Author Topic: Agilent 34461A corrupted flash  (Read 22872 times)

0 Members and 2 Guests are viewing this topic.

Offline dc101Topic starter

  • Regular Contributor
  • *
  • Posts: 220
  • Country: us
Agilent 34461A corrupted flash
« on: March 23, 2021, 01:32:17 am »
I have a Agilent 34461a that's well out of warranty and no longer boots. Thanks to previous threads on this forum I was able to determine it's a result of corrupt/dead flash, although I can't 100% rule out a more serious issue. I suspect this may have resulted from leaving it unplugged for some amount of time. I emailed Keysight and asked them for a copy of the pboot.bin image and nk.bin, but I'm not very optimistic they will send me the files.

Does anyone here have a copy of pboot.bin and nk.bin? Or is anyone who has a 34461a willing to try and dump these files? My 34461a is running U-Boot 2010.03 (Oct 09 2012 - 12:48:30)Agilent P510. I was able to flash nk.bin that I grabbed off the USB thumbdrive for a front panel update, but without pboot.bin there is no kernel to boot nk.bin, and I'm not 100% the nk.bin I flashed is in the correct format.

Boot log:
Code: [Select]
U-Boot 2010.03 (Oct 09 2012 - 12:48:30)Agilent P510

CPU:   SPEAr320
DRAM:  128 MiB
Unknown id: 0xffffff. Using ST_M23P40
Flash: 64 KiB
NAND:  INTERNAL ECC 128 MiB
In:    serial
Out:   serial
Err:   serial
SerNum:MY99999999
Chip:  AA Board Rev: 4
init  RTC: 2021-03-22 21:08:23.75
Net:   No ethernet found.
splash RTC: 2021-03-22 21:08:24.78
Press space to stop autoboot:  0

NAND read: device 0 offset 0x320000, size 0x10000
 65536 bytes read: OK
Wrong Image Format for bootm command
ERROR: can't get kernel image!
p510>

Sure enough if I list the flash images, pboot is definitely gone:
Code: [Select]
*********************   NOR Flash Images   *********************


*********************   NAND Flash Images   *********************
Image at  offset 00000000:
   Image Name:   XLOADER
   Created:      2012-05-16  23:33:58 UTC
   Image Type:   ARM Linux Firmware (uncompressed)
   Data Size:    5370 Bytes = 5.2 KiB
   Load Address: d2800b00
   Entry Point:  d2800b00
   Verifying Checksum ... OK
Image at  offset 00020000:
   Image Name:   XLOADER
   Created:      2012-05-16  23:33:58 UTC
   Image Type:   ARM Linux Firmware (uncompressed)
   Data Size:    5370 Bytes = 5.2 KiB
   Load Address: d2800b00
   Entry Point:  d2800b00
   Verifying Checksum ... OK
Image at  offset 00040000:
   Image Name:   XLOADER
   Created:      2012-05-16  23:33:58 UTC
   Image Type:   ARM Linux Firmware (uncompressed)
   Data Size:    5370 Bytes = 5.2 KiB
   Load Address: d2800b00
   Entry Point:  d2800b00
   Verifying Checksum ... OK
Image at  offset 00060000:
   Image Name:   XLOADER
   Created:      2012-05-16  23:33:58 UTC
   Image Type:   ARM Linux Firmware (uncompressed)
   Data Size:    5370 Bytes = 5.2 KiB
   Load Address: d2800b00
   Entry Point:  d2800b00
   Verifying Checksum ... OK
Image at  offset 00100000:
   Image Name:   UBOOT
   Created:      2012-10-09  18:59:15 UTC
   Image Type:   ARM Linux Kernel Image (uncompressed)
   Data Size:    237084 Bytes = 231.5 KiB
   Load Address: 03f00000
   Entry Point:  03f00000
   Verifying Checksum ... OK
p510>

Cheers
-Tim
 

Offline dc101Topic starter

  • Regular Contributor
  • *
  • Posts: 220
  • Country: us
Re: Agilent 34461A corrupted flash
« Reply #1 on: March 23, 2021, 03:37:46 am »
On a whim I grabbed pboot from my 53220a, but unfortunately the units are not as similar as I thought. I was hoping it would at least boot, but it stops shortly after loading.

Keysight has already informed me that I need to send the unit in for repair because there are "no user repair actions available."   

Code: [Select]
U-Boot 2010.03 (Oct 09 2012 - 12:48:30)Agilent P510

CPU:   SPEAr320
DRAM:  128 MiB
Unknown id: 0xffffff. Using ST_M23P40
Flash: 64 KiB
NAND:  INTERNAL ECC 128 MiB
In:    serial
Out:   serial
Err:   serial
SerNum:MY99999999
Chip:  AA Board Rev: 4
init  RTC: 2021-03-22 23:06:53.27
Net:   No ethernet found.
splash RTC: 2021-03-22 23:06:54.31
Press space to stop autoboot:  0

NAND read: device 0 offset 0x320000, size 0x10000
 65536 bytes read: OK
## Booting kernel from Legacy Image at 00600000 ...
   Image Name:   PBOOT
   Created:      2009-10-22  11:56:02 UTC
   Image Type:   ARM Linux Kernel Image (gzip compressed)
   Data Size:    37189 Bytes = 36.3 KiB
   Load Address: 00000000
   Entry Point:  00000000
   Uncompressing Kernel Image ... OK

Starting kernel ...


Debug serial initialized ........OK
 

Offline perieanuo

  • Frequent Contributor
  • **
  • Posts: 914
  • Country: fr
Re: Agilent 34461A corrupted flash
« Reply #2 on: March 23, 2021, 04:56:15 pm »
Unknown id: 0xffffff. Using ST_M23P40
imho tah means the memory chip is not responding at all
haven't yes seen chips with good memory space and not responding to ID interogation, but who knows, maybe others have seen this
corrupted or defective flash for me means remove memory/test in external programmer/replace or reprogram
i'd guess, the flash is not 'corrupted', is not responding at all
if you cand find the .hex, remove and replace with new programmed flash chip, or maybe your agilent have some sort of firmware update procedure if the flash is empty, i don't know that agilent model
 

Offline dc101Topic starter

  • Regular Contributor
  • *
  • Posts: 220
  • Country: us
Re: Agilent 34461A corrupted flash
« Reply #3 on: March 23, 2021, 10:13:19 pm »
I've been wondering this exact thing, is the flash corrupt, did the flash die, is the DDR bad?

I have a BGA63 socket in the mail that I ordered for a different project, so I could buy a new flash chip and reprogram it, but like you said I need to find the hex files to program it with. I believe I can use the nk.bin file from the firmware update, but pboot.bin is proving impossible to find. I may have to eat the cost of buying a new front panel, I believe it's around $US 250.00.
 

Offline perieanuo

  • Frequent Contributor
  • **
  • Posts: 914
  • Country: fr
Re: Agilent 34461A corrupted flash
« Reply #4 on: March 24, 2021, 11:03:44 am »
sometimes a good empty flash can do it, have you tried just replacing that flash? at least, you will see the message changing and maybe update proposed.
(I suspect from "Using ST_M23P40" you can try this type of flash or somethin,g with same size or bigger and same reading/writing algo, if you got one in your spare parts)
plus, it's a simple so8
 case, so changing it it's really simple even with some soldering station
« Last Edit: March 24, 2021, 11:05:50 am by perieanuo »
 

Offline Dr. Frank

  • Super Contributor
  • ***
  • Posts: 2445
  • Country: de
Re: Agilent 34461A corrupted flash
« Reply #5 on: March 24, 2021, 08:35:40 pm »
34465A/470A may be similar / identical, as all DMMs share same Firmware update files.
Where and how can one extract this Flash Boot Loader ?

Frank
 

Offline dc101Topic starter

  • Regular Contributor
  • *
  • Posts: 220
  • Country: us
Re: Agilent 34461A corrupted flash
« Reply #6 on: March 25, 2021, 12:08:05 am »
Frank - That might actually work! I found some photos of the 34465a on the forum from radioFlash and the ARM processors are the same.

It's not a hard process, but there are a few steps to it. It does involve removing the instrument cover which may void the warranty? So understandable if you'd prefer not to. Once the cover is off you'll need to connect to the serial port on the back of the front panel that mikeselectricstuff identified in the original 34461a thread. On the 53220a and 34461a the serial port is real 12V levels, but probably worth double checking on the 34465a. After that there are a few u-boot commands you will need to run. There is no way to download the binary straight from flash that I know of, so here's what I did when I downloaded pboot from my 53220a: List the images loaded in flash, load pboot from the given flash address into ram, print the ram contents, copy and paste the ram output into a text editor to format the text properly (remove addresses, spaces, newlines etc...) then copy and paste the properly formatted ascii hex into HxD to save as binary.

One thing I would highly recommend is running the u-boot protect command to disable writing to flash, this will prevent you from accidentally overwriting/erasing sections of your flash. It was an errant copy and paste in putty that erased my pboot :( Previously it was just nk.bin that was corrupt in flash.

I would be very grateful if you would be willing to attempt to download pboot from your meter; I am willing to pay you for your troubles. I will connect to my 53220a and document the exact u-boot commands required and the TX/RX/GND pins of the serial port, so you have a better understanding of the exact process.

Thanks again
-Tim
 

Offline Dr. Frank

  • Super Contributor
  • ***
  • Posts: 2445
  • Country: de
Re: Agilent 34461A corrupted flash
« Reply #7 on: March 25, 2021, 07:35:32 am »
Frank - That might actually work! I found some photos of the 34465a on the forum from radioFlash and the ARM processors are the same.

It's not a hard process, but there are a few steps to it. It does involve removing the instrument cover which may void the warranty? So understandable if you'd prefer not to. Once the cover is off you'll need to connect to the serial port on the back of the front panel that mikeselectricstuff identified in the original 34461a thread. On the 53220a and 34461a the serial port is real 12V levels, but probably worth double checking on the 34465a. After that there are a few u-boot commands you will need to run. There is no way to download the binary straight from flash that I know of, so here's what I did when I downloaded pboot from my 53220a: List the images loaded in flash, load pboot from the given flash address into ram, print the ram contents, copy and paste the ram output into a text editor to format the text properly (remove addresses, spaces, newlines etc...) then copy and paste the properly formatted ascii hex into HxD to save as binary.

One thing I would highly recommend is running the u-boot protect command to disable writing to flash, this will prevent you from accidentally overwriting/erasing sections of your flash. It was an errant copy and paste in putty that erased my pboot :( Previously it was just nk.bin that was corrupt in flash.

I would be very grateful if you would be willing to attempt to download pboot from your meter; I am willing to pay you for your troubles. I will connect to my 53220a and document the exact u-boot commands required and the TX/RX/GND pins of the serial port, so you have a better understanding of the exact process.

Thanks again
-Tim

Tim,
that sounds feasible.
The replacement of the current fuses requires to remove the cover.. so there is not "guarantee void"
I have done that many times already because I e.g. experimented with the LM399 vs LTZ1000 reference.

If you provide details about this internal interface, and the necessary serial port monitor programs, I'll try it.

Frank
 

Offline dc101Topic starter

  • Regular Contributor
  • *
  • Posts: 220
  • Country: us
Re: Agilent 34461A corrupted flash
« Reply #8 on: March 25, 2021, 09:22:26 pm »
Awesome, I have the steps written down, so hopefully it is fairly straightforward. If you're on Windows I would suggest using MobaXterm (https://mobaxterm.mobatek.net/download.html) and for Linux my goto is Minicom which can be installed with apt-get install minicom.
 
Step 1 - Make physical connection to serial port on back of display (see attached picture for pinout)
Step 2 - Open terminal program, and set the serial connection as follows: 115200 baud, no flow control, data bits 8, stop bits 1, parity bits none
   For MobaXterm, you click on the session icon in the upper left and select Serial from the popup. The baud is set on the main screen and other settings are under Advanced Serial Settings.
Step 3 - Power on unit and press space bar in MobaXterm to abort autoboot process. You should see a prompt that says "p510>"
Step 4 - Type "protect on all" and press enter. This will enable flash write protection.
Step 5 - Type "imls" you will see several sections under NAND Flash Images (removed here for brevity). PBOOT should be the last entry and we need to know the image offset for the next step. Your PBOOT should look a little different from the one below, as this is the one from my 53220a.
Code: [Select]
*********************   NOR Flash Images   *********************


*********************   NAND Flash Images   *********************
.....
Image at  offset 00320000:
   Image Name:   PBOOT
   Created:      2009-10-22  11:56:02 UTC
   Image Type:   ARM Linux Kernel Image (gzip compressed)
   Data Size:    37189 Bytes = 36.3 KiB
   Load Address: 00000000
   Entry Point:  00000000
   Verifying Checksum ... OK
p510>
In my case PBOOT is at 0x320000 in flash. I'm not sure if it's the same across the product range.
Step 6 - Type "nand read 0x600000 0x320000 0x10000" and press enter. Change 0x320000 to the correct address of PBOOT if it is different. This command will load PBOOT from flash into RAM at address 0x600000. This is the same command the device uses when it normally boots except we're only going to print the ram contents and not boot from them.
Step 7 - Type "md.b 0x600000 0x10000" and press enter. This is the memory display command and will display 0x10000 bytes starting at address 0x600000.
Step 8 - The last step, simply right click on the MobaXterm screen and select Copy All. Paste the contents in your favorite text editor and that's in. I can take care of formatting the data and converting it into a binary.

Thanks again! Let me know if you run into any issues. Fingers crossed this works!

-Tim
« Last Edit: March 25, 2021, 09:24:45 pm by dc101 »
 

Offline Dr. Frank

  • Super Contributor
  • ***
  • Posts: 2445
  • Country: de
Re: Agilent 34461A corrupted flash
« Reply #9 on: March 26, 2021, 09:45:21 am »
My 34465A looks identical; serial interface identified; obviously the boot loader FW should be the same vintage from ~ 2010.

Concerning the command "protect on all", is this a permanent lock, which I have to reset after the operation?

I fear, otherwise, I would not be able to do a FW update any more.

Frank
« Last Edit: March 26, 2021, 11:57:21 am by Dr. Frank »
 
The following users thanked this post: 2N3055

Offline dc101Topic starter

  • Regular Contributor
  • *
  • Posts: 220
  • Country: us
Re: Agilent 34461A corrupted flash
« Reply #10 on: March 26, 2021, 11:33:34 am »
I believe your correct. I was actually just reading over some u-boot web pages again this morning and had the same thought. http://www.denx.de/wiki/view/DULG/UBootCmdGroupInfo

It might be a good idea to run protect off all after you finish, for exactly the reason you mentioned. Or alternatively you do not have to run the protect command in the beginning.

At the time I was using Putty as my terminal program and it has a rather annoying "feature" where anything that is highlighted by the mouse is automatically copied to the clipboard and just right clicking the mouse button will paste whatever is currently in the clipboard. This is what got me in trouble when I was trying to restore nk.bin. This is also why I recommended MobaXterm, at least there you have to explicitly select copy and paste.
 

Offline Dr. Frank

  • Super Contributor
  • ***
  • Posts: 2445
  • Country: de
Re: Agilent 34461A corrupted flash
« Reply #11 on: March 26, 2021, 11:58:53 am »
OK, thanks, all went fine, appended dump to my recent post.
Have fun, and please report back if this could fix your 34461A!
Frank
 
The following users thanked this post: dc101, 2N3055

Offline dc101Topic starter

  • Regular Contributor
  • *
  • Posts: 220
  • Country: us
Re: Agilent 34461A corrupted flash
« Reply #12 on: March 26, 2021, 12:21:38 pm »
Well that definitely did the trick, it's able to boot the windows ce kernel (pboot)! Now I need to see about reflashing nk.bin to correct places and see if it will boot up fully, or if there are in fact other issues with my meter. Thanks again!
 

Offline dc101Topic starter

  • Regular Contributor
  • *
  • Posts: 220
  • Country: us
Re: Agilent 34461A corrupted flash
« Reply #13 on: March 27, 2021, 06:08:50 pm »
Well the journey continues. PBOOT is working, however it seems that the version of nk.bin that comes with the official firmware update is not in the correct format be loaded directly from ram, or stored in flash and loaded into ram. The attached screenshot shows what the meter looks like after trying to put from nk.bin.

I've read some forum posts regarding Keysight scopes having success booting from the Windows CE platform builder, so I'm attempting to try that now. I'm in the process of updating my Windows XP CE development machine, and will report back with any news.

Cheers
-Tim
 

Offline ddcc

  • Regular Contributor
  • *
  • Posts: 108
  • Country: us
Re: Agilent 34461A corrupted flash
« Reply #14 on: March 27, 2021, 07:38:04 pm »
I was curious, so I took a quick look. The NK.bin file is stored in the compressed XPRS format, so you could try decompressing it first. See https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg1035605/#msg1035605 for a direct link to bincompress.exe, or you can probably find it somewhere in the Windows CE SDK.
 
The following users thanked this post: dc101

Offline dc101Topic starter

  • Regular Contributor
  • *
  • Posts: 220
  • Country: us
Re: Agilent 34461A corrupted flash
« Reply #15 on: March 27, 2021, 10:32:47 pm »
Thank you! I had looked at the bk.bin for the 53220a, and compared it to the nand flash on mine and noticed there was quite a difference, this certainly explains things. I'll definitely look into that. I just finished installing VS 2005 and CE 6.0 on an XP VM so I'll take a look in there. I messed around with WinCE 6.0 when the FLIR C3 was released a few years back, but haven't touched it since then, so I've forgetting almost everything.
 

Offline dc101Topic starter

  • Regular Contributor
  • *
  • Posts: 220
  • Country: us
Re: Agilent 34461A corrupted flash
« Reply #16 on: March 27, 2021, 10:52:01 pm »
This makes SSOOOO much more sense now. I've been scratching my head all day trying to figure out why it seemed so easy when I loaded the FLIR C3 nk.bin in platform builder, but it just wasn't working with the 34461a firmware until after I decompressed it with the file you mentioned. Sure enough, it was in one of the WinCE directories. Once I decompressed it, I just added it to a project in WinCE like any other file and it opened right up.

I'm uploading it to my meter now via ymodem, so I've got some time to kill before it finished uploading. For whatever reason I never got u-boot to recognize any USB storage devices.
 

Offline dc101Topic starter

  • Regular Contributor
  • *
  • Posts: 220
  • Country: us
Re: Agilent 34461A corrupted flash
« Reply #17 on: March 28, 2021, 01:19:37 am »
Sooo.... I'm going to call this a win. A quick test of a dead 3V coin cell battery and shorting the probes.
1203904-0" alt="" class="bbc_img" />

It definitely works, but the serial number and model number are gone and I'm not exactly sure how to restore them.

Also the firmware update fails.


I'll have to read the DSO2000/3000 scope thread as I'm wondering if this issue has come up before. The service manual for the meter warns against swapping the front panel with another unit, so I'm assuming the serial/model number is stored some place in the ARM processor or in the NAND flash.

This correlates to some of the output on saw on the serial port while the unit was booting:
Code: [Select]
Inguard Bootup Complete -- OK
InguardBootup Buffered Test Signal detected
serialNumberW = 0000000000
rtnCode = 0

serialNumberW = 0000000000
rtnCode = 0

serialNumberW = 0000000000
rtnCode = 0

serialNumberW = 0000000000
rtnCode = 0

serialNumberW = 0000000000
rtnCode = 0
« Last Edit: March 28, 2021, 01:22:40 am by dc101 »
 

Offline TheSteve

  • Supporter
  • ****
  • Posts: 3787
  • Country: ca
  • Living the Dream
Re: Agilent 34461A corrupted flash
« Reply #18 on: March 28, 2021, 07:36:26 am »
The master model/serial # is in the front panel. It is also stored on the mainboard. If you were to buy a new front panel it would be initialized such that when it was first connected it would read the model/serial from your mainboard. It would then be stored in the front panel and can no longer be changed.
There are also SCPI commands to set them, but it is unlikely they will work.

Still worth a shot:

diag:ofinit "SERIAL", "MODEL"
VE7FM
 
The following users thanked this post: dc101

Offline dc101Topic starter

  • Regular Contributor
  • *
  • Posts: 220
  • Country: us
Re: Agilent 34461A corrupted flash
« Reply #19 on: March 28, 2021, 05:40:13 pm »
I did some more digging and found an interesting u-boot command factory.
Code: [Select]
p510> help factory
factory - factory - program factory data into NAND memory


Usage:
factory <address>
    - the first 2K of RAM <address> will be written to NAND at the appropriate block
p510>
Interestingly, it only takes one argument, the ram address to read from. This means that the NAND address must be hard coded in the function. Sure enough, a few minutes of IDA and we find that the hardcoded NAND address is 0x80000. We also find something that's probably a little more interesting. An undocumented argument. Looking at the pseudo code in IDA, it first checks the number if arguments passed to factory. If that number is equal to 2, it checks to see if the word list is contained in the argument. Following the code, you'll see that passing list will print the factory data stored in NAND. If list is not found it assumes you passed an address and will write the first 2K of the specified address to the NAND address 0x80000
Code: [Select]
p510> factory list

Manufacturing Data
        MAC: XX-XX-XX-XX-XX-XX
        GUID: XXXXXXXX-XXXX-XXXX-XXXXXXXXXXXXXXXX
        SN: MY99999999
p510>
This should help us understand the exact format the data needs to be in, and allow anyone to reprogram their serial number. Still a little fuzzy on the model number though, unless it is somehow related to the GUID?
 

Offline Dr. Frank

  • Super Contributor
  • ***
  • Posts: 2445
  • Country: de
Re: Agilent 34461A corrupted flash
« Reply #20 on: March 28, 2021, 07:12:31 pm »
Hi Tim,
the model is also contained in the serial number, I assume.
MY547xxxxx is for 34470As,  MY545xxxxx for the 34465A, please cheek the Serial Number of your 34461A.
Therefore there might be no distinct configuration (model #) parameter.
The hardware platform for all 4 instruments seems to be identical. the 460/461 have the same Mainboard, as well as the 465/470 PCBs are identical, apart from the reference.
The difference between the lower grade instruments vs. the higher grade ones seems to be a different / lesser assembly, to tailor the different features in hardware.
See 'New 34470A review' thread, where we analyzed all PCBs.

The differentiation in features and also the options like Digitizing and Memory is probably set up by firmware switches / keys only.
I assume that KS implemented a strong encryption of all these objects, to prohibit easy modification.
The serial number as well will be encrypted I assume, and as The Steve already claimed, stored in different places.

Anyhow I'm very interested, how to enable the 7 1/2  digit display on my 465A, as I already found out, how to upgrade the reference to the LTZ1000A .
Frank
« Last Edit: March 28, 2021, 08:14:52 pm by Dr. Frank »
 

Offline dc101Topic starter

  • Regular Contributor
  • *
  • Posts: 220
  • Country: us
Re: Agilent 34461A corrupted flash
« Reply #21 on: March 28, 2021, 08:13:45 pm »
Hey Frank,

Thanks, I'll check out that thread you mentioned. I'm thinking now that factory u-boot command might be some legacy code that is no longer used as the serial number showed in the help -> about menu, even before setting it with the factory command. My serial number starts with MY532, which matches the factory sticker and what is displayed on the screen.

I tried the SCPI command that The Steve mentioned, but as he guessed, it did not work. When I first uploaded new firmware and booted up the meter I saw something about detecting a new processor and taking a few minutes to update something. I wonder if the SCPI command would work when that screen is displayed?

The unfortunate part is I can't seem to be able to do a firmware update from USB or ethernet, due to the missing model number, which is preventing me from being able to get the firmware flashed to NAND. Even after uncompressing nk.bin, it still only loads from RAM. I wrote it to NAND, rebooted and read it back into to RAM and it loaded fine, so I don't think it's a NAND issue. Yet if I write nk.bin to NAND and verify the images with the CE bootloader, the NAND image comes back as invalid, while the RAM image is valid.

It's possible the issue might still be with pboot. I noticed after flashing the version from your meter, that the default NAND addresses are different from the 34461A. The RAM image was the same however at 0x84000000
Code: [Select]
34365A
Image addresses. (0xdxxxxxxx for NAND, 0x8xxxxxxx for RAM)
        1 (0xd0400000)
        2 (0xd1700000)
Code: [Select]
34461A
nimages=2
image1=0xd0620000
image2=0xd2120000
 

Offline Dr. Frank

  • Super Contributor
  • ***
  • Posts: 2445
  • Country: de
Re: Agilent 34461A corrupted flash
« Reply #22 on: March 28, 2021, 08:22:59 pm »
I made some errata to my former post, and here's the correct link to the discussion of the 461/465/470:
https://www.eevblog.com/forum/testgear/keysight_s-new-34465a-(6-5-digit)-and-34470a-(7-5-digit)-bench-multimeters/150/

some pages earlier or later, we already discussed possible feature switches, afair.

If I remember correctly, during the normal boot process, the serial number is displayed on the serial monitor.. and I did not blank my serial number inside the pboot dump file.


Frank
« Last Edit: March 28, 2021, 08:26:53 pm by Dr. Frank »
 

Offline dc101Topic starter

  • Regular Contributor
  • *
  • Posts: 220
  • Country: us
Re: Agilent 34461A corrupted flash
« Reply #23 on: March 28, 2021, 10:15:37 pm »
So looks like the DIAG:OFINIT SCPI command worked after all. It didn't work immediately after getting the new cpu alert, but after repeatedly sending the command I noticed I stopped getting errors on the scoped. I thought maybe I just broke SCPI, after a reboot now I see it actually has a model number. For another test I ran *IDN? and this time it actually worked. The first time I tried this after flashing new firmware, my scope crashed and reset.
 

Offline TheSteve

  • Supporter
  • ****
  • Posts: 3787
  • Country: ca
  • Living the Dream
Re: Agilent 34461A corrupted flash
« Reply #24 on: March 28, 2021, 11:08:16 pm »
Very nice that it worked! I have a different device I'd like to reset the model and serial # on. Any thoughts on exactly what was erased to lose the model/serial #? If the model/serial # are set the command certainly doesn't work.
VE7FM
 

Offline dc101Topic starter

  • Regular Contributor
  • *
  • Posts: 220
  • Country: us
Re: Agilent 34461A corrupted flash
« Reply #25 on: March 28, 2021, 11:50:01 pm »
It may have been when I probably erased more of the NAND flash than I intended to? When I was first starting my attempt at reflashing nk.bin, I didn't specify a block_size, so I'm pretty sure that I erased everything after whatever the starting address was. Probably worth looking into a little more, since I still have to upload an nk.bin image to RAM after power-on/reboot to get it to fully boot.

That being said, I still don't really know what happened to my meter to cause it be in it's current state. For months it had trouble booting, but usually unplugging it for a few minutes plugging in back in and then turning it on would work. Unfortunately I didn't think the problem was serious, and I never thought to look at the serial console at the time. Eventually it got to the point where it didn't matter what I did, I'd just get the Keysight splashscreen and the serial console indicated all 3 images were invalid. Perhaps whatever caused this, also caused it to lose the model number as well?

-Tim
 

Offline TheSteve

  • Supporter
  • ****
  • Posts: 3787
  • Country: ca
  • Living the Dream
Re: Agilent 34461A corrupted flash
« Reply #26 on: March 29, 2021, 12:02:55 am »
I have a Keysight 33622A that boots but won't enable any output as the FPGA authentication fails. All other self tests pass. There is a Dallas 1 wire secure IC with the FPGA that performs a secure handshake with the main processor, if it fails the meter won't work. It is tied to the model/serial # I am sure and is there to prevent someone else from ripping off the FPGA code(only reason I can think of). It seems my meter is a prototype and I'm wondering if the secure IC was never configured/programmed and worked fine with development firmware. Then someone updated to normal production firmware and it no longer operates. At that point they gave up and sold it, now I own it. The model # and serial # are correct. They are both also stored on the main board in an eeprom but if you blank that it will just silently reprogram it at boot from the front panel CPU processor. The ofinit command doesn't work because it is already programmed. I am wondering though if I was to erase the model/serial # like you did if it would also generate whatever is needed to work with the secure IC again when running the ofinit command. Obviously I don't want to erase anymore then needed.

The address location change in your 34461A is also interesting, it seems like it thought the dataspace was in use and shifted the address down and then wrote pboot in a new location. You may have slightly less NAND space then you had originally, not likely an issue though.

edit - if you perform a "factory list" Do you see your serial # listed? I tried it with my 33622A and have a valid MAC and GUID but there is no serial #.
« Last Edit: March 29, 2021, 12:17:06 am by TheSteve »
VE7FM
 

Offline dc101Topic starter

  • Regular Contributor
  • *
  • Posts: 220
  • Country: us
Re: Agilent 34461A corrupted flash
« Reply #27 on: March 29, 2021, 12:59:57 am »
When I first tried factory list it showed the same serial number as u-boot, MY99999999, but I can't be sure that's not because of current issues. I'll have to try that with my 53220A and see what it returns. Perhaps Frank can try on his scope as well? I'm not sure if that's legacy code or not.

After first reboot, it appeared the DIAG:OFINIT was not permanent as my model number was lost. But after additional tests, the model number seems to remain in memory even after unplugging the meter for several minutes. One interesting thing is that even after running the DIAG:OFINIT command, I was still unable perform a USB firmware update and received the same "Incorrect firmware loaded for this model number." unfortunately after trying the firmware update again I get a warning saying the firmware on the USB is the same or older and after pressing yes to continue, the unit simply freezes and the front panel stops responding. The web interface still seems to work though.

My current boot process is to abort the autoboot, load the NAND image2 into RAM, and issue the normal boot command.  By default this pboot boots from the RAM image. It's still a pain, but better than uploading nk.bin using ymodem after every reboot.

Out of curiosity, I ran the DIAG:OFINIT command with my serial number but changed the model number and got a "-310 System error" so there is definitely some logic checking happening in the meter.

Regarding the NAND address shifting, that seems to be related to using Frank's pboot since we have different meters. The problem is everytime I try a firmware update, the u-boot values seem to reset to their original settings. The FBGA codes on the NAND are different, although I haven't looked up the one for the 34465A, so I don't know the exact differences.

-Tim
 

Offline TheSteve

  • Supporter
  • ****
  • Posts: 3787
  • Country: ca
  • Living the Dream
Re: Agilent 34461A corrupted flash
« Reply #28 on: March 29, 2021, 01:04:28 am »
I have a 34461A - maybe I should dump the pboot from it.
VE7FM
 

Offline dc101Topic starter

  • Regular Contributor
  • *
  • Posts: 220
  • Country: us
Re: Agilent 34461A corrupted flash
« Reply #29 on: March 29, 2021, 01:24:53 am »
If you could, that would be super helpful. I'd be very curious to see what the default NAND locations are for your images. Also would be interesting to compare them with vbindiff  to see how different they are.

Have you looked at any of the interfaces coming off of the NXP chip mentioned by 6thimage in the new 34465A/34470A thread? It looks like the UART, I2C and SPI lines are all routed to traces. I checked the UART on boot with my scope and there's some 115200 baud traffic (3.3V logic) but I haven't gotten around to decoding it yet. It's on my to do list.

Since I've got a somewhat good feel for bringing up my meter from the dead, I may try to erase the entire NAND again and see what happens. Wonder if we'll lose the serial / model number again?

