Welcome to my technical errance trying to perfect those micro-computers


openocd and jtag to unbrick my iconnect

I bricked my iconnect when i decided to update the u-boot.
In this case the serial connection is unusable. Although there is a protocol permitting to a Marvell's feroceon soc (system on a chip) to boot from a serial port. It didn't work for me.

I searched for a jtag solution, preferably an open source one. I found openocd and a cheap usb interface the  DLP-USB1232H. Mine come from digi-key.

Second step was to compile the openocd on my debian system (its openocd-0.4.0 and i use debian 6.0). Maybe you can download it in your system's repository and don't need to compile it !!

   ./configure --enable-maintainer-mode --enable-ft2232_libftdi
   make install

The configure parameters and howto for openocd where found on the web particularly here :
and here
and there

I also compiled the libftdi library.

If all compiles ok you can copy the new board configuration file iconnect.cfg to the place the openocd server will try to find it (/usr/local/share/openocd/scripts/boards/ for my machine).

Now you have to open the box (four screws under the rubber "feets" and pry off the two plastic parts of the box). And make some soldering.

The connexion is a bit "straight" but it wasn't in my intention to make it permanent and the standard jtag connector is too big to fit in the iconnect's box.

What follows is extracted from the documentations of the ARM's JTAG and the DLP-USB1232H USB to serial module. The JTAG port of the iconnect is a standard one. You can verify it with a voltmeter connected between the ground pins (pins 4 6 8 10 12 14 16 18 and 20) and vsupply (pin 2) or vref (pin 1)

Pin type DLP-USB1232H pin # | JTAG pin
TRST 17 | nTRST 3
TDI 16 | TDI 5
TMS 5 | TMS 7
TCK 18 | TCK 9
TDO 2 | TDO 13
(S)RST 13 | nSRST 15
GND 1 or 10 | GND 4 6 8 10 12 14 16 18 20

IMPORTANT: You also need to connect pins 8 and 9 together on the DLP-USB1232H module in order to configure it to be powered via USB.

Pin 1 Pin 18
| |
| |
| |
| |
| |
Pin 9 USB connector Pin 10
Top View
(Interface Headers on bottom of PCB)

Standard 20 pins JTAG pinouts
5 TDI  GND 6
7 TMS  GND 8
9 TCK  GND 10
11 RTCK GND 12
13 TDO GND 14
15 nSRST GND 16

The pin 19  of the JTAG connector on the iconnect board is in the lower left corner when the power led faces you. I'll may draw a very pretty schematic one future day...

Copy the openocd local configuration file : openocd_iconnect.cfg to your home directory or where you dowloaded the code from my repository (see below).

Connect the DLP-USB1232H to an usb port.

And at last, launch the openocd server with (can be done as lambda user depending on how you compiled and stored the files) :
   openocd -f ./openocd_iconnect.cfg

If all went ok you will see a dialog like this :

hso@debian-100:/mnt/data/src/u-boot-2011.03-rc1$ openocd -f ./openocd_iconnect.cfg
Open On-Chip Debugger 0.4.0 (2011-04-25-07:10)
Licensed under GNU GPL v2
For bug reports, read
debug_level: 1
jtag_nsrst_assert_width: 1000
jtag_nsrst_delay: 200
jtag_ntrst_delay: 200
3000 kHz
trst_and_srst separate srst_gates_jtag trst_push_pull srst_open_drain
jtag_nsrst_delay: 200
jtag_ntrst_delay: 200
trst_and_srst separate srst_nogate trst_push_pull srst_open_drain
    TargetName         Type       Endian TapName            State       
--  ------------------ ---------- ------ ------------------ ------------
 0* feroceon.cpu       feroceon   little feroceon.cpu       running
target state: halted
target halted in ARM state due to debug-request, current mode: Supervisor
cpsr: 0x400000d3 pc: 0x0ff7c428
MMU: disabled, D-Cache: disabled, I-Cache: enabled
background polling: on
TAP: feroceon.cpu (enabled)
target state: halted
target halted in ARM state due to debug-request, current mode: Supervisor
cpsr: 0x400000d3 pc: 0x0ff7c428
MMU: disabled, D-Cache: disabled, I-Cache: enabled

Sometime the JTAG interface and the cpu don't synchronize. The cure is to disconnect the power cord of the iconnect and relaunch openocd (after a ctrl-c to stop it).

