Thanks to Oleg, my v2 can use all 32Mb of memory from now on. I had to change two nvram values to get it right:

sdram_init=0x0008 (to use 9bit instead of 8 bit)
sdram_ncdl=0x0000 (to make cfe recalculate the value)

Oleg has a nice document about the sdram values at http://wl500g.dyndns.org/sdram.html

Anyway, use it on Your own risk.

also works on wr850g
thanks

Just to warn others - before applying this trick be sure, that you've 32MB of RAM installed and current nvram sdram_init value is 0x0000.

Success stories are welcome. 
Questions also. 

these were my values after a nvram erase:

sdram_init    0x0
sdram_config    0x0032
sdram_refresh     0x0000
sdram_ncdl    0x21

Anyway to do this without opening the unit up?

According to broadcom up to 512 MB is supported, but you will need 8 512Mbit chips for that. 
In fact, other configurations will require more address bits to be wired to the RAM. I do not have wrt54g, so I'm unable to check how many is wired now. 16MB and 32MB use the same number of address lines, that is why it could be enabled this way.

Great - 512MB this will open room for many projects, hacks...
BTW does Broadcom have technical documentations (pin layout) for their chips online? Howmany balls does these chip have?

I haven`t a router yet, but there are many pictures online to see/guess wich pins of the RAM is connected. It`s a pitty, that the BCM47x2 uses balls - that`s realy hard (impossible) to solder - but maybe there are some boards that have enough connected lines to use bigger RAMs.

From my former posting:
http://www.openwrt.org/forum/viewtopic.php?t=316&highlight=
--
Photo from WRT54 shows RAM:
http://kampfzwerg.cdaniel.de/gallery/album23/01030010_G?full=1
etrontech
EM6381 65ts-7
http://www.etron.com/img/pdf/SDRAM/64Mb/4Mx16/638165.pdf
this shows that the RAM SDRAM is for 143 Mhz
--
DQ0-15 input and output data - Pin: 2,4,5,7,8,10,11,13,42,44,45,47,48,50,51,53

But even with such photos it is more guessing then possible to see wich pins are connected. Could anybody with a router could take a look which RAM Pins are connected?

How many would be needed for 64MB?

Instead of more lines, isn`t it possible to adresse more memory with the same adresses (bigger block)?

In the linuxdevices forum I got this hint - an example of RAM upgrade for an game handheld GP32:
http://www.cobbleware.com/gp32/gp32ram.html
The ARM CPU inside has pins to solder new lines.

*UPDATE*
I have googled for the gp32ram.html URL and found only one hit:
http://forum.chupa.nl/showthread.php?t=731
BINGO!!! Not only that Oleg had posted in that thread, it has the same number, 731 than this tread here!  8)

Greetings,
rob

No, have no idea.

Please note, that 4702 uses different memory controller, which is capable at most for 64MB.

This is 4702 unit.

64MB requires one additional address line (A12) and two 256Mbit chips.

No.

For adding additional signal lines it would be "nice" to know which ball of the chip is to use *g*.

Well _if_ there would be a signal line for 64MB but that size would enough to have much more fun *g*.
---

When resonable RAM upgrades (without desolder the CPU) probably will be limited to 32 MB, what about FLAH UPGRADE? I would prefer a box with usb - to add flash memory would be cheaper and more flexible, but there are many boxes out without USB.

Again selfqoute form a former posting:
http://www.openwrt.org/forum/viewtopic.php?t=316&highlight=
---

The same I think would be possibel with the Routers, the memory is expensive, so it is solderd seperated on the board as you can see here:
http://voidmain.is-a-geek.net/si/?i=wrt … 205%20pins

In the middel you can see on violett:
Intel Flash
VER:1.42.2
CS:4280

Another picture http://kampfzwerg.cdaniel.de/gallery/album23/01030010_G?full=1
has on a green field:
VER:1.42.2
CS:9419

AFAIK are these chips a family with same pinlayout, independent on the flash size. It is realy a pitty that there is no public Broadcom BCM47x2 specification (I will email Broadcom to get one), but I can imagine that already the BCM4702 could manage 64 MB flash. (But I have some doubts, too, the Treo 600 phone is based on a Broadcom chip as well and in a forum some people complaint the low flash memory - I hope it is only a question of costs, not of a chip layout!)

Intel seems to have two kind of flash:
"The Intel® Advanced+ (C3) and Advanced (B3) Boot Block Flash memory family is the world's first flash memory on the 0.13 µm process lithography-Intel's fifth generation of its successful boot block memory products. Intel's C3 and B3 products are the industry's most widely used flash memory with a read/write and erase voltage range of 2.7 - 3.6 V for simplified low-voltage system design."
[,,,]
"Security Features (C3 only)
Advanced+ Boot Block Flash memory offers a number of features that provide our customers with an additional level of security including a unique silicon serial number and fraud protection register. It enables next-generation security solutions and is ideally suited for minimizing the risk of cloning and fraud in digital cellular phones and internet appliances.
Intel's C3 memory enables real-time protection for stored data and helps prevent corruption through instant individual block locking. Also, high-speed programming reduces manufacturing time-without the need for costly external voltage switching logic."
http://www.intel.com/design/flcomp/prodbref/298188.htm

B3:
http://www.intel.com/design/flcomp/datashts/29058018.pdf
C3:
http://www.intel.com/design/flcomp/datashts/29064518.pdf

Whats clear is that the chip has a TSOP format - you must have quiet hands (and engough coffee) to solder this
---

-How much Flash Memory could adress the BCM4702 and the BCM4712?
-Is there also a limitation because of missing lines?

