WRT54Gv6 debrick (with Arduino JTAG "cable")

Post new topic   Reply to topic    DD-WRT Forum Forum Index -> Broadcom SoC based Hardware
Goto page 1, 2  Next
Author Message
jtrimble
DD-WRT Novice


Joined: 28 Mar 2010
Posts: 4

PostPosted: Sun Mar 28, 2010 22:07    Post subject: WRT54Gv6 debrick (with Arduino JTAG "cable") Reply with quote
Hello all. I've been given a WRT54Gv6 that up and stopped working one day. It originally had the stock Linksys (vxWorks) firmware on it, but now appears to be bricked. When I turn it on, 3 or 4 of the LAN LEDs come on immediately and power LED just blinks.

I figured it would be fun to try to fix this thing. I've never tried to debrick a router before -- I've done a lot of reading about it, but this is my first time trying. Unfortunately, I don't have a parallel port on any computer I own, so I couldn't make a parallel-port-based cable.

I do, however, have an Arduino (hobbyist microcontroller board). I downloaded tjtag 3.0.1, read through the code, and made some modifications so that instead of writing to a parallel port, my version of tjtag now talks to my Arduino. The Arduino acts like a Wiggler cable and carries out the bit-twiddling that a Wiggler normally would do, and it also reads the JTAG data pin and sends it back to tjtag.

Surprisingly, this Arduino/Wiggler setup seems to be working.

Here's a picture:
http://i42.tinypic.com/bj8gmx.jpg

After much testing, I was able to get the following output (note, lines that begin with "JTMOD" are part of my Arduino/Wiggler hacks):

jer@alice:~/wrt/tjtag3-0-1$ ./tjtag -probeonly /wiggler /noreset /flash_debug

==============================================
EJTAG Debrick Utility v3.0.1 Tornado-MOD
==============================================

JTMOD: Opened port.
JTMOD: Resetting Arduino.
JTMOD: Ready.
Probing bus ... Done

Instruction Length set to 8

CPU Chip ID: 00000101001101010010000101111111 (0535217F)
*** Found a Broadcom BCM5352 Rev 1 CPU chip ***

- EJTAG IMPCODE ....... : 00000000100000000000100100000100 (00800904)
- EJTAG Version ....... : 1 or 2.0
- EJTAG DMA Support ... : Yes
- EJTAG Implementation flags: R4k MIPS32

Issuing Processor / Peripheral Reset ... Skipped
Enabling Memory Writes ... Done
Halting Processor ... <Processor Entered Debug Mode!> ... Done
Clearing Watchdog ... Done
spi_flash_read 0x1fc00000
spi_flash_mmr 0x00000000
spi_flash_mmr_size 0x00000000
spi_flash_ctl 0x18000040
spi_flash_opcode 0x18000044
spi_flash_data 0x18000048
spi_ctl_start 0x80000000
spi_ctl_busy 0x80000000

Probing Flash at (Flash Window: 0x1fc00000) ...

Debug AMD Vendid : 00000000000000000000000011111011 (000000FB)
Debug AMD Devdid : 00000000000000000001000000000000 (00001000)

Debug SST Vendid : 00000000000000000000000011111011 (000000FB)
Debug SST Devdid : 00000000000000000001000000000000 (00001000)

Debug BSC-SCS Vendid :00010000000000000000000011111011 (100000FB)
Debug BCS-SCS Devdid :00010000000000000000000011111011 (100000FB)
REGREAD32 data 0x00000000 spi_flash_mmr 0x00000000 reg 0x18000040
REG 0x18000044 REGWRITE32 0x0000049f
SPI_FLASH_OPCODE 0x18000044 PTR_OPCODE 0x0000049f
REG 0x18000040 REGWRITE32 0x8000049f
SPI_FLASH_CTL SEND -> 0x18000040 reg 0x8000049f
REGREAD32 data 0x0000049f spi_flash_mmr 0x00000000 reg 0x18000040
REGREAD32 data 0x00000000 spi_flash_mmr 0x00000000 reg 0x18000048

Debug SPI id : 00000000000000000000000000000000 (00000000)

Debug SPI Vendid : 00000000000000000000000000000000 (00000000)
Debug SPI Devdid : 00000000000000000000000000000000 (00000000)
Done

*** Unknown or NO Flash Chip Detected ***

*** REQUESTED OPERATION IS COMPLETE ***

JTMOD: Cleaning up.
JTMOD: Done.

