Agilent 34461A corrupted flash - Page 1
Forum section: electronics / repair

author: dc101
author_rank: Regular Contributor
timestamp: March 23, 2021, 01:32:17 am
content: I have a Agilent 34461a that's well out of warranty and no longer boots. Thanks to previous threads on this forum I was able to determine it's a result of corrupt/dead flash, although I can't 100% rule out a more serious issue. I suspect this may have resulted from leaving it unplugged for some amount of time. I emailed Keysight and asked them for a copy of the pboot.bin image and nk.bin, but I'm not very optimistic they will send me the files.Does anyone here have a copy of pboot.bin and nk.bin? Or is anyone who has a 34461a willing to try and dump these files? My 34461a is running U-Boot 2010.03 (Oct 09 2012 - 12:48:30)Agilent P510. I was able to flash nk.bin that I grabbed off the USB thumbdrive for a front panel update, but without pboot.bin there is no kernel to boot nk.bin, and I'm not 100% the nk.bin I flashed is in the correct format.Boot log:Code:U-Boot 2010.03 (Oct 09 2012 - 12:48:30)Agilent P510CPU: SPEAr320DRAM: 128 MiBUnknown id: 0xffffff. Using ST_M23P40Flash: 64 KiBNAND: INTERNAL ECC 128 MiBIn: serialOut: serialErr: serialSerNum:MY99999999Chip: AA Board Rev: 4init RTC: 2021-03-22 21:08:23.75Net: No ethernet found.splash RTC: 2021-03-22 21:08:24.78Press space to stop autoboot: 0NAND read: device 0 offset 0x320000, size 0x1000065536 bytes read: OKWrong Image Format for bootm commandERROR: can't get kernel image!p510>Sure enough if I list the flash images, pboot is definitely gone:Code:********************* NOR Flash Images ****************************************** NAND Flash Images *********************Image at offset 00000000:Image Name: XLOADERCreated: 2012-05-16 23:33:58 UTCImage Type: ARM Linux Firmware (uncompressed)Data Size: 5370 Bytes = 5.2 KiBLoad Address: d2800b00Entry Point: d2800b00Verifying Checksum ... OKImage at offset 00020000:Image Name: XLOADERCreated: 2012-05-16 23:33:58 UTCImage Type: ARM Linux Firmware (uncompressed)Data Size: 5370 Bytes = 5.2 KiBLoad Address: d2800b00Entry Point: d2800b00Verifying Checksum ... OKImage at offset 00040000:Image Name: XLOADERCreated: 2012-05-16 23:33:58 UTCImage Type: ARM Linux Firmware (uncompressed)Data Size: 5370 Bytes = 5.2 KiBLoad Address: d2800b00Entry Point: d2800b00Verifying Checksum ... OKImage at offset 00060000:Image Name: XLOADERCreated: 2012-05-16 23:33:58 UTCImage Type: ARM Linux Firmware (uncompressed)Data Size: 5370 Bytes = 5.2 KiBLoad Address: d2800b00Entry Point: d2800b00Verifying Checksum ... OKImage at offset 00100000:Image Name: UBOOTCreated: 2012-10-09 18:59:15 UTCImage Type: ARM Linux Kernel Image (uncompressed)Data Size: 237084 Bytes = 231.5 KiBLoad Address: 03f00000Entry Point: 03f00000Verifying Checksum ... OKp510>Cheers-Tim

author: dc101
author_rank: Regular Contributor
timestamp: March 23, 2021, 03:37:46 am
content: On a whim I grabbed pboot from my 53220a, but unfortunately the units are not as similar as I thought. I was hoping it would at least boot, but it stops shortly after loading.Keysight has already informed me that I need to send the unit in for repair because there are "no user repair actions available."Code:U-Boot 2010.03 (Oct 09 2012 - 12:48:30)Agilent P510CPU: SPEAr320DRAM: 128 MiBUnknown id: 0xffffff. Using ST_M23P40Flash: 64 KiBNAND: INTERNAL ECC 128 MiBIn: serialOut: serialErr: serialSerNum:MY99999999Chip: AA Board Rev: 4init RTC: 2021-03-22 23:06:53.27Net: No ethernet found.splash RTC: 2021-03-22 23:06:54.31Press space to stop autoboot: 0NAND read: device 0 offset 0x320000, size 0x1000065536 bytes read: OK## Booting kernel from Legacy Image at 00600000 ...Image Name: PBOOTCreated: 2009-10-22 11:56:02 UTCImage Type: ARM Linux Kernel Image (gzip compressed)Data Size: 37189 Bytes = 36.3 KiBLoad Address: 00000000Entry Point: 00000000Uncompressing Kernel Image ... OKStarting kernel ...Debug serial initialized ........OK

author: perieanuo
author_rank: Frequent Contributor
timestamp: March 23, 2021, 04:56:15 pm
content: Unknown id: 0xffffff. Using ST_M23P40imho tah means the memory chip is not responding at allhaven't yes seen chips with good memory space and not responding to ID interogation, but who knows, maybe others have seen thiscorrupted or defective flash for me means remove memory/test in external programmer/replace or reprogrami'd guess, the flash is not 'corrupted', is not responding at allif you cand find the .hex, remove and replace with new programmed flash chip, or maybe your agilent have some sort of firmware update procedure if the flash is empty, i don't know that agilent model

author: dc101
author_rank: Regular Contributor
timestamp: March 23, 2021, 10:13:19 pm
content: I've been wondering this exact thing, is the flash corrupt, did the flash die, is the DDR bad?I have a BGA63 socket in the mail that I ordered for a different project, so I could buy a new flash chip and reprogram it, but like you said I need to find the hex files to program it with. I believe I can use the nk.bin file from the firmware update, but pboot.bin is proving impossible to find. I may have to eat the cost of buying a new front panel, I believe it's around $US 250.00.

author: perieanuo
author_rank: Frequent Contributor
timestamp: March 24, 2021, 11:03:44 am
content: sometimes a good empty flash can do it, have you tried just replacing that flash? at least, you will see the message changing and maybe update proposed.(I suspect from "Using ST_M23P40" you can try this type of flash or somethin,g with same size or bigger and same reading/writing algo, if you got one in your spare parts)plus, it's a simple so8case, so changing it it's really simple even with some soldering station

author: Dr. Frank
author_rank: Super Contributor
timestamp: March 24, 2021, 08:35:40 pm
content: 34465A/470A may be similar / identical, as all DMMs share same Firmware update files.Where and how can one extract this Flash Boot Loader ?Frank

author: dc101
author_rank: Regular Contributor
timestamp: March 25, 2021, 12:08:05 am
content: Frank - That might actually work! I found some photos of the 34465a on the forum from radioFlash and the ARM processors are the same.It's not a hard process, but there are a few steps to it. It does involve removing the instrument cover which may void the warranty? So understandable if you'd prefer not to. Once the cover is off you'll need to connect to the serial port on the back of the front panel that mikeselectricstuff identified in the original 34461a thread. On the 53220a and 34461a the serial port is real 12V levels, but probably worth double checking on the 34465a. After that there are a few u-boot commands you will need to run. There is no way to download the binary straight from flash that I know of, so here's what I did when I downloaded pboot from my 53220a: List the images loaded in flash, load pboot from the given flash address into ram, print the ram contents, copy and paste the ram output into a text editor to format the text properly (remove addresses, spaces, newlines etc...) then copy and paste the properly formatted ascii hex into HxD to save as binary.One thing I would highly recommend is running the u-boot protect command to disable writing to flash, this will prevent you from accidentally overwriting/erasing sections of your flash. It was an errant copy and paste in putty that erased my pbootPreviously it was just nk.bin that was corrupt in flash.I would be very grateful if you would be willing to attempt to download pboot from your meter; I am willing to pay you for your troubles. I will connect to my 53220a and document the exact u-boot commands required and the TX/RX/GND pins of the serial port, so you have a better understanding of the exact process.Thanks again-Tim

author: Dr. Frank
author_rank: Super Contributor
timestamp: March 25, 2021, 07:35:32 am
content: Quote from: dc101 on March 25, 2021, 12:08:05 amTim,that sounds feasible.The replacement of the current fuses requires to remove the cover.. so there is not "guarantee void"I have done that many times already because I e.g. experimented with the LM399 vs LTZ1000 reference.If you provide details about this internal interface, and the necessary serial port monitor programs, I'll try it.Frank

author: dc101
author_rank: Regular Contributor
timestamp: March 25, 2021, 09:22:26 pm
content: Awesome, I have the steps written down, so hopefully it is fairly straightforward. If you're on Windows I would suggest using MobaXterm (https://mobaxterm.mobatek.net/download.html) and for Linux my goto is Minicom which can be installed with apt-get install minicom.Step 1 - Make physical connection to serial port on back of display (see attached picture for pinout)Step 2 - Open terminal program, and set the serial connection as follows: 115200 baud, no flow control, data bits 8, stop bits 1, parity bits noneFor MobaXterm, you click on the session icon in the upper left and select Serial from the popup. The baud is set on the main screen and other settings are under Advanced Serial Settings.Step 3 - Power on unit and press space bar in MobaXterm to abort autoboot process. You should see a prompt that says "p510>"Step 4 - Type "protect on all" and press enter. This will enable flash write protection.Step 5 - Type "imls" you will see several sections under NAND Flash Images (removed here for brevity). PBOOT should be the last entry and we need to know the image offset for the next step. Your PBOOT should look a little different from the one below, as this is the one from my 53220a.Code:********************* NOR Flash Images ****************************************** NAND Flash Images *********************.....Image at offset 00320000:Image Name: PBOOTCreated: 2009-10-22 11:56:02 UTCImage Type: ARM Linux Kernel Image (gzip compressed)Data Size: 37189 Bytes = 36.3 KiBLoad Address: 00000000Entry Point: 00000000Verifying Checksum ... OKp510>In my case PBOOT is at 0x320000 in flash. I'm not sure if it's the same across the product range.Step 6 - Type "nand read 0x600000 0x320000 0x10000" and press enter. Change 0x320000 to the correct address of PBOOT if it is different. This command will load PBOOT from flash into RAM at address 0x600000. This is the same command the device uses when it normally boots except we're only going to print the ram contents and not boot from them.Step 7 - Type "md.b 0x600000 0x10000" and press enter. This is the memory display command and will display 0x10000 bytes starting at address 0x600000.Step 8 - The last step, simply right click on the MobaXterm screen and select Copy All. Paste the contents in your favorite text editor and that's in. I can take care of formatting the data and converting it into a binary.Thanks again! Let me know if you run into any issues. Fingers crossed this works!-Tim

author: Dr. Frank
author_rank: Super Contributor
timestamp: March 26, 2021, 09:45:21 am
content: My 34465A looks identical; serial interface identified; obviously the boot loader FW should be the same vintage from ~ 2010.Concerning the command "protect on all", is this a permanent lock, which I have to reset after the operation?I fear, otherwise, I would not be able to do a FW update any more.Frank

author: dc101
author_rank: Regular Contributor
timestamp: March 26, 2021, 11:33:34 am
content: I believe your correct. I was actually just reading over some u-boot web pages again this morning and had the same thought.http://www.denx.de/wiki/view/DULG/UBootCmdGroupInfoIt might be a good idea to runprotect off allafter you finish, for exactly the reason you mentioned. Or alternatively you do not have to run the protect command in the beginning.At the time I was using Putty as my terminal program and it has a rather annoying "feature" where anything that is highlighted by the mouse is automatically copied to the clipboard and just right clicking the mouse button will paste whatever is currently in the clipboard. This is what got me in trouble when I was trying to restore nk.bin. This is also why I recommended MobaXterm, at least there you have to explicitly select copy and paste.

author: Dr. Frank
author_rank: Super Contributor
timestamp: March 26, 2021, 11:58:53 am
content: OK, thanks, all went fine, appended dump to my recent post.Have fun, and please report back if this could fix your 34461A!Frank

author: dc101
author_rank: Regular Contributor
timestamp: March 26, 2021, 12:21:38 pm
content: Well that definitely did the trick, it's able to boot the windows ce kernel (pboot)! Now I need to see about reflashing nk.bin to correct places and see if it will boot up fully, or if there are in fact other issues with my meter. Thanks again!

author: dc101
author_rank: Regular Contributor
timestamp: March 27, 2021, 06:08:50 pm
content: Well the journey continues. PBOOT is working, however it seems that the version of nk.bin that comes with the official firmware update is not in the correct format be loaded directly from ram, or stored in flash and loaded into ram. The attached screenshot shows what the meter looks like after trying to put from nk.bin.I've read some forum posts regarding Keysight scopes having success booting from the Windows CE platform builder, so I'm attempting to try that now. I'm in the process of updating my Windows XP CE development machine, and will report back with any news.Cheers-Tim

author: ddcc
author_rank: Regular Contributor
timestamp: March 27, 2021, 07:38:04 pm
content: I was curious, so I took a quick look. The NK.bin file is stored in the compressed XPRS format, so you could try decompressing it first. Seehttps://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg1035605/#msg1035605for a direct link to bincompress.exe, or you can probably find it somewhere in the Windows CE SDK.

author: dc101
author_rank: Regular Contributor
timestamp: March 27, 2021, 10:32:47 pm
content: Thank you! I had looked at the bk.bin for the 53220a, and compared it to the nand flash on mine and noticed there was quite a difference, this certainly explains things. I'll definitely look into that. I just finished installing VS 2005 and CE 6.0 on an XP VM so I'll take a look in there. I messed around with WinCE 6.0 when the FLIR C3 was released a few years back, but haven't touched it since then, so I've forgetting almost everything.

author: dc101
author_rank: Regular Contributor
timestamp: March 27, 2021, 10:52:01 pm
content: This makes SSOOOO much more sense now. I've been scratching my head all day trying to figure out why it seemed so easy when I loaded the FLIR C3 nk.bin in platform builder, but it just wasn't working with the 34461a firmware until after I decompressed it with the file you mentioned. Sure enough, it was in one of the WinCE directories. Once I decompressed it, I just added it to a project in WinCE like any other file and it opened right up.I'm uploading it to my meter now via ymodem, so I've got some time to kill before it finished uploading. For whatever reason I never got u-boot to recognize any USB storage devices.

author: dc101
author_rank: Regular Contributor
timestamp: March 28, 2021, 01:19:37 am
content: Sooo.... I'm going to call this a win. A quick test of a dead 3V coin cell battery and shorting the probes.

author: TheSteve
author_rank: Unknown
timestamp: March 28, 2021, 07:36:26 am
content: The master model/serial # is in the front panel. It is also stored on the mainboard. If you were to buy a new front panel it would be initialized such that when it was first connected it would read the model/serial from your mainboard. It would then be stored in the front panel and can no longer be changed.There are also SCPI commands to set them, but it is unlikely they will work.Still worth a shot:diag:ofinit "SERIAL", "MODEL"

author: dc101
author_rank: Regular Contributor
timestamp: March 28, 2021, 05:40:13 pm
content: I did some more digging and found an interesting u-boot commandfactory.Code:p510> help factoryfactory - factory - program factory data into NAND memoryUsage:factory <address>- the first 2K of RAM <address> will be written to NAND at the appropriate blockp510>Interestingly, it only takes one argument, the ram address to read from. This means that the NAND address must be hard coded in the function. Sure enough, a few minutes of IDA and we find that the hardcoded NAND address is0x80000. We also find something that's probably a little more interesting. An undocumented argument. Looking at the pseudo code in IDA, it first checks the number if arguments passed tofactory. If that number is equal to 2, it checks to see if the wordlistis contained in the argument. Following the code, you'll see that passinglistwill print the factory data stored in NAND. Iflistis not found it assumes you passed an address and will write the first 2K of the specified address to the NAND address0x80000Code:p510> factory listManufacturing DataMAC: XX-XX-XX-XX-XX-XXGUID: XXXXXXXX-XXXX-XXXX-XXXXXXXXXXXXXXXXSN: MY99999999p510>This should help us understand the exact format the data needs to be in, and allow anyone to reprogram their serial number. Still a little fuzzy on the model number though, unless it is somehow related to the GUID?

author: Dr. Frank
author_rank: Super Contributor
timestamp: March 28, 2021, 07:12:31 pm
content: Hi Tim,the model is also contained in the serial number, I assume.MY547xxxxx is for 34470As, MY545xxxxx for the 34465A, please cheek the Serial Number of your 34461A.Therefore there might be no distinct configuration (model #) parameter.The hardware platform for all 4 instruments seems to be identical. the 460/461 have the same Mainboard, as well as the 465/470 PCBs are identical, apart from the reference.The difference between the lower grade instruments vs. the higher grade ones seems to be a different / lesser assembly, to tailor the different features in hardware.See 'New 34470A review' thread, where we analyzed all PCBs.The differentiation in features and also the options like Digitizing and Memory is probably set up by firmware switches / keys only.I assume that KS implemented a strong encryption of all these objects, to prohibit easy modification.The serial number as well will be encrypted I assume, and as The Steve already claimed, stored in different places.Anyhow I'm very interested, how to enable the 7 1/2 digit display on my 465A, as I already found out, how to upgrade the reference to the LTZ1000A .Frank

author: dc101
author_rank: Regular Contributor
timestamp: March 28, 2021, 08:13:45 pm
content: Hey Frank,Thanks, I'll check out that thread you mentioned. I'm thinking now thatfactoryu-boot command might be some legacy code that is no longer used as the serial number showed in the help -> about menu, even before setting it with the factory command. My serial number starts with MY532, which matches the factory sticker and what is displayed on the screen.I tried the SCPI command that The Steve mentioned, but as he guessed, it did not work. When I first uploaded new firmware and booted up the meter I saw something about detecting a new processor and taking a few minutes to update something. I wonder if the SCPI command would work when that screen is displayed?The unfortunate part is I can't seem to be able to do a firmware update from USB or ethernet, due to the missing model number, which is preventing me from being able to get the firmware flashed to NAND. Even after uncompressing nk.bin, it still only loads from RAM. I wrote it to NAND, rebooted and read it back into to RAM and it loaded fine, so I don't think it's a NAND issue. Yet if I write nk.bin to NAND and verify the images with the CE bootloader, the NAND image comes back as invalid, while the RAM image is valid.It's possible the issue might still be with pboot. I noticed after flashing the version from your meter, that the default NAND addresses are different from the 34461A. The RAM image was the same however at0x84000000Code:34365AImage addresses. (0xdxxxxxxx for NAND, 0x8xxxxxxx for RAM)1 (0xd0400000)2 (0xd1700000)Code:34461Animages=2image1=0xd0620000image2=0xd2120000

author: Dr. Frank
author_rank: Super Contributor
timestamp: March 28, 2021, 08:22:59 pm
content: I made some errata to my former post, and here's the correct link to the discussion of the 461/465/470:https://www.eevblog.com/forum/testgear/keysight_s-new-34465a-(6-5-digit)-and-34470a-(7-5-digit)-bench-multimeters/150/some pages earlier or later, we already discussed possible feature switches, afair.If I remember correctly, during the normal boot process, the serial number is displayed on the serial monitor.. and I did not blank my serial number inside the pboot dump file.Frank

author: dc101
author_rank: Regular Contributor
timestamp: March 28, 2021, 10:15:37 pm
content: So looks like the DIAG:OFINIT SCPI command worked after all. It didn't work immediately after getting the new cpu alert, but after repeatedly sending the command I noticed I stopped getting errors on the scoped. I thought maybe I just broke SCPI, after a reboot now I see it actually has a model number. For another test I ran *IDN? and this time it actually worked. The first time I tried this after flashing new firmware, my scope crashed and reset.

author: TheSteve
author_rank: Unknown
timestamp: March 28, 2021, 11:08:16 pm
content: Very nice that it worked! I have a different device I'd like to reset the model and serial # on. Any thoughts on exactly what was erased to lose the model/serial #? If the model/serial # are set the command certainly doesn't work.

author: dc101
author_rank: Regular Contributor
timestamp: March 28, 2021, 11:50:01 pm
content: It may have been when I probably erased more of the NAND flash than I intended to? When I was first starting my attempt at reflashing nk.bin, I didn't specify a block_size, so I'm pretty sure that I erased everything after whatever the starting address was. Probably worth looking into a little more, since I still have to upload an nk.bin image to RAM after power-on/reboot to get it to fully boot.That being said, I still don't really know what happened to my meter to cause it be in it's current state. For months it had trouble booting, but usually unplugging it for a few minutes plugging in back in and then turning it on would work. Unfortunately I didn't think the problem was serious, and I never thought to look at the serial console at the time. Eventually it got to the point where it didn't matter what I did, I'd just get the Keysight splashscreen and the serial console indicated all 3 images were invalid. Perhaps whatever caused this, also caused it to lose the model number as well?-Tim

author: TheSteve
author_rank: Unknown
timestamp: March 29, 2021, 12:02:55 am
content: I have a Keysight 33622A that boots but won't enable any output as the FPGA authentication fails. All other self tests pass. There is a Dallas 1 wire secure IC with the FPGA that performs a secure handshake with the main processor, if it fails the meter won't work. It is tied to the model/serial # I am sure and is there to prevent someone else from ripping off the FPGA code(only reason I can think of). It seems my meter is a prototype and I'm wondering if the secure IC was never configured/programmed and worked fine with development firmware. Then someone updated to normal production firmware and it no longer operates. At that point they gave up and sold it, now I own it. The model # and serial # are correct. They are both also stored on the main board in an eeprom but if you blank that it will just silently reprogram it at boot from the front panel CPU processor. The ofinit command doesn't work because it is already programmed. I am wondering though if I was to erase the model/serial # like you did if it would also generate whatever is needed to work with the secure IC again when running the ofinit command. Obviously I don't want to erase anymore then needed.The address location change in your 34461A is also interesting, it seems like it thought the dataspace was in use and shifted the address down and then wrote pboot in a new location. You may have slightly less NAND space then you had originally, not likely an issue though.edit - if you perform a "factory list" Do you see your serial # listed? I tried it with my 33622A and have a valid MAC and GUID but there is no serial #.

author: dc101
author_rank: Regular Contributor
timestamp: March 29, 2021, 12:59:57 am
content: When I first triedfactory listit showed the same serial number as u-boot, MY99999999, but I can't be sure that's not because of current issues. I'll have to try that with my 53220A and see what it returns. Perhaps Frank can try on his scope as well? I'm not sure if that's legacy code or not.After first reboot, it appeared the DIAG:OFINIT was not permanent as my model number was lost. But after additional tests, the model number seems to remain in memory even after unplugging the meter for several minutes. One interesting thing is that even after running the DIAG:OFINIT command, I was still unable perform a USB firmware update and received the same "Incorrect firmware loaded for this model number." unfortunately after trying the firmware update again I get a warning saying the firmware on the USB is the same or older and after pressing yes to continue, the unit simply freezes and the front panel stops responding. The web interface still seems to work though.My current boot process is to abort the autoboot, load the NAND image2 into RAM, and issue the normal boot command. By default this pboot boots from the RAM image. It's still a pain, but better than uploading nk.bin using ymodem after every reboot.Out of curiosity, I ran the DIAG:OFINIT command with my serial number but changed the model number and got a "-310 System error" so there is definitely some logic checking happening in the meter.Regarding the NAND address shifting, that seems to be related to using Frank's pboot since we have different meters. The problem is everytime I try a firmware update, the u-boot values seem to reset to their original settings. The FBGA codes on the NAND are different, although I haven't looked up the one for the 34465A, so I don't know the exact differences.-Tim

author: TheSteve
author_rank: Unknown
timestamp: March 29, 2021, 01:04:28 am
content: I have a 34461A - maybe I should dump the pboot from it.

author: dc101
author_rank: Regular Contributor
timestamp: March 29, 2021, 01:24:53 am
content: If you could, that would be super helpful. I'd be very curious to see what the default NAND locations are for your images. Also would be interesting to compare them with vbindiff to see how different they are.Have you looked at any of the interfaces coming off of the NXP chip mentioned by 6thimage in the new 34465A/34470A thread? It looks like the UART, I2C and SPI lines are all routed to traces. I checked the UART on boot with my scope and there's some 115200 baud traffic (3.3V logic) but I haven't gotten around to decoding it yet. It's on my to do list.Since I've got a somewhat good feel for bringing up my meter from the dead, I may try to erase the entire NAND again and see what happens. Wonder if we'll lose the serial / model number again?-Tim

author: TheSteve
author_rank: Unknown
timestamp: March 29, 2021, 01:39:25 am
content: Had a play with my 34461A. I dumped pboot.I noticed at boot it showed the serial # as SerNum:MY99999999I then thought I'd do the "factory list" but mis-remembered the command and typed "factory info". The command didn't give an error but has now changed the "MY99999999" to "x⚌⚌⚌⚌$". It seems the change is permanent. So far the meter still boots and seems to work with no errors. I haven't tried a firmware update or anything. It's made me sweat a little, not going to lie. I really like my 34461A, bought it new. Normally commands don't do odd things, guess we need to be super careful.You can see that same serial # with the printenv command.

author: Monkeh
author_rank: Super Contributor
timestamp: March 29, 2021, 01:45:23 am
content: Quote from: TheSteve on March 29, 2021, 01:39:25 amYou're working at a very low level with code chucked together for test purposes, never really expected to be seen by anyone but the original firmware engineers. Here be dragons.

author: dc101
author_rank: Regular Contributor
timestamp: March 29, 2021, 01:49:11 am
content: Not sure if this was reported in the other Agilent/Keysight multimeter threads, but you can enabled the FTP server on the 3446X by running the SCPI commandDIAG:UPD:START?Code:[user.titan] ➤ telnet 192.168.30.96 5024Trying 192.168.30.96...Connected to 192.168.30.96.Escape character is '^]'.Welcome to Keysights's 34460A Digital Multimeter34460A> DIAG:UPD:DIR?\Agilent Flash\User\34460A> DIAG:UPD:START?+134460A>Here's some more SCPI commands that you can use to try and brick you meter, get crazy:DIAG:UPD:DIR?DIAG:UPD:ENAB?DIAG:UPD:REV?DIAG:UPD:BLOCK:SIZE?DIAG:UPD:START?DIAG:UPD:STOPDIAG:UPD:REBOOTDIAG:UPD:END?DIAG:UPD:ENAB?DIAG:UPD:NKBIN "\Agilent Flash\User\Nk.bin"DIAG:UPD:FIRM:ERR?DIAG:UPD:FIRM:PROG?

author: dc101
author_rank: Regular Contributor
timestamp: March 29, 2021, 01:59:39 am
content: The Steve - Ooooofff, unfortunately that makes sense with what I saw in the decompiler.<--- Side note, what am I doing wrong, that I can't put pictures inline with my post?It assumes any argument that isn't the string "list" is a pointer to a location containing the factory data. There's no checking to make sure it's a valid address. So if you typed in "info", then factory copied 0x2000 bytes starting at (RAM)0x696e666f into NAND flash.Did you by chance run printenv prior to running factory info/list? If so, you should be able to restore your factory info back to default. It's not hard, it just involves finding a clean space of RAM, writing to it in the format that factory expects and then running the factory command with the correct address.Cheers-Tim

author: TheSteve
author_rank: Unknown
timestamp: March 29, 2021, 02:19:49 am
content: Quote from: dc101 on March 29, 2021, 01:59:39 amIt doesn't appear I did. I do have the original MAC saved elsewhere though, so maybe we can restore it still.

