Flashloader inside application

[DanielePagani]

   Dear sirs,

we're working with i.MX RT1060 EVK board and we're wondering about best practices for In-Application Programming.

We can correctly use Sdphost and Blhost utility, according to: Flash loader i.MXRT1060https://cache.nxp.com/secured/assets/downloads/en/programmers/FLASHLOADER-RT106x-1-GA.zip?__gda__=15...

However, we can not use boot pin mode for hardware's constraints.

So, we're using Rom Apis to set device programmatically into serial download mode:

void bl_serial_downloader(void)

{

run_bootloader_ctx_t boot_para;

boot_para.B.imageIndex = 0;

boot_para.B.serialBootInterface = kEnterBootloader_SerialInterface_USB;

boot_para.B.bootMode = kEnterBootloader_Mode_SerialDownloader;

boot_para.B.tag = kEnterBootloader_Tag;

g_bootloaderTree->runBootloader( (void *)&boot_para );

}

However, according to ROM APIs this feature is not available for all i.MX RT processors and our project can require usage of other processors.

So, we guess to load Flashloader application inside main application and then run it if required.

We define an array flashloader of bytes with Flashloader bin file and then we call a jump to application:

 .data.flashloader

                0x0000000020000000    0x161a1 ./source/led_blinky.o

                0x0000000020000000                flashloader

 *fill*         0x00000000200161a1        0x3 ff

JumpApplication(*(uint32_t*)0x20000400, *(uint32_t*)0x20000404);

__STATIC_FORCEINLINE void JumpApplication(uint32_t topOfMainStack, uint32_t AppAddr)

{

    __ASM volatile ("mov SP, %0" : : "r" (topOfMainStack) : );

    __ASM volatile ("mov PC, %0" : : "r" (AppAddr) : );

}

This solution doesn't work, so, can you suggest something about the matter?

BR,

Daniele

[vishnuascenten]

How to do firmware upgrade without using secondary bootloader in imxtr1050 

[jeremyzhou]

Hi Daniele Pagani ,

Thank you for your interest in NXP Semiconductor products and for the opportunity to serve you.
Before answer your question, I have one inquiry that needs to confirm with you.
According to your statement, it seems that you assign a flash area to storge the flashloader code, then jump to the flashloader code via executing the JumpApplication function, is it right? If not, I'll appreciate if you can introduce the mechanism of your implementation in details.

Have a great day,
TIC

-------------------------------------------------------------------------------
Note:
- If this post answers your question, please click the "Mark Correct" button. Thank you!

- We are following threads for 7 weeks after the last post, later replies are ignored
Please open a new thread and refer to the closed one, if you have a related question at a later point in time.
-------------------------------------------------------------------------------

[thanhnguyenquoc]

Hi jeremyzhou‌,

I'm using iMXRT1050 EVK booting from  QSPI Flash.

Above is the same as my problem which is likely:

I need a Custom Bootloader which is called 1st Application and being stored on 1st Flash segment. The Custom Bootloader will jump the 2nd Application which is stored on  another Flash Segment.

Can I do that way? If Yes, is there any example available?

Many thanks.

[anton_glukhov]

Hi Thanh,

did you find any answer? We have a similar question, so we would like to use custom bootloader which located in flash(0x60000000) and be able to jump to app1 or app2(bank1 or bank2). Please, let me know if it's possible and if you have any examples.

Thanks!

[DanielePagani]

    Hi,

we did tests using 4 scenario:

1. iled_blinky in Ram
   • compile and link iled_blinky SDK example
   • use "Linking application in RAM" option
   • create .bin file using Binary utilities
   • copy .bin file's bytes to C array and put the array inside code 
   • check the address of the array in Ram then jump to it <-- it works fine
2. iled_blinky in Flash
   • compile and link iled_blinky SDK example
   • use "Linking application in RAM" option
   • create .bin file using Binary utilities
   • write .bin content to Flash at address 0x60100000 by using sdphost and blhost utilities
   • during execution, copy Flash content (by address 0x60100000 for the right length) to Ram
   • check the address of the array in Ram then jump to it <-- it doesn't work
3. Flashloader in Ram
   • use ivt_flashloader.bin provided with Flashloader's utilities
   • copy .bin file's bytes to C array and put the array inside code
   • check the address of the array in Ram then jump to it <-- it doesn't work
4. Flashloader in Flash
   
