Unbricking

Prerequisites

In order to recover a bricked radio, you will need a JTAG cable, software for flashing over JTAG, and an image to flash to the radio. As yet, noone has successfully finished this process, so this is a documentation of progress so far.

JTAG Cables

'Wiggler' compatible cables are a popular low-cost cable, and well supported by the free jtag tools. Plans to make your own are widely available, and prebuilt ones can be found cheaply on ebay and similar sites. A "universal" wiggler will come with bare wires which can be soldered to the jtag test points on the barracuda board.

JTAG Flashing Software

The following possibilities are being explored.

• OpenOCD Support for NAND flash via the S3C2410's built in controller can be added by adapting this patch to support the K9F2808U0C fitted to the barracuda module with some minor changes (mostly just adding a case statement for K92808 where there is already a K91208 case statement - the code should be the same, as the two chips only differ in the number of blocks AFAICT.

• OpenWinCE JTAG tools Support for the S3C2410 can be added using s3c2410.bsdl from the jtager project, and some as yet undiscovered configuration changes. It is not clear whether this will enable the NAND controller of the S3C2410 to be used, or if it just recognizes it as an ARM920T core.

• jtager Seems to support the S3C2410 out of the box, but not as widely used as the above so documentation is even more difficult to find than the above two (which is already a bit of a black art). The documentation available only lists two flash chips as supported, so probably only supports the processor functionality of the S3C2410, not the NAND controller.

• sjf2410 Used by the OpenMoko project, looks promising if you already have a flash image, but only seems to support writing to flash.

• jflash-s3c2410 is mentioned on many webpages, especially Chinese ones, and seems to have been freely downloadable in the past, but it seems to only be shipped with S3C2410 dev boards now. This may be exactly the same program as sjf2410 under a different name, judging by what I can find.

Image

The following are possible sources for an image to flash.

• A previously created backup.
• If you know what caused the bricking, you could read the partition from flash, fix the problem and write it back.
• The sharpfin system image (work in progress)

Required information

• Memory map. We need to know the base address of the flash, and possibly other information.
• Partition map. This is available in the file drivers/mtd/nand/nand_rirm2.c in the reciva kernel sources.

Links

• JTAG
• Arm/Linux Booting

Steps

JTAG Cable

Install / Use a Wiggler Compatible Cable (using TDI, TDO, TCK and TMS). Note that nTRST is not actually required.

Check

• Install and run a patched version of openocd (here).
• Use a configuration file as follows (Linux version shown, Windows version uses LPT1: as parport_port):

#
# daemon configuration
#
telnet_port 4444
gdb_port 3333
daemon_startup reset 
run_and_halt_time 0 30
#
# Wiggler Adaptor on /dev/parport0
#
interface parport
parport_port 0
parport_cable wiggler
jtag_speed 0
#
# Baracuda Module Configuration
#
jtag_device 4 0x01 0x0f 0xfe
target arm9tdmi little run_and_init 0 arm9tdmi
flash bank s3c2410a 0 0 0 0 0

• Run openocd
• telnet 4444

Open On-Chip Debugger
> flash probe 0
flash 's3c2410a' found at 0x00000000
> flash info 0
#0: s3c2410a at 0x00000000, size 0x00000000, buswidth 0, chipwidth 0
s3c2410a flash driver info
device: SAMSUNG K9F2808
sectors per block: 32
total sectors: 32768