Before I go out and invest in a USBJTAG I'd like to know if it could be used to debrick a Linsys EA6900 router.The router is totally bricked and I've lost the ability to communicate to the router via the serial interface. It seems that I've wiped out the CFE and my last resort, therefore, is replacing the CFE via JTAG.
Luckily, I have backed up the CFE.bin file, so I believe that I can replace it back via JTAG.
The issue is that there is little information on the SoC CPU in the router (bcm4708a0)
The router details are as follows:
CPU1: Broadcom BCM4708A0 (800 MHz, 2 cores)
FLASH: 128 MiB (Spansion S34ML01G100TFI00) - SLC NAND Flash Memory
RAM: 256 MiB (SK hynix H5TQ2G63DFR-PBC)
I've identified the JTAG port and pins. It's as per the standard EJTAG:
Pin1 – TRST
Pin3 – TDI
Pin5 - TDO
Pin7 – TMS
Pin9 – TCK
Pin 2, 4,6,8,10 - Ground
Is there a way to scan for the start address of the FLASH, with USBJTAG, so that I can replace the CFE?
Cheers...
Debrick a Linksys EA6900 router and replace the CFE
-
- Junior Member
- Posts: 2
- Joined: Wed Aug 10, 2022 4:58 am
-
- Junior Member
- Posts: 9025
- Joined: Mon Jul 18, 2005 9:33 pm
Re: Debrick a Linksys EA6900 router and replace the CFE
I have not tested JTAG this router. So it is hard to say out of the box u-link NT can support it.
-
- Junior Member
- Posts: 2
- Joined: Wed Aug 10, 2022 4:58 am
Re: Debrick a Linksys EA6900 router and replace the CFE
Hi usbbdm,
I appreciate that you may not have had experience in JTAGing the EA6900 specifically and that's ok. I didn't think this would have been the case.
My question is more about what "discovery" tools this product has, to determine the memory map for the devices attached to the CPU.
i.e. To find at what address the Spansion S34ML01G100TFI00 NAND flash resides on the Broadcom BCM4708A0, ARM Cortex-A9 CPU?
I've spent more than 40 hours, researching and learning about the JTAG protocol and toolsets, and as an electronics engineer, this looks to be a very interesting subject.
I've managed to set up communications via a Raspberry Pi acting as a JTAG interface but it requires one to know, in detail, the target board you are JTAGing.
So, I'm happy to invest in the USB JTAG Software and Hardware if it has the ability to help me in discovering the details.
I appreciate that you may not have had experience in JTAGing the EA6900 specifically and that's ok. I didn't think this would have been the case.
My question is more about what "discovery" tools this product has, to determine the memory map for the devices attached to the CPU.
i.e. To find at what address the Spansion S34ML01G100TFI00 NAND flash resides on the Broadcom BCM4708A0, ARM Cortex-A9 CPU?
I've spent more than 40 hours, researching and learning about the JTAG protocol and toolsets, and as an electronics engineer, this looks to be a very interesting subject.
I've managed to set up communications via a Raspberry Pi acting as a JTAG interface but it requires one to know, in detail, the target board you are JTAGing.
So, I'm happy to invest in the USB JTAG Software and Hardware if it has the ability to help me in discovering the details.
-
- Junior Member
- Posts: 9025
- Joined: Mon Jul 18, 2005 9:33 pm
Re: Debrick a Linksys EA6900 router and replace the CFE
Maybe u-Link NAND will allow you directly read/write the NAND flash.
The ARM JTAG has a lot of variation depends on the core it uses. Also the NAND flash has its own controller.
Unless all those info are available, it might be easier to go with the direct NAND read/write approach.
The ARM JTAG has a lot of variation depends on the core it uses. Also the NAND flash has its own controller.
Unless all those info are available, it might be easier to go with the direct NAND read/write approach.
-
- Junior Member
- Posts: 1
- Joined: Fri Jun 11, 2021 2:40 am
Re: Debrick a Linksys EA6900 router and replace the CFE
Hi Mravko,Mravko wrote: ↑Wed Aug 10, 2022 5:19 am Before I go out and invest in a USBJTAG I'd like to know if it could be used to debrick a Linsys EA6900 router.The router is totally bricked and I've lost the ability to communicate to the router via the serial interface. It seems that I've wiped out the CFE and my last resort, therefore, is replacing the CFE via JTAG.
Luckily, I have backed up the CFE.bin file, so I believe that I can replace it back via JTAG.
The issue is that there is little information on the SoC CPU in the router (bcm4708a0)
The router details are as follows:
CPU1: Broadcom BCM4708A0 (800 MHz, 2 cores)
FLASH: 128 MiB (Spansion S34ML01G100TFI00) - SLC NAND Flash Memory
RAM: 256 MiB (SK hynix H5TQ2G63DFR-PBC)
I've identified the JTAG port and pins. It's as per the standard EJTAG:
Pin1 – TRST
Pin3 – TDI
Pin5 - TDO
Pin7 – TMS
Pin9 – TCK
Pin 2, 4,6,8,10 - Ground
Is there a way to scan for the start address of the FLASH, with USBJTAG, so that I can replace the CFE?
Cheers...
could you contact me?
Unfortunately I can't post messages here.
I am also working on the jtag topic, but for EA6400 (same CPU).
Regards,
belkone
Last edited by belkone on Mon May 13, 2024 11:48 pm, edited 1 time in total.
-
- Junior Member
- Posts: 16
- Joined: Tue Sep 05, 2017 9:15 am
-
- Junior Member
- Posts: 16
- Joined: Tue Sep 05, 2017 9:15 am
Re: Debrick a Linksys EA6900 router and replace the CFE
Linsys EA6900 version please?
Who is online
Users browsing this forum: No registered users and 3 guests