Bicephale
join:2005-09-24
 ·TekSavvy Solutions..
1 edit |  Thomson SpeedTouch 5x6 & 585 EJTAG "De-Brick" Access
Any new anecdotes about one of these?:
ST516v6 Components Side
ST516v6 Solder Side
ST546v6 Components Side
ST546v6 Solder Side
ST585iv6 Components Side |
|
diskace
Ebox Senior
Premium,VIP
join:2002-02-21 | what is the subject ?
--
Electronic Box Inc. |
|
Bicephale
join:2005-09-24
·TekSavvy Solutions..
| Hi DiskAce,
My subject is in the title, i thought it was clear
enough for the average reader: Thomson SpeedTouch
5x6 & 585 EJTAG "De-Brick" Access. Here's another
hint: HairyDairyMaid is likely to work with this:
Feel free to contribute with some feedback if any!
 |
|
diskace
Ebox Senior
Premium,VIP
join:2002-02-21
1 edit | Hi bicephale, does the JTAG interface only interact with the BCM chipset ? I thought JTAG was for the entire circuit board.
What are you trying to do ?
--
Electronic Box Inc. |
|
Bicephale
join:2005-09-24
·TekSavvy Solutions..
| Hi DiskAce,
I didn't have much time to browse around but if we
can assume that the PinOut information & suggested
interface are correct it means the JTAG feature of
the BCM6348 ChipSet is now available. The archive
which this site links to must be renamed as a .RAR
file. The file inside got no extension but that's
one more .RAR file, apparently, and it extracts as
'HairyDairyMaid_WRT54G_Debrick_Utility_v48'... It
seems what we have here is a 'WRT54G EJTAG DeBrick
Utility' under the form of Linux source code and a
set of Windows binaries. I'd suggest you refer to
'ReadMe.Txt' for details about the supported FLASH
chips, etc... As i wrote in my opening message, i
wanted to read anecdotes from others, not to write
my own! Look at 'jtag-hairydairymaid.png', that's
some 12 pins JTAG Connector in the LinkSys WRT54G;
a .PDF guide is also provided that shows where the
'TRST' pin should go when someone tries to build a
generic JTAG cable. There are passages about some
BCM94710 chip, it also shows two possible layouts:
a VisionIce 14 pins JTAG header or a 12 pins EJTAG
one. My SpeedTouch's BCM chip may use a different
PinOut and yet remain electrically compatible with
the interface described by this document, i guess.
If we're able to backup and restore the FLASH chip
that means we can effectively "De-Brick" our ST5x6
device instead of throwing it away in case of some
incident. During the late storm, for example, the
power outages caused my ST546 to switch to "BootP"
mode. What else could have happened, i wonder but
in another six months i may be able to fix that if
there's a FLASH image file handy. So, i'm curious
to see who was tempted to be the 1st guinea pig so
far since i'd bet others found out before i did...
 |
|
diskace
Ebox Senior
Premium,VIP
join:2002-02-21
1 edit | According to the readme the BCM6348 JTAG support is implemented in the V4.4. I am not sure whether or not the ST780WLi use the BCM6348 chipset but i will try later on this week to make a JTAG connector.
On your side, i would suggest to work on the 546. Pretty sure you will find more informations on their forum »www.f-x.fr/forum/index.php (French) for compatibility with the 546.
BTW the .zip extension is working here.
--
Electronic Box Inc. |
|
Bicephale
join:2005-09-24
·TekSavvy Solutions..
| Hi DiskAce,
Well, i've found discrepancies already. One ST516
picture to which i linked shows the 4 pins 3 Volts
Console pads and the 14 pins "De-Brick" access but
the European site appears to exchange them! There
is a way to make sure which is which, it happens a
scope trace is included that strongly suggests the
TTL serial port is reached via some of the 14 pins
instead of the four ones but the coulours from the
French text don't match with those on the picture;
unless their orange and my yellow are the same and
both would correspond to pin #8, that is... If it
is so, pin #1 is Tx, pin #4 is Rx, pin #8 is power
(+3.3 Volts) and pin #7 is gound (0 Volts). Also,
they have a 12 pins header were i expected to find
a 14 pins one so i conclude caution is required...
On the ST546 picture, closing up on J3 and J6 will
not allow me to follow signal paths and this means
i'd need to open mine to take even closer shots or
i won't be able to tell where the EJTAG plug goes.
