Enabling options on Agilent ESA series E4402B E4404B E4405B E4407B

[tv84]

how did you manage to get the load address?

Educated trial & error...   

I would like to know if there is any way to manually upload a license.dat file to the instrument?  (If this is not possible we can't do an universal license file.)

Also, can anyone provide a printscreen of the license input menu?

Edit: Now that you asked... 

Bootrom Checksum ...
Bootrom DRAM:     Testing 69632 bytes at 0x04000000
Non Destructive SRAM Test ...
Main Firmware DRAM:     Testing 33484800 bytes at 0x04011000
Main FW Checksum ...

[tv84]

After a few more educated googles I arrived here.     

So, we're halfway there!

The licenses should have this format:

FEATURE 202 TMOMID01 1.0 permanent uncounted 0123456789AB  HOSTID=E1234567

Now, we just need the seeds. 

[analogRF]

Those that want to play in IDA with @smgvbest's ESAFW can use these settings:

Proc: Motorola Coldfire
Load address: 0x04011000

i have been trying to open this in IDA with above settings but still I either get an error (loading address must belong to RAM or ROM) or it opens as a raw binary. any more hint?

[tv84]

i have been trying to open this in IDA with above settings but still I either get an error (loading address must belong to RAM or ROM) or it opens as a raw binary. any more hint?

You put the address also in ROM address.

[smgvbest]

I'm attaching the ESALOADER file and the install.o which loads the power suite
I'm not sure but I think one or both of these indicate the files on the discs make me think it may be compressed or partially compressed

ESALOADR is from DISC1 and loads the firmware
UPGRADE.O is from DISC6 which is the last disk of the firmware
install.o is the installer from the Power Suite software
all where zipped to allow upload

edit: fixed this missing install.o file

[tv84]

ESALOADR - Load address: 0x04011000
UPGRADE.O - Load address: 0x0 (after removing a 0x20 size header)
INSTALL.O - Load address: 0x0 (after removing a 0x20 size header)


install.o contains (in the beginning) MD5 hashes (in plain ASCII) of the files that it installs.

[smgvbest]

I'm trying to figure out how to read out the FLASH SIMM without de-soldering the Flash ICs
I've created a map between the LH28F320STKD -> SIMM -> T56 Programmer
There's a few signals that need investigation,  shown in RED.

mainly the LCS_FLASH (CS Selects), Program Voltage ,RYBY (why are there 6 of these, 3 makes sense) , PA0 (possible tried low) ,PA1 (should be straight thru), byte# (likely tied high)
I'll have to ohm out the simm to figure out

Ill still have to de-solder U74 from the processor board (no way around that)

has anyone ever use JTAG on a 68040?
I dont' see a def for it in OCD
if all you can do is a boundary scan can you access memory or do you need debug for that?

[smgvbest]

"has anyone ever use JTAG on a 68040? "

I have not...

What is that 2x5 J16 ? There is one on every interface card except the GPIB. It happens to have the same number of pins and 2x5 as a std RS232 header for a typical computer of that era.

ALSO, where can I get a nice complete set of schematics with block diagrams ? The downloadable service manual is missing those.

On the Processor Card that is a STD JTAG Header for the main FPGA,  its not connected to the processor.
for the CLIP,  http://artekmanuals.com/manuals/hp-manuals/   search for E4400-90310
there are some pages missing.

if anyone has an original CLIP and is willing share (or sell) I'm very interested in getting ahold of it.  PM me off list if you do please

[xymox]

I ordered this one off ebay.. Once I get it AND IF ITS COMPLETE,, I will compress and upload for distribution.. Assuming its not just a copy of what is in your link..

https://www.ebay.com/itm/HP-E4401B-Component-Level-Info-Package-Schematics-/390129973036

I have spent hours getting ALL the files related to ESA off Keysight's terribly organized and painful to use web site. I have collected those and organized them far better. This includes manuals, guides, firmware, personalities discs & docs, options, install notes, application notes ESA related, software drivers, software and more.. I intend on organizing it all even better and making a single downloadable file. I Will also include the CL stuff as well once I have it.

One file to rule them all..

[smgvbest]

Yes that's the one.   
they are scans of the CLIP but very legible.

I've let them know of missing pages I've found so far.  not many 2-3,  processor is missing the last page(s) of the BOM but schematics are good
another is missing a schematic page but don't remember which it was

Note   the CLIP from Artek can not be distributed

[xymox]

Were else was the processor card used ? That Ethernet header and unpopulated parts for it must have been used by something ? I am going to poke around and see what other HP / Agilent devices might have used that same card. I suppose the FPGAs might be loaded totally different tho But maybe it might be possible to load it with ESA firmware and have a Ethernet... Or not.. hahaha.. I am still gonna look around tho..

