Agilent 34461A corrupted flash

[analogRF]

well I halted in pboot prompt and now the jtag commands work and I think this probably shows where the problem is   

Code: [Select]

J-Link>w1 0xbab10000 0x90
Writing 90 -> BAB10000
J-Link>w1 0xbab20000 0x00
Writing 00 -> BAB20000
J-Link>mem 0xbab00000 5
BAB00000 = 2C F1 80 95 82                                    ,....
--------------------------------------------------------------------------
J-Link>w1 0xbab10000 0x90
Writing 90 -> BAB10000
J-Link>w1 0xbab20000 0x20
Writing 20 -> BAB20000
J-Link>mem 0xbab00000 4
BAB00000 = 4F 4E 46 49                                       ONFI
---------------------------------------------------------------------------
J-Link>w1 0xbab10000 0xec
Writing EC -> BAB10000
J-Link>w1 0xbab20000 0x00
Writing 00 -> BAB20000
J-Link>mem 0xbab00000 512

****** Error: Read memory error @ address 0xBAB00000, word access: Memory access timeout.
Could not read memory.


[analogRF]

still i think the reason it gives that error is something else I am doing wrong, still I cannot tell it is because the nand has an error

i tried again but same error

I thought it should at least read something

[ElectronMan]

still i think the reason it gives that error is something else I am doing wrong, still I cannot tell it is because the nand has an error

i tried again but same error

Maybe. I started having problems reading my parameters page with the jlink tool, and switched to OpenOCD instead of troubleshooting it. I figured that was a problem specific to my setup.

If you want to try in openOCD I can give you a config that works.

[analogRF]

still i think the reason it gives that error is something else I am doing wrong, still I cannot tell it is because the nand has an error

i tried again but same error

Maybe. I started having problems reading my parameters page with the jlink tool, and switched to OpenOCD instead of troubleshooting it. I figured that was a problem specific to my setup.

If you want to try in openOCD I can give you a config that works.

i dont have openocd right now and with your unbelievable expertise the meter is fixed and working now as normal 

I wrote the patched pboot binary provided by @ElectronMan at 0x340000 in the NAND and changed my bootcmd variable to
read pboot from the new address (instead of the original one still at 0x320000) and boot from there

The unit now boots normally and works flawlessly.

Thank you so much @ElectronMan. It was a lot of fun working with you 

[ElectronMan]

still i think the reason it gives that error is something else I am doing wrong, still I cannot tell it is because the nand has an error

i tried again but same error

Maybe. I started having problems reading my parameters page with the jlink tool, and switched to OpenOCD instead of troubleshooting it. I figured that was a problem specific to my setup.

If you want to try in openOCD I can give you a config that works.

i dont have openocd right now and with your unbelievable expertise the meter is fixed and working now as normal 

I wrote the patched pboot binary provided by @ElectronMan at 0x340000 in the NAND and changed my bootcmd variable to
read pboot from the new address (instead of the original one still at 0x320000) and boot from there

The unit now boots normally and works flawlessly.

Thank you so much @ElectronMan. It was a lot of fun working with you 

No problem, I am glad that worked!   It was out of other ideas. Keysight really should update that pboot to handle that situation properly.

[TheSteve]

Well done guys!

So what is the overall summary of the failure itself - a bad block where the original pboot sits?

[ElectronMan]

Well done guys!

So what is the overall summary of the failure itself - a bad block where the original pboot sits?

The flash chip's parameter page was apparently corrupted.

UBOOT doesn't use it. It just applies defaults based on whether the flash is Micron or not Micron, so it was unaffected.

But PBOOT just grabs the first parameter page and configures itself to talk to the flash.

I patched PBOOT to jump +256 bytes forward during the parameter load to grab the first redundant copy of the parameters page instead, and apparently that copy is good.

Really, PBOOT should be checking the checksum on the page, and automatically checking the 3 or so other copies instead of just trusting that the first copy is good.

[kanzler]

Hi!Today my device did not work. When you turn it on, there is such a picture on the screen, it does not respond to the buttons. I am attaching the download log. I ask for help in repairing, maybe someone has had such an error. Thank you.

[kanzler]

Sorry there was the wrong log file

Code: [Select]

U-Boot 2010.03 (Oct 09 2012 - 12:48:30)Agilent P510

CPU:   SPEAr320
DRAM:  128 MiB
Unknown id: 0xffffff. Using ST_M23P40
Flash: 64 KiB
NAND:  INTERNAL ECC 128 MiB
failed: 5 0
nand_bbt: Can't scan flash and build the RAM-based BBT
In:    serial
Out:   serial
Err:   serial
SerNum:MY99999999
Chip:  AA Board Rev: 4
init  RTC: 2001-02-15 15:44:10.15
Net:   No ethernet found.
splash RTC: 2001-02-15 15:44:11.18
Press space to stop autoboot:  0

NAND read: device 0 offset 0x320000, size 0x10000
 65536 bytes read: OK
## Booting kernel from Legacy Image at 00600000 ...
   Image Name:   PBOOT
   Created:      2012-05-22  16:06:43 UTC
   Image Type:   ARM Linux Kernel Image (gzip compressed)
   Data Size:    38780 Bytes = 37.9 KiB
   Load Address: 00000000
   Entry Point:  00000000
   Uncompressing Kernel Image ... OK

Starting kernel ...


