OTA Update fails on RT1060

[__kenny__]

I have been trying to use the OTA Ethernet project provided as a part of the SDK Example.

I performed the following steps:

1. Load the provided SBL (From OTA Example) onto Flash
2. Load & Run the SFW (From the OTA Ethernet Client Application) in debugger mode.
3. Fetch the Signed f/w and load it onto the Flash (I've chosen the default Hello world bin for this)

My Expected Result: After successful f/w download, system reset, perform validity checks in SBL and boot from the new image in Slot: 1 (Hence Hello World o/p for the new bin)

Observed Result:  Imprecise Data Bus Fault escalation after System Reset.

I've attached the entire log file, I've tried to debug this myself and do not find a problem with the execution until it jumps to the new address. I've referred to the following documents: AN13505 [OTA Storage Structure on RT1010] for the address allocations and the AN13460 [FOTA Design for SBL and SFW] for the Flash Remap process and code flow and my understanding is that once the validity check is performed after reboot the flash remapping process in SBL takes care of all the setup using the existing linker file present as a part of the project. I've not customized the storage configurations of the example as well, so they still run on the same addresses. However, from the document and the logs, it does try to jump to the reset vector address located where the VT addr: 0x60040400. I have mapped/set the start address for my flash for the new signed binary to this address (Also tried to set the address to 0x60240000 (BOOT_CAND_APP) as defined in the flash partitioning file). Yet I still observe the fault and my debugger pauses. If I try to resume this, the image is found to be invalid and erased from the flash as seen from the logs (Which is to be expected based on the code flow). I've checked the Disassembly code and the Memory monitors placed at address: 0x60240400 and 0x60040400 which seems to be exactly the same (However the latter has the resetISR). The debugger tool (Breakpoints and Step instruction) on the IDE doesn't seem to be working once the flash remapping is enabled. I suspect I might be missing any steps or jumping to the wrong address. Any input in resolving this would be appreciated. Relevant section near the end of the file:

Image 0 loaded from the secondary slot
Booting from Slot 1, Flash Device ID 1, Image Offset 0x240000
Bootloader chainload address offset: 0x240000
Reset_Handler address offset: 0x240400
Jumping to the image
flash_base: 60000000
Flash remapping Start Addr: 0x60040000, End Addr: 0x60240000, Offset: 0x200000
Booting the secondary slot - flash remapping is enabled
rsp->br_image_off: 40000
Vector Table Address: 60040400

I'm using the SDK Version 2.15

MCUXpresso IDE v11.9.0_2144

[kerryzhou]

Hi @__kenny__ ,

  If you are using the SBL, you also can refer to my document:

https://community.nxp.com/t5/i-MX-RT-Knowledge-Base/RT1170-SBL-ISP-download-SDRAM-APP/ta-p/1767982

  BTW, about the RT1060 OTA, I still have another document:

https://community.nxp.com/t5/i-MX-RT-Knowledge-Base/RT1060-OTA-bootloader-ISP-and-swap-rollback-usag...

You can refer to the document at first.

If you still have question about it, please kindly let me know.

Best Regards,

Kerry

[__kenny__]

Thank you for the response, I have previously referred to these documents. However, the problem that I am facing is specifically targeted towards flash remapping option provided as a part of the 1060 SDK example. I have ensured that the necessary memory configuration for the primary & candidate application are as expected in RT1060-OTA-bootloader-ISP-and-swap-rollback-usage as can also be seen from the logs. The code (example application: evkmimxrt1060_ota_mcuboot_client_enet ) works when the image is put into the primary slot and it does boot from the slot, however, upon downloading the new image to the secondary slot in flash  and after flash remapping is enabled in SBL, the jump to the Vector address table doesn't necessarily start the new (candidate) application and ultimately leads to an Imprecise data bus fault. From the memory view I could confirm that both the 0x60040000 and 0x60240000 address space had valid values before remapping and point to the same data after performing remapping.

[kerryzhou]

Hi @__kenny__ ,

  Thanks for your updated information.

  If you use the SBL, and whether it also can reproduce it on the NXP MIMXRT1060-EVK board or not? And what's the app you are using now?

  You can use the SBL+MIMXRT1060-EVK+SDK2.15.0 led_demo as an example, then share the detail steps to reproduce the issues, then I will help you to test it on my side, and check the more detail issues, thanks.

Best Regards,

Kerry

[__kenny__]

Hi @kerryzhou ,

I have tried the ota example with the SBL (evkmimxrt1060_mcuboot_opensource) from the SDK with the client application (evkmimxrt1060_ota_mcuboot_client_enet) loaded into slot 1 of the flash as provided from the readme document in the example.

For the 1st experiment I used the iled_blinky example from the SDK as the candidate application. And I could see the example working (observed the led blinking). 

For the 2nd experiment I used the hello_world example from the SDK as the candidate application. And this didn't work as I could not see the UART logs and it crashed with the imprecise data bus fault. I have attached relevant screenshots from the IDE window for the same.

The exact steps taken are as is from the readme. 

1. Load the SBL onto the flash to find : Unable to find bootable image

2. Load the client application through the debugger, give the jump ResetISR from the debug console

3. Provide the cmds to get the file from the server.

4. Inspect the image and change state to Ready for test, and subsequently perform reboot.

5. Upon reboot, I start/resume the debugger. I also followed the steps in OTA Update of Signed Application  and tried it with the jump ResetISR cmd which didn't work as well.

Please find attached the logs for both the experiments.

I've run this on the 1060EVKB with the SDK 2.15 examples.

[kerryzhou]

Hi @__kenny__ ,

   So, the led_blinky works, the hello_world can't work.

   As I know, the hello_world contains the SDRAM DCD configuration, do you try to disable the DCD:

XIP_BOOT_HEADER_DCD_ENABLE=0.

  Then, you can test it again, whether you still have issues.

  If you still have question about it, please kindly let me know.

Best Regards,

Kerry

[mjbcswitzerland]

Hi

See also https://www.utasker.com/iMX/RT1060.html
Including loading via USB, LPUART, Ethernet, Modbus, CAN, memory stick, SD card, Wifi - with OTA using Web serve or FTP.
Supports encrypted loading with clone protection and out-of-the box operation of all i.MX RT 10xx parts.

Regards

Mark

https://www.utasker.com/index.html
https://www.utasker.com/iMX/developers.html (documents and videos)


For our discounted i.MX and Kinetis production stock availability see https://www.utasker.com/Shop/semi.html