RT-AC86U 1024MB RAM support.

[chavo]

I solder 1GB ram chip MT41K512M16HA-107:A.

If i change memcfg setting to 0x1527 all works but after restart firmware restore nvram memcfg to 0x1427 and OS only view 512MB
Need add suport 1GB to firmware

PS i brick router with bad CFE, how restore CFE with UART?

problem in this code

void bcm63xx_run(int breakIntoCfe, int autorun)
{
    int ret = 0, i = 0;
    unsigned short gpio;
    printSysInfo();

#if defined(_BCM963138_) || defined(_BCM963148_) || defined(_BCM94908_)
    {
       unsigned int memcfg;
       if (validateMemoryConfig(NVRAM_RP, &memcfg)) {
           NVRAM_UPDATE_FIELD(ulMemoryConfig, &memcfg, sizeof(memcfg));
           printf("\nMEMORY CONFIG UPDATED...  REBOOTING\n");
           cfe_sleep(2*CFE_HZ);
           softReset(0);
        }

    }

May 5 05:05:13 kernel: Memory: 963632K/1019904K available (4698K kernel code, 290K rwdata, 1576K rodata, 228K init, 521K bss, 56272K reserved, 0K cma-reserved)
May 5 05:05:13 kernel: Virtual kernel memory layout:
May 5 05:05:13 kernel: vmalloc : 0xffffff8000000000 - 0xffffffbdffff0000 ( 247 GB)
May 5 05:05:13 kernel: vmemmap : 0xffffffbe00000000 - 0xffffffbfc0000000 ( 7 GB maximum)
May 5 05:05:13 kernel: 0xffffffbe00000000 - 0xffffffbe00e00000 ( 14 MB actual)
May 5 05:05:13 kernel: fixed : 0xffffffbffabfd000 - 0xffffffbffac00000 ( 12 KB)
May 5 05:05:13 kernel: PCI I/O : 0xffffffbffae00000 - 0xffffffbffbe00000 ( 16 MB)
May 5 05:05:13 kernel: modules : 0xffffffbffc000000 - 0xffffffc000000000 ( 64 MB)
May 5 05:05:13 kernel: memory : 0xffffffc000000000 - 0xffffffc040000000 ( 1024 MB)
May 5 05:05:13 kernel: .init : 0xffffffc0006a2000 - 0xffffffc0006db000 ( 228 KB)
May 5 05:05:13 kernel: .text : 0xffffffc000080000 - 0xffffffc0006a1274 ( 6277 KB)
May 5 05:05:13 kernel: .data : 0xffffffc0006dc000 - 0xffffffc000724a80 ( 291 KB)

admin@RT-AC86U-5220:/tmp/home/root# cat /proc/meminfo
MemTotal: 963860 kB
MemFree: 688204 kB
MemAvailable: 672628 kB
Buffers: 0 kB
Cached: 18208 kB
SwapCached: 0 kB
Active: 29052 kB

admin@RT-AC86U-5220:/tmp/home/root# free
total used free shared buffers cached
Mem: 963860 275640 688220 868 0 18208
-/+ buffers/cache: 257432 706428
Swap: 0 0 0
admin@RT-AC86U-5220:/tmp/home/root#

 

[chavo]

Now works 1024 MB ram
i edited mtdblocks

0) firmware 384.19
1) copy /dev/mtdblock4 and /dev/mtdblock5 to computer

cp /dev/mtdblock4 /tmp/mnt/mtdblock4
scp asus:/tmp/mnt/mtdblock4 mtdblock4  <=== on local computer
rm /tmp/mnt/mtdblock4

cp /dev/mtdblock5 /tmp/mnt/mtdblock5
scp asus:/tmp/mnt/mtdblock5 mtdblock5  <=== on local computer
rm /tmp/mnt/mtdblock5

2) find all (two) hex 27140000000000002301 and replace to 27150000000000002301 in mtdblock4 mtdblock5

sed -i 's/\x27\x14\x00\x00\x00\x00\x00\x00\x23\x01/\x27\x15\x00\x00\x00\x00\x00\x00\x23\x01/g' mtdblock4
sed -i 's/\x27\x14\x00\x00\x00\x00\x00\x00\x23\x01/\x27\x15\x00\x00\x00\x00\x00\x00\x23\x01/g' mtdblock5

