Author Topic: Keysight 1000X (EDUX1002A) Fails to boot - UART logged at boot  (Read 1845 times)

0 Members and 1 Guest are viewing this topic.

Offline pnv57Topic starter

  • Contributor
  • Posts: 18
  • Country: us
Keysight 1000X (EDUX1002A) Fails to boot - UART logged at boot
« on: October 27, 2021, 04:21:45 am »
Hi, I have recently acquired two Keysight EDUX1002As to repair, with sticky notes on them. One worked, and has been hacked into the highest model (awaiting trigger and frontend parts) but the other fails to boot. When I swapped BLT (processor/ASIC/FPGA) boards, the problem followed the bad board. Upon booting, I logged the UART output (below). I'm thinking some kind of flash chip failed? Which one is it? Perhaps I could dump my other scope, buy a new flash chip, copy it, and install a replacement? I don't have any tools for working with BGA chips, or anything for working with NAND flash also.


Code: [Select]
U-Boot 2010.03 (Oct 18 2011 - 14:28:06)Agilent P500

CPU:   SPEAr600
DRAM:  128 MiB
Flash: 512 KiB
NAND:  internal ecc 128 MiB

Debug serial initialized ........OK
RTC: 2080-165-23   7:145:99.56 UTC

Microsoft Windows CE Bootloader Common Library Version 1.4 Built May  7 2015 01:38:03
Microsoft Windows CE 6.0 Ethernet Bootloader for the Agilent P500 board
Adaptation performed by Agilent Technologies (c) 2008

PHY not found.

System ready!
Preparing for download...
RTC: 2080-165-23   7:145:99.56 UTC
 Loading image 1 from memory at 0xD0600000
O
BL_IMAGE_TYPE_BIN

X
XXXXOOOOXXOOOOOOOOXOXOOOOOOOOXOOOXOOOOXXOOOOOOOOOXOOOOXOXXOXOXXOXOXOXOXXXXOOXXXOOOOOOXXRewrite recommended, internal ECC corrected data at 0xfe9
OXXOXXXXXXOOOXXXOXXOOOXXXOXXOOOOXOOXXORewrite recommended, internal ECC corrected data at 0x111a
OOXOOOOXOXOOOOOXOOOXOOXOXXOXOXXXXXXOXXXXRewrite recommended, internal ECC corrected data at 0x12af
OOOXOOOXOXOOOOXOOOOXOXOXOOOOOOXX
OOOXOOXOOOOXOOOOXOOXXOOXOOOOOOOOOXOOOOXOOOOOOXOXOOOOXOXOOOOOOOXXOOXOOXOXOOOXOOOXOOXXOXOXOOOXOXXXXXOXOXXXOXXXXOXOXXOOOXXXXOXXXXOXXXXXXXOXXXXXXOXXOXXOXXOOXXOXXXOXXXXOOOXXX
OOOXXXOXXOOXOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOORewrite recommended, internal ECC corrected data at 0x1eab
OOOOOOOOOOOOOOOOXXOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOXXXRewrite recommended, internal ECC corrected data at 0x221b
XBlock length: 0x3fffffff  is larger than 0x10000
 CeDecompressFlashBlock failed
****** Data record 173 corrupted, ABORT!!! ******

Completed file(s):
-------------------------------------------------------------------------------
[0]: Address=0x80361000  Length=0x1A80C40  Name="" Target=RAM
 Loading image 1 failed, trying next one
 Loading image 2 from memory at 0xD1E00000

BL_IMAGE_TYPE_UNKNOWN

 Loading image 2 failed, trying next one
 All images failed

Press r to reset
« Last Edit: October 27, 2021, 04:49:51 am by pnv57 »
 

Online Bud

  • Super Contributor
  • ***
  • Posts: 6877
  • Country: ca
Re: Keysight 1000X (EDUX1002A) Fails to boot - UART logged at boot
« Reply #1 on: October 27, 2021, 05:50:49 am »
This is NAND memory corruption problem. You need to write a good image into it. You do not have to replace the NAND memory chip. However the problem with stock EDUX is it does not have a LAN interface and UBoot is locked. There are ways to upload an image but this will require a surgery to unlock UBoot or build a StupidBear LAN card (information is in the 1000x hacking thread).
Hit spacebar as soon as the UART comes alive and see what menu you get.
Facebook-free life and Rigol-free shack.
 

Offline pnv57Topic starter

  • Contributor
  • Posts: 18
  • Country: us
Re: Keysight 1000X (EDUX1002A) Fails to boot - UART logged at boot
« Reply #2 on: October 27, 2021, 06:47:23 pm »
This is NAND memory corruption problem. You need to write a good image into it. You do not have to replace the NAND memory chip. However the problem with stock EDUX is it does not have a LAN interface and UBoot is locked. There are ways to upload an image but this will require a surgery to unlock UBoot or build a StupidBear LAN card (information is in the 1000x hacking thread).
Hit spacebar as soon as the UART comes alive and see what menu you get.