author: dc101
author_rank: Regular Contributor
timestamp: March 29, 2021, 03:19:43 am
content: Thanks! Most surprisingly, it's exactly the same as the one from Frank. That's good news for the community, now we know.It does however pose more questions, why now are the image locations different from the u-boot defaults? How do you change the pboot image locations? Why do the u-boot image settings change after a firmware update attempt? How do you change the u-boot defaults? What else needs to be programmed to perform a factory firmware update?Cheers-Tim

author: dc101
author_rank: Regular Contributor
timestamp: March 29, 2021, 05:01:42 am
content: This is starting to get interesting.

author: TheSteve
author_rank: Unknown
timestamp: March 29, 2021, 05:05:33 am
content: Restored the proper mac and the dummy serial # MY99999999. Also added a new unique GUID. I think the only value that is used is the MAC address. So the 34461A is happy again. I am pondering options to nuke the serial/model on the 33622A still though.

author: dc101
author_rank: Regular Contributor
timestamp: March 29, 2021, 05:09:59 am
content: Awesome, glad to hear things are back to normal.... errr pre-factory info-Tim

author: TheSteve
author_rank: Unknown
timestamp: March 29, 2021, 05:17:23 am
content: So your 34461A works, but only if you tell it where to boot the image from manually?

author: dc101
author_rank: Regular Contributor
timestamp: March 29, 2021, 05:30:47 am
content: Yeah the Win CE bootloader boots from RAM by default, so I have to load the RAM image from flash every boot. I can't make the nk.bin images recognized as valid images when written to flash. And I can't get the firmware update to work from USB or ethernet. I've tried converting nk.bin into an nk.nb0 image and writing that to flash but that didn't work either. Maybe using u-boot to write to flash is bypassing the built-in ECC? Kind of at a loss right now.While I'm pretty happy my meter still seems to pretty much work, it's also pretty frustrating to not get any support from HP/Agilent/Keysight. Sadly, it's a stark contrast to the experience I had with Rohde & Schwarz when the FFT filters on my FSP3 stopped working. I bought it used years after it was EOL, and still got an email from the R&S support staff with a copy of the firmware and instructions on reloading the firmware.

author: TheSteve
author_rank: Unknown
timestamp: March 29, 2021, 05:42:18 am
content: What happens if you enter the Boot Loader Config menu, then load an image via the platform builder(network) option. That should get you booted, then perform a firmware update via the front panel USB?

author: dc101
author_rank: Regular Contributor
timestamp: March 29, 2021, 05:47:38 am
content: I haven't been able to figure out how to present the nk.bin image from platform builder to my meter. I have a virtual machine with Windows CE 6.0 and platform builder SP 1 installed, but I have very little experience with Windows CE/Windows Embedded. I've been able to look at the nk.bin in platform builder, but that's as far as I've gone. It's the reason why I setup the virtual machine, but I just haven't figured out how to load an nk.bin for another device to boot from.

author: TheSteve
author_rank: Unknown
timestamp: March 29, 2021, 06:04:19 am
content: Forget the true platform builder program. You want to use celoader. You can grab it from here:https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg1022267/#msg1022267Then on a windows machine run it from a command prompt window with an uncompressed nk.bin file. It will open a port on the machine with the custom tftp port needed for platform builder. When you select boot from platform builder on the 34461A it should find the machine serving the file, download and boot it.

author: Dr. Frank
author_rank: Super Contributor
timestamp: March 29, 2021, 06:48:10 am
content: Well folks,you both do a great job ..Just an idea concerning the 460/461 versus the 465/470:If I remember correctly, the 460/461 came out earlier, brand still being agilent.The main board already contained the full schematic for the later 465/470 functionality, but these additional components were not yet assembled.The 465/470 were published under the new brand Keysight, they got a slightly updated PCB version, and the Memory option probably requires more DRAM or Flash space (I don't know where they store these data, in Flash, or in a battery backed up SRAM).Therefore, the front panel PCB might also have more memory space and a slightly different memory map than the 460/461.. probably the PCB itself is identical.I could check / compare this if you tell me exactly where / what to look for, also via the monitor program.Frank

author: dc101
author_rank: Regular Contributor
timestamp: March 29, 2021, 04:14:59 pm
content: Quote from: TheSteve on March 29, 2021, 05:17:23 amI tried the celoader and that takes care of loading fairly quick, but the firmware update still didn't go through.For now, as a quick hack to just be able to use my meter again I went ahead and flashed the uncompressed nk.bin to NAND and modified the uboot preboot variable to load the image from NAND into RAM before loading the Win CE bootloader. It works for now and keeps me from having to manually abort the startup process every time I power on my meter. Eventually I need to figure out how to re-program the kernel bootloader parameters, as those seemed messed up as well.Code:Starting kernel ...Debug serial initialized ........OKNo RTC on 320Microsoft Windows CE Bootloader Common Library Version 1.4 Built May 22 2012 09:09:57Microsoft Windows CE 6.0 Ethernet Bootloader for the Agilent P500 boardAdaptation performed by Agilent Technologies (c) 2008Reading NAND configurationFMD_DirectRead : Offset must be sector aligned !!CRC does not match for NAND 6042A00 F69E122EERROR : Bootloader setting load failedINFO : Loading default bootloader settingsPress  to launch image stored in flash or  to cancel.Initiating image launch in 0 secondsSystem ready!Preparing for download...No RTC on 320Loading image 3 from memory at 0x84000000BL_IMAGE_TYPE_BINXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXrom_offset=0x0.XXImageStart = 0x80361000, ImageLength = 0x1856D34, LaunchAddr = 0x80362000

author: dc101
author_rank: Regular Contributor
timestamp: March 29, 2021, 05:02:40 pm
content: Quote from: Dr. Frank on March 29, 2021, 06:48:10 amThe NAND flash appear to be the same between units. I checked the Micron FBGA codes and they both resolve to the same part number, with the exception of the 34470A NAND being a "premium lifecycle product" but as far as the rest of the part number and FLASH layout, exactly the same.34461A Micron PN: MT29F1G08ABADAH4-IT:D34470A Micron PN: MT29F1G08ABADAH4-ITX:DDatasheet:https://www.micron.com/-/media/client/global/documents/products/data-sheet/nand-flash/60-series/m68a_1gb_nand.pdf-Tim

author: dc101
author_rank: Regular Contributor
timestamp: March 29, 2021, 11:19:47 pm
content: I believe 6thimage suggested that the model and serial number might possibly be stored in the NXP, and I think I found a hint today that he might be correct.Occasionally after loading nk.bin, sometimes I get several decrypt errors. Looking closer, I noticed a rather interesting lineFP:Platform identified as NXP 8051-type based on 0 mVLooks like I'll have to look into that NXP serial port after all.Code:#################### dllEntry ###########################Decrypt(1): CryptDecrypt failed - NTE_BAD_DATA : -2146893819Decrypt(2c): Decryption failed - NTE_BAD_DATA : -2146893819Decrypt(1): CryptDecrypt failed - NTE_BAD_DATA : -2146893819Decrypt(2c): Decryption failed - NTE_BAD_DATA : -2146893819modelNumberW = 000000rtnCode = 0Decrypt(1): CryptDecrypt failed - NTE_BAD_DATA : -2146893819Decrypt(2c): Decryption failed - NTE_BAD_DATA : -2146893819modelNumberW = 000000rtnCode = 0Decrypt(1): CryptDecrypt failed - NTE_BAD_DATA : -2146893819Decrypt(2c): Decryption failed - NTE_BAD_DATA : -2146893819modelNumberW = 000000rtnCode = 0Decrypt(1): CryptDecrypt failed - NTE_BAD_DATA : -2146893819Decrypt(2c): Decryption failed - NTE_BAD_DATA : -2146893819modelNumberW = 000000rtnCode = 0Decrypt(1): CryptDecrypt failed - NTE_BAD_DATA : -2146893819Decrypt(2c): Decryption failed - NTE_BAD_DATA : -2146893819modelNumberW = 000000rtnCode = 0FP:Platform identified as NXP 8051-type based on 0 mVFP:Platform identified as NXP 8051-type based on 0 mVSER2 Serial Port, new baud rate:0x12c0 (UARTCLK:83250000 IBRD:0x43b FBRD:0x3e)Decrypt(1): CryptDecrypt failed - NTE_BAD_DATA : -2146893819Decrypt(2c): Decryption failed - NTE_BAD_DATA : -2146893819Decrypt(1): CryptDecrypt failed - NTE_BAD_DATA : -2146893819Decrypt(2c): Decryption failed - NTE_BAD_DATA : -2146893819serialNumberW = 0000000000rtnCode = 0Decrypt(1): CryptDecrypt failed - NTE_BAD_DATA : -2146893819Decrypt(2c): Decryption failed - NTE_BAD_DATA : -2146893819serialNumberW = 0000000000rtnCode = 0Decrypt(1): CryptDecrypt failed - NTE_BAD_DATA : -2146893819Decrypt(2c): Decryption failed - NTE_BAD_DATA : -2146893819serialNumberW = 0000000000rtnCode = 0Decrypt(1): CryptDecrypt failed - NTE_BAD_DATA : -2146893819Decrypt(2c): Decryption failed - NTE_BAD_DATA : -2146893819serialNumberW = 0000000000rtnCode = 0SER2 Read timeoutFP:FAILED IOCTL_SER2_READ_WITH_TIMEOUT Decrypt(1): CryptDecrypt failed - NTE_BAD_DATA : -2146893819Decrypt(2c): Decryption failed - NTE_BAD_DATA : -2146893819serialNumberW = 0000000000rtnCode = 0SER2 Read timeout

author: analogRF
author_rank: Super Contributor
timestamp: July 29, 2023, 08:41:31 pm
content: sorry I have to revive this old thread. One of my two 34461A which has not been used for about 4 or 5 month is not booting up anymore. The Keysight logo screen appears and then stays. Here is the boot log:Code:U-Boot 2010.03 (Dec 04 2017 - 01:41:53)Agilent P510CPU: SPEAr320DRAM: 128 MiBUnknown id: 0xffffff. Using ST_M23P40Flash: 64 KiBNAND: INTERNAL ECC 128 MiBIn: serialOut: serialErr: serialSerNum:MY99999999Chip: AA Board Rev: 4init RTC: 2023-07-28 15:47:59.57Net: No ethernet found.splash RTC: 2023-07-28 15:48:00.60Press space to stop autoboot: 0NAND read: device 0 offset 0x320000, size 0x1000065536 bytes read: OK## Booting kernel from Legacy Image at 00600000 ...Image Name: PBOOTCreated: 2012-05-22 16:06:43 UTCImage Type: ARM Linux Kernel Image (gzip compressed)Data Size: 38780 Bytes = 37.9 KiBLoad Address: 00000000Entry Point: 00000000Uncompressing Kernel Image ... OKStarting kernel ...Debug serial initialized ........OKNo RTC on 320Microsoft Windows CE Bootloader Common Library Version 1.4 Built May 22 2012 09:09:57Microsoft Windows CE 6.0 Ethernet Bootloader for the Agilent P500 boardAdaptation performed by Agilent Technologies (c) 2008Reading NAND configurationFMD_DirectRead: Invalid block at sector 0x180 bumping by 0x40 sectorsFMD_DirectRead: Invalid block at sector 0x1c0 bumping by 0x40 sectorsFMD_DirectRead: Invalid block at sector 0x200 bumping by 0x40 sectorsFMD_DirectRead: Invalid block at sector 0x240 bumping by 0x40 sectorsFMD_DirectRead: Invalid block at sector 0x280 bumping by 0x40 sectorsFMD_DirectRead: Invalid block at sector 0x2c0 bumping by 0x40 sectorsFMD_DirectRead: Invalid block at sector 0x300 bumping by 0x40 sectorsFMD_DirectRead: Invalid block at sector 0x340 bumping by 0x40 sectorsFMD_DirectRead: Invalid block at sector 0x380 bumping by 0x40 sectorsFMD_DirectRead: Invalid block at sector 0x3c0 bumping by 0x40 sectorsFMD_DirectRead: Invalid block at sector 0x400 bumping by 0x40 sectorsFMD_DirectRead: Invalid block at sector 0x440 bumping by 0x40 sectorsFMD_DirectRead: Invalid block at sector 0x480 bumping by 0x40 sectorsFMD_DirectRead: Invalid block at sector 0x4c0 bumping by 0x40 sectorsFMD_DirectRead: Invalid block at sector 0x500 bumping by 0x40 sectorsFMD_DirectRead: Invalid block at sector 0x540 bumping by 0x40 sectorsFMD_DirectRead: Invalid block at sector 0x580 bumping by 0x40 sectorsFMD_DirectRead: Invalid block at sector 0x5c0 bumping by 0x40 sectorsFMD_DirectRead: Invalid block at sector 0x600 bumping by 0x40 sectorsFMD_DirectRead: Invalid block at sector 0x640 bumping by 0x40 sectorsFMD_DirectRead: Invalid block at sector 0x680 bumping by 0x40 sectorsFMD_DirectRead: Invalid block at sector 0x6c0 bumping by 0x40 sectorsFMD_DirectRead: Invalid block at sector 0x700 bumping by 0x40 sectorsFMD_DirectRead: Invalid block at sector 0x740 bumping by 0x40 sectors....FMD_DirectRead: Invalid block at sector 0xfc80 bumping by 0x40 sectorsFMD_DirectRead: Invalid block at sector 0xfcc0 bumping by 0x40 sectorsFMD_DirectRead: Invalid block at sector 0xfd00 bumping by 0x40 sectorsFMD_DirectRead: Invalid block at sector 0xfd40 bumping by 0x40 sectorsFMD_DirectRead: Invalid block at sector 0xfd80 bumping by 0x40 sectorsFMD_DirectRead: Invalid block at sector 0xfdc0 bumping by 0x40 sectorsFMD_DirectRead: Invalid block at sector 0xfe00 bumping by 0x40 sectorsFMD_DirectRead: Invalid block at sector 0xfe40 bumping by 0x40 sectorsFMD_DirectRead: Invalid block at sector 0xfe80 bumping by 0x40 sectorsFMD_DirectRead: Invalid block at sector 0xfec0 bumping by 0x40 sectorsFMD_DirectRead: Invalid block at sector 0xff00 bumping by 0x40 sectorsFMD_DirectRead: Invalid block at sector 0xff40 bumping by 0x40 sectorsFMD_DirectRead: Invalid block at sector 0xff80 bumping by 0x40 sectorsFMD_DirectRead: Invalid block at sector 0xffc0 bumping by 0x40 sectorsCRC does not match for NAND AFFF475B F381A23ERROR : Bootloader setting load failedINFO : Loading default bootloader settingsPress  to launch image stored in flash or  to cancel.Initiating image launch in 3 secondsP500 Boot Loader Configuration :Mac address .......... (04:02:02:20:02:02)Ip address ........... (192.168.114.201)Subnet Mask address .. (255.255.255.0)DHCP ................. (Enabled)Boot delay (seconds).. (5)Load image 3 at startupImage addresses. (0xdxxxxxxx for NAND, 0x8xxxxxxx for RAM)1 (0xd0400000)2 (0xd1700000)3 (0x84000000)l) Load memory resident image Load image 3 now1) Load memory resident image 1 now2) Load memory resident image 2 now3) Load memory resident image 3 nowd) Download from platform builder nowu) Start u-boot by resettingv) Verify Images[color=red](I press 1 here but it is the same with other choices. "v" just does not do anything and hangs)>System ready!Preparing for download...No RTC on 320Loading image 1 from memory at 0xD0400000[color=red](hangs here)here are "printenv" and "imls" outputs:Code:p510> imls********************* NOR Flash Images ****************************************** NAND Flash Images *********************Image at offset 00000000:Image Name: XLOADERCreated: 2012-05-16 23:33:58 UTCImage Type: ARM Linux Firmware (uncompressed)Data Size: 5370 Bytes = 5.2 KiBLoad Address: d2800b00Entry Point: d2800b00Verifying Checksum ... OKImage at offset 00020000:Image Name: XLOADERCreated: 2012-05-16 23:33:58 UTCImage Type: ARM Linux Firmware (uncompressed)Data Size: 5370 Bytes = 5.2 KiBLoad Address: d2800b00Entry Point: d2800b00Verifying Checksum ... OKImage at offset 00040000:Image Name: XLOADERCreated: 2012-05-16 23:33:58 UTCImage Type: ARM Linux Firmware (uncompressed)Data Size: 5370 Bytes = 5.2 KiBLoad Address: d2800b00Entry Point: d2800b00Verifying Checksum ... OKImage at offset 00060000:Image Name: XLOADERCreated: 2012-05-16 23:33:58 UTCImage Type: ARM Linux Firmware (uncompressed)Data Size: 5370 Bytes = 5.2 KiBLoad Address: d2800b00Entry Point: d2800b00Verifying Checksum ... OKImage at offset 00100000:Image Name: UBOOTCreated: 2017-12-04 8:50:24 UTCImage Type: ARM Linux Kernel Image (uncompressed)Data Size: 237800 Bytes = 232.2 KiBLoad Address: 03f00000Entry Point: 03f00000Verifying Checksum ... OKImage at offset 00320000:Image Name: PBOOTCreated: 2012-05-22 16:06:43 UTCImage Type: ARM Linux Kernel Image (gzip compressed)Data Size: 38780 Bytes = 37.9 KiBLoad Address: 00000000Entry Point: 00000000Verifying Checksum ... OKCode:p510> printenvramboot=dhcp 0x4000000 nk.bin;run bootcmdbaudrate=115200gatewayip=192.168.1.10netmask=255.255.255.0chipversion=AAboardversion=4ftp=dhcpbootdelay=0ecc=4cnfg_vmc_input_pin=mw 0xb3000028 0x00040300 1;mw 0xb3000048 0xfffbffff 1cnfg_lan_input_pin=mw 0xb3000030 0x00000008 1;mw 0xb3000050 0xFFFFFFFF 1;mw 0xb3000018 0x00000101preboot=mw.l 0xb300000c 0xffffacf4; run cnfg_lan_input_pin; run cnfg_vmc_input_pin; splash loaddispParm1=110 1e0 989680 0 28dispParm2=1 1 1 1 3numinstimages=1pbootdelay=0fimage=1nimages=2image1=0xd0620000image2=0xd2120000fsstart=0x3020000numfilesystems=2lengthfilesystem1=0x4EE0000lengthfilesystem2=0x100000bootcmd=nand read 0x600000 0x320000 0x10000;bootm 0x600000uart2=1rtc=1ps=0splashdata=0xd0180000erase_env=nand erase 0xC0000 0x40000store_xloader=xload 0x800000get_xload_eth=dhcp 0x800000 xloader-p510.bin; run store_xloaderstore_uboot=nand erase 0x100000 ${blocksize}; nand write 0x800000 0x100000 ${blocksize}get_uboot_eth=dhcp 0x800000 u-boot-p510.bin;run store_ubootstore_pboot=nand erase 0x320000 ${blocksize}; nand write 0x800000 0x320000 ${blocksize}get_pboot_eth=dhcp 0x800000 pboot.bin;run store_pbootflash_nkbin=dhcp 0x4000000 nk.bin;nand erase 0x00620000 ${blocksize};nand write 0x4000000 0x00620000 ${blocksize}usbtty=cdc_acmethaddr=80:09:02:0e:7a:4fserialnum=MY99999999serverip=10.0.0.242verify=nstdin=serialstdout=serialstderr=serialipaddr=192.168.1.179guid={61341e9e-af36-b347-ae05-3a404c2cd9c0}Environment size: 1482/16380 bytesI downloaded the P-Boot from NAND and compared to one I downloaded from my good meter and also the ones posted here in this thread by TheSteve and Dr.Frank and they are all exactly identical.I extracted "nk.nb0" from the firmware Nk.bin file (using bincompress and then cvrtbin tools that I had used when I was recovering my DSOX3034A from nand corruption) and then I used YMODEM to upload the nk.nb0 into memory and boot it from 0x362000 .The meter boots normally and everything is hunky dory. S/N and FW revision all fine, the meter works great and passes selftests etc...So I upgraded (I should say re flashed) same FW 3.03 into the unit using the Keysight FW update Utility (LAN connection) and you can see in the attached photoall goes well and when the unit is rebooted I am back exactly at where I was in the beginningEverytime it take 40 minutes to upload the nk.nb0 back into the unit using YMODEM to boot it and after FW update (also did using USB stick) it reboots to the same original state.I am totally at loss here....it seems the flash is bad but rewriting the FW should have fixed it...I noticed that the image addresses in u-boot (see the last lines of the boot log) are d0400000 and d1700000 but in the printenv you can see the images must be at d0620000 and d2120000.I downloaded few kilobytes of the NAND at d0620000 and it contains EXACTLY the Nk.bin file in the firmware (compressed). Also at d2120000 there is compressed Nk.bin file but I think it must be an earlier versionHowever at d0400000 there is absolutely nothing in NAND (FFFFFF for a while) and at d1700000 I can see it is the last mega byte of the Nk.bin file which started at d0620000.So if the unit actually tries to read image from d0400000 or d1700000 then obviously it must fail.I dont know how to check these addresses on my good meter.I am at total loss here now...it's been 3 days of trying YMODEM 40 minutes each time and then no joy....any help is highly appreciated

author: analogRF
author_rank: Super Contributor
timestamp: July 29, 2023, 10:14:17 pm
content: so far at least I managed to get rid of the stupid YMODEM and used CEloader.exe to upload the uncompressed nk.bin fileto the meter after it fails to boot and I have the option to boot from platform builder. thats 1000 times faster than YMODEMbut still the problem remains. after successfully booting the meter and re -flashing firmware, it reboots into the exact same conditionI am now fairly convinced that the unit tries to load image #1 at d0400000 which is the wrong address. It must be d0620000and I know for fact that there lies a good FW image at d0620000. I have checked it.I just do not know where the unit is getting those wrong addresses from.Even the RAM address 84000000 (image #3) is wrong and it must be 80361000any idea?

author: analogRF
author_rank: Super Contributor
timestamp: July 29, 2023, 10:31:14 pm
content: I managed to get into the bootloader menu on my good meter (you must be very quick in pressing the space after bootcmd command) and as I expected, there the image addresses are d0620000 and d2120000 which matches the env variables. and also the "v" command (verify images) works but on my bad meter the image addresses are wrong and the verify command just hangs and i have to power down.definitely the unit tries to read image from wrong address.where are the bootloader parameters stored?I checked my p-boot dump and it is exactly identical to the good meter

author: analogRF
author_rank: Super Contributor
timestamp: July 29, 2023, 10:51:01 pm
content: does anybody know where is the 64kB flash memory indicated in the u-boot:Code:CPU: SPEAr320DRAM: 128 MiBUnknown id: 0xffffff. Using ST_M23P40Flash: 64 KiBNAND: INTERNAL ECC 128 MiBthere is not flash memory on the board. Just the NAND and RAM.

author: analogRF
author_rank: Super Contributor
timestamp: July 30, 2023, 01:42:28 am
content: even the difference between the wrong image addresses is about 19MB which is too small. I mean if one image would have been at d0400000 it would have overlapped with the second image.where does pboot gets it boot parameters from?I just noticed that when the bootloader stops it also reports a false MAC address04:02:02:20:02:02instead of the correct one 80:09:02:0e:7a:4fnonetheless I am able to use "download from platform builder" option to get the nk.bin file over the ethernet and boot the meter. It gets IP using the wrong MAC address. But after booting, the meter shows the correct mac address!?So it is reading whole bunch of wrong boot parameters from somewhere...

author: tv84
author_rank: Super Contributor
timestamp: July 30, 2023, 10:52:37 am
content: @ElectronMan or @TheSteve might give you a hand here.

author: coromonadalix
author_rank: Super Contributor
timestamp: July 30, 2023, 12:17:27 pm
content: mabe searching windows CE or embedded booting processes could give an hint ??

author: analogRF
author_rank: Super Contributor
timestamp: July 30, 2023, 12:29:28 pm
content: Quote from: tv84 on July 30, 2023, 10:52:37 amI hope they come here and have a lookFWIW here is the .bin file of the P-Boot taken from my good 34461A and it is identical to the one from the bad meterand also identical to those posted earlier in this thread by othersI am not able to figure out where it is getting its boot parameters from. Certainly not from the environment variablesbecause they are ok. Unless there is another hidden copy of them which is bad?

author: ElectronMan
author_rank: Regular Contributor
timestamp: July 30, 2023, 04:05:51 pm
content: Quote from: analogRF on July 30, 2023, 12:29:28 pmThis looks like a problem with the CE bootloader (the stage after Uboot) or the flash. It could be that part of the NAND flash is completely unusable.Do you happen to have the output when updating firmware? Are there any errors while writing the image?

author: analogRF
author_rank: Super Contributor
timestamp: July 30, 2023, 04:11:50 pm
content: Quote from: ElectronMan on July 30, 2023, 04:05:51 pmyes the bootloader is reading wrong parameters (image address, mac address, ...are all wrong)when the unit was updating FW the UART was connected but there were no messages.as far as I can tell the part of FW update that finished was just copying the Nk.bin (original from the FW pack) into d0620000 and I can see it is there and seems to be correct. But I guess the FW will also do some stuff after rebooting the unit however in this case it does not get there because on the reboot, it reads the wrong addresses and fails to boot.

author: ElectronMan
author_rank: Regular Contributor
timestamp: July 30, 2023, 04:29:30 pm
content: Quote from: analogRF on July 30, 2023, 04:11:50 pmYeah, it looks like it loads those parameters from a location that it can't read right now, so loads those incorrect settings instead.:Code:CRC does not match for NAND AFFF475B F381A23ERROR : Bootloader setting load failedINFO : Loading default bootloader settingsI am trying to locate this config information

author: analogRF
author_rank: Super Contributor
timestamp: July 30, 2023, 04:54:24 pm
content: what is interesting is that earlier in the thread where@dc101had very similar issue as mine, he also reported the pboot is thinking image addresses are d0400000 and d1700000 exactly like my unit!I have also seen a similar issue in some broken 3000A scopes that also reported image address at d0400000 which again wrong for those scopes.

