There is not a problem to flash bmc3349 with using zjtag and TUMPA.
Here is a example (I used to flash sb5101 with haxorware)
chipset defenition
Endian: BIG
IR Length: 5
CLK: 1Mhz
So you need only add follwing command to the zjtag:
/L1:29 /skipdetect /be /instrlen:5
Example
zjtag -flash:wholeflash /L1:29 /skipdetect /be /instrlen:5
==============================================
TUMPA EJTAG Debrick Utility V0.4
==============================================
Set I/O speed to 1000 KHz
USB TAP device has been initialized. Please confirm VREF signal connected!
Press any key to continue... ONCE target board is powered on!
Probing bus ... Done
Detected IR Length is 5
CPU assumed running under BIG endian
CPU Chip ID: 00000011001101001001000101111111 (0334917F)
*** CHIP DETECTION OVERRIDDEN ***
- EJTAG IMPCODE ....... : 00000000100000000000100100000100 (00800904)
- EJTAG Version ....... : 1 or 2.0
- EJTAG DMA Support ... : Yes
- EJTAG Implementation flags: R4k MIPS32
Issuing Processor / Peripheral Reset ... Done
Enabling Memory Writes ... Done
Halting Processor ... <Processor Entered Debug Mode!> ... Done
Clearing Watchdog ... Done
Loading CPU Configuration Code ... Skipped
Probing Flash at Address: 0x1FC00000 ...
Detected Chip ID (VenID:DevID = 0089 : 88C3)
*** Found a CFI Compatiable Flash Chip from Intel
- Flash Chip Window Start .... : 1FC00000
- Flash Chip Window Length ... : 00200000
- Selected Area Start ........ : 1FC00000
- Selected Area Length ....... : 00200000
*** You Selected to Flash the WHOLEFLASH.BIN ***
=========================
Flashing Routine Started
=========================
Total Blocks to Erase: 39
Erasing block: 1 (addr = 1FC00000)...Done
Erasing block: 2 (addr = 1FC02000)...Done
...
cut some details...
...
Erasing block: 38 (addr = 1FDE0000)...Done
Erasing block: 39 (addr = 1FDF0000)...Done
Loading WHOLEFLASH.BIN to Flash Memory...
Done (WHOLEFLASH.BIN loaded into Flash Memory OK)
=========================
Flashing Routine Complete
=========================
elapsed time: 714 seconds
*** REQUESTED OPERATION IS COMPLETE ***
after flash (rs232_ttl output):
BCM3349A0
100000010346890
MemSize: ......................... 8M
Flash detected @0xbe000000
Signature: a603
Broadcom BootLoader Version: 2.1.6d release Gnu
Build Date: May 10 2004
Build Time: 19:06:46
Image 1 Program Header:
Signature: 3349
Control: 0000
Major Rev: 0001
Minor Rev: 0001
Build Time: 2009/2/6 13:23:00 Z
File Length: 1182183 bytes
Load Address: 80500000
Filename: ecram_sto.bin
HCS: babb
CRC: 49829c3d
WARNING: Signatures do not match! Don't use this image!
HCS failed on Image 2 Program Header
Enter '1', '2', or 'p' within 2 seconds or take default...
. .
Performing CRC on Image 1...
Loading non-compressed image 1...
Target Address: 0x80500000
Length: 1182183
Executing Image 1...
Piggyback LZMA decompression 1.0.2
Detected LZMA compressed image... decompressing...
Target Address: 0x80010000
..................
Decompressed length: 4719141
eCos - hal_diag_init
Init device '/dev/ttydiag'
Init tty channel: 804573a0
Init device '/dev/tty0'
Init tty channel: 804573c0
Init device '/dev/haldiag'
HAL/diag SERIAL init
Init device '/dev/ser0'
BCM 33XX SERIAL init - dev: 0.2
Set output buffer - buf: 804961a8 len: 2048
Set input buffer - buf: 804969a8 len: 2048
BCM 33XX SERIAL config
Detected 8M of RAM
0x00000014 BcmBfcStdEmbeddedTarget::InitStorageDrivers: (BFC Target) Configuring/Loading Flash driver...
0x00000014 FlashDeviceDriver::FlashDriverInit: (Flash Driver C API) WARNING - Failed to detect flash device 0 using SPI!
