I have swapped out my NOR chip for a bigger one. What next? Netgear WNDR3700v5

Hardware Questions and Recommendations
1

Apologies to anyone who has already contributed to my previous thread and feels this is a duplicate. In a way, it is, but I thought it better this way so we can focus more squarely on the WNDR3700v5 specifically.

To explain the situation, I have a Netgear WNDR3700v5. This model only comes from the factory with a 16MB NOR chip which is understandably quite small if you want to install a few packages as I do.

Without really having any knowledge about what would happen, I decided to go ahead and swap the 16MB chip for its 32MB counterpart from the same Macronix range. I used a CH134A to copy the data from the 16MB to the 32MB one before I soldered it to the board. I took the precaution of flashing back to the factory Netgear firmware prior to all this, although I don't know whether that was necessary or not. I have previously had Gargoyle 1.14.x (based on OpenWrt 22.03), Gargoyle 1.15.x (based on OpenWRT 24.10), and proper OpenWRT 24.10 running perfectly on it. It was just a bit short on storage for packages.

What I have now is a WNDR3700v5 fitted with a 32MB NOR chip, with Netgear stock firmware on it, and it boots and works fine.

I have not done anything more at this stage as I am scared what the results might be. I really need some help in planning my next move. Do I go ahead and flash a OpenWRT image to it? Will it brick it, or will it work but fail to detect the extra space? Or perhaps it will work AND detect the extra space. I seriously have no idea but just a little scared to try.

I am comfortable using NMRPflash to unbrick, but wondering if that will even still work or not now that the chip capacity no longer matches what the images for this model will expect.

I have installed a serial header on the side of the router so I can get access to serial without having to open it up again. I don't know if that will be of any help, but it came in handy for another use.

I suppose if really necessary I could open it up and put a clip on the chip to reflash it. I would prefer to avoid any more desoldering and re-soldering though as the risk of damaging the PCB pads is higher each time this is repeated.

This may feel like a trip back in time for some people, but this is my first adventure into the world of OpenWRT, and the specs of this router are perfectly adequate for my intended uses. I know very well that it would be easier to buy a different router, but there is no fun and no learning in that. It is a little odd that this once popular model has little written about it in its OpenWRT device page. For example there is no diagram of the flash layout. I have no idea how to go about providing that, but I do have the raw BIN file I ripped from the chip if that can be analysed somehow to shed some light.

All advice welcomed. Thank you

2

For others to reference:

3

This is usually discussed in thread whwre users switch the chips.

A custom built firmware (by you) that you specify the new chip size will be needed. In other words, you cannot use the official firmware files.

No such thing, it's not a disk drive.

4

Thanks for that. I guess I better start learning how to make my own images then. Is there a good starting point for beginners to learn about that? I did find a page which instructed how to set up a build environment, which I followed and now have a Oracle virtual machine running Debian linux, but I can't seem to find where I found that page or what to do next.

5
6

Thank you. Since making a custom image looks quite complicated, would it be advisable to wait until 25.12 has an official stable release rather than having to build again later? Or once you have the template in place is it easy to build again?

7

You will always have to build, doesn't matter if it's master or stable.

2 Likes
8

@frollic has it right. You will always have to build for your device (regularly to maintain security).

With respect to your question, yes. Simply selecting Target, SubTarget, and Target Profile in make menuconfig and running make will get you a standard OpenWrt build from Main for any supported device.

9

Thanks RuralRoots. I'm not sure what all that means, but no doubt I will find out as I progress in my learning.

When (and IF) I succeed in creating a custom build that suits this router, will I be able to use the Attended Upgrade feature in future to update it to newer versions? or will it be a case of having to manually build it each time a new release is out?

This morning I updated my other router from rc1 to rc2 using the Attended Upgrade tab (which I never knew existed before, found it by chance and was impressed with it) and noticed that it did mention on that tab that it can be used to upgrade custom builds.

Another question.
Is it preferred to have packages integrated in the build or to leave the build as light as possible and install packages on top of it afterwards?

10

Still applies 2 posts later:

(Also it's not clear how you would retrieve a build that doesn't officially exist, or rather, only exists where you build it, but that's a moot point.)

Why:

Since you'll be building the firmware, it's your preference. My advice is to include everything you'll use so you don't have to build a firmware just to require downloading packages later. This is especially true if e.g., you need something like VPN or packages to establish connectivity.

