IAD5130 tot - toter - ganz tot! Auch per JTAG!
Die Vorgeschichte kann man [post=1631555]hier[/post] nachlesen.
Jetzt habe ich also einen toten IAD5130, an den ich auch per JTAG nicht mehr ran komme.
Mit dem original bootloader war JTAG kein Problem, wrtjp.5.5 und auch das feadi-tool erkannten beide Prozessoren und den Flash-Chip auf Anhieb. Backup und flashen funktionierte problemlos.
Aber jetzt, mit dem (verhunzten?) bootloader der FB5140, komme ich nicht mehr an den Flash-Chip ran!
Ich beschreibe die Problematik schrittweise (am Beispiel "backup mit wrtjp.5.1"):
Erster Schritt:
Code:
wrtjp.5.1_win.exe>wrtjp.5.1 -backup:custom /instrlen:5 /window:90000000 /start:90000000 /length:100
==================================================
WRT54G/GS/AVM/Speedport EJTAG Debrick Utility v5.1
==================================================
***-----------------------------------------------------------------***
Beginning dedect scan leangth...
Switch on power!...
Chain lenght: 11 IR-Chain: 00010000011 (00000083)
Probing bus ...
Instruction length set to 5, through commmand line option
Beginning scan chain auto-detection
Device number: '1' Chip ID: 00000000000000000001000000001111 (0000100F)
*** Found a TI AR7WRD TNETD7200ZWD Rev 1 CPU chip ***
Device number: '2' Chip ID: 00010001110000011010000010010011 (11C1A093)
*** Found a XC3S250E FPGE chip ***
Done
Processing is stopped now, you must now specify new commandline options:
/skipdetect and /dev:XX with the device number of the CPU found.
Die beiden Prozessoren werden korrekt erkannt.
Zweiter Schritt: /skipdetect und /dv:1 ergänzen
Code:
wrtjp.5.1_win.exe>wrtjp.5.1 -backup:custom /instrlen:5 /window:90000000 /start:90000000 /length:100 /skipdetect /dv:1
***-----------------------------------------------------------------***
Probing bus ...
Instruction length set to 5, through commmand line option
*** CHIP Device number: '1' SET BY COMMANDLINE OPTION ***
Device number: '1' Chip ID: 00000000000000000001000000001111 (0000100F)
*** Found a TI AR7WRD TNETD7200ZWD Rev 1 CPU chip ***
Device number: '2' Chip ID: 00010001110000011010000010010011 (11C1A093)
*** Found a XC3S250E FPGE chip ***
---- Selected: '1' Chip ID: 00000000000000000001000000001111 (0000100F)
*** Found a TI AR7WRD TNETD7200ZWD Rev 1 CPU chip ***
Count devives: '2' selected device: '2' count header bits added to DR: '1' count trailing bits added to DR: '0'
You must specify /tir:X or /hir:X by Option!
Sieht gut aus.
Dritter Schritt: /hir:6 und /tir:0
Code:
wrtjp.5.1 -backup:custom /instrlen:5 /window:90000000 /start:90000000 /length:100 /skipdetect /dv:1 /hir:6 /tir:0
==================================================
WRT54G/GS/AVM/Speedport EJTAG Debrick Utility v5.1
==================================================
***-----------------------------------------------------------------***
Probing bus ...
'6' Header bits added to IR, through commmand line option
Instruction length set to 5, through commmand line option
*** CHIP Device number: '1' SET BY COMMANDLINE OPTION ***
Device number: '1' Chip ID: 00000000000000000001000000001111 (0000100F)
*** Found a TI AR7WRD TNETD7200ZWD Rev 1 CPU chip ***
Device number: '2' Chip ID: 00010001110000011010000010010011 (11C1A093)
*** Found a XC3S250E FPGE chip ***
---- Selected: '1' Chip ID: 00000000000000000001000000001111 (0000100F)
*** Found a TI AR7WRD TNETD7200ZWD Rev 1 CPU chip ***
Count devives: '2' selected device: '2' count header bits added to DR: '1' count
trailing bits added to DR: '0'
Chain length: '0' Selected IR length: '5' Sum of added header bits to IR: '6' Su
m of added trailer bits to IR: '0'
Chip ID: 00000000000000000001000000001111 (0000100F)
*** Found a TI AR7WRD TNETD7200ZWD Rev 1 CPU chip ***
check EJTAG ...
