Tekfwtool for TDS540C firmware upgrade

[Galen]

I believe it is much simpler to first try with the other "tekfwtool", and then the different "tektool":s, and if neither of those help, see if there is some other software fix.

As I suggested, you can also try if one of the "tektool":s manages to identify the chips, and if not, open it up and read on them. If you know what model they are, it should be able to modify "tekfwtool" or "tektool" to erase them.

Also, I find it very likely that you can't erase the flash without desoldering it.

Ragnar

Hi Ragge, I can try other tekfwtool/tektool.but limited to the exe. because I don't know how to compile the c program.
if you don't mind, could you help to compile a tektool or tekfwtool which support E28F016SA, and can work in Win7 command window?  that will be a great help.  Very appreciated.
Galen

[ragge]

I believe it is much simpler to first try with the other "tekfwtool", and then the different "tektool":s, and if neither of those help, see if there is some other software fix.

As I suggested, you can also try if one of the "tektool":s manages to identify the chips, and if not, open it up and read on them. If you know what model they are, it should be able to modify "tekfwtool" or "tektool" to erase them.

Also, I find it very likely that you can't erase the flash without desoldering it.

Ragnar

Hi Ragge, I can try other tekfwtool/tektool.but limited to the exe. because I don't know how to compile the c program.
if you don't mind, could you help to compile a tektool or tekfwtool which support E28F016SA, and can work in Win7 command window?  that will be a great help.  Very appreciated.
Galen

Hi,

I can build for Linux x86 or ARM (or you can trivially do it yourself), or for MacOS.

If you are using DOS/Windows, and can't build programs, first try the tekfwtool at:
https://stackframe.org/tekfwtool/

If that doesn't work, there is a "tektool5" that uses other commands to erase that someone has made, probably for a reason.
In the zip file here:
https://forum.tek.com/download/file.php?id=24983&sid=de2267bdadfd0a11ce92f2d5648d656e
there are:
TekTool_0.exe
tektool_1.exe
Tektool5.exe
Someone said that "tektool_1.exe" does not work.

Try these.
If they still do not work - try identifying the flash using the "-i" flag, and put the result here.

In any case, it would likely be helpful to all of us to understand exactly what flash chips they have put in your machine, along with the model number of the CPU board.
If you could take a picture or the chips and the model number, or just write it down, that would be nice!

Regards,
Ragnar

[madao]

My TDS754C ingore erase commando from tekfwtool and i give up trying with erase.  This is why, my TDS754C is not bricked, i have not a reason for update of firmware. -> "nothing happens", i mean, it is not changed and runs good as is.
CPU Board: 679-4172-00 w 28F016SA  (a notice, this CPU board is also used in early 700D-Series)

Galen wrote me, he has sucess with erase of firmware with tektool_0.  He use tekfwtool program of flash. It came back to life :-)
Now is clear, tekfwtool has problem with  erase of 28F016SA.


i guess, tektool_1 works with GPIB_1 card.  Most  GPIB card run in system as GPIB_0 (my NI PCI-GPIB runs also as GPIB_0)

greetings
matt

[madao]

removed, double post.

[ragge]

My TDS754C ingore erase commando from tekfwtool and i give up trying with erase.

What tekfwtool are you talking about?
So have you tried the different tekfwtools and tektools?

This is why, my TDS754C is not bricked, i have not a reason for update of firmware. -> "nothing happens", i mean, it is not changed and runs good as is.
CPU Board: 679-4172-00 w 28F016SA  (a notice, this CPU board is also used in early 700D-Series)

Sounds very reasonable, and thanks for the CPU-board-to-flash-mapping-information!

Galen wrote me, he has sucess with erase of firmware with tektool_0.  He use tekfwtool program of flash. It came back to life :-)

Good! Do we know what CPU board and flash chips is in Galen's scope?

Now is clear, tekfwtool has problem with  erase of 28F016SA.

Again, what tekfwtool do you mean?
The tekfwtool:s that I pointed out is supposed to support both 28F016SA and 28F160, but of course things may be broken in it.
The "Tektool5" erases flash in a third way. Maybe there are actually three different kinds of flashes in TDS scopes, maybe there are just two.

i guess, tektool_1 works with GPIB_1 card.  Most  GPIB card run in system as GPIB_0 (my NI PCI-GPIB runs also as GPIB_0)

Why do you think that? The program has no idea what the device is called.

Looking at the source, one difference compared to some other random tektool.c (why are there so many, and all more or less broken???), is that it assumes GPIB address 1 for the instrument.
But then, what would 5 in tektool5 mean? Could be flash type "inte_s5", but it does not handle s5 flash in the same way as the tekfwtool I pointed out.
(The other random tektool.c assumes GPIB address 0x29, or decimal 41, for the instrument, which is also totally wrong, it should be 29 (decimal)).

