0% found this document useful (0 votes)

52 views87 pages

MCU Flashloader Reference Manual

Uploaded by

Yusuf Ceylan

We take content rights seriously. If you suspect this is your content, claim it here.

Available Formats

Download as PDF, TXT or read online on Scribd

0% found this document useful (0 votes)

52 views87 pages

MCU Flashloader Reference Manual

Uploaded by

Yusuf Ceylan

We take content rights seriously. If you suspect this is your content, claim it here.

Available Formats

Download as PDF, TXT or read online on Scribd

MCUFLSHLDRRM

MCU Flashloader Reference Manual

Rev. 13 — 30 September 2022 User guide

Document information
Information Content
Keywords MCUFLSHLDRRM, MCU Flashloader. Flashloader, FLSHLDRRM, Flash
programming utility
Abstract This document describes the MCU flashloader, a configurable flash
programming utility that operates over a serial connection on MCUs.
NXP Semiconductors
MCUFLSHLDRRM
MCU Flashloader Reference Manual

1 Introduction

1.1 Overview

The MCU flashloader is a configurable flash programming utility that operates over a
serial connection on MCUs. It enables quick and easy programming of MCUs through the
entire product life cycle, including application development, final product manufacturing,
and more. The MCU flashloader will be delivered as binary or full source code that is
highly configurable. Host-side command line and GUI tools are available to communicate
with the flashloader. Users can utilize host tools to upload and/or download application
code via the flashloader.

1.2 Terminology

target
The device running the bootloader firmware (ROM).
host
The device sending commands to the target for execution.
source
The initiator of a communications sequence. For example, the sender of a command or
data packet.
destination
Receiver of a command or data packet.
incoming
From host to target.
outgoing
From target to host.

1.3 Block diagram

This block diagram describes the overall structure of the MCU flashloader.

User guide Rev. 13 — 30 September 2022

2 / 87
NXP Semiconductors
MCUFLSHLDRRM
MCU Flashloader Reference Manual

Figure 1. Block diagram

1.4 Features supported

Here are some of the features supported by the MCU flashloader:

• Supports UART and USB peripheral interfaces.
• Automatic detection of the active peripheral.
• Ability to disable any peripheral.
• UART peripheral implements autobaud.
• Common packet-based protocol for all peripherals.
• Packet error detection and retransmit.
• Protection of RAM used by the flashloader while it is running.
• Provides command to read properties of the device, such as RAM size.
• Support for serial QuadSPI and other external memories.
• Support for encrypted image download.

1.5 Components supported

Components for the flashloader firmware:

• Startup code (clocking, pinmux, etc.)
• Command phase state machine
• Command handlers
– GenericResponse
– FlashEraseAll
– FlashEraseRegion
– ReadMemory

User guide Rev. 13 — 30 September 2022

3 / 87
NXP Semiconductors
MCUFLSHLDRRM
MCU Flashloader Reference Manual

– ReadMemoryResponse
– WriteMemory
– FillMemory
– GetProperty
– GetPropertyResponse
– ReceiveSbFile
– Execute
– Call
– Reset
– SetProperty
– FlashProgramOnce/EfuseProgramOnce
– FlashReadOnce/EfuseReadOnce
– FlashReadOnceResponse
– ConfigureMemory
– GenerateKeyBlob
– GenerateKeyBlobResponse
• SB file state machine
– Unencrypted SB image support
• Packet interface
– Framing packetizer
– Command/data packet processor
• Memory interface
– Abstract interface
– Internal RAM/device memory interface
– FlexSPI NOR Memory Interface
– FlexSPI NAND Memory Interface
– SEMC NOR Memory Interface
– SEMC NAND Memory Interface
– SD Card Memory Interface
– eMMC Memory Interface
– SPI NOR FLASH/EEPROM Memory Interface
• Peripheral drivers
– UART
– Auto-baud detector
– USB device
– USB controller driver
– USB framework
– USB HID class
• Property interface
– Get or set bootloader property
– Security support
– Generate key blob for HAB encrypted boot.
Note: Different components are available on different targets. Therefore, some features
might not be supported on some targets.

User guide Rev. 13 — 30 September 2022

4 / 87
NXP Semiconductors
MCUFLSHLDRRM
MCU Flashloader Reference Manual

2 MCU Flashloader protocol API

2.1 Introduction

This section explains the general protocol for the packet transfers between the host
and the MCU flashloader. The description includes the transfer of packets for different
transactions, such as commands with no data phase, and commands with an incoming
or outgoing data phase. The next section describes the various packet types used in a
transaction.
Each command sent from the host is replied to with a response command.
Commands may include an optional data phase.
• If the data phase is incoming (from the host to MCU flashloader), it is part of the original
command.
• If the data phase is outgoing (from MCU flashloader to host), it is part of the response
command.

2.2 Command with no data phase

Note: In these diagrams, the Ack sent in response to a Command or Data packet can
arrive at any time before, during, or after the Command/Data packet has processed.
Command with no data phase
The protocol for a command with no data phase contains:
• Command packet (from host)
• Generic response command packet (to host)

Host Target
Command

Process Command
Ack

Response

Ack

Figure 2. Command with no data phase

User guide Rev. 13 — 30 September 2022

5 / 87
NXP Semiconductors
MCUFLSHLDRRM
MCU Flashloader Reference Manual

2.3 Command with incoming data phase

The protocol for a command with incoming data phase contains:

• Command packet (from host)(kCommandFlag_HasDataPhase set)
• Generic response command packet (to host)
• Incoming data packets (from host)
• Generic response command packet (to host)

Host Target
Command

Process Command
Ack
Initial Response
Ack
Data Packet

Process Data
Ack
Final Data Packet

Process Data
Ack
Final Response
Ack

Figure 3. Command with incoming data phase

Notes
• The host may not send any further packets while it is waiting for the response to a
command.
• The data phase is aborted if, prior to the start of the data phase, the Generic Response
packet does not have a status of kStatus_Success.
MCUFLSHLDRRM All information provided in this document is subject to legal disclaimers. © 2022 NXP B.V. All rights reserved.

User guide Rev. 13 — 30 September 2022

6 / 87
NXP Semiconductors
MCUFLSHLDRRM
MCU Flashloader Reference Manual

• Data phases may be aborted by the receiving side by sending the final Generic
Response early with a status of kStatus_AbortDataPhase. The host may abort the data
phase early by sending a zero-length data packet.
• The final Generic Response packet sent after the data phase includes the status for the
entire operation.

2.4 Command with outgoing data phase

The protocol for a command with an outgoing data phase contains:

• Command packet (from host)
• ReadMemory Response command packet (to host)(kCommandFlag_HasDataPhase
set)
• Outgoing data packets (to host)
• Generic response command packet (to host)

User guide Rev. 13 — 30 September 2022

7 / 87
NXP Semiconductors
MCUFLSHLDRRM
MCU Flashloader Reference Manual

Host Target
Command

Process Command
Ack
Initial Response
Ack

Data Packet

Process Data
Ack

Final Data Packet

Process Data
Ack

Final Response
Ack

Figure 4. Command with outgoing data phase

Note
• The data phase is considered part of the response command for the outgoing data
phase sequence.
• The host may not send any further packets while the host is waiting for the response to
a command.
• The data phase is aborted if, prior to the start of the data phase, the ReadMemory
Response command packet does not contain the kCommandFlag_HasDataPhase flag.
• Data phases may be aborted by the host sending the final Generic Response early with
a status of kStatus_AbortDataPhase. The sending side may abort the data phase early
by sending a zero-length data packet.
• The final Generic Response packet sent after the data phase includes the status for the
entire operation.

User guide Rev. 13 — 30 September 2022

8 / 87
NXP Semiconductors
MCUFLSHLDRRM
MCU Flashloader Reference Manual

3 Flashloader packet types

3.1 Introduction
The MCU Flashloader device works in slave mode. A host initiates all the data
communication, which is either a PC or embedded host. The MCU Flashloader device is
the target, which receives a command or data packet. All data communication between
host and target is packetized.
Note: The term "target" refers to the "MCU Flashloader device".
There are 6 types of packets used:
• Framing packet
• CRC16 algorithm
• Ping packet
• Ping response packet
• Command packet
• Response packet
All fields in the packets are in little-endian byte order.

3.2 Framing packet

The framing packet is used for flow control and error detection for the communications
links that do not have such features built-in. The framing packet structure sits between
the link layer and command layer. It wraps command and data packets as well.
Every framing packet containing data sent in one direction results in a synchronizing
response framing packet in the opposite direction.
The framing packet described in this section is used for serial peripheral UART. The USB
HID peripheral does not use framing packets. Instead, the packetization inherent in the
USB protocol itself is used.

Table 1. Framing packet format

Byte # Parameter Description
0 start byte Value - 0x5A
1 packetType
2 length_low Length is a 16-bit field that specifies the
entire command or data packet size in
3 length_high
bytes.
4 crc16_low This is a 16-bit field. The CRC16 value
covers entire framing packet, including the
5 crc16_high
start byte and command or data packets,
but does not include the CRC bytes. See
the CRC16 algorithm after this table.
6 . . .n Command or Data
packet payload

A special framing packet that contains only a start byte and a packet type is used for
synchronization between the host and target.

User guide Rev. 13 — 30 September 2022

9 / 87
NXP Semiconductors
MCUFLSHLDRRM
MCU Flashloader Reference Manual

Table 2. Special framing packet format

Byte # Value Parameter
0 0x5A start byte
1 0xAn packetType

The Packet Type field specifies the type of the packet from one of the defined types
(below):

Table 3. packetType field

packetType Name Description
0xA1 kFramingPacketType_Ack The previous packet was received successfully;
the sending of more packets is allowed.
0xA2 kFramingPacketType_Nak The previous packet was corrupted and must be
re-sent.
0xA3 kFramingPacketType_AckAbort Data phase is being aborted.
0xA4 kFramingPacketType_Command The framing packet contains a command packet
payload.
0xA5 kFramingPacketType_Data The framing packet contains a data packet
payload.
0xA6 kFramingPacketType_Ping Sent to verify the other side is alive. Also used
for UART autobaud.
0xA7 kFramingPacketType_PingResp A response to Ping; contains the framing
onse protocol version number and options.

3.3 CRC16 algorithm

This section provides the CRC16 algorithm.
The CRC is computed over each byte in the framing packet header, excluding the crc16
field itself, plus all payload bytes. The CRC algorithm is the XMODEM variant of CRC-16.
The characteristics of the XMODEM variant are:

Table 4. XMODEM charactertistics

width 16
polynomial 0x1021
init value 0x0000
reflect in false
reflect out false
xor out 0x0000
check result 0x31c3

The check result is computed by running the ASCII character sequence "123456789"
through the algorithm.

uint16_t crc16_update(const uint8_t * src, uint32_t lengthInBytes)

{
uint32_t crc = 0;
uint32_t j;
for (j=0; j < lengthInBytes; ++j)

User guide Rev. 13 — 30 September 2022

10 / 87
NXP Semiconductors
MCUFLSHLDRRM
MCU Flashloader Reference Manual

{
uint32_t i;
uint32_t byte = src[j];
crc ^= byte << 8;
for (i = 0; i < 8; ++i)
{
uint32_t temp = crc << 1;
if (crc & 0x8000)
{
temp ^= 0x1021;
}
crc = temp;
}
}
return crc;
}

3.4 Ping packet

The Ping packet can be sent from host to target any time when the target is expecting a
command packet. If the selected peripheral is UART, a ping packet must be sent before
any other communication in order to run autobaud. For other serial peripherals it is
optional, but is recommended in order to determine the serial protocol version.
In response to a Ping packet, the target sends a Ping Response packet, discussed in
following section.

Table 5. Ping packet format

Byte # Value Name
0 0x5A start byte
1 0xA6 ping

Figure 5. Ping Packet Protocol Sequence

User guide Rev. 13 — 30 September 2022

11 / 87
NXP Semiconductors
MCUFLSHLDRRM
MCU Flashloader Reference Manual

3.5 Ping response packet

The target sends a Ping Response packet back to the host after receiving a Ping packet.
If communication is over a UART peripheral, the target uses the incoming Ping packet to
determine the baud rate before replying with the Ping Response packet. After the Ping
Response packet is received by the host, the connection is established, and the host
starts sending commands to the target.

Table 6. Ping Response packet format

Byte # Value Parameter
0 0x5A start byte
1 0xA7 Ping response code
2 Protocol bugfix
3 Protocol minor
4 Protocol major
5 Protocol name = 'P' (0x50)
6 Options low
7 Options high
8 CRC16 low
9 CRC16 high

3.6 Command packet

The command packet carries a 32-bit command header and a list of 32-bit parameters.

Table 7. Command packet format

Command packet format (32 bytes)
Command 28 bytes for parameters (Max 7 parameters)
header (4 bytes)
Tag Flags Rsvd Param Param1 Param2 Param3 Param4 Param5 Param6 Param7
Count (32-bit) (32-bit) (32-bit) (32-bit) (32-bit) (32-bit) (32-bit)
byte byte byte byte - - - - - - -
0 1 2 3

Table 8. Command header format

Byte # Command header field
0 Command or Response tag
1 Flags
2 Reserved. Should be 0x00.
3 ParameterCount

The header is followed by 32-bit parameters up to the value of the ParameterCount field
specified in the header.
Command packets are also used by the target to send responses back to the host. As
described in section 3.4, command packets and data packets are embedded into framing
packets for all UART transfers.
MCUFLSHLDRRM All information provided in this document is subject to legal disclaimers. © 2022 NXP B.V. All rights reserved.

User guide Rev. 13 — 30 September 2022

12 / 87
NXP Semiconductors
MCUFLSHLDRRM
MCU Flashloader Reference Manual

Flags: Each command packet contains a Flag byte. Only bit 0 of the flag byte is used.
If bit 0 of the flag byte is set to 1, then data packets follow in the command sequence.
The number of bytes that are transferred in the data phase is determined by a command-
specific parameter in the parameters array.

User guide Rev. 13 — 30 September 2022

13 / 87
NXP Semiconductors
MCUFLSHLDRRM
MCU Flashloader Reference Manual

ParameterCount: The number of parameters included in the command packet.

Parameters: The parameters are word-length (32 bits). With the default maximum
packet size of 32 bytes, a command packet can contain up to 7 parameters.

3.7 Response packet

Response packets use the same format as command packets (refer to section 3.6).
Types of responses include:
• GenericResponse
• GetPropertyResponse
• ReadMemoryResponse
• FlashReadOnceResponse
• FlashReadResourceResponse
GenericResponse: After the MCU flashloader has processed a command, the
flashloader sends a generic response with status and command tag information to the
host. The generic response is the last packet in the command protocol sequence. The
generic response packet contains the command packet data (with generic response tag =
0xA0) and a list of parameters (defined in the next section). The parameter count field in
the header is always set to 2, for status code and command tag parameters.

Table 11. GenericResponse parameters

Byte # Parameter Description
0-3 Status code The Status codes are errors encountered during the
execution of a command by the target. If a command
succeeds, then a kStatus_Success code is returned.
4-7 Command tag The Command tag parameter identifies the response to
the command sent by the host.

GetPropertyResponse: The GetPropertyResponse packet is sent by the

target in response to the host query that uses the GetProperty command. The
GetPropertyResponse packet contains the command packet data, with the command/
response tag set to a GetPropertyResponse tag value (0xA7).
The parameter count field in the header is set to greater than 1, to always include the
status code and one or many property values.

Table 12. GetPropertyResponse parameters

Byte # Value Parameter
0-3 Status code
4-7 Property value
... ...
Can be up to maximum 6 property values, limited to the
size of the 32-bit command packet and property type.

ReadMemoryResponse: The ReadMemoryResponse packet is sent by

the target in response to the host sending a ReadMemory command. The
ReadMemoryResponse packet contains the command packet data, with the command/

User guide Rev. 13 — 30 September 2022

14 / 87
NXP Semiconductors
MCUFLSHLDRRM
MCU Flashloader Reference Manual

response tag set to a ReadMemoryResponse tag value (0xA3), the flags field set to
kCommandFlag_HasDataPhase (1).
The parameter count is set to 2 for the status code and the data byte count parameters
shown below.

Table 13. ReadMemoryResponse Parameters

Byte # Parameter Descripton
0-3 Status code The status of the associated Read Memory command.
4-7 Data byte count The number of bytes sent in the data phase.

FlashReadOnceResponse:The FlashReadOnceResponse packet is sent by

the target in response to the host sending a FlashReadOnce command. The
FlashReadOnceResponse packet contains the command packet data, with the
command/response tag set to a FlashReadOnceResponse tag value (0xAF), and the
flags field set to 0. The parameter count is set to 2 plus the number of words requested to
be read in the FlashReadOnceCommand.

Table 14. FlashReadOnceResponse Parameters

Byte # Value Parameter
0–3 Status Code
4–7 Byte count to read
… …
Can be up to 20 bytes of requested read data.

GenerateKeyBlobResponse: The GenerateKeyBlobResponse packet is sent

by the target in response to the host sending a GenerateKeyBlob command. The
GenerateKeyBlobResponse packet contains the command packet data with the
command/response tag set to a GenerateKeyBlobResponse tag value (0xB3), and the
flags field set to KCommandFlag_HasDataPhase(1).
The parameter count is set to 2 for the status code and the byte count of the key blob
generated by the target.

Table 15. GenerateKeyBlobResponse Parameters

Byte # Parameter Description
0-3 Status code The status of the associated
GenerateKeyBlob
4-7 Blob byte count The byte count of the key blob
sent in the data phase

4 MCU Flashloader command API

4.1 Introduction

All MCU flashloader command APIs follows the command packet format wrapped by the
framing packet as explained in previous sections.
See Table 3-9 for a list of commands supported by MCU flashloader.
MCUFLSHLDRRM All information provided in this document is subject to legal disclaimers. © 2022 NXP B.V. All rights reserved.

User guide Rev. 13 — 30 September 2022

15 / 87
NXP Semiconductors
MCUFLSHLDRRM
MCU Flashloader Reference Manual

For a list of status codes returned by MCU flashloader, see Appendix A.

4.2 GetProperty command

The GetProperty command is used to query the flashloader about various properties
and settings. Each supported property has a unique 32-bit tag associated with it.
The tag occupies the first parameter of the command packet. The target returns a
GetPropertyResponse packet with the values for the property identified with the tag in the
GetProperty command.
Properties are the defined units of data that can be accessed with the GetProperty
or SetProperty commands. Properties may be read-only or read-write. All read-write
properties are 32-bit integers, so they can easily be carried in a command parameter.
For a list of properties and their associated 32-bit property tags supported by MCU
flashloader, see Appendix B, "GetProperty and SetProperty commands".
The 32-bit property tag is the only parameter required for GetProperty command.

Table 16. Parameters for GetProperty command

Byte # Command
0-3 Property tag
4-7 External Memory Identifier (only applies to get property for
external memory)

Host Target

GetProperty: Property tag = 0x01

0x5a a4 0c 00 4b 33 07 00 00 02 01 00
00 00 00 00 00 00

Process Command

ACK: 0x5a a1

Generic Response:
00 00 00 06 02 4b
0x5a a4 0c 00 f4 9d a7 00 00 02 00 00

ACK: 0x5a a1

Figure 6. Protocol sequence for GetProperty command

Table 17. GetProperty packet format example

GetProperty Parameter Value
Framing packet start byte 0x5A
packetType 0xA4, kFramingPacketType_Command
length 0x0C 0x00
crc16 0x4B 0x33

User guide Rev. 13 — 30 September 2022

16 / 87
NXP Semiconductors
MCUFLSHLDRRM
MCU Flashloader Reference Manual

Table 17. GetProperty packet format example...continued

GetProperty Parameter Value
Command packet commandTag 0x07 – GetProperty
flags 0x00
reserved 0x00
parameterCount 0x02
propertyTag 0x00000001 - CurrentVersion
Memory ID 0x00000000 - Internal Flash

The GetProperty command has no data phase.

Response: In response to a GetProperty command, the target sends a
GetPropertyResponse packet with the response tag set to 0xA7. The parameter count
indicates the number of parameters sent for the property values, with the first parameter
showing status code 0, followed by the property value(s). The next table shows an
example of a GetPropertyResponse packet.

