OpenWrt Forum Archive

Topic: Arcadyan WA9117AAC23-99

The content of this topic has been archived on 6 May 2018. There are no obvious gaps in this topic, but there may still be some posts missing at the end.

Post #1
Tampert
4 Apr 2016, 13:00

Dutch ISP KPN is selling an extremely well priced (€50) AC access point, the Arcadyan WA9117AAC23-99.

Some specs:
- AC1600: N300 (2 x 150Mbps) + AC1300 (3 x 433Mbps)
- Broadcom based
- BCM4360 transceiver (5 Ghz)
- 128 MB DDR3 RAM
- 32 MB flash
- 1x WAN, 4x LAN, all gigabit
- 2x USB
- Support for DFS, band steering and beamforming

Some Googling tells me it's based on the Arcadyan WG9117GAC router and that the ASUS RT-AC87U and ASUS RT-AC68P are (partially) based on the same design. A firmware file is available here.

Given that the components are found in many OpenWRT compatible devices, is support for this specific access point feasible? I assume an extract of the bootloader is needed?

(Last edited by Tampert on 4 Apr 2016, 13:04)

Post #2
tmo26
4 Apr 2016, 18:11

Provide pictures of the inside of the router (remove any heatsinks, in order to be able to read the read the chip markings), together with a serial bootlog.

Post #3
Tampert
15 Apr 2016, 19:53

Courtesy of a generous 'Tweaker', we now know the following:

SoC: Broadcom BCM47081A0
RAM: EtronTech EM6GC16EWXD-12H
Flash: Macronix MX25L25635FMI-10G
2.4GHz: Broadcom BCM43217, 2x "747 649E 447" amplifier
5GHz: Broadcom BCM4360, 3x Skyworks 5003L1 amplifier

Serial boot log (firmware 001.007.76):

Decompressing...done
Found a ST compatible (Marconix) serial flash with 512 64KB blocks; total size 32MB
find_nvram(256): slf_info=00f56e3c, flbase=1e000000, lim=02000000
find_nvram(293): nvh=1fff0000, off=02000000 NVRAM founded.


CFE version 6.37.14.105 (r485445) based on BBP 1.0.37 for BCM947XX (32bit,SP,)
Build Date: Fri Nov  7 16:05:39 CST 2014 (linghong_tan@sw1.2)
Copyright (C) 2000-2008 Broadcom Corporation.

Init Arena
Init Devs.
Boot partition size = 262144(0x40000)
IMAGE_FIRST_OFFSET=262144,IMAGE_SECOND_OFFSET=16777216
DDR Clock: 533 MHz
Warning: using legacy sdram_ncdl parameter to set DDR frequency. Equivalent setting in clkfreq=800,*0* will be ignored.
et0: Broadcom BCM47XX 10/100/1000 Mbps Ethernet Controller 6.37.14.105 (r485445)
CPU type 0x0: 800MHz
Tot mem: 131072 KBytes

CFE mem:    0x00F00000 - 0x00FE1CDC (924892)
Data:       0x00F55DEC - 0x00F563EC (1536)
BSS:        0x00F563F8 - 0x00F7BCDC (153828)
Heap:       0x00F7BCDC - 0x00FDFCDC (409600)
Stack:      0x00FDFCDC - 0x00FE1CDC (8192)
Text:       0x00F00000 - 0x00F494F8 (300280)
Boot:       0x00FE2000 - 0x01022000
Reloc:      I:00000000 - D:00000000


