Author Topic: The fort is falling. Liberating Keysight DSOX 1200 (Linux, black) series scopes.  (Read 2368 times)

0 Members and 1 Guest are viewing this topic.

Offline BudTopic starter

  • Super Contributor
  • ***
  • Posts: 6912
  • Country: ca
A major breakthrough in liberation of the black Linux-based EDUX 1052a scope. The wall has been breached, I am in and exploring the filesystem.



The intent is to not do anything before understanding the filesystem, taking a full backup and have a restore plan.

This should also apply to the 2- and 4-channel DSOX 1200 series Linux-based scopes, since they they all have same firmware. The Subject of this topic was selected to reflect that.
« Last Edit: February 11, 2024, 08:30:50 pm by Bud »
Facebook-free life and Rigol-free shack.
 
The following users thanked this post: rsjsouza, kilobyte, voltsandjolts, HighVoltage, NF6X, TheSteve, ArdWar, eplpwr, WillTurner

Offline BudTopic starter

  • Super Contributor
  • ***
  • Posts: 6912
  • Country: ca
Full boot log:

Code: [Select]
U-Boot SPL 2019.01+tlo+b14f82da857 (Jul 16 2021 - 22:16:28 +0000)
Configure DDR
Trying to boot from NOR


U-Boot 2019.01+tlo+b14f82da857 (Jul 16 2021 - 22:16:28 +0000)-SPEAr

CPU:   SPEAr600
DRAM:  128 MiB
Flash: 512 KiB
NAND:  (ECC 4-bits BCH) 256 MiB
Loading Environment from Flash... OK
Power-on reset
Hit SPACE in 5 seconds to stop autoboot.
ubi0: attaching mtd2
ubi0: scanning is finished
ubi0: attached mtd2 (name "rootfs", size 144 MiB)
ubi0: PEB size: 131072 bytes (128 KiB), LEB size: 129024 bytes
ubi0: min./max. I/O unit sizes: 2048/2048, sub-page size 512
ubi0: VID header offset: 512 (aligned 512), data offset: 2048
ubi0: good PEBs: 1152, bad PEBs: 0, corrupted PEBs: 0
ubi0: user volume: 4, internal volumes: 1, max. volumes count: 128
ubi0: max/mean erase counter: 2/0, WL threshold: 4096, image sequence number: 1033334404
ubi0: available PEBs: 0, total reserved PEBs: 1152, PEBs reserved for bad PEB handling: 40
Loading file 'fpga1.binx' to addr 0x04000000...
Done

## Checking Image at 04000000 ...
   Legacy image found
   Image Name:   
   Image Type:   ARM Linux Firmware (gzip compressed)
   Data Size:    283776 Bytes = 277.1 KiB
   Load Address: 00000000
   Entry Point:  00000000
   Verifying Checksum ... OK
Loading FPGA Device 0...
........................................

Done.
Loading file '1000X.dtb' to addr 0x01800000...
Done
Loading file 'uImage' to addr 0x02000000...
Done

## Checking Image at 02000000 ...
   Legacy image found
   Image Name:   Linux-4.14.102-keysight-producti
   Image Type:   ARM Linux Kernel Image (uncompressed)
   Data Size:    3611384 Bytes = 3.4 MiB
   Load Address: 02000000
   Entry Point:  02000000
   Verifying Checksum ... OK
## Booting kernel from Legacy Image at 02000000 ...
   Image Name:   Linux-4.14.102-keysight-producti
   Image Type:   ARM Linux Kernel Image (uncompressed)
   Data Size:    3611384 Bytes = 3.4 MiB
   Load Address: 02000000
   Entry Point:  02000000
## Flattened Device Tree blob at 01800000
   Booting using the fdt blob at 0x1800000
   Loading Kernel Image ... OK
   Loading Device Tree to 07788000, end 0778d4f4 ... OK

Starting kernel ...

