OpenWrt Forum Archive

Topic: 32Mb ram ENABLED on XH revision v2

The content of this topic has been archived between 8 Mar 2014 and 8 Mar 2014. There are no obvious gaps in this topic, but there may still be some posts missing at the end.

Thanks to Oleg, my v2 can use all 32Mb of memory from now on. I had to change two nvram values to get it right:

sdram_init=0x0008 (to use 9bit instead of 8 bit)
sdram_ncdl=0x0000 (to make cfe recalculate the value)

Oleg has a nice document about the sdram values at http://wl500g.dyndns.org/sdram.html

Anyway, use it on Your own risk.

Thanks to Oleg, my v2 can use all 32Mb of memory from now on. I had to change two nvram values to get it right:

sdram_init=0x0008 (to use 9bit instead of 8 bit)
sdram_ncdl=0x0000 (to make cfe recalculate the value)

Oleg has a nice document about the sdram values at http://wl500g.dyndns.org/sdram.html

Anyway, use it on Your own risk.

also works on wr850g
thanks

Just to warn others - before applying this trick be sure, that you've 32MB of RAM installed and current nvram sdram_init value is 0x0000.

Success stories are welcome.  smile
Questions also.  big_smile

Just to warn others - before applying this trick be sure, that you've 32MB of RAM installed and current nvram sdram_init value is 0x0000.

Success stories are welcome.  smile
Questions also.  big_smile

these were my values after a nvram erase:

sdram_init    0x0
sdram_config    0x0032
sdram_refresh     0x0000
sdram_ncdl    0x21

Just to warn others - before applying this trick be sure, that you've 32MB of RAM installed

Anyway to do this without opening the unit up?

jvnn wrote:

Just to warn others - before applying this trick be sure, that you've 32MB of RAM installed

A real trick would it be to solder two new RAM chips on the board and to use 64,128,256 MB with the Broadcom BCM47x2 based router.

Oleg, do you have information how much memory the BCM47x2 could maximal handle? 2 x 512 MBit or 2 x 1024 MBit?

If yes *g* it would be possible to use cheap RAM-modules to desolder the RAM from there for upgrading the router.

Great work, Oleg - thanks!
Greetings, rob

According to broadcom up to 512 MB is supported, but you will need 8 512Mbit chips for that.  big_smile
In fact, other configurations will require more address bits to be wired to the RAM. I do not have wrt54g, so I'm unable to check how many is wired now. 16MB and 32MB use the same number of address lines, that is why it could be enabled this way.

According to broadcom up to 512 MB is supported, but you will need 8 512Mbit chips for that.  big_smile

Great - 512MB this will open room for many projects, hacks... wink
BTW does Broadcom have technical documentations (pin layout) for their chips online? Howmany balls does these chip have?

I haven`t a router yet, but there are many pictures online to see/guess wich pins of the RAM is connected. It`s a pitty, that the BCM47x2 uses balls - that`s realy hard (impossible) to solder - but maybe there are some boards that have enough connected lines to use bigger RAMs.

From my former posting:
http://www.openwrt.org/forum/viewtopic.php?t=316&highlight=
--
Photo from WRT54 shows RAM:
http://kampfzwerg.cdaniel.de/gallery/album23/01030010_G?full=1
etrontech
EM6381 65ts-7
http://www.etron.com/img/pdf/SDRAM/64Mb/4Mx16/638165.pdf
this shows that the RAM SDRAM is for 143 Mhz
--
DQ0-15 input and output data - Pin: 2,4,5,7,8,10,11,13,42,44,45,47,48,50,51,53

But even with such photos it is more guessing then possible to see wich pins are connected. sad Could anybody with a router could take a look which RAM Pins are connected?

How many would be needed for 64MB?

Instead of more lines, isn`t it possible to adresse more memory with the same adresses (bigger block)?

In the linuxdevices forum I got this hint - an example of RAM upgrade for an game handheld GP32:
http://www.cobbleware.com/gp32/gp32ram.html
The ARM CPU inside has pins to solder new lines.

*UPDATE*
I have googled for the gp32ram.html URL and found only one hit:
http://forum.chupa.nl/showthread.php?t=731
BINGO!!! Not only that Oleg had posted in that thread, it has the same number, 731 than this tread here!  8)

Greetings,
rob

BTW does Broadcom have technical documentations (pin layout) for their chips online? Howmany balls does these chip have?

No, have no idea.

