TJTAG - EJTAG De-Brick tool - IMPORTANT CHANGE:See 1st Post.

Post new topic   This topic is locked: you cannot edit posts or make replies.    DD-WRT Forum Index -> General Questions
Goto page Previous  1, 2, 3 ... , 82, 83, 84  Next
Author Message
LOM
DD-WRT Guru


Joined: 28 Dec 2008
Posts: 7647

PostPosted: Fri Sep 23, 2011 15:18    Post subject: Reply with quote
If tjtag had worked in 8-bit mode then you would have used backup:AR-RED where AR-RED is predefined to start at 0xA8000000 and the length is predefined to be 0x30000.

brjtag hasn't got any Atheros support, AR-RED is not defined so you have to do a backup:custom.bin and then supply the startaddress and length, ie /start:A8000000 /length:30000

tjtag has the AR-WHOLEFLASH definition and in brjtag you will again need to do a backup:custom.bin but with the parameters /start:A8000000 /length:100000

The /window switch is only for probing, erasing, and writing flash and is not needed for reading when you override the flash detection with /fc:003.

It is possible that you can read without the /Wx8 switch but you can definitely not successfully probe,erase, or write without it.

_________________
Kernel panic: Aiee, killing interrupt handler!
Sponsor
andreiursan
DD-WRT Novice


Joined: 26 Aug 2011
Posts: 29

PostPosted: Fri Sep 23, 2011 16:20    Post subject: Reply with quote
I have played and the only real result I get is with brjtag but it stops alone everytime at the same place.How I can fix this problem?
seraser
DD-WRT Novice


Joined: 12 Sep 2009
Posts: 11

PostPosted: Sat Oct 01, 2011 14:58    Post subject: Reply with quote
Hi.

I need some help, I try recover my livebox 2, with ikanos vx160 cpu and spansion flash.

livebox2 have a 2.6 mips pinout, TRST is up I think, because I measure 3v3 on this pin.

I need put one resistor on TDO to have contact to the cpu.

This is my result:

D:\tjtag3\Windows32>tjtag3 -probeonly

==============================================
EJTAG Debrick Utility v3.0 Tornado-MOD
==============================================

Probing bus ... Done

Instruction Length set to 5

CPU Chip ID: 00000010011111010011000111001011 (027D31CB)
*** Unknown or NO CPU Chip ID Detected ***

*** Possible Causes:
1) Device is not Connected.
2) Device is not Powered On.
3) Improper JTAG Cable.
4) Unrecognized CPU Chip ID.

Tjtag3 no have support to ikanos cpu, and I try this:

D:\tjtag3\Windows32>tjtag3 -probeonly /skipdetect

==============================================
EJTAG Debrick Utility v3.0 Tornado-MOD
==============================================

Probing bus ... Done

Instruction Length set to 0

CPU Chip ID: 00000000000000000000000000000000 (00000000)
*** CHIP DETECTION OVERRIDDEN ***

- EJTAG IMPCODE ....... : 00000000000000000000000000000000 (00000000)
- EJTAG Version ....... : 1 or 2.0
- EJTAG DMA Support ... : Yes
- EJTAG Implementation flags: R4k MIPS32

Issuing Processor / Peripheral Reset ... Done
Enabling Memory Writes ... Done
Halting Processor ... <Processor did NOT enter Debug Mode!> ... Done
Clearing Watchdog ... Done

Probing Flash at (Flash Window: 0x1fc00000) ...
Done

*** Unknown or NO Flash Chip Detected ***

*** REQUESTED OPERATION IS COMPLETE ***


Can not recognize the flash, but I put this parameter:

D:\tjtag3\Windows32>tjtag3 -probeonly /skipdetect /fc:91

==============================================
EJTAG Debrick Utility v3.0 Tornado-MOD
==============================================

Probing bus ... Done

Instruction Length set to 0

CPU Chip ID: 00000000000000000000000000000000 (00000000)
*** CHIP DETECTION OVERRIDDEN ***

- EJTAG IMPCODE ....... : 00000000000000000000000000000000 (00000000
- EJTAG Version ....... : 1 or 2.0
- EJTAG DMA Support ... : Yes
- EJTAG Implementation flags: R4k MIPS32

Issuing Processor / Peripheral Reset ... Done
Enabling Memory Writes ... Done
Halting Processor ... <Processor did NOT enter Debug Mode!> ... Done
Clearing Watchdog ... Done

Manual Flash Selection ... Done

Flash Vendor ID: 00000000000000000000000101111110 (0000017E)
Flash Device ID: 00000000000000000010001000000001 (00002201)
*** Manually Selected a Spansion S29GL256P U (32MB) Flash Chip ***

- Flash Chip Window Start .... : 1c000000
- Flash Chip Window Length ... : 02000000
- Selected Area Start ........ : 00000000
- Selected Area Length ....... : 00000000



*** REQUESTED OPERATION IS COMPLETE ***

Now recognize fine the flash.