Debug serial initialized ........OK
No RTC on 320

Microsoft Windows CE Bootloader Common Library Version 1.4 Built May 22 2012 09:09:57
Microsoft Windows CE 6.0 Ethernet Bootloader for the Agilent P500 board
Adaptation performed by Agilent Technologies (c) 2008

Reading NAND configuration

System ready!
Preparing for download...
No RTC on 320
 Loading image 1 from memory at 0xD0620000
O
BL_IMAGE_TYPE_BIN

X
XXXXOOOOXOXOOOOOOOXXOXXOOOOOOOXOOXOOXOOOXXXOOOOOOOOOXOOOOXOXXOXXXOXOOOXOXXXXOOXXOOOOOOXOOOOXXOOXXOOXXOXOOXOOOXOOXXOOOXOOOOXOXOOOOXOOOXOOOXXOXOXOXOXXXOXXXXOOOXOOOXOXOOOOXOOOOXOXOXOOOOOOXOOOXOOXOOOOXOXOOOOOXOXOOOOOOOOOOOXOXOOOOOOOXXOOOOOOOOXOOOOX
OXOOOXOXXOXXOOXOOXXXOXXXXOXOOXOOXOOXOOXOOXOXXOXOOXOXOOOOOOXXXXXOXOOOXOXOOOOXOOOOXOOOXOOXOOXOOOXOXXXXXXXXXXXXXXXXXXXXXXXXXrom_offset=0x0.
XXImageStart = 0x80361000, ImageLength = 0x169BC08, LaunchAddr = 0x80362000

Completed file(s):
-------------------------------------------------------------------------------
[0]: Address=0x80361000  Length=0x169BC08  Name="" Target=RAM
 Loading image 1 succeeded.
ROMHDR at Address 80361044h
Preparing launch...
No RTC on 320
Launching windows CE image by jumping at address 0x  362000

Windows CE Kernel for ARM (Thumb Enabled) Built on Mar  8 2013 at 17:05:33
Setting up for a Cold Reboot
Done Setting up for a Cold Reboot
Windows CE Firmware Init
BSP 1.0.0 for the SPEARHEAD600AB board (built Mar 18 2016)
Adaptation performed by ADENEO (c) 2005
+OALIntrInit
-OALIntrInit(rc = 1)
Initialize driver globals Zeros area...
pDrvGlobalArea 0xa0060000  size 0x800 (0xa0060800 -0xa0060000)
Initialize driver globals Zeros area...done
 OALKitlStart
Firmware Init Done.
OALIoctlHalEnterI2cCriticalSection init i2c cs
ERROR: C:\WINCE600\PLATFORM\COMMON\SRC\SOC\STM\SPEARHEAD600\DRIVERS\NandFlash\.\sh600_NandFlash.c line 57: ConfigTimming - Unable to open device registry entry
ERROR: C:\WINCE600\PLATFORM\COMMON\SRC\SOC\STM\COMMON\DRIVERS\NandFlash\.\stm_NandFlash.c line 1043: LLD_GetInfo - Unable to open device registry entry
++SER_Init: context Drivers\Active\10
SER_Init, dwIndex:2
GPIO_Select0 Register 0xB300_0024: 0x80000000
Control Register 0xB300_0010 : 0x00000040
RAS Select Register 0xB300_000C: 0xffffacf4
CORE_CLK_CFG 0xB300_0024: 0x80000000
SER2 got sysintr:0x00000013
SER2 Serial Port, new baud rate:0x1c200  (UARTCLK:83250000 IBRD:0x2d FBRD:0xa)
++SER_Init: context Drivers\Active\11
SER_Init, dwIndex:3
GPIO_Select0 Register 0xB300_0024: 0x80000000
Control Register 0xB300_0010 : 0x00000040
RAS Select Register 0xB300_000C: 0xffffacf4
CORE_CLK_CFG 0xB300_0024: 0x80000000
+OALIntrRequestSysIntr IRQ (1) already used by SYSINTR (19)
SER3 got sysintr:0x00000014
SER3 Serial Port, new baud rate:0x1c200  (UARTCLK:83250000 IBRD:0x2d FBRD:0xa)
Incorrect Data, interal ECC failed at 0x62db
Incorrect Data, interal ECC failed at 0x62db
OHCI\system.c, GCFG_USBH1_SW_RST
OHCI\system.c, GCFG_USBH2_SW_RST
-EDeviceLoadEeprom 80:09:02:05:E6:FA
Phy found addr 7 (ticks=3917)
WaitForLink Start (ticks=3919)
No Link (ticks=4921)
<--EDeviceInitialize

