How to enter a iMX6 when locked out

[jochen]

It happens that I have a couple of Yocto based iMX6 based devices here on my desk. One of them was provided by the manufacturer with a so called "unsecured" firmware, which leaves the access to the serial port open and therefore I always can access the uboot console to re-flash the whole firmware when something goes wrong.

The other devices have a so called "secured" firmware on them. That means the linux has a root password which is secret and (if at all) only known to the manufacturer. The serial port also seem not to fully work, the boards not even have the serial header soldered on.

As a user, you have exactly one try to install your own applications to the linux system via a manufacturer enabled USB setup manager, which will disable itself after the first successful execution. So with that one update, you have to apply something, that you need to have further access to the device. If you make a mistake, you find yourself locked out.

I now accidentially put myself in such a situation. The system is up and running, it answers to pings but does not accept incoming ssh connections anymore. My own applied usp update mechanism seems to be not correctly working. So in fact, I am locked out from the system. 

I first soldered the serial header onto the board and connected to it, expecting uboot to show up, as I know it from the board with the "unsecured" developer firmware image. But to my surprise, nothing showed up. After a while I can see watchdog messages printed in the terminal that originate from the running linux system. So on the hardware level, the serial port is working for sure. 

But no access to u-boot. The manufacturer refuses to help with the problem. They want us to send the device back in so that they can unlock it. 

As a developer who needs to have control of the system, this is a frustrating situation. 

Is there a way, how I can reset the device so that I can re-flash any firmware I want?

I have access to a set of files that the manufacturer provides.

Namely

* A directory "mfgtools" with a console application "mfgtool2-mx6-xxx-yyy-zzz (noUi).vbs" that I use to install the recovery image after issuing 

    sf probe

    sf erase 0x000000 0xc0000

from the uboot console.

* A direcory called "factory_images", which I usually use to re-flash the firmware from an usb flash drive once I have the recovery installed successfully.

* Two files, *.sysimage and *.firmware, which are used to install the system and firmware from within the manufacturer provided dbus-api in the running yocto.

I am sure, that it is really easy to do a low level re-flash of the device, but I have no experience in that. The manufacturer is unable to deliver developer friendly versions of their board at the moment, that are equipped with the "unsecured" firmware, so I have to deal with the devices I have and would really appreciate a way do flash the device no matter what software restrictions exist.

I appreciate any help.

Thanks in advance

Jochen

[jochen]

I bought an lpclink-2 board to play around with the jtag headers on the one working development board. The plan was to do a memory dump and write it to the non-working board.

However, the Connection using Jlink is not possible at all because of "TDO is constant high". Sometimes we get a "successfully connected" message, but that looks fake, because when we issue any command afterwards, the board reboots immediately.

[b36401]

Please make sure that options JTAG_MODE=0, NVCC_JTAG is applied.

[jochen]

Thank you Victor. On the developer boards, there are three sockets that fit the 10 pin jtag plugs. On the bricked board, I could solder them on easily. 

Now, as I have zero experience using JTAG for anything, I do not know what I need to flash uboot via JTAG.

My colleagues who work with some STM32 µCs have a debugger "Power debug USB3" by a company named Lauterbach. Apparently you need a specific debug cable for that debugger to connect to a certain architecture. I have been told, that those cables cost a lot of money which is a problem. 

Now, are you aware of a cheap way to put something different together that allows me to flash the uboot with open source software/hardware tools. Some off-the-shelf hardware to buy less than 100€/$ ?

Thank you!

[b36401]

Here is an article regarding to load u-boot with JTAG:

https://community.nxp.com/thread/438586

[b36401]

Please try lo load u-boot via jtag.

If you have no jtag interface I can suggest to unsolder eMMC (or some other media the board uses to boot) and program it separately.

Have a great day,
Victor

-----------------------------------------------------------------------------------------------------------------------
Note: If this post answers your question, please click the Correct Answer button. Thank you!
-----------------------------------------------------------------------------------------------------------------------