Broadcom路由DSL猫用的JTAG工具最新版

hugebird

回复  hugebird


    8bit/16bit在CFE和JTAG软件上应该都自动识别的，看上图是输入命令出来的帮助中（ ...
shuhans 发表于 2010-5-27 06:15

brjtag /showflashlist 可以显示列表，现在用CFI自动检测，这个列表没必要直接显示了。

跳两个电阻前提是cpu到flash高8位数据线pcb已经做了。如果没有这8条线必须要因的

MINE

8bit的机器，pcb根本就不会布高8位data线，看你怎么个接电阻法变16bit。。。
已知的16bit机器，到可 ...
phantom-gy 发表于 2010-5-27 16:54

请问你是不是722楼shuhans提到的朋友？程序能让我试一下吗？

hugebird

1.9g

临时测试版，增加了x8模式写入。
架构做了较大规模调整，部分过时代码全部砍掉了。
还未全面测试。

用开关 /wx8 启动x8模式， 包括probeonly 必须加/wx8

有环境的可以帮忙贴一下下面命令的显示

1. brjtag -probeonly /wx8 /verbose

复制代码

shuhans

回复 723# phantom-gy


    哦，看来我看错了，我以为你们是要16bit改8bit

MINE

回复 726# hugebird


以下log是BCM5354+S29GL128N输出结果，已测得S29GL128N是工作在8位宽下，而且这是我第一次在这台设备上用JTAG软件找到FLASH（虽然几十次才能找到一次）。

C:\brjtag>brjtag -probeonly /wx8 /verbose /cable:3

        ===============================================
         Broadcom EJTAG Debrick Utility v1.9g-hugebird
        ===============================================

Initializing J-Link HW Ver. 8.0
Set I/O speed to 3000 KHz
Detected target Vref = 0.931V

USB TAP device has been initialized. Please confirm VREF signal connected!
Press any key to continue ONCE target board is powered on!

Probing bus ... Done

Detected IR Length is 8

CPU assumed running under LITTLE endian

CPU Chip ID: 00110101001101010100000101111111 (3535417F)
*** Found a Broadcom manufactured BCM5354 REV 03 CPU ***

    - EJTAG IMPCODE ....... : 00000000100000010000100100000100 (00810904)
    - EJTAG Version ....... : 1 or 2.0
    - EJTAG DMA Support ... : Yes
    - EJTAG Implementation flags: R4k MIPS16 MIPS32

Issuing Processor / Peripheral Reset ... Done
Enabling Memory Writes ... Done
Halting Processor ... <Processor Entered Debug Mode!> ... Done
Clearing Watchdog ... Done
Loading CPU Configuration Code ... Skipped

Probing Flash at Address: 0x1FC00000 ...
Read raw Chip ID (MfrID:DevID = 0001 : 007E)
Read raw sub dev ID (devid2:devid3 = 0021 : 0001)
Read final Chip ID (VenID:DevID = 017E : 2101)
Detected Chip ID (VenID:DevID = 017E : 2101)


Read Array Starting from offset [0x0010]
Array[0x10] = 0x0051
Array[0x11] = 0x0052
Array[0x12] = 0x0059


Read Array Starting from offset [0x0010]
Array[0x10] = 0x0051
Array[0x11] = 0x0052
Array[0x12] = 0x0059
Array[0x13] = 0x0002
Array[0x14] = 0x0000
Array[0x15] = 0x0040
Array[0x16] = 0x0000
Array[0x17] = 0x0000
Array[0x18] = 0x0000
Array[0x19] = 0x0000
Array[0x1A] = 0x0000
Array[0x1B] = 0x0027
Array[0x1C] = 0x0036
Array[0x1D] = 0x0000
Array[0x1E] = 0x0000
Array[0x1F] = 0x0007
Array[0x20] = 0x0007
Array[0x21] = 0x000A
Array[0x22] = 0x0000
Array[0x23] = 0x0003
Array[0x24] = 0x0005
Array[0x25] = 0x0004
Array[0x26] = 0x0000
Array[0x27] = 0x0018
Array[0x28] = 0x0002
Array[0x29] = 0x0000
Array[0x2A] = 0x0005
Array[0x2B] = 0x0000
Array[0x2C] = 0x0001
Array[0x2D] = 0x007F
Array[0x2E] = 0x0000
Array[0x2F] = 0x0000
Array[0x30] = 0x0002
Array[0x31] = 0x0000
Array[0x32] = 0x0000
Array[0x33] = 0x0000
Array[0x34] = 0x0000
Array[0x35] = 0x0000
Array[0x36] = 0x0000
Array[0x37] = 0x0000
Array[0x38] = 0x0000
Array[0x39] = 0x0000
Array[0x3A] = 0x0000
Array[0x3B] = 0x0000
Array[0x3C] = 0x0000

