Debrick a Linksys EA6900 router and replace the CFE

This is JTAG to debrick any JTAG device. Modem, cable boxes, dish boxes routers.
Post Reply
Mravko
Junior Member
Posts: 2
Joined: Wed Aug 10, 2022 4:58 am

Debrick a Linksys EA6900 router and replace the CFE

Post by Mravko »

Before I go out and invest in a USBJTAG I'd like to know if it could be used to debrick a Linsys EA6900 router.The router is totally bricked and I've lost the ability to communicate to the router via the serial interface. It seems that I've wiped out the CFE and my last resort, therefore, is replacing the CFE via JTAG.
Luckily, I have backed up the CFE.bin file, so I believe that I can replace it back via JTAG.


The issue is that there is little information on the SoC CPU in the router (bcm4708a0)

The router details are as follows:
CPU1: Broadcom BCM4708A0 (800 MHz, 2 cores)
FLASH: 128 MiB (Spansion S34ML01G100TFI00) - SLC NAND Flash Memory
RAM: 256 MiB (SK hynix H5TQ2G63DFR-PBC)

I've identified the JTAG port and pins. It's as per the standard EJTAG:
Pin1 – TRST
Pin3 – TDI
Pin5 - TDO
Pin7 – TMS
Pin9 – TCK
Pin 2, 4,6,8,10 - Ground

Is there a way to scan for the start address of the FLASH, with USBJTAG, so that I can replace the CFE?

Cheers...
usbbdm
Junior Member
Posts: 9037
Joined: Mon Jul 18, 2005 9:33 pm

Re: Debrick a Linksys EA6900 router and replace the CFE

Post by usbbdm »

I have not tested JTAG this router. So it is hard to say out of the box u-link NT can support it.
Mravko
Junior Member
Posts: 2
Joined: Wed Aug 10, 2022 4:58 am

Re: Debrick a Linksys EA6900 router and replace the CFE

Post by Mravko »

Hi usbbdm,

I appreciate that you may not have had experience in JTAGing the EA6900 specifically and that's ok. I didn't think this would have been the case.

My question is more about what "discovery" tools this product has, to determine the memory map for the devices attached to the CPU.
i.e. To find at what address the Spansion S34ML01G100TFI00 NAND flash resides on the Broadcom BCM4708A0, ARM Cortex-A9 CPU?

I've spent more than 40 hours, researching and learning about the JTAG protocol and toolsets, and as an electronics engineer, this looks to be a very interesting subject.

I've managed to set up communications via a Raspberry Pi acting as a JTAG interface but it requires one to know, in detail, the target board you are JTAGing.

So, I'm happy to invest in the USB JTAG Software and Hardware if it has the ability to help me in discovering the details.
usbbdm
Junior Member
Posts: 9037
Joined: Mon Jul 18, 2005 9:33 pm

Re: Debrick a Linksys EA6900 router and replace the CFE

Post by usbbdm »

Maybe u-Link NAND will allow you directly read/write the NAND flash.
The ARM JTAG has a lot of variation depends on the core it uses. Also the NAND flash has its own controller.
Unless all those info are available, it might be easier to go with the direct NAND read/write approach.
belkone
Junior Member
Posts: 1
Joined: Fri Jun 11, 2021 2:40 am

Re: Debrick a Linksys EA6900 router and replace the CFE

Post by belkone »

Mravko wrote: Wed Aug 10, 2022 5:19 am Before I go out and invest in a USBJTAG I'd like to know if it could be used to debrick a Linsys EA6900 router.The router is totally bricked and I've lost the ability to communicate to the router via the serial interface. It seems that I've wiped out the CFE and my last resort, therefore, is replacing the CFE via JTAG.
Luckily, I have backed up the CFE.bin file, so I believe that I can replace it back via JTAG.


The issue is that there is little information on the SoC CPU in the router (bcm4708a0)

The router details are as follows:
CPU1: Broadcom BCM4708A0 (800 MHz, 2 cores)
FLASH: 128 MiB (Spansion S34ML01G100TFI00) - SLC NAND Flash Memory
RAM: 256 MiB (SK hynix H5TQ2G63DFR-PBC)

I've identified the JTAG port and pins. It's as per the standard EJTAG:
Pin1 – TRST
Pin3 – TDI
Pin5 - TDO
Pin7 – TMS
Pin9 – TCK
Pin 2, 4,6,8,10 - Ground

Is there a way to scan for the start address of the FLASH, with USBJTAG, so that I can replace the CFE?

Cheers...
Hi Mravko,
could you contact me?
Unfortunately I can't post messages here.
I am also working on the jtag topic, but for EA6400 (same CPU).

Regards,
belkone
Last edited by belkone on Mon May 13, 2024 11:48 pm, edited 1 time in total.
majacaem
Junior Member
Posts: 16
Joined: Tue Sep 05, 2017 9:15 am

Re: Debrick a Linksys EA6900 router and replace the CFE

Post by majacaem »

UP
majacaem
Junior Member
Posts: 16
Joined: Tue Sep 05, 2017 9:15 am

Re: Debrick a Linksys EA6900 router and replace the CFE

Post by majacaem »

Linsys EA6900 version please?
Post Reply

Who is online

Users browsing this forum: No registered users and 1 guest