Recovering a bricked Wiznet W7500 using the bootloader

I "bricked" a Wiznet W7500 MCU during development. After flashing yet another build of the firmware the J-Link disconnected suddenly and I was not able to connect to the chip again (even under reset). What's funny is that the LEDs blinked as usual and I was able to ping my application so the chip was far from being dead. I quickly found the suspected piece of code: pin muxing. When changing PORTA muxing options I must have un-muxed the SWD pins. 🙁

I did not want to throw away or have to resolder the development board. Fortunately, this chip has a boot ROM that can be used for programming over a standard UART without a debug probe. The bootloader mode is entered when then BOOT pin is held high at power-on. The bootloader uses pins PC_11 (RXD) and PC_10 (TXD) for the UART.

Unfortunately, the Linux software provided by Wiznet (both GUI & Python module) is quite old, uses Python 2 and antique wxPython. I could not make it run on recent Ubuntu. I also did not want to get into Linux archaeology so I had a look what it would take to implement the bootloader protocol myself.

The protocol is simple enough to type by hand in a serial termina. I connected a standard USB to UART cable and started picocom at 115200 baud. The bootloader can sync to any speed so first you have to send the uppercase U a couple of times. When the synchronization succeeds the bootloader will reply with something like U1.2. There is no echo so you will be typing blind into the terminal. Pressing enter without typing any command returns status code 3 (in plain ASCII).

In case you wondered why an uppercase U is used to establish communication with the bootloader. The ASCII encoding for U is 0x55 and its binary representation is an alternating series of zeros and ones. This makes it easy to detect the timing of the UART even without an accurate clock. 0x55 is also used for synchronization in the LIN bus.

I recovered the chip by erasing the flash by typing ERASE CHIP and pressing enter. Successful erase returned status code 0 and after a power cycle I was able to connect with the J-Link again. 🙂