DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?

[matthieu.e]

Hi,

I collected all the components to make the Memset mod on my DSOX2002A. 
I will first change the two strap resistors and try to convert the 200 MHz bandwidth to 350 MHz.
I have a question : do I have to put the 3000 firmware or will it be detected with the 2000 firmware ? Perhaps it is the same ?

I a second time I will upgrade the front end. What is the functionality of the components we are changing ? Is it a low pass filter ? If yes, what is cut-off frequency point before and after the mod ? Thanks.

PA0PBZ, have you fix your scope ?

[TheSteve]

The 2000 and 3000 use the same firmware. But there is no official 350 MHz 2000 series. If changing the strap resistors enabled 350 MHz then I'd say you can continue, if it gives an error or makes no change then I would stop.

The parts changed are low pass filters and the anti alias filter as far as I know.

[PA0PBZ]

PA0PBZ, have you fix your scope ?

Not yet, I've been waiting for my DXOLAN kit which unfortunately has not arrived yet. I'm getting a bit impatient so I might go for the RS232 port this weekend.

[PA0PBZ]

Well, that is kind of ' interesting'...
Hooked up the RS232 TTL port and I can see the following:

Code: [Select]

U-Boot 2010.03 (Oct 18 2011 - 14:28:06)Agilent P500

CPU:   SPEAr600
DRAM:  128 MiB
Flash: 512 KiB
NAND:  internal ecc 128 MiB

Debug serial initialized ........OK
RTC: 2016-9-3   20:57:30.34 UTC

Microsoft Windows CE Bootloader Common Library Version 1.4 Built May  7 2015 01:38:03
Microsoft Windows CE 6.0 Ethernet Bootloader for the Agilent P500 board
Adaptation performed by Agilent Technologies (c) 2008


System ready!
Preparing for download...
RTC: 2016-9-3   20:57:30.38 UTC
 Loading image 1 from memory at 0xD0600000
O
BL_IMAGE_TYPE_BIN

X
XXXXXOOOOXXOOOOOOOOXOXOOOOOOOOXOOXOXOOOOXXXOOOOOOOOOXOOOOXOXXOXXOXOXOXOXOXXXXOOXXXOOOOOOXXOXXOXXXXXXOOOXXXOXXOOXOXXOOOXOXOOOXXOOOXOOOOXOXOOOOOXOOOXOOXOXOXOXXXXXXXOXXXOOOXOOOXOXOOOOXOOOOXOXOXOOOOOOX
OOOXOOXOOOOXOOOOXOXOOOXXOOOOOOOOOXOOOOXOOOOOOXOXOOOOXOXOOOOOOOXXOOOOXOXOOOXOOOXOOXXOXOOOOXXXOXXXXXXOXOXXOXXXXXOXOXXOXXOOXXXOOXXOXXOXOOXXOXXXXOXXOOXOOOXOXXXXOOXXXOOOXOXOOOXOOXXXXXXXX
XXXXXOXrom_offset=0x0.
XXImageStart = 0x80361000, ImageLength = 0x15264A8, LaunchAddr = 0x80362000

Completed file(s):
-------------------------------------------------------------------------------
[0]: Address=0x80361000  Length=0x15264A8  Name="" Target=RAM
 Loading image 1 succeeded.
ROMHDR at Address 80361044h
Preparing launch...
RTC: 2016-9-3   20:57:33.31 UTC
Launching windows CE image by jumping at address 0x  362000

Windows CE Kernel for ARM (Thumb Enabled) Built on Mar  8 2013 at 17:05:33
Setting up for a Cold Reboot
Done Setting up for a Cold Reboot
Windows CE Firmware Init
BSP 1.0.0 for the SPEARHEAD600AB board (built Oct 22 2015)
Adaptation performed by ADENEO (c) 2005
+OALIntrInit
-OALIntrInit(rc = 1)
Initialize driver globals Zeros area...
pDrvGlobalArea 0xa0060000  size 0x800 (0xa0060800 -0xa0060000)
Initialize driver globals Zeros area...done
 OALKitlStart
Firmware Init Done.
OALIoctlHalEnterI2cCriticalSection init i2c cs
++SER_Init: context Drivers\Active\14
SER_Init, dwIndex:2
SER2 got sysintr:0x00000017
SER2 Serial Port, new baud rate:0x1c200  (UARTCLK:48000000 IBRD:0x1a FBRD:0x2)
OHCI\system.c, GCFG_USBH1_SW_RST
OHCI\system.c, GCFG_USBH2_SW_RST
-EDeviceLoadEeprom 00:30:D3:XX:XX:XX
Phy found addr 31 (ticks=6612)
WaitForLink Start (ticks=6614)
No Link (ticks=7617)
<--EDeviceInitialize

