1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

WRTSL54GS 64MB RAM upgrade HOWTO

Discussion in 'Modding Forum' started by jmranger, Jun 21, 2006.

  1. jmranger

    jmranger Addicted to LI Member

    (For former posts on that topic, see here and here )

    Serial port and JTAG mods recommended. Flash backup recommended.

    Hardware:
    - Install the 20 (all) missing resistors in the block containing RY30 and RY42 (see third autopsy photo). Those are 33 ohms, 0402 form factor.
    - Install the missing RAM chip, UC24. I used a Micron 46V16M16 (see former post links above) since I couldn't find an identical Hynix chip.
    That's it for hardware. Reboot to test you didn't scrap anything. Router should still work, with 32MB RAM.

    Software:
    - Change NVRAM settings:
    * sdram_init from 0x000b to 0x0009
    * sdram_ncdl from 0x10103 to 0x0000 (upon reboot, this will be auto-detected and set to 0x10208).
    - You did backup, right ?
    - Commit and reboot. You now own a collectable 64MB SL.

    Validate:
    If it boots, it's a good sign... Use whatever mean to validate that the new RAM is there. I used "free" on the serial console and got around 61MB total. (The 3MB difference is already present on the stock 32MB version.)

    Remaining work:
    - Test it more than the 5 minutes it's been up...
    - Run memtester, as described in previous posts.
    - Figure out that CC10/11 and RB34/35 are for, and whether they're required. If anyone reading this has good connections at Linksys, I'd be glad to hear about it.

    Bottom Line:
    It works :cheering: . But make sure you have the abilities to do the mod (I don't - I got someone to do it for me - thanks DF). If someone else does this mod, please let me know.

    Have fun !

    JMR
  2. albertr

    albertr Addicted to LI Member

    Very nice, JMR!

    I didn't follow these forums for awhile (since April, I guess). I'll try to pull out my SL from production and see if I can solder the second RAM chip. Thanks alot for great research and sharing the info!

    BTW, forget to mention that the second USB port was a cake to add by simply replacing the connector with a double-stacked one. I did that replacement back in April, but forget to post about it.
    -albertr
  3. albertr

    albertr Addicted to LI Member

    JTAG time

    Unfortunately, my attempt to upgrade the memory went not quite as planned... I don;t have good soldering skills, and that must have been a problem (those 0402 resistors are tiny!). I guess I managed to damage some PCB traces or maybe memory chip itself... Anyway after soldering, it seemed to work fine using only lower 32MB. So hoping for good, I've changed nvram settings and rebooted - CFE detected all 64MB of RAM, but linux kernel crashed (it's always a bad sign). Luckly, I had a serial console, so I've tried to change NVRAM values back to old setting from within CFE prompt. Unluckly for me, before I managed to complete it, the console hanged. After that, it lost serial console completely.... Nothing comes on serial console when power cord is connected. All lights light up as usual, then only USB and "internet" lights stay lit, and "power" light is blinking. That seems to be consistent with what it was before, so CPU might still be running. Wondering why serial console doesn't produce any output?

    Anyway, I guess it's a JTAG time. I always wanted to learn JTAG programming anyway ;)
    For ones who interested, console output is attached below:

    Code:
    
    
    CFE version 1.0.37 for BCM947XX (32bit,SP,LE)
    Build Date: 一 11月  7 19:02:17 CST 2005 (root@localhost)
    Copyright (C) 2000,2001,2002,2003 Broadcom Corporation.
    
    Initializing Arena
    Initializing Devices.
    
    No DPN
    et0: Broadcom BCM47xx 10/100 Mbps Ethernet Controller 3.90.38.0
    rndis0: Broadcom USB RNDIS Network Adapter (P-t-P)
    et1: Broadcom BCM47xx 10/100 Mbps Ethernet Controller 3.90.38.0
    CPU type 0x29006: 264MHz
    Total memory: 32768 KBytes
    
    Total memory used by CFE:  0x80300000 - 0x803A3890 (669840)
    Initialized Data:          0x803397A0 - 0x8033BEB0 (10000)
    BSS Area:                  0x8033BEB0 - 0x8033D890 (6624)
    Local Heap:                0x8033D890 - 0x803A1890 (409600)
    Stack Area:                0x803A1890 - 0x803A3890 (8192)
    Text (code) segment:       0x80300000 - 0x803397A0 (235424)
    Boot area (physical):      0x003A4000 - 0x003E4000
    Relocation Factor:         I:00000000 - D:00000000
    
    Boot version: v3.5
    The boot is CFE
    
    mac_init(): Find mac [00:16:B6:06:94:7A] in location 0
    Nothing...
    
