Recovering the FRDM-K64F Bootloader, or: Cloning the Program of a Microcontroller

The Freescale FRDM-K64F and FRDM-K22F have a different OpenSDA (v2) firmware on it: unlike the earlier (v1), that firmware is open and not protected which is a great thing. However, it has the disadvantage if you use the wrong SWD/JTAG header on your board, the bootloader on the K20 OpenSDA microcontroller is gone 😦

Two SWD Headers on FRDM-K64F Board

Two SWD Headers on FRDM-K64F Board

This happened to a student who did not pay enough attention which programming header to use (I admit: it could have happened to me too). So how to recover the bootloader on that board? I checked the Freescale Freedom board pages, but there is no bootloader binary or project to download :-(. But I had another board: why not copy that firmware to recover the firmware on the other board?

  1. Retrieve the image of a working board
  2. Program it to the broken board

πŸ’‘ If you do not have a second board with a good firmware on it: don’t worry and read the summary at the end.

I’m using here a Segger J-Link with Kinetis Design Studio, but same steps should be applicable for other debug connections or IDE too, with the same principle.

❗ The steps here work only for the new OpenSDA v2 boards (e.g. FRDM-K64F), and not for the previous ones (e.g. FRDM-KL25Z).

Project for K20DX128

MK20DX128 OpenSDA Device on FRDM-KL25Z

MK20DX128 OpenSDA Device on FRDM-KL25Z

First I create a project for the OpenSDA device present on the board, which is a Kinetis K20DX128:

Project to Program the K20DX128

Project to Program the K20DX128

This project allows me to write normal applications for the K20, and I can use to copy and past firmware files between boards.

Attach Debug Configuration

For that project, I’m creating an ‘attach’ configuration: I want the debugger to connect to a working board, without changing the board content. With the Segger debug configuration I use the following settings:

In the debugger tab, I specify the microcontroller:

Debugger Attach Configuration (Segger)

Debugger Attach Configuration (Segger)

The most important setting is in the ‘Startup’ tab: here I need to disable ‘Load Executable’:

Debugger Attach Startup Configuration

Debugger Attach Startup Configuration

The other settings (breakpoint setting, continue) are more optional.

❗ There is a known issue with the Segger connection that somehow aΒ  true ‘attach’ to the target is not working (attaching means that the target keeps running as normal). What happens is that after connection, the Segger J-Link will reset the target, even with ‘Pre-run reset and halt’ disabled. I have found a solution for this, but it does not matter in this use case.

Grabbing the Firmware

With this ‘attach’ configuration, I ‘debug’ now the K20 of my working board.

Grabbing Firmware from the Board

Grabbing Firmware from the Board

Because I don’t download anything, that firmware is not touched. It resets to the bootloader vector table:

Stopped Bootloader

Stopped Bootloader

Now I use the Memory view to add a new memory monitor, starting at address 0x0:

Added Memory Monitor

Added Memory Monitor

Then export the memory (see “Memory is everything“):

Exporting Memory from Memory View

Exporting Memory from Memory View

I use the S19 file format (see “S-Record, Intel Hex and Binary Files“), and specify the memory I want to dump:

Dumping the Memory as S19 File

Dumping the Memory as S19 File

For the bootloader, only the first 16KByte (or better 64 KByte) would be necessary, but I’m free to dump the memory. If I dump the full memory, then I have not only the bootloader, but as well the application loaded on the K20.

Exporting the memory will take a few seconds to complete. Then terminate the debug session. Now I have an image copy of what is on the working K20. In the next step I’m going to program it on my broken board.