Wish you all a merry christmas,
rob

I just tried this on one of my V2's, and it worked like a charm!!!!
thnx Oleg, now I don't need to get me a GS anymore ^^

I know, that with such hacks checking and double checking is a necessity, but - alas - my curiosity and impatience got the best of my WRT54G.. 

I have a v2 Linksys WRT54G and as I was quite sure, that almost all of the newer versions of this device had 32MB of memory as well as the same layout of the board as the WRT54GS, I foolishly tried to get the "extra" memory working, without checking whether the device actually had the memory.

It seems that my model has only 16MB of RAM, as I found out, when I finally had to open the box and tried the flash pin15-16 resurrection trick. Unfortunately it didn't work. The power led still blinks and the device does not respond to ping.

The RAM chips on the board are IC42S16400-6T and the Broadcom chip is BCM4712KPB.

Is there any way of revival for my WRT54G?

Thank you in advance..

You need to get direct access to NVRAM and clear it completely, see:

http://spacetoad.com/tmp/hairydairymaid_debrickv22.zip

Now there's a lack of understanding -

The pin 15-16 trick is used to "corrupt" the firmware, forcing a CRC failure which results in the device waiting for a new firmware -- it doesn't boot the firmware directly, a bootloader kicks in which validates and loads the firmware. Your firmware is fine, besides, it's not even getting to the point that it's trying to load the firmware.

It's in the bootloader trying to initialize the hardware and having a hard time finding those 32M you said it had, probably crashing pretty bad trying. The change was made in nvram and in the overall picture you only have to ways out - do something about nvram, or add more memory. The "sure thing" way of fixing it is as suggested earlier, build a jtag programmer and talk to the flash chip directly, fixing the erroneous values. The cheaper, somewhat riskier way is playing with the flash chip again, this time attempting to corrupt nvram --- if the device boots up and doesn't find the faulty nvram values it will actually boot, actually if it doesn't find nvram atall it will recreate the nvram partition for you, filling it with defaults for your router.

As documented on the wiki (read for more info), for a v1.0 device it's pins 2-3 to force an nvram reset, although the timing is critical. The pinouts being similar, I would suspect the same trick works on the v2, although honestly I've never tried.

Thank you for your help!

Got my precious router back working with the JTAG cable and utility written by hairydairymaid. By the way, before that, I tried the pin2-3 trick, but it didn't help - either it doesn't work on v2 WRT54Gs or I had my router's nvram too badly messed up. Had to build the cable and erase the whole nvram - it booted up after that right away.  :twisted:

It would be nice, if this JTAG method was mentioned somewhere in the OpenWRT FAQ.

I believe the FAQ, is inside the Wiki, which means that YOU can edit those pages to include those "nice" details in the FAQ

Just wanted to say that I have a WRT54G v2.2  and I looked up the part number on the dynamic ram to find out that it was a 16MB ram chip.

-Robert

Hey Pescador/mbm, can you please add some hints about jtag to OpenWRT Wiki? Some information about how you got your router back. That will be really helpful for everybody, I guess.

Thanks,
-Manu

Just to record some further discussion from the #wrt54g channel from kulp who has a WRT54G v2.2:

This would confirm that the latest G version only has a 16Mb Ram chip.

would those nvram settings work on a asus wl-500g deluxe?

No. For the deluxe, please check http://forum.chupa.nl/showthread.php?t=1704 for information, how to enable the memory and upgrade Your bootloader.

Thanks a lot for this tip, I just get i working on a WRT54G v2.2. FR (revision XH)

Here are now the sdram settings :

sdram_config=0x0032
sdram_refresh=0x0000
sdram_ncdl=0x20622
sdram_init=0x0008

But the question is, why put 32MB physical ram, and just use 16 MB of it by default ? I think it is done to reduce production costs and prepare transition between models, but it is still quite strange

(Last edited by RItalMan on 29 May 2005, 05:08)

Also, not all 2.0 XH models have 32 megs of ram:

http://linksysinfo.org/modules.php?name=Forums&file=viewtopic&t=2556&start=20

I posted that last post.  I have a 2.0 XH board with 16 megs of ram.  Didn't even try the procedure.

Some people on the irc channel pointed out that you cannot read that post without logging in... so here's what I said:

A little out of context, but basically, you need to open up your unit and make sure your chips say IC42S16800-7T and not IC42S16400-7T, as mine do.  I only have 16 megs of ram on my 2.0 XH unit, and if I do this procedure, I will brick my router...

Yeah. Great. Bricked my XH unit. Saw this thread to late. Fixed the Wiki HW Table. Thought all XH would have 32MB ...

Strange thing is the following:
Initializing Arena.
Initializing Devices.
et0: Broadcom BCM47xx 10/100 Mbps Ethernet Controller 3.50.21.0
CPU type 0x29007: 200MHz
Total memory: 0x2000000 bytes (32MB)

Taken from the serial console. But Linux only saw 16MB.

HP