Can not flash a Linksys E4200 with TIAO USB JTAG & ZJTAG

This site is best viewed in a modern browser with JavaScript enabled.

Can not flash a Linksys E4200 with TIAO USB JTAG & ZJTAG

ps2gamer

Hi all,
I made some weeks ago tests with several firmware compatible router "Linksys E4200", and making with that of "Tomato USB", it has totally missed the flashing.
So I try to solve this problem by passing a "JTAG COM", and after use the flash of "CFE", it did even more damage, and since then the LED logo "CISCO" does flashes even more, and even ports "RJ45" more boots (He does not blink when the ignition of the router).
I must now try to re-flash the "CFE" I already get a file "bin" for the "CFE" on the forum of "dd-wrt", but the real problem now is that either "TIAO USB JTAG" or is "ZJTAG" does not do this type of router.
http://www.dd-wrt.com/phpBB2/viewtopic.php?p=622044#622044
In order, I'm connected like this :

Use a flex female to female to connect nTRST together (PIN 1 on Router to PIN 3 on TUMPA's 20 PIN JTAG Header
Use a flex female to female to connect TDI together (PIN 3 on Router to PIN 5 on TUMPA's 20 PIN JTAG Header
Use a flex female to female to connect TCK together (PIN 9 on Router to PIN 9 on TUMPA's 20 PIN JTAG Header
Use a flex female to female to connect TMS together (PIN 7 on Router to PIN 7 on TUMPA's 20 PIN JTAG Header
Use a flex female to female to connect TDO together (PIN 5 on Router to PIN 13 on TUMPA's 20 PIN JTAG Header
Use a flex female to female to connect GND together (PIN 4 on Router to PIN 4 on TUMPA's 20 PIN JTAG Header

I added this in zjtag.c (line 289) and then compile :

  { 0x4718,  C_BRCM, 8, __LE,     0,          0, 0,"BCM4718"       },

And after I test this view :

        ==============================================
               TUMPA EJTAG Debrick Utility V0.4
        ==============================================
 Set I/O speed to 30000 KHz
USB TAP device has been initialized. Please confirm VREF signal connected!
Press any key to continue... ONCE target board is powered on!
Probing bus ... Done
Detected IR Length is 1
CPU Chip ID: 11000111100001000111011111111111 (C78477FF)
    CPU Manufature:Unknow(7FE)
    CPU Device ID :7847
    CPU Revision  :12
*** Detected a CPU but not in build-in list ***
*** You can set /skipdetect let operate continue ***

And if I re-start it takes me out every time another value, I would think that randomly generates values, even with the version "0.4" original "ZJTAG".
Here is a link with all the information for this router :
http://infodepot.wikia.com/wiki/Linksys_E4200_v1.0#Specs
An idea of the problem ?
EDIT :
Apparently "ZJTAG" is not even compatible with the flash chip, and only "TJTAG" can do.
I hope I have not bought anything for your programmer "JTAG".
Thank you.

[deleted]

ps2gamer wrote: I added this in zjtag.c (line 289) and then compile :
  { 0x4718,  C_BRCM, 8, __LE,     0,          0, 0,"BCM4718"       },

You don't have to recompile zjtag for CPU support.
Just use it with following parameters if instruction length for BCM4718 is 8:

/skipdetect /instrlen:8 /LE

ps2gamer

Haaaaa there is better this time and remains fixed values !, But by no cons no backup of "cfe" :

