[SOLVED] Keysight DSO-X 3024T - Possible NAND corruption

[AltF4Swe]

Hi!

I've got a Keysight DSO-X 3024T which shows all symptoms of the NAND corruption problem.

The scope hangs with just the "Ref" light on, with the following u-boot segment:

U-Boot 2010.03 (Oct 18 2011 - 14:28:06)Agilent P500

CPU:   SPEAr600
DRAM:  128 MiB
Flash: 512 KiB
NAND:  fsmc-ecc1 256 MiB
In:    serial
Out:   serial
Err:   serial
SerNum:serial number not programmed
Chip:  BD Board Rev: 4
Net:   smsc
Press space to stop autoboot:  0
## Booting kernel from Legacy Image at f8050000 ...
   Image Name:   PBOOT
   Created:      2011-08-12  17:16:04 UTC
   Image Type:   ARM Linux Kernel Image (gzip compressed)
   Data Size:    37297 Bytes = 36.4 KiB
   Load Address: 00000000
   Entry Point:  00000000
   Uncompressing Kernel Image ... OK

Starting kernel ...


Debug serial initialized ........OK

Microsoft Windows CE Bootloader Common Library Version 1.4 Built Aug 12 2011 11:03:19
Microsoft Windows CE 6.0 Ethernet Bootloader for the Agilent P500 board
Adaptation performed by Agilent Technologies (c) 2008

image2 value is out of range 0 so it will be ignored.
  It must be a hexadecimal integer between 0xd00000000 and 0xd7ffffff or between 0x800000000 and 0x87ffffff.

System ready!
Preparing for download...
 Loading image 1 from memory at 0xD0400000
O
BL_IMAGE_TYPE_BIN

X
XXXXXOOOOXXOOOOOOOOXOXOXOOOOOOOXOOXOOXOOOXXOOOOOOOOOOXOOOXOXOOXXXOOOXOXXXXOOXOXXOOOOOXOOXXXXOXXOOOXOOXXOXXOXOOOXOOXOOXXOOOXOOOOXOXOOOOOXOOOXOOXOXXXXXOXOXOXOXXXXXXOXXXXXOOOXOOOXOOXOOOOXOOOOXXOXOOOOOOOXOOOX
OXOOOOOXXOOOOOXOOXOOXOXOOOOOOOOOXOOOOERROR: Checksum failure (expected=0x169CABC  computed=0x169CCBE)
****** Checksum failure on record 89, ABORT!!! ******

Completed file(s):
-------------------------------------------------------------------------------

• : Address=0x80361000  Length=0x4DD1128  Name="" Target=RAM

 Loading image 1 failed, trying next one
 All images failed

Press r to reset

I've tried the "titiris" fix (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg2136181/#msg2136181) and everything works fine until it's time for the "go" command at the end. It hangs at the "BALDWIN_DDI identification step. Here's the log:

