Accessing SDRAM on IMXRT1060 EVKB using flashloader utilities

[FMA]

Hello,

I am currently trying to debug a custom board using an IMXRT106x device which is inspired for most part from the IMXRT1060 EVKB board. As we are using a BSP from an NXP partner which uses u-boot as a bootloader I am trying to adapt my u-boot setup to boot from our custom board but have failed so far since the board does not boot ...

So far I have been able to validate that we can actually read / write from our FlexSPI NOR flash using the ivt_flashloader.bin files and utilites provided for the EVKB board. In order to progress I actually have two questions:

- Can somebody explain to me how the ivt_flashloader.bin provided for the EVKB board works for us knowing that the SPI flash connected in the flex SPI interface in our case is an Adesto AT25SF041. How does the ivf_flashloader.bin adapt to another flash than the one referenced on the EVKB board ?

EDIT: looking at the flashloader project for MCU Expresso, it seems that is makes use of SFDP to adapt its settings to the chip connected. However, the AT25SF041 does not support SFDP. Any idea how, using the following blhost commands, I can actually read / write to the flash and have no errors:

blhost.exe -p COM8 -V -- fill-memory 0x2000 4 0xc0000007 (120 Mhz for the clock)
blhost.exe -p COM8 -- configure-memory 0x9 0x2000 (target should be a 'Serial NOR over FlexSPI module')

This arises since AT25SF041 should be clocked at max 80 MHz to get the whole set of commands supported.

- Is there any way (for example by adding a DCD file to the ivt_flashloader.bin ) to activate the SEMC interface to the SDRAM so that we could validate that we can actually read and write to the SDRAM ? if yes, how can I find / generate the DCD content that would be compatible ?

[FMA]

Hello @jingpan ,

Thank you for the suggestions.

I have indeed gone through the code you suggested: my bad, I did not read the file path correctly in your last email.

I have just ordered a P&E Micro SWD/JTAG interface so that I can try a step by step execution with breakpoints on the flash initialization part to check how the flashloader binary initializes our board, hoping that MCU expresso will let me execute it from the EVKB based projetct to our board .... I should receive it on monday so we will see ...

Regarding the QE bit, I do not see how I would have initialized it before since it would have required a WriteEnable command followed by a two bit write with the appropriate value set for the QE bit on the second register but you never know ... My guess is rather that the ivt_flashloader binary does not use QUAD SPI reade / write commands to write / read to our flash but rather is using 1 pad mode operations. I will have to go through the step by step operation to get a confirmation on that.

Can you also confirm whether, once booted from RAM, the ivt_flashloader utility uniquely goes through LUT based commands to operate the flash module or does it execute directly (through HAB or IP) on the flash itself ? I am quite amazed that it can perform write commands while I have not seen any configured in the LUT registers when I read them back, only a QUAD_READ was configured. If not it would explain that it works and that I could discard the fact that LUT are configured with 6 dummy bytes while the AT25SF041 flash that we use only requires 1 MODE + 2 DUMMY bytes.

Would it also be possible for you to let us know if the flexspi_nor_config_t seems to be correct for a proper generation of the FlexSPI Configuration block with our AT25SF041 flash (which requires to set the bit 1 of the 2nd status byte to set QE and enable QUAD operations)? Mostly are the "deviceMode*" settings and related LUT configuration ok? I went through the chip reference manual several times but could not find any usefull information on how I should set these values in order to get something working ...

Thanks in advance !!

[jingpan]

Hi @FMA ,

 If flexspi flash isn't configured, flash operation command will return error(kStatusMemoryNotConfigured).

From the code, it seems flexspi_nor_config_t can't configure the AT25SF041 flash correctly.

Regards,

Jing

[FMA]

Hello @jingpan ,

I got the delivery notice document from our purchase manager and this one mentions that the chip is an AT25SF041B (our BOM is not correct since our contractor indicated AT25SF041) so SFDP should be supported, which probably explains how the ivt_flashloader.bin could configure it correctly.

Still I am not sure I completely get how it gets configured correctly with 0xC000007 command submitted by blhost.

Here is an example of the transactions I got:

C:\Flashloader_RT106x_1.0_GA\Tools\sdphost\win>sdphost.exe -p COM8 -- error-status
Status (HAB mode) = 1450735702 (0x56787856) HAB disabled.
Reponse Status = 4042322160 (0xf0f0f0f0) HAB Success.

