Make your own free website on Tripod.com




Unbricking the Reciva radio using JTAG

Created 2009. Last updated: 15 Jan 2012 (Sharpfin website resurrected)

 

Contents:

 

 


Introduction

 

Warning:  Do not attempt this if you have no previous electronics and/or soldering experience.   You could damage your Reciva Barracuda module.

 

 

This is my blog describing how I reloaded the firmware onto a bricked EBuyer/Vistron MX-200i radio.   Use of these instructions is at your own risk.  I do not accept any responsibility for any damage you may cause to your Reciva radio.

If the radio is powered on, and the green diagnostic LED on the Barracuda module is blinking at a constant rate, then you can use this unbricking procedure to perhaps resolve the problem (There may also be text displayed on the radio's LCD).   If the diagnostic LED is continuously on (or off), reloading the firmware will not resolve the problem – this will probably be due to poor flow soldering on the early Barracuda modules (green coloured PCB) – visit the RecivaRefuge forum for advice.

 

I purchased one of these JTAG Programmers off eBay from seller 'virtualvillage*' (Seller uses different variations of the same ebay name including 'virtualvillage-usa').  The board is fitted with a 74HC244 chip.

The programmer requires a PC with a legacy 25 pin 'parallel printer' port.  A growing number of modern PCs and almost all laptops no longer feature legacy PS2, serial and parallel ports.

My 2008 Dell computer was not compatible, but I do have a 2004 2.6GHz Celeron HP desktop PC which is perfect for the job.

 

 



Update (17 Sep 11): Link for Guide and Sharpflash fixed.  

As a Windows user and a newbie to linux myself, I used the guide written by 'Menlopete' posted on the Sharpfin google forum.  Click here for the excellent JTAG Guide or here.  The guide is derived from information published on the Sharpfin website.found

You will also need a copy of Steve Clarke's original Sharpflash v0.1 utility which used to be hosted on the Sharpfin website. Also available here.

 

 

A friend gave me an Ebuyer/Vistron MX-200i which suffered from a particular fault.  When the radio was switched on, it booted up as far as displaying the message "Initialising Network".  Then after about 2 or 3 minutes, the radio reboots and goes through the same sequence again.

The radio could not be reset by any means.  The symptoms were reproduced when I moved the Barracuda module to a Logik IR100 radio.

ie. the radio is bricked and perhaps only reloading the firmware using JTAG cable will possibly rectify the problem.

 

 


Firmware

 

You will need to acquire a working copy of the firmware. Someone on the Reciva Refuge users forum may be able to help....



Otherwise, it is possible to obtain a copy from another Reciva radio which is still running an older version of the firmware prior to v257-a-8xx series. Tip: If you remove your working radio from the Reciva Beta programme, you may be able to revert back to a much older release of firmware.

The backup function in Sharpfin base patch does not work in v257-a-8xx because I believe Reciva have deleted the nanddump & getpart command line utilities which the Sharpfin base patch tries to call.   At the time of writing, I don't know whether anyone has successfully tried to reinstate the missing utilities.

This will involve installing the Sharpfin base patch onto the working radio, and then using the web based menu options to back up the 5 partitions and save them as files to your PC.  The procedure is documented and is best achieved using a Windows PC.

 Reciva Refuge user forum

My Sharpfin page

I had previously installed the Sharpfin base patch v0.3 onto one of my own Vistron MX-200i radios running v257-a-765-a-030 firmware, to extract a copy of the firmware which will be used to repair the above mentioned faulty radio.







 


JTAG Programmer up close

 

It cost less than £8 and was delivered in around 10 days by Virtual Village Ltd, Hong Kong, using cheapest delivery option to the UK.  Having said that, I noticed the customs label and postage suggested it may have been posted from Frankfurt, Germany!

 

This type of JTAG programmer is also commonly known as a 'Wiggler'.  This particular model is utilises a single 74HC244 buffer chip and a transistor.

The pin out for the 20 way JTAG connector can be viewed by clicking here.



