Debriking RT-N16 - tjtag 3.0.2 can´t reed IMPCODE

Post new topic   Reply to topic    DD-WRT Forum Forum Index -> Broadcom SoC based Hardware
Goto page Previous  1, 2, 3  Next
Author Message
tripexio
DD-WRT Novice


Joined: 11 Oct 2011
Posts: 26

PostPosted: Fri Nov 04, 2011 0:05    Post subject: Reply with quote
Tornado,

eventually tell me whatever you need for this

best regards
Sponsor
barryware
DD-WRT Guru


Joined: 26 Jan 2008
Posts: 13049
Location: Behind The Reset Button

PostPosted: Fri Nov 04, 2011 0:10    Post subject: Reply with quote
it'll take a day or two till I can get to it but I'll prep my RT for jtag (clean holes & install header) and see if I can help.

I really would be a big help if you could remember what bricked the router in the 1st place.. A bad flash or config is one thing.. The router coming up bricked one morning after happily running or a lightning storm is another.

Good night.. Get some rest.. You will need it Razz

_________________
[Moderator Deleted] Shocked
tripexio
DD-WRT Novice


Joined: 11 Oct 2011
Posts: 26

PostPosted: Fri Nov 04, 2011 14:16    Post subject: Reply with quote
Hi barryware,

well.. i´ll try to write down as much as i remember
If the following detail could help, i can tell you that once with homemade cable i got the right "EJTAG Version" on "TJTAG3.0.1" prompt, but that happed only 1 time in all my testing, with still no respons on IPMCode

Concerning the way i bricked the asus device, if i remember correct, i think that i was playing stupid with "router table" setup, thats because i had another old router (trust speedshare-turbo 108MB)connected to the rt-n16 trough LAN-ports
At moment of bricking, the software in the rt-n16 was the original.. i think it was "Asus 1.0.9" or something like it

The router now gives no sign of life..
Only WAN and LAN 1 to 4 led are lighted for a short moment on power cycling. After the brief moment every led goes off, unless an activ ethernet cable is plugged in to rt-n16 LAN-port

You can look at my first thread as a newbie, there is few screenshot of the cd-prompt from when i´v tested with resistor-cable and Tjtag 3.0.1..
http://www.dd-wrt.com/phpBB2/viewtopic.php?t=145627

I appreciate very much your effort..

many, many thx.. to you both
Best regards
Tornado
DD-WRT Developer/Maintainer


Joined: 07 Jun 2006
Posts: 2087
Location: Odessa, Ukraine

PostPosted: Fri Nov 04, 2011 15:39    Post subject: Will not work Reply with quote
3.0.1 will NOT work !!! Something is wrong here, just can't figure it out, you get the processor ID... one thing is curious, and thats the parallel port stats, I usuall get something like this:

Intial value of Control register is 0000000C
Intial value of status register is 000000FF
11111111 (000000FF)

Status bit 7 Busy Inverted pin 11 = 0
Status bit 6 *Ack pin 10 = 1
Status bit 5 Paper-out pin 12 = 1
Status bit 4 Select pin 13 = 1
Status bit 3 *Error pin 15 = 1
* means low = true, e.g., *Error

see the Intial value of Control register is 0000000C

_________________
Want JTAG support - Donate a router
or Donate with PayPal !

My preferred parallel jtag adapter:
TIAO Parallel adapter

Tjtag website - http://tjtag.com

Compiling DD-WRT on:
AMD Phenom II X6 1090T @ 3926.667 Mhz

Aptosid X64 - Debian SID X64
Ubuntu 10.10 X64 - Arch X64
tripexio
DD-WRT Novice


Joined: 11 Oct 2011
Posts: 26

PostPosted: Fri Nov 04, 2011 16:14    Post subject: Reply with quote
Hi again Tornado,
as far i can see, there is also a difference between yours and mine on "Status bit 7 busy inverted pin 11", where yours it´s on 1 while mine it´s on 0

