How do you JTAG the WNR854T router?

[merkin]

Merkin's XML has some issue. There should not be any space in the tab name. It is impossible to search the memory by tab if the tab name has space in there.

This detail is not stated in the manual. How should I know?

Back on topic...look here @LightworkerNaven


I think it is strange that you get same data from different addresses. Looking back you tried 0x0, 0xf4000000, and 0x40000, etc.

Use this as your xml, so NT will not try to detect flash also.

Code: Select all

<Test>
 <Name>WNR854T</Name>
 <Cat>Router</Cat>
 <IRLength>4</IRLength>
 <Protocol>ARM9</Protocol>
 <SubProtocol>ARM926</SubProtocol>
 <Endian>Little</Endian>
 <Memorys>
 </Memorys>
</Test>

And try this:

cfi 1
detect
flshdct 0
flshdct f4000000
flshdct f8000000

And post the output.
The bottom line is if you do not get 0x89 and 0x17, then you are looking at the wrong address for flash.
Have you tried to jtag your working router same model?
According to the openwrt page, WNR854T has serial (uart) console. Think its time to hook up to both routers and post the output here also. The serial console will give you all the info needed to find flash window. Maybe bootloader is still on bricked router, then all you need is putty and tftp to flash the firmware.

If you get flash window start from serial console and NT still does not detect flash, then its up to usbbdm to add support, but if demand is low do not hold your breath.

[LightworkerNaven]

OK, here's the output. My boyfriend is sleeping in the room where my computer is, so I'll JTAG the working unit tomorrow and post the results.

Code: Select all

Copyright (C) 2010,2011,2012
USB JTAG NT    0.57
Target: WNR854T
-cfi 1
-detect
IDCODE 07926041
STi (ARM926)
-flshdct 0
Unknown flash type!
Report these values http://www.usbjtag.com/vbforum 0aaa,f400
-flshdct f4000000
Unknown flash type!
Report these values http://www.usbjtag.com/vbforum 0aaa,f400
-flshdct f8000000
Unknown flash type!
Report these values http://www.usbjtag.com/vbforum 0aaa,f400

Thanks for the info. I'll look more at it tomorrow.





------------------

OK, I know uBoot works on the bricked unit, but I still want to be able to JTAG the unit. Why? Because it will make my life easier in the long run if I decide to keep buying and selling units like this I'd have to solder a header for the serial port anyway, so why not just do the JTAG instead since it has a standard 10 pin header instead of the 9 pin. That means I can use my temporary spring loaded headers on it. Pop it on, get a JTAG dump now, then if something goes wrong, pop it on the new one, JTAG it, then pop it back off and change its MAC to match the one on the case. (Avoids confusion for some users)

OK, so that being said, here's my uBoot output on the broken router. I don't know what you want me to do with it to show the memory locations as I tried finding them this way before, so I typed help for a list of commands. If I do ls like I usually do, it messes up and dumps garbage to the screen.

Code: Select all

=~=~=~=~=~=~=~=~=~=~=~= PuTTY log 2012.12.04 13:04:43 =~=~=~=~=~=~=~=~=~=~=~=

         __  __                      _ _
        |  \/  | __ _ _ ____   _____| | |
        | |\/| |/ _` | '__\ \ / / _ \ | |
        | |  | | (_| | |   \ V /  __/ | |
        |_|  |_|\__,_|_|    \_/ \___|_|_|
 _   _     ____              _
| | | |   | __ )  ___   ___ | |_
| | | |___|  _ \ / _ \ / _ \| __|
| |_| |___| |_) | (_) | (_) | |_
 \___/    |____/ \___/ \___/ \__|  ** LOADER **
 ** MARVELL BOARD: RD-88F5181L-VOIP-GE LE GE RT v1.05

U-Boot 1.1.1 (Apr 18 2007 - 16:05:00) Marvell version: 1.7.3

DRAM CS[0] base 0x00000000   size  32MB
DRAM Total size  32MB
[8192kB@ff800000] Flash:  8 MB
Addresses 20M - 0M are saved for the U-Boot usage.
Mem malloc Initialization (20M - 16M): Done

