9d98f8b7a7
The Linksys WAG200G router has a TI AR7 SoC and a 4MB Flash layout
similar to the Netgear DG834v3 router [1].
Below is an example of a successful flash recovery, using a TUMPA,
connected to the MIPS EJTAG 2.6 header (JP102) of the router.
WAG200G [2] TUMPA [3]
Desc Pin Pin Desc
------------------------
nTRST 1 3 nTRST
TDI 3 5 TDI
TDO 5 13 TDO
TMS 7 7 TMS
TCK 9 9 TCK
nSRST 11 15 RST
GND 2 4 GND
Note that nSRST is optional to halt the CPU, but is required to probe
the flash. For instance, recover the kernel with:
$ sudo ./src/openocd -s tcl \
-f interface/ftdi/tumpa.cfg \
-f tools/firmware-recovery.tcl \
-c 'board linksys-wag200g;
reset_config srst_only;
flash_part kernel /path/to/kernel.bin;
shutdown'
[1] https://wiki.openwrt.org/toh/linksys/wag200g
[2] https://www.linux-mips.org/wiki/JTAG#JTAG_headers
[3] http://www.tiaowiki.com/w/TIAO_USB_Multi_Protocol_Adapter_User's_Manual#20_PIN_JTAG_Connector
Change-Id: I952ba9f706e2e4f8f95ca03a5fa58f391ca030b6
Signed-off-by: Vivien Didelot <vivien.didelot@savoirfairelinux.com>
Reviewed-on: http://openocd.zylin.com/3776
Tested-by: jenkins
Reviewed-by: Spencer Oliver <spen@spen-soft.co.uk>
28 lines
946 B
INI
28 lines
946 B
INI
#
|
|
# Linksys WAG200G Router
|
|
#
|
|
# The stock firmware Flash layout is organized as follow:
|
|
#
|
|
# Start End Device
|
|
# 0x90000000 0x90020000 /dev/mtdblock/2
|
|
# 0x90020000 0x900d0000 /dev/mtdblock/1
|
|
# 0x900d0000 0x903a0000 /dev/mtdblock/0
|
|
# 0x903a0000 0x903e0000 /dev/mtdblock/5
|
|
# 0x903e0000 0x903f0000 /dev/mtdblock/3
|
|
# 0x903f0000 0x90400000 /dev/mtdblock/4
|
|
|
|
set partition_list {
|
|
adam2 { "Adam2 bootloader" 0x90000000 0x00020000 }
|
|
kernel { "Kernel" 0x90020000 0x000b0000 }
|
|
rootfs { "Root FS" 0x900d0000 0x002d0000 }
|
|
lang { "Minix language part" 0x903a0000 0x00040000 }
|
|
config { "Firmware config" 0x903e0000 0x00010000 }
|
|
adam2env { "Adam2 environment" 0x903f0000 0x00010000 }
|
|
}
|
|
|
|
source [find target/ti-ar7.cfg]
|
|
|
|
# External 4MB MXIC 29LV320MBTC Flash (Manufacturer/Device: 0x00c2 0x227e)
|
|
set _FLASHNAME $_CHIPNAME.flash
|
|
flash bank $_FLASHNAME cfi 0x90000000 0x00400000 2 2 $_TARGETNAME
|