|
|
高手们帮帮忙，谢谢！
- F8 t, Z% t' v: f) v我的是MX25L12845EM1 用2.05的brjtag识别为5357* W8 @: ], D' o4 v2 q
到Erasing block: 2 (addr = 1C010000)... 弹出内存不能为read（试了很多次都这样）
- J& ^+ B5 s; ]附上操作
" o( k5 e7 a1 d$ GMicrosoft Windows XP [版本 5.1.2600]5 [% P- C$ s: o! @, U
(C) 版权所有 1985-2001 Microsoft Corp.1 g0 z, E$ m+ Y* N6 D4 R
) P% V7 K/ S6 E8 y
C:\Documents and Settings\Administrator>cd d:\jtag
& ]; q% z# c+ | ^2 v, n& c' @; a. V$ W, y% q2 b+ r% d! m' o |
C:\Documents and Settings\Administrator>brjtag.exe* A" Z$ d6 ?& P. [4 w3 Y4 F9 B) P
5 G! O2 W4 m$ W& Z
===============================================: C, o" }% z6 S
Broadcom EJTAG Debrick Utility v2.0.5-hugebird
2 {& X2 H. P# o! n3 {6 Y3 A/ I ===============================================3 F8 C1 @2 d) G: D# n+ h
" w3 q2 Z& w9 f& F0 v9 \' E
ABOUT: This program reads/writes flash memory on the Broadcom MIPS(LE)
' R/ R3 a5 i# m7 I Chip and compatible routers via EJTAG using either DMA Access7 h1 \7 l/ A8 r6 o
routines or PrAcc routines (slower/more compatible). Processor chips
1 ?4 S2 I, J B @ supported in this version include the following chips:
7 x/ L0 |: v* U$ Z' Y/ M3 f) ^2 n
Supported Chips
. {/ B& A* f; {3 T ---------------) n0 s& T2 F$ S7 V- b" R- z5 {
Broadcom BCM4702
* d h% |7 W% i Broadcom BCM4704( J" U0 a; l+ ^/ {, x$ l
Broadcom BCM47126 q v5 ?, h$ b2 S; E+ O6 c
Broadcom BCM4716
! x3 e7 S, |1 d0 N Broadcom BCM4705|4785
- Z4 R- }5 g8 f; |% c; r Broadcom BCM5350; `# I- j# r% |) W2 S& _
Broadcom BCM5352
; x/ _* W$ g- w4 r' U- S9 E Broadcom BCM5354
; V" h# R, {! [! H% @ Broadcom BCM5356
! Y4 L! i2 `: I( E6 f Broadcom BCM5365
5 y8 n8 Q* c y6 |1 ` Broadcom HND Mips 74K(008C); b+ U; A% a) f
Broadcom BCM63456 e. C; ]! ~- P* v9 ]: ~+ s5 A) |
Broadcom BCM6338
, a+ |/ A5 n0 m Broadcom BCM63480 o0 ?3 R8 i) Z( a u4 K, ]# K/ b
Broadcom BCM6358
9 X: q& }5 i( |9 q% P# O* n Broadcom BCM63683 \; u) o5 E3 v* H1 [
Broadcom BCM6816
7 |( v5 U/ Z1 e& {8 y$ H5 `: G Broadcom BCM7401
6 K3 e! {. S1 j9 r. ?- x4 D5 r* S m PMC-Serria BRECIS MSP2007-CA-A1
0 v2 Q1 w8 X1 E0 B0 ^1 m% S& m9 e) ?" ] TI TNETD7300GDU(AR7WRD)
% c1 q1 {4 ]! |" O ?! E r1 g TI TNETV1060GDW
1 |; n* j" ]9 W* K0 }4 w+ P- z: {
' s7 T+ f# n' s6 C0 [' H# { Supported Cable Types/ O o4 d0 r9 I4 f
---------------
# V0 C) n6 B& e. F/ g" R7 W ID Cable Name
3 t! c7 `' B9 \) C 0 Parallel port type(DLC5/WIGGLER)% [( T x# t7 Q& V" _
1 FT2232C/D based USB cable(OpenMoko,JTAGkey,OpenJTAG)( f! w& n1 b0 M3 d* K
2 SEGGAR J-Link EMU(v5.0 or later)
1 {. w7 v6 K# J6 C; {; T4 l& W 3 HID-BRJTAG v1.xx(USBASP M8)
' A( t5 |; q; e3 o% P* W; J 4 HID-BRJTAG v2.xx(STM32F10x/SAM7S); L) ]% q7 |6 C: c+ x
