Unbricking
Introduction
This procedure will take you through the restoration of your radio using a simple JTAG cable, with software we have provided.
Prerequisites
In order to recover a bricked radio, you will need:
- JTAG cable
- Software for flashing over JTAG
- An image to flash to the radio
- A lot of patience
JTAG Cables
'Wiggler' compatible cables are a popular low-cost cable, and well supported by the free jtag tools. Plans to make your own are widely available, and prebuilt ones can be found cheaply on ebay and similar sites. A "universal" wiggler will come with bare wires which can be soldered to the jtag test points on the barracuda board.
|
|
|
JTAG Flashing Software
The application sjf2410, along with the error correction code from the linux kernel have been modified to produce a bespoke utility for the baracuda module's NAND flash. It uses the wiggler cable in the parallel port.
- Sharpflash-src-dev223.tar.bz2 - Source Code (Alpha Test Version)
This version of sharpflash supports reading and writing of the NAND flash using the wiggler parallel port interface.
Reading Flash Images
At present, we are trying to identify the association between 'nanddump' images, Reciva upgrade images, and JTAG acquired images. We recommend taking a 'nanddump' (see Making a backup) of your radio as soon as possible, as it is our goal to be able to restore these images. Until then, you can make a back-up of your flash via JTAG using the following format commands:
sharpflash r kernel-mtd1.bin 004000 0fc000
Will extract the contents of the kernel partition into 'kernel-mtd1.bin', skipping any bad sectors as it goes. The program will also create 'rawdata.bin' and 'rawdata.ext' which contains the raw data and extended data information. Have a look at Reciva NAND Flash for the background on the flash structure.
Sharpfin Flash Programmer - http://www.sharpfin.zevv.nl/ . Found S3C2410 processor on JTAG Cable Found K9F2808UOC on processor Reading NAND Flash: destination = kernel-mtd1.bin raw data = rawdata.bin err data = rawdata.err start addr = 0x4000 length = 0xFC000 . Address Progress Remaining ------- -------------------------------- --------- 0000000 rrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrr 9h 12m 0004000 rrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrr 9h 11m 0008000 rrrrrr
Getting Bad Block Information
This is not needed for programming, however it is recommended that you keep a record of the bad blocks marked by the manufacturer as bad, because this information is stored in re-programmable memory, and it may be useful to be able to distinguish between manufacturer-defined bad blocks, and user-defined bad blocks.
sharpflash b
The program will output several lines, with each '.' representing a 16K block which is marked as good, and a 'b' fir each block which is marked bad.
Sharpfin Flash Programmer - http://www.sharpfin.zevv.nl/ . Found S3C2410 processor on JTAG Cable Found K9F2808UOC on processor Checking NAND Blocks 0000000: ................................................................ 0100000: bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb...............
Writing Flash Images
This process takes a long time to run - roughly 80 seconds per 16KBytes, so a full 16Mb flash will take about 24 hours.
sharpflash w mtd.bin 000000 0F00000
Will write an entire image from the file mtd.bin, and will produce an output similar to this:
Sharpfin Flash Programmer - http://www.sharpfin.zevv.nl/ . Found S3C2410 processor on JTAG Cable Found K9F2808UOC on processor Writing NAND Flash: source = mtd.bin start addr = 0x0 length = 0xF00000 . Address Progress Remaining ------- -------------------------------- --------- 0000000 wwwwwwwwwwwwwwwwwwwwwwwwwwwwwwww 21h 12m 0004000 wwwwwwwwwwwwwwwwwwwwwwwwwwwwwwww 21h 11m 0008000 wwwwwwwwwwwwwwwwwwwwwwwwwwwwwwww 21h 09m 000C000 wwwwwwwwwwwwwwwwwwwwwwwwwwwwwwww 21h 08m 0010000 wwwwwwwwwwwwwwwwwwwwwwwwwwwwwwww 21h 07m 0014000 wwwwwwwwwwwwwwwwwwwwwwwwwwwwwwww 21h 05m 0018000 wwwwwwwwwwwwwwwwwwwwwwwwwwwwwwww 21h 04m 001C000 wwwwwwwwwwwwwwwwwwwwwwwwwwwwwwww 21h 02m 0020000 wwwwwwwwwwwwwwwwwwwwwwwwwwwwwwww 21h 01m 0024000 wwwwwwwwwwwwwwwwwwwwwwwwwwwwwwww 20h 59m .....