DOCUMENT OVERVIEW ============================================================ This document contains instructions on how to restore a broken Linksys WPC11 version 3 PCMCIA card that has all memory broken (This includes Primary & Secondary firmware, the Production Data Area (PDA), and the Card Information Structure (CIS)). The method to restore the memory will be using the DOS based flash tools. It also has some info on how to use the newer version of FLASH.EXE from an IBM package. It has the same version number, but a different release date (04.24.2002). It seems this version can look up the type of flash memory better, and is successful flashing as a result. Some people on the internet have said that the older 0.5e (06.25.2001) version of FLASH.EXE should not be used for writing data, only dumping. It says the program locks up. It noted on my machine that, maybe by random chance for me, that it only tends to lockup after entering 8 to 12 commands. Maybe register or buffer overflow? Anyway, I have to test the new version more, but maybe they corrected the lockup problem with this newer FLASH.EXE. This document is intended for those who have experience using the FLASH.EXE tools, and making bootable DOS devices. Remember, it only worked for my configuration and hardware platform (read below for more info). If you try this and it kills (or further kills) your card, you are responsible. This is only an example that happened to work. There is no guarantee that it will work correctly. Make sure that you read all of the necessary PRISM documentation before attempting this card flash. This includes flash.pdf, Download.pdf, and maybe the Driver Programmers Manual. ITEMS NEEDED TO RE-FLASH PCMCIA CARDS ============================================================ There are some items that we need to proceed further with this project. First, make sure that you have an MS-DOS version 6.2 bootable device. This can be a bootable floppy diskette (either 1.44 or 2.88, depending on what you have), a hard drive with a FAT partition that is DOS bootable (not sure whether to use FAT16, FAT32, or VFAT), a custom DOS bootable CD-ROM, or bootable USB drive. For my tests, I used a bootable CD-ROM. The disadvantage to doing this was I could not edit files on the CD from the DOS environment. However the DOS type I used created a virtual RAMDisk, so files could be copied there and then edited and used with the flash process. I did not need to do this, because the files were correct to be flashed (firmware, PDA, image dump), and I didn't mind wasting CD-ROM discs until I could get it to work... The DOS type I used was Bart's BootCD. It works OK, but may have problems with other types of PC Card controllers. This is possibly resolved with the -legacy command line option on FLASH.EXE, or editing of the flash.ini to include your PCMCIA controller. The next item that's important is the necessary files to include for the flashing project. Since I load code and data from the CD, we can include lots of files to test. I put all of the known firmware types and data files, which are: 1. Initial 2. Primary 3. Secondary 4. Tertiary (not really necessary) 5. RAM Download (really for debugging/testing) 6. CIS firmware (really BROMAX HEX files, PRISM2 3841 MAC only!) 7. Backup firmware image of card (for restoring CIS) **NOTE1 8. Backup PDA of card (for restoring PDA) **NOTE2 **NOTE1 - This can be done using Winupdate 0.7.0 **NOTE2 - This can be done using Winupdate 0.7.0 ** To back these up, it must be done from that card previously, or the same model card. The firmware image contains all of the data (Primary, Secondary, PDA, and the CIS). However, if not using it from that exact card, the PDA must be edited and re-flashed to reflect the correct MAC Address of the card. I also included all of the versions of the FLASH.EXE tools. These are all of the versions that I know of: 1. Version 0.3b (Jul 17 2000) - FLASHold.exe 2. Version 0.5e (Jun 25 2001) - FLASH.EXE 3. Version 0.5e (Apr 24 2002) - ILHOPFW.EXE 4. Version 1.21 (Special IBM MiniPCI only version?) I would recommend to use flash tool #3, the newest available version, the one that worked for me. FLASH tool #4 seems similar to the older FLASH.EXE (06.25.2001), but seems it is only for the IBM MiniPCI cards. With all of the flash tools, make sure to try and isolate the INI (maybe renaming EXE files and also match their associated INI file) for all of the tools. However, the main tool to keep in the root directory is #3, since it seems the most functional. The others can be put in