KW45 First Time Programming

[cnew01]

I am trying to program a custom KW45-based PCB for the first time. I tried using MCUXpresso. The J-Link could upload my program over SWD but when I tried entering debug mode the board halts at address 0x14816fdc. Further research has shown that the NBU for the Bluetooth coprocessor needs to be uploaded. I've tried AN13838, but my board cannot be discovered over UART. I've been looking into AN14003, but it's information is out of date with regards to the current SPSDK. What do I do?

[cnew01 · Accepted solution]

Closing this thread. There was a design error in the custom hardware that had a permanent pull up on the boot_config pin. Once removed, the issue was resolved and the NBU could be programmed as specified in AN14003.

[luis_maravilla]

Hello

The memory address you mention refers to ROM-Boot [Table 16 KW45 Reference Manual], On KW45, only boot ROM has access to the NBU flash,

For more information about ROM boot process flow please refer to AN14003 Figure 2

As you are using a KW45 chip from fabric for your custom PCB; Could you help us confirm if your KW45 chip from fabric was already fuse burned as the process described in AN14003?

And if there was already fuse burned, Could you confirm if the default KW45B41Z-EVK Keys [SBKDK and RoTKTH] described in Chapter 5.2.1 [AN14003] were used? Or you use custom generated keys for the board.

Also for confirmation, Have you done an updating NBU before on the chip?

Best Regards

Luis

[cnew01]

The fuses had not been burned yet, the KW45 is from fabric. Updating the NBU on the chip has not been done before.

[luis_maravilla]

Hello,

I need to confirm if your end goal is using the custom KW45-based PCB same as the KW45B41Z-EVK using SDK examples or is intended for custom applications?

As this will interferes on the fuses that are needed to be burn in chip.

For updating the NBU image to a KW45 device two types of keys must be written to KW45 fuse, By default, RoTKTH and SB3KDK are provided for KW45B41Z-EVK board; but in a factory chip the keys in the fuse are null.

Therefore, for Factory chips, the customer needs to burn fuses related for end goal following the instructions in [AN14003 Programming the KW45 flash for Application and Radio firmware via Serial Wire Debug during m...]

If you want to use your board for development same as the KW45B41Z-EVK you could use the same keys values from the KW45B41Z-EVK board directly [Described in AN14003 Chapter 5.2.1 Figure 9]; If you want to use your board for a different end product or custom end application; I would recommend creating your own keys and generating the sb3 file using the .xip file for a new NBU image dedicated to your end product

Then Updating NBU; If you want to use your board for development same as the KW45B41Z-EVK you can use the same sb3 file that its inside SDK folder for updating the NBU, if you want to use your board for a different end product or custom end application you should create your own sb3 file for uploading the NBU image following the instructions described in Chapter 4 in AN14003.

It's important to mention that the method of burning the fuse provided in this document cannot be reversed. The keys programmed to fuses on KW45 cannot be changed anymore. Therefore, it is recommended to modify the fuse with caution.

Best Regards

Luis

[cnew01]

Luis:
I'm trying to implement the app note, I will be using the default keys just to validate functionality on this custom board. In an14003,  Test_ota_partition on Page 13 is not defined in the OTAP example or the rest of the code provided. What is this variable supposed to be?

[luis_maravilla]

Hello,

The test_ota_partition function utilizes the OtaPartition_t structure defined in fwk_platform_ota.h. used to manage OTA operations used in other steps described in AN14003.

This structure describes the characteristics of the Over-the-Air (OTA) update partition, including parameters such as offset, size, sector and page sizes, and whether the flash is internal or external.

As outlined in Application Note AN14003 comment where Test_ota_partition is used, indicates to use internal flash so we need to initialize the parameters and true for using internal flash.

This is something every customer would need to implement by their own. Also, I attached the structure with definitions [Taken from fwk_platform_ota.h]

typedef struct
{
    uint32_t start_offset; /*!< Offset of firmware update partition in flash device. The physical address is translated
                              by flash driver */
    uint32_t size;         /*! Size of firmware update storage expressed in bytes */
    uint32_t sector_size;  /*! Sector size of flash used for OTA, usually 4kB for external flash but varies for internal
                              flash */
    uint32_t page_size;    /*! Page size of flash device : minimal program size*/
    bool     internal_flash; /*! true if internal flash, false for SPI NOR Flash */
    uint32_t spi_baudrate;   /*! SPI baudrate concerns only external flash if flash config is not used KW45 case */
} OtaPartition_t;

Best Regards

Luis

[Arjv]

Hi 

I ran into the same issue mentioned here...