author: analogRF
author_rank: Super Contributor
timestamp: July 30, 2023, 05:12:21 pm
content: FWIW when I get the pboot prompt to choose how to boot and I choose option "d" (download from platform builder) here is the boot log until the unit is fully booted and the meter works perfectly after that for hours until I turn it offCode:......FMD_DirectRead: Invalid block at sector 0xffc0 bumping by 0x40 sectorsCRC does not match for NAND AF7F475B 3665EF2ERROR : Bootloader setting load failedINFO : Loading default bootloader settingsPress  to launch image stored in flash or  to cancel.Initiating image launch in 5 secondsP500 Boot Loader Configuration :Mac address .......... (04:02:02:20:02:02)Ip address ........... (192.168.114.201)Subnet Mask address .. (255.255.255.0)DHCP ................. (Enabled)Boot delay (seconds).. (5)Load image 3 at startupImage addresses. (0xdxxxxxxx for NAND, 0x8xxxxxxx for RAM)1 (0xd0400000)2 (0xd1700000)3 (0x84000000)l) Load memory resident image Load image 3 now1) Load memory resident image 1 now2) Load memory resident image 2 now3) Load memory resident image 3 nowd) Download from platform builder nowu) Start u-boot by resettingv) Verify Images>System ready!Preparing for download...No RTC on 320Downloading image from platform builderSetting MAC address GMAC_MAC_ADDR_HI_LO = 0x80000202, GMAC_MAC_ADDR_HI_LO = 0x20020204Auto Negotiation complete in 120192 iterationsLink upAutoNegotiate Full DuplexAutoNegotiate 100 Base TReading MAC address 0x402 0x220 0x202Setting MAC address GMAC_MAC_ADDR_HI_LO = 0x80000202, GMAC_MAC_ADDR_HI_LO = 0x20020204INFO: GMAC Ethernet controller initialized.InitDHCP():: Calling ProcessDHCP()ProcessDHCP()::DHCP_INITGot Response from DHCP server, IP address: 10.0.0.13ProcessDHCP()::DHCP IP Address Resolved as 10.0.0.13, netmask: 255.255.255.0Lease time: 172800 secondsGot Response from DHCP server, IP address: 10.0.0.13No ARP response in 2 seconds, assuming ownership of 10.0.0.13+EbootSendBootmeAndWaitForTftpSent BOOTME to 255.255.255.255Packet has the following data:boot.binoctetTFTP packet could have 1 name/value pairsLocked Down Link 1Src IP 10.0.0.13 Port 03D4 Dest IP 10.0.0.223 Port 0499Default TFTP block size set to: 512 bytesThere were no options detected in the TFTPEthDown::TFTPD_OPEN::boot.bin-EbootSendBootmeAndWaitForTftpBL_IMAGE_TYPE_BINXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXrom_offset=0x0.XXImageStart = 0x80361000, ImageLength = 0x185E320, LaunchAddr = 0x80362000Completed file(s):-------------------------------------------------------------------------------: Address=0x80361000 Length=0x185E320 Name="" Target=RAMLoading image 3 succeeded.ROMHDR at Address 80361044hPreparing launch...No RTC on 320Got EDBG_CMD_JUMPIMGGot EDBG_CMD_CONFIG, flags:0x00000000Launching windows CE image by jumping at address 0x 362000Windows CE Kernel for ARM (Thumb Enabled) Built on Mar 8 2013 at 17:05:33Setting up for a Cold RebootDone Setting up for a Cold RebootWindows CE Firmware InitBSP 1.0.0 for the SPEARHEAD600AB board (built Jul 2 2021)Adaptation performed by ADENEO (c) 2005+OALIntrInit-OALIntrInit(rc = 1)Initialize driver globals Zeros area...pDrvGlobalArea 0xa0060000 size 0x800 (0xa0060800 -0xa0060000)Initialize driver globals Zeros area...doneOALKitlStartFirmware Init Done.OALIoctlHalEnterI2cCriticalSection init i2c csERROR: C:\WINCE600\PLATFORM\COMMON\SRC\SOC\STM\SPEARHEAD600\DRIVERS\NandFlash\.\sh600_NandFlash.c line 57: ConfigTimming - Unable to opeyERROR: C:\WINCE600\PLATFORM\COMMON\SRC\SOC\STM\COMMON\DRIVERS\NandFlash\.\stm_NandFlash.c line 1043: LLD_GetInfo - Unable to open devicey++SER_Init: context Drivers\Active\10SER_Init, dwIndex:2GPIO_Select0 Register 0xB300_0024: 0x80000000Control Register 0xB300_0010 : 0x00000040RAS Select Register 0xB300_000C: 0xffffacf4CORE_CLK_CFG 0xB300_0024: 0x80000000SER2 got sysintr:0x00000013SER2 Serial Port, new baud rate:0x1c200 (UARTCLK:83250000 IBRD:0x2d FBRD:0xa)++SER_Init: context Drivers\Active\11SER_Init, dwIndex:3GPIO_Select0 Register 0xB300_0024: 0x80000000Control Register 0xB300_0010 : 0x00000040RAS Select Register 0xB300_000C: 0xffffacf4CORE_CLK_CFG 0xB300_0024: 0x80000000+OALIntrRequestSysIntr IRQ (1) already used by SYSINTR (19)SER3 got sysintr:0x00000014SER3 Serial Port, new baud rate:0x1c200 (UARTCLK:83250000 IBRD:0x2d FBRD:0xa)OHCI\system.c, GCFG_USBH1_SW_RSTOHCI\system.c, GCFG_USBH2_SW_RST-EDeviceLoadEeprom 80:09:02:0E:7A:4FPhy found addr 7 (ticks=5100)WaitForLink Start (ticks=5101)Link Detected (ticks=5104)GMAC Init : 100 Mbit/s FULL DUPLEX (MII)Flushed Transmit BufferphyCfg->dwSpeed 0x64<--EDeviceInitializeGMAC DMA status register = 0x600004GMAC Device enable interruptDriverStartGMAC Device enable interruptLIN: Data ValidResetting the USB-device siliconsh600_pdd, IOCTL_BUS_POSTINITERROR: C:\WINCE600\3RDPARTY\Agilent\HPP\Common\Drivers\stm320_UsbFnBusDriver\.\ufnbus.cpp line 1137: failed opening \Agilent Flash\SPD\ue6Autonegociation Start (ticks=7141)+StartAutoNegotiation: pDeviceContext 0xd0506be0Autonegociation End (ticks=9651)WaitForLink Start (ticks=9652)Link Detected (ticks=9655)GMAC Init : 100 Mbit/s FULL DUPLEX (MII)cable attachedSHIM DLL, LoadRealDll [PalSysManagement.dll] for [AgilentPalSysManagement.dll]SHIM [AgilentPalSysManagement.dll] Get Process AddressesSHIM DLL, LoadRealDll [PalIO.dll] for [AgilentPalIO.dll]SHIM [AgilentPalIO.dll] Get Process Addresses#################### dllEntry ###########################FP:Platform identified as MSP430-type based on 1182 mVFP:IdEprom File [\Windows\AgtFrontPanelIdEpromData.34460-66502.xml] does not existFP:Platform identified as MSP430-type based on 1184 mVFP:IdEprom File [\Windows\AgtFrontPanelIdEpromData.34460-66502.xml] does not existSER3 Serial Port, new baud rate:0x2faf08 (UARTCLK:83250000 IBRD:0x1 FBRD:0x2a)Inguard Bootup Complete -- OKInguardBootup Buffered Test Signal detectedFP:INVALID CID read, 0x01FP:INVALID CID read, 0xffFP:INVALID CID read, 0xffFP:INVALID CID read, 0x33FP:INVALID CID read, 0x16FP:INVALID CID read, 0x88FP:INVALID CID read, 0x6bFP:INVALID CID read, 0x40FP:DoCommand  FAILED 0xFP:DoCommand  Retry  Error was 0xFP:DoCommand  Final call Error 0xSHIM DLL, LoadRealDll [PalCaps.dll] for [AgilentPalCaps.dll]SHIM [AgilentPalCaps.dll] Get Process AddressesSHIM DLL, LoadRealDll [PalSStorage.dll] for [AgilentPalSStorage.dll]SHIM [AgilentPalSStorage.dll] Get Process AddressesSHIM DLL, LoadRealDll [PalWin32.dll] for [AgilentPalWin32.dll]SHIM [AgilentPalWin32.dll] Get Process AddressesSHIM DLL, LoadRealDll [PalWin32.dll] for [AgilentPalWin32.dll]SHIM [AgilentPalWin32.dll] Get Process AddressesSHIM DLL, LoadRealDll [PalSStorage.dll] for [AgilentPalSStorage.dll]SHIM [AgilentPalSStorage.dll] Get Process AddressesSHIM DLL, LoadRealDll [PalSysManagement.dll] for [AgilentPalSysManagement.dll]SHIM [AgilentPalSysManagement.dll] Get Process AddressesSHIM DLL, LoadRealDll [PalCaps.dll] for [AgilentPalCaps.dll]SHIM [AgilentPalCaps.dll] Get Process AddressesAgilentLxiWebStartUp successfully started LXI web service.]FMD_DirectRead: Invalid block at sector 0xfec0 bumping by 0x40 sectorsFMD_DirectRead: Invalid block at sector 0xff00 bumping by 0x40 sectorsFMD_DirectRead: Invalid block at sector 0xff40 bumping by 0x40 sectorsFMD_DirectRead: Invalid block at sector 0xff80 bumping by 0x40 sectorsFMD_DirectRead: Invalid block at sector 0xffc0 bumping by 0x40 sectorsCRC does not match for NAND AF7F475B 3665EF2ERROR : Bootloader setting load failedINFO : Loading default bootloader settingsPress  to launch image stored in flash or  to cancel.Initiating image launch in 5 secondsP500 Boot Loader Configuration :Mac address .......... (04:02:02:20:02:02)Ip address ........... (192.168.114.201)Subnet Mask address .. (255.255.255.0)DHCP ................. (Enabled)Boot delay (seconds).. (5)Load image 3 at startupImage addresses. (0xdxxxxxxx for NAND, 0x8xxxxxxx for RAM)1 (0xd0400000)2 (0xd1700000)3 (0x84000000)l) Load memory resident image Load image 3 now1) Load memory resident image 1 now2) Load memory resident image 2 now3) Load memory resident image 3 nowd) Download from platform builder nowu) Start u-boot by resettingv) Verify Images>System ready!Preparing for download...No RTC on 320Downloading image from platform builderSetting MAC address GMAC_MAC_ADDR_HI_LO = 0x80000202, GMAC_MAC_ADDR_HI_LO = 0x20020204Auto Negotiation complete in 120192 iterationsLink upAutoNegotiate Full DuplexAutoNegotiate 100 Base TReading MAC address 0x402 0x220 0x202Setting MAC address GMAC_MAC_ADDR_HI_LO = 0x80000202, GMAC_MAC_ADDR_HI_LO = 0x20020204INFO: GMAC Ethernet controller initialized.InitDHCP():: Calling ProcessDHCP()ProcessDHCP()::DHCP_INITGot Response from DHCP server, IP address: 10.0.0.13ProcessDHCP()::DHCP IP Address Resolved as 10.0.0.13, netmask: 255.255.255.0Lease time: 172800 secondsGot Response from DHCP server, IP address: 10.0.0.13No ARP response in 2 seconds, assuming ownership of 10.0.0.13+EbootSendBootmeAndWaitForTftpSent BOOTME to 255.255.255.255Packet has the following data:boot.binoctetTFTP packet could have 1 name/value pairsLocked Down Link 1Src IP 10.0.0.13 Port 03D4 Dest IP 10.0.0.223 Port 0499Default TFTP block size set to: 512 bytesThere were no options detected in the TFTPEthDown::TFTPD_OPEN::boot.bin-EbootSendBootmeAndWaitForTftpBL_IMAGE_TYPE_BINXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXrom_offset=0x0.XXImageStart = 0x80361000, ImageLength = 0x185E320, LaunchAddr = 0x80362000Completed file(s):-------------------------------------------------------------------------------: Address=0x80361000 Length=0x185E320 Name="" Target=RAMLoading image 3 succeeded.ROMHDR at Address 80361044hPreparing launch...No RTC on 320Got EDBG_CMD_JUMPIMGGot EDBG_CMD_CONFIG, flags:0x00000000Launching windows CE image by jumping at address 0x 362000Windows CE Kernel for ARM (Thumb Enabled) Built on Mar 8 2013 at 17:05:33Setting up for a Cold RebootDone Setting up for a Cold RebootWindows CE Firmware InitBSP 1.0.0 for the SPEARHEAD600AB board (built Jul 2 2021)Adaptation performed by ADENEO (c) 2005+OALIntrInit-OALIntrInit(rc = 1)Initialize driver globals Zeros area...pDrvGlobalArea 0xa0060000 size 0x800 (0xa0060800 -0xa0060000)Initialize driver globals Zeros area...doneOALKitlStartFirmware Init Done.OALIoctlHalEnterI2cCriticalSection init i2c csERROR: C:\WINCE600\PLATFORM\COMMON\SRC\SOC\STM\SPEARHEAD600\DRIVERS\NandFlash\.\sh600_NandFlash.c line 57: ConfigTimming - Unable to opeyERROR: C:\WINCE600\PLATFORM\COMMON\SRC\SOC\STM\COMMON\DRIVERS\NandFlash\.\stm_NandFlash.c line 1043: LLD_GetInfo - Unable to open devicey++SER_Init: context Drivers\Active\10SER_Init, dwIndex:2GPIO_Select0 Register 0xB300_0024: 0x80000000Control Register 0xB300_0010 : 0x00000040RAS Select Register 0xB300_000C: 0xffffacf4CORE_CLK_CFG 0xB300_0024: 0x80000000SER2 got sysintr:0x00000013SER2 Serial Port, new baud rate:0x1c200 (UARTCLK:83250000 IBRD:0x2d FBRD:0xa)++SER_Init: context Drivers\Active\11SER_Init, dwIndex:3GPIO_Select0 Register 0xB300_0024: 0x80000000Control Register 0xB300_0010 : 0x00000040RAS Select Register 0xB300_000C: 0xffffacf4CORE_CLK_CFG 0xB300_0024: 0x80000000+OALIntrRequestSysIntr IRQ (1) already used by SYSINTR (19)SER3 got sysintr:0x00000014SER3 Serial Port, new baud rate:0x1c200 (UARTCLK:83250000 IBRD:0x2d FBRD:0xa)OHCI\system.c, GCFG_USBH1_SW_RSTOHCI\system.c, GCFG_USBH2_SW_RST-EDeviceLoadEeprom 80:09:02:0E:7A:4FPhy found addr 7 (ticks=5100)WaitForLink Start (ticks=5101)Link Detected (ticks=5104)GMAC Init : 100 Mbit/s FULL DUPLEX (MII)Flushed Transmit BufferphyCfg->dwSpeed 0x64<--EDeviceInitializeGMAC DMA status register = 0x600004GMAC Device enable interruptDriverStartGMAC Device enable interruptLIN: Data ValidResetting the USB-device siliconsh600_pdd, IOCTL_BUS_POSTINITERROR: C:\WINCE600\3RDPARTY\Agilent\HPP\Common\Drivers\stm320_UsbFnBusDriver\.\ufnbus.cpp line 1137: failed opening \Agilent Flash\SPD\ue6Autonegociation Start (ticks=7141)+StartAutoNegotiation: pDeviceContext 0xd0506be0Autonegociation End (ticks=9651)WaitForLink Start (ticks=9652)Link Detected (ticks=9655)GMAC Init : 100 Mbit/s FULL DUPLEX (MII)cable attachedSHIM DLL, LoadRealDll [PalSysManagement.dll] for [AgilentPalSysManagement.dll]SHIM [AgilentPalSysManagement.dll] Get Process AddressesSHIM DLL, LoadRealDll [PalIO.dll] for [AgilentPalIO.dll]SHIM [AgilentPalIO.dll] Get Process Addresses#################### dllEntry ###########################FP:Platform identified as MSP430-type based on 1182 mVFP:IdEprom File [\Windows\AgtFrontPanelIdEpromData.34460-66502.xml] does not existFP:Platform identified as MSP430-type based on 1184 mVFP:IdEprom File [\Windows\AgtFrontPanelIdEpromData.34460-66502.xml] does not existSER3 Serial Port, new baud rate:0x2faf08 (UARTCLK:83250000 IBRD:0x1 FBRD:0x2a)Inguard Bootup Complete -- OKInguardBootup Buffered Test Signal detectedFP:INVALID CID read, 0x01FP:INVALID CID read, 0xffFP:INVALID CID read, 0xffFP:INVALID CID read, 0x33FP:INVALID CID read, 0x16FP:INVALID CID read, 0x88FP:INVALID CID read, 0x6bFP:INVALID CID read, 0x40FP:DoCommand  FAILED 0xFP:DoCommand  Retry  Error was 0xFP:DoCommand  Final call Error 0xSHIM DLL, LoadRealDll [PalCaps.dll] for [AgilentPalCaps.dll]SHIM [AgilentPalCaps.dll] Get Process AddressesSHIM DLL, LoadRealDll [PalSStorage.dll] for [AgilentPalSStorage.dll]SHIM [AgilentPalSStorage.dll] Get Process AddressesSHIM DLL, LoadRealDll [PalWin32.dll] for [AgilentPalWin32.dll]SHIM [AgilentPalWin32.dll] Get Process AddressesSHIM DLL, LoadRealDll [PalWin32.dll] for [AgilentPalWin32.dll]SHIM [AgilentPalWin32.dll] Get Process AddressesSHIM DLL, LoadRealDll [PalSStorage.dll] for [AgilentPalSStorage.dll]SHIM [AgilentPalSStorage.dll] Get Process AddressesSHIM DLL, LoadRealDll [PalSysManagement.dll] for [AgilentPalSysManagement.dll]SHIM [AgilentPalSysManagement.dll] Get Process AddressesSHIM DLL, LoadRealDll [PalCaps.dll] for [AgilentPalCaps.dll]SHIM [AgilentPalCaps.dll] Get Process AddressesAgilentLxiWebStartUp successfully started LXI web service.the MAC address is wrong at this point but when the meter boots it has the correct MAC address and its IP becomes 10.0.0.7instead of 10.0.0.13

author: ElectronMan
author_rank: Regular Contributor
timestamp: July 30, 2023, 05:36:20 pm
content: Quote from: analogRF on July 29, 2023, 10:14:17 pmThe PBOOT loader is trying to read the config from sector 0x180 in flash. It appears to be using flash page-sized sectors of 2048 bytes, so that puts it at the beginning of the 7th flash block at byte 0xC0000. In my flash, that contains this config, with a CRC32 in the first 4 bytes. It looks similar to the UBOOT config, but is null-separated (I've attached a copy). If you can read that flash location and see what is there, it may illuminate things.With any luck, that block just needs rewritten.

author: analogRF
author_rank: Super Contributor
timestamp: July 30, 2023, 06:01:05 pm
content: Quote from: ElectronMan on July 30, 2023, 05:36:20 pmyes it seems a duplicate of the environment variables that I see in uboot and everything looks normal exactly like what I see in the uboot variablesthe image addresses and MAC are correct.note that I had changed my ipaddr variable to 10.0.0.242 (my tftp server) the default value is 000.000.000.000but it is not related to the problemis it possible that this is the place that uboot environment variables are stored? which we can see by printenv command. Because it is exactly those information

author: ElectronMan
author_rank: Regular Contributor
timestamp: July 30, 2023, 06:31:46 pm
content: Quote from: analogRF on July 30, 2023, 06:01:05 pmIt is likely, if they are sharing the config. If you change a variable in uboot, does it change at that flash location?On a related note, have you tried changing the uboot config since the problem started? The reason I ask, is because page ECC data is re-written with the data. So if for some reason PBOOT is seeing bad ECC on that page, re-writing it by a config change may fix it.

author: analogRF
author_rank: Super Contributor
timestamp: July 30, 2023, 06:32:15 pm
content: but wait a second, I only changed "serverip" variable to 10.0.0.242 and never touched "ipaddr" variable. Also in my uboot variable I see that ipaddr variable still has its factory value like yours. However it shows different in this dumpAlso I notice that at the end of the dump it looks weird.... like " ..} ..c}..." looks out of place, no?

author: analogRF
author_rank: Super Contributor
timestamp: July 30, 2023, 06:34:35 pm
content: Quote from: ElectronMan on July 30, 2023, 06:31:46 pmthe only thing that I had done was just changed "serverip" variable to my tftp server address because at that point I though I could recover it through tftp which was stupid because there is no lan available but other than that no. I have not played with uboot variables anymore

author: analogRF
author_rank: Super Contributor
timestamp: July 30, 2023, 06:36:17 pm
content: Quote from: ElectronMan on July 30, 2023, 05:36:20 pmI cannot reproduce your CRC32 checksum so that I can check mine.but the end of that dump looks out of place to me

author: ElectronMan
author_rank: Regular Contributor
timestamp: July 30, 2023, 06:39:22 pm
content: Quote from: analogRF on July 30, 2023, 06:36:17 pmYour checksum is good assuming you had 00's out to the end of that sector. I had to pad it out with zeros to the end of that page (like it should be in your flash). If the rest of that sector is not filled with 00's in your copy, then something is wrong.

author: analogRF
author_rank: Super Contributor
timestamp: July 30, 2023, 06:46:36 pm
content: I changed that serverip back to its original value and actually when you run "saveenv" in uboot it in fact erases one page of nand at that 0xC0000 address and writes the variables back into that place. Messages on screen are clearly saying this.So 0xC0000 is in fact where the uboot variables are stored.Now I am not sure pboot is getting its parameters from there

author: ElectronMan
author_rank: Regular Contributor
timestamp: July 30, 2023, 06:56:12 pm
content: Quote from: analogRF on July 30, 2023, 06:46:36 pmSo since they are sharing the config, there must be some other reason PBOOT doesn't like that block the data is stored in, that does not bother UBOOT.Looking at the PBOOT code, I am trying to find where it checks the ECC/Error status flag and not finding it so far. I am starting to wonder if they are storing their own data in the spare area of that page that might be corrupted.

author: analogRF
author_rank: Super Contributor
timestamp: July 30, 2023, 06:56:21 pm
content: I changed "serverip" back to its original value and ran "saveenv" and dumped the nand at 0xC0000 againhere is the new dump. saveenv actually writes the variables in this place. so no surprises therethis time I dumped a whole page 2048 bytes but still I cannot get the CRC32

author: ElectronMan
author_rank: Regular Contributor
timestamp: July 30, 2023, 07:12:10 pm
content: Quote from: analogRF on July 30, 2023, 06:56:21 pmSorry, my fault, that is more than a whole page that is CRC'd. It runs to the end of all the 0's in my flash. The total data length for the CRC32 should be 0x3FFC (0x4000 minus the CRC32 at the beginning).Also, I mentioned ECC before, this flash chip does not seem to have ECC, so that increases my suspicions they are doing something else, possibly in the spare area, for data integrity.I am seeing what appears to be checking of the SPARE area (64 bytes past the end of the page) on page reads.

author: analogRF
author_rank: Super Contributor
timestamp: July 30, 2023, 07:23:04 pm
content: Quote from: ElectronMan on July 30, 2023, 07:12:10 pmI remember back in 3000A scope thread there was talk of spare/duplicate copy of the env variables. I think@tv84had posted its location address but I cannot remember where it was. With similarities between these two instruments at boot time I also suspected there is another copy of these somewhere else and pboot it using those when it does not match the one at 0xc0000

author: ElectronMan
author_rank: Regular Contributor
timestamp: July 30, 2023, 07:44:01 pm
content: Quote from: analogRF on July 30, 2023, 07:23:04 pmIt does support falling back to a backup config, but I don't see any other copies. That is probably optional (which would be why yours isn't attempting to load it). What does the spare area after that first page of the config look like?

author: analogRF
author_rank: Super Contributor
timestamp: July 30, 2023, 07:49:39 pm
content: Quote from: ElectronMan on July 30, 2023, 07:44:01 pmall 00 all the way up to 0xC4000still no luck in reproducing the crc32 though

author: ElectronMan
author_rank: Regular Contributor
timestamp: July 30, 2023, 07:56:56 pm
content: Quote from: analogRF on July 30, 2023, 07:49:39 pmAre you certain you are reading the spare area? It is the extra 0x40 (64) bytes after the end of the 0x800 byte page. How were you reading the flash?There is definitely some calculation it is doing with the spare area in the code before it decides it is a bad block... I am just not sure what algorithm it is using.

author: analogRF
author_rank: Super Contributor
timestamp: July 30, 2023, 08:01:57 pm
content: Quote from: ElectronMan on July 30, 2023, 07:56:56 pmI could be quite wrong about this. So here is what I did for this last dump:Code:p510> nand read 0x800000 0xc0000 0x4000..p510> md.b 0x800000 0x4000so 0x4000 in the nand read might not mean the same as 0x4000 in the memory read?

author: analogRF
author_rank: Super Contributor
timestamp: July 30, 2023, 08:03:51 pm
content: for the previous dump I used 0x800 instead of 0x4000 in nand readbut as you see the length of the file is 0x4000 and the first 4 bytes are crc32 and that leaves 0x3ffc of data as you suggested

author: analogRF
author_rank: Super Contributor
timestamp: July 30, 2023, 08:21:41 pm
content: ok for crc calculation I skip the first 4 bytes and select everything all the way up to 0x83F and do a crc32i also tried selecting up to 0x7FF and also up to 0x3FFF and I never get those 4 bytesI am using HxD hex editor to do that

author: ElectronMan
author_rank: Regular Contributor
timestamp: July 30, 2023, 08:25:16 pm
content: Quote from: analogRF on July 30, 2023, 08:03:51 pmQuote from: analogRF on July 30, 2023, 08:03:51 pmI would guess that command is not including the spare area, as that is stored at a "lower level" on the flash and is usually not used by applications.Every page is actually 0x840 bytes long. the last 0x40 bytes is typically used to store meta data (bad blocks, ECC information, etc) and is usually invisible for higher-level operations.Looking at the code, I see what appears to be some software-implemented ECC check that is operating on the spare pages, just before the program decides to throw up that block read failure.My guess is that data is not checking out, and causing the PBOOT to report a failure, despite the data actually being good.UBOOT may not be implementing this check.

author: ElectronMan
author_rank: Regular Contributor
timestamp: July 30, 2023, 08:29:14 pm
content: Quote from: analogRF on July 30, 2023, 08:21:41 pmI am starting at 0xc0000 + 4 to skip the CRC, then running to 0xC3FF. The CRC32 is good on my area when I do that, and is also good on yours if I pad it out to that length with 00's (you didn't send me the whole thing to test).So is there anything in there to the end of that area that isn't 00? I am using the CRC-32 in 010 Editor.

author: analogRF
author_rank: Super Contributor
timestamp: July 30, 2023, 08:31:04 pm
content: I can use the nand dump command which only dumps one page 0x800 at a time but it also dumps the out of band (.oob) data for that pageis that what you mean?

author: ElectronMan
author_rank: Regular Contributor
timestamp: July 30, 2023, 08:32:43 pm
content: There is a slight chance, that rewriting all the pages in that block could cause the it to re-write the spare area ECC calculations. But that depends on whether the ting you are using to re-write those areas actually implements the ECC algorithm and updates it.The idea would be that you write that block back exactly as it already exists, and see if the writing process takes care of whatever errors are present in the spare.In my flash, that entire block is just the config padded by 0s followed by empty space.

author: ElectronMan
author_rank: Regular Contributor
timestamp: July 30, 2023, 08:33:14 pm
content: Quote from: analogRF on July 30, 2023, 08:31:04 pmYes, oob is another name for the spare, so that should do the trick.

author: analogRF
author_rank: Super Contributor
timestamp: July 30, 2023, 08:44:49 pm
content: Quote from: ElectronMan on July 30, 2023, 08:33:14 pmI added those extra 0x40 bytes to the end of the 0x800 bytes page and made a bin file (attached)still not getting those starting 4 bytes as CRC32

author: ElectronMan
author_rank: Regular Contributor
timestamp: July 30, 2023, 08:46:17 pm
content: Quote from: analogRF on July 30, 2023, 08:35:27 pmThanks. That looks significantly different than mine.I think what I am going to suggest is that you dump the entire block (64 * 2048 byte pages) starting at that 0xc0000 offset and then re-write exactly the same block back to flash if you can under the Uboot prompt.Unless there is some actual physical flash damage, that should get the spare areas back in sync for the block.Of course, this is taking a risk, so usual disclaimer here...

author: analogRF
author_rank: Super Contributor
timestamp: July 30, 2023, 08:49:25 pm
content: Quote from: ElectronMan on July 30, 2023, 08:46:17 pmoh no you looked at the wrong file, I messed up there and deleted that message alreadyplease look at the bin file I just posted. change the extension to .bin

author: analogRF
author_rank: Super Contributor
timestamp: July 30, 2023, 08:51:39 pm
content: the file i posted earlier and you looked at was supposed to be this one here but I dont know what happenedit is just the plain text. Then I made a bin file from it and posted above

author: ElectronMan
author_rank: Regular Contributor
timestamp: July 30, 2023, 08:57:49 pm
content: Quote from: analogRF on July 30, 2023, 08:49:25 pmLooks the same. (I had taken the text and copied it into my hex editor to reproduce it).The disturbing thing is that looking at your boot process, it basically told you that every block up to the end of flash from there has the same issue, which points to possible physical damage.I would still try rewriting that block and see if the error clears for that one, but you may have other errors if that fixes the boot config block.