) i5 @) W9 s# l3 p6 D; |& R( N1 F# d0 n9 Q
USAGE: Brjtag /showflashlist- k+ S1 w- v. N3 }
USAGE: Brjtag [parameter] </noreset> </noemw> </nocwd> </nobreak></LE|BE>
2 {8 k( a, q8 f </notimestamp> </dma> </nodma> </noerase></initcpu>
5 J" ?- ], u, L( O5 G4 l </nompi> </ejslow></waitbrk></srst><wx8></resetcs>
% C; y2 c. e' f; M </bypass></forcealign></showppb></clearppb></erasechip>
0 L8 F7 k- e* w. w7 x </nocfi></forcenoflip></forceflip></spirevert>+ {8 {6 L+ k0 ?
<window:XXXXXXXX><start:XXXXXXXX> </length:XXXXXXXX>! W7 B0 O) n& n' v( O0 U
<port:XXX> </instrlen:XX> </fc:XX></skipdetect>
, B0 e& h( p0 E; {6 W; A: Z </wiggler></cable:X></io2></safemode> p0 e4 P# H3 d( K' }' H' G
</verbose></pause>
% ], @- b0 y/ z3 O5 m5 y/ H# L0 N W3 o7 a/ b6 x8 q; L
Required Parameter5 X/ ]& x8 Z6 u' ]
------------------
' I- z8 }0 c" l -backup:[cfe|tfe|cfe128|nvram|wholeflash|custom|kernel|bsp]9 Y( F. H4 U+ q8 W
-erase:[cfe|tfe|cfe128|nvram|wholeflash|custom|kernel|bsp]
8 ]$ C& g1 y' d; X( G. h2 l- I$ P -flash:[cfe|tfe|cfe128|nvram|wholeflash|custom|kernel|bsp]: h, l( m* C5 {, G2 j% a2 x
-probeonly
) `% C# i' h f: _% E1 n' `) A6 \$ j
) R4 L4 `& J. k" H# x; I7 w5 D Optional Switches
2 N3 U. H- O( n; @; w -----------------; z0 E( B6 D7 b
/noreset ........... prevent Issuing EJTAG CPU reset# Y8 J! l$ Z- Z; W
/noemw ............. prevent Enabling Memory Writes* s, Y6 \* [. V# E3 v
/nocwd ............. prevent Clearing CPU Watchdog Timer
+ o+ P! E: ~; ~. } /nobreak ........... prevent Issuing Debug Mode JTAGBRK
$ r* s- m" R' b( f- F5 A% @ /noerase ........... prevent Forced Erase before Flashing1 l* n' z+ x) a* @2 e
/notimestamp ....... prevent Timestamping of Backups" l! Z0 h7 W$ n5 {7 C- L
/dma ............... force use of DMA routines
9 e8 p8 s/ r2 H0 u /srst .............. force a TAP nSRST reset on starting# k W$ p/ l# L; P
/nodma ............. force use of PRACC routines (No DMA)0 K8 U- {& I. f7 S4 e( W
/ejslow............. with low speed ejtag access) ~. \' c* l( Q! Q' X
/waitbrk............ wait until CPU enter debug mode+ e5 o% ]8 y$ E3 g% P# m
/wx8 ............... with x8 mode program flash
3 M9 d, X1 V- I" {* ]/ a /resetcs ........... issue spi controller reset before any op. P h! I! C' R$ q, N
/spirev............. reverse data endian on flashing a spi chip
1 C5 o; \1 N% R+ Z& a8 k3 k /initcpu............ load CPU configuration code
) r9 m& t6 b( R$ {+ `7 ] /nompi.............. skip autodect flash base address with MPI Reg. ^% U7 I+ j5 w5 B
/LE ................ force operate as Little Endian chip) b0 Y- `( Z, k! x9 G" _
/BE ................ force operate as Big Endian chip
# G* m7 t& c6 b- Y e8 p3 T6 a /window:XXXXXXXX ... custom flash window base&probe address(in HEX)9 B! O; X& L2 b' {, D
/start:XXXXXXXX .... custom start location (in HEX)
# S; u9 k: D( X2 j) `/ z) o /length:XXXXXXXX ... custom length (in HEX)( F1 `0 l% t" W
/verbose............ scrolling display of data
0 Q3 q; H1 p. p1 e8 X /pause.............. pause while CPU is initialized
8 q& t9 T8 @* e! H2 e! q" s6 _ /skipdetect ........ skip auto detection of CPU Chip ID
& o/ s2 o& r8 h$ I- [ /instrlen:XX ....... set CPU instruction length manually
& \0 w2 Z1 j; W- t+ k7 x /wiggler ........... use wiggler cable# V7 ]+ m* b: l. S) R6 s
