Execute from non-ITCM location for NXP MIMXRT1180 CM7 core

[javad123javad]

Hello,

I'm working on running a Zephyr application for the CM7 core on the MIMXRT1180_EVK board. The application binary is approximately 1MB, which is larger than the ITCM region (256KB), so flashing it to ITCM is not an option.

Since the board includes external flash, which is typically used by the CM33 core, my goal is to:

Store the CM7 application in a region of external flash, and

Have the CM33 core boot the CM7 core from this external flash region (instead of ITCM).

To support this, I modified the board’s device tree as follows:

chosen {
    zephyr,sram = &hyperram0;
    zephyr,dtcm = &dtcm;
    zephyr,itcm = &itcm;
    zephyr,flash-controller = &w25q128jw;
    zephyr,flash = &storage_partition; #<== it was zephyr,flash = &itcm
    zephyr,console = &lpuart12;
    zephyr,shell-uart = &lpuart12;
    zephyr,canbus = &flexcan3;
    nxp,m7-partition = &slot1_partition;
};

However, this setup is not working as expected—the CM7 core does not boot from external flash.

Could you advise on what might be missing or incorrect in this configuration? Are there additional steps required (e.g., boot configuration, linker script updates, CM33 startup code) to enable this boot flow?

[RobbieKhan]

@javad123javad, I didn't work with IMXRT1180, but on IMXRT1170 in order to boot it from external QSPI Flash W25Q512, you should use the following:

chosen {
    zephyr,sram = &sdram0;
    zephyr,dtcm = &dtcm;
    zephyr,itcm = &itcm;
    zephyr,flash-controller = &w25q512jv;
    zephyr,flash = &w25q512jv;
    zephyr,code-partition = &slot0_partition;
    zephyr,cpu1-region = &ocram;
    zephyr,ipc = &mailbox_a;
    zephyr,console = &cdc_acm_uart0;
};

[javad123javad]

@javad123javad, I didn't work with IMXRT1180, but on IMXRT1170 in order to boot it from external QSPI Flash W25Q512, you should use the following:

chosen {
    zephyr,sram = &sdram0;
    zephyr,dtcm = &dtcm;
    zephyr,itcm = &itcm;
    zephyr,flash-controller = &w25q512jv;
    zephyr,flash = &w25q512jv;
    zephyr,code-partition = &slot0_partition;
    zephyr,cpu1-region = &ocram;
    zephyr,ipc = &mailbox_a;
    zephyr,console = &cdc_acm_uart0;
};

Hi @RobbieKhan
Thanks for your response, I have already modified dts for CM7 core like as you mentioned:

chosen {
                zephyr,sram = &dtcm;
                zephyr,dtcm = &dtcm;
                zephyr,itcm = &itcm;
                zephyr,flash-controller = &w25q128jw;
                zephyr,flash = &w25q128jw;
                zephyr,console = &lpuart12;
                zephyr,shell-uart = &lpuart12;
                zephyr,canbus = &flexcan3;
                nxp,m7-partition = &slot1_partition;
        };

However, it seems that the linker is mapped the binary somewhere out of region. The output of readelf:

Elf file type is EXEC (Executable file)
Entry point 0x280015d9
There are 7 program headers, starting at offset 52

Program Headers:
  Type           Offset   VirtAddr   PhysAddr   FileSiz MemSiz  Flg Align
  EXIDX          0x004730 0x28004618 0x50727618 0x00008 0x00008 R   0x4
  LOAD           0x000000 0x20000028 0x48723028 0x00000 0x010d8 RW  0x40
  LOAD           0x000118 0x28000000 0x50723000 0x04f54 0x04f54 RWE 0x8
  LOAD           0x00506c 0x28004f54 0x50727f54 0x01014 0x030ac RWE 0x4
  LOAD           0x006080 0x20000000 0x5072b000 0x00022 0x00022 RW  0x4
  LOAD           0x0060a2 0x28008022 0x5072b022 0x00004 0x00004 R   0x1
  TLS            0x00506c 0x28004f54 0x50727f54 0x00000 0x00004 R   0x4

While, the FLASH is mapped to 0x38000000 for CM33 and 0x28000000 for CM7. When trying to flash CM7 image, it shows the following error:

Nc: Flash variant 'iMXRT1180_SFDP_FlexSPI1_A_QSPI Mar 25 2025 17:32:56' detected (16MB = 256*64K at 0x28000000)
Nc: Closing flash driver MIMXRT1180_SFDP_FlexSPI1_A_QSPI.cfx
Nc: Inspected v.2 External Flash Device on SPI using SFDP JEDEC ID MIMXRT1180_SFDP_FlexSPI1_A_QSPI_S.cfx
Nc: Image 'iMXRT1180_SFDP_FlexSPI1_A_QSPI (Secure) Mar 25 2025 17:33:26'
Nc: Opening flash driver MIMXRT1180_SFDP_FlexSPI1_A_QSPI_S.cfx
Nc: VECTRESET requested, but not supported on ARMv8-M CPUs. Using SOFTRESET instead.
Nc: Using SOFT reset to run the flash driver
Nc: Flash variant 'iMXRT1180_SFDP_FlexSPI1_A_QSPI (Secure) Mar 25 2025 17:33:26' detected (16MB = 256*64K at 0x38000000)
Nc: Closing flash driver MIMXRT1180_SFDP_FlexSPI1_A_QSPI_S.cfx
Pc: ( 65) Chip Setup Complete
Pc: ( 70) License Check Complete
Nt: Loading 'zephyr.elf' ELF 0x50723000 len 0x5F68
Ed:05: File 'zephyr.elf' load failure: Ef(11). No flash configured at the specified address.
Nt: Loading 'zephyr.elf' ELF 0x5072B000 len 0x26
Ed:05: File 'zephyr.elf' load failure: Ef(11). No flash configured at the specified address.
Pc: (100) Target Operation Failed
CRITICAL: Critical error
ERRMSG: Exception: Flash operation exited with code 1

[RobbieKhan]

@javad123javad, can you check if CONFIG_BOOT_FLEXSPI_NOR is present in build\zephyr\include\generated\zephyr\autoconf.h?

[javad123javad]

@RobbieKhan For the CM33 application, it is enabled, but for the CM7 application, it is not. When I add it to the board-specific configuration file, it still doesn't get enabled. (I'm trying to build the mbox dual-core application and run it from Flash)

[DerekSnell]

Hi @javad123javad ,
Checking the current support for the RT1180, it does not support this use-case with the CM7 executing from flash. I found some snippets in the source that expect the code to be in ITCM. For example, for the M7 CONFIG_BUILD_OUTPUT_ADJUST_LMA is set expecting the code to be relocated to ITCM. This LMA is likely causing the errors you reported. And in soc.c, the CM33 copies memory for the CM7 image before initializing the CM7. I am not sure yet what else is needed to enable your use-case.

I will check if NXP plans to enable this use-case for the CM7 executing directly from external flash. Best regards

[javad123javad]

@DerekSnell I have modified mimxrt1180_evk/Kconfig.defconfig to remove the extra offset that caused the above issue as follows:

config BUILD_OUTPUT_ADJUST_LMA
        default "($(dt_chosen_reg_addr_hex,$(DT_CHOSEN_IMAGE_M7)) - \
        $(dt_node_reg_addr_hex,/soc/itcm@0))"

Now, the CM7 image is mapped to the proper location in the FLASH:

Program Headers:
  Type           Offset   VirtAddr   PhysAddr   FileSiz MemSiz  Flg Align
  EXIDX          0x00481c 0x28004704 0x28727704 0x00008 0x00008 R   0x4
  LOAD           0x000000 0x04000028 0x04723028 0x00000 0x010d8 RW  0x40
  LOAD           0x000118 0x28000000 0x28723000 0x05040 0x05040 RWE 0x8
  LOAD           0x005158 0x28005040 0x28728040 0x01014 0x02fc0 RWE 0x4
  LOAD           0x00616c 0x04000000 0x2872b000 0x00022 0x00022 RW  0x4
  LOAD           0x00618e 0x28008022 0x2872b022 0x00004 0x00004 R   0x1
  TLS            0x005158 0x28005040 0x28728040 0x00000 0x00004 R   0x4

I have also modified the imxrt118x/soc.c to copy it into the RAM directly, by removing the extra ITCM address:

#define MEMCPY_SEGMENT(n, _)                                                    \
        memcpy((uint32_t *)(((SEGMENT_LMA_ADDRESS_ ## n) - ADJUSTED_LMA)),      \
                (uint32_t *)(SEGMENT_LMA_ADDRESS_ ## n),                        \
                (SEGMENT_SIZE_ ## n))
#endif

Now, the CM33 core starts and runs, however, the CM7 core is not running.
When I debug CM7 application, it can not load the image from flash:

Pc: (100) Target Ready
INFO: [stub (3333)] Na: GDB nonstop mode disabled (using allstop mode)
0x20000008 in __stdout ()
INFO: [stub (3333)] Wc: Zephyr stack backtrace is disabled
Loading section rom_start, size 0x3fc lma 0x28000000
Load failed
INFO: [stub (3333)] Nc: Using memory from core 2 after searching for a good core
INFO: [stub (3333)] Pc: ( 30) Emulator Connected
INFO: [stub (3333)] Pc: ( 40) Debug Halt
INFO: [stub (3333)] Pc: ( 50) CPU ID
INFO: [stub (3333)] Nc: debug interface type      = CoreSight DP (DAP DP ID 5BA02477) over SWD TAP 0
Nc: processor type            = Cortex-M7 (CPU ID 00000C27) on DAP AP 2
Nc: number of h/w breakpoints = 8
Nc: number of flash patches   = 0
Nc: number of h/w watchpoints = 4
Failed to reset to initial execution state - Ec(06). No image address available for soft reset.