Ragnar

[Galen]

Hi Ragge, thanks for the advice to trying other tektool.  I tried these tools I have, finally, tektool_0.exe make the erase successfully.  Then use the tekfwtool to write-in the firmware, successful.
Now, it is clear, the tekfwtool I used can't erase the 28F016SA in Win7 + PCI-GPIB card.
My TDS540C live again. Thanks all who provide suggestion during this process.
Galen

[madao]

tekfwtool came from stackframe.org/tekfwtool , galen got this version from me.  This version can't  erase  28F016SA, but it do good jobs by  28F160S5. I don't know other tekfwtool.exe.

galen's TDS540C CPU Board use also  28F016SA.

tektool_0 use GPIB0 , it is only my guess.  Galen and i use  win7 &  NI-VISA (and their GPIB card) and tekfwtool runs with same behavior with 28F016SA erasing.

In both C-sourcefile (tektool & tekfwtool) exists "ibdev(0,0x29, )"commando.  This commando choose GPIB card and GPIB -Device.
But your point with tektool_5 maybe  correct. Many broken tektool...possible, it is running with other than NI-VISA and GPIB-card stetting..

[geostep]

Hi Ragge, thanks for the advice to trying other tektool.  I tried these tools I have, finally, tektool_0.exe make the erase successfully.  Then use the tekfwtool to write-in the firmware, successful.
Now, it is clear, the tekfwtool I used can't erase the 28F016SA in Win7 + PCI-GPIB card.
My TDS540C live again. Thanks all who provide suggestion during this process.
Galen

That's really good to hear Galen!  I was not happy to read that your first attempt went so badly.  What firmware is your scope at now, 5.0e or 5.2e?

Still interested in upgrading my 540C at some point when I have gathered much more data on how to proceed with relative safety. I'll be using tektool and an old PC with a GPIB card when I do.

BTW, I just enabled option 2F on my 540C using Flytes floppy disk commands and a hex editor!   Next step will be enabling option 2M.

- George

[madao]

I have downloading  zip-file with tektool from ragge's link.

Tektool5's sourcefile exists and i read it (erase and identify)
erase commando: 0x20 , 0x20,  then wait (10ms), 0xA0.   Datasheet of  28F020 tells exkat this step for erase.
but identify  = 28F160SA. Probably, it is disabled by other author.


tektool5.c

Code: [Select]

tatic int flash_erase(uint32_t base)
{
uint32_t buf;
int count =  0, ret = -1;

while(count < 100){

if (flash_command(base, 0x20) == -1)
goto out;

if (flash_command(base, 0x20) == -1)
goto out;

usleep(10000);

    if (flash_command(base, 0xA0) == -1)
goto out;

usleep(6);

if (read_memory(base, (uint8_t *)&buf, sizeof(buf)) == -1)
goto out;

    if ((be32_to_cpu(buf)) == 0xffffffff ){
       ret = 0;
            break;
            }
       else {
            count += 1;           
            }
}

[Galen]

Hi geostep, my scope has 5.2e firmware now.

[ragge]

tekfwtool came from stackframe.org/tekfwtool , galen got this version from me.  This version can't  erase  28F016SA, but it do good jobs by  28F160S5. I don't know other tekfwtool.exe.

I would say it can't be, since the output strings do not match, but I now see that the strings in the source code does not match the strings in the .exe file! So whoever put that stuff there, did not put matching source code and compiled code there!

So has anyone decompiled that program and checked what it actually does? Does it send your entire hard drive to someone? Install back doors on your machine?

This is one of the many reasons why Windows is so deeply unusable - how the programmers and users use it - they just copy random binaries around, no-one knows where it came from, what version it is, what it actually does, or how many extra virus programs that have installed itself in it. In the Unix world, or for almost any normal operation system (anything but windows), one has learnt to keep track of those things since the 1950:s, and today more than ever.

galen's TDS540C CPU Board use also  28F016SA.

Ok, good!

tektool_0 use GPIB0 , it is only my guess.  Galen and i use  win7 &  NI-VISA (and their GPIB card) and tekfwtool runs with same behavior with 28F016SA erasing.

In both C-sourcefile (tektool & tekfwtool) exists "ibdev(0,0x29, )"commando.  This commando choose GPIB card and GPIB -Device.
But your point with tektool_5 maybe  correct. Many broken tektool...possible, it is running with other than NI-VISA and GPIB-card stetting..

You are right - the first argument is the device number, I had forgotten, my bad!

