Yes, timing does matter, from the zjtag options:
*) When using this utility, usually it is best to type the command line
out, then power up the router, about 0.5 second delay, hit <ENTER>
quickly to avoid bad CFE code lead to <CPU NOT enter Debug mode>
or the CPUs watchdog interfering with the EJTAG operations.
BTW, on the WRT54GS v.1, (S/N: CGN1....) Flash is detected as:
Matching Flash Chip (VenID:DevID = 0089 : 0017)
*** Found a Intel 28F640J3 4Mx16 (8MB) Flash Chip from Intel
which can be entered as a zjtag switch
/fc:063.
Here's a verbose probe for the WRT54GS v.1:
C:\DeBrick\zjtag>zjtag.exe -probeonly /verbose /L1:3
==============================================
TUMPA EJTAG Debrick Utility V0.2
==============================================
Set I/O speed to 7500 KHz
USB TAP device has been initialized. Please confirm VREF signal connected!
Press any key to continue... ONCE target board is powered on!
Probing bus ... Done
Detected IR Length is 8
CPU assumed running under LITTLE endian
CPU Chip ID: 00010100011100010010000101111111 (1471217F)
*** Found a Broadcom manufactured BCM4712 REV 01 CPU ***
- EJTAG IMPCODE ....... : 00000000100000000000100100000100 (00800904)
- EJTAG Version ....... : 1 or 2.0
- EJTAG DMA Support ... : Yes
- EJTAG Implementation flags: R4k MIPS32
Issuing Processor / Peripheral Reset ... Done
Enabling Memory Writes ... Done
Halting Processor ... <Processor Entered Debug Mode!> ... Done
Clearing Watchdog ... Done
Loading CPU Configuration Code ... Skipped
Probing Flash at Address: 0x1FC00000 ...
Read raw Chip ID (MfrID:DevID = 0089 : 0017)
Detected Chip ID (VenID:DevID = 0089 : 0017)
Read Array Starting from offset
Array = 0x0051
Array = 0x0052
Array = 0x0059
Read Array Starting from offset
Array = 0x0051
Array = 0x0052
Array = 0x0059
Array = 0x0001
Array = 0x0000
Array = 0x0031
Array = 0x0000
Array = 0x0000
Array = 0x0000
Array = 0x0000
Array = 0x0000
Array = 0x0027
Array = 0x0036
Array = 0x0000
Array = 0x0000
Array = 0x0008
Array = 0x0008
Array = 0x000B
Array = 0x0000
Array = 0x0002
Array = 0x0002
Array = 0x0003
Array = 0x0000
Array = 0x0017
Array = 0x0002
Array = 0x0000
Array = 0x0005
Array = 0x0000
Array = 0x0001
Array = 0x003F
Array = 0x0000
Array = 0x0000
Array = 0x0002
Array = 0x0050
Array = 0x0052
Array = 0x0049
Array = 0x0031
Array = 0x0031
Array = 0x00CE
Array = 0x0000
Array = 0x0000
Array = 0x0000
Array = 0x0001
Array = 0x0001
Array = 0x0000
Flash CommandSet = 0001
Read Array Starting from offset
Array = 0x0033
Array = 0x0052
Array = 0x0049
Array = 0x0031
Array = 0x0031
Array = 0x00CE
Matching Flash Chip (VenID:DevID = 0089 : 0017)
*** Found a Intel 28F640J3 4Mx16 (8MB) Flash Chip from Intel
*** REQUESTED OPERATION IS COMPLETE ***