GMAC DMA status register = 0x0
FAILED to obtain valid Flash Handle in PlatformInitializeResetting the USB-device silicon
sh600_pdd, IOCTL_BUS_POSTINIT
ERROR: C:\WINCE600\3RDPARTY\Agilent\HPP\Common\Drivers\stm320_UsbFnBusDriver\.\ufnbus.cpp line 1137: failed opening \Agilent Flash\SPD\usbOverride
                                                                                                                                                  stm320_UsbFnBusDriver, set IST priority 96


#################### dllEntry ###########################

Exception 'Raised Exception' (-1): Thread-Id=04a90002(pth=831ff000), Proc-Id=04a80002(pprc=8327bc3c) 'Torreys.exe', VM-active=04a80002(pprc=8327bc3c) 'Torreys.exe'
PC=400256e8(coredll.dll+0x000156e8) RA=803782c8(kernel.dll+0x000062c8) SP=0002f274, BVA=ffffffff
Exception 'Raised Exception' (-1): Thread-Id=04a90002(pth=831ff000), Proc-Id=04a80002(pprc=8327bc3c) 'Torreys.exe', VM-active=04a80002(pprc=8327bc3c) 'Torreys.exe'
PC=400256e8(coredll.dll+0x000156e8) RA=803782c8(kernel.dll+0x000062c8) SP=0002efe4, BVA=ffffffff
Exception 'Raised Exception' (-1): Thread-Id=04a90002(pth=831ff000), Proc-Id=04a80002(pprc=8327bc3c) 'Torreys.exe', VM-active=04a80002(pprc=8327bc3c) 'Torreys.exe'
PC=400256e8(coredll.dll+0x000156e8) RA=803782c8(kernel.dll+0x000062c8) SP=0002efdc, BVA=ffffffff
FAILED to obtain valid Flash Handle in PlatformInitialize
SSInitialize: Error 3
FAILED to obtain valid Flash Handle in PlatformInitialize
SSInitialize: Error 3
FAILED to obtain valid Flash Handle in PlatformInitialize
SSInitialize: Error 3

[kanzler]

There is an error in my LOG, "Incorrect Data, interal ECC failed at 0x62db" what could it be?

[kanzler]

 Sorry for being stupid, but how to get uncompressed nk.bin file ?

[Eng_tech]

I have a keysight 34461A that also has I believe corrupted flash. The spear CPU is not overheating and all supply voltages in the meter are spot on. The meter does not boot up and only displays a white screen, none of the button's work, and neither does the USB connection to the meter. I haven't gone much farther then measuring supply voltages. I have purchased a used supposely working front panel for a 34460a with the front circuit board but didn't receive it yet. I know keysight says do not swap out front panels from other units but I figured I would try when I receive it. Obviously, it probably won't work due to mismatch in model/serial numbers. I didn't pay much for it. Anyways, from reading these posts it seems this problem can somewhat remedied by reflashing the NAND. Does anyone have the actual process in steps to perform this fix, including firmware images to use? Thanks, any help is appreciated. I am pretty familar with firmware programming as I do this as part of my job at work.
 

[analogRF]

I have a keysight 34461A that also has I believe corrupted flash. The spear CPU is not overheating and all supply voltages in the meter are spot on. The meter does not boot up and only displays a white screen, none of the button's work, and neither does the USB connection to the meter. I haven't gone much farther then measuring supply voltages. I have purchased a used supposely working front panel for a 34460a with the front circuit board but didn't receive it yet. I know keysight says do not swap out front panels from other units but I figured I would try when I receive it. Obviously, it probably won't work due to mismatch in model/serial numbers. I didn't pay much for it. Anyways, from reading these posts it seems this problem can somewhat remedied by reflashing the NAND. Does anyone have the actual process in steps to perform this fix, including firmware images to use? Thanks, any help is appreciated. I am pretty familar with firmware programming as I do this as part of my job at work.

i dont think anybody "reflashed" the NAND here. Certainly I didnt.
the first thing to do was to hook up the UART debug port on the front panel and see if there are any messages.
still the CPU could be dead even if it's not getting hot

[Eng_tech]

Haven't gotten around to hooking up serial just yet, but that is next. I'll report back on my findings when I do. I hate to toss this meter it was barely used by my company but is out of warranty and they were going to trash it. It was given to me to take home. Yes, the CPU could be bad as the one test point on the front panel was supposed to have a 24 khz signal on it but didn't have anything except 3.3 volts on it I think. Other voltages on the front pcb were good.

