Arcadyan WE410443
The Arcadyan WE410443 is a MT7621-based access point that is distributed by various ISPs under various names, including:
- KPN SuperWiFi
- BT Whole Home Wi-Fi
- Telus WiFi Booster
- Hughes Wi-Fi Booster
- Singtel Mesh Extender
- EE WiFi Disc
- Chunghwa Telecom Wi-Fi 5 (4T4R)
The hardware, bootloader, flash layout and installation procedure are very similar to the Arcadyan WE420223.
Hardware Highlights
Installation
OEM installation
The bootloader is locked with a password, so the image needs to be written directly to the SPI flash chip. To do this, you need to open up the case, remove the heatsink and connect the flash chip to a Raspberry Pi.
To connect the SPI chip directly to the Raspberry Pi's SPI pins, use the following connections:
| Flash Chip | Raspberry Pi |
|---|---|
| VCC | 3v3 |
| RESET | 3v3 |
| /CS | GPIO 8 (SPI0 CE0) |
| DO | GPIO 9 (SPI0 MISO) |
| CLK | GPIO 11 (SPI0 SCLK) |
| DI | GPIO 10 (SPI0 MOSI) |
| GND | Ground |
You can solder wires to the flash chip, but using a SOIC16 clip is easier. When you have the Raspberry Pi connected to the flash chip, boot your Pi and follow the instructions:
1. Enable the Pi's SPI-interface with sudo raspi-config
2. Install necessary tools:
sudo apt install xxd libubootenv-tool mtd-utils
3. Upload the overlay (see below) to your Pi as we410443-overlay.dts and execute:
sudo dtc -@ -I dts -O dtb -o /boot/overlays/we410443.dtbo we410443-overlay.dts
4. Enable the overlay in /boot/firmware/config.txt by adding a new line containing dtoverlay=we410443
5. Reboot your Pi and verify the mtd partitions with cat /proc/mtd, you should see:
dev: size erasesize name mtd0: 02000000 00001000 "all" mtd1: 00030000 00001000 "u-boot" mtd2: 00010000 00001000 "u-boot-env" mtd3: 00010000 00001000 "factory" mtd4: 01f60000 00001000 "firmware" mtd5: 00010000 00001000 "glbcfg" mtd6: 00010000 00001000 "config" mtd7: 00010000 00001000 "glbcfg2" mtd8: 00010000 00001000 "config2"
6. Optionally (but recommended), make a backup:
sudo dd if=/dev/mtd0 of=backup.bin
It can be restored with:
sudo flashcp backup.bin /dev/mtd0
7. Set the variables for the bootloader:
echo '/dev/mtd2 0x0 0x1000 0x1000' > fw_env.config sudo fw_setenv -c fw_env.config bootpartition 0
8. Finally, flash the image:
sudo flashcp openwrt-ramips-mt7621-arcadyan_we410443-squashfs-sysupgrade.bin /dev/mtd4
9. Disconnect the clip and power on the device. Connect to the ethernet port on 192.168.1.1
OEM installation overlay
Save the code below as we410443-overlay.dts and use in the installation as instructed:
/dts-v1/;
/plugin/;
/ {
compatible = "brcm,bcm2835";
fragment@0 {
target = <&spi0>;
__overlay__ {
status = "okay";
#address-cells = <1>;
#size-cells = <0>;
flash@0 {
compatible = "jedec,spi-nor";
spi-max-frequency = <20000000>;
reg = <0>;
partitions {
compatible = "fixed-partitions";
#address-cells = <1>;
#size-cells = <1>;
partition@1fe0000 {
label = "config2";
reg = <0x1fe0000 0x10000>;
read-only;
};
partition@1fd0000 {
label = "glbcfg2";
reg = <0x1fd0000 0x10000>;
read-only;
};
partition@1fc0000 {
label = "config";
reg = <0x1fc0000 0x10000>;
};
partition@1fb0000 {
label = "glbcfg";
reg = <0x1fb0000 0x10000>;
};
partition@50000 {
label = "firmware";
reg = <0x50000 0x1f60000>;
};
partition@40000 {
label = "factory";
reg = <0x40000 0x10000>;
};
partition@30000 {
label = "u-boot-env";
reg = <0x30000 0x10000>;
};
partition@1 {
label = "u-boot";
reg = <0x0 0x30000>;
};
partition@0 {
label = "all";
reg = <0x0 0x2000000>;
};
};
};
};
};
};
OEM installation using the TFTP method
The bootloader supports TFTP boot, but the bootloader requires a password which is currently unknown. More research is needed to unlock the bootloader.
Buttons
→ hardware.button on howto use and configure the hardware button(s).
The Arcadyan WE410443 has the following buttons:
| BUTTON | Event |
|---|---|
| Reset | reset |
| WPS | - |
Hardware
Info
Flash Layout
| all | 0x0 | 0x2000000 | 32 MB | read-only | |||||
| u-boot | 0x0 | 0x30000 | 192 KB | read-only | |||||
| u-boot-env | 0x30000 | 0x40000 | 64 KB | read-only | |||||
| factory | 0x40000 | 0x50000 | 64 KB | read-only | |||||
| kernel | 0x50000 | 0x1FB0000 | 31.7 MB | writable | |||||
| rootfs | 0x490000 | 0x1FB0000 | 27.6 MB | writable | |||||
| glbcfg | 0x1FB0000 | 0x1FC0000 | 64 KB | read-only | |||||
| config | 0x1FC0000 | 0x1FD0000 | 64 KB | read-only | |||||
| glbcfg2 | 0x1FD0000 | 0x1FE0000 | 64 KB | read-only | |||||
| config2 | 0x1FE0000 | 0x1FF0000 | 64 KB | read-only | |||||
Opening the case
Note: This will void your warranty!
