Ruffian Heng embedded: write protection, a common factor that causes serial nor flash to fail to download / start normally under i.mxrt


Hello, I’m ruffian Heng, a serious technical ruffian. What ruffian Heng introduced to you today isWrite protection, a common factor that causes serial nor flash to fail to download / start normally under i.mxrt

i. Mxrt Series MCU has been released for more than two years, and there are more and more customer products based on i.mxrt, which can be said to be in full bloom. As a system application engineer of i.mxrt product line, ruffian Heng can also do reference design in the early days. Now a lot of time is occupied by customer support.

Because i.mxrt series do not have built-in flash (except SIP models such as rt1064 and rt1024), it is a top priority for customers to start it with a serial nor flash. There are many serial nor flash manufacturers and customers have a lot of choices, so we have to deal with the vast flash models with customers, Flash test engineers often make fun of themselves.

Ruffian Heng mainly encountered several common factors in the process of supporting customers to solve the problem of serial nor flash download and startup. These factors may affect the normal use of flash under i.mxrt. Ruffian Heng mentioned in the last two articles respectivelySFDP factorsandQE bit factorsToday, ruffian Heng will focus on the factor of write protection.

1、 Introduce the problem that the customer board can be started and cannot be downloaded again

Ruffian Heng recently met a customer of a smart meter manufacturer. The board of their project is the master control i.mxrt1051 + Huabang w25q64jvssiq, and the application is the secondary loading design of mbed bootloader + user app. Among them, mbed bootloader is led and designed by arm Pelion Internet of things team, and user app is the function code of the meter manufacturer.

The customer’s problem is that after burning a specific version of mbed bootloader, the board flash cannot be burned again, but the board can be started from flash normally. After that, the customer tried to use various download tools that didn’t work (j-flash / IDE / NXP tool, etc.), including the one-stop download tool designed by ruffian HengMCUBootUtilitySo the problem turned to ruffian Heng (it seems that he feels like lying on the gun). Kstatus will be returned when the error reported by the tool background is erase or write_ FlexSPINOR_ Commandfailure, resulting in failure to download.

Since the problem is related to a specific version of mbed bootloader, it seems to be the problem introduced by this bootloader, but the ruffian Heng can’t get the customer’s mbed bootloader source code and can’t do white box analysis. In view of ruffian Heng’s experience in dealing with flash for so many years, ruffian Heng’s blind guess is the problem caused by bootloader enabling the software write protection function of flash. Therefore, ruffian Heng asked the customer to send a board to confirm ruffian Heng’s guess.

2、 Modify the SDK flexspi routine to read the status register

According to the w25q64jvssiq data manual, the configuration of the software write protection function is integrated into the internal nonvolatile status register of the flash device. This flash has three 8-bit status registers (the status registers support volatile writing (i.e. power-off recovery) and nonvolatile writing (i.e. power-off hold), which is determined by the leading write enable command type 0x06 / 0x50), And each status register has different read-write commands:

Now we simply modify the following flexspin nor routine in the SDK (select ram build) to add the support of the above three status register reading functions, so as to actually read the status register for verification.


The first is in app. H and flexspi_ nor_ polling_ Add the read command of status register to the LUT table in transfer. C. The original project already has the reading support of status register 1, so we only need to add the support of status register 2 / 3. Because of these two new commands, you need to add custom_ LUT_ Length is changed from 60 to 64 (maximum 64 on i.mxrt1051, i.e. 16 LUT sequences are supported).

const uint32_ t customLUT[CUSTOM_ LUT_ LENGTH] = {

Then in flexspi_ nor_ flash_ Add the following flexspi in ops. C_ nor_ get_ status_ Register () function, which directly emulates flexspi_ nor_ get_ vendor_ The ID () function flow can be written, and the timing of the flash side is the same.

