[HowTo] Upgrading RAM to 128 MB (WL-500gP, WL-500W and WL-700gE)
As most of you asked to publish this I've finally finished this guide...
The goal of this mod is to increase built in memory up to 128MB to be able run more services on the router without the expense of accessing slow swap, etc. Beware, that this mod requiresvery strong soldering skills! And usual disclaimer: do it on your own risk to brick the router completely.
What do you need to perform a mod?
- Good soldering skills at first (the board is Pb Free!) and equipment
- One 22Ohm (33 Ohm is also ok) resistor to enable A12 address line (not needed for WL-700gE, as it has it already)
- Two TSOP packaged DDR333 or DDR400 SDRAM chips organized as 32Mx16
The easiest way to get chips (and perhaps cheap) is to remove them from the PC2700/PC3200 DIMM or SO-DIMM: at the moment we've checked the following parts:
- Hynix HYMD532646CP6J-D43 PC3200 DIMM: it has Hynix HY5DU121622CTP-D43 chips
- Samsung M470L6524BT0-CB3 PC2700 SO-DIMM: it has Samsung K4H511638B-TCB3 chips
- Samsung M470L6524DU0-CB3 PC2700 SO-DIMM: it has Samsung K4H511638D-UCB3 chips
- Transcend TS32MSD64V3M PC2700 SO-DIMM: it has Elpida D5116AFTA-5B-E chips
Please note, that Hynix is least preferred. Also, avoid using Infineon chips.
The problem is that PCB is not ideally traced and has some noise UDQS line coming to U4, resulting in memory errors (see below).
Doing it
- Start with flashing latest firmware which is known to support 128MB of RAM. My firmware starting with 1.9.2.7-7g are known to work ok, as they've required patches. But I recomend flashing latest anyway.
- Telnet/ssh to your router and type
Code:
nvram set sdram_init=0x000b
nvram set sdram_config=0x0032
nvram commit
halt
This would turn U4 chip off and prevent my firmware from auto enabling it. The router would be halted too, so you could safely remove power from it.
- Disassemble your router now
- Remove shieldings from the back of PCB (it's self-adhesive) and from the top
- Solder 22 Ohm resistor on the free pads labeled R43. Skip this step if you have WL-700gE. Check image below:
http://oleg.wl500g.info/wl500gp/IMG_5609_.jpg
- Replace original U3 chip with your new memory chip. Be sure to remove PB free solder completely from the PCB pads before soldering your new chip!
- Power your device on. It should now start normally and report 32MB of RAM (use free to check this).
If it does not: check your soldering work again. Don't even think of pin-9 trick or whatever! FYI: all routers starts
after replacing U3 chip. - Test RAM using memtest (see below). If it fails, then double check your soldering and try again.
- Given, that your router works with U3 replaced, continue with replacing U4, now it should look like this:
http://oleg.wl500g.info/wl500gp/IMG_5590_.jpg
- Replaced? Ok, turn it once again and check, that it still work. If it does not check U4 soldering: perhaps you short-cuted something... Now type the following in the telnet/ssh to enable U4 and 128MB of RAM:
Code:
nvram set sdram_init=0x0011
nvram set sdram_config=0x0062
nvram commit
reboot
- It should now reboot. If it does, than you're lucky man (Elpida and Samsung chips are reported to be very lucky)
if it does not (Hynix never boots this way) then proceed this way: check your U4 soldering work once again. Try
to power on your device. If everything looks good then you've to try adding 3-7 pF capacitor between U4 pin 51
(UDQS) and ground:
http://wl500g.dyndns.org/wl500gp/IMG_3999_.JPG. - If it does not boot - check your soldering work once again. If it still does not work - I've no idea then. Don't blame me, this is ASUS PCB fault.
- Test RAM using memtest (see below). Leave it running for a long time to be absolutely sure it works fine. If it does not, then perhaps you should solder a capacitor as described above. Once it's error free, you could tell
memory controller to re-tune some internal timings:
Code:
nvram set sdram_ncdl=0
nvram commit
reboot
Activating 128MB with known good memory
You need this everytime you perform a reset to defaults...
