TJTAG - EJTAG De-Brick tool - IMPORTANT CHANGE:See 1st Post.

Post new topic   This topic is locked: you cannot edit posts or make replies.    DD-WRT Forum Index -> General Questions
Goto page Previous  1, 2, 3 ... 72, 73, 74 ... 82, 83, 84  Next
Author Message
bodyguard
DD-WRT Novice


Joined: 26 Apr 2009
Posts: 7

PostPosted: Wed Nov 17, 2010 23:03    Post subject: Reply with quote
Hi.
I have D-link 2640u. Via console I selected incorrect model and modem in "down". Only ligth red power.

Flash MX29Lv320CBT

TJtag output
Code:

c:\jtag>tjtag3.exe -probeonly

==============================================
 EJTAG Debrick Utility v3.0.1 Tornado-MOD
==============================================

Probing bus ... Done

Instruction Length set to 5

CPU Chip ID: 00000110001101001000000101111111 (0634817F)
*** Found a Broadcom BCM6348 Rev 1 CPU chip ***

    - EJTAG IMPCODE ....... : 00000000100000000000100100000100 (00800904)
    - EJTAG Version ....... : 1 or 2.0
    - EJTAG DMA Support ... : Yes
    - EJTAG Implementation flags: R4k MIPS32

Issuing Processor / Peripheral Reset ... Done
Enabling Memory Writes ... Done
Halting Processor ... <Processor did NOT enter Debug Mode!> ... Done
Clearing Watchdog ... Done

Probing Flash at (Flash Window: 0x1fc00000) ...
Done

*** Unknown or NO Flash Chip Detected ***

 *** REQUESTED OPERATION IS COMPLETE ***


c:\jtag>tjtag3.exe -probeonly /flash_debug

==============================================
 EJTAG Debrick Utility v3.0.1 Tornado-MOD
==============================================

Probing bus ... Done

Instruction Length set to 5

CPU Chip ID: 00000110001101001000000101111111 (0634817F)
*** Found a Broadcom BCM6348 Rev 1 CPU chip ***

    - EJTAG IMPCODE ....... : 00000000100000000000100100000100 (00800904)
    - EJTAG Version ....... : 1 or 2.0
    - EJTAG DMA Support ... : Yes
    - EJTAG Implementation flags: R4k MIPS32

Issuing Processor / Peripheral Reset ... Done
Enabling Memory Writes ... Done
Halting Processor ... <Processor did NOT enter Debug Mode!> ... Done
Clearing Watchdog ... Done
spi_flash_read 0x1fc00000
spi_flash_mmr  0x00000000
spi_flash_mmr_size 0x00000000
spi_flash_ctl  0x18000040
spi_flash_opcode 0x18000044
spi_flash_data 0x18000048
spi_ctl_start 0x80000000
spi_ctl_busy 0x80000000

Probing Flash at (Flash Window: 0x1fc00000) ...

Debug AMD Vendid :    00000000000000000000000000000000 (00000000)
Debug AMD Devdid :    00000000000000000000000000000000 (00000000)

Debug SST Vendid :    00000000000000000000000000000000 (00000000)
Debug SST Devdid :    00000000000000000000000000000000 (00000000)

Debug BSC-SCS Vendid :00000000000000000000000000000000 (00000000)
Debug BCS-SCS Devdid :00000000000000000000000000000000 (00000000)
REGREAD32 data 0x00000000 spi_flash_mmr 0x00000000 reg 0x18000040
REG 0x18000044 REGWRITE32 0x0000049f
SPI_FLASH_OPCODE 0x18000044 PTR_OPCODE 0x0000049f
REG 0x18000040 REGWRITE32 0x8000049f
SPI_FLASH_CTL SEND -> 0x18000040 reg 0x8000049f
REGREAD32 data 0x00000000 spi_flash_mmr 0x00000000 reg 0x18000040
REGREAD32 data 0x00000000 spi_flash_mmr 0x00000000 reg 0x18000048

Debug SPI id :    00000000000000000000000000000000 (00000000)

Debug SPI Vendid :    00000000000000000000000000000000 (00000000)
Debug SPI Devdid :    00000000000000000000000000000000 (00000000)
Done

*** Unknown or NO Flash Chip Detected ***

 *** REQUESTED OPERATION IS COMPLETE ***

and
Code:

==============================================
 EJTAG Debrick Utility v3.0.2 RC2-1 Tornado-MOD
==============================================