Circuit diagrams for two Wigglers can be viewed here and here. I think I may have saved these images from the Sharpfin Project website.

 

 


Attaching to the Barracuda module

There are two versions of the Barracuda module. Easily identified by the colour of the PCB. The first version is green. The later much more reliable lead-free version is coloured blue.




 

I cut off the IDC plug and stripped and tinned the ends of the wires corresponding to pins 2, 3, 4, 5, 7, 9, 13 according to Menlopete's guide.  Please note the pin numbering may be different if you are using a different JTAG programmer.

(The wire at the top, with red marks, in above photo corresponds to pin 1, next wire below it is pin 2, and so forth to pin 20)

 

Please take the necessary antistatic electricity precautions before dismantling the radio and working on the Barracuda module.

 

Next, I tinned all of the 7 copper pads on the back of the Barracuda module which I was intending to use based on the information contained in Menlopete's guide.

This image is of the rear of a 1st generation Barracuda module.  It is reproduced from Menlopete's guide.  I believe the image itself originated from the Unbricking guide published on the Sharpfin website.

I have added the corresponding pin numbers to this image for use with the 20 pin JTAG programmer described specifically in this page. (Note the pin numbers may differ for other makes of JTAG programmers)

 

(Update 2 May 10): bobro noted the original Sharpfin wiring diagram utilises the +5v power rail from the Barracuda to feed the JTAG programmer's buffer chip.  

As far as I am aware, there hasn't been any reports of damage to barracuda modules by using 5v.  It may be wise though to take power from the 3.3v rail if the JTAG programmer can operate at this voltage as bobro has suggested.   I will try using 3.3v at the next opportunity when I have to unbrick a module.

 

bobro added he had to disconnect nTRST (pin 3) otherwise his JTAG programmer (model unknown) could not communicate with the barracuda module.

 

 

The above picture shows the rear of the much more reliable 2nd generation Barracuda radio module.

My eyesight isn't that brilliant nowadays but I did manage to attach all the wires to the corresponding tinned solder pads, taking care they did not short out against each other, as the pads on the PCB are very close together.  (If you study the above photo carefully, you can actually see two of the wires have crossed over due to weak soldering, and are possibly shorted together.  I subsequently resoldered the loose connection)

 

The Barracuda module has to remain attached and powered by the radio.  It is also how the JTAG Programmer draws its electrical power.  You can see the JTAG programmer is plugged into the parallel printer port on the back of a computer.  (Ignore the green coloured plug above the JTAG board in picture below - this is a PS2 mouse)  

I double checked all the soldered wires were attached and not shorted together before I applied power to the radio.

The BIOS setting on the HP desktop PC was already configured to 'ECP/EPP' mode by default for bidirectional printer communications.

The USB wireless dongle was intentionally removed from the radio, because the particular fault I am trying to rectify, causes the radio to reboot automatically after displaying the message 'Initialising Network' for a few minutes.  Removing the dongle causes this particular radio to stay on with the message 'No Network device found'.  In fact, the front panel does not need to be connected for the purpose of reflashing the module.

 
 
 

Programming

 

I more or less followed Menlopete's instructions.   I actually installed a copy of Ubuntu 9.10 directly onto the computer's hard drive on the first occasion, but subsequently followed Melopete's instructions for running Ubuntu off a Live CD without issues.

I downloaded and used Sharpflash v0.1 from the Sharpfin Unbricking web page – this works with BOTH variants of the Barracuda board. (There is a newer v0.3 release in the repository, but a number of people have found it is not compatible with their Wiggler or Barracuda board)





When I executed the 'Make' instruction to compile the Sharpflash utility, I did witness a 'warning' message.  This can be safely ignored.

gcc -Wall -DLINUX_PPDEV -g -o ppt.o -c ppt.c -DVER=\"0.1\"
ppt.c: In function InstallGiveIo
ppt.c:138: warning: control reaches end of non-void function



 

To test the JTAG programmer. I executed the 'Sharpflash -b' command as instructed in Menlopete's guide to read the bad blocks information.  No bad blocks were reported.