Soc: 88F5181 B1
CPU: ARM926 (Rev 0) running @ 500Mhz
SysClock = 166Mhz , TClock = 166Mhz


USB 0: host mode
PCI 0: PCI Express Root Complex Interface
PCI 1: Conventional PCI, speed = 33000000
Net:   egiga0 [PRIME]
Hit any key to stop autoboot:  3  0
Marvell>> help

?       - alias for 'help'
FSdel        - del a file from the Flash MV FS
FSdir        - ls the Flash MV FS
FSformat- format the Flash MV FS
FSlef        - Load an exe file to the Flash MV FS
FSlf        - Load a file to the Flash MV FS
FSrun        - Load an exe file from the Flash MV FS and run it
FStftp        - tftp a file to the Flash MV FS
FStftpe - tftp an exe file to the Flash MV FS
FStype        - cat file from the Flash MV FS
base    - print or set address offset
boot    - boot default, i.e., run 'bootcmd'
bootd   - boot default, i.e., run 'bootcmd'
bootelf - Boot from an ELF image in memory
bootext2    dev:boot_part1,boot_part2 addr boot_image linux_dev_name
bootm   - boot application image from memory
bootp   - boot image via network using BootP/TFTP protocol
bootvx  - Boot vxWorks from an ELF image
bubt        - Burn an image on the Boot Flash.
chpart  - change active partition
cmp     - memory compare
cmpm        - Compare Memory
cp      - memory copy
cpumap - Display CPU memory mapping settings.
crc32   - checksum calculation
date    - get/set/reset date & time
dclk        - Display the MV device CLKs.
ddimm  - Display SPD Dimm Info
dhcp    - invoke DHCP client to obtain IP/boot params
diskboot- boot from IDE device
dma        - Perform DMA
echo    - echo args to console
eeprom  - EEPROM sub-system
erase   - erase FLASH memory
ext2load- load binary file from a Ext2 filesystem
ext2ls- list files in a directory (default /)
fi        - Find value in the memory.
flinfo  - print FLASH memory information
fsinfo  - print information about filesystems
fsload  - load binary file from a filesystem image
g        - start application at cached address 'addr'(default addr 0x40000)
go      - start application at address 'addr'
help    - print online help
icrc32  - checksum calculation
ide     - IDE sub-system
iloop   - infinite loop on address range
imd     - i2c memory display
imm     - i2c memory modify (auto-incrementing)
imw     - memory write (fill)
inm     - memory modify (constant address)
iprobe  - probe to discover valid I2C chip addresses
ir        - reading and changing MV internal register values.
ln        - Load S-Record executable file through the network interface.
loop    - infinite loop on address range
ls      - list files in a directory (default /)
map        - Diasplay address decode windows
md      - memory display
me        - PCI master enable
mm      - memory modify (auto-incrementing)
mp        - map PCI BAR
mtest   - simple RAM test
mw      - memory write (fill)
nm      - memory modify (constant address)
pci     - list and access PCI Configuraton Space
phyRead        - Read Phy register
phyWrite        - Write Phy register
ping    - send ICMP ECHO_REQUEST to network host
printenv- print environment variables
protect - enable or disable FLASH write protection
rarpboot- boot image via network using RARP/TFTP protocol
reset   - Perform RESET of the CPU
resetenv        - Return all environment variable to default.
run     - run commands in an environment variable
saveenv - save environment variables to persistent storage
se        - PCI Slave enable
setenv  - set environment variables
sg        - scanning the PHYs status
sleep   - delay execution for some time
sp        - Scan PCI bus.
tftpboot- boot image via network using TFTP protocol
version - print monitor version
Marvell>>

This is the JTAG output from the working WNR854T unit.

Code: Select all

Copyright (C) 2010,2011,2012
USB JTAG NT    0.57
Target: WNR854T
-cfi 1
-detect
IDCODE 07926041
STi (ARM926)
-flshdct 0
Unknown flash type!
Report these values http://www.usbjtag.com/vbforum 0000,0000
-flshdct f4000000
Unknown flash type!
Report these values http://www.usbjtag.com/vbforum 0000,0000
-flshdct f8000000
Unknown flash type!
Report these values http://www.usbjtag.com/vbforum 0000,0000

Just so we're on the same page, I want to post the contents of some XML files.

flash.xml - This is the same as stock as I changed it back as instructed.

