RT-N66U BCM4706 Support

This site is best viewed in a modern browser with JavaScript enabled.

W1SS

I'm back! Thanks to all those that have been patient while I dealt with a family emergency and to socal87 for his condolence.
Recovery Method (RTN66U with 3 steady lights or bad CFE flash).
You will require the following before attempting this recovery (when in doubt, search DD-WRT or SmallNetBuilder forums) :
1. Patience
2. Original CFE (If you remembered to backup it up before flashing) or an edited CFE of another RT-N66U firmware with your MAC ids and place it in your zjtag folder ie. CFE.BIN
3. TUMPA Board with device software (USB) installed - IMP: Verify that TTL-OUT is selected/enabled on the board and do not connect the board to the router with RS232-OUT enabled as you may cause damage to the board and/or router (see TUMPA PDF Manual)
4. 'Proper' soldering of JTAG J2 Pinouts (verify with ohm/voltmeter) including pinout diagram for Serial/Parallel connections and connecting wires should be no more than 45cm (for J2)
5. Windows XP/7 x86 - may work on x64
6. Latest version of zjtag - I remember also using tjtag/brjtag/xjtag at some point but we will try to first recover with zjtag (I believe the later progs were used for analysis)
7. Network cable with the static ip 192.168.1.10 set on your local network adapter
8. ASUS CFE Recovery software (preferred) or CFE recovery page available at 192.168.1.1
9. Latest merlin or asus firmware (if you are restoring a 32k CFE then stick with a 32k firmware and the same applies to 64k CFEs)
10. Latest CFE conversion script (if you wish to attempt to convert the CFE to 64k again)
My Logic & Method
Current jtag software zjtag, tjtag, brjtag do not properly support the flash type SPANSION S29GL256P (missing device id / improper CPU detection / initialization) or CPU type BROADCOM BCM4706 and after analysing the source code of brjtag and zjtag and going over the technical documentation of the spansion chip, I understood how flash / CPU chip support was built into the software and was able to identify a hack that would allow us to use zjtag with the nearest supported spansion flash chip type and unsupported CPU through a 2-step initialization process using the /noreset switch to maintain the active status of the first initialization (CPU) while carrying out a second initialization to activate the spansion chip and make it ready for command processing.
This was not easy as I had to first identify the actual instruction length that made our CPU tick and after attempting over 300 possible combinations of instrlen and divider values, I was able to initialize the CPU using:

 zjtag -probeonly /cable:0 /instrlen:27 /L1:3 /noreset

Now that I had an initialized CPU, I then focused my efforts on initializing the spansion chip and was able do so by executing the following command to delete the CFE:

 zjtag -erase:cfe /skipdetect /cable:0 /instrlen:5 /L1:3 /fc:116 /noreset /verbose

After deleting the CFE, I then proceeded to flash the original CFE I had backed up from an earlier attempt at converting it to 64k:

 zjtag -flash:cfe /skipdetect /cable:0 /instrlen:5 /L1:3 /fc:116 /noreset /verbose

Now that I have flashed the CFE, I connected my network cable to the router and windows box/vm and then proceeded to manually powering off the router, disconnecting the power cable and pressing the power button to the on position (I saw a quick 3-light flash/blimp) followed by pressing the power button again to the off position.
I then connected the power cable and powered on. The router booted to CFE with a quick all light flash followed by a slowly glowing power led light which is an indicator that the router is now ready to accept new firmware. I proceeded with restoring the firmware and carried out a final reboot.
I was able to verify that the CFE was booting and the firmware flash was executed properly via the Serial connection.
Follow these instructions and your RT-N66U will be resurrected

socal87

Beautiful! I'm about to try this now.
No luck so far. Using zjtag v1.0, the software won't even talk to the router unless I use the default 30MHz clock. Also, I get a DMA write error when attempting to erase CFE. Flashing CFE doesn't seem to work...no error messages, but it goes no further than displaying flash window start/lengths.

[deleted]

socal87 wrote: Beautiful! I'm about to try this now.
No luck so far. Using zjtag v1.0, the software won't even talk to the router unless I use the default 30MHz clock. Also, I get a DMA write error when attempting to erase CFE. Flashing CFE doesn't seem to work...no error messages, but it goes no further than displaying flash window start/lengths.

I've got the same result.

socal87

W1SS and I worked on my board for a while today. Made a few small breakthroughs but no success yet. A few notes:
Use zjtag v1, not v0.6 as 0.6 doesn't recognize the CPU as Broadcom.
When using -probeonly, timing is important. Using /instrlen:27 seems to work, although my router doesn't respond to a 7.5MHz clock, only 30 (/L1:0 or no switch).
Look for Broadcom/Not in build list for CPU. Make sure you use /noreset and do NOT power off router once the CPU is recognized. Also, use /skipdetect, and look for Enabling Memory Writes ... Done.
Once you get good initialization, try to flash CFE using /instrlen:5 and /fc:116, also with /noreset.
If you get a good flash (no DMA write errors) then power board off, disconnect power, power on to flush memory, power off again, plug back in, and power on. If CFE writes correctly you should get blinking lights and be able to use recovery.