Code:
nvram set sdram_init=0x0011
nvram set sdram_ncdl=0
nvram commit
reboot
Testing device memory
Type these lines to start testing:
Code:
cd /tmp
wget http://oleg.wl500g.info/bin/memtest
chmod +x memtest
./memtest 16m
Note, that memtest at most could only pin half of device memory. Replace 16m with 64m for 128MB of RAM.
Pictures
WL-700gE with Samsung chips and 8MB flash
http://oleg.wl500g.info/wl500gp/IMG_4384_.JPG
WL-500gP with Samsung and Hynix chips at the same time
Samsung chip does not need caps on this PCB...
http://oleg.wl500g.info/wl500gp/IMG_4005_.JPG
One more happy wl500gP with 128M ram upgrade!
Big thanks to Oleg and all the contributors!
I’ve been looking around for a small form factor computer to use as the main computer of a mobile robot, when it occurred to me that routers are actually becoming some very good examples of physically small computers.
Linux is my OS of choice for such projects, so I was very happy to learn about the wl500gP + Oleg's firmware combo.
Spec's-wise the wl500gP it's nearly all-ready out of the box, but then again, one can never have enough memory!
Then I landed on that 128M memory upgrade post by Oleg, and this is the story:
Components:
After a week long search some NANYA NT5DS32M16BS-5T were located. So why not give it a try? There was no confirmation for these back then, though according to the datasheet they were pin compatible and organised as 32x16. But when I was about to acquire them, I got a call from a second-hand store, about some SO-DIMM with Samsung K4H511638C-UCB3 gathering dust on their shelves, so that was it! These were confirmed by trucki and way cheaper too.
(Thanks to particleman we now have a confirmation for NANYA NT5DS32M16BS-5T)
33 Ohm smd 0402 resistors were kindly donated from an old dvd player, (one for A12 line, one more to replace an accidentally desoldered and lost one)
Method:
- Used a hot-air gun (the paint-stripping gender) to preheat the pcb and then desolder the (fluxed) memory chips, while protecting the rest of the pcb with multiple layers of aluminium foil as a heat screen, both from the SO-DIMM and the wl500gP.
- Applied no-clean flux on the pads, then removed the solder from the pcb pads with desoldering braid (wick).
- Cleaned around with some alcohol and some cotton buds.
- Positioned the chip, then kept it in place with some scotch tape (it *really* helps).
- Used a fine tip, low wattage soldering iron with tiny amounts of solder applied on the tip.
- soldered pins under optical aid.
- cleaned around some more.
- Scanned and hi-res macro-photographed the result from various angles to visually inspect on screen.
- checked for sort / open circuits with a multi-meter.
- reworked a few stubborn pins. :p
And voila! It didn't work :confused: no power led on :eek: disappointment :(
At the time it was already very late at night, so I slept over it, many nights, and when I found the time, armed with multimeters, optical aids, pencil and paper for an improvised schematic, datasheets, previous pic's of the tracks under the chips and quite some patience I checked again every single track and pin on the first chip (U3). Pins 18 (Vdd) and 4 (DQ1) were found to be loose, giving false positives when pressed on their pads with the multi-meter probe. They were resoldered while I pressed down on them with a pointed tool and voila, router finally up and running! :) U4 was not much of an issue and soon I had all 128M of ram activated! :D:D:D
At first strong vibration would freeze the router (more loose pins) but then the soldering iron came again in to play, and everything worked just fine!
The router went through twelve runs of memtest and all is fine! Router is happy, I am happy, big Thanks Oleg!