I haven`t a router yet, but there are many pictures online to see/guess wich pins of the RAM is connected. It`s a pitty, that the BCM47x2 uses balls - that`s realy hard (impossible) to solder - but maybe there are some boards that have enough connected lines to use bigger RAMs.

Please note, that 4702 uses different memory controller, which is capable at most for 64MB.

This is 4702 unit.

How many would be needed for 64MB?

64MB requires one additional address line (A12) and two 256Mbit chips.

Instead of more lines, isn`t it possible to adresse more memory with the same adresses (bigger block)?

No.

BTW does Broadcom have technical documentations (pin layout) for their chips online? Howmany balls does these chip have?

No, have no idea.

For adding additional signal lines it would be "nice" to know which ball of the chip is to use *g*.

Please note, that 4702 uses different memory controller, which is capable at most for 64MB.

Well _if_ there would be a signal line for 64MB but that size would enough to have much more fun *g*.
---

When resonable RAM upgrades (without desolder the CPU) probably will be limited to 32 MB, what about FLAH UPGRADE? I would prefer a box with usb - to add flash memory would be cheaper and more flexible, but there are many boxes out without USB.

Again selfqoute form a former posting:
http://www.openwrt.org/forum/viewtopic.php?t=316&highlight=
---

The same I think would be possibel with the Routers, the memory is expensive, so it is solderd seperated on the board as you can see here:
http://voidmain.is-a-geek.net/si/?i=wrt … 205%20pins

In the middel you can see on violett:
Intel Flash
VER:1.42.2
CS:4280

Another picture http://kampfzwerg.cdaniel.de/gallery/album23/01030010_G?full=1
has on a green field:
VER:1.42.2
CS:9419

AFAIK are these chips a family with same pinlayout, independent on the flash size. It is realy a pitty that there is no public Broadcom BCM47x2 specification (I will email Broadcom to get one), but I can imagine that already the BCM4702 could manage 64 MB flash. (But I have some doubts, too, the Treo 600 phone is based on a Broadcom chip as well and in a forum some people complaint the low flash memory - I hope it is only a question of costs, not of a chip layout!)

Intel seems to have two kind of flash:
"The Intel® Advanced+ (C3) and Advanced (B3) Boot Block Flash memory family is the world's first flash memory on the 0.13 µm process lithography-Intel's fifth generation of its successful boot block memory products. Intel's C3 and B3 products are the industry's most widely used flash memory with a read/write and erase voltage range of 2.7 - 3.6 V for simplified low-voltage system design."
[,,,]
"Security Features (C3 only)
Advanced+ Boot Block Flash memory offers a number of features that provide our customers with an additional level of security including a unique silicon serial number and fraud protection register. It enables next-generation security solutions and is ideally suited for minimizing the risk of cloning and fraud in digital cellular phones and internet appliances.
Intel's C3 memory enables real-time protection for stored data and helps prevent corruption through instant individual block locking. Also, high-speed programming reduces manufacturing time-without the need for costly external voltage switching logic."
http://www.intel.com/design/flcomp/prodbref/298188.htm

B3:
http://www.intel.com/design/flcomp/datashts/29058018.pdf
C3:
http://www.intel.com/design/flcomp/datashts/29064518.pdf

Whats clear is that the chip has a TSOP format - you must have quiet hands (and engough coffee) to solder this wink
---

-How much Flash Memory could adress the BCM4702 and the BCM4712?
-Is there also a limitation because of missing lines?

Wish you all a merry christmas,
rob

I just tried this on one of my V2's, and it worked like a charm!!!!
thnx Oleg, now I don't need to get me a GS anymore ^^

I know, that with such hacks checking and double checking is a necessity, but - alas - my curiosity and impatience got the best of my WRT54G..  sad

I have a v2 Linksys WRT54G and as I was quite sure, that almost all of the newer versions of this device had 32MB of memory as well as the same layout of the board as the WRT54GS, I foolishly tried to get the "extra" memory working, without checking whether the device actually had the memory.

It seems that my model has only 16MB of RAM, as I found out, when I finally had to open the box and tried the flash pin15-16 resurrection trick. Unfortunately it didn't work. The power led still blinks and the device does not respond to ping.

The RAM chips on the board are IC42S16400-6T and the Broadcom chip is BCM4712KPB.

Is there any way of revival for my WRT54G?

Thank you in advance..

It seems that my model has only 16MB of RAM, as I found out, when I finally had to open the box and tried the flash pin15-16 resurrection trick. Unfortunately it didn't work. The power led still blinks and the device does not respond to ping.

