Hi there...

after successfully doing the Ram-upgrades on the se505v1 I'm  now working on one of my other projects...

I have two bricked Ravo W54-RT lying here. The board is the RT210W, which is also used in the Belkin f5d7230 v1000, the Siemens se505V1, ...

now Eko from the dd-wrt-forum found the JTAG-pinout of these boards, giving the abillity to revive these routers!
see:
http://www.dd-wrt.com/phpBB2/viewtopic.php?t=5080

mine connects fine too, but the W54-RT have another yet unsupported flash-chip.
they are equipped with the Fujitsu 29DL323BE-90PFTN. I have downloaded the Datasheet from alldatasheet.com and put it on webspace:

http://iapp.de/~kasemann/MBM29DL323BE.pdf

Now the question:
how much work is it to integrate support for this flash-chip to the debrick-utility?
how can i connect HairyDairyMaid aka Lightbulb? (Haven't found any email)
could one the the developpers perhaps forward this request to Lightbulb?

Thanks in advance...

axc27

(Last edited by axc27 on 11 Jun 2007, 18:06)

realy noone knows how to connect HairyDairyMaid?

I can't believe that...

axc27

You could try with adding this line to the end of flash_chip_list array in wrt54g.c :

   { 0x0004, 0x????, size2MB, CMD_TYPE_AMD, "MBM29LV160B 4Mx16 BotB     (8MB)"   , 8, size8K,   15,size64K,     48,size64K,  0,0 },

The second element in the array (0x????) must be replaced with what is read by wrt54g program from the device. Initially set is to 0x0000. When found out then replace with the actual value.

Count the number of active lines in the array (starting from 0 for the first active line). That is the position inside the array for the memory. Use this position in the command line. Lets assume the position is 56 then you should use /fc:56 in the command line.

Play first reading data several times and comparing the results before erasing or flashing anything. Remember it is always a good idea to make a full memory backup before erasing or writing anything.

The above information was taken from datasheet page 4.

Thanks for the answer!

ok, did as recommended...
added chip (i think it should be 'size4MB') and compiled,...

i can probe and read (backup). erasing doesn't work...

but i don't know wich value to enter in the second place...

./wrt54g -probeonly /nocwd /nobreak /noreset /fc:61

====================================
WRT54G/GS EJTAG Debrick Utility v4.8
====================================

Probing bus ... Done

Instruction Length set to 5

CPU Chip ID: 00000100011100010000000101111111 (0471017F)
*** Found a Broadcom BCM4702 Rev 1 CPU chip ***

    - EJTAG IMPCODE ....... : 00000000100000000000100100001000 (00800908)
    - EJTAG Version ....... : 1 or 2.0
    - EJTAG DMA Support ... : Yes

Issuing Processor / Peripheral Reset ... Skipped
Enabling Memory Writes ... Done
Halting Processor ... Skipped
Clearing Watchdog ... Skipped

Manual Flash Selection ... Done

Flash Vendor ID: 00000000000000000000000000000100 (00000004)
Flash Device ID: 00000000000000000000000000000000 (00000000)
*** Manually Selected a Fuji 29DL323BE 4Mx16 BotB  (4MB) Flash Chip ***

    - Flash Chip Window Start .... : 1fc00000
    - Flash Chip Window Length ... : 00400000
    - Selected Area Start ........ : 00000000
    - Selected Area Length ....... : 00000000



 *** REQUESTED OPERATION IS COMPLETE ***

./wrt54g -probeonly /nocwd /nobreak /noreset

====================================
WRT54G/GS EJTAG Debrick Utility v4.8
====================================

Probing bus ... Done

Instruction Length set to 5

CPU Chip ID: 00000100011100010000000101111111 (0471017F)
*** Found a Broadcom BCM4702 Rev 1 CPU chip ***

    - EJTAG IMPCODE ....... : 00000000100000000000100100001000 (00800908)
    - EJTAG Version ....... : 1 or 2.0
    - EJTAG DMA Support ... : Yes

