Thx,I have tried,but still get UnSet Model and UnSet SN
The safiest and easy option would be to replace U701 with a new blank chip from Digikey and use STM Flash Utility to upload the firmware via USB. What happens is when you turn on the scope it will try use Uboot in NOR U701 and if it can't find it (which will be the case if U701 is empty), the scope will switch to boot from USB (the USB connector at the back). This is where STM Flash utility comes into play. You run the utility and it gives you access to the address space. You then configure it to upload the firmware as either in chunks (say only U701 part) or as a single block for everything.
This method was described either in this thread or in 2000/3000 thread, i cant remember where- you will have to comb the threads to search for it either page by page or using kewords like STM Flash (or flashing) utility within those threads. The utility itself used to be available from STM web site, not sure if it still is.
System ready!
Preparing for download...
RTC: 2024-23-11 3:100:32.29 UTC
Loading image 1 from memory at 0xD0600000
Incorrect Data 0 EccResult: 3303c3 EccError: ccfc3c EccRead: ffffff
IsCompressed: ReadFlash failed
Incorrect Data 0 EccResult: 3303c3 EccError: ccfc3c EccRead: ffffff
EBOOT_ReadFlash failed
ERROR: Unable to read image signature.
BL_IMAGE_TYPE_UNKNOWN
Loading image 1 failed, trying next one
Loading image 2 from memory at 0xD1E00000
Incorrect Data 0 EccResult: 3303c3 EccError: ccfc3c EccRead: ffffff
IsCompressed: ReadFlash failed
Incorrect Data 0 EccResult: 3303c3 EccError: ccfc3c EccRead: ffffff
EBOOT_ReadFlash failed
ERROR: Unable to read image signature.
BL_IMAGE_TYPE_UNKNOWN
Loading image 2 failed, trying next one
All images failed
Press r to reset
p500> fpga 0xd0060000 45480
failed: 979 731
Could not copy from NAND offset 0x60000. Error -74 With ECC
failed: 1225 979
Could not copy from NAND offset 0x60000. Error -74 NO ECC
FPGA programming FAILED!
p500> md 0xd0000000
d0000000: 00000036 00000000 00000000 00000000 6...............
d0000010: 00000000 00000000 0000013f 00000000 ........?.......
d0000020: 00000000 0000001a 00000003 00000070 ............p...
d0000030: 00000301 00000012 00000000 00000000 ................
d0000040: 00000000 00000000 00000000 00000000 ................
d0000050: 00000000 00000000 00000000 00000000 ................
d0000060: 00000000 00000000 00000000 00000000 ................
d0000070: 00000000 00000000 00000000 00000000 ................
d0000080: 00000000 00000001 00000000 00000000 ................
d0000090: 00000000 00000000 00000000 00000000 ................
d00000a0: 00000000 00000000 00000000 00000000 ................
d00000b0: 00000000 00000000 00000000 00000000 ................
d00000c0: 00000000 00000000 00000000 00000000 ................
d00000d0: 00000000 00000000 00000000 00000000 ................
d00000e0: 00000000 00000000 00000000 00000000 ................
d00000f0: 00000000 00000000 00000000 00000000 ................
p500> md 0xd0000000
d0000000: 0000007f 00000000 00000000 00000000 ................
d0000010: 00000000 00000000 0000013f 00000000 ........?.......
d0000020: 00000000 0000001a 00000003 00000070 ............p...
d0000030: 00000301 00000012 00000000 00000000 ................
d0000040: 00000000 00000000 00000000 00000000 ................
d0000050: 00000000 00000000 00000000 00000000 ................
d0000060: 00000000 00000000 00000000 00000000 ................
d0000070: 00000000 00000000 00000000 00000000 ................
d0000080: 00000000 00000001 00000000 00000000 ................
d0000090: 00000000 00000000 00000000 00000000 ................
d00000a0: 00000000 00000000 00000000 00000000 ................
d00000b0: 00000000 00000000 00000000 00000000 ................
d00000c0: 00000000 00000000 00000000 00000000 ................
d00000d0: 00000000 00000000 00000000 00000000 ................
d00000e0: 00000000 00000000 00000000 00000000 ................
d00000f0: 00000000 00000000 00000000 00000000 ................