Here is a reference list compiled from this forum with all chips known to work so far for wl500gP:
Code:
Chip: By: On memory module: Type: Form: By: Confirmed by: Note:
HY5DU121622CTP-D43 HYNIX HYMD532646CP6J-D43 PC3200 DIMM HYNIX Oleg 1
K4H511638B-TCB3 SAMSUNG M470L6524BT0-CB3 PC2700 SO-DIMM SAMSUNG Oleg .
K4H511638D-UCB3 SAMSUNG M470L6524DU0-CB3 PC2700 SO-DIMM SAMSUNG Oleg .
D5116AFTA-5B-E ELPIDA TS32MSD64V3M PC2700 SO-DIMM TRANSCEND Oleg .
K4H511638F-TCB3 SAMSUNG newbiefan .
K4H511638D-UCB3 SAMSUNG newbiefan .
K4H511638C-UCB3 SAMSUNG KVR333X64SC25/512 PC2700 SO-DIMM KINGSTON trucki .
MT46V32M16-6T MICRON mitek 1
NT5DS32M16BS-5T NANYA particleman .
K4H511638B-TCB3 SAMSUNG oyabun .
K4H511638C-UCB3 SAMSUNG M470L6524CUO-CB3 PC2700 SO-DIMM SAMSUNG inertial .
HY5DU121622CTP-D43 HYNIX NotebookKiller 1
Note 1: Capacitor between pin 51 and ground / Clock lines employed.
Note 2: Infineon chips are reported as not collaborating with wl500gP pcb.
Be warned that the pcb pads are really easy to damage, static electricity could fry the chips, thermal shock could destroy them as well as the pcb and other components, flux/solder fumes are usually toxic, etc.
Before attempting such a mod it would be useful to search for "SMD desoldering" on the net, since there are many informative how-to's and even videos on the subject, get familiar with the "reflow thermal curve" and "ESD damage", practice desoldering and soldering on some scrap pcb's first and make sure you won't miss your router too much if things go wrong.
Admittedly, coming from an H/W background I have quite extensive soldering/desoldering experience but I still believe it's possible to perform the mod when having some soldering experience and rehearsing the steps on some scrap first.
@breizh76:
I am pretty sure your asus is recoverable, have a look at what these people from http://www.circuitmedic.com are doing.
Agreed it requires lots of tools and even more skill, but still it is possible!
Got four partially lifted pads myself, when desoldering U3 but finally everything works fine.
Had a 60G HD too with many cut and lifted tracks 'few years ago, but managed to functionally restore it (visual aesthetic aspect though... ouch!)
If you don't feel confident, you could find some hardware-tech / mobile-phone repair-tech guy that could do it, or even I could try and have a go at it, if you post me your unit.
@All:
Could any one direct me to some wl500gP schematics, if such thing is available? I’d like to try some extensive wl500gP hard-hacking :)
Inertial
5 Attachment(s)
Expansion possibilities inspirations for wl500gP routers
Hello!
Quote:
Originally Posted by Oyabun
What kind of hard hacking are you thinking about?
Most of my inspiration came by looking at these pieces of information: (attached below)
* BCM4704 Block Diagram
* BCM4704 System Diagram
Well besides the gpio pins, I2C bus, SPI bus, SD card, etc type hacks, (directly off wl500gp pcb tracks), the most promising thing, may be the ability of BCM4704 processor to handle three mini-PCI 2.3 peripherals.
Quote:
From Broadcom's BCM4704 Product Brief:
The PCI 2.3 host interface allows enumeration of three external PCI peripherals (more with external arbiter)
Another way to explore would be the EBI (Expansion Bus Interface) route. Signals for this bus are presented to the flash memory chip (SPANSION S29GL064M), of course stealing them from the chip's pads seems extremely hard, but it might still be an option for just a couple of lines. And since extremely hard is still possible ;) , one could even try an IDE connection if all necessary signals are found to be present and the firmware side of things in understood as well (that already sounds pretty complex to me).
