|
|
高手们帮帮忙，谢谢！
+ ^: R. L# C2 k: u) }( I我的是MX25L12845EM1 用2.05的brjtag识别为5357
4 D; Z/ U3 D" Y$ {' I; ~& \到Erasing block: 2 (addr = 1C010000)... 弹出内存不能为read（试了很多次都这样）0 z0 ] p4 c7 B# V
附上操作. |8 y/ _, h' Q; V
Microsoft Windows XP [版本 5.1.2600]
1 o! N. Y" G( p8 L5 q; N8 @(C) 版权所有 1985-2001 Microsoft Corp.( e1 @6 D9 I9 J3 {
& f& A# c m h0 {" W
C:\Documents and Settings\Administrator>cd d:\jtag
6 I- w% D6 O4 u5 M3 L1 c
) L) Q2 |, s. G C5 h! S- m4 SC:\Documents and Settings\Administrator>brjtag.exe; w {* C2 L0 X6 N- P6 `: N8 l1 Q
# y: v+ b- K& g7 B) b ===============================================
' @6 G8 r& G/ W8 N' ~3 D, y Broadcom EJTAG Debrick Utility v2.0.5-hugebird, q0 o# W4 g* M% n4 S
===============================================. U- b/ S: _ A
( W. r$ U h9 ]9 A1 M$ h* t
ABOUT: This program reads/writes flash memory on the Broadcom MIPS(LE)# O* ]# b' Q) r. M
Chip and compatible routers via EJTAG using either DMA Access
& r; D! V( o, |) l' x8 M& V routines or PrAcc routines (slower/more compatible). Processor chips
6 E+ m( }. j3 x3 F/ M$ h supported in this version include the following chips:0 B: a2 h8 ^$ I" h; _4 \" h
( @, W7 p9 B0 ?8 H$ D
Supported Chips
5 j. _* p+ R% _2 ?5 z0 L Z { ---------------4 ^" c6 \8 E) ~. B. A
Broadcom BCM4702
4 M+ b9 F9 b% X. f Broadcom BCM4704
/ L* E! n+ O: v* [ Broadcom BCM4712
* ^! ?/ X& T3 o6 D. ?3 j0 h Broadcom BCM4716
3 E; T a+ \' m' n Broadcom BCM4705|4785
. Q2 [. w' o1 b. R7 S Broadcom BCM5350
; {: k$ T7 a, `" J6 ?: }+ d Broadcom BCM5352, C" ^- m( Z1 D
Broadcom BCM5354
2 v# t% Z" H9 E2 Q Broadcom BCM5356
$ L" q& j# R) v2 S Broadcom BCM5365
$ F$ e" W5 n) ~& P Broadcom HND Mips 74K(008C)
- s+ B8 Q' q: V/ B1 R- S Broadcom BCM63450 {1 y4 z% M: w# K6 `8 Y! a
Broadcom BCM63386 g1 W6 Y: v* i4 U( `; S4 t7 r/ N
Broadcom BCM6348
5 w0 P- t1 k5 u2 ?) F Broadcom BCM6358! x% x9 U# }) x! Y
Broadcom BCM63689 e' F1 \% }. _. U% k% }
Broadcom BCM6816
' h* B- x) t1 y9 q Broadcom BCM7401
3 ~3 A' ~. Q! n: c5 J: O3 B PMC-Serria BRECIS MSP2007-CA-A18 ^ p7 b! u- ?' l& x z; G
TI TNETD7300GDU(AR7WRD)
- Q2 b: c' }4 c$ `9 Y) Q TI TNETV1060GDW
6 s% F% N# g k% F/ d# f( l1 T* p: `- \: Q& Q) Y/ g, J. z; d- @) Z2 t. j
Supported Cable Types% Y6 y( C5 Z* |7 _# u; q8 ]
---------------
( [7 y5 B Y/ v% M ID Cable Name! G7 n& u% d0 p+ n6 Y( h
0 Parallel port type(DLC5/WIGGLER)
% N/ k: N$ o( C 1 FT2232C/D based USB cable(OpenMoko,JTAGkey,OpenJTAG)' A; v+ T3 h/ o8 W, U! v" b
2 SEGGAR J-Link EMU(v5.0 or later)
' }* y- W( ~# y+ [' w 3 HID-BRJTAG v1.xx(USBASP M8)
3 n) ~4 b% n) |' S1 B 4 HID-BRJTAG v2.xx(STM32F10x/SAM7S)
& V" a4 `- _) Z; X" g! N6 d- b# n# H/ d3 Y% D
% K( L- `( U& s8 X, E$ iUSAGE: Brjtag /showflashlist: s6 v7 }$ o2 c, s7 [0 ~; {
USAGE: Brjtag [parameter] </noreset> </noemw> </nocwd> </nobreak></LE|BE>' d2 c+ y. M2 J+ m) _: v' k) P
</notimestamp> </dma> </nodma> </noerase></initcpu>$ u7 O& {0 ~/ o4 y% `
</nompi> </ejslow></waitbrk></srst><wx8></resetcs>
8 Z* F& h" T t3 } </bypass></forcealign></showppb></clearppb></erasechip>
