search

Squonk42 / TL-WR703N

Reverse Engineering work on the TP-LINK TL-WR703N 150M 802.11n Wi-Fi Router
252 stars 91 forks source link

EJTAG pins #1

Closed olerem closed 10 years ago

olerem commented 10 years ago

Hey,

i didn't know other way to contact you, so i'll try this one. I work on port of barebox to ar9331 on MR3020. I wont to try solder JTAG pins on it. Do you have any experience on JTAG with this chip? Some think i need to know before start?

Squonk42 commented 10 years ago

Hi Oleksii,

No, I don't have experience with JTAG on the AR9331 specifically.

I used JTAG for different processors, the most complex being ARM cores. If this is the same for MIPS CPUs, you will need a JTAG probe for the MIPS24Kc, along with a vendor-specific documentation describing how to access the CPU, peripheral, memories, the flash procedure and how to run, single-step, read/write registers, etc.

Unless this information is common to all MIPS24Kc processors and provided by MIPS directly or you already have access to it, there is little chance that you will find it in the wild, as this is probably subject to NDAs.

On a purely hardware point of view, according to the AR9331 datasheet, JTAG is available on the following GPIOs:

See TL-WR703N schematic (http://squonk42.github.io/TL-WR703N/) for details, as the TL-WR703N and the TL-MR3020 share more than 90% of their schematic and keep a compatible component nomenclature.

Good luck! Michel

Le 18/12/2013 09:56, Oleksij Rempel a écrit :

Hey,

i didn't know other way to contact you, so i'll try this one. I work on port of barebox to ar9331 on MR3020. I wont to try solder JTAG pins on it. Do you have any experience on JTAG with this chip? Some think i need to know before start?

— Reply to this email directly or view it on GitHub https://github.com/Squonk42/TL-WR703N/issues/1.

Ce courrier électronique ne contient aucun virus ou logiciel malveillant parce que la protection avast! Antivirus est active. http://www.avast.com

olerem commented 10 years ago

Hi Michel,

thank you for your response. I have experience with MIPS EJTAG and worked with different CPUs. I ask spesialy about this chip, because there is no special provided TRST and or EJTAG_SELECT pins, like some other atheros WiSoCs have. Right now i'm about to solder this pins. Will see i'll be able to make it work.

Am 18.12.2013 10:31, schrieb Michel Stempin:

Hi Oleksii,

No, I don't have experience with JTAG on the AR9331 specifically.

I used JTAG for different processors, the most complex being ARM cores. If this is the same for MIPS CPUs, you will need a JTAG probe for the MIPS24Kc, along with a vendor-specific documentation describing how to access the CPU, peripheral, memories, the flash procedure and how to run, single-step, read/write registers, etc.

Unless this information is common to all MIPS24Kc processors and provided by MIPS directly or you already have access to it, there is little chance that you will find it in the wild, as this is probably subject to NDAs.

On a purely hardware point of view, according to the AR9331 datasheet, JTAG is available on the following GPIOs:

  • TDI: GPIO6, pin B46, resistor R16
  • TDO: GPIO7, pin A54, resistor R15
  • TMS: GPIO8, pin A52, resistor R18
  • TCK: GPIO29, pin pin A53, resistor R17

See TL-WR703N schematic (http://squonk42.github.io/TL-WR703N/) for details, as the TL-WR703N and the TL-MR3020 share more than 90% of their schematic and keep a compatible component nomenclature.

Good luck! Michel

Regards, Oleksij

Squonk42 commented 10 years ago

The AR9331 datasheet is available here: http://www.eeboard.com/wp-content/uploads/downloads/2013/08/AR9331.pdf

Cheers, Michel Le 18/12/2013 11:03, Oleksij Rempel a écrit :

Hi Michel,

thank you for your response. I have experience with MIPS EJTAG and worked with different CPUs. I ask spesialy about this chip, because there is no special provided TRST and or EJTAG_SELECT pins, like some other atheros WiSoCs have. Right now i'm about to solder this pins. Will see i'll be able to make it work.

Am 18.12.2013 10:31, schrieb Michel Stempin:

Hi Oleksii,

No, I don't have experience with JTAG on the AR9331 specifically.

I used JTAG for different processors, the most complex being ARM cores. If this is the same for MIPS CPUs, you will need a JTAG probe for the MIPS24Kc, along with a vendor-specific documentation describing how to access the CPU, peripheral, memories, the flash procedure and how to run, single-step, read/write registers, etc.

Unless this information is common to all MIPS24Kc processors and provided by MIPS directly or you already have access to it, there is little chance that you will find it in the wild, as this is probably subject to NDAs.

On a purely hardware point of view, according to the AR9331 datasheet, JTAG is available on the following GPIOs:

  • TDI: GPIO6, pin B46, resistor R16
  • TDO: GPIO7, pin A54, resistor R15
  • TMS: GPIO8, pin A52, resistor R18
  • TCK: GPIO29, pin pin A53, resistor R17

See TL-WR703N schematic (http://squonk42.github.io/TL-WR703N/) for details, as the TL-WR703N and the TL-MR3020 share more than 90% of their schematic and keep a compatible component nomenclature.

Good luck! Michel

Regards, Oleksij

— Reply to this email directly or view it on GitHub https://github.com/Squonk42/TL-WR703N/issues/1#issuecomment-30829576.

Ce courrier électronique ne contient aucun virus ou logiciel malveillant parce que la protection avast! Antivirus est active. http://www.avast.com

pepe2k commented 10 years ago

Hello Oleksij,

Take a look at this discussion: https://github.com/pepe2k/u-boot_mod/issues/2

Regards, Piotr

olerem commented 10 years ago

Problem solved. Thank you.

mstempin commented 10 years ago

Can you provide more details?

olerem commented 10 years ago

The trick is:

With openocd i was able to set CPU in debug mode and made damp of flash. I still miss correct RAM configuration. Any tips?

olerem commented 10 years ago

Ram problem is solved too. Here you can find more info: http://wikidevi.com/wiki/TP-LINK_TL-MR3020#JTAG

Squonk42 commented 10 years ago

Thanks @olerem, very useful information!

I will post a link in the OpenWrt forum.