|
|
高手们帮帮忙，谢谢！
7 p. L( j3 e2 K; _我的是MX25L12845EM1 用2.05的brjtag识别为5357# L- V. O7 ^: [- }; n4 c+ S
到Erasing block: 2 (addr = 1C010000)... 弹出内存不能为read（试了很多次都这样）
# I, C; V/ g1 J9 ] e附上操作# S- N- h0 ]) \. I
Microsoft Windows XP [版本 5.1.2600]# B$ b# f! V0 B. o$ K: ~1 u
(C) 版权所有 1985-2001 Microsoft Corp.
4 ^. @2 q; V$ a
& _ m. ~9 ]8 Z- t+ HC:\Documents and Settings\Administrator>cd d:\jtag: Q( b4 D- v8 X. L( K
$ e* y& v4 q9 h' M2 |- vC:\Documents and Settings\Administrator>brjtag.exe
3 u T/ ~. i8 y/ [
- o# W$ E6 ^: |( T- x) z$ ?3 g( T ===============================================+ N6 O3 |/ C# G5 S7 y. X$ L+ e
Broadcom EJTAG Debrick Utility v2.0.5-hugebird5 ?6 p: L J" F) l! ~$ o4 A
===============================================
1 z) u' x; L0 w: [7 E7 F* `. Q2 `. q
ABOUT: This program reads/writes flash memory on the Broadcom MIPS(LE)
5 X# C/ n2 ]) q i2 o Chip and compatible routers via EJTAG using either DMA Access
& f& [- s6 g5 a routines or PrAcc routines (slower/more compatible). Processor chips3 {+ x8 Y: } ]! N+ w$ C
supported in this version include the following chips:8 `) _1 r: y2 E7 ~+ q. k
, n* \% [% H$ |5 y3 }. E* [/ u( m Supported Chips
- f8 W1 z9 s* U {: v ---------------
) W* T, d7 O! u' y; [9 k4 C# G# D. N Broadcom BCM4702
3 U0 D4 k0 c! G! k Broadcom BCM4704
4 ^6 }$ O' [- s; \& W) { Broadcom BCM4712/ ~9 Y4 _; |/ v }* [
Broadcom BCM4716# |, M8 N9 b q5 k$ q
Broadcom BCM4705|4785: j8 J2 F& P$ a6 l' D& h* D
Broadcom BCM5350 s# R+ G) Q% m6 |9 }
Broadcom BCM5352
3 L9 x+ x; n; z Broadcom BCM5354: K9 Y2 Y# `6 o* A! z; Q+ \
Broadcom BCM5356
1 D( e" ]) o) m8 f; u7 z7 m Broadcom BCM53657 ~$ K% ^9 a, g$ i9 t( h
Broadcom HND Mips 74K(008C)" L/ `( b3 u( H+ s% A0 {
Broadcom BCM6345
+ k; h; M4 u! l0 ~1 p Broadcom BCM6338
) ^" f/ F( x0 v5 d1 C Broadcom BCM63485 x, ~. {7 U' \; ^
Broadcom BCM6358
$ Q7 X6 K) F/ ?" |; U t* m; S Broadcom BCM6368
$ A1 `8 X6 B6 S& p: m3 @ Broadcom BCM6816, d1 y# |+ X6 H$ N0 `6 E
Broadcom BCM7401
& P: J- }: d( y6 ] PMC-Serria BRECIS MSP2007-CA-A1% J0 @6 m9 ?/ \+ F
TI TNETD7300GDU(AR7WRD)3 H% m7 L* D) m* R) y( p" I9 N5 J# d
TI TNETV1060GDW7 i' f9 M2 i4 y) Y& d5 K
+ O/ }% d6 b, o# v5 A& T
Supported Cable Types" x% p% x* x7 _) ]' z
---------------1 T4 b6 m, V5 `) D: b
ID Cable Name! R( C6 Q+ r* X) k: R4 c
0 Parallel port type(DLC5/WIGGLER)( D0 k6 _) L- M* z
1 FT2232C/D based USB cable(OpenMoko,JTAGkey,OpenJTAG)
* r$ _: f" K! x2 b- c& _ 2 SEGGAR J-Link EMU(v5.0 or later)9 C5 Y- Q- @! l0 }4 ]$ ~
3 HID-BRJTAG v1.xx(USBASP M8)* Y/ ]8 q# r! ?! k' |( G% x
4 HID-BRJTAG v2.xx(STM32F10x/SAM7S)& s; E6 Q9 N, ?) Z/ z2 g7 W, l
7 p- Q# [5 Y" K9 ~6 N9 n6 l$ I" k- c0 {2 L& _/ v
USAGE: Brjtag /showflashlist
, {0 B7 d( l+ v, m6 e! J( VUSAGE: Brjtag [parameter] </noreset> </noemw> </nocwd> </nobreak></LE|BE>+ J7 P8 y- \+ T, E
</notimestamp> </dma> </nodma> </noerase></initcpu>
O& Y; G% p M0 G6 B) Q* R </nompi> </ejslow></waitbrk></srst><wx8></resetcs>
* Z& F" R1 R C8 b </bypass></forcealign></showppb></clearppb></erasechip>
