Broadcom路由DSL猫用的JTAG工具最新版

pttt

Hugebird 你好，我的HG227改CFE变砖了，用2.0.5版本的写入CFE，识别到CPU是BCM5354 REV 03 ，识别不到闪存，实际是S29GL128P11TF101,于是手动指定/FC:88参数，可以写入，但始终提示：
DMA Read(x2) Addr = 1c000a6e  Data = (00000000)ERROR ON READ
DMA Read(x2) Addr = 1c000a6e  Data = (00000000)ERROR ON READ
写入完成后也不能启动，请帮我看一下怎么解决，谢谢！

附以下信息供参考：
C:\jtag>brjtag -probeonly /erasechip /fc:88

        ===============================================
         Broadcom EJTAG Debrick Utility v2.0.5-hugebird
        ===============================================


Probing bus ... Done

Detected IR Length is 8

CPU assumed running under LITTLE endian

CPU Chip ID: 00110101001101010100000101111111 (3535417F)
*** Found a Broadcom manufactured BCM5354 REV 03 CPU ***

    - EJTAG IMPCODE ....... : 00000000100000010000100100000100 (00810904)
    - EJTAG Version ....... : 1 or 2.0
    - EJTAG DMA Support ... : Yes
    - EJTAG Implementation flags: R4k MIPS16 MIPS32

Issuing Processor / Peripheral Reset ... Done
Enabling Memory Writes ... Done
Halting Processor ... <Processor Entered Debug Mode!> ... Done
Clearing Watchdog ... Done
Loading CPU Configuration Code ... Skipped
*** Manually Selected a Spansion S29GL128N/P Uni  (16MB) from AMD/Spansion

Operation will take 1 or 2 minutes. Don't break!!!
Erasing whole chip ... Done!



*** REQUESTED OPERATION IS COMPLETE ***


C:\jtag>brjtag -flash:cfe /fc:88

        ===============================================
         Broadcom EJTAG Debrick Utility v2.0.5-hugebird
        ===============================================


Probing bus ... Done

Detected IR Length is 8

CPU assumed running under LITTLE endian

CPU Chip ID: 00110101001101010100000101111111 (3535417F)
*** Found a Broadcom manufactured BCM5354 REV 03 CPU ***

    - EJTAG IMPCODE ....... : 00000000100000010000100100000100 (00810904)
    - EJTAG Version ....... : 1 or 2.0
    - EJTAG DMA Support ... : Yes
    - EJTAG Implementation flags: R4k MIPS16 MIPS32

Issuing Processor / Peripheral Reset ... Done
Enabling Memory Writes ... Done
Halting Processor ... <Processor Entered Debug Mode!> ... Done
Clearing Watchdog ... Done
Loading CPU Configuration Code ... Skipped
*** Manually Selected a Spansion S29GL128N/P Uni  (16MB) from AMD/Spansion

    - Flash Chip Window Start .... : 1C000000
    - Flash Chip Window Length ... : 01000000
    - Selected Area Start ........ : 1C000000
    - Selected Area Length ....... : 00040000

*** You Selected to Flash the CFE.BIN ***

=========================
Flashing Routine Started
=========================
Total Blocks to Erase: 2

Erasing block: 1 (addr = 1C000000)...Done
Erasing block: 2 (addr = 1C020000)...Done

Loading CFE.BIN to Flash Memory...
DMA Read(x2) Addr = 1c000a6e  Data = (00000000)ERROR ON READ
DMA Read(x2) Addr = 1c000a6e  Data = (00000000)ERROR ON READ
Done  (CFE.BIN loaded into Flash Memory OK)

=========================
Flashing Routine Complete
=========================
elapsed time: 1033 seconds


*** REQUESTED OPERATION IS COMPLETE ***

pttt

另外我用的是自制的简易并口JTAG线，线长只有15CM，接台式电脑原生并口。

yesup

这个重要888

pttt

运行BRJTAG2.0.5时会提示“应用程序错误”见附图。

yesup

1.6r 支持了
S29GL128P10 留爪

1330916

谢谢你,辛苦了 :)  

tom-jerry

hotqj 发表于 2011-4-8 22:22
如果你的6368设备有JTAG接口，而又没接错的话，命令应该是和6358的没什么区别的。。
你用的是LPT线？那cab ...