I hope you haven't found any more place with "0x29" as GPIB address, since that is 41 decimal, and the largest valid GPIB address is 30. Again, it should be 29 (decimal) if they mean a TDS booted NVRAM Unprotected mode (at least mine, seemingly many others too).

Best regards,

Ragnar

[ragge]

Tektool5's sourcefile exists and i read it (erase and identify)
erase commando: 0x20 , 0x20,  then wait (10ms), 0xA0.   Datasheet of  28F020 tells exkat this step for erase.
but identify  = 28F160SA. Probably, it is disabled by other author.

Good that you found that match!

Well, the source code is there, and there is a binary (or in the DOS world: a "exe"), called tektool5, so I don't think anything is disabled. I haven't checked if the binary does the same thing as the source though.

Someone for some reason did this, which I think is interesting. There could be many reasons, but one of them is that someone actually had some flashes that worked differently.

Regards,
Ragnar

[Tantratron]

I hope you haven't found any more place with "0x29" as GPIB address, since that is 41 decimal, and the largest valid GPIB address is 30. Again, it should be 29 (decimal) if they mean a TDS booted NVRAM Unprotected mode (at least mine, seemingly many others too).

I confirm this specific point when connecting my TDS540C, unprotected mode and USB-GPIB-HS communicating with my Macintosh... the valid GPIB address is 29 decimal whereas with protected mode, it will use the GPIB address defined by myself on the TDS540C. For instance I did choose 2 to make it different that the USB-GPIB-HS interface seen from my computer, my interface has GPIB address of 0

[madao]

I would say it can't be, since the output strings do not match, but I now see that the strings in the source code does not match the strings in the .exe file! So whoever put that stuff there, did not put matching source code and compiled code there!

So has anyone decompiled that program and checked what it actually does? Does it send your entire hard drive to someone? Install back doors on your machine?

This is one of the many reasons why Windows is so deeply unusable - how the programmers and users use it - they just copy random binaries around, no-one knows where it came from, what version it is, what it actually does, or how many extra virus programs that have installed itself in it. In the Unix world, or for almost any normal operation system (anything but windows), one has learnt to keep track of those things since the 1950:s, and today more than ever.

I write short:  i  don't like  computer, whatever art of operationsystem.  I am glad, if computer do their jobs and don't annoys me.
You would not believe me,  i use  win 7 since 7-8 years and i haven't got one virus.    Best virus defender is functional brain.
I know dumb  guy, he install many (2-4 ) anti virus programm and firewall and got virus on  fresh system. 
Albert know that, i hate computer. But i drive two track  with linux (linux mint) and Windows. I avoid often change of system, because i have less patient with computer.

Despite this fact, i have  a programming skill (special  c-source for µC.) and learning actually verilog for FPGA.

@ hex-decimal 0x29
You're right with  hex-value of device address. Now  i don't know, why is this count hex-decimal and not decimal.
I have reading progamming manual of IEEE488.2 of NI, it  tells only 0-30 , nothing one word about hex. Wreid !

@ tektool5
This tools is very intererssing, because we  need  flash tools for older instrument with 8bit-flash as 28F010, 28F020, 28F008SA
But, i must expose with computer for compiling of  c-source-file.

EDIT: i am sucessful with make of executable tekfwtool,   Good, now i'll hunting  old TDS540 and similar for checking of flash erase & programming.  Unfortunately, i have sold my  TDS540 since a month ago.

[ragge]

Hi Ragge, thanks for the advice to trying other tektool.  I tried these tools I have, finally, tektool_0.exe make the erase successfully.  Then use the tekfwtool to write-in the firmware, successful.
Now, it is clear, the tekfwtool I used can't erase the 28F016SA in Win7 + PCI-GPIB card.
My TDS540C live again. Thanks all who provide suggestion during this process.
Galen

Hi Galen,

I am happy to hear that it helped!
All this will probably also help others in the future, which is nice!

Ragnar

[ragge]

@ tektool5
This tools is very intererssing, because we  need  flash tools for older instrument with 8bit-flash as 28F010, 28F020, 28F008SA
But, i must expose with computer for compiling of  c-source-file.

Ah - compiling is no big deal! :-)

EDIT: i am sucessful with make of executable tekfwtool,   Good, now i'll hunting  old TDS540 and similar for checking of flash erase & programming.  Unfortunately, i have sold my  TDS540 since a month ago.

Very nice! So you can now compile the 68k part too?

Regards,
Ragnar

[madao]

Pleas wait.  I must get   spare parts from storage. (sucessful repaired TDS700D CPU Board & more acquisition board & TDS540A-corpse) 
I haven't time today. I'll trying with him tomorrow or monday.   But short check with dumping of NVSRAM, it look good.    True hurdle is erase & program of flash.

