| |
 |
|
 |
| |
|
marekm
|
Joined: 22 Nov 2005
Posts: 18
|
|
|
 |
|
 |
| |
 Posted: Wed Dec 28, 2005 1:45 pm Post subject: JTAG for bricked boxes - please test |
 |
|
Hello,
I've just released a modified version of openwince-jtag, with a new "ejtag" bus driver added. I have used it to successfully detect and read flash on RTL8181, RTL8186, ADM5120 and AR2312 based devices. Flash writing has been tested only on RTL8181 so far, and now I'm asking for help here. If you have any ADM5120-based device with erased bootloader, see if you can repair it using this program. WARNING: it's still experimental, so better don't try it on good hardware just yet. Make a full backup of the flash first (see scripts/read-adm5120) just in case something goes wrong.
http://www.amelek.gda.pl/rtl8181/jtag/
Hope this helps,
Marek |
|
|
| Back to top |
|
|
 |
|
 |
|
|
|
| |
|
vlad
Site Admin
|
Joined: 07 Aug 2005
Posts: 856
|
|
|
|
|
|
| |
| Posted: Wed Dec 28, 2005 3:04 pm Post subject: |
|
|
Its really cool, 10 months ago we have bricked device, but change it by warranty
I think we can play with this tool.
Thanks! |
|
|
| Back to top |
|
|
|
|
|
|
|
|
| |
|
margro
|
Joined: 03 Jan 2006
Posts: 9
Location: The Netherlands |
|
|
|
|
|
| |
| Posted: Tue Jan 03, 2006 3:30 pm Post subject: |
|
|
Just tested on my ADM5120 with a WIGGLER JTAG cable.
Reading the entire flash is working, but writing not yet, see the result below.
| Code: | jtag> readmem 0x5fc00000 0x1000 test.bin
address: 0x5FC00000
length: 0x00001000
reading:
addr: 0x5FC01000
Done.
jtag> flashmem 0x5fc00000 test.bin
Chip: AMD Flash
Manufacturer: Macronix
Chip: MX29LV160B
Protected: 0000
program:
addr: 0x5FC00000
flash error
jtag> |
Is your RTL8181 also using the same flash chip or a different one?
Marcel |
|
|
| Back to top |
|
|
|
|
|
|
|
|
| |
|
margro
|
Joined: 03 Jan 2006
Posts: 9
Location: The Netherlands |
|
|
|
|
|
| |
| Posted: Tue Jan 03, 2006 8:20 pm Post subject: |
|
|
JTAG Flash writing is also working for the ADM5120 on my BR6104Kp!!! Thank you!
(only in 16-bit mode)
Working for me:
| Code: |
jtag> readmem 0x5fc00000 0x10000 bootloader-broken.bin
address: 0x5FC10000
length: 0x00002000
reading:
addr: 0x5FC12000
Done.
jtag> detectflash 0x3FC0000
|
(a renewed detectflash helped me to prevent "flash error" messages.
| Code: |
jtag> flashmem 0x3fc00000 bootloader-working.bin
Chip: AMD Flash
Manufacturer: Macronix
Chip: MX29LV160B
Protected: 0000
program:
flash_unlock_block 0x3FC00000 IGNORE
block 0 unlocked
flash_erase_block 0x3FC00000
flash_erase_block 0x3FC00000 DONE
erasing block 0: 0
flash_unlock_block 0x3FC04000 IGNORE
block 1 unlocked
flash_erase_block 0x3FC04000
flash_erase_block 0x3FC04000 DONE
erasing block 1: 0
flash_unlock_block 0x3FC06000 IGNORE
block 2 unlocked
flash_erase_block 0x3FC06000
flash_erase_block 0x3FC06000 DONE
erasing block 2: 0
flash_unlock_block 0x3FC08000 IGNORE
block 3 unlocked
flash_erase_block 0x3FC08000
flash_erase_block 0x3FC08000 DONE
erasing block 3: 0
addr: 0x3FC10000 (done)
verify:
addr: 0x3FC0FFFE
Done.
jtag> reset
jtag> quit
|
|
|
|
| Back to top |
|
|
|
|
|
|
|
|
| |
|
OlegI
|
Joined: 22 Jan 2006
Posts: 4
|
|
|
|
|
|
| |
| Posted: Sun Jan 22, 2006 1:42 pm Post subject: |
|
|
i have a router with processor Brecis (PMC-Sierra) MSP2006. I investigate this router.
