Recovering the FRDM-K64F Bootloader, or: Cloning the Program of a Microcontroller

Posted on November 10, 2014 by Erich Styger

The Freescale FRDM-K64F and FRDM-K22F have a different OpenSDA (v2) firmware on it: unlike the earlier (v1), that firmware is open and not protected which is a great thing. However, it has the disadvantage if you use the wrong SWD/JTAG header on your board, the bootloader on the K20 OpenSDA microcontroller is gone 😦

Two SWD Headers on FRDM-K64F Board

This happened to a student who did not pay enough attention which programming header to use (I admit: it could have happened to me too). So how to recover the bootloader on that board? I checked the Freescale Freedom board pages, but there is no bootloader binary or project to download :-(. But I had another board: why not copy that firmware to recover the firmware on the other board?

Retrieve the image of a working board
Program it to the broken board

💡 If you do not have a second board with a good firmware on it: don’t worry and read the summary at the end.

I’m using here a Segger J-Link with Kinetis Design Studio, but same steps should be applicable for other debug connections or IDE too, with the same principle.

❗ The steps here work only for the new OpenSDA v2 boards (e.g. FRDM-K64F), and not for the previous ones (e.g. FRDM-KL25Z).

Project for K20DX128

MK20DX128 OpenSDA Device on FRDM-KL25Z

First I create a project for the OpenSDA device present on the board, which is a Kinetis K20DX128:

Project to Program the K20DX128

This project allows me to write normal applications for the K20, and I can use to copy and past firmware files between boards.

Attach Debug Configuration

For that project, I’m creating an ‘attach’ configuration: I want the debugger to connect to a working board, without changing the board content. With the Segger debug configuration I use the following settings:

In the debugger tab, I specify the microcontroller:

Debugger Attach Configuration (Segger)

The most important setting is in the ‘Startup’ tab: here I need to disable ‘Load Executable’:

Debugger Attach Startup Configuration

The other settings (breakpoint setting, continue) are more optional.

❗ There is a known issue with the Segger connection that somehow a true ‘attach’ to the target is not working (attaching means that the target keeps running as normal). What happens is that after connection, the Segger J-Link will reset the target, even with ‘Pre-run reset and halt’ disabled. I have found a solution for this, but it does not matter in this use case.

Grabbing the Firmware

With this ‘attach’ configuration, I ‘debug’ now the K20 of my working board.

Grabbing Firmware from the Board

Because I don’t download anything, that firmware is not touched. It resets to the bootloader vector table:

Stopped Bootloader

Now I use the Memory view to add a new memory monitor, starting at address 0x0:

Added Memory Monitor

Then export the memory (see “Memory is everything“):

Exporting Memory from Memory View

I use the S19 file format (see “S-Record, Intel Hex and Binary Files“), and specify the memory I want to dump:

Dumping the Memory as S19 File

For the bootloader, only the first 16KByte (or better 64 KByte) would be necessary, but I’m free to dump the memory. If I dump the full memory, then I have not only the bootloader, but as well the application loaded on the K20.

Exporting the memory will take a few seconds to complete. Then terminate the debug session. Now I have an image copy of what is on the working K20. In the next step I’m going to program it on my broken board.

Copy the Firmware to the Other Board

To program the firmware to the other board, I create again a launch configuration. This is a normal configuration, but instead the normal application file, I specify the S19 file I just have copied from the previous board:

Using dumped file to program to other board

And with this, I debug/download/program my broken board:

Copy of the Firmware to the broken board

and indeed, I have a bootloader again 🙂 🙂 🙂

Summary

The bootloader on the new FRDM boards (FRDM-K64F, FRDM-K22F) is not protected which is a good thing. But in case the bootloader is corrupted, I need a way to restore it. One way I have shown in this article is to clone and copy the bootloader (and the application, if you want) from an existing board. That method is of course handy as well if you want to program multiple boards with the same S-Record file too. Or if you want to make a backup of a firmware on a board.

