IMX RT1170B First Boot Code Execution

979A35J · ‎05-03-2024

We have a custom IMXRT1170 board based on the EVK that works great when I use LPCLink / MCUXpresso to program the board for the first time. After programming them once with the LPCLink we can use either the LPCLink or JLINK programmers without issue. However, code will not execute using the JLINK programmer until they are programmed with the LPCLink programmer once. The registers look like this if after are programmed with the JLINK:

PC = 300024BC, CycleCnt = 0B04C872
R0 = 40CAC0B0, R1 = 0A000000, R2 = 80000000, R3 = 0000F000
R4 = E000ED00, R5 = 0022946D, R6 = 001640CD, R7 = 00207DC8
R8 = 2024AE80, R9 = 2024AE84, R10= 00211C0C, R11= 000000F0
R12= 00000000
SP(R13)= 82F80000, MSP= 82F80000, PSP= 00000000, R14(LR) = 002015F3
XPSR = 81000000: APSR = Nzcvq, EPSR = 01000000, IPSR = 000 (NoException)
CFBP = 00000001, CONTROL = 00, FAULTMASK = 00, BASEPRI = 00, PRIMASK = 01

FPS0 = 00000000, FPS1 = 00000000, FPS2 = 00000000, FPS3 = 00000000
FPS4 = 00000000, FPS5 = 00000000, FPS6 = 00000000, FPS7 = 00000000
FPS8 = 00000000, FPS9 = 00000000, FPS10= 00000000, FPS11= 00000000
FPS12= 00000000, FPS13= 00000000, FPS14= 00000000, FPS15= FFFFFFFF
FPS16= 00000000, FPS17= 00000000, FPS18= 00000000, FPS19= 00000000
FPS20= 00000000, FPS21= 00000000, FPS22= 00000000, FPS23= 00000000
FPS24= 00000000, FPS25= 00000000, FPS26= 00000000, FPS27= 00000000
FPS28= 00000000, FPS29= 00000000, FPS30= 00000000, FPS31= FFFFFFFF
FPSCR= 00000000

These look OK to me but code doesn't execute. Upon Reset:

PC = 00223104, CycleCnt = 9CDD4732
R0 = 40CAC0B0, R1 = 0A000000, R2 = 80000000, R3 = 0000F000
R4 = E000ED00, R5 = 0022946D, R6 = 001640CD, R7 = 00207DC8
R8 = 2024AE80, R9 = 2024AE84, R10= 00211C0C, R11= 000000F0
R12= 00000000
SP(R13)= 20241D98, MSP= 20241D98, PSP= 00000000, R14(LR) = 002015F3
XPSR = 81000000: APSR = Nzcvq, EPSR = 01000000, IPSR = 000 (NoException)
CFBP = 00000001, CONTROL = 00, FAULTMASK = 00, BASEPRI = 00, PRIMASK = 01

FPS0 = 00000000, FPS1 = 00000000, FPS2 = 00000000, FPS3 = 00000000
FPS4 = 00000000, FPS5 = 00000000, FPS6 = 00000000, FPS7 = 00000000
FPS8 = 00000000, FPS9 = 00000000, FPS10= 00000000, FPS11= 00000000
FPS12= 00000000, FPS13= 00000000, FPS14= 00000000, FPS15= FFFFFFFF
FPS16= 00000000, FPS17= 00000000, FPS18= 00000000, FPS19= 00000000
FPS20= 00000000, FPS21= 00000000, FPS22= 00000000, FPS23= 00000000
FPS24= 00000000, FPS25= 00000000, FPS26= 00000000, FPS27= 00000000
FPS28= 00000000, FPS29= 00000000, FPS30= 00000000, FPS31= FFFFFFFF
FPSCR= 00000000

I see from reading the example .scp files from NXP that PC = 00223104 indicates the processor is still in some sort of debug mode. Trying to follow the example from the connect m7 wake m4 and reset scp scripts, I am running the following commands in JLINK for the first execution:

device MIMXRT1176XXXA_M4
si SWD
speed 4000
connect
Halt
Write4 0x2021FF00 0xE7FEE7FE
Write4 0x2021FF04 0x2021FF01
Write4 0x40C0C000 0xFF00
Write4 0x40C0C004 0x2021
Write4 0x40CC0080 0x201
Reset
Go
Exit

Device MIMXRT1176XXXA_M7
si SWD
speed 4000
Connect
LoadFile hello.elf
WReg “R13 (SP)”, 0x82F80000
WReg “R15 (PC)”, 0x300024BD
WReg “XPSR”, 0x01000000
Write4 0x40C0C068 0x4200
Write4 0xE000EDFC 0x010007F1
Halt
Reset
Go

But I still get the same result. The register settings look correct after writing, but code doesn't execute, and upon reset I still get the PC = 00223104 issue. Our production stations use JLINK programmers and so we need to be able to start the boards up with them. What other registers or addresses do I need to be writing to get the rev B processor out of debug mode permenantly? Thank you.

