Microsoft MN700 hack project

[hsddlawley]

not sure this is the right place to post this, but since i have the mn-700 I started here. But what would keep from turning one of these into a DNS server?

[Oleg]

The only problem is the available space. You've to recompile firmware or switch to openwrt.

[hsddlawley]

Well I have my 3rd mn-700 that I'm working with. Same laptop and cable that I used for the first 2. But won't flash. Getting all 1's and F's. Tried a 2nd computer same error. Cable is only about 4 inches long so cable lenght should not be a factor. Using winxp. Nothing really different other than I'm using a different AV, AVG on the machine. But the second machine I tried did not have any AV on it.

Only thing I can see is this one might be an older unit than the first 2 that I worked with. The flash chip has a different sticker on it than the others. But the wrtjtag util will not see the chip.

Just won't detect the chip. Ohm'ed out cable, resistors etc... But I suppose I could make another one.

Still boots microsoft software and did update the microsoft bin so its still working .

Any clues??

edit:

Looking at the board I'm concerned that I have good conx back to the chip, I see that not only do I go thru the 100 ohm resistor but the board also has its own resistors (4.7k?) but after that hard to trace back (using a lupe), and checking for cold solder joints or bridges. Where do the jtag conx go back to? The broadcom chip? If so what pins so I can trace it back. Since microsoft never put the connector on I'm sure it was never tested and may have never worked,any ideas? Wonder if they left anything off this one, I will open one of my working units to compare.

More info: error
CHIP ID: 11111111111111111111111111111111 (FFFFFFFF)

if I remove the power from the rtr I get

CHIP ID: 00000000000000000000000000000000 (00000000)


I saw the message about removing resistor from pin 13 but still same error.


Why the other 2 went so smooth and this one giving me fits.. dunno


logic probe shows pulse from pc up to the resistors on the mn-700, but nothing on the backside of the mn-700 onboard resistors. (guess I should note that I mounted my 100 ohm resistors on the board itself, just as I had done before) so I have signal up to onboard resistors from the jtag conx. Probe shows logic low at all points behind the resistors on mn-700.

ok see now that the resistors are to tie the logic low when not in use. So need to probe back to the broadcom chip somehow and find out why its not getting/reading the chip.

Any timing issues between chips?

[pcbroch]

Hi all:

Would anyone know what the GPIO is for the power led? I've installed openwrt on the MN700, but the power led remains off at all times. Theres an S99done in init.d that should set the led on, but I assume the address is wrong.

Thanks in advance.

[Oleg]

Hi all:

Would anyone know what the GPIO is for the power led? I've installed openwrt on the MN700, but the power led remains off at all times. Theres an S99done in init.d that should set the led on, but I assume the address is wrong.

Thanks in advance.

Restore button is GPIO7, power LED is GPIO6.

[Oleg]

Well ok see now that the resistors are to tie the logic low when not in use. So need to probe back to the broadcom chip somehow and find out why its not getting/reading the chip.

Any timing issues between chips?

Most likely some resistors are not mounted or something like this. If you make a hi-res picture of jtag surroundings, then probably we would find an answer.
BCM4702 JTAG pins:

TRST A3
TDO B3
TDI C3
TCK B4
TMS A4
TEST_ENABLE E4

[pcbroch]

Restore button is GPIO7, power LED is GPIO6.

Stupid question, but how can I flick the led on? What memory location is GPIO6, and what values does it support (various colors are possible for the LED I think).

[Oleg]

The number stays for the bit number. The gpio port itself is accessible via /dev/gpio/*. You've to read outen, OR it with 0x40 (GPIO6) and write back - this should turn power led on. Then you will need to play with bit 6 in the /dev/gpio/out to change LED color.

[pcbroch]

That did the trick, thanks!

[Oleg]

so, it works now?

[hsddlawley]

so, it works now?

Yes Sir!!! ty

[hsddlawley]

I deleted that image, all we need is someone looking at it as being correct.

Just finished my 4th unit. Got your bin/overlay and nvserial. Fired up knoppix and made the bin myself. ( feeling better now!)

I'm thinking 4 units covers my home pretty well. 2 upstairs and 2 downstairs.

Maybe I need one to hang out the back to cover my deck area.

[hsddlawley]

Now that I have these working was wonder what if anyone is doing for cooling, noticed that asus has heatsinks on cpu and switch..

Is it worthwhile doing, or just add a small fan. Hate to add moving parts. Maybe just a few more cooling vents?

[wpinegar]

Oleg, are you still handing out Boot ROM files for MN-700 routers? I have one that I bought about a year ago that I would like to get Linux running on.

Do you need anything from me besides the MAC address of my MN-700?

By the way, have you seen this post about flashing the MN-740? It seems that the same process should be used to flash a new boot ROM for the MN-700 as well. Maybe it could save some time and elimate the need for the JTAG?

http://www.dslreports.com/forum/remark,13360873

[Oleg]

Oleg, are you still handing out Boot ROM files for MN-700 routers? I have one that I bought about a year ago that I would like to get Linux running on.

Do you need anything from me besides the MAC address of my MN-700?

By the way, have you seen this post about flashing the MN-740? It seems that the same process should be used to flash a new boot ROM for the MN-700 as well. Maybe it could save some time and elimate the need for the JTAG?

http://www.dslreports.com/forum/remark,13360873

MN-740 is a completely different product, which do not use windows ce. It's just an MS branded OEM stuff.
Yes, you need MAC only.