11

Hi lleachii. Thanks for the response. Your expert opinion is most appreciated. Sorry if the question about Attended Upgrade sounded dumb, but it was the use of the word "CUSTOM" on the Attended Upgrade page that in my mind suggested the possibility that it might have the ability to actually pull in a custom built firmware from your device, analyse it and recompile it with all the same settings packages and patches and then send it back to the device being upgraded with the new kernel in place and everything else as it was.

Somewhere else somebody advised me that I may come across a problem with 3-byte and 4-byte addressing, since 4-byte addressing is required for accessing the space beyond 16mb. Does anybody have any advice or comment on this, whether it will be a problem on this model, and how it can be worked around?
The way I understand it so far (and do correct me if I am wrong), U-Boot will start up in 3-byte address mode, and that's all it needs as everything it needs to see is in the first 16MiB, then something is needed to switch into 4-byte addressing so that OpenWRT can address the full capacity of the chip. Then something else is needed (possibly a patch?) to switch back into 3-byte addressing mode just before each time a warm restart is performed, otherwise U-Boot won't be able to boot up again if it is left in 4-byte mode. It seems a cold start would be fine, but warm restarts would fail if this is not tackled somehow.

12

ASU and OWUT doesn't compile, they assemble.

1 Like
13

Well I seem to have fallen at the second hurdle. As I mentioned before I have followed the instructions here:
[OpenWrt Wiki] Setting up a build VM in VirtualBox and completed all the steps sucessfully.

Now I am trying to do what it says on this page:
[OpenWrt Wiki] Build system setup

As I am using Debian, it tells me I need to enter this:

sudo apt install build-essential clang flex bison g++ gawk \ gcc-multilib g++-multilib gettext git libncurses5-dev libssl-dev \ python3-setuptools rsync swig unzip zlib1g-dev file wget

Unfortunately it returns me with this:

Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
unzip is already the newest version (6.0-28).
unzip set to manually installed.
file is already the newest version (1:5.44-3).
wget is already the newest version (1.21.3-1+deb12u1).
Some packages could not be installed. This may mean that you have
requested an impossible situation or if you are using the unstable
distribution that some required packages have not yet been created
or been moved out of Incoming.
The following information may help to resolve the situation:

The following packages have unmet dependencies:
libssl-dev : Depends: libssl3 (= 3.0.17-1~deb12u3) but 3.0.18-1~deb12u1 is to be installed
E: Unable to correct problems, you have held broken packages.

Well that's me totally confused and unable to continue any further until I can overcome this. Can anybody advise please?

14

Is an OS issue, not related to Openwrt.

15

Hi frollic. Maybe so, but what does that mean for me? Can I ignore it or do I have to fix it before carrying on? I don't want to ignore something in the early stages that might come back to bite me later down the line and cause me to have to start all over again.

16

You would need to at least take a backup of the ART partition (maybe others too, not sure), modify the dts to change the partition layout to make use of the new space, and look for the ART at the new address (near the end of the new flash chip as opposed near the end of the original 16MB chip), along other things.

I have a wndr3700v5 too and it works fine. I have a bootloader with a webgui which makes it unbrickable.

17

theMan, thanks for responding. This is very inspiring to hear that you have the same router and have succeeded in what I am trying to do
.
I don't have a backup of the ART partition specifically, all I have is a BIN file which is the whole binary contents of the original 16MB chip with stock firmware. I can open it and locate the blocks which contain the MAC address, but I don't know how to separate it into individual partitions.

Can I ask what chip you upgraded to and how you got that bootloader with GUI? I already modified mine to get serial I/O so I can see everything that is going on with the bootloader and firmware. This is how I did it:


A 4-way female DuPont connector with long wire tails is connected to header J1 on the PCB. These are actually the Power and Reset button wires cut from an old PC case and connectors superglued together side-by-side. The long wires ensure the PCB can still be released from the casing to be worked on in future without the need to de-solder the connections from J1.


Small piece of plastic removed from the perimeter lip of the case's base, and connector superglued down to the plastic with the test points facing upwards.


Pin holes look pretty neat from the outside and will be hidden from view when the router is placed on its vertical stand anyway.


A label outlining the functions of the pins, and the order of the pins is affixed below, to avoid any mishaps.