3) copy to router and write with dd

scp mtdblock4 asus:/tmp/mnt/mtdblock4
dd if=/tmp/mnt/mtdblock4 of=/dev/mtdblock4
rm /tmp/mnt/mtdblock4

scp mtdblock5 asus:/tmp/mnt/mtdblock5
dd if=/tmp/mnt/mtdblock5 of=/dev/mtdblock5
rm /tmp/mnt/mtdblock5

2) reboot

ps run this command on router after replace memory

cp /dev/mtdblock4 /tmp/mnt/asus/mtdblock4
sed -i 's/\x27\x14\x00\x00\x00\x00\x00\x00\x23\x01/\x27\x15\x00\x00\x00\x00\x00\x00\x23\x01/g' /tmp/mnt/asus/mtdblock4
dd if=/tmp/mnt/asus/mtdblock4 of=/dev/mtdblock4
rm /tmp/mnt/asus/mtdblock4

cp /dev/mtdblock5 /tmp/mnt/asus/mtdblock5
sed -i 's/\x27\x14\x00\x00\x00\x00\x00\x00\x23\x01/\x27\x15\x00\x00\x00\x00\x00\x00\x23\x01/g' /tmp/mnt/asus/mtdblock5
dd if=/tmp/mnt/asus/mtdblock5 of=/dev/mtdblock5
rm /tmp/mnt/asus/mtdblock5

reboot

 

[Jeffrey Young]

Awesome!! A project once warranty is done. It is too bad that the programmers did not strobe the available memory as opposed to just assuming.

Thank you for posting

 

[chavo]

already order 2 GB chip memory, for test ))

 

[vaboro]

already order 2 GB chip memory, for test ))

What chip did you choose? I tried to find 16Gbit FBGA-96 DDR3L chip on mouser, but failed. 2GB FBGA-96 chips are DDR4.

 

[Keith Gorham]

Interesting....

 

[chavo]

What chip did you choose? I tried to find 16Gbit FBGA-96 DDR3L chip on mouser, but failed. 2GB FBGA-96 chips are DDR4.

this IS43TR16K01S2AL-125KBLI

https://www.mouser.com/ProductDetail/870-16K01S2L-125KBLI/

I haven't installed it yet, so I can't say whether it will work or not

ps mouser have bad search filter

 

[vaboro]

this IS43TR16K01S2AL-125KBLI

Thank you. Now I see that I had to search for BGA instead of FBGA case. When FBGA case search filter is used only DDR4 16Gbit memory modules are displayed in search results.

PS i brick router with bad CFE, how restore CFE with UART?

I haven't yet found a way to restore corrupt CFE with UART. I suspect there is none. I have an RT-AC86U with corrupt CFE, see http://www.snbforums.com/threads/rt-ac86u-very-easy-to-brick.45019/post-649269, and I couldn't find another way but to desolder Macronix NAND and reprogram it. I am still wating for tshop48 programmer adapter to arrive. On the other hand I noticed some mysterious contacts on all RT-AC86U boards, see http://www.snbforums.com/threads/rt-ac86u-mysterious-contacts-on-pcb.70439, and I suspect they are part of an interface for reprogramming Macronix NAND onboard without desoldering. Unfortunately, the purpose of these contacts and their pinont is unknown. Maybe the best way to check these contacts out would be ringing them and all the pins of Macronix NAND. Anyways, I recommend making backups of all mtd's just in case CFE gets corrupt.

 

[chavo]

chips on taobao 5$ - https://item.taobao.com/item.htm?id=613596877778
aliexpress https://www.aliexpress.com/item/32983556319.html

 

[chavo]

2GB chip not working with 271600 (if you do that, you brick router)
for 2GB need recompiler cfe with config

 

[vaboro]

Thank you for the notice. By the way what is the console output?

 

[chavo]

like 1GB i edit memory config to 0x1627 but CFE not have this config, need add this config to CFE and recompiler

CPU0
L1CD
MMUI
MMU>
CODE
ZBBS
MAIN
NVRAM memcfg 0x1627
No valid MCB found for memcfg 0x1627, use safe mode setting
DDR init safe mode
MCB chksum 0x9b0baabd, config 0x523


MemsysInit lpf0_generic_aarch64 1.3.0.1 20150910
DDR3
90002888 80018000 8001A000 00000000 00000000 0010371D
MCB rev=0x00040301 Ref ID=0x0371D Sub Bld=0x001
Dram Timing 08-08-08


DDR3-1066 CL8 total 1024MB 1 16bits part[s]


