8MB Flash Chip Replacement Modification on WRT54GS V7.2

Post new topic   Reply to topic    DD-WRT Forum Index -> Broadcom SoC based Hardware
Goto page 1, 2  Next
Author Message
eddie97044
DD-WRT User


Joined: 03 Nov 2008
Posts: 83

PostPosted: Mon Dec 01, 2008 17:21    Post subject: 8MB Flash Chip Replacement Modification on WRT54GS V7.2 Reply with quote
Ok guys, I am going to try to un nueter my router. I am going to replace the current flash chip

(EON EN29LV160AB-70TCP) 2MB x8/x16 Bottom Boot Flash

With this one.

(Spansion S29GL064N90TFI040) 8MB x8/x16 Bottom Boot Flash

Here is the datasheet on this chip.

Anobody give odd's on whether this is going to work. I already ordered the chips.

Oh, Almost forgot to mention that I already backed up the CFE.BIN and NVRAM.BIN as well as WHOLEFLASH.BIN via jtag before attempting this.



S29GL-N_01_12_e.pdf
 Description:

Download
 Filename:  S29GL-N_01_12_e.pdf
 Filesize:  3.02 MB
 Downloaded:  947 Time(s)


_________________
Linksys - WRT54GS Ver 7.2 (usb port added)
Belkin - (PLAY) F7D4302 Ver 1
Asus - WL500G Premium Ver 1
Asus - RT-N16


Last edited by eddie97044 on Thu Dec 04, 2008 10:03; edited 1 time in total
Sponsor
kjbuente
DD-WRT User


Joined: 31 Mar 2007
Posts: 181
Location: /Earth/USA/OH/Zville

PostPosted: Mon Dec 01, 2008 17:36    Post subject: Reply with quote
Man, I love a good hardware mod! Twisted Evil

I recovered my old motorola router by doing this before. Now I have not looked at the data sheets on the chips, but as long as the pins are the same then you should not have any issue as long as you flash everything back via jtag. I'm actually going to upgrade the ram in my router as soon as I get the stuff that I ordered. You might want to look into that as well.

Anyways, good luck.
Shawn360
DD-WRT Guru


Joined: 26 Jul 2008
Posts: 1237

PostPosted: Mon Dec 01, 2008 17:49    Post subject: Reply with quote
Good luck post some pictures when you finish others might also like to do this.
eddie97044
DD-WRT User


Joined: 03 Nov 2008
Posts: 83

PostPosted: Mon Dec 01, 2008 19:08    Post subject: Reply with quote
Well I already transplanted a Spansion S29GL064M out of Vonage VOIP box into it, but the chip that I transplanted is the 16 bit instruction length only versus the original EON chip which will do both 8 and 16 bit instructions. Firmware is originally 8 bit so this doesn't work.

Also another issue could be the Spansion I removed from the Vonage box is also the Uniform Sector type. Not bottom boot like the EON. I don't think the processor knows where to look to load the cfe.

So thier is a little more to it then just switching out with just any old chip.

However I am able to access the chip via tjtag using the switch /instrlen:16 and with a little recoding of the source.

At this point I am checking to see if I can flash the whole 8Mb of the Improper chip using flash:wholeflash with a 6.6MB image of dd-wrt mega. If I can flash all of that I can flash the correct chip when I get it. It's being shipped UPS 2nd day from mouser.com.

_________________
Linksys - WRT54GS Ver 7.2 (usb port added)
Belkin - (PLAY) F7D4302 Ver 1
Asus - WL500G Premium Ver 1
Asus - RT-N16
kjbuente
DD-WRT User


Joined: 31 Mar 2007
Posts: 181
Location: /Earth/USA/OH/Zville

PostPosted: Mon Dec 01, 2008 19:19    Post subject: Reply with quote
Yea, when I did my motorola I just replaced the chip with the same type.

