Author Topic: Agilent 34461A corrupted flash  (Read 22529 times)

0 Members and 1 Guest are viewing this topic.

Online analogRF

  • Super Contributor
  • ***
  • Posts: 1024
  • Country: ca
Re: Agilent 34461A corrupted flash
« Reply #50 on: July 29, 2023, 10:31:14 pm »
I managed to get into the bootloader menu on my good meter (you must be very quick in pressing the space after bootcmd command) and as I expected, there the image addresses are d0620000 and d2120000 which matches the env variables. and also the "v" command (verify images) works but on my bad meter the image addresses are wrong and the verify command just hangs and i have to power down.

definitely the unit tries to read image from wrong address.

where are the bootloader parameters stored?

I checked my p-boot dump and it is exactly identical to the good meter

 

Online analogRF

  • Super Contributor
  • ***
  • Posts: 1024
  • Country: ca
Re: Agilent 34461A corrupted flash
« Reply #51 on: July 29, 2023, 10:51:01 pm »
does anybody know where is the 64kB flash memory indicated in the u-boot:
Code: [Select]
CPU:   SPEAr320
DRAM:  128 MiB
Unknown id: 0xffffff. Using ST_M23P40
Flash: 64 KiB
NAND:  INTERNAL ECC 128 MiB

there is not flash memory on the board. Just the NAND and RAM.
« Last Edit: July 29, 2023, 10:53:38 pm by analogRF »
 

Online analogRF

  • Super Contributor
  • ***
  • Posts: 1024
  • Country: ca
Re: Agilent 34461A corrupted flash
« Reply #52 on: July 30, 2023, 01:42:28 am »
even the difference between the wrong  image addresses is about 19MB which is too small. I mean if one image would have been at d0400000 it would have overlapped with the second image.

where does pboot gets it boot parameters from?

I just noticed that when the bootloader stops it also reports a false MAC address 04:02:02:20:02:02 instead of the correct one 80:09:02:0e:7a:4f
nonetheless I am able to use "download from platform builder" option to get the nk.bin file over the ethernet and boot the meter. It gets IP using the wrong MAC address. But after booting, the meter shows the correct mac address!?

So it is reading whole bunch of wrong boot parameters from somewhere...
« Last Edit: July 30, 2023, 02:41:07 am by analogRF »
 

Online tv84

  • Super Contributor
  • ***
  • Posts: 3353
  • Country: pt
Re: Agilent 34461A corrupted flash
« Reply #53 on: July 30, 2023, 10:52:37 am »
@ElectronMan or @TheSteve might give you a hand here.
 

Offline coromonadalix

  • Super Contributor
  • ***
  • Posts: 7103
  • Country: ca
Re: Agilent 34461A corrupted flash
« Reply #54 on: July 30, 2023, 12:17:27 pm »
mabe searching  windows CE or embedded booting processes could give an hint ??
 

Online analogRF

  • Super Contributor
  • ***
  • Posts: 1024
  • Country: ca
Re: Agilent 34461A corrupted flash
« Reply #55 on: July 30, 2023, 12:29:28 pm »
@ElectronMan or @TheSteve might give you a hand here.
I hope they come here and have a look

FWIW here is the .bin file of the P-Boot taken from my good 34461A and it is identical to the one from the bad meter
and also identical to those posted earlier in this thread by others
I am not able to figure out where it is getting its boot parameters from. Certainly not from the environment variables
because they are ok. Unless there is another hidden copy of them which is bad?
 

Offline ElectronMan

  • Regular Contributor
  • *
  • Posts: 111
  • Country: us
Re: Agilent 34461A corrupted flash
« Reply #56 on: July 30, 2023, 04:05:51 pm »
@ElectronMan or @TheSteve might give you a hand here.
I hope they come here and have a look

FWIW here is the .bin file of the P-Boot taken from my good 34461A and it is identical to the one from the bad meter
and also identical to those posted earlier in this thread by others
I am not able to figure out where it is getting its boot parameters from. Certainly not from the environment variables
because they are ok. Unless there is another hidden copy of them which is bad?

This looks like a problem with the CE bootloader (the stage after Uboot) or the flash. It could be that part of the NAND flash is completely unusable.

Do you happen to have the output when updating firmware? Are there any errors while writing the image?
 

Online analogRF

  • Super Contributor
  • ***
  • Posts: 1024
  • Country: ca
Re: Agilent 34461A corrupted flash
« Reply #57 on: July 30, 2023, 04:11:50 pm »
@ElectronMan or @TheSteve might give you a hand here.
I hope they come here and have a look

FWIW here is the .bin file of the P-Boot taken from my good 34461A and it is identical to the one from the bad meter
and also identical to those posted earlier in this thread by others
I am not able to figure out where it is getting its boot parameters from. Certainly not from the environment variables
because they are ok. Unless there is another hidden copy of them which is bad?

This looks like a problem with the CE bootloader (the stage after Uboot) or the flash. It could be that part of the NAND flash is completely unusable.