Issuing Processor / Peripheral Reset ... Skipped
Enabling Memory Writes ... Done
Halting Processor ... Skipped
Clearing Watchdog ... Skipped

Probing Flash at (Flash Window: 0x1fc00000) ... Done

*** Unknown or NO Flash Chip Detected ***

 *** REQUESTED OPERATION IS COMPLETE ***

./wrt54g -backup:nvram /nocwd /nobreak /noreset /fc:61

====================================
WRT54G/GS EJTAG Debrick Utility v4.8
====================================

Probing bus ... Done

Instruction Length set to 5

CPU Chip ID: 00000100011100010000000101111111 (0471017F)
*** Found a Broadcom BCM4702 Rev 1 CPU chip ***

    - EJTAG IMPCODE ....... : 00000000100000000000100100001000 (00800908)
    - EJTAG Version ....... : 1 or 2.0
    - EJTAG DMA Support ... : Yes

Issuing Processor / Peripheral Reset ... Skipped
Enabling Memory Writes ... Done
Halting Processor ... Skipped
Clearing Watchdog ... Skipped

Manual Flash Selection ... Done

Flash Vendor ID: 00000000000000000000000000000100 (00000004)
Flash Device ID: 00000000000000000000000000000000 (00000000)
*** Manually Selected a Fuji 29DL323BE 4Mx16 BotB  (4MB) Flash Chip ***

    - Flash Chip Window Start .... : 1fc00000
    - Flash Chip Window Length ... : 00400000
    - Selected Area Start ........ : 1fff0000
    - Selected Area Length ....... : 00010000

*** You Selected to Backup the NVRAM.BIN ***

=========================
Backup Routine Started
=========================

Saving NVRAM.BIN.SAVED_20070613_200218 to Disk...
[  0% Backed Up]   1fff0000: 000c0048 000c0048 000c0048 000c0048
[  0% Backed Up]   1fff0010: 000c0048 000c0048 000c0048 000c0048
[  0% Backed Up]   1fff0020: 000c0048 000c0048 000c0048 000c0048
--- snip ---

Done  (NVRAM.BIN.SAVED_20070613_195644 saved to Disk OK)

bytes written: 65536
=========================
Backup Routine Complete
=========================
elapsed time: 24 seconds


 *** REQUESTED OPERATION IS COMPLETE ***

./wrt54g -erase:nvram /nocwd /nobreak /noreset /fc:61

====================================
WRT54G/GS EJTAG Debrick Utility v4.8
====================================

Probing bus ... Done

Instruction Length set to 5

CPU Chip ID: 00000100011100010000000101111111 (0471017F)
*** Found a Broadcom BCM4702 Rev 1 CPU chip ***

    - EJTAG IMPCODE ....... : 00000000100000000000100100001000 (00800908)
    - EJTAG Version ....... : 1 or 2.0
    - EJTAG DMA Support ... : Yes

Issuing Processor / Peripheral Reset ... Skipped
Enabling Memory Writes ... Done
Halting Processor ... Skipped
Clearing Watchdog ... Skipped

Manual Flash Selection ... Done

Flash Vendor ID: 00000000000000000000000000000100 (00000004)
Flash Device ID: 00000000000000000000000000000000 (00000000)
*** Manually Selected a Fuji 29DL323BE 4Mx16 BotB  (4MB) Flash Chip ***

    - Flash Chip Window Start .... : 1fc00000
    - Flash Chip Window Length ... : 00400000
    - Selected Area Start ........ : 1fff0000
    - Selected Area Length ....... : 00010000

*** You Selected to Erase the NVRAM.BIN ***

=========================
Erasing Routine Started
=========================
Total Blocks to Erase: 1

Erasing block: 71 (addr = 1fff0000)...

axc27

ok, found out more... had only half an hour yesterday evening...

by comparoing to the already integrated MBM29LV320BE and its datasheet i found t6he value to enter at the 0x????

now my flash is already autodetected...

ok, same symtoms on both routers...

line is
   { 0x0004, 0x2253, size4MB, CMD_TYPE_AMD, "MBM29DL323BE 2Mx16 BotB    (4MB)"   ,8,size8K,      15,size64K,   48,size64K, 0,0        },

can read and write flash. but there seem to be some problems in the region of the nvram... perhaps bot are defective there? would be a really strange coincidence...