GMAC DMA status register = 0x0
BALDWIN_DDI: cBaldwinHwIf::Init: Initializing...
BALDWIN_DDI: cBaldwinHwIf::Init: Scope successfully identified.
BALDWIN_DDI: cBaldwinHwIf::Init: Success!
Running infiniiVisionInstallHelper
Failed to start/configure network.
Time for NANDFLASH to load: 1 ms.
Time for SNANDFLASH to load: 1 ms.
Our command line is
Performing Startup
Our command line is -l all -l bw50
Released build, Oct 22 2015, 11:30:59
Initializing FPGA...
****
FPGA Type: Wyoming
Ver: 2.011 Released
Build Time: Tue May 27 16:03:14 2014
Build Machine: TS2404M
****
Performing Startup
Released build, Oct 22 2015, 11:30:59
Initializing FPGA...
****
FPGA Type: Wyoming
Ver: 2.011 Released
Build Time: Tue May 27 16:03:14 2014
Build Machine: TS2404M
****
ERROR: c:\WINCE600\3RDPARTY\Agilent\HPP\Common\Drivers\sh600_serial\.\sh600_serial_drv.cpp line 661: SER2 SER Driver: does not support multiple Open()'s
Error opening UART Driver.
*** Installing License: All Licenses
*** Installing License: 500MHz Bandwidth
No option module detected
No option module detected
Front Panel UART driver reset -- Contact ChrisG
ERROR: c:\WINCE600\3RDPARTY\Agilent\HPP\Common\Drivers\sh600_serial\.\sh600_serial_drv.cpp line 661: SER2 SER Driver: does not support multiple Open()'s
Error opening UART Driver.
Front Panel UART driver reset -- Contact ChrisG
ERROR: c:\WINCE600\3RDPARTY\Agilent\HPP\Common\Drivers\sh600_serial\.\sh600_serial_drv.cpp line 661: SER2 SER Driver: does not support multiple Open()'s
Error opening UART Driver.
Front Panel UART driver reset -- Contact ChrisG

(This repeats until the cows come home)

So it at least recognizes the command line ("Our command line is -l all -l bw50"), it's happy to install the licenses ("*** Installing License: All Licenses","*** Installing License: 500MHz Bandwidth") but then where is the UART driver error coming from? Time to contact ChrisG maybe 

I can stop the boot loader but then it has no useful options for me:

Code: [Select]

U-Boot 2010.03 (Oct 18 2011 - 14:28:06)Agilent P500

CPU:   SPEAr600
DRAM:  128 MiB
Flash: 512 KiB
NAND:  internal ecc 128 MiB

Debug serial initialized ........OK
RTC: 2016-9-3   21:5:45.25 UTC

Microsoft Windows CE Bootloader Common Library Version 1.4 Built May  7 2015 01:38:03
Microsoft Windows CE 6.0 Ethernet Bootloader for the Agilent P500 board
Adaptation performed by Agilent Technologies (c) 2008



P500 Boot Loader Configuration :

Mac address .......... (00:30:D3:XX:XX:XX)
Ip address ........... (192.168.1.190)
Subnet Mask address .. (255.255.255.0)
DHCP ................. (Enabled)
Boot delay (seconds).. (0)
Load image 1 at startup

Image addresses. (0xdxxxxxxx for NAND, 0x8xxxxxxx for RAM)
        1 (0xd0600000)
        2 (0xd1600000)

l) Load memory resident image Load image 1 now
1) Load memory resident image 1 now
2) Load memory resident image 2 now
3) Load memory resident image 3 now
d) Download from platform builder now
u) Start u-boot by resetting
v) Verify Images

I tried the usual Ctrl-C's at boot but it refuses to stop loading the application and I reseated the front panel cable (because of the "Front Panel UART driver reset" but no difference. So, any idea apart from waiting for my LAN connection?