Do you happen to have the output when updating firmware? Are there any errors while writing the image?

yes the bootloader is reading wrong parameters (image address, mac address, ...are all wrong)
when the unit was updating FW the UART was connected but there were no messages.

as far as I can tell the part of FW update that finished was just copying the Nk.bin (original from the FW pack) into d0620000 and I can see it is there and seems to be correct. But I guess the FW will also do some stuff after rebooting the unit however in this case it does not get there because on the reboot, it reads the wrong addresses and fails to boot.
 
 

Offline ElectronMan

  • Regular Contributor
  • *
  • Posts: 111
  • Country: us
Re: Agilent 34461A corrupted flash
« Reply #58 on: July 30, 2023, 04:29:30 pm »
@ElectronMan or @TheSteve might give you a hand here.
I hope they come here and have a look

FWIW here is the .bin file of the P-Boot taken from my good 34461A and it is identical to the one from the bad meter
and also identical to those posted earlier in this thread by others
I am not able to figure out where it is getting its boot parameters from. Certainly not from the environment variables
because they are ok. Unless there is another hidden copy of them which is bad?

This looks like a problem with the CE bootloader (the stage after Uboot) or the flash. It could be that part of the NAND flash is completely unusable.

Do you happen to have the output when updating firmware? Are there any errors while writing the image?

yes the bootloader is reading wrong parameters (image address, mac address, ...are all wrong)
when the unit was updating FW the UART was connected but there were no messages.

as far as I can tell the part of FW update that finished was just copying the Nk.bin (original from the FW pack) into d0620000 and I can see it is there and seems to be correct. But I guess the FW will also do some stuff after rebooting the unit however in this case it does not get there because on the reboot, it reads the wrong addresses and fails to boot.

Yeah, it looks like it loads those parameters from a location that it can't read right now, so loads those incorrect settings instead.:
Code: [Select]
CRC does not match for NAND AFFF475B F381A23
ERROR : Bootloader setting load failed
INFO : Loading default bootloader settings

I am trying to locate this config information
 

Online analogRF

  • Super Contributor
  • ***
  • Posts: 1024
  • Country: ca
Re: Agilent 34461A corrupted flash
« Reply #59 on: July 30, 2023, 04:54:24 pm »
what is interesting is that earlier in the thread where @dc101 had very similar issue as mine, he also reported the pboot is thinking image addresses are d0400000 and d1700000 exactly like my unit! :-// :-//
I have also seen a similar issue in some broken 3000A scopes that also reported image address at d0400000 which again wrong for those scopes.
 

Online analogRF

  • Super Contributor
  • ***
  • Posts: 1024
  • Country: ca
Re: Agilent 34461A corrupted flash
« Reply #60 on: July 30, 2023, 05:12:21 pm »
FWIW when I get the pboot prompt to choose how to boot and I choose option "d" (download from platform builder) here is the boot log until the unit is fully booted and the meter works perfectly after that for hours until I turn it off

Code: [Select]
......

FMD_DirectRead: Invalid block at sector 0xffc0 bumping by 0x40 sectors
CRC does not match for NAND AF7F475B 3665EF2
ERROR : Bootloader setting load failed
INFO : Loading default bootloader settings

Press [ENTER] to launch image stored in flash or [SPACE] to cancel.
Initiating image launch in   5 seconds

P500 Boot Loader Configuration :

Mac address .......... (04:02:02:20:02:02)
Ip address ........... (192.168.114.201)
Subnet Mask address .. (255.255.255.0)
DHCP ................. (Enabled)
Boot delay (seconds).. (5)
Load image 3 at startup

Image addresses. (0xdxxxxxxx for NAND, 0x8xxxxxxx for RAM)
        1 (0xd0400000)
        2 (0xd1700000)
        3 (0x84000000)

l) Load memory resident image Load image 3 now
1) Load memory resident image 1 now
2) Load memory resident image 2 now
3) Load memory resident image 3 now
d) Download from platform builder now
u) Start u-boot by resetting
v) Verify Images
>System ready!
Preparing for download...
No RTC on 320
 Downloading image from platform builder
Setting MAC address GMAC_MAC_ADDR_HI_LO[0] = 0x80000202, GMAC_MAC_ADDR_HI_LO[1] = 0x20020204
Auto Negotiation complete in 120192 iterations
Link up
AutoNegotiate Full Duplex
AutoNegotiate 100 Base T
Reading MAC address 0x402 0x220 0x202
Setting MAC address GMAC_MAC_ADDR_HI_LO[0] = 0x80000202, GMAC_MAC_ADDR_HI_LO[1] = 0x20020204
INFO: GMAC Ethernet controller initialized.
InitDHCP():: Calling ProcessDHCP()
ProcessDHCP()::DHCP_INIT
Got Response from DHCP server, IP address: 10.0.0.13

ProcessDHCP()::DHCP IP Address Resolved as 10.0.0.13, netmask: 255.255.255.0
Lease time: 172800 seconds
Got Response from DHCP server, IP address: 10.0.0.13
No ARP response in 2 seconds, assuming ownership of 10.0.0.13
+EbootSendBootmeAndWaitForTftp
Sent BOOTME to 255.255.255.255
Packet has the following data:
  boot.bin[NULL]octet[NULL]
TFTP packet could have 1 name/value pairs
Locked Down Link 1
Src IP 10.0.0.13 Port 03D4   Dest IP 10.0.0.223 Port 0499
Default TFTP block size set to: 512 bytes
There were no options detected in the TFTP
EthDown::TFTPD_OPEN::boot.bin
-EbootSendBootmeAndWaitForTftp