./wrt54g -erase:wholeflash /nocwd /noemw /fc:61

rasing block: 62 (addr = 1ff60000)...Done
Erasing block: 63 (addr = 1ff70000)...Done
Erasing block: 64 (addr = 1ff80000)...Done
Erasing block: 65 (addr = 1ff90000)...Done
Erasing block: 66 (addr = 1ffa0000)...Done
Erasing block: 67 (addr = 1ffb0000)...Done
Erasing block: 68 (addr = 1ffc0000)...Done
Erasing block: 69 (addr = 1ffd0000)...Done
Erasing block: 70 (addr = 1ffe0000)...Done
Erasing block: 71 (addr = 1fff0000)...

then it hangs there... cannot erase block 71 (71 is the last block it wants to erase...), which is also the block to erase when rewriting the nvram...

writing cfe is fine

./wrt54g -flash:nvram /nocwd /noemw /fc:61 /noerase

55% Flashed]   1fff8d40: ffffffff ffffffff ffffffff ffffffff
[ 55% Flashed]   1fff8d50: ffffffff ffffffff ffffffff ffffffff
[ 55% Flashed]   1fff8d60: ffffffff ffffffff ffffffff ffffffff
[ 55% Flashed]   1fff8d70: ffffffff ffffffff ffffffff ffffffff
[ 55% Flashed]   1fff8d80: ffffffff ffffffff ffffffff ffffffff
[ 55% Flashed]   1fff8d90: ffffffff ffffffff ffffffff ffffffff
[ 55% Flashed]   1fff8da0: ffffffff ffffffff ffffffff ffffffff
[ 55% Flashed]   1fff8db0: ffffffff ffffffff ffffffff ffffffff
[ 55% Flashed]   1fff8dc0: ffffffff ffffffff ffffffff ffffffff
[ 55% Flashed]   1fff8dd0: ffffffff ffffffff ffffffff ffffffff

writing nvram with /noerase switch stops at 55 to 56% on both routers... but the area with data in the nvram comes between 1fff800 and  1fff8890 of the nvram... so broken flash because of too much writes doesn't sound right...

any ideas?

axc27

(Last edited by axc27 on 14 Jun 2007, 10:07)

Try with this:

   { 0x0004, 0x2253, size4MB, CMD_TYPE_AMD, "MBM29DL323BE 2Mx16 BotB    (4MB)"   ,8,size8K,     63,size64K,   0,0,        0,0        },
   { 0x0004, 0x2250, size4MB, CMD_TYPE_AMD, "MBM29DL323TE 2Mx16 TopB    (4MB)"   ,63,size64K,   8,size8K,     0,0,        0,0        },

I had big problems writing cfe, always hanged at same %. Only hairydairy v2.2 rescued my router. But it's damn slow, 50 min for cfe.

BTW, why do you want to write nvram?