   • write ivt_flashloader.bin to Flash at address 0x60100000 by using sdphost and blhost utilities
   • copy Flash content (by address 0x60100000 for the right length) to Ram
   • check Ram address of the array in Ram and jump to it <-- it doesn't work

Code for scenario 1 - blinky in Ram:

uint8_t blinky[19584]={ 0x00, 0x00, 0x02, 0x20, 0x09, 0x03, 0x00, 0x20, 0x85, 0x03, 0x00, 0x20, 0x41, ...};

uint32_t address=(uint32_t)&blinky[0]; // address=0x20000000

JumpApplication(*(uint32_t*)address, *(uint32_t*)(address+4));

It works fine.

Code for scenario 2 - blinky in Flash:

uint8_t blinky[19584]={ 0x00, };

copy_data((void*)blinky,(void*)19584);

uint32_t address=(uint32_t)&blinky[0]; // address=0x20000024

JumpApplication(*(uint32_t*)address, *(uint32_t*)(address+4));

It doesn't work.

Code for scenario 3 - flashloader in Ram:

uint8_t flashloader[90529]={ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, ...};

uint32_t address=(uint32_t)&flashloader[0];

JumpApplication(*(uint32_t*)address, *(uint32_t*)(address+4));

Code for scenario 4 - flashloader in Flash:

uint8_t flashloader[90529]={ 0x00, };

copy_data((void*)flashloader,(void*)0x60100000,90529);

uint32_t address=(uint32_t)&flashloader[0];

JumpApplication(*(uint32_t*)address, *(uint32_t*)(address+4));

int copy_data(void* destination_address,void* source_address,uint32_t length){

 memcpy(destination_address,source_address,length);   

 return 0;

}

We guess we're doing something wrong with start address of JumpApplication.

Because ivt_flashloader.bin's structure, we tried to add an offset to the start address of 0x400 (header), but it didn't solve the problem.

At the end of the story, our idea is to copy from Flash to Ram a binary file (Flashloader) then jump to the execution of that application.

BR,

Daniele

[jeremyzhou]

Hi Daniele Pagani ,

Thanks for your detailed clarification.
I was wondering if you can share the demo code for the second scenario, as I'd like to do some testing with the MIMXRT1060 board and replicate the phenomenon on my site.
Looking forward to your reply.

Have a great day,
TIC

-------------------------------------------------------------------------------
Note:
- If this post answers your question, please click the "Mark Correct" button. Thank you!

- We are following threads for 7 weeks after the last post, later replies are ignored
Please open a new thread and refer to the closed one, if you have a related question at a later point in time.
-------------------------------------------------------------------------------

[DanielePagani]

    Hi jeremyzhou,

scenario 2) has 2 projects.

First of all, consider Flash partitions:

0x60000000 to 0x60100000 -> Main application

0x60100000 to 0x60200000 -> Slave application (our goal is to start this not-XIP application from Main application)

0x60200000 to ... -> Free

As far as first project is concerned (ram_iled_blinky.zip), please, start importing SDK EVK-MIMXRT1060 demo apps -> iled_blinky project.

Then, change C/C++ Build Settings -> Managed Linker Script -> select Link application to Ram.

Then create .bin by using Binary Utilities -> Create binary on .axf

Now, we've to write resulting .bin file to address 0x60100000 of Flash.

So, by using sdphost and blhost utilities from Flashloader 1060 Tools (please, boot board in Serial Downloader Mode):

dp$ ./sdphost -V -u 0x1fc9,0x0135 -- error-status

Status (HAB mode) = 1450735702 (0x56787856) HAB disabled.

Reponse Status = 4042322160 (0xf0f0f0f0) HAB Success.

dp$ ./sdphost -V -u 0x1fc9,0x0135 -- write-file 0x20000000 ivt_flashloader.bin

Preparing to send 90529 (0x161a1) bytes to the target.