[LightworkerNaven]

vender.xml - As its detecting as STi, not Marvell, I added an entry under STi for the 885S181 proc.

Code: Select all

<Venders>
   <Vender>
      <Name>TI</Name>
      <Id>0x7</Id>
      <Part>
         <Name>TNETC4401</Name>
         <Id>0x1</Id>
      </Part>
   </Vender>
   <Vender>
      <Name>TI</Name>
      <Id>0x17</Id>
      <Part>
         <Name>TNETV1061</Name>
         <Id>0xB6C6</Id>
      </Part>
      <Part>
         <Name>TNETV10552</Name>
         <Id>0xB52D</Id>
      </Part>
      <Part>
         <Name>TNETC4830ZDW</Name>
         <Id>0xB7C7</Id>
      </Part>
   </Vender>
   <Vender>
      <Name>TI</Name>
      <Id>0x97</Id>
      <Part>
         <Name>TNETC4600</Name>
         <Id>0x88</Id>
      </Part>
   </Vender>
   <Vender>
      <Name>Intel</Name>
      <Id>0x9</Id>
   </Vender>
   <Vender>
      <Name>Philips</Name>
      <Id>0x15</Id>
   </Vender>
   <Vender>
      <Name>Atmel</Name>
      <Id>0x1F</Id>
   </Vender>
   <Vender>
      <Name>Cypress</Name>
      <Id>0x34</Id>
   </Vender>
   <Vender>
      <Name>DEC</Name>
      <Id>0x35</Id>
   </Vender>
   <Vender>
      <Name>Xilinx</Name>
      <Id>0x49</Id>
   </Vender>
   <Vender>
      <Name>Altera</Name>
      <Id>0x6E</Id>
   </Vender>
   <Vender>
      <Name>Broadcom</Name>
      <Id>0xBF</Id>
      <Part>
         <Name>BCM1250</Name>
         <Id>0x1250</Id>
      </Part>
      <Part>
         <Name>BCM3310</Name>
         <Id>0x3310</Id>
      </Part>
      <Part>
         <Name>BCM5421S</Name>
         <Id>0x5421</Id>
      </Part>
      <Part>
         <Name>BCM3345</Name>
         <Id>0x3345</Id>
      </Part>
      <Part>
         <Name>BCM3348</Name>
         <Id>0x3348</Id>
      </Part>
      <Part>
         <Name>BCM3349</Name>
         <Id>0x3349</Id>
      </Part>
      <Part>
         <Name>BCM3350</Name>
         <Id>0x3350</Id>
      </Part>
      <Part>
         <Name>BCM3352</Name>
         <Id>0x3352</Id>
      </Part>
      <Part>
         <Name>BCM4702</Name>
         <Id>0x4710</Id>
      </Part>
      <Part>
         <Name>BCM4712</Name>
         <Id>0x4712</Id>
      </Part>
      <Part>
         <Name>BCM5352</Name>
         <Id>0x5352</Id>
      </Part>
      <Part>
         <Name>BCM7115</Name>
         <Id>0x7115</Id>
      </Part>
      <Part>
         <Name>BCM7038</Name>
         <Id>0x7038</Id>
      </Part>
      <Part>
         <Name>BCM5345</Name>
         <Id>0x5354</Id>
      </Part>
      <Part>
         <Name>BCM4785</Name>
         <Id>0x4785</Id>
      </Part>
      <Part>
         <Name>BCM6338</Name>
         <Id>0x6338</Id>
      </Part>
   </Vender>
   <Vender>
      <Name>Broadcom</Name>
      <Id>0x150</Id>
   </Vender>
   <Vender>
      <Name>LSI</Name>
      <Id>0x36</Id>
      <Part>
         <Name>SC2000</Name>
         <Id>0x4000</Id>
      </Part>
   </Vender>
   <Vender>
      <Name>Motorola</Name>
      <Id>0xE</Id>
      <Part>
