Products > Test Equipment

Hacking the Siglent SDM3055 Bench DMM

<< < (30/35) > >>

alexvg:
Hi,

I've created 2 diagrams because it seems I misexplained my current work on the device.
I'm not working on a new GUI to replace the original Siglent software.
I'm working on another way to operate the device, to process the data and to provide better measurements.

Let's look at how the device works with the original Siglent Software.


Now let's look at my current work



I hope that with these diagrams, my work seems to be clearer to you.

Have a nice day.
Alexia.


alexvg:
Experimentation on the AM3352 Sitara processor and Siglent digital board of the SDM3055





1. I've done a full backup of the NAND Flash memory (a global NAND file and 12 mtd files)
2. Rename and clean the 12 mtd files and generate 6 files (MLO, u-boot, kernel, rawlogo, rootfs, datafs)
3. I've reset the NAND Flash memory.
4. The SDM3055 is totally crashed/bricked !!!

Why did I lock my device ?
I need to have a step-by-step and verified procedure to allow me to quickly unlock the device if something goes wrong.


The hard way : Restoring the MLO and u-boot
I've written the MLO and u-boot files into a SD-Card under Linux
The SD-Card is /dev/sdc under Linux

--- Code: ---sudo dd if=/dev/zero of=/dev/sdc bs=1M count=10
sudo dd if=./MLO.img of=/dev/sdc count=1 bs=128k
sudo dd if=./u-boot.img of=/dev/sdc seek=1 bs=384k
--- End code ---

My MLO file is 128KiB long, now I can't shorten it.
My U-boot file is 1920KiB long, now I can't shorten it.

I unplug the SDM3055, insert the SD-Card, plug power supply to the SDM3055, short J16 (if J16 exists) and press "power".
I look at the JTAG under Putty and see the process... (need around 2 minutes)
I press "power" and unplug the power supply and remove the SD-Card.

Now the MLO and U-Boot is on the device... It's done !

The easy way : Restoring the device
Under Windows or Linux, create a partition into the SD-Card and format in FAT format.
(Personally I create a 3GB partition).

Copy the 6 files (MLO, u-boot, kernel, rawlogo, rootfs, datafs) into the SD-Card.
Create a uEnv.txt file to read and nand erase/write all 6 files into the SD-Card.

Here's my uEnv.txt (uEnv.txt file only support UNIX line feed)

--- Code: ---I've removed my uEnv.txt because my SDM3055 suddently crash after working on the filesystem.
I thing my uEnv.txt is wrong.
--- End code ---
Note : You could create your own uEnv.txt using the U-boot documentation and the mtd4 raw backup. I've seen inside the mtd4 files, it could possible to restore the device from a USB-Key... I must try this.

I unplug the SDM3055, insert the SD-Card, plug power supply to the SDM3055, short J16 (if J16 exists) and press "power".
I look at the JTAG under Putty and see the process... (need around 5 minutes)
The device will boot 2 or 3 times and... application is launched !!!
Turn off the device, remove power supply, remove SD-Card and open J16 (if exists).
Turn on the device, it works !


I've done this for the v19 firmware.
I need to work more to provide all tools, to backup NAND Flash more better and to create a v19 and a v25 compatible backup process.


Other userfull information

--- Code: ---mtd0 - the MLO (or named SPL)
mtd1 - a copy the MLO (or named SPL.backup1)
mtd2 - a copy the MLO (or named SPL.backup2)
mtd3 - a copy the MLO (or named SPL.backup3)
mtd4 - U-boot
mtd5 - U-boot env (it's empty)
mtd6 - Manufacturedata (it's the raw image, but a u-boot command could upload and convert a BMP file into this area)
mtd7 - rootfs (warning ! not all data needs to be backed up - I'm working and a tool to autocorrect the file)
mtd8 - kernel (it's the Linux kernel)
mtd9 - firmdata0 (your calibration data !!! very important to backup)
mtd10 - firmdata1 (i'll don't backup this)
mtd11 - datafs (warning ! not all data needs to be backed up - I'm working and a tool to autocorrect the file)
--- End code ---
mtd7 or rootfs is mounted into /
mtd9 or firmdata0 is mounted info /usr/bin/siglent/firmdata0 (this directory is very important, it contains the calibration data of the device)
mtd11 or datafs is mounted into /usr/bin/siglent/usr

