Help. ASUS RT-AC68u bricked - JTAG help needed

[MichaelB]

Hi,
I have a Asus RT-AC68u that I accidentally bricked doing an upgrade to the latest merlin software.
I was having trouble with it not producing a decent output signal, and I'm pretty sure I corrupted the CFE
probably in impatience when it was reloading.

In any case, I get nothing on the Serial port, and of course have tried TFTP and recovery mode using the reset switch during boot. I have a solid USB 2.o lite and if I plug an ethernet cable in port 1 it flashes, but no response monitoring with wireshark and attempting a tftp. No ping response at all.

I was able to hook up a JTAG connection using a Raspberry Pi, and can see the CPU on a scan_chain using
openocd but it looks like openocd does not have good support for the BCM4708 cpus. I've tried to make some adjustments for it, but if I try to do a flash erase I get an error and the connection resets and I start over.
I can see the cpu on an autoprobe as well.

Is there a resource with a JTAG TCL command set or scripts that supports the BCM4708 cpu target and this router? If there is someone here that can kindly provide some guidance I would sure appreciate some direction.
Hate to be stuck at the point when I can talk via the JTAG interface.

Trying 127.0.0.1...
Connected to localhost.
Escape character is '^]'.
Open On-Chip Debugger
> scan_chain
TapName Enabled IdCode Expected IrLen IrCap IrMask
-- ------------------- -------- ---------- ---------- ----- ----- ------
0 auto0.tap Y 0x502bf17f 0x00000000 3 0x01 0x03

>

Thanks in advance.

Michael

 

[ZeLbeT]

Hello. I have bricked exact router as yours. Could you share info, how to connect JTAG to board?

 

[Mravko]

Hi,
I have a Asus RT-AC68u that I accidentally bricked doing an upgrade to the latest merlin software.
I was having trouble with it not producing a decent output signal, and I'm pretty sure I corrupted the CFE
probably in impatience when it was reloading.

In any case, I get nothing on the Serial port, and of course have tried TFTP and recovery mode using the reset switch during boot. I have a solid USB 2.o lite and if I plug an ethernet cable in port 1 it flashes, but no response monitoring with wireshark and attempting a tftp. No ping response at all.

I was able to hook up a JTAG connection using a Raspberry Pi, and can see the CPU on a scan_chain using
openocd but it looks like openocd does not have good support for the BCM4708 cpus. I've tried to make some adjustments for it, but if I try to do a flash erase I get an error and the connection resets and I start over.
I can see the cpu on an autoprobe as well.

Is there a resource with a JTAG TCL command set or scripts that supports the BCM4708 cpu target and this router? If there is someone here that can kindly provide some guidance I would sure appreciate some direction.
Hate to be stuck at the point when I can talk via the JTAG interface.



Thanks in advance.

Michael

Hi Michael,
I may be a couple of years late but I had a similar experience with my EA6900 which leverages the same SoC (bcm4708a0).
I've had some more success with my connectivity after trawling the web and testing.
On the Linksys EA6900 there is a "secret" jumper (EJ5) which totally changes the JTAG response.

> scan_chain
TapName Enabled IdCode Expected IrLen IrCap IrMask
-- ------------------- -------- ---------- ---------- ----- ----- ------
0 bcm4708a0.cpu Y 0x4ba00477 0x4ba00477 4 0x01 0x03

I hope this helps.

PS, if you did have some more luck since your post, I'd love to find out what you've achieved

Cheers,

 

[L&LD]

Welcome to the forums @Mravko.

You're replying to someone with one post from over two and a half years ago that hasn't been heard from since.

Don't hold your breath for a response.