BL_IMAGE_TYPE_BIN

X
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
XXXXXrom_offset=0x0.
XXImageStart = 0x80361000, ImageLength = 0x185E320, LaunchAddr = 0x80362000

Completed file(s):
-------------------------------------------------------------------------------
[0]: Address=0x80361000  Length=0x185E320  Name="" Target=RAM
 Loading image 3 succeeded.
ROMHDR at Address 80361044h
Preparing launch...
No RTC on 320
Got EDBG_CMD_JUMPIMG
Got EDBG_CMD_CONFIG, flags:0x00000000
Launching windows CE image by jumping at address 0x  362000

Windows CE Kernel for ARM (Thumb Enabled) Built on Mar  8 2013 at 17:05:33
Setting up for a Cold Reboot
Done Setting up for a Cold Reboot
Windows CE Firmware Init
BSP 1.0.0 for the SPEARHEAD600AB board (built Jul  2 2021)
Adaptation performed by ADENEO (c) 2005
+OALIntrInit
-OALIntrInit(rc = 1)
Initialize driver globals Zeros area...
pDrvGlobalArea 0xa0060000  size 0x800 (0xa0060800 -0xa0060000)
Initialize driver globals Zeros area...done
 OALKitlStart
Firmware Init Done.
OALIoctlHalEnterI2cCriticalSection init i2c cs
ERROR: C:\WINCE600\PLATFORM\COMMON\SRC\SOC\STM\SPEARHEAD600\DRIVERS\NandFlash\.\sh600_NandFlash.c line 57: ConfigTimming - Unable to opey
ERROR: C:\WINCE600\PLATFORM\COMMON\SRC\SOC\STM\COMMON\DRIVERS\NandFlash\.\stm_NandFlash.c line 1043: LLD_GetInfo - Unable to open devicey
++SER_Init: context Drivers\Active\10
SER_Init, dwIndex:2
GPIO_Select0 Register 0xB300_0024: 0x80000000
Control Register 0xB300_0010 : 0x00000040
RAS Select Register 0xB300_000C: 0xffffacf4
CORE_CLK_CFG 0xB300_0024: 0x80000000
SER2 got sysintr:0x00000013
SER2 Serial Port, new baud rate:0x1c200  (UARTCLK:83250000 IBRD:0x2d FBRD:0xa)
++SER_Init: context Drivers\Active\11
SER_Init, dwIndex:3
GPIO_Select0 Register 0xB300_0024: 0x80000000
Control Register 0xB300_0010 : 0x00000040
RAS Select Register 0xB300_000C: 0xffffacf4
CORE_CLK_CFG 0xB300_0024: 0x80000000
+OALIntrRequestSysIntr IRQ (1) already used by SYSINTR (19)
SER3 got sysintr:0x00000014
SER3 Serial Port, new baud rate:0x1c200  (UARTCLK:83250000 IBRD:0x2d FBRD:0xa)
OHCI\system.c, GCFG_USBH1_SW_RST
OHCI\system.c, GCFG_USBH2_SW_RST
-EDeviceLoadEeprom 80:09:02:0E:7A:4F
Phy found addr 7 (ticks=5100)
WaitForLink Start (ticks=5101)
Link Detected (ticks=5104)

 GMAC Init : 100 Mbit/s FULL DUPLEX (MII)
Flushed Transmit Buffer
phyCfg->dwSpeed 0x64
<--EDeviceInitialize

GMAC DMA status register = 0x600004
GMAC Device enable interrupt
DriverStart
GMAC Device enable interrupt
LIN: Data Valid
Resetting the USB-device silicon
sh600_pdd, IOCTL_BUS_POSTINIT
ERROR: C:\WINCE600\3RDPARTY\Agilent\HPP\Common\Drivers\stm320_UsbFnBusDriver\.\ufnbus.cpp line 1137: failed opening \Agilent Flash\SPD\ue
                                                                                                                                        6
Autonegociation Start (ticks=7141)
+StartAutoNegotiation: pDeviceContext 0xd0506be0
Autonegociation End (ticks=9651)
WaitForLink Start (ticks=9652)
Link Detected (ticks=9655)

 GMAC Init : 100 Mbit/s FULL DUPLEX (MII)
cable attached
SHIM DLL, LoadRealDll [PalSysManagement.dll] for [AgilentPalSysManagement.dll]
SHIM [AgilentPalSysManagement.dll] Get Process Addresses
SHIM DLL, LoadRealDll [PalIO.dll] for [AgilentPalIO.dll]
SHIM [AgilentPalIO.dll] Get Process Addresses


