Hello,
I have bcm6348 based router (netgear dg834gt) with corrupted CFE. I connected with jtag, but it freezes:

sudo ./Telsey -flash:cfe /nodma

============================================
Telsey MAGIC EJTAG Debrick Utility v0.9beta2
============================================

Probing bus ... Done

Instruction Length set to 5

CPU Chip ID: 00000110001101001000000101111111 (0634817F)
*** Found a Broadcom BCM6348 Rev 1 CPU chip ***

    - EJTAG IMPCODE ....... : 00000000100000000000100100000100 (00800904)
    - EJTAG Version ....... : 1 or 2.0
    - EJTAG DMA Support ... : Yes
    *** DMA Mode Forced Off ***

Issuing Processor / Peripheral Reset ... Done

why? Any help will be appriciated...
many thanks

hi
  Read this thread "https://forum.openwrt.org/viewtopic.php?id=2221"

thanks, but it is not what I was asking: I have corrupted (=not working) CFE and therefore no serial output.
There is a issue with BCM6348: JTAG works if CFE is good, if there is no CFE - jtag doesn't work (as far as I understood the explanations of tornado)

I have had this happen a few times with the same chip when the bootloader gets corrupted. Just an idea but try this, it works for me but you will have to try a few times to get it timed right.

Switch off the router, set the jtag program to erase cfe but dont press return.

Turn on the router and hit return at the same time. Hopefully you'll get the erase command in before the cpu starts execution and halts on the bad data.

After its erased, restart the router and you should be able to flash the new cfe.