(1/1)0%Status (HAB mode) = 1450735702 (0x56787856) HAB disabled.

Reponse Status = 2290649224 (0x88888888) Write File complete.

dp$ ./sdphost -V -u 0x1fc9,0x0135 -- jump-address 0x20000400

Status (HAB mode) = 1450735702 (0x56787856) HAB disabled.

dp$ cd /[...]/Flashloader_RT106x_1.0_GA/Tools/blhost/mac

dp$ ./blhost -u 0x15a2,0x0073 -- get-property 1

Inject command 'get-property'

Response status = 0 (0x0) Success.

Response word 1 = 1258422528 (0x4b020100)

Current Version = K2.1.0

dp$ ./blhost -u 0x15a2,0x0073 -- fill-memory 0x2000 4 0xc0000007

Inject command 'fill-memory'

Successful generic response to command 'fill-memory'

Response status = 0 (0x0) Success.

dp$ ./blhost -u 0x15a2,0x0073 -- configure-memory 0x9 0x2000

Inject command 'configure-memory'

Successful generic response to command 'configure-memory'

Response status = 0 (0x0) Success.

dp$ ./blhost -u 0x15a2,0x0073 -- flash-erase-region 0x60100000 0x100000

Inject command 'flash-erase-region'

sendCommandGetResponse.readPacket error 5.

Response status = 10004 (0x2714) No response packet from target device.

dp$ ./blhost -u 0x15a2,0x0073 -- flash-erase-region 0x60100000 0x100000

Inject command 'flash-erase-region'

Successful generic response to command 'flash-erase-region'

Response status = 0 (0x0) Success.

dp$ ./blhost -u 0x15a2,0x0073 -- write-memory 0x60100000 ram_iled_blinky.bin

Inject command 'write-memory'

Preparing to send 19580 (0x4c7c) bytes to the target.

usbhid: received data phase abort

Error: expected commandTag 0x7, received 0x4

Warning: Failed to get packet size. Using default size(32)Successful generic response to command 'write-memory'

(1/1)100% Completed!

Successful generic response to command 'write-memory'

Response status = 0 (0x0) Success.

Wrote 19580 of 19580 bytes.

Regarding second project (boot_iled_blinky.zip) , start by importing SDK EVK-MIMXRT1060 demo apps -> iled_blinky project.

Change C/C++ Build Settings -> MCU Settings -> Flash Location 0x60000000 Size 0x100000 (instead of 0x800000 because we've reserved 0x60100000 to 0x60200000 for .bin image of the first project).

Now, create a header file and define two variables:

• int value; // this variable is useful for creating an offset of blinky variable address
• uint8_t blinky[19584]; // this is the content of the previous generated .bin file

Then, modify main for jumping to blinky's address.

If we don't set SET_OFFSET, then blinky's address is 0x20000000 and everything works fine (IS_RAM enabled).

If we set SET_OFFSET, then blinky's address is 0x20000004 and it doesn't work.

If we set IS_RAM, then blinky is populated by .bin defined array.

If we don't set IS_RAM, then blinky is populated from Flash (copy Flash to Ram).

Please, advice us if you need more details.

BR,

Daniele

[jeremyzhou]

Hi Daniele Pagani ,

Thanks for your reply.
There're some suggestions for you.
1. Confirm the different image has been programmed to the related flash area.
2. Use the malloc() function to apply for the RAM area for store the slave application.
3. The SCB->VTOR also need to be updated.
Have a great day,
TIC

-------------------------------------------------------------------------------
Note:
- If this post answers your question, please click the "Mark Correct" button. Thank you!

- We are following threads for 7 weeks after the last post, later replies are ignored
Please open a new thread and refer to the closed one, if you have a related question at a later point in time.
-------------------------------------------------------------------------------

[DanielePagani]

    Hi jeremyzhou,

thanks for your suggestions.