U-Boot 2010.03 (Oct 18 2011 - 14:28:06)Agilent P500

CPU:   SPEAr600
DRAM:  128 MiB
Flash: 512 KiB
NAND:  fsmc-ecc1 256 MiB
In:    serial
Out:   serial
Err:   serial
SerNum:serial number not programmed
Chip:  BD Board Rev: 4
Net:   smsc
Press space to stop autoboot:  0  0
p500>                   
p500> loady 0x0361000 115200
## Ready for binary (ymodem) download to 0x00361000 at 115200 bps...
CCxyzModem - CRC mode, 1(SOH)/19482(STX)/0(CAN) packets, 5 retries
## Total Size      = 0x013064d4 = 19948756 Bytes
p500> go 0x00362000
## Starting application at 0x00362000 ...
Windows CE Kernel for ARM (Thumb Enabled) Built on Jan 24 2013 at 14:52:37
Setting up for a Cold Reboot
Done Setting up for a Cold Reboot
Windows CE Firmware Init
BSP 1.0.0 for the SPEARHEAD600AB board (built Jun 18 2013)
Adaptation performed by ADENEO (c) 2005
+OALIntrInit
-OALIntrInit(rc = 1)
Initialize driver globals Zeros area...
pDrvGlobalArea 0xa0060000  size 0x800 (0xa0060800 -0xa0060000)
Initialize driver globals Zeros area...done
 OALKitlStart
Firmware Init Done.
OALIoctlHalEnterI2cCriticalSection init i2c cs
ERROR: C:\WINCE600\PLATFORM\COMMON\SRC\SOC\STM\SPEARHEAD600\DRIVERS\GPIO\.\sh600_gpio_hw.cpp line 170: GPB driver, RegQueryDword('ISTPriority') failed, status:2
ERROR: C:\WINCE600\PLATFORM\COMMON\SRC\SOC\STM\SPEARHEAD600\DRIVERS\GPIO\.\sh600_gpio_hw.cpp line 170: GPB driver, RegQueryDword('ISTPriority') failed, status:2
++SER_Init: context Drivers\Active\14
SER_Init, dwIndex:2
SER2 got sysintr:0x00000017
SER2 Serial Port, new baud rate:0x1c200  (UARTCLK:48000000 IBRD:0x1a FBRD:0x2)
OHCI\system.c, GCFG_USBH1_SW_RST
OHCI\system.c, GCFG_USBH2_SW_RST
-EDeviceLoadEeprom 00:30:D3:21:54:3C
Phy found addr 31 (ticks=3072)
WaitForLink Start (ticks=3073)
No Link (ticks=4076)
<--EDeviceInitialize

GMAC DMA status register = 0x0
BALDWIN_DDI: cBaldwinHwIf::Init: Initializing...
ERROR: C:\WINCE600\OsDesigns\P500\baldwin_ddi\.\baldwinHwIf.cpp line 380: BALDWIN_DDI: cBaldwinHwIf::Init: Unknown board config
Exception 'Data Abort' (4): Thread-Id=03e90006(pth=83219ab0), Proc-Id=00400002(pprc=81678308) 'NK.EXE', VM-active=01e40002(pprc=87fcbeac) 'udevice.exe'
PC=c08fbbe4(baldwin_ddi.dll+0x0000bbe4) RA=00100000(+0x00100000) SP=d126f2c8, BVA=00100000

What do you think, can it be fixed or should I throw my scope in a nearby lake? 

Best regards / AltF4Swe

[HighVoltage]

Contact Keysight first.
If you are lucky, they will take care of the scope, as they have done many times in the past, even if the warranty has expired.

[TheSteve]

Yes, that is typical nand corruption(quite rare on the T models).

I don't believe you will be able to use any of the files in the link you provided as you have a T model and those files are for the 2000/3000A series.

[Pinkus]

Contact Keysight first.
If you are lucky, they will take care of the scope, as they have done many times in the past, even if the warranty has expired.

I second this. Keysight installed a new motherboard with a new calibration in my DSOX4024a, no questions asked. But better mention that you expect, that the service note still applies for a free repair due to NAND issues.

[Bud]

image2 value is out of range 0 so it will be ignored.
  It must be a hexadecimal integer between 0xd00000000 and 0xd7ffffff or between 0x800000000 and 0x87ffffff.

You 3000T afficionados please tell the guy the proper address for image2 so he could try loading it.

[AltF4Swe]

Yes, that is typical nand corruption(quite rare on the T models).

I don't believe you will be able to use any of the files in the link you provided as you have a T model and those files are for the 2000/3000A series.

Ok! I might have missed that the v2.35 .cab didn’t include the T-models. Maybe that’s the cause for the ”Unknown board config” error message during startup after Ymodem-transfer. So, it might work if I find a firmware for the DSOX T-model? Guess it will have to be an old one, to be able to boot from USB. Question is, where can I find a backdated firmware?

