Knowledgebase/Digging Into AirOS8

As AirOS AC devices don't have a setting to disable AirMAX, I started to dig into the default firmware in the hopes of finding a way to disable it. The device examined is a Ubiquiti IsoStation AC so all findings are specific for this device, although it probably is very similar for all AirMAX AC devices.

As of now I have not found a way to disable it but some things I found are interesting nonetheless so let's get started.

Linux System

After logging in via SSH the first thing I noticed is the ancient Linux and GCC version of the firmware...

Linux version 2.6.32.68 (jenkins@1a1f8fa80aab) (gcc version 4.8.3 (OpenWrt/Linaro GCC 4.8-2014.01 unknown) ) #1 Tue Jun 23 16:48:07 EEST 2020

While the firmware seems to be based on OpenWrt it doesn't really share anything in the userspace with OpenWrt (no overlayfs, no UCI, ...).

The init system also is very different to OpenWrt with /etc/init.d being completely empty but all init scritps residing in /etc/sysinit and being called by a single entry in /etc/rc.d.

Main Radio

The main radio is a U-AME-G1-BR4A which seems to be a customized version of the QCA988X v2 with added support for AirMAX hardware acceleration according to UBNT. When running normal OpenWrt on the device the radio accepts a normal, unmodified firmware for the QCA988X v2 and just works with the ath10k driver but without support for AirMAX (sadly).

The driver used by UBNT seems to be some driver built by Atheros that is not the normal ath9k/ath10k driver as lsmod reports the following:

Module                  Size  Used by    Tainted: P  
ebt_redirect             880  0 
ebt_mark                 704  0 
ebt_vlan                1552  0 
ebt_stp                 1840  0 
ebt_pkttype              544  0 
ebt_mark_m               624  0 
ebt_limit               1200  0 
ebt_among               2144  0 
ebt_802_3                704  0 
ebtable_nat              880  0 
ebtable_filter           896  0 
ebtable_broute           720  1 
ebtables               15173  3 ebtable_nat,ebtable_filter,ebtable_broute
ebt_ip6                 1376  0 
ebt_snat                 864  0 
ebt_dnat                 800  0 
ebt_arpreply            1040  0 
ebt_ip                  1248  0 
ebt_arp                 1552  0 
ubnt_poll_host        150776  2 
ath_dfs              1188829  1 
em_text                 1280  0 
act_ipt                 2400  0 
sch_teql                3696  0 
em_nbyte                 688  0 
sch_red                 3472  0 
cls_basic               3392  0 
sch_gred                6288  0 
em_meta                 4608  0 
em_cmp                   720  0 
sch_dsmark              3584  0 
act_mirred              2176  0 
em_u32                   544  0 
cls_tcindex             4160  0 
cls_flow                5840  0 
cls_route               5072  0 
cls_fw                  3264  0 
sch_hfsc               14160  0 
rssi_leds               2064  0 
umac                 2005522  2 ubnt_poll_host,rssi_leds
ath_dfs_prescan        22736  0 
ath_dev               221833  3 ath_dfs,umac,ath_dfs_prescan
ath_spectral           24777  3 umac,ath_dev
ath_rate_atheros       31174  1 ath_dev
ath_hal               328906  3 umac,ath_dev,ath_rate_atheros
asf                     7121  7 ubnt_poll_host,ath_dfs,umac,ath_dfs_prescan,ath_dev,ath_spectral,ath_hal
adf                    10072  3 umac,ath_dev,ath_hal
urd                    54448  2 umac,ath_hal
ip_gre                 11952  0 
pppoe                   8160  0 
pppox                   1370  1 pppoe
ppp_mppe                5168  0 
ppp_async               6544  0 
ppp_generic            20373  4 pppoe,pppox,ppp_mppe,ppp_async
slhc                    4971  1 ppp_generic
nls_base                5102  0 
ar724x_eth             54446  0 
sha1_generic            1392  0 
michael_mic             1552  0 
md5                     1440  0 
hmac                    2272  0 
ecb                     1296  0 
des_generic            18377  0 
arc4                     832  0 
aes_generic            30153  0 
ts_fsm                  2640  0 
ts_bm                   1440  0 
ts_kmp                  1296  0 
crc_ccitt               1003  1 ppp_async
ubnthal               303371  9 ubnt_poll_host,ath_dfs,rssi_leds,umac,ath_dev,ath_hal,ar724x_eth

While iwconfig seems to sort-of work (wlan0 is the same radio as ath0 and wlan1 is the same radio as airview1 which is replaced by ath1 if the management radio is enabled)

WA# iwconfig 
lo        no wireless extensions.

eth0      no wireless extensions.

gre0      no wireless extensions.

wifi1     no wireless extensions.

teql0     no wireless extensions.

br0       no wireless extensions.

wifi0     no wireless extensions.

ath0      IEEE 802.11ac  ESSID:""  
          Mode:Managed  Frequency:5.57 GHz  Access Point: Not-Associated   
          Bit Rate:0 kb/s   Tx-Power=16 dBm   
          RTS thr:off   Fragment thr:off
          Center1-Freq: 5.57 GHz
          Encryption key:off
          Power Management:off
          Link Quality=0/94  Signal level=-96 dBm  Noise level=-96 dBm
          Rx invalid nwid:0  Rx invalid crypt:0  Rx invalid frag:0
          Tx excessive retries:0  Invalid misc:0   Missed beacon:0

airview1  IEEE 802.11na  ESSID:"spectral"  
          Mode:Monitor  Frequency:4.92 GHz  Access Point: Not-Associated   
          Bit Rate:130 Mb/s   Tx-Power=13 dBm   
          RTS thr:off   Fragment thr:off
          Center1-Freq: 4.92 GHz
          Encryption key:off
          Power Management:off
          Link Quality=0/94  Signal level=-96 dBm  Noise level=-105 dBm
          Rx invalid nwid:0  Rx invalid crypt:0  Rx invalid frag:0
          Tx excessive retries:0  Invalid misc:0   Missed beacon:0

the iw tool does not work even though it is installed.

