Agilent 34461A corrupted flash

[analogRF]

well I halted in pboot prompt and now the jtag commands work and I think this probably shows where the problem is   

Code: [Select]

J-Link>w1 0xbab10000 0x90
Writing 90 -> BAB10000
J-Link>w1 0xbab20000 0x00
Writing 00 -> BAB20000
J-Link>mem 0xbab00000 5
BAB00000 = 2C F1 80 95 82                                    ,....
--------------------------------------------------------------------------
J-Link>w1 0xbab10000 0x90
Writing 90 -> BAB10000
J-Link>w1 0xbab20000 0x20
Writing 20 -> BAB20000
J-Link>mem 0xbab00000 4
BAB00000 = 4F 4E 46 49                                       ONFI
---------------------------------------------------------------------------
J-Link>w1 0xbab10000 0xec
Writing EC -> BAB10000
J-Link>w1 0xbab20000 0x00
Writing 00 -> BAB20000
J-Link>mem 0xbab00000 512

****** Error: Read memory error @ address 0xBAB00000, word access: Memory access timeout.
Could not read memory.


[analogRF]

still i think the reason it gives that error is something else I am doing wrong, still I cannot tell it is because the nand has an error

i tried again but same error

I thought it should at least read something

[ElectronMan]

still i think the reason it gives that error is something else I am doing wrong, still I cannot tell it is because the nand has an error

i tried again but same error

Maybe. I started having problems reading my parameters page with the jlink tool, and switched to OpenOCD instead of troubleshooting it. I figured that was a problem specific to my setup.

If you want to try in openOCD I can give you a config that works.

[analogRF]

still i think the reason it gives that error is something else I am doing wrong, still I cannot tell it is because the nand has an error

i tried again but same error

Maybe. I started having problems reading my parameters page with the jlink tool, and switched to OpenOCD instead of troubleshooting it. I figured that was a problem specific to my setup.

If you want to try in openOCD I can give you a config that works.

i dont have openocd right now and with your unbelievable expertise the meter is fixed and working now as normal 

I wrote the patched pboot binary provided by @ElectronMan at 0x340000 in the NAND and changed my bootcmd variable to
read pboot from the new address (instead of the original one still at 0x320000) and boot from there

The unit now boots normally and works flawlessly.

Thank you so much @ElectronMan. It was a lot of fun working with you 

[ElectronMan]

still i think the reason it gives that error is something else I am doing wrong, still I cannot tell it is because the nand has an error

i tried again but same error

Maybe. I started having problems reading my parameters page with the jlink tool, and switched to OpenOCD instead of troubleshooting it. I figured that was a problem specific to my setup.

If you want to try in openOCD I can give you a config that works.

i dont have openocd right now and with your unbelievable expertise the meter is fixed and working now as normal 

I wrote the patched pboot binary provided by @ElectronMan at 0x340000 in the NAND and changed my bootcmd variable to
read pboot from the new address (instead of the original one still at 0x320000) and boot from there

The unit now boots normally and works flawlessly.

Thank you so much @ElectronMan. It was a lot of fun working with you 

No problem, I am glad that worked!   It was out of other ideas. Keysight really should update that pboot to handle that situation properly.

[TheSteve]

Well done guys!

So what is the overall summary of the failure itself - a bad block where the original pboot sits?

[ElectronMan]

Well done guys!

So what is the overall summary of the failure itself - a bad block where the original pboot sits?

The flash chip's parameter page was apparently corrupted.

UBOOT doesn't use it. It just applies defaults based on whether the flash is Micron or not Micron, so it was unaffected.

But PBOOT just grabs the first parameter page and configures itself to talk to the flash.

I patched PBOOT to jump +256 bytes forward during the parameter load to grab the first redundant copy of the parameters page instead, and apparently that copy is good.

Really, PBOOT should be checking the checksum on the page, and automatically checking the 3 or so other copies instead of just trusting that the first copy is good.

[kanzler]

Hi!Today my device did not work. When you turn it on, there is such a picture on the screen, it does not respond to the buttons. I am attaching the download log. I ask for help in repairing, maybe someone has had such an error. Thank you.

[kanzler]

Sorry there was the wrong log file

Code: [Select]

U-Boot 2010.03 (Oct 09 2012 - 12:48:30)Agilent P510

CPU:   SPEAr320
DRAM:  128 MiB
Unknown id: 0xffffff. Using ST_M23P40
Flash: 64 KiB
NAND:  INTERNAL ECC 128 MiB
failed: 5 0
nand_bbt: Can't scan flash and build the RAM-based BBT
In:    serial
Out:   serial
Err:   serial
SerNum:MY99999999
Chip:  AA Board Rev: 4
init  RTC: 2001-02-15 15:44:10.15
Net:   No ethernet found.
splash RTC: 2001-02-15 15:44:11.18
Press space to stop autoboot:  0

NAND read: device 0 offset 0x320000, size 0x10000
 65536 bytes read: OK
## Booting kernel from Legacy Image at 00600000 ...
   Image Name:   PBOOT
   Created:      2012-05-22  16:06:43 UTC
   Image Type:   ARM Linux Kernel Image (gzip compressed)
   Data Size:    38780 Bytes = 37.9 KiB
   Load Address: 00000000
   Entry Point:  00000000
   Uncompressing Kernel Image ... OK

Starting kernel ...