Add/Ctl Alignment
no adjustment


ZQ Cal LP PHY
 R in Ohm
 P: Finger=0x2D0 Term=0x78 Drv=0x2A
 N: Finger=0x2D0 Term=0x78 Drv=0x2A

 

[chavo]

need add support to bcm63xx_impl2_ddr_mcb.c

asuswrt-merlin.ng/release/src-rt-5.02hnd/cfe/cfe/arch/arm/board/bcm63xx_rom/src/bcm63xx_impl2_ddr_mcb.c at 384.19 · RMerl/asuswrt-merlin.ng

Third party firmware for Asus routers (newer codebase) - RMerl/asuswrt-merlin.ng

github.com

 

[chavo]

Compiled CFE with 2GB support
DDR test successfully but linux not started, without any error
modification

git diff ../../../cfe/arch/arm/board/bcm63xx_rom/src/bcm63xx_impl2_ddr_cinit.c
diff --git a/release/src-rt-5.02hnd/cfe/cfe/arch/arm/board/bcm63xx_rom/src/bcm63xx_impl2_ddr_cinit.c b/release/src-rt-5.02hnd/cfe/cfe/arch/arm/board/bcm63xx_rom/src/bcm63xx_impl2_ddr_cinit.c
index 4dcc9096d1..130b01ac18 100644
--- a/release/src-rt-5.02hnd/cfe/cfe/arch/arm/board/bcm63xx_rom/src/bcm63xx_impl2_ddr_cinit.c
+++ b/release/src-rt-5.02hnd/cfe/cfe/arch/arm/board/bcm63xx_rom/src/bcm63xx_impl2_ddr_cinit.c
@@ -641,7 +641,7 @@ static void init_memc_dram_profile(unsigned int* pMCB)
     memc_dram_profile.ddr_2T_mode  = (pMCB[MCB_2T_MODE_WORD] & MCB_2T_MODE_MASK) >> MCB_2T_MODE_SHIFT;
     memc_dram_profile.ddr_hdp_mode = (memc_dram_profile.total_width_bits == 16);
     memc_dram_profile.large_page   = 1;
-    memc_dram_profile.ddr_dual_rank = 0;
+    memc_dram_profile.ddr_dual_rank = (memc_dram_profile.total_size_Mbits == 16384) ? 1: 0;

     memc_dram_profile.timing_cfg.tRAS =  (pMCB[MCB_TIMING0_WORD] & MCB_TIMING0_tRAS_MASK) >> MCB_TIMING0_tRAS_SHIFT;
     memc_dram_profile.timing_cfg.tCwl =  (pMCB[MCB_TIMING1_WORD] & MCB_TIMING1_tCWL_MASK) >> MCB_TIMING1_tCWL_SHIFT;


git diff ../../../cfe/arch/arm/board/bcm63xx_rom/src/bcm63xx_impl2_ddr_mcb.c
diff --git a/release/src-rt-5.02hnd/cfe/cfe/arch/arm/board/bcm63xx_rom/src/bcm63xx_impl2_ddr_mcb.c b/release/src-rt-5.02hnd/cfe/cfe/arch/arm/board/bcm63xx_rom/src/bcm63xx_impl2_ddr_mcb.c
index 6115960910..2c518869a6 100644
--- a/release/src-rt-5.02hnd/cfe/cfe/arch/arm/board/bcm63xx_rom/src/bcm63xx_impl2_ddr_mcb.c
+++ b/release/src-rt-5.02hnd/cfe/cfe/arch/arm/board/bcm63xx_rom/src/bcm63xx_impl2_ddr_mcb.c
@@ -125,6 +125,11 @@ mcbindex MCB[]  = {
         BP_DDR_SPEED_MASK | BP_DDR_TOTAL_SIZE_MASK | BP_DDR_DEVICE_WIDTH_MASK | BP_DDR_TOTAL_WIDTH_MASK | BP_DDR_SSC_CONFIG_MASK,
         mcb_4908A_800MHz_16b_dev8Gx16_DDR3_1600K_ssc_1per
     },
+    {
+        BP_DDR_SPEED_800_11_11_11 | BP_DDR_TOTAL_SIZE_2048MB| BP_DDR_DEVICE_WIDTH_16 | BP_DDR_TOTAL_WIDTH_16BIT | BP_DDR_SSC_CONFIG_1,
+        BP_DDR_SPEED_MASK | BP_DDR_TOTAL_SIZE_MASK | BP_DDR_DEVICE_WIDTH_MASK | BP_DDR_TOTAL_WIDTH_MASK | BP_DDR_SSC_CONFIG_MASK,
+        mcb_4908A_800MHz_16b_dev8Gx16_DDR3_1600K_ssc_1per
+    },
     {
         BP_DDR_SPEED_800_11_11_11 | BP_DDR_TOTAL_SIZE_1024MB| BP_DDR_DEVICE_WIDTH_16 | BP_DDR_TOTAL_WIDTH_32BIT | BP_DDR_SSC_CONFIG_1,
         BP_DDR_SPEED_MASK | BP_DDR_TOTAL_SIZE_MASK | BP_DDR_DEVICE_WIDTH_MASK | BP_DDR_TOTAL_WIDTH_MASK | BP_DDR_SSC_CONFIG_MASK,