* E/ s3 G! g" x$ p* k: b8 Z </nocfi></forcenoflip></forceflip></spirevert>5 k6 e4 n! e+ {+ L- t
<window:XXXXXXXX><start:XXXXXXXX> </length:XXXXXXXX>
! |" G( |* N# T# [: j* W <port:XXX> </instrlen:XX> </fc:XX></skipdetect>
5 X* t1 \5 T* A$ i5 w; e: d, {$ w </wiggler></cable:X></io2></safemode>: Z) `' z# P8 c0 N r( s% O
</verbose></pause>
3 {3 X3 H9 \; `, W
' v; O+ H" a1 B Required Parameter
& c/ \) j! ? r; E ------------------. W; o4 s( N/ O: y! q
-backup:[cfe|tfe|cfe128|nvram|wholeflash|custom|kernel|bsp]
3 @: [) {0 @5 A; P6 H -erase:[cfe|tfe|cfe128|nvram|wholeflash|custom|kernel|bsp]
' I& m5 S* n4 p; A. f q6 q7 D -flash:[cfe|tfe|cfe128|nvram|wholeflash|custom|kernel|bsp]+ }0 M4 k7 h8 Z
-probeonly
! w) Z( @7 u0 y3 n W* `
( ]& M3 f- b& I$ b' k Optional Switches
. ~+ g' D. @! j- F8 a& Y' k! i8 R2 H -----------------( G- E$ Z ~. ~+ ]( J- I
/noreset ........... prevent Issuing EJTAG CPU reset9 z( y: J; G$ Z: Y6 A5 d9 k
/noemw ............. prevent Enabling Memory Writes
3 s( H5 m' U. B# {0 ] O$ r /nocwd ............. prevent Clearing CPU Watchdog Timer3 E8 b- c3 s& g& w3 i& T
/nobreak ........... prevent Issuing Debug Mode JTAGBRK
; m8 L1 G9 q: X1 l# W /noerase ........... prevent Forced Erase before Flashing9 [6 W1 A ^8 q
/notimestamp ....... prevent Timestamping of Backups0 x& S9 k$ w; T
/dma ............... force use of DMA routines
, `$ l# A0 ?5 `1 H /srst .............. force a TAP nSRST reset on starting
/ a% N- b: U( y) V5 H0 j; e# w0 j /nodma ............. force use of PRACC routines (No DMA): Y* \+ R8 H% I8 d
/ejslow............. with low speed ejtag access4 I) F* c" w/ x+ y; {3 t
/waitbrk............ wait until CPU enter debug mode
, s+ y* o1 F& D8 |0 R; \+ q /wx8 ............... with x8 mode program flash- o" k: o- F$ S2 G# K* E
/resetcs ........... issue spi controller reset before any op- Y* _- q. J9 n; p4 P! a
/spirev............. reverse data endian on flashing a spi chip: g) T- G1 M& \! A7 T I
/initcpu............ load CPU configuration code5 X& C, r: X9 }' S" T& g! }$ O
/nompi.............. skip autodect flash base address with MPI Reg! O; f# _# D4 j' c: T/ r$ X+ | v" D
/LE ................ force operate as Little Endian chip e1 X. c& \, p& s- K& \
/BE ................ force operate as Big Endian chip
# _, l* N+ j1 e: a5 m& L0 A /window:XXXXXXXX ... custom flash window base&probe address(in HEX)2 ~/ ]; ]8 K; x& c5 |# c' ?- t9 N
/start:XXXXXXXX .... custom start location (in HEX)% v, J6 Z4 G A, D) T/ R) Y# t# \
/length:XXXXXXXX ... custom length (in HEX)
( A& m4 U+ z- @) x$ n8 w& p /verbose............ scrolling display of data! k: ]8 w' `* G# Z' s' [) D
/pause.............. pause while CPU is initialized6 Y8 S4 ~: P- N5 V7 u6 N+ _
/skipdetect ........ skip auto detection of CPU Chip ID g8 `7 u8 g' j& e
/instrlen:XX ....... set CPU instruction length manually
8 {# c, [( Z) K; X* s4 U /wiggler ........... use wiggler cable- l0 j# K8 i2 z; h
/nocfi ............. disable CFI query flash geometry4 @7 G" P# g3 C4 m2 `% e
