OpenWrt Forum Archive

Topic: WL500GD - Upgrade RAM to 128MB

The content of this topic has been archived on 24 Mar 2018. There are no obvious gaps in this topic, but there may still be some posts missing at the end.

The thread on wl500g.info forum proves that we can have 64MB RAM on WL500GD. Considering the same risk of breaking my WLAN router, I upgraded mine to 128MB. I replaced the two SDRAM chips with two MT48LC32M16A2P-75 chips. I thought I would just need to set the followings on the NVRAM:

sdram_ncdl=0 (to have it recalculated)
sdram_init=0x2010 (to have 10 bits column addressing)

But here is what I got

syslog.info syslogd started: BusyBox v1.00 (2006.03.27-00:00+0000)
kern.notice kernel: klogd started: BusyBox v1.00 (2006.03.27-00:00+0000)
kern.warn kernel: CPU revision is: 00029007
kern.warn kernel: Primary instruction cache 8kB, physically tagged, 2-way, linesize 16 bytes.
kern.warn kernel: Primary data cache 4kB, 2-way, linesize 16 bytes.
kern.warn kernel: Linux version 2.4.30 (nbd@ux-2y02) (gcc version 3.4.4 (OpenWrt-1.0)) #1 Sun Mar 26 19:02:04 CEST 2006
kern.warn kernel: Setting the PFC value as 0x15
kern.warn kernel: Determined physical RAM map:
kern.warn kernel:  memory: 04000000 @ 00000000 (usable)
kern.warn kernel: On node 0 totalpages: 16384
kern.warn kernel: zone(0): 16384 pages.
kern.warn kernel: zone(1): 0 pages.
kern.warn kernel: zone(2): 0 pages.
kern.warn kernel: Kernel command line: root=/dev/mtdblock2 rootfstype=squashfs,jffs2 init=/etc/preinit noinitrd console=ttyS0,115200
kern.warn kernel: CPU: BCM5365 rev 1 at 200 MHz
kern.warn kernel: Using 100.000 MHz high precision timer.
kern.warn kernel: Calibrating delay loop... 199.47 BogoMIPS
kern.info kernel: Memory: 62892k/65536k available (1412k kernel code, 2644k reserved, 100k data, 80k init, 0k highmem)
kern.info kernel: Dentry cache hash table entries: 8192 (order: 4, 65536 bytes)
kern.info kernel: Inode cache hash table entries: 4096 (order: 3, 32768 bytes)
kern.info kernel: Mount cache hash table entries: 512 (order: 0, 4096 bytes)
kern.info kernel: Buffer cache hash table entries: 4096 (order: 2, 16384 bytes)

Yes. I just get 64MB! And the sdram_init always reverts back to 0x2008. So it is not that simple. I have to add some entries on for instance sbsdram.h, but to which values? And what other files related to this have to be changed?

I don’t have problem in compiling Openwrt, but I don’t know anything about the codes. Could anyone shed some light on this? Thanks in advance.

Do you have a serial console attached? It would be interesting to see what CFE says during boot.

Oh, you do a nvram commit before reboot?

(Last edited by CountZero on 26 Jan 2007, 01:00)

Hmmmm, I was hoping somebody managed to upgrade his WL-500gx to 128MB :-/
Isn't the CFE detecting how much RAM the router has?
Did you try a serial console, to see what the CFE says?
And: where did you buy those chips and how much are those (or the MT48LC16M16A2P-75 for an upgrade to 64MB)?
Any chance to get those in Vienna?
Paying 100$/€++ just for a test seems quite much to me.
A WL-700gE is <240€, has a real IDE hard disk built in with a faster and better Processor/architecture, and OpenWrt support for it has just startet :-)

@CountZero
No, I don't have serial console (yet). I thought it is not necessary to have at this stage. What do you expect from the CFE during reboot? Will it lead us to the codes that need to be changed? If so, I will build that as soon as possible!

And yes, I did "nvram commit".

@MMCM
Believe me. The chips I got were not cheap. But I think it worth the fun lol. I got it from here. You better make sure that the chips will be sent within EU. Otherwise you will pay all the costs to have it in Vienna, which is almost the same as the price of the chips themselve. As I did sad. When I got the proforma invoice from them, it says that the country of origin is Italy. So I decided to pay them. But actualy they sent them from the USA.