sub-directories or just ommited from project, since they may not be needed. NOTE: To get the newer FLASH.EXE and Initial firmware file ID010001.HEX, follow the instructions near the end of this document regarding extracting from the IBM updater. The only other two things things you may want to include are the DOS commands MODE.COM and MORE.COM. MODE.COM will allow you to change the screen to more lines of characters. For example, this command will make the DOS screen display 50 lines of text: "MODE CON LINES=50 " Once you have all of the necessary files together, place them on the DOS bootable media. Remember, they must follow 8.3 convention for file names. If you need further info on how to do this, see the bottom of the page for creating Bart's Bootable CD-ROM. HARDWARE/SOFTWARE SYMPTOMS OF A FAILED CARD ============================================================ When the LINKSYS WPC11 v3 card was inserted into the PCMCIA socket, the LED lamp labeled as "Power" illuminates for a few seconds, and then goes out, probably the hardware timing out. When using "pccardctl status ; pccardctl ident ; pccardctl info " in Linux, it reports nothing as plugged in, again, hardware failure. When I used the older FLASH.EXE tools to do anything on the card, it kept reporting that the Busy Bit was never cleared, or when using Host-Flash method it could not identify the right Flash-Memory type, and failed. It reported nothing under card status with the FLASH tool, all identify sections failed. NOTE: This could have also failed because the wrong Initial firmware was loaded in RAM, and/or no Primary firmware was loaded in flash memory. So therefore, this info may be helpful to those who are in this situation, with a totally dead card, but have an original PDA and Firmware dump image of the card, or from the same model of another similar card. IDENTIFY CARD AND CORRECT FIRMWARE TO USE ============================================================ There are several firmware types to use, based on their file names. Make sure that you use the correct firmware for the right platform, based on the component ID. This can be determined by looking in the PDA file backup of the device, under record 0x0008. The Component ID for the Linksys WPC11 v3 is 801a. Based on this info, the PRISM Download manual says that this card has the following specs: A 3842 MAC Controller, Parallel (AMD type) flash memory, and 1(x16) RAM configuration. Therefore, using the charts, It needs to use Primary and Secondary firmware with the type F Release Code ID. For example, the firmware files PF010100.HEX and SF010704.HEX would work for this card, while the PK010100.HEX would not work. Make sure that you identify the right firmware to flash to the card based on your Component ID! However, I had not been able to come across functional Initial firmware for the Prism2.5/3 platforms until recently. The ones that most people know were I10003C0.HEX and I40003C0.HEX for Prism2 platforms only with a 3841 MAC. It worked on Prism2.5/3 cards with a 3842 MAC, but may have been causing other errors with firmware download. The new Initial firmware I found with an IBM package contained the Initial file named "ID010001.HEX." It says this is for a different Memory type (SST), but it seemed to also work for my platform, even though it say's it shouldn't work? So, this file will be the one used for programming in the example. NOTE: This Initial firmware may work for both the AMD and SST memory types because they are both "parallel" flash memory. There are other cards with "Large Serial" and "Small Serial" flash type memory. This Initial firmware MAY NOT WORK ON THESE CARDS CORRECTLY!! Use at your own risk! We need to use the backup firmware from the card, acquired using the Winupdate-0.7.0 tool. The option to select in Winupdate would be the "Export Entire Fimware Image". This can be named "FIRM.HEX" as an example. Also, the PDA needs to be backed up. This is done by selecting the "Export PDA" option in Winupdate. We will use the example name of "LINKSYS.PDA". Once the proper PDA record is edited with the correct MAC address (edit record 0x0101), we will save it as "LINKSYS1.PDA". I used a Hex Editor to do so. NOTE: This should have been done BEFORE the card died, or from a functioning same model card. Once you have all of these items together, we can go forward and flash the components. FLASHING A LINKSYS WPC11 version 3 PCMCIA CARD ============================================================ ==================== NOTE: This is to be used with the newer version