And I try this:

D:\tjtag3\Windows32>tjtag3 -backup:custom /skipdetect /fc:91 /bypass /window:1c0
00000 /start:1c000000 /length:80000

==============================================
EJTAG Debrick Utility v3.0 Tornado-MOD
==============================================

Probing bus ... Done

Instruction Length set to 0

CPU Chip ID: 00000000000000000000000000000000 (00000000)
*** CHIP DETECTION OVERRIDDEN ***

- EJTAG IMPCODE ....... : 00000000000000000000000000000000 (00000000)
- EJTAG Version ....... : 1 or 2.0
- EJTAG DMA Support ... : Yes
- EJTAG Implementation flags: R4k MIPS32

Issuing Processor / Peripheral Reset ... Done
Enabling Memory Writes ... Done
Halting Processor ... <Processor did NOT enter Debug Mode!> ... Done
Clearing Watchdog ... Done

Manual Flash Selection ... Done

Flash Vendor ID: 00000000000000000000000101111110 (0000017E)
Flash Device ID: 00000000000000000010001000000001 (00002201)
*** Manually Selected a Spansion S29GL256P U (32MB) Flash Chip ***

- Flash Chip Window Start .... : 1c000000
- Flash Chip Window Length ... : 02000000
- Selected Area Start ........ : 1c000000
- Selected Area Length ....... : 00080000


*** You Selected to Backup the CUSTOM.BIN ***

=========================
Backup Routine Started
=========================

Saving CUSTOM.BIN.SAVED_20110925_123258 to Disk...
[ 0% Backed Up] 00000000: 00000000 00000000 00000000 00000000
[ 0% Backed Up] 00000010: 00000000 00000000 00000000 00000000
[ 0% Backed Up] 00000020: 00000000 00000000 00000000 00000000
[ 0% Backed Up] 00000030: 00000000 00000000 00000000 00000000
[ 0% Backed Up] 00000040: 00000000 00000000 00000000 00000000
[ 0% Backed Up] 00000050: 00000000 00000000 00000000 00000000
[ 0% Backed Up] 00000060: 00000000 00000000 00000000 00000000

I can flash and read the spansion flash, but with bad results, bad readings and writing all zero.

My interface is simply unbuffered.

I need some help.

Thanks.
RogFanther
DD-WRT User


Joined: 24 May 2008
Posts: 156

PostPosted: Sun Oct 02, 2011 23:47    Post subject: Reply with quote
what happened to it ?
Did you try http://www.andyp.uwclub.net/livebox_schematic.html

If tjtag doesn´t recognize the cpu, it will be hard to get something. You could try with other softwares or take a look in the livebox dedicated forums to see if they have developed some tool to access it.
mrc_torres
DD-WRT Novice


Joined: 24 Jan 2009
Posts: 40
Location: Sorocaba, Sao Paulo, Brazil

PostPosted: Mon Oct 03, 2011 2:24    Post subject: Reply with quote
I'm trying to debrick a Dir-300A1 via JTAG with a cable and TJTAG3 after an unsuccessful attempt to update the Redboot and the firmware (no ethernet, only power led is on) but is returning the following error message:

"Unknown or NO Flash Chip Detected"

The flash chip is a Promos Flash V54C3128164VBI7 (http://www.promos.com.tw/website/html/english/product/V54/V54C3128804VB%28Ind.%29.pdf).

Is there another option that is compatible with this flash chip or something that can be done?

Thank´s
seraser
DD-WRT Novice


Joined: 12 Sep 2009
Posts: 11

PostPosted: Mon Oct 03, 2011 20:25    Post subject: Reply with quote
RogFanther wrote:
what happened to it ?
Did you try http://www.andyp.uwclub.net/livebox_schematic.html

If tjtag doesn´t recognize the cpu, it will be hard to get something. You could try with other softwares or take a look in the livebox dedicated forums to see if they have developed some tool to access it.


Hi, thanks for the reply.

This link is valid to Livebox1 with Broadcom CPU, but Livebox2 have a Ikanos CPU.

With brjtag the output of readings is BAD SET ADDRESS.