[deleted]

socal87 wrote: W1SS and I worked on my board for a while today. Made a few small breakthroughs but no success yet. A few notes:
Use zjtag v1, not v0.6 as 0.6 doesn't recognize the CPU as Broadcom.
When using -probeonly, timing is important. Using /instrlen:27 seems to work, although my router doesn't respond to a 7.5MHz clock, only 30 (/L1:0 or no switch).
Look for Broadcom/Not in build list for CPU. Make sure you use /noreset and do NOT power off router once the CPU is recognized. Also, use /skipdetect, and look for Enabling Memory Writes ... Done.
Once you get good initialization, try to flash CFE using /instrlen:5 and /fc:116, also with /noreset.
If you get a good flash (no DMA write errors) then power board off, disconnect power, power on to flush memory, power off again, plug back in, and power on. If CFE writes correctly you should get blinking lights and be able to use recovery.

I haven't got activate the memory write yet. The router gets the power led on (only power led), but it doesn't start the memory write, and the erase not seems to do anything.
When I start "probeonly", power led switch on, but the task never goes out of:
Clearing Watchdog ... Don't start DMA Write(x4) Addr
How do you connect the pinout? How do you establish the connection on both sides (Tumpa/ASUS)?
Thanks for all!!
Regards

socal87

The correct pinout is posted earlier in this thread, I believe.
Timing is important; once your command is ready, and waiting for board power on, power the board on and hit Enter on the command prompt in short succession, about .25/sec.

socal87

Interestingly enough, we were able to use /fc:088 to wipe the whole chip, only saw I think 3 or 4 errors, and only one of those was a write error. Still having issues flashing the CFE though, but we have been getting closer.

[deleted]

I don't get to start "memory write".
- If I launch: zjtag -probeonly /cable:0 /instrlen:27 /L1:3 /noreset, it doesn't work:
C:\zjtag10>zjtag -probeonly /cable:0 /instrlen:27 /L1:3 /noreset
==============================================
zJTAG EJTAG Debrick Utility v1.0
==============================================
cableid=0, cabletype=0
Set I/O speed to 7500 KHz
USB TAP device has been initialized. Please confirm VREF signal connected!
Press any key to continue... ONCE target board is powered on!
Probing bus ... Done
Detected IR chain Length is 0
Instruction Length set to 27
CPU Chip ID: 00000000000000000000000000000000 (00000000)
*** Unknown or NO CPU Chip ID Detected ***
*** Possible Causes:
1) Router/Modem is not Connected.
2) Router/Modem is not Powered On.
3) Improper JTAG Cable.
4) Unrecognized CPU Chip ID.
- If I launch zjtag -probeonly /cable:0 /instrlen:27 /L1:3 /noreset /skipdetect, then the power led switch on (only), and it shows:
C:\zjtag10>zjtag -probeonly /cable:0 /instrlen:27 /L1:3 /noreset /skipdetect
==============================================
zJTAG EJTAG Debrick Utility v1.0
==============================================
cableid=0, cabletype=0
Set I/O speed to 7500 KHz
USB TAP device has been initialized. Please confirm VREF signal connected!
Press any key to continue... ONCE target board is powered on!
Probing bus ... Done
Detected IR chain Length is 0
Instruction Length set to 27
CPU assumed running under LITTLE endian
CPU Chip ID: 00000000000000000000000000000000 (00000000)
*** CHIP DETECTION OVERRIDDEN ***
- EJTAG IMPCODE ....... : 11111111111111111111111111111111 (FFFFFFFF)
- EJTAG Version ....... : Unknown (7 is a reserved value)
- EJTAG DMA Support ... : No
- EJTAG Implementation flags: R3k DINTsup ASID_8 ASID_6 MIPS16 NoDMA MIPS64
Issuing Processor / Peripheral Reset ... Skipped
Enabling Memory Writes ... Skipped
Halting Processor ... <Processor Entered Debug Mode!> ...
It never ends, only CTRL+C
- If i launch: zjtag -probeonly /cable:0 /instrlen:27 /L1:3 /noreset, after zjtag -probeonly /cable:0 /instrlen:27 /L1:3 /noreset /skipdetect, then shows me (led power off, three dimly lights again):
C:\zjtag10>zjtag -probeonly /cable:0 /instrlen:27 /L1:3 /noreset
==============================================
zJTAG EJTAG Debrick Utility v1.0
==============================================
cableid=0, cabletype=0
Set I/O speed to 7500 KHz
USB TAP device has been initialized. Please confirm VREF signal connected!
Press any key to continue... ONCE target board is powered on!
Probing bus ... Done
Detected IR chain Length is 5
Instruction Length set to 27
CPU Chip ID: 00010000000010001100000101111111 (1008C17F)
CPU Manufacturer :Broadcom(id=17E)
CPU Device ID :008C
CPU Revision :1
*** Detected a CPU but not in build-in list ***
*** You can set /skipdetect let operate continue ***
But it doesn't let me do anything:
C:\zjtag10>zjtag -erase:cfe /skipdetect /cable:0 /instrlen:5 /L1:3 /fc:088 /noreset /verbose
==============================================
zJTAG EJTAG Debrick Utility v1.0
==============================================
cableid=0, cabletype=0
Set I/O speed to 7500 KHz
USB TAP device has been initialized. Please confirm VREF signal connected!
Press any key to continue... ONCE target board is powered on!
Probing bus ... Done
Detected IR chain Length is 5
Instruction Length set to 5
CPU assumed running under LITTLE endian
CPU Chip ID: 00010000000010001100000101111111 (1008C17F)
*** CHIP DETECTION OVERRIDDEN ***
- EJTAG IMPCODE ....... : 01100000010000010100000000000000 (60414000)
- EJTAG Version ....... : 3.1
- EJTAG DMA Support ... : No
- EJTAG Implementation flags: R4k ASID_8 MIPS16 NoDMA MIPS32
Issuing Processor / Peripheral Reset ... Skipped
Enabling Memory Writes ... Skipped
Halting Processor ... <Processor did NOT enter Debug Mode!> ... Done
Clearing Watchdog ...
And it stay there.
What am i doing wrong?

