|
|
发表于 2013-4-6 11:39:51
|
显示全部楼层
我也是MX25L12845EM1 也是认不到 到Erasing block: 2 (addr = 1C010000)...弹出内存不能为read2 k @; ^# u# }! ^, {8 y( B
你要是研究出来麻烦分享下，谢谢！# F% C& e# K7 _8 ^+ E' ~
Microsoft Windows XP [版本 5.1.2600]1 Q9 U- g/ G# B! Y: `& `
(C) 版权所有 1985-2001 Microsoft Corp.3 G7 [, {. n& C Y
. q: N9 Q# o6 [C:\Documents and Settings\Administrator>cd d:\jtag
; v3 p/ `% ~( Y2 [* D- H$ E
8 V6 Z; j2 x3 O, U3 ]C:\Documents and Settings\Administrator>brjtag.exe
3 j6 \! d9 n/ k) C* G# T3 F
; d! ?( l3 U0 K K4 `' z* S ===============================================6 z5 k) {& j& z0 K' ^
Broadcom EJTAG Debrick Utility v2.0.5-hugebird. V h# J! N; J2 H6 F- b1 K2 l7 M
===============================================
# d: ]) a' [9 y" K- J$ ?
+ V) `! I& D7 X& e9 Z; }2 F: r ABOUT: This program reads/writes flash memory on the Broadcom MIPS(LE)
: \0 r0 a) t4 B: K" I1 n# K" t2 L' X Chip and compatible routers via EJTAG using either DMA Access% E: A8 D( _: w, Z1 \
routines or PrAcc routines (slower/more compatible). Processor chips* i* U- e1 M% I
supported in this version include the following chips:8 j- s: b& x) M% I# s) n& b
0 K3 ]/ | L# M* } Supported Chips
( S- }9 ~2 i$ L/ a2 ^ ---------------) w- _3 o1 P% ~
Broadcom BCM4702' X" ^( k* d! p; n* P( x: ~
Broadcom BCM4704
& a* h+ F& U: x5 u Broadcom BCM4712/ g$ I8 X1 T: `' t2 b
Broadcom BCM4716' E, [" J* L0 l0 u X% E
Broadcom BCM4705|4785
9 d. z3 l5 S9 ]$ ~5 q8 p Broadcom BCM5350- F( r3 H4 `) v( h) D
Broadcom BCM5352
{4 r1 E, a! m- m! g$ ?+ w Broadcom BCM5354! G3 l5 }0 o$ }2 l9 d2 Z0 p
Broadcom BCM5356
' ] X# h# W2 M2 M7 p Broadcom BCM5365. g* g+ z v; C7 y
Broadcom HND Mips 74K(008C)
* G& H. d3 L$ C1 k1 i Broadcom BCM6345) D$ T) }6 R3 f. x9 d
Broadcom BCM6338- C" x$ m: L/ @9 @2 C( ?) w" f
Broadcom BCM6348' |0 R* {! B2 {. }) p' Z; ]# \
Broadcom BCM6358
6 f2 q0 X" w4 P$ ~) S8 x! S5 V5 r Broadcom BCM63680 p: r1 {. i! g5 K7 d# o) i- N' ~
Broadcom BCM6816' F9 ?& p& U) i
Broadcom BCM7401) O; E( b7 m$ R/ V0 E, ?5 I4 q3 r( }4 D
PMC-Serria BRECIS MSP2007-CA-A1- L! Y$ f( o5 d9 H: p3 E6 B2 ]. O
TI TNETD7300GDU(AR7WRD)5 L' k$ a/ s" j& a* X0 P
TI TNETV1060GDW
. n7 V$ Q2 Z& Y& L5 I! y
6 r6 |' g- l$ U0 |6 W Supported Cable Types
1 X9 ^& [5 }8 S ---------------+ f2 y Y% Y/ t t, m
ID Cable Name( e, X- U# d' r4 s4 h5 s
0 Parallel port type(DLC5/WIGGLER)2 r! L% d) }8 C! M
1 FT2232C/D based USB cable(OpenMoko,JTAGkey,OpenJTAG)
3 \ M3 O- D; }/ e! N 2 SEGGAR J-Link EMU(v5.0 or later)
9 T) z8 R9 l/ m/ f; G 3 HID-BRJTAG v1.xx(USBASP M8)7 o8 i( ^: @1 R4 j7 j
4 HID-BRJTAG v2.xx(STM32F10x/SAM7S)$ H0 [$ z* f5 \9 A$ M4 X9 ?' R
' e V* G( X/ q! J0 }" ]% r
3 Y }/ I' C) S# z0 ?. t8 G! [; l5 S6 y USAGE: Brjtag /showflashlist
' f- _% c/ s7 J! o5 A K USAGE: Brjtag [parameter] </noreset> </noemw> </nocwd> </nobreak></LE|BE>. F1 ~' i6 x O/ m; g& `
</notimestamp> </dma> </nodma> </noerase></initcpu>2 b1 v3 t8 u# Z' O+ H$ V; B- v
</nompi> </ejslow></waitbrk></srst><wx8></resetcs>8 q6 T( h- u% f8 M# D
</bypass></forcealign></showppb></clearppb></erasechip>
