Joined: 31 Mar 2007 Posts: 181 Location: /Earth/USA/OH/Zville
Posted: Mon Dec 01, 2008 17:36 Post subject:
Man, I love a good hardware mod!
I recovered my old motorola router by doing this before. Now I have not looked at the data sheets on the chips, but as long as the pins are the same then you should not have any issue as long as you flash everything back via jtag. I'm actually going to upgrade the ram in my router as soon as I get the stuff that I ordered. You might want to look into that as well.
Well I already transplanted a Spansion S29GL064M out of Vonage VOIP box into it, but the chip that I transplanted is the 16 bit instruction length only versus the original EON chip which will do both 8 and 16 bit instructions. Firmware is originally 8 bit so this doesn't work.
Also another issue could be the Spansion I removed from the Vonage box is also the Uniform Sector type. Not bottom boot like the EON. I don't think the processor knows where to look to load the cfe.
So thier is a little more to it then just switching out with just any old chip.
However I am able to access the chip via tjtag using the switch /instrlen:16 and with a little recoding of the source.
At this point I am checking to see if I can flash the whole 8Mb of the Improper chip using flash:wholeflash with a 6.6MB image of dd-wrt mega. If I can flash all of that I can flash the correct chip when I get it. It's being shipped UPS 2nd day from mouser.com. _________________ Linksys - WRT54GS Ver 7.2 (usb port added)
Belkin - (PLAY) F7D4302 Ver 1
Asus - WL500G Premium Ver 1
Asus - RT-N16
Ok I have recieved the chip and installed it. Had to solder jumpers accross R5 and R7 as these are address 20 and 21 that go to the larger size chip and are not jumpered by default from the factory.
You have new mail in /var/spool/mail/root
[root@localhost tjtagv2-1-4]#
Have verified that tjtag can write and read the flash with no modification to tjtag code. However I am getting an invalid boot block error at the serial console when unit boots. It is starting the cfe, but then comes up and says
Invalid Boot Block
Reading Data:: timed out
Then starts all over again.
No tftp option either
Any ideas anyone. _________________ Linksys - WRT54GS Ver 7.2 (usb port added)
Belkin - (PLAY) F7D4302 Ver 1
Asus - WL500G Premium Ver 1
Asus - RT-N16
This is what I am getting at boot, I am thinking I may need to compile a custom CFE for this unit now. I think the boot block area is wrong for the bigger chip.
Welcome to minicom 2.3
OPTIONS: I18n
Compiled on Mar 13 2008, 00:58:14.
Port /dev/ttyS1
Press CTRL-A Z for help on special keys
CFE version 1.0.37 for BCM947XX (32bit,SP,LE)
Build Date: Fri Nov 23 11:34:59 EST 2007 (tornado@dd-wrt.com)
Copyright (C) 2000,2001,2002,2003 Broadcom Corporation.
Initializing Arena
Initializing Devices.
Boot partition size = 262144(0x40000)
et0: Broadcom BCM47xx 10/100 Mbps Ethernet Controller 4.150.10.5
CPU type 0x29029: 240MHz
Total memory: 16384 KBytes
Total memory used by CFE: 0x80700000 - 0x807977D0 (620496)
Initialized Data: 0x8072E860 - 0x80730FB0 (10064)
BSS Area: 0x80730FB0 - 0x807317D0 (2080)
Local Heap: 0x807317D0 - 0x807957D0 (409600)
Stack Area: 0x807957D0 - 0x807977D0 (8192)
Text (code) segment: 0x80700000 - 0x8072E860 (190560)
Boot area (physical): 0x00798000 - 0x007D8000
Relocation Factor: I:00000000 - D:00000000
Committing NVRAM...done
�aiting for reset button release...done
CFE version 1.0.37 for BCM947XX (32bit,SP,LE)
Build Date: Fri Nov 23 11:34:59 EST 2007 (tornado@dd-wrt.com)
Copyright (C) 2000,2001,2002,2003 Broadcom Corporation.
Initializing Arena
Initializing Devices.
Boot partition size = 262144(0x40000)
et0: Broadcom BCM47xx 10/100 Mbps Ethernet Controller 4.150.10.5
CPU type 0x29029: 240MHz
Total memory: 16384 KBytes
Total memory used by CFE: 0x80700000 - 0x807977D0 (620496)
Initialized Data: 0x8072E860 - 0x80730FB0 (10064)
BSS Area: 0x80730FB0 - 0x807317D0 (2080)
Local Heap: 0x807317D0 - 0x807957D0 (409600)
Stack Area: 0x807957D0 - 0x807977D0 (8192)
Text (code) segment: 0x80700000 - 0x8072E860 (190560)
Boot area (physical): 0x00798000 - 0x007D8000
Relocation Factor: I:00000000 - D:00000000
Device eth0: hwaddr 00-xx-xx-xx-xx-xx, ipaddr 192.168.1.1, mask 255.255.255.0
gateway not set, nameserver not set
Invalid boot block on disk
Reading :: Failed.: Timeout occured
Reading :: Failed.: Timeout occured
Reading :: Failed.: Timeout occured
Reading :: Failed.: Timeout occured
Reading :: Failed.: Timeout occured
Reading :: Failed.: Timeout occured
Reading :: _________________ Linksys - WRT54GS Ver 7.2 (usb port added)
Belkin - (PLAY) F7D4302 Ver 1
Asus - WL500G Premium Ver 1
Asus - RT-N16
I can get the boot to stop in the serial console by pressing CONTROL-C. This brings me to a <CFE> Prompt. From here I can configure anything in NVRAM by using nvram set (parameter)=variable.
If I set my lan_ipaddr= to my local lan I can even ping my other computers.