Selected  port  = 0x378 

Intial value of Control register is 0000000C
Intial value of status register is  00000068
01101000 (00000068)

Status bit 7 Busy Inverted pin 11 = 1
Status bit 6 *Ack          pin 10 = 1
Status bit 5 Paper-out     pin 12 = 1
Status bit 4 Select        pin 13 = 0
Status bit 3 *Error        pin 15 = 1
* means low = true, e.g., *Error

VCC connected
values of Control register after init 0x0000000C
value of status register after init   0x00000068
system reset complete

Detected IR chain length = 0
Number of device(s) = 0

Probing bus ... Done

Instruction Length set to 5

CPU Chip ID: 11111111111111111111111111111111 (FFFFFFFF)
*** Unknown or NO CPU Chip ID Detected ***

*** Possible Causes:
    1) Device is not Connected.
    2) Device is not Powered On.
    3) Improper JTAG Cable.
    4) Unrecognized CPU Chip ID.

I try in v3.0.1 set /fc:xx for all 29lv320 bottom
flash not detected (read all 0x00) (-backup:nvram /fc:40).

Howto I can repair modem?
Sponsor
RogFanther
DD-WRT User


Joined: 24 May 2008
Posts: 156

PostPosted: Wed Nov 17, 2010 23:27    Post subject: Reply with quote
You mean you downloaded and upgraded the modem with wrong firmware ?

If yes, and nothing appears in the serial port, for now that cannot be solved without rewriting the flash in an external burner. What people somehow agree is that the wrong firmware causes the processor to lock and not allow memory access.
bodyguard
DD-WRT Novice


Joined: 26 Apr 2009
Posts: 7

PostPosted: Thu Nov 18, 2010 8:20    Post subject: Reply with quote
RogFanther wrote:
You mean you downloaded and upgraded the modem with wrong firmware ?

No, I not download firmware.
I make the mistake in choice modem board id.

Code:

CFE> b
Press: <enter> to use current value
'-' to go previous parameter
'.' to clear the current value
'x' to exit this command
Board Id Name (0-11)
96348GW-11  ------- 0
96348GW-12  ------- 1
R           ------- 2
R2P-4M-16M  ------- 3
WLAN        ------- 4
SIP         ------- 5
CT5612S-122 ------- 6
D-1P-W      ------- 7
D-4P-W      ------- 8
D-1P-3P-W   ------- 9
VSIP        ------- 10
IAD2P       ------- 11 : 8 2

My board id is 8, I choice 1 (code below sample from internet).

I think clear nvram change state of modem to configure mode. But tjtag cannot read flash.
mstombs
DD-WRT User


Joined: 31 Oct 2007
Posts: 151

PostPosted: Thu Nov 18, 2010 23:32    Post subject: Reply with quote
@bodyguard

comparing your output with that on

http://texas-88.livejournal.com/657.html

or

http://pudeev.livejournal.com/33915.html?thread=124283

suggest the flash detection is not correct, there's also differences in "Processor debug mode"

What cable are you using - if unbuffered it needs to be short!
DSpyder
DD-WRT Novice


Joined: 17 Aug 2010
Posts: 3

PostPosted: Sun Nov 28, 2010 22:54    Post subject: Adding A SnapGear Router to TJtag Reply with quote
Any chance of getting U to add support, for a SnapGear SG8100 router, to your program, that I just got for Thanksgiving

I had to guess the JTag pin out, It's look's to be standard 20 pin layout and TJTag correctly identifies the routers CPU, so I think (hope) that I have my wiggler connected correctly.

It uses a IXP425 CPU
It uses a Intel StrataFlash JS28F256-P30B95 Chip (H-Flash ID = 0x891C0089) for it's Flash and
uses 2 HY57V561620FTP-H Chips for it's RAM.


Does TJtag ever put the Processor into "Debug Mode" on any router?

I always see the message:

"Halting Processor ... <Processor did NOT enter Debug Mode!> ... Done "

I thought that I would ask U about adding support for this router, before I look at trying to change your SourceCode to support these chips.

I'm currently working on, finding out what addresses, these chips use on this router, so I can try to configure H-JTAG and H-Flasher to try to dump it's OEM firmware and then to load it with newly compiled firmware.

Thanks For All your Hard work on this program.