(Last edited by Eko on 14 Jun 2007, 16:03)

i recieved botzh routers in an unknown status, and didn't know what the last owner did to them. but they both showed the sam symptoms. they hung in an edless reboot loop. they were rebooting before giving the abillity to flash anything. i tried everything i could imagine with the first one. including packet sniffing (nothing came from the router), pinging every default ip i could find on the net, tried out every possibillity of powering up while presseing reset, even shorted pins (yes, this is evil... buit i didn't know further and the device didn't have a (known) JTAG ;-). in the end i even soldered out the flash, soldered it in an se505v2 with jtag and wanted to flash it there... but then saw that the flash wasn't supported... who could know that addind more flash chips to the jtag tool is so simple?..

so my intention was to first erase nvram and see what it changes. then write a working nvram (i have lying here) and see if the router boots up again, and if this doesn't helt flash fresh cfe and nvram.

concerning the values you have written up here: i think they will not work. even though these are the values written in the features list, from the table on page 4 i would conclude that these are the values for the MBM29DL321BE and MBM29DL321TE... the MBM29DL323 has different arrangement.

trying an old debrick version is a good idea...

the next steps i had in mind were:
- try out a wiggler cable i have lying here (build some time ago...)
- add additional resistors in the signal lines. the simple unbuffert JTAG-cable was considered for the WRT-routers. these have additional resistors in the lines between the JTAG-connector and the cpu soldered on board. the pins you have found on the RT210W seem to be directly wired to the CPU. so adding additional resistors could fit the signal levels a bit...

let's see, perhaps i find some time tomorrow...

axc27

(Last edited by axc27 on 15 Jun 2007, 08:38)

The problem with these routers is that et0macaddr is not auto restored from cfe to nvram, hence no boot wait pings.
I fixed this in dd-wrt to write wt0macaddr to nvram if not there.

So, I suggest this: Erase nvram, then flash latest dd-wrt-micro-generic.bin as kernel. Will take some time. Then boot it, wait 3 min, unplug, boot again. Then it should be at 192.168.1.1. Tested working.

The additional resistors are only pull up to 3.3V, on RT210W board are also there (4 in block).

(Last edited by Eko on 15 Jun 2007, 08:48)

ok, still stuck...

tryed a wiggler cable according to
http://wiki.openwrt.org/OpenWrtDocs/Cus … JTAG_Cable

with no luck. debrick 4.8 with switch /wiggler doesn't detect the router...

debrick v4.5 patched with the patch shown on the site listed above does work, it recognizes the router and can read and erase (erase anything but block71...). but i cannot write, when trying to write it stopps after only two parts of the first block...

currently i'm flashing the kernel with 4.8 and an unbuffered cable... haven't taught v2.2 my flash-chip yet...

also played arround with other chip-def-lines...
   { 0x0004, 0x2253, size4MB, CMD_TYPE_AMD, "MBM29DL323BE 2Mx16 BotB    (4MB)"   ,8,size8K,     63,size64K,   0,0,        0,0        },
gives the same result as the one i've noted above, can erase anything but block 71.

   { 0x0004, 0x2253, size4MB, CMD_TYPE_AMD, "MBM29DL323BE 2Mx16 BotB    (4MB)"   ,16,size8K,    62,size64K,   0,0,   0,0        },
also hangs on the last block, this time block 78... (?)

   { 0x0004, 0x2253, size4MB, CMD_TYPE_AMD, "MBM29DL323BE 2Mx16 BotB    (4MB)"    ,64,size64K,   0,0,          0,0,        0,0        },
also hangs on the last block (64)

with   
{ 0x0004, 0x2250, size4MB, CMD_TYPE_AMD, "MBM29DL323TE 2Mx16 TopB    (4MB)"   ,63,size64K,   8,size8K,     0,0,        0,0        },
erasing already hangs on block 64, so the 8the last block...

   { 0x0004, 0x2253, size4MB, CMD_TYPE_AMD, "MBM29DL323BE 2Mx16 BotB    (4MB)"    ,63,size64K,   1,size32K,    2,size8K,   1,size16K },
hangs on block 64,

   { 0x0004, 0x2253, size4MB, CMD_TYPE_AMD, "MBM29DL323BE 2Mx16 BotB    (4MB)"    ,1,size16K,    2,size8K,     1,size32K,  63,size64K },
hangs on block67

so it seems to be a problem to write the last 64K of the flash, undependent how i want to devide them into blocks...

axc27

--------- edit:
ok, debrick v2.2 also hangs...