         <Name>17500QK</Name>
         <Id>0x1C55</Id>
      </Part>
   </Vender>
   <Vender>
      <Name>STi</Name>
      <Id>0x20</Id>
      <Part>
         <Name>STi5500</Name>
         <Id>0xD4C9</Id>
      </Part>
      <Part>
         <Name>STi5518</Name>
         <Id>0xD405</Id>
      </Part>
      <Part>
         <Name>STi5505</Name>
         <Id>0xD4CB</Id>
      </Part>
      <Part>
         <Name>STi5518</Name>
         <Id>0xD502</Id>
      </Part>
      <Part>
         <Name>STi5508</Name>
         <Id>0xD402</Id>
      </Part>
      <Part>
         <Name>STi5510</Name>
         <Id>0xD4CD</Id>
      </Part>
      <Part>
         <Name>STi5516</Name>
         <Id>0xD41D</Id>
      </Part>
      <Part>
         <Name>STi5517</Name>
         <Id>0xD41F</Id>
      </Part>
      <Part>
         <Name>STi5105</Name>
         <Id>0xD427</Id>
      </Part>
      <Part>
       <Name>STi7100</Name>
       <Id>0xD424</Id>
      </Part>
     <Part>
       <Name>STi5202</Name>
       <Id>0xD42C</Id>
     </Part>
     <Part>
       <Name>STi5205</Name>
       <Id>0xD43E</Id>
     </Part>
     <Part>
         <Name>ST20-TP2</Name>
         <Id>0x5193</Id>
      </Part>
      <Part>
         <Name>ST20-TP3</Name>
         <Id>0x5194</Id>
      </Part>
      <Part>
         <Name>ST20-TP4</Name>
         <Id>0x5198</Id>
      </Part>
      <Part>
         <Name>ST20-GP6</Name>
         <Id>0x5196</Id>
      </Part>
      <Part>
         <Name>885S181</Name>
         <Id>0x7926</Id>
      </Part>
   </Vender>
   <Vender>
      <Name>Conexant</Name>
      <Id>0x13</Id>
      <Part>
         <Name>ARM920T</Name>
         <Id>0x920</Id>
      </Part>
   </Vender>
   <Vender>
      <Name>TI(Orion)</Name>
      <Id>0x5E</Id>
      <Part>
         <Name>TMS320VC5472</Name>
         <Id>0x4038</Id>
      </Part>
   </Vender>
   <Vender>
      <Name>Arm</Name>
      <Id>0x787</Id>
      <Part>
         <Name>ARM7TDMI</Name>
         <Id>0xF1F0</Id>
      </Part>
     <Part>
       <Name>ARM7TDI</Name>
       <Id>0xF0F0</Id>
     </Part>
   </Vender>
   <Vender>
      <Name>Microchip</Name>
      <Id>0x029</Id>
      <Part>
         <Name>PIC32MX</Name>
         <Id>0x0978</Id>
      </Part>
   </Vender>
   <Vender>
      <Name>ADM</Name>
      <Id>0x000</Id>
      <Part>
         <Name>ADM5120</Name>
         <Id>0x0</Id>
      </Part>
   </Vender>
  <Vender>
    <Name>Marvell</Name>
    <Id>0x1E9</Id>
    <Part>
      <Name>88W8500</Name>
      <Id>0x5946</Id>
    </Part>
  </Vender>
  <Vender>
    <Name>IBM</Name>
    <Id>0x024</Id>
    <Part>
      <Name>STB02500</Name>
      <Id>0x2955</Id>
    </Part>
  </Vender>
  <Vender>
    <Name>Samsung</Name>
    <Id>0x04E</Id>
    <Part>
      <Name>S3C2440</Name>
      <Id>0x0324</Id>
    </Part>
  </Vender>
  <Vender>
    <Name>Realtek</Name>
    <Id>0x006</Id>
    <Part>
      <Name>RTL8196C</Name>
      <Id>0x4380</Id>
    </Part>
  </Vender>
</Venders>

