Another Agilent MSO-X 4000 not booting

[TheKellerman]

My Agilent MSO-X 4104A wont boot. Here is the boot log:

Code: [Select]

U-Boot 2010.03 (Jan 26 2011 - 12:37:34)Agilent P500

CPU:   SPEAr600
DRAM:  128 MiB
Flash: 512 KiB
NAND:  256 MiB
In:    serial
Out:   serial
Err:   serial
SerNum:serial number not programmed
Chip:  BD Board Rev: 4
Net:   smsc
failed: 1 0
Could not copy from NAND offset 0x60000. Error -74 With ECC
failed: 2 1
Could not copy from NAND offset 0x60000. Error -74 NO ECC
FPGA programming FAILED!
Press space to stop autoboot:  0
## Booting kernel from Legacy Image at f8050000 ...
   Image Name:   PBOOT
   Created:      2011-08-12  17:16:04 UTC
   Image Type:   ARM Linux Kernel Image (gzip compressed)
   Data Size:    37297 Bytes = 36.4 KiB
   Load Address: 00000000
   Entry Point:  00000000
   Uncompressing Kernel Image ... OK

Starting kernel ...


Debug serial initialized ........OK

Microsoft Windows CE Bootloader Common Library Version 1.4 Built Aug 12 2011 11:03:19
Microsoft Windows CE 6.0 Ethernet Bootloader for the Agilent P500 board
Adaptation performed by Agilent Technologies (c) 2008

image2 value is out of range 0 so it will be ignored.
  It must be a hexadecimal integer between 0xd00000000 and 0xd7ffffff or between 0x800000000 and 0x87ffffff.

System ready!
Preparing for download...
 Loading image 1 from memory at 0xD0400000
O
BL_IMAGE_TYPE_BIN

X
XXXXXOOOOXXOOOOOOOOXOXXOOOOOOOOXOOOXOOOOXXXOOOOOOOOOXOOOOXOXXOXOXOXOXOXOXXXXXXOOXXXOOOOOOXXOXXOXXXXXOOOXXXOOXXOOXXXOOOXOOOXOOXXOOXOOOOXOXOOOOOXOOOXOOOXXXXOXXXOXOXOOXXXXXXXXXOOOOXOOXOOX
OOOOXOOOOXXOOXOOOOOOXOOOXOOXOOOOXXOOOOOXOOXOOXXOOOOOOOOOOXOOOXOOOOOOOXOXOOOOXXOOOOOOOXOOXOOOXXOOOOXOOOXOOXXXXOXOOOXOXXXXOOXOXXXXXXXOOXXXOXXOOXOXOXOXXOXOOXXOXXXXOXOOXOOOXOXXXOOXXXOXOOOXXOOOOOXOOOXOOOOXOXOOOXOOXOOOOOXOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOX
OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOXOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOXOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOODeCompressFlash: CeCompressDecode() failed
 CeDecompressFlashBlock failed
****** Data record 163 corrupted, ABORT!!! ******

Completed file(s):
-------------------------------------------------------------------------------
[0]: Address=0x80361000  Length=0x4E09D90  Name="" Target=RAM
 Loading image 1 failed, trying next one
 All images failed

Press r to reset

Following this https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg5384609/#msg5384609 I took the lates FW (7.60) and got the recover.nb0 that is supposed to unbrick the scope.

So I put the 4000X.7.60.2023082217.ksx on a 16 GB FAT32 USB stick and hooked it up to the scope. I was able to upload and run the recover.nb0 application, but it seems to stuck at a certain point:

Code: [Select]

U-Boot 2010.03 (Jan 26 2011 - 12:37:34)Agilent P500

CPU:   SPEAr600
DRAM:  128 MiB
Flash: 512 KiB
NAND:  256 MiB
In:    serial
Out:   serial
Err:   serial
SerNum:serial number not programmed
Chip:  BD Board Rev: 4
Net:   smsc
failed: 1 0
Could not copy from NAND offset 0x60000. Error -74 With ECC
failed: 2 1
Could not copy from NAND offset 0x60000. Error -74 NO ECC
FPGA programming FAILED!
Press space to stop autoboot:  0
p500>
p500> loady 0x361000
## Ready for binary (ymodem) download to 0x00361000 at 115200 bps...
CCCxyzModem - CRC mode, 1(SOH)/16817(STX)/0(CAN) packets, 4 retries
## Total Size      = 0x0106c09c = 17219740 Bytes
p500> go 0x362000
## Starting application at 0x00362000 ...
Windows CE Kernel for ARM (Thumb Enabled) Built on Mar  8 2013 at 17:05:33
Setting up for a Cold Reboot
Done Setting up for a Cold Reboot
Windows CE Firmware Init
BSP 1.0.0 for the SPEARHEAD600AB board (built Mar 26 2015)
Adaptation performed by ADENEO (c) 2005
+OALIntrInit
-OALIntrInit(rc = 1)
Initialize driver globals Zeros area...
pDrvGlobalArea 0xa0060000  size 0x800 (0xa0060800 -0xa0060000)
Initialize driver globals Zeros area...done
 OALKitlStart
Firmware Init Done.
OALIoctlHalEnterI2cCriticalSection init i2c cs
ERROR: C:\WINCE600\PLATFORM\COMMON\SRC\SOC\STM\SPEARHEAD600\DRIVERS\GPIO\.\sh600_gpio_hw.cpp line 170: GPB driver, RegQueryDword('ISTPriority') failed, status:2
ERROR: C:\WINCE600\PLATFORM\COMMON\SRC\SOC\STM\SPEARHEAD600\DRIVERS\GPIO\.\sh600_gpio_hw.cpp line 170: GPB driver, RegQueryDword('ISTPriority') failed, status:2
++SER_Init: context Drivers\Active\12
SER_Init, dwIndex:2
SER2 got sysintr:0x00000016
SER2 Serial Port, new baud rate:0x1c200  (UARTCLK:48000000 IBRD:0x1a FBRD:0x2)
OHCI\system.c, GCFG_USBH1_SW_RST
OHCI\system.c, GCFG_USBH2_SW_RST
-EDeviceLoadEeprom 00:30:D3:20:68:B0
Phy found addr 31 (ticks=1914)
WaitForLink Start (ticks=1915)
No Link (ticks=2918)
<--EDeviceInitialize

GMAC DMA status register = 0x0
BALDWIN_DDI: cBaldwinHwIf::Init: Initializing...
BALDWIN_DDI: cBaldwinHwIf::Init: Scope successfully identified.

I tried it several times and it always hangs at the same point. And the LED indicator on the USB stick lights up just before the application hangs, so I think it is at least trying to access the FW update on the USB.

Any suggestions on what to try next? (And no I didnt reached out to Keysight jet  )