-Tim
 

Offline TheSteve

  • Supporter
  • ****
  • Posts: 3787
  • Country: ca
  • Living the Dream
Re: Agilent 34461A corrupted flash
« Reply #30 on: March 29, 2021, 01:39:25 am »
Had a play with my 34461A. I dumped pboot.
I noticed at boot it showed the serial # as SerNum:MY99999999

I then thought I'd do the "factory list" but mis-remembered the command and typed "factory info". The command didn't give an error but has now changed the "MY99999999" to "x⚌⚌⚌⚌$
". It seems the change is permanent. So far the meter still boots and seems to work with no errors. I haven't tried a firmware update or anything. It's made me sweat a little, not going to lie. I really like my 34461A, bought it new. Normally commands don't do odd things, guess we need to be super careful.
You can see that same serial # with the printenv command.
VE7FM
 
The following users thanked this post: dc101

Offline Monkeh

  • Super Contributor
  • ***
  • Posts: 8153
  • Country: gb
Re: Agilent 34461A corrupted flash
« Reply #31 on: March 29, 2021, 01:45:23 am »
Normally commands don't do odd things, guess we need to be super careful.

You're working at a very low level with code chucked together for test purposes, never really expected to be seen by anyone but the original firmware engineers. Here be dragons.
 

Offline dc101Topic starter

  • Regular Contributor
  • *
  • Posts: 220
  • Country: us
Re: Agilent 34461A corrupted flash
« Reply #32 on: March 29, 2021, 01:49:11 am »
Not sure if this was reported in the other Agilent/Keysight multimeter threads, but you can enabled the FTP server on the 3446X by running the SCPI command DIAG:UPD:START?
Code: [Select]
[user.titan] ➤ telnet 192.168.30.96 5024
Trying 192.168.30.96...
Connected to 192.168.30.96.
Escape character is '^]'.
Welcome to Keysights's 34460A Digital Multimeter
34460A> DIAG:UPD:DIR?
\Agilent Flash\User\
34460A> DIAG:UPD:START?
+1
34460A>

Here's some more SCPI commands that you can use to try and brick you meter, get crazy:
DIAG:UPD:DIR?
DIAG:UPD:ENAB?
DIAG:UPD:REV?
DIAG:UPD:BLOCK:SIZE?
DIAG:UPD:START?
DIAG:UPD:STOP
DIAG:UPD:REBOOT
DIAG:UPD:END?
DIAG:UPD:ENAB?
DIAG:UPD:NKBIN "\Agilent Flash\User\Nk.bin"
DIAG:UPD:FIRM:ERR?
DIAG:UPD:FIRM:PROG?
 

Offline dc101Topic starter

  • Regular Contributor
  • *
  • Posts: 220
  • Country: us
Re: Agilent 34461A corrupted flash
« Reply #33 on: March 29, 2021, 01:59:39 am »
The Steve - Ooooofff, unfortunately that makes sense with what I saw in the decompiler.  <--- Side note, what am I doing wrong, that I can't put pictures inline with my post?
It assumes any argument that isn't the string "list" is a pointer to a location containing the factory data. There's no checking to make sure it's a valid address. So if you typed in "info", then factory copied 0x2000 bytes starting at (RAM)0x696e666f into NAND flash.

Did you by chance run printenv prior to running factory info/list? If so, you should be able to restore your factory info back to default. It's not hard, it just involves finding a clean space of RAM, writing to it in the format that factory expects and then running the factory command with the correct address.

Cheers
-Tim
« Last Edit: March 29, 2021, 02:21:12 am by dc101 »
 

Offline TheSteve

  • Supporter
  • ****
  • Posts: 3787
  • Country: ca
  • Living the Dream
Re: Agilent 34461A corrupted flash
« Reply #34 on: March 29, 2021, 02:19:49 am »
Oofff, yes that makes sense with what I saw in the decompiler. (Attachment Link)   <--- Side note, what am I doing wrong, that I can't put pictures inline with my post?
It assumes any input that isn't the string "list" is a pointer to a location containing the factory data. There's no checking on the input to make sure it's a valid address.

Did you by chance run printenv prior to running factory info/list? If so, you should be able to restore your factory info back to default. It's not hard, it just involves finding a clean space of RAM, writing to it in the format that factory expects and then running the factory command with the correct address.

It doesn't appear I did. I do have the original MAC saved elsewhere though, so maybe we can restore it still.
VE7FM
 

Offline dc101Topic starter

  • Regular Contributor
  • *
  • Posts: 220
  • Country: us
Re: Agilent 34461A corrupted flash
« Reply #35 on: March 29, 2021, 03:19:43 am »
Thanks! Most surprisingly, it's exactly the same as the one from Frank. That's good news for the community, now we know.

It does however pose more questions, why now are the image locations different from the u-boot defaults? How do you change the pboot image locations? Why do the u-boot image settings change after a firmware update attempt? How do you change the u-boot defaults? What else needs to be programmed to perform a factory firmware update?

Cheers
-Tim
 

Offline dc101Topic starter

  • Regular Contributor
  • *
  • Posts: 220
  • Country: us
Re: Agilent 34461A corrupted flash
« Reply #36 on: March 29, 2021, 05:01:42 am »
This is starting to get interesting.
 
The following users thanked this post: salvagedcircuitry

Offline TheSteve

  • Supporter
  • ****
  • Posts: 3787
  • Country: ca
  • Living the Dream
Re: Agilent 34461A corrupted flash
« Reply #37 on: March 29, 2021, 05:05:33 am »
Restored the proper mac and the dummy serial # MY99999999. Also added a new unique GUID. I think the only value that is used is the MAC address. So the 34461A is happy again. I am pondering options to nuke the serial/model on the 33622A still though.
VE7FM
 

Offline dc101Topic starter

  • Regular Contributor
  • *
  • Posts: 220
  • Country: us
Re: Agilent 34461A corrupted flash
« Reply #38 on: March 29, 2021, 05:09:59 am »
Awesome, glad to hear things are back to normal.... errr pre-factory info

-Tim
 

Offline TheSteve

  • Supporter
  • ****
  • Posts: 3787
  • Country: ca
  • Living the Dream
Re: Agilent 34461A corrupted flash
« Reply #39 on: March 29, 2021, 05:17:23 am »
So your 34461A works, but only if you tell it where to boot the image from manually?
VE7FM
 

Offline dc101Topic starter

  • Regular Contributor
  • *
  • Posts: 220
  • Country: us
Re: Agilent 34461A corrupted flash
« Reply #40 on: March 29, 2021, 05:30:47 am »
Yeah the Win CE bootloader boots from RAM by default, so I have to load the RAM image from flash every boot. I can't make the nk.bin images recognized as valid images when written to flash. And I can't get the firmware update to work from USB or ethernet. I've tried converting nk.bin into an nk.nb0 image and writing that to flash but that didn't work either. Maybe using u-boot to write to flash is bypassing the built-in ECC? Kind of at a loss right now.

While I'm pretty happy my meter still seems to pretty much work, it's also pretty frustrating to not get any support from HP/Agilent/Keysight. Sadly, it's a stark contrast to the experience I had with Rohde & Schwarz when the FFT filters on my FSP3 stopped working. I bought it used years after it was EOL, and still got an email from the R&S support staff with a copy of the firmware and instructions on reloading the firmware.
 

Offline TheSteve

  • Supporter
  • ****
  • Posts: 3787
  • Country: ca
  • Living the Dream
Re: Agilent 34461A corrupted flash
« Reply #41 on: March 29, 2021, 05:42:18 am »
What happens if you enter the Boot Loader Config menu, then load an image via the platform builder(network) option. That should get you booted, then perform a firmware update via the front panel USB?
VE7FM
 

Offline dc101Topic starter

  • Regular Contributor
  • *
  • Posts: 220
  • Country: us
Re: Agilent 34461A corrupted flash
« Reply #42 on: March 29, 2021, 05:47:38 am »
I haven't been able to figure out how to present the nk.bin image from platform builder to my meter. I have a virtual machine with Windows CE 6.0 and platform builder SP 1 installed, but I have very little experience with Windows CE/Windows Embedded. I've been able to look at the nk.bin in platform builder, but that's as far as I've gone. It's the reason why I setup the virtual machine, but I just haven't figured out how to load an nk.bin for another device to boot from.
 

Offline TheSteve

  • Supporter
  • ****
  • Posts: 3787
  • Country: ca
  • Living the Dream
Re: Agilent 34461A corrupted flash
« Reply #43 on: March 29, 2021, 06:04:19 am »
Forget the true platform builder program. You want to use celoader. You can grab it from here:
https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg1022267/#msg1022267

Then on a windows machine run it from a command prompt window with an uncompressed nk.bin file. It will open a port on the machine with the custom tftp port needed for platform builder. When you select boot from platform builder on the 34461A it should find the machine serving the file, download and boot it.
VE7FM
 

Offline Dr. Frank

  • Super Contributor
  • ***
  • Posts: 2445
  • Country: de
Re: Agilent 34461A corrupted flash
« Reply #44 on: March 29, 2021, 06:48:10 am »
Well folks,
you both do a great job ..

Just an idea concerning the 460/461 versus the 465/470:

If I remember correctly, the 460/461 came out earlier, brand still being agilent.
The main board already contained the full schematic for the later 465/470 functionality, but these additional components were not yet assembled.

The 465/470 were published under the new brand Keysight, they got a slightly updated PCB version, and the Memory option probably requires more DRAM or Flash space (I don't know where they store these data, in Flash, or in a battery backed up SRAM).

Therefore, the front panel PCB might also have more memory space and a slightly different memory map than the 460/461.. probably the PCB itself is  identical.

I could check / compare this if you tell me exactly where / what to look for, also via the monitor program.

Frank   
« Last Edit: March 29, 2021, 06:55:01 am by Dr. Frank »
 

Offline dc101Topic starter

  • Regular Contributor
  • *
  • Posts: 220
  • Country: us
Re: Agilent 34461A corrupted flash
« Reply #45 on: March 29, 2021, 04:14:59 pm »
So your 34461A works, but only if you tell it where to boot the image from manually?

I tried the celoader and that takes care of loading fairly quick, but the firmware update still didn't go through.

For now, as a quick hack to just be able to use my meter again I went ahead and flashed the uncompressed nk.bin to NAND and modified the uboot preboot variable to load the image from NAND into RAM before loading the Win CE bootloader. It works for now and keeps me from having to manually abort the startup process every time I power on my meter. Eventually I need to figure out how to re-program the kernel bootloader parameters, as those seemed messed up as well.
Code: [Select]
Starting kernel ...


Debug serial initialized ........OK
No RTC on 320

Microsoft Windows CE Bootloader Common Library Version 1.4 Built May 22 2012 09:09:57
Microsoft Windows CE 6.0 Ethernet Bootloader for the Agilent P500 board
Adaptation performed by Agilent Technologies (c) 2008

Reading NAND configuration
FMD_DirectRead : Offset must be sector aligned !!
CRC does not match for NAND 6042A00 F69E122E
ERROR : Bootloader setting load failed
INFO : Loading default bootloader settings

Press [ENTER] to launch image stored in flash or [SPACE] to cancel.
Initiating image launch in   0 seconds
System ready!
Preparing for download...
No RTC on 320
 Loading image 3 from memory at 0x84000000

BL_IMAGE_TYPE_BIN

X
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
Xrom_offset=0x0.
XXImageStart = 0x80361000, ImageLength = 0x1856D34, LaunchAddr = 0x80362000
 

Offline dc101Topic starter

  • Regular Contributor
  • *
  • Posts: 220
  • Country: us
Re: Agilent 34461A corrupted flash
« Reply #46 on: March 29, 2021, 05:02:40 pm »
Well folks,
you both do a great job ..

Just an idea concerning the 460/461 versus the 465/470:

If I remember correctly, the 460/461 came out earlier, brand still being agilent.
The main board already contained the full schematic for the later 465/470 functionality, but these additional components were not yet assembled.

The 465/470 were published under the new brand Keysight, they got a slightly updated PCB version, and the Memory option probably requires more DRAM or Flash space (I don't know where they store these data, in Flash, or in a battery backed up SRAM).

Therefore, the front panel PCB might also have more memory space and a slightly different memory map than the 460/461.. probably the PCB itself is  identical.

I could check / compare this if you tell me exactly where / what to look for, also via the monitor program.

Frank   

The NAND flash appear to be the same between units. I checked the Micron FBGA codes and they both resolve to the same part number, with the exception of the 34470A NAND being a "premium lifecycle product" but as far as the rest of the part number and FLASH layout, exactly the same.

34461A Micron PN: MT29F1G08ABADAH4-IT:D
34470A Micron PN: MT29F1G08ABADAH4-ITX:D
Datasheet: https://www.micron.com/-/media/client/global/documents/products/data-sheet/nand-flash/60-series/m68a_1gb_nand.pdf

-Tim
 

Offline dc101Topic starter

  • Regular Contributor
  • *
  • Posts: 220
  • Country: us
Re: Agilent 34461A corrupted flash
« Reply #47 on: March 29, 2021, 11:19:47 pm »
I believe 6thimage suggested that the model and serial number might possibly be stored in the NXP, and I think I found a hint today that he might be correct.

Occasionally after loading nk.bin, sometimes I get several decrypt errors. Looking closer, I noticed a rather interesting line FP:Platform identified as NXP 8051-type based on 0 mV Looks like I'll have to look into that NXP serial port after all.

Code: [Select]
#################### dllEntry ###########################

Decrypt(1): CryptDecrypt failed -  NTE_BAD_DATA : -2146893819
Decrypt(2c): Decryption failed - NTE_BAD_DATA : -2146893819
Decrypt(1): CryptDecrypt failed -  NTE_BAD_DATA : -2146893819
Decrypt(2c): Decryption failed - NTE_BAD_DATA : -2146893819
modelNumberW = 000000
rtnCode = 0

Decrypt(1): CryptDecrypt failed -  NTE_BAD_DATA : -2146893819
Decrypt(2c): Decryption failed - NTE_BAD_DATA : -2146893819
modelNumberW = 000000
rtnCode = 0

Decrypt(1): CryptDecrypt failed -  NTE_BAD_DATA : -2146893819
Decrypt(2c): Decryption failed - NTE_BAD_DATA : -2146893819
modelNumberW = 000000
rtnCode = 0

Decrypt(1): CryptDecrypt failed -  NTE_BAD_DATA : -2146893819
Decrypt(2c): Decryption failed - NTE_BAD_DATA : -2146893819
modelNumberW = 000000
rtnCode = 0

Decrypt(1): CryptDecrypt failed -  NTE_BAD_DATA : -2146893819
Decrypt(2c): Decryption failed - NTE_BAD_DATA : -2146893819
modelNumberW = 000000
rtnCode = 0

FP:Platform identified as NXP 8051-type based on 0 mV
FP:Platform identified as NXP 8051-type based on 0 mV
SER2 Serial Port, new baud rate:0x12c0  (UARTCLK:83250000 IBRD:0x43b FBRD:0x3e)
Decrypt(1): CryptDecrypt failed -  NTE_BAD_DATA : -2146893819
Decrypt(2c): Decryption failed - NTE_BAD_DATA : -2146893819
Decrypt(1): CryptDecrypt failed -  NTE_BAD_DATA : -2146893819
Decrypt(2c): Decryption failed - NTE_BAD_DATA : -2146893819
serialNumberW = 0000000000
rtnCode = 0

Decrypt(1): CryptDecrypt failed -  NTE_BAD_DATA : -2146893819
Decrypt(2c): Decryption failed - NTE_BAD_DATA : -2146893819
serialNumberW = 0000000000
rtnCode = 0

Decrypt(1): CryptDecrypt failed -  NTE_BAD_DATA : -2146893819
Decrypt(2c): Decryption failed - NTE_BAD_DATA : -2146893819
serialNumberW = 0000000000
rtnCode = 0

Decrypt(1): CryptDecrypt failed -  NTE_BAD_DATA : -2146893819
Decrypt(2c): Decryption failed - NTE_BAD_DATA : -2146893819
serialNumberW = 0000000000
rtnCode = 0

SER2 Read timeout
FP:FAILED IOCTL_SER2_READ_WITH_TIMEOUT [1460][ERROR_TIMEOUT]
Decrypt(1): CryptDecrypt failed -  NTE_BAD_DATA : -2146893819
Decrypt(2c): Decryption failed - NTE_BAD_DATA : -2146893819
serialNumberW = 0000000000
rtnCode = 0

SER2 Read timeout
 

Offline analogRF

  • Super Contributor
  • ***
  • Posts: 1024
  • Country: ca
Re: Agilent 34461A corrupted flash
« Reply #48 on: July 29, 2023, 08:41:31 pm »
sorry I have to revive this old thread. One of my two 34461A which has not been used for about 4 or 5 month is not booting up anymore. The Keysight logo screen appears and then stays. Here is the boot log:
Code: [Select]
U-Boot 2010.03 (Dec 04 2017 - 01:41:53)Agilent P510

CPU:   SPEAr320
DRAM:  128 MiB
Unknown id: 0xffffff. Using ST_M23P40
Flash: 64 KiB
NAND:  INTERNAL ECC 128 MiB
In:    serial
Out:   serial
Err:   serial
SerNum:MY99999999
Chip:  AA Board Rev: 4
init  RTC: 2023-07-28 15:47:59.57
Net:   No ethernet found.
splash RTC: 2023-07-28 15:48:00.60
Press space to stop autoboot:  0

NAND read: device 0 offset 0x320000, size 0x10000
 65536 bytes read: OK
## Booting kernel from Legacy Image at 00600000 ...
   Image Name:   PBOOT
   Created:      2012-05-22  16:06:43 UTC
   Image Type:   ARM Linux Kernel Image (gzip compressed)
   Data Size:    38780 Bytes = 37.9 KiB
   Load Address: 00000000
   Entry Point:  00000000
   Uncompressing Kernel Image ... OK

Starting kernel ...


Debug serial initialized ........OK
No RTC on 320

Microsoft Windows CE Bootloader Common Library Version 1.4 Built May 22 2012 09:09:57
Microsoft Windows CE 6.0 Ethernet Bootloader for the Agilent P500 board
Adaptation performed by Agilent Technologies (c) 2008

Reading NAND configuration
FMD_DirectRead: Invalid block at sector 0x180 bumping by 0x40 sectors
FMD_DirectRead: Invalid block at sector 0x1c0 bumping by 0x40 sectors
FMD_DirectRead: Invalid block at sector 0x200 bumping by 0x40 sectors
FMD_DirectRead: Invalid block at sector 0x240 bumping by 0x40 sectors
FMD_DirectRead: Invalid block at sector 0x280 bumping by 0x40 sectors
FMD_DirectRead: Invalid block at sector 0x2c0 bumping by 0x40 sectors
FMD_DirectRead: Invalid block at sector 0x300 bumping by 0x40 sectors
FMD_DirectRead: Invalid block at sector 0x340 bumping by 0x40 sectors
FMD_DirectRead: Invalid block at sector 0x380 bumping by 0x40 sectors
FMD_DirectRead: Invalid block at sector 0x3c0 bumping by 0x40 sectors
FMD_DirectRead: Invalid block at sector 0x400 bumping by 0x40 sectors
FMD_DirectRead: Invalid block at sector 0x440 bumping by 0x40 sectors
FMD_DirectRead: Invalid block at sector 0x480 bumping by 0x40 sectors
FMD_DirectRead: Invalid block at sector 0x4c0 bumping by 0x40 sectors
FMD_DirectRead: Invalid block at sector 0x500 bumping by 0x40 sectors
FMD_DirectRead: Invalid block at sector 0x540 bumping by 0x40 sectors
FMD_DirectRead: Invalid block at sector 0x580 bumping by 0x40 sectors
FMD_DirectRead: Invalid block at sector 0x5c0 bumping by 0x40 sectors
FMD_DirectRead: Invalid block at sector 0x600 bumping by 0x40 sectors
FMD_DirectRead: Invalid block at sector 0x640 bumping by 0x40 sectors
FMD_DirectRead: Invalid block at sector 0x680 bumping by 0x40 sectors
FMD_DirectRead: Invalid block at sector 0x6c0 bumping by 0x40 sectors
FMD_DirectRead: Invalid block at sector 0x700 bumping by 0x40 sectors
FMD_DirectRead: Invalid block at sector 0x740 bumping by 0x40 sectors

.
.
.
.

FMD_DirectRead: Invalid block at sector 0xfc80 bumping by 0x40 sectors
FMD_DirectRead: Invalid block at sector 0xfcc0 bumping by 0x40 sectors
FMD_DirectRead: Invalid block at sector 0xfd00 bumping by 0x40 sectors
FMD_DirectRead: Invalid block at sector 0xfd40 bumping by 0x40 sectors
FMD_DirectRead: Invalid block at sector 0xfd80 bumping by 0x40 sectors
FMD_DirectRead: Invalid block at sector 0xfdc0 bumping by 0x40 sectors
FMD_DirectRead: Invalid block at sector 0xfe00 bumping by 0x40 sectors
FMD_DirectRead: Invalid block at sector 0xfe40 bumping by 0x40 sectors
FMD_DirectRead: Invalid block at sector 0xfe80 bumping by 0x40 sectors
FMD_DirectRead: Invalid block at sector 0xfec0 bumping by 0x40 sectors
FMD_DirectRead: Invalid block at sector 0xff00 bumping by 0x40 sectors
FMD_DirectRead: Invalid block at sector 0xff40 bumping by 0x40 sectors
FMD_DirectRead: Invalid block at sector 0xff80 bumping by 0x40 sectors
FMD_DirectRead: Invalid block at sector 0xffc0 bumping by 0x40 sectors
CRC does not match for NAND AFFF475B F381A23
ERROR : Bootloader setting load failed
INFO : Loading default bootloader settings

Press [ENTER] to launch image stored in flash or [SPACE] to cancel.
Initiating image launch in   3 seconds

P500 Boot Loader Configuration :

Mac address .......... (04:02:02:20:02:02)
Ip address ........... (192.168.114.201)
Subnet Mask address .. (255.255.255.0)
DHCP ................. (Enabled)
Boot delay (seconds).. (5)
Load image 3 at startup

Image addresses. (0xdxxxxxxx for NAND, 0x8xxxxxxx for RAM)
        1 (0xd0400000)
        2 (0xd1700000)
        3 (0x84000000)

l) Load memory resident image Load image 3 now
1) Load memory resident image 1 now
2) Load memory resident image 2 now
3) Load memory resident image 3 now
d) Download from platform builder now
u) Start u-boot by resetting
v) Verify Images
[color=red](I press 1 here but it is the same with other choices. "v" just does not do anything and hangs)
[/color]>System ready!
Preparing for download...
No RTC on 320
 Loading image 1 from memory at 0xD0400000
[color=red](hangs here)[/color]

here are "printenv" and "imls" outputs:
Code: [Select]
p510>   imls

*********************   NOR Flash Images   *********************


*********************   NAND Flash Images   *********************
Image at  offset 00000000:
   Image Name:   XLOADER
   Created:      2012-05-16  23:33:58 UTC
   Image Type:   ARM Linux Firmware (uncompressed)
   Data Size:    5370 Bytes = 5.2 KiB
   Load Address: d2800b00
   Entry Point:  d2800b00
   Verifying Checksum ... OK
Image at  offset 00020000:
   Image Name:   XLOADER
   Created:      2012-05-16  23:33:58 UTC
   Image Type:   ARM Linux Firmware (uncompressed)
   Data Size:    5370 Bytes = 5.2 KiB
   Load Address: d2800b00
   Entry Point:  d2800b00
   Verifying Checksum ... OK
Image at  offset 00040000:
   Image Name:   XLOADER
   Created:      2012-05-16  23:33:58 UTC
   Image Type:   ARM Linux Firmware (uncompressed)
   Data Size:    5370 Bytes = 5.2 KiB
   Load Address: d2800b00
   Entry Point:  d2800b00
   Verifying Checksum ... OK
Image at  offset 00060000:
   Image Name:   XLOADER
   Created:      2012-05-16  23:33:58 UTC
   Image Type:   ARM Linux Firmware (uncompressed)
   Data Size:    5370 Bytes = 5.2 KiB
   Load Address: d2800b00
   Entry Point:  d2800b00
   Verifying Checksum ... OK
Image at  offset 00100000:
   Image Name:   UBOOT
   Created:      2017-12-04   8:50:24 UTC
   Image Type:   ARM Linux Kernel Image (uncompressed)
   Data Size:    237800 Bytes = 232.2 KiB
   Load Address: 03f00000
   Entry Point:  03f00000
   Verifying Checksum ... OK
Image at  offset 00320000:
   Image Name:   PBOOT
   Created:      2012-05-22  16:06:43 UTC
   Image Type:   ARM Linux Kernel Image (gzip compressed)                                                   
   Data Size:    38780 Bytes = 37.9 KiB                                                                     
   Load Address: 00000000                                                                                   
   Entry Point:  00000000                                                                                   
   Verifying Checksum ... OK
Code: [Select]
p510> printenv           
ramboot=dhcp 0x4000000 nk.bin;run bootcmd
baudrate=115200
gatewayip=192.168.1.10
netmask=255.255.255.0
chipversion=AA
boardversion=4
ftp=dhcp
bootdelay=0
ecc=4
cnfg_vmc_input_pin=mw 0xb3000028 0x00040300 1;mw 0xb3000048 0xfffbffff 1
cnfg_lan_input_pin=mw 0xb3000030 0x00000008 1;mw 0xb3000050 0xFFFFFFFF 1;mw 0xb3000018 0x00000101
preboot=mw.l 0xb300000c 0xffffacf4; run cnfg_lan_input_pin; run cnfg_vmc_input_pin; splash load
dispParm1=110 1e0 989680 0 28
dispParm2=1 1 1 1 3
numinstimages=1
pbootdelay=0
fimage=1
nimages=2
image1=0xd0620000
image2=0xd2120000
fsstart=0x3020000
numfilesystems=2
lengthfilesystem1=0x4EE0000
lengthfilesystem2=0x100000
bootcmd=nand read 0x600000 0x320000 0x10000;bootm 0x600000
uart2=1
rtc=1
ps=0
splashdata=0xd0180000
erase_env=nand erase 0xC0000 0x40000
store_xloader=xload 0x800000
get_xload_eth=dhcp 0x800000 xloader-p510.bin; run store_xloader
store_uboot=nand erase 0x100000 ${blocksize}; nand write 0x800000 0x100000 ${blocksize}
get_uboot_eth=dhcp 0x800000 u-boot-p510.bin;run store_uboot
store_pboot=nand erase 0x320000 ${blocksize}; nand write 0x800000 0x320000 ${blocksize}
get_pboot_eth=dhcp 0x800000 pboot.bin;run store_pboot
flash_nkbin=dhcp 0x4000000 nk.bin;nand erase 0x00620000 ${blocksize};nand write 0x4000000 0x00620000 ${blocksize}
usbtty=cdc_acm
ethaddr=80:09:02:0e:7a:4f
serialnum=MY99999999
serverip=10.0.0.242
verify=n
stdin=serial
stdout=serial
stderr=serial
ipaddr=192.168.1.179
guid={61341e9e-af36-b347-ae05-3a404c2cd9c0}

Environment size: 1482/16380 bytes

I downloaded the P-Boot from NAND and compared to one I downloaded from my good meter and also the ones posted here in this thread by TheSteve and Dr.Frank and they are all exactly identical.

I extracted "nk.nb0" from the firmware Nk.bin file (using bincompress and then cvrtbin tools that I had used when I was recovering my DSOX3034A from nand corruption) and then I used YMODEM to upload the nk.nb0 into memory and boot it from 0x362000 .

The meter boots normally and everything is hunky dory. S/N and FW revision all fine, the  meter works great and passes selftests etc...
So I upgraded (I should say re flashed) same FW 3.03 into the unit using the Keysight FW update Utility (LAN connection) and you can see in the attached photo
all goes well and when the unit is rebooted I am back exactly at where I was in the beginning  |O |O |O |O :palm: :palm:
Everytime it take 40 minutes to upload the nk.nb0 back into the unit using YMODEM to boot it and after FW update (also did using USB stick) it reboots to the same original state.

I am totally at loss here....it seems the flash is bad but rewriting the FW should have fixed it...I noticed that the image addresses in u-boot (see the last lines of the boot log) are d0400000 and d1700000 but in the printenv you can see the images must be at d0620000 and d2120000.
I downloaded few kilobytes of the NAND at d0620000 and it contains EXACTLY the Nk.bin file in the firmware (compressed). Also at d2120000 there is compressed Nk.bin file but I think it must be an earlier version

However at d0400000 there is absolutely nothing in NAND (FFFFFF for a while) and at d1700000 I can see it is the last mega byte of the Nk.bin file which started at d0620000.

So if the unit actually tries to read image from d0400000 or d1700000 then obviously it must fail.
I dont know how to check these addresses on my good meter.

I am at total loss here now...it's been 3 days of trying YMODEM 40 minutes each time and then no joy....

any help is highly appreciated
« Last Edit: July 29, 2023, 08:45:17 pm by analogRF »
 

Offline analogRF

  • Super Contributor
  • ***
  • Posts: 1024
  • Country: ca
Re: Agilent 34461A corrupted flash
« Reply #49 on: July 29, 2023, 10:14:17 pm »
so far at least I managed to get rid of the stupid YMODEM and used CEloader.exe to upload the uncompressed nk.bin file
to the meter after it fails to boot and I have the option to boot from platform builder. thats 1000 times faster than YMODEM
but still the problem remains. after successfully booting the meter and re -flashing firmware, it reboots into the exact same condition

I am now fairly convinced that the unit tries to load image #1 at d0400000 which is the wrong address. It must be d0620000
and I know for fact that there lies a good FW image at d0620000. I have checked it.

I just do not know where the unit is getting those wrong addresses from. Even the RAM address 84000000 (image #3) is wrong and it must be 80361000

any idea?
« Last Edit: July 29, 2023, 10:56:44 pm by analogRF »
 

Offline analogRF

  • Super Contributor
  • ***
  • Posts: 1024
  • Country: ca
Re: Agilent 34461A corrupted flash
« Reply #50 on: July 29, 2023, 10:31:14 pm »
I managed to get into the bootloader menu on my good meter (you must be very quick in pressing the space after bootcmd command) and as I expected, there the image addresses are d0620000 and d2120000 which matches the env variables. and also the "v" command (verify images) works but on my bad meter the image addresses are wrong and the verify command just hangs and i have to power down.

definitely the unit tries to read image from wrong address.

where are the bootloader parameters stored?

I checked my p-boot dump and it is exactly identical to the good meter

 

Offline analogRF

  • Super Contributor
  • ***
  • Posts: 1024
  • Country: ca
Re: Agilent 34461A corrupted flash
« Reply #51 on: July 29, 2023, 10:51:01 pm »
does anybody know where is the 64kB flash memory indicated in the u-boot:
Code: [Select]
CPU:   SPEAr320
DRAM:  128 MiB
Unknown id: 0xffffff. Using ST_M23P40
Flash: 64 KiB
NAND:  INTERNAL ECC 128 MiB

there is not flash memory on the board. Just the NAND and RAM.
« Last Edit: July 29, 2023, 10:53:38 pm by analogRF »
 

Offline analogRF

  • Super Contributor
  • ***
  • Posts: 1024
  • Country: ca
Re: Agilent 34461A corrupted flash
« Reply #52 on: July 30, 2023, 01:42:28 am »
even the difference between the wrong  image addresses is about 19MB which is too small. I mean if one image would have been at d0400000 it would have overlapped with the second image.

where does pboot gets it boot parameters from?

I just noticed that when the bootloader stops it also reports a false MAC address 04:02:02:20:02:02 instead of the correct one 80:09:02:0e:7a:4f
nonetheless I am able to use "download from platform builder" option to get the nk.bin file over the ethernet and boot the meter. It gets IP using the wrong MAC address. But after booting, the meter shows the correct mac address!?

So it is reading whole bunch of wrong boot parameters from somewhere...
« Last Edit: July 30, 2023, 02:41:07 am by analogRF »
 

Offline tv84

  • Super Contributor
  • ***
  • Posts: 3355
  • Country: pt
Re: Agilent 34461A corrupted flash
« Reply #53 on: July 30, 2023, 10:52:37 am »
@ElectronMan or @TheSteve might give you a hand here.
 

