Netgear WAC120 Support

For Developers
1

Hello,

First time user here, always lurking and absorbing information related to custom firmware.

I am currently seeking any information as to if there is any support to flash OpenWRT onto this device(WAC120).

Some information that may assist:

FCC ID: PY313400246
I have a unit here an it is open, you can use the Internal Photos.pdf to view FCC pictures of device.

I have used a smart phone to zoom and have identified the following chips:

Qualcomm Atheros qca9882-br4a - I think this is the network for both 2.4 and 5ghz bands.

Atheros AR8035-A - I believe this to be the ethernet/lan chip

Atheros AR9344-BC2A - I think this is the SoC

2 of SKY85402
2 of WINBOND W975106KB-25

Is there anything else I can picture/identify to assist or further document for other user? Please make requests and I'll do this ASAP.

Many thanks.
(I hope this is the correct forum section)

2

Is there a version printed on a barcode / label?

Might be similar to this https://wikidevi.com/wiki/Netgear_WNDR4300v1

Your going to maybe need serial / OEM bootlog > partition layout to check how similar this thing is to equivalent boards.... ( unless you can find that its already done somewhere - likely )....

If you can websearch and track down equivalence between any of the existing ar71xx targets then you'd be closer to knowing the answer....

Try checking the models listed ( https://downloads.openwrt.org/releases/18.06.2/targets/ar71xx/ ) for similar storage type ( FLA1: 16 MiB (Spansion NAND) ? )

In any even a serial connection will be beneficial.....

3

Please check again, this type of RAM does not exist.
Maybe W9751G6KB?

While you are at it: What Flash chip is used? Should be the chip on the backside of the board, covered with aluminium foil.

1 Like
4

Hello,

Thanks for your reply.
There is no version number printed on the barcode or labelling of the unit or original box.

I'm looking into serial connection shortly - thank you.
I will search as suggested once I understand how much ram I have on this device. thanks again.

5

Hello,

Thank you also for your response.
I believe I made an error in reading and you are correct, further study revealed it is indeed a G.

As for the chip under the aluminium foil, I cant find much info on its serial, but here is a picture of it:
Upload of 1.7MB rejected as limit of 4096KB. Used image hosting service:

Is this the memory chip you are referring too? Its on the back side of the board.

Thanks

6

I think this is perhaps the chip in question:
MICKIT-29F1G08ABA>C>R Slc 1G 128MX8 TSOP

Can someone kindly confirm its likely memory capacity?
I'm reading possible answers: 1G or 128MB x 8(1024MB) or 128MB

Thank you

7

Very similar to the WNDR4300 indeed! Thanks for this tip!

8

Perhaps Micron KIT-29F1G08ABA>C>R (or a work-alike)

Micron's code scheme appears to be:
MT -- Micron Technology
29F -- NAND flash
1G -- 1 Gbit
08 -- bus width (so would seem to be byte-wide parallel, I'm looking at an SPI-NAND sheet)
A -- SLC
B -- classification ("B" not on the data sheet I'm looking at)
A -- 3.3 V

1 Like
9

Hello wulfy23

I've purchased a serial header connector and am able to see the boot process as well as reach a login prompt (login: can't chdir to home direc - error trying to login admin/password) so I'm unable to get access to its terminal/console.

Is there any information or guides on interrupting boot to allow me to obtain some sort of console access so I might read its partition layout and such? If you could kindly point me to the correct information or perhaps guide me I'd appreciate - I am linux experienced so dont worry about being too detailed.

Thank you

10

I thought I would go ahead and submit my bootlog.

I'm unable to read the initial characters - any information on this?