2 s! M, Q* Z& j" l8 M' @ [% I </nocfi></forcenoflip></forceflip></spirevert>
0 e/ _, H* C% u3 z' m3 Q' o4 L7 K <window:XXXXXXXX><start:XXXXXXXX> </length:XXXXXXXX>
, n8 }# W2 A4 T" F. w; S3 ] <port:XXX> </instrlen:XX> </fc:XX></skipdetect>
$ |# x; b6 T9 u: Q* T </wiggler></cable:X></io2></safemode>
$ B+ E* z7 N: }2 L$ h, e </verbose></pause>
& [7 _8 Q( v. Y! ~& t+ c: F5 a9 A
" D- X/ D% }( y0 A Required Parameter4 i/ m% Z6 N& E: v8 P3 f5 r
------------------2 H( J) x7 P& }
-backup:[cfe|tfe|cfe128|nvram|wholeflash|custom|kernel|bsp]7 T) S' L' }5 C- h
-erase:[cfe|tfe|cfe128|nvram|wholeflash|custom|kernel|bsp]
3 z9 j9 L' `7 @+ g( Q# X7 U -flash:[cfe|tfe|cfe128|nvram|wholeflash|custom|kernel|bsp]
7 v' U+ f1 j! c- m -probeonly/ T$ f) [ ~+ f7 O6 t8 ~
0 r: v* M. j- ]" g7 D Optional Switches
* E1 @8 K. s; x6 Z -----------------
& R& R% c7 \- P0 V+ r /noreset ........... prevent Issuing EJTAG CPU reset9 f. d- e! b- ?3 |. A8 e
/noemw ............. prevent Enabling Memory Writes
' V: n4 W$ K+ ?! p6 T0 [ /nocwd ............. prevent Clearing CPU Watchdog Timer
# r' U3 X, R% t0 f /nobreak ........... prevent Issuing Debug Mode JTAGBRK+ y5 f, q) M) P7 `
/noerase ........... prevent Forced Erase before Flashing( l( M7 O& e' S+ Z6 _
/notimestamp ....... prevent Timestamping of Backups
" e2 q& C# G. ]4 k/ K /dma ............... force use of DMA routines
- C, l' S7 x0 |* V /srst .............. force a TAP nSRST reset on starting
7 _: R+ i* I& w% ]7 g. q# o /nodma ............. force use of PRACC routines (No DMA)
, k) \9 f8 q! u1 A4 L /ejslow............. with low speed ejtag access6 @* \* v' G- `, |
/waitbrk............ wait until CPU enter debug mode
; M' ~, k3 B# l* R: E i /wx8 ............... with x8 mode program flash% T; e; m! g1 e" {
/resetcs ........... issue spi controller reset before any op' t! |: e/ o2 q# |
/spirev............. reverse data endian on flashing a spi chip% Q+ R" H2 G) n' p; R5 D6 [
/initcpu............ load CPU configuration code
& c3 u7 j) r% i7 n: L! t" o* R f c /nompi.............. skip autodect flash base address with MPI Reg; J2 l# h' ]" w% ?7 |- ]4 k5 f
/LE ................ force operate as Little Endian chip/ J+ m- {( y$ q' I/ m
/BE ................ force operate as Big Endian chip
; F. g5 F3 m, _1 i( X /window:XXXXXXXX ... custom flash window base&probe address(in HEX)
8 o) J! [4 t! r; R) c /start:XXXXXXXX .... custom start location (in HEX)
! q' {( B, F$ G7 | /length:XXXXXXXX ... custom length (in HEX)$ u% w4 ?2 k/ u- }: |
/verbose............ scrolling display of data2 P. Z3 R/ f$ a X
/pause.............. pause while CPU is initialized
5 g. D e" f8 k# E5 E$ v* `! | /skipdetect ........ skip auto detection of CPU Chip ID4 |* ~& C1 q0 _+ h' |. U
/instrlen:XX ....... set CPU instruction length manually
1 X' a* l6 n$ N+ e /wiggler ........... use wiggler cable
' c- S9 C& r8 |# g /nocfi ............. disable CFI query flash geometry4 ~2 g# {* z8 [2 g$ R* L; X
