Posted: Fri May 15, 2009 1:45 Post subject: Linksys WRT54GL V1.1 Jtag Pinouts
Hi all you guru's
I know about J2 but I am trying to find out some information on where the jtag connects to i.e which ic's or components or which parts of the circuit board?
Joined: 26 Jan 2008 Posts: 13049 Location: Behind The Reset Button
Posted: Fri May 15, 2009 3:24 Post subject:
There are two stickies.. One deals with the jtag utility, the other with pinouts as well as hundreds, if not thousands of threads in regards to your question.
Lets not forget about the wiki.
Near the top of your screan, there is also a tab called "search".
That should get you started. _________________ [Moderator Deleted]
There are two stickies.. One deals with the jtag utility, the other with pinouts as well as hundreds, if not thousands of threads in regards to your question.
Lets not forget about the wiki.
Near the top of your screan, there is also a tab called "search".
That should get you started.
Hi Barry,
I have been through the 2 stickies and looked at the wiki as well but cannot find this information, maybe I must be dumb. Could you point me to a few threads please.
Joined: 26 Jan 2008 Posts: 13049 Location: Behind The Reset Button
Posted: Sat May 16, 2009 5:02 Post subject:
newboy wrote:
Hi Barry,
I have been through the 2 stickies and looked at the wiki as well but cannot find this information, maybe I must be dumb. Could you point me to a few threads please.
That is not the information I am after. What I am really after is if anybody knows where the Jtag connections from (JP1) connects to. i.e if those connections connect direct back to the BCM5352 Chip IC it self and if so what pins on the IC.
The Linksys WRT54GL uses the same processor & flash chip, like the Asus unit both have a Serial connection, but the Linksys unit have a Jtag connection, which the Asus one does not have. This is where it makes it mearly impossible to recover them from a bad flash, if the CFE is damaged. A lot of the newer routers or most of them comming out now only have serial connections, unless we find some way to crack these when they are bricked they will all end up in the dumpmaster.
My thought is there are alot of very intellegent minds out there and as the Linksys WRT54GL is a very popular somebody might have an insight to this information someware, so if we know or get as much info as possible I could then dig further with the Asus unit and try to find these connections and see the chances of Jtaggging the unit.
I know there are lot of people with the Asus unit which is a very robust unit facing the same predicament like me.
barryware wrote:
I suppose you could find a data sheet on the processor and get your information from there.
I wish it was that easy as I have been looking for months for this information,hence this post.
I remember talking to eko about this...he thinks that the data lines were never pulled out on the mobo for the unit...the processor has JTAG pins...but no traces to the outside world for us to connect to.
redhawk _________________ The only stupid question....is the unasked one.
I remember talking to eko about this...he thinks that the data lines were never pulled out on the mobo for the unit...the processor has JTAG pins...but no traces to the outside world for us to connect to.
redhawk
Hi Redhawk,
Nice to hear from you on this thread, its a good feeling that I am not alone on this quest. The 2 units hardware wise have very little difference, the main components that intrest us is the processor and the flash chip, this is why I thought the Linksys unit is the most popular of the 2 units and somebody would have had a good poke around, and would have some information. The painfull part is that it uses a SOIC (BGA) type chip which is a pain to gain access to, I have traced as close as possible to the chip, but the tracks get lost from just under the edge of the chip, very close but yet so far.
From your knowledge is there anyway we could directly write to the flash chip?. Another thought crossed my mind was to see if we could clone another flash chip and replace it on the faulty unit, but trying to find a SMD type TSOP socket is another thing alltogeather.
I too have a backup of the CFE, but what good is it to us at this very moment unless we could find a method to be able to flash it. There has to be a way how they do it in production.
Joined: 04 Jan 2007 Posts: 11564 Location: Wherever the wind blows- North America
Posted: Sat May 16, 2009 16:22 Post subject:
newboy wrote:
Hi Redhawk,
Nice to hear from you on this thread, its a good feeling that I am not alone on this quest. The 2 units hardware wise have very little difference, the main components that intrest us is the processor and the flash chip, this is why I thought the Linksys unit is the most popular of the 2 units and somebody would have had a good poke around, and would have some information. The painfull part is that it uses a SOIC type chip which is a pain to gain access to, I have traced as close as possible to the chip, but the tracks get lost from just under the edge of the chip, very close but yet so far.
From your knowledge is there anyway we could directly write to the flash chip?. Another thought crossed my mind was to see if we could clone another flash chip and replace it on the faulty unit, but trying to find a SMD type TSOP socket is another thing alltogeather.
I too have a backup of the CFE, but what good is it to us at this very moment unless we could find a method to be able to flash it. There has to be a way how they do it in production.
Well...The flash chip can be flashed directly...but would require some elaborate and expensive equipment (Thousands of USD)...its much cheaper to buy a crate of routers.
However, you could flash another units flash chip with whatever CFE you want....remove it and solder it onto this unit....but again...is it really worth all that time spend and multiple chances at pin damage....and still very little chance of troubleshooting if a problem should arise in the middle of the process.
Personally, I think not....but everyone is entitled to his own hobbies.
(however, the idea of "conquering the defective router" does have some appeal...I must admit) :lol:
Many of the manufactures flash the chips first...then install them on the mobo preprogrammed....it is the most efficient way of doing the flash....and doesn't slow production.
redhawk _________________ The only stupid question....is the unasked one.
However, you could flash another units flash chip with whatever CFE you want....
redhawk
Hi Redhawk,
Thanks for the informative reply, this might be totally wacky but is it possible, or what are you thoughts on the following.
I take a backup of the CFE from both see if I could compare the 2, I guess it might have a zellion differences, maybe make changes where possible and flash the A one on the L unit and see what happens, this way at least if the L unit goes belly up, we can always recover it using the Jtag method.
Quote:
(however, the idea of "conquering the defective router" does have some appeal...I must admit)
Agreed hate to give up without trying, have this terrible itch.