    No eou key find
    Device eth0:  hwaddr 00-16-B6-06-94-7A, ipaddr 192.168.1.1, mask 255.255.255.0
            gateway not set, nameserver not set
    Reading :: Failed.: Timeout occured
    Loader:raw Filesys:raw Dev:flash0.os File: Options:(null)
    Loading: .. 3732 bytes read
    Entry at 0x80001000
    Closing network.
    Starting program at 0x80001000
    CPU revision is: 00029006
    Primary instruction cache 16kB, physically tagged, 2-way, linesize 16 bytes.
    Primary data cache 16kB, 2-way, linesize 16 bytes.
    Linux version 2.4.32 (albertr@t42) (gcc version 3.4.4 (OpenWrt-2.0)) #25 Wed Aug 2 16:16:57 EDT 2006
    Setting the PFC to its default value
    Determined physical RAM map:
     memory: 02000000 @ 00000000 (usable)
    On node 0 totalpages: 8192
    zone(0): 8192 pages.
    zone(1): 0 pages.
    zone(2): 0 pages.
    Kernel command line: root=/dev/mtdblock2 rootfstype=ext3,jffs2 init=/etc/preinit noinitrd console=ttyS0,115200
    CPU: BCM4704 rev 8 at 264 MHz
    Using 132.000 MHz high precision timer.
    Calibrating delay loop... 263.78 BogoMIPS
    Memory: 30292k/32768k available (1609k kernel code, 2476k reserved, 108k data, 84k init, 0k highmem)
    Dentry cache hash table entries: 4096 (order: 3, 32768 bytes)
    Inode cache hash table entries: 2048 (order: 2, 16384 bytes)
    Mount cache hash table entries: 512 (order: 0, 4096 bytes)
    Buffer cache hash table entries: 1024 (order: 0, 4096 bytes)
    Page-cache hash table entries: 8192 (order: 3, 32768 bytes)
    Checking for 'wait' instruction...  unavailable.
    POSIX conformance testing by UNIFIX
    PCI: Fixing up bus 0
    PCI: Fixing up bridge
    PCI: Fixing up bus 1
    Linux NET4.0 for Linux 2.4
    Based upon Swansea University Computer Society NET3.039
    Initializing RT netlink socket
    Starting kswapd
    Journalled Block Device driver loaded
    devfs: v1.12c (20020818) Richard Gooch (rgooch@atnf.csiro.au)
    devfs: boot_options: 0x1
    JFFS2 version 2.1. (C) 2001 Red Hat, Inc., designed by Axis Communications AB.
    pty: 256 Unix98 ptys configured
    Serial driver version 5.05c (2001-07-08) with MANY_PORTS SHARE_IRQ SERIAL_PCI enabled
    ttyS00 at 0xb8000300 (irq = 3) is a 16550A
    ttyS01 at 0xb8000400 (irq = 3) is a 16550A
    b44.c:v0.93 (Mar, 2004)
    eth0: Broadcom 47xx 10/100BaseT Ethernet 00:16:b6:06:94:7a
    eth1: Broadcom 47xx 10/100BaseT Ethernet 00:90:4c:60:00:2b
    SCSI subsystem driver Revision: 1.00
    cfi_cmdset_0001: Erase suspend on write enabled
    Using buffer write method
    Flash device: 0x800000 at 0x1c000000
    bootloader size: 262144
    Creating 4 MTD partitions on "Physically mapped flash":
    0x00000000-0x00040000 : "cfe"
    0x00040000-0x007e0000 : "linux"
    0x000e0000-0x007e0000 : "rootfs"
    0x007e0000-0x00800000 : "nvram"
    sflash: found no supported devices
    usb.c: registered new driver usbdevfs
    usb.c: registered new driver hub
    PCI: Enabling device 01:02.2 (0000 -> 0002)
    ehci_hcd 01:02.2: PCI device 1033:00e0
    ehci_hcd 01:02.2: irq 2, pci mem c0070000
    usb.c: new USB bus registered, assigned bus number 1
    ehci_hcd 01:02.2: USB 2.0 enabled, EHCI 1.00, driver 2003-Dec-29/2.4
    hub.c: USB hub found
    hub.c: 5 ports detected
    host/usb-ohci.c: USB OHCI at membase 0xb8003000, IRQ 6
    host/usb-ohci.c: usb-00:03.0, PCI device 14e4:4715
    usb.c: new USB bus registered, assigned bus number 2
    hub.c: USB hub found
    hub.c: 2 ports detected
    PCI: Enabling device 01:02.0 (0000 -> 0002)
    host/usb-ohci.c: USB OHCI at membase 0xc0072000, IRQ 2
    host/usb-ohci.c: usb-01:02.0, PCI device 1033:0035
    usb.c: new USB bus registered, assigned bus number 3
    hub.c: USB hub found
    hub.c: 3 ports detected
    PCI: Enabling device 01:02.1 (0000 -> 0002)
    host/usb-ohci.c: USB OHCI at membase 0xc0074000, IRQ 2
    host/usb-ohci.c: usb-01:02.1, PCI device 1033:0035
    usb.c: new USB bus registered, assigned bus number 4
    hub.c: USB hub found
    hub.c: 2 ports detected
    Initializing USB Mass Storage driver...
    usb.c: registered new driver usb-storage
    USB Mass Storage support registered.
    Initializing Cryptographic API
    NET4: Linux TCP/IP 1.0 for NET4.0
    IP Protocols: ICMP, UDP, TCP
    IP: routing cache hash table of 512 buckets, 4Kbytes
    TCP: Hash tables configured (established 2048 bind 4096)
    NET4: Unix domain sockets 1.0/SMP for Linux NET4.0.
    NET4: Ethernet Bridge 008 for NET4.0
    802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
    All bugs added by David S. Miller <davem@redhat.com>
    VFS: Mounted root (jffs2 filesystem) readonly.
    Mounted devfs on /dev
    Freeing unused kernel memory: 84k freed
    Algorithmics/MIPS FPU Emulator v1.5
    Unlocking linux ...
    init started:  BusyBox v1.1.2 (2006.08.02-20:14+0000) multi-call binary
    diag boardtype: 0000042f
    
    Please press Enter to activate this console. jffs2.bbc: SIZE compression mode activated.
    b44: eth0: Link is up at 100 Mbps, full duplex.
    b44: eth0: Flow control is off for TX and off for RX.
    device eth0 entered promiscuous mode
    b44: eth1: Link is up at 100 Mbps, full duplex.
    b44: eth1: Flow control is off for TX and off for RX.
    br0: port 1(eth0) entering learning state
    br0: port 1(eth0) entering forwarding state
    br0: topology change detected, propagating
    device eth1 entered promiscuous mode
    br0: port 2(eth1) entering learning state
    br0: port 2(eth1) entering forwarding state
    br0: topology change detected, propagating
    PCI: Enabling device 01:01.0 (0004 -> 0006)
    eth2: Broadcom BCM4318 802.11 Wireless Controller 3.90.38.0
    loop: loaded (max 8 devices)
    device eth2 entered promiscuous mode
    br0: port 3(eth2) entering learning state
    br0: port 3(eth2) entering forwarding state
    br0: topology change detected, propagating
    Installing knfsd (copyright (C) 1996 okir@monad.swb.de).
    nvram_commit(): start
    nvram_commit(): end
    
    
    
    BusyBox v1.1.2 (2006.08.02-20:14+0000) Built-in shell (ash)
    Enter 'help' for a list of built-in commands.
    