#################### dllEntry ###########################

FP:Platform identified as MSP430-type based on 1182 mV
FP:IdEprom File [\Windows\AgtFrontPanelIdEpromData.34460-66502.xml] does not exist
FP:Platform identified as MSP430-type based on 1184 mV
FP:IdEprom File [\Windows\AgtFrontPanelIdEpromData.34460-66502.xml] does not exist
SER3 Serial Port, new baud rate:0x2faf08  (UARTCLK:83250000 IBRD:0x1 FBRD:0x2a)
Inguard Bootup Complete -- OK
InguardBootup Buffered Test Signal detected
FP:INVALID CID read, 0x01
FP:INVALID CID read, 0xff
FP:INVALID CID read, 0xff
FP:INVALID CID read, 0x33
FP:INVALID CID read, 0x16
FP:INVALID CID read, 0x88
FP:INVALID CID read, 0x6b
FP:INVALID CID read, 0x40
FP:DoCommand [2] FAILED 0x[80040302]
FP:DoCommand [2] Retry [1] Error was 0x[80040302]
FP:DoCommand [2] Final call Error 0x[0]
SHIM DLL, LoadRealDll [PalCaps.dll] for [AgilentPalCaps.dll]
SHIM [AgilentPalCaps.dll] Get Process Addresses
SHIM DLL, LoadRealDll [PalSStorage.dll] for [AgilentPalSStorage.dll]
SHIM [AgilentPalSStorage.dll] Get Process Addresses
SHIM DLL, LoadRealDll [PalWin32.dll] for [AgilentPalWin32.dll]
SHIM [AgilentPalWin32.dll] Get Process Addresses
SHIM DLL, LoadRealDll [PalWin32.dll] for [AgilentPalWin32.dll]
SHIM [AgilentPalWin32.dll] Get Process Addresses
SHIM DLL, LoadRealDll [PalSStorage.dll] for [AgilentPalSStorage.dll]
SHIM [AgilentPalSStorage.dll] Get Process Addresses
SHIM DLL, LoadRealDll [PalSysManagement.dll] for [AgilentPalSysManagement.dll]
SHIM [AgilentPalSysManagement.dll] Get Process Addresses
SHIM DLL, LoadRealDll [PalCaps.dll] for [AgilentPalCaps.dll]
SHIM [AgilentPalCaps.dll] Get Process Addresses
AgilentLxiWebStartUp successfully started LXI web service.]FMD_DirectRead: Invalid block at sector 0xfec0 bumping by 0x40 sectors
FMD_DirectRead: Invalid block at sector 0xff00 bumping by 0x40 sectors
FMD_DirectRead: Invalid block at sector 0xff40 bumping by 0x40 sectors
FMD_DirectRead: Invalid block at sector 0xff80 bumping by 0x40 sectors
FMD_DirectRead: Invalid block at sector 0xffc0 bumping by 0x40 sectors
CRC does not match for NAND AF7F475B 3665EF2
ERROR : Bootloader setting load failed
INFO : Loading default bootloader settings

Press [ENTER] to launch image stored in flash or [SPACE] to cancel.
Initiating image launch in   5 seconds

P500 Boot Loader Configuration :

Mac address .......... (04:02:02:20:02:02)
Ip address ........... (192.168.114.201)
Subnet Mask address .. (255.255.255.0)
DHCP ................. (Enabled)
Boot delay (seconds).. (5)
Load image 3 at startup

Image addresses. (0xdxxxxxxx for NAND, 0x8xxxxxxx for RAM)
        1 (0xd0400000)
        2 (0xd1700000)
        3 (0x84000000)

l) Load memory resident image Load image 3 now
1) Load memory resident image 1 now
2) Load memory resident image 2 now
3) Load memory resident image 3 now
d) Download from platform builder now
u) Start u-boot by resetting
v) Verify Images
>System ready!
Preparing for download...
No RTC on 320
 Downloading image from platform builder
Setting MAC address GMAC_MAC_ADDR_HI_LO[0] = 0x80000202, GMAC_MAC_ADDR_HI_LO[1] = 0x20020204
Auto Negotiation complete in 120192 iterations
Link up
AutoNegotiate Full Duplex
AutoNegotiate 100 Base T
Reading MAC address 0x402 0x220 0x202
Setting MAC address GMAC_MAC_ADDR_HI_LO[0] = 0x80000202, GMAC_MAC_ADDR_HI_LO[1] = 0x20020204
INFO: GMAC Ethernet controller initialized.
InitDHCP():: Calling ProcessDHCP()
ProcessDHCP()::DHCP_INIT
Got Response from DHCP server, IP address: 10.0.0.13

ProcessDHCP()::DHCP IP Address Resolved as 10.0.0.13, netmask: 255.255.255.0
Lease time: 172800 seconds
Got Response from DHCP server, IP address: 10.0.0.13
No ARP response in 2 seconds, assuming ownership of 10.0.0.13
+EbootSendBootmeAndWaitForTftp
Sent BOOTME to 255.255.255.255
Packet has the following data:
  boot.bin[NULL]octet[NULL]
TFTP packet could have 1 name/value pairs
Locked Down Link 1
Src IP 10.0.0.13 Port 03D4   Dest IP 10.0.0.223 Port 0499
Default TFTP block size set to: 512 bytes
There were no options detected in the TFTP
EthDown::TFTPD_OPEN::boot.bin
-EbootSendBootmeAndWaitForTftp