0x0000001e BcmBfcStdEmbeddedTarget::InitStorageDrivers: (BFC Target) Loading ProgramStore driver...
0x0000001e BcmBfcStdEmbeddedTarget::InitStorageDrivers: (BFC Target) Loading BootloaderStore driver...
0x00000028 BcmBfcStdEmbeddedTarget::InitStorageDrivers: (BFC Target) Loading NonVol driver...
0x00000032 BcmBfcStdEmbeddedTarget::InitStorageDrivers: (BFC Target) Storage drivers initialized successfully.
0x00000032 BcmBfcStdEmbeddedTarget::InitDeviceAbstractions: (BFC Target) Creating singletons for ProgramStore/BootloaderStore/NonVol devices...
Detecting the next image number that we will store to by default...
0x3c Computing CRC32 over image2 to ensure that it is valid...
ProgramStoreDeviceDriver::ProgramStoreDriverIsHeaderValid: WARNING - ProgramStore header HCS check failed!
ProgramStoreDeviceDriver::ProgramStoreDriverIsImageValid: WARNING - Header isn't valid!
0x46 Done computing CRC32!
By default, we will dload to image number 2!
0x00000046 BcmBfcStdEmbeddedTarget::InitDeviceAbstractions: (BFC Target) Device abstraction singletons created successfully.
BcmCmVendorNonVolSettings::GetSingletonInstance: WARNING - the singleton instance is NULL, and someone is accessing it!
BcmCmVendorNonVolSettings::GetSingletonInstance: WARNING - the singleton instance is NULL, and someone is accessing it!
BcmCmVendorNonVolSettings::GetSingletonInstance: WARNING - the singleton instance is NULL, and someone is accessing it!
**** RESET DEFAULT. Unable to retrieve from DOCSIS Permanent NV, hardcode
Created CmVendorNonVolSettings object.
****** Reset Secure Factory MIB data to its default
Reading Permanent settings from non-vol...
Checksum for permanent settings: 0xe251bb9
0x0000006e BcmHalIfNonVolSettings::ReadFromImpl: (HalIf NonVol Settings) WARNING - Read older version of the settings (0.14); they have been upgraded to version 0.17, preserving original settings.
0x00000078 BcmCmDocsisNonVolSettings::ReadFromImpl: (CM DOCSIS NonVol Settings) WARNING - Read older version of the settings (0.3); they have been upgraded to version 0.4, preserving original settings.
*
*
* One or more of the settings groups was upgraded.
*
*
Settings were read and verified.
Reading Dynamic settings from non-vol...
NonVolDeviceDriver::ReadTrueSegmentSizeBytes: WARNING - Segment Size in segment control word not valid; returning 0!
NonVolDeviceDriver::NonVolDriverRead: ERROR - Failed to query the segment size (returned 0 bytes)! There is no valid data to read.
0x0000008c BcmNonVolDeviceDriverBridge::ReadImpl: (NonVol Device) ERROR - Failed to read the length from the settings data!
0x00000096 BcmNonVolDeviceDriverBridge::Read: (NonVol Device) ERROR - Failed to read the buffer from the device! Resetting the entire section to defaults.
0x00000096 CmSnmpNonVolSettings::ResetDefaults: (CM SNMP NonVol Settings) WARNING - Resetting Dynamic Settings!
**** RESET DEFAULT. Unable to retrieve from DOCSIS Permanent NV, hardcode
****** Reset Secure Factory MIB data to its default
0x000000a0 VendorSecureFactoryMibNonVolSettings::ResetDefaults: (VendorSecureFactoryMibNonVolSettings) WARNING - Vendor Non Vol settings are being reset to their default values!
*
*
* Failed to read non-vol settings from the device!
*
*
**** DYNAMIC NON VOL IS EMPTY OR CORRUPTED
Creating SNMP agent cablemodem agent
DON'T think we need to go here - so don't:::: init_mib !!!!
WARNING: netsnmp_brcm_create_tstring called with no address!
If you pressed the 's' key before this point, we will skip driver initialization...
Creating DOCSIS Control Thread...
