升级开始时：
1、先换内存：64M内存颗粒 K4S511632C-KC75 （备注： 自己从笔记本内存上吹下来的）；仍然使用原来的flash开机，正常出现设置界面；
2、开始换上Mx29LV640 的8M flash；刮A21地址线，和flash第13脚（和14脚已断开）连接。
3、短接了R88和R23两处。开机后JTAG刷CFE，下面第一个画面显示的就是brjtag 1.8C 识别到的CPU 及 Flash信息，刷好后备份出来，和刷入的比较了下，一样的。
但断电开机后，无法ping通，电源灯常亮，无线灯间隔5s左右闪一下，其他灯不亮。呵呵，有点抓狂了，真的不想放弃！
C:\JTAG>brjtag -probeonly
===============================================
Broadcom EJTAG Debrick Utility v1.8c-hugebird
===============================================
Probing bus ... Done
Instruction Length set to 8
CPU assumed running under LITTLE endian
CPU Chip ID: 00000101001101010010000101111111 (0535217F)
*** Found a Broadcom manufactured BCM5352 REV 01 CPU ***
- EJTAG IMPCODE ....... : 00000000100000000000100100000100 (00800904)
- EJTAG Version ....... : 1 or 2.0
- EJTAG DMA Support ... : Yes
- EJTAG Implementation flags: R4k MIPS32
Issuing Processor / Peripheral Reset ... Done
Enabling Memory Writes ... Done
Halting Processor ... <rocessor Entered Debug Mode!> ... Done
Clearing Watchdog ... Done
Loading CPU Configuration Code ... Skipped
Probing Flash at Address: 0x1FC00000 ...
Detected Chip ID (VenIDevID = 00C2 : 22CB)
*** Found a CFI Compatiable Flash Chip from Macronix
*** REQUESTED OPERATION IS COMPLETE ***
C:\JTAG>
TTL输出的信息：
CFE version 1.0.37 for BCM947XX (32bit,SP,LE)
Build Date: Mon Apr 16 14:41:05 CST 2007 (
root@localhost.localdomain)
Copyright (C) 2000,2001,2002,2003 Broadcom Corporation.
Initializing Arena
Initializing Devices.
Boot partition size = 131072(0x20000)
et0: Broadcom BCM47xx 10/100 Mbps Ethernet Controller 4.130.23.0
CPU type 0x29008: 200MHz
Total memory: 65536 KBytes
Total memory used by CFE: 0x80400000 - 0x8049A790 (632720)
Initialized Data: 0x80430720 - 0x80432D10 (9712)
BSS Area: 0x80432D10 - 0x80434790 (6784)
Local Heap: 0x80434790 - 0x80498790 (409600)
Stack Area: 0x80498790 - 0x8049A790 (8192)
Text (code) segment: 0x80400000 - 0x80430720 (198432)
Boot area (physical): 0x0049B000 - 0x004DB000
Relocation Factor: I:00000000 - D:00000000
Device eth0: hwaddr 00-14-6C-48-D0-CA, ipaddr 192.168.1.1, mask 255.255.255.0
gateway not set, nameserver not set
Null Rescue Flag.
Invalid boot block on disk
Hello!! Enter Rescue Mode: (Check error)
Reading :: TFTP Server.
Failed.: Timeout occured