author: analogRF
author_rank: Super Contributor
timestamp: July 30, 2023, 09:01:42 pm
content: it does not look out of ordinary to meby the way, if i want to dump the nand and write it back into the nand in ubootI cannot write into those out of band areas. "nand dump" dumps one page at a time with those oobbut nand write has no way of writing in those oob area unless they are calculated automatically and updated by the nand controllerin that case I can just read the data by nand read and write it back instead of sumping one page at a timeI am only concerned about nand write command because still I am not sure what is the third parameteris it a page size or is it # of bytes or some other block size? that scares me

author: analogRF
author_rank: Super Contributor
timestamp: July 30, 2023, 09:03:37 pm
content: can you point me to what errors/problems you see in that last bin file with .oob data?

author: ElectronMan
author_rank: Regular Contributor
timestamp: July 30, 2023, 09:07:13 pm
content: Quote from: analogRF on July 30, 2023, 09:03:37 pmWithout knowing the exact structure they are using, I can't say what is wrong with it exactly, except that the structure appears to be different. There could be a lot of reasons for this. See my spare on the first page for the config below.Code:FF FF FF FF FF FF FF FF 95 A5 6A 69 59 FF FF FF6A F3 3F CC FF FF FF FF FF FF FF FF FF FF FF FFFF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FFFF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FFYours has more actual data in it, and is only filling the one side. Since these are structured in a very specific way, it is unusual to see such a large difference.

author: ElectronMan
author_rank: Regular Contributor
timestamp: July 30, 2023, 09:09:00 pm
content: Quote from: analogRF on July 30, 2023, 09:01:42 pmDO NOT try to write the OOB data. Just rewrite the block normally. The functions that write the block SHOULD calculate the data that needs to go into the OOB and write it for you!

author: ElectronMan
author_rank: Regular Contributor
timestamp: July 30, 2023, 09:14:00 pm
content: Quote from: ElectronMan on July 30, 2023, 09:09:00 pmFrom what I can see in the uboot help, the commands should be similar to the read command.Have you tried the "nand bad" command to see if any bad blocks are known?You could also try writing this to the NEXT block assuming it is completely blank already. If you noticed during bootup, it does try the next block all the way to the end of flash.

author: analogRF
author_rank: Super Contributor
timestamp: July 30, 2023, 09:16:49 pm
content: Quote from: ElectronMan on July 30, 2023, 09:09:00 pmyeah but still I am not quite sure how the nand write command behaves. Is it taking # of bytes for the size parameter or number of 2kB pages or some other block sizeFor example, in the uboot variables I see some commands like this:Code:nand erase 0x00620000 ${blocksize};nand write 0x4000000 0x00620000 ${blocksize}but i cannot find where the blocksize was defined.Help on nand commands in uboot gives me this:Code:p510> help nandnand - NAND sub-systemUsage:nand info - show available NAND devicesnand device  - show or set current devicenand read - addr off|partition sizenand write - addr off|partition sizeread/write 'size' bytes starting at offset 'off'to/from memory address 'addr', skipping bad blocks.nand erase  [off size] - erase 'size' bytes fromoffset 'off' (entire device if not specified)nand bad - show bad blocksnand dump[.oob] off - dump pagenand scrub - really clean NAND erasing bad blocks (UNSAFE)nand markbad off [...] - mark bad block(s) at offset (UNSAFE)nand biterr off - make a bit error at offset (UNSAFE)which seems to suggest the third parameter is just # of bytes but those in the uboot variables confuse me

author: analogRF
author_rank: Super Contributor
timestamp: July 30, 2023, 09:18:48 pm
content: "nand bad" shows no bad blocks

author: analogRF
author_rank: Super Contributor
timestamp: July 30, 2023, 09:32:50 pm
content: Quote from: ElectronMan on July 30, 2023, 09:14:00 pmthe errors in the log start fromCode:Reading NAND configurationFMD_DirectRead: Invalid block at sector 0x180 bumping by 0x40 sectorsFMD_DirectRead: Invalid block at sector 0x1c0 bumping by 0x40 sectorsFMD_DirectRead: Invalid block at sector 0x200 bumping by 0x40 sectorsFMD_DirectRead: Invalid block at sector 0x240 bumping by 0x40 sectorsand it keeps bumping by 0x40 sectors whatever that means until the last error which isCode:FMD_DirectRead: Invalid block at sector 0xff80 bumping by 0x40 sectorsFMD_DirectRead: Invalid block at sector 0xffc0 bumping by 0x40 sectorshow is sector related to page? how long is it?"nand info" commands says "sector size 128 KiB" but seems way too large to me

author: ElectronMan
author_rank: Regular Contributor
timestamp: July 30, 2023, 09:39:42 pm
content: Quote from: analogRF on July 30, 2023, 09:32:50 pmThey are using sector size = 2048 bytes, so the same thing as a page. Multiply that # by 2048 to get offset.It is effectively starting from c0000 and going to the end of flash.

author: ElectronMan
author_rank: Regular Contributor
timestamp: July 30, 2023, 09:48:35 pm
content: So I just tested this from uboot, which reads out the page, and places it in the next block (the next block was empty in mine).It seems to work without any issue for me. But YMMV.The MD was just to check that memory area was mostly empty.Code:md 0x800000 0x20000nand read 0x800000 0xc0000 0x20000nand write 0x800000 0xe0000 0x20000

author: analogRF
author_rank: Super Contributor
timestamp: July 30, 2023, 09:52:44 pm
content: Quote from: ElectronMan on July 30, 2023, 09:39:42 pmyes I just figured that out but it is strange because when the unit bootsI am 100% it reads a lot from the flash and never complains for example about cal data being corrupted etc...cannot be bad all the way to 128MBI was just looking at the dumps of some random pages after 0xC0800 and they are all 00 (with identical oob data which has 4 rows of data and 4 rows of FF alternating) until 0xC4000 when all data become FF including all the oob and that continues for very long length....

author: ElectronMan
author_rank: Regular Contributor
timestamp: July 30, 2023, 09:53:08 pm
content: Quote from: ElectronMan on July 30, 2023, 09:48:35 pmJust to clarify what this is doing, it is reading that boot config BLOCK (all 128kb of it) into a memory area at 0x80000000 and then writing the contents of that same memory out to the NEXT block at 0xe0000.I did this because that block is empty on my flash (though the block after that one has redundant copy of uboot in it).I checked the nand after that and it wrote it to the correct place.If your next block at e0000 is also empty, you could try this first, with a lower risk of issues.... Again, YMMV so beware.

author: analogRF
author_rank: Super Contributor
timestamp: July 30, 2023, 09:55:54 pm
content: yes it is empty at 0xe0000for those pages that are fully 0000 what do you see for oob?and also for those pages that are all FFFF what is the oob? mine is all FF

author: analogRF
author_rank: Super Contributor
timestamp: July 30, 2023, 10:01:01 pm
content: dont you need to erase nand before writing to it?or since it is empty that's fine, right?but eventually if I want to re-write into the non empty areas i have to do erase first, right?

author: analogRF
author_rank: Super Contributor
timestamp: July 30, 2023, 10:05:29 pm
content: ok I duplicated the commands that you posted and then dumped one page from 0xE0000as you see here the result is exactly a copy of the page at 0xC0000 including the oob dataCode:p510> nand dump 0xc0000nand_dump len: 2048, ooblen 64, off 0xc0000Page 000c0000 dump:ef 1e 8b 0c 72 61 6d 62 6f 6f 74 3d 64 68 63 7020 30 78 34 30 30 30 30 30 30 20 6e 6b 2e 62 696e 3b 72 75 6e 20 62 6f 6f 74 63 6d 64 00 62 6175 64 72 61 74 65 3d 31 31 35 32 30 30 00 67 6174 65 77 61 79 69 70 3d 31 39 32 2e 31 36 38 2e31 2e 31 30 00 6e 65 74 6d 61 73 6b 3d 32 35 352e 32 35 35 2e 32 35 35 2e 30 00 63 68 69 70 7665 72 73 69 6f 6e 3d 41 41 00 62 6f 61 72 64 7665 72 73 69 6f 6e 3d 34 00 66 74 70 3d 64 68 6370 00 62 6f 6f 74 64 65 6c 61 79 3d 30 00 65 6363 3d 34 00 63 6e 66 67 5f 76 6d 63 5f 69 6e 7075 74 5f 70 69 6e 3d 6d 77 20 30 78 62 33 30 3030 30 32 38 20 30 78 30 30 30 34 30 33 30 30 2031 3b 6d 77 20 30 78 62 33 30 30 30 30 34 38 2030 78 66 66 66 62 66 66 66 66 20 31 00 63 6e 6667 5f 6c 61 6e 5f 69 6e 70 75 74 5f 70 69 6e 3d6d 77 20 30 78 62 33 30 30 30 30 33 30 20 30 7830 30 30 30 30 30 30 38 20 31 3b 6d 77 20 30 7862 33 30 30 30 30 35 30 20 30 78 46 46 46 46 4646 46 46 20 31 3b 6d 77 20 30 78 62 33 30 30 3030 31 38 20 30 78 30 30 30 30 30 31 30 31 00 7072 65 62 6f 6f 74 3d 6d 77 2e 6c 20 30 78 62 3330 30 30 30 30 63 20 30 78 66 66 66 66 61 63 6634 3b 20 72 75 6e 20 63 6e 66 67 5f 6c 61 6e 5f69 6e 70 75 74 5f 70 69 6e 3b 20 72 75 6e 20 636e 66 67 5f 76 6d 63 5f 69 6e 70 75 74 5f 70 696e 3b 20 73 70 6c 61 73 68 20 6c 6f 61 64 00 6469 73 70 50 61 72 6d 31 3d 31 31 30 20 31 65 3020 39 38 39 36 38 30 20 30 20 32 38 00 64 69 7370 50 61 72 6d 32 3d 31 20 31 20 31 20 31 20 3300 6e 75 6d 69 6e 73 74 69 6d 61 67 65 73 3d 3100 70 62 6f 6f 74 64 65 6c 61 79 3d 30 00 66 696d 61 67 65 3d 31 00 6e 69 6d 61 67 65 73 3d 3200 69 6d 61 67 65 31 3d 30 78 64 30 36 32 30 3030 30 00 69 6d 61 67 65 32 3d 30 78 64 32 31 3230 30 30 30 00 66 73 73 74 61 72 74 3d 30 78 3330 32 30 30 30 30 00 6e 75 6d 66 69 6c 65 73 7973 74 65 6d 73 3d 32 00 6c 65 6e 67 74 68 66 696c 65 73 79 73 74 65 6d 31 3d 30 78 34 45 45 3030 30 30 00 6c 65 6e 67 74 68 66 69 6c 65 73 7973 74 65 6d 32 3d 30 78 31 30 30 30 30 30 00 626f 6f 74 63 6d 64 3d 6e 61 6e 64 20 72 65 61 6420 30 78 36 30 30 30 30 30 20 30 78 33 32 30 3030 30 20 30 78 31 30 30 30 30 3b 62 6f 6f 74 6d20 30 78 36 30 30 30 30 30 00 75 61 72 74 32 3d31 00 72 74 63 3d 31 00 70 73 3d 30 00 73 70 6c61 73 68 64 61 74 61 3d 30 78 64 30 31 38 30 3030 30 00 65 72 61 73 65 5f 65 6e 76 3d 6e 61 6e64 20 65 72 61 73 65 20 30 78 43 30 30 30 30 2030 78 34 30 30 30 30 00 73 74 6f 72 65 5f 78 6c6f 61 64 65 72 3d 78 6c 6f 61 64 20 30 78 38 3030 30 30 30 00 67 65 74 5f 78 6c 6f 61 64 5f 6574 68 3d 64 68 63 70 20 30 78 38 30 30 30 30 3020 78 6c 6f 61 64 65 72 2d 70 35 31 30 2e 62 696e 3b 20 72 75 6e 20 73 74 6f 72 65 5f 78 6c 6f61 64 65 72 00 73 74 6f 72 65 5f 75 62 6f 6f 743d 6e 61 6e 64 20 65 72 61 73 65 20 30 78 31 3030 30 30 30 20 24 7b 62 6c 6f 63 6b 73 69 7a 657d 3b 20 6e 61 6e 64 20 77 72 69 74 65 20 30 7838 30 30 30 30 30 20 30 78 31 30 30 30 30 30 2024 7b 62 6c 6f 63 6b 73 69 7a 65 7d 00 67 65 745f 75 62 6f 6f 74 5f 65 74 68 3d 64 68 63 70 2030 78 38 30 30 30 30 30 20 75 2d 62 6f 6f 74 2d70 35 31 30 2e 62 69 6e 3b 72 75 6e 20 73 74 6f72 65 5f 75 62 6f 6f 74 00 73 74 6f 72 65 5f 7062 6f 6f 74 3d 6e 61 6e 64 20 65 72 61 73 65 2030 78 33 32 30 30 30 30 20 24 7b 62 6c 6f 63 6b73 69 7a 65 7d 3b 20 6e 61 6e 64 20 77 72 69 7465 20 30 78 38 30 30 30 30 30 20 30 78 33 32 3030 30 30 20 24 7b 62 6c 6f 63 6b 73 69 7a 65 7d00 67 65 74 5f 70 62 6f 6f 74 5f 65 74 68 3d 6468 63 70 20 30 78 38 30 30 30 30 30 20 70 62 6f6f 74 2e 62 69 6e 3b 72 75 6e 20 73 74 6f 72 655f 70 62 6f 6f 74 00 66 6c 61 73 68 5f 6e 6b 6269 6e 3d 64 68 63 70 20 30 78 34 30 30 30 30 3030 20 6e 6b 2e 62 69 6e 3b 6e 61 6e 64 20 65 7261 73 65 20 30 78 30 30 36 32 30 30 30 30 20 247b 62 6c 6f 63 6b 73 69 7a 65 7d 3b 6e 61 6e 6420 77 72 69 74 65 20 30 78 34 30 30 30 30 30 3020 30 78 30 30 36 32 30 30 30 30 20 24 7b 62 6c6f 63 6b 73 69 7a 65 7d 00 75 73 62 74 74 79 3d63 64 63 5f 61 63 6d 00 65 74 68 61 64 64 72 3d38 30 3a 30 39 3a 30 32 3a 30 65 3a 37 61 3a 3466 00 73 65 72 69 61 6c 6e 75 6d 3d 4d 59 39 3939 39 39 39 39 39 00 76 65 72 69 66 79 3d 6e 0073 74 64 69 6e 3d 73 65 72 69 61 6c 00 73 74 646f 75 74 3d 73 65 72 69 61 6c 00 73 74 64 65 7272 3d 73 65 72 69 61 6c 00 69 70 61 64 64 72 3d31 39 32 2e 31 36 38 2e 31 2e 31 37 39 00 67 7569 64 3d 7b 36 31 33 34 31 65 39 65 2d 61 66 3336 2d 62 33 34 37 2d 61 65 30 35 2d 33 61 34 3034 63 32 63 64 39 63 30 7d 00 73 65 72 76 65 7269 70 3d 30 30 30 2e 30 30 30 2e 30 30 30 2e 3030 30 00 00 00 00 00 00 00 00 00 00 00 00 00 0000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00OOB:ff ff ff ff ff ff ff ffc7 c0 61 e7 00 4e 80 95ff ff ff ff ff ff ff ffac 3e 59 ad 00 97 90 a1ff ff ff ff ff ff ff fffe 04 f8 c7 00 d4 30 11ff ff ff ff ff ff ff ffef 5d 4b a1 00 d7 80 8b

author: ElectronMan
author_rank: Regular Contributor
timestamp: July 30, 2023, 10:08:28 pm
content: Quote from: analogRF on July 30, 2023, 10:01:01 pmCorrect. Erasing can sometimes fix issues that you could otherwise still run into. But I'd hold off on that.My pages also have all 0xff spares for both all 0x00 and 0xFF pages.

author: ElectronMan
author_rank: Regular Contributor
timestamp: July 30, 2023, 10:11:12 pm
content: Quote from: analogRF on July 30, 2023, 10:05:29 pmStill same error during boot-up too?Just FYI, the function that verifies the data in PBOOT appears to look at the spare areas on at least the first 8 pages before deciding the block is bad. So the issue is not necessarily the first page.

author: analogRF
author_rank: Super Contributor
timestamp: July 30, 2023, 10:12:16 pm
content: Quote from: ElectronMan on July 30, 2023, 10:08:28 pmhmmmm....for all 000 pages I dont get all FF for OOB...there are numbers in it...but for all FF pages I get all FF oobi just rebooted the unit and the sector at 0x1c0 (=0xE0000) still shows invalid

author: analogRF
author_rank: Super Contributor
timestamp: July 30, 2023, 10:20:42 pm
content: for instance this is the dump of a page which is all 0x00all others 0x00 filled pages look identicalCode:p510> nand dump 0xc0800nand_dump len: 2048, ooblen 64, off 0xc0800Page 000c0800 dump:00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00OOB:ff ff ff ff ff ff ff ffef 5d 4b a1 00 d7 80 8bff ff ff ff ff ff ff ffef 5d 4b a1 00 d7 80 8bff ff ff ff ff ff ff ffef 5d 4b a1 00 d7 80 8bff ff ff ff ff ff ff ffef 5d 4b a1 00 d7 80 8b

author: analogRF
author_rank: Super Contributor
timestamp: July 30, 2023, 10:23:49 pm
content: still I am pretty sure the whole 128MB of NAND is not bad and I am not even sure the 0xC0000 area is bad either.perhaps there is still a problem with the pboot itself or it is reading its parameters from somewhere else , not from 0xc0000

author: analogRF
author_rank: Super Contributor
timestamp: July 30, 2023, 10:27:31 pm
content: these front panels (used is many Keysight instruments) are very well known to have bad CPU (SPear320)I have personally replaced 4 of them in multimeters and 33600 function generatorsso maybe mine has a slightly defective nand controller in it....but the meter was manufactured in Nov 2019 and its warranty ended in Dec 1. 2022it has been sitting off on the bench for 4-5 month and now suddenly this?is there any service note or extended warranty for this nand corruption issue similar to what was available for 3000A scopes?

author: analogRF
author_rank: Super Contributor
timestamp: July 30, 2023, 10:29:45 pm
content: by the way the areas that I wrote in the NAND (starting from 0xE0000) look exactly identical to the areas I copied fromincluding the oob dataso I dont think writing back into the nand is gonna help, is it?

author: ElectronMan
author_rank: Regular Contributor
timestamp: July 30, 2023, 10:30:19 pm
content: Quote from: analogRF on July 30, 2023, 10:23:49 pmI've considered a possible issue with PBOOT, but the problem is that it has a couple of different levels of checksums protecting it. There is a table inside it that it seems to use for the check. If that got corrupted, it could cause the appearance of a failure that is not there.But that is extremely unlikely given that the checksum that UBOOT sees when you list images shows Ok, and the gzipped nb0 for PBOOT has its own CRC.It is more likely something in the spare area isn't matching up. A hardware issue could cause a bit to appear stuck, for example.The hope is that by rewriting you can force a re-write of the spare by the same mechanism that does the checking (FMD_Write). If that doesn't correct the issue, then it is looking more like a flash hardware problem.

author: ElectronMan
author_rank: Regular Contributor
timestamp: July 30, 2023, 10:32:28 pm
content: Quote from: analogRF on July 30, 2023, 10:29:45 pmDid you try rebooting since? You can test the theory, as it should check the block you wrote (it was checking it previously) when the first one fails.If it still shows an error on that block (assuming you wrote the entire block) then it is not looking like an error that is correctable by re-writing it.And erase cycle on that block might help, but now we're getting into more dangerous stuff.

author: analogRF
author_rank: Super Contributor
timestamp: July 30, 2023, 11:01:16 pm
content: Quote from: ElectronMan on July 30, 2023, 10:32:28 pmyes I mentioned that I rebooted and I still get the same bad block error at sector 0x1c0 which is where I copied into. no changealso the oob data in those areas that I wrote into now are exact copy of the ones I copied from.I just opened up my good 34461A and dumped the same area of the nand. The oob data looks exactly identical to what i see on my bad meterso I am 100% sure it is not about those OOB data

author: ElectronMan
author_rank: Regular Contributor
timestamp: July 30, 2023, 11:12:52 pm
content: Quote from: analogRF on July 30, 2023, 11:01:16 pmI am still looking at the code to see exactly what it is verifying in the spare area. If I figure out what it is looking for, maybe we will have some idea of why it is rejecting it.

author: tv84
author_rank: Super Contributor
timestamp: July 30, 2023, 11:29:21 pm
content: Having fun without me??I'm almost sure I know how to calc that CRC/checksum.

author: ElectronMan
author_rank: Regular Contributor
timestamp: July 30, 2023, 11:56:53 pm
content: Quote from: tv84 on July 30, 2023, 11:29:21 pmWhat I am looking at actually appears to be a bad-block check.As an example:Code:00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0FXX XX XX XX XX XX XX XX87FFB708 = FF FF FF FF FF FF FF FF 95 A5 6A 69 59 FF FF FFIf any of the bytes marked with X's from the first 16 bytes of Spare are not FF, it bails with an error.

author: analogRF
author_rank: Super Contributor
timestamp: July 31, 2023, 12:06:12 am
content: Quote from: tv84 on July 30, 2023, 11:29:21 pmso finally dragged you into this

author: ElectronMan
author_rank: Regular Contributor
timestamp: July 31, 2023, 12:16:48 am
content: Okay. So I just noticed something. This is likely why our spares are not matching up... It appears you have a different flash chip with internal ECC, while I do not.Maybe a cost-cutting change Keysight made before I bought mine. Did you see what flash chip you have in there?Mine:CPU: SPEAr320DRAM: 128 MiBUnknown id: 0xffffff. Using ST_M23P40Flash: 64 KiBNAND: fsmc-ecc1 128 MiBIn: serialOut: serialErr: serialSerNum:MY99999999Chip: AA Board Rev: 4init RTC: 2023-07-30 18:12:44.22Net: No ethernet found.splash RTC: 2023-07-30 18:12:45.25Yours:CPU: SPEAr320DRAM: 128 MiBUnknown id: 0xffffff. Using ST_M23P40Flash: 64 KiBNAND: INTERNAL ECC 128 MiBIn: serialOut: serialErr: serialSerNum:MY99999999Chip: AA Board Rev: 4init RTC: 2023-07-28 15:47:59.57Net: No ethernet found.splash RTC: 2023-07-28 15:48:00.60

author: analogRF
author_rank: Super Contributor
timestamp: July 31, 2023, 12:29:57 am
content: NAND chips on both of my meters are Micron MT29F1G08ABADAH4-ITX:D marked NQ432both are identified in uboot as INTERNAL ECC 128 MiB

author: analogRF
author_rank: Super Contributor
timestamp: July 31, 2023, 12:33:40 am
content: from the datasheet of the NAND flash chip:Code:Internal ECC and Spare Area Mapping for ECCInternal ECC enables 5-bit detection and 4-bit error correction in 512 bytes (x8) or 256words (x16) of the main area and 4 bytes (x8) or 2 words (x16) of metadata I in the sparearea. The metadata II area, which consists of two bytes (x8) and one word (x16), is notECC protected. During the busy time for PROGRAM operations, internal ECC generatesparity bits when error detection is complete.During READ operations the device executes the internal ECC engine (5-bit detectionand 4-bit error correction). When the READ operaton is complete, read status bit 0 mustbe checked to determine whether errors larger than four bits have occurred.Following the READ STATUS command, the device must be returned to read mode byissuing the 00h command.Limitations of internal ECC include the spare area, defined in the figures below, andECC parity areas that cannot be written to. Each ECC user area (referred to as main andspare) must be written within one partial-page program so that the NAND device cancalculate the proper ECC parity. The number of partial-page programs within a pagecannot exceed four

author: ElectronMan
author_rank: Regular Contributor
timestamp: July 31, 2023, 12:36:08 am
content: Quote from: analogRF on July 31, 2023, 12:29:57 amOkay, that is similar to what they put in their scopes. Mine is a WINBOND W29N01HV. It doesn't have internal ECC. So while I've figured out the code path and what causes that error on mine, it will likely be somewhat different for yours.What I can see, however, is that this appears to be when it is checking the "BAD BLOCK" area that it is finding something it doesn't like.Did you say that the OOB for page 0xc0000 was the same on both of your meters? Is there anything on one that is 0xFF that isn't on the broken one?

author: analogRF
author_rank: Super Contributor
timestamp: July 31, 2023, 12:44:07 am
content: Quote from: ElectronMan on July 31, 2023, 12:36:08 amright at the first page at 0xc0000 although the actual numbers are different because I had changed the serverip on the bad meter and then changed it back and when you do make a change the whole set of env variables are re-written so the pattern becomes different and the OOB are not identical however the pattern of numbers is identicalbut after that first page (on pages that are all 0x00) the OOB are exactly identical

author: analogRF
author_rank: Super Contributor
timestamp: July 31, 2023, 12:45:53 am
content: I am pretty sure it is not the nand having a physical problem.the pboot is doing a wrong calculation for some reasonmaybe it is not identifying the correct chip ID

author: analogRF
author_rank: Super Contributor
timestamp: July 31, 2023, 12:50:03 am
content: where do you think pboot is getting those "default" boot parameters from. Look at the error here:Code:ERROR : Bootloader setting load failedINFO : Loading default bootloader settingsPress  to launch image stored in flash or  to cancel.Initiating image launch in 4 secondsP500 Boot Loader Configuration :Mac address .......... (04:02:02:20:02:02)Ip address ........... (192.168.114.201)Subnet Mask address .. (255.255.255.0)DHCP ................. (Enabled)Boot delay (seconds).. (5)Load image 3 at startupImage addresses. (0xdxxxxxxx for NAND, 0x8xxxxxxx for RAM)1 (0xd0400000)2 (0xd1700000)3 (0x84000000)if we can somehow change those stupid default values to 0xD0620000 and 0xD2120000then we should be good to go

author: analogRF
author_rank: Super Contributor
timestamp: July 31, 2023, 12:56:14 am
content: there is variable in ubootCode:erase_env=nand erase 0xC0000 0x40000i dont know where it is used but shows the env partition must be 256KiB

author: ElectronMan
author_rank: Regular Contributor
timestamp: July 31, 2023, 12:56:35 am
content: Quote from: analogRF on July 31, 2023, 12:45:53 amThat's a distinct possibility. I read through the datasheet, and it indicates that bad block information is stored on the first page OOB in bytes 0x800-0x801, 0x810-0x811, 0x820-0x821, and 0x830-0x831.Those all appear to be good (they should be 0xFF).Was the PBOOT reflashed at some point, possibly with the wrong one for your flash chip?

author: analogRF
author_rank: Super Contributor
timestamp: July 31, 2023, 01:06:52 am
content: Quote from: ElectronMan on July 31, 2023, 12:56:35 amno this meter had not been opened until few days agoalso I dumped the pboot from nand and compared the bin file with my good meter and they are identical.

author: ElectronMan
author_rank: Regular Contributor
timestamp: July 31, 2023, 01:21:56 am
content: Quote from: analogRF on July 31, 2023, 01:06:52 amIt is starting to get weird now. The flash pages in question look fine. The PBOOT image looks correct. It could be that the chip is not responding properly to parameters and giving the correct ID, but I would expect that to cause problems with UBOOT as well.You could verify that via JTAG by querying the flash chip for parameters. A memory dump might help too.It might still be worth doing an erase on that once-empty block at e0000 and reprogram it to see if anything changes. But other than that, I am out of ideas at the moment.