- EJTAG IMPCODE ....... : 01000001010000000100000000000000 (41404000)
- EJTAG IMPCODE ....... : 01000001010000000100000000000000 (41404000)
- EJTAG IMPCODE ....... : 01000001010000000100000000000000 (41404000)
- EJTAG IMPCODE ....... : 01000001010000000100000000000000 (41404000)
- EJTAG IMPCODE ....... : 01000001010000000100000000000000 (41404000)
- EJTAG IMPCODE ....... : 01000001010000000100000000000000 (41404000)
- EJTAG IMPCODE ....... : 01000001010000000100000000000000 (41404000)
- EJTAG IMPCODE ....... : 01000001010000000100000000000000 (41404000)
- EJTAG Version ....... : 2.6
- EJTAG DMA Support ... : No
Issuing Processor / Peripheral Reset ... Done
-- > Halting Processor ... <------ Processor Entered Debug Mode ------>
Clearing Watchdog (0xb8000080) ... Done
Prima! Der Prozessor geht in den Debug Mode. Jetzt hängt der Ablauf am Watchdog.
Vierter Schritt: /nocwd (not clear watchdog)
Code:
wrtjp.5.1_win.exe>wrtjp.5.1 -backup:custom /instrlen:5 /window:90000000 /start:90000000 /length:100 /skipdetect /dv:1 /hir:6 /tir:0 /nocwd
==================================================
WRT54G/GS/AVM/Speedport EJTAG Debrick Utility v5.1
==================================================
***-----------------------------------------------------------------***
Probing bus ...
'6' Header bits added to IR, through commmand line option
Instruction length set to 5, through commmand line option
*** CHIP Device number: '1' SET BY COMMANDLINE OPTION ***
Device number: '1' Chip ID: 00000000000000000001000000001111 (0000100F)
*** Found a TI AR7WRD TNETD7200ZWD Rev 1 CPU chip ***
Device number: '2' Chip ID: 00010001110000011010000010010011 (11C1A093)
*** Found a XC3S250E FPGE chip ***
---- Selected: '1' Chip ID: 00000000000000000001000000001111 (0000100F)
*** Found a TI AR7WRD TNETD7200ZWD Rev 1 CPU chip ***
Count devives: '2' selected device: '2' count header bits added to DR: '1' count
trailing bits added to DR: '0'
Chain length: '0' Selected IR length: '5' Sum of added header bits to IR: '6' Su
m of added trailer bits to IR: '0'
Chip ID: 00000000000000000001000000001111 (0000100F)
*** Found a TI AR7WRD TNETD7200ZWD Rev 1 CPU chip ***
check EJTAG ...
- EJTAG IMPCODE ....... : 01000001010000000100000000000000 (41404000)
- EJTAG IMPCODE ....... : 01000001010000000100000000000000 (41404000)
- EJTAG IMPCODE ....... : 01000001010000000100000000000000 (41404000)
- EJTAG IMPCODE ....... : 01000001010000000100000000000000 (41404000)
- EJTAG IMPCODE ....... : 01000001010000000100000000000000 (41404000)
- EJTAG IMPCODE ....... : 01000001010000000100000000000000 (41404000)
- EJTAG IMPCODE ....... : 01000001010000000100000000000000 (41404000)
- EJTAG IMPCODE ....... : 01000001010000000100000000000000 (41404000)
- EJTAG Version ....... : 2.6
- EJTAG DMA Support ... : No
Issuing Processor / Peripheral Reset ... Done
-- > Halting Processor ... <------ Processor Entered Debug Mode ------>
TAP reset ...
Probing Flash at (Flash Window: 0x90000000)
Der watchdog ist überlistet, aber
wrtjp.5.1 erkennt den Flash-Chip nicht!