Thanks

Welcome to minicom 2.7

OPTIONS: I18n 
Compiled on Jan  1 2014, 17:13:19.
Port /dev/ttyUSB0, 14:44:16

Press CTRL-A Z for help on special keys

fZ�}��f: �����rap� 0X�몪
         J򹑹�t            5
C��X�}ዱoade��ݠ�V��6 p�VV500: �o��0 :�xc��*�6c]
nX�}ዱ�ad_�֗��_‚000�x8� 0ׂ�“�����j
init�X��髕 PL�2"Rץng �����bd0°�ӓ����2�
f/w� rYX�mplYW���00 ��‚��0x��₪2�
s̮�
�U��́(32������ ini�C�se�W��Ɂfor�j�f�L'r�nd �+�5
                                                 lea�Y2]
f��0����Y���tio�ս��letYCC���� +�ᖅ�1000� :��
�1000� :���1‚0 ���
�9cfLͬu5
��n��}ዱ�ad_��旂��00‚ 0����
����2
C�n��}��ad_֗���00� 0����
�1017�j
nan�E���_fw��
�000�x8��
010��j
nX�}��ad_֗�‰�0� 0a00�
�1027�j
�na��Ž�d_f�'���100� 0����
����20�C�nan�Ž��_fw��™�000���0�0xX����f0
nan�Ž��_fw����2000����00 0��1�M�
�na��Ž�d_f�'���500� 0��0 
����2�2�0
nandŽ��_fw����6000����00 0�01���
�na��Ž�d_f�'���900����00 
��ʺ2�2�0
nandŽ���fw����a000����00 0�X��ʲ�
�X�}�oad�����b�00���0�0xኂ
C�n��}��ad_�����c0�����00�xa�L
�nan�Ž�d_f�'���d00����00 
���fj�0
�nan�Ž��_f�'���100����00 ����P�f�
010���j                 �r��(c������At�ɽ�Com[]+k�ti�k� �����At�r��� ID+�2�A178W'�if1:�:9M'�j
�ON�jQɹT:�8ABAQP on-c+31��FLas轹�rol�ɁĮ˕�, VY���K�D*0xኊ���           ���MB��5�128MŠ�сRadZ                                 ONFRj%
SZ��� N���1&j�Ja3,3�j�с�L&j��]�C�nX                    B]ID��97�Ӳfla.
OOO�� NA��P᮵��ers�==�OOC��,��x8����� b�����7���� bb�5��� =���0�nf�,��= 0�44�!��� = ��0�����k =���0�0 �K�����0
s����28S�H�SeW��0xb�16�N�� 0xM
                                   ��25
                                        Usi�"��aul*�٥ron[Y�5

In:  s��+�5
            Ou�'��ɥ��
E..'se�ZX�H� 131�2 �^Ẃrea�'z-5
                                  Net�� aV����eneו���ialZ���ɩ
�Add�Y�.2ɽ��0x87Vֲ�                                              40N��es �V�� OK
 W��� resYj��k:��30
WP*j---�F1�e�*           ���:55'Қ�:2���j
:��� 0x8�00���g2 ��1�S�et                  F1P�^��� inZj�PJ�UQ=�EG_P�UI�:1�QLC�Q!I}E000�MQ�CON��1�200��Q!I_PH�5=9QROL����j
��                                                                                                                            ATJ��_PHY'���� 0,r���Suc�Y�.H(Q!I�F1_�e�p
H�
   �� ke����stop
                �ѽ�oot'���j
                              dup L����d 1�
                                             "�٥�e 0�                              ��� imXV�at 8������ .��
!���� co]��单��ed��d o.2���ed HC�H�ꅑ�ng 殫           ѡ�nan�Bz��set�x1��00JC�## B                          �Im�Vr�me: L����Kern
5r��� s�.WɁis �                                                                                                                     �CrYXבi   � 2�Lj���21���Ғ�:0�Q
�"�ta �K��    �19���es Oš�ImXVBb鵅5com���͕d)
Linux version 2.6.31-WAC120_V2.1.7 (root@VVDN-BLD) (gcc version 4.2.4) #1 Fri Sep 21 17:49:17 IST 2018                             J�age��r�OKC�HhE��ѥng ����� ..�H
flash_size passed from bootloader = 0                              Q                   �U��yin硕�ksu[rrrOK�!������re��˝�Ker�Y
CPU revision is: 0001974c (MIPS 74Kc)
ath_sys_frequency: cpu srif ddr srif cpu 560 ddr 400 ahb 200
Determined physical RAM map:
 memory: 08000000 @ 00000000 (usable)
Initrd not found or empty - disabling initrd
Zone PFN ranges:
  Normal   0x00000000 -> 0x00008000
Movable zone start PFN for each node
early_node_map[1] active PFN ranges
    0: 0x00000000 -> 0x00008000
Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 32512
Kernel command line: console=ttyS0,115200 root=31:03 rootfstype=squashfs,jffs2 mtdparts=ath-nand:128k(u-boot),1536k(caldata),1280k(uImage),16384k(rootfs),1024k(var),128)
PID hash table entries: 512 (order: 9, 2048 bytes)
Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)
Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)
Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes
Writing ErrCtl register=00000000
Readback ErrCtl register=00000000
Memory: 112824k/131072k available (1839k kernel code, 18068k reserved, 470k data, 152k init, 0k highmem)
NR_IRQS:128
plat_time_init: plat time init done
Calibrating delay loop... 279.55 BogoMIPS (lpj=559104)
Mount-cache hash table entries: 512

