@ Tornado..

Post new topic   Reply to topic    DD-WRT Forum Forum Index -> Broadcom SoC based Hardware
Goto page 1, 2  Next
Author Message
barryware
DD-WRT Guru


Joined: 26 Jan 2008
Posts: 13049
Location: Behind The Reset Button

PostPosted: Fri Oct 14, 2011 1:01    Post subject: @ Tornado.. Reply with quote
@Tornado.. Based on your request here:

http://www.dd-wrt.com/phpBB2/viewtopic.php?t=145463&start=6

Attached is the output from a -probeonly /flash_debug.

The router is an E3000 (real one) with an MXIC MX29LV640EBTI-70G flash chip.

Using version 3.0.2-RC2-1, I need to use /fc:107 to address the chip. Using that fc.. I can read & write to the chip. However, writing is REALLY slow.. 3+ hours for a 256k cfe.

I used your preferred adapter.

atm.. I can test no further. A member sent me a working E3000 to enable jtag & install jtag & serial headers cuz I guess he plans on bricking it Razz .
I have to send the router home. The two I own, I messed up the pads trying to enable jtag. (Since then, I got it figured out Smile ) I can test on the next brick I get.. Or.. this would be a perfect time for someone to donate a router to you:

http://www.dd-wrt.com/phpBB2/viewtopic.php?t=61154


C:\E3000>tjtag302 -probeonly /flash_debug

==============================================
EJTAG Debrick Utility v3.0.2 RC2-1 Tornado-MOD
==============================================

Selected port = 0x378

Intial value of Control register is 000000CC
Intial value of status register is 0000007F
01111111 (0000007F)

Status bit 7 Busy Inverted pin 11 = 1
Status bit 6 *Ack pin 10 = 1
Status bit 5 Paper-out pin 12 = 1
Status bit 4 Select pin 13 = 1
Status bit 3 *Error pin 15 = 1
* means low = true, e.g., *Error

VCC connected
values of Control register after init 0x000000CC
value of status register after init 0x0000007F
system reset complete

Detected IR chain length = 32
Number of device(s) = 1

idcode 0x1471617f 32
Jtag is in LV mode
switching to MIPS mode
Probing bus ... Done

Instruction Length set to 5

CPU Chip ID: 00000000000010001100000101111111 (0008C17F)
*** Found a Broadcom BCM4716 Rev 1 CPU in MIPS MODE chip ***

- EJTAG IMPCODE ....... : 01100000010000010100000000000000 (60414000)
- EJTAG Version ....... : 3.1
- EJTAG DMA Support ... : No
- EJTAG Implementation flags: R4k ASID_8 MIPS16 NoDMA MIPS32

Issuing Processor / Peripheral Reset ... Done
Enabling Memory Writes ... Skipped
Halting Processor ... <Processor Entered Debug Mode!> ... Done
Init PrAcc ... Done
Clearing Watchdog ... Done


Chip ID 4716
Chip Rev 1
Package Options a
Number of Cores 9
Core Revision 79
Core Type 710
Core Vendor ID 19a10000
Flash Type 700
Flash Type = PFLASH
Dest is bits 0
Dest is bits1 0
Dest is bits 0
Flash is byteswapped 0
Endian Type is LE 0
PLL Type 00000000
spi_flash_read 0x1FC00000
spi_flash_mmr 0x00000000
spi_flash_mmr_size 0x00000000
spi_flash_ctl 0x18000040
spi_flash_opcode 0x18000044
spi_flash_data 0x18000048
spi_ctl_start 0x80000000
spi_ctl_busy 0x80000000

Byte Debug AMD Vendid : 00000000000000000000000011000010 (000000C2)
Byte Debug AMD Devdid : 00000000110010110000000000001000 (00CB0008)
00000000000000001100001000000000 (0000C200)
00000000000000001100001011000010 (0000C2C2)
00000000000000000000000011001011 (000000CB)

Byte Debug AMD Vendid : 00000000000000001100001011000010 (0000C2C2)
Byte Debug AMD Devdid : 00000000000000000000000011001011 (000000CB)