Offline coromonadalix

  • Super Contributor
  • ***
  • Posts: 7106
  • Country: ca
Re: Agilent 34461A corrupted flash
« Reply #54 on: July 30, 2023, 12:17:27 pm »
mabe searching  windows CE or embedded booting processes could give an hint ??
 

Offline analogRF

  • Super Contributor
  • ***
  • Posts: 1024
  • Country: ca
Re: Agilent 34461A corrupted flash
« Reply #55 on: July 30, 2023, 12:29:28 pm »
@ElectronMan or @TheSteve might give you a hand here.
I hope they come here and have a look

FWIW here is the .bin file of the P-Boot taken from my good 34461A and it is identical to the one from the bad meter
and also identical to those posted earlier in this thread by others
I am not able to figure out where it is getting its boot parameters from. Certainly not from the environment variables
because they are ok. Unless there is another hidden copy of them which is bad?
 

Offline ElectronMan

  • Regular Contributor
  • *
  • Posts: 111
  • Country: us
Re: Agilent 34461A corrupted flash
« Reply #56 on: July 30, 2023, 04:05:51 pm »
@ElectronMan or @TheSteve might give you a hand here.
I hope they come here and have a look

FWIW here is the .bin file of the P-Boot taken from my good 34461A and it is identical to the one from the bad meter
and also identical to those posted earlier in this thread by others
I am not able to figure out where it is getting its boot parameters from. Certainly not from the environment variables
because they are ok. Unless there is another hidden copy of them which is bad?

This looks like a problem with the CE bootloader (the stage after Uboot) or the flash. It could be that part of the NAND flash is completely unusable.

Do you happen to have the output when updating firmware? Are there any errors while writing the image?
 

Offline analogRF

  • Super Contributor
  • ***
  • Posts: 1024
  • Country: ca
Re: Agilent 34461A corrupted flash
« Reply #57 on: July 30, 2023, 04:11:50 pm »
@ElectronMan or @TheSteve might give you a hand here.
I hope they come here and have a look

FWIW here is the .bin file of the P-Boot taken from my good 34461A and it is identical to the one from the bad meter
and also identical to those posted earlier in this thread by others
I am not able to figure out where it is getting its boot parameters from. Certainly not from the environment variables
because they are ok. Unless there is another hidden copy of them which is bad?

This looks like a problem with the CE bootloader (the stage after Uboot) or the flash. It could be that part of the NAND flash is completely unusable.

Do you happen to have the output when updating firmware? Are there any errors while writing the image?

yes the bootloader is reading wrong parameters (image address, mac address, ...are all wrong)
when the unit was updating FW the UART was connected but there were no messages.

as far as I can tell the part of FW update that finished was just copying the Nk.bin (original from the FW pack) into d0620000 and I can see it is there and seems to be correct. But I guess the FW will also do some stuff after rebooting the unit however in this case it does not get there because on the reboot, it reads the wrong addresses and fails to boot.
 
 

Offline ElectronMan

  • Regular Contributor
  • *
  • Posts: 111
  • Country: us
Re: Agilent 34461A corrupted flash
« Reply #58 on: July 30, 2023, 04:29:30 pm »
@ElectronMan or @TheSteve might give you a hand here.
I hope they come here and have a look

FWIW here is the .bin file of the P-Boot taken from my good 34461A and it is identical to the one from the bad meter
and also identical to those posted earlier in this thread by others
I am not able to figure out where it is getting its boot parameters from. Certainly not from the environment variables
because they are ok. Unless there is another hidden copy of them which is bad?

This looks like a problem with the CE bootloader (the stage after Uboot) or the flash. It could be that part of the NAND flash is completely unusable.

Do you happen to have the output when updating firmware? Are there any errors while writing the image?

yes the bootloader is reading wrong parameters (image address, mac address, ...are all wrong)
when the unit was updating FW the UART was connected but there were no messages.

as far as I can tell the part of FW update that finished was just copying the Nk.bin (original from the FW pack) into d0620000 and I can see it is there and seems to be correct. But I guess the FW will also do some stuff after rebooting the unit however in this case it does not get there because on the reboot, it reads the wrong addresses and fails to boot.

Yeah, it looks like it loads those parameters from a location that it can't read right now, so loads those incorrect settings instead.:
Code: [Select]
CRC does not match for NAND AFFF475B F381A23
ERROR : Bootloader setting load failed
INFO : Loading default bootloader settings

I am trying to locate this config information
 

Offline analogRF

  • Super Contributor
  • ***
  • Posts: 1024
  • Country: ca
Re: Agilent 34461A corrupted flash
« Reply #59 on: July 30, 2023, 04:54:24 pm »
what is interesting is that earlier in the thread where @dc101 had very similar issue as mine, he also reported the pboot is thinking image addresses are d0400000 and d1700000 exactly like my unit! :-// :-//
I have also seen a similar issue in some broken 3000A scopes that also reported image address at d0400000 which again wrong for those scopes.
 

Offline analogRF

  • Super Contributor
  • ***
  • Posts: 1024
  • Country: ca
Re: Agilent 34461A corrupted flash
« Reply #60 on: July 30, 2023, 05:12:21 pm »
FWIW when I get the pboot prompt to choose how to boot and I choose option "d" (download from platform builder) here is the boot log until the unit is fully booted and the meter works perfectly after that for hours until I turn it off

Code: [Select]
......

FMD_DirectRead: Invalid block at sector 0xffc0 bumping by 0x40 sectors
CRC does not match for NAND AF7F475B 3665EF2
ERROR : Bootloader setting load failed
INFO : Loading default bootloader settings

Press [ENTER] to launch image stored in flash or [SPACE] to cancel.
Initiating image launch in   5 seconds

P500 Boot Loader Configuration :

Mac address .......... (04:02:02:20:02:02)
Ip address ........... (192.168.114.201)
Subnet Mask address .. (255.255.255.0)
DHCP ................. (Enabled)
Boot delay (seconds).. (5)
Load image 3 at startup

Image addresses. (0xdxxxxxxx for NAND, 0x8xxxxxxx for RAM)
        1 (0xd0400000)
        2 (0xd1700000)
        3 (0x84000000)

l) Load memory resident image Load image 3 now
1) Load memory resident image 1 now
2) Load memory resident image 2 now
3) Load memory resident image 3 now
d) Download from platform builder now
u) Start u-boot by resetting
v) Verify Images
>System ready!
Preparing for download...
No RTC on 320
 Downloading image from platform builder
Setting MAC address GMAC_MAC_ADDR_HI_LO[0] = 0x80000202, GMAC_MAC_ADDR_HI_LO[1] = 0x20020204
Auto Negotiation complete in 120192 iterations
Link up
AutoNegotiate Full Duplex
AutoNegotiate 100 Base T
Reading MAC address 0x402 0x220 0x202
Setting MAC address GMAC_MAC_ADDR_HI_LO[0] = 0x80000202, GMAC_MAC_ADDR_HI_LO[1] = 0x20020204
INFO: GMAC Ethernet controller initialized.
InitDHCP():: Calling ProcessDHCP()
ProcessDHCP()::DHCP_INIT
Got Response from DHCP server, IP address: 10.0.0.13

ProcessDHCP()::DHCP IP Address Resolved as 10.0.0.13, netmask: 255.255.255.0
Lease time: 172800 seconds
Got Response from DHCP server, IP address: 10.0.0.13
No ARP response in 2 seconds, assuming ownership of 10.0.0.13
+EbootSendBootmeAndWaitForTftp
Sent BOOTME to 255.255.255.255
Packet has the following data:
  boot.bin[NULL]octet[NULL]
TFTP packet could have 1 name/value pairs
Locked Down Link 1
Src IP 10.0.0.13 Port 03D4   Dest IP 10.0.0.223 Port 0499
Default TFTP block size set to: 512 bytes
There were no options detected in the TFTP
EthDown::TFTPD_OPEN::boot.bin
-EbootSendBootmeAndWaitForTftp

BL_IMAGE_TYPE_BIN

X
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
XXXXXrom_offset=0x0.
XXImageStart = 0x80361000, ImageLength = 0x185E320, LaunchAddr = 0x80362000

Completed file(s):
-------------------------------------------------------------------------------
[0]: Address=0x80361000  Length=0x185E320  Name="" Target=RAM
 Loading image 3 succeeded.
ROMHDR at Address 80361044h
Preparing launch...
No RTC on 320
Got EDBG_CMD_JUMPIMG
Got EDBG_CMD_CONFIG, flags:0x00000000
Launching windows CE image by jumping at address 0x  362000

Windows CE Kernel for ARM (Thumb Enabled) Built on Mar  8 2013 at 17:05:33
Setting up for a Cold Reboot
Done Setting up for a Cold Reboot
Windows CE Firmware Init
BSP 1.0.0 for the SPEARHEAD600AB board (built Jul  2 2021)
Adaptation performed by ADENEO (c) 2005
+OALIntrInit
-OALIntrInit(rc = 1)
Initialize driver globals Zeros area...
pDrvGlobalArea 0xa0060000  size 0x800 (0xa0060800 -0xa0060000)
Initialize driver globals Zeros area...done
 OALKitlStart
Firmware Init Done.
OALIoctlHalEnterI2cCriticalSection init i2c cs
ERROR: C:\WINCE600\PLATFORM\COMMON\SRC\SOC\STM\SPEARHEAD600\DRIVERS\NandFlash\.\sh600_NandFlash.c line 57: ConfigTimming - Unable to opey
ERROR: C:\WINCE600\PLATFORM\COMMON\SRC\SOC\STM\COMMON\DRIVERS\NandFlash\.\stm_NandFlash.c line 1043: LLD_GetInfo - Unable to open devicey
++SER_Init: context Drivers\Active\10
SER_Init, dwIndex:2
GPIO_Select0 Register 0xB300_0024: 0x80000000
Control Register 0xB300_0010 : 0x00000040
RAS Select Register 0xB300_000C: 0xffffacf4
CORE_CLK_CFG 0xB300_0024: 0x80000000
SER2 got sysintr:0x00000013
SER2 Serial Port, new baud rate:0x1c200  (UARTCLK:83250000 IBRD:0x2d FBRD:0xa)
++SER_Init: context Drivers\Active\11
SER_Init, dwIndex:3
GPIO_Select0 Register 0xB300_0024: 0x80000000
Control Register 0xB300_0010 : 0x00000040
RAS Select Register 0xB300_000C: 0xffffacf4
CORE_CLK_CFG 0xB300_0024: 0x80000000
+OALIntrRequestSysIntr IRQ (1) already used by SYSINTR (19)
SER3 got sysintr:0x00000014
SER3 Serial Port, new baud rate:0x1c200  (UARTCLK:83250000 IBRD:0x2d FBRD:0xa)
OHCI\system.c, GCFG_USBH1_SW_RST
OHCI\system.c, GCFG_USBH2_SW_RST
-EDeviceLoadEeprom 80:09:02:0E:7A:4F
Phy found addr 7 (ticks=5100)
WaitForLink Start (ticks=5101)
Link Detected (ticks=5104)

 GMAC Init : 100 Mbit/s FULL DUPLEX (MII)
Flushed Transmit Buffer
phyCfg->dwSpeed 0x64
<--EDeviceInitialize

GMAC DMA status register = 0x600004
GMAC Device enable interrupt
DriverStart
GMAC Device enable interrupt
LIN: Data Valid
Resetting the USB-device silicon
sh600_pdd, IOCTL_BUS_POSTINIT
ERROR: C:\WINCE600\3RDPARTY\Agilent\HPP\Common\Drivers\stm320_UsbFnBusDriver\.\ufnbus.cpp line 1137: failed opening \Agilent Flash\SPD\ue
                                                                                                                                        6
Autonegociation Start (ticks=7141)
+StartAutoNegotiation: pDeviceContext 0xd0506be0
Autonegociation End (ticks=9651)
WaitForLink Start (ticks=9652)
Link Detected (ticks=9655)

 GMAC Init : 100 Mbit/s FULL DUPLEX (MII)
cable attached
SHIM DLL, LoadRealDll [PalSysManagement.dll] for [AgilentPalSysManagement.dll]
SHIM [AgilentPalSysManagement.dll] Get Process Addresses
SHIM DLL, LoadRealDll [PalIO.dll] for [AgilentPalIO.dll]
SHIM [AgilentPalIO.dll] Get Process Addresses


#################### dllEntry ###########################

FP:Platform identified as MSP430-type based on 1182 mV
FP:IdEprom File [\Windows\AgtFrontPanelIdEpromData.34460-66502.xml] does not exist
FP:Platform identified as MSP430-type based on 1184 mV
FP:IdEprom File [\Windows\AgtFrontPanelIdEpromData.34460-66502.xml] does not exist
SER3 Serial Port, new baud rate:0x2faf08  (UARTCLK:83250000 IBRD:0x1 FBRD:0x2a)
Inguard Bootup Complete -- OK
InguardBootup Buffered Test Signal detected
FP:INVALID CID read, 0x01
FP:INVALID CID read, 0xff
FP:INVALID CID read, 0xff
FP:INVALID CID read, 0x33
FP:INVALID CID read, 0x16
FP:INVALID CID read, 0x88
FP:INVALID CID read, 0x6b
FP:INVALID CID read, 0x40
FP:DoCommand [2] FAILED 0x[80040302]
FP:DoCommand [2] Retry [1] Error was 0x[80040302]
FP:DoCommand [2] Final call Error 0x[0]
SHIM DLL, LoadRealDll [PalCaps.dll] for [AgilentPalCaps.dll]
SHIM [AgilentPalCaps.dll] Get Process Addresses
SHIM DLL, LoadRealDll [PalSStorage.dll] for [AgilentPalSStorage.dll]
SHIM [AgilentPalSStorage.dll] Get Process Addresses
SHIM DLL, LoadRealDll [PalWin32.dll] for [AgilentPalWin32.dll]
SHIM [AgilentPalWin32.dll] Get Process Addresses
SHIM DLL, LoadRealDll [PalWin32.dll] for [AgilentPalWin32.dll]
SHIM [AgilentPalWin32.dll] Get Process Addresses
SHIM DLL, LoadRealDll [PalSStorage.dll] for [AgilentPalSStorage.dll]
SHIM [AgilentPalSStorage.dll] Get Process Addresses
SHIM DLL, LoadRealDll [PalSysManagement.dll] for [AgilentPalSysManagement.dll]
SHIM [AgilentPalSysManagement.dll] Get Process Addresses
SHIM DLL, LoadRealDll [PalCaps.dll] for [AgilentPalCaps.dll]
SHIM [AgilentPalCaps.dll] Get Process Addresses
AgilentLxiWebStartUp successfully started LXI web service.]FMD_DirectRead: Invalid block at sector 0xfec0 bumping by 0x40 sectors
FMD_DirectRead: Invalid block at sector 0xff00 bumping by 0x40 sectors
FMD_DirectRead: Invalid block at sector 0xff40 bumping by 0x40 sectors
FMD_DirectRead: Invalid block at sector 0xff80 bumping by 0x40 sectors
FMD_DirectRead: Invalid block at sector 0xffc0 bumping by 0x40 sectors
CRC does not match for NAND AF7F475B 3665EF2
ERROR : Bootloader setting load failed
INFO : Loading default bootloader settings

Press [ENTER] to launch image stored in flash or [SPACE] to cancel.
Initiating image launch in   5 seconds

P500 Boot Loader Configuration :

Mac address .......... (04:02:02:20:02:02)
Ip address ........... (192.168.114.201)
Subnet Mask address .. (255.255.255.0)
DHCP ................. (Enabled)
Boot delay (seconds).. (5)
Load image 3 at startup

Image addresses. (0xdxxxxxxx for NAND, 0x8xxxxxxx for RAM)
        1 (0xd0400000)
        2 (0xd1700000)
        3 (0x84000000)

l) Load memory resident image Load image 3 now
1) Load memory resident image 1 now
2) Load memory resident image 2 now
3) Load memory resident image 3 now
d) Download from platform builder now
u) Start u-boot by resetting
v) Verify Images
>System ready!
Preparing for download...
No RTC on 320
 Downloading image from platform builder
Setting MAC address GMAC_MAC_ADDR_HI_LO[0] = 0x80000202, GMAC_MAC_ADDR_HI_LO[1] = 0x20020204
Auto Negotiation complete in 120192 iterations
Link up
AutoNegotiate Full Duplex
AutoNegotiate 100 Base T
Reading MAC address 0x402 0x220 0x202
Setting MAC address GMAC_MAC_ADDR_HI_LO[0] = 0x80000202, GMAC_MAC_ADDR_HI_LO[1] = 0x20020204
INFO: GMAC Ethernet controller initialized.
InitDHCP():: Calling ProcessDHCP()
ProcessDHCP()::DHCP_INIT
Got Response from DHCP server, IP address: 10.0.0.13

ProcessDHCP()::DHCP IP Address Resolved as 10.0.0.13, netmask: 255.255.255.0
Lease time: 172800 seconds
Got Response from DHCP server, IP address: 10.0.0.13
No ARP response in 2 seconds, assuming ownership of 10.0.0.13
+EbootSendBootmeAndWaitForTftp
Sent BOOTME to 255.255.255.255
Packet has the following data:
  boot.bin[NULL]octet[NULL]
TFTP packet could have 1 name/value pairs
Locked Down Link 1
Src IP 10.0.0.13 Port 03D4   Dest IP 10.0.0.223 Port 0499
Default TFTP block size set to: 512 bytes
There were no options detected in the TFTP
EthDown::TFTPD_OPEN::boot.bin
-EbootSendBootmeAndWaitForTftp

BL_IMAGE_TYPE_BIN

X
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
XXXXXrom_offset=0x0.
XXImageStart = 0x80361000, ImageLength = 0x185E320, LaunchAddr = 0x80362000

Completed file(s):
-------------------------------------------------------------------------------
[0]: Address=0x80361000  Length=0x185E320  Name="" Target=RAM
 Loading image 3 succeeded.
ROMHDR at Address 80361044h
Preparing launch...
No RTC on 320
Got EDBG_CMD_JUMPIMG
Got EDBG_CMD_CONFIG, flags:0x00000000
Launching windows CE image by jumping at address 0x  362000

Windows CE Kernel for ARM (Thumb Enabled) Built on Mar  8 2013 at 17:05:33
Setting up for a Cold Reboot
Done Setting up for a Cold Reboot
Windows CE Firmware Init
BSP 1.0.0 for the SPEARHEAD600AB board (built Jul  2 2021)
Adaptation performed by ADENEO (c) 2005
+OALIntrInit
-OALIntrInit(rc = 1)
Initialize driver globals Zeros area...
pDrvGlobalArea 0xa0060000  size 0x800 (0xa0060800 -0xa0060000)
Initialize driver globals Zeros area...done
 OALKitlStart
Firmware Init Done.
OALIoctlHalEnterI2cCriticalSection init i2c cs
ERROR: C:\WINCE600\PLATFORM\COMMON\SRC\SOC\STM\SPEARHEAD600\DRIVERS\NandFlash\.\sh600_NandFlash.c line 57: ConfigTimming - Unable to opey
ERROR: C:\WINCE600\PLATFORM\COMMON\SRC\SOC\STM\COMMON\DRIVERS\NandFlash\.\stm_NandFlash.c line 1043: LLD_GetInfo - Unable to open devicey
++SER_Init: context Drivers\Active\10
SER_Init, dwIndex:2
GPIO_Select0 Register 0xB300_0024: 0x80000000
Control Register 0xB300_0010 : 0x00000040
RAS Select Register 0xB300_000C: 0xffffacf4
CORE_CLK_CFG 0xB300_0024: 0x80000000
SER2 got sysintr:0x00000013
SER2 Serial Port, new baud rate:0x1c200  (UARTCLK:83250000 IBRD:0x2d FBRD:0xa)
++SER_Init: context Drivers\Active\11
SER_Init, dwIndex:3
GPIO_Select0 Register 0xB300_0024: 0x80000000
Control Register 0xB300_0010 : 0x00000040
RAS Select Register 0xB300_000C: 0xffffacf4
CORE_CLK_CFG 0xB300_0024: 0x80000000
+OALIntrRequestSysIntr IRQ (1) already used by SYSINTR (19)
SER3 got sysintr:0x00000014
SER3 Serial Port, new baud rate:0x1c200  (UARTCLK:83250000 IBRD:0x2d FBRD:0xa)
OHCI\system.c, GCFG_USBH1_SW_RST
OHCI\system.c, GCFG_USBH2_SW_RST
-EDeviceLoadEeprom 80:09:02:0E:7A:4F
Phy found addr 7 (ticks=5100)
WaitForLink Start (ticks=5101)
Link Detected (ticks=5104)

 GMAC Init : 100 Mbit/s FULL DUPLEX (MII)
Flushed Transmit Buffer
phyCfg->dwSpeed 0x64
<--EDeviceInitialize

GMAC DMA status register = 0x600004
GMAC Device enable interrupt
DriverStart
GMAC Device enable interrupt
LIN: Data Valid
Resetting the USB-device silicon
sh600_pdd, IOCTL_BUS_POSTINIT
ERROR: C:\WINCE600\3RDPARTY\Agilent\HPP\Common\Drivers\stm320_UsbFnBusDriver\.\ufnbus.cpp line 1137: failed opening \Agilent Flash\SPD\ue
                                                                                                                                        6
Autonegociation Start (ticks=7141)
+StartAutoNegotiation: pDeviceContext 0xd0506be0
Autonegociation End (ticks=9651)
WaitForLink Start (ticks=9652)
Link Detected (ticks=9655)

 GMAC Init : 100 Mbit/s FULL DUPLEX (MII)
cable attached
SHIM DLL, LoadRealDll [PalSysManagement.dll] for [AgilentPalSysManagement.dll]
SHIM [AgilentPalSysManagement.dll] Get Process Addresses
SHIM DLL, LoadRealDll [PalIO.dll] for [AgilentPalIO.dll]
SHIM [AgilentPalIO.dll] Get Process Addresses


#################### dllEntry ###########################

FP:Platform identified as MSP430-type based on 1182 mV
FP:IdEprom File [\Windows\AgtFrontPanelIdEpromData.34460-66502.xml] does not exist
FP:Platform identified as MSP430-type based on 1184 mV
FP:IdEprom File [\Windows\AgtFrontPanelIdEpromData.34460-66502.xml] does not exist
SER3 Serial Port, new baud rate:0x2faf08  (UARTCLK:83250000 IBRD:0x1 FBRD:0x2a)
Inguard Bootup Complete -- OK
InguardBootup Buffered Test Signal detected
FP:INVALID CID read, 0x01
FP:INVALID CID read, 0xff
FP:INVALID CID read, 0xff
FP:INVALID CID read, 0x33
FP:INVALID CID read, 0x16
FP:INVALID CID read, 0x88
FP:INVALID CID read, 0x6b
FP:INVALID CID read, 0x40
FP:DoCommand [2] FAILED 0x[80040302]
FP:DoCommand [2] Retry [1] Error was 0x[80040302]
FP:DoCommand [2] Final call Error 0x[0]
SHIM DLL, LoadRealDll [PalCaps.dll] for [AgilentPalCaps.dll]
SHIM [AgilentPalCaps.dll] Get Process Addresses
SHIM DLL, LoadRealDll [PalSStorage.dll] for [AgilentPalSStorage.dll]
SHIM [AgilentPalSStorage.dll] Get Process Addresses
SHIM DLL, LoadRealDll [PalWin32.dll] for [AgilentPalWin32.dll]
SHIM [AgilentPalWin32.dll] Get Process Addresses
SHIM DLL, LoadRealDll [PalWin32.dll] for [AgilentPalWin32.dll]
SHIM [AgilentPalWin32.dll] Get Process Addresses
SHIM DLL, LoadRealDll [PalSStorage.dll] for [AgilentPalSStorage.dll]
SHIM [AgilentPalSStorage.dll] Get Process Addresses
SHIM DLL, LoadRealDll [PalSysManagement.dll] for [AgilentPalSysManagement.dll]
SHIM [AgilentPalSysManagement.dll] Get Process Addresses
SHIM DLL, LoadRealDll [PalCaps.dll] for [AgilentPalCaps.dll]
SHIM [AgilentPalCaps.dll] Get Process Addresses
AgilentLxiWebStartUp successfully started LXI web service.


the MAC address is wrong at this point but when the meter boots it has the correct MAC address and its IP becomes 10.0.0.7
instead of 10.0.0.13
« Last Edit: July 30, 2023, 05:15:48 pm by analogRF »
 

Offline ElectronMan

  • Regular Contributor
  • *
  • Posts: 111
  • Country: us
Re: Agilent 34461A corrupted flash
« Reply #61 on: July 30, 2023, 05:36:20 pm »
so far at least I managed to get rid of the stupid YMODEM and used CEloader.exe to upload the uncompressed nk.bin file
to the meter after it fails to boot and I have the option to boot from platform builder. thats 1000 times faster than YMODEM
but still the problem remains. after successfully booting the meter and re -flashing firmware, it reboots into the exact same condition

I am now fairly convinced that the unit tries to load image #1 at d0400000 which is the wrong address. It must be d0620000
and I know for fact that there lies a good FW image at d0620000. I have checked it.

I just do not know where the unit is getting those wrong addresses from. Even the RAM address 84000000 (image #3) is wrong and it must be 80361000

any idea?

The PBOOT loader is trying to read the config from sector 0x180 in flash. It appears to be using flash page-sized sectors of 2048 bytes, so that puts it at the beginning of the 7th flash block at byte 0xC0000. In my flash, that contains this config, with a CRC32 in the first 4 bytes. It looks similar to the UBOOT config, but is null-separated (I've attached a copy). If you can read that flash location and see what is there, it may illuminate things.

With any luck, that block just needs rewritten.
 
The following users thanked this post: analogRF

Offline analogRF

  • Super Contributor
  • ***
  • Posts: 1024
  • Country: ca
Re: Agilent 34461A corrupted flash
« Reply #62 on: July 30, 2023, 06:01:05 pm »

The PBOOT loader is trying to read the config from sector 0x180 in flash. It appears to be using flash page-sized sectors of 2048 bytes, so that puts it at the beginning of the 7th flash block at byte 0xC0000. In my flash, that contains this config, with a CRC32 in the first 4 bytes. It looks similar to the UBOOT config, but is null-separated (I've attached a copy). If you can read that flash location and see what is there, it may illuminate things.

With any luck, that block just needs rewritten.

yes it seems a duplicate of the environment variables that I see in uboot and everything looks normal exactly like what I see in the uboot variables
the image addresses and MAC are correct.
note that I had changed my ipaddr variable to 10.0.0.242 (my tftp server) the default value is 000.000.000.000
but it is not related to the problem

is it possible that this is the place that uboot environment variables are stored? which we can see by printenv command. Because it is exactly those information
« Last Edit: July 30, 2023, 06:02:37 pm by analogRF »
 

Offline ElectronMan

  • Regular Contributor
  • *
  • Posts: 111
  • Country: us
Re: Agilent 34461A corrupted flash
« Reply #63 on: July 30, 2023, 06:31:46 pm »

The PBOOT loader is trying to read the config from sector 0x180 in flash. It appears to be using flash page-sized sectors of 2048 bytes, so that puts it at the beginning of the 7th flash block at byte 0xC0000. In my flash, that contains this config, with a CRC32 in the first 4 bytes. It looks similar to the UBOOT config, but is null-separated (I've attached a copy). If you can read that flash location and see what is there, it may illuminate things.

With any luck, that block just needs rewritten.

yes it seems a duplicate of the environment variables that I see in uboot and everything looks normal exactly like what I see in the uboot variables
the image addresses and MAC are correct.
note that I had changed my ipaddr variable to 10.0.0.242 (my tftp server) the default value is 000.000.000.000
but it is not related to the problem

is it possible that this is the place that uboot environment variables are stored? which we can see by printenv command. Because it is exactly those information

It is likely, if they are sharing the config. If you change a variable in uboot, does it change at that flash location?

On a related note, have you tried changing the uboot config since the problem started? The reason I ask, is because page ECC data is re-written with the data. So if for some reason PBOOT is seeing bad ECC on that page, re-writing it by a config change may fix it.
 

Offline analogRF

  • Super Contributor
  • ***
  • Posts: 1024
  • Country: ca
Re: Agilent 34461A corrupted flash
« Reply #64 on: July 30, 2023, 06:32:15 pm »
but wait a second, I only changed "serverip" variable to 10.0.0.242 and never touched "ipaddr" variable. Also in my uboot variable I see that ipaddr variable still has its factory value like yours. However it shows different in this dump

Also I notice that at the end of the dump it looks weird.... like " ..} ..c}..." looks out of place, no?

 

Offline analogRF

  • Super Contributor
  • ***
  • Posts: 1024
  • Country: ca
Re: Agilent 34461A corrupted flash
« Reply #65 on: July 30, 2023, 06:34:35 pm »

The PBOOT loader is trying to read the config from sector 0x180 in flash. It appears to be using flash page-sized sectors of 2048 bytes, so that puts it at the beginning of the 7th flash block at byte 0xC0000. In my flash, that contains this config, with a CRC32 in the first 4 bytes. It looks similar to the UBOOT config, but is null-separated (I've attached a copy). If you can read that flash location and see what is there, it may illuminate things.

With any luck, that block just needs rewritten.

yes it seems a duplicate of the environment variables that I see in uboot and everything looks normal exactly like what I see in the uboot variables
the image addresses and MAC are correct.
note that I had changed my ipaddr variable to 10.0.0.242 (my tftp server) the default value is 000.000.000.000
but it is not related to the problem

is it possible that this is the place that uboot environment variables are stored? which we can see by printenv command. Because it is exactly those information

It is likely, if they are sharing the config. If you change a variable in uboot, does it change at that flash location?

On a related note, have you tried changing the uboot config since the problem started? The reason I ask, is because page ECC data is re-written with the data. So if for some reason PBOOT is seeing bad ECC on that page, re-writing it by a config change may fix it.

the only thing that I had done was just changed "serverip" variable to my tftp server address because at that point I though I could recover it through tftp which was stupid because there is no lan available but other than that no. I have not played with uboot variables anymore
 

Offline analogRF

  • Super Contributor
  • ***
  • Posts: 1024
  • Country: ca
Re: Agilent 34461A corrupted flash
« Reply #66 on: July 30, 2023, 06:36:17 pm »



The PBOOT loader is trying to read the config from sector 0x180 in flash. It appears to be using flash page-sized sectors of 2048 bytes, so that puts it at the beginning of the 7th flash block at byte 0xC0000. In my flash, that contains this config, with a CRC32 in the first 4 bytes. It looks similar to the UBOOT config, but is null-separated (I've attached a copy). If you can read that flash location and see what is there, it may illuminate things.

With any luck, that block just needs rewritten.

I cannot reproduce your CRC32 checksum so that I can check mine.
but the end of that dump looks out of place to me
 

Offline ElectronMan

  • Regular Contributor
  • *
  • Posts: 111
  • Country: us
Re: Agilent 34461A corrupted flash
« Reply #67 on: July 30, 2023, 06:39:22 pm »



The PBOOT loader is trying to read the config from sector 0x180 in flash. It appears to be using flash page-sized sectors of 2048 bytes, so that puts it at the beginning of the 7th flash block at byte 0xC0000. In my flash, that contains this config, with a CRC32 in the first 4 bytes. It looks similar to the UBOOT config, but is null-separated (I've attached a copy). If you can read that flash location and see what is there, it may illuminate things.

With any luck, that block just needs rewritten.