[coromonadalix]

is there antyhing in that upd  file to help recover ??

https://www.keysight.com/us/en/lib/software-detail/instrument-firmware-software/34460a34461a34465a34470a-firmware-2367633.html

[Eng_tech]

It's been a few months since I last posted about this 34461A meter with the white screen when turned on. Worked I did on it since was get a used front panel pcb from someone on Ebay that was suppose to be working but it turned out to have a shorted Spear processor pulling down the 3.3v supply to it. That person then sent me another one. Same thing shorted processor. I found a supply that have correct spear processors and purchased them. So, now in total I have 3 bad front panel boards. I decided to try replacing the spear chips. In the process I damaged 2 of the boards by tearing off pads under the spear chips while cleaning the pads off with solder wick. The third board I was lucky and sucessfully was able to put down a new spear IC. Upon powering up the meter I now get Agilent in black lettering and a black bar representing that it was booting up. After that bar reaches the end a small part of the LCD screen (upper maybe 1/5 of it) displays part of I think Windows CE loading but stops there and then nothing else after that. So, I made some progress in getting it working. I still need to attach a serial connect to the front panel to see what else is going on. I will be using a serial to usb adapter for the connection that I use to talk to PIC micocontrollers. This uses 5 vdc I/O connections. This port on the front panel is it 5 vdc tolerant. I suspect it might 3.3v. What did you use (hardware) to communicate with the front panel? I know that I am not using the original front panel now and serial numbers will not match. Should I even bother proceeding because of this?

[Eng_tech]

I got serial communications going and this is what I came up with. Maybe someone can give an opinion. I was thinking maybe loading the 2nd image and see what happens but don't know how to get to that menu while booting the unit up.

Code: [Select]

                 U-Boot 2010.03 (Oct 09 2012 - 12:48:30)Agilent P510

CPU:   SPEAr320
DRAM:  128 MiB
Unknown id: 0xffffff. Using ST_M23P40
Flash: 64 KiB
NAND:  INTERNAL ECC 128 MiB
In:    serial
Out:   serial
Err:   serial
SerNum:MY99999999
Chip:  AA Board Rev: 4
init  RTC: 2001-01-01 03:03:55.82
Net:   No ethernet found.
splash RTC: 2001-01-01 03:03:56.86
Press space to stop autoboot:  0
p510>               run bootcmd

NAND read: device 0 offset 0x320000, size 0x10000
 65536 bytes read: OK
## Booting kernel from Legacy Image at 00600000 ...
   Image Name:   PBOOT
   Created:      2012-05-22  16:06:43 UTC
   Image Type:   ARM Linux Kernel Image (gzip compressed)
   Data Size:    38780 Bytes = 37.9 KiB
   Load Address: 00000000
   Entry Point:  00000000
   Uncompressing Kernel Image ... OK

Starting kernel ...


Debug serial initialized ........OK
No RTC on 320

Microsoft Windows CE Bootloader Common Library Version 1.4 Built May 22 2012 09:09:57
Microsoft Windows CE 6.0 Ethernet Bootloader for the Agilent P500 board
Adaptation performed by Agilent Technologies (c) 2008

Reading NAND configuration
PHY not found.

System ready!
Preparing for download...
No RTC on 320
 Loading image 1 from memory at 0xD0620000
O
BL_IMAGE_TYPE_BIN
XOXImageStart = 0x80361000, ImageLength = 0x165F210, LaunchAddr = 0x80362000

Completed file(s):
-------------------------------------------------------------------------------
[0]: Address=0x80361000  Length=0x165F210  Name="" Target=RAM
 Loading image 1 succeeded.
ROMHDR at Address 80361044h
Preparing launch...
No RTC on 320
Launching windows CE image by jumping at address 0x  362000