Is it possible to use your program with it? Any help appreciated.
I have a Xilinx home made cable and get info:
jtag> detect
IR length: 5
Chain length: 1
Device Id: 00010000001000000010001011100001
Unknown manufacturer!
chain.c(110) Part 0 without active instruction
chain.c(133) Part 0 without active instruction
chain.c(110) Part 0 without active instruction
jtag> instruction length 5
jtag> register IMP 32
jtag> instruction IMPCODE 00011 IMP
jtag> instruction IMPCODE
jtag> shift ir
jtag> shift dr
jtag> dr
01000001000000000100000000000000
jtag> discovery
Detecting IR length ... 5
Detecting DR length for IR 11111 ... 1
Detecting DR length for IR 00000 ... 1
Detecting DR length for IR 00001 ... 32
Detecting DR length for IR 00010 ... 1
Detecting DR length for IR 00011 ... 32
Detecting DR length for IR 00100 ... 1
Detecting DR length for IR 00101 ... 1
Detecting DR length for IR 00110 ... 1
Detecting DR length for IR 00111 ... 1
Detecting DR length for IR 01000 ... 32
Detecting DR length for IR 01001 ... 32
Detecting DR length for IR 01010 ... 32
Detecting DR length for IR 01011 ... 96
Detecting DR length for IR 01100 ... 1
Detecting DR length for IR 01101 ... 1
Detecting DR length for IR 01110 ... 33
Detecting DR length for IR 01111 ... 1
Detecting DR length for IR 10000 ... 1
Detecting DR length for IR 10001 ... 1
Detecting DR length for IR 10010 ... 1
Detecting DR length for IR 10011 ... 1
Detecting DR length for IR 10100 ... 1
Detecting DR length for IR 10101 ... 1
Detecting DR length for IR 10110 ... 1
Detecting DR length for IR 10111 ... 1
Detecting DR length for IR 11000 ... 1
Detecting DR length for IR 11001 ... 1
Detecting DR length for IR 11010 ... 1
Detecting DR length for IR 11011 ... 1
Detecting DR length for IR 11100 ... 1
Detecting DR length for IR 11101 ... 1
Detecting DR length for IR 11110 ... 1 |
|
|
| Back to top |
|
|
|
|
|
|
|
|
| |
|
OlegI
|
Joined: 22 Jan 2006
Posts: 4
|
|
|
|
|
|
| |
| Posted: Sun Jan 22, 2006 8:49 pm Post subject: |
|
|
i have successfully read a flash in my Brecis MSP2006 (i just copied data files supplied for realtek), but flashing gets error:
| Code: |
jtag> readmem 0x5fc09000 0x1000 9000.bin
address: 0x5FC09000
length: 0x00001000
reading:
addr: 0x5FC0A000
Done.
jtag> flashmem 0x5fc09000 9000.bin
Chip: AMD Flash
Manufacturer: Unknown manufacturer (ID 0x3c1a)
Chip: Unknown (ID 0xbfc0)
Protected: 005a
program:
addr: 0x5FC09000
flash error
|
Flash chip: AMD AM29LV160DB
How to combat this problem? |
|
|
| Back to top |
|
|
|
|
|
|
|
|
| |
|
margro
|
Joined: 03 Jan 2006
Posts: 9
Location: The Netherlands |
|
|
|
|
|
| |
| Posted: Mon Jan 23, 2006 2:42 pm Post subject: |
|
|
| OlegI wrote: | i have successfully read a flash in my Brecis MSP2006 (i just copied data files supplied for realtek), but flashing gets error:
| Code: |
jtag> readmem 0x5fc09000 0x1000 9000.bin
address: 0x5FC09000
length: 0x00001000
reading:
addr: 0x5FC0A000
Done.