/forcenoflip ....... force not flipping CFI queried flash geometry
) h( O! D% K6 D/ T, k /forceflip ......... force flipping CFI queried flash geometry( l! Y8 ?( b& Z$ q c$ G% P3 p2 M
/bypass ............ unlock Spansion bypass mode & disable polling
4 F) ]% S& m5 \- ? /forcealign......... force erase address align with block boundary( `" i& ^4 v) s! |9 |9 D4 G# S
/erasechip.......... erase whole chip, only work with -probeonly! P; M1 q t* C" B6 B
/clearppb........... erase Spansion PPB,only work with -probeonly. U" o/ u2 x+ f; F$ s) @/ |0 I4 f
/showppb ........... show flash sector protection status* I# ]2 S: Y( J) j
only work with -probeonly$ j1 \ }$ w. Z
/port:XXX........... customize parallel port(default XXX is 378)
% R2 E" d- E" {( Y only work in Windows version& V+ u0 a* I1 O. x0 a4 k$ @
/io2 ............... use alternative Parallel port access method
! U7 j3 W* a! K3 A& }( ?* U1 u; C2 X /cable:x ........... select cable type, x = cable type ID
- [* f6 `0 H0 o. { /safemode .......... use parallel cable way operate USB, SLOW!2 y7 D0 X4 g7 m; v2 U! D
/fc:XXX = Manual Flash Chip Selection,disable CFI and ID auto match
4 _* h G7 z5 S) G9 ~3 @& n use 'brjtag /showflashlist' show build-in flash list
+ }" y( y+ q! [3 R7 o2 G5 F0 ]: n/ K% \- I
* p! R, o# F% k4 l! V* g1 e) M, \3 g# T" _) ?+ k; ^
NOTES: *) '-backup:', '-flash:' and '-erase:', the source filename must exist' ?: I+ N ?$ y8 U! @" U+ O
as follows: CFE.BIN, NVRAM.BIN, KERNEL.BIN, WHOLEFLASH.BIN or$ x- _( l# j- m: y+ ^: k- W7 V9 a
CUSTOM.BIN, BSP.BIN, TFE.BIN(64KB or 1x bottom Sector length CFE)# L7 a- v4 O! z( Z# R
CFE128.BIN(128KB CFE)
* n# ] H5 \+ y+ p: i9 Z% ?" C3 i9 o% }* C. D1 s3 y3 X* ^# L
*) Brjtag defualt with x16 mode handle Parallel Flash chip. /wx8 switch: i: L8 y2 L& e1 R
to x8 mode.
$ q1 L- q" h) [. O+ d1 w$ c' v% I5 v' P; e/ X: N: f' T, m
*) Brjtag uses CFI command set to automatically detect flash chip9 R, a) F# T: K. `8 b+ N4 j
parameters. If you have difficulty auto-detecting flash with CFI,
. T- B) ~1 F0 P9 y3 O. x3 D5 u% ~ '/nocfi' convert to original flash detection method. brjtag then use/ g$ t, L3 Q1 I. X
detected flash ID query parameters from build-in flash list. z- X0 z: S2 f# @
particularly, you can use '/fc:XX' manually specify flash ID.: s: E7 u, H4 i$ P6 Q( Z
'brjtag /showflashlist' can print build-in flash list3 h& y# F- T7 y) a% I
, a$ Z& h! W/ B5 H. B7 n4 u
*) '/forcenoflip' and '/forceflip' can help on some AMD type flash
2 A- `) ]6 B9 K( S l% D+ h detecting sector structure correctly if CFI uses., T! u; A6 R+ g
'brjtag -probeonly /verbose' debug flash detection
( H0 e3 j* w+ g) q7 P; k3 y: H% F/ E, m
*) If you have difficulty with the older bcm47xx chips or when no CFE
7 f7 J6 E( ~" l: O5 u is currently active/operational you may want to try both the! x% E& Z# @1 B! j+ P8 y0 i0 s
/noreset and /nobreak command line options together. Some bcm47xx7 b4 [4 R" H9 i+ R
chips *may* always require both these options to function properly.