Now the grand final : re-flash the u-boot !!
Launch a telnet session on another terminal to pass command line to the openocd server (port 4444 is coded in one of the "openocd_iconnect.cfg" configuration files of openocd) :

    telnet localhost 4444

Hopefully you will see:

hso@debian-100:/mnt/data/src/u-boot-2011.03-rc1$ telnet localhost 4444
Trying ::1...
Connected to localhost.
Escape character is '^]'.
Open On-Chip Debugger

You are in the place !! The commands to flash the u-boot are automated in a script called "init6" in the openocd's board file "iconnect.cfg". But for the first try it may be more didactic and secure to try the subcommands step by step. You start by init, then init2, then init4 etc... The "#" comments out some lines, either because they fails like "nand verify" or because i desabled this line.

proc init6 { } {
nand probe 0
nand list
nand erase 0 0x0 0xc0000
nand info 0 0 10
nand write 0 u-boot.kwb 0 oob_softecc_kw
# nand verify 0 u-boot.kwb 0 oob_softecc_kw
# nand erase 0 0xA0000 0x20000
# nand write 0 iconnect_uboot_env.txt 0xa0000 oob_softecc_kw
# nand write 0 iconnect-mtd1 0xA0000 oob_softecc_kw

I comments the actions here :

The first "init" command is the standard one for the openocd server.
"init2" prepare some areas in the iconnect to permit it to start like a fresh boot.
"init4" initialise the SDRAM controller (dont know if its really necessary but it was part of my experiments).
"iconnect_reset_cpu" puts the feroceon soc in the supervisor state. found somewhere on the net.

"nand probe 0" detect the flash chip you must receive  this response :

NAND flash device 'NAND 512MiB 3,3V 8-bit' found

"nand list" to verify all nand parameters (yes i am a bit paranoid)

#0: NAND 512MiB 3,3V 8-bit (Hynix) pagesize: 2048, buswidth: 8,
blocksize: 131072, blocks: 4096

"nand erase 0 0x0 0xc0000" clear the flash for what will become the mtd0 flash area.

"nand info 0 0 10" verify if the area is erased.

"nand write 0 u-boot.kwb 0 oob_softecc_kw" flash the u-boot with its kwb header. This header permit to the primary ROM in the feroceon cpu to initialize the iconnect to launch the u-boot.

The last three lines of "init6" do the same thing with the u-boot parameters stored in flash area "mtd1". If you don't run this commands now, u-boot will create a default environment in ram at first run. You can then re-create the env flash partition with the u-boot command "saveenv".
The size of the two flash areas are hardcoded in u-boot. The patching of u-boot for the iconnect is the object of another (future) post .

Its all. Disconnect then reconnect the power cord of the iconnect and you should see a little message on the serial port).

The collection of code i loaded to the new iconnect is stored here : arm-linux-2.6.39

This directory contains :
the patched and compiled u-boot, u-boot-2011-03-rc1-iconnect.kwb, ready to flash
The patch for the Denx version of u-boot is in this directory too.

The patched and compiled linux kernel version 2.6.39 and its initrd (with mtd-utils, ubifs, squashfs).

the openocd parameters iconnect.cfg
(to be stored in the openocd's /usr/local/share/openocd/scripts/boards/)

the openocd command line parameters to be stored
 in a directory of your choice : openocd_iconnect.cfg

On some next post i will explain how to patch, compile and flash the kernel and initrd. But if you search you will find a lot of documentation on the web.

Last minute :

Here are the u-boot parameters i used to boot this kernel. If i boot only from flash with a squashfs in an ubifs partition (note the kernel wait for the exact value 0xb36 as machine number) :

setenv machid 0xb36

setenv bootcmd 'setenv bootargs $(bootargs_console); run bootcmd_usb; bootm 0x00800000 0x01100000; reset'

setenv bootcmd_usb 'nand read.e 0x800000 0x100000 0x300000; nand read.e 0x1100000 0x500000 0x500000'

setenv bootargs_console 'debug boot=live ubi.mtd=4 live-media=/dev/ubi0_0 rootfstype=ubifs console=ttyS0,115200n8 persistent quickreboot no_console_suspend utc=yes timezone=GMT+4 ip='