TWNR854T.xml

Code: Select all

<Test>
 <Name>WNR854T</Name>
 <Cat>Router</Cat>
 <IRLength>4</IRLength>
 <Protocol>ARM9</Protocol>
 <SubProtocol>ARM926</SubProtocol>
 <Endian>Little</Endian>
 <Memorys>
 </Memorys>
</Test>

Note that the XML for the unit doesn't allow for the AllFlash tab to show.

[LightworkerNaven]

Sorry about doing a triple reply, but entry is limited to a certain number of characters on here. Here's the uBoot startup from the working unit.

Code: Select all

=~=~=~=~=~=~=~=~=~=~=~= PuTTY log 2012.12.04 13:38:13 =~=~=~=~=~=~=~=~=~=~=~=


         __  __                      _ _
        |  \/  | __ _ _ ____   _____| | |
        | |\/| |/ _` | '__\ \ / / _ \ | |
        | |  | | (_| | |   \ V /  __/ | |
        |_|  |_|\__,_|_|    \_/ \___|_|_|
 _   _     ____              _
| | | |   | __ )  ___   ___ | |_
| | | |___|  _ \ / _ \ / _ \| __|
| |_| |___| |_) | (_) | (_) | |_
 \___/    |____/ \___/ \___/ \__|  ** LOADER **
 ** MARVELL BOARD: RD-88F5181L-VOIP-GE LE GE RT v1.05

U-Boot 1.1.1 (Apr 18 2007 - 16:05:00) Marvell version: 1.7.3

DRAM CS[0] base 0x00000000   size  32MB
DRAM Total size  32MB
[8192kB@ff800000] Flash:  8 MB
Addresses 20M - 0M are saved for the U-Boot usage.
Mem malloc Initialization (20M - 16M): Done

Soc: 88F5181 B1
CPU: ARM926 (Rev 0) running @ 500Mhz
SysClock = 166Mhz , TClock = 166Mhz


USB 0: host mode
PCI 0: PCI Express Root Complex Interface
PCI 1: Conventional PCI, speed = 33000000
Net:   egiga0 [PRIME]
Hit any key to stop autoboot:  3  2  1  0
### JFFS2 loading 'uImage' to 0x400000
Scanning JFFS2 FS:   .  | / - \ | / - .  \ | / - \ | / - \ .  | / .  - .  \ .  | / - \ | / - \ | / -  done.

### JFFS2 load complete: 903668 bytes loaded to 0x400000
## Booting image at 00400000 ...
   Image Name:   Linux-2.4.27-vrs1
   Created:      2009-03-05   3:16:03 UTC
   Image Type:   ARM Linux Kernel Image (uncompressed)
   Data Size:    903604 Bytes = 882.4 kB
   Load Address: 00008000
   Entry Point:  00008000
   Verifying Checksum ... OK
OK

Starting kernel ...

Uncompressing Linux.............................................................. done, booting the kernel.

=Linux version 2.4.27-vrs1 (tony@cvs2) (gcc version 3.4.4 (release) (CodeSourcery ARM 2005q3-1)) #563 Thu Mar 5 11:15:41 CST 2009

CPU: ARM926EJ-Sid(wb) revision 0

Machine: MV-88fxx81

Using UBoot passing parameters structure

Sys Clk = 166666667, Tclk = 166666667



- Warning - This LSP release was tested only with U-Boot release 1.10.16


On node 0 totalpages: 8192

zone(0): 8192 pages.

zone(1): 0 pages.

zone(2): 0 pages.

Kernel command line: root=/dev/mtdblock1 rw ip=192.168.1.1:192.168.1.62:::DB88FXX81:eth0:none

Calibrating delay loop... 332.59 BogoMIPS

Memory: 32MB 0MB 0MB 0MB = 32MB total

Memory: 30288KB available (1683K code, 323K data, 80K init)

Dentry cache hash table entries: 4096 (order: 3, 32768 bytes)

Inode cache hash table entries: 2048 (order: 2, 16384 bytes)

Mount cache hash table entries: 512 (order: 0, 4096 bytes)

Buffer cache hash table entries: 1024 (order: 0, 4096 bytes)

Page-cache hash table entries: 8192 (order: 3, 32768 bytes)

CPU: Testing write buffer: pass

POSIX conformance testing by UNIFIX

init hw started.