Uncompressing Linux... done, booting the kernel.
Booting Linux on physical CPU 0x0
Linux version 4.14.102-keysight-production (oe-user@oe-host) (gcc version 8.2.0 (GCC)) #1 PREEMPT Fri Jul 16 21:32:14 UTC 2021
CPU: ARM926EJ-S [41069265] revision 5 (ARMv5TEJ), cr=0005317f
CPU: VIVT data cache, VIVT instruction cache
OF: fdt: Machine model: Keysight,DSO-X1102A
Memory policy: Data cache writeback
Built 1 zonelists, mobility grouping on.  Total pages: 32512
Kernel command line: console=ttyAMA0,115200 instrumentguid=236ADCE1-3D7C-6820-BD59-A638093DC90E mtdparts=nand:16m(system-storage),144m(rootfs),-(user-storage) ubi.mtd=user-storage,0,0,2 ubi.mtd=system-storage,0,0,1 ubi.mtd=rootfs,0,0,0 ecc_mode=1 ubi.block=0,rootfs root=/dev/ubiblock0_0 rootfstype=squashfs init=/sbin/preinit
PID hash table entries: 512 (order: -1, 2048 bytes)
Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)
Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)
Memory: 122668K/131072K available (5126K kernel code, 211K rwdata, 1256K rodata, 180K init, 219K bss, 8404K reserved, 0K cma-reserved)
Virtual kernel memory layout:
    vector  : 0xffff0000 - 0xffff1000   (   4 kB)
    fixmap  : 0xffc00000 - 0xfff00000   (3072 kB)
    vmalloc : 0xc8800000 - 0xff800000   ( 880 MB)
    lowmem  : 0xc0000000 - 0xc8000000   ( 128 MB)
    modules : 0xbf000000 - 0xc0000000   (  16 MB)
      .text : 0xc0008000 - 0xc0509c58   (5128 kB)
      .init : 0xc0669000 - 0xc0696000   ( 180 kB)
      .data : 0xc0696000 - 0xc06cad40   ( 212 kB)
       .bss : 0xc06d00a4 - 0xc0706d04   ( 220 kB)
SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
Preemptible hierarchical RCU implementation.
Tasks RCU enabled.
NR_IRQS: 16, nr_irqs: 16, preallocated irqs: 16
VIC @f1100000: id 0x00041190, vendor 0x41
VIC @f1000000: id 0x00041190, vendor 0x41
clocksource: tmr1: mask: 0xffff max_cycles: 0xffff, max_idle_ns: 155536400 ns
sched_clock: 32 bits at 100 Hz, resolution 10000000ns, wraps every 21474836475000000ns
Console: colour dummy device 80x30
Calibrating delay loop... 165.27 BogoMIPS (lpj=826368)
pid_max: default: 32768 minimum: 301
Mount-cache hash table entries: 1024 (order: 0, 4096 bytes)
Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes)
CPU: Testing write buffer coherency: ok
Setting up static identity map for 0x8400 - 0x8458
Hierarchical SRCU implementation.
devtmpfs: initialized
random: get_random_u32 called from bucket_table_alloc+0xe0/0x274 with crng_init=0
clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
futex hash table entries: 256 (order: 0, 7168 bytes)
NET: Registered protocol family 16
DMA: preallocated 256 KiB pool for atomic coherent allocations
Serial: AMBA PL011 UART driver
d0000000.serial: ttyAMA0 at MMIO 0xd0000000 (irq = 40, base_baud = 0) is a PL011 rev2
console [ttyAMA0] enabled
d0080000.serial: ttyAMA1 at MMIO 0xd0080000 (irq = 41, base_baud = 0) is a PL011 rev2
SCSI subsystem initialized
usbcore: registered new interface driver usbfs
usbcore: registered new interface driver hub
usbcore: registered new device driver usb
pps_core: LinuxPPS API ver. 1 registered
pps_core: Software ver. 5.3.6 - Copyright 2005-2007 Rodolfo Giometti <giometti@linux.it>
PTP clock support registered
clocksource: Switched to clocksource tmr1
NET: Registered protocol family 2
TCP established hash table entries: 1024 (order: 0, 4096 bytes)
TCP bind hash table entries: 1024 (order: 2, 20480 bytes)
TCP: Hash tables configured (established 1024 bind 1024)
UDP hash table entries: 256 (order: 1, 12288 bytes)
UDP-Lite hash table entries: 256 (order: 1, 12288 bytes)
NET: Registered protocol family 1
RPC: Registered named UNIX socket transport module.
RPC: Registered udp transport module.
RPC: Registered tcp transport module.
RPC: Registered tcp NFSv4.1 backchannel transport module.
workingset: timestamp_bits=30 max_order=15 bucket_order=0
squashfs: version 4.0 (2009/01/31) Phillip Lougher
NFS: Registering the id_resolver key type
Key type id_resolver registered
Key type id_legacy registered
NET: Registered protocol family 38
Block layer SCSI generic (bsg) driver version 0.4 loaded (major 247)
io scheduler noop registered
io scheduler deadline registered
io scheduler cfq registered (default)
io scheduler mq-deadline registered
io scheduler kyber registered
pl061_gpio f0100000.gpio: PL061 GPIO chip @0xf0100000 registered
pl061_gpio fc980000.gpio: PL061 GPIO chip @0xfc980000 registered
pl061_gpio d8100000.gpio: PL061 GPIO chip @0xd8100000 registered
brd: module loaded
flash_id 3459839 0x34CAFF
smi fc000000.flash: mtd .name=nor-flash .size=800000(8M)