Table 18. GetProperty response packet format example

GetProperty Parameter Value
Response
Framing packet start byte 0x5A
packetType 0xA4, kFramingPacketType_Command
length 0x0c 0x00 (12 bytes)
crc16 0xf4 9d
Command packet responseTag 0xA7
flags 0x00
reserved 0x00
parameterCount 0x02
status 0x00000000
propertyValue 0x4b020600 - CurrentVersion

4.3 SetProperty command

The SetProperty command is used to change or alter the values of the properties or
options of the flashloader. The command accepts the same property tags used with the
GetProperty command. However, only some properties are writable--see Appendix B.
If an attempt to write a read-only property is made, an error is returned indicating the
property is read-only and cannot be changed.
The property tag and the new value to set are the two parameters required for the
SetProperty command.

Table 19. Parameters for SetProperty command

Byte # Command
0-3 Property tag

User guide Rev. 13 — 30 September 2022

17 / 87
NXP Semiconductors
MCUFLSHLDRRM
MCU Flashloader Reference Manual

Table 19. Parameters for SetProperty command...continued

Byte # Command
4-7 Property value

Host Target

SetProperty: Property tag = 0x0a, Prope

rty Value = 1
0x5a a4 0c 00 67 8d 0c 00 00 02 0a 00
00 00 01 00 00 00

Process Command

ACK: 0x5a a1

Generic Response:
00 00 0c 00 00 00
0x5a a4 0c 00 e0 f7 a0 00 00 02 00 00

ACK: 0x5a a1

Figure 7. Protocol sequence for SetProperty command

Table 20. SetProperty packet format example

SetProperty Parameter Value
Framing packet start byte 0x5A
packetType 0xA4, kFramingPacketType_Command
length 0x0C 0x00
crc16 0x67 0x8D
Command packet commandTag 0x0C – SetProperty with property tag 10
flags 0x00
reserved 0x00
parameterCount 0x02
propertyTag 0x0000000A - VerifyWrites
propertyValue 0x00000001

The SetProperty command has no data phase.

Response: The target returns a GenericResponse packet with one of following status
codes:

Table 21. SetProperty response status codes

Status Code
kStatus_Success
kStatus_ReadOnly

User guide Rev. 13 — 30 September 2022

18 / 87
NXP Semiconductors
MCUFLSHLDRRM
MCU Flashloader Reference Manual

Table 21. SetProperty response status codes...continued

Status Code
kStatus_UnknownProperty
kStatus_InvalidArgument

4.4 FlashEraseAll command

The FlashEraseAll command performs an erase of the entire flash memory. If any flash
regions are protected, then the FlashEraseAll command fails and returns an error status
code. Executing the FlashEraseAll command releases flash security if it (flash security)
was enabled, by setting the FTFA_FSEC register. However, the FSEC field of the flash
configuration field is erased, so unless it is reprogrammed, the flash security is re-
enabled after the next system reset. The Command tag for FlashEraseAll command is
0x01 set in the commandTag field of the command packet.

The FlashEraseAll command requires a memory ID. If the memory ID is not specified, the
internal flash (memory ID =0) will be selected as default.

Table 22. Parameter for FlashEraseAll command

Byte # Parameter
0-3 Memory ID

0x000 Internal Flash

0x010 Execute-only region in
Internal Flash
0x001 Serial NOR through
QuadSPI
0x008 Parallel NOR through
SEMC
0x009 Serial NOR through
FlexSPI
0x100 SLC Raw NAND
through SEMC
0x101 Serial NAND through
FlexSPI
0x110 Serial NOR/EEPROM
through SPI
0x120 SD through uSDHC
0x121 eMMC through
uSDHC

User guide Rev. 13 — 30 September 2022

19 / 87
NXP Semiconductors
MCUFLSHLDRRM
MCU Flashloader Reference Manual

Host Target

FlashEraseAll
0x5a a4 08 00 0c 22 01 00 00 01 00 00
00 00
Process Command

ACK: 0x5a a1

Generic Response:
00 00 01 00 00 00
0x5a a4 0c 00 66 ce a0 00 00 02 00 00

ACK: 0x5a a1

Figure 8. Protocol sequence for FlashEraseAll command

Table 23. FlashEraseAll packet format example

FlashEraseAll Parameter Value
Framing packet start byte 0x5A
packetType 0xA4, kFramingPacketType_Command
length 0x08 0x00
crc16 0x0C 0x22
Command packet commandTag 0x01 - FlashEraseAll
flags 0x00
reserved 0x00
parameterCount 0x01
Memory ID refer to the above table

The FlashEraseAll command has no data phase.

Response: The target returns a GenericResponse packet with status code either set to
kStatus_Success for successful execution of the command, or set to an appropriate error
status code.

4.5 FlashEraseRegion command

The FlashEraseRegion command performs an erase of one or more sectors of the flash
memory.
The start address and number of bytes are the 2 parameters required for
the FlashEraseRegion command. The start and byte count parameters must
be 4-byte aligned ([1:0] = 00), or the FlashEraseRegion command fails and
returns kStatus_FlashAlignmentError(101). If the region specified does not fit
in the flash memory space, the FlashEraseRegion command fails and returns

User guide Rev. 13 — 30 September 2022

20 / 87
NXP Semiconductors
MCUFLSHLDRRM
MCU Flashloader Reference Manual

kStatus_FlashAddressError(102). If any part of the region specified is protected, the

FlashEraseRegion command fails and returns kStatus_MemoryRangeInvalid(10200).

Table 24. Parameters for FlashEraseRegion command

Byte # Parameter
0-3 Start address
4-7 Byte count
8 - 11 Memory ID

The FlashEraseRegion command has no data phase.

Response: The target returns a GenericResponse packet with one of following error
status codes.

Table 25. FlashEraseRegion response status codes

Status code
kStatus_Success (0)
kStatus_MemoryRangeInvalid (10200)
kStatus_FlashAlignmentError (101)
kStatus_FlashAddressError (102)
kStatus_FlashAccessError (103)
kStatus_FlashProtectionViolation (104)
kStatus_FlashCommandFailure (105)

4.6 ReadMemory command

The ReadMemory command returns the contents of memory at the given address, for a
specified number of bytes. This command can read any region of memory accessible by
the CPU and is not protected by security.
The start address and number of bytes are the two parameters required for ReadMemory
command. The memory ID is optional. Internal memory is selected as default if memory
ID is not specified.

Table 26. Parameters for read memory command

Byte Parameter Description
0-3 Start address Start address of memory to read from
4-7 Byte count Number of bytes to read and return to caller
8-11 Memory ID Internal or extermal memory Identifier

User guide Rev. 13 — 30 September 2022

21 / 87
NXP Semiconductors
MCUFLSHLDRRM
MCU Flashloader Reference Manual

Host Target

ReadMemory: startAddress = 0x20

000400, byteCount = 0x64
0x5a a4 10 00 f4 1b 03 00 00 03
00 04 00 20 64 00 00 00 00 00 00
00

Process Command

ACK: 0x5a a1

ReadMemory Response:
00 00 64 00 00 00
0x5a a4 0c 00 27 f6 a3 01 00 02 00 00

ACK: 0x5a a1

Data packet:
0x5a a5 length16 CRC16 data
Process Data
ACK: 0x5a a1

Final data packet:

0x5a a5 length16 CRC16 data
Process Data
ACK: 0x5a a1

Generic Response:
00 00 03 00 00 00
0x5a a4 0c 00 0e 23 a0 00 00 02 00 00

ACK: 0x5a a1

Figure 9. Command sequence for read memory

Table 27. ReadMemory packet format example

ReadMemory Parameter Value
Framing packet Start byte 0x5A0xA4,
packetType kFramingPacketType_Command
length 0x10 0x00
crc16 0xF4 0x1B
Command packet commandTag 0x03 - readMemory
flags 0x00
reserved 0x00
parameterCount 0x03
startAddress 0x20000400
byteCount 0x00000064
memoryID 0x0

Data Phase: The ReadMemory command has a data phase. Because the target works
in slave mode, the host needs to pull data packets until the number of bytes of data

User guide Rev. 13 — 30 September 2022

22 / 87
NXP Semiconductors
MCUFLSHLDRRM
MCU Flashloader Reference Manual

specified in the byteCount parameter of the ReadMemory command are received by

host.
Response: The target returns a ReadMemoryResponse packet in response to the host
sending a ReadMemory command. And returns a GenericResponse in response to the
result of the data phase.

4.7 WriteMemory command

The WriteMemory command writes data provided in the data phase to a specified range
of bytes in memory (flash or RAM). However, if flash protection is enabled, then writes to
protected sectors fail.
Special care must be taken when writing to flash.
• First, any flash sector written to must have been previously erased with a
FlashEraseAll, FlashEraseRegion, or FlashEraseAllUnsecure command.
• Writing to flash requires the start address to be page size aligned.
• The byte count is rounded up to a multiple of page size, and trailing bytes are filled with
the flash erase pattern (0xff).
• If the VerifyWrites property is set to true, then writes to flash also perform a flash verify
program operation.
When writing to RAM, the start address does not need to be aligned, and the data is not
padded.
The start address and number of bytes are the 2 parameters required for the
WriteMemory command. The memory ID is optional. Internal memory will be selected as
default if a memory ID is not specified.

Table 28. Parameters for WriteMemory command

Byte # Command
0-3 Start address
4-7 Byte count
8 - 11 Memory ID

User guide Rev. 13 — 30 September 2022

23 / 87
NXP Semiconductors
MCUFLSHLDRRM
MCU Flashloader Reference Manual

Host Target

WriteMemory: startAddress = 0x20

000400, byteCount = 0x64
0x5a a4 10 00 97 dd 04 01 00 03
00 04 00 20 64 00 00 00 00 00 00
00

Process Command

ACK: 0x5a a1
Generic Response:
00 00 04 00 00 00
0x5a a4 0c 00 23 72 a0 00 00 02 00 00

ACK: 0x5a a1
Data packet:
0x5a a5 length16 CRC16 data

Process Data
ACK: 0x5a a1

Final data packet:

0x5a a5 length16 CRC16 data
Process Data

ACK: 0x5a a1

Generic Response:
00 00 04 00 00 00
0x5a a4 0c 00 23 72 a0 00 00 02 00 00

ACK: 0x5a a1

Figure 10. Protocol sequence for WriteMemory command

Table 29. WriteMemory packet format example

WriteMemory Parameter Value
Framing packet start byte 0x5A
packetType 0xA4, kFramingPacketType_Command
length 0x10 0x00
crc16 0x97 0xDD
Command packet commandTag 0x04 - writeMemory
flags 0x01
reserved 0x00
parameterCount 0x03
startAddress 0x20000400
byteCount 0x00000064
memoryID 0x0

User guide Rev. 13 — 30 September 2022

24 / 87
NXP Semiconductors
MCUFLSHLDRRM
MCU Flashloader Reference Manual

Data Phase: The WriteMemory command has a data phase. The host sends data
packets until the number of bytes of data specified in the byteCount parameter of the
WriteMemory command are received by the target.
Response: The target returns a GenericResponse packet with a status code set to
kStatus_Success upon successful execution of the command or to an appropriate error
status code.

4.8 FillMemory command

The FillMemory command fills a range of bytes in memory with a data pattern. It follows
the same rules as the WriteMemory command. The difference between FillMemory and
WriteMemory is that a data pattern is included in the FillMemory command parameter,
and there is no data phase for the FillMemory command, while WriteMemory does have
a data phase.

Table 30. Parameters for FillMemory command

Byte # Command
0-3 Start address of memory to fill
4-7 Number of bytes to write with the pattern
• The start address should be 32-bit aligned.
• The number of bytes must be evenly divisible by 4.
Note: For any part that uses FTFE flash, the start
address should be 64-bit aligned, and the number of bytes
must be evenly divisible by 8.
8 - 11 32-bit pattern

• To fill with a byte pattern (8-bit), the byte must be replicated 4 times in the 32-bit
pattern.
• To fill with a short pattern (16-bit), the short value must be replicated 2 times in the 32-
bit pattern.
For example, to fill a byte value with 0xFE, the word pattern is 0xFEFEFEFE; to fill a
short value 0x5AFE, the word pattern is 0x5AFE5AFE.
Special care must be taken when writing to flash.
• First, any flash sector written to must have been previously erased with a FlashEraseAll
or FlashEraseRegion command.
• Writing to flash requires the start address to be page size aligned.
• If the VerifyWrites property is set to true, then writes to flash also performs a flash verify
program operation.
When writing to RAM, the start address does not need to be aligned.

User guide Rev. 13 — 30 September 2022

25 / 87
NXP Semiconductors
MCUFLSHLDRRM
MCU Flashloader Reference Manual

Host Target

FillMemory, with word pattern 0x123

45678
0x5a a4 10 00 e4 57 05 00 00 03 00 70
00 00 00 08 00 00 78 56 34 12

Process Command

ACK: 0x5a a1

Generic Response:
00 00 00 06 02 4b
0x5a a4 0c 00 f4 9d a7 00 00 02 00 00

ACK: 0x5a a1

Figure 11. Protocol sequence for FillMemory command

Table 31. FillMemory packet format example

FillMemory Parameter Value
Framing packet start byte 0x5A
packetType 0xA4, kFramingPacketType_Command
length 0x10 0x00
crc16 0xE4 0x57
Command packet commandTag 0x05 – FillMemory
flags 0x00
Reserved 0x00
parameterCount 0x03
startAddress 0x00007000
byteCount 0x00000800
patternWord 0x12345678

The FillMemory command has no data phase.

Response: upon successful execution of the command, the target (MCU flashloader)
returns a GenericResponse packet with a status code set to kStatus_Success, or to an
appropriate error status code.

4.9 Execute command

The execute command results in the flashloader setting the program counter to the code
at the provided jump address, R0 to the provided argument, and a Stack pointer to the
provided stack pointer address. Prior to the jump, the system is returned to the reset
state.

User guide Rev. 13 — 30 September 2022

26 / 87
NXP Semiconductors
MCUFLSHLDRRM
MCU Flashloader Reference Manual

The Jump address, function argument pointer, and stack pointer are the parameters
required for the Execute command. If the stack pointer is set to zero, the called code is
responsible for setting the processor stack pointer before using the stack.

Table 32. Parameters for Execute command

Byte # Command
0-3 Jump address
4-7 Argument word
8 - 11 Stack pointer address

The Execute command has no data phase.

Response: Before running the Execute command, the target validates the parameters
and returns a GenericResponse packet with a status code either set to kStatus_Success
or an appropriate error status code.

4.10 Call command

The Call command executes a function that is written in memory at the address sent in
the command. The address needs to be a valid memory location residing in accessible
flash (internal or external) or in RAM. The command supports the passing of one 32-
bit argument. Although the command supports a stack address, at this time the call still
takes place using the current stack pointer. After execution of the function, a 32-bit value
is returned in the generic response message.

Host Target

Call: Address = 0x00000cd9, arg = 0

0x5a a4 0c 00 16 5c 0a 00 00 02 d9 0c
00 00 00 00 00 00 00

Process Command

ACK: 0x5a a1

Generic Response:
00 00 0a 00 00 00
0x5a a4 0c 00 79 d0 a0 00 00 02 00 00

ACK: 0x5a a1

Figure 12. Protocol sequence for call command

Table 33. Parameters for Call command

Byte # Command
0-3 Call address
4-7 Argument word
8 - 11 Stack pointer

User guide Rev. 13 — 30 September 2022

27 / 87
NXP Semiconductors
MCUFLSHLDRRM
MCU Flashloader Reference Manual

Response: The target returns a GenericResponse packet with a status code either set to
the return value of the function called or set to kStatus_InvalidArgument (105).

4.11 Reset command

The Reset command results in the flashloader resetting the chip.
The Reset command requires no parameters.

Figure 13. Protocol sequence for Reset command

Table 34. Reset command packet format example

Reset Parameter Value
Framing packet start byte 0x5A
packetType 0xA4, kFramingPacketType_Command
length 0x04 0x00
crc16 0x6F 0x46
Command packet commandTag 0x0B - reset
flags 0x00
reserved 0x00
parameterCount 0x00

The Reset command has no data phase.

Response: The target returns a GenericResponse packet with status code set to
kStatus_Success before resetting the chip.
The Reset command can also be used to switch boot from flash after successful flash
image provisioning via the flashloader. After issuing the reset command, allow 5 seconds
for the user application to start running from flash.

User guide Rev. 13 — 30 September 2022

28 / 87
NXP Semiconductors
MCUFLSHLDRRM
MCU Flashloader Reference Manual

4.12 FlashProgramOnce/eFuseProgramOnce command

The FlashProgramOnce/ eFuseProgramOnce command writes data (that is provided in
a command packet) to a specified range of bytes in the program once field. Special care
must be taken when writing to the program once field.
• The program once field only supports programming once, so any attempt to reprogram
a program once field gets an error response.
• Writing to the program once field requires the byte count to be 4.
The FlashProgramOnce command uses three parameters: index, byteCount, and data.

Table 35. Parameters for FlashProgramOnce command

Byte # Command
0-3 Index of program once/ eFuse field
4-7 Byte count (must be 4 or 8 for a FlashProgramOnce; must
be 4 for eFuseProgramOnce)
8 - 11 Data
12 - 16 Data

Host Target

FlashProgramOnce: index = 0, byteCount

= 4, data = 0x12345678
0x5a a4 10 00 7e 89 0e 00 00 03 00 00
00 00 04 00 00 00 78 56 34 12

Process Command

ACK: 0x5a a1

Generic Response:
00 00 0e 00 00 00
0x5a a4 0c 00 88 1a a0 00 00 02 00 00

ACK: 0x5a a1

Figure 14. Protocol sequence for FlashProgramOnce command

Table 36. FlashProgramOnce packet format example

Flash Parameter Value
ProgramOnce
Framing packet start byte 0x5A
packetType 0xA4, kFramingPacketType_Command
length 0x10 0x00
crc16 0x7E4 0x89
Command packet commandTag 0x0E – FlashProgramOnce
flags 0

User guide Rev. 13 — 30 September 2022

29 / 87
NXP Semiconductors
MCUFLSHLDRRM
MCU Flashloader Reference Manual

Table 36. FlashProgramOnce packet format example...continued

Flash Parameter Value
ProgramOnce
reserved 0
parameterCount 3
index 0x0000_0000
byteCount 0x0000_0004
data 0x1234_5678

Response: upon successful execution of the command, the target (MCU flashloader)
returns a GenericResponse packet with a status code set to kStatus_Success, or to an
appropriate error status code.

4.13 FlashReadOnce/eFuseReadOnce command

The FlashReadOnce/eFuseReadOnce command returns the contents of the program
once field by given index and byte count. The FlashReadOnce command uses 2
parameters: index and byteCount.

Table 37. Parameters for FlashReadOnce command

Byte # Parameter Description
0-3 index Index of the program once field (to read from)
4-7 byteCount Number of bytes to read and return to the caller (must
be 4 for eFuseReadOnce)

Host Target

FlashReadOnce: index = 0, byteCount

=4
0x5a a4 0c 00 c1 a5 0f 00 00 02 00 00
00 00 04 00 00 00

Process Command

ACK: 0x5a a1

FlashReadOnce Response:
00 00 04 00 00 00 78 56 34 12
0x5a a4 10 00 3f 6f af 00 00 03 00 00

ACK: 0x5a a1

Figure 15. Protocol sequence for FlashReadOnce command

Table 38. FlashReadOnce packet format example

FlashReadOnce Parameter Value
Framing packet start byte 0x5A

User guide Rev. 13 — 30 September 2022

30 / 87
NXP Semiconductors
MCUFLSHLDRRM
MCU Flashloader Reference Manual

Table 38. FlashReadOnce packet format example...continued

FlashReadOnce Parameter Value
packetType 0xA4
length 0x0C 0x00
crc 0xC1 0xA5
Command packet commandTag 0x0F – FlashReadOnce
flags 0x00
reserved 0x00
parameterCount 0x02
index 0x0000_0000
byteCount 0x0000_0004

Table 39. FlashReadOnce response format example

FlashRead Parameter Value
Once response
Framing packet start byte 0x5A
packetType 0xA4
length 0x10 0x00
crc 0x3F 0x6F
Command packet commandTag 0xAF
flags 0x00
reserved 0x00
parameterCount 0x03
status 0x0000_0000
byteCount 0x0000_0004
data 0x1234_5678

Response: Upon successful execution of the command, the target returns a

FlashReadOnceResponse packet with a status code set to kStatus_Success, a byte
count and corresponding data read from Program Once Field upon successful execution
of the command, or returns with a status code set to an appropriate error status code and
a byte count set to 0.