[smgvbest]

I have a Processor Card with Network and there's no way to configure it in the ESA menus.
only the original card had the ethernet parts.   it's likely part of their debug system

[xymox]

IS it just me ? Im trying to get all the firmware files and the ones from Keysight for the ESA for win 7/8 produce a SSL error ?  https://sa.support.keysight.com/ESA/Firmware/A.14.06.zip?id=2401677

[Miek]

Yeah, same. "Error code: SSL_ERROR_RX_RECORD_TOO_LONG" almost always means the site is serving plain http on that port (no SSL). Change the link to http and it works: http://sa.support.keysight.com/ESA/Firmware/A.14.06.zip?id=2401677

[gslick]

Were else was the processor card used ? That Ethernet header and unpopulated parts for it must have been used by something ? I am going to poke around and see what other HP / Agilent devices might have used that same card.

There are other instruments which reuse a processor card without using all of the hardware features. For example the 16700 logic analyzers use an E4406 processor card. I was curious about why there is a TI 9914 GPIB controller and 75ALS160 / 75ALS164 bus transceivers on the 16700 processor card but the GPIB connector is unpopulated. Turns out the GPIB connector is populated and used on the E4406A.

[smgvbest]

Spent a little bit of time making a PCB for the T56 Programmer to work with the FLASH SIMM.
nothing fancy,  even autorouted, just some switches to let you configure the lines to pick the correct Flash to read out.  U1/U2 or U3.

before I send to PCB house I want to verify a few more things

[Kean]

before I send to PCB house I want to verify a few more things

Maybe fix the spelling mistake on Astronomics 

[smgvbest]

before I send to PCB house I want to verify a few more things

Maybe fix the spelling mistake on Astronomics 

Yes I caught that and a much bigger issue that I've about fixed.  the spacing on the 2 24pin sockets was wrong.   it needed to be 600mils not 1060mils
would not have fit the ZIF socket on the programmer.

should be good now,  placed order from JCLPCB

[analogRF]

Spent a little bit of time making a PCB for the T56 Programmer to work with the FLASH SIMM.
nothing fancy,  even autorouted, just some switches to let you configure the lines to pick the correct Flash to read out.  U1/U2 or U3.

before I send to PCB house I want to verify a few more things

that's awesome 

[smgvbest]

I injured my back and have been pretty much confined to bed so haven’t been able to reflash my SA with a byte change.  But you can design things while confined

I’ll reflash soon as possible to test that out

[smgvbest]

Guess what I just found. 

This is the monitor program I was after. 
to get it i caused an error.   the error was planned,  getting the monitor program was not
question will be how to get this when loading normally.

Code: [Select]

***** Mosquito Bootrom *****
Copyright 1988-1997,
Hewlett-Packard Company, all rights reserved.

@(#)HEWLETT-PACKARD, E4401 Bootrom, 3.10
@(#)LDS Rev: 3.02 - Module Incremental (Feb 18 1999)
@(#)Linked: Feb 18 1999 11:46:22

Bootrom Checksum ...
Bootrom DRAM:     Testing 69632 bytes at 0x04000000
Non Destructive SRAM Test ...
Main Firmware DRAM:     Testing 33484800 bytes at 0x04011000
Main FW Checksum ...
    ROM Checksum Failure.  Bad Checksum.  01, 0
Self-tests complete.SRAM selftest results:
        Start  = 0xa000000
        End    = 0xa007fa3
        Errors = 0x0
DRAM selftest results:
        Start  = 0x4011000
        End    = 0x6000000
        Errors = 0x0
hpibPort = 0x8005000
hpibPort = 0x8005000, bus Address = 19

Cache Enabled
16MBytes of FLASH

Download to Flash Selected

***** Mosquito Bootrom *****
Copyright 1988-1997,
Hewlett-Packard Company, all rights reserved.

@(#)HEWLETT-PACKARD, E4401 Bootrom, 3.10
@(#)LDS Rev: 3.02 - Module Incremental (Feb 18 1999)
@(#)Linked: Feb 18 1999 11:46:22

Bootrom Checksum ...
Bootrom DRAM:     Testing 69632 bytes at 0x04000000
Non Destructive SRAM Test ...
Main Firmware DRAM:     Testing 33484800 bytes at 0x04011000
Main FW Checksum ...
    ROM Checksum Failure.  Bad Checksum.  01, 0
Self-tests complete.SRAM selftest results:
        Start  = 0xa000000
        End    = 0xa007fa3
        Errors = 0x0
DRAM selftest results:
        Start  = 0x4011000
        End    = 0x6000000
        Errors = 0x0
hpibPort = 0x8005000
hpibPort = 0x8005000, bus Address = 19