% E. h: c& f6 V& h </nocfi></forcenoflip></forceflip></spirevert>
; f" L$ Q( B# m; o# q( P" x <window:XXXXXXXX><start:XXXXXXXX> </length:XXXXXXXX>
o+ a* G) G% B# B& [ <port:XXX> </instrlen:XX> </fc:XX></skipdetect>
6 S% L3 }: q1 ~' B# ] </wiggler></cable:X></io2></safemode>
+ S, N' q. l# o6 ~' N4 U6 z </verbose></pause>+ U7 o* f: J; A% ]( ]; h
4 N5 Q! @# Y& \* \3 I
Required Parameter
5 g7 g7 g" R" }' ]. b" T5 W ------------------
[ k. Q9 G, d0 c. Z, G- X. v. J3 ~ -backup:[cfe|tfe|cfe128|nvram|wholeflash|custom|kernel|bsp]
* p$ x' ]' r/ k5 o: v6 C -erase:[cfe|tfe|cfe128|nvram|wholeflash|custom|kernel|bsp]$ f0 {2 Q: H9 V
-flash:[cfe|tfe|cfe128|nvram|wholeflash|custom|kernel|bsp]' X G2 C& z. c1 c. J ]
-probeonly
2 T V& B) D* P9 n: i; n- ~" Q2 b7 |9 N, C7 p# l
Optional Switches7 B: Y2 _5 |5 S) ]5 S3 L$ |
-----------------
4 q$ h8 X4 B7 D! E9 Y /noreset ........... prevent Issuing EJTAG CPU reset
2 u( f- Z* I) ? /noemw ............. prevent Enabling Memory Writes
' h+ b. N* C* r" _ U( L /nocwd ............. prevent Clearing CPU Watchdog Timer- c0 E' D7 G: Z
/nobreak ........... prevent Issuing Debug Mode JTAGBRK+ n! p2 ?( N% U) I/ B& M
/noerase ........... prevent Forced Erase before Flashing
( y" b5 U5 J, i$ \7 l- \ /notimestamp ....... prevent Timestamping of Backups* R6 j2 o5 E1 z/ A
/dma ............... force use of DMA routines* A# p4 v9 u E. X* ?5 O% O# q
/srst .............. force a TAP nSRST reset on starting
! W6 K. S1 n! e- G, E7 c /nodma ............. force use of PRACC routines (No DMA)
" Y8 n* _" F% ~. ^* r) B) N /ejslow............. with low speed ejtag access
2 P" U" I9 M- R8 a4 K7 Z/ I8 x /waitbrk............ wait until CPU enter debug mode) N' ]0 {, f% H) n9 @. O4 ^* a: Q
/wx8 ............... with x8 mode program flash
! } x1 V X6 Y" A( z /resetcs ........... issue spi controller reset before any op9 l% t& J+ m( s. m' T- M' N# m! q
/spirev............. reverse data endian on flashing a spi chip
% |0 {; Y& T2 }3 c, t5 ]% j+ p /initcpu............ load CPU configuration code% C: }' `5 ~2 ^' ~
/nompi.............. skip autodect flash base address with MPI Reg/ n& v" j, ^" v* T
/LE ................ force operate as Little Endian chip1 V7 @# }4 z: f& a- L5 L
/BE ................ force operate as Big Endian chip
3 G4 W! M/ o( D: Z, `5 r5 { /window:XXXXXXXX ... custom flash window base&probe address(in HEX)
, c+ T: u; [0 L; G0 L5 o /start:XXXXXXXX .... custom start location (in HEX); e. O4 o" M0 W7 h1 z6 h5 z
/length:XXXXXXXX ... custom length (in HEX)
, {6 D1 a) N9 N2 e /verbose............ scrolling display of data
+ X3 X1 D6 i' p8 }! M /pause.............. pause while CPU is initialized
" k7 F+ H4 Y: n: }4 G! Z /skipdetect ........ skip auto detection of CPU Chip ID
- O S$ @* E6 z/ v/ X: @ /instrlen:XX ....... set CPU instruction length manually* M7 c" @0 b, L- u0 J5 Y3 j( P
/wiggler ........... use wiggler cable
3 o. |$ a8 @; n9 M; H5 F3 l /nocfi ............. disable CFI query flash geometry+ ^7 g; \( t" t @" {0 B