smi fc000000.flash: .erasesize = 0x10000(64K)
3 ofpart partitions found on MTD device nor-flash
Creating 3 MTD partitions on "nor-flash":
0x000000000000-0x000000060000 : "uboot"
0x000000060000-0x000000070000 : "env0"
0x000000070000-0x000000080000 : "mfgdata"
fsmc-nand d1800000.flash: FSMC device partno 090, manufacturer 80, revision 00, config 00
nand: device found, Manufacturer ID: 0x2c, Chip ID: 0xda
nand: Micron MT29F2G08ABAEAH4
nand: 256 MiB, SLC, erase size: 128 KiB, page size: 2048, OOB size: 64
fsmc-nand d1800000.flash: Using 4-bit SW BCH ECC scheme
nand: chip has unique ID: 6f-f5290fa39045d345ad45ae12cc12fd61
Scanning device for bad blocks
3 cmdlinepart partitions found on MTD device nand
Creating 3 MTD partitions on "nand":
0x000000000000-0x000001000000 : "system-storage"
0x000001000000-0x00000a000000 : "rootfs"
0x00000a000000-0x000010000000 : "user-storage"
fsmc-nand d1800000.flash: FSMC NAND driver registration successful
libphy: Fixed MDIO Bus: probed
stmmaceth e0800000.ethernet: no reset control found
stmmac - user ID: 0x10, Synopsys ID: 0x32
stmmaceth e0800000.ethernet: Ring mode enabled
stmmaceth e0800000.ethernet: DMA HW capability register supported
stmmaceth e0800000.ethernet: Normal descriptors
libphy: stmmac: probed
SMSC LAN8710/LAN8720 stmmac-0:07: attached PHY driver [SMSC LAN8710/LAN8720] (mii_bus:phy_addr=stmmac-0:07, irq=POLL)
usbcore: registered new interface driver rtl8150
usbcore: registered new interface driver r8152
usbcore: registered new interface driver asix
usbcore: registered new interface driver ax88179_178a
usbcore: registered new interface driver cdc_ether
usbcore: registered new interface driver net1080
usbcore: registered new interface driver cdc_subset
usbcore: registered new interface driver zaurus
usbcore: registered new interface driver cdc_ncm
ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
SPEAr-ehci: EHCI SPEAr driver
spear-ehci e1800000.ehci: EHCI Host Controller
spear-ehci e1800000.ehci: new USB bus registered, assigned bus number 1
spear-ehci e1800000.ehci: irq 75, io mem 0xe1800000
spear-ehci e1800000.ehci: USB 2.0 started, EHCI 1.00
hub 1-0:1.0: USB hub found
hub 1-0:1.0: 1 port detected
spear-ehci e2000000.ehci: EHCI Host Controller
spear-ehci e2000000.ehci: new USB bus registered, assigned bus number 2
spear-ehci e2000000.ehci: irq 77, io mem 0xe2000000
spear-ehci e2000000.ehci: USB 2.0 started, EHCI 1.00
hub 2-0:1.0: USB hub found
hub 2-0:1.0: 1 port detected
ohci_hcd: USB 1.1 'Open' Host Controller (OHCI) Driver
SPEAr-ohci: OHCI SPEAr driver
spear-ohci e1900000.ohci: USB Host Controller
spear-ohci e1900000.ohci: new USB bus registered, assigned bus number 3
spear-ohci e1900000.ohci: irq 74, io mem 0xe1900000
hub 3-0:1.0: USB hub found
hub 3-0:1.0: 1 port detected
spear-ohci e2100000.ohci: USB Host Controller
spear-ohci e2100000.ohci: new USB bus registered, assigned bus number 4
spear-ohci e2100000.ohci: irq 76, io mem 0xe2100000
hub 4-0:1.0: USB hub found
hub 4-0:1.0: 1 port detected
usbcore: registered new interface driver usb-storage
random: fast init done
bq32k 0-0068: rtc core: registered bq32k as rtc0
i2c /dev entries driver
sp805-wdt fc880000.wdt: registration successful
device-mapper: ioctl: 4.37.0-ioctl (2017-09-20) initialised: dm-devel@redhat.com
usbcore: registered new interface driver usbhid
usbhid: USB HID core driver
spear-adc f465c354.adc: SPEAR ADC driver loaded, IRQ 54
NET: Registered protocol family 10
Segment Routing with IPv6
sit: IPv6, IPv4 and MPLS over IPv4 tunneling driver
NET: Registered protocol family 17
Key type dns_resolver registered
ubi2: attaching mtd7
ubi2: scanning is finished
ubi2: attached mtd7 (name "user-storage", size 96 MiB)
ubi2: PEB size: 131072 bytes (128 KiB), LEB size: 129024 bytes
ubi2: min./max. I/O unit sizes: 2048/2048, sub-page size 512
ubi2: VID header offset: 512 (aligned 512), data offset: 2048
ubi2: good PEBs: 768, bad PEBs: 0, corrupted PEBs: 0
ubi2: user volume: 1, internal volumes: 1, max. volumes count: 128
ubi2: max/mean erase counter: 1/0, WL threshold: 4096, image sequence number: 942022490
ubi2: available PEBs: 0, total reserved PEBs: 768, PEBs reserved for bad PEB handling: 40
ubi2: background thread "ubi_bgt2d" started, PID 629
ubi1: attaching mtd5
ubi1: scanning is finished
ubi1: attached mtd5 (name "system-storage", size 16 MiB)
ubi1: PEB size: 131072 bytes (128 KiB), LEB size: 129024 bytes
ubi1: min./max. I/O unit sizes: 2048/2048, sub-page size 512
ubi1: VID header offset: 512 (aligned 512), data offset: 2048
ubi1: good PEBs: 128, bad PEBs: 0, corrupted PEBs: 0
ubi1: user volume: 1, internal volumes: 1, max. volumes count: 128
