[Mookatroid]

As per the JTAG chat in the Broadcom Forum, I have one of these PCI-E Parallel ExpressCards on the way to me ...

http://cgi.ebay.co.uk/ws/eBayISAPI.dll?ViewItem&item=220438537227#ht_3029wt_961

And I looking forward to it operating with TJTAG v3.0.x on my Windows 7 x64 laptop, along with the Universal JTAG adapter that I have already recv'd.

Tornado, please let me know all the required secrets !

[Tornado]

But your still waiting on the cardbus, right ?

[MrAlvin]

@Mookatroid & Tornado

I have been testing the card from http://cgi.ebay.co.uk/ws/eBayISAPI.dll?ViewItem&item=220438537227#ht_3029wt_961
I am happy to report that the card works as intended.

I am also happy to report that the new /port: parameter works fine for this card as well.


I can however not get my setup to read my WRT54Gv2 router cpu, so I made a test setup. See http://www.youtube.com/user/MrAlvinAlien for a short test video, where I discover that TJTAG actually does address the parallel port.

As for reading WRT54Gv2 CPU, then I am probably not using the correct parameters of TJTAG. I am still very new to this JTAG stuff.
I have tried with: tjtag -probeonly /cable:wiggler /port:FCF8
and tjtag -probeonly /port:FCF8
Anybody have suggestions what parameters to use?

I also have a FON 2100 router that I can JTAG test sometime, when I find a good online guide for that router.

[Tornado]

@MrAlvin
I need to see the output from tjtag -probeonly /cable:wiggler /port:FCF8

You might also want to add /noemw for that router

[Mookatroid]

[Tornado]

Just so you know, some laptops use an internal usb for the parallel port, and it will not work...

[booker001]

I have WRT54G v6 router that I bricked trying to revert back to Linksys firmware. The power light is blinking and all the LAN lights are solid all the time. None of recovery methods worked so I'm using a JTAG cable. I erased he nvram, kernel and cfe. I flashed the cfe with one i downloaded from cfe collection project. The power light is still blinking but the LAN lights are off unless a computer is plugged in. The computer also recognizes its connected and the LAN light will show activity when I try and ping the router. The problem is the router will not respond to the pings. I'm not quite sure what to do next, it seems I've inched closer to repairing the thing. Any ideas?

[Tornado]

your pinging 192.168.1.1 and you have a static ip on your computer, something like 192.168.1.2-100 ?

[booker001]

Ya sorry I should have mentioned that. My computer is set to static ip 192.168.1.125 with 255.255.255.0 as the subnet. I also checked the cfe and the ip address is set to 192.168.1.1.

[booker001]

Tornado I fixed it! I was digging through the forums again today and found a post of yours from awhile back. I erased the wholeflash then flashed the cfe and then the kernel. Worked like a charm and I now have a working router again. Thanks for your help, I couldn't have done it without you, this forum or your lovely jtag software.

[MrAlvin]

Success!

Thanks to some personal guidance from Tornado, I have got JTAG working sort of perfectly.

Once I got the right wiring from the Universal JTAG board, then the command:

tjtag302 -probeonly /cable:wiggler /port:FCF8

works on WRT54Gv2, FON2100 and RT-N16


I suppose the parameter /cable:wiggler makes the TJTAG3 & the parallel port loosely follow MIPS EJTAG 2.5/2.6

This is then the pinout on the parallel port

The Universal JTAG board is used in buffered mode, meaning that D2->A1 and Y1->nSRST and so forth
Then TDO->A8 and Y8->D11 (white wire in the pictures)


And the pinout on the WRT54Gv2



EJTAG pinout for FON2100



EJTAG pinout for ASUS RT-N16




Addressing the Flash chips of the FON2100 and RT-N16 will however still take some work, as they are not yet directly detected.


Either way so far so good. Thank you Tornado!

[Mookatroid]

[RogFanther]

Hi,

Has someone dealed with routers that, due to a corruupt firmware/cfe, will hang and not allow the flash to be detected/accessed ?

What I´ve found about the problem ( with old firmware,jtag works ok, with new(wrong) firmware, jtag just detects the processor, not flash ) is some people commenting about unsoldering the CS pin of the flash, others saying VCC... The point seems to make the flash not be active the time the processor tries to access it to start reading the firmware.

Then the processor can be put in jtag reset state, and then reconnect/low the unsoldered pin, so that the software can recognize the flash and burn the cfe.

Has someone made something like this , or that could suggest anothe way ? It seems will be the only way to fix a bunch os broadcom-based units that we have dying from wrong firmware flashing...

Thanks.

[jfmateos]

Hello, I am the proud owner of a bricked fonera 2202 (fonera 2.0).

I am trying tjtag and have built this adaptor:



When i issue the -probeonly command i get different results using tjtag v3 RC1 (it does not detect the MX25L6405 chip) and tjtag v3.0.1 (it seems to get stuck enabling atheros flash read/write).

Does this mean that my jtag adaptor is wrong?

I would really appreciate any advice on how to unbrick this fonera (it does not respond using fonflash neither serial port).
Thanks and best regards from Madrid.

[Tornado]

@jfmateos
e-mail me at tornado@odessaua.com, I will send you the next version that Im working on as long as you can provide feedback

Please post the processor, and flash chip info, and if it's 8bit bus or not