      _______                     ________        __
     |       |.-----.-----.-----.|  |  |  |.----.|  |_
     |   -   ||  _  |  -__|     ||  |  |  ||   _||   _|
     |_______||   __|_____|__|__||________||__|  |____|
              |__| W I R E L E S S   F R E E D O M
     KAMIKAZE (bleeding edge, r3709) -------------------
      * 10 oz Vodka       Shake well with ice and strain
      * 10 oz Triple sec  mixture into 10 shot glasses.
      * 10 oz lime juice  Salute!
     ---------------------------------------------------
    root@WAP:/$ reboot
    br0: port 2(eth1) entering disabled state
    device eth1 left promiscuous mode
    mount: Mounting rootfs on / failed: Invalid argument
    The system is going down NOW !!
    Sending SIGTERM to all processes.
    Terminated
    nfsd: last server has exitedsses.
    nfsd: unexporting all filesystems
    Please stand by while rebooting the system.
    Restarting system.
    Please stand by while rebooting the system...
    
    
    CFE version 1.0.37 for BCM947XX (32bit,SP,LE)
    Build Date: 一 11月  7 19:02:17 CST 2005 (root@localhost)
    Copyright (C) 2000,2001,2002,2003 Broadcom Corporation.
    
    Initializing Arena
    Initializing Devices.
    
    No DPN
    et0: Broadcom BCM47xx 10/100 Mbps Ethernet Controller 3.90.38.0
    rndis0: Broadcom USB RNDIS Network Adapter (P-t-P)
    et1: Broadcom BCM47xx 10/100 Mbps Ethernet Controller 3.90.38.0
    CPU type 0x29006: 264MHz
    Total memory: 65536 KBytes
    
    Total memory used by CFE:  0x80300000 - 0x803A3890 (669840)
    Initialized Data:          0x803397A0 - 0x8033BEB0 (10000)
    BSS Area:                  0x8033BEB0 - 0x8033D890 (6624)
    Local Heap:                0x8033D890 - 0x803A1890 (409600)
    Stack Area:                0x803A1890 - 0x803A3890 (8192)
    Text (code) segment:       0x80300000 - 0x803397A0 (235424)
    Boot area (physical):      0x003A4000 - 0x003E4000
    Relocation Factor:         I:00000000 - D:00000000
    
    Boot version: v3.5
    The boot is CFE
    
    mac_init(): Find mac [00:16:B6:06:94:7A] in location 0
    Nothing...
    
