• Visit https://www.embeddedcomputers.net/ for Hardware; Software and all other things related to FlashcatUSB

Problem flashing WRT54GS v4.0

mikasi

mikasi

New Member
I have Linksys WRT54GS v4.0 router that I would like to bring back to life after bricking it while unsuccessfully tried to upgrade OpenWrt firmware.

For that purpose I've bought FlashcatUSB v1.8 board since I was sure, according to good reviews, that there will be no problems doing that.

But, as I am apparently not that fortunate, there are problems...

1.) As instructed by manual I have flashed FlashcatUSB with FCUSB.7.05.EJTAG_32K.hex firmware first.
2.) Then I have connected FlashcatUSB to the JTAG header pins
3.) After restarting FlashcatUSB application a wrong version detection of WRT54GS router was made (version with 2 MB of flash was detected instead of the one with 4 MB of flash). For that I have adapted Autorun.ini file to load my own JTAG script file named WRT54GS_4M_JTAG.bcs which I derived from WRT54GS_2M_JTAG.bcs.
4.) From now on I am able to read all parts of software CFE, Kernel and NVRAM, but not able to write anything back, not even the binary that was read only a minute ago.

Looking at the FlashcatUSB console output I assume there must be something wrong with the CFI memory initialization.


Initialization ...

LibUsbDotNet version: 2.2.8.104
FlashcatUSB Script Engine build: 202
Welcome to FlashcatUSB interfacing software, build: 330
Running on: Microsoft Windows 7 Ultimate (32 bit)
Initializing EJTAG engine
Device connected in JTAG mode: 7,05
JTAG: IR length set to 8
JTAG engine setup successfully
Detected CPU ID: 0x535217F IMP CODE: 0x800904
Manufacturer ID: 0xBF Part ID: 0x5352
EJTAG Version support: 2.0
Target device supports DMA mode
Checking for a device specific script to automatically load
Loading device specific script: WRT54GS_4M_JTAG.bcs
Loading script: WRT54GS_4M_JTAG.bcs
Setting device parameter (Intel Flash delay) to 0x32
Setting device parameter (AMD Flash delay) to 0xC8
Setting device parameter (Memory Read Delay) to 0x32
MemoryInit: Failed - device parameters failed Init

I suppose CFI device initialization should look something like the one on http://blackcatusb.net/index.php?threads/linksys-wrt54gs_2m.79/ where flash description is clearly indicated.


Reading NVRAM is somewhat successful I guess ...

Button Hander::Calling Event: ReadNVRAM
Beginning memory read from DRAM
Start address: 536805376 (0x1FFF0000) Length: 65536
Read operation complete
Read 65536 bytes in 0,794 seconds, 82.852 Bytes/s
Beginning memory read from DRAM
Start address: 536805376 (0x1FFF0000) Length: 65536
Read operation complete
Read 65536 bytes in 0,794 seconds, 82.852 Bytes/s
Data saved. 65536 bytes written
Button Hander::Calling Event: Done


But writing the same NVRAM back is not successful ...

Button Hander::Calling Event: WriteNVRAM
Unable to write data to flash device (out of bounds)
Canceled memory write operation
Button Hander::Calling Event: Done


My flash device is Intel TE28F320C3BD90 and should be supported according to the device list on http://blackcatusb.net/index.php?threads/supported-flashes.1/.

I am completely baffled and do not know what to do next. If you have any clue on how to adapt my JTAG script file and/or do something else to be successful the please let me know.


Best regards,
Mitja
 
I have the same issue your are having, except I'm using a WRT54GS v1.0 which has a 8MB Flash which I totally bricked.

Since I have a very old blackcat usb device (1.2), the only difference between your steps and mine is that I have flashed mine with the FCUSB.7.05.EJTAG 16K.hex. I have also adapted/modified one script to serve this WRT54GS 1.0 model. Posting here my log so I don't have to create another thread with the exact same problem you are going through.

