Some Realtek switches have an unpopulated JTAG header on the main board. Depending on the device, these can be made functional with some small modifications.

The following headers have been encountered:

• 2.54m pitch, 14-pin header: MIPS EJTAG layout
• 1.27mm pitch, 20-pin header: possibly Toshiba MIPS 20-pin with missing nSRST

The following config file for OpenOCD can be loaded in addition to your JTAG probe config. It assumes a chain of two elements, with the MIPS CPU being the second device. The first device is assumed to be the switch core, although it could also be something else.

# Realtek Otto/Otto40 MIPS SoC
# Modified from ath79.cfg
# https://openwrt.org/docs/guide-user/hardware/debrick.ath79.using.jtag#ath79cfg
 
if { [info exists CHIPNAME] } {
   set _CHIPNAME $CHIPNAME
} else {
   set _CHIPNAME otto
}
 
if { [info exists ENDIAN] } {
   set _ENDIAN $ENDIAN
} else {
   set _ENDIAN big
}
 
if { [info exists CPUTAPID] } {
   set _CPUTAPID $CPUTAPID
} else {
   set _CPUTAPID 0x00000001
}
 
if { [info exists SWITCHTAPID] } {
   set _SWITCHTAPID $SWITCHTAPID
} else {
   set _SWITCHTAPID 0x00001001
}
 
jtag_ntrst_assert_width 200
jtag_ntrst_delay 1
 
reset_config trst_only

#jtag newtap $_CHIPNAME cpu -irlen 5 -ircapture 0x1 -irmask 0x1f -expected-id $_CPUTAPID
jtag newtap $_CHIPNAME switchcore -irlen 5 -expected-id $_SWITCHTAPID
jtag newtap $_CHIPNAME cpu -irlen 5 -expected-id $_CPUTAPID
 
set _TARGETNAME $_CHIPNAME.cpu
target create $_TARGETNAME mips_m4k -endian $_ENDIAN -chain-position $_TARGETNAME