The only problem is: what if you have destroyed the firmware on your board, and you do not have a second board? I only have found out after writing this article that indeed

Freescale has attached the bootloader binary at the end of this community post: DOC-100720. Grab that .axf (it is infact an .elf file) file and program it instead of the .s19 file :-). However, it seems that the most recent file does not work any more? Therefore I have posted bootloader images on GitHub here: https://github.com/ErichStyger/mcuoneclipse/tree/master/OpenSDA/OpenSDA%20V2.2

Happy Recovering 🙂

23 thoughts on “Recovering the FRDM-K64F Bootloader, or: Cloning the Program of a Microcontroller”

Bob Kohan on November 11, 2014 at 16:59 said:

Erich, Where did you get the JLINK cable adapter for the tiny JTAG connector on the Freedom?

LikeLike

Reply ↓
- Erich Styger on November 11, 2014 at 17:42 said:
  
  From Mouser.ch, search for 9-Pin-Cortex-M-Adapter
  
  LikeLike
  
  Reply ↓
henry on November 11, 2014 at 17:42 said:

Hi, Erich,

Do you have some demo about how to use USB Generic HID ? my MCU is K20D70.
I use PC talk to MCU with USB HID, and display curve on pc
Thanks a lot

LikeLike

Reply ↓
- Erich Styger on November 11, 2014 at 17:44 said:
  
  No, I don’t have this (yet).
  
  LikeLike
  
  Reply ↓
javerv on November 12, 2014 at 05:51 said:

Thanks Erich..
Very helpful post.. 🙂

LikeLike

Reply ↓
Aline on October 21, 2015 at 12:58 said:

Hi Erich
Thanks for the post, it’s conforting knowing that it happened to somebody else. 😀
I tried to flash the file from that community forum that you mentioned, but it didn’t work at all. When we pluged the board, the SDA Led started to blink and no Bootloader were recognized at the computer. Could you maybe provide that .s19 file you exported from the working board? I see no other way to recover mine…
Thanks for all.

LikeLike

Reply ↓
- Erich Styger on October 21, 2015 at 15:04 said:
  
  Hi Aline,
  Can you try the bootloader s19 file located here?
  https://github.com/ErichStyger/mcuoneclipse/tree/master/Examples/KDS/tinyK20/tinyK20_Bootloader/binaries
  I hope this helps,
  Erich
  
  LikeLike
  
  Reply ↓
  - Aline on October 22, 2015 at 12:29 said:
    
    Awsome, works perfectly! Thanks again =D
    
    LikeLike
    
    Reply ↓
Pingback: How to Recover the OpenSDA V2.x Bootloader | MCU on Eclipse
Troy Lavigne on January 5, 2017 at 15:56 said:

Hi Erich,

Should this process also work with the J-Link EDU (8.08.90) + 9-pin Cortex-M Adapter (8.06.02)? We don’t currently have a J-Link debugger, and would purchase one only for the need of recovering corrupted K64F boards. The J-Link EDU does not include J-Flash, and I’m not certain if it is required.

Many Thanks,

Troy

LikeLike

Reply ↓
- Erich Styger on January 5, 2017 at 18:49 said:
  
  Hi Troy,
  yes, this works with any Segger J-Link, including the EDU version which I have used for this kind of things too.
  Erich
  
  LikeLike
  
  Reply ↓
Walter on February 9, 2018 at 06:35 said:

Hello, Erich!

I’m starter of mbed. And I appreciate of your blog.
BTW I trying to recover my mbed board. But my eclipse setting is so far from yours.
1. How can I setting my eclipse enviroment?
2. When I create project, it is just empty. How can I make empty archieve as you did?

Many thanks

Walter

LikeLike

Reply ↓
- Erich Styger on February 10, 2018 at 06:46 said:
  
  1) You need an Eclipse with an ARM toolchain, e.g. use Kinetis Design Studio (http://www.nxp.com/kds) or the MCUXpresso IDE.
  2) You don’t need an empty archive. All what you need is a project with the toolchain (especially debugger) setup. You can get this easily say with Kinetis Design Studio.
  