"I'm trying to implement the app note, I will be using the default keys just to validate functionality on this custom board. In an14003,  Test_ota_partition on Page 13 is not defined in the OTAP example or the rest of the code provided." 
Can you please suggest me a sample data for this variable please? looking into the internal memory I'm getting confused. if I get to see a sample (test) values for this variable it would be more helpful for me to understand better.

[cnew01]

Bluetooth firmware was uploaded to the KW45 using the following definition.

OtaPartition_t Test_ota_partition =
{
/*start_offset*/ 0,\
/*size*/ 0,\
/*sector_size*/ 0,\
/*page_size*/ 0,\
/*internal_flash*/ true,\
/*spi_baudrate*/ 0,\
};

[Arjv]

hi,

I was reading the thread, and I understood that you were trying to follow the steps mentioned in the AN14003, to generate a single binary to program the KW45 using SWD. Since this thread is a bit older, Were you successful in that?

I am trying to do the same here and I am facing some issues. I was not successful with the jupyter part for generating the keys and creating the secure binaries. For that part I am using the SPSDK CLI tool that was mentioned in this same thread, (I mean for generating the keys and the sb3 files). But I am getting issues when I merge the Binary files. 

As per the document, i gave used the otap_client_freertos sdk example and did modifications as mentioned. and generated the bin file. Then I opened the otap_client_freertos.bin & kw45b41_nbu_ble_xp_hosted.sb3 files in a hex editor and copied the contents of the sb3 file to the address 0x7A000 of the otap_client_freertos.bin as mentioned. I then loaded the merged binary to the SEGGER J-Flash utility for flashing the binary into the KW45. But the operation failed and after this, I am not even able to program a blinky example also. To recover from this condition I had to enter the ISP mode and erase the entire chip (I was not able to access the chip via SWD even for erasing it). The following is the error message I got when the flashing failed with the merged binary. 

****************************************************************************************

Programming and verifying target (1040384 bytes, 1 range) ...

 - Connecting ...

  - Connecting via USB to probe/ programmer device 0

  - Probe/ Programmer firmware: J-Link V9 compiled Dec 13 2022 11:14:50

  - Probe/ Programmer S/N: 69730348

  - Device "KW45B41Z83" selected.

  - Target interface speed: 4000 kHz (Fixed)

  - VTarget = 3.290V

  - ConfigTargetSettings() start

  - ConfigTargetSettings() end - Took 499us

  - InitTarget() start

  - SWD selected. Executing JTAG -> SWD switching sequence.

  - ROM entered ISP command handling loop. Re-enable the debug access.

  - InitTarget() end - Took 117ms

  - Found SW-DP with ID 0x6BA02477

  - DPv0 detected

  - CoreSight SoC-400 or earlier

  - AP map detection skipped. Manually configured AP map found.

  - AP[0]: AHB-AP (IDR: Not set, ADDR: 0x00000000)

  - Iterating through AP map to find AHB-AP to use

  - AP[0]: Skipped ROMBASE read. CoreBaseAddr manually set by user

  - AP[0]: Core found

  - CPUID register: 0x410FD214. Implementer code: 0x41 (ARM)

  - Feature set: Mainline

  - Cache: No cache

  - Found Cortex-M33 r0p4, Little endian.

  - Cortex-M (ARMv8-M and later): The connected J-Link (S/N 69730348) uses an old firmware module that does not handle I/D-cache correctly. Proper debugging functionality cannot be guaranteed if cache is enabled

  - FPUnit: 8 code (BP) slots and 0 literal slots

  - Security extension: implemented

  - Secure debug: enabled

  - ROM table scan skipped. CoreBaseAddr manually set by user: 0x80030000

  - SetupTarget() start

  - SetupTarget() end - Took 7.11ms

  - Executing init sequence ...

   - Executing Reset (0, 0 ms)

    - ResetTarget() start

    - No valid application programmed. Skipping reset.

    - ResetTarget() end - Took 1.18ms

    - Device specific reset executed.

   - Initialized successfully

  - Target interface speed: 4000 kHz (Fixed)

  - Found 1 JTAG device. Core ID: 0x6BA02477 (None)

  - Connected successfully

 - Checking if selected data fits into selected flash sectors.

 - Start of preparing flash programming

 - End of preparing flash programming

 - Start of determining dirty areas in flash cache

 - End of determining dirty areas

 - CPU speed could not be measured.

 - Start of flash programming

 - Programming range 0x00000000 - 0x00007FFF (  4 Sectors, 32 KB)

 - End of flash programming

 - ERROR: Program failed

 - Start of restoring

 - ERROR: Failed to restore target. RAMCode never stops

 - End of restoring

 - ERROR: Failed to program and verify target

WARNING: Supply voltage too low or too high, disconnecting target! VTarget = 0.000V

Disconnecting ...