Windows CE Kernel for ARM (Thumb Enabled) Built on Mar  8 2013 at 17:05:33
Setting up for a Cold Reboot
Done Setting up for a Cold Reboot
Windows CE Firmware Init
BSP 1.0.0 for the SPEARHEAD600AB board (built Oct 19 2017)
Adaptation performed by ADENEO (c) 2005
+OALIntrInit
-OALIntrInit(rc = 1)
Initialize driver globals Zeros area...
pDrvGlobalArea 0xa0060000  size 0x800 (0xa0060800 -0xa0060000)
Initialize driver globals Zeros area...done
 OALKitlStart
Firmware Init Done.
OALIoctlHalEnterI2cCriticalSection init i2c cs
ERROR: C:\WINCE600\PLATFORM\COMMON\SRC\SOC\STM\SPEARHEAD600\DRIVERS\NandFlash\.\sh600_NandFlash.c line 57: ConfigTimming - Unable to open device registry entry
ERROR: C:\WINCE600\PLATFORM\COMMON\SRC\SOC\STM\COMMON\DRIVERS\NandFlash\.\stm_NandFlash.c line 1043: LLD_GetInfo - Unable to open device registry entry
++SER_Init: context Drivers\Active\10
SER_Init, dwIndex:2
GPIO_Select0 Register 0xB300_0024: 0x80000000
Control Register 0xB300_0010 : 0x00000040
RAS Select Register 0xB300_000C: 0xffffacf4
CORE_CLK_CFG 0xB300_0024: 0x80000000
SER2 got sysintr:0x00000013
SER2 Serial Port, new baud rate:0x1c200  (UARTCLK:83250000 IBRD:0x2d FBRD:0xa)
++SER_Init: context Drivers\Active\11
SER_Init, dwIndex:3
GPIO_Select0 Register 0xB300_0024: 0x80000000
Control Register 0xB300_0010 : 0x00000040
RAS Select Register 0xB300_000C: 0xffffacf4
CORE_CLK_CFG 0xB300_0024: 0x80000000
+OALIntrRequestSysIntr IRQ (1) already used by SYSINTR (19)
SER3 got sysintr:0x00000014
SER3 Serial Port, new baud rate:0x1c200  (UARTCLK:83250000 IBRD:0x2d FBRD:0xa)
OHCI\system.c, GCFG_USBH1_SW_RST
OHCI\system.c, GCFG_USBH2_SW_RST
-EDeviceLoadEeprom 80:09:02:01:BF:42
Phy not found
WaitForLink Start (ticks=3751)
Link Detected (ticks=3753)

 GMAC Init : 100 Mbit/s FULL DUPLEX (MII)
Flushed Transmit Buffer
phyCfg->dwSpeed 0x64
<--EDeviceInitialize

GMAC DMA status register = 0x600004
GMAC Device enable interrupt
DriverStart
GMAC Device enable interrupt
Resetting the USB-device silicon
sh600_pdd, IOCTL_BUS_POSTINIT
ERROR: C:\WINCE600\3RDPARTY\Agilent\HPP\Common\Drivers\stm320_UsbFnBusDriver\.\ufnbus.cpp line 1137: failed opening \Agilent Flash\SPD\usbOverride
                                                                                                                                                  stm320_UsbFnBusDriver, set IST priority 96


Code: [Select]

*********************   NOR Flash Images   *********************


*********************   NAND Flash Images   *********************
Image at  offset 00000000:
   Image Name:   XLOADER
   Created:      2012-05-16  23:33:58 UTC
   Image Type:   ARM Linux Firmware (uncompressed)
   Data Size:    5370 Bytes = 5.2 KiB
   Load Address: d2800b00
   Entry Point:  d2800b00
   Verifying Checksum ... OK
Image at  offset 00020000:
   Image Name:   XLOADER
   Created:      2012-05-16  23:33:58 UTC
   Image Type:   ARM Linux Firmware (uncompressed)
   Data Size:    5370 Bytes = 5.2 KiB
   Load Address: d2800b00
   Entry Point:  d2800b00
   Verifying Checksum ... OK
Image at  offset 00040000:
   Image Name:   XLOADER
   Created:      2012-05-16  23:33:58 UTC
   Image Type:   ARM Linux Firmware (uncompressed)
   Data Size:    5370 Bytes = 5.2 KiB
   Load Address: d2800b00
   Entry Point:  d2800b00
   Verifying Checksum ... OK
Image at  offset 00060000:
   Image Name:   XLOADER
   Created:      2012-05-16  23:33:58 UTC
   Image Type:   ARM Linux Firmware (uncompressed)
   Data Size:    5370 Bytes = 5.2 KiB
   Load Address: d2800b00
   Entry Point:  d2800b00
   Verifying Checksum ... OK
Image at  offset 00100000:
   Image Name:   UBOOT
   Created:      2012-10-09  18:59:15 UTC
   Image Type:   ARM Linux Kernel Image (uncompressed)
   Data Size:    237084 Bytes = 231.5 KiB
   Load Address: 03f00000
   Entry Point:  03f00000
   Verifying Checksum ... OK
Image at  offset 00320000:
   Image Name:   PBOOT
   Created:      2012-05-22  16:06:43 UTC
   Image Type:   ARM Linux Kernel Image (gzip compressed)
   Data Size:    38780 Bytes = 37.9 KiB
   Load Address: 00000000
   Entry Point:  00000000
   Verifying Checksum ... OK
p510>


