RT-N66U BCM4706 Support

This site is best viewed in a modern browser with JavaScript enabled.

Dark_Shadow

My Unit Details
Possible to get CPU support added?

I:\zjtag>zjtag -probeonly
        ==============================================
               TUMPA EJTAG Debrick Utility V0.3
        ==============================================
 Set I/O speed to 30000 KHz
USB TAP device has been initialized. Please confirm VREF signal connected!
Press any key to continue... ONCE target board is powered on!
Probing bus ... Done
Detected IR Length is 1
CPU Chip ID: 01011111011011001111101101011100 (5F6CFB5C)
    CPU Manufature:Unknow(B5C)
    CPU Device ID :F6CF
    CPU Revision  :5
*** Detected a CPU but not in build-in list ***
*** You can set /skipdetect let operate continue ***

Added skipdetect and got

I:\zjtag>zjtag -probeonly /skipdetect
        ==============================================
               TUMPA EJTAG Debrick Utility V0.3
        ==============================================
 Set I/O speed to 30000 KHz
USB TAP device has been initialized. Please confirm VREF signal connected!
Press any key to continue... ONCE target board is powered on!
Probing bus ... Done
Detected IR Length is 1
CPU assumed running under LITTLE endian
CPU Chip ID: 01011011011011001111001101011100 (5B6CF35C)
*** CHIP DETECTION OVERRIDDEN ***
    - EJTAG IMPCODE ....... : 11111111111011111111011111011011 (FFEFF7DB)
    - EJTAG Version ....... : Unknown (7 is a reserved value)
    - EJTAG DMA Support ... : No
    - EJTAG Implementation flags: R3k DINTsup ASID_8 ASID_6 MIPS16 NoDMA MIPS64
Issuing Processor / Peripheral Reset ... Done
Enabling Memory Writes ... Skipped
Halting Processor ... <Processor Entered Debug Mode!> ...

At this point zJTAG frooze
EDIT: Realizing .4 was out, I gave it a shot with the same exact results
EDIT2: OK, tryed .5 as well, Same results

Dark_Shadow

Alrighty then. with sd card removed got past halting processor and hung at clearing watchdog, so

I:\zjtag>zjtag -probeonly /skipdetect /nocwd
        ==============================================
               TUMPA EJTAG Debrick Utility V0.5
        ==============================================
 Set I/O speed to 30000 KHz
USB TAP device has been initialized. Please confirm VREF signal connected!
Press any key to continue... ONCE target board is powered on!
Probing bus ... Done
Detected IR Length is 1
CPU assumed running under LITTLE endian
CPU Chip ID: 01011011011011001111101101011100 (5B6CFB5C)
*** CHIP DETECTION OVERRIDDEN ***
    - EJTAG IMPCODE ....... : 11111111111011111111011111011011 (FFEFF7DB)
    - EJTAG Version ....... : Unknown (7 is a reserved value)
    - EJTAG DMA Support ... : No
    - EJTAG Implementation flags: R3k DINTsup ASID_8 ASID_6 MIPS16 NoDMA MIPS64
Issuing Processor / Peripheral Reset ... Done
Enabling Memory Writes ... Skipped
Halting Processor ... <Processor did NOT enter Debug Mode!> ... Done
Clearing Watchdog ... Skipped
Loading CPU Configuration Code ... Skipped
Probing Flash at Address: 0x1FC00000 ...

Hung here

Dark_Shadow

Also noticed

/instrlen:XX ....... set CPU instruction length manually

Does not change the IR length in v0.5

[deleted]

http://www.tiaowiki.com/w/Debrick_Wireless_Router_Using_TUMPA_and_zJTAG wrote:the most important flag is JTAG clock speed divider
/L1:<divider>
. TUMPA can clock TCK as high as 30Mhz, however most router's CPU cannot handle such high clock speed, thus you will have to slow down the clock to make it work.
This is the formula:
Speed in KHz = 30000 / (divider + 1)
For example, if you give the following option:
/L1:3
The TCK clock speed is 7500KHz or 7.5MHz (30000/(3+1)).