4.14 Configure Memory command

The Configure Memory command configures an external memory device using a pre-
programmed configuration image. The parameters passed are memory ID and memory
address containing the configuration data. The configuration data is written to a RAM
or flash location and then this command directs the flashloader to use the data at that
location to configure the external memory devices. See Chapter 6, External Memory
Support, for configuration data details.

User guide Rev. 13 — 30 September 2022

31 / 87
NXP Semiconductors
MCUFLSHLDRRM
MCU Flashloader Reference Manual

Table 40. Parameters for Configure Memory command

Byte # Parameter
0–3 Memory ID
4–7 Configuration block address

Response: The target (MCU flashloader) returns a GenericResponse packet with a

status code either set to kStatus_Success upon successful execution of the command, or
set to an appropriate error code.

Host Target
ConfigureMemory, memoryID=0x9, configBlockAddr=0x2000[5a a4 0c 00 39 97 11 00 00 02 09 00 00 00 00 20 00 00

ACK:5a a1

Process Command

GenericResponse5a a40c00c1d5a000 00 02 00 00 00 00 11 000000

ACK:5a a1

Figure 16. Configure memory

4.15 ReceiveSBFile command

The ReceiveSBFile command starts the transfer of an SB file to the target. The command
only specifies the size in bytes of the SB file that is sent in the data phase. The SB file is
processed as it is received by the flashloader.

Table 41. Parameters for ReceiveSBFile command

Byte # Parameter
0-3 Byte count

Data Phase: The ReceiveSBFile command has a data phase. The host sends data
packets until the number of bytes of data specified in the byteCount parameter of the
ReceiveSBFile command are received by the target.
Response: The target returns a GenericResponse packet with a status code set to the
kStatus_Success upon successful execution of the command, or set to an appropriate
error code.

4.16 GenerateKeyBlob command

The GenerateKeyBlob command has two steps. The first step starts the transfer of
the data encryption key (DEK) to the target. While the second step tells bootloader to
generate the key blob, and then starts the transfer of the key blob from the target.

User guide Rev. 13 — 30 September 2022

32 / 87
NXP Semiconductors
MCUFLSHLDRRM
MCU Flashloader Reference Manual

Table 42. Parameters for GenerateKeyBlob Command

Byte # Parameter Description
0-3 Key selection The blob key encryption
key(BKEK) selected to wrap
the blob key(BK)
• 0 | 1: OTPMK(default)
• 2: ZMK from SNVS
• 3: CMK from SNVS.
4-7 Key length The byte count of DEK
8-11 Operation step The step of the GenerateKey
Blob command
0: sending DEK to the target
1: let the target to generate the
key blob, and receive it from
the target

Note:
• Not all targets support selecting ZMK or CMK as the BKEK.
• The GenerateKeyBlob must start with “Operation phase = 0”, and end with “Operation
phase = 1”. The behavior is unpredictable for any other sequence.
Data Phase The GenerateKeyBlob command has a data phase.
At the first step (Operation phase = 0), the host sends data packets until the number of
bytes of DEK specified in the “Key length” parameter of the GenerateKeyBlob command
are received by the target.
At the second step (Operation phase = 1), the host pulls data packets until the
number of bytes of data specified in the “Blob byte count” parameter of the
GenerateKeyBlobResponse.
Response The target returns two type of response packet for each steps.
At the first step, the target returns a GenericResponse packet with a status code.
At the second step, the target returns a GenerateKeyBlobResponse packet with a status
code and the byte count of the key blob.
At the end of the data phase for each steps, the target returns a GenericResponse
packet in response to the result of the data phase.

Host Target Host Target

GenerateKeyBlob:step 0, keyByteCount=0x105a a4 10 00 d8 df 13 01 00 03 00 00 00 00 10 00 00 00 00 00 00 00 GenerateKeyBlob:step 1, keyByteCount=0x105a a4 10 00 2e d2 13 00 00 03 00 00 00 00 48 00 00 00 01 00 00 00

ACK:5a a1 ACK:5a a1
Process Command
Process Command

GenericResponse5a a4 0c 00 a9 38 a0 00 00 02 00 00 00 00 13 00 00 00 GenerateKeyBlobResponse5a a4 0c 00 0b b9 b3 01 00 02 00 00 00 00 48 00 00 00

ACK:5a a1 ACK:5a a1

Data Packet5a a5 10 00 25 84 00 11 22 33 44 55 66 77 88 99 aa bb cc dd ee ff
Process Data

Process Data
Data Packet5a a5xx xx xx xx xx xx xx xx xx xx xx xx xx xx xx ……

ACK:5a a1 ACK:5a a1

GenericResponse5a a4 0c 00 a9 38 a0 00 00 02 00 00 00 00 13 00 00 00 GenericResponse5a a4 0c 00 a9 38 a0 00 00 02 00 00 00 00 13 00 00 00

ACK:5a a1 ACK:5a a1

Figure 17. GenerateKeyBlob command

User guide Rev. 13 — 30 September 2022

33 / 87
NXP Semiconductors
MCUFLSHLDRRM
MCU Flashloader Reference Manual

5 Supported peripherals

5.1 Introduction
This section describes the peripherals supported by the MCU flashloader.

5.2 UART peripheral

The MCU flashloader integrates an autobaud detection algorithm for the UART
peripheral, thereby providing flexible baud rate choices.
Autobaud feature: If UARTn is used to connect to the flashloader, then the UARTn_RX
pin must be kept high and not left floating during the detection phase in order to comply
with the autobaud detection algorithm. After the flashloader detects the ping packet
(0x5A 0xA6) on UARTn_RX, the flashloader firmware executes the autobaud sequence.
If the baudrate is successfully detected, then the flashloader sends a ping packet
response [(0x5A 0xA7), protocol version (4 bytes), protocol version options (2 bytes),
and crc16 (2 bytes)] at the detected baudrate. The MCU flashloader then enters a loop,
waiting for flashloader commands via the UART peripheral.
Note: The data bytes of the ping packet must be sent continuously (with no more than
80 ms between bytes) in a fixed UART transmission mode (8-bit data, no parity bit, and
1 stop bit). If the bytes of the ping packet are sent one-by-one with more than an 80 ms
delay between them, then the autobaud detection algorithm may calculate an incorrect
baud rate.
Supported baud rates: The baud rate is closely related to the MCU core and system
clock frequencies. Typical baud rates supported are 9600, 19200, 38400, and 57600.
Packet transfer: After autobaud detection succeeds, flashloader communications can
take place over the UART peripheral. The following flow charts show:
• How the host detects an ACK from the target
• How the host detects a ping response from the target
• How the host detects a command response from the target

Figure 18. Host reads an ACK from target via UART

User guide Rev. 13 — 30 September 2022

34 / 87
NXP Semiconductors
MCUFLSHLDRRM
MCU Flashloader Reference Manual

Figure 19. Host reads a ping response from target via UART

Figure 20. Host reads a command response from target via UART

5.3 USB HID peripheral

The MCU flashloader supports loading data into flash via the USB peripheral. The target
is implemented as a USB HID class.
USB HID does not use framing packets. Instead, the packetization inherent in the USB
protocol itself is used. The ability for the device to NAK Out transfers (until they can
be received) provides the required flow control. The built-in CRC of each USB packet
provides the required error detection.

5.3.1 Device descriptor

The MCU Flashloader configures the default USB VID/PID/Strings as shown below:
Default VID/PID:

User guide Rev. 13 — 30 September 2022

35 / 87
NXP Semiconductors
MCUFLSHLDRRM
MCU Flashloader Reference Manual

• For legacy FSL device

– VID = 0x15A2
– PID = 0x0073
• For NXP device
– VID = 0x1FC9
– PID = 0x007F
Default Strings:
• For legacy FSL device
– Manufacturer [1] = "Freescale Semiconductor Inc."
– Product [2] = "Kinetis bootloader"
• For NXP device
– Manufacturer [1] = "NXP Semiconductor Inc."
– Product [2] = "Kinetis bootloader"

5.3.2 Endpoints
The HID peripheral uses 3 endpoints:
• Control (0)
• Interrupt IN (1)
• Interrupt OUT (2)
The Interrupt OUT endpoint is optional for HID class devices, but the MCU flashloader
uses it as a pipe, where the firmware can NAK send requests from the USB host.

5.3.3 HID reports

There are 4 HID reports defined and used by the flashloader USB HID peripheral. The
report ID determines the direction and type of packet sent in the report. Otherwise, the
contents of all reports are the same.

Table 43. HID reports

Report ID Packet type Direction
1 Command OUT
2 Data OUT
3 Command IN
4 Data IN

For all reports, these properties apply:

Table 44. Report properties

Usage Min 1
Usage Max 1
Logical Min 0
Logical Max 255
Report Size 8
Report Count 34

User guide Rev. 13 — 30 September 2022

36 / 87
NXP Semiconductors
MCUFLSHLDRRM
MCU Flashloader Reference Manual

Each report has a maximum size of 34 bytes. This is derived from the minimum
flashloader packet size of 32 bytes, plus a 2-byte report header that indicates the length
(in bytes) of the packet sent in the report.
Note: In the future, the maximum report size may be increased, to support transfers of
larger packets. Alternatively, additional reports may be added with larger maximum sizes.
The actual data sent in all of the reports looks like:

Table 45. Report data

0 Report ID
1 Packet Length LSB
2 Packet Length MSB
3 Packet[0]
4 Packet[1]
5 Packet[2]
...
N+3-1 Packet[N-1]

This data includes the Report ID, which is required if more than one report is defined in
the HID report descriptor. The actual data sent and received has a maximum length of
35 bytes. The Packet Length header is written in little-endian format, and it is set to the
size (in bytes) of the packet sent in the report. This size does not include the Report ID or
the Packet Length header itself. During a data phase, a packet size of 0 indicates a data
phase abort request from the receiver.

6 External memory support

6.1 Introduction

This section describes the external memory devices supported by the MCU flashloader.
To use an external memory device correctly, the device must be enabled with the
corresponding configuration profile. If the external memory device is not enabled, then it
cannot be accessed by the flashloader. The MCU flashloader enables specific external
memory devices using memory identifiers, as shown below.

Table 46. Memory ID for external memory devices

Memory identifier External memory device
0x01 Serial NOR over QuadSPI module
0x08 Parallel NOR over SEMC module
0x09 Serial NOR over FlexSPI module
0x0a Serial NOR over SPIFI
0x100 SLC raw NAND over SEMC module
0x101 Serial NAND over FlexSPI module
0x110 Serial NOR/EEPROM over LPSPI module
0x111 I2C NOR/EEPROM memory

User guide Rev. 13 — 30 September 2022

37 / 87
NXP Semiconductors
MCUFLSHLDRRM
MCU Flashloader Reference Manual

Table 46. Memory ID for external memory devices...continued

Memory identifier External memory device
0x120 SD over uSDHC
0x121 eMMC over uSDHC

6.2 Serial NOR Flash through FlexSPI

The MCU Flashloader supports read, write, and erase of external Serial NOR Flash
devices via the FlexSPI Module. Before accessing Serial NOR Flash devices, the
FlexSPI module must be configured properly using a simplified FlexSPI NOR Config
option block or a complete 512-byte FlexSPI NOR configuration block. The flashloader
can generate the 512-byte FlexSPI NOR configuration block based on the simplified
Flash Configuration option block for most Serial NOR Flash devices in the market. To
protect Intellectual Property on external Serial NOR Flash, the Flashloader also supports
image encryption and programming using OTPMK/SNVS keys if the chip includes
the BEE or OTFAD module. See the Security Utilities and Section 6.2.3 chapters for
additional information.

6.2.1 FlexSPI NOR configuration block

Table 47. Memory ID for external memory devices

Name Offset Size (bytes) Description
Tag 0x000 4 0x42464346,
ascii:”FCFB”
Version 0x004 4 0x56010000
[07:00] bugfix
[15:08] minor
[23:16] major = 1
[31:24] ascii ‘V’
- 0x008 4 Reserved
readSampleClkSrc 0x00c 1 0 – Internal loopback
1 – loopback from DQS
pad
3 – Flash provided
DQS
csHoldTime 0x00d 1 Serial Flash CS Hold
Time
Recommend default
value is 0x03
csSetupTime 0x00e 1 Serial Flash CS Setup
Time
Recommend default
value is 0x03

User guide Rev. 13 — 30 September 2022

38 / 87
NXP Semiconductors
MCUFLSHLDRRM
MCU Flashloader Reference Manual

Table 47. Memory ID for external memory devices...continued

Name Offset Size (bytes) Description
columnAdressWidth 0x00f 1 3 – For HyperFlash/
HyperRAM
12/13 – For Serial
NAND, see datasheet
to find correct value
0 – Other devices
deviceModeCfgEnable 0x010 1 Device Mode
Configuration Enable
feature
0 – Disabled
1 – Enabled
deviceModeType 0x011 1 Specify the
Configuration
command type
0 - Generic Command
1 - Quad Enable
2 - SPI to OPI
Others - Reserved
waitTimeCfg 0x012 2 Wait time for all
Commands configuration
commands, unit:
100us.
0 - Use read status
command to determine
the busy status
for configuration
commands
Others - Delay "wait
TimeCfgCommads" *
100us for configuration
commands
deviceModeSeq 0x014 4 Sequence parameter
for device mode
configuration
[7:0] LUT sequence
number
[15:8] LUT sequence
index for this sequence
[31:16] Reserved for
future use
deviceModeArg 0x018 4 Device Mode
argument, effective
only when deviceMode
CfgEnable = 1
configCmdEnable 0x01c 1 Config Command
Enable feature
0 – Disabled
1 – Enabled

User guide Rev. 13 — 30 September 2022

39 / 87
NXP Semiconductors
MCUFLSHLDRRM
MCU Flashloader Reference Manual

Table 47. Memory ID for external memory devices...continued

Name Offset Size (bytes) Description
configModeType 0x01d 3 Configure mode type,
the same definition as
"deviceModeType"
configCmdSeqs 0x020 12 Sequences for Config
Command, allow 4
separate configuration
command sequences
- 0x02c 4 Reserved
cfgCmdArgs 0x030 12 Arguments for each
separate configuration
command sequence
- 0x03c 4 Reserved
controllerMiscOption 0x040 4 Bit0 – Enable
differential clock
Bit2 – Enable Parallel
Mode
Bit3 – Enable Word
Addressable
Bit4 – Enable Safe
Config Freq
Bit5 – Enable Pad
Setting Override
Bit6 – Enable DDR
Mode
Others - Reserved
deviceType 0x044 1 1 - Serial NOR
2 - Serial NAND
sflashPadType 0x045 1 1 – Single pad
2 – Dual pads
4 – Quad pads
8 – Octal pads
Others - Invalid value
serialClkFreq 0x046 1 Device specific value,
check System Boot
chapter in the SoC RM
for more details
lutCustomSeqEnable 0x047 1 0 - Use pre-defined
LUT sequence index
and number
1 - Use LUT sequence
parameters provided in
this block
Reserved 0x048 8 Reserved
sflashA1Size 0x050 4 For SPI NOR, need to
fill with actual size
For SPI NAND, need to
fill with actual size * 2

User guide Rev. 13 — 30 September 2022

40 / 87
NXP Semiconductors
MCUFLSHLDRRM
MCU Flashloader Reference Manual

Table 47. Memory ID for external memory devices...continued

Name Offset Size (bytes) Description
sflashA2Size 0x054 4 For SPI NOR, need to
fill with actual size
For SPI NAND, need to
fill with actual size * 2
sflashB1Size 0x058 4 For SPI NOR, need to
fill with actual size
For SPI NAND, need to
fill with actual size * 2
sflashB2Size 0x05c 4 For SPI NOR, need to
fill with actual size
For SPI NAND, need to
fill with actual size * 2
csPadSettingOverride 0x060 4 Set to 0 if it is not
supported
sclkPadSetting 0x064 4 Set to 0 if it is not
Override supported
dataPadSetting 0x068 4 Set to 0 if it is not
Override supported
dqsPadSetting 0x06c 4 Set to 0 if it is not
Override supported
timeoutInMs 0x070 4 Maximum wait time
during read/write
Not used in ROM
commandInterval 0x074 4 Unit: ns
Currently, it is used
for SPI NAND at high
working frequency
dataValidTime 0x078 4 Time from clock edge
to data valid edge, unit
ns
This field is used when
the FlexSPI Root clock
is less than 100MHz
and the read sample
clock source is device
provided DQS signal
without CK2 support
[31:16] data valid time
for DLLB in terms of
0.1ns
[15:0] data valid time
for DLLA in terms of
0.1ns
busyOffset 0x07c 2 busy bit offset, valid
range :0-31

User guide Rev. 13 — 30 September 2022

41 / 87
NXP Semiconductors
MCUFLSHLDRRM
MCU Flashloader Reference Manual

Table 47. Memory ID for external memory devices...continued

Name Offset Size (bytes) Description
busyBitPolarity 0x07e 2 0 – busy bit is 1 if
device is busy
1 – busy bit is 0 if
device is busy
lookupTable 0x080 256 Lookup table
lutCustomSeq 0x180 48 Customized LUT
sequence, see below
table for details
- 0x1b0 16 Reserved
pageSize 0x1c0 4 Flash Page size
sectorSize 0x1c4 4 Flash Sector Size
ipCmdSerialClkFreq 0x1c8 1 IP Command Clock
Frequency, the same
definition as "serialClk
Freq"
isUniformBlockSize 0x1c9 1 Sector / Block size is
identical or not
- 0x1ca 2 -
serialNorType 0x1cc 1 Serial NOR Flash
Type:
0 - Extended SPI
1 - HyperBus
2 - Octal DDR
needExitNoCmdMode 0x1cd 1 Reserved, set to 0
halfClkForNonRead 0x1ce 1 Divide the clock for
Cmd SDR command by 2
Need to set for the
device that only
supports DDR read,
other commands are
SDR commands
needrestorNoCmd 0x1cf 1 Reserved, set 0
Mode
blockSize 0x1d0 4 Flash Block size
- 0x1d4 44 Reserved

Note: To customize the LUT sequence for some specific device, users need to enable
“lutCustomSeqEnable” and fill in corresponding “lutCustomSeq” field specified by the
command index below.
For Serial (SPI) NOR, the pre-defined LUT index is as following:

Table 48. Lookup table index pre-assignment for FlexSPI NOR

Name Index in lookup table Description
Read 0 Read command Sequence
ReadStatus 1 Read Status command

User guide Rev. 13 — 30 September 2022

42 / 87
NXP Semiconductors
MCUFLSHLDRRM
MCU Flashloader Reference Manual

Table 48. Lookup table index pre-assignment for FlexSPI NOR...continued

Name Index in lookup table Description
ReadStatusXpi 2 Read Status command under
OPI mode
WriteEnable 3 Write Enable command
sequence
WriteEnableXpi 4 Write Enable command under
OPI mode
EraseSector 5 Erase Sector Command
EraseBlock 8 Erase Block Command
PageProgram 9 Page Program Command
ChipErase 11 Full Chip Erase
ExitNoCmd 15 Exit No Command Mode as
needed
Reserved 6,7,10,12,13,14 All reserved indexes can be
freely used for other purpose

6.2.2 FlexSPI NOR configuration option block

The FlexSPI NOR Configuration option block is organized by 4-bit unit. It is expandable,
and current definition of the block is as shown in the following table.
The Flashloader detects FNORCB using the read SFDP command supported by most
flash devices that are JESD216(A/B)- compliant. However, JESD216A/B only defines
the dummy cycles for Quad SDR reads. In order to get the dummy cycles for DDR/DTR
read mode, the flashloader supports auto probing by writing test patterns to offset 0x200
on the external memory devices. To get optimal timing, the readSampleClkSrc is set to
1 for Flash devices that do not support external provided DQS pad input. It is set to 3
for flash devices that do support external provided DQS pad input, such as HyperFlash.
FlexSPI_DQS pad is not used for any other purpose.