OUTPUT

----
BTRM
V1.6
CPU0
L1CD
MMUI
MMU7
DATA
ZBBS
MAIN
OTP?
OTPP
USBT
NAND
IMG?
IMGL
UHD?
UHDP
RLO?
RLOP
UBI?
UBIP
PASS
----
HELO
1.23-1.0.38-161.122
CPU0
L1CD
MMUI
MMU8
CODE
ZBBS
MAIN
NVRAM memcfg 0x1627
MCB chksum 0xa8b35841, config 0x1627

MemsysInit lpf0_generic_aarch64 1.3.0.1 20150910
DDR3
90001328 80018000 8001A000 00000000 00000000 0060371A
MCB rev=0x00040301 Ref ID=0x0371A Sub Bld=0x006
Dram Timing 11-11-11

DDR3-1600 CL11 total 2048MB 1 16bits part[s] %1 SSC

Add/Ctl Alignment
no adjustment

ZQ Cal LP PHY
R in Ohm
P: Finger=0x2D0 Term=0x78 Drv=0x2A
N: Finger=0x2D0 Term=0x78 Drv=0x2A

PLL Ref(Hz)=0x02FAF080 UI STEPS=0x03A
DDR CLK(MHz)=0x31B WL CLK dly(ps)=0x0C8 bitT(ps)=0x274 VDLsize(fs)=0x2A4B CLK_VDL=0x01A

SHMOO 28nm
8001A000 80018800 00000000 00020000 00000000

Shmoo WL

One UI Steps : 0x45

auto-clk result = 00E (filter=0C steps)
initial CLK shift = 01A
final CLK shift   = 00E

   000000000011111111112222222222333333333344444444445555555555666666666
   012345678901234567890123456789012345678901234567890123456789012345678
00 S-----------X+++++++++++++++++++++++++++++++++++++++++++++++++++++++-
01 S------------------------X+++++++++++++++++++++++++++++++++++++++++++

Shmoo RD En
FORCED WR ODT = 0x18001800
DQSN DRIVE PAD CONTROL (from) (to)
B0 00031A31 00079A31
B1 00031A31 00079A31
B0 RISE UI=1 VDL=2B PICK UI=2 VDL=2B
B1 RISE UI=1 VDL=15 PICK UI=2 VDL=15
   000000000011111111112222222222333333333344444444445555555555666666666
   012345678901234567890123456789012345678901234567890123456789012345678
00 --S----------------------------------------X+++++++++++++++++++++++++


Shmoo RD DQ NP
DQS :
B0 VDL=3A ok
B1 VDL=3A ok
   000000000011111111112222222222333333333344444444445555555555666666666
   012345678901234567890123456789012345678901234567890123456789012345678
00 ---+++++++++++++++++++++++X++++++++++++++++++++++++------------------


Shmoo RD DQ P
   000000000011111111112222222222333333333344444444445555555555666666666
   012345678901234567890123456789012345678901234567890123456789012345678
00 --++++++++++++++++++++++++X+++++++++++++++++++++++++-----------------
01 ------+++++++++++++++++++++++X++++++++++++++++++++++++---------------
02 --++++++++++++++++++++++++X+++++++++++++++++++++++++-----------------


Shmoo RD DQ N
   000000000011111111112222222222333333333344444444445555555555666666666
   012345678901234567890123456789012345678901234567890123456789012345678
00 ---+++++++++++++++++++++++++X+++++++++++++++++++++++++---------------
01 ------+++++++++++++++++++++++++X++++++++++++++++++++++++++-----------

