Hi,
I broke CFE on that PON router [and currently having no output on console] and attempting to recover. JTAG pinout is not known, so I am currently looking in a different direction.
First thing to mention: there is a NAND flash. Am I right that there should be some software that executes before [broken] CFE and copies CFE from [from a disk-alike-block] NAND to RAM?
Next thing what I've noticed: after turning on the router there is a carrier on LAN1 and LAN2 (and LEDs are flashing on activity), but no carrier on LAN2 and LAN4. Does that prove that something has been executed and initialized LAN1 and LAN2?
What is known about that pre-cfe-nand-to-ram loading software? Where it resides? (hardcoded in CPU or in blocks marked as bad in NAND even? If so, how it loads?) Can I interact with it somehow (for restoring CFE)?
As I understand, there is no documentation on BCM chips (at least for this generation)? For what words to google?
Thanks.