/nocfi ............. disable CFI query flash geometry. ^6 ]) u/ ~7 w
/forcenoflip ....... force not flipping CFI queried flash geometry' n r- N6 H8 F
/forceflip ......... force flipping CFI queried flash geometry; b: u7 T1 N0 _, V2 J- u
/bypass ............ unlock Spansion bypass mode & disable polling
0 g- L; ] W- Z8 |) O9 e /forcealign......... force erase address align with block boundary( V* i/ k# @& s0 `/ }: ]$ S
/erasechip.......... erase whole chip, only work with -probeonly @! a& n% o( i! R" i
/clearppb........... erase Spansion PPB,only work with -probeonly7 v8 P8 Y5 z* G$ m; [
/showppb ........... show flash sector protection status
% }* o( }4 _' Q; v only work with -probeonly2 X' Q. A" v, G1 w# N' `
/port:XXX........... customize parallel port(default XXX is 378)
8 ~0 a0 I8 J3 O& m6 ^ only work in Windows version1 E& k/ e, k) H
/io2 ............... use alternative Parallel port access method
* C0 e* E; r4 G$ }) o) }1 i& G2 h /cable:x ........... select cable type, x = cable type ID# V+ m7 v8 Z9 Q$ {, D/ ^9 E
/safemode .......... use parallel cable way operate USB, SLOW!* [2 d3 L' x7 I( [0 x+ G) s
/fc:XXX = Manual Flash Chip Selection,disable CFI and ID auto match6 N3 G2 W$ T4 k4 Z9 [- j
use 'brjtag /showflashlist' show build-in flash list
' o6 _; d, D3 k9 G
- q0 x6 X8 W; z9 c$ Y) D* {& M7 N1 q" h& C3 j0 X
@9 V! z. Q9 c2 H3 k4 t) {* L
NOTES: *) '-backup:', '-flash:' and '-erase:', the source filename must exist" z3 y9 X9 }! {0 N& T! R
as follows: CFE.BIN, NVRAM.BIN, KERNEL.BIN, WHOLEFLASH.BIN or# Z2 q$ q6 s# n# A
CUSTOM.BIN, BSP.BIN, TFE.BIN(64KB or 1x bottom Sector length CFE)
* ]3 Z$ Z, O& h& u8 z& i CFE128.BIN(128KB CFE)4 ~9 ?2 I; d6 F& B# W
) q; d% j- k K, g5 Z
*) Brjtag defualt with x16 mode handle Parallel Flash chip. /wx8 switch
) l' D" N& V0 X to x8 mode.
0 Z2 H+ F8 b" l( Y: f+ m/ W A/ r2 b( ?+ x
*) Brjtag uses CFI command set to automatically detect flash chip4 q$ f# z+ h, t8 l' j
parameters. If you have difficulty auto-detecting flash with CFI,
. Z; q; n# i3 i9 Z, k# ? '/nocfi' convert to original flash detection method. brjtag then use
7 a! U* @6 `( M6 {8 H* G3 G ~% S; S detected flash ID query parameters from build-in flash list.* F Q3 g3 M, S$ U' h4 w
particularly, you can use '/fc:XX' manually specify flash ID.! e. l4 x. g; c' D" b3 y" M% d
'brjtag /showflashlist' can print build-in flash list
, V# L8 J* f" M! F9 E5 [* u( q5 i
1 q$ k; T+ W) t) m( D *) '/forcenoflip' and '/forceflip' can help on some AMD type flash9 [8 w) U: {4 }# X6 X0 w
detecting sector structure correctly if CFI uses.) U0 o% s, U: q. U: T" V9 {4 }1 w8 T
'brjtag -probeonly /verbose' debug flash detection
8 {1 j8 L. M; c$ @6 K1 `4 w. u& Q+ @, ?! p" T
*) If you have difficulty with the older bcm47xx chips or when no CFE
% w/ U$ R: `* ]3 \: \ is currently active/operational you may want to try both the
; \8 {% w0 s6 @4 d1 h$ W /noreset and /nobreak command line options together. Some bcm47xx
( `. g5 }6 Z: V# h chips *may* always require both these options to function properly. b0 I% O9 `2 J# I/ |
. L. m t( T9 M* B2 \ *) When using this utility, usually it is best to type the command line8 q$ S' z" @2 P7 L; F5 P5 B0 c
out, then power up the router, about 0.5 second delay, hit <ENTER>8 d, J v! C! x2 q5 I3 l