BL_IMAGE_TYPE_BIN

X
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
XXXXXrom_offset=0x0.
XXImageStart = 0x80361000, ImageLength = 0x185E320, LaunchAddr = 0x80362000

Completed file(s):
-------------------------------------------------------------------------------
[0]: Address=0x80361000  Length=0x185E320  Name="" Target=RAM
 Loading image 3 succeeded.
ROMHDR at Address 80361044h
Preparing launch...
No RTC on 320
Got EDBG_CMD_JUMPIMG
Got EDBG_CMD_CONFIG, flags:0x00000000
Launching windows CE image by jumping at address 0x  362000

Windows CE Kernel for ARM (Thumb Enabled) Built on Mar  8 2013 at 17:05:33
Setting up for a Cold Reboot
Done Setting up for a Cold Reboot
Windows CE Firmware Init
BSP 1.0.0 for the SPEARHEAD600AB board (built Jul  2 2021)
Adaptation performed by ADENEO (c) 2005
+OALIntrInit
-OALIntrInit(rc = 1)
Initialize driver globals Zeros area...
pDrvGlobalArea 0xa0060000  size 0x800 (0xa0060800 -0xa0060000)
Initialize driver globals Zeros area...done
 OALKitlStart
Firmware Init Done.
OALIoctlHalEnterI2cCriticalSection init i2c cs
ERROR: C:\WINCE600\PLATFORM\COMMON\SRC\SOC\STM\SPEARHEAD600\DRIVERS\NandFlash\.\sh600_NandFlash.c line 57: ConfigTimming - Unable to opey
ERROR: C:\WINCE600\PLATFORM\COMMON\SRC\SOC\STM\COMMON\DRIVERS\NandFlash\.\stm_NandFlash.c line 1043: LLD_GetInfo - Unable to open devicey
++SER_Init: context Drivers\Active\10
SER_Init, dwIndex:2
GPIO_Select0 Register 0xB300_0024: 0x80000000
Control Register 0xB300_0010 : 0x00000040
RAS Select Register 0xB300_000C: 0xffffacf4
CORE_CLK_CFG 0xB300_0024: 0x80000000
SER2 got sysintr:0x00000013
SER2 Serial Port, new baud rate:0x1c200  (UARTCLK:83250000 IBRD:0x2d FBRD:0xa)
++SER_Init: context Drivers\Active\11
SER_Init, dwIndex:3
GPIO_Select0 Register 0xB300_0024: 0x80000000
Control Register 0xB300_0010 : 0x00000040
RAS Select Register 0xB300_000C: 0xffffacf4
CORE_CLK_CFG 0xB300_0024: 0x80000000
+OALIntrRequestSysIntr IRQ (1) already used by SYSINTR (19)
SER3 got sysintr:0x00000014
SER3 Serial Port, new baud rate:0x1c200  (UARTCLK:83250000 IBRD:0x2d FBRD:0xa)
OHCI\system.c, GCFG_USBH1_SW_RST
OHCI\system.c, GCFG_USBH2_SW_RST
-EDeviceLoadEeprom 80:09:02:0E:7A:4F
Phy found addr 7 (ticks=5100)
WaitForLink Start (ticks=5101)
Link Detected (ticks=5104)

 GMAC Init : 100 Mbit/s FULL DUPLEX (MII)
Flushed Transmit Buffer
phyCfg->dwSpeed 0x64
<--EDeviceInitialize

GMAC DMA status register = 0x600004
GMAC Device enable interrupt
DriverStart
GMAC Device enable interrupt
LIN: Data Valid
Resetting the USB-device silicon
sh600_pdd, IOCTL_BUS_POSTINIT
ERROR: C:\WINCE600\3RDPARTY\Agilent\HPP\Common\Drivers\stm320_UsbFnBusDriver\.\ufnbus.cpp line 1137: failed opening \Agilent Flash\SPD\ue
                                                                                                                                        6
Autonegociation Start (ticks=7141)
+StartAutoNegotiation: pDeviceContext 0xd0506be0
Autonegociation End (ticks=9651)
WaitForLink Start (ticks=9652)
Link Detected (ticks=9655)

 GMAC Init : 100 Mbit/s FULL DUPLEX (MII)
cable attached
SHIM DLL, LoadRealDll [PalSysManagement.dll] for [AgilentPalSysManagement.dll]
SHIM [AgilentPalSysManagement.dll] Get Process Addresses
SHIM DLL, LoadRealDll [PalIO.dll] for [AgilentPalIO.dll]
SHIM [AgilentPalIO.dll] Get Process Addresses