My main idea is to move all applications (if possible) from my IBM xSeries 330 to my WL500GD, especially the Asterisk PBX. So I need quite a lot of memory. To 512MB if I could, as that is the maximum memory BCM5365 processor can handle. A part from that, the IBM server consumes quite a lot of electricity as it is running 24/7. And it is also too noisy to have it at home, so I put it in the room which door always close. But now I want to use that room.

It is the CFE that handles all initialization so I would begin with that. The serial port is already in place, just needs level translators to communicatewith the computer. The actual initialization is done in sbsdram.S residing in some directory related to CFE. I settle for 64MB for now so I have not dug deeper in to it...

I dont think more than 128MB is possible, the lines are not connected(I think). If you need more the NSLU seems to provide for 256MB: http://www.nslu2-linux.org/wiki/HowTo/FattenYourSlug

In my novice opinion, we do not get detail initialisation process on the CFE. We just get a few more lines which especially do not tell us the detail about memory initialisation. And I think the only advantage to have the serial console is that we can have access to the CFE environment.

Anyway, I finally installed the serial console with the hope that I can enter some kind of CFE debug mode to get more information about memory initialisation. But here is what I got.

CFE version 1.0.37 for BCM947XX (32bit,SP,LE)
Build Date: ¤G  3¤ë  1 16:49:41 CST 2005 (root@PaNLinux)
Copyright (C) 2000,2001,2002,2003 Broadcom Corporation.

Initializing Arena.
Initializing Devices.
et0: Broadcom BCM47xx 10/100 Mbps Ethernet Controller 1.3.2.0
rndis0: Broadcom USB RNDIS Network Adapter (P-t-P)
CPU type 0x29007: 200MHz
Total memory: 0x4000000 bytes (64MB)

Total memory used by CFE:  0x80300000 - 0x80436F10 (1273616)
Initialized Data:          0x803313D0 - 0x80333760 (9104)
BSS Area:                  0x80333760 - 0x80334F10 (6064)
Local Heap:                0x80334F10 - 0x80434F10 (1048576)
Stack Area:                0x80434F10 - 0x80436F10 (8192)
Text (code) segment:       0x80300000 - 0x803313D0 (201680)
Boot area (physical):      0x00437000 - 0x00477000
Relocation Factor:         I:00000000 - D:00000000