It seems bad that I'm getting the "Unknown or NO Flash Chip Detected" thing. Anyone know how to help with this? I haven't tried any -backup/-erase/-flash commands yet, just variations of -probeonly.

My WRT54Gv6 board has a Samsung K8D***** chip on it. The ***** is covered up by a sticker that says "VER.1.00.0 CS:CC99"

Thanks in advance for any help. If this Arduino/Wiggler JTAG "cable" ends up being viable, I'll gladly clean up and release the source code.

-J. Trimble
Sponsor
Dark_Shadow
DD-WRT Guru


Joined: 31 Aug 2009
Posts: 2450
Location: Third Rock from the Sun

PostPosted: Sun Mar 28, 2010 23:05    Post subject: Reply with quote
try

tjtag -probeonly /wiggler /noemw

_________________
Peacock Thread-FAQ -- dd-wrt Wiki

Testing Multiple Routers -- Bootloader Collection Project -- My Wiki
jtrimble
DD-WRT Novice


Joined: 28 Mar 2010
Posts: 4

PostPosted: Mon Mar 29, 2010 0:10    Post subject: It worked! Reply with quote
Hey, it worked!

I was able to -erase:nvram and that got the router back on its feet too.

Thanks for the quick response, Dark_Shadow.

I guess this means my Arduino "Wiggler Emulator" (or would that be "ArduWiggler"?) works, too.

Now, here's another question: Since I've never used a parallel-port-based cable, how fast are they? I'm wondering how my Arduino Wiggler did speed wise vs the real thing.

I briefly tried to do a -backup:cfe (before calculating that it would take way too long and giving up). It was averaging about 0.75 seconds per byte.

Thanks again.

I'll try and clean up this code to post somewhere, in case anyone would ever want to use it.
Dark_Shadow
DD-WRT Guru


Joined: 31 Aug 2009
Posts: 2450
Location: Third Rock from the Sun

PostPosted: Mon Mar 29, 2010 4:05    Post subject: Reply with quote
Glad you got it working.

Dunno about the parallel speeds though, i never worry about. just hit enter then walk away.

_________________
Peacock Thread-FAQ -- dd-wrt Wiki

Testing Multiple Routers -- Bootloader Collection Project -- My Wiki
ddwrtunico
DD-WRT Novice


Joined: 29 Apr 2010
Posts: 2

PostPosted: Thu Apr 29, 2010 1:01    Post subject: arduino jtag Reply with quote
I have a bricked wrt54g and an arduino diecimila too so i dont want spend more money on a jtag programmer.
Please post the code and more info about the wire connections showed on your image..my wrt is an V2.2 so my jtags pinouts are different.
Perhaps you would start a new treath with all the info....for sure it will be a massive treath because all bricked routers out there. 8)


Thank you a lot mate.
ReadtheAnnouncements!
DD-WRT Guru


Joined: 02 Mar 2010
Posts: 1362

PostPosted: Thu Apr 29, 2010 2:37    Post subject: Re: arduino jtag Reply with quote
ddwrtunico wrote:
I have a bricked wrt54g and an arduino diecimila too so i dont want spend more money on a jtag programmer.
Please post the code and more info about the wire connections showed on your image..my wrt is an V2.2 so my jtags pinouts are different.
Perhaps you would start a new treath with all the info....for sure it will be a massive treath because all bricked routers out there. 8)


Thank you a lot mate.


See the wiki article on jtag.