ubi1: max/mean erase counter: 3/0, WL threshold: 4096, image sequence number: 1442190306
ubi1: available PEBs: 0, total reserved PEBs: 128, PEBs reserved for bad PEB handling: 40
ubi1: background thread "ubi_bgt1d" started, PID 634
ubi0: attaching mtd6
ubi0: scanning is finished
ubi0: attached mtd6 (name "rootfs", size 144 MiB)
ubi0: PEB size: 131072 bytes (128 KiB), LEB size: 129024 bytes
ubi0: min./max. I/O unit sizes: 2048/2048, sub-page size 512
ubi0: VID header offset: 512 (aligned 512), data offset: 2048
ubi0: good PEBs: 1152, bad PEBs: 0, corrupted PEBs: 0
ubi0: user volume: 4, internal volumes: 1, max. volumes count: 128
ubi0: max/mean erase counter: 2/0, WL threshold: 4096, image sequence number: 1033334404
ubi0: available PEBs: 0, total reserved PEBs: 1152, PEBs reserved for bad PEB handling: 40
ubi0: background thread "ubi_bgt0d" started, PID 642
block ubiblock0_0: created from ubi0:0(rootfs)
bq32k 0-0068: setting system clock to 2024-01-10 01:00:01 UTC (1704848401)
uart-pl011 d0000000.serial: no DMA platform data
VFS: Mounted root (squashfs filesystem) readonly on device 253:0.
devtmpfs: mounted
Freeing unused kernel memory: 180K
This architecture does not have kernel memory protection.
in /sbin/preinit
preinit - looking in /sbin/preinit.d
preinit - /sbin/preinit.d/90-overlay-etc
preinit - prepare and boot overlay /etc
UBIFS (ubi2:0): background thread "ubifs_bgt2_0" started, PID 650
UBIFS (ubi2:0): recovery needed
UBIFS (ubi2:0): recovery completed
UBIFS (ubi2:0): UBIFS: mounted UBI device 2, volume 0, name "user-storage"
UBIFS (ubi2:0): LEB size: 129024 bytes (126 KiB), min./max. I/O unit sizes: 2048 bytes/2048 bytes
UBIFS (ubi2:0): FS size: 91994112 bytes (87 MiB, 713 LEBs), journal size 4644864 bytes (4 MiB, 36 LEBs)
UBIFS (ubi2:0): reserved for root: 4345108 bytes (4243 KiB)
UBIFS (ubi2:0): media format: w5/r0 (latest is w5/r0), UUID D1C436AD7-DC43-2FAC-5FDE-8609529CEA34, small LPT model
[0]preinit - mount -t ubifs -o sync ubi2:user-storage /firmware/user
preinit - Success mounting overlay-etc for /etc on /firmware/user/etc-rw
preinit - /sbin/preinit.d/91-overlay-var-lib
preinit - prepare and boot overlay /var/lib
UBIFS (ubi1:0): background thread "ubifs_bgt1_0" started, PID 654
UBIFS (ubi1:0): recovery needed
UBIFS (ubi1:0): recovery completed
UBIFS (ubi1:0): UBIFS: mounted UBI device 1, volume 0, name "system-storage"
UBIFS (ubi1:0): LEB size: 129024 bytes (126 KiB), min./max. I/O unit sizes: 2048 bytes/2048 bytes
UBIFS (ubi1:0): FS size: 9547776 bytes (9 MiB, 74 LEBs), journal size 1032193 bytes (0 MiB, 6 LEBs)
UBIFS (ubi1:0): reserved for root: 450964 bytes (440 KiB)
UBIFS (ubi1:0): media format: w5/r0 (latest is w5/r0), UUID A56ADC46-9AD2-8734-09D3-D3DFD7D18420, small LPT model
[0]preinit - mount -t ubifs -o sync ubi1:system-storage /usr/local
preinit - Success mounting overlay-/var/lib for /var/lib on /usr/local/var/lib-rw
preinit - /sbin/preinit.d/98-check-mounts-panic
preinit - checks mounts and  panic if not all there
UBIFS (ubi0:1): background thread "ubifs_bgt0_1" started, PID 658
UBIFS (ubi0:1): recovery needed
UBIFS (ubi0:1): recovery completed
UBIFS (ubi0:1): UBIFS: mounted UBI device 0, volume 1, name "firmware-bin"
UBIFS (ubi0:1): LEB size: 129024 bytes (126 KiB), min./max. I/O unit sizes: 2048 bytes/2048 bytes
UBIFS (ubi0:1): FS size: 32385024 bytes (30 MiB, 251 LEBs), journal size 1677312 bytes (1 MiB, 13 LEBs)
UBIFS (ubi0:1): reserved for root: 1529624 bytes (1493 KiB)
UBIFS (ubi0:1): media format: w5/r0 (latest is w5/r0), UUID 36D39C56-0956-537A-9A80-384D350936528, small LPT model
[0]preinit - mount -t ubifs -o sync ubi0:firmware-bin /firmware/bin
UBIFS (ubi0:2): background thread "ubifs_bgt0_2" started, PID 661
UBIFS (ubi0:2): recovery needed
UBIFS (ubi0:2): recovery completed
UBIFS (ubi0:2): UBIFS: mounted UBI device 0, volume 2, name "firmware-data"
UBIFS (ubi0:2): LEB size: 129024 bytes (126 KiB), min./max. I/O unit sizes: 2048 bytes/2048 bytes
UBIFS (ubi0:2): FS size: 7225344 bytes (6 MiB, 56 LEBs), journal size 1032193 bytes (0 MiB, 6 LEBs)
UBIFS (ubi0:2): reserved for root: 341270 bytes (333 KiB)
UBIFS (ubi0:2): media format: w5/r0 (latest is w5/r0), UUID DFA5DE68-4A4D-29F3-67CA-5A6D7CA1FD09, small LPT model
[0]preinit - mount -t ubifs -o sync ubi0:firmware-data /firmware/data
systemd[1]: systemd 239 running in system mode. (+PAM -AUDIT -SELINUX -IMA -APPARMOR +SMACK +SYSVINIT +UTMP -LIBCRYPTSETUP -GCRYPT -GNUTLS +ACL -XZ -LZ4 -SECCOMP +BLKID -ELFUTILS +KMOD -IDN2 -IDN -PCRE2 default-hierarchy=hybrid)
systemd[1]: Detected architecture arm.

