WD Netcenter - JTAG-Interface

Das JTAG-Interface

Leider ist es nicht gelungen, das Interface benutzen zu können.

Das Kabel ist korrekt, das wurde mehrmals überprüft. Es wird wohl daran liegen, dass der Prozessor Broadcomm BCM4780 und/oder der Flash Spansion S29GL064M90TFIR7 von der bisher verfügbaren Software (noch) nicht unterstützt wird (diese Typen werden auch noch nicht in der Unterstützungs-Liste der Programme aufgeführt). Auch ein Verbinden der Flash-Anschlüsse 16/17 mit Grnd (nach dem von Christian im Forum zur Verfügung gestellten Link) ermöglichte die Kommunikation nicht.

Getestete Software:

WRTJTAG v4.5 (und ältere Versionen)
new_winxp_ejtag_debrick_v0.99

Das Log des Tests mit WRT54G:

C:\SKYNET\WRTJTAG>wrt54g

====================================
WRT54G/GS EJTAG Debrick Utility v4.5
====================================

ABOUT: This program reads/writes flash memory on the WRT54G/GS and
compatible routers via EJTAG using either DMA Access routines
or PrAcc routines (slower/more compatible). Processor chips
supported in this version include the following chips:

Supported Chips
---------------
Broadcom BCM4702 Rev 1 CPU
Broadcom BCM4712 Rev 1 CPU
Broadcom BCM4712 Rev 2 CPU
Broadcom BCM5350 Rev 1 CPU
Broadcom BCM5352 Rev 1 CPU
Broadcom BCM5365 Rev 1 CPU
Broadcom BCM6348 Rev 1 CPU
Broadcom BCM6345 Rev 1 CPU
TI AR7WRD TNETD7300GDU Rev 1 CPU

USAGE: wrt54g [parameter]

Required Parameter
------------------
-backup:cfe
-backup:nvram
-backup:kernel
-backup:wholeflash
-backup:custom
-erase:cfe
-erase:nvram
-erase:kernel
-erase:wholeflash
-erase:custom
-flash:cfe
-flash:nvram
-flash:kernel
-flash:wholeflash
-flash:custom

Optional Switches
-----------------
/noreset ........... prevent Issuing EJTAG CPU reset
/noemw ............. prevent Enabling Memory Writes
/nocwd ............. prevent Clearing CPU Watchdog Timer
/nobreak ........... prevent Issuing Debug Mode JTAGBRK
/noerase ........... prevent Forced Erase before Flashing
/notimestamp ....... prevent Timestamping of Backups
/dma ............... force use of DMA routines
/nodma ............. force use of PRACC routines (No DMA)
/window:XXXXXXXX ... custom flash window base (in HEX)
/start:XXXXXXXX .... custom start location (in HEX)
/length:XXXXXXXX ... custom length (in HEX)
/silent ............ prevent scrolling display of data
/skipdetect ........ skip auto detection of CPU Chip ID v /instrlen:XX ....... set instruction length manually