_________________
If I've said it once, I've must have said it a thousand times! READ the announcements at the start of the broadcom forum!
THESE:
http://www.dd-wrt.com/phpBB2/viewtopic.php?t=54889
http://www.dd-wrt.com/phpBB2/viewtopic.php?t=51486
http://www.dd-wrt.com/phpBB2/viewtopic.php?t=54845
http://www.dd-wrt.com/phpBB2/viewtopic.php?t=52043
(We'll wait....!) Wink
ddwrtunico
DD-WRT Novice


Joined: 29 Apr 2010
Posts: 2

PostPosted: Thu Apr 29, 2010 3:36    Post subject: Re: arduino jtag Reply with quote
ReadtheAnnouncements! wrote:
ddwrtunico wrote:
I have a bricked wrt54g and an arduino diecimila too so i dont want spend more money on a jtag programmer.
Please post the code and more info about the wire connections showed on your image..my wrt is an V2.2 so my jtags pinouts are different.
Perhaps you would start a new treath with all the info....for sure it will be a massive treath because all bricked routers out there. 8)


Thank you a lot mate.


See the wiki article on jtag.



A wiki search dont show info about arduino, but i just found this http://hsb.wikidot.com/arduino-jtag-finder-workshop


Quote:
Arduino as a JTAG cable

Try this piece of code http://www.assembla.com/spaces/avr_jtag/trac_mercurial_tool (do an hg clone http://hg.assembla.com/avr_jtag to have a copy of avr_jtag) to transform an arduino into jtag cable. A local copy of the source code here http://hsb.wikidot.com/local--files/arduino-jtag-finder-workshop/avr_jtag.tar.gz.


I will give it a try. Thanks
zoobab
DD-WRT Novice


Joined: 16 Mar 2010
Posts: 1

PostPosted: Thu Nov 04, 2010 13:39    Post subject: Source code? Reply with quote
Hi,

Do you mind sharing your source code somewhere?
jtrimble
DD-WRT Novice


Joined: 28 Mar 2010
Posts: 4

PostPosted: Mon Nov 08, 2010 3:22    Post subject: Will post code Reply with quote
Sorry for taking quite a while to get back to the forum. I don't get much time to spend on these kinds of projects and I kinda forgot about it.

I'm not at my computer right now but sometime in the next few days I will post the code and a schematic.
jtrimble
DD-WRT Novice


Joined: 28 Mar 2010
Posts: 4

PostPosted: Sat Nov 13, 2010 17:27    Post subject: Arduiggler/JTMOD Source Code Tarball Reply with quote
Alright, here is the source code and some basic documentation. The arduino/ subdirectory has the "sketch" code that you'll need to load onto your Arduino board, as well as a schematic for connecting the Arduino to your router's JTAG port (and a picture of my setup, just for reference).

See the JTMOD_README.txt file for rough instructions.

The code isn't pretty or fast, but hopefully you'll find this useful (and maybe somebody will find a way to make it faster). Let me know how your experience goes.

-Jeremy Trimble



tjtag3-0-1_JTMOD.tar.gz
 Description:
Source code and documentation for a version of tjtag that connects to a router's JTAG port through an Arduino board.

Download
 Filename:  tjtag3-0-1_JTMOD.tar.gz
 Filesize:  1.76 MB
 Downloaded:  3970 Time(s)

imthekuni
DD-WRT Novice


Joined: 14 Nov 2010
Posts: 2

PostPosted: Sun Jan 08, 2012 5:04    Post subject: Reply with quote
I am running Ubuntu 11.10 and trying to get my Arduino Uno to work as a wiggler. My computer recognizes the Uno on ttyACM0 and I have no luck setting the environment variables to ttyACM0 from ttyUSB0. Any suggestions?