jtag> flashmem 0x5fc09000 9000.bin
Chip: AMD Flash
Manufacturer: Unknown manufacturer (ID 0x3c1a)
Chip: Unknown (ID 0xbfc0)
Protected: 005a
program:
addr: 0x5FC09000
flash error
|
Flash chip: AMD AM29LV160DB
How to combat this problem? |
I'm not 100% sure, because I don't have a Brecis, but in my case (Sweex), I could read from the 0x5FC00000 address (32 bit), but writing did only work in 16-bit mode at 0x3FC00000.
You can check in your case if this is the 16 bit address bij reading from that address before trying to flash. |
|
|
| Back to top |
|
|
|
|
|
|
|
|
| |
|
OlegI
|
Joined: 22 Jan 2006
Posts: 4
|
|
|
|
|
|
| |
| Posted: Mon Jan 23, 2006 5:57 pm Post subject: |
|
|
You are right! Using 0x3FC00000 address more better. In my case there is one more error. Instead of reading Flash ID, command give first bytes from flash. It seems, something not initialized or i use inappropriate addtess.
| Code: |
jtag> flashmem 0x3fc09000 9000.bin
Chip: AMD Flash
Manufacturer: Unknown manufacturer (ID 0x3c1a)
Chip: Unknown (ID 0xbfc0)
Protected: 005a
program:
flash_unlock_block 0x3FC09000 IGNORE
block 3 unlocked
flash_erase_block 0x3FC09000
flash error
|
I have used program with Dlink DSL-500T (TI AR7) and received errors while reading flash. It seems, CPU too slow in some moments (30 times reading 64Kb) and some bytes reading incorrectly (about 70 bytes).
| Code: |
jtag> readmem 0x30000000 0x10000 adam.bin
address: 0x30000000
length: 0x00010000
reading:
ejtag.c(139) No processor access, ctrl=00000000000000000001000000001111
...
ejtag.c(139) No processor access, ctrl=00000000000000000001000000001111
|
|
|
|
| Back to top |
|
|
|
|
|
|
|
|
| |
|
fritz
|
Joined: 11 Mar 2006
Posts: 7
|
|
|
|
|
|
| |
| Posted: Tue Mar 14, 2006 8:22 am Post subject: |
|
|
Hi,
i had the same problem with the xilinx DLC5 on my br6104kp
| Quote: | | Code: | | ejtag.c(139) No processor access, ctrl=00000000000000000001000000001111 |
|
then, i tried a WIGGLER: i don't know why, but there are no errors anymore.
Fritz. |
|
|
| Back to top |
|
|
|
|
|
|
|
|
| |
|
fritz
|
Joined: 11 Mar 2006
Posts: 7
|
|
|
|
|
|
| |
| Posted: Tue Mar 14, 2006 9:20 pm Post subject: |
|
|
| Quote: | | then, i tried a WIGGLER: i don't know why, but there are no errors anymore. |
arghhhhh... this was YESTERDAY. Yesterday, things worked, and i switched off. today, i switched it on, and NOTHING works. Nothing was changed.
Have the same error as you with my br6104.
Don't know what to do.... has anybody an idea ? I checked the hardware x-times, it IS ok.
Could it be a strange Software-Problem ? Timing ?
Flash-detection give first bytes of flash (same as peek...) instead of mid and did.
Tested under cygwin and suse. |
|
|
| Back to top |
|
|
|
|
|
|
|
|
| |
|
Gwydion
|
Joined: 15 Mar 2006
Posts: 14
|
|
|
|
|
|
| |
| Posted: Wed Mar 15, 2006 6:33 pm Post subject: |
|
|
Hi,
I somehow bricked my box. Now I am trying to build the WIGGLER according to the scheme in te start post. I Have a few questions though:
- Is pc_vcc(pin9) connected to the VCC of the JTAG header(pin14)?