On this board TDO is not conected to CPU, I put one 0 ohms resistor to have direct contact with the CPU.

I orderer tornado´s favourite jtag adaptor to test.



Greetings.
RogFanther
DD-WRT User


Joined: 24 May 2008
Posts: 156

PostPosted: Mon Oct 03, 2011 23:59    Post subject: Reply with quote
mrc_torres wrote:
I'm trying to debrick a Dir-300A1 via JTAG with a cable and TJTAG3 after an unsuccessful attempt to update the Redboot and the firmware (no ethernet, only power led is on) but is returning the following error message:

"Unknown or NO Flash Chip Detected"

The flash chip is a Promos Flash V54C3128164VBI7 (http://www.promos.com.tw/website/html/english/product/V54/V54C3128804VB%28Ind.%29.pdf).

Is there another option that is compatible with this flash chip or something that can be done?

Thank´s


That is not the flash, that chip is the RAM. The flash is the smaller chip, to the right of the frontal leds.
Do you have a serial console connected to it ? What does it show ?
RogFanther
DD-WRT User


Joined: 24 May 2008
Posts: 156

PostPosted: Tue Oct 04, 2011 0:00    Post subject: Reply with quote
seraser wrote:
RogFanther wrote:
what happened to it ?
Did you try http://www.andyp.uwclub.net/livebox_schematic.html

If tjtag doesn´t recognize the cpu, it will be hard to get something. You could try with other softwares or take a look in the livebox dedicated forums to see if they have developed some tool to access it.


Hi, thanks for the reply.

This link is valid to Livebox1 with Broadcom CPU, but Livebox2 have a Ikanos CPU.

With brjtag the output of readings is BAD SET ADDRESS.

On this board TDO is not conected to CPU, I put one 0 ohms resistor to have direct contact with the CPU.

I orderer tornado´s favourite jtag adaptor to test.

Greetings.


Ok, I did not pay much attention to that link. What I meant was if you had a serial console connected to it, and what was the output in it ?
mrc_torres
DD-WRT Novice


Joined: 24 Jan 2009
Posts: 40
Location: Sorocaba, Sao Paulo, Brazil

PostPosted: Tue Oct 04, 2011 1:42    Post subject: Reply with quote
RogFanther wrote:

That is not the flash, that chip is the RAM. The flash is the smaller chip, to the right of the frontal leds.
Do you have a serial console connected to it ? What does it show ?


Oh sorry. Is 25x32VF18.
Serial Console is dead too.
seraser
DD-WRT Novice


Joined: 12 Sep 2009
Posts: 11

PostPosted: Wed Oct 05, 2011 7:06    Post subject: Reply with quote
RogFanther wrote:
seraser wrote:
RogFanther wrote:
what happened to it ?
Did you try http://www.andyp.uwclub.net/livebox_schematic.html

If tjtag doesn´t recognize the cpu, it will be hard to get something. You could try with other softwares or take a look in the livebox dedicated forums to see if they have developed some tool to access it.


Hi, thanks for the reply.

This link is valid to Livebox1 with Broadcom CPU, but Livebox2 have a Ikanos CPU.

With brjtag the output of readings is BAD SET ADDRESS.

On this board TDO is not conected to CPU, I put one 0 ohms resistor to have direct contact with the CPU.

I orderer tornado´s favourite jtag adaptor to test.

Greetings.


Ok, I did not pay much attention to that link. What I meant was if you had a serial console connected to it, and what was the output in it ?


Hi rogFanther.

No response over serial console, Im waiting the tiao bufferef universal jtag.

Do you know if TDO need one 0 ohms resistos or 32 ohms over 2.6 mips specifications?
RogFanther
DD-WRT User


Joined: 24 May 2008
Posts: 156

PostPosted: Wed Oct 05, 2011 17:38    Post subject: Reply with quote
Don´t know if the resistance needs to be an exact value. In the few cases I had to bridge pads to make jtag work, I used 0 ohm resistores and all was fine.

But I don´t believe your problem to be in the jtag adapter. TJTAG recognizes and works with a defined set of processors. Your appliance seems to use another, unrecognized one, and thus the software will have problem controlling it and the flash.

What are the results if you run tjtag with the /flash_debug option ? ( consult the exact wording in the program help ) . ( also, without the /fc: parameter . We are interested in what tjtag is detecting as flash ) .

In your original post, I believe to see kind of a misunderstanding. When you use the /fc: parameter, the messages say that the user manually selected that flash type, it doesn´t mean that tjtag recognized the chip ( maybe you already know it, but as you wrote
"Now recognize fine the flash.", I found it good to remember ) .

