RT-N66U Jtag

Post new topic   Reply to topic    DD-WRT Forum Index -> Broadcom SoC based Hardware
Goto page 1, 2, 3, 4, 5  Next
Author Message
barryware
DD-WRT Guru


Joined: 26 Jan 2008
Posts: 13049
Location: Behind The Reset Button

PostPosted: Sat Jul 28, 2012 20:01    Post subject: RT-N66U Jtag Reply with quote
In preparation for flashing the rt-ac66u cfe to the rt-n66, I thought I would play with jtag on the rt-n66u..

J2 sure looks like a jtag header. Using an ohm meter, it tests out.

I thought it would be a standard pin out.

1 = nTrst
3 = tdi
5 = tdo
7 = tms
9 = tck

2 ~ 10 = ground

Using the latest release of tjtag (donation version), a probeonly yields all fffff's.. (cable not connected, etc.)

I spent some time hunting & switching pins.. Never got it to see the processor.. even though tjtag may not "recognize" the processor, it will see it.

What I will call the "standard" pinout as posted above.. this config did show that it may be working.

This was the only config that would change the status of the led's doing a probeonly. The power light would go out, and the internet light, the 2.4, and the 5ghz lights would glow dim..

Any other wire configs, had no effect. So I believe the standard pinout is correct.

I (we) need a little help from the rest of the "gearheads" on the forum to get this sorted out.

Anyone else played with jtag on this router?

_________________
[Moderator Deleted] Shocked
Sponsor
GH0
DD-WRT User


Joined: 05 Dec 2008
Posts: 249

PostPosted: Sat Jul 28, 2012 23:22    Post subject: Reply with quote
I haven't purchased any JTAG hardware (I hope to eventually, just pretty sketchy on what to buy).

The only people that I know have, are fractal. No one else has to my knowledge.
Dark_Shadow
DD-WRT Guru


Joined: 31 Aug 2009
Posts: 2448
Location: Third Rock from the Sun

PostPosted: Tue Jul 31, 2012 4:57    Post subject: Reply with quote
was doing some searching and found

http://svn.dd-wrt.com/browser/src/linux/brcm/linux-2.6.23/brcm/include/hndjtagdefs.h?rev=17355

dunno if it will help.

Did you solder your header on top or bottom of the PCB? I noticed that if it is on top it will interfere with the cover on the router. Thinking of putting mine on the bottom, at least if i have to cut a hole it will be through the bottom of the case.

_________________
Peacock Thread-FAQ -- dd-wrt Wiki

Testing Multiple Routers -- Bootloader Collection Project -- My Wiki
barryware
DD-WRT Guru


Joined: 26 Jan 2008
Posts: 13049
Location: Behind The Reset Button

PostPosted: Tue Jul 31, 2012 23:43    Post subject: Reply with quote
Dark_Shadow wrote:
Did you solder your header on top or bottom of the PCB? I noticed that if it is on top it will interfere with the cover on the router. Thinking of putting mine on the bottom, at least if i have to cut a hole it will be through the bottom of the case.

The top.. I pushed the pins through the pcb just a bit before soldering so they do not interfere.. There is a plate on the bottom of the pcb that had to be removed to solder, then put back.

_________________
[Moderator Deleted] Shocked
Dark_Shadow
DD-WRT Guru


Joined: 31 Aug 2009
Posts: 2448
Location: Third Rock from the Sun

PostPosted: Wed Aug 01, 2012 4:22    Post subject: Reply with quote
Still working on my header

What about

http://www.jtagtest.com/pinouts/lattice_ispdownload10

Pin 2 though 10 even test ground?

_________________
Peacock Thread-FAQ -- dd-wrt Wiki

Testing Multiple Routers -- Bootloader Collection Project -- My Wiki
barryware
DD-WRT Guru


Joined: 26 Jan 2008
Posts: 13049
Location: Behind The Reset Button

PostPosted: Wed Aug 01, 2012 16:29    Post subject: Reply with quote
Dark_Shadow wrote:
Still working on my header

What about

http://www.jtagtest.com/pinouts/lattice_ispdownload10

Pin 2 though 10 even test ground?

pin 2 ~ 10 are indeed ground but that doesn't mean that tck, tms, ~, etc. are not correct in your link.

I may not have tried your link on purpose.. but when I was messing with it.. I made a "map" of pins & wires and tested what I believe was every possible combination (kind of like a game of sudoku Razz ). It didn't take too long for confusion to set in and I may have missed one or two combinations.

As stated earlier.. My 1st config was the only config that would change the status of the leds upon a probeonly but as also said, I may have missed / messed up a connection combination.

I'll keep at it as time permits.