/forcenoflip ....... force not flipping CFI queried flash geometry" \8 G4 K( ]( K9 x$ v6 ~
/forceflip ......... force flipping CFI queried flash geometry
Q& s) m! f8 C$ N /bypass ............ unlock Spansion bypass mode & disable polling. G4 c( L: ? Y* H9 T' Q
/forcealign......... force erase address align with block boundary. W8 g9 F, ? R+ @2 \- p9 Q
/erasechip.......... erase whole chip, only work with -probeonly* n7 S2 @ S& W) ^ C% z0 A4 F
/clearppb........... erase Spansion PPB,only work with -probeonly
, S; |( f9 \: T7 D! c /showppb ........... show flash sector protection status
; m% E! r1 W8 c9 v& K only work with -probeonly* |3 H3 @* ]1 u
/port:XXX........... customize parallel port(default XXX is 378)4 @7 o0 Q& m% R$ J& Q. z8 h
only work in Windows version7 C* K( G' v/ x
/io2 ............... use alternative Parallel port access method
/ i* h$ {( p h( w7 n7 W /cable:x ........... select cable type, x = cable type ID& f9 i* T- W: p5 E# E& b
/safemode .......... use parallel cable way operate USB, SLOW!
" T; T9 M G, d0 Y0 s1 _) N /fc:XXX = Manual Flash Chip Selection,disable CFI and ID auto match
$ D1 ], g) F+ V; ^2 m8 V3 c) ~; G' w- P& B use 'brjtag /showflashlist' show build-in flash list4 q& m( d2 `1 Z" |! w& w
& x; q3 K1 ]8 ?& t2 C8 B+ s( j1 a* L
v$ S7 n# a1 S0 E9 B- F
NOTES: *) '-backup:', '-flash:' and '-erase:', the source filename must exist
1 H" {0 P, G0 p0 K8 m2 g5 w as follows: CFE.BIN, NVRAM.BIN, KERNEL.BIN, WHOLEFLASH.BIN or
9 T7 \$ \% F. P1 f' j* ~( x CUSTOM.BIN, BSP.BIN, TFE.BIN(64KB or 1x bottom Sector length CFE)! V* A3 N5 I) X+ x
CFE128.BIN(128KB CFE)2 J* G0 V; r- H* [- D$ h
& A- _9 D: P c; u% ?2 Z5 j *) Brjtag defualt with x16 mode handle Parallel Flash chip. /wx8 switch$ I5 o8 Z& R6 K
to x8 mode.
* Q9 S, N1 T/ M$ Z1 W: Q1 @' k/ C* S/ x. {9 L) r% m! R
*) Brjtag uses CFI command set to automatically detect flash chip: ]( \7 Y F6 m
parameters. If you have difficulty auto-detecting flash with CFI,
& E4 A. M- g" T! O3 _ '/nocfi' convert to original flash detection method. brjtag then use
6 B! m5 N2 j( G+ W detected flash ID query parameters from build-in flash list., q4 W" K: n5 q5 C, W9 s0 e
particularly, you can use '/fc:XX' manually specify flash ID.) ?1 C8 D! a& C5 i, X
'brjtag /showflashlist' can print build-in flash list# {: I) l/ w' J3 j5 y, u
9 A' |6 j0 Z7 x' E0 ]
*) '/forcenoflip' and '/forceflip' can help on some AMD type flash
5 E/ U9 \$ V7 y( S9 ^& x6 t9 | detecting sector structure correctly if CFI uses.! {" B6 W5 h+ _* G4 Z: }* |6 B3 ]; n/ s
'brjtag -probeonly /verbose' debug flash detection. G6 D/ P: [: [. A8 K3 R
- ?$ ~9 G3 @& s& E
*) If you have difficulty with the older bcm47xx chips or when no CFE
2 [) y, X1 B X8 m- E% }; j* G. B" F is currently active/operational you may want to try both the6 c1 z5 o1 U& j9 w
/noreset and /nobreak command line options together. Some bcm47xx
, f6 s, d( F: t1 s- H chips *may* always require both these options to function properly.
