How to force SAM9G45 to boot sam-ba monitor instead of firmware

Discussion around AT91RM9200 and SAM9 Series Products.

Moderator: nferre

blue_z
Location: USA
Posts: 1983
Joined: Thu Apr 19, 2007 10:15 pm

Re: How to force SAM9G45 to boot sam-ba monitor instead of firmware

Sat Aug 03, 2019 12:20 am

framp wrote: Do you have any converter you can recommend?
I have a premium FTDI converter cable as well as a cheaper Prolific one. They seem to work equally well with Atmel chips, whereas some SoCs (e.g. MStar) create issues.
They can be obtained from sites like Adafruit.com, or if you can spare the delivery delay, Aliexpress.com.
Just be sure that the "cable" is for 3.3V signal levels rather than 5V TTL.

framp wrote: I found some which have GND, RxD, TxD, DTR/RTR and CTS and Vcc (3.3 V or 5 V) . As far as I understand I have to use a Vcc 3.3 V converter. You mentioned Pin 1 or Pin 4 to be Vcc. This makes me nervous because I don't want to create a short circuit and destroy the UART interface electronic and I have to be carefully with GND and Vcc.
With a USB serial converter, you should not need to make any Vcc connection or use the red wire of the USB "cable".
You would need to use the Vcc when connecting a RS-232 transceiver, because it needs power.
With a USB serial converter (which is powered by its PC host) you do not have to make any additional power connections.

You can start testing with just a ground connection (i.e. the black wire) and the TxD wire (e.g. the yellow wire of the FTDI or the white wire of the Prolific "cable"), and probe for console output (right after a board reset) on pin 1 or 4.
Only after you manage to find/identify the UART's TxD should you probe for the RxD.

If you want to play it safe, then only make connections when the board is not powered. That is actually prudent, since these TTL pins are not intended for hot-plugging and have no ESD protection.

framp wrote: I understand a scope will help to better identify the pins. Do you have any recommendation for a cheap scope I can buy?
Getting a new serial connection to work can sometimes be a real pain (confusing labels, crossed wires, matching port settings, etc.). I often have to resort to tracing the signals to break down the problem.
But there are too many variables to consider for any quick recommendation.
A PC-based 'scope can be less expensive than a standalone unit, but the software is typically Windows-only and setup takes longer.
There are some dinky, toy-like 'scopes for less than US$20 that should be able to capture a 115200 baud frame, but would you really rather have two (or more) channels, more bandwidth, more capture memory?

Regards
User avatar
framp
Contact:
Location: Next to Stuttgart, Germany
Posts: 12
Joined: Sat May 04, 2019 12:09 pm

Re: How to force SAM9G45 to boot sam-ba monitor instead of firmware

Tue Aug 06, 2019 11:02 pm

As you suggested blue_z, I ordered an FTDI converter and connected (my old pin numeration)

Code: Select all

Converter                MPU Pin          
GND                           1	GND
RXD                            2	TXD
You gave me confidence :) I will not destroy the MCU UART interface and therefore configured 115200 8N1 on gtkterm, turned on JamMan and got following response:

Code: Select all

RomBOOT


QNX Neutrino Initial Program Loader for JamManStereo ATMEL AT91SAM9G45
ATMEL AT45DB321D SPI Flash detected.

QNX IFS image detected on page: 00000020 Offset: 00000000 Size: 00183B2C
###############################Done
found image, calling image setup...
image_setup OK, calling image start...


PIO init : DBGU, NAND, EMAC. 
Welcome to QNX Neutrino 6.4 on the JamManStereo Atmel AT91SAM9G45
Starting DBGU driver...
fs-etfs-at91sam9xx: NAND support for 1 or 2 planes, 8 or 16 wide
fs-etfs-at91sam9xx: NAND id[1] = bc
fs-etfs-at91sam9xx: devio_init: Flash ID: Manufacturer ID=0x2c, Device ID=0xbc