So you don't believe that is a bad memory chip? And that it got corrupted through another mechanism? What kind of surgery would it require to unlock UBoot? I hooked up a keyboard to the front USB-A port, and it won't respond to spacebar on startup, nor will it respond to "r" at the end where it says "Press r to reset". Also, my keyboard doesn't light up at all. Do you mean the USB-B port in the back? Or the USB port on the StupidBear LAN card?
 

Online Bud

  • Super Contributor
  • ***
  • Posts: 6877
  • Country: ca
Re: Keysight 1000X (EDUX1002A) Fails to boot - UART logged at boot
« Reply #3 on: October 27, 2021, 07:08:48 pm »
NAND corruption is a well known problem on Keysight scopes even on higher end models. I do not think anyone arrived to a conclusion why it happens. The fix is to write a new recent firmware image to it, Keysight apparently made some changes to mitigate the problem.
I mean hit the spacebar at the computer that you have connected to the BLT board, isn't that how you got the UART log?

Facebook-free life and Rigol-free shack.
 

Offline pnv57Topic starter

  • Contributor
  • Posts: 18
  • Country: us
Re: Keysight 1000X (EDUX1002A) Fails to boot - UART logged at boot
« Reply #4 on: October 27, 2021, 07:32:40 pm »
NAND corruption is a well known problem on Keysight scopes even on higher end models. I do not think anyone arrived to a conclusion why it happens. The fix is to write a new recent firmware image to it, Keysight apparently made some changes to mitigate the problem.
I mean hit the spacebar at the computer that you have connected to the BLT board, isn't that how you got the UART log?

Ohh. I'm using a 5V TTL arduino uno with only the TX pin connected, plugged into a terminal on my PC because I don't have a 3.3V level serial adapter. Maybe I can cook something up, will post once I have.
 

Online Bud

  • Super Contributor
  • ***
  • Posts: 6877
  • Country: ca
Re: Keysight 1000X (EDUX1002A) Fails to boot - UART logged at boot
« Reply #5 on: October 27, 2021, 08:28:12 pm »
Yes, you need a functional 2-way UART connection to be able to do anything meaningful.
Facebook-free life and Rigol-free shack.
 

Online Bud

  • Super Contributor
  • ***
  • Posts: 6877
  • Country: ca
Re: Keysight 1000X (EDUX1002A) Fails to boot - UART logged at boot
« Reply #6 on: October 27, 2021, 08:56:19 pm »
What kind of surgery would it require to unlock UBoot?

You will need to reprogram U701 chip on the bottom side of the BLT board. I recommend unsoldering it and keeping as a backup, buy a new one from Digikey or Mouser , burn a replacement firmware in it and install. This is a vanila serial memory chip and is supported by many typical chip programmers. 

This will give you access to UBoot commands which then can be used to manipulate memory blocks. From there may exist a few ways to fix the NAND. But if you are not comfortable with that then you probably should just forget it and sell the scope as non-working. I can help with an advice and directions but not with step by step instructions.
Facebook-free life and Rigol-free shack.
 

Offline felixsys

  • Contributor
  • Posts: 14
  • Country: be
Re: Keysight 1000X (EDUX1002A) Fails to boot - UART logged at boot
« Reply #7 on: February 02, 2022, 08:32:29 pm »
Hello,
Same problem with my 1000x... nand crashed
Did you find a solution?
 

Offline Meow

  • Newbie
  • Posts: 3
  • Country: us
Re: Keysight 1000X (EDUX1002A) Fails to boot - UART logged at boot
« Reply #8 on: February 07, 2023, 09:42:50 pm »
Hi same problem with my EDUX1052A, unable to boot, stuck at LED lights and the screen is black. Anyone know how to fix it. Thanks
 

Offline Meow

  • Newbie
  • Posts: 3
  • Country: us
Re: Keysight 1000X (EDUX1002A) Fails to boot - UART logged at boot
« Reply #9 on: February 21, 2023, 09:04:49 pm »
Here is my uboot log. Does this mean it has NAND corruption?

Code: [Select]
U-Boot SPL 2019.01+tlo+g39e79cf090 (Jun 22 2020 - 20:27:25 +0000)
Configure DDR
Trying to boot from NOR

U-Boot SPL 2019.01+tlo+g39e79cf090 (Jun 22 2020 - 20:27:25 +0000)
Configure DDR
Trying to boot from NOR
 

Online Bud

  • Super Contributor
  • ***
  • Posts: 6877
  • Country: ca
Re: Keysight 1000X (EDUX1002A) Fails to boot - UART logged at boot
« Reply #10 on: February 21, 2023, 11:12:22 pm »
This is a very strange log, never seen it before. I looked up Uboot SPL:
Quote
SPL (Secondary Program Loader) is a small binary, generated from U-Boot
source, that fits in the SRAM and loads the main U-Boot into system RAM

So maybe the NOR ( 8-pin serial memory chip on the bottom of the module) or the dynamic RAM (DDR) is bad. NAND may be ok because it seems Uboot fails before accessing it. You can try replacing the NOR - you'd need to buy a blank IC and program it with the 1052 NOR image (if you can find an image or someone can dump it for you).
Facebook-free life and Rigol-free shack.
 

