#130 Broadcom BCM4706 support

[adrianf0]

I need to de-brick my router based on BCM4706 processor. Thus, I think it's agreat opportunity to add its support to urjtag. I would be grateful for developers support.

I base my configuration on BCM4702. I know that instruction length is 5 (https://wikidevi.com/wiki/Broadcom_BCM4706). Unfortunately, when I try to initialize ejtag bus, I get a wrong IMPCODE (0xFFFFFFFF). I think it's related to the wrong length of the BSR register in the configuration. Is there a way to figure out this length through jtag (by writing some patter and reading it back) ?

[Geert Stappers]

On Wed, Sep 19, 2018 at 10:17:27PM -0000, adrianf0 wrote:

I get a wrong IMPCODE (0xFFFFFFFF).

For What It Worth: the 0xFFFFFFFF is the pattern of all bits set.

Was another pattern seen, like Broadcom manufacture ID?
Any else that is not 1111111111111111111111111111111111111111111111111?

Groeten
Geert Stappers
--
Leven en laten leven

[adrianf0]

@Geert : Yes, the processor is properly seen on the jTag bus.
Using the enclosed configuration, where I set BSR arbitary to 342, the sessions in urjtag looks like:

$./jtag 

UrJTAG 2018.06 #
Copyright (C) 2002, 2003 ETC s.r.o.
Copyright (C) 2007, 2008, 2009 Kolja Waschk and the respective authors

UrJTAG is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
There is absolutely no warranty for UrJTAG.

warning: UrJTAG may damage your hardware!
Type "quit" to exit, "help" for help.

jtag> cable xpc_ext 
firmware version = 0x08FC (2300)
cable CPLD version = 0xFFFE (65534)
jtag> detect
IR length: 32
Chain length: 1
Device Id: 00000000000011000011000101111111 (0x000C317F)
  Manufacturer: Broadcom (0x17F)
  Part(0):      BCM4706 (0x0C3)
  Stepping:     Ver 0
  Filename:     /usr/local/share/urjtag/broadcom/bcm4706/bcm4706
jtag> initbus ejtag
ImpCode=11101101101101101101111111111101 EDB6DFFD
EJTAG version: unknown (7)
EJTAG Implementation flags: R4k DINTsup ASID_6 NoDMA MIPS64
Processor entered Debug Mode.
jtag> 

Of course, as you see, ImpCode is again wrong, thus I concluded it's related to the BSR value. Changing BSR value (ex. BSR=1 gives ImpCode = '1) results in different ImpCode, always wrong. Is there some way to figure out by probing jTag, what should I set in the configuration file?

[adrianf0]

any guidance ?

[adrianf0]

I have tried the latest tag (2018.09) but still, without guideance regarding proper generation of the bcm4706 configuration file I am not able to access ejtag bus.

[Geert Stappers]

The missing part is the BSDL file.
It is something the better hardware vendors do provide.