Fünfter Schritt: Flash-Chip manuell definieren /fc:53
Code:
wrtjp.5.1 -backup:custom /instrlen:5 /window:90000000 /start:90000000 /length:100 /skipdetect /dv:1 /hir:6 /tir:0 /nocwd /fc:53
==================================================
WRT54G/GS/AVM/Speedport EJTAG Debrick Utility v5.1
==================================================
***-----------------------------------------------------------------***
Probing bus ...
'6' Header bits added to IR, through commmand line option
Instruction length set to 5, through commmand line option
*** CHIP Device number: '1' SET BY COMMANDLINE OPTION ***
Device number: '1' Chip ID: 00000000000000000001000000001111 (0000100F)
*** Found a TI AR7WRD TNETD7200ZWD Rev 1 CPU chip ***
Device number: '2' Chip ID: 00010001110000011010000010010011 (11C1A093)
*** Found a XC3S250E FPGE chip ***
---- Selected: '1' Chip ID: 00000000000000000001000000001111 (0000100F)
*** Found a TI AR7WRD TNETD7200ZWD Rev 1 CPU chip ***
Count devives: '2' selected device: '2' count header bits added to DR: '1' count
trailing bits added to DR: '0'
Chain length: '0' Selected IR length: '5' Sum of added header bits to IR: '6' Su
m of added trailer bits to IR: '0'
Chip ID: 00000000000000000001000000001111 (0000100F)
*** Found a TI AR7WRD TNETD7200ZWD Rev 1 CPU chip ***
check EJTAG ...
- EJTAG IMPCODE ....... : 01000001010000000100000000000000 (41404000)
- EJTAG IMPCODE ....... : 01000001010000000100000000000000 (41404000)
- EJTAG IMPCODE ....... : 01000001010000000100000000000000 (41404000)
- EJTAG IMPCODE ....... : 01000001010000000100000000000000 (41404000)
- EJTAG IMPCODE ....... : 01000001010000000100000000000000 (41404000)
- EJTAG IMPCODE ....... : 01000001010000000100000000000000 (41404000)
- EJTAG IMPCODE ....... : 01000001010000000100000000000000 (41404000)
- EJTAG IMPCODE ....... : 01000001010000000100000000000000 (41404000)
- EJTAG Version ....... : 2.6
- EJTAG DMA Support ... : No
Issuing Processor / Peripheral Reset ... Done
-- > Halting Processor ... <------ Processor Entered Debug Mode ------>
TAP reset ...
Manual Flash Selection ...
wrtjp.5.1 merkt zwar, dass der Flash-Chip manuell ausgewählt wurde,
liest den Flash aber nicht aus!
Das passiert mit allen 62 Chip-Typen, die aus der Liste wählbar sind.
Sechster Schritt: DMA forcieren (/dma)
Code:
wrtjp.5.1 -backup:custom /instrlen:5 /window:90000000 /start:90000000 /length:100 /skipdetect /dv:1 /hir:6 /tir:0 /nocwd /dma /fc:53
==================================================
WRT54G/GS/AVM/Speedport EJTAG Debrick Utility v5.1
==================================================
***-----------------------------------------------------------------***
Probing bus ...
'6' Header bits added to IR, through commmand line option
Instruction length set to 5, through commmand line option
*** CHIP Device number: '1' SET BY COMMANDLINE OPTION ***
Device number: '1' Chip ID: 00000000000000000001000000001111 (0000100F)
*** Found a TI AR7WRD TNETD7200ZWD Rev 1 CPU chip ***
Device number: '2' Chip ID: 00010001110000011010000010010011 (11C1A093)
*** Found a XC3S250E FPGE chip ***
---- Selected: '1' Chip ID: 00000000000000000001000000001111 (0000100F)
*** Found a TI AR7WRD TNETD7200ZWD Rev 1 CPU chip ***
Count devives: '2' selected device: '2' count header bits added to DR: '1' count trailing bits added to DR: '0'
Chain length: '0' Selected IR length: '5' Sum of added header bits to IR: '6' Su
m of added trailer bits to IR: '0'
Chip ID: 00000000000000000001000000001111 (0000100F)
*** Found a TI AR7WRD TNETD7200ZWD Rev 1 CPU chip ***
check EJTAG ...
