Flashing eMMC Bootloader / Unbricking (IMX8MP)

One thing I’ve noticed in my tinkering with the Pocket over the few weeks I’ve had it, is that unlike the original IMX8MQ module in the Reform2, neither the boot switch on the SoM nor the BOOT1 header allow booting u-boot from the SD card. So whilst you can boot the OS from either SD or eMMC based on the inbuilt u-boot script, and can even control this via serial console, it always seems to use the u-boot on the eMMC, and I haven’t found a way to override this.

Why would you want to load u-boot from the SD card, when you have a perfectly good, well designed & configured u-boot on the eMMC, Rayne?

Well, It was always going to happen, really. It was always going to be me posting about this first.

In my ceaseless tinkering, I managed to erase/corrupt the u-boot stored on the eMMC. Yes, I know. Idle hands are the devil’s workshop, but busy hands can be just as bad. There’s a broader lesson for me here, around knowing I didn’t have a way to recover things if I dorked the eMMC u-boot, and messing with it anyway. But! If we can put this aside for a second, I have a few questions:

  1. Is it possible to access the serial download mode / UUU mode using the Pocket Reform mainboard + SoM adaptor? Is the “USB OTG” port on the IMX8MP wired up to one of the USB-C ports on the mainboard? I checked the mainboard schematics, but couldn’t find the schematrics for the Nitrogen8MP → Reform adapter board which comes as part of the SoM to confirm this myself. UUU download to eMMC would get me out of trouble.
  2. Is there a combination of BOOT1 + the BOOT switch which will boot from SD? Reviewing the docs, it seems like if both the BOOT1 and BOOT0 switches (not sure how these relate to the Nitrogen8MP SoM’s BOOT switch + the BOOT1 header on the adapter) it should be possible to load u-boot from SD. This would get me out of trouble.
  3. How are y’all loading the eMMC on the MNT assembly line? Is there some replacement mainboard needed that I could build to expose JTAG, serial download mode, or similar to reload the eMMC?

Thanks!

1 Like

I have a plan to get a SODIMM socket and try and break out power + the USB OTG port and see if I can get the SoM into serial download mode and flash it this way. I’ve ordered one of those cheap SODIMM to regular desktop RAM adapters (because that’s a real thing that exists, and also a cheap way to get a SODIMM socket in australia) and will report back if this works.

Looking at the schematics the JTAG pins on the SODIMM connector aren’t broken out to any headers on the pocket (seems like an odd choice but I guess space). But if you do have a full sized reform as well the pins are broken out there to the JTAG header next to SYSCTL and Hack the planet.

I don’t think USB OTG is going to likely work inside the pocket for programming. The USB1 port looks to be the OTG port (I could be wrong), though that is hooked straight up to the USB hub on the pocket motherboard, and the OTG power enable pin is left floating.

I suspect if there even is a way to program the pocket in circuit it’d have to exist on the SoM board itself as there seems to be no provision on the pocket motherboard itself. The manual suggests as much too saying a special carrier board is needed to flash it.

The Processor Module will try to load boot code (U-Boot)
from eMMC. If that fails, the standard i.MX8M Plus Module
can only be booted using a special USB bootloader mode,
which currently requires the Ezurio Nit8MP_ENC_CAR
carrier board, a USB connection to another computer and
the uuu tool from NXP. Please be careful when modifying
the boot partition on eMMC because it is hard to recover
without a carrier board. Other Processor Modules may have
different boot device options—please refer to their specific
documentation.

EDIT:
Looking at the schematic for the IMX8MP carrier board (in the reform2 repo, assuming it’s the same as the pocket). There is mention of a boot mode for SD card with bootmode 0 and 1 set to 11. SW1 on the carrier and a dip switch on the SoM as well. Could be worth a try.

1 Like

Thanks @Chartreuse - this is super helpful. I do have an original reform handy and may try the JTAG route given that’s broken out there. It’s also super helpful to know where the adapter board lives, I didn’t even think to check the reform2 repo. It’s also funny, I must have been looking at an older version of the reform docs, I didn’t find any reference in the material. I did find a bunch of stuff in the datasheet that Mouser has for the nitrogen8mp SoM and the boundary devices wiki, though. The schematic references are also helpful. I haven’t managed to get the BOOT0 + BOOT1 trick to work yet, but I do wonder if that’s because the actual SD card port it’s trying is different to the one wired to the socket? I’ll experiment some more and try the JTAG route. Thanks!