Device eth0:  hwaddr 00-15-F2-7E-9F-14, ipaddr 192.168.1.1, mask 255.255.255.0
        gateway not set, nameserver not set
Rescue Flag disable.
Reading :: TFTP Server.
Failed.: Timeout occured
Loader:raw Filesys:raw Dev:flash0.os File: Options:(null)
Loading: .. 3704 bytes read
Entry at 0x80001000
Closing network.
Starting program at 0x80001000
CPU revision is: 00029007
Primary instruction cache 8kB, physically tagged, 2-way, linesize 16 bytes.
Primary data cache 4kB, 2-way, linesize 16 bytes.
Linux version 2.4.30 (mbm@reboot) (gcc version 3.4.4 (OpenWrt-1.0)) #1 Mon Nov 6 17:35:21 PST 2006
Setting the PFC value as 0x15
Determined physical RAM map:
 memory: 04000000 @ 00000000 (usable)
On node 0 totalpages: 16384
zone(0): 16384 pages.
zone(1): 0 pages.
zone(2): 0 pages.
Kernel command line: root=/dev/mtdblock2 rootfstype=squashfs,jffs2 init=/etc/preinit noinitrd console=ttyS0,115200
CPU: BCM5365 rev 1 at 200 MHz
Using 100.000 MHz high precision timer.
Calibrating delay loop... 199.47 BogoMIPS
Memory: 62836k/65536k available (1464k kernel code, 2700k reserved, 104k data, 84k init, 0k highmem)
Dentry cache hash table entries: 8192 (order: 4, 65536 bytes)
Inode cache hash table entries: 4096 (order: 3, 32768 bytes)
Mount cache hash table entries: 512 (order: 0, 4096 bytes)
Buffer cache hash table entries: 4096 (order: 2, 16384 bytes)
Page-cache hash table entries: 16384 (order: 4, 65536 bytes)
Checking for 'wait' instruction...  unavailable.
POSIX conformance testing by UNIFIX
PCI: Fixing up bus 0
PCI: Fixing up bridge
PCI: Fixing up bus 1
Linux NET4.0 for Linux 2.4
Based upon Swansea University Computer Society NET3.039
Initializing RT netlink socket
Starting kswapd
Registering mini_fo version $Id$
devfs: v1.12c (20020818) Richard Gooch (rgooch@atnf.csiro.au)
devfs: boot_options: 0x1
JFFS2 version 2.1. (C) 2001 Red Hat, Inc., designed by Axis Communications AB.
Squashfs 2.1-r2 (released 2004/12/15) (C) 2002-2004 Phillip Lougher
pty: 256 Unix98 ptys configured
Serial driver version 5.05c (2001-07-08) with MANY_PORTS SHARE_IRQ SERIAL_PCI enabled
ttyS00 at 0xb8000300 (irq = 3) is a 16550A
ttyS01 at 0xb8000400 (irq = 0) is a 16550A
b44.c:v0.93 (Mar, 2004)
eth0: Broadcom 47xx 10/100BaseT Ethernet 00:15:f2:7e:9f:14
 Amd/Fujitsu Extended Query Table v1.1 at 0x0040
number of CFI chips: 1
cfi_cmdset_0002: Disabling fast programming due to code brokenness.
Flash device: 0x400000 at 0x1c000000
bootloader size: 262144
Physically mapped flash: Filesystem type: squashfs, size=0xda5f3
Creating 5 MTD partitions on "Physically mapped flash":
0x00000000-0x00040000 : "cfe"
0x00040000-0x003f0000 : "linux"
0x000bf400-0x001a0000 : "rootfs"
mtd: partition "rootfs" doesn't start on an erase block boundary -- force read-only
0x003f0000-0x00400000 : "nvram"
0x001a0000-0x003f0000 : "OpenWrt"
Initializing Cryptographic API
NET4: Linux TCP/IP 1.0 for NET4.0
IP Protocols: ICMP, UDP, TCP, IGMP
IP: routing cache hash table of 512 buckets, 4Kbytes
TCP: Hash tables configured (established 4096 bind 8192)
ip_conntrack version 2.1 (5953 buckets, 5953 max) - 332 bytes per conntrack
ip_tables: (C) 2000-2002 Netfilter core team
NET4: Unix domain sockets 1.0/SMP for Linux NET4.0.
NET4: Ethernet Bridge 008 for NET4.0
802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
All bugs added by David S. Miller <davem@redhat.com>
VFS: Mounted root (squashfs filesystem) readonly.
Mounted devfs on /dev
Freeing unused kernel memory: 84k freed
Algorithmics/MIPS FPU Emulator v1.5
Using /lib/modules/2.4.30/diag.o
diag: Detected 'ASUS WL-500g Deluxe'
Using /lib/modules/2.4.30/switch-core.o
Using /lib/modules/2.4.30/switch-robo.o
Probing device eth0: found!
b44: eth0: Link is up at 100 Mbps, full duplex.
b44: eth0: Flow control is off for TX and off for RX.
Unlocking linux ...
switching to jffs2
mini_fo: using base directory: /
mini_fo: using storage directory: /jffs

init started:  BusyBox v1.00 (2006.11.07-01:40+0000) multi-call binary

Please press Enter to activate this console. jffs2.bbc: SIZE compression mode activated.
PCI: Enabling device 01:03.0 (0004 -> 0006)
eth1: Broadcom BCM4320 802.11 Wireless Controller 3.90.37.0
BFL_ENETADM not set in boardflags. Use force=1 to ignore.
device eth0 entered promiscuous mode
b44: eth0: Link is up at 100 Mbps, full duplex.
b44: eth0: Flow control is off for TX and off for RX.
vlan0: dev_set_promiscuity(master, 1)
vlan0: dev_set_allmulti(master, 1)
device eth1 entered promiscuous mode
eth1: attempt to add interface with same source address.
br0: port 2(eth1) entering learning state
br0: port 1(vlan0) entering learning state
br0: port 2(eth1) entering forwarding state
br0: topology change detected, propagating
br0: port 1(vlan0) entering forwarding state
br0: topology change detected, propagating



BusyBox v1.00 (2006.11.07-01:40+0000) Built-in shell (ash)
Enter 'help' for a list of built-in commands.

