Debug/Flash MCUBoot image after after image swap with XIP FLASH remap enabled Dear Everyone, I would like to ask for any possible reason why does our flash driver fail in one specific situation. We use custom board with IMXRT1176, our board is based on Embedded Artists carrier board for that MCU. In our project there are two partitions in flash, 0x30100000 and 0x30200000. We use MCU-Link and Linkserver to flash binaries. Binaries are signed with --confirmed in this case. We have a FLASH remap functionality enabled so no swap is performed. We observe two situations: 1. If there is a bootloader in flash and an image in partition 1, everything works as expected. 2. Once we complete the OTA upgrade and MCUboot boots new image from a second partition, we can no longer write to FLASH partiton 1 as we get an error from linkserver: ================================================= Nc: Opening flash driver MIMXRT1170_SFDP_QSPI.cfx (already resident) Nc: Sending VECTRESET to run flash driver Nc: Flash variant 'iMXRT1170_SFDP_FlexSPI1_A_QSPI May 15 2026 18:32:39' detected (16MB = 256*64K at 0x30000000) Pb: 1 of 1 ( 0) Writing sectors 16-31 at 0x30100000 with 1048576 bytes Ps: ( 0) at 30100000: 0 bytes - 0/1048576 Ec: op ProgramPage (0x30100000, 0x20002830, 0x4000) status 0x1 - driver reported driver error - EXTSPIJ driver rc 1 - Operation failed Ec: op ProgramPage (0x30100000, 0x20002830, 0x4000) status 0x1 - driver reported driver error - EXTSPIJ driver rc 1 - Operation failed Note that I have erased the first partition with erase-range. I also can confirm that when our firmware does it with flash driver it works as expected. It fails only when i try to do it with the linkserver manually =================================================== Q1. Is there any obvious reason for it? Should we always erase partition 2 or both paritions? Q2. If we have binary built for slot1, does this binary work when we attach to the core which runs with image in partition 2? Does Flash remap make it work? Thanks in advance for any help, Best Regards! Jakub Re: Debug/Flash MCUBoot image after after image swap with XIP FLASH remap enabled Hello Gavin, thank you very much for your response! You really helped me to understand these concepts. If it's possible, could you please help me figure out one more thing? This is partition info i get after OTA: =========== Image 0; name APP; state Permanent: Slot 0 APP_PRIMARY; offset 0x100000; size 0x100000 (1048576): < size="" 821444=""> SHA256 of image payload: C825709456C098E38090... log_addr 0x30100000 remaps to 0x30200000 Slot 1 APP_SECONDARY; offset 0x200000; size 0x100000 (1048576): < size="" 821444=""> SHA256 of image payload: EBFCCC0D3E970230E404... log_addr 0x30200000 remaps to 0x30200000 *ACTIVE* =============== Then I run this script to clear slot0 LinkServer.exe flash MIMXRT1176xxxxx:MIMXRT1170-EVKB erase-range 0x30100000 0x100000 According to what you said, i expected to erase slot1 because remap overlay is active. However that's not the case. What i got after power reset is: ========= Flash REMAP_OVERLAY active. Image 0; name APP; state None: Slot 0 APP_PRIMARY; offset 0x100000; size 0x100000 (1048576): Slot 1 APP_SECONDARY; offset 0x200000; size 0x100000 (1048576): < size="" 821444=""> SHA256 of image payload: EBFCCC0D3E970230E404... log_addr 0x30200000 remaps to 0x30200000 *ACTIVE*========= I still can't write anything to slot0 which is unexpected. Is it possible that erase bypasses the logical mapping of remap but load doesn't? Re: Debug/Flash MCUBoot image after after image swap with XIP FLASH remap enabled Hi @jslota13245 ,
Thanks for your interest in NXP MIMXRT series!
Based on the information you provided, I believe the following reasons should be considered. The failure is caused by the FlexSPI remap still being enabled after OTA. When MCUboot boots slot1 (partition2) via remap, it leaves remap on into the application. LinkServer's .cfx flash driver programs through the AHB logical address, so the remap silently redirects your write to 0x30100000 (partition1) to physical 0x30200000 (partition2) — which already holds the confirmed image and is not blank. NOR flash cannot overwrite it.
Your earlier erase-range 0x30100000 actually erased partition2 for the same reason. Your own firmware works because it programs via FlexSPI IP command mode with explicit physical offsets, bypassing the remap. Note: VECTRESET / debugger attach do not clear the remap — only a POR or an explicit register write does.
Q1: Which partition to erase?
The key is to disable remap first, not just erasing partitions. Recommended:
Before programming with LinkServer, clear the remap registers;
Then erase both partitions (slot0 and slot1). Because direct-XIP selects the highest version, a stale image left in slot1 will make MCUboot pick it again and re-enable remap, so the problem returns;
Q2: Will a slot1 binary work when attached to a core running the partition2 image?
The image should be linked once for the primary slot ( 0x30100000 ); the same binary runs from either slot via remap — no separate slot1 build is needed. When you attach for debug, remap keeps logical addresses consistent, so code reads/breakpoints work fine. However, the same remap changes the physical target when writing flash, so you must disable remap before programming slot0 with LinkServer.
Best regards, Gavin
View full article