# cat run.sh
./wrt54g -flash:custom /bypass /skipdetect /instrlen:5 /window:90000000 /start:90000000 /length:100
./wrt54g -backup:custom /bypass /skipdetect /instrlen:5 /window:90000000 /start:90000000 /length:100
# bash run.sh
==================================================
WRT54G/GS/AVM/Speedport EJTAG Debrick Utility v5.1
==================================================
***-----------------------------------------------------------------***
Beginning dedect scan leangth...
Switch on power!...
Chain lenght: 14 IR-Chain: 00010010100011 (000004A3)
Probing bus ...
Instruction length set to 5, through commmand line option
*** CHIP Device number: '1' SET BY COMMANDLINE OPTION ***
Device number: '1' Chip ID: 00000000000000000001000000001111 (0000100F)
*** Found a TI AR7WRD TNETD7200ZWD Rev 1 CPU chip ***
Device number: '2' Chip ID: 00001011011011000000000000101111 (0B6C002F)
*** Found a 0B6C002F ????? chip ***
Device number: '3' Chip ID: 00000001010000011100000010010011 (0141C093)
*** Found a Spartan-3 FPGA chip ***
---- Selected: '1' Chip ID: 00000000000000000001000000001111 (0000100F)
*** Found a TI AR7WRD TNETD7200ZWD Rev 1 CPU chip ***
Count devives: '3' selected device: '3' count header bits added to DR: '2' count trailing bits added to DR: '0'
Chain length: '14' Selected IR length: '5' Sum of added header bits to IR: '9' Sum of added trailer bits to IR: '0'
Chip ID: 00000000000000000001000000001111 (0000100F)
*** Found a TI AR7WRD TNETD7200ZWD Rev 1 CPU chip ***
check EJTAG ...
- EJTAG IMPCODE ....... : 01000001010000000100000000000000 (41404000)
- EJTAG IMPCODE ....... : 01000001010000000100000000000000 (41404000)
- EJTAG IMPCODE ....... : 01000001010000000100000000000000 (41404000)
- EJTAG IMPCODE ....... : 01000001010000000100000000000000 (41404000)
- EJTAG IMPCODE ....... : 01000001010000000100000000000000 (41404000)
- EJTAG IMPCODE ....... : 01000001010000000100000000000000 (41404000)
- EJTAG IMPCODE ....... : 01000001010000000100000000000000 (41404000)
- EJTAG IMPCODE ....... : 01000001010000000100000000000000 (41404000)
- EJTAG Version ....... : 2.6
- EJTAG DMA Support ... : No
Issuing Processor / Peripheral Reset ...
Done
-- > Halting Processor ...
<------ Processor Entered Debug Mode ------>
Clearing Watchdog (0xb8000080) ... Done
TAP reset ...
Probing Flash at (Flash Window: 0x90000000) Done
Flash Vendor ID: 00000000000000000000000011000010 (000000C2)
Flash Device ID: 00000000000000000010001001111110 (0000227E)
*** Found a MX29LV640MTTC-90G 4Mx16 (8MB) Flash Chip ***
- Flash Chip Window Start .... : 90000000
- Flash Chip Window Length ... : 00800000
- Selected Area Start ........ : 90000000
- Selected Area Length ....... : 00000100
*** You Selected to Flash the CUSTOM.BIN ***
=========================
Flashing Routine Started
=========================
Total Blocks to Erase: 1
Erasing block: 1 (addr = 90000000)...'.Done
Loading CUSTOM.BIN to Flash Memory...
[ 1% Flashed] 90000000: 40809000 40809800 401a6000 241bfffe
[ 7% Flashed] 90000010: 035bd024 3c1bffbf 377bffff 035bd024
[ 14% Flashed] 90000020: 409a6000 40806800 24080003 40888000
[ 20% Flashed] 90000030: 3c08a861 35081600 ad000000 8d180008
[ 26% Flashed] 90000040: 3c029000 24420110 3c011fff 3421ffff
[ 32% Flashed] 90000050: 00411024 3c01a000 00411025 0040f809
[ 39% Flashed] 90000060: 00000000 3c089000 25080088 3c011fff
[ 45% Flashed] 90000070: 3421ffff 01014024 3c018000 01014025
[ 51% Flashed] 90000080: 01000008 00000000 3c029000 24420268
[ 57% Flashed] 90000090: 0040f809 00000000 17000004 00001021
[ 64% Flashed] 900000a0: 0c000260 00000000 1440ffff 00000000
[ 70% Flashed] 900000b0: 3c029000 244204ac 0040f809 00000000
[ 76% Flashed] 900000c0: 3c1d946a 27bde530 24085000 03a8e821
[ 82% Flashed] 900000d0: 3c1c9461 279c72c0 3c089461 2508f2d0
[ 89% Flashed] 900000e0: 3c09946a 2529e530 11090003 25080001
[ 95% Flashed] 900000f0: 1000fffd a100ffff 24080010 03a8e823
Done (CUSTOM.BIN loaded into Flash Memory OK)
=========================
Flashing Routine Complete
=========================
elapsed time: 10 seconds
*** REQUESTED OPERATION IS COMPLETE ***
==================================================
WRT54G/GS/AVM/Speedport EJTAG Debrick Utility v5.1
==================================================
***-----------------------------------------------------------------***
Beginning dedect scan leangth...
Switch on power!...
Chain lenght: 14 IR-Chain: 00010010100011 (000004A3)
Probing bus ...