If i boot only from usb  (ext2fs or ext3fs) :

setenv machid 0xb36

setenv bootcmd 'setenv bootargs $(bootargs_console); run bootcmd_usb; bootm 0x00800000 

setenv bootcmd_usb 'usb start; ext2load usb 0:1 0x01100000 /boot/uInitrd-arm-live-2.6.39; ext2load usb 0:1 0x00800000 /boot/uImage-arm-2.6.39;'

setenv bootargs_console 'debug console=ttyS0,115200n8 mtdparts=orion_nand:0xa0000@0x0(uboot),0xc0000@0xa0000(env),0x400000@0x100000(uImage),0x500000@0x500000(uInitrd),0x1f400000@0xb00000(live-iconnect) root=/dev/sda1'

you can boot from an usb key (fat) :

setenv bootcmd_usb 'usb start; fatload usb 0:1 uInitrd-arm-live-2.6.39; fatload usb 0:1 0x00800000 uImage-arm-2.6.39;'


  1. Hello. Nice post. I have an iconnect too! Could you post differences between your uboot and the stock uboot that cames with the device?

    Stock uboot is capable to boot from usb and can handle leds. I suppose that your uboot can do it as well...

    What arcnumber are you using to boot the kernel? the RD arcnumber or the new iconnect arcnumber?

    Thanks for your time

  2. Yes this u-boot is a standard one i modifed to run on the iconnect. It can boot from usb too. I didnt try the tftp boot but it may do it well. The directory where it lies contains also the patch to rebuild the code.
    Tell me if you cannot access this directory from the internet.

  3. I can access to your files and can patch the uboot sources with your patch. Everything compiles fine in codesourcery or on a ARM-native machine. But I don't have a JTAG device and I will only flash a new uboot if it has some new features...

  4. It's ok. I compiled this version of u-boot to unbrick the iconnect because i didn't have a save of the original one and when i tried to compile the one from iomega, i got compiles errors.
    The other reason is that when i tried to format and write to the flash with a new version of the kernel i got ecc errors. If fact the soft ecc algorithms changed in between. And when you have to install a new kernel. you have to install a new u-boot.

  5. Hi himax,

    On your picture, why is this connexion missing?
    (S)RST 13 | nSRST 15

    I'm trying to run openocd following your post, but I get this error:
    Open On-Chip Debugger 0.4.0 (2010-02-22-19:05)
    Licensed under GNU GPL v2
    For bug reports, read
    debug_level: 1
    jtag_nsrst_assert_width: 1000
    jtag_nsrst_delay: 200
    jtag_ntrst_delay: 200
    trst_and_srst separate srst_gates_jtag trst_push_pull srst_open_drain
    jtag_nsrst_delay: 200
    jtag_ntrst_delay: 200
    trst_and_srst separate srst_nogate trst_push_pull srst_open_drain
    Error: unable to open ftdi device: device not found
    Command handler execution failed

    Must I power on the iconnect before running openocd?

    I don't manage to solder the gnd wire onto the jtag connector. Do you have a tip?


  6. Ben : Yes the (s)rst have to be connected. I forgot it in my first test, but it worked ! In fact i had some errors reporting no response to reset from the iconnect. But i didn't found why !!

    The error message you get seems to be due to the fact that openocd don't find your hardware.
    When you install openocd, be sure that the hardware you use (mine is ftdi's DLP-USB1232H) is recognised by your machine. Under linux you can use lsusb to list the usb peripherals an dmesg to see if a device file has been created by the udev daemon. The following page is very well written :
    This one too :,_Explorer_and_eGo_(Pollux)_FTDI_JTAG_How_To

    Check if the libftdi library is also installed.

    Yes the iconnect must be powered before starting openocd.
    (all this prose assumes that you use linux, for windows i dont know ..). The script will reset the feroceon processor in debug state when you launch openocd.

    All the even numbered pins on the jtag connector are ground (except the pin number 2). I used the last one (20) but they are all interconnected.

  7. Thanks for your answer himax!

    I use linux and the dlp-usb1232h too.

    Please could you show me what you get running lsusb and dmesg with AND without the iconnect powered?


  8. Please, which interface/dlp-usb1232h.cfg file do you use?


  9. hi hierso! At least I decide to upgrade the stock uboot with the one you provided! It works great itself: faster, more simple on prompt and you can modify all env parameters. Usb boot and Tftp boot works well.

    But Ethernet connection doesn't work anymore! Ok It works on the u-boot prompt and can do ping or load an archive with tftp, but when linux is working I can't make ping....

    Do you have any trouble with network connection?