Good info to know! thanks!
eddie97044
DD-WRT User


Joined: 03 Nov 2008
Posts: 83

PostPosted: Thu Dec 04, 2008 0:48    Post subject: Reply with quote
Ok I have recieved the chip and installed it. Had to solder jumpers accross R5 and R7 as these are address 20 and 21 that go to the larger size chip and are not jumpered by default from the factory.

tjtag gives me this

[root@localhost tjtagv2-1-4]# ./tjtag -probeonly /noemw /noreset /nobreak /nocwd /bypass

==========================================
EJTAG Debrick Utility v2.1.4-Tornado-MOD
==========================================

Probing bus ... Done

Instruction Length set to 8

CPU Chip ID: 00110101001101010100000101111111 (3535417F)
*** Found a Broadcom BCM5354 KFBG Rev 3 CPU chip ***

- EJTAG IMPCODE ....... : 00000000100000010000100100000100 (00810904)
- EJTAG Version ....... : 1 or 2.0
- EJTAG DMA Support ... : Yes
- EJTAG Implementation flags: R4k MIPS16 MIPS32

Issuing Processor / Peripheral Reset ... Skipped
Enabling Memory Writes ... Skipped
Halting Processor ... Skipped
Clearing Watchdog ... Skipped

Probing Flash at (Flash Window: 0x1fc00000) ...
VENDID-A 0x00000001
DEVID-A 0x00000000
Done

Flash Vendor ID: 00000000000000000000000101111110 (0000017E)
Flash Device ID: 00000000000000000001000000000000 (00001000)
*** Found a Spansion S29GL064M BotB (8MB) Flash Chip ***

- Flash Chip Window Start .... : 1c000000
- Flash Chip Window Length ... : 00800000
- Selected Area Start ........ : 00000000
- Selected Area Length ....... : 00000000



*** REQUESTED OPERATION IS COMPLETE ***

You have new mail in /var/spool/mail/root
[root@localhost tjtagv2-1-4]#

Have verified that tjtag can write and read the flash with no modification to tjtag code. However I am getting an invalid boot block error at the serial console when unit boots. It is starting the cfe, but then comes up and says

Invalid Boot Block
Reading Data:: timed out

Then starts all over again.

No tftp option either

Any ideas anyone.

_________________
Linksys - WRT54GS Ver 7.2 (usb port added)
Belkin - (PLAY) F7D4302 Ver 1
Asus - WL500G Premium Ver 1
Asus - RT-N16
eddie97044
DD-WRT User


Joined: 03 Nov 2008
Posts: 83

PostPosted: Thu Dec 04, 2008 1:30    Post subject: Reply with quote
This is what I am getting at boot, I am thinking I may need to compile a custom CFE for this unit now. I think the boot block area is wrong for the bigger chip.

Welcome to minicom 2.3

OPTIONS: I18n
Compiled on Mar 13 2008, 00:58:14.
Port /dev/ttyS1

Press CTRL-A Z for help on special keys



CFE version 1.0.37 for BCM947XX (32bit,SP,LE)
Build Date: Fri Nov 23 11:34:59 EST 2007 (tornado@dd-wrt.com)
Copyright (C) 2000,2001,2002,2003 Broadcom Corporation.

Initializing Arena
Initializing Devices.
Boot partition size = 262144(0x40000)
et0: Broadcom BCM47xx 10/100 Mbps Ethernet Controller 4.150.10.5
CPU type 0x29029: 240MHz
Total memory: 16384 KBytes

Total memory used by CFE: 0x80700000 - 0x807977D0 (620496)
Initialized Data: 0x8072E860 - 0x80730FB0 (10064)
BSS Area: 0x80730FB0 - 0x807317D0 (2080)
Local Heap: 0x807317D0 - 0x807957D0 (409600)
Stack Area: 0x807957D0 - 0x807977D0 (8192)
Text (code) segment: 0x80700000 - 0x8072E860 (190560)
Boot area (physical): 0x00798000 - 0x007D8000

Relocation Factor: I:00000000 - D:00000000

Committing NVRAM...done
�aiting for reset button release...done

CFE version 1.0.37 for BCM947XX (32bit,SP,LE)
Build Date: Fri Nov 23 11:34:59 EST 2007 (tornado@dd-wrt.com)
Copyright (C) 2000,2001,2002,2003 Broadcom Corporation.