( O( k. O# H% P+ [4 o ^
9 ~( F* @" M! P2 z" E( D *) When using this utility, usually it is best to type the command line
0 ^. Y2 G5 m" P8 c out, then power up the router, about 0.5 second delay, hit <ENTER>
6 }6 l0 I$ `( F/ o, l quickly to avoid bad CFE code lead to <CPU NOT enter Debug mode>
! H6 X" `1 Z2 s8 B or the CPUs watchdog interfering with the EJTAG operations.; Q* ]. | b# C' n
9 E+ p' M9 I4 ?/ I L6 G *) /bypass - enables Unlock bypass command for some AMD/Spansion type
D7 {2 T3 l8 g; `; m |! q* e flashes, it also disables polling
+ V5 H+ _# a5 r G# z' s3 P, _0 a6 m
*) /initcpu allow load config code to initialize the CPU. This may help y# ?1 I8 y- w# q
BCM6358 prevent from some address non-accessible.' ^5 {- T6 F @* T$ C
% l# Q$ _. a( y k
*) '-probeonly /window:xxxxxxxx /erasechip' allow choose a workable) j/ A0 e7 H" b) i2 N0 I$ w
sector address to erase whole chip. This may help on a bricked box
) w4 s- q/ {8 L& l: H! I+ j with bad CFE" I6 V4 i- c1 L l3 G( v
! |$ c3 w% _ P8 S *) /forcealign - enable erase sectors if the operation window is not
2 a8 P! B9 R0 d1 G4 [: n; }8 L2 O' k [ aligned with sector boundary. It's risky! but can help erase some$ V' O R5 P) O% v8 |
box NVRAM area whose sector size is larger than NVRAM definition! V2 n. H, S1 O$ a6 M( ]' ?
3 [& n q9 ^' G *) /ejslow - limit parallel port clock out speed to 500KHz. This wish
8 M5 m5 y6 m& |0 t/ B8 I to increase LPT port compatibility for some high clock PC.
7 x* D$ C" H3 M8 M* t For USB cable this switch can help hit higher clock
, J9 m# i2 O4 q: r3 Z9 C9 }. r# z% Y
*) /pause - pause while CPU being initialized.
Z: @# p& S5 P# H$ }' I% q help handle <CPU NOT enter Debug Mode> via shorting pin method, Q/ B1 U7 u$ F
0 I( ^- I- o- [1 E
***************************************************************************
8 R- z2 T: o* B, j1 z1 B* Flashing the KERNEL or WHOLEFLASH will take a very long time using JTAG *( [* C, r& \" o6 B
* via this utility. You are better off flashing the CFE & NVRAM files *8 b$ v5 Q# V+ a$ {! ?
* & then using the normal TFTP method to flash the KERNEL via ethernet. *5 ]5 ~ b/ n: J: S+ Q
***************************************************************************
* w' w0 z$ b+ j
* s( J# ]. T, I" i/ ~$ e9 T& Z
& q$ T- t0 q/ K- t- c! ?" |C:\Documents and Settings\Administrator>brjtag.exe -probeonly
! K0 v3 a9 Y& W: }+ [5 _
3 J0 `9 ^0 h3 o ===============================================# M6 L( c, A# b3 e
Broadcom EJTAG Debrick Utility v2.0.5-hugebird
' i& H& k8 a" n0 E: n7 T# ~2 U ===============================================# v' N. ~1 K3 h6 `
6 D2 K7 e4 |% O3 f. \
Probing bus ... Done0 f: i( @$ v: O+ \/ H) t
8 W- _- A! H7 y! p8 E: j! s7 A4 Y
Detected IR Length is 5
& d2 T y8 H& `5 s& I* o# v! [6 B+ Z1 f3 Z% W* @' r' m" L5 X
CPU Chip ID: 00010101001101010111000101111111 (1535717F)8 N7 I6 O: j6 W4 N
CPU Manufature:Broadcom(17E)( F' I# A, t( B" |$ f# D
CPU Device ID :5357; Z" ^1 Y0 E& q7 ~, j$ {4 Y
CPU Revision :1
@! z5 @, v+ ^5 j9 b# Z8 G0 p: x/ q9 u* i5 x. K1 L4 Y: s! }
*** Detected a CPU but not in build-in list ***" s9 R* M, l& w0 ]$ |5 A% v
) y& k( t8 k$ S5 v3 _5 `*** You can set /skipdetect let operate continue ***/ p1 d1 u7 I# v+ x: I, ?