Moreover, the chipset on the ST546 photograph will
be a BroadCom BCM6338, its PinOut may differ quite
radically! I conclude more caution is required!!!
 |
|
Bicephale
join:2005-09-24
·TekSavvy Solutions..
| reply to diskace
BroadCom BCM6338 - EEtChina, 2005-Nov (0511A_DC_S11F1) |
This is an update to share what i've found so far.
 |
|
Bicephale
join:2005-09-24 | reply to Bicephale
OpenWRT page (ST585) |
|
Bicephale
join:2005-09-24 | reply to Bicephale
Feed me! |
|
chaveiro
join:2007-12-06
3 edits | reply to Bicephale
Hello,
I've been able to backup my speedtouch 585 v6 with jtag tool.
Looking for CFE, kernel and nvram from unlocked 585 v6.
This router has custom firmware (AL) from my isp (Sapo from PT) that as no suport nor updated firmware and bootloader does not accept current versions.
If you have a regular 585v6 (software version AA)send me CFE backup !!!
wrt54g.exe -probeonly
====================================
WRT54G/GS EJTAG Debrick Utility v4.8
====================================
Probing bus ... Done
Instruction Length set to 5
CPU Chip ID: 00000110001101001000000101111111 (0634817F)
*** Found a Broadcom BCM6348 Rev 1 CPU chip ***
- EJTAG IMPCODE ....... : 00000000100000000000100100000100 (00800904)
- EJTAG Version ....... : 1 or 2.0
- EJTAG DMA Support ... : Yes
Issuing Processor / Peripheral Reset ... Done
Enabling Memory Writes ... Done
Halting Processor ... ... Done
Clearing Watchdog ... Done
Probing Flash at (Flash Window: 0x1fc00000) ... Done
Flash Vendor ID: 00000000000000000000000000000001 (00000001)
Flash Device ID: 00000000000000000010001000000000 (00002200)
*** Found a AMD 29lv320MB 2Mx16 BotB (4MB) Flash Chip ***
- Flash Chip Window Start .... : 1fc00000
- Flash Chip Window Length ... : 00400000
- Selected Area Start ........ : 00000000
- Selected Area Length ....... : 00000000
*** REQUESTED OPERATION IS COMPLETE *** |
|
Angelo_
The Network Guy
Premium
join:2002-06-18 | if you guys need help just ask and i'll do whatever |
|
chaveiro
join:2007-12-06 | Hello Angelo_ you can help if have access to a unlocked speedtouch 585 v6 and can make a jtag backup.
I can help you with conecting jtag cable. |
|
Angelo_
The Network Guy
Premium
join:2002-06-18 | i have 516's but they are of the same family and i've been under suspection that the flash is identical... from a good source  |
|
ggpr
join:2007-11-23
canada | reply to Bicephale
This may or may not help you guys.
The us robotics 9108 uses the same chip, broadcom 6348 and gives the source code on their site. --may help you to better understand what is going on inside. |
|
chaveiro
join:2007-12-06
3 edits | reply to Angelo_
I dont think they are compatible. Is your modem locked?
If not, post a backup of the CFE file for that modem and you will make many guys happy here in portugal.
1 - Build the cable above, Speedtouch pinout is correct and as follow:
2 - Get »downloads.openwrt.org/utils/Hair···_v48.zip
3 - Issue command: wrt54g -backup:cfe |
|
ggpr
join:2007-11-23
canada
| reply to Bicephale
internals |
but here is the support page:
»www.usr.com/support/product-temp···rod=9108
and the source code:
»www.usr.com/support/s-gpl-code.asp?loc=unst
not sure if it has what you want, but these are the internals:
Lan Ports: BCM5325EKQM
Adsl: BCM6348KPBG
cpu: bcm96348 |
|
Bicephale
join:2005-09-24
·TekSavvy Solutions..
| Hi,
I guess it may be too late but have you considered
to discuss with the owner/author of this picture?:
US Robotics 9108 Disassembly, Rene Bartosh (aka KirJava), 2006-Dec-20
|
|
chaveiro
join:2007-12-06
| Ive tried us robotics firmware, no success. The bootloader of speedtouch aka CFE does not loads it and the usr CFE does not run on speedtouch, at last i could not put it to run.
Anyway.. How can send me backup of a normal 585 v6 CFE file ? (se above how to) |
|
Cidi Rome
join:2007-12-12
| reply to Bicephale
Hi there..
Need some help...
I've tried the JTAG connection on the ST516 and ST585 with 3 diferente computers and the software always make this reads for the CPU:
All ones (FFF..) when the Router is turned on.
All Zeros (000..)when the Router is turned off.
If someone can help, now is the time..
My MSN is: cidirome@hotmail.com
Best Regards. |
|
