Broadcom路由DSL猫用的JTAG工具最新版

nbyhc

谢谢楼主分享，支持新版！

haha111

支持我的BCM6358，可惜没有教程。

jonesleedg

谢谢楼主共享

MINE

回复  hugebird


1.9f

测试版，稳定之前源码暂不扩散

- 增加J-link arm 支持
- 进一步优化usb设 ...
hugebird 发表于 2010-5-22 18:49

用J-LINK V8 连接时，S29GL128N认不出来。

hugebird

用J-LINK V8 连接时，S29GL128N认不出来。
MINE 发表于 2010-5-24 07:02

  可能是modem加电时间与brjtag执行时间间隔没掌握好，大概半秒钟，需要自己去摸索。
usb的接口先执行brjtag，程序会自动暂停，打开猫的电源，短暂停顿马上按回车。

如果始终有问题，把输出贴一下。

phantom-gy

THX
mips   usb->jtag 终于看到希望

MINE

可能是modem加电时间与brjtag执行时间间隔没掌握好，大概半秒钟，需要自己去摸索。
usb的接口先执 ...
hugebird 发表于 2010-5-24 19:17

1、无论是并口数据线还是JLINK，都可以备份，但要加/fc参数。
2、无论是哪种数据线，都认不出S29GL128P。
   以下是用并口数据线时的输出
C:\brjtag>brjtag -probeonly

        ===============================================
         Broadcom EJTAG Debrick Utility v1.9f-hugebird
        ===============================================

Probing bus ... Done

Instruction Length set to 8

CPU assumed running under LITTLE endian

CPU Chip ID: 00110101001101010100000101111111 (3535417F)
*** Found a Broadcom manufactured BCM5354 KFBG REV 03 CPU ***

    - EJTAG IMPCODE ....... : 00000000100000010000100100000100 (00810904)
    - EJTAG Version ....... : 1 or 2.0
    - EJTAG DMA Support ... : Yes
    - EJTAG Implementation flags: R4k MIPS16 MIPS32

Issuing Processor / Peripheral Reset ... Done
Enabling Memory Writes ... Done
Halting Processor ... <Processor Entered Debug Mode!> ... Done
Clearing Watchdog ... Done
Loading CPU Configuration Code ... Skipped

Probing Flash at Address: 0x1FC00000 ...
Detected Chip ID (VenID:DevID = 0000 : 3C06)
*** Unknown or NO Flash Chip Detected ***


*** REQUESTED OPERATION IS COMPLETE ***


3、无论是哪种数据线，都不能运行擦除命令，包括擦除CFE、TFE或WHOLEFLASH。
     以下是用并口数据线时的输出

C:\brjtag>brjtag -erase:cfe /fc:088
        ===============================================
         Broadcom EJTAG Debrick Utility v1.9f-hugebird
        ===============================================
Probing bus ... Done
Instruction Length set to 8
CPU assumed running under LITTLE endian
CPU Chip ID: 00110101001101010100000101111111 (3535417F)
*** Found a Broadcom manufactured BCM5354 KFBG REV 03 CPU ***
    - EJTAG IMPCODE ....... : 00000000100000010000100100000100 (00810904)
    - EJTAG Version ....... : 1 or 2.0
    - EJTAG DMA Support ... : Yes
    - EJTAG Implementation flags: R4k MIPS16 MIPS32
Issuing Processor / Peripheral Reset ... Done
Enabling Memory Writes ... Done
Halting Processor ... <Processor Entered Debug Mode!> ... Done
Clearing Watchdog ... Done
Loading CPU Configuration Code ... Skipped
*** Manually Selected a Spansion S29GL128N/P Uni  (16MB) from AMD/Spansion
    - Flash Chip Window Start .... : 1C000000
    - Flash Chip Window Length ... : 01000000
    - Selected Area Start ........ : 1C000000
    - Selected Area Length ....... : 00040000
*** You Selected to Erase the CFE.BIN ***
=========================
Erasing Routine Started
=========================
Total Blocks to Erase: 2
Erasing block: 1 (addr = 1C000000)...^C
C:\brjtag>

hugebird

1、无论是并口数据线还是JLINK，都可以备份，但要加/fc参数。
2、无论是哪种数据线，都认不出S29GL1 ...
MINE 发表于 2010-5-24 15:18

5354的路由器啊， little endian部分的代码一直没更新过。但后面直接/fc都不能擦除就有点奇怪了。不知道这个设备是不是-backup也不能完成还是只能做-backup.
一种可能性，这个设备flash硬件是按8bit模式进行访问的，那么目前没有工具可以支持8位模式，尽管CPUID可以读出来，但JTAG只能加/fc参数读出flash，不能写 。因为读出是5354自动完成的，写入是PC控制的。
确认flash是工作在x8还是工作在x16的办法是用万用表在设备加电的时候量pin 53(BYTE)引脚对地电压，圆点上面那排，从左数第4个脚。>2.7V，高电压，说明flash工作在x16模式，brjtag可以支持，如果 <1V, 低电压，说明flash工作在x8 模式，brjtag目前不能支持任何与写操作相关的动作。