I confirm that now we can correctly run XIP and not XIP application by jumping to Flash Address and setting SCB->VTOR register.

    uint32_t address=(uint32_t)&blinky[0];

    SCB->VTOR = address; // it must be 256 aligned

    JumpApplication(*(uint32_t*)address, *(uint32_t*)(address+4));

As far as malloc is concerned, according to Re: Malloc failed in RT1060-EVK project CSI_RGB565, it seems that is better don't use it.

Then, according to "ARMv7-M Architecture Reference Manual" B3-13 and Re: Relocate verctor table, SCB->VTOR must be 256 bytes aligned, so, how can use malloc with custom alignment?

Flashloader demo application uses a custom Linker Script (MIMXRT1062_ram_flashloader.ld), so, it's totally different running standard application (XIP or not-XIP) than this type of application (run from RAM). For standard application, we've to jump to Flash Address. For applications like Flashloader, we've to jump to Ram Address. Is it correct?

BR,

Daniele

[jeremyzhou]

Hi Daniele Pagani ,

Thanks for your reply.
1) Is it correct?
-- Yes, it's.
After reviewing the ARMv7-M Architecture Reference Manual, I confirm that the SCB->VTOR should be subjected to the constraint of 256 bytes aligned, so the malloc function is not suited for your application anymore, in my opinion, you can use the linker management method as the thread (Placing data into different RAM blocks ) shows.

Have a great day,
TIC

-------------------------------------------------------------------------------
Note:
- If this post answers your question, please click the "Mark Correct" button. Thank you!

- We are following threads for 7 weeks after the last post, later replies are ignored
Please open a new thread and refer to the closed one, if you have a related question at a later point in time.
-------------------------------------------------------------------------------

[DanielePagani]

    Hi jeremyzhou,

in order to avoid misunderstanding, please, consider we've to do two different steps for XIP and for not-XIP application.

• XIP Application

  • #define JUMP_ADDRESS 0x60200000 // Flash address of your XIP bin file

  • SCB->VTOR = (uint32_t)JUMP_ADDRESS;

  • JumpApplication(*(uint32_t*)JUMP_ADDRESS, *(uint32_t*)(JUMP_ADDRESS+4));

• not-XIP Application, using C/C++ Build -> Settings -> MCU Linker -> Managed Linker Script -> Link Application to RAM option

  • #define RAM_ADDRESS 0x20000000 // we've to change Heap Size to 0x8000 for .bin space's requirement

  • #define JUMP_ADDRESS 0x60100000 // Flash address of your not-XIP bin file

  • memcpy((void*)RAM_ADDRESS,(void*)(JUMP_ADDRESS),19580); // copy from Flash to Ram, for size of .bin file

  • SCB->VTOR = (uint32_t)RAM_ADDRESS;

  • JumpApplication(*(uint32_t*)RAM_ADDRESS, *(uint32_t*)(RAM_ADDRESS+4));

That means, for not-XIP application, it's mandatory to copy .bin from Flash to Ram then it's possible to jump to that Ram's address.

Is it correct?

BR,

Daniele

[DanielePagani]

    Hi jeremyzhou,

now, do you have any suggestions about the main subject - Flashloader inside application?

That means, we wrote ivt_flashloader.bin into Flash@0x60300000.

Then, we tried to do the same thing as not-XIP Blinky application:

#define JUMP_ADDRESS 0x60300000

#define RAM_ADDRESS 0x20000000

    memcpy((void*)RAM_ADDRESS,(void*)(JUMP_ADDRESS),90532); // .bin size

    SCB->VTOR = (uint32_t)(RAM_ADDRESS);

    JumpApplication(*(uint32_t*)(RAM_ADDRESS+0x400), *(uint32_t*)(RAM_ADDRESS+0x400+4)); // 0x400 ivt offset

However, it doesn't work.

The question is: how can we run ivt_flashloader.bin from our application?

Can we copy it from Flash to Ram and Jump to its Ram's address?