, @" i; T) @6 ?6 h4 X& }
: ^ S3 s* X' l; i8 [/ p* p m8 l
- d0 `# m- i3 |C:\Documents and Settings\Administrator>brjtag -erase:wholeflash# Z: n1 d+ {7 s9 A6 y, A* v
' ?2 [/ H0 y9 v5 v ===============================================& l6 F9 w) F2 r% h5 q
Broadcom EJTAG Debrick Utility v2.0.5-hugebird" R$ J% ?+ L) h
===============================================
7 P1 o, K: x, e3 D" l! d! C: H0 Q0 b9 s
Probing bus ... Done9 p! u# u, w# s4 e, _
- k. O& g2 R( p% zDetected IR Length is 5. _/ ?- i" Y1 o
9 x0 m$ z8 u% i' k4 k& K4 w. YCPU assumed running under LITTLE endian5 O s, E5 N: D
& X% O% k- @, z6 _6 `2 v% r7 I
CPU Chip ID: 00010000000010001100000101111111 (1008C17F): p6 y0 v. {1 t$ M# E3 K
*** Found a Broadcom manufactured HND Mips 74K(008C) REV 01 CPU ***
+ Z& Q& j# H3 I- o3 R( O6 ^: @# t9 Q8 J
- EJTAG IMPCODE ....... : 01100000010000010100000000000000 (60414000)
7 [7 q9 S9 N% L - EJTAG Version ....... : 3.1
) B: g6 d( Z! o% C# I6 T( O3 p2 `& g$ H - EJTAG DMA Support ... : No# a8 G3 w' l% d0 C# ~; L/ [% r
- EJTAG Implementation flags: R4k ASID_8 MIPS16 NoDMA MIPS32
5 t7 N' k( _$ l* _; R) `0 D) H- {6 r% f8 G/ K
Issuing Processor / Peripheral Reset ... Done
- \0 y6 x" o/ t# }7 TEnabling Memory Writes ... Skipped2 Z; j: ~ }$ J3 T3 i* ?8 Q' h
Halting Processor ... <Processor Entered Debug Mode!> ... Done/ E) C9 D( ^: `) k
Clearing Watchdog ... Done
3 m- ~3 V" o/ q0 C# GLoading CPU Configuration Code ... Skipped+ i- H. g* W5 l2 n2 Y, o: z
. U( J" j. j4 j2 ?# C9 ]
Probing Flash at Address: 0x1FC00000 ...
8 m) p2 b9 L( W, Q( ?Detected pFlash Chip ID (VenID:DevID = 00FF : FFFF)
' r+ \; g9 P8 h4 n# }' ?9 nDetected sFlash Chip ID (VenID:DevID = 00C2 : 0017)7 G! v r7 y9 J4 n
*** Found a (16MB) ST SPI compatible Flash Chip from Macronix" ?" R7 T0 s4 s: r2 _, D
& ?" D1 V9 s2 j' A- \% k( g/ m - Flash Chip Window Start .... : 1C000000
8 F# V9 ^' y4 R6 s/ l. P - Flash Chip Window Length ... : 01000000/ I$ O& p8 k* |1 x( T* y% K
- Selected Area Start ........ : 1C000000
) }7 T$ F1 x- G+ M$ i6 | - Selected Area Length ....... : 01000000
6 y5 d# [, _" X5 o( h) O C$ F6 p) P8 v6 c. d, e: c# ^
*** You Selected to Erase the WHOLEFLASH.BIN ***
* `, ?* S1 x7 e; z' S+ u% u; g& B; U
=========================
6 m$ g: y) t R: e* c- N3 MErasing Routine Started% Z7 l5 l2 X* S! C& w
=========================" B+ }( J% [4 A, h7 E3 i% b
Total Blocks to Erase: 2561 U# x8 a; W1 ?2 |6 E9 f0 m
& @, l9 i S2 X0 NErasing block: 1 (addr = 1C000000)...Done! ~; ]6 O5 S8 g( T
Erasing block: 2 (addr = 1C010000)...* \, h( @$ b& S: m: ?/ r, p
C:\Documents and Settings\Administrator>
9 V) Q; D( ~' O2 F7 O- j5 q$ ~
1 Q5 ?! v" _) ~ Z |
|
粤公网安备44152102000001号 
发表于 2013-4-6 22:45:19