Agilent 34410A flash dump

[error21]

Hello everyone.
    Can somebody please help me with a flash dump ( U1001 ) mine is a S29GL064 (maybe a dump of U1104 would help as well). Mine keeps rebooting itself. I did all kind of hacks, including converting the firmware and writing it to the flash and I can get it to work to some degree, but as soon as I do a firmware update, it jut reboots itself, regardless of the version of the firmware.
    I wated attach the firmware from my 34410A (the one that does not reboot at least), but it never manages to fully boot. (I can issue shell commands to it)

Thanks

[coromonadalix]

I dont think any dump exists beside yours,  maybe ask Keysight to order the 2 chips programmed

[wictor]

You can download 34410a FW update from Keysight. Can't you use that?

[error21]

So here is what I found so far. On the U1001 (flash) there are 2 vxworks. one is the main firmware and one seems to be a "backup" in case there is a firmware issue and the main firmware cannot boot ( i thinks it is used for recovery ). That is the one that boots for me. After I do a firmware update software goes back and boots the updated firmware which keeps rebooting itself. I did change the ram chips as well as I had thought that the ram was at fault, but it was pointless.

Here is the "backup" firmware booting

Code: [Select]

Attaching interface lo0...done

Adding 8330 symbols for standalone.
AMDFLASH
-> KOM_gpib_config
KOM_int_cfgn
0x1d92478 (tUsb): Config EBIU USB Asynchronous Timings
0x1d92478 (tUsb): Previous USB EBIU_DCR_BR: 10188398
0x1d92478 (tUsb): NEW USB EBIU_DCR_BR: 10188368
*** Default MAC address, not using DHCP ***
IP address = 169.254.4.10
+------------------------------------------------------------
| GPIB is enabled
| USB is enabled
| Sockets Server is running on port 5025
| Telnet Server is running on port 5024
| VXI-11 Server is running
+------------------------------------------------------------

->

and here is the main firmware that keeps rebooting itself

Code: [Select]

Attaching interface lo0...done

Adding 26811 symbols for standalone.
AMDFLASH
-> Attaching interface lo0...done

Adding 26811 symbols for standalone.
AMDFLASH
-> Attaching interface lo0...done

Adding 26811 symbols for standalone.
AMDFLASH
-> Attaching interface lo0...done

Adding 26811 symbols for standalone.
AMDFLASH
-> Attaching interface lo0...done
.....

maybe it's the U1000 chip that is bad?
Maybe there is a way to force the backup firmware to boot instead of the main one. I did try a pullup/pulldown on all pins of J1103 but without success. Maybe it's done via J1201

[wictor]

There might be some key combination through console that can interrupt the boot and then you can command it to load other FW. I have worked with VxWorks too long ago and cannot remember the details...

[error21]

Could somebody please get me a dump of U1104 ( it's a 24C16 ). It's the last one I can try before replacing the ASIC itself.

I did try all kinds of possible combinations in order to make the secondary image boot, but without success

[ddcc]

From looking at your partially working dump, I noticed a couple of things:

• Whatever programmer/software you used to dump the firmware seems to have swapped the byte endianness. I ended up using dd conv=swab to first fix this.
• Offset 0x00000010 through 0x00351518 matches Agilent's public release of firmware 2.41 (VxWorks 5.5.1, built May 15 2015, 17:52:06), which is slightly older than the latest 2.43 (VxWorks 5.5.1, built Jan 12 2017, 21:49:22)
• Offset 0x00602100 through 0x006c320c appears to contain a second unknown firmware (VxWorks 5.5.1, built Jul 26 2006, 11:36:00). It's probably an older firmware version, but since Keysight's website only has 2.41 and 2.43 available for download, I don't know what version it is.
• There's some miscellaneous smaller segments of data in your dump that I can't identify.
• I don't fully understand the Agilent firmware updater, but it appears to make changes to multiple memory segments. Taking the following with a grain of salt, inspection of the 2.41 update suggests the following regions:
  
  0x500035152 - 0x500035153
  0xdff800000 - 0xdff800009
  0x5ff800010 - 0x5ffb51510 (main binary)
  0xdffb51510 - 0xdffb51519
  0x4000000fb - 0x4000000fb