zjtag.exe -erase:cfe /skipdetect /instrlen:8 /LE /verbose
        ==============================================
               TUMPA EJTAG Debrick Utility V0.4
        ==============================================
 Set I/O speed to 30000 KHz
USB TAP device has been initialized. Please confirm VREF signal connected!
Press any key to continue... ONCE target board is powered on!
Probing bus ... Done
Detected IR Length is 1
CPU assumed running under BIG endian
CPU Chip ID: 00000011101010000000010001010000 (03A80450)
*** CHIP DETECTION OVERRIDDEN ***
    - EJTAG IMPCODE ....... : 00000100110000000000001110101000 (04C003A8)
    - EJTAG Version ....... : 1 or 2.0
    - EJTAG DMA Support ... : Yes
    - EJTAG Implementation flags: R4k ASID_8 MIPS32
Issuing Processor / Peripheral Reset ... Done
Enabling Memory Writes ... Done
Halting Processor ... <Processor did NOT enter Debug Mode!> ... Done
Clearing Watchdog ... Done
Loading CPU Configuration Code ... Skipped
Probing Flash at Address: 0x1FC00000 ...
Read raw Chip ID (MfrID:DevID = 0000 : 0000)
Detected Chip ID (VenID:DevID = 0000 : 0000)
Read Array Starting from offset 
Array = 0x0000
Array = 0x0000
Array = 0x0080
Read Array Starting from offset 
Array = 0x0000
Array = 0x0000
Array = 0x0080
Read Array Starting from offset 
Array = 0x0000
Array = 0x0000
Array = 0x0000
Read Array Starting from offset 
Array = 0x00A8
Array = 0x00A8
Array = 0x0050
*** Unknown or NO Flash Chip Detected ***
 *** REQUESTED OPERATION IS COMPLETE ***

Again thank you !

TheOne

Does it work now?

ps2gamer

As you can see not even with -backup:CFE I did it generate any file.
One would think that now is the stage of flash chip that is the problem.

TheOne

have you tried the delay flag?

[deleted]

ps2gamer wrote: And if I re-start it takes me out every time another value, I would think that randomly generates values, even with the version "0.4" original "ZJTAG".

http://www.tiaowiki.com/w/Debrick_Wireless_Router_Using_TUMPA_and_zJTAG wrote:the most important flag is JTAG clock speed divider
/L1:<divider>
. TUMPA can clock TCK as high as 30Mhz, however most router's CPU cannot handle such high clock speed, thus you will have to slow down the clock to make it work.
This is the formula:
Speed in KHz = 30000 / (divider + 1)
For example, if you give the following option:
/L1:3
The TCK clock speed is 7500KHz or 7.5MHz (30000/(3+1)).

ps2gamer

If I add this option I found nothing, even with /L1:4, /L1:5...

zjtag.exe -erase:cfe /skipdetect /instrlen:8 /LE /verbose /L1:3
        ==============================================
               TUMPA EJTAG Debrick Utility V0.4
        ==============================================
 Set I/O speed to 7500 KHz
USB TAP device has been initialized. Please confirm VREF signal connected!
Press any key to continue... ONCE target board is powered on!
Probing bus ... Done
Detected IR Length is 0
CPU assumed running under LITTLE endian
CPU Chip ID: 00000000000000000000000000000000 (00000000)
*** CHIP DETECTION OVERRIDDEN ***
    - EJTAG IMPCODE ....... : 00000000000000000000000000000000 (00000000)
    - EJTAG Version ....... : 1 or 2.0
    - EJTAG DMA Support ... : Yes
    - EJTAG Implementation flags: R4k MIPS32
Issuing Processor / Peripheral Reset ... Done
Enabling Memory Writes ... Done
Halting Processor ... <Processor did NOT enter Debug Mode!> ... Done
Clearing Watchdog ... Done
Loading CPU Configuration Code ... Skipped
Probing Flash at Address: 0x1FC00000 ...
Read raw Chip ID (MfrID:DevID = 0000 : 0000)
Detected Chip ID (VenID:DevID = 0000 : 0000)
Read Array Starting from offset 
Array = 0x0000
Array = 0x0000
Array = 0x0000
Read Array Starting from offset 
Array = 0x0000
Array = 0x0000
Array = 0x0000
Read Array Starting from offset 
Array = 0x0000
Array = 0x0000
Array = 0x0000
Read Array Starting from offset 
Array = 0x0000
Array = 0x0000
Array = 0x0000
*** Unknown or NO Flash Chip Detected ***
 *** REQUESTED OPERATION IS COMPLETE ***

For information and saw that nothing works, I now order a JTAG Cable Linksys WRT54G WRT54GS WRT54GL Brick Repair compatible tjtag, and thus also the Linksys E4200.

