GET code from AT91RM9200

Discussion around AT91RM9200 and SAM9 Series Products.

Moderator: nferre

grezzoman
Location: italy
Posts: 7
Joined: Thu May 09, 2019 10:23 am

GET code from AT91RM9200

Thu May 09, 2019 10:30 am

Hello,
I have a controller display with AT91RM9200, I can set it in boot mode and receive "C" character from serial com. My question is:
Can I get the code from AT91RM9200 via serial link? I have to repair and program another controller and I don't know how clone the software..
THX
blue_z
Location: USA
Posts: 1977
Joined: Thu Apr 19, 2007 10:15 pm

Re: GET code from AT91RM9200

Fri May 10, 2019 2:15 am

grezzoman wrote: I have a controller display with AT91RM9200, I can set it in boot mode and receive "C" character from serial com. My question is:
Can I get the code from AT91RM9200 via serial link?
That's an insufficient description of the hardware in question.
I don't know what a "controller display" is, perhaps you mean a "display controller"?
Where is this "code" stored?
What kind of "code" normally executes on this board?

Apparently this "serial com" is the actual DBGU port, and you have activated the Xmodem transfer mode (which the datasheet confusing calls the "Boot Uploader", yet refers to executing "the downloaded image" ).
So you now have the limited capability to download (to the target board) a small (no more than 12 KB) program that can execute from the 16 KB of SRAM.
The SAM-BA utility apparently does not support the AT91RM9200, but that scheme of applets on the target with a user interface on a host would be one method of retrieving contents of NVM.


Regards
grezzoman
Location: italy
Posts: 7
Joined: Thu May 09, 2019 10:23 am

Re: GET code from AT91RM9200

Tue May 14, 2019 8:36 am

Hello blue_z,
Thank you very much for your reply,
sorry for my english, it is not very good..

Yes, I mean a display controller.

The core of this device is a AT91RM9200 with MT48LC16M16A2 sdram and 28F640 flash memory, so I suppose the code is stored on flash memory.
The device is provided with a serial port (RS232)

After switching on it appears on the hyperterminal :

boot 1.1
Uncompressing image...
Uncompressing...done.
Intel: 28F640J3A (64Mbit)
U-Boot 1.1.2 (Sep 2 2009 - 17:33:09)
U-Boot code: 20F00000 -> 20F18694 BSS: -> 20F1CC18
RAM Configuration ...... :
Bank #0: 20000000 size: 16 MB
Intel: 28F640J3A (64Mbit)
Flash: 8 MB
In: serial
Out: serial
Hit any key to stop autoboot:
## Booting image at 10020000 ...
Image Name:
Image Type: ARM Linux Kernel Image (gzip compressed)
Data Size: 719737 Bytes = 702.9 kB
Load Address: 20008000
Entry Point: 20008000
Verifying Checksum ... OK
Uncompressing Kernel Image ... OK
....

If I close a jumper on the mainboard (boot) the controller send "C" character through RS232.

As you can see, I'm not an expert on this type of system..

I downloaded SAM-BA v2.18 but seems it does not support the AT91RM9200.
Can you help me to acquire the software? I have to program another device with the same code, and I would like to avoid unsoldering flash from the working one.


Regards
blue_z
Location: USA
Posts: 1977
Joined: Thu Apr 19, 2007 10:15 pm

Re: GET code from AT91RM9200

Tue May 14, 2019 8:41 pm

Correct, SAM-BA does not support the AT91RM9200, which I tried to convey in my previous post.
The most viable approach would involve U-Boot, assuming that you can break in and obtain a command prompt.
At the "Hit any key to stop autoboot:" prompt, you can try to quickly type a key.
If this U-Boot is security conscious, then the time window could be very short (<1sec) and a specific character (rather than anything) is required.

