JTAG software

Utilities and tools for networking, routers, setup etc
Post Reply
mstombs
RouterTech Team
RouterTech Team
Posts: 3753
Joined: Wed Jan 10, 2007 11:54 pm

JTAG software

Post by mstombs » Thu Nov 11, 2010 10:28 pm

The original OpenWRT HairyDairyMaid JTAG software WRT54G does work with Ti AR7 via CUSTOM configuration options using the very poormans XILINX buffered parallel port cable - see viewtopic.php?p=15363#p15363. I am still using the same cable and the same test router, but have since repaired a second ADSL2MUE and now a DG834GV3.

The WRT54G routines have been incorporated into other tools, for example Ciclamab, a Thomson Speedtouch version stjtag and Igor Mokrushin aka McMCC also created a version for Acorp pspboot routers.

The JTAG software is still in active development by Tornado on ddwrt forums as tjtag,
http://www.dd-wrt.com/phpBB2/viewtopic.php?t=22655
and it now identifies and programs many different routers and flash chips.
I have found it works fine on my routers, but only in custom mode with long command lines, so I have applied McMCC patches to the latest version tjtag3-0-1 for which source-code released, to make it more Ti AR7 friendly. I am using the Linux version under 64 bit Ubuntu, but have also compiled and using a Linux 32 bit version for example here (should be straightforward to compile the windows version...):-

To run the program in this OS you must stop a printer task grabbing the parallel port using

Code: Select all

sudo rmmod lp
Then running the tool without parameters gives this help text:-

Code: Select all

tjtag3-0-1/linux_32bit$ ./rtjtag32

==============================================
 EJTAG Debrick Utility v3.0.1 Tornado-MOD 
==============================================

 ABOUT: This program reads/writes flash memory on the WRT54G/GS and
        compatible routers via EJTAG using either DMA Access routines
        or PrAcc routines (slower/more compatible).  Processor chips
        supported in this version include the following chips:

            Supported Chips
            ---------------
            Broadcom BCM4702 Rev 1 CPU              
            Broadcom BCM4704 KPBG Rev 9 CPU         
            Broadcom BCM4704 Rev 8 CPU              
            Broadcom BCM4712 Rev 1 CPU              
            Broadcom BCM4712 Rev 2 CPU              
            Broadcom BCM4716 Rev 1 CPU              
            Broadcom BCM4785 Rev 1 CPU              
            Broadcom BCM5350 Rev 1 CPU              
            Broadcom BCM5352 Rev 1 CPU              
            Broadcom BCM5354 KFBG Rev 1 CPU         
            Broadcom BCM5354 KFBG Rev 2 CPU         
            Broadcom BCM5354 KFBG Rev 3 CPU         
            Broadcom BCM3345 KPB Rev 1 CPU          
            Broadcom BCM5365 Rev 1 CPU              
            Broadcom BCM5365 Rev 1 CPU              
            Broadcom BCM6345 Rev 1 CPU              
            Broadcom BCM6348 Rev 1 CPU              
            Broadcom BCM6338 Rev 1 CPU              
            Broadcom BCM6358 Rev 1 CPU              
            Broadcom BCM6368 Rev 1 CPU              
            Broadcom BCM4321 RADIO STOP             
            Broadcom BCM4321L RADIO STOP            
            TI AR7 TNETD7x00 Rev 1 CPU              
            BRECIS MSP2007-CA-A1 CPU                
            TI TNETV1060GDW CPU                     
            Linkstation 2 with RISC K4C chip        
            Atheros AR531X/231X CPU                 
            XScale IXP42X 266mhz                    
            XScale IXP42X 400mhz                    
            XScale IXP42X 533mhz                    
            ARM 940T                                
            Marvell Feroceon 88F5181                
            LX4380                                  


 USAGE: tjtag [parameter] </noreset> </noemw> </nocwd> </nobreak> </noerase>
                      </notimestamp> </dma> </nodma>
                      <start:XXXXXXXX> </length:XXXXXXXX>
                      </silent> </skipdetect> </instrlen:XX> </fc:XX> /bypass /st5