[deleted]

Are you sure that 8 is the correct instrlen for your CPU?
PS. I am working on v0.5 and I will see if I can add support for E4200 flash chip.

ps2gamer

I have no idea, I took these parameters following this post : http://www.tiaowiki.com/forums/index.php/topic,4093.msg5324.html#msg5324
Thank you for your support, I am available for any test debugging.

ps2gamer

Hi all,
I made good progress through the purchase of a single cable "dlc5".
However I doubt that the problem mentioned in my first post from a crash of "CFE" because after doing a backup, the content is almost equal to the one I found on this forum.
http://www.dd-wrt.com/phpBB2/viewtopic.php?p=622044#622044
To refocus my problem.
Since the update "TomatoUSB", my router "Linksys E4200" no longer works, even the network ports LEDs do not flash when the ignition to warn that they have been initialized, except I think c is the chipset that does this, not the "CFE" ?
The logo "CISCO" also remains fixed, then that should be flashing at the time of ignition "electric".
I of course tried a connection through the port "COM3" to access the interface "CFE", but nothing.
I even tried to re-flash the "CFE" with this backup, but nothing n'à change, and worse, "tjtag" remains blocked at this stage :

tjtag3.exe -backup:cfe /cable:dlc5 /port:BE00 /byte_mode /fc:158
================================================
 EJTAG Debrick Utility v3.0.2.1 Tornado-MOD
================================================
Selected  port  = 0xBE00
Detected IR chain length = 32
Number of device(s) = 1
IDCODE for device 1 is 0x1471617F
Idcode 0x1471617f IR Length 32
Jtag is in LV mode
switching to MIPS mode 1
Probing bus ... Done
Instruction Length set to 5
CPU Chip ID: 00000000000010001100000101111111 (0008C17F)
*** Found a Broadcom BCM4716 Rev 1 CPU in MIPS MODE chip ***
    - EJTAG IMPCODE ....... : 01100000010000010100000000000000 (60414000)
    - EJTAG Version ....... : 3.1
    - EJTAG DMA Support ... : No
    - EJTAG Implementation flags: R4k ASID_8 MIPS16 NoDMA MIPS32
Intial value of Control register is 000000CC
Intial value of status register is  0000007F
01111111 (0000007F)
Status bit 7 Busy Inverted pin 11 = 1
Status bit 6 *Ack          pin 10 = 1
Status bit 5 Paper-out     pin 12 = 1
Status bit 4 Select        pin 13 = 1
Status bit 3 *Error        pin 15 = 1
* means low = true, e.g., *Error
VCC connected
values of Control register after init 0x000000CC
value of status register after init   0x0000007F
system reset complete
Issuing Processor / Peripheral Reset ... Done
Enabling Memory Writes ... Skipped
Halting Processor ... <Processor Entered Debug Mode!> ... Done
Init PrAcc ... Done
Clearing Watchdog ... Done

I feel that it is completely broken, and that I should buy another.
Thank you !

[deleted]

Please Try zJTAG version 0.6
It is available at http://sourceforge.net/projects/zjtag/files/v0.6/

tekknokrat

Hi ps2gamer,
I have also a bricked e4200 at home. Did you come any further with unbricking your device?
@volkan-k what hat has changed in version 0.6?

leshan

Hi, my E4200 bricked. I'm trying to use Universal JTAG Adapter V2 to un-brick it. I tried both zjtag and tjtag with command:
zjtag -probeonly /cable:4
tjtag -probeonly /cable:dlc5.
Both gave me error: *** Unknown or NO Flash Chip Detected ***
If I use tjtag -probeonly /cable:dlc5 /fc:158, it will work fine. But I even I erased nvram, kernel, cfe and flashed cfe successfully with /fc:158, the router still stay brick.
Since the /fc:158 is for W25Q64 which is 8M, my E4200's flash chip is W25Q128BVFG which is not in the support list of tjtag.
Can anyone please help me on this.
Thanks.