/fc:XX = Optional (Manual) Flash Chip Selection
-----------------------------------------------
/fc:01 ............. AMD 29lv160DB 1Mx16 BotB (2MB)
/fc:02 ............. AMD 29lv160DT 1Mx16 TopB (2MB)
/fc:03 ............. AMD 29lv320DB 2Mx16 BotB (4MB)
/fc:04 ............. AMD 29lv320DT 2Mx16 TopB (4MB)
/fc:05 ............. AMD 29lv320MB 2Mx16 BotB (4MB)
/fc:06 ............. AMD 29lv320MT 2Mx16 TopB (4MB)
/fc:07 ............. AMD 29lv320MT 2Mx16 TopB (4MB)
/fc:08 ............. Intel 28F128J3 8Mx16 (16MB)
/fc:09 ............. Intel 28F160B3 1Mx16 BotB (2MB)
/fc:10 ............. Intel 28F160B3 1Mx16 TopB (2MB)
/fc:11 ............. Intel 28F160C3 1Mx16 BotB (2MB)
/fc:12 ............. Intel 28F160C3 1Mx16 TopB (2MB)
/fc:13 ............. Intel 28F160S3/5 1Mx16 (2MB)
/fc:14 ............. Intel 28F320B3 2Mx16 BotB (4MB)
/fc:15 ............. Intel 28F320B3 2Mx16 TopB (4MB)
/fc:16 ............. Intel 28F320C3 2Mx16 BotB (4MB)
/fc:17 ............. Intel 28F320C3 2Mx16 TopB (4MB)
/fc:18 ............. Intel 28F320J3 2Mx16 (4MB)
/fc:19 ............. Intel 28F320J5 2Mx16 (4MB)
/fc:20 ............. Intel 28F320S3/5 2Mx16 (4MB)
/fc:21 ............. Intel 28F640B3 4Mx16 BotB (8MB)
/fc:22 ............. Intel 28F640B3 4Mx16 TopB (8MB)
/fc:23 ............. Intel 28F640C3 4Mx16 BotB (8MB)
/fc:24 ............. Intel 28F640C3 4Mx16 TopB (8MB)
/fc:25 ............. Intel 28F640J3 4Mx16 (8MB)
/fc:26 ............. Intel 28F640J5 4Mx16 (8MB)
/fc:27 ............. MBM29LV320BE 2Mx16 BotB (4MB)
/fc:28 ............. MBM29LV320TE 2Mx16 TopB (4MB)
/fc:29 ............. MX29LV320B 2Mx16 BotB (4MB)
/fc:30 ............. MX29LV320B 2Mx16 BotB (4MB)
/fc:31 ............. MX29LV320T 2Mx16 TopB (4MB)
/fc:32 ............. MX29LV320T 2Mx16 TopB (4MB)
/fc:33 ............. SST39VF320 2Mx16 (4MB)
/fc:34 ............. ST 29w320DB 2Mx16 BotB (4MB)
/fc:35 ............. ST 29w320DT 2Mx16 TopB (4MB)
/fc:36 ............. Sharp 28F320BJE 2Mx16 BotB (4MB)
/fc:37 ............. TC58FVB321 2Mx16 BotB (4MB)
/fc:38 ............. TC58FVT321 2Mx16 TopB (4MB)
/fc:39 ............. AT49BV/LV16X 2Mx16 BotB (4MB)
/fc:40 ............. AT49BV/LV16XT 2Mx16 TopB (4MB)
/fc:41 ............. MBM29LV160B 1Mx16 BotB (2MB)
/fc:42 ............. MBM29LV160T 1Mx16 TopB (2MB)
/fc:43 ............. MX29LV161B 1Mx16 BotB (2MB)
/fc:44 ............. MX29LV161T 1Mx16 TopB (2MB)
/fc:45 ............. ST M29W160EB 1Mx16 BotB (2MB)
/fc:46 ............. ST M29W160ET 1Mx16 TopB (2MB)
/fc:47 ............. SST39VF1601 1Mx16 BotB (2MB)
/fc:48 ............. SST39VF1602 1Mx16 TopB (2MB)
/fc:49 ............. SST39VF3201 2Mx16 BotB (4MB)
/fc:50 ............. SST39VF3202 2Mx16 TopB (4MB)
/fc:51 ............. SST39VF6401 4Mx16 BotB (8MB)
/fc:52 ............. SST39VF6402 4Mx16 TopB (8MB)
/fc:53 ............. K8D1716UTC 1Mx16 TopB (2MB)
/fc:54 ............. K8D1716UBC 1Mx16 BotB (2MB)

NOTES: 1) If 'flashing' - the source filename must exist as follows:
CFE.BIN, NVRAM.BIN, KERNEL.BIN, WHOLEFLASH.BIN or CUSTOM.BIN

2) If you have difficulty auto-detecting a particular flash part
you can manually specify your exact part using the /fc:XX option.

3) If you have difficulty with the older bcm47xx chips or when no CFE
is currently active/operational you may want to try both the
/noreset and /nobreak command line options together. Some bcm47xx
chips *may* always require both these options to function properly.

4) When using this utility, usually it is best to type the command line
out, then plug in the router, and then hit quickly to avoid
the CPUs watchdog interfering with the EJTAG operations.

***************************************************************************
* Flashing the KERNEL or WHOLEFLASH will take a very long time using JTAG *
* via this utility. You are better off flashing the CFE & NVRAM files *
* & then using the normal TFTP method to flash the KERNEL via ethernet. *
***************************************************************************

-------------------------------------------------------------------------------------

C:\SKYNET\WRTJTAG>wrt54g -backup:cfe

====================================
WRT54G/GS EJTAG Debrick Utility v4.5
====================================

Probing bus ... Done

Instruction Length set to 5

CPU Chip ID: 11111111111111111111111111111111 (FFFFFFFF)
*** Unknown or NO CPU Chip ID Detected ***

*** Possible Causes:
1) WRT54G/GS is not Connected.
2) WRT54G/GS is not Powered On.
3) Improper JTAG Cable.
4) Unrecognized CPU Chip ID.

C:\SKYNET\WRTJTAG>

-------------------------------------------------------------------------------------

C:\SKYNET\WRTJTAG>wrt54g -backup:cfe /noreset

====================================
WRT54G/GS EJTAG Debrick Utility v4.5
====================================

Probing bus ... Done

Instruction Length set to 5

CPU Chip ID: 11111111111111111111111111111111 (FFFFFFFF)
*** Unknown or NO CPU Chip ID Detected ***

*** Possible Causes:
1) WRT54G/GS is not Connected.
2) WRT54G/GS is not Powered On.
3) Improper JTAG Cable.
4) Unrecognized CPU Chip ID.