            Required Parameter
            ------------------
            -backup:cfe
            -backup:nvram
            -backup:kernel
            -backup:wholeflash
            -backup:custom
            -backup:bsp
            -erase:cfe
            -erase:nvram
            -erase:kernel
            -erase:wholeflash
            -erase:custom
            -erase:bsp
            -flash:cfe
            -flash:nvram
            -flash:kernel
            -flash:wholeflash
            -flash:custom
            -flash:bsp
            -probeonly
            -probeonly:custom
 and for Ti AR7 
            -backup:mtd2
            -backup:mtd3
            -backup:mtd4
            -backup:full
            -erase:mtd2
            -erase:mtd3
            -erase:mtd4
            -erase:full
            -flash:mtd2
            -flash:mtd3
            -flash:mtd4
            -flash:full

		 Optional with -backup:, -erase:, -flash: wgrv8bdata, wgrv9bdata, cfe128

            Optional Switches
            -----------------
            /noreset ........... prevent Issuing EJTAG CPU reset
            /noemw ............. prevent Enabling Memory Writes
            /nocwd ............. prevent Clearing CPU Watchdog Timer
            /nobreak ........... prevent Issuing Debug Mode JTAGBRK
            /noerase ........... prevent Forced Erase before Flashing
            /notimestamp ....... prevent Timestamping of Backups
            /dma ............... force use of DMA routines
            /nodma ............. force use of PRACC routines (No DMA)
            /window:XXXXXXXX ... custom flash window base (in HEX)
            /start:XXXXXXXX .... custom start location (in HEX)
            /length:XXXXXXXX ... custom length (in HEX)
            /silent ............ prevent scrolling display of data
            /skipdetect ........ skip auto detection of CPU Chip ID
            /instrlen:XX ....... set instruction length manually
            /wiggler ........... use wiggler cable
            /bypass ............ Unlock Bypass command & disable polling
            /st5 ............... Use Speedtouch ST5xx flash routines instead of WRT routines
            /reboot............. sets the process and reboots
		 /swap_endian........ swap endianess during backup - most Atheros based routers
		 /flash_debug........ flash chip debug messages, show flash MFG and Device ID

