Is it possible to edit the BCA ( at address 0xA3C0) from the main application?

[danielcaetano]

Hello everyone,

What I'm trying to do is change the directBoot bit in bootflags from the main application, so i can dictate if I want the bootloader to skip directly to the main app in case of reset, or to actually stay in bootlaoder mode to perform an application update.

I'm using Kinetis Flash Bootloader with a few modifications that shouldn't interfere with this subject.

I followed every step described in "How to adapt KDS applications for KBOOT.pdf". Everything is working smoothly other than this.

To turn on directBoot from my application I'm trying something like this:

memcpy(flashTmpBuffer,0xA3D8,sizeof(uint8_t)*8);   //0xA3D8 is the 8-byte aligned address that contains the bootflags
flashTmpBuffer[6] = 0x01;                                            //0xA3D8 + 6 = 0xA3DE, the location of bootflags
status = FLASH_Init(&s_flashDriver);
status = FLASH_Program(&s_flashDriver,0xA3D8,(uint32_t *) flashTmpBuffer,sizeof(uint8_t)*8);

This causes a "MGSTAT0 non-correctable error" in the function flash_command_sequence (I'm using SDK 2.0).

Do I need an extra step to disable flash security in this sector? If so, how?

Is it even possible to go this route to achieve what I'm trying?

Has anyone done something to the same effect, successfully?

Thank you all for your help :smileyhappy:

Daniel Caetano

[jingpan · Accepted solution]

Hi Daniel,

Have you erase the sector before program?

Regards

[danielcaetano]

Alright it does seem that I forgot that :smileyhappy:

Apparently I will have to erase and rewrite a whole 4kb sector to change one bit. Bummer.

Thank you very much for your support, Jing.

[jingpan]

Hi Daniel,

First of all, I'd like to know if  your flash operation code runs in RAM. If that is not true, I think you may meet a Read While Write Violations. Please look into an4695 in NXP website for the reason and workaround method.

There are several key points you should take care:

* All the flash protection registers are 0xFF

* The flash configuration is set to 0xFFFFFFFE

* Watchdog is disabled

* Interrupts are disabled

* The code is running in RAM

* fails whether or not debugger is attached

Would mind to illustrate which MCU you use?

[danielcaetano]

Hi Jing, thanks for answering.

* All the flash protection registers are 0xFF

* The flash configuration is set to 0xFFFFFFFE

The only unusual thing here is the F9 in the FOPT to disable EzPort. Unrelated to this.

* Watchdog is disabled

* Interrupts are disabled

Watchdog was always disabled. Now I tried also disabling interrupts, but the result was the same.

* The code is running in RAM

fsl_flash.c takes care of it for me. It copies the following function to the Lower SRAM area:

void flash_run_command(FTFx_REG_ACCESS_TYPE ftfx_fstat)

{
/* clear CCIF bit */
*ftfx_fstat = FTFx_FSTAT_CCIF_MASK;

/* Check CCIF bit of the flash status register, wait till it is set.
* IP team indicates that this loop will always complete. */
while (!((*ftfx_fstat) & FTFx_FSTAT_CCIF_MASK))
{
}
}

Investigating the memory everything seemed to be in order, but the MGSTAT0 flag is active after this command runs.

* fails whether or not debugger is attached

Would mind to illustrate which MCU you use?

I first noticed it was failing when the release version of the application was running on the device, with the bootloader on it too. Now I've been testing it with the debugger to try to find out what the problem could be. So, answering your question, it fails whether i'm debugging or not.

I'm using a MK64FN1 MCU in a custom board.