Tom


Last edited by DSpyder on Fri Dec 03, 2010 9:14; edited 1 time in total
stephenw10
DD-WRT User


Joined: 25 Jun 2010
Posts: 56

PostPosted: Tue Nov 30, 2010 13:23    Post subject: Reply with quote
I don't think tjtag supports any arm cpus except to identify them.
I'm in a similar situation to you though, I'm trying to find the flash address on an x-scale platform. I've had much more success with urjtag but still can't access the flash.
Any hints?
Steve
mstombs
DD-WRT User


Joined: 31 Oct 2007
Posts: 151

PostPosted: Thu Dec 02, 2010 21:41    Post subject: Reply with quote
Bug report on tjtag 3.0.2 RC1 (Linux 64 bit version)

The help text reports

Quote:
/cable:XXXXXXXX .... set cable type (xilinx, wiggler, etc)


but "xilinx" doesn't work may be "/cable:dlc5" which is mentioned somewhere.?

I do have the Tornado recommended jtag adaptor. but still using homemade HDM passive cable..., which works in 3.0.1.

It may be related to this version trying to use my non-existent parport1, the parallel port is parport0?
mstombs
DD-WRT User


Joined: 31 Oct 2007
Posts: 151

PostPosted: Thu Dec 02, 2010 23:22    Post subject: Re: Adding A SnapGear Router to TJtag Reply with quote
DSpyder wrote:

Does TJtag ever put the Processor into "Debug Mode" on any router?

I always see the message:

"Halting Processor ... <Processor did NOT enter Debug Mode!> ... Done "


Yes!

Quote:
==============================================
EJTAG Debrick Utility v3.0.1 Tornado-MOD
==============================================

Probing bus ... Done

Instruction Length set to 5

CPU Chip ID: 00000000000000000001000000001111 (0000100F)
*** Found a TI AR7 TNETD7x00 Rev 1 CPU chip ***

- EJTAG IMPCODE ....... : 01000001010000000100000000000000 (41404000)
- EJTAG Version ....... : 2.6
- EJTAG DMA Support ... : No
- EJTAG Implementation flags: R4k DINTsup ASID_8 NoDMA MIPS32

Issuing Processor / Peripheral Reset ... Done
Enabling Memory Writes ... Skipped
Halting Processor ... <Processor Entered Debug Mode!> ... Done
Clearing Watchdog ... Done
DSpyder
DD-WRT Novice


Joined: 17 Aug 2010
Posts: 3

PostPosted: Fri Dec 03, 2010 4:44    Post subject: Processor not entering Debug Mode Reply with quote
mstombs wrote:
DSpyder wrote:

Does TJtag ever put the Processor into "Debug Mode" on any router?

I always see the message:

"Halting Processor ... <Processor did NOT enter Debug Mode!> ... Done "


Yes!

Quote:
==============================================
EJTAG Debrick Utility v3.0.1 Tornado-MOD
==============================================

Halting Processor ... <Processor Entered Debug Mode!> ... Done
Clearing Watchdog ... Done



Is it that TJtag is able to go into "Debug Mode" only with some CPUs or
Is it the way that I have my JTag interface board setup and connected to the router's Jtag interface?
mstombs
DD-WRT User


Joined: 31 Oct 2007
Posts: 151

PostPosted: Fri Dec 03, 2010 15:35    Post subject: Reply with quote
Same HDM passive home-made jtag cable also works on this Broadcom WRT54G-TM

Code:
/tjtag3-0-1/linux_64bit$ sudo ./tjtag3 -erase:nvram /noreset

==============================================
 EJTAG Debrick Utility v3.0.1 Tornado-MOD
==============================================

Probing bus ... Done

Instruction Length set to 8

CPU Chip ID: 00000101001101010010000101111111 (0535217F)
*** Found a Broadcom BCM5352 Rev 1 CPU chip ***

    - EJTAG IMPCODE ....... : 00000000100000000000100100000100 (00800904)
    - EJTAG Version ....... : 1 or 2.0
    - EJTAG DMA Support ... : Yes
    - EJTAG Implementation flags: R4k MIPS32

Issuing Processor / Peripheral Reset ... Skipped
Enabling Memory Writes ... Done
Halting Processor ... <Processor Entered Debug Mode!> ... Done
Clearing Watchdog ... Done
RogFanther
DD-WRT User


Joined: 24 May 2008
Posts: 156

PostPosted: Fri Dec 03, 2010 21:26    Post subject: Re: Processor not entering Debug Mode Reply with quote
DSpyder wrote:


Is it that TJtag is able to go into "Debug Mode" only with some CPUs or
Is it the way that I have my JTag interface board setup and connected to the router's Jtag interface?