Welcome to The Keysight tlo 2.6-1.40.0!

systemd[1]: Set hostname to <k-ex1052a-31549>.
systemd[1]: File /lib/systemd/system/systemd-journald.service:36 configures an IP firewall (IPAddressDeny=any), but the local system does not support BPF/cgroup based firewalling.
systemd[1]: Proceeding WITHOUT firewalling in effect! (This warning is only shown for the first loaded unit using IP firewalling.)
random: systemd: uninitialized urandom read (16 bytes read)
systemd[1]: Listening on udev Kernel Socket.
[  OK  ] Listening on udev Kernel Socket.
random: systemd: uninitialized urandom read (16 bytes read)
systemd[1]: Listening on Journal Socket.
[  OK  ] Listening on Journal Socket.
random: systemd: uninitialized urandom read (16 bytes read)
systemd[1]: Mounting POSIX Message Queue File System...
         Mounting POSIX Message Queue File System...
systemd[1]: Listening on Network Service Netlink Socket.
[  OK  ] Listening on Network Service Netlink Socket.
systemd[1]: Starting Remount Root and Kernel File Systems...
         Starting Remount Root and Kernel File Systems...
         Starting Create list of required st…ce nodes for the current kernel...
[  OK  ] Created slice system-serial\x2dgetty.slice.
[  OK  ] Listening on Journal Socket (/dev/log).
[  OK  ] Reached target Swap.
[  OK  ] Created slice User and Session Slice.
[  OK  ] Reached target Slices.
[  OK  ] Listening on udev Control Socket.
         Mounting Kernel Debug File System...
[  OK  ] Listening on Syslog Socket.
[  OK  ] Started Dispatch Password Requests to Console Directory Watch.
[  OK  ] Started baldwin-splash startup service , start ASAP.
         Starting udev Coldplug all Devices...
         Starting Journal Service...
[  OK  ] Started Forward Password Requests to Wall Directory Watch.
         Starting Load Kernel Modules...
[  OK  ] Listening on initctl Compatibility Named Pipe.
[  OK  ] Created slice system-getty.slice.
[  OK  ] Reached target Remote File Systems.
[  OK  ] Mounted POSIX Message Queue File System.
[  OK  ] Started Remount Root and Kernel File Systems.
[  OK  ] Started Create list of required sta…vice nodes for the current kernel.
[  OK  ] Mounted Kernel Debug File System.
         Starting Create Static Device Nodes in /dev...
fuse init (API version 7.26)
[  OK  ] Started Load Kernel Modules.
         Mounting Kernel Configuration File System...
         Starting Apply Kernel Variables...
         Mounting FUSE Control File System...
[  OK  ] Mounted Kernel Configuration File System.
[  OK  ] Mounted FUSE Control File System.
[  OK  ] Started Create Static Device Nodes in /dev.
[  OK  ] Reached target Local File Systems (Pre).
         Mounting /var/volatile...
systemd[1]: Starting udev Kernel Device Manager...
         Starting udev Kernel Device Manager...
systemd[1]: Mounted /var/volatile.
[  OK  ] Mounted /var/volatile.
systemd[1]: Starting Bind mount volatile /var/cache...
         Starting Bind mount volatile /var/cache...
systemd[1]: Starting Load/Save Random Seed...
         Starting Load/Save Random Seed...
systemd[1]: Starting Bind mount volatile /var/spool...
         Starting Bind mount volatile /var/spool...
systemd[1]: Started Journal Service.
[  OK  ] Started Journal Service.
[  OK  ] Started Apply Kernel Variables.
[  OK  ] Started Load/Save Random Seed.
         Starting Flush Journal to Persistent Storage...
systemd-journald[681]: Received request to flush runtime journal from PID 1
[  OK  ] Started Flush Journal to Persistent Storage.
overlayfs: upper fs does not support xattr.
overlayfs: upper fs does not support xattr.
[  OK  ] Started udev Kernel Device Manager.
[  OK  ] Started Bind mount volatile /var/cache.
[  OK  ] Started Bind mount volatile /var/spool.
[  OK  ] Reached target Local File Systems.
         Starting Create Volatile Files and Directories...
[  OK  ] Started Create Volatile Files and Directories.
         Starting Update UTMP about System Boot/Shutdown...
[  OK  ] Started udev Coldplug all Devices.
designware-udc e1100000.usbd: Device Synopsys UDC probed csr c8d74000: plug c8d76000
[  OK  ] Found device /dev/ttyAMA0.
[  OK  ] Started Update UTMP about System Boot/Shutdown.
[  OK  ] Reached target System Initialization.
[  OK  ] Listening on RPCbind Server Activation Socket.
[  OK  ] Listening on CUPS LPD Server Socket.
[  OK  ] Started CUPS Scheduler.
[  OK  ] Reached target Paths.
[  OK  ] Listening on CUPS Scheduler.
[  OK  ] Listening on D-Bus System Message Bus Socket.
[  OK  ] Reached target Sockets.
[  OK  ] Reached target Basic System.
[  OK  ] Started D-Bus System Message Bus.
[  OK  ] Started Kernel Logging Service.
[  OK  ] Started System Logging Service.
         Starting InfiniiVision bootapp service...
         Starting Login Service...
         Starting RPC Bind Service...
--- [bootapp]: start ---------------------
         Starting palio initial usb488 as root...
[bootapp] LaunchInfiniiVision
file system registered
[  OK  ] Started RPC Bind Service.
[  OK  ] Started Login Service.
[  OK  ] Started palio initial usb488 as root.
LaunchInfiniiVision: 02.12.2021071625 ()
System has been running 33.24 seconds
TODO: AddDebugThreadData
TODO: InitClock
Released build, Jul 16 2021, 20:56:43
Initializing FPGA...
************************************
Ver: 1.067 Released
************************************
Calibration mode User
Cal Date Thu Aug 12 15:38:53 2021
TODO: SuspendThread
TODO: ResumeThread
Startup sequence is complete.
TODO: DecryptStringFromFile
System has been running 9.528608 seconds
System has been running 42.75 seconds (monontonic version)
Start Up Sequence 9.511000
MEMORY USAGE: 25484 kB
   Minor Faults:                 2323
   Major Faults:                 1125
   Block Input Operations:       0
   Block Output Operations:      0
   Voluntary context switches:   4548
   Involuntary context switches: 1041
-----> InfiniiVision is running <-----
read descriptors
read strings
[  OK  ] Started InfiniiVision bootapp service.
         Starting Network Manager...
[  OK  ] Started Daily Cleanup of Temporary Directories.
         Starting Network Service...
[  OK  ] Started Run ubirepair script early Sunday morning.
[  OK  ] Reached target Timers.
usb-device code, fix USB-device PHY glitcdesignware-udc e1100000.usbd: reg gadget driver 'configfs-gadget'
h with software:1
[  OK  ] Started Network Service.
         Starting Network Name Resolution...
[  OK  ] Started Network Name Resolution.
[  OK  ] Reached target Host and Network Name Lookups.
[  OK  ] Started Network Manager.
[  OK  ] Reached target Network.
         Starting mdns Server...
         Starting Permit User Sessions...
         Starting php-fpm Server...
[  OK  ] Started Permit User Sessions.
[  OK  ] Started Serial Getty on ttyAMA0.
[  OK  ] Started Getty on tty1.
[  OK  ] Reached target Login Prompts.
[  OK  ] Started mdns Server.
         Starting Hostname Service...
[  OK  ] Started Hostname Service.
         Starting Network Manager Script Dispatcher Service...
[  OK  ] Started Network Manager Script Dispatcher Service.
IPv6: ADDRCONF(NETDEV_UP): eth0: link is not ready
SMSC LAN8710/LAN8720 stmmac-0:07: attached PHY driver [SMSC LAN8710/LAN8720] (mii_bus:phy_addr=stmmac-0:07, irq=POLL)
stmmaceth e0800000.ethernet eth0: RX IPC Checksum Offload disabled
stmmaceth e0800000.ethernet eth0: No MAC Management Counters available
stmmaceth e0800000.ethernet eth0: PTP not supported by HW
IPv6: ADDRCONF(NETDEV_UP): eth0: link is not ready
         Starting Authorization Manager...

