Attached is the output from a -probeonly /flash_debug.
The router is an E3000 (real one) with an MXIC MX29LV640EBTI-70G flash chip.
Using version 3.0.2-RC2-1, I need to use /fc:107 to address the chip. Using that fc.. I can read & write to the chip. However, writing is REALLY slow.. 3+ hours for a 256k cfe.
I used your preferred adapter.
atm.. I can test no further. A member sent me a working E3000 to enable jtag & install jtag & serial headers cuz I guess he plans on bricking it .
I have to send the router home. The two I own, I messed up the pads trying to enable jtag. (Since then, I got it figured out ) I can test on the next brick I get.. Or.. this would be a perfect time for someone to donate a router to you:
Intial value of Control register is 000000CC
Intial value of status register is 0000007F
01111111 (0000007F)
Status bit 7 Busy Inverted pin 11 = 1
Status bit 6 *Ack pin 10 = 1
Status bit 5 Paper-out pin 12 = 1
Status bit 4 Select pin 13 = 1
Status bit 3 *Error pin 15 = 1
* means low = true, e.g., *Error
VCC connected
values of Control register after init 0x000000CC
value of status register after init 0x0000007F
system reset complete
Detected IR chain length = 32
Number of device(s) = 1
idcode 0x1471617f 32
Jtag is in LV mode
switching to MIPS mode
Probing bus ... Done
Instruction Length set to 5
CPU Chip ID: 00000000000010001100000101111111 (0008C17F)
*** Found a Broadcom BCM4716 Rev 1 CPU in MIPS MODE chip ***
- EJTAG IMPCODE ....... : 01100000010000010100000000000000 (60414000)
- EJTAG Version ....... : 3.1
- EJTAG DMA Support ... : No
- EJTAG Implementation flags: R4k ASID_8 MIPS16 NoDMA MIPS32
Chip ID 4716
Chip Rev 1
Package Options a
Number of Cores 9
Core Revision 79
Core Type 710
Core Vendor ID 19a10000
Flash Type 700
Flash Type = PFLASH
Dest is bits 0
Dest is bits1 0
Dest is bits 0
Flash is byteswapped 0
Endian Type is LE 0
PLL Type 00000000
spi_flash_read 0x1FC00000
spi_flash_mmr 0x00000000
spi_flash_mmr_size 0x00000000
spi_flash_ctl 0x18000040
spi_flash_opcode 0x18000044
spi_flash_data 0x18000048
spi_ctl_start 0x80000000
spi_ctl_busy 0x80000000
Joined: 24 Feb 2009 Posts: 2026 Location: Sol System > Earth > USA > Arkansas
Posted: Sat Nov 05, 2011 17:16 Post subject:
Unfortunately that will not happen. Although there is a large group of "modders" out there, if the manufacturer started adding jtag headers to their routers, then most people would be able to fix any problems with their router. They (the manufacturer) would lose money because less people would upgrade to the latest greatest model.
It is sad really, but I would love to see those jtag headers too. _________________ E3000 22200M KongVPN K26
WRT600n v1.1 refirb mega 18767 BS K24 NEWD2 [not used]
WRT54G v2 16214 BS K24 [access point]
Try Dropbox for syncing files - get 2.5gb online for free by signing up.
Read! Peacock thread
*PLEASE* upgrade PAST v24SP1 or no support.
I have a bricked E3000 that was probably hit by a lightning because switch IC has a small hole. Serial console output is scrambled but at least it gives output.
If it will be useful for Tornado, I can send it to him...
I know it is not the best condition but is what I have atm..
Joined: 26 Jan 2008 Posts: 13049 Location: Behind The Reset Button
Posted: Sat Nov 05, 2011 21:28 Post subject:
Indeed...
tjtag now fully supports the E3000 (610V2). No fuss, no muss.. when writing, you need to include the /byte_mode switch due to the 8 bit buss. For reading / backing up, the switch is not required.
It does write slowly (due to the 8 bit buss) but is accurate.
The only thing with the E3000 (610V2) is that the jtag circuit on the pcb needs to be enabled via bridging some pads. This has been covered in the convert thread.
There are a few 610's (V2's) that can now be recovered when converting to an E3000 (cuz the owners didn't follow the directions).
Kudo's Tornado.. You Beez Da Man!
Don't forget to donate via paypal or send routers to Tornado so we can keep the support coming and up to date.
Joined: 07 Jun 2006 Posts: 2087 Location: Odessa, Ukraine
Posted: Sun Nov 06, 2011 14:42 Post subject: CFE flash time on Serial flash 8bit bus
I no longer have a RT-N16 to test on, left it in Odessa, Ukraine. But your dealing with a 8bit bus here, that why is takes so long. I do have a E1000v2 to test on, that is almost the same. It did not take me 3hrs..but it did take probably an hour. It may be possible to speed up the flash, because on the E1000v2, the CFE is actually 128k or less, not 256k. It may be possible to just flash the 128k and save some time, but I have not tested that. _________________ Want JTAG support - Donate a router
or Donate with PayPal !
.
) I can test on the next brick I get.. Or.. this would be a perfect time for someone to donate a router to you:
