Unbricking

Prerequisites

In order to recover a bricked radio, you will need a JTAG cable, software for flashing over JTAG, and an image to flash to the radio. As yet, noone has successfully finished this process, so this is a documentation of progress so far.

JTAG Cables

'Wiggler' compatible cables are a popular low-cost cable, and well supported by the free jtag tools. Plans to make your own are widely available, and prebuilt ones can be found cheaply on ebay and similar sites. A "universal" wiggler will come with bare wires which can be soldered to the jtag test points on the barracuda board.

JTAG Flashing Software

The following possibilities are being explored.

• OpenOCD Support for NAND flash via the S3C2410's built in controller can be added by adapting this patch to support the K9F2808U0C fitted to the barracuda module with some minor changes (mostly just adding a case statement for K92808 where there is already a K91208 case statement - the code should be the same, as the two chips only differ in the number of blocks AFAICT.

• OpenWinCE JTAG tools Support for the S3C2410 can be added using s3c2410.bsdl from the jtager project, and some as yet undiscovered configuration changes. It is not clear whether this will enable the NAND controller of the S3C2410 to be used, or if it just recognizes it as an ARM920T core.

• jtager Seems to support the S3C2410 out of the box, but not as widely used as the above so documentation is even more difficult to find than the above two (which is already a bit of a black art). The documentation available only lists two flash chips as supported, so probably only supports the processor functionality of the S3C2410, not the NAND controller.

• sjf2410 Used by the OpenMoko project, looks promising if you already have a flash image, but only seems to support writing to flash.

• jflash-s3c2410 is mentioned on many webpages, especially Chinese ones, and seems to have been freely downloadable in the past, but it seems to only be shipped with S3C2410 dev boards now. This may be exactly the same program as sjf2410 under a different name, judging by what I can find.

Image

The following are possible sources for an image to flash.

• A previously created backup.
• If you know what caused the bricking, you could read the partition from flash, fix the problem and write it back.
• The sharpfin system image (work in progress)

Required information

• Memory map. We need to know the base address of the flash, and possibly other information.
• Partition map. This is available in the file drivers/mtd/nand/nand_rirm2.c in the reciva kernel sources.

Links

• JTAG
• Arm/Linux Booting

Steps

JTAG Cable

Install / Use a Wiggler Compatible Cable (using TDI, TDO, TCK and TMS). Note that nTRST is not actually required.

Check

Install and run sjf2410, which starts up, and prints:

+--------------------------------------+
|     SEC JTAG FLASH(SJF) v 0.4moko2   |
|     (S3C2410X & SMDK2410 B/D)        |
+--------------------------------------+
Usage: SJF -f <filename>  -d <delay>  -b
ID32=0x0032409d
> S3C2410X(ID=0x0032409d) is detected.
.
[SJF Main Menu]
 0:K9S1208 prog     1:28F128J3A prog   2:AM29LV800 Prog   3:Memory Rd/Wr
 4:Exit

Indicating that the ARM processor has been detected successfully (by the ID32 of 0x0032409d)