我用的是usb转jtag线，FT2232d芯片，故采用cable：1参数。现将实际出现信息如下文。共采用2种方式，方式1，不使用skipdetect参数；方式2，带skipdetect参数。
【方式1】：
C:\brjtag204>brjtag -backup:cfe /cable:1 /fc:112

        ===============================================
         Broadcom EJTAG Debrick Utility v2.0.4-hugebird
        ===============================================


Set I/O speed to 6000 KHz

USB TAP device has been initialized. Please confirm VREF signal connected!
Press any key to continue... ONCE target board is powered on!

Probing bus ... Done

Detected IR Length is 0

CPU Chip ID: 00000000000000000000000000000000 (00000000)
*** Unknown or NO CPU Chip ID Detected ***

*** Possible Causes:
    1) Router/Modem is not Connected.
    2) Router/Modem is not Powered On.
    3) Improper JTAG Cable.
    4) Unrecognized CPU Chip ID.

【方式2】：
C:\brjtag204>brjtag -backup:cfe /cable:1 /skipdetect /fc:112

        ===============================================
         Broadcom EJTAG Debrick Utility v2.0.4-hugebird
        ===============================================


Set I/O speed to 6000 KHz

USB TAP device has been initialized. Please confirm VREF signal connected!
Press any key to continue... ONCE target board is powered on!

Probing bus ... Done

Detected IR Length is 0

CPU assumed running under LITTLE endian

CPU Chip ID: 00000000000000000000000000000000 (00000000)
*** CHIP DETECTION OVERRIDDEN ***

    - EJTAG IMPCODE ....... : 00000000000000000000000000000000 (00000000)
    - EJTAG Version ....... : 1 or 2.0
    - EJTAG DMA Support ... : Yes
    - EJTAG Implementation flags: R4k MIPS32

Issuing Processor / Peripheral Reset ... Done
Enabling Memory Writes ... Done
Halting Processor ... <Processor did NOT enter Debug Mode!> ... Done
Clearing Watchdog ... Done
Loading CPU Configuration Code ... Skipped
*** Manually Selected a MX29GL128E Uni            (16MB) from Macronix

    - Flash Chip Window Start .... : 1C000000
    - Flash Chip Window Length ... : 01000000
    - Selected Area Start ........ : 1C000000
    - Selected Area Length ....... : 00040000

*** You Selected to Backup the CFE.BIN ***

=========================
Backup Routine Started
=========================

Saving CFE.BIN.SAVED_20110411_132428 to Disk...
Done  (CFE.BIN.SAVED_20110411_132428 saved to Disk OK)

bytes written: 262144
=========================
Backup Routine Complete
=========================
elapsed time: 5 seconds


*** REQUESTED OPERATION IS COMPLETE ***

billyywei

hugebird 老大，请教：JTAG刷机成功，TTL下刷RG100A-AA电信原版也成功，可以进入WEB登陆界面，但超级密码失效（由TTL下用CAT查看PSI.XML文件所得），怀疑此密码未初始化到FLASH中，是不是无法写入电信固件所需的PSI区中？另刷2760U1.04可用，谢谢了

hugebird

uzer222 发表于 2011-4-9 01:24
hi!
can you add support storlink sl3516 based on FA526 core (CS351X) or give JTAG instructions for  ...

sl3516 is an arm9 soc, brjtag currently have no plan to support arm core.
you can try openocd

hugebird

回复 pttt 的帖子

bcm5354有可能flash采用是8位的数据位宽，试一下加/wx8开关，是否可以识别，
如果已经完全清空了flash，那么再加/initcpu开关