Even though tjtag may not recognize the processor, it should still see it if connected properly. Instead of all ff's for the processor id, it should have some other type of hex id code which it never did.

Maybe possible that J2 may not be jtag at all?? dunno.

Maybe a couple of the guys that have a fast track to asus (Rmerlin, andyMS) could ask asus for the jtag pin out.
Once I am certain of the pinout, I can try to get a hold of T~ and ask for assistance with the software.

_________________
[Moderator Deleted] Shocked
Dark_Shadow
DD-WRT Guru


Joined: 31 Aug 2009
Posts: 2448
Location: Third Rock from the Sun

PostPosted: Thu Aug 02, 2012 23:34    Post subject: Reply with quote
Using your pinouts with the TUMPA and zJTAG I got

Code:
I:\zjtag>zjtag -probeonly

        ==============================================
               TUMPA EJTAG Debrick Utility V0.3
        ==============================================

 Set I/O speed to 30000 KHz

USB TAP device has been initialized. Please confirm VREF signal connected!
Press any key to continue... ONCE target board is powered on!

Probing bus ... Done

Detected IR Length is 1

CPU Chip ID: 01011111011011001111101101011100 (5F6CFB5C)
    CPU Manufature:Unknow(B5C)
    CPU Device ID :F6CF
    CPU Revision  :5

*** Detected a CPU but not in build-in list ***

*** You can set /skipdetect let operate continue ***


Created a ticket on the zJTAG forum

http://www.tiaowiki.com/forums/index.php/topic,4102.0.html

EDIT: Added /skipdetect and zjtag frooze

Code:
I:\zjtag>zjtag -probeonly /skipdetect

        ==============================================
               TUMPA EJTAG Debrick Utility V0.3
        ==============================================


 Set I/O speed to 30000 KHz

USB TAP device has been initialized. Please confirm VREF signal connected!
Press any key to continue... ONCE target board is powered on!

Probing bus ... Done

Detected IR Length is 1

CPU assumed running under LITTLE endian

CPU Chip ID: 01011011011011001111001101011100 (5B6CF35C)
*** CHIP DETECTION OVERRIDDEN ***

    - EJTAG IMPCODE ....... : 11111111111011111111011111011011 (FFEFF7DB)
    - EJTAG Version ....... : Unknown (7 is a reserved value)
    - EJTAG DMA Support ... : No
    - EJTAG Implementation flags: R3k DINTsup ASID_8 ASID_6 MIPS16 NoDMA MIPS64

Issuing Processor / Peripheral Reset ... Done
Enabling Memory Writes ... Skipped
Halting Processor ... <Processor Entered Debug Mode!> ...


EDIT2: Tried v0.4 and v0.5 with same results

_________________
Peacock Thread-FAQ -- dd-wrt Wiki

Testing Multiple Routers -- Bootloader Collection Project -- My Wiki


Last edited by Dark_Shadow on Thu Aug 02, 2012 23:58; edited 1 time in total
barryware
DD-WRT Guru


Joined: 26 Jan 2008
Posts: 13049
Location: Behind The Reset Button

PostPosted: Thu Aug 02, 2012 23:57    Post subject: Reply with quote
if you have an sd card installed.. remove it..

talking to some of the other hardware guru's.. it may be that the jtag gpio is being used for the sd card reader.. not confirmed.. but probable..

I can't get back at it till the weekend.. So.. it appears that the std jtag pinout is valid..

Is that how you have it connected (per my 1st post)?

Nice work!

_________________
[Moderator Deleted] Shocked
Dark_Shadow
DD-WRT Guru


Joined: 31 Aug 2009
Posts: 2448
Location: Third Rock from the Sun

PostPosted: Fri Aug 03, 2012 0:13    Post subject: Reply with quote
yes, pinouts in first post, i will try with the sd crd removed
_________________
Peacock Thread-FAQ -- dd-wrt Wiki

Testing Multiple Routers -- Bootloader Collection Project -- My Wiki
Dark_Shadow
DD-WRT Guru


Joined: 31 Aug 2009
Posts: 2448
Location: Third Rock from the Sun

PostPosted: Fri Aug 03, 2012 0:19    Post subject: Reply with quote
Dark_Shadow wrote:
yes, pinouts in first post, i will try with the sd crd removed


Alrighty then. with sd card removed got past halting processor and hung at clearing watchdog, so

Code:
I:\zjtag>zjtag -probeonly /skipdetect /nocwd

        ==============================================
               TUMPA EJTAG Debrick Utility V0.5
        ==============================================


 Set I/O speed to 30000 KHz

USB TAP device has been initialized. Please confirm VREF signal connected!
Press any key to continue... ONCE target board is powered on!