            /fc:XX = Optional (Manual) Flash Chip Selection
            -----------------------------------------------
            /fc:01 ............. MX29LV800BTC 512kx16 TopB  (1MB)        
            /fc:02 ............. MX29LV800BTC 512kx16 BotB  (1MB)        
            /fc:03 ............. AMD 29lv160DB 1Mx16 BotB   (2MB)        
            /fc:04 ............. AMD 29lv160DT 1Mx16 TopB   (2MB)        
            /fc:05 ............. EON EN29LV160A 1Mx16 BotB  (2MB)        
            /fc:06 ............. EON EN29LV160A 1Mx16 TopB  (2MB)        
            /fc:07 ............. MBM29LV160B 1Mx16 BotB     (2MB)        
            /fc:08 ............. MBM29LV160T 1Mx16 TopB     (2MB)        
            /fc:09 ............. MX29LV160CB 1Mx16 BotB     (2MB)        
            /fc:10 ............. MX29LV160CT 1Mx16 TopB     (2MB)        
            /fc:11 ............. K8D1716UTC  1Mx16 TopB     (2MB)        
            /fc:12 ............. K8D1716UBC  1Mx16 BotB     (2MB)        
            /fc:13 ............. ST M29W160EB 1Mx16 BotB    (2MB)        
            /fc:14 ............. ST M29W160ET 1Mx16 TopB    (2MB)        
            /fc:15 ............. Macronix MX25L160A         (2MB) Serial 
            /fc:16 ............. Atmel AT45DB161B           (2MB) Serial 
            /fc:17 ............. Atmel AT45DB161B           (2MB) Serial 
            /fc:18 ............. K8D3216UTC  2Mx16 TopB     (4MB)        
            /fc:19 ............. K8D3216UBC  2Mx16 BotB     (4MB)        
            /fc:20 ............. Macronix MX25L1605D        (2MB) Serial 
            /fc:21 ............. Macronix MX25L3205D        (4MB) Serial 
            /fc:22 ............. Macronix MX25L6405D        (8MB) Serial 
            /fc:23 ............. STMicro M25P16             (2MB) Serial 
            /fc:24 ............. STMicro M25P32             (4MB) Serial 
            /fc:25 ............. STMicro M25P64             (8MB) Serial 
            /fc:26 ............. STMicro M25P128           (16MB) Serial 
            /fc:27 ............. AMD 29lv320MB 2Mx16 BotB   (4MB)        
            /fc:28 ............. AMD 29lv320MT 2Mx16 TopB   (4MB)        
            /fc:29 ............. AMD 29lv320MT 2Mx16 TopB   (4MB)        
            /fc:30 ............. TC58FVB321 2Mx16 BotB      (4MB)        
            /fc:31 ............. TC58FVT321 2Mx16 TopB      (4MB)        
            /fc:32 ............. AT49BV/LV16X 2Mx16 BotB    (4MB)        
            /fc:33 ............. AT49BV/LV16XT 2Mx16 TopB   (4MB)        
            /fc:34 ............. MBM29DL323BE 2Mx16 BotB    (4MB)        
            /fc:35 ............. MBM29DL323TE 2Mx16 TopB    (4MB)        
            /fc:36 ............. AMD 29lv320DB 2Mx16 BotB   (4MB)        
            /fc:37 ............. AMD 29lv320DT 2Mx16 TopB   (4MB)        
            /fc:38 ............. MBM29LV320BE 2Mx16 BotB    (4MB)        
            /fc:39 ............. MBM29LV320TE 2Mx16 TopB    (4MB)        
            /fc:40 ............. MX29LV320B 2Mx16 BotB      (4MB)        
            /fc:41 ............. MX29LV320B 2Mx16 BotB      (4MB)        
            /fc:42 ............. MX29LV320T 2Mx16 TopB      (4MB)        
            /fc:43 ............. MX29LV320T 2Mx16 TopB      (4MB)        
            /fc:44 ............. ST 29w320DB 2Mx16 BotB     (4MB)        
            /fc:45 ............. ST 29w320DT 2Mx16 TopB     (4MB)        
            /fc:46 ............. MX29LV640B 4Mx16 TopB     (16MB)        
            /fc:47 ............. MX29LV640B 4Mx16 BotB     (16MB)        
            /fc:48 ............. W19B(L)320ST   2Mx16 TopB  (4MB)        
            /fc:49 ............. W19B(L)320SB   2Mx16 BotB  (4MB)        
            /fc:50 ............. W19B(L)320SB   2Mx16 BotB  (4MB)        
            /fc:51 ............. M29DW324DT 2Mx16 TopB      (4MB)        
            /fc:52 ............. M29DW324DB 2Mx16 BotB      (4MB)        
            /fc:53 ............. TC58FVM6T2A  4Mx16 TopB    (8MB)        