  10. Ben : my interface/dlp-usb1232h.cfg contains

    # DLP Design DLP-USB1232H USB-to-UART/FIFO interface module
    interface ft2232
    #ft2232_device_desc "FT2232C Dual"
    ft2232_vid_pid 0x0403 0x6010
    ft2232_layout usbjtag
    jtag_khz 3000

    The lsusb print this line :

    ID 0403:6010 Future Technology Devices International, Ltd FT2232C Dual USB-UART/FIFO IC

  11. pazos : the ethernet problem could come from your kernel. What version do you use ?
    The one i use now is this one arm-linux-2.6.39
    The url is on the pages above. I compiled it with some patches to enable the ethernet port.

  12. Thanks a lot! I use your linux.config on the top of a new 3.0 vanilla version (without the squashfs patch -only iconnect-setup.c related stuff-) and now ethernet connection works!

    But I found other options than defaults when I use your kernel config in the same kernel source tree (like DSA support). Why?

  13. Hi Himax,

    My iconnect is now unbricked!!
    Many many thanks for your help!!


  14. Pazos : i use the iconnect as a server and i need ssh. Then i included crypted algos in the options.

    Ben : you are welcome. Tell us if you used the old kernel or another one.

    I bought another iconnect to experiment new stuffs. The old one is now booting entirely from flash. My root filesystem is stored in a squashfs archive stored in the flash rom after the uboot, the kernel and iniotrd. I'll post on it some next day.

  15. Hi Himax,

    In fact, u-boot is now working but I can not yet boot from my usb stick, it stops:

    Starting MTA: exim4.
    /etc/init.d/rc.local: 45: cannot create /sys/class/leds/power_blue_led/brightness: Directory nonexistent
    startpar: service(s) returned failure: rc.local ... failed!
    INIT: no more processes left in this runlevel

    I use 2.6.39 kernel and these u-boot env vars:
    setenv bootargs_console 'console=ttyS0,115200 mtdparts=orion_nand:0xc0000@0x0(uboot),0x20000@0xa0000(env),0x300000@0x100000(zImage),0x300000@0x540000(initrd),0x1f400000@0x980000(boot) root=/dev/sda2 rootdelay=10 3'
    setenv bootcmd_usb 'usb start; ext2load usb 0:1 0x00800000 /uImage'
    setenv bootcmd 'setenv bootargs $(bootargs_console); run bootcmd_usb; bootm 0x00800000; reset'

    I don't know what to do now :-((

    Good to hear you can boot from nand!!


  16. Hi,

    My boot problem is solved!
    I just had trouble with the serial output ;-)

    But the network is down.
    I found that the mac address is wrong in u-boot.
    I changed it (setenv ethaddr 00:d0:b8:0c:9f:72), but it still fails...
    The usb stick I use works with another (non bricked) iconnect (with the stock u-boot).

    Any idea?


  17. Hi himax,

    I finally get original u-boot file.
    My iConnect is now really unbricked ;-)

    Thanks again for your precious help.


  18. Hi himax!

    Another stupid question! Have you had any problem with the pci express card??? Any of the three wireless cards that I've tried works. No output at all in 'lspci'

    Thanks for you time

    1. me too. The problem may come from the kernel not implementing the right drivers.

    2. @pazos : its ok, the problem were from the pcie init not called in my linux kernel patche. Now the iconnect see my wifi interface. In the meantime i also upgraded the u-boot to 2011.12rc3 (see post and the kernel to 3.3.0.cr7.
      I also put the kernel in an ubifs partion in Nand. More details in a next post ...

  19. Hello!

    Can you halp me. My iconnect dead, and would like to unbrick them.

    When write "init2" in openocd telnet session i got:
    > init2
    use of EmbeddedICE dbgrq instead of breakpoint for target halt disabled
    feroceon.cpu mww address data [count]
    mww ['phys'] address value [count]
    Runtime Error: /usr/share/openocd/scripts/board/iconnect.cfg:116:
    in procedure 'init2'
    in procedure 'mww' called at file "/usr/share/openocd/scripts/board/iconnect.cfg", line 116

    1. it seems that the problem come from the version of openocd, my version is 0.4.0, and th "iconnect.cfg" (in /usr/local/share/openocd/scripts/board/ directory) contains mww commands commented by "#" at the end of the lines.
      I tried with a freshly downloaded version, but it seems that some other problem arose : the NAND chip is not recognized now.
      The search continues ...

    2. @ arteq : the version of openocd i play witw now is "0.60.0" (compiled last night).
      In fact the flash NAND is recognized, only its name is not !
      Thus the flashing procedure work well. I'll next post the updated version under another page.