I cannot reproduce your CRC32 checksum so that I can check mine.
but the end of that dump looks out of place to me

Your checksum is good assuming you had 00's out to the end of that sector. I had to pad it out with zeros to the end of that page (like it should be in your flash). If the rest of that sector is not filled with 00's in your copy, then something is wrong.
 

Offline analogRF

  • Super Contributor
  • ***
  • Posts: 1024
  • Country: ca
Re: Agilent 34461A corrupted flash
« Reply #68 on: July 30, 2023, 06:46:36 pm »
I changed that serverip back to its original value and actually when you run "saveenv" in uboot it in fact erases one page of nand at that 0xC0000 address and writes the variables back into that place. Messages on screen are clearly saying this.
So 0xC0000 is in fact where the uboot variables are stored.

Now I am not sure pboot is getting its parameters from there

 

Offline ElectronMan

  • Regular Contributor
  • *
  • Posts: 111
  • Country: us
Re: Agilent 34461A corrupted flash
« Reply #69 on: July 30, 2023, 06:56:12 pm »
I changed that serverip back to its original value and actually when you run "saveenv" in uboot it in fact erases one page of nand at that 0xC0000 address and writes the variables back into that place. Messages on screen are clearly saying this.
So 0xC0000 is in fact where the uboot variables are stored.

Now I am not sure pboot is getting its parameters from there

So since they are sharing the config, there must be some other reason PBOOT doesn't like that block the data is stored in, that does not bother UBOOT.

Looking at the PBOOT code, I am trying to find where it checks the ECC/Error status flag and not finding it so far. I am starting to wonder if they are storing their own data in the spare area of that page that might be corrupted.
 

Offline analogRF

  • Super Contributor
  • ***
  • Posts: 1024
  • Country: ca
Re: Agilent 34461A corrupted flash
« Reply #70 on: July 30, 2023, 06:56:21 pm »
I changed "serverip" back to its original value and ran "saveenv" and dumped the nand at 0xC0000 again
here is the new dump. saveenv actually writes the variables in this place. so no surprises there

this time I dumped a whole page 2048 bytes but still I cannot get the CRC32  :-[
« Last Edit: July 30, 2023, 06:58:01 pm by analogRF »
 

Offline ElectronMan

  • Regular Contributor
  • *
  • Posts: 111
  • Country: us
Re: Agilent 34461A corrupted flash
« Reply #71 on: July 30, 2023, 07:12:10 pm »
I changed "serverip" back to its original value and ran "saveenv" and dumped the nand at 0xC0000 again
here is the new dump. saveenv actually writes the variables in this place. so no surprises there

this time I dumped a whole page 2048 bytes but still I cannot get the CRC32  :-[

Sorry, my fault, that is more than a whole page that is CRC'd. It runs to the end of all the 0's in my flash. The total data length for the CRC32 should be 0x3FFC (0x4000 minus the CRC32 at the beginning).

Also, I mentioned ECC before, this flash chip does not seem to have ECC, so that increases my suspicions they are doing something else, possibly in the spare area, for data integrity.

I am seeing what appears to be checking of the SPARE area (64 bytes past the end of the page) on page reads.
 
The following users thanked this post: analogRF

Offline analogRF

  • Super Contributor
  • ***
  • Posts: 1024
  • Country: ca
Re: Agilent 34461A corrupted flash
« Reply #72 on: July 30, 2023, 07:23:04 pm »


Sorry, my fault, that is more than a whole page that is CRC'd. It runs to the end of all the 0's in my flash. The total data length for the CRC32 should be 0x3FFC (0x4000 minus the CRC32 at the beginning).

Also, I mentioned ECC before, this flash chip does not seem to have ECC, so that increases my suspicions they are doing something else, possibly in the spare area, for data integrity.

I am seeing what appears to be checking of the SPARE area (64 bytes past the end of the page) on page reads.

I remember back in 3000A scope thread there was talk of spare/duplicate copy of the env variables. I think @tv84 had posted its location address but I cannot remember where it was. With similarities between these two instruments at boot time I also suspected there is another copy of these somewhere else and pboot it using those when it does not match the one at 0xc0000

 

Offline ElectronMan

  • Regular Contributor
  • *
  • Posts: 111
  • Country: us
Re: Agilent 34461A corrupted flash
« Reply #73 on: July 30, 2023, 07:44:01 pm »


Sorry, my fault, that is more than a whole page that is CRC'd. It runs to the end of all the 0's in my flash. The total data length for the CRC32 should be 0x3FFC (0x4000 minus the CRC32 at the beginning).

Also, I mentioned ECC before, this flash chip does not seem to have ECC, so that increases my suspicions they are doing something else, possibly in the spare area, for data integrity.

I am seeing what appears to be checking of the SPARE area (64 bytes past the end of the page) on page reads.

I remember back in 3000A scope thread there was talk of spare/duplicate copy of the env variables. I think @tv84 had posted its location address but I cannot remember where it was. With similarities between these two instruments at boot time I also suspected there is another copy of these somewhere else and pboot it using those when it does not match the one at 0xc0000

It does support falling back to a backup config, but I don't see any other copies. That is probably optional (which would be why yours isn't attempting to load it). What does the spare area after that first page of the config look like?
 

Offline analogRF

  • Super Contributor
  • ***
  • Posts: 1024
  • Country: ca
Re: Agilent 34461A corrupted flash
« Reply #74 on: July 30, 2023, 07:49:39 pm »


It does support falling back to a backup config, but I don't see any other copies. That is probably optional (which would be why yours isn't attempting to load it). What does the spare area after that first page of the config look like?


all 00 all the way up to 0xC4000

still no luck in reproducing the crc32 though  :-[ :-[
« Last Edit: July 30, 2023, 07:55:26 pm by analogRF »
 

Offline ElectronMan

  • Regular Contributor
  • *
  • Posts: 111
  • Country: us
Re: Agilent 34461A corrupted flash
« Reply #75 on: July 30, 2023, 07:56:56 pm »


It does support falling back to a backup config, but I don't see any other copies. That is probably optional (which would be why yours isn't attempting to load it). What does the spare area after that first page of the config look like?


all 00 all the way up to 0xC4000

Are you certain you are reading the spare area? It is the extra 0x40 (64) bytes after the end of the 0x800 byte page. How were you reading the flash?

There is definitely some calculation it is doing with the spare area in the code before it decides it is a bad block... I am just not sure what algorithm it is using.
 

Offline analogRF

  • Super Contributor
  • ***
  • Posts: 1024
  • Country: ca
Re: Agilent 34461A corrupted flash
« Reply #76 on: July 30, 2023, 08:01:57 pm »

Are you certain you are reading the spare area? It is the extra 0x40 (64) bytes after the end of the 0x800 byte page. How were you reading the flash?

There is definitely some calculation it is doing with the spare area in the code before it decides it is a bad block... I am just not sure what algorithm it is using.

I could be quite wrong about this. So here is what I did for this last dump:
Code: [Select]
p510> nand read 0x800000 0xc0000 0x4000
.
.
p510> md.b 0x800000 0x4000

so 0x4000 in the nand read might not mean the same as 0x4000 in the memory read?
 

Offline analogRF

  • Super Contributor
  • ***
  • Posts: 1024
  • Country: ca
Re: Agilent 34461A corrupted flash
« Reply #77 on: July 30, 2023, 08:03:51 pm »
for the previous dump I used 0x800 instead of 0x4000 in nand read

but as you see the length of the file is 0x4000 and the first 4 bytes are crc32 and that leaves 0x3ffc of data as you suggested
 

Offline analogRF

  • Super Contributor
  • ***
  • Posts: 1024
  • Country: ca
Re: Agilent 34461A corrupted flash
« Reply #78 on: July 30, 2023, 08:21:41 pm »
ok for crc calculation I skip the first 4 bytes and select everything all the way up to 0x83F and do a crc32
i also tried selecting up to 0x7FF and also up to 0x3FFF and I never get those 4 bytes
I am using HxD hex editor to do that
 

Offline ElectronMan

  • Regular Contributor
  • *
  • Posts: 111
  • Country: us
Re: Agilent 34461A corrupted flash
« Reply #79 on: July 30, 2023, 08:25:16 pm »
for the previous dump I used 0x800 instead of 0x4000 in nand read

but as you see the length of the file is 0x4000 and the first 4 bytes are crc32 and that leaves 0x3ffc of data as you suggested

for the previous dump I used 0x800 instead of 0x4000 in nand read

but as you see the length of the file is 0x4000 and the first 4 bytes are crc32 and that leaves 0x3ffc of data as you suggested

I would guess that command is not including the spare area, as that is stored at a "lower level" on the flash and is usually not used by applications.

Every page is actually 0x840 bytes long. the last 0x40 bytes is typically used to store meta data (bad blocks, ECC information, etc) and is usually invisible for higher-level operations.

Looking at the code, I see what appears to be some software-implemented ECC check that is operating on the spare pages, just before the program decides to throw up that block read failure.

My guess is that data is not checking out, and causing the PBOOT to report a failure, despite the data actually being good.

UBOOT may not be implementing this check.
 

Offline ElectronMan

  • Regular Contributor
  • *
  • Posts: 111
  • Country: us
Re: Agilent 34461A corrupted flash
« Reply #80 on: July 30, 2023, 08:29:14 pm »
ok for crc calculation I skip the first 4 bytes and select everything all the way up to 0x83F and do a crc32
i also tried selecting up to 0x7FF and also up to 0x3FFF and I never get those 4 bytes
I am using HxD hex editor to do that

I am starting at 0xc0000 + 4 to skip the CRC, then running to 0xC3FF. The CRC32 is good on my area when I do that, and is also good on yours if I pad it out to that length with 00's (you didn't send me the whole thing to test).

So is there anything in there to the end of that area that isn't 00? I am using the CRC-32 in 010 Editor.
 

Offline analogRF

  • Super Contributor
  • ***
  • Posts: 1024
  • Country: ca
Re: Agilent 34461A corrupted flash
« Reply #81 on: July 30, 2023, 08:31:04 pm »
I can use the nand dump command which only dumps one page 0x800 at a time but it also dumps the out of band (.oob) data for that page
is that what you mean?
 

Offline ElectronMan

  • Regular Contributor
  • *
  • Posts: 111
  • Country: us
Re: Agilent 34461A corrupted flash
« Reply #82 on: July 30, 2023, 08:32:43 pm »
There is a slight chance, that rewriting all the pages in that block could cause the it to re-write the spare area ECC calculations. But that depends on whether the ting you are using to re-write those areas actually implements the ECC algorithm and updates it.

The idea would be that you write that block back exactly as it already exists, and see if the writing process takes care of whatever errors are present in the spare.

In my flash, that entire block is just the config padded by 0s followed by empty space.
 

Offline ElectronMan

  • Regular Contributor
  • *
  • Posts: 111
  • Country: us
Re: Agilent 34461A corrupted flash
« Reply #83 on: July 30, 2023, 08:33:14 pm »
I can use the nand dump command which only dumps one page 0x800 at a time but it also dumps the out of band (.oob) data for that page
is that what you mean?

Yes, oob is another name for the spare, so that should do the trick.
 

Offline analogRF

  • Super Contributor
  • ***
  • Posts: 1024
  • Country: ca
Re: Agilent 34461A corrupted flash
« Reply #84 on: July 30, 2023, 08:44:49 pm »


Yes, oob is another name for the spare, so that should do the trick.

I added those extra 0x40 bytes to the end of the 0x800 bytes page and made a bin file (attached)

still not getting those starting 4 bytes as CRC32  :-[ :-[
 

Offline ElectronMan

  • Regular Contributor
  • *
  • Posts: 111
  • Country: us
Re: Agilent 34461A corrupted flash
« Reply #85 on: July 30, 2023, 08:46:17 pm »
here it is

Thanks. That looks significantly different than mine.

I think what I am going to suggest is that you dump the entire block (64 * 2048 byte pages) starting at that 0xc0000 offset and then re-write exactly the same block back to flash if you can under the Uboot prompt.

Unless there is some actual physical flash damage, that should get the spare areas back in sync for the block.

Of course, this is taking a risk, so usual disclaimer here...
 

Offline analogRF

  • Super Contributor
  • ***
  • Posts: 1024
  • Country: ca
Re: Agilent 34461A corrupted flash
« Reply #86 on: July 30, 2023, 08:49:25 pm »
here it is

Thanks. That looks significantly different than mine.

I think what I am going to suggest is that you dump the entire block (64 * 2048 byte pages) starting at that 0xc0000 offset and then re-write exactly the same block back to flash if you can under the Uboot prompt.

Unless there is some actual physical flash damage, that should get the spare areas back in sync for the block.

Of course, this is taking a risk, so usual disclaimer here...

oh no you looked at the wrong file, I messed up there and deleted that message already  :-[ :-[

please look at the bin file I just posted. change the extension to .bin

 

Offline analogRF

  • Super Contributor
  • ***
  • Posts: 1024
  • Country: ca
Re: Agilent 34461A corrupted flash
« Reply #87 on: July 30, 2023, 08:51:39 pm »
the file i posted earlier and you looked at was supposed to be this one here but I dont know what happened

it is just the plain text. Then I made a bin file from it and posted above

 

Offline ElectronMan

  • Regular Contributor
  • *
  • Posts: 111
  • Country: us
Re: Agilent 34461A corrupted flash
« Reply #88 on: July 30, 2023, 08:57:49 pm »
here it is

Thanks. That looks significantly different than mine.

I think what I am going to suggest is that you dump the entire block (64 * 2048 byte pages) starting at that 0xc0000 offset and then re-write exactly the same block back to flash if you can under the Uboot prompt.

Unless there is some actual physical flash damage, that should get the spare areas back in sync for the block.

Of course, this is taking a risk, so usual disclaimer here...

oh no you looked at the wrong file, I messed up there and deleted that message already  :-[ :-[

please look at the bin file I just posted. change the extension to .bin

Looks the same. (I had taken the text and copied it into my hex editor to reproduce it).

The disturbing thing is that looking at your boot process, it basically told you that every block up to the end of flash from there has the same issue, which points to possible physical damage.

I would still try rewriting that block and see if the error clears for that one, but you may have other errors if that fixes the boot config block.
 

Offline analogRF

  • Super Contributor
  • ***
  • Posts: 1024
  • Country: ca
Re: Agilent 34461A corrupted flash
« Reply #89 on: July 30, 2023, 09:01:42 pm »
it does not look out of ordinary to me

by the way, if i want to dump the nand and write it back into the nand in uboot
I cannot write into those out of band areas. "nand dump" dumps one page at a time with those oob
but nand write has no way of writing in those oob area unless they are calculated automatically and updated by the nand controller

in that case I can just read the data by nand read and write it back instead of sumping one page at a time
I am only concerned about nand write command because still I am not sure what is the third parameter
is it a page size or is it # of bytes or some other block size? that scares me  :scared: :scared:
 

Offline analogRF

  • Super Contributor
  • ***
  • Posts: 1024
  • Country: ca
Re: Agilent 34461A corrupted flash
« Reply #90 on: July 30, 2023, 09:03:37 pm »
can you point me to what errors/problems you see in that last bin file with .oob data?
 

Offline ElectronMan

  • Regular Contributor
  • *
  • Posts: 111
  • Country: us
Re: Agilent 34461A corrupted flash
« Reply #91 on: July 30, 2023, 09:07:13 pm »
can you point me to what errors/problems you see in that last bin file with .oob data?

Without knowing the exact structure they are using, I can't say what is wrong with it exactly, except that the structure appears to be different. There could be a lot of reasons for this. See my spare on the first page for the config below.
Code: [Select]
FF FF FF FF FF FF FF FF 95 A5 6A 69 59 FF FF FF
6A F3 3F CC FF FF FF FF FF FF FF FF FF FF FF FF
FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF

Yours has more actual data in it, and is only filling the one side. Since these are structured in a very specific way, it is unusual to see such a large difference.
 

Offline ElectronMan

  • Regular Contributor
  • *
  • Posts: 111
  • Country: us
Re: Agilent 34461A corrupted flash
« Reply #92 on: July 30, 2023, 09:09:00 pm »
it does not look out of ordinary to me

by the way, if i want to dump the nand and write it back into the nand in uboot
I cannot write into those out of band areas. "nand dump" dumps one page at a time with those oob
but nand write has no way of writing in those oob area unless they are calculated automatically and updated by the nand controller

in that case I can just read the data by nand read and write it back instead of sumping one page at a time
I am only concerned about nand write command because still I am not sure what is the third parameter
is it a page size or is it # of bytes or some other block size? that scares me  :scared: :scared:


DO NOT try to write the OOB data. Just rewrite the block normally. The functions that write the block SHOULD calculate the data that needs to go into the OOB and write it for you!
 

Offline ElectronMan

  • Regular Contributor
  • *
  • Posts: 111
  • Country: us
Re: Agilent 34461A corrupted flash
« Reply #93 on: July 30, 2023, 09:14:00 pm »
it does not look out of ordinary to me

by the way, if i want to dump the nand and write it back into the nand in uboot
I cannot write into those out of band areas. "nand dump" dumps one page at a time with those oob
but nand write has no way of writing in those oob area unless they are calculated automatically and updated by the nand controller

in that case I can just read the data by nand read and write it back instead of sumping one page at a time
I am only concerned about nand write command because still I am not sure what is the third parameter
is it a page size or is it # of bytes or some other block size? that scares me  :scared: :scared:


DO NOT try to write the OOB data. Just rewrite the block normally. The functions that write the block SHOULD calculate the data that needs to go into the OOB and write it for you!

From what I can see in the uboot help, the commands should be similar to the read command.

Have you tried the "nand bad" command to see if any bad blocks are known?

You could also try writing this to the NEXT block assuming it is completely blank already. If you noticed during bootup, it does try the next block all the way to the end of flash.
 

Offline analogRF

  • Super Contributor
  • ***
  • Posts: 1024
  • Country: ca
Re: Agilent 34461A corrupted flash
« Reply #94 on: July 30, 2023, 09:16:49 pm »


DO NOT try to write the OOB data. Just rewrite the block normally. The functions that write the block SHOULD calculate the data that needs to go into the OOB and write it for you!

yeah but still I am not quite sure how the nand write command behaves. Is it taking # of bytes for the size parameter or number of 2kB pages or some other block size
For example, in the uboot variables I see some commands like this:
Code: [Select]
nand erase 0x00620000 ${blocksize};nand write 0x4000000 0x00620000 ${blocksize}but i cannot find where the blocksize was defined.

Help on nand commands in uboot gives me this:
Code: [Select]
p510> help nand
nand - NAND sub-system

Usage:
nand info - show available NAND devices
nand device [dev] - show or set current device
nand read - addr off|partition size
nand write - addr off|partition size
    read/write 'size' bytes starting at offset 'off'
    to/from memory address 'addr', skipping bad blocks.
nand erase [clean] [off size] - erase 'size' bytes from
    offset 'off' (entire device if not specified)
nand bad - show bad blocks
nand dump[.oob] off - dump page
nand scrub - really clean NAND erasing bad blocks (UNSAFE)
nand markbad off [...] - mark bad block(s) at offset (UNSAFE)
nand biterr off - make a bit error at offset (UNSAFE)

which seems to suggest the third parameter is just # of bytes but those in the uboot variables confuse me

 

Offline analogRF

  • Super Contributor
  • ***
  • Posts: 1024
  • Country: ca
Re: Agilent 34461A corrupted flash
« Reply #95 on: July 30, 2023, 09:18:48 pm »
"nand bad" shows no bad blocks
 

Offline analogRF

  • Super Contributor
  • ***
  • Posts: 1024
  • Country: ca
Re: Agilent 34461A corrupted flash
« Reply #96 on: July 30, 2023, 09:32:50 pm »


From what I can see in the uboot help, the commands should be similar to the read command.

Have you tried the "nand bad" command to see if any bad blocks are known?

You could also try writing this to the NEXT block assuming it is completely blank already. If you noticed during bootup, it does try the next block all the way to the end of flash.

the errors in the log start from
Code: [Select]
Reading NAND configuration
FMD_DirectRead: Invalid block at sector 0x180 bumping by 0x40 sectors
FMD_DirectRead: Invalid block at sector 0x1c0 bumping by 0x40 sectors
FMD_DirectRead: Invalid block at sector 0x200 bumping by 0x40 sectors
FMD_DirectRead: Invalid block at sector 0x240 bumping by 0x40 sectors

and it keeps bumping by 0x40 sectors whatever that means until the last error which is
Code: [Select]
FMD_DirectRead: Invalid block at sector 0xff80 bumping by 0x40 sectors
FMD_DirectRead: Invalid block at sector 0xffc0 bumping by 0x40 sectors

how is sector related to page? how long is it?

"nand info" commands says "sector size 128 KiB" but seems way too large to me
« Last Edit: July 30, 2023, 09:35:08 pm by analogRF »
 

Offline ElectronMan

  • Regular Contributor
  • *
  • Posts: 111
  • Country: us
Re: Agilent 34461A corrupted flash
« Reply #97 on: July 30, 2023, 09:39:42 pm »


From what I can see in the uboot help, the commands should be similar to the read command.

Have you tried the "nand bad" command to see if any bad blocks are known?

You could also try writing this to the NEXT block assuming it is completely blank already. If you noticed during bootup, it does try the next block all the way to the end of flash.



the errors in the log start from
Code: [Select]
Reading NAND configuration
FMD_DirectRead: Invalid block at sector 0x180 bumping by 0x40 sectors
FMD_DirectRead: Invalid block at sector 0x1c0 bumping by 0x40 sectors
FMD_DirectRead: Invalid block at sector 0x200 bumping by 0x40 sectors
FMD_DirectRead: Invalid block at sector 0x240 bumping by 0x40 sectors

and it keeps bumping by 0x40 sectors whatever that means until the last error which is
Code: [Select]
FMD_DirectRead: Invalid block at sector 0xff80 bumping by 0x40 sectors
FMD_DirectRead: Invalid block at sector 0xffc0 bumping by 0x40 sectors

how is sector related to page? how long is it?

"nand info" commands says "sector size 128 KiB" but seems way too large to me
They are using sector size = 2048 bytes, so the same thing as a page. Multiply that # by 2048 to get offset.
It is effectively starting from c0000 and going to the end of flash.
 

Offline ElectronMan

  • Regular Contributor
  • *
  • Posts: 111
  • Country: us
Re: Agilent 34461A corrupted flash
« Reply #98 on: July 30, 2023, 09:48:35 pm »
So I just tested this from uboot, which reads out the page, and places it in the next block (the next block was empty in mine).

It seems to work without any issue for me. But YMMV.

The MD was just to check that memory area was mostly empty.
Code: [Select]
md 0x800000 0x20000
nand read 0x800000 0xc0000 0x20000
nand write 0x800000 0xe0000 0x20000
 

Offline analogRF

  • Super Contributor
  • ***
  • Posts: 1024
  • Country: ca
Re: Agilent 34461A corrupted flash
« Reply #99 on: July 30, 2023, 09:52:44 pm »


They are using sector size = 2048 bytes, so the same thing as a page. Multiply that # by 2048 to get offset.
It is effectively starting from c0000 and going to the end of flash.

yes I just figured that out but it is strange because when the unit boots
I am 100% it reads a lot from the flash and never complains for example about cal data being corrupted etc...
cannot be bad all the way to 128MB

I was just looking at the dumps of some random pages after 0xC0800 and they are all 00 (with identical oob data which has 4 rows of data and 4 rows of FF alternating) until 0xC4000 when all data become FF including all the oob and that continues for very long length....

 

Offline ElectronMan

  • Regular Contributor
  • *
  • Posts: 111
  • Country: us
Re: Agilent 34461A corrupted flash
« Reply #100 on: July 30, 2023, 09:53:08 pm »
So I just tested this from uboot, which reads out the page, and places it in the next block (the next block was empty in mine).

It seems to work without any issue for me. But YMMV.

The MD was just to check that memory area was mostly empty.
Code: [Select]
md 0x800000 0x20000
nand read 0x800000 0xc0000 0x20000
nand write 0x800000 0xe0000 0x20000

Just to clarify what this is doing, it is reading that boot config BLOCK (all 128kb of it) into a memory area at 0x80000000 and then writing the contents of that same memory out to the NEXT block at 0xe0000.

I did this because that block is empty on my flash (though the block after that one has redundant copy of uboot in it).

I checked the nand after that and it wrote it to the correct place.

If your next block at e0000 is also empty, you could try this first, with a lower risk of issues.... Again, YMMV so beware.
 

Offline analogRF

  • Super Contributor
  • ***
  • Posts: 1024
  • Country: ca
Re: Agilent 34461A corrupted flash
« Reply #101 on: July 30, 2023, 09:55:54 pm »
yes it is empty at 0xe0000

for those pages that are fully 0000 what do you see for oob?

and also for those pages that are all FFFF what is the oob? mine is all FF
 

Offline analogRF

  • Super Contributor
  • ***
  • Posts: 1024
  • Country: ca
Re: Agilent 34461A corrupted flash
« Reply #102 on: July 30, 2023, 10:01:01 pm »
dont you need to erase nand before writing to it?
or since it is empty that's fine, right?

but eventually if I want to re-write into the non empty areas i have to do erase first, right?
 

Offline analogRF

  • Super Contributor
  • ***
  • Posts: 1024
  • Country: ca
Re: Agilent 34461A corrupted flash
« Reply #103 on: July 30, 2023, 10:05:29 pm »
ok I duplicated the commands that you posted and then dumped one page from 0xE0000
as you see here the result is exactly a copy of the page at 0xC0000 including the oob data
Code: [Select]
p510> nand dump 0xc0000
nand_dump len: 2048, ooblen 64, off 0xc0000
Page 000c0000 dump:
        ef 1e 8b 0c 72 61 6d 62 6f 6f 74 3d 64 68 63 70
        20 30 78 34 30 30 30 30 30 30 20 6e 6b 2e 62 69
        6e 3b 72 75 6e 20 62 6f 6f 74 63 6d 64 00 62 61
        75 64 72 61 74 65 3d 31 31 35 32 30 30 00 67 61
        74 65 77 61 79 69 70 3d 31 39 32 2e 31 36 38 2e
        31 2e 31 30 00 6e 65 74 6d 61 73 6b 3d 32 35 35
        2e 32 35 35 2e 32 35 35 2e 30 00 63 68 69 70 76
        65 72 73 69 6f 6e 3d 41 41 00 62 6f 61 72 64 76
        65 72 73 69 6f 6e 3d 34 00 66 74 70 3d 64 68 63
        70 00 62 6f 6f 74 64 65 6c 61 79 3d 30 00 65 63
        63 3d 34 00 63 6e 66 67 5f 76 6d 63 5f 69 6e 70
        75 74 5f 70 69 6e 3d 6d 77 20 30 78 62 33 30 30
        30 30 32 38 20 30 78 30 30 30 34 30 33 30 30 20
        31 3b 6d 77 20 30 78 62 33 30 30 30 30 34 38 20
        30 78 66 66 66 62 66 66 66 66 20 31 00 63 6e 66
        67 5f 6c 61 6e 5f 69 6e 70 75 74 5f 70 69 6e 3d
        6d 77 20 30 78 62 33 30 30 30 30 33 30 20 30 78
        30 30 30 30 30 30 30 38 20 31 3b 6d 77 20 30 78
        62 33 30 30 30 30 35 30 20 30 78 46 46 46 46 46
        46 46 46 20 31 3b 6d 77 20 30 78 62 33 30 30 30
        30 31 38 20 30 78 30 30 30 30 30 31 30 31 00 70
        72 65 62 6f 6f 74 3d 6d 77 2e 6c 20 30 78 62 33
        30 30 30 30 30 63 20 30 78 66 66 66 66 61 63 66
        34 3b 20 72 75 6e 20 63 6e 66 67 5f 6c 61 6e 5f
        69 6e 70 75 74 5f 70 69 6e 3b 20 72 75 6e 20 63
        6e 66 67 5f 76 6d 63 5f 69 6e 70 75 74 5f 70 69
        6e 3b 20 73 70 6c 61 73 68 20 6c 6f 61 64 00 64
        69 73 70 50 61 72 6d 31 3d 31 31 30 20 31 65 30
        20 39 38 39 36 38 30 20 30 20 32 38 00 64 69 73
        70 50 61 72 6d 32 3d 31 20 31 20 31 20 31 20 33
        00 6e 75 6d 69 6e 73 74 69 6d 61 67 65 73 3d 31
        00 70 62 6f 6f 74 64 65 6c 61 79 3d 30 00 66 69
        6d 61 67 65 3d 31 00 6e 69 6d 61 67 65 73 3d 32
        00 69 6d 61 67 65 31 3d 30 78 64 30 36 32 30 30
        30 30 00 69 6d 61 67 65 32 3d 30 78 64 32 31 32
        30 30 30 30 00 66 73 73 74 61 72 74 3d 30 78 33
        30 32 30 30 30 30 00 6e 75 6d 66 69 6c 65 73 79
        73 74 65 6d 73 3d 32 00 6c 65 6e 67 74 68 66 69
        6c 65 73 79 73 74 65 6d 31 3d 30 78 34 45 45 30
        30 30 30 00 6c 65 6e 67 74 68 66 69 6c 65 73 79
        73 74 65 6d 32 3d 30 78 31 30 30 30 30 30 00 62
        6f 6f 74 63 6d 64 3d 6e 61 6e 64 20 72 65 61 64
        20 30 78 36 30 30 30 30 30 20 30 78 33 32 30 30
        30 30 20 30 78 31 30 30 30 30 3b 62 6f 6f 74 6d
        20 30 78 36 30 30 30 30 30 00 75 61 72 74 32 3d
        31 00 72 74 63 3d 31 00 70 73 3d 30 00 73 70 6c
        61 73 68 64 61 74 61 3d 30 78 64 30 31 38 30 30
        30 30 00 65 72 61 73 65 5f 65 6e 76 3d 6e 61 6e
        64 20 65 72 61 73 65 20 30 78 43 30 30 30 30 20
        30 78 34 30 30 30 30 00 73 74 6f 72 65 5f 78 6c
        6f 61 64 65 72 3d 78 6c 6f 61 64 20 30 78 38 30
        30 30 30 30 00 67 65 74 5f 78 6c 6f 61 64 5f 65
        74 68 3d 64 68 63 70 20 30 78 38 30 30 30 30 30
        20 78 6c 6f 61 64 65 72 2d 70 35 31 30 2e 62 69
        6e 3b 20 72 75 6e 20 73 74 6f 72 65 5f 78 6c 6f
        61 64 65 72 00 73 74 6f 72 65 5f 75 62 6f 6f 74
        3d 6e 61 6e 64 20 65 72 61 73 65 20 30 78 31 30
        30 30 30 30 20 24 7b 62 6c 6f 63 6b 73 69 7a 65
        7d 3b 20 6e 61 6e 64 20 77 72 69 74 65 20 30 78
        38 30 30 30 30 30 20 30 78 31 30 30 30 30 30 20
        24 7b 62 6c 6f 63 6b 73 69 7a 65 7d 00 67 65 74
        5f 75 62 6f 6f 74 5f 65 74 68 3d 64 68 63 70 20
        30 78 38 30 30 30 30 30 20 75 2d 62 6f 6f 74 2d
        70 35 31 30 2e 62 69 6e 3b 72 75 6e 20 73 74 6f
        72 65 5f 75 62 6f 6f 74 00 73 74 6f 72 65 5f 70
        62 6f 6f 74 3d 6e 61 6e 64 20 65 72 61 73 65 20
        30 78 33 32 30 30 30 30 20 24 7b 62 6c 6f 63 6b
        73 69 7a 65 7d 3b 20 6e 61 6e 64 20 77 72 69 74
        65 20 30 78 38 30 30 30 30 30 20 30 78 33 32 30
        30 30 30 20 24 7b 62 6c 6f 63 6b 73 69 7a 65 7d
        00 67 65 74 5f 70 62 6f 6f 74 5f 65 74 68 3d 64
        68 63 70 20 30 78 38 30 30 30 30 30 20 70 62 6f
        6f 74 2e 62 69 6e 3b 72 75 6e 20 73 74 6f 72 65
        5f 70 62 6f 6f 74 00 66 6c 61 73 68 5f 6e 6b 62
        69 6e 3d 64 68 63 70 20 30 78 34 30 30 30 30 30
        30 20 6e 6b 2e 62 69 6e 3b 6e 61 6e 64 20 65 72
        61 73 65 20 30 78 30 30 36 32 30 30 30 30 20 24
        7b 62 6c 6f 63 6b 73 69 7a 65 7d 3b 6e 61 6e 64
        20 77 72 69 74 65 20 30 78 34 30 30 30 30 30 30
        20 30 78 30 30 36 32 30 30 30 30 20 24 7b 62 6c
        6f 63 6b 73 69 7a 65 7d 00 75 73 62 74 74 79 3d
        63 64 63 5f 61 63 6d 00 65 74 68 61 64 64 72 3d
        38 30 3a 30 39 3a 30 32 3a 30 65 3a 37 61 3a 34
        66 00 73 65 72 69 61 6c 6e 75 6d 3d 4d 59 39 39
        39 39 39 39 39 39 00 76 65 72 69 66 79 3d 6e 00
        73 74 64 69 6e 3d 73 65 72 69 61 6c 00 73 74 64
        6f 75 74 3d 73 65 72 69 61 6c 00 73 74 64 65 72
        72 3d 73 65 72 69 61 6c 00 69 70 61 64 64 72 3d
        31 39 32 2e 31 36 38 2e 31 2e 31 37 39 00 67 75
        69 64 3d 7b 36 31 33 34 31 65 39 65 2d 61 66 33
        36 2d 62 33 34 37 2d 61 65 30 35 2d 33 61 34 30
        34 63 32 63 64 39 63 30 7d 00 73 65 72 76 65 72
        69 70 3d 30 30 30 2e 30 30 30 2e 30 30 30 2e 30
        30 30 00 00 00 00 00 00 00 00 00 00 00 00 00 00
        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
OOB:
        ff ff ff ff ff ff ff ff
        c7 c0 61 e7 00 4e 80 95
        ff ff ff ff ff ff ff ff
        ac 3e 59 ad 00 97 90 a1
        ff ff ff ff ff ff ff ff
        fe 04 f8 c7 00 d4 30 11
        ff ff ff ff ff ff ff ff
        ef 5d 4b a1 00 d7 80 8b
 

Offline ElectronMan

  • Regular Contributor
  • *
  • Posts: 111
  • Country: us
Re: Agilent 34461A corrupted flash
« Reply #104 on: July 30, 2023, 10:08:28 pm »
dont you need to erase nand before writing to it?
or since it is empty that's fine, right?

but eventually if I want to re-write into the non empty areas i have to do erase first, right?