The NAND Flash memory mapping

--- Code: ---Offset                    Size (hex)  Size (KiB)  Description
0x0000000-0x0020000       0x0020000   128KiB      mtd0 - MLO (SPL)
0x0020000-0x0040000       0x0020000   128KiB      mtd1 - MLO (SPL.backup 1)
0x0040000-0x0060000       0x0020000   128KiB      mtd2 - MLO (SPL.backup 2)
0x0060000-0x0080000       0x0020000   128KiB      mtd3 - MLO (SPL.backup 3)
0x0080000-0x0260000       0x01E0000   1920KiB     mtd4 - U-Boot
0x0260000-0x0280000       0x0020000   128KiB      mtd5 - U-Boot Env
0x0280000-0x0580000       0x0300000   3072KiB     mtd6 - Raw logo
0x0580000-0x3080000       0x2b00000   44032KiB    mtd7 - rootfs
0x3080000-0x3680000       0x0600000   6144KiB     mtd8 - Linux Kernel
0x3680000-0x6880000       0x3200000   51200KiB    mtd9 - firmdata0
0x6880000-0x9A80000       0x3200000   51200KiB    mtd10- firmdata1
0x9a80000-0x10000000      0x6580000   103936KiB   mtd11- datafs
Total                     0x10000000  256MiB      NAND Flash
--- End code ---

About how to backup data of mtd0 to mtd11
I've noticed a difference of data backed up between U-boot and Linux.

--- Code: ---U-Boot code to backup MLO into a SD-Card
nand read 0x82000000 0x00000 0x20000
fatwrite mmc 0 0x82000000 backup-MLO.img 0x20000

Linux code to backup MLO into a USB-Key
nanddump -s 0 /dev/mtd0 -f /usr/bin/siglent/usr/mass_storage/U-disk0/MLO.img
--- End code ---
The MLO file saved using the U-Boot command is 128KiB long and cannot be shorten with my own tool to clear backup flash file.
The MLO file saved using Linux command is 132KiB long and can be shorten to 84KiB with my own tool to clear backup flash file.
Why ? I don't understand...


--- Quote ---Updated on 2023-02-21 02:24 GMT
I've removed some incorrect or false information.
I've added the Flash NAND memory mapping.
I've added information about how to backup data.
--- End quote ---

To be continued...
Alexia.

alexvg:
Hello everyone,

I finally found a solution to make a complete backup of the NAND Flash memory of the SDM3055 for all firmware versions.
The problem with the solution? It's too complex!

Anyway, I'll briefly explain my method.

My first functional solution (quick explanation)
You need to create 3 text files on an uSD-CARD formatted in FAT32. These 3 files contain U-Boot commands to dump the NAND Flash.
You need to boot the device on the uSD-CARD and wait for it to start up completely.
Under Linux, you need to mount and then reduce the images of the rootfs.img and datafs.img files with mkfs.ubifs.
Finally, you need to create a uSD-CARD with the image files in ubifs format as well as the few other dumped image files. All this with a uEnv.txt file.

My second functional solution (quick explanation)
You need to create 3 text files on an uSD-CARD formatted in FAT32. These 3 files contain U-Boot commands to dump the rootfs partition of the NAND Flash.
You need to boot the device on the uSD-CARD and wait for it to start up completely.
Under Linux, you need to mount and then reduce the image of the rootfs.img file with mkfs.ubifs.
From a Siglent update file in ADS format, you need to extract the files to be added to the uSD-CARD and add the ubifs file of rootfs. You need to accompany all this with a uEnv.txt file.

My third solution but not yet functional
You need to place a special version of mkfs.ubifs on a USB key.
With Telnet or Putty, you need to mount the USB key in another path, dump the non-ubi partitions, unmount some partitions, and convert the ubi partitions with mkfs.ubifs.
You will need to copy all the resulting files to a uSD-CARD with the uEnv.txt file.
(Currently, I can extract all ubi partitions except rootfs because my version of mkfs.ubifs is blocked due to a known bug).

The future
For now, I'm putting the NAND Flash memory extraction on hold. I may incorporate an option into my software to extract all data quickly and simply (if possible).
I noted that firmware version 1.01.01.25 changed things for the management of the rootfs partition. But I also noted a bug in version 25 that locks the device (perhaps due to my tinkering with the partitions?)
In the meantime, I'll start working on the software again and I'll post versions of my binaries when they're available.


I am seriously considering distributing my software for free while offering people who wish to financially support me through donations.
So... free of charge !


Thank you for supporting me.

Alexia.

alexvg:
Hi,

Here is the status of the project :
- I have improved the capture to gain one bit of precision at the ADC level.
- I still have issues with range/function selection (sometimes the selection goes wrong and the measurements are completely off)
- I haven't yet implemented the very high precision capture processing functions.
- I have improved the processor load with a significant decrease: going from 60% to 35% load.
- To date, I have only had one crash during operation, but I haven't yet looked for the cause.
- The DCV, DCI, ACV, ACI, R2W, R4W, and "continuity" functions work. The "diode" function is buggy. The other functions are inactive.

Here is a small capture with a reference set to 1V (1000V / DCV / 1NPLC)

alexvg:
Hi,
I've done some little improvements but not enough to provide a public beta.
So here is a little video at 60FPS.
https://youtu.be/HVU-4-q3Zkc

Alexia from France.

Navigation

[0] Message Index

[#] Next page

[*] Previous page

There was an error while thanking
Thanking...
Go to full version
Powered by SMFPacks Advanced Attachments Uploader Mod