Sparklan WX-6615 (externally similar to WX-6615GT ... is same model?)

CPU         Broadcom BCM4702KPB
FLASH     4MB AM29LV320DB
RAM         16MB 2 x DYNACHIPS D98SD6416AH-6
LAN          Broadcom BCM5325A2KQM
WAN     Altima AC101LKQT
WLAN mini-PCI BCM94306MP rev 4 with Broadcom BCM4306KFB chip
PCB        WX5525R_V02
FCCID    MXF-R920220G

The hw is identical to
- TRENDnet TEW-411BRP
- Sitecom WL111

and similar to
- Dell TrueMobile 2300

but also to
- Linksys WRT54G ver 1.0 & 1.1 (that use a different lan controller)
- Linksys WRT54G ver 3.x & 1.1 (that use same lan ctrl, but different cpu)
- Asus WL500G (with some differences)

My story:

After many test with DDWrt (VINT) and OpenWrt (kamikaze) firmware (both  working, for many days), the router not longer works (last change that I made: bridging between LAN and WiFi -> symptom:  isn't possible to ping the router, on any interface).

Now (but, sorry, only now) I know that before I was due to make a erasing of NVRAM.

My work:

First, through JTAG i/f, I made a backup copy of CFE, NVRAM, KERNEL and WHOLEFLASH (note: backup aren't from original Sparklan firmware, but from last working configuration with OpenWRT).

I tried to replace CFE. I used the CFE of many and many different (but similar) devices. The only ones that can be flashing are those of
(1) WRT54G 1.1
(2) WRT54G 3.1
(3) Asus WL500
(4) Dell TM 2300

Others CFE (and also my backup copy) aren't flashable: procedure stop after x% and if I plug OFF/ON the router power supply, procedure again stop after y%.

I used:
- tjtag utility ver 2 (ver 3 also work, HairyDairyMaid not recognize cpu) with /noreset and /nobreak options;
- wiggler and poor i/f (both work).

Symptoms:
- with bad CFE: power LED flash quickly;
- with CFE (2): power LED on; is possible to ping at address 192.168.1.1, but tftp don't works; reply from ping has regular time;
- with CFE (1) and (4): power LED on and an other (not labeled) yellow LED flash quickly; is possible to ping at address 192.168.1.1, but with no regular time (from 1ms to 500 ms); tftp seems working, but after reboot nothing change (a curiosity: is possible to upload many and many files, all with positive reply from router)

Obviously:
used CFE with boot_wait=on
erased NVRAM
used many tftp client (under win and linux)
used 10Mbit switch between PC and router
between “tftp upload” and “router reboot”, I waited (at least) 3 min

My request
Can anyone help me? I'm looking for original Sparklan CFE (but also for original NVRAM, KERNEL and WHOLEFLASH).

A question: upgrade of WRT firmware through web interface also modify CFE bootloader? If not, the backup copy that I made is yet the original (but why isn't possible tu flash them???).

Sorry for my long post.

Thanks.

(Last edited by ottone on 25 May 2010, 20:03)

Please, someone could send me WHOLEFLASH.BIN, CFE.BIN or BSP.BIN of the following models (in order of preference)?

- Linksys WRT54G ver 1.1 (preferred) or 1.0
- Linksys WRT54G ver 3.1 (preferred) or 3.0
- Trendnet TEW 411BRP
- Sitecom WL111
- Dell TrueMobile 2300 ver 1
- Asus WL500G

Many Thanx.

(Last edited by ottone on 1 Jul 2009, 15:33)

I have a CFE.BIN from my WX-6615GT if that might be useful?

Tried, but no success.

Solved!

1) with JTAG, I flashed CFE, using a copy of an WRT54G ver 3.1 and - but not strictly necessary - I flashed NVRAM obtained from original backup
2) with tftp method, uploaded a VINT version of ddwrt (note that VINT version is necessary because the presence of module wifi BMC94306 *rev4*); is also possible to use a openwrt WR release, but is necessary add a 32 byte header to this fw (i guess because CFE refuse fw whitout this header, obtained from Linksys fw... remember? also CFE come from a Linksys router).
3) as described in http://wiki.openwrt.org/oldwiki/openwrt … mobile2300, the only way to communicate with Sparklan after the uploading of ddwrt fw is through WLAN i/f (you see a new ddwrt network in your wireless list); connection is simple: no security and dhcp server on.
4) the reason why LAN (and WAN) i/f don't work are - i guess - two:
a) ddwrt fw use VLAN method to obtain a separated WAN i/f from a unique hardware switch (typical for the WRT54 routers), but Sparklan hw use 2 separated chips for LAN and WAN i/f; therefore, in a telnet/ssh session, use "vconfig rem vlanX" where vlanX is obtained from ifconfig command
b) during boot, the CPU of this board use some i/o to initialize other chip, such LAN chip; also if tftp method work over LAN i/f, after boot, this i/f went not working (all LED permantely on); probably CFE or ddwrt set this chip in an inappropriate way; I solved whit "gpio enable 2" command.

Indeed, LED are not perfectly workings.
The i/o map (referred to the gpio command):
0 reset button
1 ???
2 enable/disable LAN
3 power LED (enable=blink, disable=on)
4 G LED (enable=off, disable=blink)
5 other not labeled LED (enable=off, disable=blink)
6 ??? (with "gpio disable 6", hard reset because handled from ddwrt fw)
7 ???

Can anyone help me to remap the i/o (LED function is not important, but reset button yes). Exist a file with this map, or the map is only included in fw source?
In other words: how firmware hadles i/o?
Thanks!