stmmaceth e0800000.ethernet eth0: Link is Up - 100Mbps/Full - flow control rx/tx
IPv6: ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready
random: crng init done
random: 7 urandom warning(s) missed due to ratelimiting

tlo 2.6-1.40.0 k-ex1052a-31549 ttyAMA0

k-ex1052a-31549 login:


Interesting that EDUX is identified as a higher model DSOX1102A:

Quote
...
Machine model: Keysight,DSO-X1102A
...

Also attached are the NOR map, Uboot environment variables, Kernel config, and a dump of the filesystem structure.
« Last Edit: February 23, 2024, 04:58:26 am by Bud »
Facebook-free life and Rigol-free shack.
 

Offline BudTopic starter

  • Super Contributor
  • ***
  • Posts: 6912
  • Country: ca
The 1200X scope filesystem is ridiculously convoluted. It has 3 layers as represented in the image. The base layer is the raw NAND which provide ECC error correction. The 256MiB NAND is divided to 3 partitions in U-boot with names MTD1, MTD2, MTD3. On top of each of MTD partitions is mounted UBI system which provides wear-leveling control over the NAND physical blocks marking them bad as they wear out and relocating data to reserved good blocks. UBI also provides data volume management to UBIFS file system which is the top layer in the hierarchy. UBIFS manages files and folders and relies on UBI layer for error correction and bad blocks management. Individual files can only be read/written at UBIFS level. UBI can only read/write entire Volumes, not individual files.



