Differences

This shows you the differences between two versions of the page.

--- projects:routers:netgear:wgt634u [2013/01/18 01:15] – [FT2232H based JTAG] admin
+++ projects:routers:netgear:wgt634u [2013/02/01 11:35] (current) – [JTAG software] admin
@@ Line 1: / Line 1: @@
 ====== Netgear WGT634U ======
-After flashing a WGT634U router, which I wanted to convert to a 3g usb wifi router, a apparently used a wrong openwrt image, despite careful checking, the device was bricked. (I changed the header with 4 bytes, which I read ..., which was not a good thing to do)\\ So a JTAG interface was needed to bring this device back to life. The first time in my life I would use this kind of interface.
+After flashing a WGT634U router, which I wanted to convert to a 3g usb wifi router, a apparently used a wrong openwrt image, despite careful checking, the device was bricked. (I changed the header with 4 bytes, which I read ..., which was not a good thing to do)\\ So a JTAG interface was needed to bring this device back to life. The first time in my life I would use this kind of interface.\\
 ==== FT2232H based JTAG ====
 Spending many hours on the internet what differences between JTAG interfaces are, how they are controlled, I found a very popular chip, the FT2232H from the company FTDI, which manifest itself into a myriad of circuits. This one is from Ebay: TIAO USB JTAG. Manual of this can be found here: [[http://www.tiaowiki.com]]
@@ Line 29: / Line 28: @@
 </code>
+==== JTAG on router ====
+Following text is from [[http://irgendwasistjaimmer.in-kiel.de/iwiji/index.php?/archives/23-How-to-flash-a-new-CFE-into-your-bricked-Netgear-WGT634U.html|this webpage]].\\ Once upon a time, when the WGT634U wasn't yet EOL'd, OpenWrt had a bug that caused the flash partition containing the CFE to be erased. As the CFE is the boot loader, you then had a paperweight.\\ There were rumors one of the two headers on the PCB was a JTAG port, but nobody found out how to utilize it.\\ \\ Some weeks ago I came across [[http://secure.dd-wrt.com/phpBB2/viewtopic.php?t=28947&postdays=0&postorder=asc&start=129|this forum post]] detailing how to populate the resistor pads to make JTAG work. That link also provides the image file which is to be flashed.\\ \\ My WGT634U is now resurrected, so how to repeat this?\\ \\ First, you need to populate the 2x7 header on the front side and the resistor pads on the backside. These resistor values worked for me:
+<code>
+R66 (pin 3) 10KΩ
+R65 (pin 5) 33Ω
+R67 (pin 7) 10KΩ
+R68 (pin 9) 10KΩ
+R73 (pin 11) 33Ω
+</code>
+Information about the pinout on the wgt634u can be found [[http://wiki.openwrt.org/doc/hardware/port.jtag|here]]. It is assumed that the pin layout is MIPS EJTAG 2.6 compatible:
+<csv hdr_rows=1>
+function,pin,pin,function
+nTRST,1,2,GND
+TDI,3,4,GND
+TDO,5,6,GND
+TMS,7,8,GND
+TCK,9,10,GND
+nSRST,11,12,n/a
+n/a,13,14,Vcc
+</csv>
+A buffered cable such as the Wiggler requires an external Vcc voltage supply. The 14-pin header conveniently supplies this voltage on pin 14. The typical unbuffered cable, however, does not require an external voltage in order to function. Formally, the pin 14 is called VREF and used to indicate a JTAG signal levels: 5V, 3.3V or 2.5V. On the most devices this pin is tied to the device's Vcc and may be used to power a buffer IC chip (and to generate an appropriate levels as result). Note that the 12-pin JTAG header arrangement does not provide Vcc.
+==== JTAG software ====
+In the openmoko wiki they tell how to use openocd with the Debug Board to flash the openmoko Freerunner gsm phone; but there's no information regarding MIPS devices like the WGT. I finally managed to do it using urjtag revision 1855 (current HEAD) from their svn.
+<code bash>
+svn co -r 1855 http://urjtag.svn.sourceforge.net/svnroot/urjtag/trunk/urjtag
+cd urjtag
+sh autogen.sh --enable-cable=ft2232 --enable-lowlevel=ftdi
+make
+sudo make install
+</code>
+You need to enhance the data installed to /usr/local/share/urjtag/:
+<code bash>
+echo -e "0101001101100101\tbcm5365\tBCM5365" >> /usr/local/share/urjtag/broadcom/PARTS
+mkdir /usr/local/share/urjtag/broadcom/bcm5365
+echo -e "0001\tbcm5365\tVer 1" > /usr/local/share/urjtag/broadcom/bcm5365/STEPPINGS
+cp /usr/local/share/urjtag/broadcom/bcm4712/bcm4712 /usr/local/share/urjtag/broadcom/bcm5365/bcm5365
+</code>
+Then, you can finally flash your WGT. Download the [[http://www.auditeon.com/xyz/wgt634uCFE.bin|image wgt634uCFE.bin here]].
+<code bash>
+cable ft2232 vid=0x1457 pid=0x5118
+detect
+initbus ejtag_dma
+detectflash 0x1fc00000
+eraseflash 0x1fc00000 3
+flashmem 0x1fc00000 wgt634uCFE.bin
+</code>
+===== Links and information =====
+  * [[http://www.fccps.cz/download/adv/frr/spi/msi_spi.html]] Programming a flash chip in-circuit via the parallel port

Auditeon

User Tools

Site Tools

Differences

Page Tools