Linksys WRT54GL V1.1 Jtag Pinouts

Post new topic   Reply to topic    DD-WRT Forum Forum Index -> Broadcom SoC based Hardware
Author Message
newboy
DD-WRT Novice


Joined: 18 Sep 2008
Posts: 42

PostPosted: Fri May 15, 2009 1:45    Post subject: Linksys WRT54GL V1.1 Jtag Pinouts Reply with quote
Hi all you guru's

I know about J2 but I am trying to find out some information on where the jtag connects to i.e which ic's or components or which parts of the circuit board?

Any information would be greatly appriciated.

Newboy
Sponsor
barryware
DD-WRT Guru


Joined: 26 Jan 2008
Posts: 12737
Location: Behind The Reset Button

PostPosted: Fri May 15, 2009 3:24    Post subject: Reply with quote
There are two stickies.. One deals with the jtag utility, the other with pinouts as well as hundreds, if not thousands of threads in regards to your question.

Lets not forget about the wiki.

Near the top of your screan, there is also a tab called "search".

That should get you started.

_________________
[Moderator Deleted] Shocked
newboy
DD-WRT Novice


Joined: 18 Sep 2008
Posts: 42

PostPosted: Fri May 15, 2009 4:08    Post subject: Reply with quote
barryware wrote:
There are two stickies.. One deals with the jtag utility, the other with pinouts as well as hundreds, if not thousands of threads in regards to your question.

Lets not forget about the wiki.

Near the top of your screan, there is also a tab called "search".

That should get you started.


Hi Barry,

I have been through the 2 stickies and looked at the wiki as well but cannot find this information, maybe I must be dumb. Could you point me to a few threads please.
StillLearning
DD-WRT User


Joined: 22 Jul 2007
Posts: 60

PostPosted: Sat May 16, 2009 4:55    Post subject: Reply with quote
Could the connections come directly form the Broadcom BCM5352 Chip?. Would anybody know what pins or connections?.
barryware
DD-WRT Guru


Joined: 26 Jan 2008
Posts: 12737
Location: Behind The Reset Button

PostPosted: Sat May 16, 2009 5:02    Post subject: Reply with quote
newboy wrote:

Hi Barry,

I have been through the 2 stickies and looked at the wiki as well but cannot find this information, maybe I must be dumb. Could you point me to a few threads please.


http://www.dd-wrt.com/phpBB2/viewtopic.php?t=51701&postdays=0&postorder=asc&start=78

_________________
[Moderator Deleted] Shocked
newboy
DD-WRT Novice


Joined: 18 Sep 2008
Posts: 42

PostPosted: Sat May 16, 2009 9:04    Post subject: Reply with quote
barryware wrote:

http://www.dd-wrt.com/phpBB2/viewtopic.php?t=51701&postdays=0&postorder=asc&start=78


That is not the information I am after. What I am really after is if anybody knows where the Jtag connections from (JP1) connects to. i.e if those connections connect direct back to the BCM5352 Chip IC it self and if so what pins on the IC.
barryware
DD-WRT Guru


Joined: 26 Jan 2008
Posts: 12737
Location: Behind The Reset Button

PostPosted: Sat May 16, 2009 12:00    Post subject: Reply with quote
I don't know.. Why would someone need to know that? Just curious..

I suppose you could find a data sheet on the processor and get your information from there.

_________________
[Moderator Deleted] Shocked
newboy
DD-WRT Novice


Joined: 18 Sep 2008
Posts: 42

PostPosted: Sat May 16, 2009 13:06    Post subject: Reply with quote
barryware wrote:
I don't know.. Why would someone need to know that? Just curious..


Hi Barryware,

The reason for this is this thread, http://www.dd-wrt.com/phpBB2/viewtopic.php?t=38178 Which I learned a lot I did not know about.

The Linksys WRT54GL uses the same processor & flash chip, like the Asus unit both have a Serial connection, but the Linksys unit have a Jtag connection, which the Asus one does not have. This is where it makes it mearly impossible to recover them from a bad flash, if the CFE is damaged. A lot of the newer routers or most of them comming out now only have serial connections, unless we find some way to crack these when they are bricked they will all end up in the dumpmaster.

My thought is there are alot of very intellegent minds out there and as the Linksys WRT54GL is a very popular somebody might have an insight to this information someware, so if we know or get as much info as possible I could then dig further with the Asus unit and try to find these connections and see the chances of Jtaggging the unit.

I know there are lot of people with the Asus unit which is a very robust unit facing the same predicament like me.

barryware wrote:


I suppose you could find a data sheet on the processor and get your information from there.


I wish it was that easy as I have been looking for months for this information,hence this post.

Hope it answers your question.
barryware
DD-WRT Guru


Joined: 26 Jan 2008
Posts: 12737
Location: Behind The Reset Button

PostPosted: Sat May 16, 2009 13:10    Post subject: Reply with quote
Got'cha.. Thats a good project. However, I can't help with the information you seek.

May the force be with you.

