RW612 ROM Bootloader Stuck in ISP Mode and not loading MCUBoot from external flash

[dstarck]

Issue Description
I'm experiencing a consistent issue with the NXP RW612 where the ROM bootloader always enters ISP mode instead of booting from external flash, regardless of the binary structure or configuration used.

Symptoms

• Consistent ISP Mode: Device always enters ISP mode with identical register values
• PC Register: 0x1302B460 (ROM bootloader address)
• Magic Numbers: R1=0x5AC33CA5, R3=0x5AC33CA5, R6=0x55AACC33, R7=0x33CCAA55, R8=0x5AA55AA5, R10=0xC33CA55A, R11=0x55AACC33
• Behavior: Identical across all tested configurations

What I've Tested

1. Custom MCUBoot Builds:

• Signed and unsigned binaries
• Different FCB configurations (with/without CMML)
• Various offset configurations (0x400, 0x1000)

1. Official Zephyr Samples:

• frdm_rw612 board configuration
• rd_rw612_bga board configuration
• Both sysbuild and standard builds
• Signed with imgtool

1. Binary Structures Verified:

• MCUBoot header magic (0x3DB8F396) at offset 0x0000
• FCB signature (FCFB) at offset 0x0400
• Complete FlexSPI configuration with LUT entries
• Proper IVT/MBI headers

Current Setup

• Board: Custom board with RW612
• External Flash: Fidelix memory (IRIS-W106-30B module)
• Toolchain: Zephyr 4.1.0 with Zephyr SDK 0.17.0
• Programming: J-Link via SWD interface

Questions for the Community

1. Boot Sequence Requirements: What are the exact requirements for the RW612 ROM bootloader to successfully boot from external flash? Are there specific hardware configuration requirements I'm missing?
2. FCB Format Validation: What specific FCB format does the ROM bootloader expect? Are there validation requirements or specific parameters that must be met?
3. Hardware Configuration: Are there specific jumper settings, pin configurations, or fuse settings required for external flash boot that aren't documented?
4. Known Issues: Are there known issues with the RW612 ROM bootloader and external flash boot? Has anyone successfully booted from external flash?
5. Working Examples: Does anyone have working examples that successfully boot from external flash on RW612? What configuration did you use?
6. Alternative Approaches: If external flash boot has limitations, what are the recommended alternatives for production deployment?
7. Debugging Steps: What debugging steps would you recommend to identify why the ROM bootloader is rejecting the FCB?

Additional Context

The fact that even official Zephyr samples (frdm_rw612 and rd_rw612_bga) result in identical ISP mode behavior suggests this might be a fundamental issue with either:

• The ROM bootloader implementation
• Hardware configuration requirements
• Our understanding of the boot process

Any guidance or working examples would be greatly appreciated!

[dstarck]

FYI... I was able to implement these changes.  Currently, the custom board I have has locked the Flash memory and I am working to get that unlocked before flashing and testing.

[RomanVR]

Hello @dstarck.

Thanks for the update on your tests. Regarding the flash lock, please refer to the How to solve flashing problems in FRDM-RW612 (flash lock) post, just be careful to select your module specific memory when creating a new workspace.

Please let me know if you are able to unlock the flash.

[dstarck]

thanks, I saw that... I think when I implemented it, it did not work... I need to goo back and look at it again.  Also, I found out just recently that Segger (e.g. my JLink Pro) does not have a loader to flash the binaries correctly for Fidelix type memory which the IRIS-W106-30B module that contains the RW612 chip uses....  so I have to figure that out also (unless you have a loader that I can use).

[RomanVR]

Hi @dstarck.

For a better module-specific support, I suggest to contact directly the module maker (uBlox) in order to access to a wide variety of documentation regarding your own module.

Please let me know if you have any more questions.

[RomanVR]

Hello @dstarck, hope you are doing well.

Please check Chapter 11 - Non-secure boot ROM of the UM11865 - RW61x User Manual available at the product page, which contains information regarding on RW61x boot modes as well as FCB configuration and structure.

Additionally, please refer to Migration guide from FRDM-RW612 to third-party module memories, where a guide and example to configure the IRIS-W106-30B specific flash memory is provided.

Note: You mentioned that you tried to load an RD-RW612-BGA binary into your EVK, this procedure might cause to lock the flash and not be able to write to it, if you see this behavior, take a look into the following post on how to solve it: How to solve flashing problems in FRDM-RW612 (flash lock).

Let me know if the resources are helpful.

[dstarck]

btw... I found the UM11865 User Manual late last night... I will also review the docs you posted... here is a summary of my investigations from this morning: 

IRIS-W106-30B module (RW612-based) ROM bootloader remains stuck in ISP mode (PC =
1302B460) instead of handing off to MCUBoot bootloader from external flash.

Investigation Results

Confirmed Working Components:
- FlexSPI external flash access via FCB (Flash Configuration Block)
- FCB signature: 42464346 at 0x08000400
- IVT (Image Vector Table) signature: 402000D1 at 0x08001040
- ARM Cortex-M33 vector table: valid stack pointer 3000B320 at 0x08001400
- External flash programming and verification successful
- All boot structures readable by ROM bootloader

Root Cause Identified:
- IVT boot_data_ptr (0x08001060) points to location containing all zeros
- Boot data structure not properly placed in flash by linker
- ROM bootloader validates boot structures but rejects image during validation
phase

Key Technical Details:
- Memory Layout: FCB@0x400 → IVT@0x1040 → ARM_vectors@0x1400
- IVT pointers: boot_data_ptr=0x08001060, self_ptr=0x08001040
- ROM bootloader successfully initializes FlexSPI and reads flash contents
- Issue occurs during image validation, not during flash access

Build Configuration:
- Using Zephyr RTOS with MCUBoot
- CONFIG_NXP_RW6XX_BOOT_HEADER=y
- CONFIG_TRUSTED_EXECUTION_NONSECURE=y
- Custom IVT header and FCB for IRIS-W106-30B

Remaining Question for NXP Community

Does the RW612 ROM bootloader require signed/authenticated boot images for handoff
to external flash bootloaders?

The ROM bootloader appears to validate all boot structures correctly but refuses
handoff. Missing boot data structure suggests either:
1. Linker script issue preventing proper boot data placement in flash
2. ROM bootloader requires signed images (HAB/secure boot) even for bootloader
handoff
3. Additional validation requirements (I will review the docs)

Any additional insights on the RW612-specific ROM bootloader validation requirements would be appreciated.

Thanks so much for your assistance!

[RomanVR]

Hello @dstarck.

Regarding your question about requiring signed/authenticated boot images, please refer to page 78 of UM11865 where the validation of the boot process is detailed, if you are not using secure boot ROM, the image does not require signature.

Additionally, please confirm if you have followed the guide/example I shared from the Application Code Hub.

Let me know if the information is useful and about your findings.

[dstarck]

Yes, I got it, and have made the changes.  I am working with a custom board that has a IRIS-W106-30B module (which contains the RW612).  I'll be testing over the weekend. Thanks.  I will reach out if I have questions, and will report back regarding my progress.

[dstarck]

Thank you so much I will check these out and will report back.  I thing the root if the issue us that the ROM bootloader can boit validate the MCUBoot bootloader in flash memory... I will report back later today