I could load something to the FPGA using the method described here: https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg3802571/#msg3802571. The commandline seemed to accept this just fine, so I am assuming this worked. I then proceeded to try and copy that data, from ram, to the right place in nand (0xd0060000) using the "cp" command, but that command just hang forever, so I had to restart the device.
I then tried uploading everything to the right addresses in NAND using that STM flash utility:
I set up the partitions like this, and then I uploaded the files, and rebooted the scope, and I got something like this:
Are you sure the NAND block size is 0x10000? You should be able to check it from p500 prompt using one of NAND commands- type "NAND help" to see list of commands. I can't remember which one. You have to use that block size then in the Flasher utility in NAND section, and when manipulating NAND from p500 prompt.
Edit: Just noticed you used cp command to write to NAND, i think you cant do that, you have to use NAND commands to work with NAND. Type nand help from p500 to see list of commands for nand. The cp command is for RAM.
U-Boot 2010.03 (Oct 18 2011 - 14:28:06)Agilent P500
CPU: SPEAr600
DRAM: 128 MiB
Flash: 512 KiB
NAND: internal ecc 128 MiB
Debug serial initialized ........OK
RTC: 2024-23-11 7:99:35.56 UTC
Microsoft Windows CE Bootloader Common Library Version 1.4 Built May 7 2015 01:38:03
Microsoft Windows CE 6.0 Ethernet Bootloader for the Agilent P500 board
Adaptation performed by Agilent Technologies (c) 2008
PHY not found.
System ready!
Preparing for download...
RTC: 2024-23-11 7:99:35.56 UTC
Loading image 1 from memory at 0xD0600000
O
BL_IMAGE_TYPE_BIN
X
XXXXOOOOXXIncorrect Data 2 EccResult: cf330 EccError: 3cfcc3 EccRead: 300ff3
EBOOT_ReadFlash failed offset 62d7ce
EBOOT_ReadFlash failed location d0632000
ODeCompressFlash: CeCompressDecode() failed
CeDecompressFlashBlock failed
****** Data record 7 corrupted, ABORT!!! ******
Completed file(s):
-------------------------------------------------------------------------------
[0]: Address=0x80361000 Length=0x1A857C0 Name="" Target=RAM
Loading image 1 failed, trying next one
Loading image 2 from memory at 0xD1E00000
BL_IMAGE_TYPE_UNKNOWN
Loading image 2 failed, trying next one
All images failed
Press r to reset
Try without writing nk.bin.comp into NAND. Just prepair nk.nb0 file as desribed in titiris's post you referenced and use the output from viewbin.exe, the color coded offsets in that post. Load that nk.nb0 using ymodem into RAM to the proper offset and execute the image from RAM using go <your start address> command (do not reboot) If the scope starts, immediately run firmware upgrade and let the scope worry about writing firmware to NAND.
But to do this you again need access to Uboot.
By the way, what NOR image did you flash into U701 using ST flasher? Did you use the original image with bootdelay changed and checksums updated or was it any other image, which may be dangerous? I say only use the changed one from your scope because it initializes cruicial environment variables.
Did what? Updated the original NOR?
Make sure you updated UBoot checksums as well, otherwise Uboot will assume its data is corrupted and will not load the environment variables and that will cause further NAND corruption.
From UBoot prompt type printenv and post the output here. Let us review it before you attempt to boot an image.