CPU Interface

-------------

SDRAM_CS0 ....base 00000000, size  32MB

SDRAM_CS1 ....disable

SDRAM_CS2 ....disable

SDRAM_CS3 ....disable

PEX0_MEM ....base e0000000, size 128MB

PEX0_IO ....base f2000000, size   1MB

PCI0_MEM ....base e8000000, size 128MB

PCI0_IO ....base f2100000, size   1MB

INTER_REGS ....base f1000000, size   1MB

DEVICE_CS0 ....no such

DEVICE_CS1 ....no such

DEVICE_CS2 ....no such

DEV_BOOCS ....base f4000000, size  16MB

Flash bankwidth 2, base f4000000, size 1000000

PCI: bus0: Fast back to back transfers enabled

HW already initialized.

PCI: bus1: Fast back to back transfers enabled

Linux NET4.0 for Linux 2.4

Based upon Swansea University Computer Society NET3.039

Initializing RT netlink socket


  Marvell Development Board (LSP Version 1.1.3)-- RD-88F5181L-VOIP-GE  Soc: 88F5181 B1


 Detected Tclk 166666667 and SysClk 166666667

Starting kswapd

devfs: v1.12c (20020818) Richard Gooch ([email protected])

devfs: boot_options: 0x1

JFFS2 version 2.1. (C) 2001 Red Hat, Inc., designed by Axis Communications AB.

pty: 256 Unix98 ptys configured

Serial driver version 5.05c (2001-07-08) with MANY_PORTS SHARE_IRQ SERIAL_PCI enabled

ttyS00 at 0xf1012000 (irq = 3) is a 16550A

Marvell Gateway Driver:

Detected RD_88F5181L_VOIP_GE

Using VLAN-tag Mode

L3/L4 Checksum offload enabled

Multi queue support ( rxq0=128 rxq1=64 rxq2=64 rxq3=64 txq0=2000 )

Routing QoS support (ToS 0x11;0x22)

L2 IGMP support

Using boot network interface configuration

eth0: mac_addr 00:00:00:00:51:81, VID 0x100, port list: port-0

eth1: mac_addr 00:00:00:00:51:80, VID 0x200, port list: port-1 port-2 port-3 port-4

init switch layer... done

init MAC layer... done

loading network interfaces: eth0 eth1

gprtSetLed: port=0,data1=15,data2=1777

gprtSetLed: port=1,data1=15,data2=1777

gprtSetLed: port=2,data1=15,data2=1777

gprtSetLed: port=5,data1=15,data2=1777

gprtSetLed: port=7,data1=15,data2=1777

----set PPU En

PPP generic driver version 2.4.2

physmap flash device: 1000000 at f4000000

cfi_cmdset_0001: Erase suspend on write enabled

Using buffer write method

Using physmap partition definition

Creating 6 MTD partitions on "phys_mapped_flash":

0x00000000-0x00600000 : "root"

0x00600000-0x00620000 : "nvram"

0x00620000-0x00640000 : "nvram default"

0x00640000-0x00660000 : "POT"

0x00660000-0x00680000 : "Traffic Meter"

0x00700000-0x00800000 : "uboot"

Initializing Cryptographic API

NET4: Linux TCP/IP 1.0 for NET4.0

IP Protocols: ICMP, UDP, TCP, IGMP

IP: routing cache hash table of 512 buckets, 4Kbytes

TCP: Hash tables configured (established 2048 bind 4096)

IPv4 over IPv4 tunneling driver

GRE over IPv4 tunneling driver

Linux IP multicast router 0.06 plus PIM-SM

ip_conntrack version 2.1 (8192 buckets, 65536 max) - 348 bytes per conntrack

ip_tables: (C) 2000-2002 Netfilter core team

ipt_time loading

NET4: Unix domain sockets 1.0/SMP for Linux NET4.0.

NET4: Ethernet Bridge 008 for NET4.0

Fast Floating Point Emulator V0.94M by Peter Teichmann.

cramfs: wrong magic

VFS: Mounted root (jffs2 filesystem).

Mounted devfs on /dev

Freeing init memory: 80K

==init: Missing PROCESS field in inittabinit: Missing PROCESS field in inittabinit: Missing PROCESS field in inittab

BusyBox v1.1.0 (2008.12.04-05:57+0000) Built-in shell (ash)
Enter 'help' for a list of built-in commands.