socal87

You got it to identify the Broadcom CPU, a VERY good thing. The trick is to initialize the CPU with -probeonly and /noreset, then attempt to flash...unfortunately, it takes a lot of patience and experimentation with divider, instrlen, and FC values.
We were able to successfully erase my flash chip, then flash the CFE; but the CFE was done too quickly, and though we got a matching backup to confirm, the router is still dead.
As W1SS said in our experiences with my router, not all are created equally, and not all will respond to the same commands that worked on another router.

[deleted]

zjtag identify Broadcom CPU, but when i launch erase, never starts to delete:
C:\zjtag10>zjtag -erase:cfe /cable:0 /skipdetect /instrlen:5 /fc:88 /noreset /ve
rbose
==============================================
zJTAG EJTAG Debrick Utility v1.0
==============================================
cableid=0, cabletype=0
Set I/O speed to 30000 KHz
USB TAP device has been initialized. Please confirm VREF signal connected!
Press any key to continue... ONCE target board is powered on!
Probing bus ... Done
Detected IR chain Length is 1
Instruction Length set to 5
CPU assumed running under LITTLE endian
CPU Chip ID: 00000000000000000000000000000000 (00000000)
*** CHIP DETECTION OVERRIDDEN ***
- EJTAG IMPCODE ....... : 01000000100000111000000000000000 (40838000)
- EJTAG Version ....... : 2.6
- EJTAG DMA Support ... : Yes
- EJTAG Implementation flags: R4k MIPS16 MIPS32
Issuing Processor / Peripheral Reset ... Skipped
Enabling Memory Writes ... Skipped
Halting Processor ... <Processor did NOT enter Debug Mode!> ... Done
Clearing Watchdog ... Done
Loading CPU Configuration Code ... Skipped
Matching Flash Chip (VenID

evID = 017E : 2101)
*** Manually Selected a Spansion S29GL128N/P Uni (16MB) from AMD/Spansion
- Flash Chip Window Start .... : 1C000000
- Flash Chip Window Length ... : 01000000
- Selected Area Start ........ : 1C000000
- Selected Area Length ....... : 00040000
*** You Selected to Erase the CFE.BIN ***
=========================
Erasing Routine Started
=========================
Total Blocks to Erase: 2
Erasing block: 1 (addr = 1C000000)...
How should be the lights at this point? How could i enable memory write?
EDIT:
Finally, i got erase with:
zjtag -erase:cfe /cable:0 /skipdetect /instrlen:8 /fc:88 /noreset /verbose

socal87

Memory write should be enabled if you initialized the processor correctly. The problem is, there isn't really a "right" way to do it...it's more or less luck.
What you're looking for is right here:

Issuing Processor / Peripheral Reset ... Skipped
Enabling Memory Writes ... Skipped <<<Right here, it should say DONE
Halting Processor ... <Processor did NOT enter Debug Mode!> ... Done
Clearing Watchdog ...

In my case, it seems that with /L1:0 the board always responds as DB74B3EB, regardless of instrlen. /L1:3 results in either FFFFFFFF if I hit Enter too early on boot, or 00000000 if I hit it too late. Either way, CPU not detected.