/forcenoflip ....... force not flipping CFI queried flash geometry
* w8 [( ~2 _' j6 A* u$ a0 }4 a0 L /forceflip ......... force flipping CFI queried flash geometry, h$ ]& A4 H: X }/ j
/bypass ............ unlock Spansion bypass mode & disable polling1 v7 ^ G( ?& H6 N+ e' W1 e K- b
/forcealign......... force erase address align with block boundary
$ x; ]1 S: j7 P: m2 [ /erasechip.......... erase whole chip, only work with -probeonly
5 }. ~/ @. p1 s) v3 ]. X% l% @# A) \$ U /clearppb........... erase Spansion PPB,only work with -probeonly8 I* E- {9 d2 C5 L7 W
/showppb ........... show flash sector protection status0 `" F3 H v( q0 I1 B6 |6 k
only work with -probeonly
, { L; _1 S/ @* ~0 y /port:XXX........... customize parallel port(default XXX is 378)
2 ^% ? _8 w+ r2 x$ d* \3 H/ w only work in Windows version
0 a5 @5 H: {) n8 P! H2 ~ /io2 ............... use alternative Parallel port access method* }- {, s; ?9 |0 g- D
/cable:x ........... select cable type, x = cable type ID, P, W& _; K7 ?/ N. K. U4 T
/safemode .......... use parallel cable way operate USB, SLOW!
5 a; Y7 ]; b% m6 b) @ /fc:XXX = Manual Flash Chip Selection,disable CFI and ID auto match
. ]: J0 K3 u% }' k use 'brjtag /showflashlist' show build-in flash list# j) S- |6 G6 _2 ~! @0 k
0 \' `4 `6 s6 C8 a& `) x
# i7 u; v1 @# @& {: G1 }
" H. U/ e M& c' J) E5 _8 t
NOTES: *) '-backup:', '-flash:' and '-erase:', the source filename must exist R$ d9 a# f6 d, e5 s
as follows: CFE.BIN, NVRAM.BIN, KERNEL.BIN, WHOLEFLASH.BIN or
8 o2 n- z( [. s1 M5 t7 ~% Z+ A CUSTOM.BIN, BSP.BIN, TFE.BIN(64KB or 1x bottom Sector length CFE): K. a. h+ L8 m+ R6 o& C; r
CFE128.BIN(128KB CFE)
% I& v) l* a( [8 K4 M/ Q7 a
, m. R( U7 v" H' t *) Brjtag defualt with x16 mode handle Parallel Flash chip. /wx8 switch
: M. R' J7 I' U# U1 M' e to x8 mode.. C" ^8 w6 u5 u, X( b
# d W5 n! y0 l( }
*) Brjtag uses CFI command set to automatically detect flash chip' ]" Z2 q3 j4 s& q
parameters. If you have difficulty auto-detecting flash with CFI,; ^( N& l% b6 H, m/ K0 R( U# y7 E
'/nocfi' convert to original flash detection method. brjtag then use; p% W e( M+ J2 I
detected flash ID query parameters from build-in flash list.
4 V7 y0 b$ m' k/ G$ o6 m0 e2 S particularly, you can use '/fc:XX' manually specify flash ID.: H- |6 y5 h4 ~7 N. ?
'brjtag /showflashlist' can print build-in flash list
# T3 }+ L: r8 Z t5 ?, C b& ~5 c0 F* d' M& l: T$ N6 m5 C& I
*) '/forcenoflip' and '/forceflip' can help on some AMD type flash: H5 L% ^6 b: n0 f3 x' E8 G9 [
detecting sector structure correctly if CFI uses.
! m) i' `- M7 u( C9 {+ ~ 'brjtag -probeonly /verbose' debug flash detection9 m: O1 M; T" a) A, j$ U& C1 X
0 l5 _* ?; o$ @3 y6 H) _! J
*) If you have difficulty with the older bcm47xx chips or when no CFE" l! G2 L# b/ f
is currently active/operational you may want to try both the
* D. |1 R0 G" \ /noreset and /nobreak command line options together. Some bcm47xx
/ `. V; ]2 x6 ~ ? chips *may* always require both these options to function properly.