****************ALLOC***********************
 Packet mem: 80283120 (0xe00000 bytes)
********************************************

NET: Registered protocol family 16
ath_pcibios_init: bus 0
ath_pcibios_init(250): PCI 0 CMD write: 0x356
registering PCI controller with io_map_base unset
bio: create slab <bio-0> at 0
SCSI subsystem initialized
pci 0000:00:00.0: PME# supported from D0 D1 D3hot
pci 0000:00:00.0: PME# disabled
pcibios_map_irq: IRQ 70 for bus 0
NET: Registered protocol family 2
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 4096 (order: 3, 32768 bytes)
TCP bind hash table entries: 4096 (order: 2, 16384 bytes)
TCP: Hash tables configured (established 4096 bind 4096)
TCP reno registered
NET: Registered protocol family 1
ATH GPIOC major 0
squashfs: version 4.0 (2009/01/31) Phillip Lougher
JFFS2 version 2.2 (NAND) (ZLIB) (RTIME) (c) 2001-2006 Red Hat, Inc.
fuse init (API version 7.12)
msgmni has been set to 220
io scheduler noop registered
io scheduler deadline registered (default)
Serial: 8250/16550 driver, 1 ports, IRQ sharing disabled
serial8250.0: ttyS0 at MMIO 0xb8020000 (irq = 19) is a 16550A
console [ttyS0] enabled
brd: module loaded
RedBoot partition parsing not available
No partitions found on flash bank 0
Atheros on-chip NAND FLash Controller Driver, Version 0.1 (c) 2010 Atheros Communications, Ltd.
Ath Nand ID[878cbd9c]: 2c:f1:80:95:04
ONFI MICRON      MT29F1G08ABAEAWP   
Micron NAND 128MiB 3,3V 8-bit [128MB]
7 cmdlinepart partitions found on MTD device ath-nand
Creating 7 MTD partitions on "ath-nand":
0x000000000000-0x000000020000 : "u-boot"
0x000000020000-0x0000001a0000 : "caldata"
0x0000001a0000-0x0000002e0000 : "uImage"
0x0000002e0000-0x0000012e0000 : "rootfs"
0x0000012e0000-0x0000013e0000 : "var"
0x0000013e0000-0x000001400000 : "manu_data"
0x000001400000-0x000007000000 : "rootfs_data"
====== NAND Parameters ======
sc = 0x878cbc00 bbt = 0x878bcaa0 bbt_size = 0x100 nf_ctrl = 0x344
page = 0x800 block = 0x20000 oob = 0x40
TCP cubic registered
NET: Registered protocol family 17
802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
All bugs added by David S. Miller <davem@redhat.com>
arch/mips/atheros/gpio.c (ath_simple_config_init) JUMPSTART_GPIO: 3
wls-wps dev success
athwdt_init: Registering WDT success
athwdt_timer_init:447: here jiffies:2149874900
ath_otp_init: Registering OTP success
ath_clksw_init: Registering Clock Switch Interface success
VFS: Mounted root (squashfs filesystem) readonly on device 31:3.
Freeing unused kernel memory: 152k freed

Mounting etc to ramfs.      [DONE]

Mounting var to jffs2.      rootfs on / type rootfs (rw)
/dev/root on / type squashfs (ro,relatime)
proc on /proc type proc (rw,relatime)
tmpfs on /tmp type tmpfs (rw,relatime)
devpts on /dev/pts type devpts (rw,relatime,mode=620)
none on /etc type tmpfs (rw,relatime)
jffs2_scan_inode_node(): CRC failed on node at 0x000a5fc0: Read 0xffffffff, calculated 0xa62bfc6b
[DONE]

Checking SSH keys.          [DONE]

Checking for run file.      [DONE]

Starting System Logger.     [DONE]

Starting Kernel Logger.     [DONE]

Starting Panel LED.         [DONE]

Starting watchdog.          [DONE]

Starting Reset Detect.      [DONE]
USAGES: /usr/bin/wr_mfg_data -h for Help.