From my experience, sometimes bad soldering in the cable can cause it, sometimes the correct pinout for the jtag connection is required, and in a few cases ( DSL-2640U, for example ) corrupt firmware hangs the processor before it can enter debug mode.

[ ]
hvandrie
DD-WRT Novice


Joined: 29 Mar 2009
Posts: 36
Location: Netherlands

PostPosted: Sun Dec 05, 2010 21:47    Post subject: Reply with quote
Tornado wrote:
@gabber2k
Tjtag 3.0.1 is not capable of flashing your 320n, only 3.0.2 is, and its still a little buggy, I thnk I have found the problem with it and will post another RC3 today. Then you may be able to recover you router.


Hey Tornado, any news about the RC3 version?

I have an WRT320N also, which is bricked for about a year now. I was in touch with BlCa' and performed a erase:wholeflash . Unfortunately, the flash now seems to be zero't and I too can't flash anything in there. It also stops at 'init PrAcc' when using tjtag RC2-1 without /dma. However, with /dma still nothing is written. Am trying to flash back the CFE and it's not 'written' somehow.
I use the universal TJTAG adapter as you advertise with in your signature footer.

_________________
It's all about bits and bytes!
barryware
DD-WRT Guru


Joined: 26 Jan 2008
Posts: 13049
Location: Behind The Reset Button

PostPosted: Thu Dec 23, 2010 19:15    Post subject: Pony Up! Reply with quote
It's time for you guys to "Pony Up" and contribute a little something to Tornado for all his efforts and work!

If you fixed your router or have made a few bucks fixing someone else's router, it is time to send Tornado a token of your appreciation.

No contribution is too small or too large!

You just fixed your 50 ~ 150 dollar router using T~'s utility, donate a few bucks or hang your head in shame. Support for new routers is needed.

The donation link is in the 1st post of this thread.

Happy holidays to all.

_________________
[Moderator Deleted] Shocked
Eaglesoft69
DD-WRT Novice


Joined: 29 Sep 2008
Posts: 4

PostPosted: Tue Jan 11, 2011 0:51    Post subject: Linksys WRT54GS v7 Bricked ? Reply with quote
Ok ... So I have a WRT54GS Version 7 I attempted to flash with the DD-WRT firmware close to 18 months ago and I apparently Bricked it and after trying to EJtag it with a Buffered Jtag and not getting it to revive I placed it to the wayside thinking that I would tackle it at a later date. Well that later date has arrived as I came across it last night while cleaning up some of my cluttered Junk. What I am wondering is within the past 18mo if any progress has been made with software that would help me to un-brick this? All I get is Solid lights where the Port Light are located. If anyone can shed some light on this or maybe if one of the Gurus would like this Challenge I would be interested to hear from them

Eaglesoft69
barryware
DD-WRT Guru


Joined: 26 Jan 2008
Posts: 13049
Location: Behind The Reset Button

PostPosted: Tue Jan 11, 2011 1:09    Post subject: Re: Linksys WRT54GS v7 Bricked ? Reply with quote
Eaglesoft69 wrote:
Ok ... So I have a WRT54GS Version 7 I attempted to flash with the DD-WRT firmware close to 18 months ago and I apparently Bricked it and after trying to EJtag it with a Buffered Jtag and not getting it to revive I placed it to the wayside thinking that I would tackle it at a later date. Well that later date has arrived as I came across it last night while cleaning up some of my cluttered Junk. What I am wondering is within the past 18mo if any progress has been made with software that would help me to un-brick this? All I get is Solid lights where the Port Light are located. If anyone can shed some light on this or maybe if one of the Gurus would like this Challenge I would be interested to hear from them

Eaglesoft69


If you are having a problem with GS V7, it is not the fault of the jtag software. tjtag 2.1.4 & earlier supported the GS v7

_________________
[Moderator Deleted] Shocked
Goto page Previous  1, 2, 3 ... 72, 73, 74 ... 82, 83, 84  Next Display posts from previous:    Page 73 of 84
Post new topic   This topic is locked: you cannot edit posts or make replies.    DD-WRT Forum Index -> General Questions All times are GMT

Navigation

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You can attach files in this forum
You can download files in this forum