OpenWrt Forum Archive

Topic: WNR2000(v1): where are the JTAG pins?

The content of this topic has been archived on 3 Apr 2018. There are no obvious gaps in this topic, but there may still be some posts missing at the end.

Does anyone know where the JTAG pins are located on a WNR2000 (FCC ID PY308200083)?
I want to patch the bootloader and be prepared in case I break it. There are no obvious pins rows.

I've found two test point groups on the back of the PCB:

- group 1: TP8, TP26-TP30 (six pins)
- group 2: TP2, TP12, TP16, TP18, TP19 (five pins)

so, assuming the JTAG pins are put closely together (not always true) and EJTAG requiring
five pins beside GND and Vcc (TDI, TDO, TMS, TCK and nTRST), while DINT and SRST are optional, both are candidates.

Unfortunately the traces on the PCB are difficult to follow towards the CPU.

Anyhow, it may be easier to replace the SPI flash by a socket.

The whole PCB, backside:
http://s10.directupload.net/images/100324/temp/ro49uz5v.jpg

Group 1:
http://s10b.directupload.net/images/100324/temp/jazkdwhn.jpg

Group 2:
http://s10.directupload.net/images/100324/temp/egfqtz3f.jpg

(Last edited by jal2 on 24 Mar 2010, 23:40)

I've compared the traces of the WNR2000 to the ones of WR941ND with the same AR9132, but a dedicated JTAG header - you can find a hi-res picture here or here. Serial port traces and JTAG traces run close together, so I'd guess group 2 above are the JTAG pins (TP2, ...).

(Last edited by jal2 on 26 Mar 2010, 00:10)

I measured the voltages and resistance to Vcc and GND of testpoints TP2, TP12, TP16, TP18, TP19 yesterday. Doubt that they are JTAG, I couldn't find any reasonable pullups there.
Maybe JTAG is located at the frontside of the PCB at R149, RR213, R334, ... instead?
They were covered by some kind of finish, I had to remove it with pure alcohol to get to the solder.

Anyhow, I'll try to use a hw tool to find the pins. It will take me one or two weeks to get the Arduino and the software running.

BTW, does anyone know the JTAG IDCODE and IR length for the Atheros AR9130?

Hi jal2!
Have you found the pinout? Any news about the bootloader?

cyrusza wrote:

Have you found the pinout? Any news about the bootloader?

No, sorry, not yet. The Arduino test program is working fine with a WRT54G, but my first five pin candidates for JTAG on the WNR2000 failed. I'll include the testpoints around TP2 next.

thanatos2k wants to try the patched bootloader
but we haven't figured out how to overwrite the old one on his board - mtd failed and u-boot seems to lack the command to write to the SPI flash.

jal2 wrote:
cyrusza wrote:

Have you found the pinout? Any news about the bootloader?

No, sorry, not yet. The Arduino test program is working fine with a WRT54G, but my first five pin candidates for JTAG on the WNR2000 failed. I'll include the testpoints around TP2 next.

thanatos2k wants to try the patched bootloader
but we haven't figured out how to overwrite the old one on his board - mtd failed and u-boot seems to lack the command to write to the SPI flash.

Understood. Thank you for you work! I hope on a solution because this router is really unusable with Netgear firmware...

Sorry for the long delay. We failed to detect the JTAG pins in the group around TP2 as well. Next step is to sacrifice two boards,
WNR2000 and TP-Link WR1043ND, remove the SoC and look at the traces. The TP-Link has a JTAG header and features the same SoC.
I just wait for the delivery of the second WNR2000.

Maybe we could also keep the SoC of the WNR2000 in reset and access the SPI flash with some external hardware hoping that the SoC pins towards the SPI are kept in high-z during reset. Any volunteers? smile

jal2 wrote:

Maybe we could also keep the SoC of the WNR2000 in reset and access the SPI flash with some external hardware hoping that the SoC pins towards the SPI are kept in high-z during reset. Any volunteers? smile

I tried this while waiting for the second device and failed. It seems like with nSRST asserted, the pins SCLK and SI (on the SPI flash) are tied to ground and WP#, HOLD# and CS# are at Vcc.

jal2 wrote:

Next step is to sacrifice two boards,
WNR2000 and TP-Link WR1043ND, remove the SoC and look at the traces

Found the JTAG pins this way using the JTAGenum program. Have a look at
http://wiki.openwrt.org/toh/netgear/wnr2000#jtag for the mapping and some pictures.

Next task is to run tjtag and test if it supports the CPU/flash.

Hey, great job on that; that showed a lot patience and perseverance. 

What will your next move be after this? See if you can back up and restore the U-boot partition via JTAG and then start experimenting with your own compiles of U-boot?

The discussion might have continued from here.