' i# x3 |& C* U- g+ v
5 u: H+ f1 u2 W- P *) When using this utility, usually it is best to type the command line' S: l9 b' U. s. Z+ b4 f) e u
out, then power up the router, about 0.5 second delay, hit <ENTER>$ S( m- u( x$ [! b& F
quickly to avoid bad CFE code lead to <CPU NOT enter Debug mode>
( M4 f1 q* a. a; P% B or the CPUs watchdog interfering with the EJTAG operations.
# a4 o4 ~9 \8 L/ i8 s* X( Z2 S% n3 ~3 ~" b. x% @ b
*) /bypass - enables Unlock bypass command for some AMD/Spansion type
7 ?$ L3 o- \- l) [( _! M flashes, it also disables polling
- ^ Y" k2 o. B, l6 x$ m9 J, r+ H
% r3 h6 ]5 \/ c+ m' F6 U *) /initcpu allow load config code to initialize the CPU. This may help
( B! O1 {/ E6 N9 s4 g! s BCM6358 prevent from some address non-accessible.; |+ s. @3 [( i0 w
_$ [: R) E. P8 O# k6 T, z0 q/ f
*) '-probeonly /window:xxxxxxxx /erasechip' allow choose a workable- C$ h+ J2 h; m6 `; N h! g9 W+ B( u
sector address to erase whole chip. This may help on a bricked box, A7 M8 @ R$ u$ y/ X
with bad CFE
, j% k# L/ g* \* {) i- y' g& n/ m+ }
% p( h1 F7 C' M, S *) /forcealign - enable erase sectors if the operation window is not5 A8 T5 ~& x' F
aligned with sector boundary. It's risky! but can help erase some
" k0 S8 B; S* G: [+ \! l5 h2 y) y1 ^ box NVRAM area whose sector size is larger than NVRAM definition
% d7 k1 S9 p* x/ T& C
Y# S0 p8 G, c) y *) /ejslow - limit parallel port clock out speed to 500KHz. This wish A( Q8 n1 ?2 `7 A
to increase LPT port compatibility for some high clock PC.
9 t/ x- q9 u0 B! M* F" t For USB cable this switch can help hit higher clock
( o8 M, b# m+ y) Y* d
1 x; U5 w! V' q' {' o" Q) u" i *) /pause - pause while CPU being initialized.. D3 q* o# F( R5 H2 V0 n
help handle <CPU NOT enter Debug Mode> via shorting pin method; X k. M8 T6 D3 j6 P
' w, h" k* m6 H0 w
***************************************************************************
: i4 C4 e: A6 S* Flashing the KERNEL or WHOLEFLASH will take a very long time using JTAG *0 p3 G6 e7 z4 J# k- _' H
* via this utility. You are better off flashing the CFE & NVRAM files *- P3 o+ M% Z# ]9 C
* & then using the normal TFTP method to flash the KERNEL via ethernet. *0 x5 a. x3 v+ t6 }4 X( r R2 ]
***************************************************************************0 E; B9 W/ W. F( P2 o
_+ n* W K7 C$ c4 _3 U* ~: N E! ~. T! c4 f' A/ R* ^6 t; o! i
C:\Documents and Settings\Administrator>brjtag.exe -probeonly
! a) @( [" s# H( |
: \. ]5 s8 l1 w" B0 q5 m ===============================================
# l: a# a8 q. C2 _9 d Broadcom EJTAG Debrick Utility v2.0.5-hugebird5 s- ^+ c2 O* u: ?5 _
===============================================" k5 }6 M- A( F2 g @0 A9 }
* M3 B' O* D% g6 o9 P o' I* i
Probing bus ... Done
% }7 \& E; B: {8 E% {& n I6 q5 ` I, a4 p8 \$ c
Detected IR Length is 5
- }6 p3 b, y) `( K2 ?