WA# iw list
nl80211 not found.

The main radio is initialized using the following script in /etc/sysinit:

WA# cat radio.conf 
plugin_start() {
  insmod ath_dfs 1>/dev/null 2>&1 || true
  rmmod ubnt_poll_host 1>/dev/null 2>&1 || true
  echo 0 > /sys/module/umac/parameters/is_ubnt_ptp
  echo 0 > /sys/module/umac/parameters/tgdeb
  echo 1 > /sys/module/umac/parameters/is_ubnt_ff
  echo 0 > /sys/module/umac/parameters/ubnt_op_mode
  iwpriv "wifi0" SetTargetReset 0
  i=0; while [ $i -lt 3 ]; do [ ! -d /sys/class/net/wifi0 ] && break; i=$(($i+1)); sleep 1; done
  i=0; while [ $i -lt 3 ]; do sleep 1; [ -d /sys/class/net/wifi0 ] && break; i=$(($i+1)); done
  insmod ubnt_poll_host 1>/dev/null 2>&1 || true
  iwpriv "wifi0" setCountryID 40
  echo wifi0 0 1 1 > /proc/sys/dev/uph/addradio
  echo 1 > /proc/sys/dev/uph_wifi0/enable
  echo 0 > /proc/sys/dev/uph_wifi0/noack_mode
  echo 0 > /proc/sys/dev/uph_wifi0/daprot
  echo 2 0 > /proc/sys/dev/uph_wifi0/sta_priority
  echo 0 > /proc/sys/dev/uph_wifi0/ff_cap_rep
  echo 0 > /proc/sys/dev/uph_wifi0/cms_bias
  echo 10 > /proc/sys/dev/uph_wifi0/ff_mcast_airtime_limit
  echo 0 50 3 12 12 10 10 0 0 1 > /proc/sys/dev/uph_wifi0/fixed_frame
  echo 12 > /proc/sys/dev/uph_wifi0/sta_rx_rssi_th
  iwpriv "wifi0" band 2
  /sbin/wlanconfig "ath0" create wlandev wifi0 wlanmode ap  > /dev/null 2>&1
  if [ $? -eq 0 ]; then
    echo wifi0 > /tmp/.wifi_ath0
  else
    echo "WLANCONFIG: ath0 could not created, waiting for 5 secs" > /dev/kmsg
    sleep 5;
    /sbin/wlanconfig "ath0" create wlandev wifi0 wlanmode ap  > /dev/null 2>&1
    if [ $? -eq 0 ]; then
      echo wifi00 > /tmp/.wifi_ath00
    fi
  fi
  radartool -i "wifi0" dfsdebug 0x00000003 >/dev/null 2>&1
  iwpriv "ath0" mode 11ACVHT40
  iwpriv "wifi0" chanbw 40
  iwpriv "wifi0" RegObey 1
  iwpriv "wifi0" ant_gain 14
  iwpriv "wifi0" cable_loss 0
  iwpriv "wifi0" txchainmask 3
  iwpriv "wifi0" rxchainmask 3
  athchans -i ath0 0
  iwconfig "ath0" center1 5190M
  iwconfig "ath0" freq 5180M
  iwconfig "ath0" rate auto
  if [ -e /proc/sys/dev/ubnt_poll/no_ack_rate ]; then
    echo 1 -1 > /proc/sys/dev/ubnt_poll/no_ack_rate
  fi
  iwconfig "ath0" rts off
  iwconfig "ath0" txpower auto

  echo 0 0 0 0 -128 > /proc/sys/dev/uph_wifi0/atpc
  iwpriv "wifi0" ani_enable 0
  iwpriv "wifi0" sens_level -96
  iwpriv "ath0" shortgi 1
  iwpriv "ath0" cwmenable 0
  iwpriv "ath0" cwmmode 1
  iwpriv "wifi0" distance 600
  iwpriv "wifi0" damode 0
  iwpriv "wifi0" dacount 25
  iwpriv "ath0" puren 0
  iwpriv "wifi0" enable_ol_stats 1
  iwconfig "ath0"  commit
  iwpriv "ath0" rc_mode 0
  true
}
plugin_stop() {
  killall scand
  pkill -9 radarmon
  ifconfig "wifi0" down
  /sbin/wlanconfig "ath0" destroy
  rm -f /tmp/.wifi_ath0
  rmmod ath_dfs 1>/dev/null 2>&1 || true
  true
}

While I don't know yet how to disable AirMAX, the entries in /proc/sys/dev/uph_wifi0 and /sys/module/umac look very promising to poke around with.

I was looking for the two firmware files for the primary radio (the one which is used for AP with AirMax N backwards compatibility and the AirMax-AC-only one which is used for everything else) and could not find them in the filesystem. After a bit of searching I found them compiled into the umac kernel module and extracted them. It looks like a modified version of a normal ath10k firmware in the standard format so I'll try to load this file with OpenWRT and the normal ath10k driver later.

Management/Spectral-View Radio

Next to the main radio the device has a dual Band 802.11abgn AR9340 radio. It is used either for the 2.4GHz management radio or the spectral view, which is why the spectral view is disabled while the management radio is enabled. When started in spectral view mode it is set to the 5GHz band and monitor mode, while it is set to 2.4GHz in normal HostAPd-driven AP mode for the management radio.