[TheSteve]

Looks like there may be some file corruption. Being the 2.41 link loads a different infiniivision file hopefully removing the link once you get the lan card will allow you to reload the 2.41 firmware.
Or perhaps some hardware failed, I assume you haven't taken the unit apart at all.

[PA0PBZ]

I assume you haven't taken the unit apart at all.

Not before it started to error, but you have to take it apart to get to the serial debug port.

[TheSteve]

How much longer until your lan card arrives, this must be driving you bonkers. Hopefully 2.41 can be reinstalled once it does arrive and that fixes it.

[PA0PBZ]

How much longer until your lan card arrives, this must be driving you bonkers. Hopefully 2.41 can be reinstalled once it does arrive and that fixes it.

I'm not really in panic mode yet  it's one of the small lessons you learn getting older. The kit should have been posted the 26th but it got delayed a little bit so I now expect to get it Tuesday at latest. Then I of course have to assemble it, see if it works and then remove the link and hope that the scope boots again. I don't think there is anything wrong with the firmware because this scope came directly from Keysight, but then again what the problem is I have no idea yet. Oh well, another learning experience both for me and others that are following this thread.

*To be continued*

[FrankBuss]

I can stop the boot loader but then it has no useful options for me:

An interesting thing to do is to load a patched version of the WindowsCE image, as I described here. Probably also possible with an USB stick, not only from network. I did this for a patched telnetd version without password (before the password was published in this thread). You could backup and restore the NAND flash as well.

[matthieu.e]

Hi,

I took picture of the strap resistors of my 2002A. I change the 10K L1 to 46,6K. I was going to change H1 but I realize that I have not got H0.
What do you think. Should I put the good value to H0 too ? Do you know the value ?

[TheSteve]

An interesting thing to do is to load a patched version of the WindowsCE image, as I described here. Probably also possible with an USB stick, not only from network. I did this for a patched telnetd version without password (before the password was published in this thread). You could backup and restore the NAND flash as well.

Would you be willing to detail the command sequence needed to backup/restore the NAND flash?

[TheSteve]

Hi,

I took picture of the strap resistors of my 2002A. I change the 10K L1 to 46,6K. I was going to change H1 but I realize that I have not got H0.
What do you think. Should I put the good value to H0 too ? Do you know the value ?

You're in uncharted territory so you may need to experiment.

[matthieu.e]

Yes, I made the changes and it activate the 500 MHz bandwidth on the 2002A. I rapidly put a signal on channel 1 and all seems to be OK.

The only problem is that I now have the 4 channels activated but I only have 2 
I soldered a 100K on H0, so I conclude H0 enable the 4 channel. What do you think ?

What is the next step, upgrade the front-end ?

[matthieu.e]

Ok, I removed H0 and I am back to two channels.

Do I have to upgrade the front end to have the 500 MHz BW ? Thanks

[matthieu.e]

Here the pictures of the DSOX2002A front-end. 
Do the modification seems possible ?

All the components you have changed seems to be on the top of this PCB version. It miss one resistor on the input.
Implantation seems to be different. What are your opinions ? I go in standby mode for now.

[FrankBuss]

An interesting thing to do is to load a patched version of the WindowsCE image, as I described here. Probably also possible with an USB stick, not only from network. I did this for a patched telnetd version without password (before the password was published in this thread). You could backup and restore the NAND flash as well.

Would you be willing to detail the command sequence needed to backup/restore the NAND flash?

I don't know it for the scope, but there are the tftpput and tftpget commands to load and write from a TFTP-server to RAM and from RAM (if the u-boot was compiled with support for it). And then there are the flash write and read commands: http://www.denx.de/wiki/view/DULG/UBootCmdGroupFlash I used this for another embedded platform to flash the initial filesystem from TFTP and worked well.

[matthieu.e]

I try to match the DSOX3000 components with the DSOX2000 components but I am not sure about L4 and R2.
What is your opinion ?

What is the Agilent 2AD2-0001 ? Is that the ASIC and have we got a datasheet ?

