Flashloader fails writing to hyperflash on custom board

[h_bouchard]

Hi,

We are using the flashloader as a secondary bootloader to allow flashing our application. The flashloader is programmed with the MCUXpresso secure provisioning tool. It starts and execute normally.

Our custom board is based on i.MX RT1051 with an external hyperflash from ISSI (ISKS26S128...). Writing to hyperflash with a debug tool (JLink) works fine and with ROM bootloader as well. However, when I try to flash our application through the flashloader (provided by NXP without modification except USB vid and pid), the writing process seems to work but when I read the hyperflash back with the debug tool, flashing didn't work (all 0xFF).

We use a custom Python application to flash and here is the output:

['c:\\git\\imxrt-prog-tools\\cli-tools\\bin\\blhost.exe', '-u', '0x34A8,0x210', '-t', '1000000000', '-j', '--', 'fill-memory', '0x2000', '4', '0xc0233008']
{
   "command" : "fill-memory",
   "response" : [],
   "status" : {
      "description" : "10000 (0x2710) kStatus_UnknownCommand",
      "value" : 10000
   }
}
['c:\\git\\imxrt-prog-tools\\cli-tools\\bin\\blhost.exe', '-u', '0x34A8,0x210', '-t', '1000000000', '-j', '--', 'fill-memory', '0x2004', '4', '0x00000000']
{
   "command" : "fill-memory",
   "response" : [],
   "status" : {
      "description" : "0 (0x0) Success.",
      "value" : 0
   }
}
['c:\\git\\imxrt-prog-tools\\cli-tools\\bin\\blhost.exe', '-u', '0x34A8,0x210', '-t', '1000000000', '-j', '--', 'configure-memory', '9', '0x2000']
{
   "command" : "configure-memory",
   "response" : [],
   "status" : {
      "description" : "0 (0x0) Success.",
      "value" : 0
   }
}
['c:\\git\\imxrt-prog-tools\\cli-tools\\bin\\blhost.exe', '-u', '0x34A8,0x210', '-t', '1000000000', '-j', '--', 'flash-erase-region', '0x60040000', '0xfc0000']
{
   "command" : "flash-erase-region",
   "response" : [],
   "status" : {
      "description" : "0 (0x0) Success.",
      "value" : 0
   }
}
['c:\\git\\imxrt-prog-tools\\cli-tools\\bin\\blhost.exe', '-u', '0x34A8,0x210', '-t', '1000000000', '-j', '--', 'write-memory', '0x60040000', 'c:\\git\\Skinetic\\Release\\Skinetic.bin']
{
   "command" : "write-memory",
   "response" : [],
   "status" : {
      "description" : "0 (0x0) Success.",
      "value" : 0
   }
}
['c:\\git\\imxrt-prog-tools\\cli-tools\\bin\\blhost.exe', '-u', '0x34A8,0x210', '-t', '1000000000', '-j', '--', 'reset']
{
   "command" : "reset",
   "response" : [],
   "status" : {
      "description" : "0 (0x0) Success.",
      "value" : 0
   }
}

I tried step by step debugging with Ozone but everything seems to work fine. The write commands are sent to the external flash and success is returned.

There must be a difference in the flash configuration between 1052 EVK and our board. However, the only difference beside that we use a 1051 is the hyperflash (we use ISSI IS26KS128S-DPBLI00 instead infineon S26KS512SDPBHI020). The commands to program the flash are the same for both hyperflash.

Does anyone has an idea of where I should look to make this work?

Thanks,
Hugo

[jeremyzhou]

Hi @h_bouchard ，
Thank you for your interest in NXP Semiconductor products and for the opportunity to serve you.
To provide the fastest possible support, I'd highly recommend you use
the NXP-MCU Boot Utility tool to program and read back image file, this tool provides a log that can help figure out the issue of your customize commands.
Have a great day,
TIC

-------------------------------------------------------------------------------
Note:
- If this post answers your question, please click the "Mark Correct" button. Thank you!

- We are following threads for 7 weeks after the last post, later replies are ignored
Please open a new thread and refer to the closed one, if you have a related question at a later point in time.
-------------------------------------------------------------------------------

[h_bouchard]

hi @jeremyzhou,

I tried flashing the application with your tool and its working. However, as mention in my previous post, this is not a solution for us. I've attached the log to the thread in case this helps you understand what can be the differences. It is also working with MCUXpresso Secure Provisioning v3.1 [b210726]. The log file is also attached.

I don't see much difference with what we are doing in our python script and the tools. The only difference I can see is that both tools use a flashloader (ivt_flashloader.bin) when I'm using the flashloader example project from the SDK. Also, both tools program FNORCB when mine is generated by MCUXpresso Secure Provisioning and added to the flashloader .bin file before being written in hyperflash with again MCUXpresso Secure Provisioning.

- Do you see other differences in the log files?

- What is the difference between ivt_flashloader.bin file included in both tools and generated flashloader .bin file from the SDK example?