9 B% [5 @, W! f7 d* }: N# A' GCPU Chip ID: 00010101001101010111000101111111 (1535717F)
% ^% F U4 w$ g3 q+ w- L Z CPU Manufature:Broadcom(17E)6 y7 B' ]% M8 a
CPU Device ID :5357
7 m+ n0 K6 o' w) d# O/ B2 ` CPU Revision :1
! l# T7 a$ J* z9 O7 b* g* Y
' d! F' S7 m8 i) E" \*** Detected a CPU but not in build-in list ***' h- B. P- |: z/ y! Y8 a6 ~) n
7 \3 K' b0 t% J7 c) ~
*** You can set /skipdetect let operate continue ***! ^; L" e0 e9 F4 D1 |5 _
' f# k0 N5 g- r1 |* V- @3 G
# y$ r3 D) F6 S% k- @' {7 j( r1 l5 X) X" d( r
C:\Documents and Settings\Administrator>brjtag -erase:wholeflash9 K2 q) D. z+ o3 |4 c u
/ B8 t9 ]+ y6 i% ?. @: _- w* n d ===============================================+ O( p- M' u. `% l
Broadcom EJTAG Debrick Utility v2.0.5-hugebird
& ~. V( h4 h9 k$ G. P B# P ===============================================( `) S* s6 b! k5 w% N/ Y
: j' B5 T$ `7 B1 l6 m& r
Probing bus ... Done
$ k+ E$ c- |9 ? L6 ] E4 C k: r5 P5 c& _1 x# Y
Detected IR Length is 5
. i; m# W$ H% |* b
6 s" y8 y8 `2 BCPU assumed running under LITTLE endian9 D- N8 e( [: F2 U
0 R: a$ E# p$ a5 I. X, v8 f8 K. XCPU Chip ID: 00010000000010001100000101111111 (1008C17F)
% M9 w0 x/ C8 @& z3 v' r$ C*** Found a Broadcom manufactured HND Mips 74K(008C) REV 01 CPU ***6 v9 |" T4 `9 L% `! F; o
# c; _) u4 ~+ w$ h# o
- EJTAG IMPCODE ....... : 01100000010000010100000000000000 (60414000)9 B) ?5 P1 ?# F6 v
- EJTAG Version ....... : 3.12 \# f) V; s: ~0 I, L1 Z. H4 _3 Q" E
- EJTAG DMA Support ... : No
. B# E2 Y3 M1 b1 `! Z, ^ - EJTAG Implementation flags: R4k ASID_8 MIPS16 NoDMA MIPS32" V' i, e8 T4 V; r
. j3 m% R* j. s6 D2 H. MIssuing Processor / Peripheral Reset ... Done
( B: t/ [; g$ v9 HEnabling Memory Writes ... Skipped2 g" s' k% d0 \( t, n3 S- x
Halting Processor ... <Processor Entered Debug Mode!> ... Done: Q, o9 ]& E+ A) c: o; e
Clearing Watchdog ... Done
; }% [3 |4 u$ a' L+ ^' hLoading CPU Configuration Code ... Skipped
$ W( q4 G! T o g! @
- X* D+ v. x4 l( d' ?Probing Flash at Address: 0x1FC00000 .../ {0 O4 c3 ^: [6 ]. d/ ~- ?: c- T
Detected pFlash Chip ID (VenID:DevID = 00FF : FFFF)& r+ B' F' R3 Y# d! w- J
Detected sFlash Chip ID (VenID:DevID = 00C2 : 0017)
& r3 I7 Q: T+ y. W$ b*** Found a (16MB) ST SPI compatible Flash Chip from Macronix
+ R$ h0 [) L; q ~
1 t [3 I) W- C$ G, u - Flash Chip Window Start .... : 1C0000007 N* Y% N+ i1 {3 y/ i5 ?( k
- Flash Chip Window Length ... : 01000000( u+ y+ C7 s! B
- Selected Area Start ........ : 1C0000002 _8 p" N# y/ F$ g+ F
- Selected Area Length ....... : 01000000
- R% l4 F$ h, t5 \9 p0 o, M
2 v% s& L3 e! V, b2 r' n*** You Selected to Erase the WHOLEFLASH.BIN ***
0 C- j- o6 Z2 ?9 ^; K6 r) b
" N0 ^ `0 t$ `/ \% R3 l6 ~=========================
: n! V! M+ l- X" K2 bErasing Routine Started
: E% [# P: S2 E; s/ ^) F=========================
6 u9 ^, s6 b6 fTotal Blocks to Erase: 2565 E. D) p$ I7 @ J0 o0 e
4 h) w2 z; \' k, F e; g
Erasing block: 1 (addr = 1C000000)...Done' |3 `- H' V+ T- R9 l
Erasing block: 2 (addr = 1C010000)...
, G6 q' @% E @9 F& l% iC:\Documents and Settings\Administrator>
+ B$ y" {, K9 `4 A$ ~ e' L* N- k# w( B# L, O& k5 c
|
|
粤公网安备44152102000001号 
发表于 2013-4-6 22:45:19