[TheSteve]

I compared front ends and I agree with your value designation(assuming L4 is an inductor, it is hard to be certain from the quality of the picture). It is hard to say if every value will directly translate but most look pretty close. They may also not be quite the same because the 2000 series offers a 70 MHz front end option. I don't think there is any datasheet on the Agilent front end ASIC. Do you have a signal generator to verify performance if you make the mod?

[PA0PBZ]

Well, no panic yet but let's say slightly nervous 

Got the DSOXLAN kit today so I assembled and tested it and it works okay. However...  Scope gets DHCP lease, I can ping it fine, it opens the telnet port, it acks at every telnet packet but it doesn't send anything back. Am I missing something essential here? I guess it should prompt for a login either directly after making the connection or after sending <Enter>, but nothing. 

[TheSteve]

Yes, if you telnet to it you should get a login prompt right away.

[memset]

Hello!
Something goes really wrong in your case.
Actually, your scope tries to run two instances of it's main application - default (?), marked green and one more with extra command line string (blue).
And they two race for never-tested concurrent access to some shared resources and both fail. That's a really expected outcome then you load several instances of some designed to be exclusive application.

That may put a huge load on your CPU, that's thy telnet may work very slow.

I suggest you to connect the telnet and try to wait for the server's welcome message. If you'll get it (maybe in minutes after connection), login, inspect and clean Secure\Startup folder.

Time for NANDFLASH to load: 1 ms.
Time for SNANDFLASH to load: 1 ms.
Our command line is
Performing Startup
Our command line is -l all -l bw50
Released build, Oct 22 2015, 11:30:59
Initializing FPGA...
****
FPGA Type: Wyoming
Ver: 2.011 Released
Build Time: Tue May 27 16:03:14 2014
Build Machine: TS2404M
****
Performing Startup
Released build, Oct 22 2015, 11:30:59
Initializing FPGA...
****
FPGA Type: Wyoming
Ver: 2.011 Released
Build Time: Tue May 27 16:03:14 2014
Build Machine: TS2404M
****

[memset]

I try to match the DSOX3000 components with the DSOX2000 components but I am not sure about L4 and R2.
What is your opinion ?

What is the Agilent 2AD2-0001 ? Is that the ASIC and have we got a datasheet ?

That's an ASIC, yes.
Frontend seem to be very similar to 3000-series, further simplified to remove 50-ohm paths.
Both the anti-aliasing filter and low-pass filter are clearly seen and similar to 3000-series. Attenuated low-pass signal path is somewhat different though. I think you can boost it to 350-500MHz as 1-2-3, but that's not doing to be very useful without 50-Ohm coupled input.
Use 500MHz 3000-series component values as a reference for your upgrade and save all the original parts in separate marked containers to secure your way back. You'll need a signal generator to get this work properly done.

[memset]

Got the DSOXLAN kit today so I assembled and tested it and it works okay. However...  Scope gets DHCP lease, I can ping it fine, it opens the telnet port, it acks at every telnet packet but it doesn't send anything back. Am I missing something essential here? I guess it should prompt for a login either directly after making the connection or after sending <Enter>, but nothing. 

That could be because the OS is busy dealing with two fighting main apps and flooding debug port with messages. Telnet server is started - that's why you can connect and interact with kernel's TCPIP stack. After that it could take some time to get CPU ticks for userspace telnet server process. If the scope's OS isn't completely blocked you'll be able to get telnet welcome message (maybe in several minutes after connection). If so - you're saved.

[PA0PBZ]

Something goes really wrong in your case.

Hi memset,

Yes, I was already wondering why I had 2 command line messages, and that would also explain why it complains about multiple open()'s. The only mystery is why does it do that?
I will see if eventually the telnet prompt is going to show up, thank you for giving it your attention.
 

[memset]

Yes, I was already wondering why I had 2 command line messages, and that would also explain why it complains about multiple open()'s. The only mystery is why does it do that?

V 2.41 seem to scan Secure\Startup folder for any executable files like .lnk and starts all of them. If it finds none, default registry-based startup process is executed. Possibly in your case you're got two lnk files in startup folder or starter process falls back to default start (for unknown reason) after actually running the file from startup folder.