User guide Rev. 13 — 30 September 2022

43 / 87
NXP Semiconductors
MCUFLSHLDRRM
MCU Flashloader Reference Manual

Table 49. FlexSPI NOR configuration option block

OffsetField Description
0 Option0
TAG Option Device Query CMD Quad Misc Max
[31:28] size detectionCMD Pad(s) Enable [7:4] Freq
[27:24] type Pad(s) [15:12] Type [3:0]
[23:20] [19:16] [11:8]
0x0C Size in 0- 0-1 0-1 1 - QE 3 - Byte Device-
bytes = QuadSPI 2 - 4 2-4 bit is order is specific
(Option SDR 3-8 3-8 bit 6 in swapped , see
Size + 1- Status under System
1) * 4 QuadSPI Reg1 OPI Boot
DDR 2 - QE DDR chapter
2- bit is mode in SoC
Hyper bit 1 in 5- RM for
FLASH Status Internal more
1V8 Reg2 loopback details
3- 3 - QE 6 - SPI
Hyper bit is in mode
FLASH bit7 in
3V Status
4- Reg2
MXIC 4 - QE
OPI bit is
DDR bit 1 in
6- Status
Micron Reg2,
OPI enable
DDR command
is 0x31
8-
Adesto
OPI
DDR

4 Option1
Optional flash_connecti drive_strength Reserved [15:8] Dummy Cycle
on[31:28] [27:24] [7:0]
0 - PortA The drive strength dqs_pinmux_ 0 - Use auto-
1 - Parallel Mode of FlexSPI pad. group [23:20] probing dummy
2 - PORTB See IOMUXC 0 - primary group cycle
chapter in SoC 1 - secondary Others - dummy
RM for more group cycles provided in
details. data sheet
pinmux_group
[19:16]
0 - primary group
1 - secondary
group

• Tag - Fixed as 0x0C.

• Option Size - Provide scalability for future use, the option block size equals to (Option
size + 1) * 4 bytes.
• Device Detection type - Software defined device types used for config block auto
detection.
MCUFLSHLDRRM All information provided in this document is subject to legal disclaimers. © 2022 NXP B.V. All rights reserved.

User guide Rev. 13 — 30 September 2022

44 / 87
NXP Semiconductors
MCUFLSHLDRRM
MCU Flashloader Reference Manual

• Query Command Pad(s) - Command pads (1/4/8) for the SFDP command.
• CMD pad(s) - Commands pads for the Flash device (1/4/8). For devices that use 1-1-4,
1-4-4, 1-1-8, or 1-8-8 mode, CMD pad(s) value is always 0x0. For devices that only
support 4-4-4 mode for high performance, CMD pads value is 2. For devices that only
support 8-8-8 mode for high performance, CMD pads value is 3.
• Quad Enable Type - Specify the Quad Enable sequence. Only applicable for devices
that are JESD216-compliant. This field is ignored if device supports JESD216A or later
version.
• Misc - Specify miscellaneous mode for selected flash type.
• Max Frequency - The maximum frequency for the specified flash device.
• Dummy Cycle - User provided dummy cycles for SDR/DDR read command.

[Link] Typical use cases for FlexSPI NOR configuration block

• QuadSPI NOR - Quad SDR Read: option0 = 0xc0000006 (100 MHz).

• QuadSPI NOR - Quad DDR Read: option0 = 0xc0100003 (60 MHz).
• HyperFlash 1V8: option0 = 0xc0233007 (133 MHz).
• HyperFlash 3V0: option0 = 0xc0333006 (100 MHz).
• MXIC OPI DDR: option0 = 0xc0403006 (100 MHz), for devices where data order is
consistent between SDR mode and DDR mode, option0 = 0xc0403036, for device that
the data order is inconsistent between SDR mode and DDR mode.
• Micron Octal DDR: option0=0xc0600006 (100 MHz).
• Micron OPI DDR: option0=0xc0603006 (100 MHz), SPI->OPI DDR.
• Micron OPI DDR (DDR read enabled by default): option0=0xc0633006(100 MHz).
• Adesto OPI DDR: option0=0xc0803007(133 MHz).

[Link] Programming Serial NOR Flash device using FlexSPI NOR configuration option
block

The MCU Flashloader supports generating complete FNORCB using the configure-
memory command. It also supports programming the generated FNORCB to the correct
offset (0x0/0x400, depending on the MCU model) of the flash memory using a specific
option "0xF000000F". An example for configuring and accessing HyperFlash (assuming it
is a blank HyperFlash device) is mentioned below.

blhost -u -- fill-memory 0x2000 0x04 0xc0233007 (write option block to SRAM

address 0x2000)
blhost -u -- configure-memory 0x09 0x2000 (configure HyperFLASH using option
block)
blhost -u -- fill-memory 0x3000 0x04 0xf000000f (write specific option to SRAM
address 0x3000)
blhost -u -- configure-memory 0x09 0x3000 (program FNORCB to the correct offset
of HyperFLASH)
blhost -u -- write-memory <addr> [Link]

[Link] Select the FLEXSPI instance

The MCU Flashloader supports selecting the FLEXSPI instance via 0xcf90000<x> on the
SoC which supports multiple FLEXSPI instances, here the x is the index of the FLEXSPI
instance.
Take RT1170 as an example, below is the sequence to select the FLEXSPI instance via
the Flashloader:
MCUFLSHLDRRM All information provided in this document is subject to legal disclaimers. © 2022 NXP B.V. All rights reserved.

User guide Rev. 13 — 30 September 2022

45 / 87
NXP Semiconductors
MCUFLSHLDRRM
MCU Flashloader Reference Manual

blhost -u -- fill-memory 0x2000 4 0xcf900001

blhost -u -- configure-memory 9 0x2000

[Link] FlexSPI Instance Selection using FlexSPI NOR configuration option block

For certain MCU parts, multiple instances are available. The MCU Flashloader supports
instance selection via the FlexSPI NOR configuration option block.

Table 50. FlexSPI NOR Configuration option block option

Offset Field Description
0 Option0 TAG[31:20] Reserved[19:4] Instance[3:0]
0xCF9 Set 0 1 - Instance 1 selected
2 - Instance 2 selected
Otherwise - Undefined

Below is an example of instance selection.

blhost -u -- fill-memory 0x20000000 4 0xcf900002 (Instance 2 to be chosen)
blhost -u -- configure-memory 9 0x20000000 (Issue the option)
If an instance selection option is issued, it is highly recommended to perform a thorough
FlexSPI NOR configuration just following the selection.
Note: This section applies to RT1176 Flashloader only.

6.2.3 FlexSPI NOR on-chip OTFAD pre-encryption option block

OTFAD module performs in-place decryption of a pre-encrypted boot image in a serial

NOR flash via FlexSPI. When an SNVS key is intended to be the OTFAD KEK, the pre-
encryption has to be done on-chip and the flow is implemented in the MCU flashloader
as a reference. Prior to the on-chip encryption, the On-chip OTFAD Pre-encryption option
block is required for the flashloader.
The definition of the option block is shown in the following table.

Table 51. FlexSPI NOR configuration option block

Offset Field Description
0 Option
TAG Reserved SNVS High 128b Context Keyblob
[31:28] [27:16] Selected [15:12] Count Offset in
[11:8] 256k [7:0]
0x0E 0 – SNVS[127:0] 1,2,3,4 – OTFAD
1 – SNVS[255:128] OTFAD keyblob
Else - Forbidden context storage
number offset in
Else - 256k
Forbidden

4 Context 1 Start Bus address of the mandatory first context’s start. For example,
Addr 0x60001000
8 Context 1 End Bus address of the mandatory first context’s end. For example,
Addr 0x60001fff

User guide Rev. 13 — 30 September 2022

46 / 87
NXP Semiconductors
MCUFLSHLDRRM
MCU Flashloader Reference Manual

Table 51. FlexSPI NOR configuration option block...continued

Offset Field Description
12 Context 2 Start Bus address of the optional 2nd context’s start. For example,
Addr 0x60002000
16 Context 2 End Bus address of the optional 2nd context’s end. For example,
Addr 0x60002fff
20 Context 3 Start Bus address of the optional 3rd context’s start. For example,
Addr 0x60003000
24 Context 3 End Bus address of the optional 3rd context’s end. For example, 0x60003fff
Addr
28 Context 4 Start Bus address of the optional 4th context’s start. For example,
Addr 0x60004000
32 Context 4 End Bus address of the optional 4th context’s end. For example, 0x60007fff
Addr

• Tag - Fixed as 0x0E.

• SNVS High 128b Selected – Decides which part of SNVS is selected as the KEK.
0 stands for SNVS[127:0] and 1 for SNVS[255:128]. The given value should be
equivalent to the eFuse OTFAD_KEY_SEL
• Context Count – Number of OTFAD contexts following the option block. There should
be 1 to 4 contexts
• Keyblob Offset in 256k – Specify the OTFAD keyblob storage offset in 256k from the
base address of FlexSPI NOR flash. Typically, 0 is used with the pre-encryption of
a normal boot image, and a non-zero value with a redundant boot image. The given
value should be equivalent to the eFuse XSPI_FLASH_SEC_IMG_OFFSET_VALUE
• Context # Start Addr – AHB bus address of the corresponding context’s start. The
address should be 1k-aligned
• Context # End Addr – AHB bus address of the corresponding context’s end. The
address plus 1 should be 1k-aligned. There is at least one context so start and end
addresses of context 1 must exist. The segment specified in a context should be within
the FlexSPI NOR flash’s address space, and should not overlap another segment or
the keyblob
Note: This section is applicable to RT1011 Flashloader only.

[Link] On-chip pre-encryption using the option block

An example of configuring and accessing a blank serial NOR flash is given below. Prior
to the example, the flash should have been configured as stated in Section 6.2.1

blhost -u -- fill-memory 0x3000 0x04 0xe0001100 (context count is 1)

blhost -u -- fill-memory 0x3004 4 0x60001000 (context 1 start addr, 2 does not
exist)
blhost -u -- fill-memory 0x3008 4 0x6000ffff (context 1 end addr)
blhost -u -- configure-memory 9 0x3000 (configure the flash)

Once configuration is complete, the flashloader generates an OTFAD keyblob, encrypts it

with the KEK, and programs it to the correct location of a serial NOR flash (typically offset
0x0 from the base address of FlexSPI NOR flash). For confidentiality, the AES-CTR
keys and counters in the keyblob is randomly generated with TRNG instead of specified
manually.

User guide Rev. 13 — 30 September 2022

47 / 87
NXP Semiconductors
MCUFLSHLDRRM
MCU Flashloader Reference Manual

blhost -u -- write-memory 0x60001000 [Link] (plaintext image

encrypted and programmed)
Data to be written to the address space 0x60001000~0x6000ffff is automatically
encrypted before being programmed.
Below is another example where the Keyblob Offset in 256k field is non-zero.

blhost -u -- fill-memory 0x3000 0x04 0xe0001101 (256k offset)

blhost -u -- fill-memory 0x3004 4 0x60001000 (no offset on context addresses)
blhost -u -- fill-memory 0x3008 4 0x6000ffff
blhost -u -- configure-memory 9 0x3000

The OTFAD keyblob is now programmed with an extra 256k (0x40000) offset. It is
necessary that the FNORCB be programmed with the identical offset, so it is highly
recommended that the FNORCB be embedded in [Link] at the correct offset.
blhost -u -- write-memory 0x60041000 [Link] (also be
programmed with the identical offset)
Note: SNVS keys are constantly 0 if HAB is open. To obtain full confidentiality, the flow
above should be performed on a HAB-closed part with a signed flashloader. In this case,
the bootable [Link] should also be pre-signed.

6.3 Serial NAND Flash through FlexSPI

Some MCUs support booting from Serial NAND Flash devices via BootROM. The MCU
Flashloader works as a companion to program the boot image into the Serial NAND. The
Flashloader supports generating corresponding boot data structures like the FlexSPI
NAND Firmware Configuration Block (FCB) and Discovered Bad Block Table (DBBT)
required by the BootROM. See the System Boot Chapter in the device reference manual
for details regarding FlexSPI NAND boot flow. This chapter only focuses on generating
FCB, DBBT, and programming FCB, DBBT, and boot images using Flashloader.
The Flashloader can configure Serial NAND devices using FCB, or a simplified FCB
option block. The Flashloader can generate a complete FCB based on the simplified FCB
option block.

6.3.1 FlexSPI NAND Firmware configuration block (FCB)

FCB is a 1024-byte data structure that contains the optimum NAND timings, page
address of Discovered Bad Block Table (DBBT) Search Area firmware info (including the
start page address and page count), and more.

Table 52. FlexSPI NAND Firmware configuration block Definition

Name Offset Size (bytes) Description
crcChecksum 0x000 4 Checksum
fingerprint 0x004 4 0x4E46_4342
ASCII: “NFCB”
version 0x008 4 0x0000_0001
DBBTSearch 0x00c 4 Start Page address for bad block table search
StartPage area

User guide Rev. 13 — 30 September 2022

48 / 87
NXP Semiconductors
MCUFLSHLDRRM
MCU Flashloader Reference Manual

Table 52. FlexSPI NAND Firmware configuration block Definition...continued

Name Offset Size (bytes) Description
searchStride 0x010 2 Search stride for DBBT and FCB search
Not used by ROM, max value is defined in
Fusemap. See the Fusemap in SoC RM for
more details.
searchCount 0x012 2 Copies on DBBT and FCB
Not used by ROM, max value is defined in
Fusemap. See the Fusemap in SoC RM for
more details.
firmwareCopies 0x014 4 Firmware copies
Valid range 1-8
Reserved 0x018 40 Reserved for future use
Must be set to 0
firmwareInfo 0x40 64 This table consists of (up to 8 entries):
Table
Field Size(Bytes) Description
StartPage 4 Start page of
this firmware
pageCount 4 Pages in this
firmware

Reserved 0x080 128 Reserved

Must be set to 0
spiNandConfig 0x100 512 Serial NAND configuration block over FlexSPI
Block
Reserved 0x300 256 Reserved
Must be set to 0

6.3.2 FlexSPI NAND configuration block

The optimum Serial NAND parameters are defined in FlexSPI NAND configuration block
(FNANDCB). FNANDCB is a 512-byte data structure as shown in the following table.

Table 53. FlexSPI NAND configuration block Definition

Name Offset Size (bytes) Description
memCfg 0x00 480 The same definition
as the first 480 bytes
in FlexSPI NOR
configuration block
pageDataSize 0x1c0 480 Page size in bytes. In
general, it is 2048 or
4096
pageTotalSize 0x1c4 4 It equals to 2 ^ width of
column address
pagesPerBlock 0x1c8 4 Pages per Block

User guide Rev. 13 — 30 September 2022

49 / 87
NXP Semiconductors
MCUFLSHLDRRM
MCU Flashloader Reference Manual

Table 53. FlexSPI NAND configuration block Definition...continued

Name Offset Size (bytes) Description
bypassReadStatus 0x1cc 1 0 - Perform Read
Status
1 - Bypass Read
Status
bypassEccRead 0x1cd 1 0 - Perform ECC Read
1 - Bypass ECC Read
hasMultiPlanes 0x1ce 1 0 - Device has only 1
plane
1 - Device has 2
planes
- 0x1cf 1 Reserved
eccCheckCustom 0x1d0 1 0 - Use the commonly
Enable used ECC check
command and masks
1 - Use ECC check
related masks provide
in this configuration
block
ipCmdSerialClkFreq 0x1d1 1 Chip specific value, set
to 0
readPageTimeUs 0x1d2 2 Wait time during page
read, only effective if
"bypassReadStatus" is
set to 1
eccStatusMask 0x1d4 4 ECC status mask, only
effective if "eccCheck
CustomEnable" is set
to 1
eccFailureMask 0x1d8 4 ECC Check Failure
mask, only effective
if "eccCheckCustom
Enable" is set to 1
blocksPerDevice 0x1dc 4 Blocks in a Serial
NAND device
- 0x1e0 32 Reserved

Note: For Serial (SPI) NAND, the pre-defined LUT index is as follows:

Table 54. Lookup Table index pre-assignment for FlexSPI

Command Index Name Index in lookup table Description
0 ReadFromCache 0 Read From cache
1 ReadStatus 1 Read Status
2 WriteEnable 3 Write Enable
3 BlockErase 5 Erase block
4 ProgramLoad 9 Program Load
5 ReadPage 11 Read page to cache

User guide Rev. 13 — 30 September 2022

50 / 87
NXP Semiconductors
MCUFLSHLDRRM
MCU Flashloader Reference Manual

Table 54. Lookup Table index pre-assignment for FlexSPI...continued

Command Index Name Index in lookup table Description
6 ReadEccStatus 13 Read ECC Status
7 ProgramExecute 14 Program Execute
8 ReadFromCacheOdd 4 Read from Cache while
page in odd plane
9 ProgramLoadOdd 10 -
- Reserved 2, 6, 7, 8, 12, 15 All reserved indexes
can be freely used for
other purposes

6.3.3 FlexSPI NAND FCB option block

FlexSPI NAND FCB option block defines the major parameters required by FCB, such as
image info. The detailed configuration block definition is shown below.

Table 55. FlexSPI NAND FCB option block

Offset Field Size Description
0 option0 4
Offset Field Description
31:28 tag Fixed to 0x0C
27:24 searchCount Valid value:
1-4
23:20 searchStride 0 - 64 pages
1 - 128 pages
2 - 256 pages
3 - 32 pages
Note: This field is
aligned with Fuse
definition
19:12 Reserved -
11:8 addressType 0 - byte address
1 - block address
7:4 Reserved -
3:0 Option size Option size in
longword, Min size
is 3, Max size is 10

4 nandOption 4 Address of NAND option defined above

Addr

User guide Rev. 13 — 30 September 2022

51 / 87
NXP Semiconductors
MCUFLSHLDRRM
MCU Flashloader Reference Manual

Table 55. FlexSPI NAND FCB option block...continued

Offset Field Size Description
8 imageInfo 4-32 Image info is a map of below info, maximum entry size is 8

Field Size Description

blockCount 2 Maximum allowed
blocks for this
image
blockId 2 Start block index for
this image

Note:
• “searchCount” should match the one provisioned in eFUSE
• “searchStride” should match the one provisioned in eFUSE
• “addressType” specifies the address type for the start address of erase, write and read
operation in Flashloader
• “Option size” specifies the total size of the option block size in longwords
• “nandOptionAddr” specifies the address that stores FlexSPI NAND Configuration
Option
• “imageInfo” is an array that holds each image info used during boot. For example,
0x00040002 means the block Id is 4, maximum allowed block count is 2

6.3.4 FlexSPI NAND configuration option block

Currently, all Serial NAND devices in the market support the same commands. The
differences are the NAND size, page size, and more. This option block focuses on these
differences, and the detailed block definitions are shown below:

Table 56. FlexSPI NAND configuration option block

Offset Field Description
0 option 0
TAG Option Device Flash Has Pages Page Max
[31:28] size Type size multiplanes Per Size Freq
[27:24] [23:20] [19:16] [15:12] Block (Kbytes) [3:0]
[11:8] [7:4]
0x0c Size in 0- 0- 0 - 1 plane 0 - 64 2 - 2KB NAND
bytes = Quad 512Mb 1 - 2 planes 1 - 128 4 - 4KB Freq:
(Option 1- 1- 2 - 256 Device
Size + Octal 1Gb specific
3 - 32
1) * 4 2-
2Gb
4-
4Gb

User guide Rev. 13 — 30 September 2022

52 / 87
NXP Semiconductors
MCUFLSHLDRRM
MCU Flashloader Reference Manual

Table 56. FlexSPI NAND configuration option block...continued

Offset Field Description
4 option 1 This field is optional, it is effective if option size in option0 is greater than 0.

