Intial value of Control register is 0000000C
Intial value of status register is 0000007F
01111111 (0000007F)
Status bit 7 Busy Inverted pin 11 = 1
Status bit 6 *Ack pin 10 = 1
Status bit 5 Paper-out pin 12 = 1
Status bit 4 Select pin 13 = 1
Status bit 3 *Error pin 15 = 1
* means low = true, e.g., *Error
VCC connected
values of Control register after init 0x0000000C
value of status register after init 0x0000007F
system reset complete
Detected IR chain length = 32
Number of device(s) = 1
idcode 0x1471617f 32
Jtag is in LV mode
switching to MIPS mode
Probing bus ... Done
Instruction Length set to 5
CPU Chip ID: 00000000000010001100000101111111 (0008C17F)
*** Found a Broadcom BCM4716 Rev 1 CPU in MIPS MODE chip ***
- EJTAG IMPCODE ....... : 01100000010000010100000000000000 (60414000)
- EJTAG Version ....... : 3.1
- EJTAG DMA Support ... : No
- EJTAG Implementation flags: R4k ASID_8 MIPS16 NoDMA MIPS32
*** DMA Mode Forced On ***
Chip ID 0
Chip Rev 0
Package Options 0
Number of Cores 0
Core Revision 15
Core Type 0
Core Vendor ID 0
Flash Type 0
Flash Type = FLASH_NONE
Dest is bits 0
Dest is bits1 0
Dest is bits 0
Flash is byteswapped 0
Endian Type is LE 0
PLL Type 00000000
spi_flash_read 0x1FC00000
spi_flash_mmr 0x00000000
spi_flash_mmr_size 0x00000000
spi_flash_ctl 0x18000040
spi_flash_opcode 0x18000044
spi_flash_data 0x18000048
spi_ctl_start 0x80000000
spi_ctl_busy 0x80000000
Joined: 07 Jun 2006 Posts: 2087 Location: Odessa, Ukraine
Posted: Fri Oct 08, 2010 14:15 Post subject:
Well, it seems it is a problem with pracc, if it isn't hardware damage. from now on please send everything via e-mail to tornado@tjtag.com, I don't want to flood the thread with useless info for others, we will post something if we have positive results to report _________________ Want JTAG support - Donate a router
or Donate with PayPal !
Well, it seems it is a problem with pracc, if it isn't hardware damage. from now on please send everything via e-mail to tornado@tjtag.com, I don't want to flood the thread with useless info for others, we will post something if we have positive results to report
I can confirm that my wrt320n misbehave in the very same way as lijianch's. I wont flood with another log of /dma /flash_debug as my output is exactly the same as his.
Do you also not have a working cfe on the router ?
Yeah, my flash should be totally empty after -erase:wholeflash (done with RC1). I don't know if the erasing process went properly but cfe is either gone or not working. Serial console shows no activity.
I´m curious if someone has already observed this :
If one overwrites the CFE with 00´s or FF´s, jtag can find the flash and one can re-flash it.
If one overwrites the CFE with garbage ( say, a .DOC file or zipped firmware file ) , then the processor seems to hang and not be able to detect the flash.
Tuesday is a holiday here, and I will be able to try the newest version of tjtag to see if it can detect the flash now ( the old versions couldn´t ) .
Modem/Router, based in Broadcom 6348. When it has the correct firmware, all jtag tools workok. After updating with wrong firmware, tools cannot detect flash.
One clue from a French forum is that the garbage in the place of CFE make the processor hang and thus not process the jtag commands.
Ops, forgot the models. Dlink 2640U and 2640B mainly ( about 20 of them here in this situation ) . There are some other brands with the same chips, but I haven´t had time to try burning a jpg to their cfe to see what happens...
Joined: 07 Jun 2006 Posts: 2087 Location: Odessa, Ukraine
Posted: Tue Oct 12, 2010 7:45 Post subject:
@RogFanther
I have a 2640B here that someone sent me, they had tried to flash a different CFE or firmware to it, and after that, jtag could not detect the flash... So I would be interested in hear any information you know about that would help us figure out how to recover the router, please e-mail me at tornado@tjtag.com
Send me any links you may have on it please _________________ Want JTAG support - Donate a router
or Donate with PayPal !
I have a 2640B here that someone sent me, they had tried to flash a different CFE or firmware to it, and after that, jtag could not detect the flash... So I would be interested in hear any information you know about that would help us figure out how to recover the router, please e-mail me at tornado@tjtag.com
Send me any links you may have on it please
Could this be somehow related to the problem we see with wrt320n? Assuming flash was written incorrectly when lijianch or myself tried to re-flash CFE, then we have garbage in place of CFE.
Besides, the fact that (at least mine) control/status registers only are the same as your if tjtag is run within ~2sec after the router is powered on and change after (as shown here) seem to indicate some modification in CPU status (maybe a crash?).
Joined: 07 Jun 2006 Posts: 2087 Location: Odessa, Ukraine
Posted: Tue Oct 12, 2010 9:23 Post subject:
I don't believe so, I know we have de-bricked and or flash a 320n. What I don't know is if it is a change I have made, or what the real problem is, I have the 4718 here, and these to are very similiar when it comes to tjtag, with the exception of the 320n havinf a serial flash.
Who, know...when I get access to one, I will try to figure it out _________________ Want JTAG support - Donate a router
or Donate with PayPal !