Flash CommandSet = 0002


Read Array Starting from offset [0x0040]
Array[0x40] = 0x0050
Array[0x41] = 0x0052
Array[0x42] = 0x0049
Array[0x43] = 0x0031
Array[0x44] = 0x0033
Array[0x45] = 0x0010
Array[0x46] = 0x0002
Array[0x47] = 0x0001
Array[0x48] = 0x0000
Array[0x49] = 0x0008
Array[0x4A] = 0x0000
Array[0x4B] = 0x0000
Array[0x4C] = 0x0002
Array[0x4D] = 0x00B5
Array[0x4E] = 0x00C5
Array[0x4F] = 0x0005

Flash Boot Block Location: Non TOP
Flash total size: 16384KB (16MB)
Flash has total 1 erase block regions
Region[0] sector count: 128,   size:128KB
Complete CFI Query!!

Matching Flash Chip (VenID:DevID = 017E : 2101)

*** Found a CFI Compatiable Flash Chip from AMD/Spansion



*** REQUESTED OPERATION IS COMPLETE ***

但是在执行brjtag -flash:cfe /wx8 /cable:3后，确实可以看到已经擦除了BLOCK1和2，但紧接着：

10A10007 - FFFFFFFF
dma write not correctly !!
00000000 - FFFFFFFF
dma write not correctly !!
24841000 - FFFFFFFF
dma write not correctly !!
240108FF - FFFFFFFF
   1%   bytes = 3136
dma write not correctly !!
14A1FFF1 - FFFFFFFF
dma write not correctly !!
00000000 - FFFFFFFF
dma write not correctly !!
01C00008 - FFFFFFFF
dma write not correctly !!
24020000 - FFFFFFFF
dma write not correctly !!
04110001 - FFFFFFFF
dma write not correctly !!
00000000 - FFFFFFFF
dma write not correctly !!
3C081FFF - FFFFFFFF
dma write not correctly !!
3508FFFF - FFFFFFFF
dma write not correctly !!
011F4024 - FFFFFFFF
dma write not correctly !!
3C091FC0 - FFFFFFFF
dma write not correctly !!
0109082A - FFFFFFFF
dma write not correctly !!
14200106 - FFFFFFFF
dma write not correctly !!
00000000 - FFFFFFFF
dma write not correctly !!
2401080E - FFFFFFFF
dma write not correctly !!
14A10005 - FFFFFFFF
dma write not correctly !!
00000000 - FFFFFFFF
   1%   bytes = 3200
dma write not correctly !!
0411025F - FFFFFFFF
dma write not correctly !!
24060000 - FFFFFFFF
dma write not correctly !!
100000FF - FFFFFFFF
dma write not correctly !!
00000000 - FFFFFFFF
dma write not correctly !!
3C08B800 - FFFFFFFF
dma write not correctly !!
8D090FFC - FFFFFFFF
dma write not correctly !!
31298FF0 - FFFFFFFF
dma write not correctly !!
00094902 - FFFFFFFF
dma write not correctly !!
24010800 - FFFFFFFF
dma write not correctly !!
15210011 - FFFFFFFF
dma write not correctly !!
00000000 - FFFFFFFF
dma write not correctly !!
306A7000 - FFFFFFFF
dma write not correctly !!
000A5202 - FFFFFFFF
dma write not correctly !!
3063000F - FFFFFFFF
dma write not correctly !!
006A1825 - FFFFFFFF
dma write not correctly !!
14600007 - FFFFFFFF
   1%   bytes = 3264
dma write not correctly !!
00000000 - FFFFFFFF
dma write not correctly !!
8D090000 - FFFFFFFF
dma write not correctly !!
3129FFFF - FFFFFFFF
dma write not correctly !!
24015365 - FFFFFFFF
dma write not correctly !!
15210002 - FFFFFFFF
dma write not correctly !!
00000000 - FFFFFFFF
dma write not correctly !!
24030001 - FFFFFFFF
dma write not correctly !!
3C0ABBFF - FFFFFFFF
dma write not correctly !!
3C0C0200 - FFFFFFFF
dma write not correctly !!
10000003 - FFFFFFFF
dma write not correctly !!
00000000 - FFFFFFFF
dma write not correctly !!