/ j9 k( c8 p% Y! y; C/ [) X( {5 i8 I& H
*) When using this utility, usually it is best to type the command line# Q0 ]8 U* `4 @% c7 X
out, then power up the router, about 0.5 second delay, hit <ENTER>
1 X6 ~, D0 ?" t2 r) n quickly to avoid bad CFE code lead to <CPU NOT enter Debug mode>
' V2 J- q; f4 y9 }* Q; k% W or the CPUs watchdog interfering with the EJTAG operations.$ V$ {* g0 B |% y3 t, T3 L
/ U3 D) B. E/ [. J) B+ c *) /bypass - enables Unlock bypass command for some AMD/Spansion type# ?% f1 ?5 G# D& U4 V* W7 V4 N) W# `1 I
flashes, it also disables polling& g9 P6 D6 Q: J8 C5 ^6 s, {# K$ h
* l1 w a) Q! b" M8 a5 T) I. z, n
*) /initcpu allow load config code to initialize the CPU. This may help
! _+ U( x( n y9 ] BCM6358 prevent from some address non-accessible.8 D6 r4 w: ^) c. V
0 M V7 H6 P% w5 N- }2 K( G *) '-probeonly /window:xxxxxxxx /erasechip' allow choose a workable
& D0 U4 w$ j& U" S2 x& A sector address to erase whole chip. This may help on a bricked box" X- `. ?5 V0 a, w* c/ V
with bad CFE; }9 q6 \2 e- F% R- o3 W: E& V4 Z% z3 g
$ M1 {/ B7 d; v4 \" U
*) /forcealign - enable erase sectors if the operation window is not
3 |4 @' ~( ^+ |3 D$ D3 h- S aligned with sector boundary. It's risky! but can help erase some3 Z1 p: r0 G* g1 W4 k v# ?
box NVRAM area whose sector size is larger than NVRAM definition& g, A9 V4 X6 }3 F. t, p
8 u- d' ^* |+ r6 w) K *) /ejslow - limit parallel port clock out speed to 500KHz. This wish$ A7 n6 Z& z: ]/ Y( A3 z( ^
to increase LPT port compatibility for some high clock PC.( p2 B1 n& Y$ m5 \- r
For USB cable this switch can help hit higher clock
) K, e; b4 ?0 h
/ v' g* _; f1 a$ T *) /pause - pause while CPU being initialized.
6 ~5 C/ {) q& z1 A3 M help handle <CPU NOT enter Debug Mode> via shorting pin method
8 m( ?& |% E% @$ k t) X9 ?
8 J4 X5 K* w, a( n( f( [ ***************************************************************************
6 d7 ]. H- E; x- n5 ~, T0 U! z * Flashing the KERNEL or WHOLEFLASH will take a very long time using JTAG *$ t+ a1 h% n) n# [
* via this utility. You are better off flashing the CFE & NVRAM files *
% u% z6 A$ {7 i; ]9 R# E7 u j * & then using the normal TFTP method to flash the KERNEL via ethernet. *" I" H" g8 q3 x
***************************************************************************- W9 B7 y5 Y" f: G3 z7 N) u
' u% C* V V6 h1 h
0 a" l' p( C# C5 I( v: F* q% HC:\Documents and Settings\Administrator>brjtag.exe -probeonly
1 R6 ~% Z& S# W( A
4 K6 l" G/ Q3 Y4 Q' [# T; a ===============================================( V, ]! q; _0 [
Broadcom EJTAG Debrick Utility v2.0.5-hugebird1 X7 O/ v% a& u( x- u1 S
===============================================- j6 E' E7 Q: C6 k0 _+ Z s! p
b- k4 ~/ d0 R, o1 W3 r( `8 ]Probing bus ... Done2 e& i' W+ y B/ S3 r' ~6 @# v
, F* G2 Q# x5 `8 P. w: j# S. [Detected IR Length is 5
# O' X+ E- f, x* A8 S
( ?6 S# q; C6 E1 Q `1 |CPU Chip ID: 00010101001101010111000101111111 (1535717F)
6 h' ]5 t) M. {- X+ e+ `$ g CPU Manufature:Broadcom(17E)
