E1000 V1 - Wrt160N V3 Jtag

Post new topic   Reply to topic    DD-WRT Forum Forum Index -> Broadcom SoC based Hardware
Author Message
barryware
DD-WRT Guru


Joined: 26 Jan 2008
Posts: 12836
Location: Behind The Reset Button

PostPosted: Sat Oct 22, 2011 20:41    Post subject: E1000 V1 - Wrt160N V3 Jtag Reply with quote
As most know.. The wrt160n v3 & the E1000 v1 are identical in regards to hardware.

As most know, Linksys has disabled the jtag circuit in these routers by leaving out smt components (just like the 610 v2 & E3000)

I'll link this in another thread where a dd-wrt member needs jtag for this router.

I traced the jtag header to the missing components. What needs to be done, is to bridge the pads on the pcb. There are 5 pads that need to be bridged.

Four can be found on the bottom of the pcb, and one on the top.

They are marked R64, R65, R66, R67, & R68.

R67 is on the top side of the pcb, and the rest on the bottom.

Attached are pics showing the pads that need to be bridged as well as the jtag output doing a -probeonly.

The ribbon cable you will see in one of the pics, is connected to a serial header I hot glued to the side of the pcb. This router I purchased to assist the devs (Eko) in porting dd-wrt to this router. Cuz we bricked it many times, pogo pins to the serial pads would not do. I needed something I could connect to many times.

Jtag Header:

Pin 1: nTRSt - R64
Pin 3: TDI - R65
Pin 5: TDO - R66
Pin 7: TMS - R67
Pin 9: TCK - R68

Even numbered pins: 2 ~ 12 - Ground (I use pin 6)

Jtag output:

C:\E1000>tjtag302 -probeonly

==============================================
EJTAG Debrick Utility v3.0.2 RC2-1 Tornado-MOD
==============================================

Selected port = 0x378

Intial value of Control register is 000000CC
Intial value of status register is 0000007F
01111111 (0000007F)

Status bit 7 Busy Inverted pin 11 = 1
Status bit 6 *Ack pin 10 = 1
Status bit 5 Paper-out pin 12 = 1
Status bit 4 Select pin 13 = 1
Status bit 3 *Error pin 15 = 1
* means low = true, e.g., *Error

VCC connected
values of Control register after init 0x000000CC
value of status register after init 0x0000007F
system reset complete

Detected IR chain length = 32
Number of device(s) = 1

idcode 0x000a817f 32
Jtag is in LV mode
switching to MIPS mode
Probing bus ... Done

Instruction Length set to 5

CPU Chip ID: 00010000000010001100000101111111 (1008C17F)
*** Found a Broadcom BCM5356A1 KFGB REV 1 CPU chip ***

- EJTAG IMPCODE ....... : 01100000010000010100000000000000 (60414000)
- EJTAG Version ....... : 3.1
- EJTAG DMA Support ... : No
- EJTAG Implementation flags: R4k ASID_8 MIPS16 NoDMA MIPS32

Issuing Processor / Peripheral Reset ... Done
Enabling Memory Writes ... Skipped
Halting Processor ... <Processor Entered Debug Mode!> ... Done
Init PrAcc ... Done
Clearing Watchdog ... Done


Chip ID b83a
Chip Rev 0
Package Options 2
Number of Cores 5
Core Revision 63
Core Type 8830
Core Vendor ID 15200000
Flash Type 100
Flash Type = SFLASH_ST
Dest is bits 0
Dest is bits1 0
Dest is bits 0
Flash is byteswapped 0
Endian Type is LE 0
PLL Type 00000000
00000000000000000000000000000000 (00000000)
00000000000000000000000000000000 (00000000)
00000000000000000000000000010010 (00000012)
Done

Flash Vendor ID: 00000000000000000000000011000010 (000000C2)
Flash Device ID: 00000000000000000010000000010110 (00002016)
*** Found a Macronix MX25L3205D (4MB) Serial Flash Chip ***

- Flash Chip Window Start .... : 1FC00000
- Flash Chip Window Length ... : 00400000
- Selected Area Start ........ : 00000000
- Selected Area Length ....... : 00000000



*** REQUESTED OPERATION IS COMPLETE ***


C:\E1000>



R67.jpg
 Description:
 Filesize:  123.8 KB
 Viewed:  23816 Time(s)

R67.jpg



R64+.jpg
 Description:
 Filesize:  97.73 KB
 Viewed:  23816 Time(s)

R64+.jpg



_________________
[Moderator Deleted] Shocked
Sponsor
Murrkf
DD-WRT Guru


Joined: 22 Sep 2008
Posts: 11223

PostPosted: Sun Oct 23, 2011 5:21    Post subject: Reply with quote
I am not sure most will understand what you have done.

But, as always, very fine work BW! This is exceptionally useful.