Probing bus ... Done

Detected IR Length is 1

CPU assumed running under LITTLE endian

CPU Chip ID: 01011011011011001111101101011100 (5B6CFB5C)
*** CHIP DETECTION OVERRIDDEN ***

    - EJTAG IMPCODE ....... : 11111111111011111111011111011011 (FFEFF7DB)
    - EJTAG Version ....... : Unknown (7 is a reserved value)
    - EJTAG DMA Support ... : No
    - EJTAG Implementation flags: R3k DINTsup ASID_8 ASID_6 MIPS16 NoDMA MIPS64

Issuing Processor / Peripheral Reset ... Done
Enabling Memory Writes ... Skipped
Halting Processor ... <Processor did NOT enter Debug Mode!> ... Done
Clearing Watchdog ... Skipped
Loading CPU Configuration Code ... Skipped

Probing Flash at Address: 0x1FC00000 ...

_________________
Peacock Thread-FAQ -- dd-wrt Wiki

Testing Multiple Routers -- Bootloader Collection Project -- My Wiki
barryware
DD-WRT Guru


Joined: 26 Jan 2008
Posts: 13049
Location: Behind The Reset Button

PostPosted: Fri Aug 03, 2012 0:35    Post subject: Reply with quote
to give credit where credit is do..

LOM was the one that directed me to the jtag gpio being used for the sd card reader.

When I was messing with it.. I did not remove the sd card..

Ya gotta love LOM..

_________________
[Moderator Deleted] Shocked
Dark_Shadow
DD-WRT Guru


Joined: 31 Aug 2009
Posts: 2448
Location: Third Rock from the Sun

PostPosted: Fri Aug 03, 2012 0:40    Post subject: Reply with quote
Yup, no just to get it to do the flash chip right.
_________________
Peacock Thread-FAQ -- dd-wrt Wiki

Testing Multiple Routers -- Bootloader Collection Project -- My Wiki
Dark_Shadow
DD-WRT Guru


Joined: 31 Aug 2009
Posts: 2448
Location: Third Rock from the Sun

PostPosted: Fri Aug 03, 2012 0:55    Post subject: Reply with quote
Now i'm gettin somewhere, had to change the I/O speed

Code:
I:\zjtag>zjtag -probeonly /skipdetect /nocwd /L1:3

        ==============================================
               TUMPA EJTAG Debrick Utility V0.5
        ==============================================


 Set I/O speed to 7500 KHz

USB TAP device has been initialized. Please confirm VREF signal connected!
Press any key to continue... ONCE target board is powered on!

Probing bus ... Done

Detected IR Length is 0

CPU assumed running under LITTLE endian

CPU Chip ID: 00000000000000000000000000000000 (00000000)
*** CHIP DETECTION OVERRIDDEN ***

    - EJTAG IMPCODE ....... : 00000000000000000000000000000000 (00000000)
    - EJTAG Version ....... : 1 or 2.0
    - EJTAG DMA Support ... : Yes
    - EJTAG Implementation flags: R4k MIPS32

Issuing Processor / Peripheral Reset ... Done
Enabling Memory Writes ... Done
Halting Processor ... <Processor did NOT enter Debug Mode!> ... Done
Clearing Watchdog ... Skipped
Loading CPU Configuration Code ... Skipped

Probing Flash at Address: 0x1FC00000 ...
Detected Chip ID (VenID:DevID = 0000 : 0000)
*** Unknown or NO Flash Chip Detected ***


 *** REQUESTED OPERATION IS COMPLETE ***

_________________
Peacock Thread-FAQ -- dd-wrt Wiki

Testing Multiple Routers -- Bootloader Collection Project -- My Wiki
Dark_Shadow
DD-WRT Guru


Joined: 31 Aug 2009
Posts: 2448
Location: Third Rock from the Sun

PostPosted: Fri Aug 03, 2012 0:57    Post subject: Reply with quote
damn, thats not gonna work, lost the CPU
_________________
Peacock Thread-FAQ -- dd-wrt Wiki

Testing Multiple Routers -- Bootloader Collection Project -- My Wiki
LOM
DD-WRT Guru


Joined: 28 Dec 2008
Posts: 7647

PostPosted: Fri Aug 03, 2012 2:56    Post subject: Reply with quote
The IR length of 1 is wrong, it should be either 5 or 32 depending on which mode the jtag TAP controller is in.
Can you override that on the cmd line?

_________________
Kernel panic: Aiee, killing interrupt handler!
Goto page 1, 2, 3, 4, 5  Next Display posts from previous:    Page 1 of 5
Post new topic   Reply to topic    DD-WRT Forum Index -> Broadcom SoC based Hardware All times are GMT

Navigation

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You can attach files in this forum
You can download files in this forum