Code: [Select]

printenv
ramboot=dhcp 0x4000000 nk.bin;run bootcmd
baudrate=115200
gatewayip=192.168.1.10
netmask=255.255.255.0
chipversion=AA
boardversion=4
serialnum=MY99999999
ftp=dhcp
serverip=000.000.000.000
bootdelay=0
ecc=4
cnfg_vmc_input_pin=mw 0xb3000028 0x00040300 1;mw 0xb3000048 0xfffbffff 1
cnfg_lan_input_pin=mw 0xb3000030 0x00000008 1;mw 0xb3000050 0xFFFFFFFF 1;mw 0xb3000018 0x00000101
preboot=mw.l 0xb300000c 0xffffacf4; run cnfg_lan_input_pin; run cnfg_vmc_input_pin; splash load
dispParm1=110 1e0 989680 0 28
dispParm2=1 1 1 1 3
numinstimages=1
pbootdelay=0
fimage=1
nimages=2
image1=0xd0620000
image2=0xd2120000
fsstart=0x3020000
numfilesystems=2
lengthfilesystem1=0x4EE0000
lengthfilesystem2=0x100000
bootcmd=nand read 0x600000 0x320000 0x10000;bootm 0x600000
uart2=1
rtc=1
ps=0
splashdata=0xd0180000
erase_env=nand erase 0xC0000 0x40000
store_xloader=xload 0x800000
get_xload_eth=dhcp 0x800000 xloader-p510.bin; run store_xloader
store_uboot=nand erase 0x100000 ${blocksize}; nand write 0x800000 0x100000 ${blocksize}
get_uboot_eth=dhcp 0x800000 u-boot-p510.bin;run store_uboot
store_pboot=nand erase 0x320000 ${blocksize}; nand write 0x800000 0x320000 ${blocksize}
get_pboot_eth=dhcp 0x800000 pboot.bin;run store_pboot
flash_nkbin=dhcp 0x4000000 nk.bin;nand erase 0x00620000 ${blocksize};nand write 0x4000000 0x00620000 ${blocksize}
usbtty=cdc_acm
ethaddr=80:09:02:01:bf:42
verify=n
stdin=serial
stdout=serial
stderr=serial
ipaddr=192.168.1.166
guid={d602e6a5-bd8e-e946-827e-66229d5fb213}

Environment size: 1487/16380 bytes


[voltsandjolts]

I'm watching with interest as I have a 34461A with same symptoms as you, white screen, no uart output. Like yours, cold Spear but it probably needs replaced.

Regarding swapping the front panels - there is an soic NXP LPC 8051 type mcu on the board and IIUC it has eeprom containing the meter serial. When a new panel is connected it receives the meter serial from the motherboard and is thereafter locked to that unit (thanks Keysight, very nice of you). I need to try swapping that mcu between panels to allow panel swaps. I also see that mcu has had fw protection bypassed by glitching the reset - would be nice to get a copy of the fw and eeprom.

Looks like your pboot is OK but perhaps needs an nk.bin to boot to. Somewhat similar to the OP of this thread, after they had fixed their pboot. Maybe reading this thread from the start will provide some hints?

[Eng_tech]

Was thinking about swapping the NXP LPC 8051 from my original front panel pcb wih the front pcb I have the new sprear processor tonight. Reason is because I read in previous comments that NXP LPC 8051 may hold the meter sn. That's an easy thing to do just to make sure that's not causing issues. Easier than doing that Spear BGA. I needed to make sure the spear processor aligned up perfectly on the pcb and decided to create a kind of drop in template that I placed on the front panel. Drop the spear into it and it is exactly aligned before applying hot air to the spear and the board underside. If the switching of the NXP LPC 8051 does not make any difference in booting then I will try loading the second image. I read the entire thread and it is a lot to digest and make sense of. I'm going to try doing the easier things first.

[Eng_tech]

Swapped the  NXP LPC 8051 with my original one and it didn't make any difference in the bootup process. So, then getting to the UBoot menu options I selected to load "image 2". After that I still got the same white srceen with the black Agilent text and the loading bar at the bottom. After loading is completed I wound up with just a black screen and nothing more. No, USB communications either. Haven't tried ethernet because I don't have a crossover cable. I suppose I could use a switch which I have to connect up to my laptop. When I do load image 1 I get the white screen with black Agilent with loading bar and after it done I get a partial blue background maybe upper 1/5 of the display and then the unit freezes up and nothing more.
So, anyways here is what was displayed after booting image 2 it's only slightly different than Image 1. I'm stuck right now on what the problem is. Ran image verify and the images check good.