Flash_connecti Pinmux_ Reserved [23:8] Manufacturer

on [31:28] group [27:24] ID [7:0]
Actual
Manufacturer ID
provided in Serial
0 - Primary group NAND device
0 - PortA Reserved for
1 - Secondary datasheet. For
2 - PortB future use
group example, 0x2C is
the manufacture
ID assigned to
Micron.

6.3.5 Example usage with Flashloader

Flashloader can generate FCB and DBBT based on a specified FlexSPI NAND FCB
option block.
Assuming FCB parameters are:
• FCB and DBBT copies are 2.
• Firmware copies are 2.
• Firmware 0 starts at block 4, maximum block count is 2.
• Firmware 1 starts at block 8, maximum block count is 2.
Assuming Serial NAND parameters are:
• Flash size: 1 Gb
• Plane number:1
• Pages Per Block: 64
• Page Size: 2 KB
• Maximum Frequency: 80 MHz
Below are the example steps for generating FlexSPI NAND Configuration Option block.
Write FlexSPI NAND Configuration option block to SRAM:

blhost -u -- fill-memory 0x2030 0x4 0xc0010025

Write FlexSPI NAND FCB option block to SRAM:

blhost -u -- fill-memory 0x2000 0x4 0xc2000104

blhost -u -- fill-memory 0x2004 0x4 0x2030 // nandOptionAddr = 0x2030
blhost -u -- fill-memory 0x2008 0x4 0x00040002 // blockId = 4, blockCount = 2
blhost -u -- fill-memory 0x200c 0x4 0x00080002 // blockId = 8, blockCount = 2

Configure Serial NAND using FCB option and NAND option:

blhost -u -- configure-memory 0x101 0x2000

User guide Rev. 13 — 30 September 2022

53 / 87
NXP Semiconductors
MCUFLSHLDRRM
MCU Flashloader Reference Manual

Erase and Program image

blhost -u -- flash-erase-region 0x4 0x2 0x101 // Erase 2 blocks starting

from block 4
blhost -u -- write-memory 0x4 [Link] 0x101 // Program [Link] to block 4
blhost -u -- flash-erase-region 0x8 0x2 0x101 // Erase 2 blocks starting
from block 8
blhost -u -- write-memory 0x8 [Link] 0x101 // Program [Link] to block 8

6.4 SD/eMMC through uSDHC

Some MCUs supports booting from SD/eMMC devices via BootROM. The MCU
Flashloader supports flashing the boot image into the SD/eMMC devices. This section
explains the usage of SD/eMMC via Flashloader.

6.4.1 SD configuration block

The SD Card must be initialized before the Flashloader accesses SD memory. The SD
configuration block is a combination of several necessary SD configurations used by
Flashloader to initialize the card.
Table 6-10 lists the detailed description of each bits in the SD configuration block.

Table 57. SD configuration block Definition

Word index Bit field Name Description
Word0 [31:28] TAG SD configuration block
tag used to mark if the
block is valid or not
0xD: Valid block
Others: Invalid
[27:26] RSV 0x0
[25:24] PWR_DOWN_TIME SD power down delay
time before power up
the SD card
Only valid when PWR_
CYCLE_ENABLE is
enable
0: 20 ms
1: 10 ms
2: 5 ms
3: 2.5 ms
23 PWR_POLARITY SD power control
polarity
Only valid when PWR_
CYCLE_ENABLE is
enabled
0: Power down when
[Link] is set low
1: Power down when
[Link] is set
high
[22:21] RSV 0x0
MCUFLSHLDRRM All information provided in this document is subject to legal disclaimers. © 2022 NXP B.V. All rights reserved.

User guide Rev. 13 — 30 September 2022

54 / 87
NXP Semiconductors
MCUFLSHLDRRM
MCU Flashloader Reference Manual

Table 57. SD configuration block Definition...continued

20 PWR_UP_TIME SD power up delay
time to wait voltage
regulator output stable
Only valid when PWR_
CYCLE_ENABLE is
enabled
0: 5 ms
1: 2.5 ms
19 PWR_CYCLE_ Executes a power
ENABLE cycle before starting
the initialization
progress [1]
0: Disable for non-
UHSI timing [2]
Enable for UHSI timing
1: Enable
[18:15] RSV 0x0
[14:12] TIMING_INTERFACE SD speed timing
selection.
0: Normal/SDR12
1: High/SDR25
2: SDR50
3: SDR104
4: DDR50 (not support
yet)
5-7: Reserved
[11:9] RSV 0x0
8 BUS_WIDTH SD bus width
selection.
0: 1 bit
4-bit for UHSI timing
1: 4 bit
[7:0] RSV 0x0
Word1 [31:0] RSV 0x0

Note: Flashloader toggles the [Link] pin to execute the power cycle progress.
This needs board-level hardware support. If the hardware does not support controlling
SD power, the power cycle progress cannot fully reset the SD card.
Note: UHSI timing includes SDR50, SDR104, and DDR50.

6.4.2 Example usage with Flashloader

This section uses the SDR25 timing and 4-bit bus width as an example. To make sure
the SD card is reset before the initialization progress, it is suggested to enable the power
cycle. Choose the default settings of power cycle.
The hex of the SD configuration block is 0xD0082100.
• Write the configuration block to MCU internal RAM.
blhost -u –– fill-memory 0x20000000 0x4 0xD0082100
MCUFLSHLDRRM All information provided in this document is subject to legal disclaimers. © 2022 NXP B.V. All rights reserved.

User guide Rev. 13 — 30 September 2022

55 / 87
NXP Semiconductors
MCUFLSHLDRRM
MCU Flashloader Reference Manual

RAM address 0x20000000 is selected as an example. User can select any RAM
position which is available to use. The user can also select an address located at an
XIP external memory, such as Flex SPI NOR Flash.
• Execute the initialization progress using configure-memory command.
blhost -u –– configure-memory 0x120 0x20000000
0x120 is the memory ID of eMMC card device. If the eMMC card is initialized
successfully, then a “Success” message is received and SD memory is available to be
accessed by Flashloader. If an error occurred, see Chapter 8 Appendix A, "Status and
error codes". for debugging.
• After SD is initialized, the user can use get the property 25 command to check the SD
card capacity.
blhost -u –– get-property 25 0x120
• To program the boot image, the user needs to erase the SD card memory first, then
program the image.

blhost -u –– flash-erase-region 0x0 0x1000 0x120

blhost -u –– write-memory 0x400 C:\Image\[Link]
0x120

0x0 at the flash-erase-region command line and 0x400 at the write-memory command
line is the byte offset of the SD memory, not the sector offset. That means 4 K bytes
starting from the start address of SD memory are erased, then the boot image C:
\Image\[Link] is written to the space starting from SD second Block.
• To check if the boot image is programmed successfully, the user can read the data out.
blhost –u –– read-memory 0x400 0x1000 0x120

In most cases, the user does not need to read the data out to verify if the boot image is
written successfully or not. Flashloader guarantees this.

6.4.3 eMMC configuration block

Similar to the SD Card, eMMC also must be initialized before accessing it. The eMMC
configuration block is used to tell Flashloader how to initialize the eMMC device. To use
the fast boot feature offered by BootROM, eMMC also must be pre-configured. The fast
boot configuration is also included in the eMMC configuration block.
The below table lists the detailed description of each bits in the eMMC configuration
block.

Table 58. eMMC configuration block Definition

Word index Bit field Name Description
Word0 [31:28] TAG eMMC configuration
block tag used to mark
if the block is valid or
not
0xC: Valid block
Others: Invalid
27 RSV 0x0

User guide Rev. 13 — 30 September 2022

56 / 87
NXP Semiconductors
MCUFLSHLDRRM
MCU Flashloader Reference Manual

Table 58. eMMC configuration block Definition...continued

[26:24] PARTITION_ACCESS Select eMMC partition
which the Flashloader
write the image or data
to
0: User data area
1: Boot partition 1
2: Boot partition 2
3: RPMB
4: General Purpose
parition 1
5: General Purpose
parition 2
6: General Purpose
parition 3
7: General Purpose
parition 4
23 RSV 0x0
[22:20] BOOT_PARTITION_ Select the boot
ENABLE partition used for fast
boot
Only valid when
BOOT_CONFIG_
ENABLE is set
0: Not enabled
1: Boot partition 1
2: Boot partition 2
3-6: Reserved
7: User data area
[19:18] RSV 0x0
[17:16] BOOT_BUS_WIDTH Select the bus width
used for fast boot
0: x1(SDR),
x4(DDR)
1: x4(SDR,DDR)
2: x8(SDR,DDR)
3: Reserved
[15:12] TIMING_INTERFACE Select the bus timing
when Flashloader
accesses eMMC
memory
0: Normal
1: HS
2: HS200(Not support
yet)
3: HS400(Not support
yet)
4-15: Reserved

User guide Rev. 13 — 30 September 2022

57 / 87
NXP Semiconductors
MCUFLSHLDRRM
MCU Flashloader Reference Manual

Table 58. eMMC configuration block Definition...continued

[11:8] BUS_WIDTH Select the bus width
when Flashloader
accesses eMMC
memory
0: x1 SDR
1: x4 SDR
2: x8 SDR
3-4: Reserved
5: x4 DDR
6: x8 DDR
7-15: Reserved
[7:6] RSV 0x0
[5:4] BOOT_MODE 0: Normal
1: HS
2: DDR
3: Reserved
3 RESET_BOOT_BUS_ Configure eMMC
CONDITIONS behavior after exiting
fast boot
0: Reset to
x1,SDR,Normal
1: Retain boot config
2 BOOT_ACK Configure eMMC ACK
behavior at fast boot.
0: NO ACK
1: ACK
1 RSV 0x0
0 BOOT_CONFIG_ Determine if write fast
ENABLE boot configurations into
eMMC or not [2]
0: Boot configuration
will be ignored
1: Boot configuration
will be written into
device
Word1 [31:26] RSV 0x0
[25:24] PWR_DOWN_TIME eMMC power down
delay time before
power up the eMMC
card
Only valid when PWR_
CYCLE_ENABLE is
enabled
0: 20 ms
1: 10 ms
2: 5 ms
3: 2.5 ms

User guide Rev. 13 — 30 September 2022

58 / 87
NXP Semiconductors
MCUFLSHLDRRM
MCU Flashloader Reference Manual

Table 58. eMMC configuration block Definition...continued

23 PWR_POLARITY eMMC power control
polarity.
Only valid when PWR_
CYCLE_ENABLE is
enabled
0: Power down when
[Link] set low
1: Power down when
[Link] set high
[22:21] RSV 0x0
20 PWR_UP_TIME eMMC power up delay
time to wait voltage
regulator output stable
Only valid when PWR_
CYCLE_ENABLE is
enabled
0: 5 ms
1: 2.5 ms
19 PWR_CYCLE_ Execute a power cycle
ENABLE before start the SD
initialization progress
0: Disable
1: Enable
18 1V8_ENABLE Select if set uSDHC.
VSELECT pin
0: Not set vselect pin
1: Set vselect pin high
[17:0] RSV 0x0

Note: Fast boot configuration includes BOOT_PARTITION_ENABLE,

BOOT_BUS_WIDTH, BOOT_MODE, RESET_BOOT_BUS_CONDITIONS, and
BOOT_ACK.

6.4.4 Example usage with Flashloader

This section uses the 8-bit DDR mode as an example, and boot image is written to the
user data area. After writing the boot image, the user wants boot ROM to boot the image
via fast boot to decrease the boot time. Fast boot also uses the same mode (8-bit DDR
mode). ACK is enabled for fast boot.
The hex of the eMMC configuration block is 0xC0721625, 0x00000000
• Write the configuration block to MCU internal RAM.

blhost -u –– fill-memory 0x20000000 0x4 0xC0721625

blhost -u –– fill-memory 0x20000004 0x4 0x00000000

RAM address 0x20000000 is selected as an example. The user can select any RAM
position which is available to use. The user also can select an address located at an
XIP external memory, such as Flex SPI NOR Flash.
• Execute the initialization progress using configure-memory command.
blhost -u –– configure-memory 0x121 0x20000000
MCUFLSHLDRRM All information provided in this document is subject to legal disclaimers. © 2022 NXP B.V. All rights reserved.

User guide Rev. 13 — 30 September 2022

59 / 87
NXP Semiconductors
MCUFLSHLDRRM
MCU Flashloader Reference Manual

0x121 is the memory ID of eMMC card device. If the eMMC card is initialized
successfully, then a “Success” message is recieved. If an error occurred, see Chapter
9, "Appendix A: status and error codes" for debugging.
• After step 2, eMMC is available to access. The user can use get the property 25
command to check the eMMC card capacity. blhost -u –– get-property 25
0x121
• To program the boot image, the user needs to erase the eMMC card memory before
program the image.

blhost -u –– flash-erase-region 0x0 0x2000 0x121

blhost -u –– write-memory 0x400 C:\Image\[Link] 0x121

the address of eMMC memory in the command line is byte address, not sector
address. That means 8 K bytes starting from the start address of eMMC memory are
erased, then the boot image C:\Image\[Link] writes to eMMC 1st Block.
• To check if the boot image is programmed successfully, the user can read the data out.
blhost –u –– read-memory 0x200 0x2000 0x121

In most cases, the user does not need to read the data out to verify if the boot image is
written successfully or not. Flashloader guarantees this when the user gets a “Success”
status for write-memory command.
If user wants to switch to other partitions of the eMMC device, they need to re-configure
the eMMC devices two times.
• Select the Boot partition 1, bus width and speed timing are kept unchanged. Fast boot
configuration is not necessary if user does not want to update it.

blhost -u –– fill-memory 0x20000000 0x4 0xC1001600

blhost -u –– configure-memory 0x121 0x20000000
blhost -u –– flash-erase-region 0x0 0x1000 0x121
blhost -u –– write-memory 0x400 C:\Image\[Link]
0x121

6.5 Parallel NAND Flash through SEMC

Certain MCUs support booting from parallel NAND flash devices via BootROM. The
MCU Flashloader works as a companion to program the parallel NAND flash with the
boot image. The flashloader supports generating corresponding boot data structures
like the SEMC NAND Firmware configuration block (FCB) and Discovered Bad Block
Table (DBBT) required by the BootROM. This section is only intended for generating and
writing FCB, DBBT, and writing boot images using Flashloader. For details on SEMC
NAND boot flow, see the System Boot chapter in the device reference manual.
The flashloader can configure parallel NAND devices directly using FCB or by a
simplified configuration option block, based on which flashloader can also implicitly
generate a complete FCB.

6.5.1 SEMC NAND Firmware configuration block

Firmware configuration block (FCB) is a 1024-byte data structure containing the optimum
NAND timings and page address of DBBT search area firmware information (including
the start page address and page count), etc.

User guide Rev. 13 — 30 September 2022

60 / 87
NXP Semiconductors
MCUFLSHLDRRM
MCU Flashloader Reference Manual

Table 59. SEMC NAND Firmware configuration block

Name Offset (in Size (in Description
bytes) bytes)
crcChecksum 0x000 4 CRC checksum
Fingerprint 0x004 4 Fixed 0x4e464342
ASCII: “NFCB”
Version 0x008 4 Fixed 0x00000001
DBBTSearchStart 0x00c 4 Start page address for bad block table search
Page area
searchStride 0x010 2 Stride in blocks of DBBT/FCB search
Not used by ROM, max value is defined in
Fusemap. Refer to the fusemap in SoC RM for
more details.
searchCount 0x012 2 Copies of DBBT and FCB
Not used by ROM, max value is defined in
Fusemap. Refer to the fusemap in SoC RM for
more details.
firmwareCopies 0x014 4 Firmware copies
Valid range 1~8
Reserved 0x018 40 Reserved for future use
Must be set to 0
firmwareInfoTable 0x040 8*8 This table consists of 8 entries in the form below.
Entries 0~ firmwareCopies-1 are valid. Invalid
entries should be 0-filled.

Field Size (in Description

bytes)
startPage 4 Start page of
this firmware
pageCount 4 # of pages
to store this
firmware

Reserved 0x080 128 Reserved

Must be set to 0
semcNandConfig 0x100 256 Parallel NAND configuration block over SEMC,
Block see section Section 6.5.2.
Reserved 0x200 512 Reserved
Must be 0

6.5.2 SEMC NAND configuration block

The SEMC NAND parameters are defined in the SEMC NAND configuration block
regarding a specific flash device. It is a 256-byte data structure.

User guide Rev. 13 — 30 September 2022

61 / 87
NXP Semiconductors
MCUFLSHLDRRM
MCU Flashloader Reference Manual

Table 60. SEMC NAND configuration block

Name Offset Size (in bytes) Description
tag 0x000 4 0x434d4553
ASCII:”SEMC”
version 0x004 4 Version number
Typ. value 0x00010000

Offset Field
31:16 major
15:8 minor
7:0 bugfix

deviceMem 0x008 1 Device Memory Type

Type 1 - parallel NAND
access 0x009 1 Access Command Type
Command 0 - Access via IP commands
Type 1 - Access via AXI bus
Reserved 0x00a 2 Reserved
Must be set to 0
asyncClkFreq 0x00c 1 Asynchronous Clock Frequency
0 – 33MHz
1 – 40MHz
2 – 50MHz
3 – 66MHz
4 – 108MHz
5 – 133MHz
6 – 166MHz
7 - Max possible frequency
busTimeout 0x00d 1 Bus Timeout Clock Cycles
Cycles 0 – 255*1024 cycles
n – n*1024 cycles
command 0x00e 1 Command Timeout Clock Cycles
Execution 0 – 255*1024 cycles
Timeout n – n*1024 cycles
Cycles
readStrobe 0x00f 1 Read Strobe Mode
Mode 0 – Dummy read strobe loopbacked internally
1 – Dummy read strobe loopbacked from
DQS pad
axiMemBase 0x010 4 SoC level base address for NAND AXI
Address command
axiMemSizeIn 0x014 4 SoC level memory size for NAND AXI
Byte command
ipgMemBase 0x018 4 SoC level base address for NAND IPG
Address command

User guide Rev. 13 — 30 September 2022

62 / 87
NXP Semiconductors
MCUFLSHLDRRM
MCU Flashloader Reference Manual

Table 60. SEMC NAND configuration block...continued

Name Offset Size (in bytes) Description
ipgMemSizeIn 0x01c 4 SoC level memory size for NAND IPG
Byte command
edoMode 0x020 1 EDO Mode Enable
0 - Disabled
1 - Enabled
ioPortWidth 0x021 1 I/O Port Bit Width
16 - 16-bit wide
8 - 8-bit wide
arrayAddress 0x022 1 Array Address Option
Option 0 - 2-byte CA, 3-byte RA
1 - 1-byte CA, 3-byte RA
2 - 2-byte CA, 2-byte RA
3 - 1-byte CA, 2-byte RA
4 - 2-byte CA, 1-byte RA
7 - 1-byte CA, 1-byte RA
column 0x023 1 Column Address Bit Width
AddressWidth
burstLengthIn 0x024 1 Burst Length in Bytes
Bytes
column 0x025 1 Column Address Option
Address 0 - Page data access only
Option 1 - Spare area access enabled
Reserved 0x026 10 Reserved
Must be set to 0
cePortOutput 0x030 1 CE Port Output Selection
Selection 0 - CSX0
1 - CSX1
2 - CSX2
3 - CSX3
rdyPort 0x031 1 RDY Port Polarity
Polarity 0 - Low active
1 - High active
Reserved 0x032 14 Reserved
Must be set to 0
ceSetupTime 0x040 1 CE Setup Time
value[3:0] + 1 cycles
ceMinHold 0x041 1 CE Minimum Hold Time
Time value[3:0] + 1 cycles
ceMinInterval 0x042 1 CE Minimum Interval
Time value[3:0] + 1 cycles
weLowTime 0x043 1 WE Low Time
value[3:0] + 1 cycles