#################### dllEntry ###########################

FP:Platform identified as MSP430-type based on 1182 mV
FP:IdEprom File [\Windows\AgtFrontPanelIdEpromData.34460-66502.xml] does not exist
FP:Platform identified as MSP430-type based on 1184 mV
FP:IdEprom File [\Windows\AgtFrontPanelIdEpromData.34460-66502.xml] does not exist
SER3 Serial Port, new baud rate:0x2faf08  (UARTCLK:83250000 IBRD:0x1 FBRD:0x2a)
Inguard Bootup Complete -- OK
InguardBootup Buffered Test Signal detected
FP:INVALID CID read, 0x01
FP:INVALID CID read, 0xff
FP:INVALID CID read, 0xff
FP:INVALID CID read, 0x33
FP:INVALID CID read, 0x16
FP:INVALID CID read, 0x88
FP:INVALID CID read, 0x6b
FP:INVALID CID read, 0x40
FP:DoCommand [2] FAILED 0x[80040302]
FP:DoCommand [2] Retry [1] Error was 0x[80040302]
FP:DoCommand [2] Final call Error 0x[0]
SHIM DLL, LoadRealDll [PalCaps.dll] for [AgilentPalCaps.dll]
SHIM [AgilentPalCaps.dll] Get Process Addresses
SHIM DLL, LoadRealDll [PalSStorage.dll] for [AgilentPalSStorage.dll]
SHIM [AgilentPalSStorage.dll] Get Process Addresses
SHIM DLL, LoadRealDll [PalWin32.dll] for [AgilentPalWin32.dll]
SHIM [AgilentPalWin32.dll] Get Process Addresses
SHIM DLL, LoadRealDll [PalWin32.dll] for [AgilentPalWin32.dll]
SHIM [AgilentPalWin32.dll] Get Process Addresses
SHIM DLL, LoadRealDll [PalSStorage.dll] for [AgilentPalSStorage.dll]
SHIM [AgilentPalSStorage.dll] Get Process Addresses
SHIM DLL, LoadRealDll [PalSysManagement.dll] for [AgilentPalSysManagement.dll]
SHIM [AgilentPalSysManagement.dll] Get Process Addresses
SHIM DLL, LoadRealDll [PalCaps.dll] for [AgilentPalCaps.dll]
SHIM [AgilentPalCaps.dll] Get Process Addresses
AgilentLxiWebStartUp successfully started LXI web service.


the MAC address is wrong at this point but when the meter boots it has the correct MAC address and its IP becomes 10.0.0.7
instead of 10.0.0.13
« Last Edit: July 30, 2023, 05:15:48 pm by analogRF »
 

Offline ElectronMan

  • Regular Contributor
  • *
  • Posts: 111
  • Country: us
Re: Agilent 34461A corrupted flash
« Reply #61 on: July 30, 2023, 05:36:20 pm »
so far at least I managed to get rid of the stupid YMODEM and used CEloader.exe to upload the uncompressed nk.bin file
to the meter after it fails to boot and I have the option to boot from platform builder. thats 1000 times faster than YMODEM
but still the problem remains. after successfully booting the meter and re -flashing firmware, it reboots into the exact same condition

I am now fairly convinced that the unit tries to load image #1 at d0400000 which is the wrong address. It must be d0620000
and I know for fact that there lies a good FW image at d0620000. I have checked it.

I just do not know where the unit is getting those wrong addresses from. Even the RAM address 84000000 (image #3) is wrong and it must be 80361000

any idea?

The PBOOT loader is trying to read the config from sector 0x180 in flash. It appears to be using flash page-sized sectors of 2048 bytes, so that puts it at the beginning of the 7th flash block at byte 0xC0000. In my flash, that contains this config, with a CRC32 in the first 4 bytes. It looks similar to the UBOOT config, but is null-separated (I've attached a copy). If you can read that flash location and see what is there, it may illuminate things.

With any luck, that block just needs rewritten.
 
The following users thanked this post: analogRF

Online analogRF

  • Super Contributor
  • ***
  • Posts: 1024
  • Country: ca
Re: Agilent 34461A corrupted flash
« Reply #62 on: July 30, 2023, 06:01:05 pm »

The PBOOT loader is trying to read the config from sector 0x180 in flash. It appears to be using flash page-sized sectors of 2048 bytes, so that puts it at the beginning of the 7th flash block at byte 0xC0000. In my flash, that contains this config, with a CRC32 in the first 4 bytes. It looks similar to the UBOOT config, but is null-separated (I've attached a copy). If you can read that flash location and see what is there, it may illuminate things.

With any luck, that block just needs rewritten.

yes it seems a duplicate of the environment variables that I see in uboot and everything looks normal exactly like what I see in the uboot variables
the image addresses and MAC are correct.
note that I had changed my ipaddr variable to 10.0.0.242 (my tftp server) the default value is 000.000.000.000
but it is not related to the problem

is it possible that this is the place that uboot environment variables are stored? which we can see by printenv command. Because it is exactly those information
« Last Edit: July 30, 2023, 06:02:37 pm by analogRF »
 

Offline ElectronMan

  • Regular Contributor
  • *
  • Posts: 111
  • Country: us
Re: Agilent 34461A corrupted flash
« Reply #63 on: July 30, 2023, 06:31:46 pm »

The PBOOT loader is trying to read the config from sector 0x180 in flash. It appears to be using flash page-sized sectors of 2048 bytes, so that puts it at the beginning of the 7th flash block at byte 0xC0000. In my flash, that contains this config, with a CRC32 in the first 4 bytes. It looks similar to the UBOOT config, but is null-separated (I've attached a copy). If you can read that flash location and see what is there, it may illuminate things.