Debug AMD Vendid : 00000000000000000000100000010111 (00000817)
Debug AMD Devdid : 00000000000000000001000000000000 (00001000)

Debug SST Vendid : 00000000000000000000100000010111 (00000817)
Debug SST Devdid : 00000000000000000001000000000000 (00001000)

Debug BSC-SCS Vendid :00000000000000000000100000010111 (00000817)
Debug BSC-SCS Devdid :00000000000000000001000000000000 (00001000)
REGREAD32 spi_flash_mmr+reg 0x18000040 data 0x00000000
REGWRITE32 ADDR MMR+REG 0x18000044 DATA 0x0000049F
SPI_FLASH_OPCODE 0x18000044 PTR_OPCODE 0x0000049F
REGWRITE32 ADDR MMR+REG 0x18000040 DATA 0x8000049F
SPI_FLASH_CTL SEND -> 0x18000040 reg 0x8000049F
REGREAD32 spi_flash_mmr+reg 0x18000040 data 0x0000049F
REGREAD32 spi_flash_mmr+reg 0x18000048 data 0xFFFFFFFF

Debug SPI id : 00000000111111111111111111111111 (00FFFFFF)

Debug SPI Vendid : 00000000000000000000000011111111 (000000FF)
Debug SPI Devdid : 00000000000000001111111111111111 (0000FFFF)

Byte Debug AMD Vendid : 00000000000000000000000011000010 (000000C2)
Byte Debug AMD Devdid : 00000000110010110000000000001000 (00CB0008)
00000000000000001100001000000000 (0000C200)
00000000000000001100001011000010 (0000C2C2)
00000000000000000000000011001011 (000000CB)

Byte Debug AMD Vendid : 00000000000000001100001011000010 (0000C2C2)
Byte Debug AMD Devdid : 00000000000000000000000011001011 (000000CB)

Debug AMD Vendid : 00000000000000000000100000010111 (00000817)
Debug AMD Devdid : 00000000000000000001000000000000 (00001000)

Debug SST Vendid : 00000000000000000000100000010111 (00000817)
Debug SST Devdid : 00000000000000000001000000000000 (00001000)

Debug BSC-SCS Vendid :00000000000000000000100000010111 (00000817)
Debug BSC-SCS Devdid :00000000000000000001000000000000 (00001000)
REGREAD32 spi_flash_mmr+reg 0x18000040 data 0x00000000
REGWRITE32 ADDR MMR+REG 0x18000044 DATA 0x0000049F
SPI_FLASH_OPCODE 0x18000044 PTR_OPCODE 0x0000049F
REGWRITE32 ADDR MMR+REG 0x18000040 DATA 0x8000049F
SPI_FLASH_CTL SEND -> 0x18000040 reg 0x8000049F
REGREAD32 spi_flash_mmr+reg 0x18000040 data 0x0000049F
REGREAD32 spi_flash_mmr+reg 0x18000048 data 0xFFFFFFFF

Debug SPI id : 00000000111111111111111111111111 (00FFFFFF)

Debug SPI Vendid : 00000000000000000000000011111111 (000000FF)
Debug SPI Devdid : 00000000000000001111111111111111 (0000FFFF)

Byte Debug AMD Vendid : 00000000000000000000000011000010 (000000C2)
Byte Debug AMD Devdid : 00000000110010110000000000001000 (00CB0008)
00000000000000001100001000000000 (0000C200)
00000000000000001100001011000010 (0000C2C2)
00000000000000000000000011001011 (000000CB)

Byte Debug AMD Vendid : 00000000000000001100001011000010 (0000C2C2)
Byte Debug AMD Devdid : 00000000000000000000000011001011 (000000CB)

Debug AMD Vendid : 00000000000000000000100000010111 (00000817)
Debug AMD Devdid : 00000000000000000001000000000000 (00001000)

Debug SST Vendid : 00000000000000000000100000010111 (00000817)
Debug SST Devdid : 00000000000000000001000000000000 (00001000)