Code: [Select]

P500 Boot Loader Configuration :

Mac address .......... (80:09:02:01:BF:42)
Ip address ........... (192.168.1.166)
Subnet Mask address .. (255.255.255.0)
DHCP ................. (Enabled)
Boot delay (seconds).. (0)
Load image 1 at startup

Image addresses. (0xdxxxxxxx for NAND, 0x8xxxxxxx for RAM)
        1 (0xd0620000)
        2 (0xd2120000)

l) Load memory resident image Load image 1 now
1) Load memory resident image 1 now
2) Load memory resident image 2 now
3) Load memory resident image 3 now
d) Download from platform builder now
u) Start u-boot by resetting
v) Verify Images
>System ready!
Preparing for download...
No RTC on 320
 Loading image 2 from memory at 0xD2120000
O
BL_IMAGE_TYPE_BIN

X
XXOXOOOXXOOOOOOOXOOXOOOOOOXOOOOXOOOXXOOOOOOOOOXOOOOXOXOOXXOOOXOXXXOOXXOOOOOOXOOOXOOXXOOXXXOOOXOOXOOXXOOOXOOOOOXOOOXOOXOXOOXXXXXOXXXXOOOXOOOXOXOOOOXOOOOXOXOXOOOOOOXOOOXOOXOOOOOXXOOOOOXOXOOOOOOOOOXOXOOOOOOXOXOOOOOOOXOOOOXOXOOOOXOXOXXXXXOXXXXX
XOOXOOXOXXOXXXOXOOXOXOOOOXOOOOXOOOXOOXOOXOOOXOOXXXXXXXXXXXXXXXXXXOXrom_offset=0x0.
XXImageStart = 0x80361000, ImageLength = 0x111B768, LaunchAddr = 0x80362000

Completed file(s):
-------------------------------------------------------------------------------
[0]: Address=0x80361000  Length=0x111B768  Name="" Target=RAM
 Loading image 2 succeeded.
ROMHDR at Address 80361044h
Preparing launch...
No RTC on 320
Launching windows CE image by jumping at address 0x  362000

Windows CE Kernel for ARM (Thumb Enabled) Built on Mar  8 2013 at 17:05:33
Setting up for a Cold Reboot
Done Setting up for a Cold Reboot
Windows CE Firmware Init
BSP 1.0.0 for the SPEARHEAD600AB board (built Oct  2 2013)
Adaptation performed by ADENEO (c) 2005
+OALIntrInit
-OALIntrInit(rc = 1)
Initialize driver globals Zeros area...
pDrvGlobalArea 0xa0060000  size 0x800 (0xa0060800 -0xa0060000)
Initialize driver globals Zeros area...done
 OALKitlStart
Firmware Init Done.
OALIoctlHalEnterI2cCriticalSection init i2c cs
ERROR: C:\WINCE600\PLATFORM\COMMON\SRC\SOC\STM\SPEARHEAD600\DRIVERS\GPIO\.\sh600_gpio_hw.cpp line 170: GPB driver, RegQueryDword('ISTPriority') failed, status:2
ERROR: C:\WINCE600\PLATFORM\COMMON\SRC\SOC\STM\SPEARHEAD600\DRIVERS\NandFlash\.\sh600_NandFlash.c line 57: ConfigTimming - Unable to open device registry entry
ERROR: C:\WINCE600\PLATFORM\COMMON\SRC\SOC\STM\COMMON\DRIVERS\NandFlash\.\stm_NandFlash.c line 1043: LLD_GetInfo - Unable to open device registry entry
*** DLL_PROCESS_ATTACH - Current Process: 0x42, ID: 0x400002 ***
TMC_Init: context Drivers\Active\09
TMC_Init: device name is 'TMC1:'
Resetting the USB-device silicon
TMC_Init: returning 0xc07ea190
++SER_Init: context Drivers\Active\10
SER_Init, dwIndex:2
GPIO_Select0 Register 0xB300_0024: 0x80000000
Control Register 0xB300_0010 : 0x00000040
RAS Select Register 0xB300_000C: 0xffffacf4
CORE_CLK_CFG 0xB300_0024: 0x80000000
SER2 got sysintr:0x00000014
SER2 Serial Port, new baud rate:0x1c200  (UARTCLK:83250000 IBRD:0x2d FBRD:0xa)
++SER_Init: context Drivers\Active\11
SER_Init, dwIndex:3
GPIO_Select0 Register 0xB300_0024: 0x80000000
Control Register 0xB300_0010 : 0x00000040
RAS Select Register 0xB300_000C: 0xffffacf4
CORE_CLK_CFG 0xB300_0024: 0x80000000
+OALIntrRequestSysIntr IRQ (1) already used by SYSINTR (20)
SER3 got sysintr:0x00000015
SER3 Serial Port, new baud rate:0x1c200  (UARTCLK:83250000 IBRD:0x2d FBRD:0xa)
OHCI\system.c, GCFG_USBH1_SW_RST
OHCI\system.c, GCFG_USBH2_SW_RST
-EDeviceLoadEeprom 80:09:02:01:BF:42
Phy not found
WaitForLink Start (ticks=4109)
Link Detected (ticks=4111)

 GMAC Init : 100 Mbit/s FULL DUPLEX (MII)
Flushed Transmit Buffer
phyCfg->dwSpeed 0x64
<--EDeviceInitialize

GMAC DMA status register = 0x600004
GMAC Device enable interrupt
DriverStart
GMAC Device enable interrupt