    No eou key find
    Committing NVRAM...done
    Device eth0:  hwaddr 00-16-B6-06-94-7A, ipaddr 192.168.1.1, mask 255.255.255.0
            gateway not set, nameserver not set
    Reading :: Failed.: Timeout occured
    Loader:raw Filesys:raw Dev:flash0.os File: Options:(null)
    Loading: .. 3732 bytes read
    Entry at 0x80001000
    Closing network.
    Starting program at 0x80001000
    CPU revision is: 00029006
    Primary instruction cache 16kB, physically tagged, 2-way, linesize 16 bytes.
    Primary data cache 16kB, 2-way, linesize 16 bytes.
    Linux version 2.4.32 (albertr@t42) (gcc version 3.4.4 (OpenWrt-2.0)) #25 Wed Aug 2 16:16:57 EDT 2006
    Setting the PFC to its default value
    Determined physical RAM map:
     memory: 04000000 @ 00000000 (usable)
    On node 0 totalpages: 16384
    zone(0): 16384 pages.
    zone(1): 0 pages.
    zone(2): 0 pages.
    Kernel command line: root=/dev/mtdblock2 rootfstype=ext3,jffs2 init=/etc/preinit noinitrd console=ttyS0,115200
    CPU: BCM4704 rev 8 at 264 MHz
    Using 132.000 MHz high precision timer.
    Calibrating delay loop... 263.78 BogoMIPS
    Memory: 62708k/65536k available (1609k kernel code, 2828k reserved, 108k data, 84k init, 0k highmem)
    Dentry cache hash table entries: 8192 (order: 4, 65536 bytes)
    Inode cache hash table entries: 4096 (order: 3, 32768 bytes)
    Mount cache hash table entries: 512 (order: 0, 4096 bytes)
    Buffer cache hash table entries: 4096 (order: 2, 16384 bytes)
    Page-cache hash table entries: 16384 (order: 4, 65536 bytes)
    Checking for 'wait' instruction...  unavailable.
    POSIX conformance testing by UNIFIX
    PCI: Fixing up bus 0
    PCI: Fixing up bridge
    PCI: Fixing up bus 1
    Linux NET4.0 for Linux 2.4
    Based upon Swansea University Computer Society NET3.039
    Initializing RT netlink socket
    Starting kswapd
    Journalled Block Device driver loaded
    devfs: v1.12c (20020818) Richard Gooch (rgooch@atnf.csiro.au)
    devfs: boot_options: 0x1
    JFFS2 version 2.1. (C) 2001 Red Hat, Inc., designed by Axis Communications AB.
    pty: 256 Unix98 ptys configured
    Serial driver version 5.05c (2001-07-08) with MANY_PORTS SHARE_IRQ SERIAL_PCI enabled
    ttyS00 at 0xb8000300 (irq = 3) is a 16550A
    ttyS01 at 0xb8000400 (irq = 3) is a 16550A
    b44.c:v0.93 (Mar, 2004)
    eth0: Broadcom 47xx 10/100BaseT Ethernet 00:16:b6:06:94:7a
    eth1: Broadcom 47xx 10/100BaseT Ethernet 00:90:4c:60:00:2b
    SCSI subsystem driver Revision: 1.00
    cfi_cmdset_0001: Erase suspend on write enabled
    Using buffer write method
    Flash device: 0x800000 at 0x1c000000
    bootloader size: 262144
    Creating 4 MTD partitions on "Physically mapped flash":
    0x00000000-0x00040000 : "cfe"
    0x00040000-0x007e0000 : "linux"
    0x000e0000-0x007e0000 : "rootfs"
    0x007e0000-0x00800000 : "nvram"
    sflash: found no supported devices
    usb.c: registered new driver usbdevfs
    usb.c: registered new driver hub
    PCI: Enabling device 01:02.2 (0000 -> 0002)
    ehci_hcd 01:02.2: PCI device 1033:00e0
    ehci_hcd 01:02.2: irq 2, pci mem c0070000
    usb.c: new USB bus registered, assigned bus number 1
    ehci_hcd 01:02.2: USB 2.0 enabled, EHCI 1.00, driver 2003-Dec-29/2.4
    hub.c: USB hub found
    hub.c: 5 ports detected
    host/usb-ohci.c: USB OHCI at membase 0xb8003000, IRQ 6
    host/usb-ohci.c: usb-00:03.0, PCI device 14e4:4715
    usb.c: new USB bus registered, assigned bus number 2
    hub.c: USB hub found
    hub.c: 2 ports detected
    PCI: Enabling device 01:02.0 (0000 -> 0002)
    host/usb-ohci.c: USB OHCI at membase 0xc0072000, IRQ 2
    host/usb-ohci.c: usb-01:02.0, PCI device 1033:0035
    usb.c: new USB bus registered, assigned bus number 3
    hub.c: USB hub found
    hub.c: 3 ports detected
    PCI: Enabling device 01:02.1 (0000 -> 0002)
    host/usb-ohci.c: USB OHCI at membase 0xc0074000, IRQ 2
    host/usb-ohci.c: usb-01:02.1, PCI device 1033:0035
    usb.c: new USB bus registered, assigned bus number 4
    hub.c: USB hub found
    hub.c: 2 ports detected
    Initializing USB Mass Storage driver...
    usb.c: registered new driver usb-storage
    USB Mass Storage support registered.
    Initializing Cryptographic API
    NET4: Linux TCP/IP 1.0 for NET4.0
    IP Protocols: ICMP, UDP, TCP
    IP: routing cache hash table of 512 buckets, 4Kbytes
    TCP: Hash tables configured (established 4096 bind 8192)
    NET4: Unix domain sockets 1.0/SMP for Linux NET4.0.
    NET4: Ethernet Bridge 008 for NET4.0
    802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
    All bugs added by David S. Miller <davem@redhat.com>
    Data bus error, epc == 80090778, ra == 80090750
    Oops in traps.c::do_be, line 385:
    $0 : 00000000 1000fc00 0000002c 811ee2c0 802f2cf8 00000001 811ef000 811ee2c0
    $8 : 08a00110 802b1d95 00000001 00000000 00700000 00000000 000003b4 00000000
    $16: 89abf450 80281000 802b1d80 802f2cf8 802b1d95 fffffffc 8021bd80 00000000
    $24: 802b1d95 800dde54                   8021a000 8021bce0 00000000 80090750
    Hi : 00000000
    Lo : 08a00110
    epc   : 80090778    Not tainted
    Status: 1000fc03
    Cause : 0000001c
    PrId  : 00029006
    Process swapper (pid: 1, stackpage=8021a000)
    Stack:    80293080 8003f8d8 811f1180 00000002 00000003 8021bd90 802b1d98
     80294120 e0011985 0000002b 7d266ee6 801bd330 e0021985 00000044 98f7fb1d
     00000009 00000001 000041ed 00000000 00000000 44510218 44510218 44510218
     00000000 00000000 00000000 00000000 00000000 b5b0646c 00000000 e0011985
     0000002b 7d266ee6 00000001 00000008 0000000a 44510228 00000403 3e52064b
     61463430 ...
    Call Trace:   [<8003f8d8>] [<800928c8>] [<8002d950>] [<8008ec68>] [<8003e740>]
     [<80170024>] [<800537bc>] [<800433b8>] [<80170024>] [<80046420>] [<80046134>]
     [<80170024>] [<80170000>] [<80170024>] [<80030530>] [<80170024>] [<80170028>]
     [<80170028>] [<800531d4>] [<80170024>] [<80170000>] [<80053cc4>] [<80001c8c>]
     [<80001b80>] [<8002144c>] [<800017fc>] [<80001794>] [<80003530>] [<80011940>]
     [<8005b79c>] [<80003520>]
    
    Code: 2415fffc  24420003  00551024 <ae02000c> 8fa200a0  ae000004  ae020008  8ce20008  ae020000
    Kernel panic: Attempted to kill init!
     <0>Rebooting in 5 seconds..Please stand by while rebooting the system...
    
    
    CFE version 1.0.37 for BCM947XX (32bit,SP,LE)
    Build Date: 一 11月  7 19:02:17 CST 2005 (root@localhost)
    Copyright (C) 2000,2001,2002,2003 Broadcom Corporation.
    
    Initializing Arena
    Initializing Devices.
    