Thanks,
Hugo

[h_bouchard]

Hi @jeremyzhou,

This tool is completely useless to us. It is only needed if you have access to the boot pin of the MCU where you can force it to stay in boot ROM. But this setup is not suitable if you have thousands of devices in the field and you need to update the application. Also it writes the flashloader in RAM which we don't want because the flashloader is already written into the hyperflash and is loaded into RAM at startup by the boot ROM. This flashloader (secondary bootloader) then checks if there is a valid application and jump to it. If there isn't, it stays in the bootloader.

We use this setup with the 1064 without problem and it works fine with the same Python script that we have. The only difference is the configuration memory word as the QSPI flash is used for the 1064 instead of hyperflash.

Any idea why flash process returns success but nothing is written? Erase flash do work though.

Thanks,
Hugo

[jeremyzhou]

Hi @h_bouchard ,

Thanks for your reply.

Maybe you can try using the ivt_flashloader.bin of either NXP-MCU Boot Utility or MCUXpressoSecureProvisioning to generate the second bootloader, please give it a try.
Further, did you ever replicate the issue on the MIMXRT1050 EVK board?
Have a great day,
TIC

-------------------------------------------------------------------------------
Note:
- If this post answers your question, please click the "Mark Correct" button. Thank you!

- We are following threads for 7 weeks after the last post, later replies are ignored
Please open a new thread and refer to the closed one, if you have a related question at a later point in time.
-------------------------------------------------------------------------------

[h_bouchard]

Hi @jeremyzhou,

I've been looking at the LUT configuration in function flexspi_nor_generate_config_block_hyperflash in file flexspi_nor_flash.c. The part where the page program LUT is configured is kinda weird because it setup the LUT as if it would be word programming with the WC (word count) of 128. When you look at the specification in the reference manual at page 1749 for page programming, I don't see the same thing.

However, I don't know how to setup the LUT for page programming, it is not clear at all. There is a two sequence number 2 and sequence number 3-N and N+1 are different but how can I set this in LUT?

Do you have access to the code for ivt_flashloader.bin? could you check how the LUT is configured?

Thanks for you help,
Hugo

[h_bouchard]

Hi @jeremyzhou,

I can try with ivt_bootloader.bin but having this as a secondary bootloader is not an option to us. It doesn't jump to the right application address which is hardcoded in the bootloader. Also, we need to control a LED to inform the user that he is in bootloader. There is also other little modifications we need to do.

I don't have an eval board for the 1050 here so I cannot try to replicate the issue. I will check with my manager if I can buy one to test.

Any other ideas where I should look? What about the log files I sent you. Did you see anything wrong?

Thanks
Hugo

[jeremyzhou]

Hi,
Thanks for your reply.
1) Do you have access to the code for ivt_flashloader.bin?
-- The source code is the flashloader demo in the SDK library.
2) Could you check how the LUT is configured?
-- I'd like to suggest you refer to the 27.6.3.1 Hyper Flash in the RM.
3) As you said before, either NXP-MCUBootUtility-master or MCUXpresso Secure Provisioning can access the Hyper flash successfully, in the logs, the configuration step is different from what you did in the script, please check it carefully.

Have a great day,
TIC

-------------------------------------------------------------------------------
Note:
- If this post answers your question, please click the "Mark Correct" button. Thank you!

- We are following threads for 7 weeks after the last post, later replies are ignored
Please open a new thread and refer to the closed one, if you have a related question at a later point in time.
-------------------------------------------------------------------------------

[h_bouchard]

Hi @jeremyzhou,

Thanks for your answer.

1) Concerning the ivt_flashloader.bin, you are saying that the source code is the flashloader demo in the SDK library. However, which SDK version because when I compile the .bin files, the are quite different. I compiled the release version.

2) Thanks but as I mentioned in my previous post, I don't understand how to setup the LUT as per reference manual at page 1749 for page programming (chapter 27.6.3.1). There are two sequences number 2 and sequence number 3-N and N+1 are different. How to setup the LUT for N commands?

3) You said that in the logs, the configuration steps are different from what I did in the script. The only difference is that MCUXpresso Secure Provisioning tool writes the flashloader which I don't need, it is already running in RAM. It also writes the FCFB which I don't need either since it has been written already in hyperflash when I generated and flashed the flashloader with MCUXpresso Secure Provisioning tool.

Any other ideas?

Regards,
Hugo

[jeremyzhou]

Hi，

Thanks for your reply.
1) How to setup the LUT for N commands?
-- Actually, it's difficult to do it for the Hyperflash without the template, you'd better to refer to the flexspi_hyper_flash_polling_transfer demo.
2) Did you ever try to type the command manually instead of using the script to contact the secondary bootloader?
Have a great day,
TIC

-------------------------------------------------------------------------------
Note:
- If this post answers your question, please click the "Mark Correct" button. Thank you!

- We are following threads for 7 weeks after the last post, later replies are ignored
Please open a new thread and refer to the closed one, if you have a related question at a later point in time.
-------------------------------------------------------------------------------

[h_bouchard]

Hi @jeremyzhou,

I don't think typing the commands manually instead of using our script would change anything. However, I've tested the flexspi_hyper_flash_polling_transfer demo and it is working. I will try to investigate the differences between the flashload and this demo. I'll keep you posted.

Regards,
Hugo