_________________
[Moderator Deleted] Shocked
redhawk0
DD-WRT Guru


Joined: 04 Jan 2007
Posts: 10882
Location: Wherever the wind blows- North America

PostPosted: Sat May 16, 2009 15:06    Post subject: Reply with quote
I've looked too...for the 520GU unit...never found the pinout.

http://www.dd-wrt.com/phpBB2/viewtopic.php?t=40015

I remember talking to eko about this...he thinks that the data lines were never pulled out on the mobo for the unit...the processor has JTAG pins...but no traces to the outside world for us to connect to.

redhawk

_________________
I currently test dd-wrt on Asus, Buffalo, Linksys, and Netgear. Too many to list.

Looking for more test units (newer models) for the project...got a brick?...PM me to make a donation. (USA) A donation is not a debricking service....it is a way to "Give back" to the dd-wrt project.

I do NOT provide personal assistance through chat or phone....so please don't ask.
newboy
DD-WRT Novice


Joined: 18 Sep 2008
Posts: 42

PostPosted: Sat May 16, 2009 16:03    Post subject: Reply with quote
redhawk0 wrote:
I've looked too...for the 520GU unit...never found the pinout.

http://www.dd-wrt.com/phpBB2/viewtopic.php?t=40015

I remember talking to eko about this...he thinks that the data lines were never pulled out on the mobo for the unit...the processor has JTAG pins...but no traces to the outside world for us to connect to.

redhawk


Hi Redhawk,

Nice to hear from you on this thread, its a good feeling that I am not alone on this quest. The 2 units hardware wise have very little difference, the main components that intrest us is the processor and the flash chip, this is why I thought the Linksys unit is the most popular of the 2 units and somebody would have had a good poke around, and would have some information. The painfull part is that it uses a SOIC (BGA) type chip which is a pain to gain access to, I have traced as close as possible to the chip, but the tracks get lost from just under the edge of the chip, very close but yet so far.

From your knowledge is there anyway we could directly write to the flash chip?. Another thought crossed my mind was to see if we could clone another flash chip and replace it on the faulty unit, but trying to find a SMD type TSOP socket is another thing alltogeather.

I too have a backup of the CFE, but what good is it to us at this very moment unless we could find a method to be able to flash it. There has to be a way how they do it in production.
redhawk0
DD-WRT Guru


Joined: 04 Jan 2007
Posts: 10882
Location: Wherever the wind blows- North America

PostPosted: Sat May 16, 2009 16:22    Post subject: Reply with quote
newboy wrote:
Hi Redhawk,

Nice to hear from you on this thread, its a good feeling that I am not alone on this quest. The 2 units hardware wise have very little difference, the main components that intrest us is the processor and the flash chip, this is why I thought the Linksys unit is the most popular of the 2 units and somebody would have had a good poke around, and would have some information. The painfull part is that it uses a SOIC type chip which is a pain to gain access to, I have traced as close as possible to the chip, but the tracks get lost from just under the edge of the chip, very close but yet so far.

From your knowledge is there anyway we could directly write to the flash chip?. Another thought crossed my mind was to see if we could clone another flash chip and replace it on the faulty unit, but trying to find a SMD type TSOP socket is another thing alltogeather.

I too have a backup of the CFE, but what good is it to us at this very moment unless we could find a method to be able to flash it. There has to be a way how they do it in production.


Well...The flash chip can be flashed directly...but would require some elaborate and expensive equipment (Thousands of USD)...its much cheaper to buy a crate of routers.

However, you could flash another units flash chip with whatever CFE you want....remove it and solder it onto this unit....but again...is it really worth all that time spend and multiple chances at pin damage....and still very little chance of troubleshooting if a problem should arise in the middle of the process.

Personally, I think not....but everyone is entitled to his own hobbies.

(however, the idea of "conquering the defective router" does have some appeal...I must admit) :lol:

Many of the manufactures flash the chips first...then install them on the mobo preprogrammed....it is the most efficient way of doing the flash....and doesn't slow production.

redhawk

_________________
I currently test dd-wrt on Asus, Buffalo, Linksys, and Netgear. Too many to list.

Looking for more test units (newer models) for the project...got a brick?...PM me to make a donation. (USA) A donation is not a debricking service....it is a way to "Give back" to the dd-wrt project.

I do NOT provide personal assistance through chat or phone....so please don't ask.
newboy
DD-WRT Novice


Joined: 18 Sep 2008
Posts: 42

PostPosted: Sat May 16, 2009 21:46    Post subject: Reply with quote
redhawk0 wrote:

However, you could flash another units flash chip with whatever CFE you want....

redhawk


Hi Redhawk,

Thanks for the informative reply, this might be totally wacky but is it possible, or what are you thoughts on the following.

I take a backup of the CFE from both see if I could compare the 2, I guess it might have a zellion differences, maybe make changes where possible and flash the A one on the L unit and see what happens, this way at least if the L unit goes belly up, we can always recover it using the Jtag method.

Quote:
(however, the idea of "conquering the defective router" does have some appeal...I must admit) Laughing
Agreed hate to give up without trying, have this terrible itch. Evil or Very Mad
Display posts from previous:    Page 1 of 1
Post new topic   Reply to topic    DD-WRT Forum Forum Index -> Broadcom SoC based Hardware All times are GMT

Navigation

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You can attach files in this forum
You can download files in this forum