-- updater Compiled: Apr 13 2010 15:16:26 --

UPd: SD is inserted
Path=0 - 
 target=0 lun=0     Direct-Access(0) - SD:#159 00000 Rev: 0.0
UPD: SD is mounted
Looking for: /mnt/sdfs/updJamManStereo
UPD: No SD updater file
/mnt/nandfs/lib/fs-dos.so
Executing StartJamManStereoUpdater
find: Can't get stat. (/mnt/nandfs/usr/updJamManStereo): No such file or directory
find: Can't get stat. (/mnt/nandfs/usr/updJamManStereoTar): No such file or directory
/mnt/nandfs/usr/ImJustForTheUpdater
 
Starting JamMan Stereo
 
Launching application processes
 

-- mediaMgr Compiled: Aug 14 2012 16:09:46 --

-- cNandMgr Compiled: Aug 14 2012 16:09:46 --
DOS: mountDrive ret 2

-- cSdMgr Compiled: Aug 14 2012 16:09:44 --
SD Card is in
SD is NOT write protected
Path=0 - 
 target=0 lun=0     Direct-Access(0) - SD:#159 00000 Rev: 0.0
# Entered ioScanThread (ID=2) with priority 250
Entered ioSendThread (ID=3) with priority 45
IOMgr main start
Version1.3.0.0
-- Compiled: Aug 14 2012 16:14:02 --
-- USB Device CDC Serial Project --
-- Compiled: Aug 14 2012 16:16:30 --

JamStereoUI main start
Version1.3.0.0
-- Compiled: Aug 14 2012 16:14:12 --
censored Empty Behavior: TransitionIfStopped
censored Current Behavior: RevertToSaved
GUID found:  @@@@@@@@-@@@@-@@@@-@@@@@@@@@@@@@@@@@
loopengine started
usbserial connected to loopengine
Dbg endStrg = 1
USBD Init()
There is no TXD connected as of now and it seems to me this are just the boot messages of QNX. I looked up ONX and found out it's an OS with a structure similar to Unix and Posix compliant. It was sold to Harman International Industries in 2004 and which produced JamMan.

So I'm wondering whether it makes sense to identify the TXD pin. I expected to see a kind of console which allows an OS interaction but as far as I can see it's just a log of any system messages and I have to find another way to get to the NAND data.

@blue_z: What do you think? Should I continue to identify TXD pin on the MCU and will get access to the Unix/Posix OS or do I have to go another path to retrieve the NAND data? Anyhow - thank you very much for your detailed answer: This helped me to order the right HW to connect to the MCU and also to get more insights about UART, TTL, RS232 et al.
Last edited by framp on Wed Aug 07, 2019 11:37 am, edited 2 times in total.
blue_z
Location: USA
Posts: 1983
Joined: Thu Apr 19, 2007 10:15 pm

Re: How to force SAM9G45 to boot sam-ba monitor instead of firmware

Wed Aug 07, 2019 1:02 am

framp wrote: Should I continue to identify TXD pin on the MCU and will get access to the Unix/Posix OS or do I have to go another path to retrieve the NAND data?
You have "TXD" and "RXD" reversed, at least in the conventional sense, i.e. from the perspective of the target processor.
I fail to understand your hesitation/reluctance. What do you have to lose?
I know nothing about QNX, and have no advice on how to proceed.

There never was a guarantee of quickly breaking in, even with a Linux console.
E.G. the system could have been protected with a username & password.

BTW the SAM9G45 is a SoC or MPU, rather than a "MCU".

Regards
User avatar
framp
Contact:
Location: Next to Stuttgart, Germany
Posts: 12
Joined: Sat May 04, 2019 12:09 pm