The case has multiple clips around the entire disc, opening it will leave some permanent cosmetic damage. Be careful not to pry into the case too deeply, as the antennas are situated around the entire disc as well.
Serial
→ port.serial general information about the serial port, serial port cable, etc.
There is no clear pinout on the PCB, instead solder the TX and RX points as shown below. The shielding around this part of the PCB can be used as GND. Note that you have to remove the heatsink to access the pins.
| Serial connection parameters | 57600, 8N1, 3.3V |
|---|
Bootlogs
OEM bootlog
=================================================================== MT7621 stage1 code 10:33:55 (ASIC) CPU=500000000 HZ BUS=166666666 HZ ================================================================== Change MPLL source from XTAL to CR... do MEMPLL setting.. MEMPLL Config : 0x11100000 3PLL mode + External loopback === XTAL-40Mhz === DDR-1200Mhz === PLL2 FB_DL: 0x7, 1/0 = 627/397 1D000000 PLL4 FB_DL: 0xa, 1/0 = 769/255 29000000 PLL3 FB_DL: 0xc, 1/0 = 558/466 31000000 do DDR setting..[01F40000] Apply DDR3 Setting...(use customer AC) 0 8 16 24 32 40 48 56 64 72 80 88 96 104 112 120 -------------------------------------------------------------------------------- 0000:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0001:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0002:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0003:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0004:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0005:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0006:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0007:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0008:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0009:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 000A:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 000B:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 000C:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 000D:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 1 000E:| 0 0 0 0 0 0 0 0 1 1 1 1 1 1 1 1 000F:| 0 0 0 1 1 1 1 1 1 1 1 1 0 0 0 0 0010:| 1 1 1 1 1 1 1 1 0 0 0 0 0 0 0 0 0011:| 1 1 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0012:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0013:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0014:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0015:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0016:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0017:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0018:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0019:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 001A:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 001B:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 001C:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 001D:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 001E:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 001F:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 rank 0 coarse = 15 rank 0 fine = 56 B:| 0 0 0 0 0 0 0 0 0 1 1 1 0 0 0 0 opt_dle value:10 DRAMC_R0DELDLY[018]=00001D1D ================================================================== RX DQS perbit delay software calibration ================================================================== 1.0-15 bit dq delay value ================================================================== bit| 0 1 2 3 4 5 6 7 8 9 -------------------------------------- 0 | 7 7 6 9 5 7 6 7 4 6 10 | 7 7 6 9 7 7 -------------------------------------- ================================================================== 2.dqs window x=pass dqs delay value (min~max)center y=0-7bit DQ of every group input delay:DQS0 =29 DQS1 = 29 ================================================================== bit DQS0 bit DQS1 0 (1~58)29 8 (1~54)27 1 (2~56)29 9 (1~55)28 2 (1~54)27 10 (1~56)28 3 (1~55)28 11 (1~55)28 4 (1~56)28 12 (1~55)28 5 (1~55)28 13 (1~55)28 6 (1~55)28 14 (1~56)28 7 (1~57)29 15 (1~57)29 ================================================================== 3.dq delay value last ================================================================== bit| 0 1 2 3 4 5 6 7 8 9 -------------------------------------- 0 | 7 7 8 10 6 8 7 7 6 7 10 | 8 8 7 10 8 7 ================================================================== ================================================================== TX perbyte calibration ================================================================== DQS loop = 15, cmp_err_1 = ffff0000 dqs_perbyte_dly.last_dqsdly_pass[0]=15, finish count=1 dqs_perbyte_dly.last_dqsdly_pass[1]=15, finish count=2 DQ loop=15, cmp_err_1 = ffff0080 dqs_perbyte_dly.last_dqdly_pass[1]=15, finish count=1 DQ loop=14, cmp_err_1 = ffff0000 dqs_perbyte_dly.last_dqdly_pass[0]=14, finish count=2 byte:0, (DQS,DQ)=(8,8) byte:1, (DQS,DQ)=(8,8) 20,data:88 [EMI] DRAMC calibration passed =================================================================== MT7621 stage1 code done CPU=500000000 HZ BUS=166666666 HZ =================================================================== U-Boot 1.1.3 (Jul 23 2019 - 10:52:58) Board: Ralink APSoC DRAM: 128 MB relocate_code Pointer at: 87fa0000 Config XHCI 40M PLL flash manufacture id: ef, device id 40 18 find flash: W25Q128BV *** Warning - bad CRC, using default environment ============================================ Ralink UBoot Version: 5.a.0.1 -------------------------------------------- ASIC MT7621A DualCore (MAC to MT7530 Mode) DRAM_CONF_FROM: Auto-Detection DRAM_TYPE: DDR3 DRAM bus: 16 bit Xtal Mode=3 OCP Ratio=1/3 Flash component: 16 MBytes NOR Flash Date:Jul 23 2019 Time:10:52:58 ============================================ icache: sets:256, ways:4, linesz:32 ,total:32768 dcache: sets:256, ways:4, linesz:32 ,total:32768 ##### The CPU freq = 880 MHZ #### estimate memory size =128 Mbytes #Reset_MT7530 default: 3 0 Verifying Checksum ... OK Uncompressing Kernel Image ... OK No initrd ## Transferring control to Linux (at address 815148e0) ... ## Giving linux memsize in MB, 128 Starting kernel ... LINUX started... THIS IS ASIC SDK 5.0.S.0
OpenWrt bootlog
COPY HERE THE BOOTLOG ONCE OPENWRT IS INSTALLED AND RUNNING
Notes
Special thanks to Harm Berntsen for his work on the Arcadyan WE420223.