OpenWrt Forum Archive

Topic: JTAG on a WRTSL54GS - reflashing NVRAM with a JTAG cable

The content of this topic has been archived on 29 Apr 2018. There are no obvious gaps in this topic, but there may still be some posts missing at the end.

Has anyone successfully flashed the nvram on a WRTSL54GS?
I've bricked my AP (stupid network config). As I am backordered on MAX233A chips, I figured I can reflash the NVRAM for boot_wait=on, and recover.

I've been successful in reading the NVRAM using the instructions in the wiki.  I can write stuff into memory and read it back, so I guess my cable is working.

For reading I am using (I've renamed HairyDairyMaid's wrt54g debrick)

./debrick -backup:nvram /skipdetect /instrlen:8

and for flashing I am using

./debrick -flash:nvram /skipdetect /instrlen:8

When I flash the AP with the above command the operation completes very quickly - about 7 seconds, and no changes are made to NVRAM contents.

If I use

./debrick -flash:nvram /skipdetect /instrlen:8 /noerase

the flash takes a reasonable amount of time - about 30 minutes - and I can read the contents back using -backup correctly, but the changes are lost after a powerdown.

Has anyone succeeded in reflashing this AP?

--Yan

Bricked my WRTSL54GS by not reading all of the information carefully :-(   I switched from HyperWRT after a few months for more functionality and lost all of it! 

Anyway, Failsafe is gone as I believe I erased NVRAM like a dummy.  I cannot TelNet or SSH.  Ping responds intermittently (2-3 times, then timeout).  Power light blinks continously and usb stays lit.  I need new CFE? 

I've built buffered  JTAG before for my TV but instead built the cheap version for this project. followed all same advice from previos post.   Not much info about WRTSL54GS because it's new and crazy hard to solder to the JTAG on back......but I did it correctly....I think. 

Is this the correct connection? 

DB25---------->JTAG

2                      47
3                      46
4                      43
13                    49
20-25               19

also, I'm supplying 3.3V to the pads behind those from my computer power supply....I think I'm confused here because this turns on the lights on front with out being plugged in!! 

Here is output from the utility with power supplied from computer:   It's also the same with computer VCC unhooked and power supplied from back of unit.

C:\Documents and Settings\XP>wrt54g -backup:cfe /skipdetect /instrlen:8 /fc:25

====================================
WRT54G/GS EJTAG Debrick Utility v4.5
====================================

Probing bus ... Done

Instruction Length set to 8

CPU Chip ID: 11111111111111111111111111111111 (FFFFFFFF)
*** CHIP DETECTION OVERRIDDEN ***

    - EJTAG IMPCODE ....... : 11111111111111111111111111111111 (FFFFFFFF)
    - EJTAG Version ....... : Unknown (7 is a reserved value)
    - EJTAG DMA Support ... : No

Issuing Processor / Peripheral Reset ... Done
Enabling Memory Writes ... Skipped
Halting Processor ... <Processor Entered Debug Mode!> ... Done
Clearing Watchdog ...

Then it hangs for a LONG time!!!

So.....I unplug the supplied 3.3volts and the power from the back and try this command:    Results follow: 

C:\Documents and Settings\XP>wrt54g -backup:cfe /skipdetect /instrlen:8

====================================
WRT54G/GS EJTAG Debrick Utility v4.5
====================================

Probing bus ... Done

Instruction Length set to 8

CPU Chip ID: 00000000000000000000000000000000 (00000000)
*** CHIP DETECTION OVERRIDDEN ***

    - EJTAG IMPCODE ....... : 00000000000000000000000000000000 (00000000)
    - EJTAG Version ....... : 1 or 2.0
    - EJTAG DMA Support ... : Yes

Issuing Processor / Peripheral Reset ... Done
Enabling Memory Writes ... Done
Halting Processor ... <Processor did NOT enter Debug Mode!> ... Done
Clearing Watchdog ... Done

Probing Flash at (Flash Window: 0x1fc00000) ... Done

*** Unknown or NO Flash Chip Detected ***

*** REQUESTED OPERATION IS COMPLETE ***

Finally, If I supply the switch  /fc:25  to the above situation then it porceeds to backup 100%, but the file is empty!


I guess maybe my cable could be bad, but I do get feedback from the program?   I've rechecked all my connections...as best as possible....... multiple times.  Damn Them for not including a HEADER :-( 

I also added a header to the board for the Serial connection and I'm building the interface with some spare MAX chips I had from a previos project.  Will this save me? 

I've downloaded nvserial.exe but I don't have a clue as what to do next. 

Please, help if you have any experiance DEBRICKING a WRTSL54GS.  I'm capable if someone can help out :-) 

Thanks for reading this far.....

--Duane

I have a patched version of HairyDairyMaid's debrick utility on my website:

http://www.seiner.com/debrick-4_6.tar.bz2

This should work with the WRTSL54GS.  However, you will need to find the original tarball to get the docs and search the forums for the correct command line options.

--Yan

i havent used a jtag for the wrtsl54gs(yet) but i did have exactly the same problem when i was flashing a new cfe to my wrt54g v5 it turned out to be a totally n00b'ed up cable, i guess i was tired when i made the cable, when i checked the pinouts it turned out to be bass ackward after i fixed it, the utility detected the board/flash and worked fine

You were so right....totally nOObed the cable like you said,  oh well it was like 3 am when I did it, that's my excuse anyway.  I also ripped off one of the tiny JTAG pads after hours of soldering and resoldering so it's really dead now. So I bought a new one from Best Buy ;-) 

I also found a WRT54GS v.4 at WalMart last night .  Now I have something with a JTAG header that I can practice OpenWRT without fear of Bricking like I did my SL. 

Thanks for the help ,  Good luck to anyone else trying to JTAG the WRTSL54GS, it's very possible but those pads do lift easily ;-) 

--Duane

Well the trick to those pads is to use a really small stranded wire (like a cut up IDE40 cable), prestrip and presolder the ends, and then just touch the the wire to the pad and touch the iron to the wire.  That's all you need.

Use a low-heat iron; mine (at home) is an $8 25w iron (the one at work is a $200 temp controlled beauty...)

--Yan

The discussion might have continued from here.