[SOLVED] Keysight DSO-X 3024T - Possible NAND corruption

[AltF4Swe]

Hi!

I've got a Keysight DSO-X 3024T which shows all symptoms of the NAND corruption problem.

The scope hangs with just the "Ref" light on, with the following u-boot segment:

U-Boot 2010.03 (Oct 18 2011 - 14:28:06)Agilent P500

CPU:   SPEAr600
DRAM:  128 MiB
Flash: 512 KiB
NAND:  fsmc-ecc1 256 MiB
In:    serial
Out:   serial
Err:   serial
SerNum:serial number not programmed
Chip:  BD Board Rev: 4
Net:   smsc
Press space to stop autoboot:  0
## Booting kernel from Legacy Image at f8050000 ...
   Image Name:   PBOOT
   Created:      2011-08-12  17:16:04 UTC
   Image Type:   ARM Linux Kernel Image (gzip compressed)
   Data Size:    37297 Bytes = 36.4 KiB
   Load Address: 00000000
   Entry Point:  00000000
   Uncompressing Kernel Image ... OK

Starting kernel ...


Debug serial initialized ........OK

Microsoft Windows CE Bootloader Common Library Version 1.4 Built Aug 12 2011 11:03:19
Microsoft Windows CE 6.0 Ethernet Bootloader for the Agilent P500 board
Adaptation performed by Agilent Technologies (c) 2008

image2 value is out of range 0 so it will be ignored.
  It must be a hexadecimal integer between 0xd00000000 and 0xd7ffffff or between 0x800000000 and 0x87ffffff.

System ready!
Preparing for download...
 Loading image 1 from memory at 0xD0400000
O
BL_IMAGE_TYPE_BIN

X
XXXXXOOOOXXOOOOOOOOXOXOXOOOOOOOXOOXOOXOOOXXOOOOOOOOOOXOOOXOXOOXXXOOOXOXXXXOOXOXXOOOOOXOOXXXXOXXOOOXOOXXOXXOXOOOXOOXOOXXOOOXOOOOXOXOOOOOXOOOXOOXOXXXXXOXOXOXOXXXXXXOXXXXXOOOXOOOXOOXOOOOXOOOOXXOXOOOOOOOXOOOX
OXOOOOOXXOOOOOXOOXOOXOXOOOOOOOOOXOOOOERROR: Checksum failure (expected=0x169CABC  computed=0x169CCBE)
****** Checksum failure on record 89, ABORT!!! ******

Completed file(s):
-------------------------------------------------------------------------------

• : Address=0x80361000  Length=0x4DD1128  Name="" Target=RAM

 Loading image 1 failed, trying next one
 All images failed

Press r to reset

I've tried the "titiris" fix (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg2136181/#msg2136181) and everything works fine until it's time for the "go" command at the end. It hangs at the "BALDWIN_DDI identification step. Here's the log:

U-Boot 2010.03 (Oct 18 2011 - 14:28:06)Agilent P500

CPU:   SPEAr600
DRAM:  128 MiB
Flash: 512 KiB
NAND:  fsmc-ecc1 256 MiB
In:    serial
Out:   serial
Err:   serial
SerNum:serial number not programmed
Chip:  BD Board Rev: 4
Net:   smsc
Press space to stop autoboot:  0  0
p500>                   
p500> loady 0x0361000 115200
## Ready for binary (ymodem) download to 0x00361000 at 115200 bps...
CCxyzModem - CRC mode, 1(SOH)/19482(STX)/0(CAN) packets, 5 retries
## Total Size      = 0x013064d4 = 19948756 Bytes
p500> go 0x00362000
## Starting application at 0x00362000 ...
Windows CE Kernel for ARM (Thumb Enabled) Built on Jan 24 2013 at 14:52:37
Setting up for a Cold Reboot
Done Setting up for a Cold Reboot
Windows CE Firmware Init
BSP 1.0.0 for the SPEARHEAD600AB board (built Jun 18 2013)
Adaptation performed by ADENEO (c) 2005
+OALIntrInit
-OALIntrInit(rc = 1)
Initialize driver globals Zeros area...
pDrvGlobalArea 0xa0060000  size 0x800 (0xa0060800 -0xa0060000)
Initialize driver globals Zeros area...done
 OALKitlStart
Firmware Init Done.
OALIoctlHalEnterI2cCriticalSection init i2c cs
ERROR: C:\WINCE600\PLATFORM\COMMON\SRC\SOC\STM\SPEARHEAD600\DRIVERS\GPIO\.\sh600_gpio_hw.cpp line 170: GPB driver, RegQueryDword('ISTPriority') failed, status:2
ERROR: C:\WINCE600\PLATFORM\COMMON\SRC\SOC\STM\SPEARHEAD600\DRIVERS\GPIO\.\sh600_gpio_hw.cpp line 170: GPB driver, RegQueryDword('ISTPriority') failed, status:2
++SER_Init: context Drivers\Active\14
SER_Init, dwIndex:2
SER2 got sysintr:0x00000017
SER2 Serial Port, new baud rate:0x1c200  (UARTCLK:48000000 IBRD:0x1a FBRD:0x2)
OHCI\system.c, GCFG_USBH1_SW_RST
OHCI\system.c, GCFG_USBH2_SW_RST
-EDeviceLoadEeprom 00:30:D3:21:54:3C
Phy found addr 31 (ticks=3072)
WaitForLink Start (ticks=3073)
No Link (ticks=4076)
<--EDeviceInitialize