If I get the OTG thing to work I might also design a quick carrier board for flashing the module via OTG in KiCad, if I do that I’ll be sure to share the sources. Very glad to have these options & very much enjoying tinkering with this.

OK, after some more schematic review and a small amount of soldering I’ve worked out a few things:

  • Reviewing the schematics again, the OTG port is USB2 on the SoM connector, and the SO-DIMM connector used in the reform & pocket reform
  • With a reform2 motherboard, you can swap the imx8mp module in, flip the BOOT switch on the imx8mp SoM, and the 3rd USB port next to the HDMI port is the OTG port. You can then use uuu to unbrick the module if you’ve corrupted the eMMC and have access to a reform2 motherboard or reform2 laptop
  • With just a pocket reform, you should be able to use the SYSUSB connector accessible on the pocket reform motherboard to access USB2, the OTG port. This however didn’t work when I tried - I’ve worked out why.
  • On the current revision Pocket Reform motherboard, the RUD- and XUD-, as well as the RUD+ and XUD+ pins on the 6-pin jumper connector which switches between the LPC and SoM connection for SYSUSB are swapped, such that the jumpers to not switch between the LPC and SoM, but rather switch between connecting the LPC to the SoM, or the LPC to the SYSUSB connector, but it’s not possible to connect the SoM to the SYSUSB connector with the jumpers. It’s a really small, easy to make routing issue on the board, and should also be really easy to correct. I’ve done some soldering to bypass this, and can confirm the OTG port is indeed accessible on the SoM using SYSUSB if this is bypassed/bodged.
  • I was able to use UUU to boot from USB a compatible u-boot image on both the reform2 board and pocket reform (with bodge wires)

I’ll do a bit more experimenting, and then write up an actual guide on de-bricking once I actually have the eMMC flashed & recovered via UUU.

5 Likes

So using my bodge wires, I was able to fully recovery by Pocket Reform with IMX8MP. The steps were as follows:

NOTE: The following starts with the Pocket Reform switched off. It will need to be powered on when you are done, but for the first steps you should disconnect the charging cable, and the green and black battery cables at the bottom of the board per the maintenance advice in the manual.

  1. Remove jumpers from J21/USBSEL header on Pocket Reform motherboard
  2. Solder 1 wire between pin 1 and 5 on J21 USBSEL
  3. Solder 1 wire between pin 2 and 6 on J21 USBSEL
  4. Switch the small switch on the IMX8MP SoM labelled BOOT to the ON position. For the computers amongst us, this is not the “1” position, but the ON position, which says “NO” if you look at it the wrong way. Note this is not the BOOT1 jumper on the carrier board, but the small DIP switch with kapton tape over it on the actual SoM board. You’ll need a little screwdriver or whittled bone or something to do this.
  5. Connect a USB cable to the SYSUSB connector. I used a USB-C to USB-A cable, and plugged the USB-A into my desktop computers. I found that a USB 2.0 USB-C to USB-C did not work, likely because the resistors interfered with the operation of USB-OTG negotiation or something like that.
  6. Reconnect cables (battery & charger cables) and switch the Pocket Reform on.
  7. On the computer you have connected the other end of the USB cable to, you should see a USB device appear with ID 1fc9:0146 NXP Semiconductors SE Blank 865. You can check this with lsusb if you’re on Linux etc.
  8. Download and install UUU (the IMX manufacturing tool). It is packaged for most operating systems - on NixOS I just ran nix-shell -p uuu. It’s also packaged for Debian unstable/sid I think.
  9. Download the latest imx8mp u-boot image from the build artefacts in the latest CI job from this MNT project. The one I used was called imx8mp-mnt-pocket-reform-flash.bin
  10. Run uuu -b emmc imx8mp-mnt-pocket-reform-flash.bin in the directory where you have downloaded the u-boot binary from MNT
  11. This will upload and run u-boot from USB. You should be able to either boot an inserted SD card with the system image on it, or if you have an intact system image / install on your eMMC, you should be able to boot that too
  12. Once booted into either an SD image or eMMC install, you should download the u-boot binary onto the Pocket Reform itself.
  13. I found the uuu -b emmc command didn’t properly flash the u-boot binary onto the emmc for some reason, so once I was booted via UUU, I used dd to update it. First you need to enable writing to the boot part of the eMMC with echo 0 > /sys/class/block/mmcblk2boot0/force_ro. This needs to be run as the root user, so use sudo -i to get a root shell first, if you’re not logged in as root.
  14. With the u-boot image downloaded to imx8mp-mnt-pocket-reform-flash.bin, run dd if=imx8mp-mnt-pocket-reform-flash.bin of=/dev/mmcblk2boot0 && sync. This also needs to be run as root.
  15. You should now be able to turn the BOOT switch on the SoM to “1” aka off, it shouldn’t be set to “ON”.
  16. Reboot your Pocket Reform, and you should be able to boot up as normal and boot either an SD or eMMC install.