Initializing Arena
Initializing Devices.
Boot partition size = 262144(0x40000)
et0: Broadcom BCM47xx 10/100 Mbps Ethernet Controller 4.150.10.5
CPU type 0x29029: 240MHz
Total memory: 16384 KBytes

Total memory used by CFE: 0x80700000 - 0x807977D0 (620496)
Initialized Data: 0x8072E860 - 0x80730FB0 (10064)
BSS Area: 0x80730FB0 - 0x807317D0 (2080)
Local Heap: 0x807317D0 - 0x807957D0 (409600)
Stack Area: 0x807957D0 - 0x807977D0 (8192)
Text (code) segment: 0x80700000 - 0x8072E860 (190560)
Boot area (physical): 0x00798000 - 0x007D8000
Relocation Factor: I:00000000 - D:00000000

Device eth0: hwaddr 00-xx-xx-xx-xx-xx, ipaddr 192.168.1.1, mask 255.255.255.0
gateway not set, nameserver not set
Invalid boot block on disk
Reading :: Failed.: Timeout occured
Reading :: Failed.: Timeout occured
Reading :: Failed.: Timeout occured
Reading :: Failed.: Timeout occured
Reading :: Failed.: Timeout occured
Reading :: Failed.: Timeout occured
Reading ::

_________________
Linksys - WRT54GS Ver 7.2 (usb port added)
Belkin - (PLAY) F7D4302 Ver 1
Asus - WL500G Premium Ver 1
Asus - RT-N16
eddie97044
DD-WRT User


Joined: 03 Nov 2008
Posts: 83

PostPosted: Thu Dec 04, 2008 7:15    Post subject: Reply with quote
I can get the boot to stop in the serial console by pressing CONTROL-C. This brings me to a <CFE> Prompt. From here I can configure anything in NVRAM by using nvram set (parameter)=variable.

If I set my lan_ipaddr= to my local lan I can even ping my other computers.

I even tried loading dd-wrt.v24_micro_generic.bin via tftp. The router connected to my windows pc running the tftp server, but then the router just frose at reading:: and would do nothing till I did a reboot.

This router is alive, but only partially. I know this has to do with the CFE and where it is trying to load part of itself from. Anyone have anything to input on all of this.

Some CFE source code would be nice for the BCM5354 chipset. I have some source that is for the BCM947xx series, but have no idea where to start in trying to configure it to compile correctly for this box.

Or even maybe some console boot text from people who own a router with the bcm5354 chip and 8MB of flash (dought anyone does own one though)

Anything would be helpfull at this point.

_________________
Linksys - WRT54GS Ver 7.2 (usb port added)
Belkin - (PLAY) F7D4302 Ver 1
Asus - WL500G Premium Ver 1
Asus - RT-N16
eddie97044
DD-WRT User


Joined: 03 Nov 2008
Posts: 83

PostPosted: Thu Dec 04, 2008 7:39    Post subject: Reply with quote
It looks like cfe has initialized flash0 device, but when I try to do anything with it. It says something like this:

CFE> boot -raw flash0:*.bin
Loader:raw Filesys:raw Dev:flash0 File:*.bin Options:(null)
Loading: Failed.
Could not load flash0:*.bin: Invalid boot block on disk
*** command status = -31

So flash0 has an invalid boot block. How do I fix it?

_________________
Linksys - WRT54GS Ver 7.2 (usb port added)
Belkin - (PLAY) F7D4302 Ver 1
Asus - WL500G Premium Ver 1
Asus - RT-N16
eddie97044
DD-WRT User


Joined: 03 Nov 2008
Posts: 83

PostPosted: Thu Dec 04, 2008 10:38    Post subject: Reply with quote
Ok, just tried a different cfe.bin from a wrt54g V8 that I downloaded off the internet.

I was greeted with the same results, so it's not a corrupted cfe.bin.

I figure it is either the cfe doesn't know how to initiate the flash for access or that the flash boot block is corrupt.

More apt to think at this point that the cfe is booting, but not bringing up flash0 device for access. Maybe something to do with flash device id and vendor id not being recognized. At this point I am tired of this. I will keep trying though. Something has to work.

_________________
Linksys - WRT54GS Ver 7.2 (usb port added)
Belkin - (PLAY) F7D4302 Ver 1
Asus - WL500G Premium Ver 1
Asus - RT-N16
cwarky
DD-WRT User


Joined: 20 May 2008
Posts: 68
Location: Iasi, RO

PostPosted: Thu Dec 04, 2008 14:52    Post subject: Reply with quote
IMO try to load a micro version and if it works maybe u should try another CFE from linksys with same processor, 16M ram and higher ROM capacity (see here ). Maybe that CFE takes only 2M even if ROM is 8M. Just an opinion.
kjbuente
DD-WRT User


Joined: 31 Mar 2007
Posts: 181
Location: /Earth/USA/OH/Zville

PostPosted: Thu Dec 04, 2008 17:39    Post subject: Reply with quote
I would check, double check, and double double check your soldering points. I would think if one of the lines that is use for reading the flash device is loose or not connected could cause an error like that. Somethings is just telling me the check the solder connections.