p500> printenv
bootcmd=tftp 0x4000000 nk.bin;bootm 0xf8050000
ramboot=dhcp 0x4000000 nk.bin;bootm 0xf8050000
bootdelay=3
baudrate=115200
serverip=192.168.1.10
preboot=splash load;fpga;expi
gatewayip=192.168.1.10
netmask=255.255.255.0
usbtty=cdc_acm
fpgadata=0xd0060000
fpgasize=0x75394
splashdata=0xd0000000
dispParm1=0x300 0x400 0x2625A00 0x1 0x3
dispParm2=0x20 0x4c 0x1 0x2 0x3
boardversion=4
ps=0
rtc=0
erase_env=protect off 1:4;erase 1:4
store_uboot=protect off 1:1-3;erase 1:1-3;cp.b 0x800000 0xF8010000 ${filesize};protect on 1:1-3;imi 0xF8010000
get_uboot_eth=dhcp 0x800000 u-boot_image.bin;run store_uboot
get_uboot_uart=loadb 0x800000 115200;run store_uboot
verify=n
ethaddr=00:03:d3:04:10:00
ipaddr=192.168.1.100
serialnum=serial number not programmed
chipversion=BD
ethact=unknown
Environment size: 777/16380 bytes
I am just missing a serial number, but I am just going by that not being needed to get a boot.Oh, that is unfortunate....Your device calibration is gone then and Infiniivision application is gone. Downloading nk.bin will only restore WinCE image but I think boot process will fail when it comes to starting the scope application. So you won't be able to run firmware upgrade from the scope menu.
U-Boot 2010.03 (Oct 18 2011 - 14:28:06)Agilent P500
CPU: SPEAr600
DRAM: 128 MiB
Unknown id: 0x13409d. Using ST_M23P40
Flash: 64 KiB
NAND: fsmc-ecc1 128 MiB
*** Warning - bad CRC, using default environment
In: serial
Out: serial
Err: serial
SerNum:serial number not programmed
Chip: BD Board Rev: 4
Error: start address not on sector boundary
Net: unknown
BMP data is not valid. Use splash bmp
Press space to stop autoboot: 2
p500> loady 0x0361000 115200
## Ready for binary (ymodem) download to 0x00361000 at 115200 bps...
CSending: nk.nb0
Ymodem sectors/kbytes sent: 0/ 0kRetry 0: NAK on sector
Retry 0: NAK on sector
Retry 0: NAK on sector
Retry 0: NAK on sector
Retry 0: NAK on sector
Retry 0: NAK on sector
Retry 0: NAK on sector
Bytes Sent:27809792 BPS:7995
Sending:
Ymodem sectors/kbytes sent: 0/ 0k
Transfer complete
) packets, 10 retries
## Total Size = 0x01a857c0 = 27809728 Bytes
p500> crc 0x0361000 0x01a857c0
CRC32 for 00361000 ... 01de67bf ==> f3fb57d9
p500> go 0x00362000
## Starting application at 0x00362000 ...
Windows CE Kernel for ARM (Thumb Enabled) Built on Mar 8 2013 at 17:05:33
Setting up for a Cold Reboot
Done Setting up for a Cold Reboot
Windows CE Firmware Init
BSP 1.0.0 for the SPEARHEAD600AB board (built Jun 10 2019)
Adaptation performed by ADENEO (c) 2005
+OALIntrInit
-OALIntrInit(rc = 1)
Initialize driver globals Zeros area...
pDrvGlobalArea 0xa0060000 size 0x800 (0xa0060800 -0xa0060000)
Initialize driver globals Zeros area...done
OALKitlStart
Firmware Init Done.
OALIoctlHalEnterI2cCriticalSection init i2c cs
UBOO: CRC does not match for primary a431ee82 7f16dd10
ERROR: c:\WINCE600\3RDPARTY\Agilent\HPP\P500\Drivers\p500_uboo\.\p500_uboo_hw.cpp line 143: UBOO: CRC does not match for backupffffffff a05a35aa
ERROR: c:\WINCE600\3RDPARTY\Agilent\HPP\P500\Drivers\p500_uboo\.\p500_uboo_drv.cpp line 116: UBOO_Init - Failed to initialize UBOO Controller
++SER_Init: context Drivers\Active\14
SER_Init, dwIndex:2
SER2 got sysintr:0x00000017
SER2 Serial Port, new baud rate:0x1c200 (UARTCLK:48000000 IBRD:0x1a FBRD:0x2)
FMD: Start of the FileSystem not set, reverting to default values
OHCI\system.c, GCFG_USBH1_SW_RST
OHCI\system.c, GCFG_USBH2_SW_RST
LAN PHY NOT detected.