- What about the dotted line with a 1k resistor, is this 'optional'??
- Do I need to connect the grounds on the LPT port to the ground of the WIGGLER board?
- I see a capicator between VCC and ground, but I can't find what type of capicator I need to use
Maybe someone can help me with these 4 questions and bring my box to live again. Thanks in advance!
Gwydion
edit: added another question  |
|
|
| Back to top |
|
|
|
|
|
|
|
|
| |
|
margro
|
Joined: 03 Jan 2006
Posts: 9
Location: The Netherlands |
|
|
|
|
|
| |
| Posted: Wed Mar 15, 2006 8:48 pm Post subject: |
|
|
| Gwydion wrote: |
- Is pc_vcc(pin9) connected to the VCC of the JTAG header(pin14)?
- What about the dotted line with a 1k resistor, is this 'optional'??
- Do I need to connect the grounds on the LPT port to the ground of the WIGGLER board?
- I see a capicator between VCC and ground, but I can't find what type of capicator I need to use
|
- Don't connect pc_vcc to VCC_jtag (because the pc uses 5 volt and your JTAG only 3.3). Just skip pc_vcc
- The 1k resistor is optional, but in my case it was required for a proper disable/enable for the JTAG port.
- Yes, interconnect the grounds
- It is for decoupling/noise filtering. A common used value is 100 nf. |
|
|
| Back to top |
|
|
|
|
|
|
|
|
| |
|
Gwydion
|
Joined: 15 Mar 2006
Posts: 14
|
|
|
|
|
|
| |
| Posted: Thu Mar 16, 2006 12:01 am Post subject: |
|
|
| margro wrote: | | Gwydion wrote: |
- Is pc_vcc(pin9) connected to the VCC of the JTAG header(pin14)?
- What about the dotted line with a 1k resistor, is this 'optional'??
- Do I need to connect the grounds on the LPT port to the ground of the WIGGLER board?
- I see a capicator between VCC and ground, but I can't find what type of capicator I need to use
|
- Don't connect pc_vcc to VCC_jtag (because the pc uses 5 volt and your JTAG only 3.3). Just skip pc_vcc
- The 1k resistor is optional, but in my case it was required for a proper disable/enable for the JTAG port.
- Yes, interconnect the grounds
- It is for decoupling/noise filtering. A common used value is 100 nf. |
Hey thanks! I will try to finish the wiggler tomorrow and I will post the results here. |
|
|
| Back to top |
|
|
|
|
|
|
|
|
| |
|
Gwydion
|
Joined: 15 Mar 2006
Posts: 14
|
|
|
|
|
|
| |
| Posted: Mon Mar 20, 2006 7:48 am Post subject: |
|
|
I finally got the WIGGLER working! I tried to flash it with a default sweex binary, but that didn't work. Then I found a binary for the extended bootloader, but now I can't flash the board anymore.
Everytime when I type: detectflash 0x3fc00000 it says unknown flash.
and thus the flashmem command doesnt work. Any advice? |
|
|
| Back to top |
|
|
|
|
|
|
|
|
| |
|
Gwydion
|
Joined: 15 Mar 2006
Posts: 14
|
|
|
|
|
|
| |
| Posted: Mon Mar 20, 2006 5:50 pm Post subject: |
|
|
| Code: | jtag> detectflash 0x3fc00000
ImpCode=01000001010000000100000000000000
EJTAG version: 2.6
EJTAG Implementation flags: R4k DINTsup ASID_8 NoDMA MIPS32
jedec_detect: mid 4257, did 4b34
Flash not found!
|
This is what detectflash says, the other functions are working just fine. Atleast I get the same results as before this problem occured.
Maybe there is some way to completly reset the thing? |
|
|
| Back to top |
|
|
|
|
|
| Page 1 of 5 |
All times are GMT
Goto page 1, 2, 3, 4, 5 Next
|
|
|
|
| |
|
|
|
|
|
| |
|
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
|
|
|
|
|
|
|
|
Adv:
|
|
|
|