Copy the Firmware to the Other Board

To program the firmware to the other board, I create again a launch configuration. This is a normal configuration, but instead the normal application file, I specify the S19 file I just have copied from the previous board:

Using dumped file to program to other board

Using dumped file to program to other board

And with this, I debug/download/program my broken board:

Copy of the Firmware to the broken board

Copy of the Firmware to the broken board

and indeed, I have a bootloader again πŸ™‚ πŸ™‚ πŸ™‚

Summary

The bootloader on the new FRDM boards (FRDM-K64F, FRDM-K22F) is not protected which is a good thing. But in case the bootloader is corrupted, I need a way to restore it. One way I have shown in this article is to clone and copy the bootloader (and the application, if you want) from an existing board. That method is of course handy as well if you want to program multiple boards with the same S-Record file too. Or if you want to make a backup of a firmware on a board.

The only problem is: what if you have destroyed the firmware on your board, and you do not have a second board? I only have found out after writing this article that indeed

Freescale has attached the bootloader binary at the end of this community post:Β https://community.freescale.com/docs/DOC-100720. Grab that .axf (it is infact an .elf file) file and program it instead of the .s19 file :-). However, it seems that the most recent file does not work any more? Therefore I have posted bootloader images on GitHub here:

Happy Recovering πŸ™‚

Advertisements

23 thoughts on “Recovering the FRDM-K64F Bootloader, or: Cloning the Program of a Microcontroller

  1. Hi, Erich,

    Do you have some demo about how to use USB Generic HID ? my MCU is K20D70.
    I use PC talk to MCU with USB HID, and display curve on pc
    Thanks a lot

    Like

  2. Hi Erich
    Thanks for the post, it’s conforting knowing that it happened to somebody else. πŸ˜€
    I tried to flash the file from that community forum that you mentioned, but it didn’t work at all. When we pluged the board, the SDA Led started to blink and no Bootloader were recognized at the computer. Could you maybe provide that .s19 file you exported from the working board? I see no other way to recover mine…
    Thanks for all.

    Like

  3. Pingback: How to Recover the OpenSDA V2.x Bootloader | MCU on Eclipse

  4. Hi Erich,

    Should this process also work with the J-Link EDU (8.08.90) + 9-pin Cortex-M Adapter (8.06.02)? We don’t currently have a J-Link debugger, and would purchase one only for the need of recovering corrupted K64F boards. The J-Link EDU does not include J-Flash, and I’m not certain if it is required.

    Many Thanks,

    Troy

    Like

  5. Hello, Erich!

    I’m starter of mbed. And I appreciate of your blog.
    BTW I trying to recover my mbed board. But my eclipse setting is so far from yours.
    1. How can I setting my eclipse enviroment?
    2. When I create project, it is just empty. How can I make empty archieve as you did?

    Many thanks

    Walter

    Like

    • 1) You need an Eclipse with an ARM toolchain, e.g. use Kinetis Design Studio (http://www.nxp.com/kds) or the MCUXpresso IDE.
      2) You don’t need an empty archive. All what you need is a project with the toolchain (especially debugger) setup. You can get this easily say with Kinetis Design Studio.

      Like

  6. Hello , Erich!!

    I try to copy FRDM-KL43Z. But I got erro message.
    ‘J-Link GDB Server failed: Could not connect to target. Please check if target is powered and if ribbon cable is plugged properly. For more details, see the JLinkGDBServerCL.exe console’

    I use [J-Lind edu] and KDS verersin 3.2.0. I connected through JTAG.

    FRDM-KL43Z is protected?

    sincere,
    Walter

    Like

  7. Hello Erich,

    I have one more question. I think I bother you a lot. Sorry about that first.
    BTW, I extrated bootloader from FRDM-KL43Z board.(.s19 file) And I try to install broken board. I imported dump file and some hex code was changed to red. But when I click the resume button all changed bits are setted 0. These symtoms happen when I flash the bootloader on my broken board. Is there way to fix the code after I import bootloader?

    I use KDS 3.2.0 and J-Link

    Sincere,
    Walter

    Like

    • The bootloader on the OpenSDA/K20 V1.x of the FRDM-KL43Z board is closed and secured by the flash protection. You cannot change the V1.x bootloader. You only can change the V2.x bootloader as it is present on the FRDM-K64F.

      Like

What do you think?

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google+ photo

You are commenting using your Google+ account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

w

Connecting to %s