Debug serial initialized ........OK
No RTC on 320

Microsoft Windows CE Bootloader Common Library Version 1.4 Built May 22 2012 09:09:57
Microsoft Windows CE 6.0 Ethernet Bootloader for the Agilent P500 board
Adaptation performed by Agilent Technologies (c) 2008

Reading NAND configuration

System ready!
Preparing for download...
No RTC on 320
 Loading image 1 from memory at 0xD0620000
O
BL_IMAGE_TYPE_BIN

X
XXXXOOOOXOXOOOOOOOXXOXXOOOOOOOXOOXOOXOOOXXXOOOOOOOOOXOOOOXOXXOXXXOXOOOXOXXXXOOXXOOOOOOXOOOOXXOOXXOOXXOXOOXOOOXOOXXOOOXOOOOXOXOOOOXOOOXOOOXXOXOXOXOXXXOXXXXOOOXOOOXOXOOOOXOOOOXOXOXOOOOOOXOOOXOOXOOOOXOXOOOOOXOXOOOOOOOOOOOXOXOOOOOOOXXOOOOOOOOXOOOOX
OXOOOXOXXOXXOOXOOXXXOXXXXOXOOXOOXOOXOOXOOXOXXOXOOXOXOOOOOOXXXXXOXOOOXOXOOOOXOOOOXOOOXOOXOOXOOOXOXXXXXXXXXXXXXXXXXXXXXXXXXrom_offset=0x0.
XXImageStart = 0x80361000, ImageLength = 0x169BC08, LaunchAddr = 0x80362000

Completed file(s):
-------------------------------------------------------------------------------
[0]: Address=0x80361000  Length=0x169BC08  Name="" Target=RAM
 Loading image 1 succeeded.
ROMHDR at Address 80361044h
Preparing launch...
No RTC on 320
Launching windows CE image by jumping at address 0x  362000

Windows CE Kernel for ARM (Thumb Enabled) Built on Mar  8 2013 at 17:05:33
Setting up for a Cold Reboot
Done Setting up for a Cold Reboot
Windows CE Firmware Init
BSP 1.0.0 for the SPEARHEAD600AB board (built Mar 18 2016)
Adaptation performed by ADENEO (c) 2005
+OALIntrInit
-OALIntrInit(rc = 1)
Initialize driver globals Zeros area...
pDrvGlobalArea 0xa0060000  size 0x800 (0xa0060800 -0xa0060000)
Initialize driver globals Zeros area...done
 OALKitlStart
Firmware Init Done.
OALIoctlHalEnterI2cCriticalSection init i2c cs
ERROR: C:\WINCE600\PLATFORM\COMMON\SRC\SOC\STM\SPEARHEAD600\DRIVERS\NandFlash\.\sh600_NandFlash.c line 57: ConfigTimming - Unable to open device registry entry
ERROR: C:\WINCE600\PLATFORM\COMMON\SRC\SOC\STM\COMMON\DRIVERS\NandFlash\.\stm_NandFlash.c line 1043: LLD_GetInfo - Unable to open device registry entry
++SER_Init: context Drivers\Active\10
SER_Init, dwIndex:2
GPIO_Select0 Register 0xB300_0024: 0x80000000
Control Register 0xB300_0010 : 0x00000040
RAS Select Register 0xB300_000C: 0xffffacf4
CORE_CLK_CFG 0xB300_0024: 0x80000000
SER2 got sysintr:0x00000013
SER2 Serial Port, new baud rate:0x1c200  (UARTCLK:83250000 IBRD:0x2d FBRD:0xa)
++SER_Init: context Drivers\Active\11
SER_Init, dwIndex:3
GPIO_Select0 Register 0xB300_0024: 0x80000000
Control Register 0xB300_0010 : 0x00000040
RAS Select Register 0xB300_000C: 0xffffacf4
CORE_CLK_CFG 0xB300_0024: 0x80000000
+OALIntrRequestSysIntr IRQ (1) already used by SYSINTR (19)
SER3 got sysintr:0x00000014
SER3 Serial Port, new baud rate:0x1c200  (UARTCLK:83250000 IBRD:0x2d FBRD:0xa)
Incorrect Data, interal ECC failed at 0x62db
Incorrect Data, interal ECC failed at 0x62db
OHCI\system.c, GCFG_USBH1_SW_RST
OHCI\system.c, GCFG_USBH2_SW_RST
-EDeviceLoadEeprom 80:09:02:05:E6:FA
Phy found addr 7 (ticks=3917)
WaitForLink Start (ticks=3919)
No Link (ticks=4921)
<--EDeviceInitialize