Dark_Shadow

With your suggestion I get

I:\zjtag>zjtag -probeonly /L1:3
        ==============================================
               TUMPA EJTAG Debrick Utility V0.5
        ==============================================
 Set I/O speed to 7500 KHz
USB TAP device has been initialized. Please confirm VREF signal connected!
Press any key to continue... ONCE target board is powered on!
Probing bus ... Done
Detected IR Length is 0
Warning: detected IR Length isn't same as knew!
CPU assumed running under LITTLE endian
CPU Chip ID: 00000000000000000000000000000000 (00000000)
*** Found a AMD manufactured Atheros AR531X/231X REV 01 CPU ***
    - EJTAG IMPCODE ....... : 00000000000000000000000000000000 (00000000)
    - EJTAG Version ....... : 1 or 2.0
    - EJTAG DMA Support ... : Yes
    - EJTAG Implementation flags: R4k MIPS32
Issuing Processor / Peripheral Reset ... Done
Enabling Memory Writes ... Done
Halting Processor ... <Processor did NOT enter Debug Mode!> ... Done
Clearing Watchdog ... Done
Loading CPU Configuration Code ... Skipped
Probing Flash at Address: 0x1FC00000 ...
Detected Chip ID (VenID:DevID = 0000 : 0000)
*** Unknown or NO Flash Chip Detected ***
 *** REQUESTED OPERATION IS COMPLETE ***

I have tried 1-9 and nothing detects the cpu but default

[deleted]

Could you please try zJTAG version 0.4 with /L1:3 parameter? and let us know the result

Dark_Shadow

I:\zjtag>zjtag -probeonly /L1:3
        ==============================================
               TUMPA EJTAG Debrick Utility V0.4
        ==============================================
 Set I/O speed to 7500 KHz
USB TAP device has been initialized. Please confirm VREF signal connected!
Press any key to continue... ONCE target board is powered on!
Probing bus ... Done
Detected IR Length is 0
CPU Chip ID: 00000000000000000000000000000000 (00000000)
*** Unknown or NO CPU Chip ID Detected ***
*** Possible Causes:
    1) Router/Modem is not Connected.
    2) Router/Modem is not Powered On.
    3) Improper JTAG Cable.
    4) Unrecognized CPU Chip ID.

[deleted]

Dark_Shadow wrote: I have tried 1-9 and nothing detects the cpu but default

AFAIK, CPU Manufature:Unknow(B5C) is not valid, too. I think it means that zJTAG can't find CPU ID but bullshit. probably due to high clock speed or chip damage or unsupported protocol maybe?.
Are you sure that you've made proper JTAG connection? Could you please check JTAG pin-out of your router?

[deleted]

Dark_Shadow wrote: Also noticed
/instrlen:XX ....... set CPU instruction length manually
Does not change the IR length in v0.5

Thank you for the bug report.
I was able to reproduce instrlen problem and find the bug in the code.
Please Stay tuned for a bug-fix release.

[deleted]

I tried to fix the bug and released a bug-fix release (ver0.6):
http://sourceforge.net/projects/zjtag/files/v0.6/zjtag.source_0.6.zip
Please try ver0.6 with /instrlen and /L1:3
(try 5, 8 and 32 as IR length)
Let me know the result and please paste at least one output

Dark_Shadow

volkan-k wrote: I tried to fix the bug and released a bug-fix release (ver0.6):
http://sourceforge.net/projects/zjtag/files/v0.6/zjtag.source_0.6.zip
Please try ver0.6 with /instrlen and /L1:3
(try 5, 8 and 32 as IR length)
Let me know the result and please paste at least one output

Will do as soon as I get home.

Dark_Shadow

I:\zjtag>zjtag -probeonly /L1:3 /instrlen:5
        ==============================================
               zJTAG EJTAG Debrick Utility V0.6
        ==============================================
 Set I/O speed to 7500 KHz
USB TAP device has been initialized. Please confirm VREF signal connected!
Press any key to continue... ONCE target board is powered on!
Probing bus ... Done
Detected IR Length is 0
Instruction Length set to 5
CPU assumed running under LITTLE endian
CPU Chip ID: 00000000000000000000000000000000 (00000000)
*** Found a AMD manufactured Atheros AR531X/231X REV 01 CPU ***
    - EJTAG IMPCODE ....... : 00101101101101100111100110101110 (2DB679AE)
    - EJTAG Version ....... : 2.5
    - EJTAG DMA Support ... : No
    - EJTAG Implementation flags: R4k DINTsup ASID_6 NoDMA MIPS32
Issuing Processor / Peripheral Reset ... Done
Enabling Memory Writes ... Skipped
Halting Processor ... <Processor Entered Debug Mode!> ... ^C

Frozen

I:\zjtag>zjtag -probeonly /L1:3 /instrlen:8
        ==============================================
               zJTAG EJTAG Debrick Utility V0.6
        ==============================================
 Set I/O speed to 7500 KHz
USB TAP device has been initialized. Please confirm VREF signal connected!
Press any key to continue... ONCE target board is powered on!
Probing bus ... Done
Detected IR Length is 0
Instruction Length set to 8
Warning: detected/set IR Length isn't same as knew!
 (Defined IR length: 5, detected/set: 8)
CPU assumed running under LITTLE endian
CPU Chip ID: 00000000000000000000000000000000 (00000000)
*** Found a AMD manufactured Atheros AR531X/231X REV 01 CPU ***
    - EJTAG IMPCODE ....... : 00101111101101100111110110101110 (2FB67DAE)
    - EJTAG Version ....... : 2.5
    - EJTAG DMA Support ... : No
    - EJTAG Implementation flags: R4k DINTsup ASID_6 NoDMA MIPS32
Issuing Processor / Peripheral Reset ... Done
Enabling Memory Writes ... Skipped
Halting Processor ... <Processor Entered Debug Mode!> ... ^C

