Hey!
So I've bricked my WRT54GS v2 while trying to overclock it. I know it's not burned though, because I've tried higher frequency for a while, then tested lower ones and ended up setting a invalide speed, which caused it to stop working on the spot.
I've got the TUMPA lite rigged via jtag. I've tried a lot of programs, and I can't figure out how to unbrick it. Here's what I've learned so far.
UrJTAG
C:\Program Files\UrJTAG>jtag.exe
UrJTAG 0.10 #1502
Copyright (C) 2002, 2003 ETC s.r.o.
Copyright (C) 2007, 2008, 2009 Kolja Waschk and the respective authors
UrJTAG is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
There is absolutely no warranty for UrJTAG.
WARNING: UrJTAG may damage your hardware!
Type "quit" to exit, "help" for help.
jtag> cable ft2232
Connected to libftd2xx driver.
jtag> detect
jtag> frequency 5000
Setting TCK frequency to 5000 Hz
jtag> detect
IR length: 8
Chain length: 1
Device Id: 00010100011100010010000101111111 (0x000000001471217F)
Manufacturer: Broadcom
Part(0): BCM4712
Stepping: Ver 1
Filename: c:\program files\urjtag\data/broadcom/bcm4712/bcm4712
jtag> initbus ejtag
ejtag.c(292) EJCONTROL or EJIMPCODE register not found
bus initialization failed!
jtag>
With urJtag, it detects clearly the router's cpu. We must then conclude that the solderings are good.
The problem here seems to be with the code itself and only a urjtag developper could fix that.
zJtag
Z:\JTAG\zjtag-1.8 bleeding\zjtag.source_1.8>zjtag -probeonly /cable:3 /l1:7 /ve
bose
==============================================
zJTAG EJTAG Debrick Utility v1.8 RC3
==============================================
cableid=3, cabletype=0
Dev 0:
Flags=0x2
Type=0x8
ID=0x4038a99
LocId=0x12
SerialNumber=TITL0263
Description=USB Multi-Protocol Adapter Lite
ftHandle=0x0
Set I/O speed to 3750 KHz
USB TAP device has been initialized. Please confirm VREF signal connected!
Press any key to continue... ONCE target board is powered on!
Detected IR chain length = 32
There are 1 device(s) in the JTAG chain
IDCODE for device 1 is 0x1471217F (IR length:1)
Probing bus ... Done
Defined IR Length is 8 bits
CPU assumed running under LITTLE endian
CPU Chip ID: 00010100011100010010000101111111 (0x1471217F)
*** Found a Broadcom manufactured BCM4712 REV 01 CPU ***
- EJTAG IMPCODE ....... : 00000000100000000000100100000100 (0x00800904)
- EJTAG Version ....... : 1 or 2.0
- EJTAG DMA Support ... : Yes
- EJTAG Implementation flags: R4k MIPS32
Issuing Processor / Peripheral Reset ... Done
Enabling Memory Writes ... Done
Halting Processor ... <Processor did NOT enter Debug Mode!> ... Done
Clearing Watchdog ... Done
Loading CPU Configuration Code ... Skipped
Probing Flash at Address: 0x1FC00000 ...
Read raw Chip ID (MfrID:DevID = 0000 : 0000)
Detected Chip ID (VenID:DevID = 0000 : 0000)
Read Array Starting from offset
Array = 0x0000
Array = 0x0000
Array = 0x0000
Read Array Starting from offset
Array = 0x0000
Array = 0x0000
Array = 0x0000
Read Array Starting from offset
Array = 0x0000
Array = 0x0000
Array = 0x0000
Read Array Starting from offset
Array = 0x0000
Array = 0x0000
Array = 0x0000
*** Unknown or NO Flash Chip Detected ***
*** REQUESTED OPERATION IS COMPLETE ***
zJtag has seem to be the program that took me the furthest. It detects the cpu, but not the flash. So in order to place a command, I need to define it to fc:63. Both backup and erase run without error, but the backup files are empty (all 0) and erase doesn't seem to have any effect.
Z:\JTAG\zjtag-1.8 bleeding\zjtag.source_1.8>zjtag -backup:nvram /cable:3 /l1:7
fc:63 /verbose
==============================================
zJTAG EJTAG Debrick Utility v1.8 RC3
==============================================
cableid=3, cabletype=0
Dev 0:
Flags=0x2
Type=0x8
ID=0x4038a99
LocId=0x12
SerialNumber=TITL0263
Description=USB Multi-Protocol Adapter Lite
ftHandle=0x0
Set I/O speed to 3750 KHz
USB TAP device has been initialized. Please confirm VREF signal connected!
Press any key to continue... ONCE target board is powered on!
Detected IR chain length = 32
There are 1 device(s) in the JTAG chain
IDCODE for device 1 is 0x1471217F (IR length:1)
Probing bus ... Done
Defined IR Length is 8 bits
CPU assumed running under LITTLE endian
CPU Chip ID: 00010100011100010010000101111111 (0x1471217F)
*** Found a Broadcom manufactured BCM4712 REV 01 CPU ***
- EJTAG IMPCODE ....... : 00000000100000000000100100000100 (0x00800904)
- EJTAG Version ....... : 1 or 2.0
- EJTAG DMA Support ... : Yes
- EJTAG Implementation flags: R4k MIPS32
Issuing Processor / Peripheral Reset ... Done
Enabling Memory Writes ... Done
Halting Processor ... <Processor did NOT enter Debug Mode!> ... Done
Clearing Watchdog ... Done
Loading CPU Configuration Code ... Skipped
Matching Flash Chip (VenID:DevID = 0089 : 0017)
*** Manually Selected a Intel 28F640J3 4Mx16 (8MB) from Intel
- Flash Chip Window Start .... : 1C000000
- Flash Chip Window Length ... : 00800000
- Selected Area Start ........ : 1C7E0000
- Selected Area Length ....... : 00020000
*** You Selected to Backup the NVRAM.BIN ***
=========================
Backup Routine Started
=========================
Saving NVRAM.BIN.SAVED_20140626_190621 to Disk...
Done (NVRAM.BIN.SAVED_20140626_190621 saved to Disk OK)
bytes written: 131072
=========================
Backup Routine Complete
=========================
elapsed time: 6 seconds
*** REQUESTED OPERATION IS COMPLETE ***
tJtag
Z:\JTAG\tjtag3\Windows32>tjtag3 -probeonly /noreset /nobreak /nodma /fc:74
==============================================
EJTAG Debrick Utility v3.0 Tornado-MOD
==============================================
Probing bus ... Done
Instruction Length set to 5
CPU Chip ID: 11111111111111111111111111111111 (FFFFFFFF)
*** Unknown or NO CPU Chip ID Detected ***
*** Possible Causes:
1) Device is not Connected.
2) Device is not Powered On.
3) Improper JTAG Cable.
4) Unrecognized CPU Chip ID.
With tJtag, nothing seems to work. I've tried all switch combinations. There is one thing I can't figure out. How do I clock down the frequency? In both UrJTAG and zJtag, I had to slow down the communication. But I can't find how to do that with tJtag. Maybe the answer stands there.
So, do you have any idea how I can make the jtag cable work?
Thanks