a few nvram set commands.
Neither of these are easy things to test. Trying to pull the driver out of the stock firmware and into Tomato would be tricky at best. And carries the same risk as editing the CFE.. which is bricking the router. Editing the CFE requires precision. It has to remain exactly identical size. Any addition or subtraction to the overall file size from the required changes must be made up for in "padding" elsewhere. CRC checksums must match etc.
You stated you have several of these routers correct? If you would be willing to set one up and enable remote ssh of which I could have access to, I'd be willing to dig around in it an try to come up with a plan. However, those ventures would be too much to try an accomplish via forum postings back n forth.