    No DPN
    et0: Broadcom BCM47xx 10/100 Mbps Ethernet Controller 3.90.38.0
    rndis0: Broadcom USB RNDIS Network Adapter (P-t-P)
    et1: Broadcom BCM47xx 10/100 Mbps Ethernet Controller 3.90.38.0
    CPU type 0x29006: 264MHz
    Total memory: 65536 KBytes
    
    Total memory used by CFE:  0x80300000 - 0x803A3890 (669840)
    Initialized Data:          0x803397A0 - 0x8033BEB0 (10000)
    BSS Area:                  0x8033BEB0 - 0x8033D890 (6624)
    Local Heap:                0x8033D890 - 0x803A1890 (409600)
    Stack Area:                0x803A1890 - 0x803A3890 (8192)
    Text (code) segment:       0x80300000 - 0x803397A0 (235424)
    Boot area (physical):      0x003A4000 - 0x003E4000
    Relocation Factor:         I:00000000 - D:00000000
    
    Boot version: v3.5
    The boot is CFE
    
    mac_init(): Find mac [00:16:B6:06:94:7A] in location 0
    Nothing...
    
    No eou key find
    Device eth0:  hwaddr 00-16-B6-06-94-7A, ipaddr 192.168.1.1, mask 255.255.255.0
            gateway not set, nameserver not set
    Reading :: Failed.: Interrupted
    CFE> ^C
    CFE> ^C
    CFE>
    
    
    -albertr
  4. albertr

    albertr Addicted to LI Member

    I've JTAG'ed my SL and re-wrote the NVRAM area with the old settings from backup (thanks JMR for tracing JTAG lines!) Now it's all good and works in 32MB RAM mode. The point taken - always have a backup ready and be prepared for worst.
    -albertr
  5. albertr

    albertr Addicted to LI Member

    While looking and the NVRAM settings on my briked (and now revived SL), I noticed that for some reason sdram_ncdl was set by CFE to different value than reported by JMR above? Here's the setting for 32MB SDRAM configuration:

    Code:
    sdram_config=0x0062
    sdram_refresh=0x0000
    sdram_ncdl=0x10103
    sdram_init=0x000b
    
    Here's the setting I recovered from NVRAM after it went south:

    Code:
    sdram_config=0x0062
    sdram_refresh=0x0000
    sdram_ncdl=0x400
    sdram_init=0x0009
    
    Note that sdram_ncdl was set to 0x400, not 0x10208 as was mentioned by JMR!

    JMR, could you please confirm that after auto-tuning, CFE set sdram_ncdl to 0x10208 on your SL? If so, I might want to give it another try, i.e. set to to fixed value to skip auto-tuning?

    Does anyone know how to decode the values in sdram_ncdl?
    -albertr
  6. albertr

    albertr Addicted to LI Member

    Well, I've tried to enable 64MB of RAM again, this time skipping memory auto-tuning in CFE. Unfortunately, it didn't help, so I guess somehow I managed to damage the second memory chip or it's traces, so it's in unusable state.

    Anyway, having JTAG working, I thought that I can easily restore my NVRAM to be able to use just original 32MB of RAM as I did before. But I ran into the problem this time - whatever data I'm trying to write to NVRAM area in flash, when I read it back it comes out as garbage. And it reads exactly the same regardless of what I've tried to write to it before. Does anyone have any idea why that could happen? I'm quite new to JTAG'ing and it worked for me yesterday without any problem...

    How exacly CPU writes into the flash? Does it buffer the data in RAM or use stack/registers only? In other words, if my RAM is fsk'ed up, should I still be able to write into flash? Any information is appreciated...
    -albertr
  7. albertr

    albertr Addicted to LI Member

    Hmm, even erasing the flash area doesn't seem to work... Debrick utility runs without detecting any errors, but when I'm trying to read it back after erasing, it reads the same garbage:

    Here's how debrick utility runs:
    Code:
    albertr@t42:~/Desktop/WRTSL54GS/JTAG/v45$ sudo ./wrt54g -erase:nvram /skipdetect /instrlen:8
    
    ====================================
    WRT54G/GS EJTAG Debrick Utility v4.5
    ====================================
    
    Probing bus ... Done
    
    Instruction Length set to 8
    
    CPU Chip ID: 00000100011100000100000101111111 (0470417F)
    *** CHIP DETECTION OVERRIDDEN ***
    
        - EJTAG IMPCODE ....... : 00000000100000000000100100000100 (00800904)
        - EJTAG Version ....... : 1 or 2.0
        - EJTAG DMA Support ... : Yes
    
    Issuing Processor / Peripheral Reset ... Done
    Enabling Memory Writes ... Done
    Halting Processor ... <Processor Entered Debug Mode!> ... Done
    Clearing Watchdog ... Done
    
    Probing Flash at (Flash Window: 0x1fc00000) ... Done
    
    Flash Vendor ID: 00000000000000000000000010001001 (00000089)
    Flash Device ID: 00000000000000000000000000010111 (00000017)
    *** Found a Intel 28F640J3 4Mx16       (8MB) Flash Chip ***
    
        - Flash Chip Window Start .... : 1c000000
        - Flash Chip Window Length ... : 00800000
        - Selected Area Start ........ : 1c7e0000
        - Selected Area Length ....... : 00020000
    
    *** You Selected to Erase the NVRAM.BIN ***
    
    =========================
    Erasing Routine Started
    =========================
    Total Blocks to Erase: 1
    
    Erasing block: 64 (addr = 1c7e0000)...Done
    
    =========================
    Erasing Routine Complete
    =========================
    elapsed time: 0 seconds
    