Try to get the results for /flash_debug and post them here.
seraser
DD-WRT Novice


Joined: 12 Sep 2009
Posts: 11

PostPosted: Fri Oct 07, 2011 17:02    Post subject: Reply with quote
RogFanther wrote:
Don´t know if the resistance needs to be an exact value. In the few cases I had to bridge pads to make jtag work, I used 0 ohm resistores and all was fine.

But I don´t believe your problem to be in the jtag adapter. TJTAG recognizes and works with a defined set of processors. Your appliance seems to use another, unrecognized one, and thus the software will have problem controlling it and the flash.

What are the results if you run tjtag with the /flash_debug option ? ( consult the exact wording in the program help ) . ( also, without the /fc: parameter . We are interested in what tjtag is detecting as flash ) .

In your original post, I believe to see kind of a misunderstanding. When you use the /fc: parameter, the messages say that the user manually selected that flash type, it doesn´t mean that tjtag recognized the chip ( maybe you already know it, but as you wrote
"Now recognize fine the flash.", I found it good to remember ) .

Try to get the results for /flash_debug and post them here.


You are right, this soft not can recognize the flash.



Mensajes: 4034


Ver Perfil Email Mensaje Privado (Conectado)

xxx
« : Ayer a las 08:49:20 » Responder con cita Modificar mensaje Eliminar mensaje Dividir Tema
D:\tjtaglast\Windows32>tjtag3 -probeonly /skipdetect /nocwd /flash_debug

==============================================
EJTAG Debrick Utility v3.0.1 Tornado-MOD
==============================================

Probing bus ... Done

Instruction Length set to 0

CPU Chip ID: 11111111111111111111111111111111 (FFFFFFFF)
*** CHIP DETECTION OVERRIDDEN ***

- EJTAG IMPCODE ....... : 11111111111111111111111111111111 (FFFFFFFF)
- EJTAG Version ....... : Unknown (7 is a reserved value)
- EJTAG DMA Support ... : No
- EJTAG Implementation flags: R3k DINTsup ASID_8 ASID_6 MIPS16 NoDMA MIPS64

Issuing Processor / Peripheral Reset ... Done
Enabling Memory Writes ... Skipped
Halting Processor ... <Processor Entered Debug Mode!> ... Done
Clearing Watchdog ... Skipped
spi_flash_read 0x1fc00000
spi_flash_mmr 0x11300000
spi_flash_mmr_size 0x0000000c
spi_flash_ctl 0x00000000
spi_flash_opcode 0x00000004
spi_flash_data 0x00000008
spi_ctl_start 0x00000100
spi_ctl_busy 0x00010000

Probing Flash at (Flash Window: 0x1fc00000) ...
^C

Dificult solution I think...
LOM
DD-WRT Guru


Joined: 28 Dec 2008
Posts: 7647

PostPosted: Fri Oct 07, 2011 18:19    Post subject: Reply with quote
seraser wrote:


You are right, this soft not can recognize the flash.




Jtag is a cpu interface and all operations on the memory bus(es) is done with help of the cpu.

If your jtag software don't have support for the cpu, then you will never be able to read or write the flash.

_________________
Kernel panic: Aiee, killing interrupt handler!
seraser
DD-WRT Novice


Joined: 12 Sep 2009
Posts: 11

PostPosted: Sun Oct 09, 2011 21:00    Post subject: Reply with quote
LOM wrote:
seraser wrote:


You are right, this soft not can recognize the flash.




Jtag is a cpu interface and all operations on the memory bus(es) is done with help of the cpu.

If your jtag software don't have support for the cpu, then you will never be able to read or write the flash.


Ok, thank you for your reply.

Urjtag yes recognize ikanos cpu, but I have not a needed jtag interface for this software.

Can I build any jtag interface with urjtag support?
RogFanther
DD-WRT User


Joined: 24 May 2008
Posts: 156

PostPosted: Mon Oct 10, 2011 13:21    Post subject: Reply with quote
The normal interfaces, discussed here in the forums, that are supported by tjtag, are supported by urjtag. I used the same "arachno-cable" with tjtag in a thomsom router with tjtag, and in a G700AP, with urjtag.

Make a buffered one, to reduce interference/problems.
Goto page Previous  1, 2, 3 ... , 82, 83, 84  Next Display posts from previous:    Page 83 of 84
Post new topic   This topic is locked: you cannot edit posts or make replies.    DD-WRT Forum Index -> General Questions All times are GMT

Navigation

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You can attach files in this forum
You can download files in this forum