BR,

Daniele

[jeremyzhou]

Hi Daniele Pagani,

Thanks for your reply.
I've attached the ivt_flashloader.bin which is consist of the IVT and application code, the offset of IVT is 0x400 versus the 0x2000 for the application code.
So you should jump to the application code instead of the IVT.
Hope this is clear.
Have a great day,
TIC

-------------------------------------------------------------------------------
Note:
- If this post answers your question, please click the "Mark Correct" button. Thank you!

- We are following threads for 7 weeks after the last post, later replies are ignored
Please open a new thread and refer to the closed one, if you have a related question at a later point in time.
-------------------------------------------------------------------------------

[DanielePagani]

    Hi jeremyzhou,

according to non-xip example with MCUXpresso we've to add:

    SCB_DisableDCache();

    SCB_DisableICache();

instructions before:

    SCB->VTOR = (uint32_t)(RAM_ADDRESS+0x2000);

    JumpApplication(*(uint32_t*)(RAM_ADDRESS+0x2000), *(uint32_t*)(RAM_ADDRESS+0x2000+4));

USB is now correctly recognized:

MacOs$ system_profiler SPUSBDataType

[...]

            USB COMPOSITE DEVICE:

              Product ID: 0x0073

              Vendor ID: 0x15a2  (Freescale Semiconductor, Inc.)

              Version: 0.02

              Speed: Up to 480 Mb/sec

              Manufacturer: FREESCALE SEMICONDUCTOR INC.

              Location ID: 0x14230000 / 14

              Current Available (mA): 500

              Current Required (mA): 100

              Extra Operating Current (mA): 0

but blhost's commands don't work:

MacOs$ ./blhost -u 0x15a2,0x0073 -- get-property 1

Inject command 'get-property'

sendCommandGetResponse.readPacket error 5.

Response status = 10004 (0x2714) No response packet from target device.

If we try with SerialDownloader Mode and sophost/blhost utilities everything works fine.

So, we're wondering if we've to set Memory Configuration to something different than default.

We've attached Managed Linker Script settings and MCU Settings.

BR,

Daniele

[jeremyzhou]

Hi Daniele Pagani,

Thanks for your reply.

Please follow the thread (Generating a Bootable Image for the RT1050 ) to create a boot image for the RAM and give a try again.
Have a great day,
TIC

-------------------------------------------------------------------------------
Note:
- If this post answers your question, please click the "Mark Correct" button. Thank you!

- We are following threads for 7 weeks after the last post, later replies are ignored
Please open a new thread and refer to the closed one, if you have a related question at a later point in time.
-------------------------------------------------------------------------------

[DanielePagani]

    Hi jeremyzhou,

we followed the indications of Generating a Bootable Image for the RT1050,  Bootable Image Generation - SRAM mostly.

We read How to generate ivt_flashloader.bin for IMXRT?‌ carefully, as well as Chapter 4.2 Generate unsigned normal i.MX RT bootable image of i.NX RT1060 Manufacturing User's Guide Document at doc directory distributed with Flashloader 1060 utilities.

At the moment, the USB interface is recognized, but we receive a No response packet from target device report.

So, we've some questions:

• "Then go to settings > MCU C compiler > preprocessor and set the XIP_boot_header enable and and XIP_boot_header_DCD_enable both to 0" <-- we guess it isn't necessary because these preprocessor's options are not present
• Settings -> Managed Linker Script is different for Flashloader project; it uses a custom MIMXRT1062_ram_flashloader.ld Linker script
• do we have to modify imx-dtcm-unsigned-dcd.bd with reference to dcd path DCDFilePath = "dcd.bin";?
• where can we find the correct dcd.bin file?
• we're not using MFG tool because we're working with Mac, but we guess sdphost/blshost utilities can work fine, is it correct?
• SCB->VTOR must be set with a 0x2000 offset?

So, we guess Flashloader project is different than Led Blinky project used in the suggested discussion and, probably, some different step is required.

