The Freescale FRDM-K64F and FRDM-K22F have a different OpenSDA (v2) firmware on it: unlike the earlier (v1), that firmware is open and not protected which is a great thing. However, it has the disadvantage if you use the wrong SWD/JTAG header on your board, the bootloader on the K20 OpenSDA microcontroller is gone 😦
This happened to a student who did not pay enough attention which programming header to use (I admit: it could have happened to me too). So how to recover the bootloader on that board? I checked the Freescale Freedom board pages, but there is no bootloader binary or project to download :-(. But I had another board: why not copy that firmware to recover the firmware on the other board?
- Retrieve the image of a working board
- Program it to the broken board
💡 If you do not have a second board with a good firmware on it: don’t worry and read the summary at the end.
I’m using here a Segger J-Link with Kinetis Design Studio, but same steps should be applicable for other debug connections or IDE too, with the same principle.
❗ The steps here work only for the new OpenSDA v2 boards (e.g. FRDM-K64F), and not for the previous ones (e.g. FRDM-KL25Z).
Project for K20DX128
First I create a project for the OpenSDA device present on the board, which is a Kinetis K20DX128:
This project allows me to write normal applications for the K20, and I can use to copy and past firmware files between boards.
Attach Debug Configuration
For that project, I’m creating an ‘attach’ configuration: I want the debugger to connect to a working board, without changing the board content. With the Segger debug configuration I use the following settings:
In the debugger tab, I specify the microcontroller:
The most important setting is in the ‘Startup’ tab: here I need to disable ‘Load Executable’:
The other settings (breakpoint setting, continue) are more optional.
❗ There is a known issue with the Segger connection that somehow a true ‘attach’ to the target is not working (attaching means that the target keeps running as normal). What happens is that after connection, the Segger J-Link will reset the target, even with ‘Pre-run reset and halt’ disabled. I have found a solution for this, but it does not matter in this use case.
Grabbing the Firmware
With this ‘attach’ configuration, I ‘debug’ now the K20 of my working board.
Because I don’t download anything, that firmware is not touched. It resets to the bootloader vector table:
Now I use the Memory view to add a new memory monitor, starting at address 0x0:
Then export the memory (see “Memory is everything“):
I use the S19 file format (see “S-Record, Intel Hex and Binary Files“), and specify the memory I want to dump:
For the bootloader, only the first 16KByte (or better 64 KByte) would be necessary, but I’m free to dump the memory. If I dump the full memory, then I have not only the bootloader, but as well the application loaded on the K20.
Exporting the memory will take a few seconds to complete. Then terminate the debug session. Now I have an image copy of what is on the working K20. In the next step I’m going to program it on my broken board.
Copy the Firmware to the Other Board
To program the firmware to the other board, I create again a launch configuration. This is a normal configuration, but instead the normal application file, I specify the S19 file I just have copied from the previous board:
And with this, I debug/download/program my broken board:
and indeed, I have a bootloader again 🙂 🙂 🙂
Summary
The bootloader on the new FRDM boards (FRDM-K64F, FRDM-K22F) is not protected which is a good thing. But in case the bootloader is corrupted, I need a way to restore it. One way I have shown in this article is to clone and copy the bootloader (and the application, if you want) from an existing board. That method is of course handy as well if you want to program multiple boards with the same S-Record file too. Or if you want to make a backup of a firmware on a board.
The only problem is: what if you have destroyed the firmware on your board, and you do not have a second board? I only have found out after writing this article that indeed
Freescale has attached the bootloader binary at the end of this community post: DOC-100720. Grab that .axf (it is infact an .elf file) file and program it instead of the .s19 file :-). However, it seems that the most recent file does not work any more? Therefore I have posted bootloader images on GitHub here: https://github.com/ErichStyger/mcuoneclipse/tree/master/OpenSDA/OpenSDA%20V2.2
Happy Recovering 🙂
Erich, Where did you get the JLINK cable adapter for the tiny JTAG connector on the Freedom?
LikeLike
From Mouser.ch, search for 9-Pin-Cortex-M-Adapter
LikeLike
Hi, Erich,
Do you have some demo about how to use USB Generic HID ? my MCU is K20D70.
I use PC talk to MCU with USB HID, and display curve on pc
Thanks a lot
LikeLike
No, I don’t have this (yet).
LikeLike
Thanks Erich..
Very helpful post.. 🙂
LikeLike
Hi Erich
Thanks for the post, it’s conforting knowing that it happened to somebody else. 😀
I tried to flash the file from that community forum that you mentioned, but it didn’t work at all. When we pluged the board, the SDA Led started to blink and no Bootloader were recognized at the computer. Could you maybe provide that .s19 file you exported from the working board? I see no other way to recover mine…
Thanks for all.