2 {) ^% R8 P/ g! s6 E CPU Device ID :5357* f0 s9 k3 t9 W: M2 J& E$ S
CPU Revision :1
3 Z" U* x8 E3 X) \" N# K9 M" M, r. U/ c a
*** Detected a CPU but not in build-in list ***
- ?; j/ R) ]- d: O- Z+ _$ D8 P
; W; g0 S, b5 ?; y: {*** You can set /skipdetect let operate continue ***4 f& @: o1 \* [/ ?. I% J
( U" d b0 i. r8 C& z
' l6 X y2 g1 n, C. X7 G
4 P. g7 Y& g9 Z; _) pC:\Documents and Settings\Administrator>brjtag -erase:wholeflash
: m' e k# F3 ?1 ]7 }
3 w- R7 i, q0 n! h. N1 |4 b" i ===============================================9 O/ y1 D3 k& W1 ?* C+ E
Broadcom EJTAG Debrick Utility v2.0.5-hugebird
, g& X, v/ X# L6 W% q$ D' L ===============================================" q. N" o( l% l: M
$ q3 x0 S1 \. d! T6 T1 B
Probing bus ... Done g6 m0 S$ T* I- G6 g1 j
( j9 X/ t$ g9 ^% G4 EDetected IR Length is 5$ z, i. v/ X! k; x
( z( _) T, n/ |" k, C2 x* }; zCPU assumed running under LITTLE endian$ z: x! P) e- v% U. s
' `5 F0 G- q1 I# t: w* q: q8 l% TCPU Chip ID: 00010000000010001100000101111111 (1008C17F). m5 D/ B" ^( p$ k- ?/ _ Y
*** Found a Broadcom manufactured HND Mips 74K(008C) REV 01 CPU ***2 q& s% i+ E) r; I( q% M8 i0 q) K
0 w* b! S2 R l* _% G1 c1 {/ \ - EJTAG IMPCODE ....... : 01100000010000010100000000000000 (60414000)
: O+ G( r: A0 x5 F6 }3 }4 g* c1 L7 L0 [ - EJTAG Version ....... : 3.1
! J* E$ ?) t1 r" c5 j9 q/ s - EJTAG DMA Support ... : No6 t. L) ~- m2 Z9 B
- EJTAG Implementation flags: R4k ASID_8 MIPS16 NoDMA MIPS32
( K0 H ]- W6 u" x# w0 H$ Z$ R3 n1 v t8 F9 u6 s8 h. J
Issuing Processor / Peripheral Reset ... Done$ l4 P/ V$ a. X9 H- j
Enabling Memory Writes ... Skipped; m) F# q8 _* t+ N; Z* Z
Halting Processor ... <Processor Entered Debug Mode!> ... Done5 p2 k6 d: B6 n/ a9 w0 e5 r7 `
Clearing Watchdog ... Done7 w7 Q, N7 P# i. X; C
Loading CPU Configuration Code ... Skipped
) s0 P f" N0 p6 p+ [: j; W# C$ x# K4 M4 j6 U% V! o
Probing Flash at Address: 0x1FC00000 ...* ?# y3 S/ S1 S' N; }7 s* f% [
Detected pFlash Chip ID (VenID:DevID = 00FF : FFFF)2 U2 Z% x) E+ D
Detected sFlash Chip ID (VenID:DevID = 00C2 : 0017)
. M3 F9 G5 Q+ |5 V5 C*** Found a (16MB) ST SPI compatible Flash Chip from Macronix( R7 |* I" z1 ~5 Q* U, s
* C2 @% l* O# i7 ?, O6 Z( c - Flash Chip Window Start .... : 1C000000
& G0 k$ e) q% q& n+ x' V8 P - Flash Chip Window Length ... : 01000000
Z- N" r Z3 S: p; B ? - Selected Area Start ........ : 1C0000002 [6 S' [1 a1 D3 L
- Selected Area Length ....... : 01000000) Q, m4 N" R; a/ h; d% d
$ q/ h$ `' `- {4 t9 H/ b8 O. K9 r*** You Selected to Erase the WHOLEFLASH.BIN ***
$ t, v$ ]! [# O7 i9 c" S& g7 w' S2 _+ {9 k
=========================8 ^" ~3 n4 p* i1 [& C4 D1 e
Erasing Routine Started
6 a& S$ W5 x, L. X0 I( [=========================7 A; P) U7 C9 K. v; K
Total Blocks to Erase: 256
$ E) n1 y+ H7 ?) R/ @
3 F4 Q* ]; W$ {! q( Q1 d9 n. S$ XErasing block: 1 (addr = 1C000000)...Done
2 W! I: o/ E$ C5 d: PErasing block: 2 (addr = 1C010000)...' Z& u" Y \6 r0 F5 k. g
C:\Documents and Settings\Administrator> |
|
粤公网安备44152102000001号 
