I recently bough a very nice and very cheap WiFi router - Amit CDE530AM-S.
It's based on the Ralink RT3050 chipset, with 8MB of flash, 32MB of RAM and USB host.
Motivated by Arran Short, who's managed to run OpenWrt (a modified Fonera 2.0n image) on an Edimax NS-1500 (also based on RT3050), I decided to try running OpenWrt on the Amit.
The device has a bootloader, but it has no documentation, and there are no official firmware images available to try to decipher the required format.
I've managed to set up a JTAG connection using OpenOCD, here's a little HOWTO.
Hardware connection
First of all, the CDE530AM-S has two serial ports, one nicely brought out on a pin header, unfortunately it's not used for anything. The one used as a serial console is just two tiny pads on the underside of the board near the chip, fortunately they are marked RX and TX, the baud rate is 57600.
As for JTAG, there is a standard EJTAG header on the underside of the board, but to make it work you have to populate a small resistor near the TDO pin (I guess you can bridge it with solder, just to be safe I soldered in a 51 Ohm resistor). All the other pads are for pull-downs or pull-ups so you can ignore them.
 |
| Don't forget about that resistor (R28)! |
Software
I'm using OpenOCD and a Wiggler clone parallel port JTAG adapter.
Connect everything, the nTRST pin can be pulled high all the time if your adapter doesn't control it.
Create a file rt3050.cfg containing (you have to change the contents if you use a different adapter):
set _CHIPNAME rt3050
set _ENDIAN little
#daemon configuration
telnet_port 4444
gdb_port 3333
#interface
interface parport
parport_port 0
parport_cable wiggler
#jtag_speed 0
set _CPUTAPID 0x1335024F
jtag_nsrst_delay 100
jtag_ntrst_delay 100
# jtag scan chain
# format L IRC IRCM IDCODE (Length, IR Capture, IR Capture Mask, IDCODE)
jtag newtap $_CHIPNAME cpu -irlen 5 -ircapture 0x1 -irmask 0x1
set _TARGETNAME [format "%s.cpu" $_CHIPNAME]
target create $_TARGETNAME mips_m4k -endian $_ENDIAN -chain-position $_TARGETNAME
How to use JTAG:
1. Open two terminal windows
2. Connect everything and power up the router
3. In one terminal run
"openocd -f rt3050.cfg" (you have to that quickly after power up, before the device leaves the bootloader)
4. In the other terminal run "
telnet localhost 4444"
5. Use the telnet window to send commands to OpenOCD, start off with writing "halt", which will stop the CPU and allow you to read and edit the memory
Some useful commands:
mdb [
phys]
addr [
count]
Display contents of address
addr, as 32-bit words (
mdw), 16-bit halfwords (
mdh), or 8-bit bytes (
mdb).
dump_image filename address size
Dump
size bytes of target memory starting at
address to the binary file named
filename.
load_image filename address [[
bin|ihex|elf|s19]
min_addr max_length]
Load image from file
filename to target memory offset by
address from its load address.
resume [
address]
Resume the target at its current code position, or the optional
address if it is provided.
Refer to OpenOCD documentation for more info.
Refer to the RT3050/52 datasheet for memory mapping information:
qasdfdsaq.com/files/RT3050_5x_V2.0_081408_0902.pdf