Code:
andrew@Media:~/Desktop/tjtag3-0-1_JTMOD$ JTMOD_SER_PORT=/dev/ttyACM0
andrew@Media:~/Desktop/tjtag3-0-1_JTMOD$ echo $JTMOD_SER_PORT
/dev/ttyACM0
andrew@Media:~/Desktop/tjtag3-0-1_JTMOD$ sudo ./tjtag -probeonly /wiggler
[sudo] password for andrew:

==============================================
 EJTAG Debrick Utility v3.0.1 Tornado-MOD
==============================================

Failed to open '/dev/ttyUSB0': No such file or directory
andrew@Media:~/Desktop/tjtag3-0-1_JTMOD$



If I symlink ttyACM0 to ttyUSB0 I get this:

Code:

andrew@Media:~/Desktop/tjtag3-0-1_JTMOD$ sudo ln -s /dev/ttyACM0 /dev/ttyUSB0
andrew@Media:~/Desktop/tjtag3-0-1_JTMOD$ ./tjtag -probeonly /wiggler

==============================================
 EJTAG Debrick Utility v3.0.1 Tornado-MOD
==============================================

JTMOD: Opened port.
JTMOD: Resetting Arduino.
JTMOD:  Hmm.  Looks like the Arduino isn't responding.  Did you program it with the correct sketch?
davidtgbe
DD-WRT Novice


Joined: 05 Apr 2012
Posts: 1

PostPosted: Thu Apr 05, 2012 20:16    Post subject: tjtag v3.0.1 jt_mod windows port Reply with quote
Hi everbody,
I've modified a bit the J.Trimble mod of tjtaj to port it to windows. May be it could be useful to someone.

C:\Users\David\workspace\jtag-arduino\Debug>tjtag-jtmod-winport -probeonly /wiggler
/flash_debug

==============================================
EJTAG Debrick Utility v3.0.1 Tornado-MOD
==============================================

Puerto abierto \\.\COM4 115200
JTMOD: Opened port.
JTMOD: Resetting Arduino.
JTMOD: Ready.
Probing bus ... Done

Instruction Length set to 8

CPU Chip ID: 00010100011100010010000101111111 (1471217F)
*** Found a Broadcom BCM4712 Rev 1 CPU chip ***

- EJTAG IMPCODE ....... : 00000000100000000000100100000100 (00800904)
- EJTAG Version ....... : 1 or 2.0
- EJTAG DMA Support ... : Yes
- EJTAG Implementation flags: R4k MIPS32

Issuing Processor / Peripheral Reset ... Done
Enabling Memory Writes ... Done
Halting Processor ... <Processor Entered Debug Mode!> ... Done
Clearing Watchdog ... Done
spi_flash_read 0x1fc00000
spi_flash_mmr 0x00000000
spi_flash_mmr_size 0x00000000
spi_flash_ctl 0x18000040
spi_flash_opcode 0x18000044
spi_flash_data 0x18000048
spi_ctl_start 0x80000000
spi_ctl_busy 0x80000000

Probing Flash at (Flash Window: 0x1fc00000) ...

Debug AMD Vendid : 00000000000000000000000010001001 (00000089)
Debug AMD Devdid : 00000000000000000000000000000000 (00000000)

Debug SST Vendid : 00000000000000000000000010001001 (00000089)
Debug SST Devdid : 00000000000000000000000000000000 (00000000)

Debug BSC-SCS Vendid :10001000110001010000000010001001 (88C50089)
Debug BCS-SCS Devdid :00000000000000000000000000000000 (00000000)
REGREAD32 data 0x00000000 spi_flash_mmr 0x00000000 reg 0x18000040
REG 0x18000044 REGWRITE32 0x0000049f
SPI_FLASH_OPCODE 0x18000044 PTR_OPCODE 0x0000049f
REG 0x18000040 REGWRITE32 0x8000049f
SPI_FLASH_CTL SEND -> 0x18000040 reg 0x8000049f
REGREAD32 data 0x0000049f spi_flash_mmr 0x00000000 reg 0x18000040
REGREAD32 data 0x00000000 spi_flash_mmr 0x00000000 reg 0x18000048

Debug SPI id : 00000000000000000000000000000000 (00000000)

Debug SPI Vendid : 00000000000000000000000000000000 (00000000)
Debug SPI Devdid : 00000000000000000000000000000000 (00000000)
Done

*** Unknown or NO Flash Chip Detected ***

*** REQUESTED OPERATION IS COMPLETE ***

JTMOD: Cleaning up.
JTMOD: Done.



tjtag3-0-1_JTMOD_WinPort.zip
 Description:

Download
 Filename:  tjtag3-0-1_JTMOD_WinPort.zip
 Filesize:  1.89 MB
 Downloaded:  2987 Time(s)

mrdude
DD-WRT User


Joined: 04 Nov 2008
Posts: 58

PostPosted: Sun Dec 29, 2013 15:50    Post subject: Reply with quote
Here is the same file converted for Arduino Due and Udoo.

