If your radio bricked after you edited the config file, it is possible to unbrick it by removing the Barracuda module and placing it in a radio that has a different hardware-id e.g. a module from an Intempo (761), inside a Logik IR100 (1012). Once powered up, you can login and restore the config file edits (since the new radio boots using the config files for its radio hardware-id, not the one you messed up).
The following procedure will take you through the restoration of your radio using a simple JTAG cable, with software we have provided.
In order to recover a bricked radio, you will need:
- JTAG cable
- Software for flashing over JTAG
- An image to flash to the radio (see Making a backup)
- A lot of patience
'Wiggler' compatible cables are a popular low-cost cable, and well supported by the free jtag tools. Plans to make your own are widely available, and prebuilt ones can be found cheaply on ebay and similar sites. A "universal" wiggler will come with bare wires which can be soldered to the jtag test points on the barracuda board.
N.B. The Barracuda board needs to be installed in a powered up radio (standby is OK) for the JTAG process to work.
19/08/08 : I used a wiggler based on this circuit. This worked 100% on the first attempt. Note this uses HC rather than AC logic, which is advised in several places.
JTAG Flashing Software
The application sjf2410, along with the error correction code from the linux kernel have been modified to produce a bespoke utility for the baracuda module's NAND flash. It uses the wiggler cable in the parallel port.
This version of sharpflash supports reading and writing of the NAND flash using the wiggler parallel port interface.
This software is far from perfect. It has taken me several weeks to restore a fully working IRMA1, as the flash program seems to drop the odd byte here and there
Reading Flash Images
You can make a back-up of your flash via JTAG using the following format commands:
sharpflash -r kernel-mtd.bin 004000 0fc000
Will extract the contents of the kernel partition into 'kernel-mtd1.bin', which is a nanddump format file, skipping any bad sectors as it goes. Have a look at Reciva NAND Flash for the background on the flash structure.
Sharpfin Flash Programmer - http://www.sharpfin.zevv.nl/ . Found S3C2410 processor on JTAG Cable Found K9F2808UOC on processor Reading NAND Flash: destination = kernel-mtd1.bin start addr = 0x4000 length = 0xFC000 . Address Progress Remaining ------- -------------------------------- --------- 0004000 rrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrr 9h 12m 0008000 rrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrr 9h 11m 000C000 rrrrrr
Getting Bad Block Information
This is not needed for programming, however it is recommended that you keep a record of the bad blocks marked by the manufacturer as bad, because this information is stored in re-programmable memory, and it may be useful to be able to distinguish between manufacturer-defined bad blocks, and user-defined bad blocks.
The program will output several lines, with each '.' representing a 16K block which is marked as good, and a 'b' for each block which is marked bad.
Sharpfin Flash Programmer - http://www.sharpfin.zevv.nl/ . Found S3C2410 processor on JTAG Cable Found K9F2808UOC on processor Checking NAND Blocks 0000000: ................................................................ 0100000: bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb...............
Writing Flash Images
This process takes a long time to run - roughly 80 seconds per 16KBytes, so a full 16Mb flash will take about 24 hours.
When you are choosing your images to write, make sure that they are in 'nanddump' format. Writing images to flash that are not in 'nanddump' format will result in valid blocks being marked bad
sharpflash -w boot-mtd.bin 000000 04000
Will write the boot sector from the file boot-mtd.bin, and will produce an output similar to this:
Sharpfin Flash Programmer - http://www.sharpfin.zevv.nl/ . Found S3C2410 processor on JTAG Cable Found K9F2808UOC on processor Writing NAND Flash: source = boot-mtd.bin start addr = 0x0 length = 0x04000 . Address Progress Remaining ------- -------------------------------- --------- 0000000 wwwwwwwwwwwwwwwwwwwwwwwwwwwwwwww 0h 00m
Interesting Information / Links
- Arm Programming Info
- OpenOCD Support for NAND flash via the S3C2410's built in controller
- patch supporting the K9F1208 Flash (similar to the K9F2808)
- OpenWinCE JTAG tools
- s3c2410.bsdl Support for OpenWinCE
- sjf2410 Used by the OpenMoko project
- JTAG Information
- Arm/Linux Booting method
- PC Parallel Port Access From Linux
- JTAG USB Programming Info
- FTDI Library, used by Altera ByteBlaster