3C0ABFBF - FFFFFFFF
dma write not correctly !!
3C0C0040 - FFFFFFFF
dma write not correctly !!
3C0B0002 - FFFFFFFF
dma write not correctly !!
3C084853 - FFFFFFFF
dma write not correctly !!
35084C46 - FFFFFFFF
   1%   bytes = 3328
dma write not correctly !!
014B3020 - FFFFFFFF
dma write not correctly !!
8CC90000 - FFFFFFFF
dma write not correctly !!
11090011 - FFFFFFFF
dma write not correctly !!
00000000 - FFFFFFFF
dma write not correctly !!
000B5840 - FFFFFFFF
dma write not correctly !!
018B082A - FFFFFFFF
dma write not correctly !!
1020FFF9 - FFFFFFFF
dma write not correctly !!
00000000 - FFFFFFFF
dma write not correctly !!
3C06BFC0 - FFFFFFFF
dma write not correctly !!
34C61000 - FFFFFFFF
dma write not correctly !!
8CC90000 - FFFFFFFF
dma write not correctly !!
11090008 - FFFFFFFF
dma write not correctly !!
00000000 - FFFFFFFF
dma write not correctly !!
3C06BFC0 - FFFFFFFF
dma write not correctly !!
34C60400 - FFFFFFFF
dma write not correctly !!
8CC90000 - FFFFFFFF
   1%   bytes = 3392
dma write not correctly !!
11090003 - FFFFFFFF
dma write not correctly !!
00000000 - FFFFFFFF
dma write not correctly !!
10000007 - FFFFFFFF
dma write not correctly !!
24060000 - FFFFFFFF
dma write not correctly !!
8CC80008 - FFFFFFFF
dma write not correctly !!
00084402 - FFFFFFFF
dma write not correctly !!
8CCA000C - FFFFFFFF
dma write not correctly !!
3149FFFF - FFFFFFFF
dma write not correctly !!
000A5402 - FFFFFFFF
dma write not correctly !!
8CCB0010 - FFFFFFFF
dma write not correctly !!
24010803 - FFFFFFFF
dma write not correctly !!
10A100AF - FFFFFFFF
dma write not correctly !!
00000000 - FFFFFFFF
dma write not correctly !!
14C00009 - FFFFFFFF
dma write not correctly !!
00000000 - FFFFFFFF
dma write not correctly !!
24080009 - FFFFFFFF
   1%   bytes = 3456
dma write not correctly !!
24090062 - FFFFFFFF
dma write not correctly !!
240B0A0A - FFFFFFFF
dma write not correctly !!
24010001 - FFFFFFFF
dma write not correctly !!
10610003 - FFFFFFFF
dma write not correctly !!
00000000 - FFFFFFFF
dma write not correctly !!
3C0B0005 - FFFFFFFF
dma write not correctly !!
356B050A - FFFFFFFF
dma write not correctly !!
31070001 - FFFFFFFF
dma write not correctly !!
10E00057 - FFFFFFFF
dma write not correctly !!
00000000 - FFFFFFFF
dma write not correctly !!
11600004 - FFFFFFFF
dma write not correctly !!
00000000 - FFFFFFFF
dma write not correctly !!
240CFFFF - FFFFFFFF
dma write not correctly !!
156C0049 - FFFFFFFF
dma write not correctly !!
00000000 - FFFFFFFF
dma write not correctly !!
00008021 - FFFFFFFF


现在设备已经成砖，加电后在终端中没有任何显示，5个有线接口灯常亮。不过这也正说明你的新版brjtag确实对这个8位宽的FLASH进行了写操作（已经清空CFE，只是新的CFE没写入而已）。

shuhans

回复 726# hugebird


   设计了48脚FLASH的板子，如果45脚上有两个电阻的，可以16bit改8bit试

hugebird

回复 728# MINE


写入出错了，你再备份出来比较一下，看看是否有东西写进去了。

写入时降速处理
/L1:2000   /L4:128
/L1:1000   /L4:128

sdam269

PS E:\> brjtag\brjtag -probeonly /wx8 /verbose /cable:3

        ===============================================
         Broadcom EJTAG Debrick Utility v1.9g-hugebird
        ===============================================