Individual male DuPont pin connectors (or preferably a single quad pin one) can easily be inserted.

This was the last boot log I captured from it with the original chip in it, before changing to the 32MB one. Maybe I should capture another log now that the chip has been swapped out.

===================================================================


   MT7621   stage1 code 13:14:00 (ASIC)

   CPU=50000000 HZ BUS=16666666 HZ


==================================================================

Change MPLL source from XTAL to CR...

do MEMPLL setting..

MEMPLL Config : 0x11100000
3PLL mode + External loopback

=== XTAL-40Mhz === DDR-1200Mhz ===

PLL3 FB_DL: 0xe, 1/0 = 667/357 39000000

PLL4 FB_DL: 0x11, 1/0 = 540/484 45000000

PLL2 FB_DL: 0x14, 1/0 = 723/301 51000000

do DDR setting..\[00320000\]

Apply DDR3 Setting...(use customer AC)


  0    8   16   24   32   40   48   56   64   72   80   88   96  104  112  120


0000:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0

0001:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0

0002:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0

0003:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0

0004:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0

0005:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0

0006:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0

0007:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0

0008:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0

0009:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0

000A:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0

000B:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0

000C:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0

000D:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0

000E:|    0    0    0    0    0    0    0    0    0    0    1    1    1    1    1    1

000F:|    0    0    0    0    0    1    1    1    1    1    1    1    1    1    1    0

0010:|    1    1    1    1    1    1    1    1    1    0    0    0    0    0    0    0

0011:|    1    1    1    1    0    0    0    0    0    0    0    0    0    0    0    0

0012:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0

0013:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0

0014:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0

0015:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0

0016:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0

0017:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0

0018:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0

0019:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0

001A:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0

001B:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0

001C:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0

001D:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0

001E:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0

001F:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0

rank 0 coarse = 15

rank 0 fine = 80

B:|    0    0    0    0    0    0    0    0    1    1    1    0    0    0    0    0

opt_dle value:9

DRAMC_R0DELDLY\[018\]=00001E1F

==================================================================

RX DQS perbit delay software calibration


==================================================================

1.0-15 bit dq delay value

==================================================================

bit|     0  1  2  3  4  5  6  7  8  9

---

0 |    15 9 15 14 15 11 15 9 6 13

10 |    9 15 9 14 8 14

---

==================================================================

2.dqs window

x=pass dqs delay value (min\~max)center

y=0-7bit DQ of every group

input delay:DQS0 =31 DQS1 = 30

==================================================================

bit   DQS0    bit      DQS1

0  (0\~58)29  8  (1\~56)28

1  (0\~56)28  9  (1\~56)28

2  (0\~58)29  10  (1\~57)29

3  (1\~60)30  11  (1\~55)28

4  (0\~61)30  12  (1\~58)29

5  (1\~61)31  13  (1\~56)28

6  (0\~59)29  14  (1\~58)29

7  (1\~62)31  15  (1\~59)30

==================================================================

3.dq delay value last

==================================================================

bit|    0  1  2  3  4  5  6  7  8   9

---

0 |    15 12 15 15 15 11 15 9 8 15

10 |    10 15 10 15 9 14

==================================================================

==================================================================

TX perbyte calibration


==================================================================

DQS loop = 15, cmp_err_1 = ffff2a15

DQS loop = 14, cmp_err_1 = ffff0801

DQS loop = 13, cmp_err_1 = ffff0001

dqs_perbyte_dly.last_dqsdly_pass\[1\]=13,  finish count=1

DQS loop = 12, cmp_err_1 = ffff0000

dqs_perbyte_dly.last_dqsdly_pass\[0\]=12,  finish count=2

DQ loop=15, cmp_err_1 = ffff00aa

dqs_perbyte_dly.last_dqdly_pass\[1\]=15,  finish count=1

DQ loop=14, cmp_err_1 = ffff0082

DQ loop=13, cmp_err_1 = ffff0000

dqs_perbyte_dly.last_dqdly_pass\[0\]=13,  finish count=2

byte:0, (DQS,DQ)=(8,8)

byte:1, (DQS,DQ)=(8,9)

20,data:88

\[EMI\] DRAMC calibration passed

===================================================================


   MT7621   stage1 code done

   CPU=50000000 HZ BUS=16666666 HZ


===================================================================

U-Boot 1.1.3 (Nov 17 2014 - 08:29:53)