C:\Flashloader_RT106x_1.0_GA\Tools\sdphost\win>sdphost.exe -p COM8 -- write-file 0x20000000 "..\..\mfgtools-rel\Profiles\MXRT106X\OS Firmware\ivt_flashloader.bin"
Preparing to send 90529 (0x161a1) bytes to the target.
(1/1)0%Status (HAB mode) = 1450735702 (0x56787856) HAB disabled.
Reponse Status = 2290649224 (0x88888888) Write File complete.

C:\Flashloader_RT106x_1.0_GA\Tools\sdphost\win>sdphost.exe -p COM8 -- jump-address 0x20000400
Status (HAB mode) = 1450735702 (0x56787856) HAB disabled.

C:\Flashloader_RT106x_1.0_GA\Tools\blhost\win>blhost.exe -p COM8 -- get-property 1
Ping responded in 1 attempt(s)
Inject command 'get-property'
Response status = 0 (0x0) Success.
Response word 1 = 1258422528 (0x4b020100)
Current Version = K2.1.0

C:\Documents\Professionnel\NCS\Dvpt\ProjectManagement\proj_CP5MA\Test&Programming\Flashloader_RT106x_1.0_GA\Tools\blhost\win>blhost.exe -p COM8 -- fill-memory 0x2000 4 0xc0000007
Ping responded in 1 attempt(s)
Inject command 'fill-memory'
Successful generic response to command 'fill-memory'
Response status = 0 (0x0) Success.

C:\Flashloader_RT106x_1.0_GA\Tools\blhost\win>blhost.exe -p COM8 -- configure-memory 0x9 0x2000
Ping responded in 1 attempt(s)
Inject command 'configure-memory'
Successful generic response to command 'configure-memory'
Response status = 0 (0x0) Success.

C:\Flashloader_RT106x_1.0_GA\Tools\blhost\win>blhost.exe -p COM8 -t 30000 -- flash-erase-region 0x60000000 0x80000
Ping responded in 1 attempt(s)
Inject command 'flash-erase-region'
Successful generic response to command 'flash-erase-region'
Response status = 0 (0x0) Success.


C:\Flashloader_RT106x_1.0_GA\Tools\blhost\win>blhost -p COM8 -t 30000 -- write-memory 0x60000000 "C:\CP5MA\u-boot.flexspi"
Ping responded in 1 attempt(s)
Inject command 'write-memory'
Preparing to send 243712 (0x3b800) bytes to the target.
Successful generic response to command 'write-memory'
(1/1)100% Completed!
Successful generic response to command 'write-memory'
Response status = 0 (0x0) Success.
Wrote 243712 of 243712 bytes.

[FMA]

Hello Jin,

1. I downloaded the flashloader SDK but the middelware section does not provided sources, only a linkable file. so I could not take a look at it ...

As I am able to write and read back from flash I suppose that the flashloader binary is able to correctly adapt to the features and speed of the flash chip we are using. However, I am not sure how it does that: AT25SF041 is not supposed to support SFDP but provides vendor and depth information through JEDEC compatible commands. AT25SF041B should support SFDP but this is not the component I ordered to be mounted on our cards (though I read that AT25SF041 has probaly been discontinued in 2019 and should be replaced by AT25SF041B .... and marking on the chip is AT25SF0418 (8 and not B ...)).

Anyways, I read the content of the flexSPI related registers in order to get a peak at how the ivt_flashloader firmware initializes the flexSPI in order to manage to read and write from it, hoping I could use those settings in order to initialize my the flexSPI configuration block for the firmware I want to start from flash ...

What I get is the following:

0	MCR0	ff ff 80 10	[5:4] RXCLKSRC - 00 - Dummy read strobe generated by Flex SPI and loopbacked internally (corresponds to our board since DQS is not present as we are also using flexSPI for NAND flash)  /  [10:8] SERCLKDIV = 000 - Devided by 1
18	LUTKEY	5a f0 5a f0
1C	LUTCR	00 00 00 01	LUT is locked
60	FLASHA1CR0	00 00 02 00	FLHZZ = 0x200 - 512 kB (corresponds to our chip)
70	FLASHA2CR1	00 00 00 63	[7:0] = 0110 0011 - TCSS = 3, TCSH = 3
200	LUT0[0&1]	0a 18 04 eb	SEQ0: CMD_SDR 1PAD 0xEB SEQ1: RADDR_SDR 4PAD 0x18
204	LUT0[2&3]	26043206	SEQ2: DUMMY_SDR 4PAD 0x06 SEQ3: READ_SRD 4PAD 0x04
208	LUT0[4&5]	00 00 00 00
20c	LUT0[6&7]	00 00 00 00
210	LUT1[0&1]	24 04 04 05	SEQ0: CMD_SDR 1PAD 0x05 (Status reg) SEQ1: READ_SDR 1PAG 0x04
214		00