_________________
SIG:
I'm trying to teach you to fish, not give you a fish. If you just want a fish, wait for a fisherman who hands them out. I'm more of a fishing instructor. So See this:
http://i31.tinypic.com/24mz3ms.png

LOM: "If you show that you have not bothered to read the forum announcements or to follow the advices in them then the level of help available for you will drop substantially, also known as Murrkf's law.."
Bird333
DD-WRT Guru


Joined: 07 Jun 2006
Posts: 807

PostPosted: Sun Oct 23, 2011 14:45    Post subject: Reply with quote
Great work once again.
barryware
DD-WRT Guru


Joined: 26 Jan 2008
Posts: 12836
Location: Behind The Reset Button

PostPosted: Sun Oct 23, 2011 21:11    Post subject: Reply with quote
Mr. Green
_________________
[Moderator Deleted] Shocked
Murrkf
DD-WRT Guru


Joined: 22 Sep 2008
Posts: 11223

PostPosted: Sun Oct 23, 2011 23:05    Post subject: Reply with quote
Wikis have been updated to link to this thread.
_________________
SIG:
I'm trying to teach you to fish, not give you a fish. If you just want a fish, wait for a fisherman who hands them out. I'm more of a fishing instructor. So See this:
http://i31.tinypic.com/24mz3ms.png

LOM: "If you show that you have not bothered to read the forum announcements or to follow the advices in them then the level of help available for you will drop substantially, also known as Murrkf's law.."
bail_w
DD-WRT User


Joined: 16 Dec 2008
Posts: 57

PostPosted: Sat Nov 12, 2011 17:25    Post subject: Reply with quote
Quote:
Jtag Header:

Pin 1: nTRSt - R64
Pin 3: TDI - R65
Pin 5: TDO - R66
Pin 7: TMS - R67
Pin 9: TCK - R68

Even numbered pins: 2 ~ 12 - Ground (I use pin 6)


Correct me if i am wrong, the following is how i should connect the db-25 and router.

DB-25 / Jtag Header of the PCB / Pads
nTRst / Pin 1 / R64
TDI / Pin 3 / R65
TDO / Pin 5 / R66
TMS / Pin 7 / R67
TCK / Pin 9 / R68
lameandboard
DD-WRT User


Joined: 20 Nov 2009
Posts: 58

PostPosted: Wed Jan 11, 2012 10:56    Post subject: Linksys E1000 v1 Reply with quote
Guy please help... my E1000 v1 bricked randomly after a reset. and I'm a moron and burnt out the RX and TX connections on the board so I can't solder to them, is there any other rx and tx connection points on this board. so I can debrick? or should i just toss this in the trash?

The connections I burnt out were at TP13 and TP14
barryware
DD-WRT Guru


Joined: 26 Jan 2008
Posts: 12836
Location: Behind The Reset Button

PostPosted: Wed Jan 11, 2012 13:37    Post subject: Reply with quote
There is no other "serial" connection points. This thread explains how to enable jtag on the router.

All you need to do is erase nvram and kernel, then flash the right firmware via tftp.

Take no offense but if you don't quite have the skills for a serial connection, you may not be successful enabling and using jtag without further pcb damage.

You may want to consider sending your router to someone to fix. There are many on the forum that do this. It would depend on where you are located.

_________________
[Moderator Deleted] Shocked
lameandboard
DD-WRT User


Joined: 20 Nov 2009
Posts: 58

PostPosted: Thu Jan 12, 2012 1:39    Post subject: Reply with quote
im in NJ. i got the jtag. thanks. i know i hijacked this thread, but i figured you knew what you were talking about.
lameandboard
DD-WRT User


Joined: 20 Nov 2009
Posts: 58

PostPosted: Thu Jan 12, 2012 1:41    Post subject: Reply with quote
when i was soldering to the serial connection one of the pads just came off right away as soon as i touched it.. then i burnt it trying to get a connection.
barryware
DD-WRT Guru


Joined: 26 Jan 2008
Posts: 12836
Location: Behind The Reset Button

PostPosted: Thu Jan 12, 2012 14:17    Post subject: Reply with quote
lameandboard wrote:
when i was soldering to the serial connection one of the pads just came off right away as soon as i touched it.. then i burnt it trying to get a connection.


Yea.. I messed up one also before I started using pogo pins on these routers. It is easy to do (lift a pad off the pcb).

_________________
[Moderator Deleted] Shocked
lameandboard
DD-WRT User


Joined: 20 Nov 2009
Posts: 58

PostPosted: Fri May 25, 2012 1:52    Post subject: Reply with quote
Has anyone overclocked the E1000 v1? if so whats the highest you've gotten it to without any issues?
sf1
DD-WRT Novice


Joined: 28 Nov 2013
Posts: 14

PostPosted: Fri Nov 29, 2013 21:45    Post subject: Reply with quote
What kind of cable do I need for this?

Thanks
Display posts from previous:    Page 1 of 1
Post new topic   Reply to topic    DD-WRT Forum Forum Index -> Broadcom SoC based Hardware All times are GMT

Navigation

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You can attach files in this forum
You can download files in this forum