            /fc:54 ............. TC58FVM6B2A  4Mx16 BopB    (8MB)        
            /fc:55 ............. K8D6316UTM  4Mx16 TopB     (8MB)        
            /fc:56 ............. K8D6316UBM  4Mx16 BotB     (8MB)        
            /fc:57 ............. Intel 28F160B3 1Mx16 BotB  (2MB)        
            /fc:58 ............. Intel 28F160B3 1Mx16 TopB  (2MB)        
            /fc:59 ............. Intel 28F160C3 1Mx16 BotB  (2MB)        
            /fc:60 ............. Intel 28F160C3 1Mx16 TopB  (2MB)        
            /fc:61 ............. Intel 28F320B3 2Mx16 BotB  (4MB)        
            /fc:62 ............. Intel 28F320B3 2Mx16 TopB  (4MB)        
            /fc:63 ............. Intel 28F320C3 2Mx16 BotB  (4MB)        
            /fc:64 ............. Intel 28F320C3 2Mx16 TopB  (4MB)        
            /fc:65 ............. Sharp 28F320BJE 2Mx16 BotB (4MB)        
            /fc:66 ............. Intel 28F640B3 4Mx16 BotB  (8MB)        
            /fc:67 ............. Intel 28F640B3 4Mx16 TopB  (8MB)        
            /fc:68 ............. Intel 28F640C3 4Mx16 BotB  (8MB)        
            /fc:69 ............. Intel 28F640C3 4Mx16 TopB  (8MB)        
            /fc:70 ............. Intel 28F160S3/5 1Mx16     (2MB)        
            /fc:71 ............. Intel 28F320J3 2Mx16       (4MB)        
            /fc:72 ............. Intel 28F320J5 2Mx16       (4MB)        
            /fc:73 ............. Intel 28F320S3/5 2Mx16     (4MB)        
            /fc:74 ............. Intel 28F640J3 4Mx16       (8MB)        
            /fc:75 ............. Intel 28F640J5 4Mx16       (8MB)        
            /fc:76 ............. Intel 28F128J3 8Mx16      (16MB)        
            /fc:77 ............. SST39VF1601 1Mx16 BotB     (2MB)        
            /fc:78 ............. SST39VF1602 1Mx16 TopB     (2MB)        
            /fc:79 ............. SST39VF3201 2Mx16 BotB     (4MB)        
            /fc:80 ............. SST39VF3202 2Mx16 TopB     (4MB)        
            /fc:81 ............. SST39VF6401 4Mx16 BotB     (8MB)        
            /fc:82 ............. SST39VF6402 4Mx16 TopB     (8MB)        
            /fc:83 ............. SST39VF6401B 4Mx16 BotB    (8MB)        
            /fc:84 ............. SST39VF6402B 4Mx16 TopB    (8MB)        
            /fc:85 ............. Spansion S29GL032M BotB    (4MB)        
            /fc:86 ............. Spansion S29GL032M TopB    (4MB)        
            /fc:87 ............. Spansion S29GL064M BotB    (8MB)        
            /fc:88 ............. Spansion S29GL064M TopB    (8MB)        
            /fc:89 ............. Spansion S29GL064M U       (8MB)        
            /fc:90 ............. Spansion S29GL128P U      (16MB)        
            /fc:91 ............. Spansion S29GL128M U      (16MB)        
            /fc:92 ............. Spansion S29GL256P U      (32MB)        
            /fc:93 ............. Spansion S29GL512P U      (64MB)        
            /fc:94 ............. Spansion S29GL01GP U     (128MB)        
            /fc:95 ............. Spansion S25FL016A         (2MB) Serial 
            /fc:96 ............. Spansion S25FL032A         (4MB) Serial 
            /fc:97 ............. Spansion S25FL064A         (8MB) Serial 
            /fc:98 ............. Winbond W19B320AB BotB     (4MB)        
            /fc:99 ............. Winbond W19B320AT TopB     (4MB)        
            /fc:100 ............. Winbond W25X32             (4MB) Serial 
            /fc:101 ............. Winbond W25X64             (8MB) Serial 
            /fc:102 ............. EON EN29LV320 2Mx16 BotB   (4MB)        
            /fc:103 ............. EON EN29LV320 2Mx16 TopB   (4MB)        
            /fc:104 ............. EON EN29LV640 4Mx16 TopB   (8MB)        
            /fc:105 ............. EON EN29LV640 4Mx16 BotB   (8MB)        
            /fc:106 ............. AT49BV322A 2Mx16 BotB      (4MB)        
            /fc:107 ............. AT49BV322A(T) 2Mx16 TopB   (4MB)        


