How to reanimate a bricked iMXS Micro Framework reference board..

..or simply how to use JTAG. In Visual Studio it’s only one click to deploy your application to the USB connected Micro Framework board. But at some point this might not work for whatever reason. Maybe you tried to update the booter or TinyCLR using FlashLiteClient or MFDeploy and something went wrong during flashing. These deployment tools need some kind of software running on the target board to talk to. But what if this software gets corrupted? How can we re-establish the factory state of the board?

Fortunately the latest iMXS Development Kit contains beside the two available booters the original binary image of the shipped sideshow application. There is also a document with the flashing instructions included: “Software Used: ARM Developer Suite V1.2, Hardware Used: ARM Multi-ICE debug unit.” This doesn't sound very cheap. And in fact you have to spend several thousand dollars to get this. But do we really need this equipment just for flashing?

The answer is No!

If you look around you will find some really low-priced JTAG adapters, which can be used to access the hardware as well. In the following we’ll use the USB JTAG debugger “ARM-USB-OCD” from Olimex (about 70$) and the software OpenOCD (it’s free like free beer).

• First of all we have to install the drivers for the JTAG adapter and OpenOCD
  


• OpenOCD needs some information about the connected device to talk to. For example what type of cpu and flash is used. This is provided by a simple configuration file. For the iMXS board it looks like this (save it as imxs.cfg):


#daemon configuration
telnet_port 4444
gdb_port 3333

#interface
interface ft2232
ft2232_device_desc "Olimex OpenOCD JTAG A"
ft2232_layout "olimex-jtag"
ft2232_vid_pid 0x15BA 0x0003
jtag_speed 0

#use combined on interfaces or targets that can't set TRST/SRST separately
reset_config trst_and_srst

#jtag scan chain
#format L IRC IRCM IDCODE (Length, IR Capture, IR Capture Mask, IDCODE)
jtag_device 4 0x1 0xf 0xe

#target configuration
daemon_startup reset

#target type endianess reset mode
target arm9tdmi little reset_halt 0 arm920t

working_area 0 0x09FF0000 0x4000 nobackup
#run_and_halt_time 0 5000

#flash configuration
#flash bank driver base size chip_width bus_width
flash bank cfi 0x10000000 0x800000 2 2 0



• Now we connect the JTAG adapter with the board (check the JTAG wiring!) and run OpenOCD with our configuration file as a parameter:
  "C:\Program Files\openocd\bin\openocd-ftd2xx.exe" -f imxs.cfg
  
  
  
  No, that’s not an error message! Everything went well when this command window appears. There is no nice GUI and you can not even type in anything. How does it work? OpenOCD runs as a server, waiting for connections from clients like telnet or GDB. In the configuration file we specified the telnet port as 4444.
  


• Let’s try to connect: telnet 127.0.0.1 4444
  
  
  
  As a warm up we first should try some easy commands without any risk to harm someone. For example "help". (Also take a look at the quick reference card.)
  
  
  
  • The command "mdb address count" displays count bytes at the specified address. The flash memory of our iMXS board starts at address 0x10000000. Let's dump the first 64 bytes:
    mdb 0x10000000 64
    
    
    (very interesting..)
    
  
  
  • Of course it's also possible to dump the content of the whole 8mb flash memory to a file:
    dump_image MyDump.bin 0x10000000 0x800000
    
  
  
  • Before we can write to the flash, we have to probe it (0 is the flash bank):
    flash probe 0
    
    
    
    
  
  
  • Some more information provides the command:
    flash info 0
    
  
  
  • Now we can erase the flash (bank 0, starting at sector 0, including last sector 63):
    flash erase 0 0 63
    
  
  
  • Again we take a look at the beginning of the flash:
    mdb 0x10000000 64
    
    
    
    voilá, only ffffffffffffffffff... The flash is erased.
    
  
  
  • To write the data, we use the command "flash write_binary bank file offset"
    flash write_binary 0 FSL_MXSdevkitImage_Flash8MB_RTM.bin 0
    (Now it's time to get some coffee, this takes some time..)
    
  
  
  • Finally we take again a look at the flash:
    mdb 0x10000000 64
    
    
    
    This looks good! There seems to be something usefull in flash and with some luck the device will be alive again :)