Is there anything else that should be done? Or is it a must that all applications should be started from ITCM?

[DerekSnell]

Is there any way to run the CM7 application if the binary size exceeds the ITCM size? For example, can it be copied from FLASH to RAM and executed from there—assuming it cannot be run directly from FLASH?

Hi @javad123javad ,
At the moment, no. Currently the Zephyr support for this board assumes the M7 code executes from ITCM. Executing from somehwere else is a feature that will need to be added. Best regards

[javad123javad]

Is there any way to run the CM7 application if the binary size exceeds the ITCM size? For example, can it be copied from FLASH to RAM and executed from there—assuming it cannot be run directly from FLASH?

Hi @javad123javad , At the moment, no. Currently the Zephyr support for this board assumes the M7 code executes from ITCM. Executing from somehwere else is a feature that will need to be added. Best regards

Thanks @DerekSnell
Two final question:

• Is there any application note, samples (non-Zephyr) from NXP that demonstrates how to do that?
• Is there any plan when NXP will add this feature?

[DerekSnell]

Hi @javad123javad ,
NXP is looking into this use-case. There is a non-Zephyr example document for executing the CM7 code from flash. However, NXP believes we can simplify this for Zephyr: choose the memory location with devictree, and have the CM33 configure the TRDC and boot the CM7 from flash.

When this is implemented, we will upstream and share the pull request link here. Best regards

[javad123javad]

Hi @javad123javad , NXP is looking into this use-case. There is a non-Zephyr example document for executing the CM7 code from flash. However, NXP believes we can simplify this for Zephyr: choose the memory location with devictree, and have the CM33 configure the TRDC and boot the CM7 from flash.

When this is implemented, we will upstream and share the pull request link here. Best regards

Hi @DerekSnell,
Thank you for your continued support.

We've also tested some non-Zephyr samples for this scenario. Despite the CM7 kickoff address correctly pointing to the image in flash and TRDC being enabled, CM7 still fails to start—unless we copy the entire image into ITCM, which isn't feasible for larger binaries.
What we do so far is as follows:
Change the CM7 Kick off address from 0x00 to the load address in the flash

#define CORE1_KICKOFF_ADDRESS SEGMENT_LMA_ADDRESS_1
....
 Prepare_CM7(CORE1_KICKOFF_ADDRESS);

Then, Configuring the TRDC to XIP before CM7 being started:

static int second_core_boot(void)
{
        // First configure TRDC
        APP_SetTrdcGlobalConfig();
        /*
         * RT1180 Specific CM7 Kick Off operation
         */
        /* Trigger S401 */
        while ((MU_RT_S3MUA->TSR & MU_TSR_TE0_MASK) == 0) {
                ; } /* Wait TR empty */
        MU_RT_S3MUA->TR[0] = 0x17d20106;
        while ((MU_RT_S3MUA->RSR & MU_RSR_RF0_MASK) == 0) {
                ; } /* Wait RR Full */
        while ((MU_RT_S3MUA->RSR & MU_RSR_RF1_MASK) == 0) {
                ; } /* Wait RR Full */

        /* Response from ELE must be always read */
        __attribute__((unused)) volatile uint32_t result1, result2;
        result1 = MU_RT_S3MUA->RR[0];
        result2 = MU_RT_S3MUA->RR[1];

        /* Deassert Wait */
        BLK_CTRL_S_AONMIX->M7_CFG =
                (BLK_CTRL_S_AONMIX->M7_CFG & (~BLK_CTRL_S_AONMIX_M7_CFG_WAIT_MASK)) |
                BLK_CTRL_S_AONMIX_M7_CFG_WAIT(0);

        return 0;
}

In this case, the CM7 kicks off, however, when we comment out the copy to RAM macro:

//        LISTIFY(SEGMENT_NUM, MEMCPY_SEGMENT, (;));

It won't start. It seems that, even though it is XIP, copying to RAM is still required.

Furthermore, switching zephyr,flash = &itcm to zephyr,flash = &w25q128jw results in final images that are not writable, as it then points to an incorrect address.

[javad123javad]

@DerekSnell Also, by the way—do you happen to know if there's an estimated timeline for the patch from NXP?
Furthermore, is running from External RAM (code and data in RAM ) for CM7 also considered for this patch?

We're looking forward to your upstreaming and the patch.
Best Regards,
Javad