[deleted]

I got erase, but now, on flash cfe launch (zjtag -flash:cfe /skipdetect /cable:0 /instrlen:8 /fc:088 /L1:0 /noreset /verbose), shows:
dma write not correctly !!
40086000 - 7D00FA00
dma write not correctly !!
3C0905C7 - 80FA00FA
dma write not correctly !!
3529FFEE - 7D00FA00
dma write not correctly !!
01094024 - 80FA00FA
dma write not correctly !!
3409FF00 - 7D00FA00
FT Write data to FT2232 error occur!
FT Write data to FT2232 error occur!
FT Write data to FT2232 error occur!

socal87

Hmm, looks like we are in the same boat then. Are you still able to consistently initialize your CPU as Broadcom? I'm having trouble with mine. Did you time yours at all? How exactly did you turn everything on/start the process?
You may be able to use -probeonly with /clearppb to remove any flash protection, but given the output you got, I don't think it would help...I'm in the same situation. Go back a couple pages and look at the screenshot W1SS posted of flashing his CFE...that's what it should look like.
There seem to be multiple bugs still in zjtag, such as DMA...using the /dma swtich to force DMA, zjtag will hang consistently.

[deleted]

I still able to initialize as Broadcom. The process:
zjtag -probeonly /cable:0 /instrlen:27 /L1:3 /noreset /skipdetect
zjtag -probeonly /cable:0 /instrlen:27 /L1:3 /noreset -> Shows Broadcom
zjtag -erase:cfe /cable:0 /skipdetect /instrlen:8 /fc:88 /noreset /verbose -> Done 2 erase jobs
zjtag -flash:cfe /skipdetect /cable:0 /instrlen:8 /fc:088 /L1:0 /noreset /verbose -> Done erase jobs, but dma errors. If i change timing, don't seems start erase jobs

socal87

amadian wrote: I still able to initialize as Broadcom. The process:
zjtag -probeonly /cable:0 /instrlen:27 /L1:3 /noreset /skipdetect
zjtag -probeonly /cable:0 /instrlen:27 /L1:3 /noreset -> Shows Broadcom
zjtag -erase:cfe /cable:0 /skipdetect /instrlen:8 /fc:88 /noreset /verbose -> Done 2 erase jobs
zjtag -flash:cfe /skipdetect /cable:0 /instrlen:8 /fc:088 /L1:0 /noreset /verbose -> Done erase jobs, but dma errors. If i change timing, don't seems start erase jobs

Okay...but how are you getting the router to initialize? Do you have it on the whole time when you run the commands? Or do you start powered off, you ready the command ("Hit enter once target board is powered on"), turn on the router, then start...and if so, how much delay are you giving it?
Mine won't identify as Broadcom no matter what I do. I get either FFFFFFFF or 0000000 when using /L1:3, regardless of /instrlen:x.

W1SS

amadian wrote: I still able to initialize as Broadcom. The process:
zjtag -probeonly /cable:0 /instrlen:27 /L1:3 /noreset /skipdetect
zjtag -probeonly /cable:0 /instrlen:27 /L1:3 /noreset -> Shows Broadcom
zjtag -erase:cfe /cable:0 /skipdetect /instrlen:8 /fc:88 /noreset /verbose -> Done 2 erase jobs
zjtag -flash:cfe /skipdetect /cable:0 /instrlen:8 /fc:088 /L1:0 /noreset /verbose -> Done erase jobs, but dma errors. If i change timing, don't seems start erase jobs

Can you setup a remote session so that I can work on your router in the current initialized mode?

[deleted]

Did you try with Universal JTAG Adapter V2 (Parallel port version)? If not could you please do so?
Is it working with TJTAG or BrJTAG? If so please let me know...

W1SS

volkan-k wrote: Did you try with Universal JTAG Adapter V2 (Parallel port version)? If not could you please do so?
Is it working with TJTAG or BrJTAG? If so please let me know...

I succeeded in flashing with the TUMPA board before my v2 parallel board order arrived. I have hunch of what the problem could be and am waiting for amadian to sign back on.
Has Broadcom released the source for the 4706 chip?

socal87

volkan-k wrote: Did you try with Universal JTAG Adapter V2 (Parallel port version)? If not could you please do so?
Is it working with TJTAG or BrJTAG? If so please let me know...

Some of us do not have the option to use a parallel adapter, as we are working with newer machines without parallel ports (or in my case, a laptop without an extender interface).

[deleted]

socal87 wrote: Some of us do not have the option to use a parallel adapter, as we are working with newer machines without parallel ports (or in my case, a laptop without an extender interface).

In that case you will need to buy a USB-to-Parallel adapter (or extender interface), too.
AFAIK Both TJTAG and BrJTAG supports selecting port other than default of 0x378, so JTAG cables should work with USB-to-Parallel adapter.

« Previous Page Next Page »