FRDM-RW612 Error: Verification failed @ address 0x18000000

[nguterresn]

Hey!

I've been trying to make the FRDM RW612 work. I was able to flash for a couple of times, until I've connected the Adafruit TFT 2.8 LCD screen on top of the Arduino Header presented in the board, and, after that, I was able to flash a few more times until something went wrong and I couldn't anymore.

I've tried everything at this points:

- Downloaded MCUExpresso, created a default build for the board and tried to flash: failed.

- Downloaded the LinkServer, change from JLink probe to CMSIS, tried to flash: failed.

- Played around with JLink console: I can read and write onto specific addresses, but I can't flash.

I've tried different builds, NXP examples and Zephyr samples (Blinky): does't work.

Here's an example of error message from JLink:

J-Link>loadfile /Users/nunoguterres/Downloads/zephyr.elf 0x18000000
'loadfile': Performing implicit reset & halt of MCU.
ResetTarget() start
Reset via SYSRESETREQ and reset pin + halt after bootloader
ROM entered ISP command handling loop. Re-enable the debug access.
  MSPLIM cleared
ResetTarget() end - Took 113ms
Downloading file [/Users/nunoguterres/Downloads/zephyr.elf]...
J-Link: Flash download: Bank 1 @ 0x18000000: 1 range affected (65536 bytes)
J-Link: Flash download: Total: 0.648s (Prepare: 0.165s, Compare: 0.150s, Erase: 0.004s, Program: 0.145s, Verify: 0.107s, Restore: 0.075s)
J-Link: Flash download: Program speed: 440 KB/s

****** Error: Verification failed @ address 0x18000000
Error while programming flash: Verify failed.

And here is the example of a connection to JLink:

JLinkExe -Device RW612 -speed 4000 -if swd
SEGGER J-Link Commander V8.10 (Compiled Sep 25 2024 14:15:06)
DLL version V8.10, compiled Sep 25 2024 14:14:53

Connecting to J-Link via USB...O.K.
Firmware: J-Link MCU-Link V1 compiled Sep 24 2024 10:57:33
Hardware version: V1.00
J-Link uptime (since boot): 0d 00h 22m 48s
S/N: 1066319194
USB speed mode: High speed (480 MBit/s)
VTref=3.300V


Type "connect" to establish a target connection, '?' for help
J-Link>connect
Device "RW612" selected.


Connecting to target via SWD
InitTarget() start
SWD selected. Executing JTAG -> SWD switching sequence.
DAP initialized successfully.
  DMAP_REG_ID: DM-AP IDCODE detected: 0x002A0000
  DHCSR: 0x05100000
InitTarget() end - Took 2.71ms
Found SW-DP with ID 0x6BA02477
DPIDR: 0x6BA02477
CoreSight SoC-400 or earlier
Scanning AP map to find all available APs
AP[1]: Stopped AP scan as end of AP map has been reached
AP[0]: AHB-AP (IDR: 0x84770001, ADDR: 0x00000000)
Iterating through AP map to find AHB-AP to use
AP[0]: Core found
AP[0]: AHB-AP ROM base: 0xE00FF000
CPUID register: 0x410FD214. Implementer code: 0x41 (ARM)
Feature set: Mainline
Cache: No cache
Found Cortex-M33 r0p4, Little endian.
FPUnit: 8 code (BP) slots and 0 literal slots
Security extension: implemented
Secure debug: enabled
CoreSight components:
ROMTbl[0] @ E00FF000
[0][0]: E000E000 CID B105900D PID 000BBD21 DEVARCH 47702A04 DEVTYPE 00 Cortex-M33
[0][1]: E0001000 CID B105900D PID 000BBD21 DEVARCH 47701A02 DEVTYPE 00 DWT
[0][2]: E0002000 CID B105900D PID 000BBD21 DEVARCH 47701A03 DEVTYPE 00 FPB
[0][3]: E0000000 CID B105900D PID 000BBD21 DEVARCH 47701A01 DEVTYPE 43 ITM
[0][5]: E0041000 CID B105900D PID 002BBD21 DEVARCH 47724A13 DEVTYPE 13 ETM
[0][6]: E0042000 CID B105900D PID 000BBD21 DEVARCH 47701A14 DEVTYPE 14 CSS600-CTI
Memory zones:
  Zone: "Default" Description: Default access mode
Cortex-M33 identified.

I've noticed this behavior has happened twice (in two boards). I really want to believe this has nothing to do with the LCD, since it would place the responsibility of this not working onto NXP/Adafruit hands and faulty design.

Has anyone experienced something like this?

[nguterresn]

This also happens when trying to load an image to flash:

blhost --port /dev/tty.usbmodem0010663191941 flash-image /Users/nunoguterres/mcu-expresso/RW612_Project/Debug/RW612_Project.hex erase 0x09
WARNING:spsdk.mboot.mcuboot:Note: memoryId is not required when accessing mapped external memory (149ms since start, mcuboot.py:1782)
Response status = 20106 (0x4e8a) FlexSPINOR: Command Failure.
blhost --port /dev/tty.usbmodem0010663191941 load-image /Users/nunoguterres/mcu-expresso/RW612_Project/Debug/RW612_Project.bin
Loading image  [------------------------------------]    0%ERROR:spsdk.mboot.mcuboot:RX: No Response, Timeout Error ! (5142ms since start, mcuboot.py:242)