These values are quite confusing though as:

- Quad-I/O Read Array(EBh) commands specifies 3 dummy bytes to be sent (1 mode and 2 actual dummy bytes)

- There is no command dedicated to writing to the status register to enable quad read. Mostly, there should also be a command dedicated to read status register byte 2 (opcode 0x35) as that is the place where the Quad enable bit is located.

These made me think about something though, as quad mode enable bit is in second register (and might not be the default behavior):

- How can the ivt_flashloader.bin firmware use a memory initialization as "0xC0000007" and manage to read/write to our Adesto flash since we do not set the option to use bit 1 of the 2nd byte of status register and the target flash is not supposed to provide SFDP??

- In the flexSPI configuration block (9.6.3.1 FlexSPI Configuration Block), how should I set this so that I am sure that it is correctly configured for the firmware I copy in the flash ?

[jingpan]

Hi @FMA ,

1. Use serial_nor_config_option_t to config flash need SFDP. If the flash doesn't support SFDP. This command will fail. You can refer to 在\SDK_2.x.x_MIMXRTxxxx-EVK\middleware\mcu-boot\src\memory\src\flexspi_nor_memory.c. The function flexspi_nor_mem_config() is used to deal this data. It is the source code of ivt_flashloader.bin.

2. If ivt_flashloader.bin is download by serial download mode or debugger, DCD will not be read by ROM boot. So, you can copy SEMC demo code to flashloader demo to make your own RAM base flashloader. But before that please make sure the SEMC demo can run well on your board.

Regards,

Jing

[FMA]

Regarding point 1. I have downloaded the SDK for the flashloader example but the MCUBOOT middelware is provided as an .ld file so I cannot see the sources.

Regarding point 2, we use the serial download on our end so I guess we won't be able to use the DCD. As the BSP we are using for the IMXRT106xEVKB board is not based on MCUExpresso, we have not gone through the usage of this tool but we are in the process of trying to generate a compatible SDK and go through some example (hello world would be the first then the flexSPI and SDRAM example).

Meanwhile, I have used the blhost utility to read back the flexSPI register and found out quite puzzling settings looking at the LUT configuration that you might help us understand.

- The data for read operation are the following:

0a 18 04 eb	2	2	18	1	0	eb	CMD_SDR 1_PAD_0xEB	RADDR_SDR 4_PAD 0x18
26 04 32 06	9	2	04	C	2	06	DUMMY_SDR 4_PAD 0x06  READ_SDR 4_PAD 0x04

There is only another configuration in LUT1 for READ_STATUS but nothing for the WRITE, WRITE_STATUS or WRITE_ENABLE operation.

We are using an ADESTO AT25SF041 (512 kB) flash on this card which is connected to the A interface the flexSPI controller.

On this chip:

- a write to bit 1 of the 2nd byte of the status register is required to enable Quad read

- 3 dummy bytes (1 mode bytes + 2 dummy bytes) should be configured to enable proper read operation with the 0xEB command

-> how can the setting provided in the LUT allow proper write / read operations in the ivt_bootloader case ?

In addition, I have tried to figure out what would be a proper setting for the flexspi_nor_config_t configuration structure for our chip for the moment, the best I have come up with is the following. If you have any advice or suggestion on how I should set it up, it would be most welcome:

const flexspi_nor_config_t qspiflash_config = {
    .memConfig =
        {
            .tag = FLEXSPI_CFG_BLK_TAG,
            .version = FLEXSPI_CFG_BLK_VERSION,
            .readSampleClksrc=kFlexSPIReadSampleClk_LoopbackInternally, // 
            // AT25SF041 5 ns (relative to clocks)
            .csHoldTime = 3u,
            .csSetupTime = 3u,
            /* Introduce device Mode configuration to tune Quad enable bit reference */
            .deviceModeCfgEnable = 1u,
            .deviceModeType = kDeviceConfigCmdType_QuadEnable,
            .deviceModeSeq = {
              .seqId = NOR_CMD_LUT_SEQ_IDX_WRITE_STATUS,
              .seqNum = 1u,
            },
            .deviceModeArg = 0x0200, // set Bit1 of byte 1 (=QE, quad enable)
            /* End of deviceMode configuration */
            .sflashPadType = kSerialFlash_4Pads,
            // AT25SF041 Max freq is 104 MHz but 0x3B max freq is 85 MHz
            .serialClkFreq = kFlexSpiSerialClk_80MHz,
            .deviceType=kFlexSpiDeviceType_SerialNOR, 
            .sflashA1Size = 512u * 1024u,
            .lookupTable =
                {
                     /*0 - Read data */
                    [NOR_CMD_LUT_SEQ_IDX_READ*4+0] = FLEXSPI_LUT_SEQ(CMD_SDR, FLEXSPI_1PAD, 0xEB, RADDR_SDR, FLEXSPI_4PAD, 0x18),
                    [NOR_CMD_LUT_SEQ_IDX_READ*4+1] = FLEXSPI_LUT_SEQ(MODE8_DDR, FLEXSPI_4PAD, 0x00, DUMMY_SDR, FLEXSPI_4PAD, 0x02),
                    [NOR_CMD_LUT_SEQ_IDX_READ*4+2] = FLEXSPI_LUT_SEQ(READ_SDR, FLEXSPI_4PAD, 0x04,STOP,0,0),

                    /* 2 - Write Enable (should be sent before Write Status)
                        * Writing the WriteEnable (0x06) command to assert WEL bit - no data writen afterwards
                    */    
                    [NOR_CMD_LUT_SEQ_IDX_WRITEENABLE*4+0] = FLEXSPI_LUT_SEQ(CMD_SDR, FLEXSPI_1PAD, 0x06, STOP,0,0),
                    /*7 - Write Status 
                        * Writing afterwards the WriteStatus command (0x01) with 2 bytes of data
                    */
                    [NOR_CMD_LUT_SEQ_IDX_WRITE_STATUS*4+0] = FLEXSPI_LUT_SEQ(CMD_SDR, FLEXSPI_1PAD, 0x01, WRITE_SDR, FLEXSPI_1PAD, 0x02),
                    [NOR_CMD_LUT_SEQ_IDX_WRITE_STATUS*4+1] = FLEXSPI_LUT_SEQ(STOP,0,0,STOP,0,0),

                },
        },
};

[jingpan]

Hi @FMA ,

1. readSampleClkSrc should be kFlexSPIReadSampleClk_LoopbackFromDqsPad. Otherwise the max speed limit to 60Mhz only.

2.deviceModeCfgEnable (along with deviceModeType, deviceModeSeq, deviceModeArg) is usable with specific flash devices which can enter a command mode for configuration. but we don't have detail doc for this field. It seems your configuration to enable QE bit is correct.
 But QE bit is NVM. It only need to be program once. It's not good for this bit to be programmed to many times.

Regards,

Jing

[FMA]

Hello @jingpan 

Thank you for your answer.

1. As the possibly available DQS pin is actually used since we will have two SPI memories controlled on the SPI interface (NOR on interface A and NAND on interface B), we cannot use DQS loopback and have to use internal loopback. Can you maybe pinpoint us to the right reference in the chip manual mentionning the limitation to 60 MHz when using internal loopback since I cannot find it. I suppose then that we should use the following setting for our design.

            .serialClkFreq = kFlexSpiSerialClk_60MHz,

2. I will make sure that we take your remark into account for our design in order to ensure that we do not write excessively to the status register if this is not required. If the flashloader does indeed write this bit to 1 then I will ensure that the FlexSPI configuration segment does not assert those values. It is rather sad however that there is no specific information regarding those parameters .

[jingpan]

Hi @FMA ,

FlexSPI A and B have different DQS pin. I think we are talk about NOR. Please refer to section 7.3 in RT1050/60 hardware design guide. It is not mentioned that without LoopbackFromDqsPad max speed is 60Mhz only, but it's true. So, please keep this pad floating and LoopbackFromDqsPad if you still want it to work at 80Mhz/104Mhz.

Regards,

Jing

[FMA · Accepted solution]

Hello @jingpan 

Thanks for your answer.

We need this pad for other purposes so I guess that we will have to run it only at 60 MHz.

I have not yet managed to run it at this frequency though, but diving into the documentation, I think I found a possible source for this issue since with have not yet blown any fuse and some of the GPIO associated to fuse override are connected to some other components on our board and, if I try to run the run in internal boot mode I still get answers when using the ivt_flashloader (meaning the board is still working in serial mode). Could you let me know whether the following strategy should get us going ?

