[Shugo]

[SixLima]

hello

where can i get EJTAG Debrick Utility v2.1.4-Tornado-MOD??? i have WRT54G/GS EJTAG Debrick Utility v4.8 but it cannot detect my CPU (CPU Chip ID: 00100101001101010100000101111111 (2535417F))

[Tornado]

Look at the very first post in this thread, you don't say what router ?

[SixLima]

Sorry, I access from google to the topic and i don't see that I was where i want, only see that someone have the same chip than I.

Thanks!

[Tornado]

Well, with that chip ID it's a:

{ 0x2535417F, 8, "Broadcom BCM5354 KFBG Rev 2 CPU" }

[SixLima]

Thanks to Tornado-Mod my linksys reply to ping... but i dont know what i have to do now, because i can't access by browser to the router.. have i to re-flash the router?

[SixLima]

Woooo!!
I can't belive!!

Linksys WRT54G v8 Debricked with Tornado-Mod!!

[WiFried]

Not having any fun yet!

I got a couple questions about the tjtag:

I saw the /noerase and /start:XXXXXXXX
and was wondering if I could just resume the flash after
it freezes. Lately, I've been only gettting like 4% before it
freezes.

I've even remade the cable and shortened it thinking that might help but no such luck either under WinXP or Knoppix

I've been mainly trying the tjtagv2 -flash:cfe /noreset

any ideas??? thanks hehe

[WiFried]

whoever said flashing GSv7 was hard was understating!

still trying to get a successful flash - Have shortened my cable to where the router board is hanging off the parport so I don't think cable length is an issue :)

When trying to flash the CFE or BSP I get frequent freezes but I'm trying a WHOLEFLASH I found and it's at like 40% without a problem yet, so we'll see.....

couple of questions though:

when trying the -flash, sometimes it says the cpu (Broadcom BC5354 rev 2) did enter debug mode and sometimes it says it did NOT - does it have to enter
debug mode for flashing?

also, if I finish a CFE or WHOLEFLASH successfully, do I need to wait a few and then power cycle or let it reboot itself (doubtful)?

I have had a couple times that the CFE did finish but only after I had to power cycle to get it to finish the flash after a freeze - I don't know if it's really continuing the flash but it seems to be, but then after cycling the power again, I still have just the 5 port lights continuously lit and a dim power led. Also, I heard others talking about the leds blinking during a flash but mine has never changed states ever!

sorry for the length - hopefully I can learn and help others like I learned from other posts.

Thanks again to all - especially Tornado for the info and the CFE file!!

[WiFried]

Well folks - looks like persistence paid off!!

After flashing the wholeflash image successfully the router was restored to the original linksys system

After a quick vxworkskiller, dd-wrt v24 was installed without a problem!

I can't thank everyone enough - I was really excited to get it working again, more for accomplishment than cost of another router.

Thanks again Tornado and all!

[felipe83]

hi it is my first post here, my English its really bad i will try somebody here understood my problem. I have a wrt54GL v1.1

F:\tjtagv2-1-4\windows>tjtagv2 -probeonly /noreset
==========================================
EJTAG Debrick Utility v2.1.4-Tornado-MOD
==========================================
Probing bus ... Done
Instruction Length set to 8
CPU Chip ID: 00000101001101010010000101111111 (0535217F)
*** Found a Broadcom BCM5352 Rev 1 CPU chip ***
- EJTAG IMPCODE ....... : 00000000100000000000100100000100 (00800904)
- EJTAG Version ....... : 1 or 2.0
- EJTAG DMA Support ... : Yes
- EJTAG Implementation flags: R4k MIPS32
Issuing Processor / Peripheral Reset ... Skipped
Enabling Memory Writes ... Done
Halting Processor ... <Processor Entered Debug Mode!> ... Done
Clearing Watchdog ... Done
Probing Flash at (Flash Window: 0x1fc00000) ... Done
Flash Vendor ID: 00000000000000000000000011101100 (000000EC)
Flash Device ID: 00000000000000000010001010100010 (000022A2)
*** Found a K8D3216UBC 2Mx16 BotB (4MB) Flash Chip ***
- Flash Chip Window Start .... : 1fc00000
- Flash Chip Window Length ... : 00200000
- Selected Area Start ........ : 00000000
- Selected Area Length ....... : 00000000
*** REQUESTED OPERATION IS COMPLETE ***

I will try whit all posted here about to recover but nothing happen, the 5 lan leds always is on. I erase the wholeflash, CFE, kernel and nvram... and I use -flash:cfe /noreset im wait the five minutes and unplug -plug quickly and the 5 leds continue always on. what can i do?
really thx for the help

[Tornado]

@WiFried
Great
What commands did you use ? I still do not know why this flash chip causes these problems.

@felipe83

I have only found it nessasary to use /noreset with Gv8,GSv7 Try flashing with just -flash:cfe /noemw

[felipe83]

@Tornado
I use the command -flash:cfe /noemw but nothing happen, according to the writing was finished without errors and the 5 leds of LAN continue on. law in others post that there is to let it 5 minutes and soon disconnect and connect quickly of the current thing which also I did and anything step

[Tornado]

That rule is not for flashing, you do not need to wait after flashing with wrt54g or tjtag.. tell us about your router or give -probeonly /noemw output ?

[felipe83]

@tornado

his is llo that shows to me with that command

D:\jtag\windows>tjtagv2 -probeonly /noemw

==========================================
EJTAG Debrick Utility v2.1.4-Tornado-MOD
==========================================

Probing bus ... Done

Instruction Length set to 8

CPU Chip ID: 00000101001101010010000101111111 (0535217F)
*** Found a Broadcom BCM5352 Rev 1 CPU chip ***

- EJTAG IMPCODE ....... : 00000000100000000000100100000100 (00800904)
- EJTAG Version ....... : 1 or 2.0
- EJTAG DMA Support ... : Yes
- EJTAG Implementation flags: R4k MIPS32

Issuing Processor / Peripheral Reset ... Done
Enabling Memory Writes ... Skipped
Halting Processor ... <Processor Entered Debug Mode!> ... Done
Clearing Watchdog ... Done
Probing Flash at (Flash Window: 0x1fc00000) ... Done

Flash Vendor ID: 00000000000000000000000011101100 (000000EC)
Flash Device ID: 00000000000000000010001010100010 (000022A2)
*** Found a K8D3216UBC 2Mx16 BotB (4MB) Flash Chip ***

- Flash Chip Window Start .... : 1fc00000
- Flash Chip Window Length ... : 00200000
- Selected Area Start ........ : 00000000
- Selected Area Length ....... : 00000000



*** REQUESTED OPERATION IS COMPLETE ***