Regards
grezzoman
Location: italy
Posts: 7
Joined: Thu May 09, 2019 10:23 am

Re: GET code from AT91RM9200

Wed May 15, 2019 12:00 pm

Hi blue_z,
thank you again for your time,
I can stop autoboot and get a command prompt.
After blocking the autoboot and getting the prompt, if I type "help" I get the following commands:

? - alias for 'help'
autoscr - run script from memory
base - print or set address offset
boot - boot default, i.e., run 'bootcmd'
bootd - boot default, i.e., run 'bootcmd'
bootm - boot application image from memory
bootp - boot image via network using BootP/TFTP protocol
cmp - memory compare
coninfo - print console devices and information
cp - memory copy
crc32 - checksum calculation
dhcp - invoke DHCP client to obtain IP/boot params
echo - echo args to console
erase - erase FLASH memory
flinfo - print FLASH memory information
go - start application at address 'addr'
help - print online help
ieth - init ETH (0/1)
imls - list all images found in flash
itest - return true/false on integer compare
loadb - load binary file over serial line (kermit mode)
loop - infinite loop on address range
md - memory display
mm - memory modify (auto-incrementing)
mtest - simple RAM test
mw - memory write (fill)
nfs - boot image via network using NFS protocol
nm - memory modify (constant address)
printenv- print environment variables
protect - enable or disable FLASH write protection
rarpboot- boot image via network using RARP/TFTP protocol
reset - Perform RESET of the CPU
run - run commands in an environment variable
saveenv - save environment variables to persistent storage
setenv - set environment variables
tftpboot- boot image via network using TFTP protocol
version - print monitor version
T3120>

Now I don't know what I can do.. Do you have any idea?

Regards
blue_z
Location: USA
Posts: 1977
Joined: Thu Apr 19, 2007 10:15 pm

Re: GET code from AT91RM9200

Wed May 15, 2019 9:12 pm

Besides the output from the `help` command, the other salient information would be from the `printenv` command.

The only command capable of loading images from flash into RAM seems to be the `cp` command. The environment variables are needed to confirm that.
Some old versions of U-Boot would software map the flash (i.e. DataFlash) address space into the 0xC0000000 and/or 0xD0000000 regions. So reading and writing flash could be accomplished by a superficially-simple `cp` command.

U-Boot 1.1.2 is a very early version. You should be able to load code/data into memory and display hex values. But with this set of commands you are not going to be able to do anything else like transfer that image to a removable storage or network device.

What happens when Linux boots?
Can you log into Linux from the serial console?


Regards
grezzoman
Location: italy
Posts: 7
Joined: Thu May 09, 2019 10:23 am

Re: GET code from AT91RM9200

Thu May 16, 2019 11:00 am

I can't log into Linux, unfortunately a username and password are required. I tried some typical usernames and passwords but I didn't have any luck.

Do you think my only chance is to unsolder flash memory and acquire it by a parallel programmer? I can do it since I have a programmer, but desoldering smd components always involves a minimum risk..

Regards
blue_z
Location: USA
Posts: 1977
Joined: Thu Apr 19, 2007 10:15 pm

Re: GET code from AT91RM9200

Thu May 16, 2019 10:59 pm

What is the output from the `printenv` command in U-Boot?

Regards
grezzoman
Location: italy
Posts: 7
Joined: Thu May 09, 2019 10:23 am

Re: GET code from AT91RM9200

Fri May 17, 2019 11:27 am

Hi blue_z,

After typing "printenv" I get :


T3120> printenv

date=26-09-07
board=46213589
boarded=_
sn=174
ethaddr=00:D0:F3:00:80:C6
ipaddr=172.26.100.216
serverip=172.26.100.227
bootcmd=ieth; bootm 0x10020000
bootargs=root=/dev/mtdblock3 console=ttyS0,115200 mem=16M mtdparts=phys:128k(u-boot)ro,768k(kernel)ro,-(jffs2)
stdin=serial
stdout=serial
stderr=serial

Environment size: 301/8188 bytes

Any idea? Thank you for your interest!
Regards
CleberPeter
Location: Brazil
Posts: 6
Joined: Tue May 14, 2019 7:57 pm

Re: GET code from AT91RM9200

Fri May 17, 2019 2:40 pm

Returning to the initial idea proposed by bluez, to use the Applet to extract the contents of Nvm memory.