979A35J · ‎05-10-2024

I figured it out, and thought I would share in case someone else needs the information. Turns out the IMX RT family needs a separate flashloader program that lives on-chip to correctly program external flash. MCUXpresso uses their internal flashloader which is why we needed to use their tool to boot first. But, it turns out an NXP engineer also wrote a flashloader for the IMX RT family to work with JLink:

https://github.com/JayHeng/RT-UFL/blob/master/README-en.md

Instructions on how to use it are here (note that this is for the RT600 but the basic steps are identical):

https://community.nxp.com/t5/i-MX-RT-Knowledge-Base/RT600-MCUXpresso-JLINK-debug-QSPI-flash/ta-p/134...

Only unfortunate thing is this flashloader hasn't been updated for a while, and I had to revert to JLINK version 7.60d in order to get it to work.

View solution in original post

979A35J · ‎05-06-2024

Hi Pavel, I am not exactly sure if this is what you are asking - I am unsure how the launcher is relevant as we need to use JLink Commander to program with the JLink probe, not MCUXpresso. JLink Commander/JLink is our production tool and so we need to be able to program with that toolset. Our code is also not built in MCUXpresso, so again I don't think the launcher is relevant.

In case this is what you are after, here is the output from a successful programming via MCUXpresso / LPCLink (i.e. the first time programming after which all subsequent programming work regardless of the method).