Re: How to force SAM9G45 to boot sam-ba monitor instead of firmware

Wed Aug 07, 2019 10:16 am

blue_z wrote: You have "TXD" and "RXD" reversed, at least in the conventional sense, i.e. from the perspective of the target processor.
I bought this converter which has all pins labeld. (Just ignore the German stuff, check the pictures :) ) I used the label RXD which is OK from the converters point of view which ix TXD from the processor view. Makes sense to use the view from the processor. I updated my previous post accordingly.
blue_z wrote: I fail to understand your hesitation/reluctance. What do you have to lose?
Nothing. Frankly I was very disappointed when I didn't see something which looks like a console. Thank you very much to encourage me. Will try to locate RXD now :)
blue_z wrote: I know nothing about QNX, and have no advice on how to proceed.
Sorry, you got me wrong. I didn't expect you to know ONX. Actually we're already OT (check the thread subject). You pointed me to the 5 pins which was a great idea and I enjoy to learn to work with a MPU and UART serial IO. I'm still hesitating to start working on the thread subject. Maybe there is another way to get access to the box? Do you have an idea what the other 20 pins may be useful for? I stumbled upon acronym JTAG which seems to be some kind of debugging feature. Would this be the next step to go if the 5 pin UART is a dead end?
blue_z wrote: There never was a guarantee of quickly breaking in, even with a Linux console.
E.G. the system could have been protected with a username & password.
Agree with you. I have to be much more patient. Re UID/PWD - it doesn't make sense for me to protect a looper this way - but engineers sometimes have constraints which force them to be creative :mrgreen:
blue_z wrote: BTW the SAM9G45 is a SoC or MPU, rather than a "MCU".
I frankly wasn't aware there exists the acronym MPU. ATMEL AT91SAM9G45 is definitely a MPU.
Last edited by framp on Wed Aug 07, 2019 11:36 am, edited 1 time in total.
User avatar
framp
Contact:
Location: Next to Stuttgart, Germany
Posts: 12
Joined: Sat May 04, 2019 12:09 pm

Re: How to force SAM9G45 to boot sam-ba monitor instead of firmware

Wed Aug 07, 2019 11:23 am

Just a quick update: As blue_z suggested I tried to find the right pin for RXD and when I connected pin 4 with RXD of the converter I got a Unix prompt :D :D :D

Code: Select all

# df -h
/dev/hds1                   7.4G      3.4M      7.4G       1%  /mnt/sdfs/      
/dev/etfs2                  505M       65M      439M      13%  /mnt/nandfs/    
/dev/hds                    7.4G      7.4G         0     100%                  
/dev/etfs2                  508M      508M         0     100%  (/mnt/nandfs/)  
/dev/etfs1                  7.5M      7.5M         0     100%  
and I have a lot of common Unix tools available :D :D :D

Code: Select all

# ls /mnt/nandfs/boot 
cat                       esh                       mkdosfs
chmod                     fdisk                     mv
cksum                     ftp                       pdebug
cmp                       hd                        rm
cp                        hogs                      sed
dd                        ifconfig                  sloginfo
devb-loopback             io-pkt-v4                 umount
devc-pty                  libcam.so                 use
devnp-at91sam9xx.so       ln                        vi
df                        ls                        which
dhcp.client               mkdir
Hurray - many thanks to everybody who helped me to get Unix console access to the JamMan looper - in particular blue_z, who pointed me to the 5 pins, introduced me into the secrets of UART, serial IO et al and motivated me not to stop trying to get the Unix console path to succeed. :D :D :D

Now I have to find out the differences between Linux and QNX :roll: but I think I will get it sorted out.
User avatar
framp
Contact:
Location: Next to Stuttgart, Germany
Posts: 12
Joined: Sat May 04, 2019 12:09 pm

Re: How to force SAM9G45 to boot sam-ba monitor instead of firmware

Sun Oct 06, 2019 3:21 pm

Just a final update: I finally managed to extract the NAND data from the looper and also spent a lot of time to understand the dump format (QNX etfs filesystem) and to extract the files from the raw dump. Unfortunately the transactions in the dump which contained the data of the deleted loops was cleared with 0xff :evil: I frankly have no idea why this happened.

As I said I spent a lot of time understanding the etfs format and design. The code I created to recover all files which have associated transactions in the raw etfs dump is available here in github. It's not very elegant code because I had a lot of trial and error coding loops but finally it recovers files with existing transactions. Maybe it's useful for somebody in the future who has to recover data from an etfs filesystem.

Return to “SAM9 ARM9 MPU”

Who is online

Users browsing this forum: No registered users and 1 guest