Please, tell me if there´s something i can do to help..
i´ll appreciate it.. I will keep on trying

Best regards and respect
tripexio
DD-WRT Novice


Joined: 11 Oct 2011
Posts: 26

PostPosted: Fri Nov 04, 2011 16:17    Post subject: Reply with quote
sorry, the opposit..
yours it´s on 0, mine it´s on 1
regards
tripexio
DD-WRT Novice


Joined: 11 Oct 2011
Posts: 26

PostPosted: Fri Nov 04, 2011 18:18    Post subject: Reply with quote
Hi,
If you think that it could help, i can try jtagging on another motherboard (asus P5Q-E, core2cpu-3,2GHz).. in this case the p-port will not be a native one, but on a PCI-slot, with an "I/O" other than 0x378 Exclamation

Please, will you tell me wich flash chip /fc:xx i have to pick up for rt-n16, so i can try to insert it manually..
Maybe if you feel like, you can tell me shortly how or where to find info for using /start:xxx and /length:xxx Smile

What do you think is the best TJTAG version i should use for testing??

Best regards Wink
barryware
DD-WRT Guru


Joined: 26 Jan 2008
Posts: 13049
Location: Behind The Reset Button

PostPosted: Sat Nov 05, 2011 3:14    Post subject: Reply with quote
works for me... It took a while to prep the router cuz my jtag holes were filled with factory solder. I had to clean that out and install a header before I could test.

I used both 3.0.2 RC2-1 & the new one Tornado sent me to test 3.0.2 RC2-3. Neither had a problem recognizing the processor, flash, impcode and set the instruction length properly.

You have a problem with your rig, your setup, or your router is broke (that is why I asked what caused it to need jtag)

C:\rt-n16>tjtag302 -probeonly

==============================================
EJTAG Debrick Utility v3.0.2 RC2-1 Tornado-MOD
==============================================

Selected port = 0x378

Intial value of Control register is 000000CC
Intial value of status register is 0000007F
01111111 (0000007F)

Status bit 7 Busy Inverted pin 11 = 1
Status bit 6 *Ack pin 10 = 1
Status bit 5 Paper-out pin 12 = 1
Status bit 4 Select pin 13 = 1
Status bit 3 *Error pin 15 = 1
* means low = true, e.g., *Error

VCC connected
values of Control register after init 0x000000CC
value of status register after init 0x0000007F
system reset complete

Detected IR chain length = 32
Number of device(s) = 1

idcode 0x1471617f 32
Jtag is in LV mode
switching to MIPS mode
Probing bus ... Done

Instruction Length set to 5

CPU Chip ID: 00000000000010001100000101111111 (0008C17F)
*** Found a Broadcom BCM4716 Rev 1 CPU in MIPS MODE chip ***

- EJTAG IMPCODE ....... : 01100000010000010100000000000000 (60414000)
- EJTAG Version ....... : 3.1
- EJTAG DMA Support ... : No
- EJTAG Implementation flags: R4k ASID_8 MIPS16 NoDMA MIPS32

Issuing Processor / Peripheral Reset ... Done
Enabling Memory Writes ... Skipped
Halting Processor ... <Processor Entered Debug Mode!> ... Done
Init PrAcc ... Done
Clearing Watchdog ... Done


Chip ID 4716
Chip Rev 1
Package Options a
Number of Cores 9
Core Revision 79
Core Type 710
Core Vendor ID 19a10000
Flash Type 700
Flash Type = PFLASH
Dest is bits 0
Dest is bits1 0
Dest is bits 0
Flash is byteswapped 0
Endian Type is LE 0
PLL Type 00000000
Done

Flash Vendor ID: 00000000000000000000000000000001 (00000001)
Flash Device ID: 00000000011111100010001000000001 (007E2201)
*** Found a Spansion S29GL256P U (32MB) Flash Chip ***

- Flash Chip Window Start .... : 1C000000
- Flash Chip Window Length ... : 02000000
- Selected Area Start ........ : 00000000
- Selected Area Length ....... : 00000000