Executing flash operation 'Program' (Program file into flash: test_ads1119.elf) - Thu May 02 14:13:52 PDT 2024
Checking MCU info...
Scanning for targets...
Executing flash action...
MCUXpresso IDE RedlinkMulti Driver v11.9 (Dec 11 2023 18:02:10 - crt_emu_cm_redlink.exe build 2)
( 0) Reading remote configuration
Wc(03). No cache support.
Found chip XML file in C:/Users/breste60576/Documents/MCUXpressoIDE_11.9.0_2144/workspace/evkmimxrt1170_freertos_generic_cm7\MIMXRT1176xxxxx.xml
( 5) Remote configuration complete
Reconnected to existing LinkServer process.
============= SCRIPT: RT1170_connect_M7_wake_M4.scp =============
RT1170 Connect M7 and Wake M4 Script
DpID = 6BA02477
Error: No power acknowledge on DAP bus
Setting M4 spin code
Setting M4 clock
Resetting M4 core
Releasing M4
View cores on the DAP AP
DpID = 6BA02477
TAP 0: 6BA02477 Core 0: M7 APID: 84770001 ROM Table: E00FD003*
TAP 0: 6BA02477 Core 1: M4 APID: 24770011 ROM Table: E00FF003
============= END SCRIPT ========================================
Probe Firmware: LPC-LINK2 CMSIS-DAP V5.361 (NXP Semiconductors)
Serial Number: IWFWO1ES
VID:PID: 1FC9:0090
USB Path: \\?\hid#vid_1fc9&pid_0090&mi_00#9&36d46763&0&0000#{4d1e55b2-f16f-11cf-88cb-001111000030}
Using memory from core 0 after searching for a good core
( 30) Emulator Connected
( 40) Debug Halt
( 50) CPU ID
debug interface type = CoreSight DP (DAP DP ID 6BA02477) over SWD TAP 0
processor type = Cortex-M7 (CPU ID 00000C27) on DAP AP 0
number of h/w breakpoints = 8
number of flash patches = 0
number of h/w watchpoints = 4
Probe(0): Connected&Reset. DpID: 6BA02477. CpuID: 00000C27. Info: <None>
Debug protocol: SWD. RTCK: Disabled. Vector catch: Disabled.
Content of CoreSight Debug ROM(s):
RBASE E00FD000: CID B105100D PID 000008E88C ROM (type 0x1)
ROM 1 E00FE000: CID B105100D PID 04000BB4C8 ROM (type 0x1)
ROM 2 E00FF000: CID B105100D PID 04000BB4C7 ROM (type 0x1)
ROM 3 E000E000: CID B105E00D PID 04000BB00C Gen SCS (type 0x0)
ROM 3 E0001000: CID B105E00D PID 04000BB002 Gen DWT (type 0x0)
ROM 3 E0002000: CID B105E00D PID 04000BB00E Gen (type 0x0)
ROM 3 E0000000: CID B105E00D PID 04000BB001 Gen ITM (type 0x0)
ROM 2 E0041000: CID B105900D PID 04001BB975 CSt ARM ETMv4.0 type 0x13 Trace Source - Core
ROM 2 E0042000: CID B105900D PID 04004BB906 CSt type 0x14 Debug Control - Trigger, e.g. ECT
ROM 1 E0043000: CID B105900D PID 04001BB908 CSt CSTF type 0x12 Trace Link - Trace funnel/router
NXP: MIMXRT1176xxxxx
DAP stride is 1024 bytes (256 words)
Inspected v.2 External Flash Device on SPI using SFDP JEDEC ID MIMXRT1170_SFDP_QSPI.cfx
Image 'iMXRT1170_SFDP_FlexSPI1_A_QSPI Dec 12 2023 17:27:24'
Opening flash driver MIMXRT1170_SFDP_QSPI.cfx
Sending VECTRESET to run flash driver
Flash variant 'iMXRT1170_SFDP_FlexSPI1_A_QSPI Dec 12 2023 17:27:24' detected (16MB = 256*64K at 0x30000000)
Closing flash driver MIMXRT1170_SFDP_QSPI.cfx
( 65) Chip Setup Complete
Connected: was_reset=true. was_stopped=false
( 70) License Check Complete
Loading 'test_ads1119.elf' ELF 0x30000400 len 0x200
Opening flash driver MIMXRT1170_SFDP_QSPI.cfx (already resident)
Sending VECTRESET to run flash driver
Flash variant 'iMXRT1170_SFDP_FlexSPI1_A_QSPI Dec 12 2023 17:27:24' detected (16MB = 256*64K at 0x30000000)
Writing 512 bytes to address 0x30000400 in Flash
1 of 1 ( 0) Writing sectors 0-0 at 0x30000400 with 512 bytes
( 0) at 30000000: 0 bytes - 0/1536
(100) at 30000000: 16384 bytes - 16384/1536
Sectors written: 1, unchanged: 0, total: 1
Erased/Wrote sector 0-0 with 512 bytes in 166msec
Closing flash driver MIMXRT1170_SFDP_QSPI.cfx
(100) Finished writing Flash successfully.
Flash Write Done
Loaded 0x200 bytes in 273ms (about 1kB/s)
Loading 'test_ads1119.elf' ELF 0x30001000 len 0x30
Opening flash driver MIMXRT1170_SFDP_QSPI.cfx (already resident)
Sending VECTRESET to run flash driver
Flash variant 'iMXRT1170_SFDP_FlexSPI1_A_QSPI Dec 12 2023 17:27:24' detected (16MB = 256*64K at 0x30000000)
Writing 48 bytes to address 0x30001000 in Flash
1 of 1 ( 0) Writing sectors 0-0 at 0x30001000 with 48 bytes
( 0) at 30000000: 0 bytes - 0/4144
(100) at 30000000: 16384 bytes - 16384/4144
Sectors written: 1, unchanged: 0, total: 1
Erased/Wrote sector 0-0 with 48 bytes in 202msec
Closing flash driver MIMXRT1170_SFDP_QSPI.cfx
(100) Finished writing Flash successfully.
Flash Write Done
Loaded 0x30 bytes in 310ms (about 0kB/s)
Loading 'test_ads1119.elf' ELF 0x30001040 len 0x10
Opening flash driver MIMXRT1170_SFDP_QSPI.cfx (already resident)
Sending VECTRESET to run flash driver
Flash variant 'iMXRT1170_SFDP_FlexSPI1_A_QSPI Dec 12 2023 17:27:24' detected (16MB = 256*64K at 0x30000000)
Writing 16 bytes to address 0x30001040 in Flash
1 of 1 ( 0) Writing sectors 0-0 at 0x30001040 with 16 bytes
( 0) at 30000000: 0 bytes - 0/4176
(100) at 30000000: 16384 bytes - 16384/4176
Sectors written: 1, unchanged: 0, total: 1
Erased/Wrote sector 0-0 with 16 bytes in 199msec
Closing flash driver MIMXRT1170_SFDP_QSPI.cfx
(100) Finished writing Flash successfully.
Flash Write Done
Loaded 0x10 bytes in 309ms (about 0kB/s)
Loading 'test_ads1119.elf' ELF 0x30002000 len 0x777C
Opening flash driver MIMXRT1170_SFDP_QSPI.cfx (already resident)
Sending VECTRESET to run flash driver
Flash variant 'iMXRT1170_SFDP_FlexSPI1_A_QSPI Dec 12 2023 17:27:24' detected (16MB = 256*64K at 0x30000000)
Writing 30588 bytes to address 0x30002000 in Flash
1 of 1 ( 0) Writing sectors 0-0 at 0x30002000 with 30588 bytes
( 0) at 30000000: 0 bytes - 0/38780
( 42) at 30000000: 16384 bytes - 16384/38780
( 84) at 30004000: 16384 bytes - 32768/38780
(100) at 30008000: 16384 bytes - 49152/38780
Sectors written: 1, unchanged: 0, total: 1
Erased/Wrote sector 0-0 with 30588 bytes in 363msec
Closing flash driver MIMXRT1170_SFDP_QSPI.cfx
(100) Finished writing Flash successfully.
Flash Write Done
Loaded 0x777C bytes in 465ms (about 65kB/s)
Reset target (system)
============= SCRIPT: RT1170_reset.scp =============
SYSTEM Reset
DpID = 6BA02477
TAP 0: 6BA02477 Core 0: M7 APID: 84770001 ROM Table: E00FD003*
TAP 0: 6BA02477 AP 1: APID: 24770011 ROM Table: E00FF003
TAP 0: 6BA02477 AP 2: APID: 54770002 ROM Table: 00000002
APID = 0x84770001
Setting M4 spin code
Setting M4 clock
Resetting M4 core
Releasing M4
View cores on the DAP AP
DpID = 6BA02477
TAP 0: 6BA02477 Core 0: M7 APID: 84770001 ROM Table: E00FD003*
TAP 0: 6BA02477 Core 1: M4 APID: 24770011 ROM Table: E00FF003
R15 = 0x00223104
Vector table SP/PC is the reset context.
PC = 0x300024BD
SP = 0x82F80000
XPSR = 0x01000000
VTOR = 0x30002000
Set DEMCR = 0x010007F1
============= END SCRIPT ===========================