Cache Enabled
16MBytes of FLASH

Download to Flash Selected

Unexpected exception at VBR offset 0x2c
  Vector #663
  format = 4, frame is at 0x4004794
  PC = 0xcff80000
  SR = 0x0400
  Registers = 0x0a007fa4 thru 0x0a007fef
ROM Monitor
Enter ? for help.
->?
bc      [<hex boot config>] - set the bootrom configuration (see bchelp)
bootvars- display bootrom variables
bs      - force a breakpoint when starting
dbyte   [<hex start address> [num bytes]] - display memory using bytes
dlong   [<hex start address> [num bytes]] - display memory using longs
dmem    [<hex start address> [num bytes]] - display memory using bytes
dword   [<hex start address> [num bytes]] - display memory using words
gbreak  - force a gdb breakpoint
gdb     - enable gdb trapping of exceptions
gu      [<hex start addr>]      - go to start address
hmon    [device] - download into memory
rty test routine
sbyte   <hex start address> <hexchars> - set memory using bytes
slong   <hex start address> <hexchars> - set memory using longs
smem    <hex start address> <hexchars> - set memory using bytes
sword   <hex start address> <hexchars> - set memory using words
version - display bootrom version
->dbyte
00000000  00 00 00 00 00 00 ad 34 4e 56 00 00 4e 41 00 00   .......4NV..NA..
->dbyte 0401100 255



***** Mosquito Bootrom *****
Copyright 1988-1997,
Hewlett-Packard Company, all rights reserved.

@(#)HEWLETT-PACKARD, E4401 Bootrom, 3.10
@(#)LDS Rev: 3.02 - Module Incremental (Feb 18 1999)
@(#)Linked: Feb 18 1999 11:46:22

Bootrom Checksum ...
Bootrom DRAM:     Testing 69632 bytes at 0x04000000
Non Destructive SRAM Test ...
Main Firmware DRAM:     Testing 33484800 bytes at 0x04011000
Main FW Checksum ...
    ROM Checksum Failure.  Bad Checksum.  01, 0
Self-tests complete.SRAM selftest results:
        Start  = 0xa000000
        End    = 0xa007fa3
        Errors = 0x0
DRAM selftest results:
        Start  = 0x4011000
        End    = 0x6000000
        Errors = 0x0
hpibPort = 0x8005000
hpibPort = 0x8005000, bus Address = 19

Cache Enabled
16MBytes of FLASH

Download to Flash Selected

Unexpected exception at VBR offset 0x8
  Access Fault (bus error)
  format = 7, frame is at 0x4004648
  PC = 0xdc9a
  SR = 0x2004
  Registers = 0x0a007fa4 thru 0x0a007fef
  Access Address = 0x401100
ROM Monitor
Enter ? for help.
->?
bc      [<hex boot config>] - set the bootrom configuration (see bchelp)
bootvars- display bootrom variables
bs      - force a breakpoint when starting
dbyte   [<hex start address> [num bytes]] - display memory using bytes
dlong   [<hex start address> [num bytes]] - display memory using longs
dmem    [<hex start address> [num bytes]] - display memory using bytes
dword   [<hex start address> [num bytes]] - display memory using words
gbreak  - force a gdb breakpoint
gdb     - enable gdb trapping of exceptions
gu      [<hex start addr>]      - go to start address
hmon    [device] - download into memory
rty test routine
sbyte   <hex start address> <hexchars> - set memory using bytes
slong   <hex start address> <hexchars> - set memory using longs
smem    <hex start address> <hexchars> - set memory using bytes
sword   <hex start address> <hexchars> - set memory using words
version - display bootrom version
->dbyte
00000000  00 00 00 00 00 00 ad 34 4e 56 00 00 4e 41 00 00   .......4NV..NA..
->dbyte 1024
00001024  53 49 53 00 6a fa 20 49 72 ff b2 90 67 04 4a 90   SIS.j. Ir...g.J.
->version
Bootrom Revision 3.10


Serial is at 19.2Kb so dumping memory will be slow but may be doable soon (I hope)
and if you notice the menu you can dump and write memory 

[tv84]

Sandra,

Do some dumps of 0x04011000 and beyond just to test and compare with ESAFW.

Later i'll provide some specific addresses.

[suj]

I am the owner of the E4407B with AYZ (external mixing) and 1DR (narrow resolution bandwitch) options installed. Also B72 and 1D5. If the memory dump is possible using the monitor program via the J1/RS-232C connector, I can prepare the hardware and do such a dump. Will it be helpful?

[tv84]

Code: [Select]

->dbyte
00000000  00 00 00 00 00 00 ad 34 4e 56 00 00 4e 41 00 00   .......4NV..NA..
->dbyte 1024
00001024  53 49 53 00 6a fa 20 49 72 ff b2 90 67 04 4a 90   SIS.j. Ir...g.J.


These are exactly the bytes of bootrom at 0x00 and 0x1024. 

[smgvbest]

SO far my Playing around to get a dump off a fully running E4407B has not been successful
biggest issue with a successful load your not in the monitor program where you can dump memory.
I am dumping 0401100 on but it's going to take some time at 19.6Kb

From the System/pSOS menu it says that ^C gets you to the monitor.   I've assuming that's CTRL+C and that don't work.  get un-recognized char also tried literal ^C didn't recognize the ^.  looks like its a single char command so not sure what ^C was to be.

the hmon device command will load from a device into memory but I can't figure out the device names
i do know that hmon alone will try to load from GPIB
i tried hmon GPIB and get un-recognized device

I'm find all the things that don't work.  just to find the one that does.
pSOS being so old it's hard to find DOC on as well