Updating firmware on airport express
It was obscured by a part of one of the EMI shield anchors; with the anchor removed, I was able to view the package: Upon removal of the bottom panel, there is a debug header visible in the corner, adjacent to the audio jack.
The header layout nearly corresponds to the compact TI 20 pin connector for JTAG on certain ARM devices, except the two columns of pads are offset slightly: Two of the pads are connected to the onboard low-speed UART.
I performed a capture while toggling the output for confirmation: Despite configuring all four GPIOs as outputs, only TDO responded with any change of output.
To test the other three pads, I pulled each of them up by connecting them to VCC through a 10kΩ resistor.
CFE (the bootloader; more on that later) has built-in functions to read and write at arbitrary memory addresses.
I decided to sacrifice one of my two test devices to test for continuity between the BGA pads and the debug header pads.
18040050: 00000C0B 00000000 00000000 00000000 ................ 18040060: 00000000 0D0F110E 00000000 00000040 [email protected] *** command status = 0 After connecting a logic analyzer to the unknown pads, I set the DISABLE_JTAG bit, configured GPIO[3:0] as outputs, and set the outputs high.
One of the four unknown signals went from low to high (corresponding to the TDO pin).
The BGA removal went rather poorly, and the tracings underneath were damaged enough that I was unable to locate any connections between a set of pads.
My final idea was to manipulate the GPIO registers to try to map out the connection between the header and So C.Noticably absent was one from i Fixit, who performed teardowns of several other devices in the Air Port family.The main components on the logic board are as follows: The AP contains a MIPS 74Kc core in a big endian configuration.Substituted for the Hynix memory found on other devices is the Nanya NT5TU32M16DG-AC.