BIG FAT WARNING: If you screw up your thermostat by applying the stuff that I wrote, don't blame me. Just because this works for me, does not mean it works for everybody. It depends on JTAG interface, openocd version, probably OS, most likely the wiring, etc.
(still not scared? let's move on, then
).
Took a shot at the JTAG connector again, after playing around with lots of configurations, I found one that actually works, and enables dumping the NAND flash:
This is the pinout (not necessary completely correct, but works for me):
JTAG:
pin 1: RTCK
pin 2: TRST
pin 3: GND
pin 4: TCK
pin 5: GND
pin 6: TMS
pin 7: SRST
pin 8: TDI
pin 9: Vt
pin 10: TDO
serial port (3.3V logic levels, ttymxc0, 115200 baud, 8N1):
pin 11: RxD
pin 12: ??
pin 13: TxD
pin 14: GND
Then, with the J-Link JTAG interface attached, openocd and proper NAND configuration:
Code: Select all
[root@doubletrouble openocd-0.8.0]# openocd -f ./jlink.cfg -f ./toon.cfg
Open On-Chip Debugger 0.8.0 (2015-03-26-19:26)
Licensed under GNU GPL v2
For bug reports, read
http://openocd.sourceforge.net/doc/doxygen/bugs.html
Info : only one transport option; autoselect 'jtag'
adapter speed: 1000 kHz
trst_and_srst srst_pulls_trst srst_gates_jtag trst_push_pull srst_open_drain connect_deassert_srst
dcc downloads are enabled
fast memory access is enabled
trst_and_srst separate srst_gates_jtag trst_push_pull srst_open_drain connect_deassert_srst
trst_and_srst separate srst_gates_jtag trst_open_drain srst_open_drain connect_deassert_srst
jtag_ntrst_assert_width: 50
toon_init
Info : J-Link initialization started / target CPU reset initiated
Info : J-Link ARM V8 compiled Dec 1 2009 11:42:48
Info : J-Link caps 0xb9ff7bbf
Info : J-Link hw version 80000
Info : J-Link hw type J-Link
Info : J-Link max mem block 9576
Info : J-Link configuration
Info : USB-Address: 0xff
Info : Kickstart power on JTAG-pin 19: 0xffffffff
Info : Vref = 2.536 TCK = 1 TDI = 0 TDO = 1 TMS = 0 SRST = 0 TRST = 0
Info : J-Link JTAG Interface ready
Info : clock speed 1000 kHz
Info : JTAG tap: imx27.etb tap/device found: 0x1b900f0f (mfg: 0x787, part: 0xb900, ver: 0x1)
Info : JTAG tap: imx27.cpu tap/device found: 0x07926121 (mfg: 0x090, part: 0x7926, ver: 0x0)
Info : Embedded ICE version 6
Info : imx27.cpu: hardware has 2 breakpoint/watchpoint units
Info : ETM v1.3
Get access to the openocd server and halt the processor:
Code: Select all
[marcelr@doubletrouble openocd-0.8.0]$ telnet localhost 4444
Trying ::1...
telnet: connect to address ::1: Connection refused
Trying 127.0.0.1...
Connected to localhost.
Escape character is '^]'.
Open On-Chip Debugger
> soft_reset_halt
requesting target halt and executing a soft reset
target state: halted
target halted in ARM state due to debug-request, current mode: Supervisor
cpsr: 0x000000d3 pc: 0x00000000
MMU: disabled, D-Cache: disabled, I-Cache: disabled
>
Before I could probe the flash, I had to resume the processor first, then issue a second soft_reset_halt and then it worked. Probably still some wiring issues, or a configuration script that's flawed.
probe flash:
Code: Select all
> nand probe 0
NAND flash device 'NAND 128MiB 3.3V 8-bit (Samsung)' found
check type:
Code: Select all
> nand list
#0: NAND 128MiB 3.3V 8-bit (Samsung) pagesize: 2048, buswidth: 8,
blocksize: 131072, blocks: 1024
.. and dump (see serial output at boot for nand addresses):
Code: Select all
> nand dump 0 u-boot-env.img 0x100000 0x80000
dumped 524288 bytes in 95.674171s (5.351 KiB/s)
>
This gives a file of 512kB size, holding the u-boot environment, as stored in nand flash. The same goes for the other partitions. Especially the root filesystem may take some time
.
Just a quick edit:
1: The thing I'm least sure about is the Vt-pin. A Freescale i.MX27 also has a JTAG_CTRL signal, which is normally pulled up to 3.3V. Pulling this signal low disables the JTAG TAP device. The pin I used for Vt could be that signal. I had to have the serial port attached to get decent signal levels. (2.8V or thereabouts). Without the serial port it was a bit over 1.8 V. So my Vt-pin is probably not what I think it is. There's a strong possibility that Vt should be supplied by the JTAG interface (not standard, but then again, almost nothing about toon's JTAG interface is standard
).
2: The JTAG interface was connected to the processor through a series of 1k resistors, one for each pin. This way, the current never exceeds 3mA, which should be tolerable for normal digital devices. See picture (link, images don't seem to work for me):
dropbox.com/s/ouip4soi35qi1x4/toon_atta ... 00x600.png
Toon attached to my boiler, with JTAG interface, resistors bridge and serial connector.
That's all for now. I'm in, so I can finally reassemble my toon
.
If you have improvements, better solutions, whatever, I'll be happy to hear them (and other people too, most likely).
Please note that I am not an expert in embedded systems or hardware to probe them. So if you have any questions regarding this access route, with other JTAG hardware, software, there's a strong possibility that I cannot really help you.
grtz,
marcelr