Copying boot params.....
DONE


Bootloader version a1.3.4
Project name : WA9117
Press space bar to cancel startup...
Device eth0:  hwaddr 4C-09-D4-00-00-00, ipaddr 192.168.1.254, mask 255.255.255.0
        gateway not set, nameserver not set
Booting(0): boot -raw -z -addr=0x8000 -max=0xef8000 flash0.os:
Loader:raw Filesys:raw Dev:flash0.os File: Options:(null)
Loading: .... 4600576 bytes read
Entry at 0x00008000
Closing network.
Starting program at 0x00008000
console [ttyS0] enabled, bootconsole disabled
serial8250.0: ttyS1 at MMIO 0x18000400 (irq = 117) is a 16550
brd: module loaded
loop: module loaded
pflash: found no supported devices
The first offset=40000, 2nd offset=1000000
bcmsflash: squash filesystem found at block 34
Detect first image vmlz_off=50000,rfs_off=224db8,size=2000000
boot partition is writable
boot param partition is writable
bcmsflash: squash filesystem found at block 286
Detect second image offset=1010000,rfs_off=11e4d70,size=2000000
Creating 8 MTD partitions on "bcmsflash":
0x000000000000-0x000000040000 : "boot"
0x000000040000-0x000000050000 : "bootp"
0x000000050000-0x000001010000 : "linux"
0x000000224db8-0x000001010000 : "rootfs"
0x000001010000-0x000001fe0000 : "linux2"
0x0000011e4d70-0x000001fe0000 : "rootfs2"
0x000001fe0000-0x000001ff0000 : "nvram2"
0x000001ff0000-0x000002000000 : "nvram"
nflash: found no supported devices
PPP generic driver version 2.4.2
NET: Registered protocol family 24
usbmon: debugfs is not available
usbcore: registered new interface driver usblp
Initializing USB Mass Storage driver...
usbcore: registered new interface driver usb-storage
USB Mass Storage support registered.
u32 classifier
    Actions configured
Netfilter messages via NETLINK v0.30.
nf_conntrack version 0.5.0 (1954 buckets, 7816 max)
ctnetlink v0.93: registering with nfnetlink.
xt_time: kernel timezone is -0000
ip_tables: (C) 2000-2006 Netfilter Core Team
TCP cubic registered
NET: Registered protocol family 10
ip6_tables: (C) 2000-2006 Netfilter Core Team
IPv6 over IPv4 tunneling driver
NET: Registered protocol family 17
802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
All bugs added by David S. Miller <davem@redhat.com>
Northstar brcmnand NAND Flash Controller driver, Version 0.1 (c) Broadcom Inc. 2012
brcmnand: found no supported devices
VFS: Mounted root (squashfs filesystem) readonly on device 31:3.
devtmpfs: mounted
Freeing init memory: 224K
/sbin/hotplug2: No such file or directory
modprobe: module 'ipv6' not found
modprobe: module 'bcm57xx' not found
hotplug detected product:  1d6b/3/206
hotplug detected product:  1d6b/3/206
hotplug detected product:  1d6b/2/206
hotplug detected product:  1d6b/2/206
hotplug detected product:  1d6b/1/206
hotplug detected product:  1d6b/1/206
devpath=[/dev/mtd2]
SHA256=[c21fdfcfc0173a1587930bb4c3148da350baa7b85b38d355d2e8aef4a753442f]
Hit enter to continue...
Post #4
incomer
1 Jun 2016, 09:45

Do you still need some information? I have the same AP and like to get more functionality for it.

Post #5
Tampert
21 Aug 2016, 15:48

What else would be needed to build a firmware for this unit?

Post #6
elektroman
22 Aug 2016, 16:48

Hi

you must gain access to the serial console, be aware of 3.3Volt levels
Then build a firmware with initramfs support, base on the same hardware design.
The big problem here might be
- ethernet NIC and switch
- wireless NIC, maybe broadcom

Post #7
knoxville.nl
16 Apr 2017, 03:42

Wooopwooop i

s there here somebody who can do such thing as open up this cheap beast?

For only 50eu you can buy this access point via dutch ISP KPN. If we could realise a custom firmware this would be a great deal!

Post #8
kazim19
10 Jul 2017, 11:49

It would be nice to unlock this access point and enable the usb ports for things like a printer server. Anyone that can unlock the bootloader and compile an openwrt image for this router?

Post #9
ddwert
18 Jul 2017, 20:27

I am interested in this as well. It seems like a lot of people have this access point. It would be great if we had the opportunity to use all its functions instead of just the AP

(Last edited by ddwert on 18 Jul 2017, 20:27)

The discussion might have continued from here.