RD DQS adjustments :
BL0: Start: 0x3A Final: 0x3A
BL1: Start: 0x3A Final: 0x3A

Shmoo WR DQ
   000000000011111111112222222222333333333344444444445555555555666666666
   012345678901234567890123456789012345678901234567890123456789012345678
00 ---+++++++++++++++++++++++X+++++++++++++++++++++++-------------------
01 ------++++++++++++++++++++++++X++++++++++++++++++++++++--------------

Shmoo WR DM
WR DM
   000000000011111111112222222222333333333344444444445555555555666666666
   012345678901234567890123456789012345678901234567890123456789012345678
00 ------++++++++++++++++++++++++++X++++++++++++++++++++++++++----------
01 --+++++++++++++++++++++++++++X+++++++++++++++++++++++++++------------
DDR test done successfully
FPS0
----
PAR0
J026
JFFS
BT26
0008
----
PAR1
J025
JFFS
BT25
0768
----
TRY0
NAN3
JFS2
RFS1
JFFS
JFS2
NAN5


Base: 1.2_3
CFE version 1.0.38-161.122 for BCM94908 (64bit,SP,LE)
Build Date: Thu 01 Apr 2021 12:25:07 PM EDT (evg@evgasus)
Copyright (C) 2000-2015 Broadcom Corporation.

Boot Strap Register:  0x6fc42
Chip ID: BCM4906_A0, Broadcom B53 Quad Core: 1800MHz
Total Memory: 2147483648 bytes (2048MB)
Status wait timeout: nandsts=0x50000000 mask=0x40000000, count=0
NAND ECC BCH-4, page size 0x800 bytes, spare size used 64 bytes
NAND flash device: , id 0xc2da block 128KB size 262144KB
pmc_init:PMC using DQM mode

pmc_init slow 95, fast 70
pmc_init:7 0 264047c 33a0337
nand_flash_read_buf(): Attempt to read bad nand block 1992
nand_flash_read_buf(): Attempt to read bad nand block 1992
nand_flash_read_buf(): Attempt to read bad nand block 1992
Skip Rescue Mode

Board IP address                  : 192.168.1.1:ffffff00
Host IP address                   : 192.168.1.100
Gateway IP address                :  
Run from flash/host/tftp (f/h/c)  : f
Default host run file name        : vmlinux
Default host flash file name      : bcm963xx_fs_kernel
Boot delay (0-9 seconds)          : 1
Boot image (0=latest, 1=previous) : 0
Default host ramdisk file name    :  
Default ramdisk store address     :  
Default DTB file name             :  
Board Id                          : 94906REF
Number of MAC Addresses (1-64)    : 10
Base MAC Address                  : 04:d4:c4:1b:1f:48
PSI Size (1-128) KBytes           : 128
Enable Backup PSI [0|1]           : 0
System Log Size (0-256) KBytes    : 0
Auxillary File System Size Percent: 0
flow memory allocation (MB)       : 14
buffer memory allocation (MB)     : 32
DHD 0 memory allocation (MB)      : 0
DHD 1 memory allocation (MB)      : 14
DHD 2 memory allocation (MB)      : 0
WLan Feature                      : 0x00
Partition 1 Size (MB)             : 8M
Partition 2 Size (MB)             : 48M
Partition 3 Size (MB)             : 0M
Partition 4 Size (MB) (Data)      : 8M

Initalizing switch low level hardware.
pmc_switch_power_up: Rgmii Tx clock zone1 enable 1 zone2 enable 1.
Software Resetting Switch ... Done.
Waiting MAC port Rx/Tx to be enabled by hardware ...Done
Disable Switch All MAC port Rx/Tx
*** Press any key to stop auto run (1 seconds) ***
Auto run second count down: 0
Booting from latest image (address 0x00100000, flash offset 0x00100000) ...
Decompression LZMA Image OK!
Entry at 0x0000000000080000
Starting program at 0x0000000000080000
/memory = 0x80000000

 

[vaboro]

linux not started, without any error

You mean the booting just hanged without any errors being reported?

 

[chavo]

You mean the booting just hanged without any errors being reported?

yes, last message - "/memory = 0x80000000"

 

[vaboro]

Maybe another ECC issue?

 

[chavo]

Maybe another ECC issue?

What ECC?

 

[chavo]

I tryed test write read
in address > 1GB i get the error
probably memory works with erorrs

 

[vaboro]

Maybe need to reconfigure the kernel?