  _______                     ________        __
 |       |.-----.-----.-----.|  |  |  |.----.|  |_
 |   -   ||  _  |  -__|     ||  |  |  ||   _||   _|
 |_______||   __|_____|__|__||________||__|  |____|
          |__| W I R E L E S S   F R E E D O M
 WHITE RUSSIAN (RC6) -------------------------------
  * 2 oz Vodka   Mix the Vodka and Kahlua together
  * 1 oz Kahlua  over ice, then float the cream or
  * 1/2oz cream  milk on the top.
 ---------------------------------------------------
root@OpenWrt:/# 
root@OpenWrt:/# 
root@OpenWrt:/# 
root@OpenWrt:/# nvram show | sort
size: 806 bytes (31962 left)
boardnum=45
boardrev=0x10
boardtype=bcm95365r
boot_wait=on
clkfreq=200
dl_ram_addr=a0001000
et0macaddr=00:15:F2:7E:9F:14
et0mdcport=0
et0phyaddr=254
hardware_version=WL500gd-01-04-01-50
lan_ifname=br0
lan_ifnames=vlan0 eth1
lan_ipaddr=192.168.1.1
lan_netmask=255.255.255.0
lan_proto=static
os_flash_addr=bfc40000
os_ram_addr=80001000
pmon_ver=CFE 1.3.2.0
pppoe_ifname=
pppoe_ifnames=
regulation_domain=0X30DE
rescueflag=disable
reset_gpio=7
scratch=a0180000
sdram_config=0x32
sdram_init=0x2008    
sdram_ncdl=0x2023e
sdram_refresh=0x0
vlan0hwname=et0
vlan0ports=1 2 3 4 5*
vlan1hwname=et0
vlan1ports=0 5
wan_device=vlan1
wan_ifname=vlan1
wan_ifnames=
wan_proto=dhcp
watchdog=5000
wifi_ifname=
wifi_ifnames=
wl0_ifname=eth1
wl0_infra=1
wl0_mode=ap
wl0_radio=1
wl0_ssid=OpenWrt
wl0id=0x4320
root@OpenWrt:/# 
root@OpenWrt:/# nvram set sdram_ncdl=0
root@OpenWrt:/# nvram set sdram_init=0x2010
root@OpenWrt:/# nvram commit
root@OpenWrt:/# 
root@OpenWrt:/# nvram show | sort
size: 799 bytes (31969 left)
boardnum=45
boardrev=0x10
boardtype=bcm95365r
boot_wait=on
clkfreq=200
dl_ram_addr=a0001000
et0macaddr=00:15:F2:7E:9F:14
et0mdcport=0
et0phyaddr=254
hardware_version=WL500gd-01-04-01-50
lan_ifname=br0
lan_ifnames=vlan0 eth1
lan_ipaddr=192.168.1.1
lan_netmask=255.255.255.0
lan_proto=static
os_flash_addr=bfc40000
os_ram_addr=80001000
pmon_ver=CFE 1.3.2.0
pppoe_ifname=
pppoe_ifnames=
regulation_domain=0X30DE
rescueflag=disable
reset_gpio=7
scratch=a0180000
sdram_config=0x32
sdram_init=0x2010
sdram_ncdl=0
sdram_refresh=0x0
vlan0hwname=et0
vlan0ports=1 2 3 4 5*
vlan1hwname=et0
vlan1ports=0 5
wan_device=vlan1
wan_ifname=vlan1
wan_ifnames=
wan_proto=dhcp
watchdog=5000
wifi_ifname=
wifi_ifnames=
wl0_ifname=eth1
wl0_infra=1
wl0_mode=ap
wl0_radio=1
wl0_ssid=OpenWrt
wl0id=0x4320
root@OpenWrt:/# 
root@OpenWrt:/# reboot
root@OpenWrt:/# 
The system is going down NOW !!

Sending SIGTERM to all processes.

Sending SIGKI
Please stand by while rebooting the system.
Restarting system.
Please stand by while rebooting the system...

That is all. Nothing more. My router is just plain dead after that. Whatever I did, nothing came up on the serial console. The interesting thing is that I could still ping the router. But I could not get to the firmware restoration mode, hence I could not re-flash it. I did this 3 times in a row and always get the same thing. I am not sure why it was not like this before. I had indeed bricked my router a few times but never like this, 3 times in a row.

The only way to unbrick it is by doing the nasty thing that I can not say here otherwise my post will be automatically deleted lol.

Now what? There is no CFE debug mode or something like that, or maybe the commands are hidden as I just got the followings.