Pavel_Hernandez · ‎05-06-2024

Hello, maybe need to recover control, indicates the processor is still in some sort of debug mode could you try to do the steps on the thread?

RT board recovery for debugger connect issues - NXP Community

Does this mean you are working on a dual-core project?

Trying to follow the example from the connect m7 wake m4 and reset scp scripts, I am running the following commands in JLINK for the first execution:

If yes, maybe this thread could help you.

How to use JLINK to debug RT1170 dual core - NXP Community

Best regards,
Pavel

979A35J · ‎05-06-2024

Hi Pavel,

I do not believe this is a confused core issue, and our project only uses the M7 core. I am setting the M4 spin codes only to prevent its interrupts from interfering with the M7 per the comments in the reset and connect scripts from NXP.

There's actually a pretty good comment from NXP in the header of the reset.scp script for the IMX RT 1170 explaining what's going on here:

100 REM IMXRT1170 Reset script

110 REM When RT1170 Rev B is reset via SYSRESET_REQ under debugger control, bootROM will
120 REM not boot an existent flash application, instead it will enter a debug loop at a
130 REM fixed PC address (0x00223104). The debugger then needs to initialise the execution
140 REM context in order to jump to the user application.
150 REM RT1170 Rev A does not present this functionality, so it is allowed to continue
160 REM the booting process without any other intervention post reset.

Per this comment, the "The debugger then needs to initialise the execution context in order to jump to the user application." is the bit I am having trouble with. Like I said, I copied the register writes present in this same reset.scp script into my own custom JLINK script, and confirmed the writes are successful, but this is still evidently not enough to "initialize the execution context in order to jump to the user application." Perhaps you could contact the author of this IMXRT 1170 reset.scp script for more detail about what needs to be done?

979A35J · ‎05-10-2024