quickly to avoid bad CFE code lead to <CPU NOT enter Debug mode>
2 Z4 g9 G1 i: t7 }5 U or the CPUs watchdog interfering with the EJTAG operations.
/ Y, A& l9 G3 i, r$ g( p
+ w1 `- {1 Z4 w7 \& n% x& q8 V; f *) /bypass - enables Unlock bypass command for some AMD/Spansion type9 D$ S+ Y$ `2 F- [% j$ A
flashes, it also disables polling
8 Y3 x" T" r' ]$ c% h
0 C% B0 i$ d; z% F3 _% t5 }: u *) /initcpu allow load config code to initialize the CPU. This may help0 I0 Z8 O( m: z( C/ W
BCM6358 prevent from some address non-accessible.
2 I% |/ a& j' M
' ~7 ?3 T. u Y4 z; H *) '-probeonly /window:xxxxxxxx /erasechip' allow choose a workable
5 v' e m8 L; U, \! E, c8 B$ a sector address to erase whole chip. This may help on a bricked box+ Z' L4 o2 {/ B
with bad CFE
R) Z, M! u- {# f
! ~6 }# Y) Y8 }: g: @ *) /forcealign - enable erase sectors if the operation window is not7 U8 n' h7 j ]9 K1 m& F/ X( b; p0 h$ v
aligned with sector boundary. It's risky! but can help erase some
& L) ~" h9 i: Z' t box NVRAM area whose sector size is larger than NVRAM definition
, E6 g8 w Q9 d1 r+ ? Q& A5 q2 q% r6 G" I) q3 D
*) /ejslow - limit parallel port clock out speed to 500KHz. This wish$ ~3 c, m# }2 P1 P' v. I; w1 O/ i
to increase LPT port compatibility for some high clock PC.
. f' p0 K- q. b4 M2 N For USB cable this switch can help hit higher clock* i# j3 X. s. f+ y' S1 h [- M6 o
$ @* K2 i2 s9 f) L1 Q \4 z *) /pause - pause while CPU being initialized.5 M( d8 u1 }3 ]: N
help handle <CPU NOT enter Debug Mode> via shorting pin method
1 h- T8 `7 J7 w4 e. Q% J4 [6 Z1 V; _! K
***************************************************************************
, S1 J" \. M) F: g2 V* Flashing the KERNEL or WHOLEFLASH will take a very long time using JTAG *
& s% u( i% e; G* N* k$ W) D* via this utility. You are better off flashing the CFE & NVRAM files *
( @9 e6 R3 G5 m9 ?* & then using the normal TFTP method to flash the KERNEL via ethernet. *
$ `, A: F# q6 @8 @3 u***************************************************************************
, e* e5 v. O! ?3 S& l( N/ U, b Q2 {- }- W2 n1 P: @( ?5 D
" g2 T/ S7 y: P6 Z2 S; \% D
C:\Documents and Settings\Administrator>brjtag.exe -probeonly) B* G. C% j$ A
9 K5 x1 o+ a. T5 W* y( q) q ===============================================
' f1 {8 k5 f) h6 [: j6 S Broadcom EJTAG Debrick Utility v2.0.5-hugebird
: P* q* k# A+ b H% p& E1 k ===============================================; d: u( H: T% V F
% {3 k# ^- l2 q- s& h: SProbing bus ... Done
. C1 J y3 n8 H' `! @3 E
/ O2 P# n) [. }: X* ~) R4 g& [) Z# BDetected IR Length is 5
" t7 N% i- K& j1 e! ~" Y$ x! I: _0 s, |) r1 V, S
CPU Chip ID: 00010101001101010111000101111111 (1535717F)
. j* d' \; G4 \) h3 n+ D. Q CPU Manufature:Broadcom(17E)7 _) s% P! x% w! I' \
CPU Device ID :5357
6 e2 T. w% L$ ?+ A1 g. Y1 S" ^% I3 Q% k CPU Revision :1% L/ T4 f4 M) W* I7 n( y
; P5 n7 X& Y) ?6 l9 d7 Q* X# e% n
*** Detected a CPU but not in build-in list ***& q. ]2 R# x6 `
5 u/ m) g4 Y; d% b& g' _7 e/ ~; |*** You can set /skipdetect let operate continue ***
6 A- R, b% ` w/ p+ T! |' X) G+ T5 D+ j0 h4 H1 j. Q
u* q( r1 Y+ s
8 I5 q' o2 P* tC:\Documents and Settings\Administrator>brjtag -erase:wholeflash3 f" P/ l/ S! |+ q% @# D
: v: t" N' Z7 W6 h+ {, }
===============================================
( H' _, V4 a. B& _1 K( U" s Broadcom EJTAG Debrick Utility v2.0.5-hugebird
% \5 [3 Y- `0 @# [ ===============================================6 P/ I* a6 G" u! w% L8 E