Debug BSC-SCS Vendid :00000000000000000000100000010111 (00000817)
Debug BSC-SCS Devdid :00000000000000000001000000000000 (00001000)
REGREAD32 spi_flash_mmr+reg 0x18000040 data 0x00000000
REGWRITE32 ADDR MMR+REG 0x18000044 DATA 0x0000049F
SPI_FLASH_OPCODE 0x18000044 PTR_OPCODE 0x0000049F
REGWRITE32 ADDR MMR+REG 0x18000040 DATA 0x8000049F
SPI_FLASH_CTL SEND -> 0x18000040 reg 0x8000049F
REGREAD32 spi_flash_mmr+reg 0x18000040 data 0x0000049F
REGREAD32 spi_flash_mmr+reg 0x18000048 data 0xFFFFFFFF

Debug SPI id : 00000000111111111111111111111111 (00FFFFFF)

Debug SPI Vendid : 00000000000000000000000011111111 (000000FF)
Debug SPI Devdid : 00000000000000001111111111111111 (0000FFFF)

Byte Debug AMD Vendid : 00000000000000000000000011000010 (000000C2)
Byte Debug AMD Devdid : 00000000110010110000000000001000 (00CB0008)
00000000000000001100001000000000 (0000C200)
00000000000000001100001011000010 (0000C2C2)
00000000000000000000000011001011 (000000CB)

Byte Debug AMD Vendid : 00000000000000001100001011000010 (0000C2C2)
Byte Debug AMD Devdid : 00000000000000000000000011001011 (000000CB)

Debug AMD Vendid : 00000000000000000000100000010111 (00000817)
Debug AMD Devdid : 00000000000000000001000000000000 (00001000)

Debug SST Vendid : 00000000000000000000100000010111 (00000817)
Debug SST Devdid : 00000000000000000001000000000000 (00001000)

Debug BSC-SCS Vendid :00000000000000000000100000010111 (00000817)
Debug BSC-SCS Devdid :00000000000000000001000000000000 (00001000)
REGREAD32 spi_flash_mmr+reg 0x18000040 data 0x00000000
REGWRITE32 ADDR MMR+REG 0x18000044 DATA 0x0000049F
SPI_FLASH_OPCODE 0x18000044 PTR_OPCODE 0x0000049F
REGWRITE32 ADDR MMR+REG 0x18000040 DATA 0x8000049F
SPI_FLASH_CTL SEND -> 0x18000040 reg 0x8000049F
REGREAD32 spi_flash_mmr+reg 0x18000040 data 0x0000049F
REGREAD32 spi_flash_mmr+reg 0x18000048 data 0xFFFFFFFF

Debug SPI id : 00000000111111111111111111111111 (00FFFFFF)

Debug SPI Vendid : 00000000000000000000000011111111 (000000FF)
Debug SPI Devdid : 00000000000000001111111111111111 (0000FFFF)

Byte Debug AMD Vendid : 00000000000000000000000011000010 (000000C2)
Byte Debug AMD Devdid : 00000000110010110000000000001000 (00CB0008)
00000000000000001100001000000000 (0000C200)
00000000000000001100001011000010 (0000C2C2)
00000000000000000000000011001011 (000000CB)

Byte Debug AMD Vendid : 00000000000000001100001011000010 (0000C2C2)
Byte Debug AMD Devdid : 00000000000000000000000011001011 (000000CB)

Debug AMD Vendid : 00000000000000000000100000010111 (00000817)
Debug AMD Devdid : 00000000000000000001000000000000 (00001000)

Debug SST Vendid : 00000000000000000000100000010111 (00000817)
Debug SST Devdid : 00000000000000000001000000000000 (00001000)

