Hello Moonman, have you had any luck in restoring your E3000?
I restored mine using the parallel TIAO board, buffered (BTW: for others on the forum, using anything other than a buffered connection could result in permanent microcontroller damage. The micro is LVTTL, 3.3V, and a PC parallel port can be 5V. Use buffered always which level-shifts to 3.3V).
I checked each pin on the router to ensure I had 3.3V in there. That's a good indication that your resistor or soldered bridge was done correctly. I then made the connection as you did above, following the TIAO instructions. I had tried many commands with the USB version and none work. With the parallel version, the trick was to use
byte_mode. Volkan can tell us if that is supported in zJTAG as I did not try that.
I used Tornado's TJTAG, not sure if it would be different for zJTAG. I erased both NVRAM and Kernel and the E3000 came back to life. I then used TFTP to flash the original Linksys firmware. The router thought about it for a few minutes and then restarted itself. Do not turn it off until it does that. Once it came up, and since it was still on the operating table with all the wires hooked up, I saw the serial port spring to life and show the bootloader doing it's thing.
Here's the exact command I used to clear the NVRAM, for your reference.
NOTE: I used parameter /FC:159 for my router but keep in mind that this number changes with the different builds of JTAG software. Run the JTAG program without parameters to get a list of supported memory chips. For the Linksys E3000 you want to pick the /FC: number corresponding to memory chip: MX29LV640EB
tjtag3 -erase:nvram /cable:wiggler /byte_mode /fc:159
================================================
EJTAG Debrick Utility v3.0.2.1 Tornado-MOD
================================================
Selected port = 0x378
Detected IR chain length = 32
Number of device(s) = 1
IDCODE for device 1 is 0x1471617F
Idcode 0x1471617f IR Length 32
Jtag is in LV mode
switching to MIPS mode 1
Probing bus ... Done
Instruction Length set to 5
CPU Chip ID: 00000000000010001100000101111111 (0008C17F)
*** Found a Broadcom BCM4716 Rev 1 CPU in MIPS MODE chip ***
- EJTAG IMPCODE ....... : 01100000010000010100000000000000 (60414000)
- EJTAG Version ....... : 3.1
- EJTAG DMA Support ... : No
- EJTAG Implementation flags: R4k ASID_8 MIPS16 NoDMA MIPS32
Intial value of Control register is 000000EC
Intial value of status register is 000000FF
11111111 (000000FF)
Status bit 7 Busy Inverted pin 11 = 0
Status bit 6 *Ack pin 10 = 1
Status bit 5 Paper-out pin 12 = 1
Status bit 4 Select pin 13 = 1
Status bit 3 *Error pin 15 = 1
* means low = true, e.g., *Error
VCC connected
values of Control register after init 0x000000EC
value of status register after init 0x000000FF
system reset complete
Issuing Processor / Peripheral Reset ... Done
Enabling Memory Writes ... Skipped
Halting Processor ... <Processor Entered Debug Mode!> ... Done
Init PrAcc ... Done
Clearing Watchdog ... Done
Chip ID 4716
Chip Rev 1
Package Options a
Number of Cores 9
Core Revision 79
Core Type 710
Core Vendor ID 19a10000
Flash Type 700
Flash Type = PFLASH
Flash bus is 8 bits
Dest is bits 0
Flash is byteswapped 0
Endian Type is LE 0
PLL Type 00000000
Manual Flash Selection ... Done
Flash Vendor ID: 00000000000000001100001011000010 (0000C2C2)
Flash Device ID: 00000000000000000000000011001011 (000000CB)
*** Manually Selected a MX29LV640EB 4Mx16 BotB (8MB) Flash Chip ***
- Flash Chip Window Start .... : 1C000000
- Flash Chip Window Length ... : 00800000
- Selected Area Start ........ : 1C7E0000
- Selected Area Length ....... : 00020000
*** You Selected to Erase the NVRAM.BIN ***
=========================
Erasing Routine Started
=========================
Total Blocks to Erase: 2
Erasing block: 134 (addr = 1C7E0000)...
Erasing in Byte_Mode
Done
Erasing block: 135 (addr = 1C7F0000)...
Erasing in Byte_Mode
Done
=========================
Erasing Routine Complete
=========================
elapsed time: 2 seconds
*** REQUESTED OPERATION IS COMPLETE ***