Checking Manufac. data      [DONE]

Checking board file.        [CREATED]

Loading Ethernet module.    [GENMAC]

                            [DONE]

Checking database.          [DONE]

Verifing checksum.          [DONE]

Loading Bridge module.      [DONE]

Loading wlan modules.       [DONE]

Creating sta interface.     [DONE]

Starting configd.           [DONE]

Starting web server.        [DONE]

Starting Translator...      start-stop-daemon: cannot start /usr/bin/log_ro: No such file or directory
[syslog]

Starting Translator...      [password]

Starting Translator...      cat: can't open '/tmp/resolv.conf': No such file or directory
[dns]

Starting Translator...      awk: /tmp/bridge_vlan_script: No such file or directory
killall: lldpd: no process killed
route: SIOCADDRT: Invalid argument
[client_bridge_tr]

Starting Translator...      sh: arping: not found
[nmbd_tr]

Starting Translator...      [dhcp]

Starting Translator...      [ntp]

Starting Translator...      [timezone]

Starting Translator...      [sc_radio]
/etc/init.d/rcS: /etc/init.d/S091arping.sh: line 4: cannot create junk: Read-only file system

Sending ARPing/etc/init.d/rcS: /etc/init.d/S091arping.sh: line 34: arping: not found
/etc/init.d/rcS: /etc/init.d/S091arping.sh: line 34: arping: not found
/etc/init.d/rcS: /etc/init.d/S091arping.sh: line 34: arping: not found
/etc/init.d/rcS: /etc/init.d/S091arping.sh: line 34: arping: not found
/etc/init.d/rcS: /etc/init.d/S091arping.sh: line 34: arping: not found
insmod: cannot insert '/lib/modules/socket-CAN/can.ko': Cannot allocate memory
insmod: cannot insert '/lib/modules/socket-CAN/can-raw.ko': Cannot allocate memory
insmod: cannot insert '/lib/modules/socket-CAN/can-bcm.ko': Cannot allocate memory
insmod: cannot insert '/lib/modules/socket-CAN/can-isotp.ko': Cannot allocate memory
insmod: cannot insert '/lib/modules/socket-CAN/vcan.ko': Cannot allocate memory
insmod: cannot insert '/lib/modules/peak-linux-driver/pcan.ko': Cannot allocate memory
ifconfig: SIOCGIFFLAGS: No such device
ifconfig: SIOCGIFFLAGS: No such device
ifconfig: SIOCGIFFLAGS: No such device

System initilization is ..  [DONE...]


Welcome to SDK.

Have a lot of fun...

netgear9B8D48 login: admin
Password: 
login: can't chdir to home direc

Welcome to SDK.

Have a lot of fun...

netgear9B8D48 login:
1 Like
11

We can't edit your posts, but the pre-format button </> is great for code and the like

image

1 Like
12

For reference here is the serial pin header config im using:

GREEN - GND
RED - TXD
BROWN - RXD


1 Like
13

Try the advised escape sequence

Press CTRL-A Z for help on special keys?

If output is garbled, adjust your serial baud to various rates ( 3600? ).... Web search how to interact with uboot, specifically tftpboot methods for similar devices. Once you can iron this out, you can start testing builds and backup your NAND layout + partitions.

14

Ive been at it all night trying to figure out why the uboot is garbled. I'm using a ch340g and have spent hours trying different braudrates as well as web searching. Any other forums that might specialise in this area that I could post in perhaps?

Thank you

15

Unfortunately the kernel and U-Boot are sometimes compiled for different serial rates. Unless somebody has posted it and search engines have found it, it is really down to trying the different rates until one works. Hopefully you don't need to deal with weirdness like things other than "8n1" encoding.

9600 is one of the other very common rates. 115,200 is common for newer devices.

Might be some clues for both U-Boot serial rate and "all the rest" in

https://kb.netgear.com/000060434/WAC120-Firmware-Version-2-1-7

http://www.downloads.netgear.com/files/GDC/WAC120/WAC120_firmware_V2.1.7.zip

https://kb.netgear.com/2649/NETGEAR-Open-Source-Code-for-Programmers-GPL

The GPL drops look better than most! (Though I didn't see U-Boot in the one I downloaded)

1 Like