GMAC DMA status register = 0x0
FAILED to obtain valid Flash Handle in PlatformInitializeResetting the USB-device silicon
sh600_pdd, IOCTL_BUS_POSTINIT
ERROR: C:\WINCE600\3RDPARTY\Agilent\HPP\Common\Drivers\stm320_UsbFnBusDriver\.\ufnbus.cpp line 1137: failed opening \Agilent Flash\SPD\usbOverride
                                                                                                                                                  stm320_UsbFnBusDriver, set IST priority 96


#################### dllEntry ###########################

Exception 'Raised Exception' (-1): Thread-Id=04a90002(pth=831ff000), Proc-Id=04a80002(pprc=8327bc3c) 'Torreys.exe', VM-active=04a80002(pprc=8327bc3c) 'Torreys.exe'
PC=400256e8(coredll.dll+0x000156e8) RA=803782c8(kernel.dll+0x000062c8) SP=0002f274, BVA=ffffffff
Exception 'Raised Exception' (-1): Thread-Id=04a90002(pth=831ff000), Proc-Id=04a80002(pprc=8327bc3c) 'Torreys.exe', VM-active=04a80002(pprc=8327bc3c) 'Torreys.exe'
PC=400256e8(coredll.dll+0x000156e8) RA=803782c8(kernel.dll+0x000062c8) SP=0002efe4, BVA=ffffffff
Exception 'Raised Exception' (-1): Thread-Id=04a90002(pth=831ff000), Proc-Id=04a80002(pprc=8327bc3c) 'Torreys.exe', VM-active=04a80002(pprc=8327bc3c) 'Torreys.exe'
PC=400256e8(coredll.dll+0x000156e8) RA=803782c8(kernel.dll+0x000062c8) SP=0002efdc, BVA=ffffffff
FAILED to obtain valid Flash Handle in PlatformInitialize
SSInitialize: Error 3
FAILED to obtain valid Flash Handle in PlatformInitialize
SSInitialize: Error 3
FAILED to obtain valid Flash Handle in PlatformInitialize
SSInitialize: Error 3

[kanzler]

There is an error in my LOG, "Incorrect Data, interal ECC failed at 0x62db" what could it be?

[kanzler]

 Sorry for being stupid, but how to get uncompressed nk.bin file ?

[Eng_tech]

I have a keysight 34461A that also has I believe corrupted flash. The spear CPU is not overheating and all supply voltages in the meter are spot on. The meter does not boot up and only displays a white screen, none of the button's work, and neither does the USB connection to the meter. I haven't gone much farther then measuring supply voltages. I have purchased a used supposely working front panel for a 34460a with the front circuit board but didn't receive it yet. I know keysight says do not swap out front panels from other units but I figured I would try when I receive it. Obviously, it probably won't work due to mismatch in model/serial numbers. I didn't pay much for it. Anyways, from reading these posts it seems this problem can somewhat remedied by reflashing the NAND. Does anyone have the actual process in steps to perform this fix, including firmware images to use? Thanks, any help is appreciated. I am pretty familar with firmware programming as I do this as part of my job at work.
 

[analogRF]

I have a keysight 34461A that also has I believe corrupted flash. The spear CPU is not overheating and all supply voltages in the meter are spot on. The meter does not boot up and only displays a white screen, none of the button's work, and neither does the USB connection to the meter. I haven't gone much farther then measuring supply voltages. I have purchased a used supposely working front panel for a 34460a with the front circuit board but didn't receive it yet. I know keysight says do not swap out front panels from other units but I figured I would try when I receive it. Obviously, it probably won't work due to mismatch in model/serial numbers. I didn't pay much for it. Anyways, from reading these posts it seems this problem can somewhat remedied by reflashing the NAND. Does anyone have the actual process in steps to perform this fix, including firmware images to use? Thanks, any help is appreciated. I am pretty familar with firmware programming as I do this as part of my job at work.

i dont think anybody "reflashed" the NAND here. Certainly I didnt.
the first thing to do was to hook up the UART debug port on the front panel and see if there are any messages.
still the CPU could be dead even if it's not getting hot

[Eng_tech]

Haven't gotten around to hooking up serial just yet, but that is next. I'll report back on my findings when I do. I hate to toss this meter it was barely used by my company but is out of warranty and they were going to trash it. It was given to me to take home. Yes, the CPU could be bad as the one test point on the front panel was supposed to have a 24 khz signal on it but didn't have anything except 3.3 volts on it I think. Other voltages on the front pcb were good.

[coromonadalix]

is there antyhing in that upd  file to help recover ??

https://www.keysight.com/us/en/lib/software-detail/instrument-firmware-software/34460a34461a34465a34470a-firmware-2367633.html