DeleteP500EnetRegistry:
\Comm\GMAC 0x0
\Comm\GMAC1 0x0
\Comm\Tcpip\Linkage 0x0
\Drivers\Virtual 0x0
\Drivers\BuiltIn\LIN 0x5
FMD: Start of the FileSystem not set, reverting to default values
LIN: Data Valid
BALDWIN_DDI: cBaldwinHwIf::Init: Initializing...
BALDWIN_DDI: cBaldwinHwIf::Init: Scope successfully identified.
BALDWIN_DDI: cBaldwinHwIf::Init: Success!
Device load time:
NANDFLASH: 380 ms
USB Hard Disk Drive: 380 ms
ERROR: OALIoCtlHalGetDeviceInfo: Device doesn't support IOCTL_HAL_GET_DEVICE_INFO::SPI_GETBOOTMENAME
SHIM DLL, LoadRealDll [PalIO.dll] for [AgilentPalIO.dll]
SHIM [AgilentPalIO.dll] Get Process Addresses
LaunchInfiniiVision:
SHIM DLL, LoadRealDll [PalSStorage.dll] for [AgilentPalSStorage.dll]
SHIM [AgilentPalSStorage.dll] Get Process Addresses
SHIM DLL, LoadRealDll [PalWin32.dll] for [AgilentPalWin32.dll]
SHIM [AgilentPalWin32.dll] Get Process Addresses
FWUpdate: Bad news, can't get environment data
Create: \Agilent Flash\selftest\
Create: \Secure\cal\
Create: \Secure\help\
Create: \Secure\bin\
Create: \Agilent Flash\wfmMem\
Create: \Agilent Flash\LxiMdns\
Released build, Jun 10 2019, 21:13:39
Initializing FPGA...
************************************
Ver: 1.067 Released
************************************
Calibration mode User
Serial Number file isn't loaded, defaulting to 0
open FAILED
open FAILED
open FAILED
Cal Date Thu Jan 01 00:00:00 1970
Could not load valid cal factors
Startup sequence is complete.
Saved configuration invalid
FWUpdate: Bad news, can't get environment data
System has been running 134.088058 seconds
Start Up Sequence 5.067179
Memory Load 47%
System Physical Memory 33.957 / 73.465 MB
Process Virtual Memory 42.375 / 1024.000 MB
-----> InfiniiVision is running <-----
failed open \Secure\InfiniiVision\LudicrousSpeed.usb
no workaround for USB phy
** BEGIN ** ExtractFileFromCabFile: INSTALL.XML
** END ** ExtractFileFromCabFile: INSTALL.XML: 140 ms
** BEGIN ** ExtractFileFromCabFile: infiniiVisionSetup.cab
** END ** ExtractFileFromCabFile: infiniiVisionSetup.cab: 13425 ms
** BEGIN ** ExtractFileFromCabFile: _setup.xml
** END ** ExtractFileFromCabFile: _setup.xml: 14 ms
** BEGIN ** ExtractFileFromCabFile: INFINI~1.025
** END ** ExtractFileFromCabFile: INFINI~1.025: 15 ms
** BEGIN ** ExtractFileFromCabFile: INSTALL.XML
** END ** ExtractFileFromCabFile: INSTALL.XML: 24 ms
** BEGIN ** ExtractFileFromCabFile: INSTALL.XML
** END ** ExtractFileFromCabFile: INSTALL.XML: 16 ms
** BEGIN ** ExtractFileFromCabFile: updateSplashImage.wvga.bin
** END ** ExtractFileFromCabFile: updateSplashImage.wvga.bin: 8 ms
GetNextUsbEvent, bOpenContextClosing
EventThread, ERROR ABORTED or INVALID HANDLE, exiting
GetSetupPacket, tmcDriverClosing 2
** BEGIN ** ExtractFileFromCabFile: nk.bin.comp
** END ** ExtractFileFromCabFile: nk.bin.comp: 6893 ms
** BEGIN ** ProcessRecipeStep: \windows\loadP500Flash -u ceImage2 \TEMP\{FB49C34B-AF8F-785E-20BD-0D9FCFF926FB}\nk.bin.comp
SHIM DLL, LoadRealDll [PalSysManagement.dll] for [AgilentPalSysManagement.dll]
SHIM [AgilentPalSysManagement.dll] Get Process Addresses
FWUpdate: Bad news, can't get environment data
FWUpdate: Bad news, can't get environment data
fwUpdateOffset error: Too Big Error
** END ** ProcessRecipeStep: \windows\loadP500Flash -u ceImage2 \TEMP\{FB49C34B-AF8F-785E-20BD-0D9FCFF926FB}\nk.bin.comp: 432 ms
** BEGIN ** ExtractFileFromCabFile: updateBootLoaders2.exe
** END ** ExtractFileFromCabFile: updateBootLoaders2.exe: 184 ms
** BEGIN ** ExtractFileFromCabFile: pboot_rel.bin
** END ** ExtractFileFromCabFile: pboot_rel.bin: 244 ms
** BEGIN ** ProcessRecipeStep: \TEMP\{FB49C34B-AF8F-785E-20BD-0D9FCFF926FB}\updatebootloaders2.exe
Update XLOADER at address f8000000.