CFE> help
Available commands:

rndis               Broadcom USB RNDIS utility.
et                  Broadcom Ethernet utility.
nvram               NVRAM utility.
reboot              Reboot.
printdefault        Display the environment default variables embeded in the bootloader
flash               Update a flash memory device
autoboot            Automatic system bootstrap.
batch               Load a batch file into memory and execute it
go                  Verify and boot OS image.
boot                Load an executable file into memory and execute it
load                Load an executable file into memory without executing it
save                Save a region of memory to a remote file via TFTP
ping                Ping a remote IP host.
arp                 Display or modify the ARP Table
ifconfig            Configure the Ethernet interface
unsetenv            Delete an environment variable.
printenv            Display the environment variables
setenv              Set an environment variable.
help                Obtain help for CFE commands

For more information about a command, enter 'help command-name'
*** command status = 0
CFE> printdefault
FLSH¸ 2
boardtype=bcm95365r
boardnum=45
boardrev=0x10
clkfreq=200
sdram_init=0x2008    
sdram_config=0x32
sdram_refresh=0x0
sdram_ncdl=0x0
et0macaddr=00:15:F2:7E:9F:14
et0phyaddr=254
et0mdcport=0
dl_ram_addr=a0001000
os_ram_addr=80001000
os_flash_addr=bfc40000
lan_ipaddr=192.168.1.1
lan_netmask=255.255.255.0
scratch=a0180000
boot_wait=on
watchdog=5000
reset_gpio=7
hardware_version=WL500gd-01-04-01-50
regulation_domain=0X30DE
*** command status = 0
CFE> 
CFE> printenv
Variable Name        Value
-------------------- --------------------------------------------------
BOOT_CONSOLE         uart0
CFE_VERSION          1.0.37
CFE_BOARDNAME        BCM947XX
CFE_MEMORYSIZE       64
NET_DEVICE           eth0
NET_IPADDR           192.168.1.1
NET_NETMASK          255.255.255.0
NET_GATEWAY          0.0.0.0
NET_NAMESERVER       0.0.0.0
STARTUP              go;
*** command status = 0
CFE>

Do you guys know how to get the detail CFE initialisation process? Or do you have any other clues to get the RAM on WL500GD to 128MB? I really appreciate any hints. Thanks in advance.

well, it does indeed look like CFE defaults to sdram_init=0x2008 so it probably needs to be rebuilt. Not sure of how to change it though...   However if I would start experimenting with the bootloader I would get a JTAG interface first... Another option is to remove the flash and program it out of the router, wich you obviously are capable of smile

Anyway, getting the sources for CFE is the first thing to get started with, IIRC it is included in the ASUS GPL firmware + Broadcom has a much newer version available online(probably need some mods to suit the 500gd).

Unfortunately, there is no JTAG on WL500GD.

Yes, I have been looking at the CFE codes in the last two days. I know a little bit of programming, but this thing is quite new to me. I am still at the stage to understand the structure. Unfortunately, documentation about this is very hard to find.

Now I am wondering, is it impossible to have 128MB? What do you think CountZero?

I remeber the jtag signals being specified in the schematic, leading to tiny reistors so I think it would be possible to add... trickier than replacing the memory though!

I only know enough programming to be dangerous, but I will take a new look at the sources and see if I can come up with anything.

I think 128 MB is possible, but without reliable Jtag I would not mess with the bootloader, so see if you can get your applications to run on 64MB first...

Thanks for your confirmation and support CountZero. Otherwise, to be honest, I almost gave up. As to what I understood up to now, the maximum supported memory is only 64MB. It looks like quite a lot of things need to be changed. Oh.. well, this is just a matter of time. I just need to read more.

Yes, I plan to continue with 64MB. I still need to mount the 60GB hard disk, properly mount the USB interface and serial ports, and also two tiny fans. This will be my little pretty and silence server lol

How sure are you about your solder joints? I had some instability at first that turned out to be poor connection in the two bridges.

To be honest, not 100% sure. But since CFE detects 64MB, so I thought all the 13 row addresses should be fine. I had it also running for more than 2 hours without crashing when I tested the serial console. Does CFE not do memory test? I think it does.

At the moment, this router is without WAN connection. I'll configure something there. Maybe wireless client and ftp server then test it. Or do you know the best way to test the memory?

I think it does test it, how thorough it tests is another question smile

I tested it by using ftp to transfer some files, keeping an eye on memory usage. Sofar from looking at CFE sources I have not seen anything suggesting that CFE is limited as to what memory parameters are passed to the controller.

Hi Anto,

I was following this post http://wl500g.info/showthread.php?t=7048 and I found out that you need to put a 22 ohm resistor on A12 address line. Also on that thread there a link to a special firmware that is supposed to work with the modification.

quote:

In WL500gp/WL500w we establish the resistor on address line A12 which is necessary for addressing all of memory of 128 mbyte (differently you receive only 64 mbytes). 

quote:

I used an online translator http://www.online-translator.com/ in order to read the russian language.

Let me know how it works, I am interested to do this modification too.

BR,

Chrys

The discussion might have continued from here.