author: analogRF
author_rank: Super Contributor
timestamp: July 31, 2023, 01:33:44 am
content: Quote from: ElectronMan on July 31, 2023, 01:21:56 ami dont know the JTAG pins on the board. Do you?I will do the erase and re-write but I am pretty sure it will work. maybe the issue is not pboot but it is the ubootI mean if I understand correctly, uboot reads pboot from 0x320000 into memory but it is a packed (gzipped) binaryso when the bootm command runs, I suppose it must unpack pboot in order for it to execute and maybe that's where the problem starts

author: ElectronMan
author_rank: Regular Contributor
timestamp: July 31, 2023, 02:25:02 am
content: Quote from: analogRF on July 31, 2023, 01:33:44 amHere is the pinout on the connector labeled J102.Code:0 0 GND3.3V 0 0 GNDTMS 0 0 GNDTCK 0 0 GNDTDO 0 0 3.3VTDI 0 0 TRST3.3V 0 0 GND

author: analogRF
author_rank: Super Contributor
timestamp: July 31, 2023, 02:32:41 am
content: Quote from: ElectronMan on July 31, 2023, 02:25:02 amGreat! Thanks. I only have a Segger J-Link. Not sure if it is compatible with Spear320. I doubt that but I will certainly checkHow could a memory dump help?

author: ElectronMan
author_rank: Regular Contributor
timestamp: July 31, 2023, 02:40:10 am
content: Quote from: analogRF on July 31, 2023, 02:32:41 amI've been using a J-LINK pro with J-Link commander for some things (debugging and breakpointing) and OpenOCD via the j-link on a Linux box for things like dumping full NAND images.Really the memory dump around the time of failure may just reveal some things about what the software was "thinking" at the time. Parameters it has loaded for the flash device, etc. I could compare it to my memory state. It's a long shot without me being able to actually breakpoint it and follow it myself.

author: TheSteve
author_rank: Unknown
timestamp: July 31, 2023, 06:05:19 am
content: I need to read the entire thread in detail, but I'd certainly say it's JTAG time.

author: analogRF
author_rank: Super Contributor
timestamp: July 31, 2023, 10:40:05 am
content: Quote from: TheSteve on July 31, 2023, 06:05:19 amplease do. your input is always highly appreciated.

author: analogRF
author_rank: Super Contributor
timestamp: July 31, 2023, 12:37:13 pm
content: I did the erase and re-write at the empty block at 0xe0000 as was suggested everything is exactly the same including the oob datalooks identical to what i have at 0xc0000 which is what i saw also on my good meteri really dont think it's the NAND chip physical problem. it is still a software issuecan it have something to do with those "preboot" commands/variables in the uboot?

author: analogRF
author_rank: Super Contributor
timestamp: July 31, 2023, 12:42:14 pm
content: I also have a crazy idea which may not completely solve the problem but at least might let the meter boot on its ownwhat if I write the extracted nk.nb0 file in the nand (need to decide in what location) and then using those preboot commandsI load it into memory and change the bootcmd to just start the WInce and therefore bypass the damn pboot altogetherthe same way that I boot it now using CEloader or YMODEM.obviously FW update will not be possible but other than that it seems it should be a solution? no?

author: ElectronMan
author_rank: Regular Contributor
timestamp: July 31, 2023, 03:58:17 pm
content: Quote from: analogRF on July 31, 2023, 12:42:14 pmCould work in theory. Might also be worth a try to modify the default settings in that PBOOT to the correct ones, so it proceeds anyway.You could write it to a different location in flash, and load it from there via uboot, so you don't have to overwrite the current one.It is a lot smaller, and probably safer to try than decompressing the entire image.

author: analogRF
author_rank: Super Contributor
timestamp: July 31, 2023, 04:54:17 pm
content: Quote from: ElectronMan on July 31, 2023, 03:58:17 pmI thought about that first but the problem is I dont know where it gets those default values from to change themand also the first option that it follows automatically if user does not interfere is loading from 0x84000000 which leads to boot fail.I dont know where it gets that address from and what is supposed to be loaded in there (nk.bin??) and when was it supposed to be loaded therethat;s when I thought I can just write the uncompressed nk.bin in NAND and load it to memory before the pboot...

author: ElectronMan
author_rank: Regular Contributor
timestamp: July 31, 2023, 05:01:56 pm
content: Quote from: analogRF on July 31, 2023, 04:54:17 pmIt gets the 0xd0400000 and 0xd1700000 and 0x84000000 addresses from defaults it loads in the binary.I PMed you a copy of the xloader you can try, where I changed the defaults to the correct ones.This is normally in flash @0x320000 but I would recommend writing it somewhere empty and then:nand read 0x600000 <New Address> 0x10000;bootm 0x600000to boot and test it.

author: analogRF
author_rank: Super Contributor
timestamp: July 31, 2023, 05:06:55 pm
content: Quote from: ElectronMan on July 31, 2023, 05:01:56 pmThankslooks very promising. I'll try that. I will write it somewhere maybe after the current one in the nandor I can write it at that 0xe0000 no? it's empty

author: ElectronMan
author_rank: Regular Contributor
timestamp: July 31, 2023, 05:13:06 pm
content: Quote from: analogRF on July 31, 2023, 05:06:55 pmYes, that should work.

author: analogRF
author_rank: Super Contributor
timestamp: July 31, 2023, 07:15:48 pm
content: I uploaded the modified pboot into NAND at 0xe0000 (after erasing and made sure it is all 0xFF before writing)and then loaded from there into memory at 0x600000 and issued bootm 0x600000pboot ran exactly the same way it used to and stopped after all those error messageswhen I press space bar to enter the bootloader menu, Now I get the correct addresses 0xd0620000 and 0xd2120000for image locations however when I choose any of them, the unit simply says "loading image 1 from memory at 0xd0620000" and stops there and hangsI know there is a Nk.bin (compressed exactly as it is in the firmware package) at d0620000 and d2120000and it is the same on my good meter.it seems pboot cannot read the nand or it cannot decompress the XPRS Nk.bin so it hangs in there

author: analogRF
author_rank: Super Contributor
timestamp: July 31, 2023, 07:39:26 pm
content: it seems the only way is to bypass the pboot by writing the extracted nk.nb0 directly and using the "go" commandbut I will give that JTAG a try and see if you guys can decipher anything from memory content

author: ElectronMan
author_rank: Regular Contributor
timestamp: July 31, 2023, 08:52:29 pm
content: Quote from: analogRF on July 31, 2023, 07:15:48 pmSo, this uses the same exact function to verify block status when loading the nkbin as it uses when trying to read the uboot configuration.It may be failing that part too. It is also possible I missed something.Either way, we can rule out a bad copy of the xloader as the cause, if you are still seeing the same block defects showing up. Theoretically I could nix the part of that binary that does the bad block check, but that's not a good idea long-term.If you manage to get connected via JTAG, we can query the flash chip to make sure it is outputting the correct parameters. The flash chips in these devices are not natively supported by the PBOOT, they are supported by OFNI-standard parameters read from the chip. If something is bad there, it could cause what we're seeing.

author: ElectronMan
author_rank: Regular Contributor
timestamp: July 31, 2023, 09:24:52 pm
content: If you get JTAG going, here is what you'll need uisng JTAG Commander (the segger tools, if using openocd, replace w1 with mwb and replace mem with mdb in the commands).First "halt" the CPU while in the uboot prompt.The first command should output 5 bytes identifying the chip manufacturer and a few parameters (the PBOOT checks this to see if it is natively supported).Code:Read ID:w1 0xBAB10000 0x90w1 0xBAB20000 0x0mem 0xBAB00000 5Next, PBOOT checks for the ONFI "magic" like this:Code:Read ONFI:w1 0xBAB10000 0x90w1 0xBAB20000 0x20mem 0xBAB00000 4This should return the letters "ONFI"Finally, this next is the most likely place there could be an issue. It is the page PBOOT uses to configure itself. It tells it what kind of ECC is in use, as well as lots of other things that could break the boot process if it is wrong. For this reason, the manufacturer includes a checksum in this info, AND alternate copies of parameters later. PBOOT appears to ignore these things.Code:Read Parameter Page:w1 0xBAB10000 0xECw1 0xBAB20000 0x0mem 0xBAB00000 512This will grab the complete parameters, with CRC and at least 1 redundant copy.Make sure you don't resume the CPU after this. Just power cycle it, as you are putting the NAND into a mode UBOOT won't be aware of...

author: analogRF
author_rank: Super Contributor
timestamp: August 01, 2023, 01:49:58 pm
content: I connected the JTag and tried those commands but the "mem" command always says "Could not read memory."

author: analogRF
author_rank: Super Contributor
timestamp: August 01, 2023, 01:57:45 pm
content: if I use mem8 instead of mem, it takes the command with no error but then it does not show anything.

author: ElectronMan
author_rank: Regular Contributor
timestamp: August 01, 2023, 02:29:09 pm
content: Quote from: analogRF on August 01, 2023, 01:57:45 pmWhat was the memory error? Can you try this while in the PBOOT loader? That memory range is sometimes not available in earlier and later boot stages. Just drop into that menu and halt it there to try.Even with the patched loader booting okay, it would be interesting to see what's wrong with your flash parameters page exactly.

author: analogRF
author_rank: Super Contributor
timestamp: August 01, 2023, 02:32:41 pm
content: Quote from: ElectronMan on August 01, 2023, 02:29:09 pmjust says "Could not read memory." that's iti'll try it in pboot

author: analogRF
author_rank: Super Contributor
timestamp: August 01, 2023, 02:40:25 pm
content: well I halted in pboot prompt and now the jtag commands work and I think this probably shows where the problem isCode:J-Link>w1 0xbab10000 0x90Writing 90 -> BAB10000J-Link>w1 0xbab20000 0x00Writing 00 -> BAB20000J-Link>mem 0xbab00000 5BAB00000 = 2C F1 80 95 82 ,....--------------------------------------------------------------------------J-Link>w1 0xbab10000 0x90Writing 90 -> BAB10000J-Link>w1 0xbab20000 0x20Writing 20 -> BAB20000J-Link>mem 0xbab00000 4BAB00000 = 4F 4E 46 49 ONFI---------------------------------------------------------------------------J-Link>w1 0xbab10000 0xecWriting EC -> BAB10000J-Link>w1 0xbab20000 0x00Writing 00 -> BAB20000J-Link>mem 0xbab00000 512****** Error: Read memory error @ address 0xBAB00000, word access: Memory access timeout.Could not read memory.

author: analogRF
author_rank: Super Contributor
timestamp: August 01, 2023, 02:49:46 pm
content: still i think the reason it gives that error is something else I am doing wrong, still I cannot tell it is because the nand has an errori tried again but same errorI thought it should at least read something

author: ElectronMan
author_rank: Regular Contributor
timestamp: August 01, 2023, 03:09:32 pm
content: Quote from: analogRF on August 01, 2023, 02:49:46 pmMaybe. I started having problems reading my parameters page with the jlink tool, and switched to OpenOCD instead of troubleshooting it. I figured that was a problem specific to my setup.If you want to try in openOCD I can give you a config that works.

author: analogRF
author_rank: Super Contributor
timestamp: August 01, 2023, 03:37:36 pm
content: Quote from: ElectronMan on August 01, 2023, 03:09:32 pmi dont have openocd right now and with your unbelievable expertise the meter is fixed and working now as normalI wrote the patched pboot binary provided by@ElectronManat 0x340000 in the NAND and changed my bootcmd variable toread pboot from the new address (instead of the original one still at 0x320000) and boot from thereThe unit now boots normally and works flawlessly.Thank you so much@ElectronMan. It was a lot of fun working with you

author: ElectronMan
author_rank: Regular Contributor
timestamp: August 01, 2023, 03:58:48 pm
content: Quote from: analogRF on August 01, 2023, 03:37:36 pmNo problem, I am glad that worked!It was out of other ideas. Keysight really should update that pboot to handle that situation properly.

author: TheSteve
author_rank: Unknown
timestamp: August 01, 2023, 04:30:53 pm
content: Well done guys!So what is the overall summary of the failure itself - a bad block where the original pboot sits?

author: ElectronMan
author_rank: Regular Contributor
timestamp: August 01, 2023, 06:24:00 pm
content: Quote from: TheSteve on August 01, 2023, 04:30:53 pmThe flash chip's parameter page was apparently corrupted.UBOOT doesn't use it. It just applies defaults based on whether the flash is Micron or not Micron, so it was unaffected.But PBOOT just grabs the first parameter page and configures itself to talk to the flash.I patched PBOOT to jump +256 bytes forward during the parameter load to grab the first redundant copy of the parameters page instead, and apparently that copy is good.Really, PBOOT should be checking the checksum on the page, and automatically checking the 3 or so other copies instead of just trusting that the first copy is good.

author: kanzler
author_rank: Newbie
timestamp: November 09, 2023, 10:45:33 am
content: Hi!Today my device did not work. When you turn it on, there is such a picture on the screen, it does not respond to the buttons. I am attaching the download log. I ask for help in repairing, maybe someone has had such an error. Thank you.

author: kanzler
author_rank: Newbie
timestamp: November 10, 2023, 08:11:13 pm
content: Sorry there was the wrong log fileCode:U-Boot 2010.03 (Oct 09 2012 - 12:48:30)Agilent P510CPU: SPEAr320DRAM: 128 MiBUnknown id: 0xffffff. Using ST_M23P40Flash: 64 KiBNAND: INTERNAL ECC 128 MiBfailed: 5 0nand_bbt: Can't scan flash and build the RAM-based BBTIn: serialOut: serialErr: serialSerNum:MY99999999Chip: AA Board Rev: 4init RTC: 2001-02-15 15:44:10.15Net: No ethernet found.splash RTC: 2001-02-15 15:44:11.18Press space to stop autoboot: 0NAND read: device 0 offset 0x320000, size 0x1000065536 bytes read: OK## Booting kernel from Legacy Image at 00600000 ...Image Name: PBOOTCreated: 2012-05-22 16:06:43 UTCImage Type: ARM Linux Kernel Image (gzip compressed)Data Size: 38780 Bytes = 37.9 KiBLoad Address: 00000000Entry Point: 00000000Uncompressing Kernel Image ... OKStarting kernel ...Debug serial initialized ........OKNo RTC on 320Microsoft Windows CE Bootloader Common Library Version 1.4 Built May 22 2012 09:09:57Microsoft Windows CE 6.0 Ethernet Bootloader for the Agilent P500 boardAdaptation performed by Agilent Technologies (c) 2008Reading NAND configurationSystem ready!Preparing for download...No RTC on 320Loading image 1 from memory at 0xD0620000OBL_IMAGE_TYPE_BINXXXXXOOOOXOXOOOOOOOXXOXXOOOOOOOXOOXOOXOOOXXXOOOOOOOOOXOOOOXOXXOXXXOXOOOXOXXXXOOXXOOOOOOXOOOOXXOOXXOOXXOXOOXOOOXOOXXOOOXOOOOXOXOOOOXOOOXOOOXXOXOXOXOXXXOXXXXOOOXOOOXOXOOOOXOOOOXOXOXOOOOOOXOOOXOOXOOOOXOXOOOOOXOXOOOOOOOOOOOXOXOOOOOOOXXOOOOOOOOXOOOOXOXOOOXOXXOXXOOXOOXXXOXXXXOXOOXOOXOOXOOXOOXOXXOXOOXOXOOOOOOXXXXXOXOOOXOXOOOOXOOOOXOOOXOOXOOXOOOXOXXXXXXXXXXXXXXXXXXXXXXXXXrom_offset=0x0.XXImageStart = 0x80361000, ImageLength = 0x169BC08, LaunchAddr = 0x80362000Completed file(s):-------------------------------------------------------------------------------: Address=0x80361000 Length=0x169BC08 Name="" Target=RAMLoading image 1 succeeded.ROMHDR at Address 80361044hPreparing launch...No RTC on 320Launching windows CE image by jumping at address 0x 362000Windows CE Kernel for ARM (Thumb Enabled) Built on Mar 8 2013 at 17:05:33Setting up for a Cold RebootDone Setting up for a Cold RebootWindows CE Firmware InitBSP 1.0.0 for the SPEARHEAD600AB board (built Mar 18 2016)Adaptation performed by ADENEO (c) 2005+OALIntrInit-OALIntrInit(rc = 1)Initialize driver globals Zeros area...pDrvGlobalArea 0xa0060000 size 0x800 (0xa0060800 -0xa0060000)Initialize driver globals Zeros area...doneOALKitlStartFirmware Init Done.OALIoctlHalEnterI2cCriticalSection init i2c csERROR: C:\WINCE600\PLATFORM\COMMON\SRC\SOC\STM\SPEARHEAD600\DRIVERS\NandFlash\.\sh600_NandFlash.c line 57: ConfigTimming - Unable to open device registry entryERROR: C:\WINCE600\PLATFORM\COMMON\SRC\SOC\STM\COMMON\DRIVERS\NandFlash\.\stm_NandFlash.c line 1043: LLD_GetInfo - Unable to open device registry entry++SER_Init: context Drivers\Active\10SER_Init, dwIndex:2GPIO_Select0 Register 0xB300_0024: 0x80000000Control Register 0xB300_0010 : 0x00000040RAS Select Register 0xB300_000C: 0xffffacf4CORE_CLK_CFG 0xB300_0024: 0x80000000SER2 got sysintr:0x00000013SER2 Serial Port, new baud rate:0x1c200 (UARTCLK:83250000 IBRD:0x2d FBRD:0xa)++SER_Init: context Drivers\Active\11SER_Init, dwIndex:3GPIO_Select0 Register 0xB300_0024: 0x80000000Control Register 0xB300_0010 : 0x00000040RAS Select Register 0xB300_000C: 0xffffacf4CORE_CLK_CFG 0xB300_0024: 0x80000000+OALIntrRequestSysIntr IRQ (1) already used by SYSINTR (19)SER3 got sysintr:0x00000014SER3 Serial Port, new baud rate:0x1c200 (UARTCLK:83250000 IBRD:0x2d FBRD:0xa)Incorrect Data, interal ECC failed at 0x62dbIncorrect Data, interal ECC failed at 0x62dbOHCI\system.c, GCFG_USBH1_SW_RSTOHCI\system.c, GCFG_USBH2_SW_RST-EDeviceLoadEeprom 80:09:02:05:E6:FAPhy found addr 7 (ticks=3917)WaitForLink Start (ticks=3919)No Link (ticks=4921)<--EDeviceInitializeGMAC DMA status register = 0x0FAILED to obtain valid Flash Handle in PlatformInitializeResetting the USB-device siliconsh600_pdd, IOCTL_BUS_POSTINITERROR: C:\WINCE600\3RDPARTY\Agilent\HPP\Common\Drivers\stm320_UsbFnBusDriver\.\ufnbus.cpp line 1137: failed opening \Agilent Flash\SPD\usbOverridestm320_UsbFnBusDriver, set IST priority 96#################### dllEntry ###########################Exception 'Raised Exception' (-1): Thread-Id=04a90002(pth=831ff000), Proc-Id=04a80002(pprc=8327bc3c) 'Torreys.exe', VM-active=04a80002(pprc=8327bc3c) 'Torreys.exe'PC=400256e8(coredll.dll+0x000156e8) RA=803782c8(kernel.dll+0x000062c8) SP=0002f274, BVA=ffffffffException 'Raised Exception' (-1): Thread-Id=04a90002(pth=831ff000), Proc-Id=04a80002(pprc=8327bc3c) 'Torreys.exe', VM-active=04a80002(pprc=8327bc3c) 'Torreys.exe'PC=400256e8(coredll.dll+0x000156e8) RA=803782c8(kernel.dll+0x000062c8) SP=0002efe4, BVA=ffffffffException 'Raised Exception' (-1): Thread-Id=04a90002(pth=831ff000), Proc-Id=04a80002(pprc=8327bc3c) 'Torreys.exe', VM-active=04a80002(pprc=8327bc3c) 'Torreys.exe'PC=400256e8(coredll.dll+0x000156e8) RA=803782c8(kernel.dll+0x000062c8) SP=0002efdc, BVA=ffffffffFAILED to obtain valid Flash Handle in PlatformInitializeSSInitialize: Error 3FAILED to obtain valid Flash Handle in PlatformInitializeSSInitialize: Error 3FAILED to obtain valid Flash Handle in PlatformInitializeSSInitialize: Error 3

author: kanzler
author_rank: Newbie
timestamp: January 02, 2024, 04:07:57 pm
content: There is an error in my LOG, "Incorrect Data, interal ECC failed at 0x62db" what could it be?

author: kanzler
author_rank: Newbie
timestamp: January 02, 2024, 09:06:12 pm
content: Sorry for being stupid, but how to get uncompressed nk.bin file ?

author: Eng_tech
author_rank: Contributor
timestamp: October 02, 2024, 01:48:02 pm
content: I have a keysight 34461A that also has I believe corrupted flash. The spear CPU is not overheating and all supply voltages in the meter are spot on. The meter does not boot up and only displays a white screen, none of the button's work, and neither does the USB connection to the meter. I haven't gone much farther then measuring supply voltages. I have purchased a used supposely working front panel for a 34460a with the front circuit board but didn't receive it yet. I know keysight says do not swap out front panels from other units but I figured I would try when I receive it. Obviously, it probably won't work due to mismatch in model/serial numbers. I didn't pay much for it. Anyways, from reading these posts it seems this problem can somewhat remedied by reflashing the NAND. Does anyone have the actual process in steps to perform this fix, including firmware images to use? Thanks, any help is appreciated. I am pretty familar with firmware programming as I do this as part of my job at work.

author: analogRF
author_rank: Super Contributor
timestamp: October 02, 2024, 01:54:48 pm
content: Quote from: Eng_tech on October 02, 2024, 01:48:02 pmi dont think anybody "reflashed" the NAND here. Certainly I didnt.the first thing to do was to hook up the UART debug port on the front panel and see if there are any messages.still the CPU could be dead even if it's not getting hot

author: Eng_tech
author_rank: Contributor
timestamp: October 02, 2024, 06:53:31 pm
content: Haven't gotten around to hooking up serial just yet, but that is next. I'll report back on my findings when I do. I hate to toss this meter it was barely used by my company but is out of warranty and they were going to trash it. It was given to me to take home. Yes, the CPU could be bad as the one test point on the front panel was supposed to have a 24 khz signal on it but didn't have anything except 3.3 volts on it I think. Other voltages on the front pcb were good.

author: coromonadalix
author_rank: Super Contributor
timestamp: October 02, 2024, 07:19:13 pm
content: is there antyhing in that upd file to help recover ??https://www.keysight.com/us/en/lib/software-detail/instrument-firmware-software/34460a34461a34465a34470a-firmware-2367633.html

author: Eng_tech
author_rank: Contributor
timestamp: January 08, 2025, 05:36:27 pm
content: It's been a few months since I last posted about this 34461A meter with the white screen when turned on. Worked I did on it since was get a used front panel pcb from someone on Ebay that was suppose to be working but it turned out to have a shorted Spear processor pulling down the 3.3v supply to it. That person then sent me another one. Same thing shorted processor. I found a supply that have correct spear processors and purchased them. So, now in total I have 3 bad front panel boards. I decided to try replacing the spear chips. In the process I damaged 2 of the boards by tearing off pads under the spear chips while cleaning the pads off with solder wick. The third board I was lucky and sucessfully was able to put down a new spear IC. Upon powering up the meter I now get Agilent in black lettering and a black bar representing that it was booting up. After that bar reaches the end a small part of the LCD screen (upper maybe 1/5 of it) displays part of I think Windows CE loading but stops there and then nothing else after that. So, I made some progress in getting it working. I still need to attach a serial connect to the front panel to see what else is going on. I will be using a serial to usb adapter for the connection that I use to talk to PIC micocontrollers. This uses 5 vdc I/O connections. This port on the front panel is it 5 vdc tolerant. I suspect it might 3.3v. What did you use (hardware) to communicate with the front panel? I know that I am not using the original front panel now and serial numbers will not match. Should I even bother proceeding because of this?