 

I noted my actual partition file sizes were exactly the same as those quoted in Menlopete's guide, so I did not need to calculate the start addresses and sizes required for use with the Sharpflash tool.

 

I also noted that the Sharpflash utility incorrectly detected a 16M x 8bit K9F2808U0C NAND chip was present.   The Barracuda module in question has a 32M x 8bit K9F5608U00 chip...    I understand that only 16Mbytes is only utilised regardless of the size of the NAND chip.

 There are two versions of the Sharpflash utility - ensure  you use the original earlier release (v0.1 I think) as the later version does not work well under certain circumstances.

 

I don't know whether the specification of the PC has any relevance, but I have also included the times taken to load each of the five partitions.  The computer used was a circa 2004 HP Compaq Desktop PC fitted with a 2.6 GHz Celeron (Northwood) processor (Intel i865G motherboard chipset).  ECP/EPP bidirectional printer mode enabled in BIOS.

 

The first partition 'boot-mtd.bin'  only took 50 seconds to write to the NAND flash chip. 

 

The second partition 'kernel-mtd.bin' (1 Mbyte) was completed in exactly 59 minutes.

 

The third and largest partition 'root-mtd.bin' (13 Mbytes) was completed in less than 13 hours.  (I wasn't around when it had apparently finished, but it had finished when I got around to checking at 12 hours 45 mins)

 

The fourth partition 'config-mtd.bin' (1 Mbytes) was completed in about 1 hour.

 

The fifth and final partition 'debug-mtd.bin' (1 Mbytes) was completed in about 1 hour.

 

Total time to reload all 5 partitions came to about 16 hours when a 2.6GHz Celeron/2.66GHz Pentium 4 computer was utilised.

 

 


Success !

 

I switched off the computer and radio.  Then carefully unplugged the ribbon cable from the JTAG programmer circuit board, and attached the USB wireless dongle to the radio.

I powered on the radio and observed it successfully connected to my wireless network and to the last radio station stored in memory.

The firmware version correctly reported v257-a-765-a-030.

I registered the radio and was able to access 'My Stations' and 'My Stuff'.  Minutes later, I encountered an error message when attempting to access these menus "Unable to load menu".

At this point, I decided to perform a full factory reset to clear all settings, and set up the radio from scratch.

 

I noted too the Sharpfin base patch was present which was no surprise.

 

 

 


Post-repair Testing

 

After factory resetting the radio, all the main functions appear to be working fine.

The Sharpfin webserver appears to have stopped working, however I can still telnet the radio.

 

I removed the Sharpfin base patch v0.3, then reinstalled it.  The Sharpfin webserver returned.

I have now removed the base patch.

 

I used the radio to listen to a number of stations throughout the day with no problems.  Also switched the radio off and on a number of times at the mains power socket.    All appears to be working well.

 

 


Other information

 

I did wonder whether anyone had successfully compiled a version of Sharpflash to run under Windows, and it looks like someone was indeed successful.  Unfortunately, the exact details are very scarce.

Sharpflash running under Cygwin for Windows thread

 

 

 


Firmware flashing service

 

If this seems like too much hard work and you are desperate to revive the module in your Reciva based radio.



SteveGB located in Surrey can reflash Reciva modules.  He has been repairing the Logik IR100 and other radios in his spare time.  He can be contacted through this email address:

         ir100repairoXoavtsuk.com        (replace  the 'oXo' with an '@' symbol)

I believe he was quoting a fee of £20 including UK return postage if the module is successfully reloaded. 

Please note this is not a personal endorsement of his services, and any negotiation and/or contract of services is between yourself and Steve.

 


References

 

Sharpfin base patch, patch server and Sharpflash were written by Steve Clarke, Sharpfin Project www.sharpfin.zevv.nl

(15 Jan 12): The Sharpfin website has recently been resurrected. Click here.

Menlopete's guide for linux newbies.

 



Return to My Ebuyer/Vistron MX-200i Resource Page