How do I solder a JTAG connector to ASUS WL500

[noisyb]

The only way to revive it. I know there have had been efforts in the past to make this possible, but the explanations are too sloppy.

So how do I solder JTAG to my Router mainboard?

Where can I get information about how to solder JTAG to the mainboard?

No, failsafe mode doesnt work.
No, connecting PIN 10, 12, etc of the flashrom did never work.

Thanks,
Dirk

[xj600]

There is a CE report document in the files section containing the schematics and PCB layouts of the wl500gx device. On page 10 you'll find that TDI/TDO/TMS/TCK are connected to resistor network RN21 and resistor R77, respectively. Now go to page 23 and search for RN21. It's left of the processor chip.
I haven't tried it but I'm curious if it works. At least, EJTAG DeBrick Utility has some support for BCM5365 from version 4.4 on.

Good luck!

fritz

[noisyb]

Thanks!

> There is a CE report document in the files section containing the schematics and PCB layouts of the wl500gx device.

Which files section? I can only find a file section containing firmwares....

Could you give me a link?

I'll definately try this... If it works I'll report back here... If it doesn't and I trashbin the router I'll report too...

[xj600]

Which files section? I can only find a file section containing firmwares....

Could you give me a link?

I meant this: http://files.wl500g.info/asus/wl500gx/document/

[Mathijs]

I'll definately try this... If it works I'll report back here... If it doesn't and I trashbin the router I'll report too...

Sure, where is the 'report' then?
If i would have been writing this, i would have 'reported' back, why promise otherwise?

I can't get to that part of the site to find that document, as the link gives a 'forbidden'.
What should the filename be?
Is this really for a WL-500G-deluxe, as the broadcom chip differs from the non-deluxe?

[mururoa]

I get only forbidden when trying to access the link

[lowsix]

Hi,

I bricked my wl500gpv2 messing with nvram (didn't know if I could increase ram, so I tried it). All 5 ethernet lights go solid (with nothing plugged into them) but the air and power lights are all off.

So researching the pin 9/10/12 trick I noticed the chip was a mx29lv320ab for the deluxe version, and a very similar chip for the wl500gpv2. They all had the same pinout. Knowing that my device was already bricked I went for grounding the reset and address pins on power up.

I was actually successful when grounding pin 9 on power up, getting it into restore mode with the power led flashing, 192.168.1.1 pingable, and tftp uploads clearly occuring. However, after trying the clear and restore nvram images, as well as 2 different dd-wrt images that worked previously, the unit always goes back into "brick mode" after a power cycle.

I've tried the following images to no avail
wl500g-clear-nvram.trx
wl500g-recover.trx
dd-wrt.v24-12188_NEWD_mega.bin
dd-wrt.v24-12188_NEWD_mini_usb.bin
I even waited a full 5 minutes after each flash (gasp...me wait?)

Any ideas? I feel so close!

TIA,
Lou

[al37919]

good idea would be to connect the system console. If CFE is still alive, you can change some nvram values from its command prompt, and overall see about what it complains. If it is already dead... Hm... in this case you are anyway in advantageous state relative to the users of v1. You can put new CFE using JTAG without desoldering of the flash chip.

[lowsix]

Thanks for the idea...I was considering that but haven't figured out the right hardware and connections to either serial or JTAG the hardware. All I can find is that it does have a serial connection and (?) a JTAG in the compatibility spreadsheet for openwrt or dd-wrt.

But while I was looking for how to JTAG/serial I found someone with the identical problem who said the "pin-9-pin-16-trick combined with a vcc-to-ground-hack" did the trick for him. So I'm going to try that first.

But if you can point me to a howto on serial or JTAG connection I'd still like to try that.

Thanks,
Lou

[al37919]

vcc-to-ground-hack? I guess it may result in failure of PSU...

I suggest serial first:

You have 4-pin linear connector on the boards corner. That's serial. The header probably is not soldered, so you have to do it. +3.3V and GND are at the ends of the connector. You can identify them either visually or by multimeter. RX and TX are the two middle pins. If you have an oscilloscope, you identify it so --- on TX pin during power up there should be some activity --- console output. If none you can skip to JTAG directly ,because console and pin 9 already not helpful. If you don't have scope then trial and error is ok.

Next you have to make level convertor. Router's rs232 uses 3.3/0V logics while PC uses +12/-12V. It's 1 chip and 5 capacitors. Look in the datasheet of max3232 at maxim-ic.com for connection. On my experience max232 also works fine despite it's 5V chip.

Finally, you connect router through converter to rs232 of PC, set 115200 as speed and if it is alive you should get console output which may help to diagnose what is wrong.

Pinout of JTAG I've seen somewhere on the openwrt site. There should be probably description of JTAG-LPT connector and what is needed to do, but I don't have experience with this.

[lowsix]

I agree, vcc to ground sounds like an excellent way to overload PS, not something I want to do. I can only assume it power cycles the chip, which we have a reset for anyway.

No oscope anymore, but I'm sure I can figure out the TX/RX. Thanks for all the good info. Hope to try as soon as I order the max3232!

Lou

[Renegate]

Hi everyone,

I need jtag pinout for wl-500gp v1,
The CFE is corrupt or deleted, and the RS232 console does not show anything when connected, and I do not have acces to a Flash programer or AVR.

Thanks in advance,

Renegate

[lly]

Unfortunately, JTAG on 500gP V1 didn't routed on board. You have to desolder flash chip or try to find CPU pinout.

[Renegate]

Unfortunately, JTAG on 500gP V1 didn't routed on board. You have to desolder flash chip or try to find CPU pinout.

I guess there is only one solution for my little friend ..... to put him in the trash can

[lowsix]

I've tried console, and if I just start it up, there is no output at all to console. If I do the pin 9 trick (ground pin 9 on flash on powerup) it goes into tftp upload mode and the console shows this repeatedly...

> Reading :: TFTP Server.
> Failed.: Timeout occured

Then if I send a flash image it shows the following...

Reading :: TFTP Server.
TFTP_BLKLEN!!
Done. 3088384 bytes read
Download of 0x2f2000 bytes completed
Write kernel and filesystem binary to FLASH (0xbfc20000)
Programming...
copysize=3088384, amtcopy=3088384
done. 3088384 bytes written

I've tried tftp'ing the nvram clear, the nvram recover, and finally an image (dd-wrt.v24_mini_generic.bin) separately in a row and all with the pin 9 trick, but after the final power cycle, the box still comes up with no console output, and all lights on solid.

The reset button won't put it into re-flash mode still either. And I made sure to wait 10 minutes between each load although the "Programming" appears to be done within 20-30 seconds.

I think it may be time for JTAG. Can someone point me to some JTAG docs, or give me a brief howto for the box?

TIA,
Lou