  LikeLike
  
  Reply ↓
Walter on March 8, 2018 at 06:10 said:

Hello , Erich!!

I try to copy FRDM-KL43Z. But I got erro message.
‘J-Link GDB Server failed: Could not connect to target. Please check if target is powered and if ribbon cable is plugged properly. For more details, see the JLinkGDBServerCL.exe console’

I use [J-Lind edu] and KDS verersin 3.2.0. I connected through JTAG.

FRDM-KL43Z is protected?

sincere,
Walter

LikeLike

Reply ↓
- Erich Styger on March 8, 2018 at 07:31 said:
  
  Hi Walter,
  did you connect to the OpenSDA or to the J11 header? Keep in minid that you cannot use JTAG, you have to use SWD.
  And if you connected to J11, then I would say you have plugged in the cable the wrong way, so it does not sense the 3.3V.
  For the header/pin layout see https://mcuoneclipse.com/2012/11/07/jtagswd-debugging-with-the-frdm-kl25z-board/ (it is the same for the FRDM-KL43Z).
  I hope this helps,
  Erich
  
  LikeLike
  
  Reply ↓
  - Walter on March 9, 2018 at 01:00 said:
    
    Hi Erich!
    
    Thanks!! I used JTAG first, I cannot download it.
    Thank you again.
    
    Sincere,
    Walter
    
    LikeLike
    
    Reply ↓
Walter on March 9, 2018 at 07:07 said:

Hello Erich,

I have one more question. I think I bother you a lot. Sorry about that first.
BTW, I extrated bootloader from FRDM-KL43Z board.(.s19 file) And I try to install broken board. I imported dump file and some hex code was changed to red. But when I click the resume button all changed bits are setted 0. These symtoms happen when I flash the bootloader on my broken board. Is there way to fix the code after I import bootloader?

I use KDS 3.2.0 and J-Link

Sincere,
Walter

LikeLike

Reply ↓
- Erich Styger on March 9, 2018 at 08:50 said:
  
  The bootloader on the OpenSDA/K20 V1.x of the FRDM-KL43Z board is closed and secured by the flash protection. You cannot change the V1.x bootloader. You only can change the V2.x bootloader as it is present on the FRDM-K64F.
  
  LikeLike
  
  Reply ↓
access on April 15, 2018 at 13:19 said:

Can i dump memory of mc9s08sh4? using usbdm?

LikeLike

Reply ↓
- Erich Styger on April 15, 2018 at 19:07 said:
  
  I have not used USBDM recently, but with Eclipse and with any debug connection you can dump the target memory, e.g. see https://mcuoneclipse.com/2012/05/04/dump-my-device-memory/
  
  LikeLike
  
  Reply ↓
Mike Ihm on May 9, 2018 at 23:13 said:

Hi Erich,
Is there any licensing issues with cloning the bootloader circuit from K64 to a new board design including firmware?
Thank you,
Mike

LikeLike

Reply ↓
- Mike Ihm on May 9, 2018 at 23:14 said:
  
  I meant to say: Is there any licensing issues with cloning the bootloader circuit from FRDM-K64F to a new board design including firmware?
  
  LikeLike
  
  Reply ↓
  - Erich Styger on May 10, 2018 at 08:59 said:
    
    The OpenSDA circuit is ‘open’ so you can integrate it into your own design (altough I did not see any specific licensing clause for the schematics/circuits?).
    The firmware is a different topic: the bootloader is open under the mbed license (see https://mcuoneclipse.com/2017/10/29/adding-a-delay-to-the-arm-daplink-bootloader/ and https://github.com/ARMmbed/DAPLink.
    The CMSIS-DAP firmware is open too, but the P&E and Segger OpenSDA firmware are closed. Especially the Segger firmware calls out that it cannot be used for custom boards (see https://mcuoneclipse.com/2013/05/16/freedom-board-with-segger-opensda-debug-firmware/).
    
    LikeLike
    
    Reply ↓