I even tried loading dd-wrt.v24_micro_generic.bin via tftp. The router connected to my windows pc running the tftp server, but then the router just frose at reading:: and would do nothing till I did a reboot.
This router is alive, but only partially. I know this has to do with the CFE and where it is trying to load part of itself from. Anyone have anything to input on all of this.
Some CFE source code would be nice for the BCM5354 chipset. I have some source that is for the BCM947xx series, but have no idea where to start in trying to configure it to compile correctly for this box.
Or even maybe some console boot text from people who own a router with the bcm5354 chip and 8MB of flash (dought anyone does own one though)
Anything would be helpfull at this point. _________________ Linksys - WRT54GS Ver 7.2 (usb port added)
Belkin - (PLAY) F7D4302 Ver 1
Asus - WL500G Premium Ver 1
Asus - RT-N16
It looks like cfe has initialized flash0 device, but when I try to do anything with it. It says something like this:
CFE> boot -raw flash0:*.bin
Loader:raw Filesys:raw Dev:flash0 File:*.bin Options:(null)
Loading: Failed.
Could not load flash0:*.bin: Invalid boot block on disk
*** command status = -31
So flash0 has an invalid boot block. How do I fix it? _________________ Linksys - WRT54GS Ver 7.2 (usb port added)
Belkin - (PLAY) F7D4302 Ver 1
Asus - WL500G Premium Ver 1
Asus - RT-N16
Ok, just tried a different cfe.bin from a wrt54g V8 that I downloaded off the internet.
I was greeted with the same results, so it's not a corrupted cfe.bin.
I figure it is either the cfe doesn't know how to initiate the flash for access or that the flash boot block is corrupt.
More apt to think at this point that the cfe is booting, but not bringing up flash0 device for access. Maybe something to do with flash device id and vendor id not being recognized. At this point I am tired of this. I will keep trying though. Something has to work. _________________ Linksys - WRT54GS Ver 7.2 (usb port added)
Belkin - (PLAY) F7D4302 Ver 1
Asus - WL500G Premium Ver 1
Asus - RT-N16
IMO try to load a micro version and if it works maybe u should try another CFE from linksys with same processor, 16M ram and higher ROM capacity (see here ). Maybe that CFE takes only 2M even if ROM is 8M. Just an opinion.
Joined: 31 Mar 2007 Posts: 181 Location: /Earth/USA/OH/Zville
Posted: Thu Dec 04, 2008 17:39 Post subject:
I would check, double check, and double double check your soldering points. I would think if one of the lines that is use for reading the flash device is loose or not connected could cause an error like that. Somethings is just telling me the check the solder connections.
If they are 100% good, then I would then say that it is the cfe programming. Like you said, it is either written to work only with a certain product id, or it has something to do with the memory addressing. I would of tried to copy the whole flash as a single binary from the old chip and tried to flash that to the new chip. This is what I did for my Motorola, but again I was not upgrading it just de-bricking it. _________________ WRT-350N v1.0; 128MB RAM, WPC600N, Dual USB, Mini+USB+FTP NEWD, CPU@330Mhz, Terk WF-R x3, Serial, external jtag, and working on SD Mod. Running Samba3, Lighttpd, and some Python apps.
WRT-300N v1.1; 128MB Ram, USB1.1, Bricked
From what I got from Tornado. It's not finding a valid boot block because I don't have dd-wrt binary loaded onto it. However I can't load it via TFTP because when it boots CFE it skips the TFTP loading and goes straight to trying to load from flash. Anybody know how I can tell the router to load a binary image via tftp from the CFE prompt. I tried a few times, but it just keeps timing out.
I tried with a tftp server running on my windows pc with IP address of 192.168.2.10 and router set with IP address of 192.168.2.50 hosting the dd-wrt.v24_micro_generic.bin. At the CFE prompt I typed boot -raw -tftp 192.168.2.10:dd-wrt.v24_micro_generic.bin. It timed out. Server however on the windows PC did acknowledge the get command in the log. However it dropped the connection due to the peer not responding.
I tried tftp -i 192.168.2.50 put dd-wrt.v24_micro_generic.bin on the windows pc right after entering boot command on router in the above paragraph. Timed out. _________________ Linksys - WRT54GS Ver 7.2 (usb port added)
Belkin - (PLAY) F7D4302 Ver 1
Asus - WL500G Premium Ver 1
Asus - RT-N16
Joined: 31 Mar 2007 Posts: 181 Location: /Earth/USA/OH/Zville
Posted: Sat Dec 06, 2008 17:45 Post subject:
I don't know squat about tftp, sorry. But I do have a question for you. What did you flash back to the chip? Just the CFE or the WHOLEFLASH? I would think with the WholeFlash being flashed to it instead, it would be able to find the boot block since it is a direct copy of were everything was, going back to it's old location on the new chip. _________________ WRT-350N v1.0; 128MB RAM, WPC600N, Dual USB, Mini+USB+FTP NEWD, CPU@330Mhz, Terk WF-R x3, Serial, external jtag, and working on SD Mod. Running Samba3, Lighttpd, and some Python apps.
WRT-300N v1.1; 128MB Ram, USB1.1, Bricked
I talked to tornado about this, and we came to the conclusion that I boobooed. does anyone have a wholeflash dump of original vxworks flash for WRT54GS v7.2
Also i am curious to see someone elses nvram settings for this same router. I think mine are incorrect. I used the wrong vxworks_killer when I put dd-wrt on the original chip. It worked, but is causing issues now.
Repeat that I need the following for a WRTS54GS v7.2:
--wholeflash.bin (original stock vxworks)
--nvram settings for sdram (all would be nice) _________________ Linksys - WRT54GS Ver 7.2 (usb port added)
Belkin - (PLAY) F7D4302 Ver 1
Asus - WL500G Premium Ver 1
Asus - RT-N16