XLOADER is up to date. Skipping
Update UBOOT at address f8010000.
UBOOT is up to date. Skipping
Update PBOOT at address f8050000.
PBOOT is up to date. Skipping
** END ** ProcessRecipeStep: \TEMP\{FB49C34B-AF8F-785E-20BD-0D9FCFF926FB}\updatebootloaders2.exe: 95 ms
** BEGIN ** ExtractFileFromCabFile: nk.bin.comp
** END ** ExtractFileFromCabFile: nk.bin.comp: 6873 ms
** BEGIN ** ProcessRecipeStep: \windows\loadP500Flash -u ceImage1 \TEMP\{FB49C34B-AF8F-785E-20BD-0D9FCFF926FB}\nk.bin.comp
SHIM DLL, LoadRealDll [PalSysManagement.dll] for [AgilentPalSysManagement.dll]
SHIM [AgilentPalSysManagement.dll] Get Process Addresses
FWUpdate: Bad news, can't get environment data
FWUpdate: Bad news, can't get environment data
fwUpdateOffset error: Too Big Error
** END ** ProcessRecipeStep: \windows\loadP500Flash -u ceImage1 \TEMP\{FB49C34B-AF8F-785E-20BD-0D9FCFF926FB}\nk.bin.comp: 433 ms
** BEGIN ** ExtractFileFromCabFile: fpga1000a.bin
** END ** ExtractFileFromCabFile: fpga1000a.bin: 102 ms
** BEGIN ** ProcessRecipeStep: \windows\loadP500Flash -u fpga --target marsupial \TEMP\{FB49C34B-AF8F-785E-20BD-0D9FCFF926FB}\fpga1000a.bin
SHIM DLL, LoadRealDll [PalSysManagement.dll] for [AgilentPalSysManagement.dll]
SHIM [AgilentPalSysManagement.dll] Get Process Addresses
** END ** ProcessRecipeStep: \windows\loadP500Flash -u fpga --target marsupial \TEMP\{FB49C34B-AF8F-785E-20BD-0D9FCFF926FB}\fpga1000a.bin: 615 ms
** BEGIN ** ExtractFileFromCabFile: cleanupFileSystem.exe
** END ** ExtractFileFromCabFile: cleanupFileSystem.exe: 164 ms
** BEGIN ** ProcessRecipeStep: \TEMP\{FB49C34B-AF8F-785E-20BD-0D9FCFF926FB}\cleanupFileSystem.exe
** END ** ProcessRecipeStep: \TEMP\{FB49C34B-AF8F-785E-20BD-0D9FCFF926FB}\cleanupFileSystem.exe: 15 ms
** BEGIN ** ExtractFileFromCabFile: infiniivisionSetup.cab
** END ** ExtractFileFromCabFile: infiniivisionSetup.cab: 8084 ms
** BEGIN ** ProcessRecipeStep: \windows\wceldcmd.exe /delete 0 \TEMP\{FB49C34B-AF8F-785E-20BD-0D9FCFF926FB}\infiniivisionSetup.cab
** END ** ProcessRecipeStep: \windows\wceldcmd.exe /delete 0 \TEMP\{FB49C34B-AF8F-785E-20BD-0D9FCFF926FB}\infiniivisionSetup.cab: 833 ms
** BEGIN ** ExtractFileFromCabFile: splashImage.png
** END ** ExtractFileFromCabFile: splashImage.png: 285 ms
** BEGIN ** ProcessRecipeStep: \windows\compileImageForSplashScreen.exe \TEMP\{FB49C34B-AF8F-785E-20BD-0D9FCFF926FB}\SplashImage.png \Secure\InfiniiVision\splashImage.bin
** END ** ProcessRecipeStep: \windows\compileImageForSplashScreen.exe \TEMP\{FB49C34B-AF8F-785E-20BD-0D9FCFF926FB}\SplashImage.png \Secure\InfiniiVision\splashImage.bin: 2438 ms
** BEGIN ** ProcessRecipeStep: \windows\rebootInfiniivision.exe
U-Boot 2010.03 (Oct 18 2011 - 14:28:06)Agilent P500
CPU: SPEAr600
DRAM: 128 MiB
Unknown id: 0x13409d. Using ST_M23P40
Flash: 64 KiB
NAND: fsmc-ecc1 128 MiB