Correct. Erasing can sometimes fix issues that you could otherwise still run into. But I'd hold off on that.

My pages also have all 0xff spares for both all 0x00 and 0xFF pages.
 

Offline ElectronMan

  • Regular Contributor
  • *
  • Posts: 111
  • Country: us
Re: Agilent 34461A corrupted flash
« Reply #105 on: July 30, 2023, 10:11:12 pm »
ok I duplicated the commands that you posted and then dumped one page from 0xE0000
as you see here the result is exactly a copy of the page at 0xC0000 including the oob data
Code: [Select]
p510> nand dump 0xc0000
nand_dump len: 2048, ooblen 64, off 0xc0000
Page 000c0000 dump:
        ef 1e 8b 0c 72 61 6d 62 6f 6f 74 3d 64 68 63 70
        20 30 78 34 30 30 30 30 30 30 20 6e 6b 2e 62 69
        6e 3b 72 75 6e 20 62 6f 6f 74 63 6d 64 00 62 61
        75 64 72 61 74 65 3d 31 31 35 32 30 30 00 67 61
        74 65 77 61 79 69 70 3d 31 39 32 2e 31 36 38 2e
        31 2e 31 30 00 6e 65 74 6d 61 73 6b 3d 32 35 35
        2e 32 35 35 2e 32 35 35 2e 30 00 63 68 69 70 76
        65 72 73 69 6f 6e 3d 41 41 00 62 6f 61 72 64 76
        65 72 73 69 6f 6e 3d 34 00 66 74 70 3d 64 68 63
        70 00 62 6f 6f 74 64 65 6c 61 79 3d 30 00 65 63
        63 3d 34 00 63 6e 66 67 5f 76 6d 63 5f 69 6e 70
        75 74 5f 70 69 6e 3d 6d 77 20 30 78 62 33 30 30
        30 30 32 38 20 30 78 30 30 30 34 30 33 30 30 20
        31 3b 6d 77 20 30 78 62 33 30 30 30 30 34 38 20
        30 78 66 66 66 62 66 66 66 66 20 31 00 63 6e 66
        67 5f 6c 61 6e 5f 69 6e 70 75 74 5f 70 69 6e 3d
        6d 77 20 30 78 62 33 30 30 30 30 33 30 20 30 78
        30 30 30 30 30 30 30 38 20 31 3b 6d 77 20 30 78
        62 33 30 30 30 30 35 30 20 30 78 46 46 46 46 46
        46 46 46 20 31 3b 6d 77 20 30 78 62 33 30 30 30
        30 31 38 20 30 78 30 30 30 30 30 31 30 31 00 70
        72 65 62 6f 6f 74 3d 6d 77 2e 6c 20 30 78 62 33
        30 30 30 30 30 63 20 30 78 66 66 66 66 61 63 66
        34 3b 20 72 75 6e 20 63 6e 66 67 5f 6c 61 6e 5f
        69 6e 70 75 74 5f 70 69 6e 3b 20 72 75 6e 20 63
        6e 66 67 5f 76 6d 63 5f 69 6e 70 75 74 5f 70 69
        6e 3b 20 73 70 6c 61 73 68 20 6c 6f 61 64 00 64
        69 73 70 50 61 72 6d 31 3d 31 31 30 20 31 65 30
        20 39 38 39 36 38 30 20 30 20 32 38 00 64 69 73
        70 50 61 72 6d 32 3d 31 20 31 20 31 20 31 20 33
        00 6e 75 6d 69 6e 73 74 69 6d 61 67 65 73 3d 31
        00 70 62 6f 6f 74 64 65 6c 61 79 3d 30 00 66 69
        6d 61 67 65 3d 31 00 6e 69 6d 61 67 65 73 3d 32
        00 69 6d 61 67 65 31 3d 30 78 64 30 36 32 30 30
        30 30 00 69 6d 61 67 65 32 3d 30 78 64 32 31 32
        30 30 30 30 00 66 73 73 74 61 72 74 3d 30 78 33
        30 32 30 30 30 30 00 6e 75 6d 66 69 6c 65 73 79
        73 74 65 6d 73 3d 32 00 6c 65 6e 67 74 68 66 69
        6c 65 73 79 73 74 65 6d 31 3d 30 78 34 45 45 30
        30 30 30 00 6c 65 6e 67 74 68 66 69 6c 65 73 79
        73 74 65 6d 32 3d 30 78 31 30 30 30 30 30 00 62
        6f 6f 74 63 6d 64 3d 6e 61 6e 64 20 72 65 61 64
        20 30 78 36 30 30 30 30 30 20 30 78 33 32 30 30
        30 30 20 30 78 31 30 30 30 30 3b 62 6f 6f 74 6d
        20 30 78 36 30 30 30 30 30 00 75 61 72 74 32 3d
        31 00 72 74 63 3d 31 00 70 73 3d 30 00 73 70 6c
        61 73 68 64 61 74 61 3d 30 78 64 30 31 38 30 30
        30 30 00 65 72 61 73 65 5f 65 6e 76 3d 6e 61 6e
        64 20 65 72 61 73 65 20 30 78 43 30 30 30 30 20
        30 78 34 30 30 30 30 00 73 74 6f 72 65 5f 78 6c
        6f 61 64 65 72 3d 78 6c 6f 61 64 20 30 78 38 30
        30 30 30 30 00 67 65 74 5f 78 6c 6f 61 64 5f 65
        74 68 3d 64 68 63 70 20 30 78 38 30 30 30 30 30
        20 78 6c 6f 61 64 65 72 2d 70 35 31 30 2e 62 69
        6e 3b 20 72 75 6e 20 73 74 6f 72 65 5f 78 6c 6f
        61 64 65 72 00 73 74 6f 72 65 5f 75 62 6f 6f 74
        3d 6e 61 6e 64 20 65 72 61 73 65 20 30 78 31 30
        30 30 30 30 20 24 7b 62 6c 6f 63 6b 73 69 7a 65
        7d 3b 20 6e 61 6e 64 20 77 72 69 74 65 20 30 78
        38 30 30 30 30 30 20 30 78 31 30 30 30 30 30 20
        24 7b 62 6c 6f 63 6b 73 69 7a 65 7d 00 67 65 74
        5f 75 62 6f 6f 74 5f 65 74 68 3d 64 68 63 70 20
        30 78 38 30 30 30 30 30 20 75 2d 62 6f 6f 74 2d
        70 35 31 30 2e 62 69 6e 3b 72 75 6e 20 73 74 6f
        72 65 5f 75 62 6f 6f 74 00 73 74 6f 72 65 5f 70
        62 6f 6f 74 3d 6e 61 6e 64 20 65 72 61 73 65 20
        30 78 33 32 30 30 30 30 20 24 7b 62 6c 6f 63 6b
        73 69 7a 65 7d 3b 20 6e 61 6e 64 20 77 72 69 74
        65 20 30 78 38 30 30 30 30 30 20 30 78 33 32 30
        30 30 30 20 24 7b 62 6c 6f 63 6b 73 69 7a 65 7d
        00 67 65 74 5f 70 62 6f 6f 74 5f 65 74 68 3d 64
        68 63 70 20 30 78 38 30 30 30 30 30 20 70 62 6f
        6f 74 2e 62 69 6e 3b 72 75 6e 20 73 74 6f 72 65
        5f 70 62 6f 6f 74 00 66 6c 61 73 68 5f 6e 6b 62
        69 6e 3d 64 68 63 70 20 30 78 34 30 30 30 30 30
        30 20 6e 6b 2e 62 69 6e 3b 6e 61 6e 64 20 65 72
        61 73 65 20 30 78 30 30 36 32 30 30 30 30 20 24
        7b 62 6c 6f 63 6b 73 69 7a 65 7d 3b 6e 61 6e 64
        20 77 72 69 74 65 20 30 78 34 30 30 30 30 30 30
        20 30 78 30 30 36 32 30 30 30 30 20 24 7b 62 6c
        6f 63 6b 73 69 7a 65 7d 00 75 73 62 74 74 79 3d
        63 64 63 5f 61 63 6d 00 65 74 68 61 64 64 72 3d
        38 30 3a 30 39 3a 30 32 3a 30 65 3a 37 61 3a 34
        66 00 73 65 72 69 61 6c 6e 75 6d 3d 4d 59 39 39
        39 39 39 39 39 39 00 76 65 72 69 66 79 3d 6e 00
        73 74 64 69 6e 3d 73 65 72 69 61 6c 00 73 74 64
        6f 75 74 3d 73 65 72 69 61 6c 00 73 74 64 65 72
        72 3d 73 65 72 69 61 6c 00 69 70 61 64 64 72 3d
        31 39 32 2e 31 36 38 2e 31 2e 31 37 39 00 67 75
        69 64 3d 7b 36 31 33 34 31 65 39 65 2d 61 66 33
        36 2d 62 33 34 37 2d 61 65 30 35 2d 33 61 34 30
        34 63 32 63 64 39 63 30 7d 00 73 65 72 76 65 72
        69 70 3d 30 30 30 2e 30 30 30 2e 30 30 30 2e 30
        30 30 00 00 00 00 00 00 00 00 00 00 00 00 00 00
        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
OOB:
        ff ff ff ff ff ff ff ff
        c7 c0 61 e7 00 4e 80 95
        ff ff ff ff ff ff ff ff
        ac 3e 59 ad 00 97 90 a1
        ff ff ff ff ff ff ff ff
        fe 04 f8 c7 00 d4 30 11
        ff ff ff ff ff ff ff ff
        ef 5d 4b a1 00 d7 80 8b

Still same error during boot-up too?

Just FYI, the function that verifies the data in PBOOT appears to look at the spare areas on at least the first 8 pages before deciding the block is bad. So the issue is not necessarily the first page.
 

Offline analogRF

  • Super Contributor
  • ***
  • Posts: 1024
  • Country: ca
Re: Agilent 34461A corrupted flash
« Reply #106 on: July 30, 2023, 10:12:16 pm »
dont you need to erase nand before writing to it?
or since it is empty that's fine, right?

but eventually if I want to re-write into the non empty areas i have to do erase first, right?

Correct. Erasing can sometimes fix issues that you could otherwise still run into. But I'd hold off on that.

My pages also have all 0xff spares for both all 0x00 and 0xFF pages.

hmmmm....for all 000 pages I dont get all FF for OOB...there are numbers in it...but for all FF pages I get all FF oob

i just rebooted the unit and the sector at 0x1c0 (=0xE0000) still shows invalid
 

Offline analogRF

  • Super Contributor
  • ***
  • Posts: 1024
  • Country: ca
Re: Agilent 34461A corrupted flash
« Reply #107 on: July 30, 2023, 10:20:42 pm »
for instance this is the dump of a page which is all 0x00
all others 0x00 filled pages look identical

Code: [Select]
p510> nand dump 0xc0800
nand_dump len: 2048, ooblen 64, off 0xc0800
Page 000c0800 dump:
        00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
        00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
        00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
        00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
        00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
        00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
        00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
        00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
        00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
        00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
        00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
        00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
        00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
        00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
        00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
        00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
        00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
        00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
        00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
        00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
        00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
        00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
        00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
        00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
        00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
        00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
        00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
        00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
        00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
        00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
        00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
        00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
        00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
        00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
        00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
        00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
        00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
        00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
        00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
        00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
        00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
        00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
        00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
        00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
        00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
        00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
        00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
        00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
        00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
        00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
        00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
        00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
        00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
        00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
        00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
        00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
        00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
        00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
        00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
        00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
        00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
        00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
        00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
        00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
        00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
        00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
        00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
        00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
        00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
        00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
        00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
        00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
        00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
        00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
        00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
        00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
        00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
        00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
        00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
        00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
        00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
        00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
        00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
        00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
        00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
        00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
        00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
        00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
        00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
        00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
        00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
        00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
        00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
        00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
        00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
        00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
        00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
        00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
        00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
        00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
        00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
        00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
        00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
        00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
        00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
        00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
        00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
        00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
        00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
        00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
        00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
        00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
        00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
        00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
        00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
        00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
        00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
        00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
        00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
        00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
        00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
        00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
        00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
        00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
        00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
        00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
        00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
        00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
OOB:
        ff ff ff ff ff ff ff ff
        ef 5d 4b a1 00 d7 80 8b
        ff ff ff ff ff ff ff ff
        ef 5d 4b a1 00 d7 80 8b
        ff ff ff ff ff ff ff ff
        ef 5d 4b a1 00 d7 80 8b
        ff ff ff ff ff ff ff ff
        ef 5d 4b a1 00 d7 80 8b
 

Offline analogRF

  • Super Contributor
  • ***
  • Posts: 1024
  • Country: ca
Re: Agilent 34461A corrupted flash
« Reply #108 on: July 30, 2023, 10:23:49 pm »
still I am pretty sure the whole 128MB of NAND is not bad and I am not even sure the 0xC0000 area is bad either.

perhaps there is still a problem with the pboot itself or it is reading its parameters from somewhere else , not from 0xc0000
 

Offline analogRF

  • Super Contributor
  • ***
  • Posts: 1024
  • Country: ca
Re: Agilent 34461A corrupted flash
« Reply #109 on: July 30, 2023, 10:27:31 pm »
these front panels (used is many Keysight instruments) are very well known to have bad CPU (SPear320)
I have personally replaced 4 of them in multimeters and 33600 function generators

so maybe mine has a slightly defective nand controller in it....but the meter was manufactured in Nov 2019 and its warranty ended in Dec 1. 2022  |O |O

it has been sitting off on the bench for 4-5 month and now suddenly this?  :palm: :palm:

is there any service note or extended warranty for this nand corruption issue similar to what was available for 3000A scopes?

 

Offline analogRF

  • Super Contributor
  • ***
  • Posts: 1024
  • Country: ca
Re: Agilent 34461A corrupted flash
« Reply #110 on: July 30, 2023, 10:29:45 pm »
by the way the areas that I wrote in the NAND (starting from 0xE0000) look exactly identical to the areas I copied from
including the oob data


so I dont think writing back into the nand is gonna help, is it?
 

Offline ElectronMan

  • Regular Contributor
  • *
  • Posts: 111
  • Country: us
Re: Agilent 34461A corrupted flash
« Reply #111 on: July 30, 2023, 10:30:19 pm »
still I am pretty sure the whole 128MB of NAND is not bad and I am not even sure the 0xC0000 area is bad either.

perhaps there is still a problem with the pboot itself or it is reading its parameters from somewhere else , not from 0xc0000

I've considered a possible issue with PBOOT, but the problem is that it has a couple of different levels of checksums protecting it. There is a table inside it that it seems to use for the check. If that got corrupted, it could cause the appearance of a failure that is not there.

But that is extremely unlikely given that the checksum that UBOOT sees when you list images shows Ok, and the gzipped nb0 for PBOOT has its own CRC.

It is more likely something in the spare area isn't matching up. A hardware issue could cause a bit to appear stuck, for example.

The hope is that by rewriting you can force a re-write of the spare by the same mechanism that does the checking (FMD_Write). If that doesn't correct the issue, then it is looking more like a flash hardware problem.
 

Offline ElectronMan

  • Regular Contributor
  • *
  • Posts: 111
  • Country: us
Re: Agilent 34461A corrupted flash
« Reply #112 on: July 30, 2023, 10:32:28 pm »
by the way the areas that I wrote in the NAND (starting from 0xE0000) look exactly identical to the areas I copied from
including the oob data


so I dont think writing back into the nand is gonna help, is it?

Did you try rebooting since? You can test the theory, as it should check the block you wrote (it was checking it previously) when the first one fails.

If it still shows an error on that block (assuming you wrote the entire block) then it is not looking like an error that is correctable by re-writing it.

And erase cycle on that block might help, but now we're getting into more dangerous stuff.
 

Offline analogRF

  • Super Contributor
  • ***
  • Posts: 1024
  • Country: ca
Re: Agilent 34461A corrupted flash
« Reply #113 on: July 30, 2023, 11:01:16 pm »
by the way the areas that I wrote in the NAND (starting from 0xE0000) look exactly identical to the areas I copied from
including the oob data


so I dont think writing back into the nand is gonna help, is it?

Did you try rebooting since? You can test the theory, as it should check the block you wrote (it was checking it previously) when the first one fails.

If it still shows an error on that block (assuming you wrote the entire block) then it is not looking like an error that is correctable by re-writing it.

And erase cycle on that block might help, but now we're getting into more dangerous stuff.

yes I mentioned that I rebooted and I still get the same bad block error at sector 0x1c0 which is where I copied into. no change
also the oob data in those areas that I wrote into now are exact copy of the ones I copied from.

I just opened up my good 34461A and dumped the same area of the nand. The oob data looks exactly identical to what i see on my bad meter
so I am 100% sure it is not about those OOB data

 

Offline ElectronMan

  • Regular Contributor
  • *
  • Posts: 111
  • Country: us
Re: Agilent 34461A corrupted flash
« Reply #114 on: July 30, 2023, 11:12:52 pm »
by the way the areas that I wrote in the NAND (starting from 0xE0000) look exactly identical to the areas I copied from
including the oob data


so I dont think writing back into the nand is gonna help, is it?

Did you try rebooting since? You can test the theory, as it should check the block you wrote (it was checking it previously) when the first one fails.

If it still shows an error on that block (assuming you wrote the entire block) then it is not looking like an error that is correctable by re-writing it.

And erase cycle on that block might help, but now we're getting into more dangerous stuff.

yes I mentioned that I rebooted and I still get the same bad block error at sector 0x1c0 which is where I copied into. no change
also the oob data in those areas that I wrote into now are exact copy of the ones I copied from.

I just opened up my good 34461A and dumped the same area of the nand. The oob data looks exactly identical to what i see on my bad meter
so I am 100% sure it is not about those OOB data


I am still looking at the code to see exactly what it is verifying in the spare area. If I figure out what it is looking for, maybe we will have some idea of why it is rejecting it.
 

Offline tv84

  • Super Contributor
  • ***
  • Posts: 3355
  • Country: pt
Re: Agilent 34461A corrupted flash
« Reply #115 on: July 30, 2023, 11:29:21 pm »
Having fun without me??

I'm almost sure I know how to calc that CRC/checksum.
 

Offline ElectronMan

  • Regular Contributor
  • *
  • Posts: 111
  • Country: us
Re: Agilent 34461A corrupted flash
« Reply #116 on: July 30, 2023, 11:56:53 pm »
Having fun without me??

I'm almost sure I know how to calc that CRC/checksum.

What I am looking at actually appears to be a bad-block check.

As an example:

Code: [Select]
           00 01 02 03 04 05 06 07  08 09 0A 0B 0C 0D 0E 0F
           XX XX          XX XX XX                 XX XX XX
87FFB708 = FF FF FF FF FF FF FF FF  95 A5 6A 69 59 FF FF FF
If any of the bytes marked with X's from the first 16 bytes of Spare are not FF, it bails with an error.
 

Offline analogRF

  • Super Contributor
  • ***
  • Posts: 1024
  • Country: ca
Re: Agilent 34461A corrupted flash
« Reply #117 on: July 31, 2023, 12:06:12 am »
Having fun without me??

I'm almost sure I know how to calc that CRC/checksum.

so finally dragged you into this  >:D >:D
 

Offline ElectronMan

  • Regular Contributor
  • *
  • Posts: 111
  • Country: us
Re: Agilent 34461A corrupted flash
« Reply #118 on: July 31, 2023, 12:16:48 am »
Okay. So I just noticed something. This is likely why our spares are not matching up... It appears you have a different flash chip with internal ECC, while I do not.

Maybe a cost-cutting change Keysight made before I bought mine. Did you see what flash chip you have in there?

Mine:
CPU:   SPEAr320
DRAM:  128 MiB
Unknown id: 0xffffff. Using ST_M23P40
Flash: 64 KiB
NAND:  fsmc-ecc1 128 MiB
In:    serial
Out:   serial
Err:   serial
SerNum:MY99999999
Chip:  AA Board Rev: 4
init  RTC: 2023-07-30 18:12:44.22
Net:   No ethernet found.
splash RTC: 2023-07-30 18:12:45.25

Yours:
CPU:   SPEAr320
DRAM:  128 MiB
Unknown id: 0xffffff. Using ST_M23P40
Flash: 64 KiB
NAND:  INTERNAL ECC 128 MiB
In:    serial
Out:   serial
Err:   serial
SerNum:MY99999999
Chip:  AA Board Rev: 4
init  RTC: 2023-07-28 15:47:59.57
Net:   No ethernet found.
splash RTC: 2023-07-28 15:48:00.60
« Last Edit: July 31, 2023, 12:18:43 am by ElectronMan »
 

Offline analogRF

  • Super Contributor
  • ***
  • Posts: 1024
  • Country: ca
Re: Agilent 34461A corrupted flash
« Reply #119 on: July 31, 2023, 12:29:57 am »
NAND chips on both of my meters are Micron MT29F1G08ABADAH4-ITX:D  marked NQ432
both are identified in uboot as INTERNAL ECC 128 MiB
 

Offline analogRF

  • Super Contributor
  • ***
  • Posts: 1024
  • Country: ca
Re: Agilent 34461A corrupted flash
« Reply #120 on: July 31, 2023, 12:33:40 am »
from the datasheet of the NAND flash chip:
Code: [Select]
Internal ECC and Spare Area Mapping for ECC
Internal ECC enables 5-bit detection and 4-bit error correction in 512 bytes (x8) or 256
words (x16) of the main area and 4 bytes (x8) or 2 words (x16) of metadata I in the spare
area. The metadata II area, which consists of two bytes (x8) and one word (x16), is not
ECC protected. During the busy time for PROGRAM operations, internal ECC generates
parity bits when error detection is complete.
During READ operations the device executes the internal ECC engine (5-bit detection
and 4-bit error correction). When the READ operaton is complete, read status bit 0 must
be checked to determine whether errors larger than four bits have occurred.
Following the READ STATUS command, the device must be returned to read mode by
issuing the 00h command.
Limitations of internal ECC include the spare area, defined in the figures below, and
ECC parity areas that cannot be written to. Each ECC user area (referred to as main and
spare) must be written within one partial-page program so that the NAND device can
calculate the proper ECC parity. The number of partial-page programs within a page
cannot exceed four
 

Offline ElectronMan

  • Regular Contributor
  • *
  • Posts: 111
  • Country: us
Re: Agilent 34461A corrupted flash
« Reply #121 on: July 31, 2023, 12:36:08 am »
NAND chips on both of my meters are Micron MT29F1G08ABADAH4-ITX:D  marked NQ432
both are identified in uboot as INTERNAL ECC 128 MiB

Okay, that is similar to what they put in their scopes. Mine is a WINBOND W29N01HV. It doesn't have internal ECC. So while I've figured out the code path and what causes that error on mine, it will likely be somewhat different for yours.

What I can see, however, is that this appears to be when it is checking the "BAD BLOCK" area that it is finding something it doesn't like.

Did you say that the OOB for page 0xc0000 was the same on both of your meters? Is there anything on one that is 0xFF that isn't on the broken one?
 

Offline analogRF

  • Super Contributor
  • ***
  • Posts: 1024
  • Country: ca
Re: Agilent 34461A corrupted flash
« Reply #122 on: July 31, 2023, 12:44:07 am »
NAND chips on both of my meters are Micron MT29F1G08ABADAH4-ITX:D  marked NQ432
both are identified in uboot as INTERNAL ECC 128 MiB

Okay, that is similar to what they put in their scopes. Mine is a WINBOND W29N01HV. It doesn't have internal ECC. So while I've figured out the code path and what causes that error on mine, it will likely be somewhat different for yours.

What I can see, however, is that this appears to be when it is checking the "BAD BLOCK" area that it is finding something it doesn't like.

Did you say that the OOB for page 0xc0000 was the same on both of your meters? Is there anything on one that is 0xFF that isn't on the broken one?

right at the first page at 0xc0000 although the actual numbers are different because I had changed the serverip on the bad meter and then changed it back and when you do make a change the whole set of env variables are re-written so the pattern becomes different and the OOB are not identical however the pattern of numbers is identical
but after that first page (on pages that are all 0x00) the OOB are exactly identical

 

Offline analogRF

  • Super Contributor
  • ***
  • Posts: 1024
  • Country: ca
Re: Agilent 34461A corrupted flash
« Reply #123 on: July 31, 2023, 12:45:53 am »
I am pretty sure it is not the nand having a physical problem.

the pboot is doing a wrong calculation for some reason
maybe it is not identifying the correct chip ID
 

Offline analogRF

  • Super Contributor
  • ***
  • Posts: 1024
  • Country: ca
Re: Agilent 34461A corrupted flash
« Reply #124 on: July 31, 2023, 12:50:03 am »
where do you think pboot is getting those "default" boot parameters from. Look at the error here:
Code: [Select]
ERROR : Bootloader setting load failed
[b][b]INFO : Loading default bootloader settings[/b][/b]

Press [ENTER] to launch image stored in flash or [SPACE] to cancel.
Initiating image launch in   4 seconds

P500 Boot Loader Configuration :

Mac address .......... (04:02:02:20:02:02)
Ip address ........... (192.168.114.201)
Subnet Mask address .. (255.255.255.0)
DHCP ................. (Enabled)
Boot delay (seconds).. (5)
Load image 3 at startup

Image addresses. (0xdxxxxxxx for NAND, 0x8xxxxxxx for RAM)
        1 (0xd0400000)
        2 (0xd1700000)
        3 (0x84000000)

if we can somehow change those stupid default values to 0xD0620000 and 0xD2120000
then we should be good to go   :-X :-X
« Last Edit: July 31, 2023, 12:55:09 am by analogRF »
 

Offline analogRF

  • Super Contributor
  • ***
  • Posts: 1024
  • Country: ca
Re: Agilent 34461A corrupted flash
« Reply #125 on: July 31, 2023, 12:56:14 am »
there is variable in uboot
Code: [Select]
erase_env=nand erase 0xC0000 0x40000i dont know where it is used but shows the env partition must be 256KiB
 

Offline ElectronMan

  • Regular Contributor
  • *
  • Posts: 111
  • Country: us
Re: Agilent 34461A corrupted flash
« Reply #126 on: July 31, 2023, 12:56:35 am »
I am pretty sure it is not the nand having a physical problem.

the pboot is doing a wrong calculation for some reason
maybe it is not identifying the correct chip ID

That's a distinct possibility. I read through the datasheet, and it indicates that bad block information is stored on the first page OOB in bytes 0x800-0x801, 0x810-0x811, 0x820-0x821, and 0x830-0x831.

Those all appear to be good (they should be 0xFF).

Was the PBOOT reflashed at some point, possibly with the wrong one for your flash chip?
 

Offline analogRF

  • Super Contributor
  • ***
  • Posts: 1024
  • Country: ca
Re: Agilent 34461A corrupted flash
« Reply #127 on: July 31, 2023, 01:06:52 am »
I am pretty sure it is not the nand having a physical problem.

the pboot is doing a wrong calculation for some reason
maybe it is not identifying the correct chip ID

That's a distinct possibility. I read through the datasheet, and it indicates that bad block information is stored on the first page OOB in bytes 0x800-0x801, 0x810-0x811, 0x820-0x821, and 0x830-0x831.

Those all appear to be good (they should be 0xFF).

Was the PBOOT reflashed at some point, possibly with the wrong one for your flash chip?

no this meter had not been opened until few days ago
also I dumped the pboot from nand and compared the bin file with my good meter and they are identical.
 

Offline ElectronMan

  • Regular Contributor
  • *
  • Posts: 111
  • Country: us
Re: Agilent 34461A corrupted flash
« Reply #128 on: July 31, 2023, 01:21:56 am »
I am pretty sure it is not the nand having a physical problem.

the pboot is doing a wrong calculation for some reason
maybe it is not identifying the correct chip ID

That's a distinct possibility. I read through the datasheet, and it indicates that bad block information is stored on the first page OOB in bytes 0x800-0x801, 0x810-0x811, 0x820-0x821, and 0x830-0x831.

Those all appear to be good (they should be 0xFF).

Was the PBOOT reflashed at some point, possibly with the wrong one for your flash chip?

no this meter had not been opened until few days ago
also I dumped the pboot from nand and compared the bin file with my good meter and they are identical.

It is starting to get weird now. The flash pages in question look fine. The PBOOT image looks correct. It could be that the chip is not responding properly to parameters and giving the correct ID, but I would expect that to cause problems with UBOOT as well.

You could verify that via JTAG by querying the flash chip for parameters. A memory dump might help too.

It might still be worth doing an erase on that once-empty block at e0000 and reprogram it to see if anything changes. But other than that, I am out of ideas at the moment.
 