leshan

exactly same as OP.
By the way, my e4200's flash chip is winbond W25Q128BVFG.
I believe /fc:158 is for W25Q64 which is 8M only.
Anyone help us?

leshan

Now the router is not response to Jtag anymore after I used /fc:158 to flash:cfe. I think /fc:158 completely bricked one of my e4200 now.
/fc:148 and /fc:150 reported processing completed on another of my e4200, but after earse:nvram and earse:kernel, this e4200 stay bricked, /fc:148 and /fc150 will not erase:cfe, they reported 0 erased, /fc:158 reported 4 erased on the completed bricked e4200 instead.

leshan

Exactly same here as one of my e4200, I think we should use /fc:158.
I have another bricked e4200, don't know what to do next.

ps2gamer wrote: Hi all,
I made good progress through the purchase of a single cable "dlc5".
However I doubt that the problem mentioned in my first post from a crash of "CFE" because after doing a backup, the content is almost equal to the one I found on this forum.
http://www.dd-wrt.com/phpBB2/viewtopic.php?p=622044#622044
To refocus my problem.
Since the update "TomatoUSB", my router "Linksys E4200" no longer works, even the network ports LEDs do not flash when the ignition to warn that they have been initialized, except I think c is the chipset that does this, not the "CFE" ?
The logo "CISCO" also remains fixed, then that should be flashing at the time of ignition "electric".
I of course tried a connection through the port "COM3" to access the interface "CFE", but nothing.
I even tried to re-flash the "CFE" with this backup, but nothing n'à change, and worse, "tjtag" remains blocked at this stage :
tjtag3.exe -backup:cfe /cable:dlc5 /port:BE00 /byte_mode /fc:158
================================================
 EJTAG Debrick Utility v3.0.2.1 Tornado-MOD
================================================
Selected  port  = 0xBE00
Detected IR chain length = 32
Number of device(s) = 1
IDCODE for device 1 is 0x1471617F
Idcode 0x1471617f IR Length 32
Jtag is in LV mode
switching to MIPS mode 1
Probing bus ... Done
Instruction Length set to 5
CPU Chip ID: 00000000000010001100000101111111 (0008C17F)
*** Found a Broadcom BCM4716 Rev 1 CPU in MIPS MODE chip ***
    - EJTAG IMPCODE ....... : 01100000010000010100000000000000 (60414000)
    - EJTAG Version ....... : 3.1
    - EJTAG DMA Support ... : No
    - EJTAG Implementation flags: R4k ASID_8 MIPS16 NoDMA MIPS32
Intial value of Control register is 000000CC
Intial value of status register is  0000007F
01111111 (0000007F)
Status bit 7 Busy Inverted pin 11 = 1
Status bit 6 *Ack          pin 10 = 1
Status bit 5 Paper-out     pin 12 = 1
Status bit 4 Select        pin 13 = 1
Status bit 3 *Error        pin 15 = 1
* means low = true, e.g., *Error
VCC connected
values of Control register after init 0x000000CC
value of status register after init   0x0000007F
system reset complete
Issuing Processor / Peripheral Reset ... Done
Enabling Memory Writes ... Skipped
Halting Processor ... <Processor Entered Debug Mode!> ... Done
Init PrAcc ... Done
Clearing Watchdog ... Done
I feel that it is completely broken, and that I should buy another.
Thank you !

leshan

If I use Universal JTAG Adapter V2 and command with switches /noreset /nobreak /skipdetect /cable:dlc5 /fc:150. All Parameter can be run correctly, but router still stay bricked.
I get we need the support of the flashchip W25Q128BVFG.
Help please.

[deleted]

Are you using 64-bit Operating System on your PC?
If so, please try latest version of zJTAG (ver1.1) which can be found on SourceForge.net project downloads.

leshan

I used Windowsxp and zJTAG1.0, Same as OP.
I ended up using programmer.
The cheapest 25 CH341 programmer will do the job.

volkan-k wrote: Are you using 64-bit Operating System on your PC?
If so, please try latest version of zJTAG which can be found on SourceForge.net