User guide Rev. 13 — 30 September 2022

63 / 87
NXP Semiconductors
MCUFLSHLDRRM
MCU Flashloader Reference Manual

Table 60. SEMC NAND configuration block...continued

Name Offset Size (in bytes) Description
weHighTime 0x044 1 WE High Time
value[3:0] + 1 cycles
reLowTime 0x045 1 RE Low Time
value[3:0] + 1 cycles
reHighTime 0x046 1 RE High Time
value[3:0] + 1 cycles
weHighToRe 0x047 1 WE High to RE Low Time
LowTime value[3:0] + 1 cycles
reHighToWe 0x048 1 RE High to WE Low Time
LowTime value[3:0] + 1 cycles
aleToData 0x049 1 ALE to Data Time
StartTime value[3:0] + 1 cycles
readyToRe 0x04a 1 RDY to RE Low Time
LowTime value[3:0] + 1 cycles
weHighTo 0x04b 1 WE High to BUSY Time
BusyTime value[3:0] + 1 cycles
async 0x04c 1 Async Turnaround Time
Turnaround value[3:0] + 1 cycles
Time
Reserved 0x04d 3 Reserved
Must be set to 0
vendorType 0x050 1 Vendor Type
0 - Micron
1 - Spansion
2 - Samsung
3 - Winbond
4 - Hynix
5 - Toshiba
6 - Macronix
7 - Unknown
cell 0x051 1 Cell Technology
Technology 0 - SLC
1 - MLC
onfiVersion 0x052 1 ONFI Compliance
0 - None
1 - ONFI 1.0
2 - ONFI 2.0
3 - ONFI 3.0
4 - ONFI 4.0
acTiming 0x053 1 Timing Mode
TableIndex 0 - User defined
1~6 - ONFI 1.0 mode 0~5
7 - Fastest mode

User guide Rev. 13 — 30 September 2022

64 / 87
NXP Semiconductors
MCUFLSHLDRRM
MCU Flashloader Reference Manual

Table 60. SEMC NAND configuration block...continued

Name Offset Size (in bytes) Description
enableEcc 0x054 1 ECC Enable
Check 0 - Enabled
1 - Disabled
eccCheck 0x055 1 ECC Type
Type 0 - Device ECC
1 - External/Software ECC
deviceEcc 0x056 1 Device ECC Default Status
Status 0 - Enabled
1 - Disabled
swEcc 0x057 1 Software ECC Algorithm
Algorithm Refer to SoC RM for details
swEccBlock 0x058 4 Software ECC Block Size in Bytes
Bytes
readyCheck 0x05c 1 Ready Check Option
Option 0 - Via status register
1 - Via R/B# signal
status 0x05d 1 Status Command Type
Command 0 - Common
Type 1 - Enhanced
readyCheck 0x05e 2 Ready Check Timeout in ms
TimeoutInMs
readyCheck 0x060 2 Ready Check Interval in us
IntervalInUs
Reserved 0x062 30 Reserved
Must be set to 0
userOnfiAc 0x080 1 User ONFI AC Timing Mode
TimingMode
Code
Reserved 0x081 31 Reserved
Must be set to 0
bytesInPage 0x0a0 4 Data Area Size in Bytes per Page
DataArea
bytesInPage 0x0a4 4 Spare Area Size in bytes per Page
SpareArea
pagesInBlock 0x0a8 4 Pages per Block
blocksInPlane 0x0ac 4 Blocks per Plane
planesIn 0x0b0 4 Planes in Device
Device
Reserved 0x0b4 44 Reserved
Must be set to 0
enable 0x0e0 1 Readback Verification Enable
Readback 0 - Enabled
Verify 1 - Disabled

User guide Rev. 13 — 30 September 2022

65 / 87
NXP Semiconductors
MCUFLSHLDRRM
MCU Flashloader Reference Manual

Table 60. SEMC NAND configuration block...continued

Name Offset Size (in bytes) Description
Reserved 0x0e1 3 Reserved
Must be set to 0
readback 0x0e4 1 Readback Page Buffer Address
PageBuffer
Address
Reserved 0x0e8 24 Reserved
Must be set to 0

6.5.3 SEMC NAND configuration option block

SEMC configuration option block defines the key parameters required by FCB. Currently
a uniform command set is applicable across mainstream ONFI-compliant parallel NAND
devices in the market. Their major differences lie in the ECC type. The configuration
option block covers these differences so as to simplify the configuration.

User guide Rev. 13 — 30 September 2022

66 / 87
NXP Semiconductors
MCUFLSHLDRRM
MCU Flashloader Reference Manual

Table 61. SEMC NAND configuration option block definition

Offset Field Size Description
0 nandOption 4 NAND configuration options

Offset Field Description

31:28 tag Fixed 0x0d
27:18 Reserved Set to 0
17 eccStatus Initial device ECC
status
Refer to device
EccStatus in
Section 6.5.2 for
definition
16 eccType ECC Type
Refer to ecc
CheckType in
Section 6.5.2 for
definition
15 Reserved Set to 0
14:12 pcsSelection CE port selection
Refer to cePort
OutputSelection in
Section 6.5.2 for
definition
11:10 Reserved Set to 0
9:8 ioPortDiv8 I/O port byte width
1 - 8-bit wide
2 - 16-bit wide
7 Reserved Set to 0
6:4 onfiTimingMode ONFI timing mode
Refer to acTiming
TableIndex in
Section 6.5.2 for
definition
3 edoMode EDO mode enable
Refer to edoMode
in Section 6.5.2 for
definition
2:0 onfiVersion ONFI Version
Refer to onfiVersion
in Section 6.5.2 for
definition

User guide Rev. 13 — 30 September 2022

67 / 87
NXP Semiconductors
MCUFLSHLDRRM
MCU Flashloader Reference Manual

Table 61. SEMC NAND configuration option block definition...continued

Offset Field Size Description
4 bcbOption 4 Key FCB and DBBT parameters

Offset Field Description

31:20 Reserved Set to 0
19:16 imgCopies Firmware copies
Refer to firmware
Copies in for
definition
15:8 searchStride Search stride in
blocks
7:4 Reserved Set to 0
3:0 searchCount Search count

8 imageInfo 4*8 Image info is a map of 8 entries in the form below. Entries 0~
imgCopies-1 are valid. Invalid entries should be 0-filled.

Offset Field Description

31:16 blockId Start block index of
the image
15:0 blockCount Occupied blocks of
the image

Note:
• searchStride should match the one provisioned in eFuse.
• searchCount should match the one provisioned in eFuse.

6.5.4 Example usage with Flashloader

[Link] FCB/DBBT management

It is not recommended to manually program NAND devices with the FCB and the DBBT.
The flashloader implicitly writes them into NAND during configuration.
The FCB, DBBT and firmware images will be loaded into NAND in the layout given below
(n stands for search count, m for search stride).

[Link].1

Block 0: FCB1
…
Block m: FCB2
…
Block (n-1)*m: FCBn

User guide Rev. 13 — 30 September 2022

68 / 87
NXP Semiconductors
MCUFLSHLDRRM
MCU Flashloader Reference Manual

Block n*m: DBBT1

…
Block (n+1)*m: DBBT2
…
Block (2n-1)*m: DBBTn
Image1
Image2
…
Image8 (assuming imgCopies is 8)

[Link] Example configuration

• Flashloader can generate an FCB and DBBT based on a specified SEMC NAND
configuration option block. Assuming the FCB parameters are:
– 1 copy of FCB and DBBT
– 1 copy of firmware
– Firmware intended to start at block 2, and occupy 1 block
• And parallel NAND parameters are:
– ONFI-compliant
– 8-bit wide I/O port
– CSX0 connected to NAND device’s CE port
– Device ECC applied
Below are the example steps for generating SEMC NAND configuration option block:
blhost -u -- fill-memory 0x20000000 0x4 0xd0000101 # NAND parameters
blhost -u -- fill-memory 0x20000004 0x4 0x00010101 # 1 copy of firmware, search stride
1, search step 1
blhost -u -- fill-memory 0x20000008 0x4 0x00020001 # firmware starts at block 2,
occupies 1 block
Configure the NAND flash using the option block above:
blhost -u -- configure-memory 0x100 0x20000000
Erasure, programming and readback:
blhost -u -- flash-erase-region 0x80000 0x40000 0x100 # erasure starts from block 2 (64
pp/block, 4KB/page), 1 block is erased
blhost -u -- write-memory 0x80000 [Link] 0x100
blhost -u -- read-memory 0x80400 16 0x100 # bootable image’s IVT offset should be
0x400

6.6 1-bit SPI EEPROM/NOR Flash through LPSPI

Certain MCUs support recovery boot from an external EEPROM/NOR flash through the
LPSPI under 1-bit mode. The MCU Flashloader works as a companion to program the
external SPI EEPROM/NOR device with the boot image. This section is only intended
for write boot images using Flashloader. For details on the recovery boot flow, see the
System Boot Chapter in the device reference manual.
MCUFLSHLDRRM All information provided in this document is subject to legal disclaimers. © 2022 NXP B.V. All rights reserved.

User guide Rev. 13 — 30 September 2022

69 / 87
NXP Semiconductors
MCUFLSHLDRRM
MCU Flashloader Reference Manual

The Flashloader can configure SPI EEPROM/NOR devices using a simplified

configuration option block.

6.6.1 SPI EEPROM/NOR configuration option block

SPI EEPROM/NOR configuration option block defines the parameters required for data
interaction.

User guide Rev. 13 — 30 September 2022

70 / 87
NXP Semiconductors
MCUFLSHLDRRM
MCU Flashloader Reference Manual

Table 62. SPI EEPROM/NOR configuration option block definition

Offset Field Size Description
0 option0 4 EEPROM/NOR configuration options

Offset Field Description

31:28 tag Fixed 0x0c
27:14 option_size Option size in 32-bit
words
0 - Only option0
given
1 - Option0 and
option1 both given
32:20 spi_index LPSPI instance
index
1~4 -
LPSPI1~LPSPI4
Refer to SoC RM for
details
19:16 pcs_index CS index of the
LPSPI module
0 - PCS0
1 - PCS1
2 - PCS2
3 - PCS3
Refer to SoC RM for
details
15:12 memory_type Memory device type
0 - NOR, parameters
specified
1 - EEPROM,
parameters specified
2 - NOR, parameters
auto detected (bits
11:0 omitted)
11:8 memory_size Memory size
(0≤n≤11): 512
KB*2^n n(12≤n≤15):
32KB*2^(n-12)
7:4 sector_size Sector size
n(0≤n≤1): 4KB*2^n
n(2≤n≤5): 32
KB*2^(n-2)
3:0 page_size Page size n(0≤n≤2):
256B*2^n n(3≤n≤5):
32B*2^(n-3)

User guide Rev. 13 — 30 September 2022

71 / 87
NXP Semiconductors
MCUFLSHLDRRM
MCU Flashloader Reference Manual

Table 62. SPI EEPROM/NOR configuration option block definition...continued

Offset Field Size Description
4 option1 4 SPI speed option
(optional)
Offset Field Description
31:4 Reserved Reserved for future
uses
3:0 speed SPI clock speed
0 - 20MHz (default)
1 - 10MHz
2 - 5MHz
3 - 2MHz

6.6.2 Example usage with Flashloader

Assume a SPI NOR is connected to LPSPI1, and that PCS0 of LPSPI1 is used as the
NOR device’s chip-select signal.
The configuration option block should be generated with the command
blhost -u -- fill-memory 0x20000000 0x4 0xc0002000 # auto detect NOR’s parameters
Or if the NOR device’s parameters to be manually specified are:
• 4MB (32Mb) total memory size
• 4KB sector size
• 256B page size
The configuration option block should be instead generated with
blhost -u -- fill-memory 0x20000000 0x4 0xc0000300
Configure the NOR flash using the option block above:
blhost -u -- configure-memory 0x110 0x20000000
Erasure, programming and readback:
blhost -u -- flash-erase-region 0x0 0x8000 0x110
blhost -u -- write-memory 0x0 [Link] 0x110
blhost -u -- read-memory 0x400 16 0x110 # bootable image’s IVT offset should be 0x400

7 Security utilities

7.1 Introduction

The MCU Flashloader supports certain security utilities that can generate security related
blocks easily. See that the Flashloader itself must be signed first to enable the security
utilities correctly.

User guide Rev. 13 — 30 September 2022

72 / 87
NXP Semiconductors
MCUFLSHLDRRM
MCU Flashloader Reference Manual

7.2 Image encryption and programming

For devices with the BEE module, it supports two encrypted regions using two unique
crypto keys. Each encrypted region can support up to 3 sub-divided FAC regions. See
the details of the image decryption and data structure required for image decryption
in System Boot Chapter in SoC’s RM. In the section, it focuses on encrypted image
generation and programming using Flashloader. Flashloader generates encrypted
images based on a simplified PRDB option block, which is defined below.
Note: The Flashloader only supports image encryption and programming for the first
encrypted region using the OTPMK/SNVS key.

Table 63. PRDB option block

Offset Field Size Description
(bytes)
0 Option 4
Tag Key Mode FAC Region1Region2Region3Lock
[31:28] source [23:20] Region Protection
Protection
Protection
Option
[27:24] Count Mode Mode Mode [3:0]
[19:16] [15:12] [11:8] [7:4]
0xE 0- 1-AES 1/2/3 0/1/ 0/1 0/1 0 - No
OTPMK CTR
/ Lock
SNVS

4 Fac 8-24
Region Offset Field Description
info
0 Start Fac Region Start
4 Size Fac Region Size

Note:
• Tag is fixed as 0x0E.
• Key Source can be OTPMK/SNVS [255:128].
• Mode: It is recommended to use AES-CTR mode.
• FAC Region Count: Maximum allowed FAC region number is 3 (shared by encrypted
region 0 and encrypted region 1).
• Region n Protection mode: 0 – No protection, 1 – Debug disabled.
• Lock Option: Must be 0.

7.2.1 Example to generate encrypted image and program to Flash

Take HyperFlash as an example, assuming the encrypted info is:

• Key source: OTPMK/SNVS [255:128].
• FAC region Count: 2.
• Region Protection mode: 1.
Below are the steps to create a PRDB option block.
Configure HyperFlash using FlexSPI NOR configuration option block:

User guide Rev. 13 — 30 September 2022

73 / 87
NXP Semiconductors
MCUFLSHLDRRM
MCU Flashloader Reference Manual

blhost -u -- fill-memory 0x2000 0x04 0xc0233007 //(133MHz)

blhost -u -- configure-memory 0x9 0x2000
blhost -u -- fill-memory 0x3000 0x04 0xf000000f
blhost -u -- configure-memory 0x09 0x3000

Prepare PRDB0 info using PRDB option block:

blhost -u -- fill-memory 0x4000 0x04 0xe0121100

blhost -u -- configure-memory 0x09 0x4000
//Program HyperFLASH
blhost -u -- write-memory <addr> [Link]

7.3 KeyBlob generation and programming

7.3.1 KeyBlob

KeyBlob is a data structure that wraps the DEK for image decryption using AES-CCM
algorithm. The whole KeyBlob data structure is shown below.

Table 64. KeyBlob Data structure

Field Size (bytes) Description
Header 4
Offset Field Description
0 tag Fixed value:
0x81
1-2 len Length of
KeyBlob
block, 16-bit
big-endian
order
3 par KeyBlob
Version, set to
0x42 or 0x43

AEAD 4
Offset Field Description
0 mode Fixed to 0x66,
CCM mode
1 alg Fixed to
0x55, Crypto
Algorithm:
AES
2 mac_bytes Fixed to 16
3 aad_bytes Fixed to 0

EBK 16 / 32 Blob key is used for DEK encryption, it is a

random number generated by TRNG engine
Blob key is encrypted to EBK by a key derived
from Security Engine such as SNVS or CAAM

User guide Rev. 13 — 30 September 2022

74 / 87
NXP Semiconductors
MCUFLSHLDRRM
MCU Flashloader Reference Manual

Table 64. KeyBlob Data structure...continued

Field Size (bytes) Description
EDEK 16 / 24 / 32 DEK is used for boot image encryption, it
is encrypted to EDEK by the BK with AES
algorithm using AES-CCM mode
MAC 16 MAC is generated during DEK encryption

7.3.2 KeyBlob Option Block

The MCU Flashloader supports KeyBlob generation and programming using a simplified
option block called KeyBlob Option Block.

User guide Rev. 13 — 30 September 2022

75 / 87
NXP Semiconductors
MCUFLSHLDRRM
MCU Flashloader Reference Manual

Table 65. KeyBlob Data structure

Offset Field Size Description
0 option 4
Offset Field Description
31:28 Tag Fixed to
0x0B
27:24 type 0 - Update,
used to
update the
keyblob
context
1-
Program
- used
to notify
memory
driver to
program
Keyblob to
destination
23:20 size keyblob_
info size
must equal
to 3 if
type = 0,
ignored if
type = 1
19:8 Reserved -
7:4 dek_size DEK size
0 - 128 bits
1 - 192 bits
2 - 256 bits
Effective if
type = 0,
ignored if
type = 1
3:0 image_ Boot image
index index
For
example,
index for
firmware
Table
effective if
type = 1,
ignored if
type = 0

1 dek_addr 4 Start address for the memory holds

DEK

User guide Rev. 13 — 30 September 2022

76 / 87
NXP Semiconductors
MCUFLSHLDRRM
MCU Flashloader Reference Manual

Table 65. KeyBlob Data structure...continued

Offset Field Size Description
2 keyblob_offset 4 The relative Keyblob offset in the
selected image
For example, a signed image that
contains IVT, encrypted application,
CSF, Key blob
IVT is at offset 0x400
Encrypted image is at offset 0x2000
CSF is at offset 0xA000
KeyBlob is at offset 0xB000
Note: For NAND device, keyblob_
offset must be page aligned

7.3.3 Example to generate and program KeyBlob

Generate KeyBlob
// Write DEK to RAM

blhost -u -- write-memory 0x2100 [Link]

// Construct KeyBlob option

blhost -u -- fill-memory 0x2080 4 0xb0300000 // tag = 0x0b, type = 0, size = 3,

dek_size = 0 (128bits)
blhost -u -- fill-memory 0x2084 4 0x2100 // dek_addr = 0x2100
blhost -u -- fill-memory 02088 4 0x80000 // keybob_offset = 0x80000,
keybob is located at offset 0x80000 in application image

// Update KeyBlob Info

blhost -u -- configure-memory 0x101 0x2080 // Update KeyBlob Info (memory id:

0x101 - FlexSPI NAND)

// Program KeyBlob

blhost -u -- fill-memory 0x2080 0xb1000000 // tag = 0x0b, type = 1,

image_index = 0
blhost -u -- configure-memory 0x101 0x2080 // Generate KeyBlob and program it
into offset <keyblob_offset> in the selected Image <image_idex> memory region

8 Status and error codes

Status and error codes are grouped by component. Each component that defines errors
has a group number. This expression is used to construct a status code value.
status_code = (group * 100) + code
Component group numbers are listed in this table.

User guide Rev. 13 — 30 September 2022

77 / 87
NXP Semiconductors
MCUFLSHLDRRM
MCU Flashloader Reference Manual

Table 66. Component group numbers

Group Component
0 Generic errors
100 Bootloader
101 SB loader
102 Memory interface
103 Property store
104 CRC checker
105 Packetizer
106 Reliable update

The following table lists all of the error and status codes.