    
     *** REQUESTED OPERATION IS COMPLETE ***
    
    albertr@t42:~/Desktop/WRTSL54GS/JTAG/v45$
    

    Here's a snipset showing how the garbage data looks like after reading it back from NVRAM area:
    Code:
    $ strings NVRAM.BIN.SAVED_20060822_002700
    FLSH
    dcM``mI``Db) 000000
    bO``dRad$0800
      0
    a`dp0
    02!22     *80:!`
    `n dddSt 08!
    a` Ddr!  "122@4* &
      "0A
    blddV5
    `-abd
    e`4 h
    )$0
    ad `$ 0*048
    2 2 0
    PidlEta`%
     0 )!"! $0
     $ B
     $ 04"&A
       0
    aba``e40
    bo`bdTp``=0
    0$0F
    ad1`ac
    `db4
    0 )08$B
    6 0   "B
    ep`arK0"0
    !$,0
    d` ld`
    ul0``
     h$!0
     40%$
    pl0d0
    f`ie1
    P@0 DS
    Id4$
    bapl5
    `A0e`p`gb=00$0
    b`aa4
    a``D``,!!0"100 !$0
    bDra`
    CFD !&90(00&0
    aa`adCH
     0
    CA@ %1
    `c``ddLaga- h00
    SD0 ES
    e`b`ah%
    h   0
    RDR@%
    l! X! 0 0
    a400 (!$ "5"0
    p`0B $ `!%0a
    b0) 0$a 0
    `a0`",
    HBE3
    bDbalDabId5 80
    raa_`dd
    !a
    !phi!$``1
    MRer4d2,0
    bl Rdbad%40
    0_mode=ap
    wan_gateway=0.0.0.0
    dhcp_start=100
    wl0_ap_isolate=0
    video_VOB=1
    audio_WMA=1
    os_flash_addr=bfc40000
    wl0_gmode=1
    sromrev=2
    storage_groups_limit=15
    boardtype=0x042f
    et1macaddr=00:90:4C:60:00:2B
    users_gid=42000
    gdns=0
    dvlwds=1
    lan_netmask=255.255.255.0
    guest_uid=35000
    wl0_dtim=1
    wl0_ssid=WAP
    et1mdcport=1
    os_date=Feb 15 2006
    video_DAT=1
    ppp_redialperiod=30
    dhcpc_ckps=1
    photo_TIF=1
    wan_netmask=255.255.255.0
    wl0id=0x4320
    wl0_txant=3
    workgroup=Linksys
    ppp_demand=0
    ag0=255
    domain_WRTSL54GS_sid=S-1-4-0-0-0-0-0-5-15-98366706-19f66519-a35dd7dc-0-0-0-0-0-0-0-0-0-0-0
    root_passwd=admin
    lan_stp=0
    upnpmnp=0
    wl0_plcphdr=long
    wl0_rate=0
    wl0_closed=1
    wl0_macmode=disabled
    wl0_radioids=BCM2050
    wl0_phytype=g
    wl0gpio2=0
    video_M4V=1
    wl0gpio3=0
    wl0_afterburner=off
    upnpcas=0
    lan_hwaddr=00:16:B6:06:94:7A
    wl0_antdiv=3
    wan_dns=0.0.0.0
    storage_shares_limit=15
    nobody_gid=42001
    wl0_wpa_psk=myverysecretpassword
    shared_info=All_Partitions:1:admin:rw
    flash_type=Intel 28F640J3 4Mx16
    dmdns=1
    bcm4712_firmware_version=v1.50.0
    wan_proto=static
    ftp_share_folder=/
    wl0_net_reauth=36000
    noffx=0
    audio_AIF=1
    pa0itssit=62
    gid_range=42000-43000
    photo_BMP=1
    audio_AAC=1
    telnetdst=1
    backup_job1=:::::::::::
    backup_job2=:::::::::::
    backup_job3=:::::::::::
    backup_job4=:::::::::::
    forcewep0=0
    backup_job5=:::::::::::
    cctl=0
    backup_job6=:::::::::::
    backup_job7=:::::::::::
    wan_hwaddr=00:16:B6:06:94:7B
    selpwr=4
    backup_job8=:::::::::::
    backup_job9=:::::::::::
    lan_ifnames=eth0 eth1 eth2 ed
     adH$
     .140(0.00
    `dhT`abpIphaba
    ``d%!
    @@@%!
    pa0- x00
    falEa$d`h!
    0`pH!
    ``dR)0! $040(0.10
    "!"!0
    B`cb10
    **"008:::::
    ppati!
    ````b
    a,"&0
    a!040
    p`0Sma8!20
    a(!08
    ba`%!
    D@$%!
    qd0P``9d
    p, Isa`,d`
    a``ad
    cdb`iG! h  &0
    ul0Ra-ALD
    q4A@@
    aTeraba_dae`p
    `p`_a`a`aS!!"a`a) :`d
    ab2`t
    `!` 0  0 0
    
    td0Ep!debat,d
    ``edd
    @HF4!
    aib_a`e`,Adaab
    addin
    AA )!
    @@0-!
    ```edIid,%
    aa`$!
    lalE)bb
    d)``
    D@D%!
    @@A0
    `aar$ h  18
    p 0!(
    rdb`eS`% p 0 0
    `00
    cd`!
    b```-
    h
    pA`Lh$!
    e!dTh
    ``!`Th1
    W`dM)0
    (0  $0
    0( $
    PB41
    `q$ #
    dHA0A
    d`c`bG0!
    esIfe01
    2$01(#(,0
    gd _r`aEa4#
    di$!&
    gAFMD41
    pp)0!0
    p`arap%A`hAPar4AdhO@a2 (`imla* :#fm`ehd*
    bh``ac
    Aq`abEA
    0@9!
    dp00
    add`-
    AE$!
    W@@CI$
    ea,E``
    ed0Ep`
    p``Im41
    `u$!%
    dDFAV)
    d`faL)&0
    `fal,
    hfe-J
    rh0E B*
     2!$ B4002000
     0  *
    CE-!
    eL0Rgde`dI`b-ddb
    `a   $
    0!0b
    0 0 10
    `a0
    0 0b 00
    `a0
    1 p`e
    ad0 h
    $ X0  B
    ddR0a
       00
    000!
    ```d%
    dd`N`-0
    pl0T!"0
    @ARab!(
    MAXSbal
    Wl0M!
    `hndl
    dV@BC1!
    d`0Sa50
    Wl Da5p`K
    ed!0`qa
    dp10
    `addR4%
     f#$
    e`0V#"1
    tl0Aar
    `da0`dq
    `fqd!40
    
    Any idea why this is happening?