x8模式是计划中的功能，如果要支持，软件结构需要大变，短期内恐怕实现不了。

另外方便的话，贴一下这两个命令的log

brjtag -probeonly /verbose
brjtag -probeonly /window:1c000000 /verbose

MINE

1、采用Bcm5354的DI524SU C1版的S29GL128N的BYTE脚加电后低于1V，而且跟pin 54 (VSS)是通着的（这点不解，烦请解释下）。
2、经测量，采用Bcm6358芯片的RG100A的S29GL128P的BYTE脚在加电后确实大于2.7V，Brjtag 1.9f通过J-Link可以正常读出FLASH（没有具体型号，Found a CFI Compatiable Flash Chip from AMD/Spansion），可以备份，可以擦除，也可以写入。
3、
brjtag -probeonly /verbose 输出log
C:\brjtag>brjtag -probeonly /verbose /cable:3
        ==========================================
         Broadcom EJTAG Debrick Utility v1.9f-hugebird
        ==========================================
Initializing J-Link HW Ver. 8.0
Set I/O speed to 3000 KHz
Detected target Vref = 3.248V
USB TAP device has been initialized. Please confirm VREF signal connected!
Press any key to continue ONCE target board is powered on!
Probing bus ... Done
Instruction Length set to 8
CPU assumed running under LITTLE endian
CPU Chip ID: 00110101001101010100000101111111 (3535417F)
*** Found a Broadcom manufactured BCM5354 KFBG REV 03 CPU ***
    - EJTAG IMPCODE ....... : 00000000100000010000100100000100 (00810904)
    - EJTAG Version ....... : 1 or 2.0
    - EJTAG DMA Support ... : Yes
    - EJTAG Implementation flags: R4k MIPS16 MIPS32
Issuing Processor / Peripheral Reset ... Done
Enabling Memory Writes ... Done
Halting Processor ... <Processor Entered Debug Mode!> ... Done
Clearing Watchdog ... Done
Loading CPU Configuration Code ... Skipped
Probing Flash at Address: 0x1FC00000 ...
Read raw Chip ID (MfrID:DevID = 0000 : 0090)
Detected Chip ID (VenID:DevID = 0000 : 0090)

Read Array Starting from offset [0x0010]
Array[0x10] = 0xB800
Array[0x11] = 0x0098
Array[0x12] = 0x5024

Read Array Starting from offset [0x0010]
Array[0x10] = 0x0010
Array[0x11] = 0x0098
Array[0x12] = 0x5024

Read Array Starting from offset [0x0010]
Array[0x10] = 0x0010
Array[0x11] = 0x012A
Array[0x12] = 0x5024

Read Array Starting from offset [0x0010]
Array[0x10] = 0x0010
Array[0x11] = 0x0098
Array[0x12] = 0x5024
*** Unknown or NO Flash Chip Detected ***

*** REQUESTED OPERATION IS COMPLETE ***

brjtag -probeonly /window:1c000000 /verbose 输出log
C:\brjtag>brjtag -probeonly /window:1c000000 /verbose /cable:3
        ==========================================
         Broadcom EJTAG Debrick Utility v1.9f-hugebird
        ==========================================
Initializing J-Link HW Ver. 8.0
Set I/O speed to 3000 KHz
Detected target Vref = 3.248V
USB TAP device has been initialized. Please confirm VREF signal connected!
Press any key to continue ONCE target board is powered on!
Probing bus ... Done
Instruction Length set to 8
CPU assumed running under LITTLE endian
CPU Chip ID: 00110101001101010100000101111111 (3535417F)
*** Found a Broadcom manufactured BCM5354 KFBG REV 03 CPU ***
    - EJTAG IMPCODE ....... : 00000000100000010000100100000100 (00810904)
    - EJTAG Version ....... : 1 or 2.0
    - EJTAG DMA Support ... : Yes
    - EJTAG Implementation flags: R4k MIPS16 MIPS32
Issuing Processor / Peripheral Reset ... Done
Enabling Memory Writes ... Done
Halting Processor ... <Processor Entered Debug Mode!> ... Done
Clearing Watchdog ... Done
Loading CPU Configuration Code ... Skipped
Probing Flash at Address: 0x1C000000 ...
Read raw Chip ID (MfrID:DevID = 0000 : 0090)
Detected Chip ID (VenID:DevID = 0000 : 0090)

Read Array Starting from offset [0x0010]
Array[0x10] = 0xB800
Array[0x11] = 0x0098
Array[0x12] = 0x5024

Read Array Starting from offset [0x0010]
Array[0x10] = 0x0010
Array[0x11] = 0x0098
Array[0x12] = 0x5024

Read Array Starting from offset [0x0010]
Array[0x10] = 0x0010
Array[0x11] = 0x012A
Array[0x12] = 0x5024

Read Array Starting from offset [0x0010]
Array[0x10] = 0x0010
Array[0x11] = 0x0098
Array[0x12] = 0x5024
*** Unknown or NO Flash Chip Detected ***

*** REQUESTED OPERATION IS COMPLETE ***

两个个额外的问题（1.9f with J-Link）：
A、有时会发现Vref电压为正常的3.3V，有时竟然是47V甚至更高（Vref连接到TTL接口的VCC）。
B、采用Bcm6358芯片的RG100A的S29GL128N，单独使用brjtag -erash:wholeflash /cable:3可以成功全片擦除，但使用brjtag -flash:wholeflash /cable:3时，擦除到block 82时则无法继续，brjtag -flash:wholeflash /cable:3 /L5:1000也不行。

dichao

很好很强大