Thanks to EliteEng for modding to work on the Arduino Due and Udoo - see this thread for further details.

hxxp://forum.arduino.cc/index.php?topic=207044.0

I have included all the files - readmes etc in the attachment and a CFE with offsets for the wrt350n v1.



Udoo - Arduino uno and due Tjtag.zip
 Description:

Download
 Filename:  Udoo - Arduino uno and due Tjtag.zip
 Filesize:  1.56 MB
 Downloaded:  1470 Time(s)


_________________
http://www.speedtest.net/result/532668085.png
daubsi
DD-WRT Novice


Joined: 29 Dec 2013
Posts: 7

PostPosted: Sun Dec 29, 2013 23:39    Post subject: Reply with quote
Hi,

I'm running into the same problem with /dev/ttyACM0 on Ubuntu when using the patched tjtag command line tool. When I set the environment variable to use ttyACM0 I also get the error message "Hmm.. Looks like the Arduino isn't responding"

The sketch is programmed correctly. I was able to successfully upload it via /dev/ttyACM0 and I also programmed it under Windows as well. The user using tjtag is in the "dialout" group in order to r/w to /dev/ttyACM0

Any ideas what's wrong here? Is /dev/ttyACM0 behaving any different from /dev/ttyUSB0?

I tried to run the tools under Ubuntu, as the Windows version is not running correctly either. I already tried the provided Win32 ports and all the tools run OK so far but I never got any response from the WRT54GS (v1.0). (--> The sketch is working correctly when using the Windows tools, it is just the Linux version of tjtag which behaves strangely with /dev/ttyACM0).

I already checked all JTAG headers for short circuits but everything looks fine, however no matter which command line options I am using, there is never any response from the router via JTAG Sad tjtag stays there saying "Probing bus..." and times out after approx. 20 second with the error "No response" and various sources of errors. During the probe, the LEDs of the Arduino flash, so there seems to be serial port activity.

How fast should this response be returned normally after the message "Probing bus..."? When does the watchdog timer of the router kick in? How many seconds do I have?
Is the pinout of the WRT54GS v1.0 the same as for the WRT54GS v2 which is mentioned in the Wiki? Is there anything else how I can debug this? Everything looks gut, it is just that there isn't any response from the router... As the Linux version of the tool seems to be the native platform I thought I could give Ubuntu a try. Maybe it would have worked there instead of Windows... :-/

My specs: Win7 x64, COM4@115200 8N1, Linksys WRT54GS v1.0, Arduino Uni SMD edition, Power LED of router blinks after powering the unit. LAN ports react, but router is not reachable via any means (no ping, no tftp). Flashed dd-wrt version is unknown (flashed it a couple of years ago and router was used at my Dad's site). It think it is a v24 SP2 but I cannot remember more.

Any help is greatly appreciated. Thank you!
flipy
DD-WRT Novice


Joined: 04 May 2012
Posts: 43

PostPosted: Thu Jan 23, 2014 12:15    Post subject: Reply with quote
I'm trying to do the same.
How are you connecting the Arduino to the WRT?
However, did you put resistors when making connections?
I haven't done that yet but it may be worth it.

Also, someone has created a v2 version of the sketch: http://sourceforge.net/apps/trac/arduinodoodles/wiki/SketchArduiggler_v2.0
Goto page 1, 2  Next Display posts from previous:    Page 1 of 2
Post new topic   Reply to topic    DD-WRT Forum Forum Index -> Broadcom SoC based Hardware All times are GMT

Navigation

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You can attach files in this forum
You can download files in this forum