A very skilled MS-paint level drawing of how the bodge wires should be connected:

4 Likes

OK… I think I may be in a similar situation here :slightly_frowning_face:

I tried using reform-flash-uboot emmc to update uboot (see my other post) and now I’m in a situation where the Pocket Reform seemingly powers up (OLED comes on, keyboard backlight comes on), but there is no screen output. The uboot update appeared to run - downloaded flash.bin and flashed it - but now I have no further life.

Looking at section 8.1.2 Serial Console of the Handbook, it seems to say (I think?) that I can use a USB-to-UART adapter and connect
J17

  1. 1 S2 UART2_TXD, connect to RX of your adapter
  2. 2 S2 UART2_RXD, connect to TX of your adapter
  3. 3 S2 GND, connect to GND of your adapter

I’ve tried this but I’m not seeing anything on the serial output from my other machine. I’ve also tried wiring according to the actual pinout and pins on the board to the relevant corresponding pins on the UART adapter. I’ve tried with and without a base image on SD inserted i.e. it seems as though boot from flash and SD are both broken in some way.

I unfortunately don’t have a Reform2 or any other SoM adapters. Is this something that requires the bodge wiring and use of the OTG port as described here, or should this be working over UART? Any other ideas?

I just came here and saw there was a draft reply here that i never posted:

I applaud you for figuring this out, well done. BTW the jumper routing is not a bug but intentional: the jumpers are mainly for being able to connect the System Controller (RP2040) either to the SoC (for in system flashing) or usb-c port (for external flashing). Connecting SoC USB2 to the outside like that was in the back of my head, but not realized on the board… I figured one could make an adapter cable, but the jumper cable solution is easier.

1 Like

Yes, if u-boot on the eMMC boot partition is botched, the USB recovery via UUU is the only option, see @digitalrayne’s solution. The i.MX8MPlus module cannot load u-boot from SD card at all. U-boot on eMMC will prefer boot files on SD card, but for that, u-boot on eMMC has to work.

Addendum: soldering wires is not necessary, one could use a 2-pin JST-PH cable to bridge the usb pins (mostly anything that has 2mm pitch between pins).

Something like this should work: JST-PH 2-pin Jumper Cable - 100mm long : ID 4714 : Adafruit Industries, Unique & fun DIY electronics and kits

2 Likes

Thanks! I’ll take a look.

Ahah! That makes a lot of sense. I didn’t realise that the system controller + SoC would be able to work out the controller/device relationship like that but given it’s an OTG connection on the SoC side, I could see how that would work. It would be really tidy if the system controller could be used to restore/flash the eMMC contents so I definitely get the intent there. For now, I also thought of making a small PCB with the required headers on it to bring out the USB connector for this kind of recovery, I’ll update here if I end up doing that. Thanks for the kind words and extra context!

I am now back and booting, thank you @digitalrayne for capturing this process so clearly.

I used Dupont cables to connect the J21 headers, and I found it useful to use a right-angled USB-C connector with the SYSUSB socket since there is not a lot of room between it and the case hinge.

I initially had some confusion because I was flipping the 1/ON switch which you did say was the wrong one, but somehow I convinced myself that must have been it. Here’s my additional highly detailed annotated guidance to others!

Thank you thank you. Now I shall try to avoid messing with uboot, and focus on other things!

4 Likes