*** Warning - bad CRC, using default environment
In: serial
Out: serial
Err: serial
SerNum:serial number not programmed
Chip: BD Board Rev: 4
Error: start address not on sector boundary
Net: unknown
BMP data is not valid. Use splash bmp
Press space to stop autoboot: 0
no link
Using unknown device
TFTP from server 192.168.1.10; our IP address is 192.168.1.100
Filename 'nk.bin'.
Load address: 0x4000000
*** Warning - bad CRC, using default environment
... it takes like 45 minutes to upload that uncompressed image through UART.
/==========================================
Updating u-boot in SPI Flash (ST M2540P IC) for EDUX1002A
Location of Uboot image in SPI firmware : 0x00010000 - 0x0003F90B
Location of Uboot environment variables: 0x00040000 - 0x00043FFF
The first 4 bytes in envvars area is a CRC32 of the envvars area in Little Endian (LSB first) format over the block 0x00040004 - 0x00043FFF (including zero bytes fill after the env variables end.)
For example if a calculated CRC32 is 98C7C680, then the first 4 bytes (0x40000-0x40003) become 80C6C798.
It is IMPORTANT to update this envvars CRC32 if envvars area is patched.
Failure to update the env variables data checksum after a change (typically by unsoldering and re-programming the U701 IC located on the bottom side of the BLT Module) will cause u-boot to load default environment variables which will lead to failed boot and NAND corruption.
To calculate CRC32 over a block of data use any existing tool which can do this, like a Hex editor.
User envvars area is located in SPI chip outside of the U-boot binary image, so if user envvars are patched, the U-boot's own header CRC32 and Data CRC32 do not need to be updated.
/==========================================
U-Boot 2010.03 (Oct 18 2011 - 14:28:06)Agilent P500
CPU: SPEAr600
DRAM: 128 MiB
Unknown id: 0x13409d. Using ST_M23P40
Flash: 64 KiB
NAND: internal ecc 128 MiB
Debug serial initialized ........OK
RTC: 2024-19-6 2:85:47.54 UTC
Microsoft Windows CE Bootloader Common Library Version 1.4 Built May 7 2015 01:38:03
Microsoft Windows CE 6.0 Ethernet Bootloader for the Agilent P500 board
Adaptation performed by Agilent Technologies (c) 2008
PHY not found.
P500 Boot Loader Configuration :
Mac address .......... (00:03:D3:04:10:00)
Ip address ........... (192.168.1.100)
Subnet Mask address .. (255.255.255.0)
DHCP ................. (Enabled)
Boot delay (seconds).. (0)
Load image 1 at startup
Image addresses. (0xdxxxxxxx for NAND, 0x8xxxxxxx for RAM)
1 (0xd0600000)
2 (0xd1e00000)
l) Load memory resident image Load image 1 now
1) Load memory resident image 1 now
2) Load memory resident image 2 now
3) Load memory resident image 3 now
d) Download from platform builder now
u) Start u-boot by resetting
v) Verify Images
>
> strings dump5.bin | grep bootdela
bootdelay
bootdelay=3
bootdelay=3
pbootdelay=0