/ # #sysinit: [sysinit]
Thu Jan  1 00:00:00 UTC 1970
Warning: loading gpio_module will taint the kernel: non-GPL license - Gemtek
  See http://www.tux.org/lkml/#export-tainted for information about tainted modules
resetC.c :Parent process, pid = 33
resetC.c :Child process, pid = 36
# update nvram with default list!
Init interfaces.
SIOCGIFFLAGS: No such device
can't get macaddr of ap0
(http)This is the child process, pid = 41
(http)This is the parent process, pid = 38
mv_gateway: eth1 db1 port-mask=0x8, 00:00:00:00:51:80 deleted

mv_gateway: eth1 db1 port-mask=0x8, 00:18:4d:24:c4:30 added

mv_gateway: eth1 change mac address to 00:18:4d:24:c4:30

mv_gateway: starting eth1

mv_gateway: eth1 db1 port-mask=0x8, 00:18:4d:24:c4:30 added

mv_gateway: eth1 db1 port-mask=0xab, ff:ff:ff:ff:ff:ff added

mv_gateway: eth1 db1 port-mask=0xab, 01:00:5e:00:00:01 added

mv_gateway: eth1 db1 port-mask=0xab, 01:00:5e:00:00:01 added

mv_gateway: eth1 db1 port-mask=0xab, 01:00:5e:00:00:01 added

device eth1 entered promiscuous mode

SIOCSIFADDR: No such device
SIOCGIFFLAGS: No such device
interface ap0 does not exist!
br0: port 1(eth1) entering learning state

iptables: Bad rule (does a matching rule exist in that chain?)
Init lan services.
syslog: remote IP 192.168.1.254
BusyBox v1.1.0 (2008.12.04-05:57+0000) multi-call binary

Usage: syslogd [OPTION]...

Hostname         Mac Address       IP-Address      Expires in
killall: udhcpd: no process killed
Start UPnP
udhcp server (v0.9.8) started
dhcpd child process, pid = 76
Attaching option router to list
Attaching option subnet to list
Attaching option dns to list
Attaching option lease to list
unable to parse 'option domain '
route: resolving netmask
dhcpd parent process, pid = 71
Read 0 leases
br0 (our ip) = 192.168.1.1
adapter index 7
adapter hardware address 00:18:4d:24:c4:30
Opening listen socket on 0x00000000:67 br0

route: resolving netmask
route: resolving netmask
route: resolving netmask
route: resolving netmask
route: resolving netmask
route: resolving netmask
route: resolving netmask
route: resolving netmask
route: resolving netmask
iptables: Bad rule (does a matching rule exist in that chain?)
iptables: Bad rule (does a matching rule exist in that chain?)
killall: dnsmasq: no process killed
Init wan.
mv_gateway: eth0 db0 port-mask=0x8, 00:00:00:00:51:81 deleted
mv_gateway: eth0 db0 port-mask=0x8, 00:18:4d:24:c4:31 added
mv_gateway: eth0 change mac address to 00:18:4d:24:c4:31

[LightworkerNaven]

As per:

Code: Select all

Creating 6 MTD partitions on "phys_mapped_flash":

0x00000000-0x00600000 : "root"
0x00600000-0x00620000 : "nvram"
0x00620000-0x00640000 : "nvram default"
0x00640000-0x00660000 : "POT"
0x00660000-0x00680000 : "Traffic Meter"
0x00700000-0x00800000 : "uboot"

Should my XML look like this?