author: Eng_tech
author_rank: Contributor
timestamp: January 09, 2025, 12:35:09 pm
content: I got serial communications going and this is what I came up with. Maybe someone can give an opinion. I was thinking maybe loading the 2nd image and see what happens but don't know how to get to that menu while booting the unit up.Code:U-Boot 2010.03 (Oct 09 2012 - 12:48:30)Agilent P510CPU: SPEAr320DRAM: 128 MiBUnknown id: 0xffffff. Using ST_M23P40Flash: 64 KiBNAND: INTERNAL ECC 128 MiBIn: serialOut: serialErr: serialSerNum:MY99999999Chip: AA Board Rev: 4init RTC: 2001-01-01 03:03:55.82Net: No ethernet found.splash RTC: 2001-01-01 03:03:56.86Press space to stop autoboot: 0p510> run bootcmdNAND read: device 0 offset 0x320000, size 0x1000065536 bytes read: OK## Booting kernel from Legacy Image at 00600000 ...Image Name: PBOOTCreated: 2012-05-22 16:06:43 UTCImage Type: ARM Linux Kernel Image (gzip compressed)Data Size: 38780 Bytes = 37.9 KiBLoad Address: 00000000Entry Point: 00000000Uncompressing Kernel Image ... OKStarting kernel ...Debug serial initialized ........OKNo RTC on 320Microsoft Windows CE Bootloader Common Library Version 1.4 Built May 22 2012 09:09:57Microsoft Windows CE 6.0 Ethernet Bootloader for the Agilent P500 boardAdaptation performed by Agilent Technologies (c) 2008Reading NAND configurationPHY not found.System ready!Preparing for download...No RTC on 320Loading image 1 from memory at 0xD0620000OBL_IMAGE_TYPE_BINXOXImageStart = 0x80361000, ImageLength = 0x165F210, LaunchAddr = 0x80362000Completed file(s):-------------------------------------------------------------------------------: Address=0x80361000 Length=0x165F210 Name="" Target=RAMLoading image 1 succeeded.ROMHDR at Address 80361044hPreparing launch...No RTC on 320Launching windows CE image by jumping at address 0x 362000Windows CE Kernel for ARM (Thumb Enabled) Built on Mar 8 2013 at 17:05:33Setting up for a Cold RebootDone Setting up for a Cold RebootWindows CE Firmware InitBSP 1.0.0 for the SPEARHEAD600AB board (built Oct 19 2017)Adaptation performed by ADENEO (c) 2005+OALIntrInit-OALIntrInit(rc = 1)Initialize driver globals Zeros area...pDrvGlobalArea 0xa0060000 size 0x800 (0xa0060800 -0xa0060000)Initialize driver globals Zeros area...doneOALKitlStartFirmware Init Done.OALIoctlHalEnterI2cCriticalSection init i2c csERROR: C:\WINCE600\PLATFORM\COMMON\SRC\SOC\STM\SPEARHEAD600\DRIVERS\NandFlash\.\sh600_NandFlash.c line 57: ConfigTimming - Unable to open device registry entryERROR: C:\WINCE600\PLATFORM\COMMON\SRC\SOC\STM\COMMON\DRIVERS\NandFlash\.\stm_NandFlash.c line 1043: LLD_GetInfo - Unable to open device registry entry++SER_Init: context Drivers\Active\10SER_Init, dwIndex:2GPIO_Select0 Register 0xB300_0024: 0x80000000Control Register 0xB300_0010 : 0x00000040RAS Select Register 0xB300_000C: 0xffffacf4CORE_CLK_CFG 0xB300_0024: 0x80000000SER2 got sysintr:0x00000013SER2 Serial Port, new baud rate:0x1c200 (UARTCLK:83250000 IBRD:0x2d FBRD:0xa)++SER_Init: context Drivers\Active\11SER_Init, dwIndex:3GPIO_Select0 Register 0xB300_0024: 0x80000000Control Register 0xB300_0010 : 0x00000040RAS Select Register 0xB300_000C: 0xffffacf4CORE_CLK_CFG 0xB300_0024: 0x80000000+OALIntrRequestSysIntr IRQ (1) already used by SYSINTR (19)SER3 got sysintr:0x00000014SER3 Serial Port, new baud rate:0x1c200 (UARTCLK:83250000 IBRD:0x2d FBRD:0xa)OHCI\system.c, GCFG_USBH1_SW_RSTOHCI\system.c, GCFG_USBH2_SW_RST-EDeviceLoadEeprom 80:09:02:01:BF:42Phy not foundWaitForLink Start (ticks=3751)Link Detected (ticks=3753)GMAC Init : 100 Mbit/s FULL DUPLEX (MII)Flushed Transmit BufferphyCfg->dwSpeed 0x64<--EDeviceInitializeGMAC DMA status register = 0x600004GMAC Device enable interruptDriverStartGMAC Device enable interruptResetting the USB-device siliconsh600_pdd, IOCTL_BUS_POSTINITERROR: C:\WINCE600\3RDPARTY\Agilent\HPP\Common\Drivers\stm320_UsbFnBusDriver\.\ufnbus.cpp line 1137: failed opening \Agilent Flash\SPD\usbOverridestm320_UsbFnBusDriver, set IST priority 96Code:********************* NOR Flash Images ****************************************** NAND Flash Images *********************Image at offset 00000000:Image Name: XLOADERCreated: 2012-05-16 23:33:58 UTCImage Type: ARM Linux Firmware (uncompressed)Data Size: 5370 Bytes = 5.2 KiBLoad Address: d2800b00Entry Point: d2800b00Verifying Checksum ... OKImage at offset 00020000:Image Name: XLOADERCreated: 2012-05-16 23:33:58 UTCImage Type: ARM Linux Firmware (uncompressed)Data Size: 5370 Bytes = 5.2 KiBLoad Address: d2800b00Entry Point: d2800b00Verifying Checksum ... OKImage at offset 00040000:Image Name: XLOADERCreated: 2012-05-16 23:33:58 UTCImage Type: ARM Linux Firmware (uncompressed)Data Size: 5370 Bytes = 5.2 KiBLoad Address: d2800b00Entry Point: d2800b00Verifying Checksum ... OKImage at offset 00060000:Image Name: XLOADERCreated: 2012-05-16 23:33:58 UTCImage Type: ARM Linux Firmware (uncompressed)Data Size: 5370 Bytes = 5.2 KiBLoad Address: d2800b00Entry Point: d2800b00Verifying Checksum ... OKImage at offset 00100000:Image Name: UBOOTCreated: 2012-10-09 18:59:15 UTCImage Type: ARM Linux Kernel Image (uncompressed)Data Size: 237084 Bytes = 231.5 KiBLoad Address: 03f00000Entry Point: 03f00000Verifying Checksum ... OKImage at offset 00320000:Image Name: PBOOTCreated: 2012-05-22 16:06:43 UTCImage Type: ARM Linux Kernel Image (gzip compressed)Data Size: 38780 Bytes = 37.9 KiBLoad Address: 00000000Entry Point: 00000000Verifying Checksum ... OKp510>Code:printenvramboot=dhcp 0x4000000 nk.bin;run bootcmdbaudrate=115200gatewayip=192.168.1.10netmask=255.255.255.0chipversion=AAboardversion=4serialnum=MY99999999ftp=dhcpserverip=000.000.000.000bootdelay=0ecc=4cnfg_vmc_input_pin=mw 0xb3000028 0x00040300 1;mw 0xb3000048 0xfffbffff 1cnfg_lan_input_pin=mw 0xb3000030 0x00000008 1;mw 0xb3000050 0xFFFFFFFF 1;mw 0xb3000018 0x00000101preboot=mw.l 0xb300000c 0xffffacf4; run cnfg_lan_input_pin; run cnfg_vmc_input_pin; splash loaddispParm1=110 1e0 989680 0 28dispParm2=1 1 1 1 3numinstimages=1pbootdelay=0fimage=1nimages=2image1=0xd0620000image2=0xd2120000fsstart=0x3020000numfilesystems=2lengthfilesystem1=0x4EE0000lengthfilesystem2=0x100000bootcmd=nand read 0x600000 0x320000 0x10000;bootm 0x600000uart2=1rtc=1ps=0splashdata=0xd0180000erase_env=nand erase 0xC0000 0x40000store_xloader=xload 0x800000get_xload_eth=dhcp 0x800000 xloader-p510.bin; run store_xloaderstore_uboot=nand erase 0x100000 ${blocksize}; nand write 0x800000 0x100000 ${blocksize}get_uboot_eth=dhcp 0x800000 u-boot-p510.bin;run store_ubootstore_pboot=nand erase 0x320000 ${blocksize}; nand write 0x800000 0x320000 ${blocksize}get_pboot_eth=dhcp 0x800000 pboot.bin;run store_pbootflash_nkbin=dhcp 0x4000000 nk.bin;nand erase 0x00620000 ${blocksize};nand write 0x4000000 0x00620000 ${blocksize}usbtty=cdc_acmethaddr=80:09:02:01:bf:42verify=nstdin=serialstdout=serialstderr=serialipaddr=192.168.1.166guid={d602e6a5-bd8e-e946-827e-66229d5fb213}Environment size: 1487/16380 bytes

author: voltsandjolts
author_rank: Unknown
timestamp: January 09, 2025, 02:59:35 pm
content: I'm watching with interest as I have a 34461A with same symptoms as you, white screen, no uart output. Like yours, cold Spear but it probably needs replaced.Regarding swapping the front panels - there is an soic NXP LPC 8051 type mcu on the board and IIUC it has eeprom containing the meter serial. When a new panel is connected it receives the meter serial from the motherboard and is thereafter locked to that unit (thanks Keysight, very nice of you). I need to try swapping that mcu between panels to allow panel swaps. I also see that mcu has had fw protection bypassed by glitching the reset - would be nice to get a copy of the fw and eeprom.Looks like your pboot is OK but perhaps needs an nk.bin to boot to. Somewhat similar to the OP of this thread, after they had fixed their pboot. Maybe reading this thread from the start will provide some hints?

author: Eng_tech
author_rank: Contributor
timestamp: January 09, 2025, 08:14:14 pm
content: Was thinking about swapping the NXP LPC 8051 from my original front panel pcb wih the front pcb I have the new sprear processor tonight. Reason is because I read in previous comments that NXP LPC 8051 may hold the meter sn. That's an easy thing to do just to make sure that's not causing issues. Easier than doing that Spear BGA. I needed to make sure the spear processor aligned up perfectly on the pcb and decided to create a kind of drop in template that I placed on the front panel. Drop the spear into it and it is exactly aligned before applying hot air to the spear and the board underside. If the switching of the NXP LPC 8051 does not make any difference in booting then I will try loading the second image. I read the entire thread and it is a lot to digest and make sense of. I'm going to try doing the easier things first.

author: Eng_tech
author_rank: Contributor
timestamp: January 10, 2025, 12:08:22 pm
content: Swapped the NXP LPC 8051 with my original one and it didn't make any difference in the bootup process. So, then getting to the UBoot menu options I selected to load "image 2". After that I still got the same white srceen with the black Agilent text and the loading bar at the bottom. After loading is completed I wound up with just a black screen and nothing more. No, USB communications either. Haven't tried ethernet because I don't have a crossover cable. I suppose I could use a switch which I have to connect up to my laptop. When I do load image 1 I get the white screen with black Agilent with loading bar and after it done I get a partial blue background maybe upper 1/5 of the display and then the unit freezes up and nothing more.So, anyways here is what was displayed after booting image 2 it's only slightly different than Image 1. I'm stuck right now on what the problem is. Ran image verify and the images check good.Code:P500 Boot Loader Configuration :Mac address .......... (80:09:02:01:BF:42)Ip address ........... (192.168.1.166)Subnet Mask address .. (255.255.255.0)DHCP ................. (Enabled)Boot delay (seconds).. (0)Load image 1 at startupImage addresses. (0xdxxxxxxx for NAND, 0x8xxxxxxx for RAM)1 (0xd0620000)2 (0xd2120000)l) Load memory resident image Load image 1 now1) Load memory resident image 1 now2) Load memory resident image 2 now3) Load memory resident image 3 nowd) Download from platform builder nowu) Start u-boot by resettingv) Verify Images>System ready!Preparing for download...No RTC on 320Loading image 2 from memory at 0xD2120000OBL_IMAGE_TYPE_BINXXXOXOOOXXOOOOOOOXOOXOOOOOOXOOOOXOOOXXOOOOOOOOOXOOOOXOXOOXXOOOXOXXXOOXXOOOOOOXOOOXOOXXOOXXXOOOXOOXOOXXOOOXOOOOOXOOOXOOXOXOOXXXXXOXXXXOOOXOOOXOXOOOOXOOOOXOXOXOOOOOOXOOOXOOXOOOOOXXOOOOOXOXOOOOOOOOOXOXOOOOOOXOXOOOOOOOXOOOOXOXOOOOXOXOXXXXXOXXXXXXOOXOOXOXXOXXXOXOOXOXOOOOXOOOOXOOOXOOXOOXOOOXOOXXXXXXXXXXXXXXXXXXOXrom_offset=0x0.XXImageStart = 0x80361000, ImageLength = 0x111B768, LaunchAddr = 0x80362000Completed file(s):-------------------------------------------------------------------------------: Address=0x80361000 Length=0x111B768 Name="" Target=RAMLoading image 2 succeeded.ROMHDR at Address 80361044hPreparing launch...No RTC on 320Launching windows CE image by jumping at address 0x 362000Windows CE Kernel for ARM (Thumb Enabled) Built on Mar 8 2013 at 17:05:33Setting up for a Cold RebootDone Setting up for a Cold RebootWindows CE Firmware InitBSP 1.0.0 for the SPEARHEAD600AB board (built Oct 2 2013)Adaptation performed by ADENEO (c) 2005+OALIntrInit-OALIntrInit(rc = 1)Initialize driver globals Zeros area...pDrvGlobalArea 0xa0060000 size 0x800 (0xa0060800 -0xa0060000)Initialize driver globals Zeros area...doneOALKitlStartFirmware Init Done.OALIoctlHalEnterI2cCriticalSection init i2c csERROR: C:\WINCE600\PLATFORM\COMMON\SRC\SOC\STM\SPEARHEAD600\DRIVERS\GPIO\.\sh600_gpio_hw.cpp line 170: GPB driver, RegQueryDword('ISTPriority') failed, status:2ERROR: C:\WINCE600\PLATFORM\COMMON\SRC\SOC\STM\SPEARHEAD600\DRIVERS\NandFlash\.\sh600_NandFlash.c line 57: ConfigTimming - Unable to open device registry entryERROR: C:\WINCE600\PLATFORM\COMMON\SRC\SOC\STM\COMMON\DRIVERS\NandFlash\.\stm_NandFlash.c line 1043: LLD_GetInfo - Unable to open device registry entry*** DLL_PROCESS_ATTACH - Current Process: 0x42, ID: 0x400002 ***TMC_Init: context Drivers\Active\09TMC_Init: device name is 'TMC1:'Resetting the USB-device siliconTMC_Init: returning 0xc07ea190++SER_Init: context Drivers\Active\10SER_Init, dwIndex:2GPIO_Select0 Register 0xB300_0024: 0x80000000Control Register 0xB300_0010 : 0x00000040RAS Select Register 0xB300_000C: 0xffffacf4CORE_CLK_CFG 0xB300_0024: 0x80000000SER2 got sysintr:0x00000014SER2 Serial Port, new baud rate:0x1c200 (UARTCLK:83250000 IBRD:0x2d FBRD:0xa)++SER_Init: context Drivers\Active\11SER_Init, dwIndex:3GPIO_Select0 Register 0xB300_0024: 0x80000000Control Register 0xB300_0010 : 0x00000040RAS Select Register 0xB300_000C: 0xffffacf4CORE_CLK_CFG 0xB300_0024: 0x80000000+OALIntrRequestSysIntr IRQ (1) already used by SYSINTR (20)SER3 got sysintr:0x00000015SER3 Serial Port, new baud rate:0x1c200 (UARTCLK:83250000 IBRD:0x2d FBRD:0xa)OHCI\system.c, GCFG_USBH1_SW_RSTOHCI\system.c, GCFG_USBH2_SW_RST-EDeviceLoadEeprom 80:09:02:01:BF:42Phy not foundWaitForLink Start (ticks=4109)Link Detected (ticks=4111)GMAC Init : 100 Mbit/s FULL DUPLEX (MII)Flushed Transmit BufferphyCfg->dwSpeed 0x64<--EDeviceInitializeGMAC DMA status register = 0x600004GMAC Device enable interruptDriverStartGMAC Device enable interrupt

author: analogRF
author_rank: Super Contributor
timestamp: January 10, 2025, 02:11:34 pm
content: if you are not connected to LAN why is the meter thinking it is connected?still it could be a hardware issue like not properly soldered BGA ball or a RAM issue.you can test the RAM by 'mtest' command at p510> promptwithout any address, it takes a while to finish because it will check the whole RAM.as for BGA ball suspicion, I'd recommend use heat gun with a narrow nozzle on the CPU (low temp like 200C or even less)just for a few seconds while you power it on and see if the behavior changes.you can also do that same thing for the RAM and see if the behavior changesif you rule these out then most likely it is just a corrupted flash (nk.nb0 kernel is bad) and needs to be loadedby ymodem (or tfpt from LAN) to boot the device and then perform fw upgrade.your FW is 2.17 right now so you will need nk.nb0 extracted from FW2.17I assume you have already tried the obvious first thing which is just putting the .UPD file (FW update file) on the USB flashinserted in the device and power it on. that's the first thing I would have done before anything else.I think your normal boot log shows it has fired up the USB so it may look for update file on it. Most like this will not solve the issuebut it wont do any harm .I have the bin file extracted from the FW. if you do all the above tests and still inconclusive. just post message hereand I will tell you how to upload and boot the device using the external kernel

author: Eng_tech
author_rank: Contributor
timestamp: January 10, 2025, 03:01:00 pm
content: Uboot and Wince are new to me as far as troubleshooting goes. I write plenty of programming code for work and home projects for many different microcontrollers and FPGAs, but I have never worked on an operating system like Wince or on someone else's equipment design when it comes to embedded OS.I'll follow your advice and see what happens. I have not tried putting the .UPD file on a flash drive and booting. I thought the front panel USB would not be working until WinCE fully was loaded and running.I'm pretty sure the spear is seated good and all balls are connecting. I made a small fixture to make sure the spear was aligned exactly over the pads when installed. I did redo (hot air on top and bottom of pcb) for chip yesterday just to make sure. Still, you never know as I don't have Xray machine to check it. Well, I do at work but never used it. I don't think they would be too fond of me using it for personal use but wouldn't hurt to ask I guess. It has been sitting ever since we got it. No one has ever used it yet.As for LAN why do you think that the meter thinks it is connected to a LAN? I did do a mtest yesterday but for some reason it aborted and I didn't run it again. I'll try again today after I get out of work.This is just a strange thing, The spear microprocessor goes bad and shorted out the 3.3 supply to it. Put new spear in and 3.3v supply source looks good now. It appears to be a common problem with these spear processors failing and when they do NAND or RAM gets corrupted also. But anyway I'll run some more tests. I have read through the U-Boot reference manual to get better aquainted with it and it's commands.Oh, you thought LAN was hooked up because of this.Mac address .......... (80:09:02:01:BF:42)Ip address ........... (192.168.1.166)Subnet Mask address .. (255.255.255.0)DHCP ................. (Enabled)Only did this after loading image 2. It wasn't hooked up though.Thanks for your assistance!

author: analogRF
author_rank: Super Contributor
timestamp: January 10, 2025, 04:06:38 pm
content: Code:WaitForLink Start (ticks=3751)Link Detected (ticks=3753)GMAC Init : 100 Mbit/s FULL DUPLEX (MII)Flushed Transmit BufferphyCfg->dwSpeed 0x64<--EDeviceInitializealthough it is strange that it also saysCode:Phy not foundstill this may not point to anything though....if the CPU is fine then the only other thing I can think of is the kernel being corrupted which needs to be loaded by ymodem (very slow)or tftp (very fast)still booting with a USB with FW file is good ideaI checked my logs and it seems the mtest doesnt work on these meters I think it is not implemented correctly or somthingit works on keysight scopes though.a pointed/localized heat gun for a few seconds on the memory chip at power on usually will detect if the RAM is bad.if those will get you nowhere I will upload the kernel and you can boot the device either by ymodem or tftpI highly recommend tftp because the loading process may encounter errors and in tftp you can repeat it very quickly many timeswith ymodm is very slow and if error occurs the you wasted like half an hour for nothing...

author: Eng_tech
author_rank: Contributor
timestamp: January 11, 2025, 02:44:00 am
content: Well, booting with USB stick with firmware didn't work loading either image 1 or 2. Guess I'll try what you recommend using tftp and nk.nb0. I tried hooking the LAN connection to a network switch as well as my laptop but I couldn't establish a connection. Maybe I need to make up a cross over cable and try that. What are your instructions for doing this? What program are you using to run tftp on your computer? MobaXterm?

author: coromonadalix
author_rank: Super Contributor
timestamp: January 11, 2025, 04:25:24 am
content: mobaxtermputty no gui,bitvises ssh client, voc terminal free for 30 daysnormally the cross over era cable are supposed to be over, any good router hub should have auto mdx negotiation, all our scopes, dmm, gens etc are straight cables, hub will help if the meter is in dhcpwireshark free maybe could be useful, when you start the meter you can see its ip address or any requests it will make on the network, once you find the right lan connection in wiresharkbe sure your main system is not consuming data, video audio updates ...

author: Eng_tech
author_rank: Contributor
timestamp: January 11, 2025, 03:55:59 pm
content: I tried connecting through a network switch and also through my wireless router LAN connections and cannot make a connection to the 34461a. Front panel USB does not work either. Rear USB I don't know as boot log is showing I have 1 USB connection but it seems like it's not working. Not recoginized if I plug it into my laptop USB. So, this looks like if I need to use Ymodem if I want to attempt installing a new kernal.

author: coromonadalix
author_rank: Super Contributor
timestamp: January 11, 2025, 07:08:07 pm
content: mmm seems the problems levels have increasedsome talked about spear mcu damages, flash corruption, some about some voltage regulators who failed in the mcu section ... dangit would need a working one and probe into many places to get voltages, data points. memory dumps etc ... well done keysight well done

author: Eng_tech
author_rank: Contributor
timestamp: January 13, 2025, 12:30:43 am
content: Tried to convert Nk.bin to nk.nb0 using viewbin.exe to get start and length which did not work giving error "Missing B000FF) Not a BIN file".Then was going to use cvrtbin.exe afterwards but assuming that won't work either. What's the reason for this? I'm trying these utilities because I don't want to have to install another programming environment to do the conversion or extraction of nk.nb0.analogRF, you mentioned you have a good nk.nb0 file you can share? It would be greatly appreciated.update... So, i decompresses nk.bin, used a small Russian made utility to create the nk.nb0 file. Then I uploaded it via Tera Term Y modem using loady waited the long 40 minutes. After it was done I ran "go 0x00320000" and nothing happened.. Could be something wrong I did maybe like not have a good nk.nb0 file. Tried bootm also after another 40 minutes got wrong image format error.

author: analogRF
author_rank: Super Contributor
timestamp: January 13, 2025, 12:39:13 pm
content: Quote from: Eng_tech on January 13, 2025, 12:30:43 amI sent you the nk.nb0 file for 2.17. The FW in your device right now is 2.17. if you use another bin file it wont workbut where did you load the file in the memory? I am curious how did you come up with "go 0x00320000"?you have to load it into 0x0361000 ("loady 0x0361000 115200" if you want to use ymodem) and then after finished loading with no errorsuse "go 0x00362000" to bootbut like I said, you can use tftp if you set up a tftp server and put the nk.nb0 file in the shared directoy and then usethe dhcp command at p510> prompt.believe me it will connect to ethernet and will get an IP instantly and download the file. Use the same address 0x0361000 for downloading the bin fileinto memory.still I am puzzled why your device thinks there is an ethernet cable connected when there is none but who knows...let's see if it boots

author: Eng_tech
author_rank: Contributor
timestamp: January 13, 2025, 01:16:43 pm
content: Thanks, very much appreciated, I was looking at past posts and looked like it was mentioned to load the nk.nb0 file at 0x00320000. Anyway, thanks for pointing out my mistake because it looks like I was doing this all wrong. I think I tried DHCP command and didn't do anything but I'll try it again and see if it gets working. Really, thanks for the help. At work so, won't be able to try anything till tonight EST.

author: analogRF
author_rank: Super Contributor
timestamp: January 13, 2025, 06:06:53 pm
content: Quote from: Eng_tech on January 13, 2025, 01:16:43 pmtechnically you can upload it anywhere in the ram as long as it is not used at the time but then you have to skip 0x1000 for the start or launch address.however if you look at your boot record the FW always copies the bin file at 0x361000 and then starts at 0x362000 exactly the same as in Keysight 3000/2000 scopes.with DHCP command you need to give the correct addresses too just like above. or u can use tftp to upload it to memory Instead of LOADY from terminal and then use the 'go' command. your tftp server must be up and running.if the unit still cannot connect to tftp server then I'd say there is still some hardware problem to be sorted out specially since she thinks the ethernet is connected while it isn'tI once had a case when the LAN controller chip LAN8710A needed to be replaced as well but never saw such a case again

author: Eng_tech
author_rank: Contributor
timestamp: January 14, 2025, 02:54:13 am
content: Must still be a hardware problem. Maybe I will go back a try reheating the spear process again. Or I have RAM issues. I get the same result as I have with booting from the NAND. It boots but gets a partial screen that is white with about 1/5 of the top of the display has a blue background. Here is the boot log. I did this with Ymodem.Just for funI'm going to do DHCP knowing full well it ain't gonna work. I'll heat that Spear up more tomorrow at work. Just tried DHCP, gives no ethernet adapter found, same with tftp commandAlso, any idea about the 2 leds next to the FPGA on the main board. The one closest to the FPGA is always flashing and the one farthest away is always on. Is this normal behavior?Maybe this thing is too far gone. It partially boots but stops that was giving me some hope.Code:## Starting application at 0x00362000 ...Windows CE Kernel for ARM (Thumb Enabled) Built on Mar 8 2013 at 17:05:33Setting up for a Cold RebootDone Setting up for a Cold RebootWindows CE Firmware InitBSP 1.0.0 for the SPEARHEAD600AB board (built Oct 19 2017)Adaptation performed by ADENEO (c) 2005+OALIntrInit-OALIntrInit(rc = 1)Initialize driver globals Zeros area...pDrvGlobalArea 0xa0060000 size 0x800 (0xa0060800 -0xa0060000)Initialize driver globals Zeros area...doneOALKitlStartFirmware Init Done.OALIoctlHalEnterI2cCriticalSection init i2c csERROR: C:\WINCE600\PLATFORM\COMMON\SRC\SOC\STM\SPEARHEAD600\DRIVERS\NandFlash\.\sh600_NandFlash.c line 57: ConfigTimming - Unable to open device registry entryERROR: C:\WINCE600\PLATFORM\COMMON\SRC\SOC\STM\COMMON\DRIVERS\NandFlash\.\stm_NandFlash.c line 1043: LLD_GetInfo - Unable to open device registry entry++SER_Init: context Drivers\Active\10SER_Init, dwIndex:2GPIO_Select0 Register 0xB300_0024: 0x80000000Control Register 0xB300_0010 : 0x00000040RAS Select Register 0xB300_000C: 0xffffacf4CORE_CLK_CFG 0xB300_0024: 0x80000000SER2 got sysintr:0x00000013SER2 Serial Port, new baud rate:0x1c200 (UARTCLK:83250000 IBRD:0x2d FBRD:0xa)++SER_Init: context Drivers\Active\11SER_Init, dwIndex:3GPIO_Select0 Register 0xB300_0024: 0x80000000Control Register 0xB300_0010 : 0x00000040RAS Select Register 0xB300_000C: 0xffffacf4CORE_CLK_CFG 0xB300_0024: 0x80000000+OALIntrRequestSysIntr IRQ (1) already used by SYSINTR (19)SER3 got sysintr:0x00000014SER3 Serial Port, new baud rate:0x1c200 (UARTCLK:83250000 IBRD:0x2d FBRD:0xa)OHCI\system.c, GCFG_USBH1_SW_RSTOHCI\system.c, GCFG_USBH2_SW_RST-EDeviceLoadEeprom 80:09:02:01:BF:42Phy not foundWaitForLink Start (ticks=3751)Link Detected (ticks=3753)GMAC Init : 100 Mbit/s FULL DUPLEX (MII)Flushed Transmit BufferphyCfg->dwSpeed 0x64<--EDeviceInitializeGMAC DMA status register = 0x600004GMAC Device enable interruptDriverStartGMAC Device enable interruptResetting the USB-device siliconsh600_pdd, IOCTL_BUS_POSTINITERROR: C:\WINCE600\3RDPARTY\Agilent\HPP\Common\Drivers\stm320_UsbFnBusDriver\.\ufnbus.cpp line 1137: failed opening \Agilent Flash\SPD\usbOverrideERROR: OALIoCtlHalGetDeviceInfo: Device doesn't support IOCTL_HAL_GET_DEVICE_INFO::SPI_GETUUIDWarning: you are calling IOCTL_HAL_GET_UUID, which has been deprecated. Use IOCTL_HAL_GET_DEVICE_INFO instead.ERROR: OALIoCtlHalGetUUID: Device doesn't support UUIDstm320_UsbFnBusDriver, set IST priority 96

author: analogRF
author_rank: Super Contributor
timestamp: January 14, 2025, 03:25:16 am
content: I would insert a USB stick with FW file on it into the device before uploading the bin file and issuing the 'go' command. Still I think the correct kernel should look for update file if it finds a usb flashfor me this is still strange and does not match what I have seen on these meters. Maybe I am wrong but I have many logs of different meters and noneshows up like this. I mean first it says phy not found and then it shows link detected and 100Mb/sec even though no cable is connectedthis is not some internal ethernet communication. this is exactly for the LAN connection.Code:Phy not foundWaitForLink Start (ticks=3751)Link Detected (ticks=3753)GMAC Init : 100 Mbit/s FULL DUPLEX (MII)Flushed Transmit BufferphyCfg->dwSpeed 0x64<--EDeviceInitializeit could be that dll files of the WInCE are corrupted as well. The next message you will see after the last line of your log is about loading some dll files.of course there could be some other stuff going on in between which we are not aware of but as far as the UART messages are concerned the next message is about some dll files. If that's the case we need to force the unit to boot the wince from usb (just like in the keysight 3000A scopes) and thus take the dlls from therei dont know how it can be done but it must be similar to keysight infiniivision scopes.still I think a hardware issue is the more likely problem. if you got the cpu from aliexpress, be ready to exchange it again as I had to a couple of times.also maybe probing around that LAN chip could be useful too

author: Eng_tech
author_rank: Contributor
timestamp: January 14, 2025, 04:35:50 am
content: I probably won't give up on it yet. I will probably just get another cpu again. I get them from a seller on ebay. They look original. The seller is top-chips and the chips are SPEAR320S-2-AA. Others being sold on ebay are Spear320-2. The seller is good, packages it in anti-static bags and the chips are cut from a reel tape and not loose. He has them cheap at $14 a piece last time I looked. Others sell them at much higher costs. Think I will pick up 2 more. Replacing them is no easy task but I figured out a way to perfectly align them on their pads. I will show you how I manage that if I can get an image of my little fixture/guide on here. It works really good.