Offline analogRF

  • Super Contributor
  • ***
  • Posts: 1024
  • Country: ca
Re: Agilent 34461A corrupted flash
« Reply #129 on: July 31, 2023, 01:33:44 am »



It is starting to get weird now. The flash pages in question look fine. The PBOOT image looks correct. It could be that the chip is not responding properly to parameters and giving the correct ID, but I would expect that to cause problems with UBOOT as well.

You could verify that via JTAG by querying the flash chip for parameters. A memory dump might help too.

It might still be worth doing an erase on that once-empty block at e0000 and reprogram it to see if anything changes. But other than that, I am out of ideas at the moment.

i dont know the JTAG pins on the board. Do you?

I will do the erase and re-write but I am pretty sure it will work. maybe the issue is not pboot but it is the uboot
I mean if I understand correctly, uboot reads pboot from 0x320000 into memory but it is a packed (gzipped) binary
so when the bootm command runs, I suppose it must unpack pboot in order for it to execute and maybe that's where the problem starts

 

Offline ElectronMan

  • Regular Contributor
  • *
  • Posts: 111
  • Country: us
Re: Agilent 34461A corrupted flash
« Reply #130 on: July 31, 2023, 02:25:02 am »



It is starting to get weird now. The flash pages in question look fine. The PBOOT image looks correct. It could be that the chip is not responding properly to parameters and giving the correct ID, but I would expect that to cause problems with UBOOT as well.

You could verify that via JTAG by querying the flash chip for parameters. A memory dump might help too.

It might still be worth doing an erase on that once-empty block at e0000 and reprogram it to see if anything changes. But other than that, I am out of ideas at the moment.

i dont know the JTAG pins on the board. Do you?

I will do the erase and re-write but I am pretty sure it will work. maybe the issue is not pboot but it is the uboot
I mean if I understand correctly, uboot reads pboot from 0x320000 into memory but it is a packed (gzipped) binary
so when the bootm command runs, I suppose it must unpack pboot in order for it to execute and maybe that's where the problem starts
Here is the pinout on the connector labeled J102.
Code: [Select]
         0        0 GND
   3.3V  0        0 GND
   TMS   0        0 GND
   TCK   0        0 GND
   TDO   0        0 3.3V
   TDI   0        0 TRST
   3.3V  0        0 GND
 

Offline analogRF

  • Super Contributor
  • ***
  • Posts: 1024
  • Country: ca
Re: Agilent 34461A corrupted flash
« Reply #131 on: July 31, 2023, 02:32:41 am »


Here is the pinout on the connector labeled J102.
Code: [Select]
         0        0 GND
   3.3V  0        0 GND
   TMS   0        0 GND
   TCK   0        0 GND
   TDO   0        0 3.3V
   TDI   0        0 TRST
   3.3V  0        0 GND

Great! Thanks. I only have a Segger J-Link. Not sure if it is compatible with Spear320. I doubt that but I will certainly check

How could a memory dump help?
 

Offline ElectronMan

  • Regular Contributor
  • *
  • Posts: 111
  • Country: us
Re: Agilent 34461A corrupted flash
« Reply #132 on: July 31, 2023, 02:40:10 am »


Here is the pinout on the connector labeled J102.
Code: [Select]
         0        0 GND
   3.3V  0        0 GND
   TMS   0        0 GND
   TCK   0        0 GND
   TDO   0        0 3.3V
   TDI   0        0 TRST
   3.3V  0        0 GND

Great! Thanks. I only have a Segger J-Link. Not sure if it is compatible with Spear320. I doubt that but I will certainly check

How could a memory dump help?

I've been using a J-LINK pro with J-Link commander for some things (debugging and breakpointing) and OpenOCD via the j-link on a Linux box for things like dumping full NAND images.

Really the memory dump around the time of failure may just reveal some things about what the software was "thinking" at the time. Parameters it has loaded for the flash device, etc. I could compare it to my memory state. It's a long shot without me being able to actually breakpoint it and follow it myself.
 

Offline TheSteve

  • Supporter
  • ****
  • Posts: 3787
  • Country: ca
  • Living the Dream
Re: Agilent 34461A corrupted flash
« Reply #133 on: July 31, 2023, 06:05:19 am »
I need to read the entire thread in detail, but I'd certainly say it's JTAG time.
VE7FM
 
The following users thanked this post: analogRF

Offline analogRF

  • Super Contributor
  • ***
  • Posts: 1024
  • Country: ca
Re: Agilent 34461A corrupted flash
« Reply #134 on: July 31, 2023, 10:40:05 am »
I need to read the entire thread in detail, but I'd certainly say it's JTAG time.

please do. your input is always highly appreciated.
 

Offline analogRF

  • Super Contributor
  • ***
  • Posts: 1024
  • Country: ca
Re: Agilent 34461A corrupted flash
« Reply #135 on: July 31, 2023, 12:37:13 pm »
I did the erase and re-write at the empty block at 0xe0000 as was suggested everything is exactly the same including the oob data
looks identical to what i have at 0xc0000 which is what i saw also on my good meter

i really dont think it's the NAND chip physical problem. it is still a software issue

can it have something to do with those "preboot" commands/variables in the uboot?
 

Offline analogRF

  • Super Contributor
  • ***
  • Posts: 1024
  • Country: ca
Re: Agilent 34461A corrupted flash
« Reply #136 on: July 31, 2023, 12:42:14 pm »
I also have a crazy idea which may not completely solve the problem but at least might let the meter boot on its own

what if I write the extracted nk.nb0 file in the nand (need to decide in what location) and then using those preboot commands
I load it into memory and change the bootcmd to just start the WInce and therefore bypass the damn pboot altogether
the same way that I boot it now using CEloader or YMODEM.

obviously FW update will not be possible but other than that it seems it should be a solution? no?
 

Offline ElectronMan

  • Regular Contributor
  • *
  • Posts: 111
  • Country: us
Re: Agilent 34461A corrupted flash
« Reply #137 on: July 31, 2023, 03:58:17 pm »
I also have a crazy idea which may not completely solve the problem but at least might let the meter boot on its own

what if I write the extracted nk.nb0 file in the nand (need to decide in what location) and then using those preboot commands
I load it into memory and change the bootcmd to just start the WInce and therefore bypass the damn pboot altogether
the same way that I boot it now using CEloader or YMODEM.

obviously FW update will not be possible but other than that it seems it should be a solution? no?

Could work in theory. Might also be worth a try to modify the default settings in that PBOOT to the correct ones, so it proceeds anyway.

You could write it to a different location in flash, and load it from there via uboot, so you don't have to overwrite the current one.

It is a lot smaller, and probably safer to try than decompressing the entire image.
 

Offline analogRF

  • Super Contributor
  • ***
  • Posts: 1024
  • Country: ca
Re: Agilent 34461A corrupted flash
« Reply #138 on: July 31, 2023, 04:54:17 pm »
I also have a crazy idea which may not completely solve the problem but at least might let the meter boot on its own

what if I write the extracted nk.nb0 file in the nand (need to decide in what location) and then using those preboot commands
I load it into memory and change the bootcmd to just start the WInce and therefore bypass the damn pboot altogether
the same way that I boot it now using CEloader or YMODEM.

obviously FW update will not be possible but other than that it seems it should be a solution? no?

Could work in theory. Might also be worth a try to modify the default settings in that PBOOT to the correct ones, so it proceeds anyway.

You could write it to a different location in flash, and load it from there via uboot, so you don't have to overwrite the current one.

It is a lot smaller, and probably safer to try than decompressing the entire image.

I thought about that first but the problem is I dont know where it gets those default values from to change them
and also the first option that it follows automatically if user does not interfere is loading from 0x84000000 which leads to boot fail.
I dont know where it gets that address from and what is supposed to be loaded in there (nk.bin??) and when was it supposed to be loaded there

that;s when I thought I can just write  the uncompressed nk.bin in NAND and load it to memory before the pboot...
 

Offline ElectronMan

  • Regular Contributor
  • *
  • Posts: 111
  • Country: us
Re: Agilent 34461A corrupted flash
« Reply #139 on: July 31, 2023, 05:01:56 pm »
I also have a crazy idea which may not completely solve the problem but at least might let the meter boot on its own

what if I write the extracted nk.nb0 file in the nand (need to decide in what location) and then using those preboot commands
I load it into memory and change the bootcmd to just start the WInce and therefore bypass the damn pboot altogether
the same way that I boot it now using CEloader or YMODEM.

obviously FW update will not be possible but other than that it seems it should be a solution? no?

Could work in theory. Might also be worth a try to modify the default settings in that PBOOT to the correct ones, so it proceeds anyway.

You could write it to a different location in flash, and load it from there via uboot, so you don't have to overwrite the current one.

It is a lot smaller, and probably safer to try than decompressing the entire image.

I thought about that first but the problem is I dont know where it gets those default values from to change them
and also the first option that it follows automatically if user does not interfere is loading from 0x84000000 which leads to boot fail.
I dont know where it gets that address from and what is supposed to be loaded in there (nk.bin??) and when was it supposed to be loaded there

that;s when I thought I can just write  the uncompressed nk.bin in NAND and load it to memory before the pboot...

It gets the 0xd0400000 and 0xd1700000 and 0x84000000 addresses from defaults it loads in the binary.

I PMed you a copy of the xloader you can try, where I changed the defaults to the correct ones.

This is normally in flash @0x320000 but I would recommend writing it somewhere empty and then:
nand read 0x600000 <New Address> 0x10000;bootm 0x600000

to boot and test it.
 
The following users thanked this post: analogRF

Offline analogRF

  • Super Contributor
  • ***
  • Posts: 1024
  • Country: ca
Re: Agilent 34461A corrupted flash
« Reply #140 on: July 31, 2023, 05:06:55 pm »

It gets the 0xd0400000 and 0xd1700000 and 0x84000000 addresses from defaults it loads in the binary.

I PMed you a copy of the xloader you can try, where I changed the defaults to the correct ones.

This is normally in flash @0x320000 but I would recommend writing it somewhere empty and then:
nand read 0x600000 <New Address> 0x10000;bootm 0x600000

to boot and test it.
Thanks  :-+

looks very promising. I'll try that.  I will write it somewhere maybe after the current one in the nand

or I can write it at that 0xe0000 no? it's empty
 

Offline ElectronMan

  • Regular Contributor
  • *
  • Posts: 111
  • Country: us
Re: Agilent 34461A corrupted flash
« Reply #141 on: July 31, 2023, 05:13:06 pm »

It gets the 0xd0400000 and 0xd1700000 and 0x84000000 addresses from defaults it loads in the binary.

I PMed you a copy of the xloader you can try, where I changed the defaults to the correct ones.

This is normally in flash @0x320000 but I would recommend writing it somewhere empty and then:
nand read 0x600000 <New Address> 0x10000;bootm 0x600000

to boot and test it.
Thanks  :-+

looks very promising. I'll try that.  I will write it somewhere maybe after the current one in the nand

or I can write it at that 0xe0000 no? it's empty

Yes, that should work.
 

Offline analogRF

  • Super Contributor
  • ***
  • Posts: 1024
  • Country: ca
Re: Agilent 34461A corrupted flash
« Reply #142 on: July 31, 2023, 07:15:48 pm »
I uploaded the modified pboot into NAND at 0xe0000 (after erasing and made sure it is all 0xFF before writing)
and then loaded from there into memory at 0x600000 and issued bootm 0x600000
pboot ran exactly the same way it used to and stopped after all those error messages
when I press space bar to enter the bootloader menu, Now I get the correct addresses 0xd0620000 and 0xd2120000
for image locations however when I choose any of them, the unit simply says "loading image 1 from memory at 0xd0620000" and stops there and hangs

I know there is a Nk.bin (compressed exactly as it is in the firmware package) at d0620000 and d2120000
and it is the same on my good meter.

it seems pboot cannot read the nand or it cannot decompress the XPRS Nk.bin so it hangs in there
« Last Edit: July 31, 2023, 07:47:23 pm by analogRF »
 

Offline analogRF

  • Super Contributor
  • ***
  • Posts: 1024
  • Country: ca
Re: Agilent 34461A corrupted flash
« Reply #143 on: July 31, 2023, 07:39:26 pm »
it seems the only way is to bypass the pboot by writing the extracted nk.nb0 directly and using the "go" command

but I will give that JTAG a try and see if you guys can decipher anything from memory content
 

Offline ElectronMan

  • Regular Contributor
  • *
  • Posts: 111
  • Country: us
Re: Agilent 34461A corrupted flash
« Reply #144 on: July 31, 2023, 08:52:29 pm »
I uploaded the modified pboot into NAND at 0xe0000 (after erasing and made sure it is all 0xFF before writing)
and then loaded from there into memory at 0x600000 and issued bootm 0x600000
pboot ran exactly the same way it used to and stopped after all those error messages
when I press space bar to enter the bootloader menu, Now I get the correct addresses 0xd0620000 and 0xd2120000
for image locations however when I choose any of them, the unit simply says "loading image 1 from memory at 0xd0620000" and stops there and hangs

I know there is a Nk.bin (compressed exactly as it is in the firmware package) at d0620000 and d2120000
and it is the same on my good meter.

So, this uses the same exact function to verify block status when loading the nkbin as it uses when trying to read the uboot configuration.

It may be failing that part too. It is also possible I missed something.

Either way, we can rule out a bad copy of the xloader as the cause, if you are still seeing the same block defects showing up. Theoretically I could nix the part of that binary that does the bad block check, but that's not a good idea long-term.

If you manage to get connected via JTAG, we can query the flash chip to make sure it is outputting the correct parameters. The flash chips in these devices are not natively supported by the PBOOT, they are supported by OFNI-standard parameters read from the chip. If something is bad there, it could cause what we're seeing.
 

Offline ElectronMan

  • Regular Contributor
  • *
  • Posts: 111
  • Country: us
Re: Agilent 34461A corrupted flash
« Reply #145 on: July 31, 2023, 09:24:52 pm »
If you get JTAG going, here is what you'll need uisng JTAG Commander (the segger tools, if using openocd, replace w1 with mwb and replace mem with mdb in the commands).

First "halt" the CPU while in the uboot prompt.


The first command should output 5 bytes identifying the chip manufacturer and a few parameters (the PBOOT checks this to see if it is natively supported).

Code: [Select]
Read ID:
w1 0xBAB10000 0x90
w1 0xBAB20000 0x0
mem 0xBAB00000 5

Next, PBOOT checks for the ONFI "magic" like this:
Code: [Select]
Read ONFI:
w1 0xBAB10000 0x90
w1 0xBAB20000 0x20
mem 0xBAB00000 4

This should return the letters "ONFI"

Finally, this next is the most likely place there could be an issue. It is the page PBOOT uses to configure itself. It tells it what kind of ECC is in use, as well as lots of other things that could break the boot process if it is wrong. For this reason, the manufacturer includes a checksum in this info, AND alternate copies of parameters later. PBOOT appears to ignore these things.

Code: [Select]
Read Parameter Page:
w1 0xBAB10000 0xEC
w1 0xBAB20000 0x0
mem 0xBAB00000 512

This will grab the complete parameters, with CRC and at least 1 redundant copy.

Make sure you don't resume the CPU after this. Just power cycle it, as you are putting the NAND into a mode UBOOT won't be aware of...
 
The following users thanked this post: analogRF

Offline analogRF

  • Super Contributor
  • ***
  • Posts: 1024
  • Country: ca
Re: Agilent 34461A corrupted flash
« Reply #146 on: August 01, 2023, 01:49:58 pm »
I connected the JTag and tried those commands but the "mem" command always says "Could not read memory." :-// :-// :scared:
 

Offline analogRF

  • Super Contributor
  • ***
  • Posts: 1024
  • Country: ca
Re: Agilent 34461A corrupted flash
« Reply #147 on: August 01, 2023, 01:57:45 pm »
if I use mem8 instead of mem, it takes the command with no error but then it does not show anything.
 

Offline ElectronMan

  • Regular Contributor
  • *
  • Posts: 111
  • Country: us
Re: Agilent 34461A corrupted flash
« Reply #148 on: August 01, 2023, 02:29:09 pm »
if I use mem8 instead of mem, it takes the command with no error but then it does not show anything.

What was the memory error? Can you try this while in the PBOOT loader? That memory range is sometimes not available in earlier and later boot stages. Just drop into that menu and halt it there to try.

Even with the patched loader booting okay, it would be interesting to see what's wrong with your flash parameters page exactly.
 

Offline analogRF

  • Super Contributor
  • ***
  • Posts: 1024
  • Country: ca
Re: Agilent 34461A corrupted flash
« Reply #149 on: August 01, 2023, 02:32:41 pm »
if I use mem8 instead of mem, it takes the command with no error but then it does not show anything.

What was the memory error? Can you try this while in the PBOOT loader? That memory range is sometimes not available in earlier and later boot stages. Just drop into that menu and halt it there to try.

Even with the patched loader booting okay, it would be interesting to see what's wrong with your flash parameters page exactly.

just says "Could not read memory." that's it

i'll try it in pboot
 

Offline analogRF

  • Super Contributor
  • ***
  • Posts: 1024
  • Country: ca
Re: Agilent 34461A corrupted flash
« Reply #150 on: August 01, 2023, 02:40:25 pm »
well I halted in pboot prompt and now the jtag commands work and I think this probably shows where the problem is   :-// :-//
Code: [Select]
J-Link>w1 0xbab10000 0x90
Writing 90 -> BAB10000
J-Link>w1 0xbab20000 0x00
Writing 00 -> BAB20000
J-Link>mem 0xbab00000 5
BAB00000 = 2C F1 80 95 82                                    ,....
--------------------------------------------------------------------------
J-Link>w1 0xbab10000 0x90
Writing 90 -> BAB10000
J-Link>w1 0xbab20000 0x20
Writing 20 -> BAB20000
J-Link>mem 0xbab00000 4
BAB00000 = 4F 4E 46 49                                       ONFI
---------------------------------------------------------------------------
J-Link>w1 0xbab10000 0xec
Writing EC -> BAB10000
J-Link>w1 0xbab20000 0x00
Writing 00 -> BAB20000
J-Link>mem 0xbab00000 512

****** Error: Read memory error @ address 0xBAB00000, word access: Memory access timeout.
Could not read memory.
 

Offline analogRF

  • Super Contributor
  • ***
  • Posts: 1024
  • Country: ca
Re: Agilent 34461A corrupted flash
« Reply #151 on: August 01, 2023, 02:49:46 pm »
still i think the reason it gives that error is something else I am doing wrong, still I cannot tell it is because the nand has an error

i tried again but same error

I thought it should at least read something
« Last Edit: August 01, 2023, 03:09:06 pm by analogRF »
 

Offline ElectronMan

  • Regular Contributor
  • *
  • Posts: 111
  • Country: us
Re: Agilent 34461A corrupted flash
« Reply #152 on: August 01, 2023, 03:09:32 pm »
still i think the reason it gives that error is something else I am doing wrong, still I cannot tell it is because the nand has an error

i tried again but same error

Maybe. I started having problems reading my parameters page with the jlink tool, and switched to OpenOCD instead of troubleshooting it. I figured that was a problem specific to my setup.

If you want to try in openOCD I can give you a config that works.
 

Offline analogRF

  • Super Contributor
  • ***
  • Posts: 1024
  • Country: ca
Re: Agilent 34461A corrupted flash
« Reply #153 on: August 01, 2023, 03:37:36 pm »
still i think the reason it gives that error is something else I am doing wrong, still I cannot tell it is because the nand has an error

i tried again but same error

Maybe. I started having problems reading my parameters page with the jlink tool, and switched to OpenOCD instead of troubleshooting it. I figured that was a problem specific to my setup.

If you want to try in openOCD I can give you a config that works.

i dont have openocd right now and with your unbelievable expertise the meter is fixed and working now as normal  :-+ :-+ ;D ;D ;D

I wrote the patched pboot binary provided by @ElectronMan at 0x340000 in the NAND and changed my bootcmd variable to
read pboot from the new address (instead of the original one still at 0x320000) and boot from there

The unit now boots normally and works flawlessly.

Thank you so much @ElectronMan. It was a lot of fun working with you  :-DMM :-DMM
 

Offline ElectronMan

  • Regular Contributor
  • *
  • Posts: 111
  • Country: us
Re: Agilent 34461A corrupted flash
« Reply #154 on: August 01, 2023, 03:58:48 pm »
still i think the reason it gives that error is something else I am doing wrong, still I cannot tell it is because the nand has an error

i tried again but same error

Maybe. I started having problems reading my parameters page with the jlink tool, and switched to OpenOCD instead of troubleshooting it. I figured that was a problem specific to my setup.

If you want to try in openOCD I can give you a config that works.

i dont have openocd right now and with your unbelievable expertise the meter is fixed and working now as normal  :-+ :-+ ;D ;D ;D

I wrote the patched pboot binary provided by @ElectronMan at 0x340000 in the NAND and changed my bootcmd variable to
read pboot from the new address (instead of the original one still at 0x320000) and boot from there

The unit now boots normally and works flawlessly.

Thank you so much @ElectronMan. It was a lot of fun working with you  :-DMM :-DMM

No problem, I am glad that worked! :clap:  It was out of other ideas. Keysight really should update that pboot to handle that situation properly.
 
The following users thanked this post: analogRF

Offline TheSteve

  • Supporter
  • ****
  • Posts: 3787
  • Country: ca
  • Living the Dream
Re: Agilent 34461A corrupted flash
« Reply #155 on: August 01, 2023, 04:30:53 pm »
Well done guys!

So what is the overall summary of the failure itself - a bad block where the original pboot sits?
VE7FM
 

Offline ElectronMan

  • Regular Contributor
  • *
  • Posts: 111
  • Country: us
Re: Agilent 34461A corrupted flash
« Reply #156 on: August 01, 2023, 06:24:00 pm »
Well done guys!

So what is the overall summary of the failure itself - a bad block where the original pboot sits?

The flash chip's parameter page was apparently corrupted.

UBOOT doesn't use it. It just applies defaults based on whether the flash is Micron or not Micron, so it was unaffected.

But PBOOT just grabs the first parameter page and configures itself to talk to the flash.

I patched PBOOT to jump +256 bytes forward during the parameter load to grab the first redundant copy of the parameters page instead, and apparently that copy is good.

Really, PBOOT should be checking the checksum on the page, and automatically checking the 3 or so other copies instead of just trusting that the first copy is good.
 
The following users thanked this post: TheSteve, analogRF

Offline kanzler

  • Newbie
  • Posts: 8
  • Country: de
Re: Agilent 34461A corrupted flash
« Reply #157 on: November 09, 2023, 10:45:33 am »
Hi!Today my device did not work. When you turn it on, there is such a picture on the screen, it does not respond to the buttons. I am attaching the download log. I ask for help in repairing, maybe someone has had such an error. Thank you.
« Last Edit: November 10, 2023, 08:04:19 pm by kanzler »
 

Offline kanzler

  • Newbie
  • Posts: 8
  • Country: de
Re: Agilent 34461A corrupted flash
« Reply #158 on: November 10, 2023, 08:11:13 pm »
Sorry there was the wrong log file
Code: [Select]
U-Boot 2010.03 (Oct 09 2012 - 12:48:30)Agilent P510

CPU:   SPEAr320
DRAM:  128 MiB
Unknown id: 0xffffff. Using ST_M23P40
Flash: 64 KiB
NAND:  INTERNAL ECC 128 MiB
failed: 5 0
nand_bbt: Can't scan flash and build the RAM-based BBT
In:    serial
Out:   serial
Err:   serial
SerNum:MY99999999
Chip:  AA Board Rev: 4
init  RTC: 2001-02-15 15:44:10.15
Net:   No ethernet found.
splash RTC: 2001-02-15 15:44:11.18
Press space to stop autoboot:  0

NAND read: device 0 offset 0x320000, size 0x10000
 65536 bytes read: OK
## Booting kernel from Legacy Image at 00600000 ...
   Image Name:   PBOOT
   Created:      2012-05-22  16:06:43 UTC
   Image Type:   ARM Linux Kernel Image (gzip compressed)
   Data Size:    38780 Bytes = 37.9 KiB
   Load Address: 00000000
   Entry Point:  00000000
   Uncompressing Kernel Image ... OK

Starting kernel ...


Debug serial initialized ........OK
No RTC on 320

Microsoft Windows CE Bootloader Common Library Version 1.4 Built May 22 2012 09:09:57
Microsoft Windows CE 6.0 Ethernet Bootloader for the Agilent P500 board
Adaptation performed by Agilent Technologies (c) 2008

Reading NAND configuration

System ready!
Preparing for download...
No RTC on 320
 Loading image 1 from memory at 0xD0620000
O
BL_IMAGE_TYPE_BIN

X
XXXXOOOOXOXOOOOOOOXXOXXOOOOOOOXOOXOOXOOOXXXOOOOOOOOOXOOOOXOXXOXXXOXOOOXOXXXXOOXXOOOOOOXOOOOXXOOXXOOXXOXOOXOOOXOOXXOOOXOOOOXOXOOOOXOOOXOOOXXOXOXOXOXXXOXXXXOOOXOOOXOXOOOOXOOOOXOXOXOOOOOOXOOOXOOXOOOOXOXOOOOOXOXOOOOOOOOOOOXOXOOOOOOOXXOOOOOOOOXOOOOX
OXOOOXOXXOXXOOXOOXXXOXXXXOXOOXOOXOOXOOXOOXOXXOXOOXOXOOOOOOXXXXXOXOOOXOXOOOOXOOOOXOOOXOOXOOXOOOXOXXXXXXXXXXXXXXXXXXXXXXXXXrom_offset=0x0.
XXImageStart = 0x80361000, ImageLength = 0x169BC08, LaunchAddr = 0x80362000

Completed file(s):
-------------------------------------------------------------------------------
[0]: Address=0x80361000  Length=0x169BC08  Name="" Target=RAM
 Loading image 1 succeeded.
ROMHDR at Address 80361044h
Preparing launch...
No RTC on 320
Launching windows CE image by jumping at address 0x  362000

Windows CE Kernel for ARM (Thumb Enabled) Built on Mar  8 2013 at 17:05:33
Setting up for a Cold Reboot
Done Setting up for a Cold Reboot
Windows CE Firmware Init
BSP 1.0.0 for the SPEARHEAD600AB board (built Mar 18 2016)
Adaptation performed by ADENEO (c) 2005
+OALIntrInit
-OALIntrInit(rc = 1)
Initialize driver globals Zeros area...
pDrvGlobalArea 0xa0060000  size 0x800 (0xa0060800 -0xa0060000)
Initialize driver globals Zeros area...done
 OALKitlStart
Firmware Init Done.
OALIoctlHalEnterI2cCriticalSection init i2c cs
ERROR: C:\WINCE600\PLATFORM\COMMON\SRC\SOC\STM\SPEARHEAD600\DRIVERS\NandFlash\.\sh600_NandFlash.c line 57: ConfigTimming - Unable to open device registry entry
ERROR: C:\WINCE600\PLATFORM\COMMON\SRC\SOC\STM\COMMON\DRIVERS\NandFlash\.\stm_NandFlash.c line 1043: LLD_GetInfo - Unable to open device registry entry
++SER_Init: context Drivers\Active\10
SER_Init, dwIndex:2
GPIO_Select0 Register 0xB300_0024: 0x80000000
Control Register 0xB300_0010 : 0x00000040
RAS Select Register 0xB300_000C: 0xffffacf4
CORE_CLK_CFG 0xB300_0024: 0x80000000
SER2 got sysintr:0x00000013
SER2 Serial Port, new baud rate:0x1c200  (UARTCLK:83250000 IBRD:0x2d FBRD:0xa)
++SER_Init: context Drivers\Active\11
SER_Init, dwIndex:3
GPIO_Select0 Register 0xB300_0024: 0x80000000
Control Register 0xB300_0010 : 0x00000040
RAS Select Register 0xB300_000C: 0xffffacf4
CORE_CLK_CFG 0xB300_0024: 0x80000000
+OALIntrRequestSysIntr IRQ (1) already used by SYSINTR (19)
SER3 got sysintr:0x00000014
SER3 Serial Port, new baud rate:0x1c200  (UARTCLK:83250000 IBRD:0x2d FBRD:0xa)
Incorrect Data, interal ECC failed at 0x62db
Incorrect Data, interal ECC failed at 0x62db
OHCI\system.c, GCFG_USBH1_SW_RST
OHCI\system.c, GCFG_USBH2_SW_RST
-EDeviceLoadEeprom 80:09:02:05:E6:FA
Phy found addr 7 (ticks=3917)
WaitForLink Start (ticks=3919)
No Link (ticks=4921)
<--EDeviceInitialize

GMAC DMA status register = 0x0
FAILED to obtain valid Flash Handle in PlatformInitializeResetting the USB-device silicon
sh600_pdd, IOCTL_BUS_POSTINIT
ERROR: C:\WINCE600\3RDPARTY\Agilent\HPP\Common\Drivers\stm320_UsbFnBusDriver\.\ufnbus.cpp line 1137: failed opening \Agilent Flash\SPD\usbOverride
                                                                                                                                                  stm320_UsbFnBusDriver, set IST priority 96


#################### dllEntry ###########################

Exception 'Raised Exception' (-1): Thread-Id=04a90002(pth=831ff000), Proc-Id=04a80002(pprc=8327bc3c) 'Torreys.exe', VM-active=04a80002(pprc=8327bc3c) 'Torreys.exe'
PC=400256e8(coredll.dll+0x000156e8) RA=803782c8(kernel.dll+0x000062c8) SP=0002f274, BVA=ffffffff
Exception 'Raised Exception' (-1): Thread-Id=04a90002(pth=831ff000), Proc-Id=04a80002(pprc=8327bc3c) 'Torreys.exe', VM-active=04a80002(pprc=8327bc3c) 'Torreys.exe'
PC=400256e8(coredll.dll+0x000156e8) RA=803782c8(kernel.dll+0x000062c8) SP=0002efe4, BVA=ffffffff
Exception 'Raised Exception' (-1): Thread-Id=04a90002(pth=831ff000), Proc-Id=04a80002(pprc=8327bc3c) 'Torreys.exe', VM-active=04a80002(pprc=8327bc3c) 'Torreys.exe'
PC=400256e8(coredll.dll+0x000156e8) RA=803782c8(kernel.dll+0x000062c8) SP=0002efdc, BVA=ffffffff
FAILED to obtain valid Flash Handle in PlatformInitialize
SSInitialize: Error 3
FAILED to obtain valid Flash Handle in PlatformInitialize
SSInitialize: Error 3
FAILED to obtain valid Flash Handle in PlatformInitialize
SSInitialize: Error 3
« Last Edit: November 10, 2023, 08:19:57 pm by kanzler »
 

Offline kanzler

  • Newbie
  • Posts: 8
  • Country: de
Re: Agilent 34461A corrupted flash
« Reply #159 on: January 02, 2024, 04:07:57 pm »
There is an error in my LOG, "Incorrect Data, interal ECC failed at 0x62db" what could it be?
« Last Edit: January 02, 2024, 04:16:51 pm by kanzler »
 

Offline kanzler

  • Newbie
  • Posts: 8
  • Country: de
Re: Agilent 34461A corrupted flash
« Reply #160 on: January 02, 2024, 09:06:12 pm »
 Sorry for being stupid, but how to get uncompressed nk.bin file ?
 

Offline Eng_tech

  • Contributor
  • Posts: 26
  • Country: us
Re: Agilent 34461A corrupted flash
« Reply #161 on: October 02, 2024, 01:48:02 pm »
I have a keysight 34461A that also has I believe corrupted flash. The spear CPU is not overheating and all supply voltages in the meter are spot on. The meter does not boot up and only displays a white screen, none of the button's work, and neither does the USB connection to the meter. I haven't gone much farther then measuring supply voltages. I have purchased a used supposely working front panel for a 34460a with the front circuit board but didn't receive it yet. I know keysight says do not swap out front panels from other units but I figured I would try when I receive it. Obviously, it probably won't work due to mismatch in model/serial numbers. I didn't pay much for it. Anyways, from reading these posts it seems this problem can somewhat remedied by reflashing the NAND. Does anyone have the actual process in steps to perform this fix, including firmware images to use? Thanks, any help is appreciated. I am pretty familar with firmware programming as I do this as part of my job at work.
 