Now there's a lack of understanding -

The pin 15-16 trick is used to "corrupt" the firmware, forcing a CRC failure which results in the device waiting for a new firmware -- it doesn't boot the firmware directly, a bootloader kicks in which validates and loads the firmware. Your firmware is fine, besides, it's not even getting to the point that it's trying to load the firmware.

It's in the bootloader trying to initialize the hardware and having a hard time finding those 32M you said it had, probably crashing pretty bad trying. The change was made in nvram and in the overall picture you only have to ways out - do something about nvram, or add more memory. The "sure thing" way of fixing it is as suggested earlier, build a jtag programmer and talk to the flash chip directly, fixing the erroneous values. The cheaper, somewhat riskier way is playing with the flash chip again, this time attempting to corrupt nvram --- if the device boots up and doesn't find the faulty nvram values it will actually boot, actually if it doesn't find nvram atall it will recreate the nvram partition for you, filling it with defaults for your router.

As documented on the wiki (read for more info), for a v1.0 device it's pins 2-3 to force an nvram reset, although the timing is critical. The pinouts being similar, I would suspect the same trick works on the v2, although honestly I've never tried.

Thank you for your help!

Got my precious router back working with the JTAG cable and utility written by hairydairymaid. By the way, before that, I tried the pin2-3 trick, but it didn't help - either it doesn't work on v2 WRT54Gs or I had my router's nvram too badly messed up. Had to build the cable and erase the whole nvram - it booted up after that right away.  :twisted:

It would be nice, if this JTAG method was mentioned somewhere in the OpenWRT FAQ.

I believe the FAQ, is inside the Wiki, which means that YOU can edit those pages to include those "nice" details in the FAQ wink

Just wanted to say that I have a WRT54G v2.2  and I looked up the part number on the dynamic ram to find out that it was a 16MB ram chip.

-Robert

Hey Pescador/mbm, can you please add some hints about jtag to OpenWRT Wiki? Some information about how you got your router back. That will be really helpful for everybody, I guess.

Thanks,
-Manu

Just to record some further discussion from the #wrt54g channel from kulp who has a WRT54G v2.2:

[20:05] <kulp> unfortunately the hynix hy5du281622et-j i have is a 128Mib chip, so only 16MiB for me

This would confirm that the latest G version only has a 16Mb Ram chip.

would those nvram settings work on a asus wl-500g deluxe?

would those nvram settings work on a asus wl-500g deluxe?

No. For the deluxe, please check http://forum.chupa.nl/showthread.php?t=1704 for information, how to enable the memory and upgrade Your bootloader.

Thanks a lot for this tip, I just get i working on a WRT54G v2.2. FR (revision XH)

Here are now the sdram settings :

sdram_config=0x0032
sdram_refresh=0x0000
sdram_ncdl=0x20622
sdram_init=0x0008

But the question is, why put 32MB physical ram, and just use 16 MB of it by default ? I think it is done to reduce production costs and prepare transition between models, but it is still quite strange smile

(Last edited by RItalMan on 29 May 2005, 05:08)

Some people on the irc channel pointed out that you cannot read that post without logging in... so here's what I said:

Yup, folks should listen to you. I have a version 2.0 of the WRT54G. I opened up the case, and I had a 2.0 XH version!

BUT ... looking at the chips mine said 400, not 800. So I definitely have only 16 megs of ram and not 32.

I didn't even attempt to do the procedure. I just wanted to share with everyone that only certain 2.0 XH's have the larger chips, mine does not, and Toxic is absolutely right... if you risk doing the upgrade, you better be 100% completely and totally sure you can. If you ruin your router, you have noone to blame but yourself.

I got a little excited and anxious when I saw the 2.0 XH on the board, but when I noticed my chips were only 400's ... kinda let down. But it beats the heck outta bricking my router.

A little out of context, but basically, you need to open up your unit and make sure your chips say IC42S16800-7T and not IC42S16400-7T, as mine do.  I only have 16 megs of ram on my 2.0 XH unit, and if I do this procedure, I will brick my router...

Yeah. Great. Bricked my XH unit. Saw this thread to late. Fixed the Wiki HW Table. Thought all XH would have 32MB ...

Strange thing is the following:
Initializing Arena.
Initializing Devices.
et0: Broadcom BCM47xx 10/100 Mbps Ethernet Controller 3.50.21.0
CPU type 0x29007: 200MHz
Total memory: 0x2000000 bytes (32MB)

Taken from the serial console. But Linux only saw 16MB.

HP