Lets say I get a new iMX6SL based board with BOOT_MODE = 00 so that it boots from FUSEs. The first time I power on the system it will see that the FUSEs have not been set, so it will start the Serial Downloader. I connect to the serial downloader using the Freescale MFG TOOL and load my script than sets the FUSEs to boot from SPI NOR FLASH. Then I write the image I want to boot into the SPI FLASH. When I power cycle the device it will boot from the SPI FLASH as expected. So far so good.
Now what if there is a problem with the image I flashed to the SPI and I want to enter the MFG TOOL again to fix? How do I tell the MX6 that I want to start the Serial Downloader even though the FUSEs say boot from SPI FLASH? The BOOT_MODE pins are hard tied to GND so I cannot change the BOOT_MODE using the pins.
I can think of one option:
Use a JTAG controller to load u-boot in to RAM and then use u-boot to write to the SPI FLASH. However, I already have MFG TOOL scripts ready to go and so it would be nice to use the Serial Downloader.
Is there anyway to use the JTAG interface to reset the MX6 in to Serial Downloader mode in this situation?
Hi Nathan
please look at SDK example system_util.c:
void jump_to_sdp(void)
{
/* Re-configure the clock gating like the ROM expects it */
HW_CCM_CCGR0_WR(0xF0C03F0F);
HW_CCM_CCGR1_WR(0xF0FC0000);
HW_CCM_CCGR2_WR(0xFC3FF00C);
HW_CCM_CCGR3_WR(0x3FF00000);
HW_CCM_CCGR4_WR(0x0000FF00);
HW_CCM_CCGR5_WR(0xF0033F0F);
HW_CCM_CCGR6_WR(0xFFFF0303);
/* enter the ROM Serial Download Protocol */
hab_rvt_failsafe();
}
i.MX 6Series Platform SDK : Bare-metal SDK
Best regards
chip
-----------------------------------------------------------------------------------------------------------------------
Note: If this post answers your question, please click the Correct Answer button. Thank you!
-----------------------------------------------------------------------------------------------------------------------
Update:
I have made some good progress, but not quite there... I can get the device to show up in windows as an HID device but when I use the MfgTool to configure it it locks up at the first step and I never see anything on the debug console that usually shows the Linux Kernel output.
This is what I have so far (in OpenOCD TCL):
proc start_serial_downloader {} {
## THIS DOES NOT WORK YET !!!!!
## It will now enumerate in windows but will not transfer data
halt
dap apsel 0
dap apcsw 1
## Re-configure the clock gating like the ROM expects it
mww phys 0x020c4018 0x00a61324
mww phys 0x020c4068 0xF0C03F0F
mww phys 0x020c406c 0xF0FC0000
mww phys 0x020c4070 0xFC3FF00C
mww phys 0x020c4074 0x3FF00000
mww phys 0x020c4078 0x0000FF00
mww phys 0x020c407c 0xF0033F0F
mww phys 0x020c4080 0xFFFF0303
## Switch to Supervisor mode
reg cpsr 0x00000033
## Allocate some stack space at the top of OCRAM
## -- See Figure 8-3 in the i.mx6sl RM
reg sp_usr 0x0091FFB8
reg sp_svc 0x0091E000
reg sp 0x0091E000
## Code is in thumb format
arm core_state thumb
step
## enter the ROM Serial Download Protocol
## resume 0x000000bc
## I think the SDL expects R0 = 0
reg r0 0
## The address of the ROM Serial Downloader is @ 0xbc
resume [mrw 0xbc]
}
Hi Nathan
SDK has USB examples (Host and Device modes),
one can start with them.
i.MX 6Series Platform SDK : Bare-metal SDK
If you are interested in MfgTool, then I would suggest
to create new thread, since this is new issue.
Do not forget to choose right MfgTool, since every
processor has own version.
Best regards
chip
Not a new issue, still same as original post. My MFG Tool is working great when I set the BOOT_MODE to 01 (Serial Downloader) so I know the tool is the right version and USB is OK on the Windows side.
And, I think the USB is configured OK because the device enumerates and shows the proper device ID in Windows when using my JTAG approach. So the SDK USB examples are of little use.
My problem is that I want to call the Serial Downloader without booting from BOOT_MODE=01, So I need to configure the chip properly before jumping to the function but I must be missing something. I was hoping someone on the ROM team or someone that has done this before could point me to what I am missing.
There are no other API, ROM addresses or other ROM entries to enter Serial Mode
[except described in Reference Manual].
Thanks for the responses. Is there an API or ROM address described somewhere in the Reference Manual? I haven't found one, I was just going by the SDK example you pointed me too ( jump_to_sdp(void) ), and it is not quite working. I assume there is some more setup required than just setting the clock gating as the SDK does.
Sorry, there are no descriptions of ROM and its APIs.
Reason is that ROM is run by security functions, even you
disabled security, security engine will check every ROM step.
One can check application Note AN4581 (Rev. 0, 10/2012) "Secure Boot on i.MX50, i.MX53, and
i.MX 6 Series using HABv4" for some descriptions.
<http://www.freescale.com/files/32bit/doc/app_note/AN4581.pdf>
For this reason I think it is impossible to just jump to
somewhere address of "Serial Mode" function - just because
security engine will not allow its correct execution.
I can not see the necessity of this. Actually, once any boot failed(sd, spi, nand), ROM will go in to serial down load mode.
See OP. The problem is that a "valid" (the ROM boots it instead of the USB Downloader) image could be in the memory specified by the fuses (SPI FLASH, for ex.) but the image itself may be defective. For example, it could not allow writing to the SPI FLASH which leads to a system that cannot be fixed without resorting to JTAG.
Thanks for pointing me to that function, This looks like it should be exactly what I need, but I cannot get it to work. The hab_rvt_failsafe(); is a function pointer to address 0x000000BC. When I try to jump to that address using JTAG, OpenOCD in my case, (after configuring the CCM registers as you specified) I get a get an Abort Exception.
Could there be some other configuration necessary?
Hi Nathan
I am afraid not, sorry.
Best regards
chip