of the FLASH.EXE, named in this document ILHOPFW.EXE from 04/24/2002! Also, if your Linksys WPC11 v3 card has a fried CIS, you need to re-flash with a firmware image dump HEX file created with Winupdate. If you cannot get this, you can try using the BroMax CIS HEX files included with the old we110.exe file, but I think these BroMax CIS HEX files are for Prism2 cards only, not Prism2.5/3. Try the BroMax method at your own risk! (NOTE: See CIS Card Section Below!!) UPDATE: The Bromax CIS files program the Card Information Structure at the wrong memory location for Prism2.5/3 cards. DO NOT USE these files on Prism2.5/3 cards with a 3842 MAC. Try obtaining a CIS from a firmware image of a similar card. (See CIS Section below.) The Linksys WPC11 v3 is actually an OEM BroMax WL300 wireless LAN card, but again those cards were Prism2.5/3, not Prism2 like the WE110. ==================== NOTE: Some of the commands differ in this version of FLASH.EXE. To check the new commands, issue this command to get a list: "ILHOPFW -? ". This will scroll through all of the options. Make sure when issuing these commands, you get the voltage right. I believe that the Linksys WPC11 v3 is dual voltage (both 5v and 3.3v), but it steps it down and runs natively at 3.3v. Therefore, when programming, use the -3v command switch. Also, depending of what the configuraton of your card is, you have to set the Hardware Configuration Register (HCR) on the card to allow programming. For the Linksys WPC11 v3, the HCR should be set to 0F07, as in the example below. Other cards may vary. See the flash.pdf and Download.pdf manuals from Intersil for understanding what HCR should be issued. When running the flash updates, it may report that some PDR records are missing. Do not worry about these, most are not necessary, others can be added as needed. To see which PDR records these are, refer to the "PRISM Driver Programmers Manual". NOTE: It issues commands regarding missing PDR records for PCI variables (Numbers 0x0402, 0x0403, and 0x0404). It believe this is caused because the FLASH.EXE version 0.5e 04.24.2002 is a custom MiniPCI type version, and will auto-prompt for these. You can ignore these however, we are programming PCMCIA type not PCI bus. It also complained of 0x0003, which is Serial Number, and 0x0005 which is NIC RAM Size. I think if you don't enter any values, then it will assume firmware default values instead. See the Driver Programmers Manual for more info on what the default values are. Let's start by booting into the DOS environment, and plugging the PCMCIA card into the slot (if your notebook has 2 PC Card slots, use Slot 0) NOTE: You may be able to skip the first three steps and just start from step 4 and re-program the firmware backup image, but I would not recommend this. Start from step one to see if the Initial, Primary, and Secondary can even be loaded/flashed. 1. Start the card with Initial Firmware: "ILHOPFW -legacy -3v -on -3842 0F07 -i ID010001.HEX -gen" If no errors are received, proceed to next step. 2. Then, download a primary firmware image to the card first (**see NOTE3 below): "ILHOPFW -legacy -3842 0F07 -gen -pf -p LINKSYS1.PDA -spi -hf -3v -on -d PF010100.HEX" If no flash programming errors are received, proceed to next step (exclude CIS/PDA errors) 3. Then, download a secondary firmware image to the card: "ILHOPFW -legacy -3842 0F07 -gen -pf -p LINKSYS1.PDA -spi -hf -3v -on -d SF010704.HEX" If no flash programming errors are received, proceed to next step (exclude CIS/PDA errors) 4. At this point, when you run "ILHOPFW -legacy -3v -status", it will show a corrupted PDA and CIS, but will show that there are HEX files in NVRAM. To restore the CIS, re-flash the firmware image dump hex file back to the card (This must be a dump from that card, or the same model of card!) NOTE: See Below section regarding the CIS for more info on CIS HEX files. "ILHOPFW -legacy -3v -on -3842 0F07 -i ID010001.HEX -gen" "ILHOPFW -legacy -3842 0F07 -gen -pf -p LINKSYS1.PDA -spi -hf -3v -on -d FIRM.HEX" If no flash programming errors are received, proceed to next step (exclude PDA errors) 5. Now, when running "ILHOPFW -legacy -3v -status", it should show the PDA from the firmware dump (possible different MAC address if from another card), and the firmware version from the firmware image dump, and also the CIS should be reporting correctly. Now let's re-update the PDA and firmware to the correct versions: "ILHOPFW -legacy -3v -on -3842 0F07 -i ID010001.HEX -gen" "ILHOPFW -legacy -3v -on -3842 0F07 -gen -p LINKSYS1.PDA -spi" "ILHOPFW -legacy -3842 0F07 -gen -pf -p LINKSYS1.PDA -spi -hf -3v -on -d PF010100.HEX" "ILHOPFW -legacy -3842 0F07 -gen -pf -p LINKSYS1.PDA -spi -hf -3v -on -d SF010704.HEX" 6. Now, when you run "ILHOPFW -legacy -3v -status", it should show everything correctly. The PDA, the primary and secondary firmware versions, and the correct CIS. 7. Everything should now be OK. Issue the command "ILHOPFW -legacy -3v -off" to shutdown the card before removing it from the machine. Try using the card in another OS on this machine to test the card, or eject it and use in another machine to test functionality. You should now have a functioning card. ** NOTE3: For the Linksys WPC11 v3, I could not use the PF010101.HEX primary firmware version (version 1.1.1). This would not initalize the card correctly when I brought it up in Linux with hostap. When I re-flashed it with PF010100.HEx (version 1.1.0), then it worked correctly. Therefore, it may have errors with certain firmware versions. Others have reported that using Winupdate afterward to perform the flash will allow 1.1.1 to be sucessfully flashed. I have not attempted to do so (I'm just glad I got my card working again at all...) TO EXTRACT THE NEW FLASH.EXE and INITIAL FIRMWARE FROM IBM UPDATER: ============================================================ Here are the locations of the necessary firmware updaters which need to have the tools & firmware extracted: THE FIRMWARE CONTAINING ILHOPFW.EXE (New FLASH.EXE 4/24/2002) 1. ftp://ftp.software.ibm.com/pc/pccbbs/mobiles/tphrwf1i.exe MD5 Checksum: 349faeab635e17b817c91ce7d5715e0a 2. ftp://ftp.software.ibm.com/pc/pccbbs/mobiles/tphrwf1i.txt MD5 Checksum: 6915522968443c4f6f5dd82826d9e81c THE FIRMWARE CONTAINING ID010001.HEX firmware image 1. ftp://ftp.software.ibm.com/pc/pccbbs/mobiles/wirefirm.exe MD5 Checksum: b285609f22060a9071cd8766c8bdc207 2. ftp://ftp.software.ibm.com/pc/pccbbs/mobiles/wirefirm.txt MD5 Checksum: 948aad77c5bacfe4dadbf3b0ece36dff EXTRACTED FILE CHECKSUMS: 1. ID010001.HEX - ca5d5c0273f903489455bbe7db08d91e2. ILHOPFW.EXE - 8198aae159f3619ebe18a1ee324202c23. ILHOPFW.INI - b67611bca0a00aeaee56cff30167bc41 To extract, run the .EXE's. It will initiate setup. Hit "yes" on the legal agreement, and stop when it gets to the first IBM splash screen. It will create the following directories : "C:\drivers\WIN\WLLANINT" - for the tphrwf1i.exe file "C:\drivers\WIN\WLLANACT" - for the wirefirm.exe file Leave the IBM setup on the first screen in the background, and in these two directories, copy the following files out to a temporary location: "C:\drivers\WIN\WLLANINT\1iwg05ww.IMG" - for the tphrwf1i.exe file "C:\drivers\WIN\WLLANACT\1awg06ww.IMG" - for the wirefirm.exe file Once copied, cancel the setup for the firmware. Then, use a program to extract the contents of the floppy images (like MagicISO or Winimage) to get the FLASH programs and ID010001.HEX files. So, from the 1iwg05ww.IMG disk image, extract the ILHOPFW.EXE and ILHOPFW.INI files. They can be renamed to FLASH.EXE and FLASH.INI if you want to make it easier to use on your updater disk. Then, from the 1awg06ww.IMG disk image, we only need to extract the ID010001.HEX initial firmware file. Also, in this file, there is the PF010100.HEX and SF010402.HEX files. However, they have a different size and checksum compared to the normal PRISM flash files. DO NOT use these files, they are probably for the IBM MiniPCI only. RE-PROGRAMMING A PRISM2.5/3 Card Information Structure (CIS) ============================================================ For a while now, I have seen how people are having problems with Prism2.5/3 CIS restoring. I am looking into a way to properly change and/or restore a card's CIS structure. I was going to include it in this document, but it gets too long. Please see my document on CIS restore to get more information about this, and what I have learned regarding programming the CIS. Also, as stated above, DO NOT use the BroMax HEX files that were included with the we110.exe file's ROMCODE directory on ANY Prism2.5/3 cards. These HEX files are for Prism2 cards with a 3841 MAC only! They program the wrong location in memory, and will not work. Please see the CIS document to get more info on the right HEX files to program and restore a CIS data structure. CREATING A DOS BOOTABLE DOS CD-ROM DISC ============================================================ I have also decided to create a separate document for this, it will add too much space. Please see that document on how to create a bootable CD disc for flashing PRISM platforms.