LikeLike
Hi Aline,
Can you try the bootloader s19 file located here?
https://github.com/ErichStyger/mcuoneclipse/tree/master/Examples/KDS/tinyK20/tinyK20_Bootloader/binaries
I hope this helps,
Erich
LikeLike
Awsome, works perfectly! Thanks again =D
LikeLike
Pingback: How to Recover the OpenSDA V2.x Bootloader | MCU on Eclipse
Hi Erich,
Should this process also work with the J-Link EDU (8.08.90) + 9-pin Cortex-M Adapter (8.06.02)? We don’t currently have a J-Link debugger, and would purchase one only for the need of recovering corrupted K64F boards. The J-Link EDU does not include J-Flash, and I’m not certain if it is required.
Many Thanks,
Troy
LikeLike
Hi Troy,
yes, this works with any Segger J-Link, including the EDU version which I have used for this kind of things too.
Erich
LikeLike
Hello, Erich!
I’m starter of mbed. And I appreciate of your blog.
BTW I trying to recover my mbed board. But my eclipse setting is so far from yours.
1. How can I setting my eclipse enviroment?
2. When I create project, it is just empty. How can I make empty archieve as you did?
Many thanks
Walter
LikeLike
1) You need an Eclipse with an ARM toolchain, e.g. use Kinetis Design Studio (http://www.nxp.com/kds) or the MCUXpresso IDE.
2) You don’t need an empty archive. All what you need is a project with the toolchain (especially debugger) setup. You can get this easily say with Kinetis Design Studio.
LikeLike
Hello , Erich!!
I try to copy FRDM-KL43Z. But I got erro message.
‘J-Link GDB Server failed: Could not connect to target. Please check if target is powered and if ribbon cable is plugged properly. For more details, see the JLinkGDBServerCL.exe console’
I use [J-Lind edu] and KDS verersin 3.2.0. I connected through JTAG.
FRDM-KL43Z is protected?
sincere,
Walter
LikeLike
Hi Walter,
did you connect to the OpenSDA or to the J11 header? Keep in minid that you cannot use JTAG, you have to use SWD.
And if you connected to J11, then I would say you have plugged in the cable the wrong way, so it does not sense the 3.3V.
For the header/pin layout see https://mcuoneclipse.com/2012/11/07/jtagswd-debugging-with-the-frdm-kl25z-board/ (it is the same for the FRDM-KL43Z).
I hope this helps,
Erich
LikeLike
Hi Erich!
Thanks!! I used JTAG first, I cannot download it.
Thank you again.
Sincere,
Walter
LikeLike
Hello Erich,
I have one more question. I think I bother you a lot. Sorry about that first.
BTW, I extrated bootloader from FRDM-KL43Z board.(.s19 file) And I try to install broken board. I imported dump file and some hex code was changed to red. But when I click the resume button all changed bits are setted 0. These symtoms happen when I flash the bootloader on my broken board. Is there way to fix the code after I import bootloader?
I use KDS 3.2.0 and J-Link
Sincere,
Walter
LikeLike
The bootloader on the OpenSDA/K20 V1.x of the FRDM-KL43Z board is closed and secured by the flash protection. You cannot change the V1.x bootloader. You only can change the V2.x bootloader as it is present on the FRDM-K64F.
LikeLike
Can i dump memory of mc9s08sh4? using usbdm?
LikeLike
I have not used USBDM recently, but with Eclipse and with any debug connection you can dump the target memory, e.g. see https://mcuoneclipse.com/2012/05/04/dump-my-device-memory/
LikeLike
Hi Erich,
Is there any licensing issues with cloning the bootloader circuit from K64 to a new board design including firmware?
Thank you,
Mike
LikeLike
I meant to say: Is there any licensing issues with cloning the bootloader circuit from FRDM-K64F to a new board design including firmware?
LikeLike
The OpenSDA circuit is ‘open’ so you can integrate it into your own design (altough I did not see any specific licensing clause for the schematics/circuits?).
The firmware is a different topic: the bootloader is open under the mbed license (see https://mcuoneclipse.com/2017/10/29/adding-a-delay-to-the-arm-daplink-bootloader/ and https://github.com/ARMmbed/DAPLink.
The CMSIS-DAP firmware is open too, but the P&E and Segger OpenSDA firmware are closed. Especially the Segger firmware calls out that it cannot be used for custom boards (see https://mcuoneclipse.com/2013/05/16/freedom-board-with-segger-opensda-debug-firmware/).
LikeLike