Table 67. Error and status codes

Name Value Description
kStatus_Success 0 Operation succeeded without error
kStatus_Fail 1 Operation failed with a generic error
kStatus_ReadOnly 2 Property cannot be changed because it is
read-only
kStatus_OutOfRange 3 Requested value is out of range
kStatus_InvalidArgument 4 The requested command's argument is
undefined
kStatus_Timeout 5 A timeout occurred
kStatus_NoTransferInProgress 6 The current transfer status is idle
kStatus_SDMMC_NotSuppo 1800 Not supported this feature
rtYet
kStatus_SDMMC_Transfer 1801 Failed to communicate with the device
Failed
kStatus_SDMMC_SetCardB 1802 Failed to set the block size
lockSizeFailed
kStatus_SDMMC_HostNotS 1803 Host doesn't support this feature
upport
kStatus_SDMMC_CardNotS 1804 The card does not support this feature
upport
kStatus_SDMMC_AllSendC 1805 Failed to send CID
idFailed
kStatus_SDMMC_SendRela 1806 Failed to send relative address
tiveAddressFailed
kStatus_SDMMC_SendCsdF 1807 Failed to send CSD
ailed
kStatus_SDMMC_SelectCa 1808 Failed to select card
rdFailed
kStatus_SDMMC_SendScrF 1809 Failed to send SCR
ailed

User guide Rev. 13 — 30 September 2022

78 / 87
NXP Semiconductors
MCUFLSHLDRRM
MCU Flashloader Reference Manual

Table 67. Error and status codes...continued

Name Value Description
kStatus_SDMMC_SetDataB 1810 Failed to set bus width
usWidthFailed
kStatus_SDMMC_GoIdleFailed 1811 Go idle failed
kStatus_SDMMC_HandShak 1812 Failed to send operation condition
eOperationConditionFailed
kStatus_SDMMC_SendAppl 1813 Failed to send application command
icationCommandFailed
kStatus_SDMMC_SwitchFailed 1814 Switch command failed
kStatus_SDMMC_StopTran 1815 Stop transmission failed
smissionFailed
kStatus_SDMMC_WaitWrit 1816 Failed to wait write complete
eCompleteFailed
kStatus_SDMMC_SetBlock 1817 Failed to set block count
CountFailed
kStatus_SDMMC_SetRelat 1818 Failed to set relative address
iveAddressFailed
kStatus_SDMMC_SwitchBu 1819 Failed to switch high speed
sTimingFailed
kStatus_SDMMC_SendExte 1820 Failed to send EXT_CSD
ndedCsdFailed
kStatus_SDMMC_Configur 1821 Failed to configure boot
eBootFailed
kStatus_SDMMC_Configur 1822 Failed to configure EXT_CSD
eExtendedCsdFailed
kStatus_SDMMC_EnableHi 1823 Failed to enable high capacity erase
ghCapacityEraseFailed
kStatus_SDMMC_SendTest 1824 Failed to send test pattern
PatternFailed
kStatus_SDMMC_ReceiveT 1825 Failed to receive test pattern
estPatternFailed
kStatus_SDMMC_InvalidV 1829 Invalid voltage
oltage
kStatus_SDMMC_TuningFail 1833 Tuning failed
kStatus_SDMMC_SwitchVo 1834 Failed to switch voltage
ltageFail
kStatus_SDMMC_SetPower 1837 Set power class fail
ClassFail
kStatus_UnknownCommand 10000 The requested command value is undefined
kStatus_SecurityViolation 10001 Command is disallowed because flash
security is enabled
kStatus_AbortDataPhase 10002 Abort the data phase early
kStatus_Ping 10003 Internal: Received ping during command
phase

User guide Rev. 13 — 30 September 2022

79 / 87
NXP Semiconductors
MCUFLSHLDRRM
MCU Flashloader Reference Manual

Table 67. Error and status codes...continued

Name Value Description
kStatus_NoResponse 10004 There is no response for the command
kStatus_NoResponseExpected 10005 There is no response expected for the
command
kStatusRomLdrSectionOverrun 10100 ROM SB loader section overrun
kStatusRomLdrSignature 10101 ROM SB loader incorrect signature
kStatusRomLdrSectionLength 10102 ROM SB loader incorrect section length
kStatusRomLdrUnencrypted 10103 ROM SB loader does not support plain text
Only image
kStatusRomLdrEOFReached 10104 ROM SB loader EOF reached
kStatusRomLdrChecksum 10105 ROM SB loader checksum error
kStatusRomLdrCrc32Error 10106 ROM SB loader CRC32 error
kStatusRomLdrUnknown 10107 ROM SB loader unknown command
Command
kStatusRomLdrIdNotFound 10108 ROM SB loader ID not found
kStatusRomLdrDataUnderrun 10109 ROM SB loader data underrun
kStatusRomLdrJumpReturned 10110 ROM SB loader return from jump command
occurred
kStatusRomLdrCallFailed 10111 ROM SB loader call command failed
kStatusRomLdrKeyNotFound 10112 ROM SB loader key not found
kStatusRomLdrSecureOnly 10113 ROM SB loader security state is secured
only
kStatusRomLdrResetReturned 10114 ROM SB loader return from reset occurred
kStatusMemoryRangeInvalid 10200 Memory range conflicts with a protected
region
kStatusMemoryReadFailed 10201 Failed to read from memory range
kStatusMemoryWriteFailed 10202 Failed to write to memory range
StatusMemoryCumulativeWrite 10203 Failed to write to unerased memory range
kStatusMemoryAppOverlap 10204 Memory range contains a protected executed
WithExecuteOnlyRegion only region
kStatusMemoryNotConfigured 10205 Failed to access to un-configured external
memory
kStatusMemoryAlignmentError 10206 Address alignment Error
kStatusMemoryVerifyFailed 10207 Failed to verify the write operation
kStatusMemoryWriteProtected 10208 Memory range contains protected memory
region
kStatus_UnknownProperty 10300 The requested property value is undefined
kStatus_ReadOnlyProperty 10301 The requested property value cannot be
written
kStatus_InvalidPropertyValue 10302 The specified property value is invalid
kStatus_AppCrcCheckPassed 10400 CRC check passed

User guide Rev. 13 — 30 September 2022

80 / 87
NXP Semiconductors
MCUFLSHLDRRM
MCU Flashloader Reference Manual

Table 67. Error and status codes...continued

Name Value Description
kStatus_AppCrcCheckFailed 10401 CRC check failed
kStatus_AppCrcCheckInactive 10402 CRC checker is not enabled
kStatus_AppCrcCheckInvalid 10403 Invalid CRC checker
kStatus_AppCrcCheckOutOf 10404 CRC check is valid but addresses are out of
Range range
kStatus_NoPingResponse 10500 Packetizer did not receive any response for
the ping packet
kStatus_InvalidPacketType 10501 Packet type is invalid
kStatus_InvalidCRC 10502 Invalid CRC in the packet
kStatus_NoCommandRespons 10503 No response received for the command
e
kStatus_ReliableUpdateSu 10600 Reliable update process completed
ccess successfully
kStatus_ReliableUpdateFail 10601 Reliable update process failed
kStatus_ReliableUpdateInacive 10602 Reliable update feature is inactive
kStatus_ReliableUpdateBa 10603 Backup application image is invalid
ckupApplicationInvalid
kStatus_ReliableUpdateSt 10604 Next boot will still be with Main Application
illInMainApplication image
kStatus_ReliableUpdateSw 10605 Cannot swap flash by default because swap
apSystemNotReady system is not ready
kStatus_ReliableUpdateBa 10606 Cannot swap flash because there is no valid
ckupBootloaderNotReady backup bootloader image
kStatus_ReliableUpdateSw 10607 Cannot swap flash because provided swap
apIndicatorAddressInvalid indicator is invalid

9 GetProperty and SetProperty commands

Properties are the defined units of data that can be accessed with the GetProperty
or SetProperty commands. Properties may be read-only or read-write. All read-write
properties are 32-bit integers, so they can easily be carried in a command parameter. Not
all properties are available on all platforms. If a property is not available, GetProperty and
SetProperty return kStatus_UnknownProperty.
The tag values shown in the table below are used with the GetProperty and SetProperty
commands to query information about the flashloader.

Table 68. Tag values GetProperty and SetProperty

Name Writable Tag Size Description
value
Current no 0x01 4 Current flashloader version
Version
Available no 0x02 4 Set of peripherals supported on this chip
Peripherals

User guide Rev. 13 — 30 September 2022

81 / 87
NXP Semiconductors
MCUFLSHLDRRM
MCU Flashloader Reference Manual

Table 68. Tag values GetProperty and SetProperty...continued

Name Writable Tag Size Description
value
FlashStart no 0x03 4 Start address of program flash
Address
FlashSizeIn no 0x04 4 Size in bytes of program flash
Bytes
FlashSector no 0x05 4 Size in bytes of one sector of program flash,
Size this is the minimum erase size
FlashBlock no 0x06 4 Number of blocks in the flash array
Count
Available no 0x07 4 Set of commands supported by the
Commands flashloader
CRCCheck no 0x08 4 Status of the application CRC check
Status
Reserved n/a 0x09 n/a
VerifyWrites yes 0x0a 4 Controls whether the bootloader verifies
writes to flash. The VerifyWrites feature is
enabled by default.
0 - No verification is done
1 - Enable verification
MaxPacket no 0x0b 4 Maximum supported packet size for the
Size currently active peripheral interface
Reserved no 0x0c n List of memory regions reserved by the
Regions flashloader. Returned as value pairs (<start-
address-of-region>,<end-address-of-region>)
• If HasDataPhase flag is not set, then
Response packet parameter count indicates
number of pairs
• If HasDataPhase flag is set, then the
second parameter is the number of bytes in
the data phase
RAMStart no 0x0e 4 Start address of RAM
Address
RAMSizeIn no 0x0f 4 Size in bytes of RAM
Bytes
SystemDevice no 0x10 4 Value of the Kinetis System Device
Id Identification register
FlashSecurity no 0x11 4 Indicates whether Flash security is enabled
State 0 - Flash security is disabled
1 - Flash security is enabled
UniqueDevice no 0x12 n Unique device identification. This value is
Id the concatenation of the Kinetis Unique
Identification registers. For details, see the
Unique Identification registers located in the
SIM module.

User guide Rev. 13 — 30 September 2022

82 / 87
NXP Semiconductors
MCUFLSHLDRRM
MCU Flashloader Reference Manual

Table 68. Tag values GetProperty and SetProperty...continued

Name Writable Tag Size Description
value
FlashFac no 0x13 4 FAC (Flash Access Control) support flag
Support 0 - FAC not supported
1 - FAC supported
FlashAccess no 0x14 4 Size in bytes of 1 segment of flash
SegmentSize
FlashAccess no 0x15 4 FAC segment count (The count of flash
Segment access segments within the flash model)
Count
FlashRead yes 0x16 4 The margin level setting for flash erase and
Margin program verify commands
0=Normal
1=User
2=Factory
QspiInitStatus no 0x17 4 The result of the QSPI or OTFAD initialization
process
405 - QSPI is not initialized
0 - QSPI is initialized
TargetVersion no 0x18 4 Target build version number
External no 0x19 24 List of attributes supported by the specified
Memory memory Id (0=Internal Flash, 1=QuadSpi0),
Attributes see description for the return value in the
section ExternalMemoryAttributes Property

10 Revision history
This table shows the revision history of the document.

Table 69. Revision history

Revision number Date Substantive changes
0 04/2016 Kinetis Bootloader v2.0.0
release.
1 10/2017 Update for Flashloader
application for [Link] RT Series
of devices.
2 01/2018 Update for Flashloader
application for QuadSPI NOR
Flash device that is only
JESD216-compliant.
3 05/2018 MCU Bootloader v2.5.0
release.
4 09/2018 MCU Bootloader v2.6.0
release.
5 11/2018 MCU Bootloader v2.7.0
release.
6 09/2019 Added section Section 6.2.3.

User guide Rev. 13 — 30 September 2022

83 / 87
NXP Semiconductors
MCUFLSHLDRRM
MCU Flashloader Reference Manual

Table 69. Revision history...continued

Revision number Date Substantive changes
7 03/2020 Updated for RT1170
Flashloader EAR release,
added section Section [Link].
8 28 December 2020 Updated for MCUXpresso SDK
v2.9.0 release .
9 01 June 2021 Updated for MCUXpresso SDK
v2.10.0 release.
10 17 October 2021 Updated size for ipCmdSerial
ClkFreq, isUniformBlockSize,
and needExitNoCmdMode in
Section 6.2.1
11 29 March 2022 Updated Table 56 for
MCUBOOT SDK 2.11.0
RT1180 EAR .
12 14 June 2022 Updated EEPROM/NOR
configuration options for
MCUXpresso SDK 2.12.0.
13 30 September 2022 Updated Table 56.

User guide Rev. 13 — 30 September 2022

84 / 87
NXP Semiconductors
MCUFLSHLDRRM
MCU Flashloader Reference Manual

11 Legal information
11.1 Definitions Terms and conditions of commercial sale — NXP Semiconductors
products are sold subject to the general terms and conditions of commercial
sale, as published at [Link] unless otherwise
Draft — A draft status on a document indicates that the content is still agreed in a valid written individual agreement. In case an individual
under internal review and subject to formal approval, which may result agreement is concluded only the terms and conditions of the respective
in modifications or additions. NXP Semiconductors does not give any agreement shall apply. NXP Semiconductors hereby expressly objects to
representations or warranties as to the accuracy or completeness of applying the customer’s general terms and conditions with regard to the
information included in a draft version of a document and shall have no purchase of NXP Semiconductors products by customer.
liability for the consequences of use of such information.
Export control — This document as well as the item(s) described herein
may be subject to export control regulations. Export might require a prior
11.2 Disclaimers authorization from competent authorities.

Limited warranty and liability — Information in this document is believed Suitability for use in non-automotive qualified products — Unless
to be accurate and reliable. However, NXP Semiconductors does not give this data sheet expressly states that this specific NXP Semiconductors
any representations or warranties, expressed or implied, as to the accuracy product is automotive qualified, the product is not suitable for automotive
or completeness of such information and shall have no liability for the use. It is neither qualified nor tested in accordance with automotive testing
consequences of use of such information. NXP Semiconductors takes no or application requirements. NXP Semiconductors accepts no liability for
responsibility for the content in this document if provided by an information inclusion and/or use of non-automotive qualified products in automotive
source outside of NXP Semiconductors. equipment or applications.
In no event shall NXP Semiconductors be liable for any indirect, incidental, In the event that customer uses the product for design-in and use in
punitive, special or consequential damages (including - without limitation - automotive applications to automotive specifications and standards,
lost profits, lost savings, business interruption, costs related to the removal customer (a) shall use the product without NXP Semiconductors’ warranty
or replacement of any products or rework charges) whether or not such of the product for such automotive applications, use and specifications, and
damages are based on tort (including negligence), warranty, breach of (b) whenever customer uses the product for automotive applications beyond
contract or any other legal theory. NXP Semiconductors’ specifications such use shall be solely at customer’s
own risk, and (c) customer fully indemnifies NXP Semiconductors for any
Notwithstanding any damages that customer might incur for any reason
liability, damages or failed product claims resulting from customer design and
whatsoever, NXP Semiconductors’ aggregate and cumulative liability
use of the product for automotive applications beyond NXP Semiconductors’
towards customer for the products described herein shall be limited in
standard warranty and NXP Semiconductors’ product specifications.
accordance with the Terms and conditions of commercial sale of NXP
Semiconductors.
Translations — A non-English (translated) version of a document, including
the legal information in that document, is for reference only. The English
Right to make changes — NXP Semiconductors reserves the right to
version shall prevail in case of any discrepancy between the translated and
make changes to information published in this document, including without
English versions.
limitation specifications and product descriptions, at any time and without
notice. This document supersedes and replaces all information supplied prior
Security — Customer understands that all NXP products may be subject to
to the publication hereof.
unidentified vulnerabilities or may support established security standards or
specifications with known limitations. Customer is responsible for the design
Suitability for use — NXP Semiconductors products are not designed,
and operation of its applications and products throughout their lifecycles
authorized or warranted to be suitable for use in life support, life-critical or
to reduce the effect of these vulnerabilities on customer’s applications
safety-critical systems or equipment, nor in applications where failure or
and products. Customer’s responsibility also extends to other open and/or
malfunction of an NXP Semiconductors product can reasonably be expected
proprietary technologies supported by NXP products for use in customer’s
to result in personal injury, death or severe property or environmental
applications. NXP accepts no liability for any vulnerability. Customer should
damage. NXP Semiconductors and its suppliers accept no liability for
regularly check security updates from NXP and follow up appropriately.
inclusion and/or use of NXP Semiconductors products in such equipment or
applications and therefore such inclusion and/or use is at the customer’s own Customer shall select products with security features that best meet rules,
risk. regulations, and standards of the intended application and make the
ultimate design decisions regarding its products and is solely responsible
for compliance with all legal, regulatory, and security related requirements
Applications — Applications that are described herein for any of these
concerning its products, regardless of any information or support that may be
products are for illustrative purposes only. NXP Semiconductors makes no
provided by NXP.
representation or warranty that such applications will be suitable for the
specified use without further testing or modification. NXP has a Product Security Incident Response Team (PSIRT) (reachable
at PSIRT@[Link]) that manages the investigation, reporting, and solution
Customers are responsible for the design and operation of their
release to security vulnerabilities of NXP products.
applications and products using NXP Semiconductors products, and NXP
Semiconductors accepts no liability for any assistance with applications or
customer product design. It is customer’s sole responsibility to determine
whether the NXP Semiconductors product is suitable and fit for the
customer’s applications and products planned, as well as for the planned
11.3 Trademarks
application and use of customer’s third party customer(s). Customers should
Notice: All referenced brands, product names, service names, and
provide appropriate design and operating safeguards to minimize the risks
trademarks are the property of their respective owners.
associated with their applications and products.
NXP Semiconductors does not accept any liability related to any default, NXP — wordmark and logo are trademarks of NXP B.V.
damage, costs or problem which is based on any weakness or default AMBA, Arm, Arm7, Arm7TDMI, Arm9, Arm11, Artisan, [Link],
in the customer’s applications or products, or the application or use by Cordio, CoreLink, CoreSight, Cortex, DesignStart, DynamIQ, Jazelle,
customer’s third party customer(s). Customer is responsible for doing all Keil, Mali, Mbed, Mbed Enabled, NEON, POP, RealView, SecurCore,
necessary testing for the customer’s applications and products using NXP Socrates, Thumb, TrustZone, ULINK, ULINK2, ULINK-ME, ULINK-PLUS,
Semiconductors products in order to avoid a default of the applications ULINKpro, μVision, Versatile — are trademarks or registered trademarks
and the products or of the application or use by customer’s third party of Arm Limited (or its subsidiaries) in the US and/or elsewhere. The related
customer(s). NXP does not accept any liability in this respect. technology may be protected by any or all of patents, copyrights, designs
and trade secrets. All rights reserved.
Airfast — is a trademark of NXP B.V.

User guide Rev. 13 — 30 September 2022

85 / 87
NXP Semiconductors
MCUFLSHLDRRM
MCU Flashloader Reference Manual

Bluetooth — the Bluetooth wordmark and logos are registered trademarks Immersiv3D — is a trademark of NXP B.V.
owned by Bluetooth SIG, Inc. and any use of such marks by NXP I2C-bus — logo is a trademark of NXP B.V.
Semiconductors is under license.
Kinetis — is a trademark of NXP B.V.
Cadence — the Cadence logo, and the other Cadence marks found at www.
[Link]/go/trademarks are trademarks or registered trademarks of Layerscape — is a trademark of NXP B.V.
Cadence Design Systems, Inc. All rights reserved worldwide. Mantis — is a trademark of NXP B.V.
CodeWarrior — is a trademark of NXP B.V. MIFARE — is a trademark of NXP B.V.
ColdFire — is a trademark of NXP B.V. NTAG — is a trademark of NXP B.V.
ColdFire+ — is a trademark of NXP B.V. Processor Expert — is a trademark of NXP B.V.
EdgeLock — is a trademark of NXP B.V. QorIQ — is a trademark of NXP B.V.
EdgeScale — is a trademark of NXP B.V. SafeAssure — is a trademark of NXP B.V.
EdgeVerse — is a trademark of NXP B.V. SafeAssure — logo is a trademark of NXP B.V.
elQ — is a trademark of NXP B.V. Synopsys — Portions Copyright © 2021 Synopsys, Inc. Used with
FeliCa — is a trademark of Sony Corporation. permission. All rights reserved.
Freescale — is a trademark of NXP B.V. Tower — is a trademark of NXP B.V.
HITAG — is a trademark of NXP B.V. UCODE — is a trademark of NXP B.V.
ICODE and I-CODE — are trademarks of NXP B.V. VortiQa — is a trademark of NXP B.V.