BR

Daniele

[jeremyzhou]

Hi Daniele Pagani,

Thanks for your reply.
1. Do we have to modify imx-dtcm-unsigned-dcd.bd with reference to dcd path DCDFilePath = "dcd.bin";?
-- I'd like to suggest you use the imx-dtcm-unsigned.bd instead of
imx-dtcm-unsigned-dcd.bd, please check the attachment.
2) we're not using MFG tool because we're working with Mac, but we guess sdphost/blshost utilities can work fine, is it correct?
-- Yes, maybe you can give a try if you have other PC on hand.
3) SCB->VTOR must be set with a 0x2000 offset?
-- Yes.

TIC

-------------------------------------------------------------------------------
Note:
- If this post answers your question, please click the "Mark Correct" button. Thank you!

- We are following threads for 7 weeks after the last post, later replies are ignored
Please open a new thread and refer to the closed one, if you have a related question at a later point in time.
-------------------------------------------------------------------------------

[DanielePagani]

    Hi jeremyzhou‌,

we followed these steps:

1. Compile evkmimxrt1060_flashloader
2. Create S-Record by using Binary Utilities
3. Create .bin file by using:

   ./elftosb -f imx -V -c imx-dtcm-unsigned.bd -o ivt_flashloader_unsigned.bin test_flashloader.s19

4. Use sdphost to write on RAM this file and jump to its execution: 

   ./sdphost -V -u 0x1fc9,0x0135 -- error-status

   ./sdphost -V -u 0x1fc9,0x0135 -- write-file 0x20000000 ivt_flashloader_unsigned.bin

   ./sdphost -V -u 0x1fc9,0x0135 -- jump-address 0x20000400

5. Check it's right by doing: 

   ./blhost -u 0x15a2,0x0073 -- get-property 1

   Inject command 'get-property'

   Response status = 0 (0x0) Success.

   Response word 1 = 1258424064 (0x4b020700)

   Current Version = K2.7.0

So, in our opinion the generated ivt_flashloader_unsigned.bin file is ok.

Then, we wrote the same file to Flash and our application copy this file from Flash to Ram and try to execute it without success.

We guess the problem is regarding the way the application try to execute it:

#define JUMP_ADDRESS 0x60300000

#define RAM_ADDRESS 0x20000000

    memcpy((void*)RAM_ADDRESS,(void*)(JUMP_ADDRESS),91632);

    if(memcmp((void*)(RAM_ADDRESS),(void*)JUMP_ADDRESS, 91632)==0){

    DisableGlobalIRQ();

    SCB_DisableDCache();

    SCB_DisableICache();

    SCB->VTOR = (uint32_t)(RAM_ADDRESS+0x2000);

    JumpApplication(*(uint32_t*)(RAM_ADDRESS+0x2000), *(uint32_t*)(RAM_ADDRESS+0x2000+4));

BR

Daniele

[jeremyzhou]

Hi Daniele Pagani,

Thanks for your reply.
According to the steps you did, I don't find something wrong with them until now.
I'd like to know whether you do the same testing with the ivt_flashloader.bin I shared before.

Have a great day,
TIC

-------------------------------------------------------------------------------
Note:
- If this post answers your question, please click the "Mark Correct" button. Thank you!

- We are following threads for 7 weeks after the last post, later replies are ignored
Please open a new thread and refer to the closed one, if you have a related question at a later point in time.
-------------------------------------------------------------------------------

[DanielePagani]

    Hi jeremyzhou‌,

we confirm we did the same testing with ivt_flashloader.bin you provided.

It seems to be the same of Flashloader distribution package:

Mac$ md5 ivt_flashloader.bin (your ivt_flashloader.bin)

MD5 (ivt_flashloader.bin) = 30d7da95013ce979aacfff39f7252aeb

Mac$ md5 /Users/?/Downloads/Flashloader_RT106x_1.0_GA/Tools/mfgtools-rel/Profiles/MXRT106X/OS\ Firmware/ivt_flashloader.bin 

MD5 (/Users/danielepagani/Downloads/Flashloader_RT106x_1.0_GA/Tools/mfgtools-rel/Profiles/MXRT106X/OS Firmware/ivt_flashloader.bin) = 30d7da95013ce979aacfff39f7252aeb

We're wondering if we can ask you how you managed to generate this file: did you start with the SDK flash loader - example?

BR,

Daniele