 NOTES: 1) If 'flashing' - the source filename must exist as follows:
           CFE.BIN, NVRAM.BIN, KERNEL.BIN, WHOLEFLASH.BIN or CUSTOM.BIN
           BSP.BIN

...........or for Ti AR7 MTD2.BIN, MTD3.BIN

        2) If you have difficulty auto-detecting a particular flash part
           you can manually specify your exact part using the /fc:XX option.

        3) If you have difficulty with the older bcm47xx chips or when no CFE
           is currently active/operational you may want to try both the
           /noreset and /nobreak command line options together.  Some bcm47xx
           chips *may* always require both these options to function properly.

        4) When using this utility, usually it is best to type the command line
           out, then plug in the router, and then hit <ENTER> quickly to avoid
           the CPUs watchdog interfering with the EJTAG operations.

        5) /bypass - enables Unlock bypass command for some AMD/Spansion type
           flashes, it also disables polling

 ***************************************************************************
 * Flashing the KERNEL or WHOLEFLASH will take a very long time using JTAG *
 * via this utility.  You are better off flashing the CFE & NVRAM files    *
 * & then using the normal TFTP method to flash the KERNEL via ethernet.   *
 ***************************************************************************
and you can see the AR7 bits I added. Note mtd4 and FULL access is also programmed, it should adjust to the flash chip size but not yet tested - too slow to be any use?

NOTE mtd3 is the PSPBOOT config, not the adam2 one which is at the end of the flash memory.

This version of the software will detect the Ti AR7 CPU and look in the correct place for the flash chip so few extra params needed - note "sudo" required to run this as root under Ubuntu.

Code: Select all

tjtag3-0-1/linux_32bit$ sudo ./rtjtag32 -probeonly 

==============================================
 EJTAG Debrick Utility v3.0.1 Tornado-MOD 
==============================================

Probing bus ... Done

Instruction Length set to 5

CPU Chip ID: 00000000000000000001000000001111 (0000100F)
*** Found a TI AR7 TNETD7x00 Rev 1 CPU chip ***

    - EJTAG IMPCODE ....... : 01000001010000000100000000000000 (41404000)
    - EJTAG Version ....... : 2.6
    - EJTAG DMA Support ... : No
    - EJTAG Implementation flags: R4k DINTsup ASID_8 NoDMA MIPS32

Issuing Processor / Peripheral Reset ... Done
Enabling Memory Writes ... Skipped
Halting Processor ... <Processor Entered Debug Mode!> ... Done
Clearing Watchdog ... Done

Probing Flash at (Flash Window: 0x90000000) ... 
Done

Flash Vendor ID: 00000000000000000000000011000010 (000000C2)
Flash Device ID: 00000000000000000010001010101000 (000022A8)
*** Found a MX29LV320B 2Mx16 BotB      (4MB) Flash Chip ***

    - Flash Chip Window Start .... : 90000000
    - Flash Chip Window Length ... : 00400000
    - Selected Area Start ........ : 00000000
    - Selected Area Length ....... : 00000000



 *** REQUESTED OPERATION IS COMPLETE ***
You can backup the bootloader mtd2 with

Code: Select all

tjtag3-0-1/linux_32bit$ sudo ./rtjtag32 -backup:mtd2

==============================================
 EJTAG Debrick Utility v3.0.1 Tornado-MOD 
==============================================

Probing bus ... Done

Instruction Length set to 5

CPU Chip ID: 00000000000000000001000000001111 (0000100F)
*** Found a TI AR7 TNETD7x00 Rev 1 CPU chip ***

    - EJTAG IMPCODE ....... : 01000001010000000100000000000000 (41404000)
    - EJTAG Version ....... : 2.6
    - EJTAG DMA Support ... : No
    - EJTAG Implementation flags: R4k DINTsup ASID_8 NoDMA MIPS32

Issuing Processor / Peripheral Reset ... Done
Enabling Memory Writes ... Skipped
Halting Processor ... <Processor Entered Debug Mode!> ... Done
Clearing Watchdog ... Done

Probing Flash at (Flash Window: 0x90000000) ... 
Done

Flash Vendor ID: 00000000000000000000000011000010 (000000C2)
Flash Device ID: 00000000000000000010001010101000 (000022A8)
*** Found a MX29LV320B 2Mx16 BotB      (4MB) Flash Chip ***

    - Flash Chip Window Start .... : 90000000
    - Flash Chip Window Length ... : 00400000
    - Selected Area Start ........ : 90000000
    - Selected Area Length ....... : 00010000