@@@@@ In BcmCmDocsisCtlThread, fRemainingInitRngPowerSteps 17
******** Private Key Source is ENCRYPTED. (650 BytesUsed)
******* Source Key 0x0 0 84 b3 8b 7b bb b3 48 5f 83 bb 13 2e 6a 72
Private Key Source After DECRYPTION: outbutbufflength 648
Source Key 0xb1 24 bf 11 2 7a 30 82 2 76 2 1 0 30 d 6
CRC CHECK: 0xb1 0x24 0xbf 0x11
****** FACT MIB DISABLE ******, COPY PNV TO DNV
***** CALLED CloneValueFromPermToDynamic ****
Before Cloning, the dynamic & perm values are:
fCmDocsis20CapableDynamic 1, Perm 1
fCmFreqPlanTypeDynamic 0, Perm 1
fCmAnnexModeDynamic 0, Perm 3
fCmDhcpServerEnableDynamic 1, Perm 1
fCmCfgConcatEnabledDynamic 1, Perm 1
NonVolDeviceDriver::ReadTrueSegmentSizeBytes: WARNING - Segment Size in segment control word not valid; returning 0!
NonVolDeviceDriver::NonVolDriverWrite: WARNING - Current segment size < buffer size! Increasing the segment size!
Calling Vendor PreDriverInitialization...
PreDriverInitialization: Tuner 4 Amp 4
tunerInit()
*** Current USB Device ID is 0x5101, Default is 0x5101
vvv Interface creation and driver startup beginning vvv
-> Begin DOCSIS CM WAN interface
Creating HAL object for the DOCSIS CableModem interface
mot_scanList::Create European Plan!
mot_scanList::Create - plan=1, lim=0,863000000, cur=3263, max=3500
Favorite Channels
Freq = 0 Hz, US ID = 0, Power = 0.00 dBmV
Freq = 0 Hz, US ID = 0, Power = 0.00 dBmV
Freq = 0 Hz, US ID = 0, Power = 0.00 dBmV
Freq = 0 Hz, US ID = 0, Power = 0.00 dBmV
Freq = 0 Hz, US ID = 0, Power = 0.00 dBmV
Freq = 0 Hz, US ID = 0, Power = 0.00 dBmV
Freq = 0 Hz, US ID = 0, Power = 0.00 dBmV
Freq = 0 Hz, US ID = 0, Power = 0.00 dBmV
Freq = 0 Hz, US ID = 0, Power = 0.00 dBmV
Freq = 0 Hz, US ID = 0, Power = 0.00 dBmV
Freq = 0 Hz, US ID = 0, Power = 0.00 dBmV
Freq = 0 Hz, US ID = 0, Power = 0.00 dBmV
Freq = 0 Hz, US ID = 0, Power = 0.00 dBmV
Freq = 0 Hz, US ID = 0, Power = 0.00 dBmV
Freq = 0 Hz, US ID = 0, Power = 0.00 dBmV
Freq = 0 Hz, US ID = 0, Power = 0.00 dBmV
Freq = 0 Hz, US ID = 0, Power = 0.00 dBmV
Freq = 0 Hz, US ID = 0, Power = 0.00 dBmV
Freq = 0 Hz, US ID = 0, Power = 0.00 dBmV
Registering DOCSIS CableModem driver
BcmMacInit: advMapRunAheadTimeMin = 5120 (0x00001400) 10.24 MHz ticks, 500 usec
0x00000a96 BcmDocsisCmHalIf::Register: (DOCSIS CableModem HalIf) CM HAL reports h/w support for PHS, bitmask=0x3
0x00000aa0 BcmDocsisCmHalIf::Register: (DOCSIS CableModem HalIf) CM HAL reports h/w support for PHS, size=64 bytes.
-> End DOCSIS CM WAN interface
-> Begin Ethernet LAN interfaces
Creating HAL object for the Ethernet interface
Registering Ethernet driver
-> End Ethernet LAN interfaces
-> Begin USB LAN interface
Creating HAL object for the USB 1.1 interface
Registering USB driver
-> End USB LAN interface
-> Begin IP Stack interfaces
-> Starting V2 DHCP Client subsystem...
Creating HAL object for IP Stack1 (MAC Addr=00:13:71:d8:10:22)
DHCPc: Created default DHCP lease for IP Stack1
using client id htype=1, value=00:13:71:d8:10:22; auto-config enabled (IP, subnet, router).
