Use JTAG to force entry into Serial Downloader mode

[nathanpalmer]

Lets say I get a new iMX6SL based board with BOOT_MODE = 00 so that it boots from FUSEs.  The first time I power on the system it will see that the FUSEs have not been set, so it will start the Serial Downloader.  I connect to the serial downloader using the Freescale MFG TOOL and load my script than sets the FUSEs to boot from SPI NOR FLASH.  Then I write the image I want to boot into the SPI FLASH.   When I power cycle the device it will boot from the SPI FLASH as expected. So far so good.

Now what if there is a problem with the image I flashed to the SPI and I want to enter the MFG TOOL again to fix?  How do I tell the MX6 that I want to start the Serial Downloader even though the FUSEs say boot from SPI FLASH?  The BOOT_MODE pins are hard tied to GND so I cannot change the BOOT_MODE using the pins.

I can think of one option:

Use a JTAG controller to load u-boot in to RAM and then use u-boot to write to the SPI FLASH.  However, I already have MFG TOOL scripts ready to go and so it would be nice to use the Serial Downloader. 

Is there anyway to use the JTAG interface to reset the MX6 in to Serial Downloader mode in this situation?

[igorpadykov]

Hi Nathan

please look at SDK example system_util.c:

void jump_to_sdp(void)

{

    /* Re-configure the clock gating like the ROM expects it */

    HW_CCM_CCGR0_WR(0xF0C03F0F);

    HW_CCM_CCGR1_WR(0xF0FC0000);

    HW_CCM_CCGR2_WR(0xFC3FF00C);

    HW_CCM_CCGR3_WR(0x3FF00000);

    HW_CCM_CCGR4_WR(0x0000FF00);

    HW_CCM_CCGR5_WR(0xF0033F0F);

    HW_CCM_CCGR6_WR(0xFFFF0303);

    /* enter the ROM Serial Download Protocol */

    hab_rvt_failsafe();

}

i.MX 6Series Platform SDK : Bare-metal SDK

Best regards

chip

-----------------------------------------------------------------------------------------------------------------------

Note: If this post answers your question, please click the Correct Answer button. Thank you!

-----------------------------------------------------------------------------------------------------------------------

[nathanpalmer]

Update:

I have made some good progress, but not quite there...  I can get the device to show up in windows as an HID device but when I use the MfgTool to configure it it locks up at the first step and I never see anything on the debug console that usually shows the Linux Kernel output.

This is what I have so far (in OpenOCD TCL):

proc start_serial_downloader {} {

    ## THIS DOES NOT WORK YET !!!!!

    ## It will now enumerate in windows but will not transfer data

    halt

    dap apsel 0

    dap apcsw 1   

    ## Re-configure the clock gating like the ROM expects it

    mww phys 0x020c4018 0x00a61324

    mww phys 0x020c4068 0xF0C03F0F

    mww phys 0x020c406c 0xF0FC0000

    mww phys 0x020c4070 0xFC3FF00C

    mww phys 0x020c4074 0x3FF00000

    mww phys 0x020c4078 0x0000FF00

    mww phys 0x020c407c 0xF0033F0F

    mww phys 0x020c4080 0xFFFF0303

    ## Switch to Supervisor mode

    reg cpsr         0x00000033

    ## Allocate some stack space at the top of OCRAM

    ##  -- See Figure 8-3 in the i.mx6sl RM

    reg sp_usr         0x0091FFB8

    reg sp_svc         0x0091E000

    reg sp             0x0091E000

    ## Code is in thumb format

    arm core_state thumb

    step

    ## enter the ROM Serial Download Protocol

    ## resume 0x000000bc

    ## I think the SDL expects R0 = 0

    reg r0 0

    ## The address of the ROM Serial Downloader is @ 0xbc

    resume [mrw 0xbc]

}

[igorpadykov]

Hi Nathan

SDK has USB examples (Host and Device modes),

one can start with them.

i.MX 6Series Platform SDK : Bare-metal SDK

If you are interested in MfgTool, then I would suggest

to create new thread, since this is new issue.

Do not forget to choose right MfgTool, since every

processor has own version.

Best regards

chip

[nathanpalmer]

Not a new issue, still same as original post. My MFG Tool is working great when I set the BOOT_MODE to 01 (Serial Downloader) so I know the tool is the right version and USB is OK on the Windows side. 

And, I think the USB is configured OK because the device enumerates and shows the proper device ID in Windows when using my JTAG approach.  So the SDK USB examples are of little use.

My problem is that I want to call the Serial Downloader without booting from BOOT_MODE=01, So I need to configure the chip properly before jumping to the function but I must be missing something.  I was hoping someone on the ROM team or someone that has done this before could point me to what I am missing.

[igorpadykov]

There are no other API, ROM addresses or other ROM entries to enter Serial Mode

[except described in Reference Manual].

[nathanpalmer]

Thanks for the responses.  Is there an API or ROM address described somewhere in the Reference Manual?  I haven't found one, I was just going by the SDK example you pointed me too ( jump_to_sdp(void) ), and it is not quite working. I assume there is some more setup required than just setting the clock gating as the SDK does.

[igorpadykov]

Sorry, there are no descriptions of ROM and its APIs.

Reason is that ROM is run by security functions, even you

disabled security, security engine will check every ROM step.

One can check application Note AN4581 (Rev. 0, 10/2012)  "Secure Boot on i.MX50, i.MX53, and

i.MX 6 Series using HABv4" for some descriptions.

<http://www.freescale.com/files/32bit/doc/app_note/AN4581.pdf>

For this reason I think it is impossible to just jump to

somewhere address of "Serial Mode" function - just because

security engine will not allow its correct execution.

[JerryFan]

I can not see the necessity of this. Actually, once any boot failed(sd, spi, nand), ROM will go in to serial down load mode.

[nathanpalmer]

See OP. The problem is that a "valid" (the ROM boots it instead of the USB Downloader) image could be in the memory specified by the fuses (SPI FLASH, for ex.) but the image itself may be defective.  For example, it could not allow writing to the SPI FLASH which leads to a system that cannot be fixed without resorting to JTAG.

[nathanpalmer]

Thanks for pointing me to that function, This looks like it should be exactly what I need, but I cannot get it to work.  The hab_rvt_failsafe(); is a function pointer to address 0x000000BC.  When I try to jump to that address using JTAG, OpenOCD in my case, (after configuring the CCM registers as you specified) I get a get an Abort Exception.

Could there be some other configuration necessary?

[igorpadykov]

Hi Nathan

I am afraid not, sorry.

Best regards

chip