Erasing block: 1006 / 1024 (addr = 1ffed000)...Unlocked...Done.
Erasing block: 1007 / 1024 (addr = 1ffee000)...Unlocked...Done.
Erasing block: 1008 / 1024 (addr = 1ffef000)...Unlocked...Done.

and nothing more...

(Last edited by axc27 on 17 Jun 2007, 18:43)

ok, flashed everything (cfe, nvram and kernel) with debrick v2.2... but it still doesn't boot...

if i backup again, a section wich should contain only ffffffff looks like stis:

[ 99% Backed Up]   1ffffe60: ffffffff ffffffff ffffffff ffffffff
[ 99% Backed Up]   1ffffe70: 0fffffff ffffffff ffffffff ffffffff
[ 99% Backed Up]   1ffffe80: ffffffff ffffffff ffffffff ffffffff
[ 99% Backed Up]   1ffffe90: ffffffff ffffffff ffffffff ffffffff
[ 99% Backed Up]   1ffffea0: ffffffff ffffffff ffffffff 0fffffff
[ 99% Backed Up]   1ffffeb0: ffffffff 0fffffff ffffffff ffffffff
[ 99% Backed Up]   1ffffec0: ffffffff ffffffff ffff00ff ffffffff
[ 99% Backed Up]   1ffffed0: ffffffff ffffffff 0fffffff ffffffff
[ 99% Backed Up]   1ffffee0: ffff00ff ffffffff ffffffff ffffffff
[ 99% Backed Up]   1ffffef0: ffff00ff ffffffff ffffffff ffffffff
[ 99% Backed Up]   1fffff00: ffffffff ffffffff ffff00ff ffffffff
[ 99% Backed Up]   1fffff10: ffffffff ffffffff ffffffff ffffffff
[ 99% Backed Up]   1fffff20: ffffffff ffffffff ffffffff ffffffff
[ 99% Backed Up]   1fffff30: ffffffff ffffffff ffff00ff ffffffff
[ 99% Backed Up]   1fffff40: ffffffff ffffffff ffffffff ffffffff
[ 99% Backed Up]   1fffff50: ffffffff ffffffff ffffffff ffffffff
[ 99% Backed Up]   1fffff60: ffffffff ffffffff ffffffff ffff00ff
[ 99% Backed Up]   1fffff70: ffffffff 0fffffff ffffffff ffffffff
[ 99% Backed Up]   1fffff80: ffffffff 0fffffff ffffffff ffff00ff
[ 99% Backed Up]   1fffff90: ffffffff ffffffff ffffffff ffffffff
[ 99% Backed Up]   1fffffa0: ffffffff 0fffffff ffffffff ffffffff
[ 99% Backed Up]   1fffffb0: ffffffff 0fffffff ffffffff ffff00ff
[ 99% Backed Up]   1fffffc0: ffffffff ffffffff ffffffff ffffffff
[ 99% Backed Up]   1fffffd0: ffffffff ffffffff ffffffff ffffffff
[ 99% Backed Up]   1fffffe0: ffff00ff ffffffff 0fffffff ffffffff
[ 99% Backed Up]   1ffffff0: ffff00ff ffffffff ffffffff ffffffff

but also two subsequrnt backuos differ, so reading isn't fine either...

a possibillity could be to integrate checks in the flash pocess: write sector, read sector, and if they differ write once again...

[edit]
ok, debrick v2.2 already seems to do those checks:
after writing it reads the sector until they match...

        do {
            res = ejtag_dma_read_h(addr);
        } while((res & 0x80) != (data & 0x80));

[/edit]

but my cable is good, i flashed my se505v2 dozens of times...
perhaps i'll have to go to the brute-force method again: unsolder the flash, solder it in an se505, flash everythin there and solder it back...

axc27

(Last edited by axc27 on 19 Jun 2007, 07:26)