Board: Ralink APSoC DRAM:  128 MB
relocate_code Pointer at: 87fb4000

Config XHCI 40M PLL
flash manufacture id: c2, device id 20 18
find flash: MX25L12805D
\*\*\* Warning - bad CRC, using default environment

## ============================================
Ralink UBoot Version: 4.2.1.0

# ASIC MT7621AS (MAC to MT7530 Mode)
DRAM_CONF_FROM: Auto-Detection
DRAM_TYPE: DDR3
DRAM bus: 16 bit
Xtal Mode=3 OCP Ratio=1/3
Flash component: SPI Flash
Date:Nov 17 2014  Time:08:29:53

icache: sets:256, ways:4, linesz:32 ,total:32768
dcache: sets:256, ways:4, linesz:32 ,total:32768

##### The CPU freq = 880 MHZ

estimate memory size =128 Mbytes

Reset switch ...
#Reset_MT7530
set LAN/WAN LLLLW
Example expects ABI version 2
Actual U-Boot ABI version 2

e\[31m\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*
Uboot StandAlone Entry
\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*e\[0m
0, cmd
1, 0x0000000D
cmd : 0x0000000D

Press Ctrl+C to Enter the Main loop...
Example expects ABI version 2
Actual U-Boot ABI version 2

e\[31m\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*
Uboot StandAlone Entry
\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*e\[0m
0, cmd
1, 0x0000000F
cmd : 0x0000000F
Enter NMRP_main
Flash Sector Number : 256.

NetTxPacket = 0x87FE4300

KSEG1ADDR(NetTxPacket) = 0xA7FE4300

NetLoop,call eth_halt !

NetLoop,call eth_init !
Trying Eth0 (10/100-M)

Waitting for RX_DMA_BUSY status Start... done

ETH_STATE_ACTIVE!!
NMRP_FLASH_SIZE_buffer --> a1000000.
NMRP:LISTENING

### No NMRP Server found

Example expects ABI version 2
Actual U-Boot ABI version 2

e\[31m\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*
Uboot StandAlone Entry
\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*e\[0m
0, boot
Flash Sector Number : 256.

---

Sercomm Boot Version 1.13.0


---

Entering Firmware : Everything is OK.

flash base: 0xbfc00000, kernel addr :0xbfc50000, bootloader size: 0x30000, config size 0x10000, fac size : 0x10000
kernel addr :0xbfc50000
18

Sorry, I haven’t modified mine except the bootloader.
My post was just meant as a caution, that it’s not totally straightforward to use a 32MB flash, and that you’d be limited to using your own fork of OpenWrt.
And what I meant by my router is working well, was just to tell it does work quite well as an OpenWrt router, not that I had performed a flash swap myself.

Here’s the dts file for the router that you need to modify, among other things:

My router is in storage in a closet or somewhere, so I’m afraid I won’t be of much help.

19

It should be straightforward using Debian or Ubuntu, and to be honest nobody here wants to give general linux advice that’s a given that you should be able to figure out yourself if you want to build your own firmware. (No offence, that’s just the way it is).
Anyways, try sudo apt-mark unhold libssl3

1 Like
20

Hi theMan,
Sorry I misunderstood you. Yes these routers do seem to work very well with OpenWRT . Your bootloader does indeed sound very interesting. Did you obtain it from somewhere or invent it yourself? I'm not sure what to make of the term "unbrickable". I guess these Netgear routers are one of the easiest to unbrick anyway due to the ease of using NMRPflash. I assume the bootloader lives on the chip, so if you messed that up it could still stop it working. I guess having a full backup of the original binary data from the chip means you are unbrickable anyway as you can always put a clip on the chip and flash the old data back.

I'm trying my best with the Linux issue, but its a really steep learning curve I'm finding. Of course I can go along typing codes and entering without knowing what they mean or what they do, but when something unexpected happens or I get a different message to what a guide or tutorial says then I'm totally lost.
Unfortunately sudo apt-mark unhold libssl3 didn't work, it just returned libssl3 was already not on hold.

Anyway I managed to overcome it using sudo apt-get install libssl3=3.0.17-1~deb12u3 which downgraded libssl3 to the version that libssl-dev needed, then it was happy. Wish me luck going forward. Thanks again.