Debrick Wrt54G

WRT54G EJTAG DeBrick Guide by HairyDairyMaid (a.k.a. lightbulb)
hairydairymaid@yahoo.com

Ok – Let’s just be clear on a couple things right up front: 1) If you use EJTAG or any form of JTAG to recover (debrick) your WRT54G unit you do so fully ***at your own risk***. 2) I (nor Linksys) will not/can not be held accountable for anything you screw up using this (including your router). [If youwant to complain to Broadcom for not releasing
chip specs – be my guest.]

3) This ***will void your warrantee***. (Of course – if you already popped the lid off your router it is already voided anyhow) 4) I *hate* writing documentation – so this is it – take it or leave it! (i.e. – don’t ask for another guide)

Introduction
I guess if you are reading this you probably either have a brickedWRT54G v2 router or you want the capability to be able to re-flash your Intel Flash chip on your router in an alternate manner in case the normal method(s) do not work. Well I unfortunately found myself exactly in that spot… trying to upgrade the firmware and it crashed hard and nothing could revive it. So I decided that I must not be alone in this and that there may be a need for JTAG recovery ofthe flash chip. I started into this project and quickly found Broadcom was about the worst chipmaker out there at releasing info about their chips unless you signed a NDA

and swore to never mention anything to anyone about anything Broadcom related. (Can you tell I don’t care for their business stance? Their chips are ok – but their proprietary nature is terrible). [I feel better now] Anyhow –since Broadcom was unwilling/uncooperative in releasing the Boundary Scan Definition Language (BSDL) file and/or chip specs for the bcm4712 chip there was only one other alternative I knew of and that was EJTAG. This would use the same JTAG port that might be used for JTAG Boundary Scan. Fortunately, Broadcom did add EJTAG 2.0 support to the bcm4712 chip used in the WRT54G v2 router. This is whatI decided to use. I did not, however, support everything that EJTAG has to offer. Since the intent of this project was ONLY to be able to recover/reflash a bad flash (any or all portions of it) or make backups of the flash chip (any or all portions of it) – I only wrote the “WRT54G EJTAG DeBrick Utility” using the bare EJTAG minimums to talk to the flash chip by using DMA routines over EJTAG. Okwith that said let’s move on…

Requirements
In order to debrick your WRT54G v2 router’s flash using EJTAG/JTAG you need really only two things: 1) A parallel based JTAG cable. I built mine for nothing with spare parts but you could also purchase a Xilinx III parallel JTAG cable or possibly a Wiggler style parallel JTAG cable. 2) Software to do the communications and talk to the flash chip. Iwrote my own and am releasing it under the GPL.

Building a JTAG cable
The JTAG cable can actually be of a few different types; however, I decided on a Xilinx parallel type cable since those are very easy to construct for little or no money. You could also use a Wiggler style parallel cable. Since I made the Xilinx cable myself that is what I am going to describe: Parts needed: 1) One DB25parallel connector shell with solder pads 2) Four 100-ohm resistors

3) One old 12 or 14-pin ribbon cable with a connector on the end (from an old PC card) or you can use your own wire and solder your own ends. 4) One 12 pin male header (to solder to the board) I am not going to write a real detailed explanation as I think pictures will make things much easier. Here is a simple schematic of how towire up the parallel connector end and what signals they map to:

Note:
You don't need the VCC and TRST pins on the interface: The TRST is already pulled high on the WRT54G, that's why there is no (need for a) TRST pin on the board. But you might want to build a generic JTAG cable that works with other devices too (as I did – but not needed), even if they actually have a TRST pin. Since this is...