- EJTAG IMPCODE ....... : 01000001010000000100000000000000 (41404000)
- EJTAG IMPCODE ....... : 01000001010000000100000000000000 (41404000)
- EJTAG IMPCODE ....... : 01000001010000000100000000000000 (41404000)
- EJTAG IMPCODE ....... : 01000001010000000100000000000000 (41404000)
- EJTAG IMPCODE ....... : 01000001010000000100000000000000 (41404000)
- EJTAG IMPCODE ....... : 01000001010000000100000000000000 (41404000)
- EJTAG IMPCODE ....... : 01000001010000000100000000000000 (41404000)
- EJTAG IMPCODE ....... : 01000001010000000100000000000000 (41404000)
- EJTAG Version ....... : 2.6
- EJTAG DMA Support ... : No
*** DMA Mode Forced On ***
Issuing Processor / Peripheral Reset ... Done
-- > Halting Processor ... <------ Processor Entered Debug Mode ------>
TAP reset ...
Manual Flash Selection ...
Done
Flash Vendor ID: 00000000000000000000000011101100 (000000EC)
Flash Device ID: 00000000000000000010001001110101 (00002275)
*** Manually Selected a K8D1716UTC 1Mx16 TopB (2MB) Flash Chip ***
- Flash Chip Window Start .... : 90000000
- Flash Chip Window Length ... : 00200000
- Selected Area Start ........ : 90000000
- Selected Area Length ....... : 00000100
*** You Selected to Backup the CUSTOM.BIN ***
=========================
Backup Routine Started
=========================
Saving CUSTOM.BIN.SAVED_20101031_151236 to Disk...
[ 1% Backed Up] 90000000: 00f000f0 00000000 00000000 00000000
[ 7% Backed Up] 90000010: 00000000 00000000 00000000 00000000
[ 14% Backed Up] 90000020: 00000000 00000000 00000000 00000000
[ 20% Backed Up] 90000030: 00000000 00000000 00000000 00000000
[ 26% Backed Up] 90000040: 00000000 00000000 00000000 00000000
[ 32% Backed Up] 90000050: 00000000 00000000 00000000 00000000
[ 39% Backed Up] 90000060: 00000000 00000000 00000000 00000000
[ 45% Backed Up] 90000070: 00000000 00000000 00000000 00000000
[ 51% Backed Up] 90000080: 00000000 00000000 00000000 00000000
[ 57% Backed Up] 90000090: 00000000 00000000 00000000 00000000
[ 64% Backed Up] 900000a0: 00000000 00000000 00000000 00000000
[ 70% Backed Up] 900000b0: 00000000 00000000 00000000 00000000
[ 76% Backed Up] 900000c0: 00000000 00000000 00000000 00000000
[ 82% Backed Up] 900000d0: 00000000 00000000 00000000 00000000
[ 89% Backed Up] 900000e0: 00000000 00000000 00000000 00000000
[ 95% Backed Up] 900000f0: 00000000 00000000 00000000 00000000
Done (CUSTOM.BIN.SAVED_20101031_151236 saved to Disk OK)
bytes written: 256
=========================
Backup Routine Complete
=========================
elapsed time: 0 seconds
*** REQUESTED OPERATION IS COMPLETE ***
Der gewählte Flash-Chip wird korrekt erkannt,
aber es werden nur Nullen gelesen!
Dasselbe passiert beim flashen!
Und dasselbe Problem bei allen 62 Flash-Chips auf der Liste.
Was kann ich machen, damit ich auf den Flash-Chip mit flash und backup zugreifen kann ?
Es handelt sich um einen 8MB Chip von Samsung, Typ K4S281632I-UC75
EDIT:
Habe nochmal genauer hingeschaut: Es ist noch ein Speicher-Chip auf der Platine:
Spansion S29GL064N90TF10 834FF481 J
Ich habe jetzt mehr den Spansion in Verdacht, der Flash-Speicher zu sein.
.