 

Offline analogRF

  • Super Contributor
  • ***
  • Posts: 1024
  • Country: ca
Re: Agilent 34461A corrupted flash
« Reply #162 on: October 02, 2024, 01:54:48 pm »
I have a keysight 34461A that also has I believe corrupted flash. The spear CPU is not overheating and all supply voltages in the meter are spot on. The meter does not boot up and only displays a white screen, none of the button's work, and neither does the USB connection to the meter. I haven't gone much farther then measuring supply voltages. I have purchased a used supposely working front panel for a 34460a with the front circuit board but didn't receive it yet. I know keysight says do not swap out front panels from other units but I figured I would try when I receive it. Obviously, it probably won't work due to mismatch in model/serial numbers. I didn't pay much for it. Anyways, from reading these posts it seems this problem can somewhat remedied by reflashing the NAND. Does anyone have the actual process in steps to perform this fix, including firmware images to use? Thanks, any help is appreciated. I am pretty familar with firmware programming as I do this as part of my job at work.
i dont think anybody "reflashed" the NAND here. Certainly I didnt.
the first thing to do was to hook up the UART debug port on the front panel and see if there are any messages.
still the CPU could be dead even if it's not getting hot
 

Offline Eng_tech

  • Contributor
  • Posts: 26
  • Country: us
Re: Agilent 34461A corrupted flash
« Reply #163 on: October 02, 2024, 06:53:31 pm »
Haven't gotten around to hooking up serial just yet, but that is next. I'll report back on my findings when I do. I hate to toss this meter it was barely used by my company but is out of warranty and they were going to trash it. It was given to me to take home. Yes, the CPU could be bad as the one test point on the front panel was supposed to have a 24 khz signal on it but didn't have anything except 3.3 volts on it I think. Other voltages on the front pcb were good.
 

Offline coromonadalix

  • Super Contributor
  • ***
  • Posts: 7106
  • Country: ca
Re: Agilent 34461A corrupted flash
« Reply #164 on: October 02, 2024, 07:19:13 pm »
 

Offline Eng_tech

  • Contributor
  • Posts: 26
  • Country: us
Re: Agilent 34461A corrupted flash
« Reply #165 on: January 08, 2025, 05:36:27 pm »
It's been a few months since I last posted about this 34461A meter with the white screen when turned on. Worked I did on it since was get a used front panel pcb from someone on Ebay that was suppose to be working but it turned out to have a shorted Spear processor pulling down the 3.3v supply to it. That person then sent me another one. Same thing shorted processor. I found a supply that have correct spear processors and purchased them. So, now in total I have 3 bad front panel boards. I decided to try replacing the spear chips. In the process I damaged 2 of the boards by tearing off pads under the spear chips while cleaning the pads off with solder wick. The third board I was lucky and sucessfully was able to put down a new spear IC. Upon powering up the meter I now get Agilent in black lettering and a black bar representing that it was booting up. After that bar reaches the end a small part of the LCD screen (upper maybe 1/5 of it) displays part of I think Windows CE loading but stops there and then nothing else after that. So, I made some progress in getting it working. I still need to attach a serial connect to the front panel to see what else is going on. I will be using a serial to usb adapter for the connection that I use to talk to PIC micocontrollers. This uses 5 vdc I/O connections. This port on the front panel is it 5 vdc tolerant. I suspect it might 3.3v. What did you use (hardware) to communicate with the front panel? I know that I am not using the original front panel now and serial numbers will not match. Should I even bother proceeding because of this?
 

Offline Eng_tech

  • Contributor
  • Posts: 26
  • Country: us
Re: Agilent 34461A corrupted flash
« Reply #166 on: January 09, 2025, 12:35:09 pm »
I got serial communications going and this is what I came up with. Maybe someone can give an opinion. I was thinking maybe loading the 2nd image and see what happens but don't know how to get to that menu while booting the unit up.
Code: [Select]
                 U-Boot 2010.03 (Oct 09 2012 - 12:48:30)Agilent P510

CPU:   SPEAr320
DRAM:  128 MiB
Unknown id: 0xffffff. Using ST_M23P40
Flash: 64 KiB
NAND:  INTERNAL ECC 128 MiB
In:    serial
Out:   serial
Err:   serial
SerNum:MY99999999
Chip:  AA Board Rev: 4
init  RTC: 2001-01-01 03:03:55.82
Net:   No ethernet found.
splash RTC: 2001-01-01 03:03:56.86
Press space to stop autoboot:  0
p510>               run bootcmd

NAND read: device 0 offset 0x320000, size 0x10000
 65536 bytes read: OK
## Booting kernel from Legacy Image at 00600000 ...
   Image Name:   PBOOT
   Created:      2012-05-22  16:06:43 UTC
   Image Type:   ARM Linux Kernel Image (gzip compressed)
   Data Size:    38780 Bytes = 37.9 KiB
   Load Address: 00000000
   Entry Point:  00000000
   Uncompressing Kernel Image ... OK

Starting kernel ...


Debug serial initialized ........OK
No RTC on 320

Microsoft Windows CE Bootloader Common Library Version 1.4 Built May 22 2012 09:09:57
Microsoft Windows CE 6.0 Ethernet Bootloader for the Agilent P500 board
Adaptation performed by Agilent Technologies (c) 2008

Reading NAND configuration
PHY not found.

System ready!
Preparing for download...
No RTC on 320
 Loading image 1 from memory at 0xD0620000
O
BL_IMAGE_TYPE_BIN
XOXImageStart = 0x80361000, ImageLength = 0x165F210, LaunchAddr = 0x80362000

Completed file(s):
-------------------------------------------------------------------------------
[0]: Address=0x80361000  Length=0x165F210  Name="" Target=RAM
 Loading image 1 succeeded.
ROMHDR at Address 80361044h
Preparing launch...
No RTC on 320
Launching windows CE image by jumping at address 0x  362000

Windows CE Kernel for ARM (Thumb Enabled) Built on Mar  8 2013 at 17:05:33
Setting up for a Cold Reboot
Done Setting up for a Cold Reboot
Windows CE Firmware Init
BSP 1.0.0 for the SPEARHEAD600AB board (built Oct 19 2017)
Adaptation performed by ADENEO (c) 2005
+OALIntrInit
-OALIntrInit(rc = 1)
Initialize driver globals Zeros area...
pDrvGlobalArea 0xa0060000  size 0x800 (0xa0060800 -0xa0060000)
Initialize driver globals Zeros area...done
 OALKitlStart
Firmware Init Done.
OALIoctlHalEnterI2cCriticalSection init i2c cs
ERROR: C:\WINCE600\PLATFORM\COMMON\SRC\SOC\STM\SPEARHEAD600\DRIVERS\NandFlash\.\sh600_NandFlash.c line 57: ConfigTimming - Unable to open device registry entry
ERROR: C:\WINCE600\PLATFORM\COMMON\SRC\SOC\STM\COMMON\DRIVERS\NandFlash\.\stm_NandFlash.c line 1043: LLD_GetInfo - Unable to open device registry entry
++SER_Init: context Drivers\Active\10
SER_Init, dwIndex:2
GPIO_Select0 Register 0xB300_0024: 0x80000000
Control Register 0xB300_0010 : 0x00000040
RAS Select Register 0xB300_000C: 0xffffacf4
CORE_CLK_CFG 0xB300_0024: 0x80000000
SER2 got sysintr:0x00000013
SER2 Serial Port, new baud rate:0x1c200  (UARTCLK:83250000 IBRD:0x2d FBRD:0xa)
++SER_Init: context Drivers\Active\11
SER_Init, dwIndex:3
GPIO_Select0 Register 0xB300_0024: 0x80000000
Control Register 0xB300_0010 : 0x00000040
RAS Select Register 0xB300_000C: 0xffffacf4
CORE_CLK_CFG 0xB300_0024: 0x80000000
+OALIntrRequestSysIntr IRQ (1) already used by SYSINTR (19)
SER3 got sysintr:0x00000014
SER3 Serial Port, new baud rate:0x1c200  (UARTCLK:83250000 IBRD:0x2d FBRD:0xa)
OHCI\system.c, GCFG_USBH1_SW_RST
OHCI\system.c, GCFG_USBH2_SW_RST
-EDeviceLoadEeprom 80:09:02:01:BF:42
Phy not found
WaitForLink Start (ticks=3751)
Link Detected (ticks=3753)

 GMAC Init : 100 Mbit/s FULL DUPLEX (MII)
Flushed Transmit Buffer
phyCfg->dwSpeed 0x64
<--EDeviceInitialize

GMAC DMA status register = 0x600004
GMAC Device enable interrupt
DriverStart
GMAC Device enable interrupt
Resetting the USB-device silicon
sh600_pdd, IOCTL_BUS_POSTINIT
ERROR: C:\WINCE600\3RDPARTY\Agilent\HPP\Common\Drivers\stm320_UsbFnBusDriver\.\ufnbus.cpp line 1137: failed opening \Agilent Flash\SPD\usbOverride
                                                                                                                                                  stm320_UsbFnBusDriver, set IST priority 96

Code: [Select]
*********************   NOR Flash Images   *********************


*********************   NAND Flash Images   *********************
Image at  offset 00000000:
   Image Name:   XLOADER
   Created:      2012-05-16  23:33:58 UTC
   Image Type:   ARM Linux Firmware (uncompressed)
   Data Size:    5370 Bytes = 5.2 KiB
   Load Address: d2800b00
   Entry Point:  d2800b00
   Verifying Checksum ... OK
Image at  offset 00020000:
   Image Name:   XLOADER
   Created:      2012-05-16  23:33:58 UTC
   Image Type:   ARM Linux Firmware (uncompressed)
   Data Size:    5370 Bytes = 5.2 KiB
   Load Address: d2800b00
   Entry Point:  d2800b00
   Verifying Checksum ... OK
Image at  offset 00040000:
   Image Name:   XLOADER
   Created:      2012-05-16  23:33:58 UTC
   Image Type:   ARM Linux Firmware (uncompressed)
   Data Size:    5370 Bytes = 5.2 KiB
   Load Address: d2800b00
   Entry Point:  d2800b00
   Verifying Checksum ... OK
Image at  offset 00060000:
   Image Name:   XLOADER
   Created:      2012-05-16  23:33:58 UTC
   Image Type:   ARM Linux Firmware (uncompressed)
   Data Size:    5370 Bytes = 5.2 KiB
   Load Address: d2800b00
   Entry Point:  d2800b00
   Verifying Checksum ... OK
Image at  offset 00100000:
   Image Name:   UBOOT
   Created:      2012-10-09  18:59:15 UTC
   Image Type:   ARM Linux Kernel Image (uncompressed)
   Data Size:    237084 Bytes = 231.5 KiB
   Load Address: 03f00000
   Entry Point:  03f00000
   Verifying Checksum ... OK
Image at  offset 00320000:
   Image Name:   PBOOT
   Created:      2012-05-22  16:06:43 UTC
   Image Type:   ARM Linux Kernel Image (gzip compressed)
   Data Size:    38780 Bytes = 37.9 KiB
   Load Address: 00000000
   Entry Point:  00000000
   Verifying Checksum ... OK
p510>

Code: [Select]
printenv
ramboot=dhcp 0x4000000 nk.bin;run bootcmd
baudrate=115200
gatewayip=192.168.1.10
netmask=255.255.255.0
chipversion=AA
boardversion=4
serialnum=MY99999999
ftp=dhcp
serverip=000.000.000.000
bootdelay=0
ecc=4
cnfg_vmc_input_pin=mw 0xb3000028 0x00040300 1;mw 0xb3000048 0xfffbffff 1
cnfg_lan_input_pin=mw 0xb3000030 0x00000008 1;mw 0xb3000050 0xFFFFFFFF 1;mw 0xb3000018 0x00000101
preboot=mw.l 0xb300000c 0xffffacf4; run cnfg_lan_input_pin; run cnfg_vmc_input_pin; splash load
dispParm1=110 1e0 989680 0 28
dispParm2=1 1 1 1 3
numinstimages=1
pbootdelay=0
fimage=1
nimages=2
image1=0xd0620000
image2=0xd2120000
fsstart=0x3020000
numfilesystems=2
lengthfilesystem1=0x4EE0000
lengthfilesystem2=0x100000
bootcmd=nand read 0x600000 0x320000 0x10000;bootm 0x600000
uart2=1
rtc=1
ps=0
splashdata=0xd0180000
erase_env=nand erase 0xC0000 0x40000
store_xloader=xload 0x800000
get_xload_eth=dhcp 0x800000 xloader-p510.bin; run store_xloader
store_uboot=nand erase 0x100000 ${blocksize}; nand write 0x800000 0x100000 ${blocksize}
get_uboot_eth=dhcp 0x800000 u-boot-p510.bin;run store_uboot
store_pboot=nand erase 0x320000 ${blocksize}; nand write 0x800000 0x320000 ${blocksize}
get_pboot_eth=dhcp 0x800000 pboot.bin;run store_pboot
flash_nkbin=dhcp 0x4000000 nk.bin;nand erase 0x00620000 ${blocksize};nand write 0x4000000 0x00620000 ${blocksize}
usbtty=cdc_acm
ethaddr=80:09:02:01:bf:42
verify=n
stdin=serial
stdout=serial
stderr=serial
ipaddr=192.168.1.166
guid={d602e6a5-bd8e-e946-827e-66229d5fb213}

Environment size: 1487/16380 bytes
 

Offline voltsandjolts

  • Supporter
  • ****
  • Posts: 2590
  • Country: gb
Re: Agilent 34461A corrupted flash
« Reply #167 on: January 09, 2025, 02:59:35 pm »
I'm watching with interest as I have a 34461A with same symptoms as you, white screen, no uart output. Like yours, cold Spear but it probably needs replaced.

Regarding swapping the front panels - there is an soic NXP LPC 8051 type mcu on the board and IIUC it has eeprom containing the meter serial. When a new panel is connected it receives the meter serial from the motherboard and is thereafter locked to that unit (thanks Keysight, very nice of you). I need to try swapping that mcu between panels to allow panel swaps. I also see that mcu has had fw protection bypassed by glitching the reset - would be nice to get a copy of the fw and eeprom.

Looks like your pboot is OK but perhaps needs an nk.bin to boot to. Somewhat similar to the OP of this thread, after they had fixed their pboot. Maybe reading this thread from the start will provide some hints?
 

Offline Eng_tech

  • Contributor
  • Posts: 26
  • Country: us
Re: Agilent 34461A corrupted flash
« Reply #168 on: January 09, 2025, 08:14:14 pm »
Was thinking about swapping the NXP LPC 8051 from my original front panel pcb wih the front pcb I have the new sprear processor tonight. Reason is because I read in previous comments that NXP LPC 8051 may hold the meter sn. That's an easy thing to do just to make sure that's not causing issues. Easier than doing that Spear BGA. I needed to make sure the spear processor aligned up perfectly on the pcb and decided to create a kind of drop in template that I placed on the front panel. Drop the spear into it and it is exactly aligned before applying hot air to the spear and the board underside. If the switching of the NXP LPC 8051 does not make any difference in booting then I will try loading the second image. I read the entire thread and it is a lot to digest and make sense of. I'm going to try doing the easier things first.
« Last Edit: January 09, 2025, 08:18:46 pm by Eng_tech »
 

Offline Eng_tech

  • Contributor
  • Posts: 26
  • Country: us
Re: Agilent 34461A corrupted flash
« Reply #169 on: January 10, 2025, 12:08:22 pm »
Swapped the  NXP LPC 8051 with my original one and it didn't make any difference in the bootup process. So, then getting to the UBoot menu options I selected to load "image 2". After that I still got the same white srceen with the black Agilent text and the loading bar at the bottom. After loading is completed I wound up with just a black screen and nothing more. No, USB communications either. Haven't tried ethernet because I don't have a crossover cable. I suppose I could use a switch which I have to connect up to my laptop. When I do load image 1 I get the white screen with black Agilent with loading bar and after it done I get a partial blue background maybe upper 1/5 of the display and then the unit freezes up and nothing more.
So, anyways here is what was displayed after booting image 2 it's only slightly different than Image 1. I'm stuck right now on what the problem is. Ran image verify and the images check good.
Code: [Select]
P500 Boot Loader Configuration :

Mac address .......... (80:09:02:01:BF:42)
Ip address ........... (192.168.1.166)
Subnet Mask address .. (255.255.255.0)
DHCP ................. (Enabled)
Boot delay (seconds).. (0)
Load image 1 at startup

Image addresses. (0xdxxxxxxx for NAND, 0x8xxxxxxx for RAM)
        1 (0xd0620000)
        2 (0xd2120000)

l) Load memory resident image Load image 1 now
1) Load memory resident image 1 now
2) Load memory resident image 2 now
3) Load memory resident image 3 now
d) Download from platform builder now
u) Start u-boot by resetting
v) Verify Images
>System ready!
Preparing for download...
No RTC on 320
 Loading image 2 from memory at 0xD2120000
O
BL_IMAGE_TYPE_BIN

X
XXOXOOOXXOOOOOOOXOOXOOOOOOXOOOOXOOOXXOOOOOOOOOXOOOOXOXOOXXOOOXOXXXOOXXOOOOOOXOOOXOOXXOOXXXOOOXOOXOOXXOOOXOOOOOXOOOXOOXOXOOXXXXXOXXXXOOOXOOOXOXOOOOXOOOOXOXOXOOOOOOXOOOXOOXOOOOOXXOOOOOXOXOOOOOOOOOXOXOOOOOOXOXOOOOOOOXOOOOXOXOOOOXOXOXXXXXOXXXXX
XOOXOOXOXXOXXXOXOOXOXOOOOXOOOOXOOOXOOXOOXOOOXOOXXXXXXXXXXXXXXXXXXOXrom_offset=0x0.
XXImageStart = 0x80361000, ImageLength = 0x111B768, LaunchAddr = 0x80362000

Completed file(s):
-------------------------------------------------------------------------------
[0]: Address=0x80361000  Length=0x111B768  Name="" Target=RAM
 Loading image 2 succeeded.
ROMHDR at Address 80361044h
Preparing launch...
No RTC on 320
Launching windows CE image by jumping at address 0x  362000

Windows CE Kernel for ARM (Thumb Enabled) Built on Mar  8 2013 at 17:05:33
Setting up for a Cold Reboot
Done Setting up for a Cold Reboot
Windows CE Firmware Init
BSP 1.0.0 for the SPEARHEAD600AB board (built Oct  2 2013)
Adaptation performed by ADENEO (c) 2005
+OALIntrInit
-OALIntrInit(rc = 1)
Initialize driver globals Zeros area...
pDrvGlobalArea 0xa0060000  size 0x800 (0xa0060800 -0xa0060000)
Initialize driver globals Zeros area...done
 OALKitlStart
Firmware Init Done.
OALIoctlHalEnterI2cCriticalSection init i2c cs
ERROR: C:\WINCE600\PLATFORM\COMMON\SRC\SOC\STM\SPEARHEAD600\DRIVERS\GPIO\.\sh600_gpio_hw.cpp line 170: GPB driver, RegQueryDword('ISTPriority') failed, status:2
ERROR: C:\WINCE600\PLATFORM\COMMON\SRC\SOC\STM\SPEARHEAD600\DRIVERS\NandFlash\.\sh600_NandFlash.c line 57: ConfigTimming - Unable to open device registry entry
ERROR: C:\WINCE600\PLATFORM\COMMON\SRC\SOC\STM\COMMON\DRIVERS\NandFlash\.\stm_NandFlash.c line 1043: LLD_GetInfo - Unable to open device registry entry
*** DLL_PROCESS_ATTACH - Current Process: 0x42, ID: 0x400002 ***
TMC_Init: context Drivers\Active\09
TMC_Init: device name is 'TMC1:'
Resetting the USB-device silicon
TMC_Init: returning 0xc07ea190
++SER_Init: context Drivers\Active\10
SER_Init, dwIndex:2
GPIO_Select0 Register 0xB300_0024: 0x80000000
Control Register 0xB300_0010 : 0x00000040
RAS Select Register 0xB300_000C: 0xffffacf4
CORE_CLK_CFG 0xB300_0024: 0x80000000
SER2 got sysintr:0x00000014
SER2 Serial Port, new baud rate:0x1c200  (UARTCLK:83250000 IBRD:0x2d FBRD:0xa)
++SER_Init: context Drivers\Active\11
SER_Init, dwIndex:3
GPIO_Select0 Register 0xB300_0024: 0x80000000
Control Register 0xB300_0010 : 0x00000040
RAS Select Register 0xB300_000C: 0xffffacf4
CORE_CLK_CFG 0xB300_0024: 0x80000000
+OALIntrRequestSysIntr IRQ (1) already used by SYSINTR (20)
SER3 got sysintr:0x00000015
SER3 Serial Port, new baud rate:0x1c200  (UARTCLK:83250000 IBRD:0x2d FBRD:0xa)
OHCI\system.c, GCFG_USBH1_SW_RST
OHCI\system.c, GCFG_USBH2_SW_RST
-EDeviceLoadEeprom 80:09:02:01:BF:42
Phy not found
WaitForLink Start (ticks=4109)
Link Detected (ticks=4111)

 GMAC Init : 100 Mbit/s FULL DUPLEX (MII)
Flushed Transmit Buffer
phyCfg->dwSpeed 0x64
<--EDeviceInitialize

GMAC DMA status register = 0x600004
GMAC Device enable interrupt
DriverStart
GMAC Device enable interrupt
« Last Edit: January 10, 2025, 12:30:03 pm by Eng_tech »
 

Offline analogRF

  • Super Contributor
  • ***
  • Posts: 1024
  • Country: ca
Re: Agilent 34461A corrupted flash
« Reply #170 on: January 10, 2025, 02:11:34 pm »
if you are not connected to LAN why is the meter thinking it is connected?
still it could be a hardware issue like not properly soldered BGA ball or a RAM issue.
you can test the RAM by 'mtest' command at p510> prompt
without any address, it takes a while to finish because it will check the whole RAM.
as for BGA ball suspicion, I'd recommend use heat gun with a narrow nozzle on the CPU (low temp like 200C or even less)
just for a few seconds while you power it on and see if the behavior changes.
you can also do that same thing for the RAM and see if the behavior changes

if you rule these out then most likely it is just a corrupted flash (nk.nb0 kernel is bad) and needs to be loaded
by ymodem (or tfpt from LAN) to boot the device and then perform fw upgrade.
your FW is 2.17 right now so you will need nk.nb0 extracted from FW2.17

I assume you have already tried the obvious first thing which is just putting the .UPD file (FW update file) on the USB flash
inserted in the device and power it on. that's the first thing I would have done before anything else.
I think your normal boot log shows it has fired up the USB so it may look for update file on it. Most like this will not solve the issue
but it wont do any harm .

I have the bin file extracted from the FW. if you do all the above tests and still inconclusive. just post message here
and I will tell you how to upload and boot the device using the external kernel
 

Offline Eng_tech

  • Contributor
  • Posts: 26
  • Country: us
Re: Agilent 34461A corrupted flash
« Reply #171 on: January 10, 2025, 03:01:00 pm »
Uboot and Wince are new to me as far as troubleshooting goes. I write plenty of programming code for work and home projects for many different microcontrollers and FPGAs, but I have never worked on an operating system like Wince or on someone else's equipment design when it comes to embedded OS.
I'll follow your advice and see what happens. I have not tried putting the .UPD file on a flash drive and booting. I thought the front panel USB would not be working until WinCE fully was loaded and running.
I'm pretty sure the spear is seated good and all balls are connecting. I made a small fixture to make sure the spear was aligned exactly over the pads when installed. I did redo (hot air on top and bottom of pcb) for chip yesterday just to make sure. Still, you never know as I don't have Xray machine to check it. Well, I do at work but never used it. I don't think they would be too fond of me using it for personal use but wouldn't hurt to ask I guess. It has been sitting ever since we got it. No one has ever used it yet.
As for LAN why do you think that the meter thinks it is connected to a LAN? I did do a mtest yesterday but for some reason it aborted and I didn't run it again. I'll try again today after I get out of work.
This is just a strange thing, The spear microprocessor goes bad and shorted out the 3.3 supply to it. Put new spear in and 3.3v supply source looks good now.  It appears to be a common problem with these spear processors failing and when they do NAND or RAM gets corrupted also. But anyway I'll run some more tests. I have read through the U-Boot reference manual to get better aquainted with it and it's commands.
Oh, you thought LAN was hooked up because of this.

Mac address .......... (80:09:02:01:BF:42)
Ip address ........... (192.168.1.166)
Subnet Mask address .. (255.255.255.0)
DHCP ................. (Enabled)

Only did this after loading image 2. It wasn't hooked up though.
Thanks for your assistance!
« Last Edit: January 10, 2025, 03:12:48 pm by Eng_tech »
 

Offline analogRF

  • Super Contributor
  • ***
  • Posts: 1024
  • Country: ca
Re: Agilent 34461A corrupted flash
« Reply #172 on: January 10, 2025, 04:06:38 pm »
Code: [Select]
WaitForLink Start (ticks=3751)
Link Detected (ticks=3753)

 GMAC Init : 100 Mbit/s FULL DUPLEX (MII)
Flushed Transmit Buffer
phyCfg->dwSpeed 0x64
<--EDeviceInitialize

although it is strange that it also says
Code: [Select]
Phy not found

still this may not point to anything though....
if the CPU is fine then the only other thing I can think of is the kernel being corrupted which needs to be loaded by ymodem (very slow)
or tftp (very fast)
still booting with a USB with FW file is good idea

I checked my logs and it seems the mtest doesnt work on these meters I think it is not implemented correctly or somthing
it works on keysight scopes though.
a pointed/localized heat gun for a few seconds on the memory chip at power on usually will detect if the RAM is bad.

if those will get you nowhere I will upload the kernel and you can boot the device either by ymodem or tftp
I highly recommend  tftp because the loading process may encounter errors and in tftp you can repeat it very quickly many times
with ymodm is very slow and if error occurs the you wasted like half an hour for nothing...
 
 

Offline Eng_tech

  • Contributor
  • Posts: 26
  • Country: us
Re: Agilent 34461A corrupted flash
« Reply #173 on: January 11, 2025, 02:44:00 am »
Well, booting with USB stick with firmware didn't work loading either image 1 or 2. Guess I'll try what you recommend using tftp and nk.nb0. I tried hooking the LAN connection to a network switch as well as my laptop but I couldn't establish a connection. Maybe I need to make up a cross over cable and try that. What are your instructions for doing this? What program are you using to run tftp on your computer? MobaXterm?
 

Offline coromonadalix

  • Super Contributor
  • ***
  • Posts: 7106
  • Country: ca
Re: Agilent 34461A corrupted flash
« Reply #174 on: January 11, 2025, 04:25:24 am »
mobaxterm 

putty no gui, 

bitvises ssh client,  voc terminal   free for 30 days

normally the cross over era cable are supposed to be over, any good router hub should have auto mdx negotiation, all our scopes, dmm, gens  etc   are straight cables, hub will help  if the meter is in dhcp

wireshark free  maybe could be useful,   when you start the meter  you can see its ip address or any requests it will make on the network, once you find the right lan connection in wireshark
be sure your main system is not consuming data, video  audio updates ...
 

Offline Eng_tech

  • Contributor
  • Posts: 26
  • Country: us
Re: Agilent 34461A corrupted flash
« Reply #175 on: January 11, 2025, 03:55:59 pm »
I tried connecting through a network switch and also through my wireless router LAN connections and cannot make a connection to the 34461a. Front panel USB does not work either. Rear USB I don't know as boot log is showing I have 1 USB connection but it seems like it's not working. Not recoginized if I plug it into my laptop USB. So, this looks like if I need to use Ymodem if I want to attempt installing a new kernal.
 

Offline coromonadalix

  • Super Contributor
  • ***
  • Posts: 7106
  • Country: ca
Re: Agilent 34461A corrupted flash
« Reply #176 on: January 11, 2025, 07:08:07 pm »
mmm seems the problems levels have increased

some talked about spear mcu damages, flash corruption,    some about some voltage regulators who failed in the mcu section ...  dang

it would need a working one and  probe into many places to get voltages, data points.  memory dumps etc ...      well done keysight well done   :--
« Last Edit: January 11, 2025, 07:10:36 pm by coromonadalix »
 

Offline Eng_tech

  • Contributor
  • Posts: 26
  • Country: us
Re: Agilent 34461A corrupted flash
« Reply #177 on: January 13, 2025, 12:30:43 am »
Tried to convert Nk.bin to nk.nb0 using viewbin.exe to get start and length which did not work giving error  "Missing B000FF) Not a BIN file".
Then was going to use cvrtbin.exe afterwards but assuming that won't work either. What's the reason for this? I'm trying these utilities because I don't want to have to install another programming environment to do the conversion or extraction of nk.nb0.
analogRF, you mentioned you have a good nk.nb0 file you can share? It would be greatly appreciated.

update... So, i decompresses nk.bin, used a small Russian made utility to create the nk.nb0 file. Then I uploaded it via Tera Term Y modem using loady waited the long 40 minutes. After it was done I ran "go 0x00320000" and nothing happened.  :(. Could be something wrong I did maybe like not have a good nk.nb0 file. Tried bootm also after another 40 minutes got wrong image format error.
« Last Edit: January 13, 2025, 05:31:50 am by Eng_tech »
 

Offline analogRF

  • Super Contributor
  • ***
  • Posts: 1024
  • Country: ca
Re: Agilent 34461A corrupted flash
« Reply #178 on: January 13, 2025, 12:39:13 pm »
Tried to convert Nk.bin to nk.nb0 using viewbin.exe to get start and length which did not work giving error  "Missing B000FF) Not a BIN file".
Then was going to use cvrtbin.exe afterwards but assuming that won't work either. What's the reason for this? I'm trying these utilities because I don't want to have to install another programming environment to do the conversion or extraction of nk.nb0.
analogRF, you mentioned you have a good nk.nb0 file you can share? It would be greatly appreciated.

update... So, i decompresses nk.bin, used a small Russian made utility to create the nk.nb0 file. Then I uploaded it via Tera Term Y modem using loady waited the long 40 minutes. After it was done I ran "go 0x00320000" and nothing happened.  :(. Could be something wrong I did maybe like not have a good nk.nb0 file. Tried bootm also after another 40 minutes got wrong image format error.

I sent you the nk.nb0 file for 2.17. The FW in your device right now is 2.17. if you use another bin file it wont work
but where did you load the file in the memory? I am curious how did you come up with "go 0x00320000"?

you have to load it into 0x0361000 ("loady 0x0361000 115200" if you want to use ymodem) and then after finished loading with no errors
use "go 0x00362000" to boot

but like I said, you can use tftp if you set up a tftp server and put the nk.nb0 file in the shared directoy and then use
the dhcp command at p510> prompt.
believe me it will connect to ethernet and will get an IP instantly and download the file. Use the same address 0x0361000 for downloading the bin file
into memory.
still I am puzzled why your device thinks there is an ethernet cable connected when there is none but who knows...
let's see if it boots



 
The following users thanked this post: voltsandjolts, coromonadalix, Eng_tech

Offline Eng_tech

  • Contributor
  • Posts: 26
  • Country: us
Re: Agilent 34461A corrupted flash
« Reply #179 on: January 13, 2025, 01:16:43 pm »
Thanks, very much appreciated, I was looking at past posts and looked like it was mentioned to load the nk.nb0 file at 0x00320000. Anyway, thanks for pointing out my mistake because it looks like I was doing this all wrong. I think I tried DHCP command and didn't do anything but I'll try it again and see if it gets working. Really, thanks for the help. At work so, won't be able to try anything till tonight EST.
 