When Linux is booted, several UBIFS volumes are mounted. The rootfs filesystem which contains the Linux OS is mounted separately not as a UBIFS volume but as a UBI block, because it is squashfs type of image which is read-only. Being read-only it is never gets re-written except during firmware updates. From liberation perspective that means a part of it can't be changed in-place, only as a whole image which then will require erasing and re-writing the entire 76MiB rootfs volume. So perhaps that may not be a good approach.

The other volumes seem to be writable and are divided to store different types of system, application and user data. The Linux kernel is stored on its own volume named "boot" together with the kernel device tree. User data such as screen captures and acquisition data is stored in "user-storage" volume. "Firmware-bin" volume stores the InfiniiVision application executable and other files. Additionally, several overlays are mounted which map some of the volumes into the rootfs volume, thus making part of rootfs writable, kinda.

I took a backup of the entire NAND, uploaded it to a Linux VM and mounted in a NAND simulator. The filesystem structure that resulted from that is shown in the below images. The 3 layers of the hierarchy can clearly be seen. Analysis of the filesystem structure is needed to understand the backup/restore strategy and liberation options.




« Last Edit: February 12, 2024, 06:40:51 am by Bud »
Facebook-free life and Rigol-free shack.
 
The following users thanked this post: NF6X, TheSteve

Offline BudTopic starter

  • Super Contributor
  • ***
  • Posts: 6912
  • Country: ca
Reserved for updates.
Facebook-free life and Rigol-free shack.
 

Offline xlslope

  • Newbie
  • Posts: 4
  • Country: cn
Nice work, wish you could find a way to 'update' the BW soon.
 

Offline nctnico

  • Super Contributor
  • ***
  • Posts: 26907
  • Country: nl
    • NCT Developments
The 1200X scope filesystem is ridiculously convoluted. It has 3 layers as represented in the image. The base layer is the raw NAND which provide ECC error correction. The 256MiB NAND is divided to 3 partitions in U-boot with names MTD1, MTD2, MTD3. On top of each of MTD partitions is mounted UBI system which provides wear-leveling control over the NAND physical blocks marking them bad as they wear out and relocating data to reserved good blocks. UBI also provides data volume management to UBIFS file system which is the top layer in the hierarchy. UBIFS manages files and folders and relies on UBI layer for error correction and bad blocks management. Individual files can only be read/written at UBIFS level. UBI can only read/write entire Volumes, not individual files.


AFAIK this image is incorrect. UBI doesn't divide the flash in seperate sections for each partition but uses the entire flash for wear levelling. The partitions are just a way to slice the flash into fixed size pieces which can be accessed as a block device.
There are small lies, big lies and then there is what is on the screen of your oscilloscope.
 

Offline BudTopic starter

  • Super Contributor
  • ***
  • Posts: 6912
  • Country: ca
I do not think so. UBI has to attach each MTD partition (from NAND layer) individually using ubi attach command. Therefore UBI can only use NAND space available within an attached partition. And I understand you do not have to give the entire NAND to UBI, you can give some space to UBI and use rest of space for something else.
Facebook-free life and Rigol-free shack.
 

Offline nctnico

  • Super Contributor
  • ***
  • Posts: 26907
  • Country: nl
    • NCT Developments
Wikipedia claims I'm right  ;D ; the entire flash is used (unless you tell UBI to use a smaller part of the flash but this isn't at the partition size level). IIRC in a past project I told UBI that the flash was larger but had the partitions sized so it would fit in the smaller flash. But lo & behold, at some point the UBI wear levelling algorithm tried to access a  flash sector which wasn't physically there.
« Last Edit: February 20, 2024, 06:16:08 pm by nctnico »
There are small lies, big lies and then there is what is on the screen of your oscilloscope.
 

Offline BudTopic starter

  • Super Contributor
  • ***
  • Posts: 6912
  • Country: ca
Wiki is written by people and people tend to make errors. I never take Wiki for granted. My entire looking into UBI was a discovery that things were not documented well. For some things I had to go as deep as examine UBI source code. I will stick to my findings because of a couple things: 1- I still believe you can allocate one partition to UBI and a second partition to a different filesystem such as jffs2, which means UBI can't use the entire NAND, otherwise it will corrupt the jffs2 partition. And 2 - I have looked at the NAND dump that I downloaded and I found no data being spread out all over the NAND space, the data was perfectly sequentially written, with each partition having its respective data within the address space allocated to each individual partition. It is possible that UBI will start reallocating blocks as they become bad later, but on a brand new NAND the data blocks are sequential and is within its respective partition (just interleaved with UBI headers).

It should be easy to prove one way or the other by using NAND simulator in Linux by instantiating a NAND device and creating two partitions, one allocate to UBI and second one to , say, JFFS2. Fill JFFS one with data, then UBIFS one with data, and see if UBIFS corrupted data on JFFS2 partition, which what should happen if UBI uses the entire NAND. I do not anticipate that to happen.

Anyway, this is not my focus at the moment. It seems that liberating 1200X is not a question anymore, the question is how to do it in a way with minimum writes to NAND, as NAND corruption appears to be Keysight scope's  specialty. This is why I wanted to understand organization of data storage, how UBI works, etc. In general, after gaining access there are so many ways that I am not even sure yet which one to use. In this regard 1200X with its Linux appears to be easier to work with than 1000X with its Windows Embedded OS. I'll post details later, just being busy at work.

Facebook-free life and Rigol-free shack.
 