Other interesting things are the modem and audio codec’s as well as the two-port USB 1.1 host. Interesting these are, however, only if their respective signal/data lines are present somewhere on the pcb, since un-burying them from under the BGA :eek: seems highly unlikely, to stay optimistic. :cool:
Software-wise, access to the MAC (Multiply Accumulate) unit on-chip would be very useful to people who wish to hook up some sensors on the wl500gp and then use it to perform some DSP (digital signal processing) on the collected data.
Also software-wise, access to the IPSec Core and related hard-wired functions available in the BCM4704 (IPSec 3DES, SSL MAC, TLS HMAC, SSL/TLS DES/3DES, MD5/SHA-1 HASH, IPSec AES), would be very useful for some types of network applications.
All of the above require, inside knowledge of the processor core, usually found in a Programmer's Guide type document and in datasheets, for the software part, whereas for the hardware part, processor datasheets and router schematics would be needed. Without any of these documents in sight, it's gonna be pretty hard to attempt most of these modifications.
That's why I believe mini-PCI peripheral expansion is the most viable approach, given the available documentation.
PCI's, let's sum it up, we have: One for the PCI-to-USB bridge (VIA VT6212L), one more for the actual mini-PCI connector harbouring the wi-fi card, that's two, leaving room for (hopefully) one more! Plus all the signals for the PCI bus should be presented to the mini-PCI connector. That's only a guess however, I haven't actually checked to verify that, but still. The specifications for PCI and mini-PCI bus are at hand, so it will be a matter of (spare) time to verify it.
After verifying that all necessary signals are present and that the firmware (as is or modified) could handle such an addition, it might be possible to try and solder one more mini-PCI card connector on the existing pcb pads.
Many mini-PCI cards are available which could be used to offer additional functionality, provided the suitable driver exists, that is.
* mini-PCI to IDE and/or SATA controllers + Compact Flash (CF) Socket, (no USB bottleneck)
* mini-PCI to (a multitude of) serial ports extension cards
* mini-PCI GPS receiver module with extra serial ports
* mini-PCI 801.11a/b/g 400mW card
* more examples welcomed
A simple idea would be to add an extra dual band wi-fi card, transforming the router to a link, or even backbone node for wireless metropolitan networks. A GPS card would suit locative (location-aware) applications. The extra serial ports would be good for robotics or home automation and a direct mini-PCI to IDE/SATA/CF card would allow for file transfers at full speed, overcoming the USB bottleneck. I could go on daydreaming about possibilities for long... :)
Take a wl500gP, hook up some temp, humidity, pressure, wind-speed, rainfall, etc sensors over USB or serial ports and you get a remote, networked, weather-station. Or add some motors and motor drivers assortments, vision, GPS, batteries, sensors (speed, distance, temp, inertial, rotational, magnetic, etc) a few microcontrolers, quite some code, and voila: you have a networked mobile robot...
For the moment my preferred (and much more realistic) approach is to interface microcontrollers to the RS-232 and USB ports of the router. I'm planning to work with some PIC18F4550 with USB connection while some other PIC boards with rs-232 are already available and have plenty of things interfaced to them. Now I only need to set up a cross compiler for the wl500gP and write some code to get them to communicate with the router (and, hopefully, one day, attempt even native compilation). Some more code writting/porting will be needed to have the router perform some processing on the data collected through the uC's and plan some actions to execute on the devices interfaced to them in response, all while sending part of the data over lan/wi-fi. The birth of a simple robotics platform, indeed.
Following the various posts about the RS-232 console connection, and parper's post "Additional USB ports and Internal HD!", I performed the corresponding mod's, and now I have a very happy wl500gP with Oleg's firmware, 128MB ram, four onboard USB 2.0 ports and two RS-232 signal level serial ports. :D
I will post methods and findings soon!
Ideas, comments, suggestions are welcomed :)
Greetings to all and thanks for all the info's you are sharing,
inertial
Below are some very inspiring BCM4704 Diagrams from Broadcom's Product Brief, a picture of wl500gP's case following modification to house the extra two USB connectors, and a couple of pictures of the actual post mod pcb.