    3. Look at for the patches and modified configuration files.

  20. I try hard but.. i get errors like this..
    trst_and_srst separate srst_nogate trst_push_pull srst_open_drain
    Warn : JTAG tap: feroceon.cpu UNEXPECTED: 0x00000000 (mfg: 0x000, part: 0x0000, ver: 0x0)
    Error: JTAG tap: feroceon.cpu expected 1 of 1: 0x20a023d3 (mfg: 0x1e9, part: 0x0a02, ver: 0x2)
    Warn : Unexpected idcode after end of chain: 1 0x00000000
    Warn : Unexpected idcode after end of chain: 33 0x00000000
    Warn : Unexpected idcode after end of chain: 65 0x7d000000

    What's going on? Can you help me?

  21. At first look, the processor seems to not responds to the jtag requests.
    Check first that :
    - the iconnect is powered (does the leds emit light ?),
    - there is no mismatch in the connections (a last, i soldererd a 20 way jtag connector on my board). This one at digikey or similar is ok : "A33165-ND CONN HEADER LOPRO STR 20POS",
    - your jtag interface is ok (i am searching to make a loopback connector to check the lines, its a 2 channel serial port after all).

    1. -light is brighter with rst connected
      -i checked connection twicce
      -jlag is new, i suppose its fine:

      I have following errors on openocd 0.4.0
      Open On-Chip Debugger 0.4.0 (2012-08-29-02:08)
      Licensed under GNU GPL v2
      For bug reports, read
      debug_level: 1
      jtag_nsrst_assert_width: 1000
      jtag_nsrst_delay: 200
      jtag_ntrst_delay: 200
      Error: The specified JTAG interface was not found (ft2232)
      The following JTAG interfaces are available:
      Command handler execution failed

      but on openocd 0.5.0 or 0.6.0rc1 (with iconnect2.cfg)

      root@debian:/usr/local/share/openocd# openocd -f ./openocd_iconnect2.cfg
      Open On-Chip Debugger 0.6.0-rc1 (2012-09-01-15:49)
      Licensed under GNU GPL v2
      For bug reports, read
      debug_level: 2
      2000 kHz
      adapter_nsrst_assert_width: 3000
      adapter_nsrst_delay: 200
      Info : only one transport option; autoselect 'jtag'
      trst_and_srst separate srst_gates_jtag trst_push_pull srst_open_drain
      adapter_nsrst_delay: 200
      jtag_ntrst_delay: 200
      missing: -option VALUE ..."tup.tcl:20: wrong # args: should be "
      in procedure 'script'
      at file "embedded:startup.tcl", line 58
      at file "./openocd_iconnect2.cfg", line 20
      in procedure 'feroceon.cpu' called at file "scripts/board/iconnect2.cfg", line 5
      in procedure 'ocd_bouncer'
      at file "embedded:startup.tcl", line 20

      on winxp 0.5.0
      EICE is not recognize or something like that

      any ideas?

    2. openocd 0.5 on xp platform
      after connected telnet:
      unexpected Feroceon EICE version signature
      use of EmbeddedICE dbgrq instead of breakpoint for target halt disabled

      unknown NAND flash device found, manufacturer id: 0xff device id: 0xff

    3. The version i use is the "0.6.0", and the name of the commands changed between versions 0.5.0 and 0.6.0 !!
      Could you send all the dialog with the openocd. Includind the command line ?
      do you use the last config files for openocd ? Please look at this page :
      You just need the config file at the end of the page.

  22. Yes, i use this file openocd_iconnect2.cfg for openocd 0.6.0.

  23. OK.. another problem, i write uboot, but something seems to be wrong.. ERROR: can't get kernel image! after boot

    Any ideas?

    1. It would be better if you display the whole boot message !
      Is it a mesage of uboot ?
      What version of kernel do you use ?
      Where did you put the kernel image : in flash rom, on a usb disk ?

    2. I used obsy image, and everything is fine.

      My previous problem was totally my fault.
      Soldering was bad:(

      Thank for you interest..

  24. Great post man thanks for sharing this useful information as i was in serach for Xbox One Jailbreak download finally i found one original and working Xbox One Jailbreak download & Xbox One Jtag for free follow the link to read more.

    If you are looking for an Xbox 360 Jailbreak then your search is over now as we are giving you a chance to jailbreak your Xbox,Visit Xbox 360 Jailbreak download for free with Guide & Xbox 360 Jtag Download