Unknown flash type :00c2h,00dah , EdgeRouter X

JTAG software bug report.
Post Reply
shin_li
Junior Member
Posts: 4
Joined: Thu Jun 04, 2020 1:26 am

Unknown flash type :00c2h,00dah , EdgeRouter X

Post by shin_li »

Hi USBBDM,

I'm now using your fantastic USB JTAG NT to backup my EdgeRouter X.

I've got these error message so I ask for your kindly help here.
Image

in text form :
-detect
IDCODE 1762124F
MediaTek MT7621
IMPCODE A0414000
EJTAG V2.6
DMA not supported
Unknown flash type!
Report these values http://www.usbjtag.com/phpbb3 00c2h,00dah

I've seen there's another profile called erx1 I also tried and get the same result.

when I tried to use "GETRAM" command I'll get this error message:
-getram RootFS
No routine defined!

The NAND flash on my EdgeRouter X is

MXIC:
MX30LF2G18AC-TI
8E827800

Hope this information may help.

Thanks and hope to hear from you soon.

Shin
shin_li
Junior Member
Posts: 4
Joined: Thu Jun 04, 2020 1:26 am

Re: Unknown flash type :00c2h,00dah , EdgeRouter X

Post by shin_li »

Hi All,

I've found the datasheet which point out the 00c2, 00da is the right ID for this NAND
https://www.macronix.com/Lists/Datashee ... 20v1.4.pdf
See page 33 section 6-8.

I'm a newbie to USB JTAG, If it's okey someone may kindly tell me how to modify flash description file to add this support?

Thanks.

Shin
usbbdm
Junior Member
Posts: 8994
Joined: Mon Jul 18, 2005 9:33 pm

Re: Unknown flash type :00c2h,00dah , EdgeRouter X

Post by usbbdm »

I will make a video how to back up this router.
The NAND flash needs to be defined.
You should have the data file. Come to chat and we can work this out.
usbbdm
Junior Member
Posts: 8994
Joined: Mon Jul 18, 2005 9:33 pm

Re: Unknown flash type :00c2h,00dah , EdgeRouter X

Post by usbbdm »

I see why you get "no routine defined"
Please type "program" to enter TRAP ON mode and then you should be fine. Similar to MR18.
usbbdm
Junior Member
Posts: 8994
Joined: Mon Jul 18, 2005 9:33 pm

Re: Unknown flash type :00c2h,00dah , EdgeRouter X

Post by usbbdm »

Try add these lines to the nandflash.xml
<flash>
<id1>0xc2</id1>
<id2>0xDA</id2>
<id3>0x90</id3>
<id4>0x95</id4>
<id5>0x06</id5>
<name>MX30LF2G18AC</name>
<size>0x84000000</size>
<pagesize>0x840</pagesize>
<protocol>11</protocol>
<block>
<secnum>16384</secnum>
<secsize>0x21000</secsize>
</block>
</flash>
shin_li
Junior Member
Posts: 4
Joined: Thu Jun 04, 2020 1:26 am

Re: Unknown flash type :00c2h,00dah , EdgeRouter X

Post by shin_li »

Hi USBBDM,

Thanks for your quickly reply,

I've fixed this issue by apply your nand description.

Besides, I accidentally achieve success dump via typing "BK" after detect ID code. Than I can successfully dump the firmware.

I also want to check if speed 0 with "13.66kb/s" data rate is correct?

Sorry for my late reply due to timezone issue.

Shin
shin_li
Junior Member
Posts: 4
Joined: Thu Jun 04, 2020 1:26 am

Re: Unknown flash type :00c2h,00dah , EdgeRouter X

Post by shin_li »

Hi USBBDM,

I've give it some tried.

If I just tried to dump after detect. It will get no routine issue :
Image
(Please ignore the text before replug)

Than if I use bk to enable debug mode , I can successfully dump firmware in a extremely slow speed (13.66kb/s) :
Image

Last, I tried to type "program" right after detect, I can successfully dump firmware at a faster speed (about 112kb/s) :
Image

Thanks again for your immediately reply, and I'm also interested in such difference on speed.

AFAIK, MT7621a can't directly mapping NAND ROM to it's memory map. So we need to program one NAND Reader code as our agent into correct ram section than communicate with the agent code.

It looks like you wrote one adorable NAND reader for MT7621a, the code will be load after typing "program" than make usbjtagnt gui have ability to reach NAND. But I'm really interested in the situation "BK" (debug mode on) , why this work? why it's slow? Due to my love of JTAG and embedded system I will be ecstatic if you willing to share the reason.

BR,
Shin
usbbdm
Junior Member
Posts: 8994
Joined: Mon Jul 18, 2005 9:33 pm

Re: Unknown flash type :00c2h,00dah , EdgeRouter X

Post by usbbdm »

Bk is in debug mode, instructions are scanned only on jtag port.that is why it is slow. The purpose of it is to debrick to program the boot.
Trap on mode when I inject a trap code in ram and that is why it is much faster. This chip has 5 core in scan chain. So the scan bits are longer than regular 5bits mips IR length.That is why the read speed is slower than other mips target.
Post Reply

Who is online

Users browsing this forum: No registered users and 7 guests