Debug BSC-SCS Vendid :00000000000000000000100000010111 (00000817)
Debug BSC-SCS Devdid :00000000000000000001000000000000 (00001000)
REGREAD32 spi_flash_mmr+reg 0x18000040 data 0x00000000
REGWRITE32 ADDR MMR+REG 0x18000044 DATA 0x0000049F
SPI_FLASH_OPCODE 0x18000044 PTR_OPCODE 0x0000049F
REGWRITE32 ADDR MMR+REG 0x18000040 DATA 0x8000049F
SPI_FLASH_CTL SEND -> 0x18000040 reg 0x8000049F
REGREAD32 spi_flash_mmr+reg 0x18000040 data 0x0000049F
REGREAD32 spi_flash_mmr+reg 0x18000048 data 0xFFFFFFFF

Debug SPI id : 00000000111111111111111111111111 (00FFFFFF)

Debug SPI Vendid : 00000000000000000000000011111111 (000000FF)
Debug SPI Devdid : 00000000000000001111111111111111 (0000FFFF)

Byte Debug AMD Vendid : 00000000000000000000000011000010 (000000C2)
Byte Debug AMD Devdid : 00000000110010110000000000001000 (00CB0008)
00000000000000001100001000000000 (0000C200)
00000000000000001100001011000010 (0000C2C2)
00000000000000000000000011001011 (000000CB)

Byte Debug AMD Vendid : 00000000000000001100001011000010 (0000C2C2)
Byte Debug AMD Devdid : 00000000000000000000000011001011 (000000CB)

Debug AMD Vendid : 00000000000000000000100000010111 (00000817)
Debug AMD Devdid : 00000000000000000001000000000000 (00001000)

Debug SST Vendid : 00000000000000000000100000010111 (00000817)
Debug SST Devdid : 00000000000000000001000000000000 (00001000)

Debug BSC-SCS Vendid :00000000000000000000100000010111 (00000817)
Debug BSC-SCS Devdid :00000000000000000001000000000000 (00001000)
REGREAD32 spi_flash_mmr+reg 0x18000040 data 0x00000000
REGWRITE32 ADDR MMR+REG 0x18000044 DATA 0x0000049F
SPI_FLASH_OPCODE 0x18000044 PTR_OPCODE 0x0000049F
REGWRITE32 ADDR MMR+REG 0x18000040 DATA 0x8000049F
SPI_FLASH_CTL SEND -> 0x18000040 reg 0x8000049F
REGREAD32 spi_flash_mmr+reg 0x18000040 data 0x0000049F
REGREAD32 spi_flash_mmr+reg 0x18000048 data 0xFFFFFFFF

Debug SPI id : 00000000111111111111111111111111 (00FFFFFF)

Debug SPI Vendid : 00000000000000000000000011111111 (000000FF)
Debug SPI Devdid : 00000000000000001111111111111111 (0000FFFF)
Done

*** Unknown or NO Flash Chip Detected ***

*** REQUESTED OPERATION IS COMPLETE ***


C:\E3000>



e3000_debug.txt
 Description:

Download
 Filename:  e3000_debug.txt
 Filesize:  10.23 KB
 Downloaded:  676 Time(s)


_________________
[Moderator Deleted] Shocked
Sponsor
Bird333
DD-WRT Guru


Joined: 07 Jun 2006
Posts: 809

PostPosted: Fri Oct 14, 2011 15:06    Post subject: Re: @ Tornado.. Reply with quote
barryware wrote:
A member sent me a working E3000 to enable jtag & install jtag & serial headers cuz I guess he plans on bricking it Razz .


All routers should come from the factory with jtag and serial headers. Razz
Tornado
DD-WRT Developer/Maintainer


Joined: 07 Jun 2006
Posts: 2087
Location: Odessa, Ukraine

PostPosted: Sat Nov 05, 2011 13:58    Post subject: jtag headers Reply with quote
Big time agree !!!
_________________
Want JTAG support - Donate a router
or Donate with PayPal !