User guide Rev. 13 — 30 September 2022

86 / 87
NXP Semiconductors
MCUFLSHLDRRM
MCU Flashloader Reference Manual

Contents
1 Introduction ......................................................... 2 [Link] Programming Serial NOR Flash device
1.1 Overview ............................................................ 2 using FlexSPI NOR configuration option
1.2 Terminology ........................................................2 block .................................................................45
1.3 Block diagram ....................................................2 [Link] Select the FLEXSPI instance .......................... 45
1.4 Features supported ............................................3 [Link] FlexSPI Instance Selection using FlexSPI
1.5 Components supported ..................................... 3 NOR configuration option block ....................... 46
2 MCU Flashloader protocol API .......................... 5 6.2.3 FlexSPI NOR on-chip OTFAD pre-
2.1 Introduction ........................................................ 5 encryption option block ....................................46
2.2 Command with no data phase ...........................5 [Link] On-chip pre-encryption using the option
2.3 Command with incoming data phase .................6 block .................................................................47
2.4 Command with outgoing data phase ................. 7 6.3 Serial NAND Flash through FlexSPI ................48
3 Flashloader packet types ................................... 9 6.3.1 FlexSPI NAND Firmware configuration
3.1 Introduction ........................................................ 9 block (FCB) ......................................................48
3.2 Framing packet ..................................................9 6.3.2 FlexSPI NAND configuration block .................. 49
3.3 CRC16 algorithm ............................................. 10 6.3.3 FlexSPI NAND FCB option block .................... 51
3.4 Ping packet ......................................................11 6.3.4 FlexSPI NAND configuration option block ........52
3.5 Ping response packet ...................................... 12 6.3.5 Example usage with Flashloader .....................53
3.6 Command packet ............................................ 12 6.4 SD/eMMC through uSDHC ..............................54
3.7 Response packet ............................................. 14 6.4.1 SD configuration block .....................................54
4 MCU Flashloader command API ......................15 6.4.2 Example usage with Flashloader .....................55
4.1 Introduction ...................................................... 15 6.4.3 eMMC configuration block ............................... 56
4.2 GetProperty command .....................................16 6.4.4 Example usage with Flashloader .....................59
4.3 SetProperty command ..................................... 17 6.5 Parallel NAND Flash through SEMC ............... 60
4.4 FlashEraseAll command ..................................19 6.5.1 SEMC NAND Firmware configuration block .....60
4.5 FlashEraseRegion command ...........................20 6.5.2 SEMC NAND configuration block .................... 61
4.6 ReadMemory command .................................. 21 6.5.3 SEMC NAND configuration option block ..........66
4.7 WriteMemory command ...................................23 6.5.4 Example usage with Flashloader .....................68
4.8 FillMemory command ...................................... 25 [Link] FCB/DBBT management ................................. 68
4.9 Execute command ........................................... 26 [Link] Example configuration ..................................... 69
4.10 Call command ..................................................27 6.6 1-bit SPI EEPROM/NOR Flash through
4.11 Reset command .............................................. 28 LPSPI ...............................................................69
4.12 FlashProgramOnce/eFuseProgramOnce 6.6.1 SPI EEPROM/NOR configuration option
command ......................................................... 29 block .................................................................70
4.13 FlashReadOnce/eFuseReadOnce 6.6.2 Example usage with Flashloader .....................72
command ......................................................... 30 7 Security utilities ................................................ 72
4.14 Configure Memory command .......................... 31 7.1 Introduction ...................................................... 72
4.15 ReceiveSBFile command ................................ 32 7.2 Image encryption and programming ................ 73
4.16 GenerateKeyBlob command ............................32 7.2.1 Example to generate encrypted image and
5 Supported peripherals ......................................34 program to Flash ............................................. 73
5.1 Introduction ...................................................... 34 7.3 KeyBlob generation and programming ............ 74
5.2 UART peripheral .............................................. 34 7.3.1 KeyBlob ............................................................74
5.3 USB HID peripheral ......................................... 35 7.3.2 KeyBlob Option Block ......................................75
5.3.1 Device descriptor ............................................. 35 7.3.3 Example to generate and program KeyBlob .... 77
5.3.2 Endpoints ......................................................... 36 8 Status and error codes .....................................77
5.3.3 HID reports ...................................................... 36 9 GetProperty and SetProperty commands ....... 81
6 External memory support ................................ 37 10 Revision history ................................................ 83
6.1 Introduction ...................................................... 37 11 Legal information .............................................. 85
6.2 Serial NOR Flash through FlexSPI .................. 38
6.2.1 FlexSPI NOR configuration block .................... 38
6.2.2 FlexSPI NOR configuration option block ..........43
[Link] Typical use cases for FlexSPI NOR
configuration block ...........................................45

Please be aware that important notices concerning this document and the product(s)
described herein, have been included in section 'Legal information'.

For more information, please visit: [Link]
Date of release: 30 September 2022
Document identifier: MCUFLSHLDRRM

PM0075 Programming Manual: STM32F10xxx Flash Memory Microcontrollers
No ratings yet
PM0075 Programming Manual: STM32F10xxx Flash Memory Microcontrollers
31 pages
Stm32 Flash Programming
No ratings yet
Stm32 Flash Programming
31 pages
89E516RD2 SiliconStorageTechnology PDF
No ratings yet
89E516RD2 SiliconStorageTechnology PDF
91 pages
STM32F10xx Flash Programming Manual
No ratings yet
STM32F10xx Flash Programming Manual
31 pages
PM0081 Programming Manual: STM32F40xxx and STM32F41xxx Flash Programming Manual
No ratings yet
PM0081 Programming Manual: STM32F40xxx and STM32F41xxx Flash Programming Manual
27 pages
DM00023388 - STM32F40xxx and STM32F41xxx Flash Programming Manual
No ratings yet
DM00023388 - STM32F40xxx and STM32F41xxx Flash Programming Manual
27 pages
FlashcatUSB User's Guide for Professionals
No ratings yet
FlashcatUSB User's Guide for Professionals
28 pages
FlashcatUSB Manual
No ratings yet
FlashcatUSB Manual
26 pages
Chatgpt Mca Unit 1
No ratings yet
Chatgpt Mca Unit 1
28 pages
RM0351r6 - STM32L4xy PDF
No ratings yet
RM0351r6 - STM32L4xy PDF
1,881 pages
FlashcatUSB Manual
No ratings yet
FlashcatUSB Manual
28 pages
Stm32l4 Manual
No ratings yet
Stm32l4 Manual
2,301 pages
STM32L4 Reference Manual
No ratings yet
STM32L4 Reference Manual
1,906 pages
XM132 Module Software User Guide 3
No ratings yet
XM132 Module Software User Guide 3
29 pages
FlashcatUSB Manual10
No ratings yet
FlashcatUSB Manual10
27 pages
Production Flash Programming Best Practices For S32K1xx MCUs
No ratings yet
Production Flash Programming Best Practices For S32K1xx MCUs
8 pages
Rm0440 Stm32g4 Series Advanced Armbased 32bit Mcus Stmicroelectronics
No ratings yet
Rm0440 Stm32g4 Series Advanced Armbased 32bit Mcus Stmicroelectronics
2,127 pages
FlashcatUSB Manual
No ratings yet
FlashcatUSB Manual
39 pages
Basic Software App Development Lab Guide
No ratings yet
Basic Software App Development Lab Guide
6 pages
User Manual To LPC Controllers
0% (1)
User Manual To LPC Controllers
709 pages
LPC2378 PDF
No ratings yet
LPC2378 PDF
709 pages
Rm0432 Stm32l4 Series Advanced Armbased 32bit Mcus Stmicroelectronics
No ratings yet
Rm0432 Stm32l4 Series Advanced Armbased 32bit Mcus Stmicroelectronics
2,300 pages
PSD834 F 2
No ratings yet
PSD834 F 2
129 pages
RM0440 Stm32g4 Series Advanced Armbased 32bit Mcus Stmicroelectronics
No ratings yet
RM0440 Stm32g4 Series Advanced Armbased 32bit Mcus Stmicroelectronics
2,138 pages
JD51单片机sst89e58数据手册
No ratings yet
JD51单片机sst89e58数据手册
79 pages
Fundamentals of MCUs Session 1
No ratings yet
Fundamentals of MCUs Session 1
31 pages
DM00224583 - Reference Manual
No ratings yet
DM00224583 - Reference Manual
1,896 pages
Flash Programming for SPC560xx Devices
No ratings yet
Flash Programming for SPC560xx Devices
20 pages
DM00124865 - RM0385 - Reference Manual
No ratings yet
DM00124865 - RM0385 - Reference Manual
1,657 pages
USB Thumb Drive: Designer Reference Manual
No ratings yet
USB Thumb Drive: Designer Reference Manual
26 pages
FreeScale Bootloader
100% (2)
FreeScale Bootloader
21 pages
Rm0394 Stm32l41xxx42xxx43xxx44xxx45xxx46xxx Advanced Armbased 32bit Mcus Stmicroelectronics
No ratings yet
Rm0394 Stm32l41xxx42xxx43xxx44xxx45xxx46xxx Advanced Armbased 32bit Mcus Stmicroelectronics
1,600 pages
Serialflash PDF
No ratings yet
Serialflash PDF
39 pages
Stmicroelectronics cd00002452-1204946
No ratings yet
Stmicroelectronics cd00002452-1204946
130 pages
stm32f7 Reference Manual
No ratings yet
stm32f7 Reference Manual
1,709 pages
Rm0394 Stm32l41xxx42xxx43xxx44xxx45xxx46xxx Advanced Armbased 32bit Mcus Stmicroelectronics
No ratings yet
Rm0394 Stm32l41xxx42xxx43xxx44xxx45xxx46xxx Advanced Armbased 32bit Mcus Stmicroelectronics
1,628 pages
LPC2148 Microcontroller User Manual
No ratings yet
LPC2148 Microcontroller User Manual
5 pages
Manual Completo ARM STM32F746ZG
No ratings yet
Manual Completo ARM STM32F746ZG
1,671 pages
FlashcatUSB User's Guide Overview
No ratings yet
FlashcatUSB User's Guide Overview
39 pages
En DM00124865 PDF
No ratings yet
En DM00124865 PDF
1,724 pages
MX25 L2005 Ver 14
No ratings yet
MX25 L2005 Ver 14
40 pages
25L2005
No ratings yet
25L2005
40 pages
FlashcatUSB Manual
No ratings yet
FlashcatUSB Manual
39 pages
Features: 8M-Bit (8M X 1) Cmos Serial Flash Eeprom
No ratings yet
Features: 8M-Bit (8M X 1) Cmos Serial Flash Eeprom
24 pages
Gettingstartedrflasher
No ratings yet
Gettingstartedrflasher
23 pages
PCI-to-PCI Bridge: Product Features
No ratings yet
PCI-to-PCI Bridge: Product Features
100 pages
BlackcatUSB Manual
No ratings yet
BlackcatUSB Manual
26 pages
Dm00224583 Stm32f7 Series Advanced Armbased Mcus Stmicroelectronics
No ratings yet
Dm00224583 Stm32f7 Series Advanced Armbased Mcus Stmicroelectronics
1,942 pages
8-Bit PIC® MCU Bootloader Code Generator: A Simple Way To Add Remote Update Capability To Your Application
No ratings yet
8-Bit PIC® MCU Bootloader Code Generator: A Simple Way To Add Remote Update Capability To Your Application
2 pages
Rm0434 Multiprotocol Wireless 32bit Mcu Armbased Cortexm4 With Fpu Bluetooth Lowenergy and 802154 Radio Solution Stmicroelectronics
No ratings yet
Rm0434 Multiprotocol Wireless 32bit Mcu Armbased Cortexm4 With Fpu Bluetooth Lowenergy and 802154 Radio Solution Stmicroelectronics
1,530 pages
1M-Bit CMOS Serial Flash Memory MX25L1005
No ratings yet
1M-Bit CMOS Serial Flash Memory MX25L1005
40 pages
MC68HC912DG128
No ratings yet
MC68HC912DG128
452 pages
Lab 2: Developing and Debugging C Programs in Codewarrior For The Hcs12 Microcontroller
100% (1)
Lab 2: Developing and Debugging C Programs in Codewarrior For The Hcs12 Microcontroller
12 pages
Writing A Flash Programming Algorithm For Unsupported Devices
No ratings yet
Writing A Flash Programming Algorithm For Unsupported Devices
18 pages
Ucos + Arm
No ratings yet
Ucos + Arm
33 pages
An 12384
No ratings yet
An 12384
18 pages
16-Bit MCU With MAC Unit, 512 Kbyte Flash Memory and 18 Kbyte RAM
No ratings yet
16-Bit MCU With MAC Unit, 512 Kbyte Flash Memory and 18 Kbyte RAM
239 pages
ST10F280
No ratings yet
ST10F280
239 pages
UM11442 NXP Wi Fi and Bluetooth Demo Applications For I.mx RT Platforms User Guide
No ratings yet
UM11442 NXP Wi Fi and Bluetooth Demo Applications For I.mx RT Platforms User Guide
225 pages
I.mx RT1170 Manufacturing User's Guide
No ratings yet
I.mx RT1170 Manufacturing User's Guide
44 pages
MCUXpresso SDK Azure RTOS Release Notes
No ratings yet
MCUXpresso SDK Azure RTOS Release Notes
15 pages
Aws Ota User Guide
No ratings yet
Aws Ota User Guide
62 pages
Getting Started With MCUXpresso SDK For MIMXRT1170-EVK
No ratings yet
Getting Started With MCUXpresso SDK For MIMXRT1170-EVK
49 pages
PetaLinux 2023.2 OS Package List
No ratings yet
PetaLinux 2023.2 OS Package List
20 pages
Wazuh Guide
No ratings yet
Wazuh Guide
8 pages
MANUAL
No ratings yet
MANUAL
19 pages
Karbonn Phone Specs Overview
No ratings yet
Karbonn Phone Specs Overview
11 pages
SAP Security & User Management Guide
100% (1)
SAP Security & User Management Guide
42 pages
Mastering Android NDK Development Guide
No ratings yet
Mastering Android NDK Development Guide
25 pages
Toshiba 57H81
No ratings yet
Toshiba 57H81
96 pages
UX Design Proposal for Brands
No ratings yet
UX Design Proposal for Brands
7 pages
Use of BRM Flex Hones in Preparation of 4 Cycle Kart Engines
No ratings yet
Use of BRM Flex Hones in Preparation of 4 Cycle Kart Engines
4 pages
Assignment 2 DBD261
No ratings yet
Assignment 2 DBD261
2 pages
CS Unit - 4
No ratings yet
CS Unit - 4
11 pages
LDM Implementation M&E Plan: Inputs and Activities
0% (1)
LDM Implementation M&E Plan: Inputs and Activities
2 pages
Computer Science - Dr. Swati Sherekar
No ratings yet
Computer Science - Dr. Swati Sherekar
38 pages
Harshitha Resume
No ratings yet
Harshitha Resume
2 pages
Bayu Reksa: Strategic Communication Profile
No ratings yet
Bayu Reksa: Strategic Communication Profile
1 page
Ansi Asabe S493.1 Jul2003 (R2008)
No ratings yet
Ansi Asabe S493.1 Jul2003 (R2008)
6 pages
Subject: Reply of Charge Sheet and Statement of Allegation
100% (2)
Subject: Reply of Charge Sheet and Statement of Allegation
2 pages
Digital Marketing Internship Offer
No ratings yet
Digital Marketing Internship Offer
3 pages
Smart Car Parking System Using Iot
No ratings yet
Smart Car Parking System Using Iot
7 pages
TSP129897 Wiring PDF
No ratings yet
TSP129897 Wiring PDF
8 pages
Organization: Structure and Culture (Chapter-3)
No ratings yet
Organization: Structure and Culture (Chapter-3)
23 pages
CS-2 User Manual: Operator Passwords
No ratings yet
CS-2 User Manual: Operator Passwords
80 pages
Lesson 09 - Develop Responsive Web Design
No ratings yet
Lesson 09 - Develop Responsive Web Design
27 pages
(Ebook) Core Data Mastery in SwiftUI by No Author - The Latest Updated Ebook Version Is Ready For Download
No ratings yet
(Ebook) Core Data Mastery in SwiftUI by No Author - The Latest Updated Ebook Version Is Ready For Download
83 pages
Aayu Dewalekar
No ratings yet
Aayu Dewalekar
1 page
LS Matasol ACB - Technical+Manual - E PDF
No ratings yet
LS Matasol ACB - Technical+Manual - E PDF
156 pages
WRE54G Manual
No ratings yet
WRE54G Manual
44 pages
Lab 8 Electronics 2
No ratings yet
Lab 8 Electronics 2
5 pages
Applications Development & Emerging Tech
No ratings yet
Applications Development & Emerging Tech
3 pages
IB Business Management Section C Sample
83% (12)
IB Business Management Section C Sample
1 page
Day-6-3 Comsearch MW Class NTIA 19-311 Sept 2019
No ratings yet
Day-6-3 Comsearch MW Class NTIA 19-311 Sept 2019
66 pages

MCU Flashloader Reference Manual

Uploaded by

MCU Flashloader Reference Manual

Uploaded by

MCUFLSHLDRRM

MCU Flashloader Reference Manual

1.3 Block diagram

User guide Rev. 13 — 30 September 2022

Figure 1. Block diagram

1.4 Features supported

Here are some of the features supported by the MCU flashloader:

1.5 Components supported

Components for the flashloader firmware:

User guide Rev. 13 — 30 September 2022

User guide Rev. 13 — 30 September 2022

2 MCU Flashloader protocol API

2.2 Command with no data phase

Figure 2. Command with no data phase

User guide Rev. 13 — 30 September 2022

2.3 Command with incoming data phase

The protocol for a command with incoming data phase contains:

Figure 3. Command with incoming data phase

User guide Rev. 13 — 30 September 2022

2.4 Command with outgoing data phase

The protocol for a command with an outgoing data phase contains:

User guide Rev. 13 — 30 September 2022

Final Data Packet

Figure 4. Command with outgoing data phase

User guide Rev. 13 — 30 September 2022

3 Flashloader packet types

3.2 Framing packet

Table 1. Framing packet format

User guide Rev. 13 — 30 September 2022

Table 2. Special framing packet format

Table 3. packetType field

3.3 CRC16 algorithm

Table 4. XMODEM charactertistics

uint16_t crc16_update(const uint8_t * src, uint32_t lengthInBytes)

User guide Rev. 13 — 30 September 2022

3.4 Ping packet

Table 5. Ping packet format

Figure 5. Ping Packet Protocol Sequence

User guide Rev. 13 — 30 September 2022

3.5 Ping response packet

Table 6. Ping Response packet format

3.6 Command packet

Table 7. Command packet format

Table 8. Command header format

User guide Rev. 13 — 30 September 2022

Table 9. Command Tags

Table 10. Response Tags

User guide Rev. 13 — 30 September 2022

ParameterCount: The number of parameters included in the command packet.

3.7 Response packet

Table 11. GenericResponse parameters

GetPropertyResponse: The GetPropertyResponse packet is sent by the

Table 12. GetPropertyResponse parameters

ReadMemoryResponse: The ReadMemoryResponse packet is sent by

User guide Rev. 13 — 30 September 2022

Table 13. ReadMemoryResponse Parameters

FlashReadOnceResponse:The FlashReadOnceResponse packet is sent by

Table 14. FlashReadOnceResponse Parameters

GenerateKeyBlobResponse: The GenerateKeyBlobResponse packet is sent

Table 15. GenerateKeyBlobResponse Parameters

4 MCU Flashloader command API

User guide Rev. 13 — 30 September 2022

For a list of status codes returned by MCU flashloader, see Appendix A.

4.2 GetProperty command

Table 16. Parameters for GetProperty command

GetProperty: Property tag = 0x01

Figure 6. Protocol sequence for GetProperty command

Table 17. GetProperty packet format example

User guide Rev. 13 — 30 September 2022

Table 17. GetProperty packet format example...continued

The GetProperty command has no data phase.

Table 18. GetProperty response packet format example

4.3 SetProperty command

Table 19. Parameters for SetProperty command

User guide Rev. 13 — 30 September 2022

Table 19. Parameters for SetProperty command...continued