With any luck, that block just needs rewritten.

yes it seems a duplicate of the environment variables that I see in uboot and everything looks normal exactly like what I see in the uboot variables
the image addresses and MAC are correct.
note that I had changed my ipaddr variable to 10.0.0.242 (my tftp server) the default value is 000.000.000.000
but it is not related to the problem

is it possible that this is the place that uboot environment variables are stored? which we can see by printenv command. Because it is exactly those information

It is likely, if they are sharing the config. If you change a variable in uboot, does it change at that flash location?

On a related note, have you tried changing the uboot config since the problem started? The reason I ask, is because page ECC data is re-written with the data. So if for some reason PBOOT is seeing bad ECC on that page, re-writing it by a config change may fix it.
 

Online analogRF

  • Super Contributor
  • ***
  • Posts: 1024
  • Country: ca
Re: Agilent 34461A corrupted flash
« Reply #64 on: July 30, 2023, 06:32:15 pm »
but wait a second, I only changed "serverip" variable to 10.0.0.242 and never touched "ipaddr" variable. Also in my uboot variable I see that ipaddr variable still has its factory value like yours. However it shows different in this dump

Also I notice that at the end of the dump it looks weird.... like " ..} ..c}..." looks out of place, no?

 

Online analogRF

  • Super Contributor
  • ***
  • Posts: 1024
  • Country: ca
Re: Agilent 34461A corrupted flash
« Reply #65 on: July 30, 2023, 06:34:35 pm »

The PBOOT loader is trying to read the config from sector 0x180 in flash. It appears to be using flash page-sized sectors of 2048 bytes, so that puts it at the beginning of the 7th flash block at byte 0xC0000. In my flash, that contains this config, with a CRC32 in the first 4 bytes. It looks similar to the UBOOT config, but is null-separated (I've attached a copy). If you can read that flash location and see what is there, it may illuminate things.

With any luck, that block just needs rewritten.

yes it seems a duplicate of the environment variables that I see in uboot and everything looks normal exactly like what I see in the uboot variables
the image addresses and MAC are correct.
note that I had changed my ipaddr variable to 10.0.0.242 (my tftp server) the default value is 000.000.000.000
but it is not related to the problem

is it possible that this is the place that uboot environment variables are stored? which we can see by printenv command. Because it is exactly those information

It is likely, if they are sharing the config. If you change a variable in uboot, does it change at that flash location?

On a related note, have you tried changing the uboot config since the problem started? The reason I ask, is because page ECC data is re-written with the data. So if for some reason PBOOT is seeing bad ECC on that page, re-writing it by a config change may fix it.

the only thing that I had done was just changed "serverip" variable to my tftp server address because at that point I though I could recover it through tftp which was stupid because there is no lan available but other than that no. I have not played with uboot variables anymore
 

Online analogRF

  • Super Contributor
  • ***
  • Posts: 1024
  • Country: ca
Re: Agilent 34461A corrupted flash
« Reply #66 on: July 30, 2023, 06:36:17 pm »



The PBOOT loader is trying to read the config from sector 0x180 in flash. It appears to be using flash page-sized sectors of 2048 bytes, so that puts it at the beginning of the 7th flash block at byte 0xC0000. In my flash, that contains this config, with a CRC32 in the first 4 bytes. It looks similar to the UBOOT config, but is null-separated (I've attached a copy). If you can read that flash location and see what is there, it may illuminate things.

With any luck, that block just needs rewritten.

I cannot reproduce your CRC32 checksum so that I can check mine.
but the end of that dump looks out of place to me
 

Offline ElectronMan

  • Regular Contributor
  • *
  • Posts: 111
  • Country: us
Re: Agilent 34461A corrupted flash
« Reply #67 on: July 30, 2023, 06:39:22 pm »



The PBOOT loader is trying to read the config from sector 0x180 in flash. It appears to be using flash page-sized sectors of 2048 bytes, so that puts it at the beginning of the 7th flash block at byte 0xC0000. In my flash, that contains this config, with a CRC32 in the first 4 bytes. It looks similar to the UBOOT config, but is null-separated (I've attached a copy). If you can read that flash location and see what is there, it may illuminate things.

With any luck, that block just needs rewritten.

I cannot reproduce your CRC32 checksum so that I can check mine.
but the end of that dump looks out of place to me

Your checksum is good assuming you had 00's out to the end of that sector. I had to pad it out with zeros to the end of that page (like it should be in your flash). If the rest of that sector is not filled with 00's in your copy, then something is wrong.
 

Online analogRF

  • Super Contributor
  • ***
  • Posts: 1024
  • Country: ca
Re: Agilent 34461A corrupted flash
« Reply #68 on: July 30, 2023, 06:46:36 pm »
I changed that serverip back to its original value and actually when you run "saveenv" in uboot it in fact erases one page of nand at that 0xC0000 address and writes the variables back into that place. Messages on screen are clearly saying this.
So 0xC0000 is in fact where the uboot variables are stored.