[Bud]

Completed file(s):
-------------------------------------------------------------------------------
: Address=0x80361000  Length=0x4DD1128  Name="" Target=RAM

You know the length of the nk image, this gives you a clue what firmware version to look for. You then can write it to NAND, no need to worry about USB.

Can you stop autoboot and type printenv from p500 prompt to view the environment variables. Also type help to see which commands are available.

[AltF4Swe]

Success! The DSO-X 3024T is now unbricked!

Thank you for getting me on the right track. The thing I missed was that the v2.35 firmware in the "titiris method" didn't include the T-series.

I managed to find an old firmware (04.08) for the T-series and did the following (a few changes to the titiris method).

1. Extracted the recover.nk.bin.com from the .ksx (renamed it to .cab first)
2. Ran the UnKsx.exe tool to decrypt the recover.nk.bin.comp (Thank you user: abyrvalg)
3. Extracted nk.bin from the decrypted recover.nk.bin.comp with bincompress
4. Got the length of nk.bin with viewvbin.exe
5. Converted nk.bin to nk.nb0 with cvrtbin.exe
6. Connected to the scope via 3.3V Serial
7. Stopped the boot sequence
8. Entered the "loady 0x0361000 115200" command at p500> prompt
9. Transferred the nk.nb0 via YMODEM
10. Entered "go 0x00362000" command

And, boom!

The u-boot sequence finally looked much better and the scope started! Once started it complained that the FW was corrupt, but I just took the corresponding .ksx firmware I used earlier, put in on a USB and ran the prompted FW-upgrade. After upgrade the scope started and worked 100%. After this I grabbed the latest firmware (7.60 from 2023) and made yet another firmware upgrade.

Greetings from a happy user 

[xyqahzw]

Success! The DSO-X 3024T is now unbricked!

Thank you for getting me on the right track. The thing I missed was that the v2.35 firmware in the "titiris method" didn't include the T-series.

I managed to find an old firmware (04.08) for the T-series and did the following (a few changes to the titiris method).

1. Extracted the recover.nk.bin.com from the .ksx (renamed it to .cab first)
2. Ran the UnKsx.exe tool to decrypt the recover.nk.bin.comp (Thank you user: abyrvalg)
3. Extracted nk.bin from the decrypted recover.nk.bin.comp with bincompress
4. Got the length of nk.bin with viewvbin.exe
5. Converted nk.bin to nk.nb0 with cvrtbin.exe
6. Connected to the scope via 3.3V Serial
7. Stopped the boot sequence
8. Entered the "loady 0x0361000 115200" command at p500> prompt
9. Transferred the nk.nb0 via YMODEM
10. Entered "go 0x00362000" command

And, boom!

The u-boot sequence finally looked much better and the scope started! Once started it complained that the FW was corrupt, but I just took the corresponding .ksx firmware I used earlier, put in on a USB and ran the prompted FW-upgrade. After upgrade the scope started and worked 100%. After this I grabbed the latest firmware (7.60 from 2023) and made yet another firmware upgrade.

Greetings from a happy user 

I tried to use the UnKsx.exe tool to decrypt the recover.nk.bin.comp, and it prompted that it is not a ksx file. Could you send me a copy of the recover.nk.bin.comp file? The error on my device is exactly the same as yours.

[gbalangero]

Hi Everyone! 
I have a Keysight MSOX-3024T oscilloscope, which is affected by NAND corruption...
Symptom: When powered on, all the LEDs flash twice briefly, but nothing happens.
The fan runs normally.
I checked all the voltages on the board following the instructions in the 3000T series service manual, and they are within normal range.
The power supply is fine, and there are no damaged or burned components on the main board.
Reading many posts here on the forum, I've seen and tried various recovery solutions.
But in my case, I can't perform the recovery procedure.
Attached are the boot logs viewed via serial with teraterm.
Power-on log:

U-Boot 2010.03 (Oct 18 2011 - 14:28:06)Agilent P500

CPU:   SPEAr600
DRAM:  128 MiB
Flash: 512 KiB
NAND:  internal ecc 256 MiB

Debug serial initialized ........OK
RTC: 2011-10-20   23:50:23.14 UTC

Microsoft Windows CE Bootloader Common Library Version 1.4 Built May  7 2015 01:38:03
Microsoft Windows CE 6.0 Ethernet Bootloader for the Agilent P500 board
Adaptation performed by Agilent Technologies (c) 2008


System ready!
Preparing for download...
RTC: 2011-10-20   23:50:23.18 UTC
 Loading image 1 from memory at 0xD0400000
FMD_DirectRead : Offset must be sector aligned !!
 IsCompressed: ReadFlash failed
FMD_DirectRead : Offset must be sector aligned !!
 EBOOT_ReadFlash failed

ERROR: Unable to read image signature.

BL_IMAGE_TYPE_UNKNOWN

 Loading image 1 failed, trying next one
 Loading image 2 from memory at 0xD4400000
FMD_DirectRead : Offset must be sector aligned !!
 IsCompressed: ReadFlash failed
FMD_DirectRead : Offset must be sector aligned !!
 EBOOT_ReadFlash failed

ERROR: Unable to read image signature.

BL_IMAGE_TYPE_UNKNOWN

 Loading image 2 failed, trying next one
 All images failed

Press r to reset

Power-on log, interrupting the loop with the spacebar:

U-Boot 2010.03 (Oct 18 2011 - 14:28:06)Agilent P500

CPU:   SPEAr600
DRAM:  128 MiB
Flash: 512 KiB
NAND:  internal ecc 256 MiB

Debug serial initialized ........OK
RTC: 2011-10-20   23:49:18.52 UTC

Microsoft Windows CE Bootloader Common Library Version 1.4 Built May  7 2015 01:38:03
Microsoft Windows CE 6.0 Ethernet Bootloader for the Agilent P500 board
Adaptation performed by Agilent Technologies (c) 2008



P500 Boot Loader Configuration :

Mac address .......... (00:30:D3:29:33:4A)
Ip address ........... (192.168.1.174)
Subnet Mask address .. (255.255.255.0)
DHCP ................. (Enabled)
Boot delay (seconds).. (0)
Load image 1 at startup

Image addresses. (0xdxxxxxxx for NAND, 0x8xxxxxxx for RAM)
        1 (0xd0400000)
        2 (0xd4400000)

l) Load memory resident image Load image 1 now
1) Load memory resident image 1 now
2) Load memory resident image 2 now
3) Load memory resident image 3 now
d) Download from platform builder now
u) Start u-boot by resetting
v) Verify Images
>

It seems the only way to reload the firmware is to use the Ethernet interface, which I don't currently have but want to purchase...
If anyone kind and willing has any suggestions or can point me to other solutions for repairing the oscilloscope, I'd be very grateful.
Apologies for my poor English!

[msuthar]

Hi,

It happned to me many times like scope after booting went  black screen and ref light lit and bricked .

just open it up , connect to serial pins on PCB.

Use this terminal program as it shows errors etc in colour.
https://mobaxterm.mobatek.net/
COM xx ,115200,8,1,None,None...

Power on the scope and within 1 second press Space bar on key board .

the terminal will show following:

        2 (0xd4400000)

l) Load memory resident image Load image 1 now
1) Load memory resident image 1 now
2) Load memory resident image 2 now
3) Load memory resident image 3 now
d) Download from platform builder now
u) Start u-boot by resetting
v) Verify Images
>

Now option
2) Load memory resident image 2 now
is of our interest.
It will load 2nd recovery image and boot the scope in recovery mode.
Connect a mouse on back USB connector on scope and USB stick with new firmware file like 3000G.7.66.2025...ksx on it.
navigate to this file by mouse and doble click. this will load new firmware with all new NavRam flushing which went garbage...

Best Regards.
73


for 3000G the pin configuration is shown on image. (For 2000 the pin config is different)