Couldn't load libusb liberary
在WIN7下显示

hugebird

PS E:\> brjtag\brjtag -probeonly /wx8 /verbose /cable:3

        ================================= ...
sdam269 发表于 2010-5-28 02:33

   下1.9f版，看里面的使用说明，需要安装5.5之后的libusb-win32 库

MINE

回复 730# hugebird


刚才换并口JTAG数据线写128K的CFE，提示成功（手工加了/fc:088参数），但再备份出CFE时，备份出来的256K文件为全空。

C:\brjtag>brjtag -flash:cfe /wx8 /fc:088

        ===============================================
         Broadcom EJTAG Debrick Utility v1.9g-hugebird
        ===============================================

Probing bus ... Done

Detected IR Length is 8

CPU assumed running under LITTLE endian

CPU Chip ID: 00110101001101010100000101111111 (3535417F)
*** Found a Broadcom manufactured BCM5354 REV 03 CPU ***

    - EJTAG IMPCODE ....... : 00000000100000010000100100000100 (00810904)
    - EJTAG Version ....... : 1 or 2.0
    - EJTAG DMA Support ... : Yes
    - EJTAG Implementation flags: R4k MIPS16 MIPS32

Issuing Processor / Peripheral Reset ... Done
Enabling Memory Writes ... Done
Halting Processor ... <Processor Entered Debug Mode!> ... Done
Clearing Watchdog ... Done
Loading CPU Configuration Code ... Skipped
*** Manually Selected a Spansion S29GL128N/P Uni  (16MB) from AMD/Spansion

    - Flash Chip Window Start .... : 1C000000
    - Flash Chip Window Length ... : 01000000
    - Selected Area Start ........ : 1C000000
    - Selected Area Length ....... : 00040000

*** You Selected to Flash the CFE.BIN ***

=========================
Flashing Routine Started
=========================
Total Blocks to Erase: 2

Erasing block: 1 (addr = 1C000000)...Done
Erasing block: 2 (addr = 1C020000)...Done

Loading CFE.BIN to Flash Memory...
Done  (CFE.BIN loaded into Flash Memory OK)

=========================
Flashing Routine Complete
=========================
elapsed time: 426 seconds


*** REQUESTED OPERATION IS COMPLETE ***


C:\brjtag>brjtag -backup:cfe /wx8 /fc:088

        ===============================================
         Broadcom EJTAG Debrick Utility v1.9g-hugebird
        ===============================================

Probing bus ... Done

Detected IR Length is 8

CPU assumed running under LITTLE endian

CPU Chip ID: 00110101001101010100000101111111 (3535417F)
*** Found a Broadcom manufactured BCM5354 REV 03 CPU ***

    - EJTAG IMPCODE ....... : 00000000100000010000100100000100 (00810904)
    - EJTAG Version ....... : 1 or 2.0
    - EJTAG DMA Support ... : Yes
    - EJTAG Implementation flags: R4k MIPS16 MIPS32

Issuing Processor / Peripheral Reset ... Done
Enabling Memory Writes ... Done
Halting Processor ... <Processor Entered Debug Mode!> ... Done
Clearing Watchdog ... Done
Loading CPU Configuration Code ... Skipped
*** Manually Selected a Spansion S29GL128N/P Uni  (16MB) from AMD/Spansion

    - Flash Chip Window Start .... : 1C000000
    - Flash Chip Window Length ... : 01000000
    - Selected Area Start ........ : 1C000000
    - Selected Area Length ....... : 00040000

*** You Selected to Backup the CFE.BIN ***

=========================
Backup Routine Started
=========================

Saving CFE.BIN.SAVED_20100528_112448 to Disk...
Done  (CFE.BIN.SAVED_20100528_112448 saved to Disk OK)

bytes written: 262144
=========================
Backup Routine Complete
=========================
elapsed time: 122 seconds


*** REQUESTED OPERATION IS COMPLETE ***