Registering IP Stack1 driver
Tcpip NI: Init - RegisteredStackCount = 1
Creating HAL object for IP Stack2 (MAC Addr=00:13:71:d8:10:23)
DHCPc: Created default DHCP lease for IP Stack2
using client id htype=1, value=00:13:71:d8:10:23; auto-config enabled (IP, subnet, router).
Registering IP Stack2 driver
Tcpip NI: Init - RegisteredStackCount = 2
IP Stack3 not enabled or failed to create and start interface; no other stacks will be loaded.
-> End IP Stack interfaces
^^^ Interface creation and driver startup complete ^^^
Creating the DOCSIS Forwarder...
Adding DOCSIS CableModem HalIf as the default interface to the DOCSIS Forwarder
Adding Ethernet HalIf to the DOCSIS Forwarder
Adding USB HalIf to the DOCSIS Forwarder
Adding IP Stack1 HalIf to the DOCSIS Forwarder
Adding IP Stack2 HalIf to the DOCSIS Forwarder
Current IP address is default 0.0.0.0.
0x00000b54 BcmEcosIpHalIf::ConfigureLeaseImpl: (IP Stack2 HalIf)
Configuring IP stack 2:
IP Address = 192.168.100.1 (primary IP address)
Subnet Mask = 255.255.255.0
Router = 192.168.100.254
IsPrimaryInterface = 0
Creating Propane Control Thread...
Propane version: 2.0.1 (28 Oct 2002)
Instantiating CmSnmpAgent object.
Starting SNMP subsystem
Registering STP F
Starting Rajko HttpD on 192.168.100.1:80
Starting TelnetD on 192.168.100.1:23
ilter Snoop with all interfaces.
Registering DOCSIS MIB Filter Snoop with CPE and WAN interfaces.
**** Add Scalar for cmSunboxCapable
**** Add Scalar for cmSunboxCapable
*** cmPrivateFactoryGroup::Populate GetFmibUserLevel 1
0x00000e74 BcmDocsisCmHalIf::RegisterSnmpObjects: (DOCSIS CableModem HalIf) Interface 10 additional registration w/ SNMP agent OK.
WARNING: EventLog::LogEvent can't log events yet, not initialized. ID=-1994011568
CmSnmpAgent installing views...
SB5102 CM Agent w/ BRCM Factory Support setting V1/V2 view to unrestricted
SB5102 CM Agent w/ BRCM Factory Support IpStackEvent: Ip=0.0.0.0, Subnet=0.0.0.0, Gateway=0.0.0.0
Ip addr is the same, not rebinding.
SB5102 CM Agent w/ BRCM Factory Support installing engine ID...
SB5102 CM Agent w/ BRCM Factory Support installing context...
Creating SNMP agent CPE diag agent
CPE diag agent disabling management.
CPE diag agent defering traps.
SB5102 CM Event Log w/ BRCM Factory Support initializing with stored events.
Event log initialization complete.
SB5102 CPE Agent w/ BRCM Factory Support setting V1/V2 view to unrestricted
SB5102 CPE Agent w/ BRCM Factory Support IpStackEvent: Ip=192.168.100.1, Subnet=255.255.255.0, Gateway=192.168.100.254
SB5102 CPE Agent w/ BRCM Factory Support enabling management.
SB5102 CPE Agent w/ BRCM Factory Support sending deferred traps...
Done w/ deferred traps.
SNMP Agent Binding to 192.168.100.1:225
BcmSnmpThread starting thread operation.
SB5102 CPE Agent w/ BRCM Factory Support installing engine ID...
SB5102 CPE Agent w/ BRCM Factory Support installing context...
SB5102 CPE Agent w/ BRCM Factory Support setting V1/V2 view to docsisCpeView
SNMP startup complete.
0x000010cc BcmVendorCmApplication::CreateDhcpServer: (VendorExtension CmApp) Configuring the DHCP server with 50 leases from 192.168.100.11 -> 192.168.100.42; lease time is 20 seconds.
0x000010e0 BcmVendorCmApplication::StartDhcpServer: (VendorExtension CmApp) Starting DHCP Server!
StartUsb()...
Checking board manufacturing state...
Board appears to be manufactured OK.
* *
*** ***
*** ***
*** ***
***** *****
***** *****
***** *****
******* *******
******* *******
******* *******
********* *********
********* *********
**** *** *** ****
*** *** ***
*** * ***
** **
** **
** **
** **
* *
Motorola Corporation
...
and so on...