Code: Select all

<Test>
 <Name>WNR854T</Name>
 <Cat>Router</Cat>
 <IRLength>4</IRLength>
 <Protocol>ARM9</Protocol>
 <SubProtocol>ARM926</SubProtocol>
 <Endian>Little</Endian>
 <Memorys>
      <Memory>
         <Name>root</Name>
         <Type>1</Type>
         <Address>0x00000000</Address>
         <Size>0x00600000</Size>
      </Memory>
      <Memory>
         <Name>nvram</Name>
         <Type>1</Type>
         <Address>0x00600000</Address>
         <Size>0x00020000</Size>
      </Memory>
      <Memory>
         <Name>nvram_default</Name>
         <Type>1</Type>
         <Address>0x00620000</Address>
         <Size>0x00020000</Size>
      </Memory>
      <Memory>
         <Name>POT</Name>
         <Type>1</Type>
         <Address>0x00640000</Address>
         <Size>0x00020000</Size>
      </Memory>
      <Memory>
         <Name>Traffic_Meter</Name>
         <Type>1</Type>
         <Address>0x00660000</Address>
         <Size>0x00020000</Size>
      </Memory>
      <Memory>
         <Name>uboot</Name>
         <Type>1</Type>
         <Address>0x00700000</Address>
         <Size>0x00020000</Size>
      </Memory>
 </Memorys>
</Test>

[usbbdm]

Detect correct vendor is not important. You get it TRAO ON that is most important.
Mapping is not important yet.
Start of the flash is more important now.

You can use "peek" command to peek the address to see if it is empty or likely to be the flash. The ARM9 supports (NT) 16 bit width. If this bus is 8 bit it might not detect the flash. However it should peek the memory.
There is also a useful command which can search the memory rang to see if there is a possible flash.

Again you get DEBUG ON that is important. Do not worry about the correct vendor or memory map. If you find the beginning of the flash, then you can make segment in the flash if you want. That is still optional.

[merkin]

Look at uboot.....
It says flash is at 0xff800000

So do flshdct at that location.

Do not worry about vendor or flash xml right now. We are using cfi
Please try this first on working router. If you do not detect the flash at above location, then only usbbdm can help you. Fix the broken router with tftp and send it to him. Or just buy/make one of the thousand arm jtag that support this archtecture oob.

I can explain xml files to you, but first get flash to detect. The syntax has never been adequately explained, and any attempts implied more than described.


EDIT
Damn I hear an echo.

[LightworkerNaven]

It says DEBUG OFF now. Here's a screenshot.

You get it TRAO ON that is most important.
There is also a useful command which can search the memory rang to see if there is a possible flash.

What's TRAO ON? What's the command to search a range.

[usbbdm]

Sorry I mean DEBUG OFF.
https://forum.openwrt.org/viewtopic.php?id=13244

The processor is a Marvell Feroceon 88F5181, and not a true ARM926EJ-S. If you want to use JTAG, you need to buy or make a JTAG adapter, but DO NOT get/make an unbuffered one, like the "WRT54G De-Brick Cable" described everywhere. I use a Wiggler-type. If you want to use serial, you need a device or circuit for serial communications that operates ONLY at 3.3V:
http://wiki.openwrt.org/OpenWrtDocs/Cus ... JTAG_Cable
http://wiki.openwrt.org/OpenWrtDocs/Cus ... al_Console
http://wiki.openwrt.org/OpenWrtDocs/Har ... ear/WNR854

If it is not true ARM926EJ-S. Then there might be software change needed.

[LightworkerNaven]

Sounds good. Should I ship you one of the routers so you can add the needed support?

[usbbdm]

Looks like WRT350N V2 uses the same CPU. Maybe it is more popular.

[merkin]

Here is a stupid question.

Did you ever try speed 1 or speed 2?

Serial console says flash is at 0xff800000....nuff said.

[LightworkerNaven]

Wow! That's a pretty router. Is it new on the market? There doesn't seem to be much out there on it. It also has tamper resistant features like ercomm needs to be a t a certain offset. Sad when routers are made to prevent people tampering with the firmware... Perfectly pointless.

Here is a stupid question.

Did you ever try speed 1 or speed 2?

Serial console says flash is at 0xff800000....nuff said.

I tried speed 2 at one point, but I can't remember if I did that on the WNR854T or just the WRT54G V2. I'll try it again when I feel like rigging up individual pins. Its annoying to JTAG the thing. =P When I get these working, I'll sell them off and specialize in the WRT54G router series since you can mod them with SD Cards and USB ports among other things like fans and heat sinks that you can do with any unit that has space.

[usbbdm]

I have ordered one router from ebay and hope I can get it before new year. I will see how hard is to add this router to the support list. I might have other device to start before this router. Only thing I can say is I will start to looking into it sometime.

[LightworkerNaven]

Sounds good. Thank you.