*** You Selected to Backup the MTD2.BIN ***

=========================
Backup Routine Started
=========================

Saving MTD2.BIN.SAVED_20101111_204505 to Disk...
[  0% Backed Up]   90000000: 40809000 40809800 401a6000 241bfffe
...
[ 99% Backed Up]   9000fff0: ffffffff ffffffff ffffffff ffffffff
Done  (MTD2.BIN.SAVED_20101111_204505 saved to Disk OK)

bytes written: 65536
=========================
Backup Routine Complete
=========================
elapsed time: 110 seconds


 *** REQUESTED OPERATION IS COMPLETE ***
Note the datetime coded save file

You can backup the config with

Code: Select all

tjtag3-0-1/linux_32bit$ sudo ./rtjtag32 -backup:mtd3

==============================================
 EJTAG Debrick Utility v3.0.1 Tornado-MOD 
==============================================

Probing bus ... Done

Instruction Length set to 5

CPU Chip ID: 00000000000000000001000000001111 (0000100F)
*** Found a TI AR7 TNETD7x00 Rev 1 CPU chip ***

    - EJTAG IMPCODE ....... : 01000001010000000100000000000000 (41404000)
    - EJTAG Version ....... : 2.6
    - EJTAG DMA Support ... : No
    - EJTAG Implementation flags: R4k DINTsup ASID_8 NoDMA MIPS32

Issuing Processor / Peripheral Reset ... Done
Enabling Memory Writes ... Skipped
Halting Processor ... <Processor Entered Debug Mode!> ... Done
Clearing Watchdog ... Done

Probing Flash at (Flash Window: 0x90000000) ... 
Done

Flash Vendor ID: 00000000000000000000000011000010 (000000C2)
Flash Device ID: 00000000000000000010001010101000 (000022A8)
*** Found a MX29LV320B 2Mx16 BotB      (4MB) Flash Chip ***

    - Flash Chip Window Start .... : 90000000
    - Flash Chip Window Length ... : 00400000
    - Selected Area Start ........ : 90010000
    - Selected Area Length ....... : 00010000

*** You Selected to Backup the MTD3.BIN ***

=========================
Backup Routine Started
=========================

Saving MTD3.BIN.SAVED_20101111_205029 to Disk...
[  0% Backed Up]   90010000: 4e454954 382e3056 ffffff00 ffffffff
...
[ 99% Backed Up]   9001fff0: ffffffff ffffffff ffffffff ffffffff
Done  (MTD3.BIN.SAVED_20101111_205029 saved to Disk OK)

bytes written: 65536
=========================
Backup Routine Complete
=========================
elapsed time: 110 seconds
or write a new bootloader from file MTD2.BIN with

Code: Select all

tjtag3-0-1$ sudo ./rtjtag64 -flash:mtd2

==============================================
 EJTAG Debrick Utility v3.0.1 Tornado-MOD 
==============================================

Probing bus ... Done

Instruction Length set to 5

CPU Chip ID: 00000000000000000001000000001111 (0000100F)
*** Found a TI AR7 TNETD7x00 Rev 1 CPU chip ***

    - EJTAG IMPCODE ....... : 01000001010000000100000000000000 (41404000)
    - EJTAG Version ....... : 2.6
    - EJTAG DMA Support ... : No
    - EJTAG Implementation flags: R4k DINTsup ASID_8 NoDMA MIPS32

Issuing Processor / Peripheral Reset ... Done
Enabling Memory Writes ... Skipped
Halting Processor ... <Processor Entered Debug Mode!> ... Done
Clearing Watchdog ... Done

Probing Flash at (Flash Window: 0x90000000) ... 
Done

Flash Vendor ID: 00000000000000000000000011000010 (000000C2)
Flash Device ID: 00000000000000000010001010101000 (000022A8)
*** Found a MX29LV320B 2Mx16 BotB      (4MB) Flash Chip ***

    - Flash Chip Window Start .... : 90000000
    - Flash Chip Window Length ... : 00400000
    - Selected Area Start ........ : 90000000
    - Selected Area Length ....... : 00010000