*** REQUESTED OPERATION IS COMPLETE ***

C:\rt-n16

C:\rt-n16>tjtag3023 -probeonly

===============================================
EJTAG Debrick Utility v3.0.2 RC2-3 Tornado-MOD
===============================================

Selected port = 0x378

Detected IR chain length = 32
Number of device(s) = 1

IDCODE for device 1 is 0x1471617F

INSTR_LEN 0 0
idcode 0x1471617f 32
Jtag is in LV mode
switching to MIPS mode
Probing bus ... Done

Instruction Length set to 5

CPU Chip ID: 00000000000010001100000101111111 (0008C17F)
*** Found a Broadcom BCM4716 Rev 1 CPU in MIPS MODE chip ***

- EJTAG IMPCODE ....... : 01100000010000010100000000000000 (60414000)
- EJTAG Version ....... : 3.1
- EJTAG DMA Support ... : No
- EJTAG Implementation flags: R4k ASID_8 MIPS16 NoDMA MIPS32

Intial value of Control register is 000000CC
Intial value of status register is 000000FF
11111111 (000000FF)

Status bit 7 Busy Inverted pin 11 = 0
Status bit 6 *Ack pin 10 = 1
Status bit 5 Paper-out pin 12 = 1
Status bit 4 Select pin 13 = 1
Status bit 3 *Error pin 15 = 1
* means low = true, e.g., *Error

VCC connected
values of Control register after init 0x000000CC
value of status register after init 0x000000FF
system reset complete

Issuing Processor / Peripheral Reset ... Done
Enabling Memory Writes ... Skipped
Halting Processor ... <Processor Entered Debug Mode!> ... Done
Init PrAcc ... Done
Clearing Watchdog ... Done


Chip ID 4716
Chip Rev 1
Package Options a
Number of Cores 9
Core Revision 79
Core Type 710
Core Vendor ID 19a10000
Flash Type 700
Flash Type = PFLASH
Dest is bits 0
Dest is bits1 0
Dest is bits 0
Flash is byteswapped 0
Endian Type is LE 0
PLL Type 00000000
Enter Flash Probe
Done

Flash Vendor ID: 00000000000000000000000000000001 (00000001)
Flash Device ID: 00000000011111100010001000000001 (007E2201)
*** Found a Spansion S29GL256P U (32MB) Flash Chip ***

- Flash Chip Window Start .... : 1C000000
- Flash Chip Window Length ... : 02000000
- Selected Area Start ........ : 00000000
- Selected Area Length ....... : 00000000



*** REQUESTED OPERATION IS COMPLETE ***


C:\rt-n16>

_________________
[Moderator Deleted] Shocked
tripexio
DD-WRT Novice


Joined: 11 Oct 2011
Posts: 26

PostPosted: Sat Nov 05, 2011 16:03    Post subject: Reply with quote
hi barryware, Wink

Quote:
You have a problem with your rig, your setup, or your router is broke (that is why I asked what caused it to need jtag)


What is the rig:?: Embarassed is this the PC??
..eventully, how can i check for problems on the rig and/or in the setup?? ..where should i look for??

Have you noted the difference between your prompt and mine concerning "bit-7 busy inverted pin-11", yours it´s =0 while mine it´s =1, does it mean something?? ...whats the differnce between MIPS and LV mode??