author: Eng_tech
author_rank: Contributor
timestamp: January 14, 2025, 01:21:33 pm
content: When I first did the YModem upload and booted I did have my USB flash drive inserted into the front panel with the firmware on it. The flash drive just flashed it's led like it was being read but the meter's screen stayed white. I left it alone giving it some time and watch the serial terminal for any indication that something was happening. After a while, I just shut off the meter and tried the same process but without the flash drive attached. It booted just like it boots off the NAND.So, you speak of DLL files. They are not part of nk.nb0 that I uploaded via Ymodem? I'm confused. You think they are loaded in at another location in NAND? You could be correct that the boot process halts from a corrupted DLL. It looks like the process just stops as it is trying to display the blue graphics background. Gets a small part of the way and stops.

author: analogRF
author_rank: Super Contributor
timestamp: January 14, 2025, 01:31:44 pm
content: Quote from: Eng_tech on January 14, 2025, 01:21:33 pmyes if i understood correctly (others may correct me here) the main wince files are still being read from the nand. the nk.nb0 is just a minimal kernel to boot the device initially. i may be wrong about that but since everything is quite similar to keysight scopes, I believe the main WinCE files are loaded after your last line of boot record. if we can extract them from the FW file and instruct the meter to read them from usb then maybe....are you sure there is no hardware issue with the display itself? or the LAN chip? those lan messages are still bothering me....

author: coromonadalix
author_rank: Super Contributor
timestamp: January 14, 2025, 02:32:33 pm
content: Windows Ce by default load nk. *** in ram and decompress it to run ... normally the bin vs the b0 contain more data and infos .. but both should contain configs / drivers and the Keysight dmm executable software ....at some point Windows Ce could be connected to Windows if it contains what it need to do that communication, that way once connected you see WinCe drive and files and can copy them out, export the registry etc ... not sure in this case, i don't have theses meters to play withhttps://supportcommunity.zebra.com/articles/en_US/Knowledge/Windows-CE-device-does-not-connect-with-Windows-10-with-Creators-upgrade-via-WMDCunless you do have somekind of ssd emmc or elses, it start in nand ram locations as mentioned, some on other threads managed to shift the allocation / address to be able to boot the dmm ??the Spear 320 failures ? , no one has clearly stated why it is failing, voltages ?, heat ? degradation ?for the other peripherals as we can guess usb and lan hardware should come 1st to be able to help if it crash ? uboot or others ... the spear 320 should contain what we need ? unless ...old 2023 threadhttps://www.eevblog.com/forum/repair/agilent-keysight-34461a-doesnt-boot/https://www.eevblog.com/forum/repair/keysight-34461a-179388/34465https://www.eevblog.com/forum/testgear/keysight-34465a-reliability/

author: Eng_tech
author_rank: Contributor
timestamp: January 14, 2025, 03:43:00 pm
content: Pretty sure display is good. As when it first boots you get a white background with the words Keysight Technologies in black and at the bottom of the display is a black bar that increases in length as the booting process runs. After that, the screen would display a blue graphics background image that says on it Keysight Technologies with a load bar at the bottom that would say "initializing and verifying hardware". Only if the meter is working correctly. But I only get the very top part of that blue graphics background and the meter stops booting at that point or loading the OS. So, maybe it's something with "initializing and verifying hardware". DLL, driver maybe? You would think it would at least display the full graphics background but it stops loading it or sending it to the display. Or maybe where the image is stored is corrupted. Don't know yet.

author: coromonadalix
author_rank: Super Contributor
timestamp: January 14, 2025, 05:28:31 pm
content: previous fw as 3.01 3.02 where about memory leaks, the latest v 3.03 ??and a small note from keysight ?have you tried the fw updater from keysight ? +- 72 Mb

author: Eng_tech
author_rank: Contributor
timestamp: January 14, 2025, 05:32:48 pm
content: This is whats contained in nb.nb0. I used a utility called dumprom.exe to extract all the files to a folder. It's a large log of what was dumped and it won't all fit in this message so I'm attaching it as a text file.

author: coromonadalix
author_rank: Super Contributor
timestamp: January 14, 2025, 05:51:39 pm
content: windows ce tools

author: Eng_tech
author_rank: Contributor
timestamp: January 14, 2025, 06:00:22 pm
content: I've used it to create a USB drive containing the firmware that the meter orginally had. Of course the USB on the front panel does not work so it can't be used for updating firmware. YModem is only choice that works at this point. The log generated from dumprom is nice as it shows where each file is located and its length. Of what help that will at this point I don't know. I just wanted to see the files thats contained in nb.nb0.

author: coromonadalix
author_rank: Super Contributor
timestamp: January 14, 2025, 07:12:42 pm
content: the worst would be some both spear problems and nand corruption ?? dangbut the keysight fw talk about creating the build.xml file and the Nk.bin and put them on the usb keyattached

author: Neganur
author_rank: Unknown
timestamp: January 15, 2025, 04:36:56 pm
content: managed to fix a white screen / no boot error on an 34465A by swapping the Spear (U201).As received, unit did power up, but no fan/USB/LAN, white display.Upon initial optical inspection of the front panel module, I saw that the Spear had shorted solder balls, and the power management IC (TPS650701) got very hot.Replaced the Spear, short circuits were gone. Unit powered on, fan spun up. B/W Keysight logo on the display with a progress bar running, but halting.Two reboots and the progress bar made it to 100%, device seems to power up normally and functions.Last instrument error displayed is "+822 Controller and measurement board serial numbers do not match", which went away after a factory reset (Edit: seems to persist, error queue was just emptied).The Spear is quite warm to the touch, I think I am going to place one of those sticky heat sinks on it.Is it worthwhile dumping the EEPROM?

author: coromonadalix
author_rank: Super Contributor
timestamp: January 15, 2025, 05:07:31 pm
content: @neganur, if you can do a dump and post it, sure it would maybe help others ??the best would be having nand dumps and others things like a "good booting" log filethe FW is good for the 34461 34465 and 34470 meters ?

author: Eng_tech
author_rank: Contributor
timestamp: January 15, 2025, 05:56:31 pm
content: Well just to isolate the problem with this meter I put my front panel on a known good unit to see if that unit would act the same during the boot process and it did. This eliminates the main pcb from having anything to do with the problem. So, the problem still resides with the front panel. I'm going to check out the best I can the Ethernet controller on the front panel because during boot the unit thinks it is wired to a network which it isn't. This maybe a clue of some kind. Odd that they put the ethernet controller on the front panel. I would think they would have that near the network connector on the main pcb.

author: Eng_tech
author_rank: Contributor
timestamp: January 17, 2025, 02:54:51 am
content: Success! I think. I replace the LAN/Ethernet IC LAN8710A and the unit completely boots up now. Only one other condition exists and that is a little red box in the upper right corner that says "error". It passes self testing also. I am thinking that maybe the meter lost it's calibration information but could be wrong. Tried to do a self calibration but the meter is locked. Firmware updates are also locked. An odd thing that when this meter finally booted up it did a firmware update by itself. Sad installing firmware update in 2 parts. Same version. Kinda strange but maybe has something to do with the new spear microprocessor.

author: analogRF
author_rank: Super Contributor
timestamp: January 17, 2025, 03:06:07 am
content: Quote from: Eng_tech on January 17, 2025, 02:54:51 amgreat !I told you I was very suspicious of that LAN chip because the log was strange.you should be able to see the error in the error list. also the boot record might show what error is happeningcan you connect to the ethernet? does the meter get IP?no calibration is not lost. it is in a eeprom on the main board but I think there is a procedure to read that calibration and copy to nand because you changed the front panel. that could be the cause of erroryou can update the FW either with lan or usb stick.

author: Eng_tech
author_rank: Contributor
timestamp: January 17, 2025, 03:31:05 am
content: Jumped the gun I guess. It is randomly doing the same thing upon booting up. Sometimes the meter is working normally and sometimes I just get what I was getting before. It is a big step in the right direction I think. I have to find out why it is randomly working. Yeap, the error had something to do with calibration an serial numbers not matching. But for some reason after looking at the log the errors went away. Still gotta find out what is going on. Maybe I have a bad solder connection on that LAN chip. It was a bit of a pain getting it mounted and soldered. I used hot air on it both on top and below with and Chip Quik paste.

author: coromonadalix
author_rank: Super Contributor
timestamp: January 17, 2025, 10:09:11 am
content: Lan chip that's a 1st report i've seen @analogRF was rightyou should be able to realign it, but theses have a thermal pad under them ....or you may burn it ?i would have tried the meter without it just to see if it get working and stay stable in reboots ? and do a factory reset ...

author: analogRF
author_rank: Super Contributor
timestamp: January 17, 2025, 11:46:59 am
content: Quote from: Eng_tech on January 17, 2025, 03:31:05 amvery much sounds like a soldering issue either with the LAN chip or the CPU itself. solder paste can be a pain...

author: Eng_tech
author_rank: Contributor
timestamp: January 19, 2025, 02:15:22 am
content: Well, it completely stop working. I used the LAN chip from off another front panel. So, desoldering and then resoldering it to another pcb may have done damage to it. Maybe I applied heat too long or too much heat I don't know as it has a ground pad under the chip and had to make sure it connected. In any case I'm pretty sure this can be resolved. I'm ordering a new chip actually a couple from Digikey and replace the one I think is defective. This is going to take about a week or so before I get the new chip and put it on. So, I'll give an update when that is accomplished.

author: Eng_tech
author_rank: Contributor
timestamp: January 22, 2025, 06:00:12 am
content: Finally, after putting in a new LAN IC, the meter is now working. It is fully functional, and passes both self tests. It is still coming up with an error on bootup that the serial numbers don't match but that is not affecting it's operation in any way. The serial number must be stored in NAND as I replaced the other microcontroller on the front panel with the one from my original front panel that I messed up when changing out the spear processor. I had damaged it pads trying to clean them up with solder wick. A couple pads got stuck to the solder wick and were ripped off. Hopefully it last for awhile. I have 2 spare spear processors on their way to me just in case I have to change it out again. It's not a simple task doing it by ones self. There are places that will professionally change the chip out for you as long as you provide them the chip. The cost I don't know. In all I spent a little over $100.00 to fix this thing. Which is a good deal seeing I got it for free. But anyways, I would like to thank all who gave their helpful advice in troubleshooting the problem. Also, those who posted their issues and troubleshooting methods in previous messages on here.

author: voltsandjolts
author_rank: Unknown
timestamp: January 22, 2025, 08:36:32 am
content: Can you please confirm the PN and markings on your replacement SPEAR?Can you share the eBay item number?Thanks.

author: Eng_tech
author_rank: Contributor
timestamp: January 22, 2025, 05:11:12 pm
content: The seller is top-chips and the chips are SPEAR320S-2-AA. It costs I believe it was $14.00 US dollars for one. He has a limited amount so get them while you can. I have 2 on order from him now for backup spares. They are not easy to replace and must be perfectly aligned on the pads. Also, it is very easy to tear off pads if you use solder wick to remove the excess solder on the pads after removing the faulty chip. The pads need to be level. No high spots from solder or the new chip will not seat correctly. You can use flux but a very thin coating of it because it bubbles up when heated and will cause the new chip not to seat correctly. The pcb should be heated on the underside at about 130 degrees Celsius and on top with a smd hot air station about 450 - 500 celsius maybe a little more if the chip is not coming off. Don't try to pull it up. Just poke it on one of it's sides to see if it moves while heating. Once it moves keep applying heat and gently, and slowly lift it up. I made a guide out of fr4 board that fits snuggly on the front panel pcb. It fits exactly around the spear chip with only a very tiny amount of play so the chip will seat down without hanging up on the guide. It works perfectly aligning the chip up for soldering. I will try and post of picture of it sometime soon if someone wants to do it that way.

author: coromonadalix
author_rank: Super Contributor
timestamp: January 22, 2025, 05:23:50 pm
content: once again a spear mcu who get defective BUT whythks for the heads upcan the owners of theses 34461 65 70 series check their working temperatures ?

author: voltsandjolts
author_rank: Unknown
timestamp: January 22, 2025, 06:33:58 pm
content: Quote from: Eng_tech on January 22, 2025, 05:11:12 pmGot it, ebay.com item 395529524773Thanks for the tip!

author: Eng_tech
author_rank: Contributor
timestamp: January 22, 2025, 08:11:15 pm
content: Yes, temperature can be read when you put it in calibration mode. Mine is reading 26 degrees Celsius. It has been on for several hours.

author: kanzler
author_rank: Newbie
timestamp: February 03, 2025, 10:58:35 am
content: Dear analogRF,could you please share the file nk.nb0 with me? I havent repaired my device yet so I belive it would help me out.Thanks in advance

author: analogRF
author_rank: Super Contributor
timestamp: February 03, 2025, 11:58:36 am
content: Quote from: kanzler on February 03, 2025, 10:58:35 amwhich version of FW?

author: kanzler
author_rank: Newbie
timestamp: February 03, 2025, 03:30:00 pm
content: Hi,I`d like the FW 2.17 version if possible.

author: analogRF
author_rank: Super Contributor
timestamp: February 03, 2025, 03:43:19 pm
content: Quote from: kanzler on February 03, 2025, 03:30:00 pmhttps://www.mediafire.com/file/bautnyseg219yna/nk.nb0.FW2.17_34461A.rar/file

author: kanzler
author_rank: Newbie
timestamp: February 03, 2025, 03:53:16 pm
content: Thank you very much! As soon as I make it all work out, I will update you!

author: kanzler
author_rank: Newbie
timestamp: February 08, 2025, 10:28:35 am
content: Dear analogRF,thank ypu very much for your file. Sadly I still cant get my device to work properly and I cant download the file.I have attached the download in my log. Would you mind take a look at it?Thanks in advanceCode:U-Boot 2010.03 (Oct 09 2012 - 12:48:30)Agilent P510CPU: SPEAr320DRAM: 128 MiBUnknown id: 0xffffff. Using ST_M23P40Flash: 64 KiBNAND: INTERNAL ECC 128 MiBfailed: 5 0nand_bbt: Can't scan flash and build the RAM-based BBTIn: serialOut: serialErr: serialSerNum:MY99999999Chip: AA Board Rev: 4init RTC: 2002-03-08 18:08:29.29Net: No ethernet found.splash RTC: 2002-03-08 18:08:30.32Press space to stop autoboot: 0p510> run bootcmdNAND read: device 0 offset 0x320000, size 0x1000065536 bytes read: OK## Booting kernel from Legacy Image at 00600000 ...Image Name: PBOOTCreated: 2012-05-22 16:06:43 UTCImage Type: ARM Linux Kernel Image (gzip compressed)Data Size: 38780 Bytes = 37.9 KiBLoad Address: 00000000Entry Point: 00000000Uncompressing Kernel Image ... OKStarting kernel ...Debug serial initialized ........OKNo RTC on 320Microsoft Windows CE Bootloader Common Library Version 1.4 Built May 22 2012 09:09:57Microsoft Windows CE 6.0 Ethernet Bootloader for the Agilent P500 boardAdaptation performed by Agilent Technologies (c) 2008Reading NAND configurationP500 Boot Loader Configuration :Mac address .......... (80:09:02:05:E6:FA)Ip address ........... (192.168.1.222)Subnet Mask address .. (255.255.255.0)DHCP ................. (Enabled)Boot delay (seconds).. (0)Load image 1 at startupImage addresses. (0xdxxxxxxx for NAND, 0x8xxxxxxx for RAM)1 (0xd0620000)2 (0xd2120000)l) Load memory resident image Load image 1 now1) Load memory resident image 1 now2) Load memory resident image 2 now3) Load memory resident image 3 nowd) Download from platform builder nowu) Start u-boot by resettingv) Verify Images>System ready!Preparing for download...No RTC on 320Downloading image from platform builderSetting MAC address GMAC_MAC_ADDR_HI_LO = 0x8000FAE6, GMAC_MAC_ADDR_HI_LO = 0x5020980Auto Negotiation complete in 151430 iterationsLink upAutoNegotiate Full DuplexAutoNegotiate 100 Base TReading MAC address 0x8009 0x205 0xE6FASetting MAC address GMAC_MAC_ADDR_HI_LO = 0x8000FAE6, GMAC_MAC_ADDR_HI_LO = 0x5020980INFO: GMAC Ethernet controller initialized.InitDHCP():: Calling ProcessDHCP()ProcessDHCP()::DHCP_INIT!CheckUDP: Not UDP (proto = 0x00000002)!CheckUDP: Not UDP (proto = 0x00000002)!CheckUDP: Not UDP (proto = 0x00000002)!CheckUDP: Not UDP (proto = 0x00000002)!CheckUDP: Not UDP (proto = 0x00000002)!CheckUDP: Not UDP (proto = 0x00000002)!CheckUDP: Not UDP (proto = 0x00000002)!CheckUDP: Not UDP (proto = 0x00000002)Got Response from DHCP server, IP address: 192.168.0.13ProcessDHCP()::DHCP IP Address Resolved as 192.168.0.13, netmask: 255.255.255.0Lease time: 179940 secondsGot Response from DHCP server, IP address: 192.168.0.13No ARP response in 2 seconds, assuming ownership of 192.168.0.13+EbootSendBootmeAndWaitForTftpSent BOOTME to 255.255.255.255Sent BOOTME to 255.255.255.255Sent BOOTME to 255.255.255.255Sent BOOTME to 255.255.255.255Sent BOOTME to 255.255.255.255Sent BOOTME to 255.255.255.255Sent BOOTME to 255.255.255.255Sent BOOTME to 255.255.255.255Sent BOOTME to 255.255.255.255Sent BOOTME to 255.255.255.255Sent BOOTME to 255.255.255.255Sent BOOTME to 255.255.255.255Sent BOOTME to 255.255.255.255Sent BOOTME to 255.255.255.255Sent BOOTME to 255.255.255.255Sent BOOTME to 255.255.255.255

author: imett
author_rank: Contributor
timestamp: March 16, 2025, 06:43:28 pm
content: Hi, here my problem,my 34461A have had the spear320s-2 fried, i replace it with a spear320-2 withoutS.the screen is white anyway, no RS232 signal from the on board connector... (have you noticed that in this connector are two RS232 ports?)I've checked the TPS three voltage out ok ( 1.2V ok, 1.8V ok, 3,3V ok), even the 5V is ok, all the board sink about 100mA on.What could be the problem? The DDR? The Spear bad soldered?Thanks at allMatteo

author: K
author_rank: Contributor
timestamp: March 27, 2025, 11:52:57 pm
content: I am trying to fix a "dead NAND" problem on my 34465A.Events:* Acquired broken 34465A.* Replaced a smashed LCD and fixed blown input resistors/inductors on main board. Repair thread here:https://www.eevblog.com/forum/repair/hints-for-fixing-a-34465a-(blown-input)/* Unit booted fine, no errors.* Upgraded firmware to 3.0.3. Initially unit booted fine.* Then few days after it failed to boot - showed splash, and then inital black progress bar got stuck at ~80%.* Connected to serial port. Found that XLOADER and U-Boot loaded ok, but PBoot failed while reading main image from NAND (see Boot log #1).* Some days after that even XLOADER and U-Boot would not load - screen was black, and nothing on serial port.* BUT - when connected with USB cable to a computer, a USB device would show up as "Bus 002 Device 017: ID 0483:3801 STMicroelectronics", which, according to SPEAR320S reference, is a fallback for case when NAND is not found/errors out.From all of the above I take that CPU itself is not dead. Which is good. But NAND likely has died. Which is quite less good.Alternatively the issue might be caused by bad/broken CPU solderballs for FSCM connections, as it was apparent that unit got damaged in a fall (broken LCD). I guess this will be answered after removing NAND chip - and then trying to read it's contents.So, going with the assumption that NAND chip has indeed gone bad, I went on and ordered a replacement NAND chip.But I am missing some parts of firmware to properly flash the new NAND. To my understanding, following parts must be present:- XLOADER - from a 3446xA unit, as this contains init code/params for DDR chip. I do not have a dump of this part.- U-Boot - also from a 3446xA unit, as it appears to be some custom build. I assume it is a special build because it has extra command "xload - xload - program xloader image into NAND from memory", which I could not find in any available U-Boot source. I do not have a dump this part too.- PBoot - from 3446xA unit. Dumps of this are availble in this very thread.- nk.bin - is available from Keysight update file.The offsets for all parts in NAND can be seen in this thread.At the moment is somewhat unclear to me how and where various envs need to be present for U-Boot and PBoot, but I think there is enough info in this thread to piece those together.So, my big asks/questions are:Does anyone (analogRF, ElectronMan ?) have dumps of XLOADER and U-Boot from a 3446xA?Maybe even a dump of all "boot area" - from 0x00000000 to 0x00330000 (~3.3MB) in NAND?I suppose a dump of whole NAND chip (128MB) is somewhat unfeasable, unless there is a way to transfer it without using ymodem?Boot log #1:Code:U-Boot 2010.03 (Oct 09 2012 - 12:48:30)Agilent P510CPU: SPEAr320DRAM: 128 MiBUnknown id: 0xffffff. Using ST_M23P40Flash: 64 KiBNAND: INTERNAL ECC 128 MiBIn: serialOut: serialErr: serialSerNum:MY99999999Chip: AA Board Rev: 4init RTC: 2001-01-01 00:35:36.92Net: No ethernet found.splash RTC: 2001-01-01 00:35:37.95Press space to stop autoboot: 0NAND read: device 0 offset 0x320000, size 0x1000065536 bytes read: OK## Booting kernel from Legacy Image at 00600000 ...Image Name: PBOOTCreated: 2012-05-22 16:06:43 UTCImage Type: ARM Linux Kernel Image (gzip compressed)Data Size: 38780 Bytes = 37.9 KiBLoad Address: 00000000Entry Point: 00000000Uncompressing Kernel Image ... OKStarting kernel ...Debug serial initialized ........OKNo RTC on 320Microsoft Windows CE Bootloader Common Library Version 1.4 Built May 22 2012 09:09:57Microsoft Windows CE 6.0 Ethernet Bootloader for the Agilent P500 boardAdaptation performed by Agilent Technologies (c) 2008Reading NAND configurationSystem ready!Preparing for download...No RTC on 320Loading image 1 from memory at 0xD0620000OBL_IMAGE_TYPE_BINXXXOXOOOXOXOOOOOOOXOXOOOOOOOXOOOOXOOOXXXOOOOOOOOOXOOOOXOXOXXOXOOXOOXXXXOOXOOOOOOXOOOOXXOXXOXXOOXXOXOOXOOOXOOXXOOOXOOOOXOXOOOOXOOOXOOOXOXXXXOXOXOXXXXXXXOXXOOOXOOOXOXOOOOXOOOOXOXOXOOOOOOXOOOXOOXOOOOXOXOOOOOXOXOOOXOOOOOOOOOOOXOXOOOOOOOXOXOOOOXXOOOOOOOXOOXXOOOXOOOXOXOXXOOOXOOXXXXOXXXXXOXOOXXOXXOXXOXXXOOOXXOXXXXOXXOXOOXXOXOOXOXOOOOOOXXXXOXOOXOXOOOOXOOOOXOOOXOOXOOXOOOXOOXXXXXXXXXXXXXXXXXXXXXOXXIncorrect Data, interal ECC failed at 0x2ba5EBOOT_ReadFlash failed offset 15ca691EBOOT_ReadFlash failed location d15d2000Incorrect Data, interal ECC failed at 0x2ba5EBOOT_ReadFlash failedBlock length: 0xd2c4f is larger than 0x10000CeDecompressFlashBlock failed****** Data record 159 corrupted, ABORT!!! ******Completed file(s):-------------------------------------------------------------------------------: Address=0x80361000 Length=0x185E320 Name="" Target=RAMLoading image 1 failed, trying next oneLoading image 2 from memory at 0xD2120000OBL_IMAGE_TYPE_BINXXXOXOOOXXOOOOOOOXOOXOOOOOOXOOOOXOOOXXOOOOOOOOOXOOOOXOXOOXXOOOXOXXXOOXXOOOOOOXOOOXOOXXOOXXXOOOXOOXOOXXOOOXOOOOOXOOOXOOXOXOOXXXXXOXXXXOOOXOOOXOXOOOOXOOOOXOXOXOOOOODeCompressFlash: CeCompressDecode() failedCeDecompressFlashBlock failed****** Data record 55 corrupted, ABORT!!! ******Completed file(s):-------------------------------------------------------------------------------: Address=0x80361000 Length=0x111B768 Name="" Target=RAMLoading image 2 failed, trying next oneAll images failedPress r to reset

author: analogRF
author_rank: Super Contributor
timestamp: March 28, 2025, 02:09:04 am
content: I dont have those dumps but I believe they can all be extracted from the FWbut that is not gonna help you to build the NAND image as needed by the deviceat this point the only thing that helps is a true image (clone) of the nand memory and then how are you gonna program it?if you do have a programmer with BGA adaptor for the NAND try to read the nand you have firstI dont think the nand was physically bad. It must have been the CPU, solder balls on CPU or the NAND

author: K
author_rank: Contributor
timestamp: March 28, 2025, 07:22:02 am
content: Ah, I forgot to mention that programmer (XGecu T76) and adapter for BGA63 are coming (few days still). The NAND chip is supported.Not quite sure I understand what you meant by "they can all be extracted from the FW" - as far as I see, only nk.bin file is in Keysight firmware application, but it did not occur to me to look for XLOADER and U-Boot bytes (I have some scraps) in whole firmware application file as such. Will try that later today.Regarding potentially bad CPU - I guess I better get a replacement one, just in case.When the programmer arrives, I will remove existing NAND, check it and then go from there.

author: K
author_rank: Contributor
timestamp: March 30, 2025, 01:29:19 am
content: After some digging I am rather convinced that neither Keysight Firmware Update Utility, nor firmware update files (.upd) contain XLOADER, U-Boot or PBOOT section binaries. Which kinda makes sense - as it is application firmware.Update Utility investigation:The enormous dowload size for Keysight Firmware Utility installer is because the application itself is written in C#, and as such has all the necessary .NET frameworks and libraries bundled in for it. The IL/bytecode of the application and supporting libraries can be decompiled and investigated, albeit - with some effort, as a slight obfuscation has been applied. I did some digging and could not find anything suggesting Update Utility knows about boot section binaries. From the code in "Keysight.FirmwareUpdate.dll" I discovered that .upd files have following structure, it is quite simple:- first 4 bytes are int64, and specify length of build.xml file contents,- next part is contents of build.xml file, uncompressed.- and the rest is just gzipped nk.bin, which, somewhat curiously, it is compressed with "fastest" setting, and as such takes up more space when compressed (27MB vs 18MB).Firmware file (.upd) investigation:Extracted nk.bin from .upd, then decompressed (with bincompress.exe) and dumped the contents (with dumprom.exe) to files. Note: I have 0 experience with WinCE dev/reveng, so take following analysis with some skepticism.Looking for "UBOOT", "XLOADER", "PBOOT" strings (in various casings, both ASCII and UCS2 encodings), yielded only one interesting file - "nand320_uboo.dll". Loaded the file in Ghidra. As the file name suggests, it appears to contain functions for working with NAND. The strings in file identify one such function as "UbooWriteBootloader". The code in this function appears to validate, check some CRCs and signatures, read, compare, and then write and read to/from boot sections (XLOADER, UBOOT and PBOOT) of NAND. The function takes a pointer to "new" boot section data in as one of arguments. This function is called from something called "UBOODriver" (also a function). I did not yet manage to find any references to neither function "UBOODriver", nor it's address, nor what I think is it's thunk (i.e. a pointer in some table) address, anywhere in the rest of dump files. There might be something funny going on with calls/jumps being relative, or code being re-located, but this feels like grabbing straws. I will try to read up on how WinCE organizes the code sections, but I do not have high hopes.The "nand320_uboo.dll" file itself does not contain any data for boot sections. And there are no files, as far as I can tell, in the dump, that contain boot sections as stright binaries. And as I see it, it would make little sense to obfuscate or even compress those.So for now this looks like a dead end.Have I completely missed something?