McuBootConnectionError: MBoot: Connection issue -> No Response from Device
See debug log file: /Users/nunoguterres/Library/Logs/spsdk/2.4.0/debug.log for more info

[nguterresn]

 I also have the feeling the JLink is targeting the secure zone (0x1800_0000) whereas the blhost is targeting the non-secure zone (0x0800_0000)

J-Link>erase
No address range specified, 'Erase Chip' will be executed
'erase': Performing implicit reset & halt of MCU.
ResetTarget() start
Reset via SYSRESETREQ and reset pin + halt after bootloader
ROM entered ISP command handling loop. Re-enable the debug access.
  MSPLIM cleared
ResetTarget() end - Took 113ms
Erasing device...
J-Link: Flash download: Only internal flash banks will be erased.
To enable erasing of other flash banks like QSPI or CFI, it needs to be enabled via "exec EnableEraseAllFlashBanks"
J-Link: Flash download: Total time needed: 1.482s (Prepare: 0.199s, Compare: 0.000s, Erase: 1.176s, Program: 0.000s, Verify: 0.000s, Restore: 0.106s)
Erasing done.
J-Link>r
Reset delay: 0 ms
Reset type NORMAL: Resets core & peripherals via SYSRESETREQ & VECTRESET bit.
ResetTarget() start
Reset via SYSRESETREQ and reset pin + halt after bootloader
ROM entered ISP command handling loop. Re-enable the debug access.
  MSPLIM cleared
ResetTarget() end - Took 119ms
J-Link>mem8  0x08001000, 10
08001000 = 01 4B 0C 10 ED FC 05 18 31 14 0A 18 D9 FC 05 18 
J-Link>mem8  0x18001000, 10
18001000 = 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 

[nguterresn]

J-Link>erase
No address range specified, 'Erase Chip' will be executed
'erase': Performing implicit reset & halt of MCU.
ResetTarget() start
Reset via SYSRESETREQ and reset pin + halt after bootloader
ROM entered ISP command handling loop. Re-enable the debug access.
  MSPLIM cleared
ResetTarget() end - Took 113ms
Erasing device...
J-Link: Flash download: Only internal flash banks will be erased.
To enable erasing of other flash banks like QSPI or CFI, it needs to be enabled via "exec EnableEraseAllFlashBanks"
J-Link: Flash download: Total time needed: 1.482s (Prepare: 0.199s, Compare: 0.000s, Erase: 1.176s, Program: 0.000s, Verify: 0.000s, Restore: 0.106s)
Erasing done.

J-Link>r
Reset delay: 0 ms
Reset type NORMAL: Resets core & peripherals via SYSRESETREQ & VECTRESET bit.
ResetTarget() start
Reset via SYSRESETREQ and reset pin + halt after bootloader
ROM entered ISP command handling loop. Re-enable the debug access.
  MSPLIM cleared
ResetTarget() end - Took 119ms

 
After erasing, this is the data at 0x0800_0000:

J-Link>mem8  0x08001000, 10
08001000 = 01 4B 0C 10 ED FC 05 18 31 14 0A 18 D9 FC 05 18 

 
I really don't know what's going on. 

[nguterresn]

Hi,

blhost --port /dev/tty.usbmodem0010663191941 get-property 0x19 0x09
Response status = 0 (0x0) Success.
Response word 1 = 31 (0x1f)
Response word 2 = 134217728 (0x8000000)
Response word 3 = 65536 (0x10000)
Response word 4 = 256 (0x100)
Response word 5 = 4096 (0x1000)
Response word 6 = 32768 (0x8000)
External Memory Attributes = Start Address: 0x08000000, Total Size:    64.0 MiB, Page Size:     256 B, Sector Size:   4.0 kiB, Block Size:    32.0 kiB

blhost --port /dev/tty.usbmodem0010663191941 read-memory 0x08000400 100
Reading memory  [####################################]  100%
46 42 00 00 00 00 00 00 00 00 01 03 03 00 01 00
00 00 01 02 00 00 40 c7 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 01 04 07 00 00 00 00 00 00 00 00 00 00 00
00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00
Response status = 0 (0x0) Success.
Response word 1 = 100 (0x64)
Read 100 of 100 bytes.

FCB (@x400) looks odd!

blhost --port /dev/tty.usbmodem0010663191941 get-property 0x11              
Response status = 0 (0x0) Success.
Response word 1 = 1520786085 (0x5aa55aa5)
Response word 2 = 3 (0x3)
Security State = UNSECURE

blhost --port /dev/tty.usbmodem0010663191941 get-property 0x0a              
Response status = 0 (0x0) Success.
Response word 1 = 1 (0x1)
Verify Writes = ON

I'm not able to write using blhost, but with JLink:

blhost --port /dev/tty.usbmodem0010663191941 fill-memory 0x08001000 10 0x01 
Response status = 10203 (0x27db) Memory Cumulative Write.

blhost --port /dev/tty.usbmodem0010663191941 write-memory 0x08000000 {{aabbccdd}}
Writing memory  [####################################]  100%
Response status = 10203 (0x27db) Memory Cumulative Write.

J-Link>Write1 0x08001000, 0x01
Writing 01 -> 08001000

J-Link>mem8  0x08001000, 10
08001000 = 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 

> Do you recall what was the last application you were able to flash?
 
It was probably the zephyr sample Blinky for this board. But can't be 100% sure.

[DanielRuvalcaba]

Hi,

Are you able to write on flash?

Do you recall what was the last application you were able to flash?

Regards,

Daniel.