Instruction length set to 5, through commmand line option
*** CHIP Device number: '1' SET BY COMMANDLINE OPTION ***
Device number: '1' Chip ID: 00000000000000000001000000001111 (0000100F)
*** Found a TI AR7WRD TNETD7200ZWD Rev 1 CPU chip ***
Device number: '2' Chip ID: 00001011011011000000000000101111 (0B6C002F)
*** Found a 0B6C002F ????? chip ***
Device number: '3' Chip ID: 00000001010000011100000010010011 (0141C093)
*** Found a Spartan-3 FPGA chip ***
---- Selected: '1' Chip ID: 00000000000000000001000000001111 (0000100F)
*** Found a TI AR7WRD TNETD7200ZWD Rev 1 CPU chip ***
Count devives: '3' selected device: '3' count header bits added to DR: '2' count trailing bits added to DR: '0'
Chain length: '14' Selected IR length: '5' Sum of added header bits to IR: '9' Sum of added trailer bits to IR: '0'
Chip ID: 00000000000000000001000000001111 (0000100F)
*** Found a TI AR7WRD TNETD7200ZWD Rev 1 CPU chip ***
check EJTAG ...
- EJTAG IMPCODE ....... : 01000001010000000100000000000000 (41404000)
- EJTAG IMPCODE ....... : 01000001010000000100000000000000 (41404000)
- EJTAG IMPCODE ....... : 01000001010000000100000000000000 (41404000)
- EJTAG IMPCODE ....... : 01000001010000000100000000000000 (41404000)
- EJTAG IMPCODE ....... : 01000001010000000100000000000000 (41404000)
- EJTAG IMPCODE ....... : 01000001010000000100000000000000 (41404000)
- EJTAG IMPCODE ....... : 01000001010000000100000000000000 (41404000)
- EJTAG IMPCODE ....... : 01000001010000000100000000000000 (41404000)
- EJTAG Version ....... : 2.6
- EJTAG DMA Support ... : No
Issuing Processor / Peripheral Reset ...
Done
-- > Halting Processor ...
<------ Processor Entered Debug Mode ------>
Clearing Watchdog (0xb8000080) ... Done
TAP reset ...
Probing Flash at (Flash Window: 0x90000000) Done
Flash Vendor ID: 00000000000000000000000011000010 (000000C2)
Flash Device ID: 00000000000000000010001001111110 (0000227E)
*** Found a MX29LV640MTTC-90G 4Mx16 (8MB) Flash Chip ***
- Flash Chip Window Start .... : 90000000
- Flash Chip Window Length ... : 00800000
- Selected Area Start ........ : 90000000
- Selected Area Length ....... : 00000100
*** You Selected to Backup the CUSTOM.BIN ***
=========================
Backup Routine Started
=========================
Saving CUSTOM.BIN.SAVED_20100717_110913 to Disk...
[ 1% Backed Up] 90000000: ffffffff 40809800 401a6000 241bfffe
[ 7% Backed Up] 90000010: 035bd024 3c1bffbf 377bffff 035bd024
[ 14% Backed Up] 90000020: 409a6000 40806800 24080003 40888000
[ 20% Backed Up] 90000030: 3c08a861 35081600 ad000000 8d180008
[ 26% Backed Up] 90000040: 3c029000 24420110 3c011fff 3421ffff
[ 32% Backed Up] 90000050: 00411024 3c01a000 00411025 0040f809
[ 39% Backed Up] 90000060: 00000000 3c089000 25080088 3c011fff
[ 45% Backed Up] 90000070: 3421ffff 01014024 3c018000 01014025
[ 51% Backed Up] 90000080: 01000008 00000000 3c029000 24420268
[ 57% Backed Up] 90000090: 0040f809 00000000 17000004 00001021
[ 64% Backed Up] 900000a0: 0c000260 00000000 1440ffff 00000000
[ 70% Backed Up] 900000b0: 3c029000 244204ac 0040f809 00000000
[ 76% Backed Up] 900000c0: 3c1d946a 27bde530 24085000 03a8e821
[ 82% Backed Up] 900000d0: 3c1c9461 279c72c0 3c089461 2508f2d0
[ 89% Backed Up] 900000e0: 3c09946a 2529e530 11090003 25080001
[ 95% Backed Up] 900000f0: 1000fffd a100ffff 24080010 03a8e823
Done (CUSTOM.BIN.SAVED_20100717_110913 saved to Disk OK)
bytes written: 256
=========================
Backup Routine Complete
=========================
elapsed time: 2 seconds
*** REQUESTED OPERATION IS COMPLETE ***
ADAM2 Revision TI:0.18.01 AVM: Version:99
(C) Copyright 1996-2003 Texas Instruments Inc. All Rights Reserved.
(C) Copyright 2003 Telogy Networks, Inc.
(C) Copyright 2003-2004 AVM
change 'mtd0' to 0x900C0000,0x903C0000
change 'mtd1' to 0x90010000,0x900C0000
change 'mtd2' to 0x90000000,0x90010000
change 'mtd3' to 0x903C0000,0x903E0000
change 'mtd4' to 0x903E0000,0x90400000
Nun finde ich aber keine konkreten Hinweise darauf, wo TDI, TDO etc. ist.
Das ist gut, mach das Kabel kürzer (besser 20cm als 50cm).Da es aber zu lang zu sein schein, mache ich es kürzer (denke an 0,5m) ...
Das wissen wir -glaube ich- alle nicht (ausser bei der FB7050).... nicht sicher weiß, welcher "Pin" TDO sein soll.
Nein, das ist kein Fehler, das ist richtig so.Also habe ich die ganzen GND Kabel zusammengelötet und ein einzelnes Kabel an GND des Seriellen Ports angelötet (ich hoffe das war kein Fehler).
Du hast wahrscheinlich recht (glaube ich), Deine Box hat nur einen Prozessor, keine Kette. Aber der Prozessor scheint einen Coprozessor zu haben.Ich habe TRST an 3,3V gelegt (mit 100 Ohm Widerstand), cTRST allerdings ausgelassen ...