[analogRF]

if you are not connected to LAN why is the meter thinking it is connected?
still it could be a hardware issue like not properly soldered BGA ball or a RAM issue.
you can test the RAM by 'mtest' command at p510> prompt
without any address, it takes a while to finish because it will check the whole RAM.
as for BGA ball suspicion, I'd recommend use heat gun with a narrow nozzle on the CPU (low temp like 200C or even less)
just for a few seconds while you power it on and see if the behavior changes.
you can also do that same thing for the RAM and see if the behavior changes

if you rule these out then most likely it is just a corrupted flash (nk.nb0 kernel is bad) and needs to be loaded
by ymodem (or tfpt from LAN) to boot the device and then perform fw upgrade.
your FW is 2.17 right now so you will need nk.nb0 extracted from FW2.17

I assume you have already tried the obvious first thing which is just putting the .UPD file (FW update file) on the USB flash
inserted in the device and power it on. that's the first thing I would have done before anything else.
I think your normal boot log shows it has fired up the USB so it may look for update file on it. Most like this will not solve the issue
but it wont do any harm .

I have the bin file extracted from the FW. if you do all the above tests and still inconclusive. just post message here
and I will tell you how to upload and boot the device using the external kernel

[Eng_tech]

Uboot and Wince are new to me as far as troubleshooting goes. I write plenty of programming code for work and home projects for many different microcontrollers and FPGAs, but I have never worked on an operating system like Wince or on someone else's equipment design when it comes to embedded OS.
I'll follow your advice and see what happens. I have not tried putting the .UPD file on a flash drive and booting. I thought the front panel USB would not be working until WinCE fully was loaded and running.
I'm pretty sure the spear is seated good and all balls are connecting. I made a small fixture to make sure the spear was aligned exactly over the pads when installed. I did redo (hot air on top and bottom of pcb) for chip yesterday just to make sure. Still, you never know as I don't have Xray machine to check it. Well, I do at work but never used it. I don't think they would be too fond of me using it for personal use but wouldn't hurt to ask I guess. It has been sitting ever since we got it. No one has ever used it yet.
As for LAN why do you think that the meter thinks it is connected to a LAN? I did do a mtest yesterday but for some reason it aborted and I didn't run it again. I'll try again today after I get out of work.
This is just a strange thing, The spear microprocessor goes bad and shorted out the 3.3 supply to it. Put new spear in and 3.3v supply source looks good now.  It appears to be a common problem with these spear processors failing and when they do NAND or RAM gets corrupted also. But anyway I'll run some more tests. I have read through the U-Boot reference manual to get better aquainted with it and it's commands.
Oh, you thought LAN was hooked up because of this.

Mac address .......... (80:09:02:01:BF:42)
Ip address ........... (192.168.1.166)
Subnet Mask address .. (255.255.255.0)
DHCP ................. (Enabled)

Only did this after loading image 2. It wasn't hooked up though.
Thanks for your assistance!

[analogRF]

Code: [Select]

WaitForLink Start (ticks=3751)
Link Detected (ticks=3753)

 GMAC Init : 100 Mbit/s FULL DUPLEX (MII)
Flushed Transmit Buffer
phyCfg->dwSpeed 0x64
<--EDeviceInitialize
although it is strange that it also says

Code: [Select]

Phy not found

still this may not point to anything though....
if the CPU is fine then the only other thing I can think of is the kernel being corrupted which needs to be loaded by ymodem (very slow)
or tftp (very fast)
still booting with a USB with FW file is good idea

I checked my logs and it seems the mtest doesnt work on these meters I think it is not implemented correctly or somthing
it works on keysight scopes though.
a pointed/localized heat gun for a few seconds on the memory chip at power on usually will detect if the RAM is bad.

if those will get you nowhere I will upload the kernel and you can boot the device either by ymodem or tftp
I highly recommend  tftp because the loading process may encounter errors and in tftp you can repeat it very quickly many times
with ymodm is very slow and if error occurs the you wasted like half an hour for nothing...
 

[Eng_tech]

Well, booting with USB stick with firmware didn't work loading either image 1 or 2. Guess I'll try what you recommend using tftp and nk.nb0. I tried hooking the LAN connection to a network switch as well as my laptop but I couldn't establish a connection. Maybe I need to make up a cross over cable and try that. What are your instructions for doing this? What program are you using to run tftp on your computer? MobaXterm?

[coromonadalix]

mobaxterm 

putty no gui, 

bitvises ssh client,  voc terminal   free for 30 days

normally the cross over era cable are supposed to be over, any good router hub should have auto mdx negotiation, all our scopes, dmm, gens  etc   are straight cables, hub will help  if the meter is in dhcp

wireshark free  maybe could be useful,   when you start the meter  you can see its ip address or any requests it will make on the network, once you find the right lan connection in wireshark
be sure your main system is not consuming data, video  audio updates ...