C:\SKYNET\WRTJTAG>

-------------------------------------------------------------------------------------

C:\SKYNET\WRTJTAG>wrt54g -backup:cfe /noreset /nobreak

====================================
WRT54G/GS EJTAG Debrick Utility v4.5
====================================

Probing bus ... Done

Instruction Length set to 5

CPU Chip ID: 11111111111111111111111111111111 (FFFFFFFF)
*** Unknown or NO CPU Chip ID Detected ***

*** Possible Causes:
1) WRT54G/GS is not Connected.
2) WRT54G/GS is not Powered On.
3) Improper JTAG Cable.
4) Unrecognized CPU Chip ID.

C:\SKYNET\WRTJTAG>

---------------------------------------------------------------------------------------

C:\SKYNET\WRTJTAG>wrt54g -backup:cfe /noreset /nobreak /nodma

====================================
WRT54G/GS EJTAG Debrick Utility v4.5
====================================

Probing bus ... Done

Instruction Length set to 5

CPU Chip ID: 11111111111111111111111111111111 (FFFFFFFF)
*** Unknown or NO CPU Chip ID Detected ***

*** Possible Causes:
1) WRT54G/GS is not Connected.
2) WRT54G/GS is not Powered On.
3) Improper JTAG Cable.
4) Unrecognized CPU Chip ID.

C:\SKYNET\WRTJTAG>

----------------------------------------------------------------------------------------

C:\SKYNET\WRTJTAG>wrt54g -backup:cfe /noreset /nobreak /skipdetect

====================================
WRT54G/GS EJTAG Debrick Utility v4.5
====================================

Probing bus ... Done

Instruction Length set to 0

CPU Chip ID: 11111111111111111111111111111111 (FFFFFFFF)
*** CHIP DETECTION OVERRIDDEN ***

- EJTAG IMPCODE ....... : 11111111111111111111111111111111 (FFFFFFFF)
- EJTAG Version ....... : Unknown (7 is a reserved value)
- EJTAG DMA Support ... : No

Issuing Processor / Peripheral Reset ... Skipped
Enabling Memory Writes ... Skipped
Halting Processor ... Skipped
Clearing Watchdog ...

[einer erste Reaktion: die rote Front-LED blinkt hektisch!!!]
(nach 5 Minuten wurde abgebrochen, LED aus)

^C
C:\SKYNET\WRTJTAG>

-----------------------------------------------------------------------------------------

C:\SKYNET\WRTJTAG>wrt54g -backup:cfe /noreset /nobreak /skipdetect /nocwd

====================================
WRT54G/GS EJTAG Debrick Utility v4.5
====================================

Probing bus ... Done

Instruction Length set to 0

CPU Chip ID: 11111111111111111111111111111111 (FFFFFFFF)
*** CHIP DETECTION OVERRIDDEN ***

- EJTAG IMPCODE ....... : 11111111111111111111111111111111 (FFFFFFFF)
- EJTAG Version ....... : Unknown (7 is a reserved value)
- EJTAG DMA Support ... : No

Issuing Processor / Peripheral Reset ... Skipped
Enabling Memory Writes ... Skipped
Halting Processor ... Skipped
Clearing Watchdog ... Skipped

Probing Flash at (Flash Window: 0x1fc00000) ...

[rote Front-LED blinkt]
(nach 5 Minuten wurde abgebrochen, LED aus)

^C
C:\SKYNET\WRTJTAG>

------------------------------------------------------------------------------------------

C:\SKYNET\WRTJTAG>wrt54g -backup:cfe /skipdetect

==================================== WRT54G/GS EJTAG Debrick Utility v4.5 ====================================

Probing bus ... Done

Instruction Length set to 0

CPU Chip ID: 11111111111111111111111111111111 (FFFFFFFF)
*** CHIP DETECTION OVERRIDDEN ***

- EJTAG IMPCODE ....... : 11111111111111111111111111111111 (FFFFFFFF)
- EJTAG Version ....... : Unknown (7 is a reserved value)
- EJTAG DMA Support ... : No

Issuing Processor / Peripheral Reset ... Done
Enabling Memory Writes ... Skipped
Halting Processor ... ... Done
Clearing Watchdog ...

[rote Front-LED blinkt]
(nach 5 Minuten wurde abgebrochen, LED aus)

^C
C:\SKYNET\WRTJTAG>

-------------------------------------------------------------------------------------------

Home