1. In order to validate if GPIO connections are the cause of our current boot problem, I plan to try to run it again in internal mode and, when the processor is back in serial mode sample the content of SRC_SBMR1 register with the ivt_flashloader.bin firmware and reading memory content to file. Indeed, I think SRC_SMBR1, if I am correct, should provide the different values read on the GPIO associated with the BOOT_CFG override. Do you think this is a correct assertion to get the status of the GPIO BOOT_CFG override pins ?

2. If our problem comes from from the GPIO override, I plan to configure the following fuse to prevent the chip from sampling GPIO override pins:

- BT_FUSE_SEL set to 1

- if I am correct no other fuse needs to be set: we keep BOOT_CFG1 and BOOT_CFG2 all to 0 as for the content of BOOT_CONFG_MISC so that the board should read the 512 bits for flexSPI NOR config from memory and configure the flexSPI interface to read the IVT and the rest of the firmware since:

   * BOOT_CFG1[7:4] = 0000 --> flexSPI NOR

   * BOOT_CFG1[3:2] = 00 --> 3B read command used to read at 30 MHz the 512 flexSPI init block

Is that correct or should I set additional fuses in order to have my flash read knowing that I use a AT25SF041 flash with QE bit in status byte 2 without an available pin for DQS loopback and that my flexSPI configuration block is set with the settings discussed before amongst which:

- internal loopback

- serialCldFreq = kFlexSpiSerialClk_60MHz (since no DQS is available for loopback)

- deviceMode parameters are set to use a specifi LUT for 2nd Status Register byte write at position BIT 1 (deviceModeArg = 0x02,deviceModeType = kDeviceConfigCmdType_QuadEnable, deviceModeCfgEnable = 1, deviceModeSeq = { seqId = LUTINDEXforStatusByte2Write, sedNum = 1})

- I have 6 Dummy cycles for quad read operations as was stated before.

[jingpan]

Hi @FMA ,

Can you share your schematic here? And please clarify the problem you are facing now again. I'm a bit lost...

Regards,

Jing

[FMA]

Hello @jingpan 

I finally managed to have my board booting u-boot from the flexSPI NOR.

I basically had to ensure that BT_FUSE_SEL was set in order to avoid GPIOs to override the fuse configuration (reading the SRC_SMRB registers, it seems that the board was trying to boot from NAND flash connected on SEMC interface ...).

And it seems that my 64 MB SDRAM is also correctly initialized ...

Now, I am to test and validate my prototypes.

Thanks for the support.

[jingpan]

Hi @FMA ,

1. Please download RT1060 SDK from https://mcuxpresso.nxp.com/en/welcome. And about \SDK_2.x.x_MIMXRTxxxx-EVK\middleware\mcu-boot\src\memory\src\flexspi_nor_memory.c, this is a file route, not in MCUXpresso project. In the project, you can find it at here.

Without SFDP, flashloader will not know where is the QE bit. I guess you programmed it before. This bit is none volatile. You only need to program it one time. 

I'm also not quite clear why LUT is configured in such way by flashloader. Please debug the flashloader project in sdk

You can trace into the project, see how flexspi_nor_get_config() function work.

Regards,

jing

[FMA]

Hello @jingpan 

That's actually the second time that an reply posted in this thread gets lost in the lymbos of the NXP servers ... so I will try to reformulate my answer from wednesday ....

I have orderered a P&E Micro SWD compatible debugger in order to try to execute the flashloader step-by-step on our target, hoping that MCU expresso will allow it eventhough our target board is not the EVKB (but the compiled flashloader.bin works on it ...). It should arrive on monday so I will give it a try  then.

Regarding the flexspi_nor_memory files I had not seen the path you mentionned but only focused on the "middelware" part, my bad.

Regarding the configuration I mentioned for the FlexSPI NOR Configuration block, could you let me know whether the settings I set for the flexspi_nor_config_t in the above example are correct for our AT25SF041 memory (more specifically the values for the deviceMode* parameters and the content of the LUTs knowing that I need to set the QE bit in Reg2[1] to enable Quad read operations and that those require one mode + 2 dummy bytes to be serialized before we actually read the values on a Quad read command)? I have not been able to find a comprehensive documentation on the deviceMode settings to ensure that I correctly use those ....

Thanks in advance.