If you think that it could help, i can try jtagging on another motherboard (asus P5Q-E, core2cpu-3,2GHz) Exclamation
.. in this case the p-port will not be a native one, but on a PCI-slot, with an "I/O" other than 0x378

Please.. will you tell me wich flash chip /fc:xx i have to pick up for rt-n16, so i can try to insert it manually.. maybe if you feel like, you can also tell me shortly how or where to find info for using /start:xxx and /length:xxx

see my prompt for Tornado new
tjtag302RC2-3 -probeonly /port:0x378
==============================================
EJTAG Debrick Utility v3.0.2 RC2-1 Tornado-MOD
==============================================

Selected port = 0x378

Intial value of Control register is 000000CC
Intial value of status register is 0000007F
01111111 (0000007F)

Status bit 7 Busy Inverted pin 11 = 1
Status bit 6 *Ack pin 10 = 1
Status bit 5 Paper-out pin 12 = 1
Status bit 4 Select pin 13 = 1
Status bit 3 *Error pin 15 = 1
* means low = true, e.g., *Error

VCC connected
values of Control register after init 0x000000CC
value of status register after init 0x0000007F
system reset complete

Detected IR chain length = 0
Number of device(s) = 0

Probing bus ... Done

Instruction Length set to 32

CPU Chip ID: 00010100011100010110000101111111 (1471617F)
*** Found a Broadcom BCM4716 Rev 1 CPU in LV MODE chip ***

- EJTAG IMPCODE ....... : 11111111111111111111111111111110 (FFFFFFFE)
- EJTAG Version ....... : Unknown (7 is a reserved value)
- EJTAG DMA Support ... : No
- EJTAG Implementation flags: R3k DINTsup ASID_8 ASID_6 MIPS16 NoDMA MIPS32

Issuing Processor / Peripheral Reset ... Done
Enabling Memory Writes ... Skipped
Halting Processor ... <Processor Entered Debug Mode!> ... Done
Init PrAcc ...


xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx


==============================================
EJTAG Debrick Utility v3.0.2 RC2-1 Tornado-MOD
==============================================

Selected port = 0x378

Intial value of Control register is 000000CC
Intial value of status register is 0000007F
01111111 (0000007F)

Status bit 7 Busy Inverted pin 11 = 1
Status bit 6 *Ack pin 10 = 1
Status bit 5 Paper-out pin 12 = 1
Status bit 4 Select pin 13 = 1
Status bit 3 *Error pin 15 = 1
* means low = true, e.g., *Error

VCC connected
values of Control register after init 0x000000CC
value of status register after init 0x0000007F
system reset complete

Detected IR chain length = 0
Number of device(s) = 0

Probing bus ... Done

Instruction Length set to 32

CPU Chip ID: 00010100011100010110000101111111 (1471617F)
*** Found a Broadcom BCM4716 Rev 1 CPU in LV MODE chip ***

- EJTAG IMPCODE ....... : 11111111111111111111111111111110 (FFFFFFFE)
- EJTAG Version ....... : Unknown (7 is a reserved value)
- EJTAG DMA Support ... : No
- EJTAG Implementation flags: R3k DINTsup ASID_8 ASID_6 MIPS16 NoDMA MIPS32

Issuing Processor / Peripheral Reset ... Done
Enabling Memory Writes ... Skipped
Halting Processor ... <Processor Entered Debug Mode!> ... Done
Init PrAcc ...

many thanks for the big effort you are putting in.. Smile Very Happy

Best regards
tripexio
DD-WRT Novice


Joined: 11 Oct 2011
Posts: 26

PostPosted: Sat Nov 05, 2011 16:09    Post subject: Reply with quote
sorry i paste it wrong in the preview, this is the right tjtag 302 RC2-3 promt

==============================================
EJTAG Debrick Utility v302 RC2-3 Tornado-MOD
==============================================

Selected port = 0x378


Detected IR chain length = 0
Number of device(s) = 0

Probing bus ... Done

Instruction Length set to 32

CPU Chip ID: 00010100011100010110000101111111 (1471617F)
*** Found a Broadcom BCM4716 Rev 1 CPU in LV MODE chip ***

- EJTAG IMPCODE ....... : 11111111111111111111111111111110 (FFFFFFFE)
- EJTAG Version ....... : Unknown (7 is a reserved value)
- EJTAG DMA Support ... : No
- EJTAG Implementation flags: R3k DINTsup ASID_8 ASID_6 MIPS16 NoDMA MIPS32