author: voltsandjolts
author_rank: Unknown
timestamp: March 30, 2025, 07:13:54 pm
content: Quote from: dc101 on March 29, 2021, 01:59:39 amJust to add a little more info on the factory command:Code:int do_factory(cmd_tbl_t * cmdtp, int flag, int argc, char * argv[]) {nand_info_t * nand;int rc = 0;nand = nand_info;if (argc == 2) {unsigned long manufacturing_data = 0;if (strcmp(argv, "list") != 0) {manufacturing_data = simple_strtoul(argv, (char ** ) 0, 0);size_t bytes_unwritten = 0;erase_factory_data(nand);nand -> write(nand, nand -> erasesize * 4, 0x2000, & bytes_unwritten, (unsigned char * ) manufacturing_data);} else {struct manufacturing_data {unsigned char mac_addr;unsigned char guid;unsigned char serial_number;}manufacturing_data;size_t retlen = 0;nand -> read(nand, CONFIG_MANUFACTURING_OFFSET, sizeof(manufacturing_data), & retlen, (unsigned char * ) & manufacturing_data);manufacturing_data.serial_number = 0;printf("\nManufacturing Data\n");printf("\tMAC: %02x-%02x-%02x-%02x-%02x-%02x\n", manufacturing_data.mac_addr,manufacturing_data.mac_addr,manufacturing_data.mac_addr,manufacturing_data.mac_addr,manufacturing_data.mac_addr,manufacturing_data.mac_addr);printf("\tGUID: %02x%02x%02x%02x-%02x%02x-%02x%02x-%02x%02x%02x%02x%02x%02x%02x%02x\n",manufacturing_data.guid,manufacturing_data.guid,manufacturing_data.guid,manufacturing_data.guid,manufacturing_data.guid,manufacturing_data.guid,manufacturing_data.guid,manufacturing_data.guid,manufacturing_data.guid,manufacturing_data.guid,manufacturing_data.guid,manufacturing_data.guid,manufacturing_data.guid,manufacturing_data.guid,manufacturing_data.guid,manufacturing_data.guid);printf("\tSN: %s\n", manufacturing_data.serial_number);}} else {printf("Usage:\n%s\n", cmdtp -> usage);rc = 1;}return rc;}U_BOOT_CMD(factory, 2, 0, do_factory,"factory - program factory data into NAND memory\n","<address>\n"" - the first 2K of RAM <address> will be written to NAND at the appropriate block");

author: testpoint1
author_rank: Frequent Contributor
timestamp: April 11, 2025, 07:58:31 pm
content: Quote from: K on March 28, 2025, 07:22:02 amI already read the BGA63 chip (MT29F1G08ABADA), firmware 3.03, do you need me upload it?

author: voltsandjolts
author_rank: Unknown
timestamp: April 12, 2025, 12:36:23 pm
content: Yes please.

author: testpoint1
author_rank: Frequent Contributor
timestamp: April 12, 2025, 06:58:31 pm
content: Quote from: voltsandjolts on April 12, 2025, 12:36:23 pmhere you go FW 3.03:https://mega.nz/file/3DQTwTgK#nTUb7hb87H6RfphJV7CmlRjaf3hmaw28FGLEzWTfC2Uanother one is 02.17, can not boot completely, but I think the Nand chip and frimware is OK:https://mega.nz/file/Tfx3gayJ#hWoSFJlHotu_DfZQK00DR5XLYUN-Gg73Zoiprs6APyo

author: voltsandjolts
author_rank: Unknown
timestamp: April 14, 2025, 08:38:06 am
content: Thanks.Your images include the spare/ecc bytes. These can be easily removed:Code:#!/usr/bin/env pythonimport os,sysfname1 = os.path.join(os.path.dirname(__file__), 'MT29F1G08ABADAH4-ITD@VFBGA63(NQ277)-3.03-ok.BIN')f_no_spare = os.path.join(os.path.dirname(__file__), 'MT29F1G08ABADAH4-ITD@VFBGA63(NQ277)-3.03-ok-no-ecc.BIN')with open(fname1, 'rb') as f1, open(f_no_spare, 'wb') as f2:while (page := f1.read(2048 + 64)): #page size 2048 + 64f2.write(page[0:2048])Then the NAND address map is as per usual:Code:XLoader(0) => 0x0000_0000 - 0x0001_FFFF (Block 0 => 128 KB)XLoader(1) => 0x0002_0000 - 0x0003_FFFF (Block 1 => 128 KB)XLoader(2) => 0x0004_0000 - 0x0005_FFFF (Block 2 => 128 KB)XLoader(3) => 0x0006_0000 - 0x0007_FFFF (Block 3 => 128 KB)Manufacturing Data => 0x0008_0000 - 0x000B_FFFF (Block 4-5) => 256 KB)UBoot Environment Variables => 0x000C_0000 - 0x000F_FFFF (Block 6-7) => 256 KB)UBoot => 0x0010_0000 - 0x0017_FFFF (Block 8 to Block 12 => 640 KB )Splash => 0x0018_0000 - 0x001B_FFFF (Block 13 to Block 14 => 256 KB )FPGA => 0x001C_0000 - 0x0031_FFFF (Block 15 to Block 25 => 2640 KB ) (legacy, now in WinCE section?)PBoot (compressed) => 0x0032_0000 - 0x0035_FFFF (Block 26 to Block 27 => 128 KB )Redundant UBoot Environment => 0x0036_0000 - 0x0037_FFFF (Block 28-29) => 256 KB) (legacy, now removed?)WinCE* (nk.bin) => 0x0062_0000WinCE* (nk.bin) => 0x0212_0000 (recovery image?)*XPRS compressed nk.bin (bincompress.exe) inflated to nb0 in DDR by pbootSome notes on the boot process, mostly from ST User Manual UM0844. Shoot me down if I'm wrong...After power-on, the SPEAr executes an on-chip firmware BootROM from the internal SPEAr 32KiB ROM area. This is the first stage. The SPEAr boot select pins are configured for NAND Flash booting mode, so the BootROM loads a 2nd stage XLoader from NAND memory(1)to on-chip 8KiB SRAM and then gives control to it.XLoader is a small ST-specific firmware (source code available from ST apparently - anyone got a copy?) that executes in internal SRAM and configures the PLLs and the specific DDR memory available on each board. There are four copies of it in NAND for redundancy purposes(2), the first stage checks and selects which XLoader image to use (see RM0082 section 38 for details). XLoader loads a third stage boot loader (U-Boot) from NAND into DDR and jumps to its entry point.The open sourceU-Bootprogram is used as a third-stage boot loader. In addition to its role in the overall booting process, U-Boot also operates as a resident monitor. To start theserialportmonitor function after power-on, stop U-Boot execution at the "Hit SPACE to stop autoboot" prompt. This stage is configured in a special NAND partition known as U-Boot Environment (0x000C_0000), basically a collection of parameter/value pairs. U-Boot is mainly in charge of loading and then executing P-Boot.When not interrupted after board power-on, U-Boot continues to load P-Boot from NAND into DDR with the command"nand read 0x600000 0x320000 0x10000;bootm 0x600000"which means copy 64KiB (0x10000 bytes) from NAND 0x320000 to DDR 0x600000 and then start execution at DDR 0x600000.But actually P-Boot only takes up about half of that 64KiB sector.P-Boot(3)inflates one of the nk.bin images available in NAND into DDR (nb0) and runs it. Presumably the second image at 0x0212_0000 is a recovery image that allows firmware refresh over USB, if the first image fails integrity check? To be confirmed. Through the same uart as U-Boot, there is a P-Boot menu which allows selection of which image to boot.Code:P500 Boot Loader Configuration :Mac address .......... (80:09:02:01:BF:42)Ip address ........... (192.168.1.166)Subnet Mask address .. (255.255.255.0)DHCP ................. (Enabled)Boot delay (seconds).. (0)Load image 1 at startupImage addresses. (0xdxxxxxxx for NAND, 0x8xxxxxxx for RAM)1 (0xd0620000)2 (0xd2120000)l) Load memory resident image Load image 1 now1) Load memory resident image 1 now2) Load memory resident image 2 now3) Load memory resident image 3 nowd) Download from platform builder nowu) Start u-boot by resettingv) Verify Images>System ready!Preparing for download...No RTC on 320Loading image 2 from memory at 0xD2120000OBL_IMAGE_TYPE_BINXXXOXOOOXXOOOOOOOXOOXOOOOOOXOOOOXOOOXXOOOOOOOOOXOOOOXOXOOXXOOOXOXXXOOXXOOOOOOXOOOXOOXXOOXXXOOOXOOXOOXXOOOXOOOOOXOOOXOOXOXOOXXXXXOXXXXOOOXOOOXOXOOOOXOOOOXOXOXOOOOOOXOOOXOOXOOOOOXXOOOOOXOXOOOOOOOOOXOXOOOOOOXOXOOOOOOOXOOOOXOXOOOOXOXOXXXXXOXXXXXXOOXOOXOXXOXXXOXOOXOXOOOOXOOOOXOOOXOOXOOXOOOXOOXXXXXXXXXXXXXXXXXXOXrom_offset=0x0.XXImageStart = 0x80361000, ImageLength = 0x111B768, LaunchAddr = 0x80362000Completed file(s):-------------------------------------------------------------------------------: Address=0x80361000 Length=0x111B768 Name="" Target=RAMLoading image 2 succeeded.ROMHDR at Address 80361044hPreparing launch...No RTC on 320Launching windows CE image by jumping at address 0x 362000Windows CE Kernel for ARM (Thumb Enabled) Built on Mar 8 2013 at 17:05:33Setting up for a Cold RebootDone Setting up for a Cold RebootWindows CE Firmware InitBSP 1.0.0 for the SPEARHEAD600AB board (built Oct 2 2013)Adaptation performed by ADENEO (c) 2005+OALIntrInit-OALIntrInit(rc = 1)Initialize driver globals Zeros area...pDrvGlobalArea 0xa0060000 size 0x800 (0xa0060800 -0xa0060000)Initialize driver globals Zeros area...doneOALKitlStartFirmware Init Done.OALIoctlHalEnterI2cCriticalSection init i2c csERROR: C:\WINCE600\PLATFORM\COMMON\SRC\SOC\STM\SPEARHEAD600\DRIVERS\GPIO\.\sh600_gpio_hw.cpp line 170: GPB driver, RegQueryDword('ISTPriority') failed, status:2ERROR: C:\WINCE600\PLATFORM\COMMON\SRC\SOC\STM\SPEARHEAD600\DRIVERS\NandFlash\.\sh600_NandFlash.c line 57: ConfigTimming - Unable to open device registry entryERROR: C:\WINCE600\PLATFORM\COMMON\SRC\SOC\STM\COMMON\DRIVERS\NandFlash\.\stm_NandFlash.c line 1043: LLD_GetInfo - Unable to open device registry entry*** DLL_PROCESS_ATTACH - Current Process: 0x42, ID: 0x400002 ***TMC_Init: context Drivers\Active\09TMC_Init: device name is 'TMC1:'Resetting the USB-device siliconTMC_Init: returning 0xc07ea190++SER_Init: context Drivers\Active\10SER_Init, dwIndex:2GPIO_Select0 Register 0xB300_0024: 0x80000000Control Register 0xB300_0010 : 0x00000040RAS Select Register 0xB300_000C: 0xffffacf4CORE_CLK_CFG 0xB300_0024: 0x80000000SER2 got sysintr:0x00000014SER2 Serial Port, new baud rate:0x1c200 (UARTCLK:83250000 IBRD:0x2d FBRD:0xa)++SER_Init: context Drivers\Active\11SER_Init, dwIndex:3GPIO_Select0 Register 0xB300_0024: 0x80000000Control Register 0xB300_0010 : 0x00000040RAS Select Register 0xB300_000C: 0xffffacf4CORE_CLK_CFG 0xB300_0024: 0x80000000+OALIntrRequestSysIntr IRQ (1) already used by SYSINTR (20)SER3 got sysintr:0x00000015SER3 Serial Port, new baud rate:0x1c200 (UARTCLK:83250000 IBRD:0x2d FBRD:0xa)OHCI\system.c, GCFG_USBH1_SW_RSTOHCI\system.c, GCFG_USBH2_SW_RST-EDeviceLoadEeprom 80:09:02:01:BF:42Phy not foundWaitForLink Start (ticks=4109)Link Detected (ticks=4111)GMAC Init : 100 Mbit/s FULL DUPLEX (MII)Flushed Transmit BufferphyCfg->dwSpeed 0x64<--EDeviceInitializeGMAC DMA status register = 0x600004GMAC Device enable interruptDriverStartGMAC Device enable interruptWelcome to WinCE.Footnotes(1)If for some reason there is a failure to communicate with the NAND, the BootROM will fallback to USB mode. If this happens, and the rear panel USB is connected to a host computer, you should see a USB device "0483:3801 STMicroelectronics". This may indicate that the SPEAR is OK but the NAND is dead.(2)The U-Boot command xload is used to program four redundant copies of the xloader image from DDR into NANDxload <address>- the first 8K of RAM <address> will be written to NAND -- duplicated in each of the first 4 blocks(3)P-Boot is an Agilent modified version of the WinCE bootloader. There is not much information when searching "P-Boot", so perhaps this is just Agilent's name for their modified EBoot, which is commonly used with WinCE?P-Bootapparently reads the U-Boot Environment(0x000C_0000), so a problem in that config may cause issues in U-Boot and/or P-Boot. Also, P-Boot reads the first ONFI config page in NAND and if that page happens to be bad,it doesn't use the redundant copies and fails, doh.Misc. NotesIt'snot uncommonfor these units to have CPU/NAND/boot problems.When replacing a SPEAr MCU, it's OK to replace a SPEAr320 with a newer 320S. The 320S manual says;QuoteParts list taken fromhereandhereU100TI 2051b 2bm a4djSingle power distribution switch <0.5 AU101ST M41T82RI2C RTC with battery switch overU102Maxim MAX3232ERS232 driverU103C6AF NZ04NC7NZ04K8X (marking NZ04), TinyLogic UHS Triple InverterU200Unpopulated 8 pinU201ST SPEAr320S-2Main processor, ARM926EJ-S core, <333 MHz, 32 kB embedded boot ROM, 8 kB embedded SRAM, crypto co-processor, touch screen interfaceU202SMSC 8710ALAN8710A (microchip) 10/100 ethernet transceiver - has auto-MDIX supportU203Micron NQ277 2TDI7MT29F1G08ABADAH4 1 Gb (128 MB) NAND flashU204Micron D9LHR 2NHI2MT47H64M16HR-3 1 Gb (128 MB) DDR2-667 333 MHz DRAMU205TI LC07A 26K C6ECSN74LVC07A hex buffer/driver with open drain outputsU300TI 54140TPS54140, 1.5A step down converterU304TI TPS 650701Single chip power IC for battery applications - can charge Li-ion batteries & has a resistive touch screen interface controllerU400ODNTLV70033DDCR (marking ODN), 200mA, high-PSRR, low-IQ, low-dropout voltage regulator with enableU401NXP LPC932A1FDH80C51, 8k flash, 768B RAM, 512B EEPROM - used for the soft power buttonU403TI L393LM393 dual voltage comparator

author: testpoint1
author_rank: Frequent Contributor
timestamp: April 15, 2025, 03:45:09 pm
content: my board following chips burnt:SPEAR320SP89LPC932A1FDHand 2 TI chip for PWMreplace the chips is easy to me, but when I replace all of them, the problem is here, can not boot:https://www.eevblog.com/forum/repair/agilent-34461a-boot-problem/msg5863413/#msg5863413

author: voltsandjolts
author_rank: Unknown
timestamp: April 15, 2025, 04:39:30 pm
content: This probably isn't the fault you are seeing but...the P89LPC932A1FDH is an 8051 microcontroller which needs firmware to operate. Knowing Keysight, it's probably locked, making it impossible to read the firmware from a working device. Oh, wait...didn't glitching the reset line on nxp mcu's allow full debug access, maybe that was arm mcu's...hmm maybeNote also, the NAND must have a version of firmware that matches the mainboard logic, IIUC. There was something about not being able to upgrade from 1.x to 3.x, you had to go to 2.17 first - maybe it upgrades the mainboard firmware or something? Ah, here it is;https://www.keysight.com/gb/en/lib/software-detail/instrument-firmware-software/34460a34461a34465a34470a-firmware-2367633.htmlQuoteAlso;https://docs.keysight.com/kkbopen/follow-support-instructions-to-restore-the-firmware-displayed-on-the-34461a-dmm-after-firmware-update-what-to-do-580260380.htmlI'm unsure why matching versions matters - can someone confirm?

author: imett
author_rank: Contributor
timestamp: April 19, 2025, 07:29:41 am
content: Quote from: analogRF on July 31, 2023, 02:32:41 amPlease could you confirm the J102 pinout? in my board (34460-26502) the TRST is connectect directly to 3v3 (from the DC/DC buck converter) and the 3V3 in the pinout have in series a resistance..Other things in the second row from the top (in the proposed J102 pinout is 3v3--- GND) in the pcb there is a label "FUSB"what does it means?regards matteo

author: voltsandjolts
author_rank: Unknown
timestamp: April 19, 2025, 07:50:22 am
content: Quote from: imett on April 19, 2025, 07:29:41 amThis is a total guess:The SPEAr mcu has several boot modes selected by pin states, one of them is boot from USB. FUSB could be connected to boot state pins B1 and B2 and mean "Force USB", as-in force USB boot. If this is the case, FUSB pin would likely be pulled high through a 1K or so. If pulled low, with the rear panel USB is connected to a host computer, you should see a USB device "0483:3801 STMicroelectronics". See RM0082 section 38 for details on USB boot.

author: lzcubchgg
author_rank: Contributor
timestamp: April 23, 2025, 11:36:33 am
content: My 34461A is broken, showing that it cannot measure any values, including current, voltage, and resistance. The automatic detection has passed. I want to try repairing it. Where should I check? I really need help.

author: testpoint1
author_rank: Frequent Contributor
timestamp: April 25, 2025, 02:09:41 pm
content: Quote from: voltsandjolts on April 15, 2025, 04:39:30 pmI also think the chip "P89LPC932A1FDH" need to be programmed, but when I replaced it, the board can boot, just boot to that screen, then I try to replace the NAND and ARM, same phenomenon, give up; then I bought a white screen spare part board, replace the ARM CPU, easy to fix it.

author: lzcubchgg
author_rank: Contributor
timestamp: April 25, 2025, 04:07:53 pm
content: white screen spare board from eBay?URL? thank...

author: neverendingstudent
author_rank: Regular Contributor
timestamp: May 19, 2025, 03:52:08 am
content: Quote from: coromonadalix on January 22, 2025, 05:23:50 pmI did a recent 34461A screen replacement repair () and before I figured out it was the screen I had assumed it would be the SPEAR. Checked it with my thermal camera - it went between 42 and 48 C depending on how long it was on. Seems acceptable temp - not hot enough for burnout like the 90 to 150 C death temps I've heard other users report. I also double-checked by holding my thumb on the chip - warm, but not hot or burning. For my unit these were the actual-measured temps of the SPEAR MCU with a Hikmicro B20, not temps measured from the meter config.

author: neverendingstudent
author_rank: Regular Contributor
timestamp: May 19, 2025, 03:58:00 am
content: Quote from: lzcubchgg on April 23, 2025, 11:36:33 amI apologize for suggesting this if you have already checked - but have you tried both front and back terminals as well as the front/back switch? If the back terminals work and you can't switch I'd check to see if your push rod is properly engaged and working with the internal front/back selector switch on the board. Again, I apologize for suggesting something this simple if you have already checked this, it's just that since different functions use different circuitry it makes me think of the front/back selector as the first most likely culprit.

author: K
author_rank: Contributor
timestamp: May 28, 2025, 10:01:22 pm
content: A late followup on my escapades with my broken 34465A:The repaired (https://www.eevblog.com/forum/repair/hints-for-fixing-a-34465a-(blown-input)) unit suddenly failed to boot - initially just partially (got stuck in PBOOT stage, with messages about bad CRC while reading OS/app image from NAND), and later would not even get to that.Determined that most likely the NAND is dead/unresponsive/fails to initialize - as the CPU was falling back to USB-boot (as per SPEAR320s reference).Forum usertestpoint1kindly posted a link to a working NAND dump for 34461A, which I scooped right up.Desoldered the NAND chip from display unit PCB. My T76 programmer could access and dump it (note: I had to reduce CLK to 10MHz, otherwise verification would fail). Then after some comparison with the known working dump I discovered that my NAND has more than dozen stuck bad bits and about same amount of bits flippin' around in the breeze (different values on repeated reads). Some of the bad bits were right in the middle of main image.Prepared a working NAND image from the 34461A dump - I replaced U-Boot parameters block and both filesystems from my NAND - and programmed it into a new NAND chip. (as it turned out later, replacing the U-Boot paramers block did nothing).Soldered on the new NAND chip and put it somewhat back together.To my surprise - the unit booted on first try!Alas, after the bood the unit beeped and displayed the red erorr label. Error log had "+822: Controller and measurement board serial numbers do not match" error in it. Dang.From this I summarised that serial/model number is not stored in neither of copied filesystems, and instead is somewhere on the NAND, and is read/written as raw data block.Ghidra time!Unpacked/dumped the nk.bin from firmware update (OS/app image) files.Ran "strings " on all dumped files and grepped for "serial number" and other such. The file "Torreys.dll" looked most promising. So I loaded it up into Ghidra (armv8, little endian).After some mucking around arrived at function @ 0x100DB484 (aka "DoStuffWithModelAndSerial"):1) it gets called when main app is initializing,2) refers to error strings that suggests it reads model/serial from both primary and backup NV storages (primary storage - NAND on display unit PCB, backup NV - flash on main PCB), and compares them.Then after untangling some bits of C++ vtable madness, arrived at function @ 0x100E7188 (aka "Spear320NANDGetSerialNumber"), which some calls down jumps out to something named "PALSSTORAGE.DLL::GetSerialNumber". Promising!Loaded file "PalSStorage.dll" into Ghidra, right next to "Torreys.dll".Unfortunately, due to Ghidra getting a bit stumped with Windows CE function import/export resolution, I was not able to decipher which function in the "PalSStorage.dll" is "GetSerialNumber". Le sad.But - I have one more tool!JTAG time!Connected JLink probe to the display unit PCB and fired up Ozone app. It has support for SPEAR320 and managed to connect to it without any issues.But then I hit a snag - setting breakpoint to 0x100DB484 ("DoStuffWithModelAndSerial") did not catch anything. Maybe some more address offset monkey business is going on?Going from that I let the unit boot, and then randomly halted/paused CPU, noted the PC register value and then looked up some 20 bytes it was going to execute next, and then tried to look up those bytes in nk.bin dump files. Some tries later I got lucky and had landed somewhere in code of "Torreys.dll". It turned out that I need to add 0x30EB0000 to the offset from Ghidra disassembly.Knowing that I set the breakpoint to 0x40F8B484 (0x100DB484 + 0x30EB0000), rebooted and got a hit! Woo!Now stepping trough the code I arrived at the call to "PALSSTORAGE.DLL::GetSerialNumber" - and jumping into it revealed proper function address in "PalSStorage.dll" - 0x40C82D04 (aka "PalSStorageGetSerial"). I noted that this function address matched one in Ghidra, no offsets. Nice.Working down into the "PalSStorageGetSerial" function (several calls down) I discovered it really does read a block of data directly from NAND (function 0x40C82AF0 "GetRawCommonArea"). But the API for the NAND read is quite opaque and I could not manage to get a nice "offset-in-NAND" value for the block.Also the block read from NAND is encrypted. With AES. And is decrypted using the wierd Windows encryption API. Eew.Ok - nevermind the encryption - I now have the encrypted bytes the application retreived - and I can just look up those bytes in NAND image. Which is what I did.The encrypted block is located in NAND at offset 0x3A0000 and is 0xA0 (160) bytes long. Woo! And this block differs in both NAND images I have. Not sure how I missed that when I compared the images initially.Now I had two options:1) Replace the encrypted block with one from my NAND dump (via "JTAG in U-Boot, write to memory via JTAG, and then write memory to nand") and it should just work!2) Nuke the block in the NAND - during my excavations in "Torreys.dll" I noticed there is code that checks that model/serial could not be retreived from NAND, and then asks user whether to restore model/serial from backup NV storage (flash on main PCB).I tried 1st option, but it did not work and I am not sure why. Maybe the block was damaged? Seems unlikely. But anyway - I got the "restore from backup" prompt to which I said "Yes".After some seconds (not sure why prompt says "could take up to 2 minutes") model/serial got restored from backup NV storage and "+822" error was gone.Great success, much rejoicing!To summarise:Model/serial for 3446xA is stored in 2 places:1) Primary NV storage - NAND chip on display PCB, at offset 0x3A0000 and "block" size is 160 bytes. It is encrypted with AES. Not sure if key is static or not (it might be).2) Backup NV storage - flash somewhere on main PCB. Did not investigate deeper. Note: in "Torreys.dll" there is code that writes model/serial FROM Primary NV storage TO Backup NV storage.Erasing/damaging the encrypted data from NAND causes "restore from backup?" prompt.

author: KE5FX
author_rank: Super Contributor
timestamp: May 28, 2025, 10:55:16 pm
content: Good info, filed away in case my '61A and '65A ever need it! That would have been an enormous amount of work.

author: neverendingstudent
author_rank: Regular Contributor
timestamp: June 17, 2025, 04:12:08 am
content: Excellent and valuable write up for others who come along later searching for how to fix this. Congrats on the successful revival!

author: fzabkar
author_rank: Super Contributor
timestamp: July 22, 2025, 06:42:19 pm
content: Quote from: voltsandjolts on April 14, 2025, 08:38:06 am

author: John Harry
author_rank: Newbie
timestamp: August 26, 2025, 10:38:23 am
content: Quote from: dc101 on March 23, 2021, 01:32:17 amHello Tim, My 34461A, the screen is white , i also try to connect with RS232 pin but not display (1.2v,3.3v, 1.8v power are nice ).Can you tell me how to connect RS232 of 34461A to laptop to show boot code as you, please?

author: Neo2199
author_rank: Contributor
timestamp: October 12, 2025, 02:47:14 am
content: My 34465A has LM3S1D21 issue where there is no uart communication with SPEAr and no DS901 uC LED. I am suspecting corrupted flash. By any chance does anyone has older unit like mine and has flash dump ?Error codes +821 and +320

author: voltsandjolts
author_rank: Unknown
timestamp: October 12, 2025, 07:51:32 am
content: AFAIK the LM3S on the main board can be updated from the front panel SPEAR mcu. So the firmware for it is likely in the nk.bin somewhere but may well be encypted. There could also be a custom bootloader required to be pre-programmed on the LM3S, so yeh, if a flash dump is possible that would be better.