Offline Meow

  • Newbie
  • Posts: 3
  • Country: us
Re: Keysight 1000X (EDUX1002A) Fails to boot - UART logged at boot
« Reply #11 on: February 22, 2023, 12:07:05 am »
This is a very strange log, never seen it before. I looked up Uboot SPL:
Quote
SPL (Secondary Program Loader) is a small binary, generated from U-Boot
source, that fits in the SRAM and loads the main U-Boot into system RAM

So maybe the NOR ( 8-pin serial memory chip on the bottom of the module) or the dynamic RAM (DDR) is bad. NAND may be ok because it seems Uboot fails before accessing it. You can try replacing the NOR - you'd need to buy a blank IC and program it with the 1052 NOR image (if you can find an image or someone can dump it for you).

Is NOR IC the U701 chip on the BLT board? Thank you!
 

Online Bud

  • Super Contributor
  • ***
  • Posts: 6877
  • Country: ca
Re: Keysight 1000X (EDUX1002A) Fails to boot - UART logged at boot
« Reply #12 on: February 22, 2023, 01:19:04 am »
Yes
Facebook-free life and Rigol-free shack.
 

Offline TT-392

  • Contributor
  • Posts: 21
  • Country: nl
Re: Keysight 1000X (EDUX1002A) Fails to boot - UART logged at boot
« Reply #13 on: November 12, 2023, 01:49:29 pm »
I have a similar UART log as OP:

Code: [Select]
U-Boot 2010.03 (Oct 18 2011 - 14:28:06)Agilent P500

CPU:   SPEAr600
DRAM:  128 MiB
Flash: 512 KiB
NAND:  internal ecc 128 MiB

Debug serial initialized ........OK
RTC: 2024-23-11   1:94:20.31 UTC

Microsoft Windows CE Bootloader Common Library Version 1.4 Built May  7 2015 01:38:03
Microsoft Windows CE 6.0 Ethernet Bootloader for the Agilent P500 board
Adaptation performed by Agilent Technologies (c) 2008

PHY not found.

System ready!
Preparing for download...
RTC: 2024-23-11   1:94:20.31 UTC
 Loading image 1 from memory at 0xD0600000
O
BL_IMAGE_TYPE_BIN

X
XXXXOOOOXXOOOOOOOOXOXOOOOOOOOXOOOXOOOOXXOOOOOOOOOXOOOOXOXXOXOXXOXOXOXOXXXXOOXXXOOOOOOXXOXXOXXXXXXOOOXXXOXXOOOXXXOXXOOOOXOOXXOOOXOOOOXOXOOOOOXOOOXOOXOXXOXOXXXXXXOXXXXOOOXOOOXOXOOOOXOOOOXOXOXOOORewrite recommended, internal ECC corrected data at 0x13ea
OOOXX
OOOXOOXOOOOXOOOOXOOXXOOXOOOOOOOOOXOOOOXOOOOOOXOXOOOOXOXOOOOOOOXXOOXOOXOXOOOXOOOXOOXXOXOXOOOXOXXXXXOXOXXXOXXXXOXOXXOOOXXXXOXXXXOXXXXXXXODeCompressFlash: CeCompressDecode() failed
 CeDecompressFlashBlock failed
****** Data record 137 corrupted, ABORT!!! ******

Completed file(s):
-------------------------------------------------------------------------------
[0]: Address=0x80361000  Length=0x1A80C40  Name="" Target=RAM
 Loading image 1 failed, trying next one
 Loading image 2 from memory at 0xD1E00000

BL_IMAGE_TYPE_UNKNOWN

 Loading image 2 failed, trying next one
 All images failed

Press r to reset

Resetting

Press r to reset


I am open to doing surgery to unlock UBoot:
What kind of surgery would it require to unlock UBoot?

You will need to reprogram U701 chip on the bottom side of the BLT board. I recommend unsoldering it and keeping as a backup, buy a new one from Digikey or Mouser , burn a replacement firmware in it and install. This is a vanila serial memory chip and is supported by many typical chip programmers. 

This will give you access to UBoot commands which then can be used to manipulate memory blocks. From there may exist a few ways to fix the NAND. But if you are not comfortable with that then you probably should just forget it and sell the scope as non-working. I can help with an advice and directions but not with step by step instructions.

I actually already desoldered and read U701 before and confirmed its contents were identical to "xloader_image.bin", which I extracted from keysight's firmware upgrade file. (This seemed like easy low hanging fruit to check before connecting the UART console).
So, with that experience, writing new firmware to that chip should be doable. Am I understanding correctly that the method for reprogramming UBoot involves writing some firmware with UBoot writing capabilities to that chip, and using that to flash a new UBoot image? If so, then my question is, where would I find this magical UBoot unlocking firmware image?



edit:
I also have a J-Link EDU Mini to talk to the JTAG connector could I maybe program the UBoot directly like that?
« Last Edit: November 12, 2023, 06:12:54 pm by TT-392 »
 


Share me

Digg  Facebook  SlashDot  Delicious  Technorati  Twitter  Google  Yahoo
Smf