    JMR, if you are reading this, could you please post a copy of CFE backup from your SL?

    -albertr
  8. AmyGrrl

    AmyGrrl LI Guru Member

    This quite interesting... I wonder if more Linksys router and support more ram.. has anyone tried upgrading the ram on other models.. the WRT54G/GS/GL?
  9. ka9yhd

    ka9yhd LI Guru Member

  10. Bird333

    Bird333 LI Guru Member

    Are you sure you have good solder joints? You might want to also try a buffered jtag. How long are your jtag wires and parallel cable?
  11. albertr

    albertr Addicted to LI Member

    I don't think JTAG cable is the problem. I can read the other areas of the flash (i.e. CFE), and it doesn't have this garbage. The cable lenght is about 12cm in total.

    I can't erase the flash block of NVRAM area via JTAG either. Debricking utility runs fine, but when I try to read this area back, it still has the same data (not all 1's as it supposed to have after being erased).

    -albertr
  12. Bird333

    Bird333 LI Guru Member

    How long is your parallel cable?
  13. albertr

    albertr Addicted to LI Member

    I see where you are going, but I already answered your question above.
    -albertr
  14. albertr

    albertr Addicted to LI Member

    I solved SL' "unable to erase flash block" problem by making a minor change to EJTAG debricking utility. I sent the patch to its author - hairydairymaid.

    Thanks to his great utility my SL working again, and I'm a happy cat ;)
    -albertr
  15. Bird333

    Bird333 LI Guru Member

    Glad you got it fixed! What did you have to change?

    Did you get it working with 64 megs?
  16. albertr

    albertr Addicted to LI Member

    Unfortunately I desoldered the second SDRAM chip thinking that it was the problem. I'm not gonna try to solder it again - it's too risky and I dont have o'scope. So it's over for me. But since JTAG works, I don't see any reason for somebody else not to try this mod. Hairydairymaid will be releasing the new version of debricking utility soon that would incorporate the change.
    -albertr
  17. jmranger

    jmranger Addicted to LI Member

    0x10208 confirmed on mine.

    The best information source I found on sdram_* was http://wl500g.dyndns.org/sdram.html but there's not much on ncdl. Maybe by looking at the source code ?

    albertr, if you have a chance, could you tell us a little more about the patch you had to do on the debricker ?

    JMR
  18. albertr

    albertr Addicted to LI Member

    JMR,

    Thank you for confirming it! Your research and findings are very helpful. As far as debricking utility goes, I was told that Hairydairymaid is releasing the updated version soon, but since there's interest, here it goes:

    http://www.iral.com/~albertr/linux/misc/wrt54g.c.diff

    As usual, no warranty it won't kill your hardware, use it on your own risk.

    Here's snipset explaining the nature of the change:

    "... I think the problem was that
    unlocking flash takes about 0.2 seconds in my case and there was no
    waiting for flash busy status to clear between unlocking and erase
    commands. While there, I also added the CPU to the list of
    supported chips (otherwise /skipdetect and /instrlen:8 options were
    required). And lastly I moved the routine to probe for Intel flash chips
    before probing for AMD flash because my Intel flash chip were recognized
    by AMD probing routine, but that might not be required."

    Once the new official version is released by Hairydairymaid, this patch will be removed.

    -albertr
  19. Bird333

    Bird333 LI Guru Member

    Can either of you tell what the maximum amount of flash and ram this router can use?

    Jmranger: Your second link in your original post does seem to work.
  20. jmranger

    jmranger Addicted to LI Member

    Not me :)

    RAM:
    Reading this (found here), some Broadcom processors can address 128MB. Chip pinout is identical between 16Mx16 in the SL and the 32Mx16 (2 x 32Mx16 = 128MB).
    So 64MB is yes, 128MB would be worth trying but you may have fun finding the correct nvram setting since Oleg has nothing about 512Mbit chips, 256MB, I didn't do enough research... Don't put your JTAG too far...

    Flash:
    No idea, and useless IMHO. Why would you try to increase flash on an USB-equipped router ? I'd add a 1GB USB flash stick, and move to another project.
    If you really want to find out, look at the StrataFlash datasheet and see whether there are higher density chips with compatible pinout. The 'SL, like the 'GL, supports multiple flash form factor (there are two locations one on top of the other, see the autopsy
    thread), but the 'GL has 4. Anyway, have fun and share your successes.

    It does ?
    Tell Toxic to stop changing forum software every other day :)
    My original research post is now here .

    JMR
  21. briansrapier

    briansrapier Guest

    I know this discussion is getting rather dated, but it still seems to be the most relavent in terms of upgrading the WRTSL54GS. I am going to make an attempt at this soon. The good thing is that my company is footing the bill for RnD, so if I mess up, it's not a tragedy. That being said:

    1) Does anyone have a recommended supplier for the chip and resistors?

    2) Has anyone been successful doing the mod to 128MB? I saw that it should be theoretically possible.

    3) Does anyone have a good link for building the JTAG or a serial port connection? I've seen the pin outs, which I suppose is sufficient, btu I want to have my duck in a row before I start.

    I appreciate the work/tinkering that you guys do to help out folks like me...

    Thanks!
  22. netbuddy

    netbuddy Addicted to LI Member

    So that the data is retained after powerdown or dropout (brown out). You then dont need to rely on your suggestion which then relys on other external equiptment such as a PC or Laptop to access where as you can access the data via an IP address from what I have read. That opens the possibilty to remote updating and you wouldnt be restricted to just one machine but open up to many.....
  23. RobNC

    RobNC LI Guru Member

    128MB not maximum?