Offline analogRF

  • Super Contributor
  • ***
  • Posts: 1024
  • Country: ca
Re: Agilent 34461A corrupted flash
« Reply #180 on: January 13, 2025, 06:06:53 pm »
Thanks, very much appreciated, I was looking at past posts and looked like it was mentioned to load the nk.nb0 file at 0x00320000. Anyway, thanks for pointing out my mistake because it looks like I was doing this all wrong. I think I tried DHCP command and didn't do anything but I'll try it again and see if it gets working. Really, thanks for the help. At work so, won't be able to try anything till tonight EST.

technically you can upload it anywhere in the ram as long as it is not used at the time but then you have to skip 0x1000 for the start or launch address.
however if you look at your boot record the FW always copies the bin file at 0x361000 and then starts at 0x362000 exactly the same as  in Keysight 3000/2000 scopes.

with DHCP command you need to give the correct addresses too just like above. or u can use tftp to upload it to memory Instead of LOADY from terminal and then use the 'go' command. your tftp server must be up and running.
if the unit still cannot connect to tftp server then I'd say there is still some hardware problem to be sorted out specially since she thinks the ethernet is connected while it isn't

I once had a case when the LAN controller chip LAN8710A needed to be replaced as well but never saw such a case again
« Last Edit: January 13, 2025, 06:11:03 pm by analogRF »
 
The following users thanked this post: Eng_tech

Offline Eng_tech

  • Contributor
  • Posts: 26
  • Country: us
Re: Agilent 34461A corrupted flash
« Reply #181 on: January 14, 2025, 02:54:13 am »
Must still be a hardware problem. Maybe I will go back a try reheating the spear process again. Or I have RAM issues. I get the same result as I have with booting from the NAND. It boots but gets a partial screen that is white with about 1/5 of the top of the display has a blue background. Here is the boot log. I did this with Ymodem. :( >:( :palm: :wtf:

Just for fun :-DD |O I'm going to do DHCP knowing full well it ain't gonna work.  I'll heat that Spear up more tomorrow at work. Just tried DHCP, gives no ethernet adapter found, same with tftp command

Also, any idea about the 2 leds next to the FPGA on the main board. The one closest to the FPGA is always flashing and the one farthest away is always on. Is this normal behavior?

Maybe this thing is too far gone. It partially boots but stops that was giving me some hope.


Code: [Select]
## Starting application at 0x00362000 ...
Windows CE Kernel for ARM (Thumb Enabled) Built on Mar  8 2013 at 17:05:33
Setting up for a Cold Reboot
Done Setting up for a Cold Reboot
Windows CE Firmware Init
BSP 1.0.0 for the SPEARHEAD600AB board (built Oct 19 2017)
Adaptation performed by ADENEO (c) 2005
+OALIntrInit
-OALIntrInit(rc = 1)
Initialize driver globals Zeros area...
pDrvGlobalArea 0xa0060000  size 0x800 (0xa0060800 -0xa0060000)
Initialize driver globals Zeros area...done
 OALKitlStart
Firmware Init Done.
OALIoctlHalEnterI2cCriticalSection init i2c cs
ERROR: C:\WINCE600\PLATFORM\COMMON\SRC\SOC\STM\SPEARHEAD600\DRIVERS\NandFlash\.\sh600_NandFlash.c line 57: ConfigTimming - Unable to open device registry entry
ERROR: C:\WINCE600\PLATFORM\COMMON\SRC\SOC\STM\COMMON\DRIVERS\NandFlash\.\stm_NandFlash.c line 1043: LLD_GetInfo - Unable to open device registry entry
++SER_Init: context Drivers\Active\10
SER_Init, dwIndex:2
GPIO_Select0 Register 0xB300_0024: 0x80000000
Control Register 0xB300_0010 : 0x00000040
RAS Select Register 0xB300_000C: 0xffffacf4
CORE_CLK_CFG 0xB300_0024: 0x80000000
SER2 got sysintr:0x00000013
SER2 Serial Port, new baud rate:0x1c200  (UARTCLK:83250000 IBRD:0x2d FBRD:0xa)
++SER_Init: context Drivers\Active\11
SER_Init, dwIndex:3
GPIO_Select0 Register 0xB300_0024: 0x80000000
Control Register 0xB300_0010 : 0x00000040
RAS Select Register 0xB300_000C: 0xffffacf4
CORE_CLK_CFG 0xB300_0024: 0x80000000
+OALIntrRequestSysIntr IRQ (1) already used by SYSINTR (19)
SER3 got sysintr:0x00000014
SER3 Serial Port, new baud rate:0x1c200  (UARTCLK:83250000 IBRD:0x2d FBRD:0xa)
OHCI\system.c, GCFG_USBH1_SW_RST
OHCI\system.c, GCFG_USBH2_SW_RST
-EDeviceLoadEeprom 80:09:02:01:BF:42
Phy not found
WaitForLink Start (ticks=3751)
Link Detected (ticks=3753)

 GMAC Init : 100 Mbit/s FULL DUPLEX (MII)
Flushed Transmit Buffer
phyCfg->dwSpeed 0x64
<--EDeviceInitialize

GMAC DMA status register = 0x600004
GMAC Device enable interrupt
DriverStart
GMAC Device enable interrupt
Resetting the USB-device silicon
sh600_pdd, IOCTL_BUS_POSTINIT
ERROR: C:\WINCE600\3RDPARTY\Agilent\HPP\Common\Drivers\stm320_UsbFnBusDriver\.\ufnbus.cpp line 1137: failed opening \Agilent Flash\SPD\usbOverride
                                                           ERROR: OALIoCtlHalGetDeviceInfo: Device doesn't support IOCTL_HAL_GET_DEVICE_INFO::SPI_GETUUID
Warning: you are calling IOCTL_HAL_GET_UUID, which has been deprecated.  Use IOCTL_HAL_GET_DEVICE_INFO instead.
ERROR: OALIoCtlHalGetUUID: Device doesn't support UUID
stm320_UsbFnBusDriver, set IST priority 96
« Last Edit: January 14, 2025, 03:15:13 am by Eng_tech »
 

Offline analogRF

  • Super Contributor
  • ***
  • Posts: 1024
  • Country: ca
Re: Agilent 34461A corrupted flash
« Reply #182 on: January 14, 2025, 03:25:16 am »
I would insert a USB stick with FW file on it into the device before uploading the bin file and issuing the 'go' command. Still I think the correct kernel should look for update file if it finds a usb flash

for me this is still strange and does not match what I have seen on these meters. Maybe I am wrong but I have many logs of different meters and none
shows up  like this. I mean first it says phy not found and then it shows link detected and 100Mb/sec even though no cable is connected
this is not some internal ethernet communication. this is exactly for the LAN connection.
Code: [Select]
Phy not found
WaitForLink Start (ticks=3751)
Link Detected (ticks=3753)

 GMAC Init : 100 Mbit/s FULL DUPLEX (MII)
Flushed Transmit Buffer
phyCfg->dwSpeed 0x64
<--EDeviceInitialize

it could be that dll files of the WInCE are corrupted as well. The next message you will see after the last line of your log is about loading some dll files.
of course there could be some other stuff going on in between which we are not aware of but as far as the UART messages are concerned the next message is about some dll files. If that's the case we need to force the unit to boot the wince from usb (just like in the keysight 3000A scopes) and thus take the dlls from there
i dont know how it can be done but it must be similar to keysight infiniivision scopes.

still I think a hardware issue is the more likely problem. if you got the cpu from aliexpress, be ready to exchange it again as I had to a couple of times.

also maybe probing around that LAN chip could be useful too
 

Offline Eng_tech

  • Contributor
  • Posts: 26
  • Country: us
Re: Agilent 34461A corrupted flash
« Reply #183 on: January 14, 2025, 04:35:50 am »
I probably won't give up on it yet. I will probably just get another cpu again. I get them from a seller on ebay. They look original. The seller is top-chips and the chips are SPEAR320S-2-AA. Others being sold on ebay are Spear320-2. The seller is good, packages it in anti-static bags and the chips are cut from a reel tape and not loose. He has them cheap at $14 a piece last time I looked. Others sell them at much higher costs. Think I will pick up 2 more. Replacing them is no easy task but I figured out a way to perfectly align them on their pads. I will show you how I manage that if I can get an image of my little fixture/guide on here. It works really good.
 

Offline Eng_tech

  • Contributor
  • Posts: 26
  • Country: us
Re: Agilent 34461A corrupted flash
« Reply #184 on: January 14, 2025, 01:21:33 pm »
When I first did the YModem upload and booted I did have my USB flash drive inserted into the front panel with the firmware on it. The flash drive just flashed it's led like it was being read but the meter's screen stayed white. I left it alone giving it some time and watch the serial terminal for any indication that something was happening. After a while, I just shut off the meter and tried the same process but without the flash drive attached. It booted just like it boots off the NAND.
So, you speak of DLL files. They are not part of nk.nb0 that I uploaded via Ymodem? I'm confused. You think they are loaded in at another location in NAND? You could be correct that the boot process halts from a corrupted DLL. It looks like the process just stops as it is trying to display the blue graphics background. Gets a small part of the way and stops.
 

Offline analogRF

  • Super Contributor
  • ***
  • Posts: 1024
  • Country: ca
Re: Agilent 34461A corrupted flash
« Reply #185 on: January 14, 2025, 01:31:44 pm »
When I first did the YModem upload and booted I did have my USB flash drive inserted into the front panel with the firmware on it. The flash drive just flashed it's led like it was being read but the meter's screen stayed white. I left it alone giving it some time and watch the serial terminal for any indication that something was happening. After a while, I just shut off the meter and tried the same process but without the flash drive attached. It booted just like it boots off the NAND.
So, you speak of DLL files. They are not part of nk.nb0 that I uploaded via Ymodem? I'm confused. You think they are loaded in at another location in NAND? You could be correct that the boot process halts from a corrupted DLL. It looks like the process just stops as it is trying to display the blue graphics background. Gets a small part of the way and stops.

yes if i understood correctly (others may correct me here) the main wince files are still being read from the nand. the nk.nb0 is just a minimal kernel to boot the device initially. i may be wrong about that but since everything is quite similar to keysight scopes, I believe the main WinCE files are loaded after your last line of boot record. if we can extract them from the FW file and instruct the meter to read them from usb then maybe....

are you sure there is no hardware issue with the display itself? or the LAN chip? those lan messages are still bothering me....
 

Offline coromonadalix

  • Super Contributor
  • ***
  • Posts: 7106
  • Country: ca
Re: Agilent 34461A corrupted flash
« Reply #186 on: January 14, 2025, 02:32:33 pm »
Windows Ce  by default  load   nk. ***   in ram and decompress it  to run ...   normally the bin vs the b0 contain more data and infos .. but both should contain configs / drivers and the Keysight   dmm executable software  ....

at some point  Windows Ce could be connected to Windows if it contains what it need to do that communication, that way once connected you see WinCe drive and files and can copy them out, export the registry etc ...    not sure in this case, i don't have theses meters to play with

https://supportcommunity.zebra.com/articles/en_US/Knowledge/Windows-CE-device-does-not-connect-with-Windows-10-with-Creators-upgrade-via-WMDC


unless you do have somekind of ssd emmc  or elses, it start in nand ram locations as mentioned,  some  on other threads managed to shift the allocation / address to be able to boot the dmm  ??

the Spear 320 failures ? , no one has clearly stated why it is failing,  voltages ?,  heat ? degradation ?

for the other peripherals as we can guess  usb and lan  hardware should come 1st   to be able to help if it crash ?  uboot or others ...  the spear 320 should contain what we need ? unless  ...

old 2023 thread
https://www.eevblog.com/forum/repair/agilent-keysight-34461a-doesnt-boot/
https://www.eevblog.com/forum/repair/keysight-34461a-179388/

34465
https://www.eevblog.com/forum/testgear/keysight-34465a-reliability/
« Last Edit: January 14, 2025, 02:57:17 pm by coromonadalix »
 

Offline Eng_tech

  • Contributor
  • Posts: 26
  • Country: us
Re: Agilent 34461A corrupted flash
« Reply #187 on: January 14, 2025, 03:43:00 pm »
Pretty sure display is good. As when it first boots you get a white background with the words Keysight Technologies in black and at the bottom of the display is a black bar that increases in length as the booting process runs. After that, the screen would display a blue graphics background image that says on it Keysight Technologies with a load bar at the bottom that would say "initializing and verifying hardware". Only if the meter is working correctly.  But I only get the very top part of that blue graphics background and the meter stops booting at that point or loading the OS. So, maybe it's something with "initializing and verifying hardware". DLL, driver maybe? You would think it would at least display the full graphics background but it stops loading it or sending it to the display. Or maybe where the image is stored is corrupted. Don't know yet.
 

Offline coromonadalix

  • Super Contributor
  • ***
  • Posts: 7106
  • Country: ca
Re: Agilent 34461A corrupted flash
« Reply #188 on: January 14, 2025, 05:28:31 pm »
previous fw  as 3.01 3.02  where about memory leaks, the latest v 3.03  ??


and a small note from keysight ?


have you tried the fw updater from keysight ?  +- 72 Mb
 

Offline Eng_tech

  • Contributor
  • Posts: 26
  • Country: us
Re: Agilent 34461A corrupted flash
« Reply #189 on: January 14, 2025, 05:32:48 pm »
This is whats contained in nb.nb0. I used a utility called dumprom.exe to extract all the files to a folder. It's a large log of what was dumped and it won't all fit in this message so I'm attaching it as a text file.

 

Offline coromonadalix

  • Super Contributor
  • ***
  • Posts: 7106
  • Country: ca
Re: Agilent 34461A corrupted flash
« Reply #190 on: January 14, 2025, 05:51:39 pm »
windows ce tools
 

Offline Eng_tech

  • Contributor
  • Posts: 26
  • Country: us
Re: Agilent 34461A corrupted flash
« Reply #191 on: January 14, 2025, 06:00:22 pm »
I've used it to create a USB drive containing the firmware that the meter orginally had. Of course the USB on the front panel does not work so it can't be used for updating firmware. YModem is only choice that works at this point. The log generated from dumprom is nice as it shows where each file is located and its length. Of what help that will at this point I don't know. I just wanted to see the files thats contained in nb.nb0.
 

Offline coromonadalix

  • Super Contributor
  • ***
  • Posts: 7106
  • Country: ca
Re: Agilent 34461A corrupted flash
« Reply #192 on: January 14, 2025, 07:12:42 pm »
the worst  would be some both  spear problems and nand corruption ??       dang



but the keysight fw  talk about creating the build.xml file and the Nk.bin   and put them on the usb key ???

attached
 

Offline Neganur

  • Supporter
  • ****
  • Posts: 1174
  • Country: fi
Re: Agilent 34461A corrupted flash
« Reply #193 on: January 15, 2025, 04:36:56 pm »
managed to fix a white screen / no boot error on an 34465A by swapping the Spear (U201).

As received, unit did power up, but no fan/USB/LAN, white display.
Upon initial optical inspection of the front panel module, I saw that the Spear had shorted solder balls, and the power management IC (TPS650701) got very hot.
Replaced the Spear, short circuits were gone. Unit powered on, fan spun up. B/W Keysight logo on the display with a progress bar running, but halting.
Two reboots and the progress bar made it to 100%, device seems to power up normally and functions.

Last instrument error displayed is "+822 Controller and measurement board serial numbers do not match", which went away after a factory reset (Edit: seems to persist, error queue was just emptied).

The Spear is quite warm to the touch, I think I am going to place one of those sticky heat sinks on it.

Is it worthwhile dumping the EEPROM?
« Last Edit: January 15, 2025, 05:23:21 pm by Neganur »
 

Offline coromonadalix

  • Super Contributor
  • ***
  • Posts: 7106
  • Country: ca
Re: Agilent 34461A corrupted flash
« Reply #194 on: January 15, 2025, 05:07:31 pm »
@neganur,  if you can do a dump and post it,  sure it would maybe help others ??

the best would be having nand dumps and others things like a "good booting"  log file

the FW is good for the 34461 34465 and 34470 meters ?
 

Offline Eng_tech

  • Contributor
  • Posts: 26
  • Country: us
Re: Agilent 34461A corrupted flash
« Reply #195 on: January 15, 2025, 05:56:31 pm »
Well just to isolate the problem with this meter I put my front panel on a known good unit to see if that unit would act the same during the boot process and it did. This eliminates the main pcb from having anything to do with the problem. So, the problem still resides with the front panel. I'm going to check out the best I can the Ethernet controller on the front panel because during boot the unit thinks it is wired to a network which it isn't. This maybe a clue of some kind. Odd that they put the ethernet controller on the front panel. I would think they would have that near the network connector on the main pcb.
 
The following users thanked this post: coromonadalix

Offline Eng_tech

  • Contributor
  • Posts: 26
  • Country: us
Re: Agilent 34461A corrupted flash
« Reply #196 on: January 17, 2025, 02:54:51 am »
Success! I think. I replace the LAN/Ethernet IC LAN8710A and the unit completely boots up now. Only one other condition exists and that is a little red box in the upper right corner that says "error". It passes self testing also. I am thinking that maybe the meter lost it's calibration information but could be wrong. Tried to do a self calibration but the meter is locked. Firmware updates are also locked. An odd thing that when this meter finally booted up it did a firmware update by itself. Sad installing firmware update in 2 parts. Same version. Kinda strange but maybe has something to do with the new spear microprocessor.
 

Offline analogRF

  • Super Contributor
  • ***
  • Posts: 1024
  • Country: ca
Re: Agilent 34461A corrupted flash
« Reply #197 on: January 17, 2025, 03:06:07 am »
Success! I think. I replace the LAN/Ethernet IC LAN8710A and the unit completely boots up now. Only one other condition exists and that is a little red box in the upper right corner that says "error". It passes self testing also. I am thinking that maybe the meter lost it's calibration information but could be wrong. Tried to do a self calibration but the meter is locked. Firmware updates are also locked. An odd thing that when this meter finally booted up it did a firmware update by itself. Sad installing firmware update in 2 parts. Same version. Kinda strange but maybe has something to do with the new spear microprocessor.
great !
I told you I was very suspicious of that LAN chip because the log was strange.
you should be able to see the error in the error list. also the boot record might show what error is happening
can you connect to the ethernet? does the meter get IP?

no calibration is not lost. it is in a eeprom on the main board but I think there is a procedure to read that calibration and copy to nand because you changed the front panel. that could be the cause of error
you can update the FW either with lan or usb stick.
 

Offline Eng_tech

  • Contributor
  • Posts: 26
  • Country: us
Re: Agilent 34461A corrupted flash
« Reply #198 on: January 17, 2025, 03:31:05 am »
Jumped the gun I guess. It is randomly doing the same thing upon booting up. Sometimes the meter is working normally and sometimes I just get what I was getting before. It is a big step in the right direction I think. I have to find out why it is randomly working. Yeap, the error had something to do with calibration an serial numbers not matching. But for some reason after looking at the log the errors went away. Still gotta find out what is going on. Maybe I have a bad solder connection on that LAN chip. It was a bit of a pain getting it mounted and soldered. I used hot air on it both on top and below with and Chip Quik paste.
 
The following users thanked this post: voltsandjolts

Offline coromonadalix

  • Super Contributor
  • ***
  • Posts: 7106
  • Country: ca
Re: Agilent 34461A corrupted flash
« Reply #199 on: January 17, 2025, 10:09:11 am »
Lan  chip  that's a 1st report i've seen  @analogRF was right

you should be able to realign it, but theses have a thermal pad under them ....    :-+   or  you may burn it  ?   

i would have tried the meter without it  just to see if it get working and stay stable in reboots ?  and do a factory reset ...
 

Offline analogRF

  • Super Contributor
  • ***
  • Posts: 1024
  • Country: ca
Re: Agilent 34461A corrupted flash
« Reply #200 on: January 17, 2025, 11:46:59 am »
Jumped the gun I guess. It is randomly doing the same thing upon booting up. Sometimes the meter is working normally and sometimes I just get what I was getting before. It is a big step in the right direction I think. I have to find out why it is randomly working. Yeap, the error had something to do with calibration an serial numbers not matching. But for some reason after looking at the log the errors went away. Still gotta find out what is going on. Maybe I have a bad solder connection on that LAN chip. It was a bit of a pain getting it mounted and soldered. I used hot air on it both on top and below with and Chip Quik paste.

very much sounds like a soldering issue either with the LAN chip or the CPU itself. solder paste can be a pain...
 

Offline Eng_tech

  • Contributor
  • Posts: 26
  • Country: us
Re: Agilent 34461A corrupted flash
« Reply #201 on: January 19, 2025, 02:15:22 am »
Well, it completely stop working. I used the LAN chip from off another front panel. So, desoldering and then resoldering it to another pcb may have done damage to it. Maybe I applied heat too long or too much heat I don't know as it has a ground pad under the chip and had to make sure it connected. In any case I'm pretty sure this can be resolved. I'm ordering a new chip actually a couple from Digikey and replace the one I think is defective. This is going to take about a week or so before I get the new chip and put it on. So, I'll give an update when that is accomplished.
 

Offline Eng_tech

  • Contributor
  • Posts: 26
  • Country: us
Re: Agilent 34461A corrupted flash
« Reply #202 on: January 22, 2025, 06:00:12 am »
Finally, after putting in a new LAN IC, the meter is now working. It is fully functional, and passes both self tests. It is still coming up with an error on bootup that the serial numbers don't match but that is not affecting it's operation in any way. The serial number must be stored in NAND as I replaced the other microcontroller on the front panel with the one from my original front panel that I messed up when changing out the spear processor. I had damaged it pads trying to clean them up with solder wick. A couple pads got stuck to the solder wick and were ripped off. Hopefully it last for awhile. I have 2 spare spear processors on their way to me just in case I have to change it out again. It's not a simple task doing it by ones self. There are places that will professionally change the chip out for you as long as you provide them the chip. The cost I don't know. In all I spent a little over $100.00 to fix this thing. Which is a good deal seeing I got it for free. But anyways, I would like to thank all who gave their helpful advice in troubleshooting the problem. Also, those who posted their issues and troubleshooting methods in previous messages on here.
 
The following users thanked this post: voltsandjolts

Offline voltsandjolts

  • Supporter
  • ****
  • Posts: 2590
  • Country: gb
Re: Agilent 34461A corrupted flash
« Reply #203 on: January 22, 2025, 08:36:32 am »
Can you please confirm the PN and markings on your replacement SPEAR?
Can you share the eBay item number?
Thanks.
 

Offline Eng_tech

  • Contributor
  • Posts: 26
  • Country: us
Re: Agilent 34461A corrupted flash
« Reply #204 on: January 22, 2025, 05:11:12 pm »
The seller is top-chips and the chips are SPEAR320S-2-AA. It costs I believe it was $14.00 US dollars for one. He has a limited amount so get them while you can. I have 2 on order from him now for backup spares. They are not easy to replace and must be perfectly aligned on the pads. Also, it is very easy to tear off pads if you use solder wick to remove the excess solder on the pads after removing the faulty chip. The pads need to be level. No high spots from solder or the new chip will not seat correctly. You can use flux but a very thin coating of it because it bubbles up when heated and will cause the new chip not to seat correctly. The pcb should be heated on the underside at about 130 degrees Celsius and on top with a smd hot air station about 450 - 500 celsius maybe a little more if the chip is not coming off. Don't try to pull it up. Just poke it on one of it's sides to see if it moves while heating. Once it moves keep applying heat and gently, and slowly lift it up. I made a guide out of fr4 board that fits snuggly on the front panel pcb. It fits exactly around the spear chip with only a very tiny amount of play so the chip will seat down without hanging up on the guide. It works perfectly aligning the chip up for soldering. I will try and post of picture of it sometime soon if someone wants to do it that way.
« Last Edit: January 22, 2025, 05:16:58 pm by Eng_tech »
 
The following users thanked this post: voltsandjolts

Offline coromonadalix

  • Super Contributor
  • ***
  • Posts: 7106
  • Country: ca
Re: Agilent 34461A corrupted flash
« Reply #205 on: January 22, 2025, 05:23:50 pm »
once again   a spear mcu who get defective  BUT  why ??? 

thks for the heads up


can the owners of theses 34461 65 70 series  check their working temperatures  ?
« Last Edit: January 22, 2025, 05:29:44 pm by coromonadalix »
 

Offline voltsandjolts

  • Supporter
  • ****
  • Posts: 2590
  • Country: gb
Re: Agilent 34461A corrupted flash
« Reply #206 on: January 22, 2025, 06:33:58 pm »
The seller is top-chips and the chips are SPEAR320S-2-AA. It costs I believe it was $14.00 US dollars for one.

Got it, ebay.com item 395529524773
Thanks for the tip!
 

Offline Eng_tech

  • Contributor
  • Posts: 26
  • Country: us
Re: Agilent 34461A corrupted flash
« Reply #207 on: January 22, 2025, 08:11:15 pm »
Yes, temperature can be read when you put it in calibration mode. Mine is reading 26 degrees Celsius. It has been on for several hours.
 
The following users thanked this post: coromonadalix

Offline kanzler

  • Newbie
  • Posts: 8
  • Country: de
Re: Agilent 34461A corrupted flash
« Reply #208 on: February 03, 2025, 10:58:35 am »
Dear analogRF,

could you please share the file nk.nb0 with me? I havent repaired my device yet so I belive it would help me out.

Thanks in advance
 

Offline analogRF

  • Super Contributor
  • ***
  • Posts: 1024
  • Country: ca
Re: Agilent 34461A corrupted flash
« Reply #209 on: February 03, 2025, 11:58:36 am »
Dear analogRF,

could you please share the file nk.nb0 with me? I havent repaired my device yet so I belive it would help me out.

Thanks in advance

which version of FW?
 

Offline kanzler

  • Newbie
  • Posts: 8
  • Country: de
Re: Agilent 34461A corrupted flash
« Reply #210 on: February 03, 2025, 03:30:00 pm »
Hi,

I`d like the FW 2.17 version if possible.
 

Offline analogRF

  • Super Contributor
  • ***
  • Posts: 1024
  • Country: ca
 

Offline kanzler

  • Newbie
  • Posts: 8
  • Country: de
Re: Agilent 34461A corrupted flash
« Reply #212 on: February 03, 2025, 03:53:16 pm »
Thank you very much! As soon as I make it all work out, I will update you!
 

Offline kanzler

  • Newbie
  • Posts: 8
  • Country: de
Re: Agilent 34461A corrupted flash
« Reply #213 on: February 08, 2025, 10:28:35 am »
Dear analogRF,

thank ypu very much for your file. Sadly I still cant get my device to work properly and I cant download the file.
I have attached the download in my log. Would you mind take a look at it?

Thanks in advance

Code: [Select]
U-Boot 2010.03 (Oct 09 2012 - 12:48:30)Agilent P510

CPU:   SPEAr320
DRAM:  128 MiB
Unknown id: 0xffffff. Using ST_M23P40
Flash: 64 KiB
NAND:  INTERNAL ECC 128 MiB
failed: 5 0
nand_bbt: Can't scan flash and build the RAM-based BBT
In:    serial
Out:   serial
Err:   serial
SerNum:MY99999999
Chip:  AA Board Rev: 4
init  RTC: 2002-03-08 18:08:29.29
Net:   No ethernet found.
splash RTC: 2002-03-08 18:08:30.32
Press space to stop autoboot:  0
p510> run bootcmd

NAND read: device 0 offset 0x320000, size 0x10000
 65536 bytes read: OK
## Booting kernel from Legacy Image at 00600000 ...
   Image Name:   PBOOT
   Created:      2012-05-22  16:06:43 UTC
   Image Type:   ARM Linux Kernel Image (gzip compressed)
   Data Size:    38780 Bytes = 37.9 KiB
   Load Address: 00000000
   Entry Point:  00000000
   Uncompressing Kernel Image ... OK

Starting kernel ...


Debug serial initialized ........OK
No RTC on 320

Microsoft Windows CE Bootloader Common Library Version 1.4 Built May 22 2012 09:09:57
Microsoft Windows CE 6.0 Ethernet Bootloader for the Agilent P500 board
Adaptation performed by Agilent Technologies (c) 2008

Reading NAND configuration


P500 Boot Loader Configuration :

Mac address .......... (80:09:02:05:E6:FA)
Ip address ........... (192.168.1.222)
Subnet Mask address .. (255.255.255.0)
DHCP ................. (Enabled)
Boot delay (seconds).. (0)
Load image 1 at startup

Image addresses. (0xdxxxxxxx for NAND, 0x8xxxxxxx for RAM)
        1 (0xd0620000)
        2 (0xd2120000)

l) Load memory resident image Load image 1 now
1) Load memory resident image 1 now
2) Load memory resident image 2 now
3) Load memory resident image 3 now
d) Download from platform builder now
u) Start u-boot by resetting
v) Verify Images
>System ready!
Preparing for download...
No RTC on 320
 Downloading image from platform builder
Setting MAC address GMAC_MAC_ADDR_HI_LO[0] = 0x8000FAE6, GMAC_MAC_ADDR_HI_LO[1] = 0x5020980
Auto Negotiation complete in 151430 iterations
Link up
AutoNegotiate Full Duplex
AutoNegotiate 100 Base T
Reading MAC address 0x8009 0x205 0xE6FA
Setting MAC address GMAC_MAC_ADDR_HI_LO[0] = 0x8000FAE6, GMAC_MAC_ADDR_HI_LO[1] = 0x5020980
INFO: GMAC Ethernet controller initialized.
InitDHCP():: Calling ProcessDHCP()
ProcessDHCP()::DHCP_INIT
!CheckUDP: Not UDP (proto = 0x00000002)
!CheckUDP: Not UDP (proto = 0x00000002)
!CheckUDP: Not UDP (proto = 0x00000002)
!CheckUDP: Not UDP (proto = 0x00000002)
!CheckUDP: Not UDP (proto = 0x00000002)
!CheckUDP: Not UDP (proto = 0x00000002)
!CheckUDP: Not UDP (proto = 0x00000002)
!CheckUDP: Not UDP (proto = 0x00000002)
Got Response from DHCP server, IP address: 192.168.0.13

ProcessDHCP()::DHCP IP Address Resolved as 192.168.0.13, netmask: 255.255.255.0
Lease time: 179940 seconds
Got Response from DHCP server, IP address: 192.168.0.13
No ARP response in 2 seconds, assuming ownership of 192.168.0.13
+EbootSendBootmeAndWaitForTftp
Sent BOOTME to 255.255.255.255
Sent BOOTME to 255.255.255.255
Sent BOOTME to 255.255.255.255
Sent BOOTME to 255.255.255.255
Sent BOOTME to 255.255.255.255
Sent BOOTME to 255.255.255.255
Sent BOOTME to 255.255.255.255
Sent BOOTME to 255.255.255.255
Sent BOOTME to 255.255.255.255
Sent BOOTME to 255.255.255.255
Sent BOOTME to 255.255.255.255
Sent BOOTME to 255.255.255.255
Sent BOOTME to 255.255.255.255
Sent BOOTME to 255.255.255.255
Sent BOOTME to 255.255.255.255
Sent BOOTME to 255.255.255.255


« Last Edit: February 08, 2025, 10:44:58 am by kanzler »
 


Share me

Digg  Facebook  SlashDot  Delicious  Technorati  Twitter  Google  Yahoo
Smf