Recovering a bricked Wiznet W7500 using the bootloader
I "bricked" a Wiznet W7500 MCU during development. After flashing yet another build of the firmware
the J-Link disconnected suddenly and I was not able to connect to the chip again (even under reset).
What's funny is that the LEDs blinked as usual and I was able to ping my application so
the chip was far from being dead. I quickly found the suspected piece of code:
pin muxing. When changing
PORTA muxing options I must have un-muxed the SWD pins. 🙁
I did not want to throw away or have to resolder the development board.
Fortunately, this chip has a boot ROM that can be used for programming over a standard UART without a debug probe.
The bootloader mode is entered
BOOT pin is held high at power-on. The bootloader uses pins
PC_11 (RXD) and
PC_10 (TXD) for the UART.
Unfortunately, the Linux software provided by Wiznet (both GUI & Python module) is quite old, uses Python 2 and antique wxPython. I could not make it run on recent Ubuntu. I also did not want to get into Linux archaeology so I had a look what it would take to implement the bootloader protocol myself.
The protocol is simple enough to type by hand in a serial termina.
I connected a standard USB to UART cable and started
picocom at 115200 baud. The bootloader can sync
to any speed so first you have to send the uppercase
U a couple of times. When the synchronization
succeeds the bootloader will reply with something like
U1.2. There is no echo so you will be typing
blind into the terminal. Pressing enter without typing any command returns status code
3 (in plain ASCII).
In case you wondered why an uppercase
U is used to establish communication with the bootloader. The ASCII encoding
U is 0x55 and its binary representation is an alternating series of zeros and ones. This makes it
easy to detect the timing of the UART even without an accurate clock. 0x55 is also used for synchronization in
the LIN bus.
I recovered the chip by erasing the flash by typing
ERASE CHIP and pressing enter.
Successful erase returned status code
0 and after a power cycle I was able to connect with the
J-Link again. 🙂