My preferred parallel jtag adapter:
TIAO Parallel adapter

Tjtag website - http://tjtag.com

Compiling DD-WRT on:
AMD Phenom II X6 1090T @ 3926.667 Mhz

Aptosid X64 - Debian SID X64
Ubuntu 10.10 X64 - Arch X64
crashfly
DD-WRT Guru


Joined: 24 Feb 2009
Posts: 2026
Location: Sol System > Earth > USA > Arkansas

PostPosted: Sat Nov 05, 2011 17:16    Post subject: Reply with quote
Unfortunately that will not happen. Although there is a large group of "modders" out there, if the manufacturer started adding jtag headers to their routers, then most people would be able to fix any problems with their router. They (the manufacturer) would lose money because less people would upgrade to the latest greatest model.

It is sad really, but I would love to see those jtag headers too.

_________________
E3000 22200M KongVPN K26
WRT600n v1.1 refirb mega 18767 BS K24 NEWD2 [not used]
WRT54G v2 16214 BS K24 [access point]

Try Dropbox for syncing files - get 2.5gb online for free by signing up.

Read! Peacock thread
*PLEASE* upgrade PAST v24SP1 or no support.
fggs
DD-WRT Guru


Joined: 28 Jan 2008
Posts: 1741

PostPosted: Sat Nov 05, 2011 18:09    Post subject: Reply with quote
I have a bricked E3000 that was probably hit by a lightning because switch IC has a small hole. Serial console output is scrambled but at least it gives output.

If it will be useful for Tornado, I can send it to him...

I know it is not the best condition but is what I have atm..
Tornado
DD-WRT Developer/Maintainer


Joined: 07 Jun 2006
Posts: 2087
Location: Odessa, Ukraine

PostPosted: Sat Nov 05, 2011 21:01    Post subject: E3000 Reply with quote
Okay Flash definitions updated, should see flash now, but use /byte_mode when flashing this router.

Tjtag 3.0.2 version only

_________________
Want JTAG support - Donate a router
or Donate with PayPal !

My preferred parallel jtag adapter:
TIAO Parallel adapter

Tjtag website - http://tjtag.com

Compiling DD-WRT on:
AMD Phenom II X6 1090T @ 3926.667 Mhz

Aptosid X64 - Debian SID X64
Ubuntu 10.10 X64 - Arch X64
fggs
DD-WRT Guru


Joined: 28 Jan 2008
Posts: 1741

PostPosted: Sat Nov 05, 2011 21:04    Post subject: Reply with quote
I would love to test it right now but 3.0.2 doesn't detect my unbuffered cable even with /cable:dlc5 switch Sad
Tornado
DD-WRT Developer/Maintainer


Joined: 07 Jun 2006
Posts: 2087
Location: Odessa, Ukraine

PostPosted: Sat Nov 05, 2011 21:07    Post subject: DLC5 Reply with quote
I know, code needs a little work
_________________
Want JTAG support - Donate a router
or Donate with PayPal !

My preferred parallel jtag adapter:
TIAO Parallel adapter

Tjtag website - http://tjtag.com

Compiling DD-WRT on:
AMD Phenom II X6 1090T @ 3926.667 Mhz

Aptosid X64 - Debian SID X64
Ubuntu 10.10 X64 - Arch X64
fggs
DD-WRT Guru


Joined: 28 Jan 2008
Posts: 1741

PostPosted: Sat Nov 05, 2011 21:11    Post subject: Reply with quote
Sadly, I will probably be able to buy my buffered cable only on friday, then wait for it to come, then...

C'mon BW, test it for us Smile I'm sure the owner of E3000 can wait a few days :d
Tornado
DD-WRT Developer/Maintainer


Joined: 07 Jun 2006
Posts: 2087
Location: Odessa, Ukraine

PostPosted: Sat Nov 05, 2011 21:13    Post subject: E3000 Reply with quote
He already has, and its working, just has not posted output yet.
_________________
Want JTAG support - Donate a router
or Donate with PayPal !