The following users thanked this post: Someone

Offline tv84

  • Super Contributor
  • ***
  • Posts: 3221
  • Country: pt
Please share a list of all the files in the system.
 

Offline BudTopic starter

  • Super Contributor
  • ***
  • Posts: 6912
  • Country: ca
Is a Linux command that can dump file tree in a file?

 BTW: for rootfs just see the squashfs file in the official update package, rootfs is  read only, so it is 1:1 match.
« Last Edit: February 21, 2024, 05:34:47 pm by Bud »
Facebook-free life and Rigol-free shack.
 

Offline Veteran68

  • Frequent Contributor
  • **
  • Posts: 727
  • Country: us
Is a Linux command that can dump file tree in a file?

The tree command is commonly used, but typically isn't installed be default especially on an embedded OS.

You can always fall back on ls -R >output.txt
 
The following users thanked this post: Bud

Offline tv84

  • Super Contributor
  • ***
  • Posts: 3221
  • Country: pt
Is a Linux command that can dump file tree in a file?

Use:

ls -aR / > output.txt
 

Offline nctnico

  • Super Contributor
  • ***
  • Posts: 26907
  • Country: nl
    • NCT Developments
Wiki is written by people and people tend to make errors. I never take Wiki for granted. My entire looking into UBI was a discovery that things were not documented well. For some things I had to go as deep as examine UBI source code. I will stick to my findings because of a couple things: 1- I still believe you can allocate one partition to UBI and a second partition to a different filesystem such as jffs2, which means UBI can't use the entire NAND, otherwise it will corrupt the jffs2 partition. And 2 - I have looked at the NAND dump that I downloaded and I found no data being spread out all over the NAND space, the data was perfectly sequentially written, with each partition having its respective data within the address space allocated to each individual partition. It is possible that UBI will start reallocating blocks as they become bad later, but on a brand new NAND the data blocks are sequential and is within its respective partition (just interleaved with UBI headers).

It should be easy to prove one way or the other by using NAND simulator in Linux by instantiating a NAND device and creating two partitions, one allocate to UBI and second one to , say, JFFS2. Fill JFFS one with data, then UBIFS one with data, and see if UBIFS corrupted data on JFFS2 partition, which what should happen if UBI uses the entire NAND. I do not anticipate that to happen.
You are mis-understanding what I wrote. What I wrote is that UBI takes the entire piece of NAND flash you assign to it and UBI creates virtual partitions on it if you like. Under the hood it will use the entire piece of NAND flash you assigned to it to place the data randomly into flash. So your partitions end up anywhere on the piece of NAND flash you assigned to it as wear levelling progresses. Doing this makes a lot of sense because you only need 1 pool of spare sectors for all the partitions instead of seperate pools AND you don't run the risk of running out of spare sectors for very small partitions. Ofcourse when writing data initially, it will be sequential. But try writing files repeatedly for a while and things will start to mix.
« Last Edit: February 21, 2024, 06:41:20 pm by nctnico »
There are small lies, big lies and then there is what is on the screen of your oscilloscope.
 

Offline BudTopic starter

  • Super Contributor
  • ***
  • Posts: 6912
  • Country: ca
Nice work, wish you could find a way to 'update' the BW soon.
EDUX would require input circuit hardware update for BW. Otherwise it will only be extended time/ setting added.
Facebook-free life and Rigol-free shack.
 

Offline BudTopic starter

  • Super Contributor
  • ***
  • Posts: 6912
  • Country: ca
Reply #1 updated, see filesystem dump there.


« Last Edit: February 23, 2024, 05:09:35 am by Bud »
Facebook-free life and Rigol-free shack.
 
The following users thanked this post: tv84

Offline xlslope

  • Newbie
  • Posts: 4
  • Country: cn
I just checked the DSOX1200A/G BW upgrade option on Keysight site, it seems D1200BW1A/2A/3A all not required to send the scope back.
I bought my DSOX1204G last year with all functions available already.(like 20MHzAWG, Blod plot, I2C/SPI/CAN Analyse....), only the BW is 70MHz upgradable.
Btw, thanks to your (and the others‘) work on DSOX2000/3000X again, I just repaired and 'upgrade' 2 broken 3014A in our lab. ;D
 

Offline BudTopic starter

  • Super Contributor
  • ***
  • Posts: 6912
  • Country: ca
Do you have "all" licenses though? The device datasheet only tells you what is marketed with the device. In the 1000X model other licenses were liberated, going from my memory - Advanced Math, enhanced video triggering, circular segmented memory (not just segmented memory), more serial bus types, firmware downgrade, and a few for which their purpose was not clear  :D
Facebook-free life and Rigol-free shack.
 

Offline xlslope

  • Newbie
  • Posts: 4
  • Country: cn
I just check the Licences I have in DSOX1204G, EMBD/AUTO/SGM/MASK/EDK/WAVEGEN/DVM/RML,
Analyze functions seems less than 3014A (like PowerSupply functions(Noise/Ripple/Efficiency/PSRR.....), but I never use them,  FRA and AWG is enough for me to test the PSRR and loop)
I'm not sure if its all 1204G can provide, just like you said, there may be some useful functions unpublished.  :scared:
 


Share me

Digg  Facebook  SlashDot  Delicious  Technorati  Twitter  Google  Yahoo
Smf