Code: 
LibUsbDotNet version: 2.2.8.104
FlashcatUSB Script Engine build: 202
Welcome to FlashcatUSB interfacing software, build: 330
Running on: Microsoft Windows 7 Ultimate  (32 bit)
Initializing EJTAG engine
Device connected in JTAG mode: 7.05
JTAG: IR length set to 8
JTAG engine setup successfully
Detected CPU ID: 0x1471217F IMP CODE: 0x800904
Manufacturer ID: 0xBF Part ID: 0x4712
EJTAG Version support: 2.0
Target device supports DMA mode
Checking for a device specific script to automatically load
Loading device specific script: WRT54GS_8M_JTAG.bcs
Loading script: WRT54GS_8M_JTAG.bcs
Setting device parameter (Intel Flash delay) to 0x32
Setting device parameter (AMD Flash delay) to 0xC8
Setting device parameter (Memory Read Delay) to 0x32
MemoryInit: Failed - device parameters failed Init

The flash IC is an Intel TE28F640 J3C120 which should also be supported as well.

I wish I knew someone with an old computer (with an LPT Parallel port) so I could also test with the LPT blackcat.

Any help is appreciated!
 
The FCUSB is not good at all for recovering bricked devices unless you have a flash detection , did you get a flash detection when you used the 2MB script ?
I setup a script ages ago for 4m and 8m devices but unles you have a flash detection they will not work.
 

Attachments

  • WRT54G_4M_JTAG.bcs
    4.2 KB · Views: 11
Actually having the same issue, was it ever found out what the issue was? I am able to read the entire flash chip but it wont allow for any writes.

This is the serial output of the boot process, it freezes there.
Code: 
CFE version 1.0.37 for BCM947XX (32bit,SP,LE)
Build Date: Thu Mar 24 16:31:45 CST 2005 (motoplayer@cvs.gemtek.com.tw)
Copyright (C) 2000,2001,2002,2003 Broadcom Corporation.

Initializing Arena
Initializing Devices.
CPU type 0x29008: 200MHz
Total memory: 8192 KBytes

Total memory used by CFE:  0x80300000 - 0x80399700 (628480)
Initialized Data:          0x8032F870 - 0x80331F50 (9952)
BSS Area:                  0x80331F50 - 0x80333700 (6064)
Local Heap:                0x80333700 - 0x80397700 (409600)
Stack Area:                0x80397700 - 0x80399700 (8192)
Text (code) segment:       0x80300000 - 0x8032F870 (194672)
Boot area (physical):      0x0039A000 - 0x003DA000
Relocation Factor:         I:00000000 - D:00000000

Reading :: Failed.: Error
Loader:raw Filesys:raw Dev:flash0.os File: Options:(null)
Loading: .. 3916 bytes read
Entry at 0x80001000
Starting program at 0x80001000
 
whatnot said:
Actually having the same issue, was it ever found out what the issue was? I am able to read the entire flash chip but it wont allow for any writes.

This is the serial output of the boot process, it freezes there.
Code: 
CFE version 1.0.37 for BCM947XX (32bit,SP,LE)
Build Date: Thu Mar 24 16:31:45 CST 2005 (motoplayer@cvs.gemtek.com.tw)
Copyright (C) 2000,2001,2002,2003 Broadcom Corporation.

Initializing Arena
Initializing Devices.
CPU type 0x29008: 200MHz
Total memory: 8192 KBytes

Total memory used by CFE:  0x80300000 - 0x80399700 (628480)
Initialized Data:          0x8032F870 - 0x80331F50 (9952)
BSS Area:                  0x80331F50 - 0x80333700 (6064)
Local Heap:                0x80333700 - 0x80397700 (409600)
Stack Area:                0x80397700 - 0x80399700 (8192)
Text (code) segment:       0x80300000 - 0x8032F870 (194672)
Boot area (physical):      0x0039A000 - 0x003DA000
Relocation Factor:         I:00000000 - D:00000000

Reading :: Failed.: Error
Loader:raw Filesys:raw Dev:flash0.os File: Options:(null)
Loading: .. 3916 bytes read
Entry at 0x80001000
Starting program at 0x80001000
Click to expand...

Are you getting an ID on the FCUSB software and does it read the whole flash ?
 
You must log in or register to reply here.
Back
Top