My preferred parallel jtag adapter:
TIAO Parallel adapter

Tjtag website - http://tjtag.com

Compiling DD-WRT on:
AMD Phenom II X6 1090T @ 3926.667 Mhz

Aptosid X64 - Debian SID X64
Ubuntu 10.10 X64 - Arch X64
barryware
DD-WRT Guru


Joined: 26 Jan 2008
Posts: 13049
Location: Behind The Reset Button

PostPosted: Sat Nov 05, 2011 21:28    Post subject: Reply with quote
Indeed...

tjtag now fully supports the E3000 (610V2). No fuss, no muss.. when writing, you need to include the /byte_mode switch due to the 8 bit buss. For reading / backing up, the switch is not required.

It does write slowly (due to the 8 bit buss) but is accurate.

The only thing with the E3000 (610V2) is that the jtag circuit on the pcb needs to be enabled via bridging some pads. This has been covered in the convert thread.

There are a few 610's (V2's) that can now be recovered when converting to an E3000 (cuz the owners didn't follow the directions).

Kudo's Tornado.. You Beez Da Man!

Don't forget to donate via paypal or send routers to Tornado so we can keep the support coming and up to date.

My favorite website: http://tjtag.com/

EDIT: we forgot to test an unbuffered cable.. We will get to it.. Problem is, my hangover is already starting Smile

This type of "development" consumes quite a bit of beer Razz

_________________
[Moderator Deleted] Shocked
Tornado
DD-WRT Developer/Maintainer


Joined: 07 Jun 2006
Posts: 2087
Location: Odessa, Ukraine

PostPosted: Sun Nov 06, 2011 13:33    Post subject: Consumes alot of BEER Reply with quote
Smile I like that Barry, can we start testing NOW ? Smile
_________________
Want JTAG support - Donate a router
or Donate with PayPal !

My preferred parallel jtag adapter:
TIAO Parallel adapter

Tjtag website - http://tjtag.com

Compiling DD-WRT on:
AMD Phenom II X6 1090T @ 3926.667 Mhz

Aptosid X64 - Debian SID X64
Ubuntu 10.10 X64 - Arch X64
Bird333
DD-WRT Guru


Joined: 07 Jun 2006
Posts: 809

PostPosted: Sun Nov 06, 2011 14:25    Post subject: Reply with quote
Glad my output could help. Does it still take 3+ hours write the CFE?
Tornado
DD-WRT Developer/Maintainer


Joined: 07 Jun 2006
Posts: 2087
Location: Odessa, Ukraine

PostPosted: Sun Nov 06, 2011 14:42    Post subject: CFE flash time on Serial flash 8bit bus Reply with quote
I no longer have a RT-N16 to test on, left it in Odessa, Ukraine. But your dealing with a 8bit bus here, that why is takes so long. I do have a E1000v2 to test on, that is almost the same. It did not take me 3hrs..but it did take probably an hour. It may be possible to speed up the flash, because on the E1000v2, the CFE is actually 128k or less, not 256k. It may be possible to just flash the 128k and save some time, but I have not tested that.
_________________
Want JTAG support - Donate a router
or Donate with PayPal !

My preferred parallel jtag adapter:
TIAO Parallel adapter

Tjtag website - http://tjtag.com

Compiling DD-WRT on:
AMD Phenom II X6 1090T @ 3926.667 Mhz

Aptosid X64 - Debian SID X64
Ubuntu 10.10 X64 - Arch X64
barryware
DD-WRT Guru


Joined: 26 Jan 2008
Posts: 13049
Location: Behind The Reset Button

PostPosted: Sun Nov 06, 2011 14:48    Post subject: Re: Consumes alot of BEER Reply with quote
Tornado wrote:
Smile I like that Barry, can we start testing NOW ? Smile


Yo.. Initial test with rc2-4 with unbuffered /cable:dlc5.. like it isn't hooked up at all

Just for shits & grins, tjtag V2.0 see the processor.. Does not recognize it, but sees it.. chip ID (1471617F)

_________________
[Moderator Deleted] Shocked
Goto page 1, 2  Next Display posts from previous:    Page 1 of 2
Post new topic   Reply to topic    DD-WRT Forum Forum Index -> Broadcom SoC based Hardware All times are GMT

Navigation

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You can attach files in this forum
You can download files in this forum