OpenWrt Forum Archive

Topic: WNCE2001 Flash Mod

The content of this topic has been archived on 10 Apr 2018. There are no obvious gaps in this topic, but there may still be some posts missing at the end.

I been reading through this thread:
https://forum.openwrt.org/viewtopic.php?id=32512

And was wondering is the same is possible with the WNCE2001. I have been able to flash OpenWrt and get it running but because of the limited flash space it enters kernel panic after I install relayd and its dependencies.

I believe this flash chip should work:
http://www.digikey.com/product-detail/e … ND/2744807

I have a Blackcat USB JTAG and will purchase a SOIC-8 clip if this is feasible. I downloaded the source but could not identify any u-boot files that I could modify. This is where I'm currently stuck. Any input is appreciated.

Source here:
http://www.downloads.netgear.com/files/ … NA-GPL.zip

(Last edited by Spegs21 on 22 Mar 2016, 13:10)

So I bought the new SPI flash chip and copied uboot and factory partitions over to it using a FlashcatUSB. It booted and I used tftp to transfer over the normal 4M image which worked as well.

In effort to build an 8M image I compiled my own after editing a couple files:

https://dev.openwrt.org/browser/branche … CE2001.dts

Line 19:
compatible = "mx25l3205d";
to
compatible = "mx25l6405d";

Line 21:
linux,modalias = "m25p80", "mx25l3205d";
to
linux,modalias = "m25p80", "mx25l6405d";

Line 61:
reg = <0xb0000 0x350000>;
to
reg = <0xb0000 0x750000>;

https://dev.openwrt.org/browser/branche … e/Makefile

Line 667:
$(call BuildFirmware/Default4M/$(1),$(1),$(2),$(3))
to
$(call BuildFirmware/Default8M/$(1),$(1),$(2),$(3))

When it was finished compiling I received a 3.5MB file. Attempting to tftp the binary when the WNCE is in recovery mode gives and error saying the image is too large and tftping the binary through uboot tftp to flash gives a bad magic number error:

Bytes transferred = 3670100 (380054 hex)
NetBootFileXferSize= 00380054
raspi_erase_write: offs:b0000, count:380054
raspi_erase: offs:b0000 len:380000
raspi_write: to:b0000 len:380000
raspi_read: from:430000 len:10000
raspi_erase: offs:430000 len:10000
raspi_write: to:430000 len:10000
Done!
## Booting image at bf0b0000 ...
raspi_read: from:b0000 len:40
Bad Magic Number,1D9CE293

 KSEG1ADDR(NetTxPacket) = 0xA1FE5900

 NetLoop,call eth_halt !

 NetLoop,call eth_init !
Trying Eth0 (10/100-M)

 ETH_STATE_ACTIVE!!

The Router is in TFTP Server Firmware Recovery mode NOW!
Listening on Port : 69, IP Address: 192.168.1.251...
Got ARP REQUEST, return our IP
Got ARP REQUEST, return our IP
Got ARP REQUEST, return our IP
checksum bad
checksum bad
checksum bad
Got ARP REQUEST, return our IP

Rcv:
        Got ARP REPLY, set server/gtwy eth addr (f8:b1:56:d5:75:d8)
Got it
T .................................................................
        .................................................................
        .................................................................
        .................................................................
        .................................................................
        .................................................................
        .................................................................
        .................................................................
        .................................................................
        .................................................................
        .................................................................
        ..T T T T T T T T T
Retry to wait TFTP Client's Data count exceeded; starting again

I did not try to use the sysupgrade image with luci yet but that probably won't work either.

At this point I don't know what else I can do to get it working. Any input is appreciated.

(Last edited by Spegs21 on 7 Apr 2016, 15:47)

Got it working by reverting the changes in the Makefile and re-compiling. Sysupgrade through luci didn't work for the sysupgrade file and tftp through uboot to flash always results in bad magic number. I ended up flashing by way of tftp in recovery mode. Luci reports over 4MB available. Now if I could just get client bridge with relayd working.

(Last edited by Spegs21 on 8 Apr 2016, 15:09)

The discussion might have continued from here.