Frozen

I:\zjtag>zjtag -probeonly /L1:3 /instrlen:32
        ==============================================
               zJTAG EJTAG Debrick Utility V0.6
        ==============================================
 Set I/O speed to 7500 KHz
USB TAP device has been initialized. Please confirm VREF signal connected!
Press any key to continue... ONCE target board is powered on!
Probing bus ... Done
Detected IR Length is 0
Instruction Length set to 32
Warning: detected/set IR Length isn't same as knew!
 (Defined IR length: 5, detected/set: 32)
CPU assumed running under LITTLE endian
CPU Chip ID: 00000000000000000000000000000000 (00000000)
*** Found a AMD manufactured Atheros AR531X/231X REV 01 CPU ***
    - EJTAG IMPCODE ....... : 00000000000000000000000000000000 (00000000)
    - EJTAG Version ....... : 1 or 2.0
    - EJTAG DMA Support ... : Yes
    - EJTAG Implementation flags: R4k MIPS32
Issuing Processor / Peripheral Reset ... Done
Enabling Memory Writes ... Done
Halting Processor ... <Processor did NOT enter Debug Mode!> ... Done
Clearing Watchdog ... Done
Loading CPU Configuration Code ... Skipped
Probing Flash at Address: 0x1FC00000 ...
Detected Chip ID (VenID:DevID = 0000 : 0000)
*** Unknown or NO Flash Chip Detected ***
 *** REQUESTED OPERATION IS COMPLETE ***

Looks like it went through all the motions, still nothing detected

Dark_Shadow

volkan-k wrote:
Dark_Shadow wrote: I have tried 1-9 and nothing detects the cpu but default
AFAIK, CPU Manufature:Unknow(B5C) is not valid, too. I think it means that zJTAG can't find CPU ID but bullshit. probably due to high clock speed or chip damage or unsupported protocol maybe?.
Are you sure that you've made proper JTAG connection? Could you please check JTAG pin-out of your router?

Obviously not chip damage, the router is operational. Not sure about the pinouts though, going off BW's tests.
http://www.dd-wrt.com/phpBB2/viewtopic.php?p=703880#703880

barryware wrote: In preparation for flashing the rt-ac66u cfe to the rt-n66, I thought I would play with jtag on the rt-n66u..
J2 sure looks like a jtag header. Using an ohm meter, it tests out.
I thought it would be a standard pin out.
1 = nTrst
3 = tdi
5 = tdo
7 = tms
9 = tck
2 ~ 10 = ground
Using the latest release of tjtag (donation version), a probeonly yields all fffff's.. (cable not connected, etc.)
I spent some time hunting & switching pins.. Never got it to see the processor.. even though tjtag may not "recognize" the processor, it will see it.
What I will call the "standard" pinout as posted above.. this config did show that it may be working.
This was the only config that would change the status of the led's doing a probeonly. The power light would go out, and the internet light, the 2.4, and the 5ghz lights would glow dim..
Any other wire configs, had no effect. So I believe the standard pinout is correct.
I (we) need a little help from the rest of the "gearheads" on the forum to get this sorted out.
Anyone else played with jtag on this router?

[deleted]

Thank you for the feedback.! It seems like /instrlen parameter works OK now. I'm making ver0.6 the default download.
Please try with /delay:100 parameter (and also L1 divider between 1-9). If you get the same result, I think there is something wrong with connection or pin-out. or maybe your router needs test clock(Tck) values between 15MHz and 30MHz.?

Dark_Shadow

All same result. How to verify the pinouts? Connections are good. This pinout config is the only one that actually changed the leds.

[deleted]

Could you please send me a photo of your router's board focused on J2?

Dark_Shadow

http://www.techinfodepot.info/index.php/Asus_RT-N66U_B1#Pictures Under DarkShadow's Unit are the best pics I got.

[deleted]

It seems like 10-pin AVR JTAG header pin-out?
http://www.jtagtest.com/pinouts/avr

Dark_Shadow

Sure, I'll give it a shot, but you should know that pins 2-10 ohm out as ground.

[deleted]

If still no luck after trials;
http://hackingbtbusinesshub.wordpress.com/2012/01/26/discovering-jtag-pinouts/