+ n+ Q# J2 o: _/ SProbing bus ... Done; n+ Y# r. w" t) r# Z, }
0 D' m1 X' _% y) ?
Detected IR Length is 5
& o2 h) Z7 j: Y/ J4 e3 q
# }1 x) [3 G3 jCPU assumed running under LITTLE endian( `) Z! B D- s+ U& s" ?5 p$ S
; G! W: L+ K) v0 Z) B. j
CPU Chip ID: 00010000000010001100000101111111 (1008C17F)
/ M: B9 T+ O2 N* V& ]*** Found a Broadcom manufactured HND Mips 74K(008C) REV 01 CPU ***' Z8 G. w( x6 R, _5 j
6 F7 h% b( W ~) C
- EJTAG IMPCODE ....... : 01100000010000010100000000000000 (60414000): v) O% u* G2 h; P
- EJTAG Version ....... : 3.12 B# J5 p6 G4 x4 {
- EJTAG DMA Support ... : No8 |) f* \6 n! M$ _
- EJTAG Implementation flags: R4k ASID_8 MIPS16 NoDMA MIPS328 F: N; n, h9 G2 m% Y
1 ^6 |2 i. u7 h% x2 ~0 y- a
Issuing Processor / Peripheral Reset ... Done
9 S7 L0 W% \' E' _Enabling Memory Writes ... Skipped1 u }& m' M7 x3 m: e2 k
Halting Processor ... <Processor Entered Debug Mode!> ... Done
) G4 @1 Z$ b6 u( E# m& A3 h. X, NClearing Watchdog ... Done! W& N* h O2 y% ?, Z$ K: k& N5 D
Loading CPU Configuration Code ... Skipped
1 i9 D4 L& [( M) F) V" a. F7 { G5 X$ @: {
Probing Flash at Address: 0x1FC00000 ...
5 C& w/ s& J5 } r: M0 C" L7 ]Detected pFlash Chip ID (VenID:DevID = 00FF : FFFF)
+ N; d" J7 X3 f/ V1 c$ NDetected sFlash Chip ID (VenID:DevID = 00C2 : 0017)+ K2 X$ C H+ z! @- b
*** Found a (16MB) ST SPI compatible Flash Chip from Macronix
* s' l2 F% E0 O& T+ V
9 D4 P4 n/ A7 G, q; \ - Flash Chip Window Start .... : 1C000000
% J: R. {; T6 y* M [2 I - Flash Chip Window Length ... : 01000000& C. C- u r! C% E* h
- Selected Area Start ........ : 1C000000
# I* x1 O4 t$ f- o - Selected Area Length ....... : 01000000
2 z: i- U7 g! H9 R/ F% s8 `& M* l; p# M$ s* p8 m
*** You Selected to Erase the WHOLEFLASH.BIN ***
3 l( Q: {5 x$ J
7 F4 g( B! U9 [6 q b=========================2 H. m& N% M/ t
Erasing Routine Started
; B/ m$ {% `, S5 O% K=========================
* v$ {2 l6 ~* m# x" e4 HTotal Blocks to Erase: 256/ o0 \/ o) H. v& {, D4 i3 A
2 `8 N0 R X3 |Erasing block: 1 (addr = 1C000000)...Done! s; H: k) C( c5 S3 u' w
Erasing block: 2 (addr = 1C010000)...
3 C6 a0 G I! |/ {& J( a2 sC:\Documents and Settings\Administrator>" z6 s3 w# U* I: k/ F% `+ k# S+ c u
7 Z, o& `- U% W: x2 P% O
|
|
粤公网安备44152102000001号 
发表于 2013-4-6 22:45:19