 - Disconnected

**********************************************************************************************

It appears like the area we are attempting to program is 0x00000000 - 0x00007FFF & as per the document the NBU firmware is copied to 0x7A000 which is beyond this range.

Please correct me if I'm wrong here.

[cnew01]

This didn't work. I'm still going to that address in the boot memory when trying to debug. Anything else I can look into?

[luis_maravilla]

Could you help us share a log failure or message error?

What you could look into, As you mentioned you are using the Default keys for fuse burning with AN14003, Could you help us try to update the NBU image with the instructions described in section 3.3 Updating NBU for Wireless Examples as the sb3 file in SDK apply for the default keys burned in KW45 board.

Could you help us confirm that the process of fuse burning went correctly? If not, could you help us sharing the error shown?

Could you confirm if you can enter ISP mode without problem?

[cnew01]

I cannot find the Tools > Manufacturing Tool in MCUXpresso as the guide that was sent specifies. Is there more up to date information available?

[luis_maravilla]

Hello,

This instruction refers to the "MCUXpresso Secure Provisioning Tool", I would recommend using the latest version "MCUXpresso Secure Provisioning Tool 25.06" of your OS, you can download the tool from this link: MCUXpresso Secure Provisioning Tool Downloads, also creating a new workspace in the tool.

Regards

Luis

[cnew01]

Luis:
I have installed the SPSDK and have found the tool you have mentioned. My current issue is since I don't have an onboard device for USB I must use a USB to UART Converter. In attempting that the software cannot find my board (on the USB port with my USB to TTL converter I'm getting the error message below.  

I can confirm that I used the nxpdebugmbox cmd -f kw45b41z8 ispmode -m 1 command in the terminal to set it to ISP mode and the terminal indicates that has taken place successfully.

[luis_maravilla]

Hello

Could you please help us confirm whether you're able to flash and run any program on your board—excluding wireless or Bluetooth Low Energy examples?, this is for, I’d like to confirm whether the board still fails to operate even when running a program that doesn’t require the NBU.

I recommend testing one of the examples available in the SDK to verify basic functionality.

Additionally, please ensure that your board’s serial connection is correctly configured by comparing it with the KW45B41Z-EVK schematics. You can consult the schematics at the following link: KW45B41Z Evaluation Kit Board Schematics

Best Regards

Luis

[cnew01]

The program will get stuck at 0x14816fdc even when it's the LED Blinky example.

[luis_maravilla]

Could you help us confirm in which OEM state is the KW45? You can use the blhost tool command "blhost -p COMx get-property 0x01" and can you share with us the response? Also Could you help us share with us what it is the complete part number of your KW45?

You can check the part number information with the table 1 in the datasheet KW45B (radio) and KW45Z (MCU) Data Sheet

Best Regards, Luis

[cnew01]

The part number is here: KW45B41Z83AFTBR
I am unable to use blhost.

Whenever I try I get the following:

I have a USB to UART adapter that is connected to LPUART0 pins.

I can do the following below:

The debug log referenced by the error is attached. My USB to TTL Serial should be connected at COM15

[luis_maravilla]

Hello,

To use the bootloader and load the NBU image the connection is by using PTC2 and PTC3 [LPUART1]; this connection allows the ROM bootloader enter ISP mode and use the blhost for loading the KW45 Default keys and NBU image. There is a recommendation to have the option for a way to pull BOOT_CFG[PTA4] to logic high in order to enter the device in bootloader mode also that the peripherals instances used by ISP to have the option to connect them to UART to USB converter.

This information is described in KW45 Reference Manual Chapter 16 Table 74 and Hardware Design Recommendations slide 52 BOOTLOADER chapter

Could you kindly describe your process to enter ISP mode? Did you make a connection from BOOT_CFG[PTA4] pin to VDD while reset?

Could you possibly change your UART0 connection to UART1 to enter ISP mode and upload the KW45 default keys and NBU image [SDK v25.09]?

Please let me know if you can enter ISP mode via this described method and the blhost can be used now.

Also, could you share what SDK version for the examples were you using? And if you could use the latest version available [25.09] for the SDK examples to match the NBU image.

Best Regards

Luis

[luis_maravilla]

Hello,

Could you help us check if your board is being correctly detected as a COM port [UART] in Device Manager tool in your computer, under the section Ports (COM & LPT)? This will help confirm the active COM connection. Based on the image, the command appears to be using COM15, while the debug_log indicates COM7

In device manager you should see something like this

If you confirm the connection being COM7; please retry the blhost command [blhost -p COM7 get-property 0x01] to verify a success response connection.

If this command succeeds, please retry the MCUXpresso Secure Provisioning Tool step using COM7 instead of COM15 to update the NBU image.

Please let me know your findings.

Best Regards

Luis