    This doesn't imply that 128MB is the maximum addressable size, but this might give some more information:

    http://wl500g.dyndns.org/sdram.html

    Seems to indicate the possible use of 1Gb modules, which if used in pairs, could get you 256MB. Good luck finding those though... :) But a 256MB router would be very cool, even possible to set up a decent web server with the extra space, or with Tomato, a huge amount of logging.
  24. jmranger

    jmranger Addicted to LI Member

    Glad to see Oleg found new info to update his page. I agree: technically, it looks very feasible to me. Mod price: in large amounts, my usual supplier has the 256Mb part for around $5, the 512Mb for around $10 and the 1Gb for around... $150!!! For 1-2: $10, $20 and not available, period.

    Let me know if you succeed !!!

    jmranger
  25. ovrclocked

    ovrclocked Guest

    Hi Everyone,

    I was looking at the Hynix web site for the memory chip spec's and ran accross this:

    http://www.hynix.com/eng/02_products/01_dram/down/DDR.pdf

    From what I read looking at the chip on the site http://www.linksysinfo.org/forums/showthread.php?t=47389

    The part number HY5DU561622DT is a 256M Chip running at 8K Refresh, 4banks x16 and is DDR333 SDRAM.

    Now I am not sure if that is a 256M Chip but unless I am not understanding something there is more memory to be had from the WRTSL54GS routers then we all are aware of.


    I have also posted the process for adding swap space to the WRTSL54GS:
    http://www.opensourcerebels.org/forums/viewforum.php?f=4
  26. u3gyxap

    u3gyxap Network Guru Member

    Ammm, 256MBits of RAM is exactly 32MB.
    I know it is awkward for the manufaturers to use bits instead of bytes, I had to learn it the hard way.
  27. jaras123

    jaras123 Networkin' Nut Member

    Hi, everyone.
    I'm new to this forum. I recently purchased WRTSL54GS router and decided to upgrade its memory to 64MB. I followed the instructions here and bought Micron MT46V16M16TG-6T which is an equivalent to Hynix chip quoted above. And then I opened my router and... realised that I have other type of Hynix memory. :eek:
    It is HY5DU561622ETP-D43, still in production as per Hynix catalogue:

    http://www.hynix.com/datasheet/pdf/dram/HY5DU568(16)22E(L)TP(Rev1.1).pdf

    The most important difference between memory chip installed in my router and the older ones is that it's DDR400 SDRAM memory (200MHz@CL3) instead of DDR333 (133MHz@CL2.5).

    Yes, I know what you think, I should have opened my box BEFORE ordering Micron memory but I didn't suspect that Linksys could use another type. Well, my mistake...

    Now I have no idea if my DDR333 memory will work with my unit. Does anybody think if it's worth of giving it a try? Is it possible that DDR400 200 MHz Hynix memory natively installed in the router is working at 133 MHz as DDR333 ? :confused:

    Or maybe ordering a direct equivalent to DDR400 from Micron would be better idea?

    I'm worried that I'd damage my router by installing wrong type of memory. :frown:
  28. jaras123

    jaras123 Networkin' Nut Member

    64MB upgrade done but router unstable

    Ok, I think I found the answer. This is sdram_config parameter value: 0x0062 which means that memory is natively running at 2.5 CAS Latency even if memory chip is CL3 capable (reference: http://wl500g.dyndns.org/sdram.html). If other parameters aren't critical I think I could succefully use Micron MT46V16M16TG-6T.

    But I decided to not take any risks and ordered direct equivalent of CL3 DDR400 Hynix chip from Micron: the MT46V16M16TG-5B.

    I soldered it into my router, then missing resistors. After powering on, there was still 32MB available as I could expect. The router was stable. Original NVRAM settings were:

    Code:
    sdram_config	0x0062
    sdram_init	0x000b
    sdram_ncdl	0x107
    I changed sdram_init for 0x0009 and sdram_ncdl for 0x0000 and rebooted.

    The device restarted and reported about 62MB RAM available but was unstable. :frown: I've never got it working for more than 15-20 minutes. After that time it either stopped responding (completely dead console on serial port) or automatically restarted with no error message. :frown:

    The NVRAM settings after reboot were:

    Code:
    sdram_config	0x0062
    sdram_init	0x0009
    sdram_ncdl	0x406
    The sdram_ncdl was different from JMRANGERS's or ALBRERT's values, both before and after upgrade. I wonder, what would happen if I modified the parameter manually but I can't do it at the moment as I don't have JTAG to recover in case something goes wrong.

    Anyway, I'm quite busy now so I switched my WRT back to 32MB by recovering the original NVRAM parameters. It's stable. I'll get back to it later when I have some spare time.

    Does anybody have an idea how to decode sdram_ncdl parameter? Site http://wl500g.dyndns.org/sdram.html doesn't say much about it...
  29. niaz09

    niaz09 Networkin' Nut Member

    changed nvram settings and rebooted

    I guess I managed to damage some PCB traces or maybe memory chip itself... Anyway after soldering, it seemed to work fine using only lower 32MB. So hoping for good, I've changed nvram settings and rebooted - CFE detected all 64MB of RAM, but linux kernel crashed (it's always a bad sign). Luckly, I had a serial console, so I've tried to change NVRAM values back to old setting from within CFE prompt. Unluckly for me, before I managed to complete it, the console hanged. After that, it lost serial console completely.... Nothing comes on serial console when power cord is connected. All lights light up as usual, then only USB and "internet" lights stay lit, and "power" light is blinking.
  30. CheBuzz

    CheBuzz Guest

    I was finally able to do this mod successfully after many unsuccessful attempts. It always came down to solder contacts. I finally plastered the thing with flux and got everything to work. I can confirm the steps worked all you need to do is set sdram_init=0x0009 and sdram_ncdl=0x0. I also changed sdram_config to 0x0022 to get a latency of 2, though I may change it back to 2.5 if this proves unstable (but so far everything looks great)

    Ran the built-in CFE memtest and everything passed. Then installed the package memtester and tested all available ram (about 11M was used and untestable) and everything passed. It has been up and running for about a day now. If anything changes, I will post here.

    But as for now, looks like I finally have one of those collectible SLs.

Share This Page