status_t flexspi_nor_get_status_register(FLEXSPI_Type *base, uint8_t seqIndex, uint8_t *regValue)
    uint32_t readValue;
    flexspi_transfer_t flashXfer;

    flashXfer.deviceAddress = 0;
    flashXfer.port          = kFLEXSPI_PortA1;
    flashXfer.cmdType       = kFLEXSPI_Read;
    flashXfer.SeqNumber     = 1;
    flashXfer.seqIndex      = seqIndex;          = &readValue;
    flashXfer.dataSize      = 1;

    status_t status = FLEXSPI_TransferBlocking(base, &flashXfer);
    *regValue = (uint8_t)readValue;

    /* Do software reset. */

    return status;

Finally, in flexspi_ nor_ polling_ Flexspi is added to the main() function in transfer. C_ nor_ get_ status_ Register() function calls the statement to read all the values of status register 1 / 2 / 3.

static uint8_t s_regValue1 = 0;
static uint8_t s_regValue2 = 0;
static uint8_t s_regValue3 = 0;

int main(void)
    status_t status;


    /* Get status register 1-3. */
    status = flexspi_nor_get_status_register(EXAMPLE_FLEXSPI, NOR_CMD_LUT_SEQ_IDX_READSTATUSREG, &s_regValue1);
    status = flexspi_nor_get_status_register(EXAMPLE_FLEXSPI, NOR_CMD_LUT_SEQ_IDX_READSTATUSREG2, &s_regValue2);
    status = flexspi_nor_get_status_register(EXAMPLE_FLEXSPI, NOR_CMD_LUT_SEQ_IDX_READSTATUSREG3, &s_regValue3);

    // ...

3、 Write protection feature of w25q64jvssiq

Download the flexspinor routine modified in the previous section into RAM for debugging and running. You can read the values of status register 1 / 2 / 3 as 0x40, 0x42 and 0x60 respectively. It seems that status register has indeed been modified by mbed bootloader. Ruffian Heng has marked all the bit bits related to write protection in w25q64jvssiq internal status register as follows. We need to check the specific write protection settings corresponding to the read values according to the flash data manual:

First, status register1 [SRP], status register2 [SRL] and external wp# pins jointly determine the setting conditions of status register. In this example, if both SRL and SRP are 0, the wp# pin control does not take effect, and status register can be set directly.

Other bit bits related to write protection in status register are explained as follows. WPS is the core setting, which determines whether write protection is controlled by a separate block lock command (see flash command set) or directly determined by CMP, TB, SEC and BPX bits in status register1 / 2.

Status register3 [WPS]: determines whether the write protection policy is controlled by an independent block lock command (WPS = 1, the default) or by status register1 / 2 (WPS = 0)

Based on the above analysis, we finally found that mbed bootloader protects all 8MB flash space, so various download tools can’t burn this flash normally.

4、 Modify the SDK flexspi routine to write to the status register

To enable flash writing again, you need a separate embedded small project to change the status register1 / 2 / 3 value back to the default state (WPS = 0, CMP = 0). You can read the SR function modification steps in Section 2, and the code is as follows.After the code engineering modification is completed, it can be downloaded to ram for operation once with the help of the debugger. It should be noted that it should run in the chip SDP mode. After the operation is completed, update the old firmware in flash with the help of other download tools immediately to ensure that there is no possibility of soft reset causing the old firmware to run again in this process.(the mbed bootloader in flash is replaced here because it enables the write protection function of flash)

// flexspi_ nor_ flash_ New flexspi in ops. C file_ nor_ set_ status_ Register() function

5、 Write at the end

Here, we only take Huabang flash as an example to introduce write protection. Other flash manufacturers may have different designs for this write protection feature. You need to check the data manual for specific analysis. In addition, since flash will cause i.mxrt to fail to download or start normally, the new host computer tool mcutestsuite planned by ruffian Heng will consider including the serial nor flash status information query function (SFDP / QE bit / write protection, etc.). Please pay attention to this new project:

So far, write protection ruffian Heng, a common factor that causes serial nor flash to fail to download / start normally under i.mxrt, has been introduced. Where is the applause~~~

Welcome to subscribe

The article will be published to me at the same timeBlog Park home pageCSDN home pageZhihu home pageWeChat official accountOn the platform.

Wechat search“Ruffian scale“Or scan the QR code below to see it for the first time on the mobile phone.