Hello everyone,
I have Linksys WRT54GL ver. 1.1, SN: CL7Cxxxxxxxx
CPU: BCM5352EKPBG
Flash: MX29LV320EBTI-70G
It's bricked by a typing mistake I set CPU to 215 MHz instead of 216. After reboot power LED is blinking, DMZ and WLAN are off and all Ethernet and Internet LED are solid on.
It doesn't respond to ping and reset button. I've seen the same scenario on other forums and the recommendation/solution is to clear the NVRAM. So, I'm trying to clear NVRAM using passive (resistors built) JTAG cable.
I've tried zJTAG ver. 1.0, 1.7, 1.8RC - all are not able to detect my flash chip (see above).
Just to point out - no success with other JTAG software - all of them stick at "Probing Flash at (Flash Window: 0x1fc00000) ..." I used "-probeonly /nocwd /noemw".
See the example of zJTAG:
C:\Temp>zjtag18.exe -probeonly /cable:4
==============================================
zJTAG EJTAG Debrick Utility v1.8 RC3
==============================================
cableid=4, cabletype=1
Selected port = 0x378
Detected IR chain length = 32
There are 1 device(s) in the JTAG chain
IDCODE for device 1 is 0x0535217F (IR length:1)
Probing bus ... Done
Defined IR Length is 8 bits
CPU assumed running under LITTLE endian
CPU Chip ID: 00000101001101010010000101111111 (0x0535217F)
*** Found a Broadcom manufactured BCM5352 REV 01 CPU ***
- EJTAG IMPCODE ....... : 00000000100000000000100100000100 (0x00800904)
- EJTAG Version ....... : 1 or 2.0
- EJTAG DMA Support ... : Yes
- EJTAG Implementation flags: R4k MIPS32
Issuing Processor / Peripheral Reset ... Done
Enabling Memory Writes ... Done
Halting Processor ... <Processor did NOT enter Debug Mode!> ... Done
Clearing Watchdog ... Done
Loading CPU Configuration Code ... Skipped
Probing Flash at Address: 0x1FC00000 ...
Detected Chip ID (VenID:DevID = 001A : 0000)
*** Unknown or NO Flash Chip Detected ***
*** REQUESTED OPERATION IS COMPLETE ***
Please note that VenID sometimes shows 001A, sometimes 001E and I believe initially was 005A.
I have no idea why it changed from 005A to 001, probably when I played with erase NVRAM forcing the flash to any specific number (e.g. /fc:060)
Any ideas which flash to use (/fc: command) or which JTAG software?
P.S. I didn't try pin shorting yet.