You can communicate with it through the command set in the protocol, take a look at the commands on page 10:

http://ww1.microchip.com/downloads/en/a ... t09423.pdf

The command:
wAddress,# allows reading a word from memory, I have tested it on SAMA5D27 and it seems to work.
blue_z
Location: USA
Posts: 1977
Joined: Thu Apr 19, 2007 10:15 pm

Re: GET code from AT91RM9200

Fri May 17, 2019 10:45 pm

grezzoman wrote: After typing "printenv" I get :

bootcmd=ieth; bootm 0x10020000
bootargs=root=/dev/mtdblock3 console=ttyS0,115200 mem=16M mtdparts=phys:128k(u-boot)ro,768k(kernel)ro,-(jffs2)
The U-Boot environment provided the last pieces of information for a viable (but crude) solution of retrieving flash contents.

The board has 8 MB StrataFlash (NOR flash) that is mapped to address 0x10000000.
The U-Boot image is 128KB stored at offset 0 (or address 0x10000000), and can execute in place (XIP) prior to relocation,.
The Linux kernel image is 768KB stored at offset 0x20000 (or address 0x10020000), and executes in place for uncompression.
The rootfs is a JFFS2 filesystem of 0x720000 bytes at offset 0xE0000 (or address 0x100E0000).

You can use the U-Boot md (memory display) command to display each MTD partition of this NOR flash.
The contents of the NOR flash can be read directly from its mapped address; there's no need to copy it to RAM.
Use a terminal emulator program (e.g. minicom) that can log/capture the md command results to a file.
You will then have to write a program (or try Linux command `xxd -r` ) to convert the files of screen text to binary images.

Regards
grezzoman
Location: italy
Posts: 7
Joined: Thu May 09, 2019 10:23 am

Re: GET code from AT91RM9200

Thu May 23, 2019 12:55 pm

Hi blue_z,

I got image with the following commands,

md 0x10000000 0x8000 -> U-Boot image
md 0x10020000 0xc000 -> U-kernel image
md 107e0000 8000

Now I have to buy and program a new AT91RM9200,
What can I do?

Thank you very much for your precious help



H CleberPeter, thank you very much for your reply, I will check!
blue_z
Location: USA
Posts: 1977
Joined: Thu Apr 19, 2007 10:15 pm

Re: GET code from AT91RM9200

Thu May 23, 2019 10:48 pm

grezzoman wrote: Now I have to buy and program a new AT91RM9200,
What can I do?
The AT91RM9200 has no embedded flash memory, so there is nothing that can be programmed on that chip.

Regards
grezzoman
Location: italy
Posts: 7
Joined: Thu May 09, 2019 10:23 am

Re: GET code from AT91RM9200

Fri May 24, 2019 3:19 pm

Hi blue_z,

sorry for my unclear request..
I have to program another display controller where I have to replace AT91RM9200 and external memory, same device as the one I acquired the software.

Can I program it via RS232?

regards
blue_z
Location: USA
Posts: 1977
Joined: Thu Apr 19, 2007 10:15 pm

Re: GET code from AT91RM9200

Sat May 25, 2019 12:09 am

You can download and execute a small (<15KB) program using the Xmodem capability through the DBGU port.
For more ideas see viewtopic.php?t=472
The 6th post seems interesting.
If you can't find a CFI driver, then you may have to write your own driver to interface with that NOR flash.

Might be easier to investigate if you can pre-program the flash chip before it is installed on the board.

Regards

Return to “SAM9 ARM9 MPU”

Who is online

Users browsing this forum: No registered users and 4 guests