If they are 100% good, then I would then say that it is the cfe programming. Like you said, it is either written to work only with a certain product id, or it has something to do with the memory addressing. I would of tried to copy the whole flash as a single binary from the old chip and tried to flash that to the new chip. This is what I did for my Motorola, but again I was not upgrading it just de-bricking it.

_________________
WRT-350N v1.0; 128MB RAM, WPC600N, Dual USB, Mini+USB+FTP NEWD, CPU@330Mhz, Terk WF-R x3, Serial, external jtag, and working on SD Mod. Running Samba3, Lighttpd, and some Python apps.
WRT-300N v1.1; 128MB Ram, USB1.1, Bricked

ALL FOR SALE!
eddie97044
DD-WRT User


Joined: 03 Nov 2008
Posts: 83

PostPosted: Sat Dec 06, 2008 15:16    Post subject: Reply with quote
From what I got from Tornado. It's not finding a valid boot block because I don't have dd-wrt binary loaded onto it. However I can't load it via TFTP because when it boots CFE it skips the TFTP loading and goes straight to trying to load from flash. Anybody know how I can tell the router to load a binary image via tftp from the CFE prompt. I tried a few times, but it just keeps timing out.

I tried with a tftp server running on my windows pc with IP address of 192.168.2.10 and router set with IP address of 192.168.2.50 hosting the dd-wrt.v24_micro_generic.bin. At the CFE prompt I typed boot -raw -tftp 192.168.2.10:dd-wrt.v24_micro_generic.bin. It timed out. Server however on the windows PC did acknowledge the get command in the log. However it dropped the connection due to the peer not responding.

I tried tftp -i 192.168.2.50 put dd-wrt.v24_micro_generic.bin on the windows pc right after entering boot command on router in the above paragraph. Timed out.

_________________
Linksys - WRT54GS Ver 7.2 (usb port added)
Belkin - (PLAY) F7D4302 Ver 1
Asus - WL500G Premium Ver 1
Asus - RT-N16
kjbuente
DD-WRT User


Joined: 31 Mar 2007
Posts: 181
Location: /Earth/USA/OH/Zville

PostPosted: Sat Dec 06, 2008 17:45    Post subject: Reply with quote
I don't know squat about tftp, sorry. But I do have a question for you. What did you flash back to the chip? Just the CFE or the WHOLEFLASH? I would think with the WholeFlash being flashed to it instead, it would be able to find the boot block since it is a direct copy of were everything was, going back to it's old location on the new chip.
_________________
WRT-350N v1.0; 128MB RAM, WPC600N, Dual USB, Mini+USB+FTP NEWD, CPU@330Mhz, Terk WF-R x3, Serial, external jtag, and working on SD Mod. Running Samba3, Lighttpd, and some Python apps.
WRT-300N v1.1; 128MB Ram, USB1.1, Bricked

ALL FOR SALE!
eddie97044
DD-WRT User


Joined: 03 Nov 2008
Posts: 83

PostPosted: Sat Dec 06, 2008 21:24    Post subject: Reply with quote
I talked to tornado about this, and we came to the conclusion that I boobooed. does anyone have a wholeflash dump of original vxworks flash for WRT54GS v7.2

Also i am curious to see someone elses nvram settings for this same router. I think mine are incorrect. I used the wrong vxworks_killer when I put dd-wrt on the original chip. It worked, but is causing issues now.

Repeat that I need the following for a WRTS54GS v7.2:

--wholeflash.bin (original stock vxworks)

--nvram settings for sdram (all would be nice)

_________________
Linksys - WRT54GS Ver 7.2 (usb port added)
Belkin - (PLAY) F7D4302 Ver 1
Asus - WL500G Premium Ver 1
Asus - RT-N16
Goto page 1, 2  Next Display posts from previous:    Page 1 of 2
Post new topic   Reply to topic    DD-WRT Forum Index -> Broadcom SoC based Hardware All times are GMT

Navigation

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You can attach files in this forum
You can download files in this forum