Intial value of Control register is 000000CC
Intial value of status register is 0000007F
01111111 (0000007F)

Status bit 7 Busy Inverted pin 11 = 1
Status bit 6 *Ack pin 10 = 1
Status bit 5 Paper-out pin 12 = 1
Status bit 4 Select pin 13 = 1
Status bit 3 *Error pin 15 = 1
* means low = true, e.g., *Error

VCC connected
values of Control register after init 0x000000CC
value of status register after init 0x0000007F
system reset complete

Issuing Processor / Peripheral Reset ... Done
Enabling Memory Writes ... Skipped
Halting Processor ... <Processor Entered Debug Mode!> ... Done
Init PrAcc ...
barryware
DD-WRT Guru


Joined: 26 Jan 2008
Posts: 13049
Location: Behind The Reset Button

PostPosted: Sun Nov 06, 2011 3:04    Post subject: Reply with quote
tripexio wrote:
What is the rig:?: Embarassed is this the PC??

Yes.. the "rig" is the pc.. Sorry, I always refer to the computer as the "rig"

I again apologize but I can not help.. as posted earlier, Tornado's utility works for me. Both Rc-1 and Rc-3 that he sent me to test.

I don't know where your problem lies but it is not with the jtag software..

As a side note.. Working on this, Tornado has now added full support for the E3000 (610V2)

_________________
[Moderator Deleted] Shocked
tripexio
DD-WRT Novice


Joined: 11 Oct 2011
Posts: 26

PostPosted: Sun Nov 06, 2011 15:47    Post subject: Reply with quote
Dear Tornado and barryware,
i appreciate very much your effort.. very kind of you both,

but really don´t think that i´ll spend anymore time on this, expecially if there is a big possibility that it´s an hardware brick..

Please.. would you like to point me a good router to buy, maybe a new stable wireless model(300Mbps or dual-band), possibly with a well-defined JTAG and Serial recovery procedure..

Very many thanks for all you did for me

Best regards
tripexio
tripexio
DD-WRT Novice


Joined: 11 Oct 2011
Posts: 26

PostPosted: Sun Nov 06, 2011 15:51    Post subject: Reply with quote
Sorry forgot it...

for the new router i´m thinking about something in the 70-100 euro range

Best regards
Tornado
DD-WRT Developer/Maintainer


Joined: 07 Jun 2006
Posts: 2087
Location: Odessa, Ukraine

PostPosted: Sun Nov 06, 2011 16:57    Post subject: router Reply with quote
If you can send the bricked router to Barry or me, maybe we can de-brick it ?
_________________
Want JTAG support - Donate a router
or Donate with PayPal !

My preferred parallel jtag adapter:
TIAO Parallel adapter

Tjtag website - http://tjtag.com

Compiling DD-WRT on:
AMD Phenom II X6 1090T @ 3926.667 Mhz

Aptosid X64 - Debian SID X64
Ubuntu 10.10 X64 - Arch X64
Tornado
DD-WRT Developer/Maintainer


Joined: 07 Jun 2006
Posts: 2087
Location: Odessa, Ukraine

PostPosted: Sun Nov 06, 2011 17:12    Post subject: DLC5 Reply with quote
@tripexio

wanna test 3.0.2 RC2-3 for me using dlc5 cable ?

email me at tornado@tjtag.com, if interested

_________________
Want JTAG support - Donate a router
or Donate with PayPal !

My preferred parallel jtag adapter:
TIAO Parallel adapter

Tjtag website - http://tjtag.com

Compiling DD-WRT on:
AMD Phenom II X6 1090T @ 3926.667 Mhz

Aptosid X64 - Debian SID X64
Ubuntu 10.10 X64 - Arch X64
Goto page Previous  1, 2, 3  Next Display posts from previous:    Page 2 of 3
Post new topic   Reply to topic    DD-WRT Forum Forum Index -> Broadcom SoC based Hardware All times are GMT

Navigation

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You can attach files in this forum
You can download files in this forum