Unbricking

Introduction

This procedure will take you through the restoration of your radio using a simple JTAG cable, with software we have provided.

Prerequisites

In order to recover a bricked radio, you will need:

• JTAG cable
• Software for flashing over JTAG
• An image to flash to the radio
• A lot of patience

JTAG Cables

'Wiggler' compatible cables are a popular low-cost cable, and well supported by the free jtag tools. Plans to make your own are widely available, and prebuilt ones can be found cheaply on ebay and similar sites. A "universal" wiggler will come with bare wires which can be soldered to the jtag test points on the barracuda board.

JTAG Flashing Software

The application sjf2410, along with the error correction code from the linux kernel have been modified to produce a bespoke utility for the baracuda module's NAND flash. It uses the wiggler cable in the parallel port.

You will soon be able to Download the software from here:

• sharpflashsrc.zip - Source Code
• sharpflash.zip - Windows Executable
• sharpflash.bz2 - Linux Executable

Reading Flash Images

At present, we are trying to identify the association between 'nanddump' images, Reciva upgrade images, and JTAG acquired images. We recommend taking a 'nanddump' (see Making a backup) of your radio as soon as possible, as it is our goal to be able to restore these images. Until then, you can make a back-up of your flash via JTAG using the following format commands:

sharpflash r kernel-mtd1.bin 004000 0fc000

Will extract the contents of the kernel partition into 'kernel-mtd1.bin', skipping any bad sectors as it goes. The program will also create 'rawdata.bin' and 'rawdata.ext' which contains the raw data and extended data information. Have a look at Reciva NAND Flash for the background on the flash structure.

Getting Bad Block Information

This is not needed for programming, however it is recommended that you keep a record of the bad blocks marked by the manufacturer as bad, because this information is stored in re-programmable memory, and it may be useful to be able to distinguish between manufacturer-defined bad blocks, and user-defined bad blocks.

sharpflash b

Writing Flash Images

This process takes a long time to run - roughly 80 seconds per 16KBytes, so a full 16Mb flash will take about 24 hours.

sharpflash w mtd.bin 000000 0F00000

Will write an entire image from the file mtd.bin, and will produce an output similar to this:

Sharpfin Flash Programmer - http://www.sharpfin.zevv.nl/
.
Found S3C2410 processor on JTAG Cable
Found K9F2808UOC on processor
Writing NAND Flash:
 source      = mtd.bin
 start addr  = 0x0
 length      = 0xF00000
.
Address  Progress                          Remaining
-------  --------------------------------  ---------
0000000  wwwwwwwwwwwwwwwwwwwwwwwwwwwwwwww   21h 12m
0004000  wwwwwwwwwwwwwwwwwwwwwwwwwwwwwwww   21h 11m
0008000  wwwwwwwwwwwwwwwwwwwwwwwwwwwwwwww   21h 09m
000C000  wwwwwwwwwwwwwwwwwwwwwwwwwwwwwwww   21h 08m
0010000  wwwwwwwwwwwwwwwwwwwwwwwwwwwwwwww   21h 07m
0014000  wwwwwwwwwwwwwwwwwwwwwwwwwwwwwwww   21h 05m
0018000  wwwwwwwwwwwwwwwwwwwwwwwwwwwwwwww   21h 04m
001C000  wwwwwwwwwwwwwwwwwwwwwwwwwwwwwwww   21h 02m
0020000  wwwwwwwwwwwwwwwwwwwwwwwwwwwwwwww   21h 01m
0024000  wwwwwwwwwwwwwwwwwwwwwwwwwwwwwwww   20h 59m
.....

Old Information

The following possibilities are being explored.

• OpenOCD Support for NAND flash via the S3C2410's built in controller can be added by adapting this patch to support the K9F2808U0C fitted to the barracuda module with some minor changes (mostly just adding a case statement for K92808 where there is already a K91208 case statement - the code should be the same, as the two chips only differ in the number of blocks AFAICT.

• OpenWinCE JTAG tools Support for the S3C2410 can be added using s3c2410.bsdl from the jtager project, and some as yet undiscovered configuration changes. It is not clear whether this will enable the NAND controller of the S3C2410 to be used, or if it just recognizes it as an ARM920T core.

• jtager Seems to support the S3C2410 out of the box, but not as widely used as the above so documentation is even more difficult to find than the above two (which is already a bit of a black art). The documentation available only lists two flash chips as supported, so probably only supports the processor functionality of the S3C2410, not the NAND controller.

• sjf2410 Used by the OpenMoko project, looks promising if you already have a flash image, but only seems to support writing to flash.

• jflash-s3c2410 is mentioned on many webpages, especially Chinese ones, and seems to have been freely downloadable in the past, but it seems to only be shipped with S3C2410 dev boards now. This may be exactly the same program as sjf2410 under a different name, judging by what I can find.

Image

The following are possible sources for an image to flash.

• A previously created backup.
• If you know what caused the bricking, you could read the partition from flash, fix the problem and write it back.
• The sharpfin system image (work in progress)

Required information

• Memory map. We need to know the base address of the flash, and possibly other information.
• Partition map. This is available in the file drivers/mtd/nand/nand_rirm2.c in the reciva kernel sources.

Links

• JTAG
• Arm/Linux Booting

Steps

JTAG Cable

Install / Use a Wiggler Compatible Cable (using TDI, TDO, TCK and TMS). Note that nTRST is not actually required.

Install

• Install and run a patched version of openocd (here).
• Use a configuration file as follows (Linux version shown, Windows version uses LPT1: as parport_port):

#
# daemon configuration
#
telnet_port 4444
gdb_port 3333
daemon_startup reset 
run_and_halt_time 0 30
#
# Wiggler Adaptor on /dev/parport0
#
interface parport
parport_port 0
parport_cable wiggler
jtag_speed 0
#
# Baracuda Module Configuration
#
jtag_device 4 0x01 0x0f 0xfe
target arm9tdmi little run_and_init 0 arm9tdmi
flash bank s3c2410a 0 0 0 0 0

• Run openocd

Check

• telnet 4444

Open On-Chip Debugger
> flash probe 0
flash 's3c2410a' found at 0x00000000
> flash info 0
#0: s3c2410a at 0x00000000, size 0x00000000, buswidth 0, chipwidth 0
s3c2410a flash driver info
device: SAMSUNG K9F2808
sectors per block: 32
total sectors: 32768