Now I am not sure pboot is getting its parameters from there

 

Offline ElectronMan

  • Regular Contributor
  • *
  • Posts: 111
  • Country: us
Re: Agilent 34461A corrupted flash
« Reply #69 on: July 30, 2023, 06:56:12 pm »
I changed that serverip back to its original value and actually when you run "saveenv" in uboot it in fact erases one page of nand at that 0xC0000 address and writes the variables back into that place. Messages on screen are clearly saying this.
So 0xC0000 is in fact where the uboot variables are stored.

Now I am not sure pboot is getting its parameters from there

So since they are sharing the config, there must be some other reason PBOOT doesn't like that block the data is stored in, that does not bother UBOOT.

Looking at the PBOOT code, I am trying to find where it checks the ECC/Error status flag and not finding it so far. I am starting to wonder if they are storing their own data in the spare area of that page that might be corrupted.
 

Online analogRF

  • Super Contributor
  • ***
  • Posts: 1024
  • Country: ca
Re: Agilent 34461A corrupted flash
« Reply #70 on: July 30, 2023, 06:56:21 pm »
I changed "serverip" back to its original value and ran "saveenv" and dumped the nand at 0xC0000 again
here is the new dump. saveenv actually writes the variables in this place. so no surprises there

this time I dumped a whole page 2048 bytes but still I cannot get the CRC32  :-[
« Last Edit: July 30, 2023, 06:58:01 pm by analogRF »
 

Offline ElectronMan

  • Regular Contributor
  • *
  • Posts: 111
  • Country: us
Re: Agilent 34461A corrupted flash
« Reply #71 on: July 30, 2023, 07:12:10 pm »
I changed "serverip" back to its original value and ran "saveenv" and dumped the nand at 0xC0000 again
here is the new dump. saveenv actually writes the variables in this place. so no surprises there

this time I dumped a whole page 2048 bytes but still I cannot get the CRC32  :-[

Sorry, my fault, that is more than a whole page that is CRC'd. It runs to the end of all the 0's in my flash. The total data length for the CRC32 should be 0x3FFC (0x4000 minus the CRC32 at the beginning).

Also, I mentioned ECC before, this flash chip does not seem to have ECC, so that increases my suspicions they are doing something else, possibly in the spare area, for data integrity.

I am seeing what appears to be checking of the SPARE area (64 bytes past the end of the page) on page reads.
 
The following users thanked this post: analogRF

Online analogRF

  • Super Contributor
  • ***
  • Posts: 1024
  • Country: ca
Re: Agilent 34461A corrupted flash
« Reply #72 on: July 30, 2023, 07:23:04 pm »


Sorry, my fault, that is more than a whole page that is CRC'd. It runs to the end of all the 0's in my flash. The total data length for the CRC32 should be 0x3FFC (0x4000 minus the CRC32 at the beginning).

Also, I mentioned ECC before, this flash chip does not seem to have ECC, so that increases my suspicions they are doing something else, possibly in the spare area, for data integrity.

I am seeing what appears to be checking of the SPARE area (64 bytes past the end of the page) on page reads.

I remember back in 3000A scope thread there was talk of spare/duplicate copy of the env variables. I think @tv84 had posted its location address but I cannot remember where it was. With similarities between these two instruments at boot time I also suspected there is another copy of these somewhere else and pboot it using those when it does not match the one at 0xc0000

 

Offline ElectronMan

  • Regular Contributor
  • *
  • Posts: 111
  • Country: us
Re: Agilent 34461A corrupted flash
« Reply #73 on: July 30, 2023, 07:44:01 pm »


Sorry, my fault, that is more than a whole page that is CRC'd. It runs to the end of all the 0's in my flash. The total data length for the CRC32 should be 0x3FFC (0x4000 minus the CRC32 at the beginning).

Also, I mentioned ECC before, this flash chip does not seem to have ECC, so that increases my suspicions they are doing something else, possibly in the spare area, for data integrity.

I am seeing what appears to be checking of the SPARE area (64 bytes past the end of the page) on page reads.

I remember back in 3000A scope thread there was talk of spare/duplicate copy of the env variables. I think @tv84 had posted its location address but I cannot remember where it was. With similarities between these two instruments at boot time I also suspected there is another copy of these somewhere else and pboot it using those when it does not match the one at 0xc0000

It does support falling back to a backup config, but I don't see any other copies. That is probably optional (which would be why yours isn't attempting to load it). What does the spare area after that first page of the config look like?
 

Online analogRF

  • Super Contributor
  • ***
  • Posts: 1024
  • Country: ca
Re: Agilent 34461A corrupted flash
« Reply #74 on: July 30, 2023, 07:49:39 pm »


It does support falling back to a backup config, but I don't see any other copies. That is probably optional (which would be why yours isn't attempting to load it). What does the spare area after that first page of the config look like?


all 00 all the way up to 0xC4000

still no luck in reproducing the crc32 though  :-[ :-[
« Last Edit: July 30, 2023, 07:55:26 pm by analogRF »
 


Share me

Digg  Facebook  SlashDot  Delicious  Technorati  Twitter  Google  Yahoo
Smf