GMAC DMA status register = 0x0
BALDWIN_DDI: cBaldwinHwIf::Init: Initializing...
ERROR: C:\WINCE600\OsDesigns\P500\baldwin_ddi\.\baldwinHwIf.cpp line 380: BALDWIN_DDI: cBaldwinHwIf::Init: Unknown board config
Exception 'Data Abort' (4): Thread-Id=03e90006(pth=83219ab0), Proc-Id=00400002(pprc=81678308) 'NK.EXE', VM-active=01e40002(pprc=87fcbeac) 'udevice.exe'
PC=c08fbbe4(baldwin_ddi.dll+0x0000bbe4) RA=00100000(+0x00100000) SP=d126f2c8, BVA=00100000

What do you think, can it be fixed or should I throw my scope in a nearby lake? 

Best regards / AltF4Swe

[HighVoltage]

Contact Keysight first.
If you are lucky, they will take care of the scope, as they have done many times in the past, even if the warranty has expired.

[TheSteve]

Yes, that is typical nand corruption(quite rare on the T models).

I don't believe you will be able to use any of the files in the link you provided as you have a T model and those files are for the 2000/3000A series.

[Pinkus]

Contact Keysight first.
If you are lucky, they will take care of the scope, as they have done many times in the past, even if the warranty has expired.

I second this. Keysight installed a new motherboard with a new calibration in my DSOX4024a, no questions asked. But better mention that you expect, that the service note still applies for a free repair due to NAND issues.

[Bud]

image2 value is out of range 0 so it will be ignored.
  It must be a hexadecimal integer between 0xd00000000 and 0xd7ffffff or between 0x800000000 and 0x87ffffff.

You 3000T afficionados please tell the guy the proper address for image2 so he could try loading it.

[AltF4Swe]

Yes, that is typical nand corruption(quite rare on the T models).

I don't believe you will be able to use any of the files in the link you provided as you have a T model and those files are for the 2000/3000A series.

Ok! I might have missed that the v2.35 .cab didn’t include the T-models. Maybe that’s the cause for the ”Unknown board config” error message during startup after Ymodem-transfer. So, it might work if I find a firmware for the DSOX T-model? Guess it will have to be an old one, to be able to boot from USB. Question is, where can I find a backdated firmware?

[Bud]

Completed file(s):
-------------------------------------------------------------------------------
: Address=0x80361000  Length=0x4DD1128  Name="" Target=RAM

You know the length of the nk image, this gives you a clue what firmware version to look for. You then can write it to NAND, no need to worry about USB.

Can you stop autoboot and type printenv from p500 prompt to view the environment variables. Also type help to see which commands are available.

[AltF4Swe]

Success! The DSO-X 3024T is now unbricked!

Thank you for getting me on the right track. The thing I missed was that the v2.35 firmware in the "titiris method" didn't include the T-series.

I managed to find an old firmware (04.08) for the T-series and did the following (a few changes to the titiris method).

1. Extracted the recover.nk.bin.com from the .ksx (renamed it to .cab first)
2. Ran the UnKsx.exe tool to decrypt the recover.nk.bin.comp (Thank you user: abyrvalg)
3. Extracted nk.bin from the decrypted recover.nk.bin.comp with bincompress
4. Got the length of nk.bin with viewvbin.exe
5. Converted nk.bin to nk.nb0 with cvrtbin.exe
6. Connected to the scope via 3.3V Serial
7. Stopped the boot sequence
8. Entered the "loady 0x0361000 115200" command at p500> prompt
9. Transferred the nk.nb0 via YMODEM
10. Entered "go 0x00362000" command

And, boom!

The u-boot sequence finally looked much better and the scope started! Once started it complained that the FW was corrupt, but I just took the corresponding .ksx firmware I used earlier, put in on a USB and ran the prompted FW-upgrade. After upgrade the scope started and worked 100%. After this I grabbed the latest firmware (7.60 from 2023) and made yet another firmware upgrade.

Greetings from a happy user