*** You Selected to Flash the MTD2.BIN ***

=========================
Flashing Routine Started
=========================
Total Blocks to Erase: 8

Erasing block: 1 (addr = 90000000)...Done
Erasing block: 2 (addr = 90002000)...Done
Erasing block: 3 (addr = 90004000)...Done
Erasing block: 4 (addr = 90006000)...Done
Erasing block: 5 (addr = 90008000)...Done
Erasing block: 6 (addr = 9000a000)...Done
Erasing block: 7 (addr = 9000c000)...Done
Erasing block: 8 (addr = 9000e000)...Done

Loading MTD2.BIN to Flash Memory...
[  0% Flashed]   90000000: 40809000 40809800 401a6000 241bfffe
...
[ 99% Flashed]   9000fff0: ffffffff ffffffff ffffffff ffffffff
Done  (MTD2.BIN loaded into Flash Memory OK)

=========================
Flashing Routine Complete
=========================
elapsed time: 1056 seconds


 *** REQUESTED OPERATION IS COMPLETE ***
if it works for you then please thank Tornado - if i broke it, sorry, I'll try to fix - but no guarantees!

Please see original download for documentation - I've not updated it, Windoze port to follow
Attachments
tjtag3-0-1RT.zip
Mod to dd-wrt Tornado's tjtag program for better support of Ti AR7 routers Linux source and pre-compiled binaries only
(70.91 KiB) Downloaded 1469 times
mstombs
RouterTech Team
RouterTech Team
Posts: 3753
Joined: Wed Jan 10, 2007 11:54 pm

Re: JTAG software

Post by mstombs » Fri Nov 12, 2010 10:19 am

And this a version compiled with MS Studio 2003 on XP.
Needed a couple of missing header files, and minor change to c routine to compile with "cl"

Usage: see original docs, must first load and activate giveio.sys using Loaddrv.exe

basic check it works:-

Code: Select all

C:\Downloads\tjtag3-0-1\Windows32>rtjtagwin32.exe -probeonly

==============================================
 EJTAG Debrick Utility v3.0.1 Tornado-MOD
==============================================

Probing bus ... Done

Instruction Length set to 5

CPU Chip ID: 00000000000000000001000000001111 (0000100F)
*** Found a TI AR7 TNETD7x00 Rev 1 CPU chip ***

    - EJTAG IMPCODE ....... : 01000001010000000100000000000000 (41404000)
    - EJTAG Version ....... : 2.6
    - EJTAG DMA Support ... : No
    - EJTAG Implementation flags: R4k DINTsup ASID_8 NoDMA MIPS32

Issuing Processor / Peripheral Reset ... Done
Enabling Memory Writes ... Skipped
Halting Processor ... <Processor Entered Debug Mode!> ... Done
Clearing Watchdog ... Done

Probing Flash at (Flash Window: 0x90000000) ...
Done

Flash Vendor ID: 00000000000000000000000011000010 (000000C2)
Flash Device ID: 00000000000000000010001010101000 (000022A8)
*** Found a MX29LV320B 2Mx16 BotB      (4MB) Flash Chip ***

    - Flash Chip Window Start .... : 90000000
    - Flash Chip Window Length ... : 00400000
    - Selected Area Start ........ : 00000000
    - Selected Area Length ....... : 00000000



 *** REQUESTED OPERATION IS COMPLETE ***

Code: Select all

C:\Downloads\tjtag3-0-1\Windows32>rtjtagwin32.exe -backup:mtd3
...

...
[ 99% Backed Up]   9001fff0: ffffffff ffffffff ffffffff ffffffff
Done  (MTD3.BIN.SAVED_20101112_092054 saved to Disk OK)

bytes written: 65536
=========================
Backup Routine Complete
=========================
elapsed time: 167 seconds


 *** REQUESTED OPERATION IS COMPLETE ***
Attachments
tjtag3-0-1.zip
Windows XP version of Ti AR7 modded tjtagV3.01
(100.13 KiB) Downloaded 2011 times
Post Reply