AH !  I tell you:  "Ping Firmware 50 50 00 00" is happens also  by this TDS700D CPU board w  28F160S5 and did good their jobs.

[Tantratron]

After all this saga and recovery progress, don't you think guys that maybe we should go towards a unified or universal tekXtool able to cover all TDSs hardware and software scenarios. After all it seem clear that tektool.c only deals with NVRAM, the tekfwtool.c covers NVRAM EEPROM and Flash except some IC chips require special erase-writing C commands.

What is quite interesting and refreshing, the mixture of test, ideas and track between DOS, Windows, Linux and Mac OS seems to bring cleaning many topics plus now we have proof if GPIB-USB interface any type of computer can run tekXtool application once compiled from C files and their libraries.

Albert

[madao]

My program skill  is not  the best for high complex program with pointer and operation in computer w operation system. (only C for µC) I don't unterstand , how functions pointer in C.   This is why,  i  want modify only tektool, every one for one flash type.

But, it is possible, i think. 
Because all  flash in tek TDS can be identify by write&read pattern.

Code: [Select]

write  <data0x90><addr 0x0000>   // flash identify command
read <addr 0x0000>               // read manufactur identify
read <addr 0x0001>               // read  device identify 
write <data 0xFF><addr 0x0000>   // reset command 
(example,  Intel 28F016SA = 0x0089,  0x66A0,  Intel 28F010 = 0x89, 0xB4, AMD 28F010 = 0x01, 0xA7)

We must  listen GPIB bus, how look commando.  A notice:  m<hexdecimal addr & lenght >  =  read commando   , M<unknown> = write command.

[ragge]

Hi madao,

My program skill  is not  the best for high complex program with pointer and operation in computer w operation system. (only C for µC) I don't unterstand , how functions pointer in C.   This is why,  i  want modify only tektool, every one for one flash type.

You certainly have the knowledge to learn how to use C pointers - they are not hard, you will learn it in a very short time.
Here is one short tutorial, just the first google hit I got:
https://www.tutorialspoint.com/cprogramming/c_pointers.htm

But, it is possible, i think. 
Because all  flash in tek TDS can be identify by write&read pattern.

Code: [Select]

write  <data0x90><addr 0x0000>   // flash identify command
read <addr 0x0000>               // read manufactur identify
read <addr 0x0001>               // read  device identify 
write <data 0xFF><addr 0x0000>   // reset command 
(example,  Intel 28F016SA = 0x0089,  0x66A0,  Intel 28F010 = 0x89, 0xB4, AMD 28F010 = 0x01, 0xA7)

Are there Tektronix TDS scopes with the AMD 28F010, or was that just an example?

We must  listen GPIB bus, how look commando.  A notice:  m<hexdecimal addr & lenght >  =  read commando   , M<unknown> = write command.

There already is code for that in the tektool.c:s and tekfwtool.c, and also in getcaldata.c. Just check the code in my repo, they are actually pretty small programs.
https://github.com/ragges/tektools

Regards,
Ragnar

[madao]

I have a TDS520 with  mixing (yes it is cocktail w intel & amd flash, it was tek factory repair) of intel & AMD  28F010.  Friends from me has a TDS540 with AMD-flash.  Dead  TDS540A has AMD 28F020.  Good news:  AMD Flash use same erase & program algo as intel's flash.



Indeed, i 'll reading your link.  but: pleas don't demand me to use pointers.  I have tried a few times to unterstanding pointers. without sucess.

[ragge]

I have a TDS520 with  mixing (yes, it was tek factory repair) of intel & AMD  28F010.  Friends from me has a TDS540 with AMD-flash.  Dead  TDS540A has AMD 28F020.  Good news:  AMD Flash use same erase & program algo as intel's flash.

Interesting, thanks!

Ragnar

[madao]

Now  is spare part (TDS700D CPU,  TDS724C Acquisition board) here, i can play with him.

I have checked tekfwtool, which i have compiled.
Not same reaction.  It show   percent of reading. Tekfwtool from stackframe.org doesn't show percent by reading.

But, it can't erase  flash 28F160S5. (error message came qiuck)  probably  68k code problem, no mood about computer stuff.

[ragge]

Now  is spare part (TDS700D CPU,  TDS724C Acquisition board) here, i can play with him.

I have checked tekfwtool, which i have compiled.
Not same reaction.  It show   percent of reading. Tekfwtool from stackframe.org doesn't show percent by reading.

But, it can't erase  flash 28F160S5. (error message came qiuck)  probably  68k code problem, no mood about computer stuff.

Hi madao,

So this one can not erase 28F160S5?
You mentioned above that the one from stackframe.org could.

Since this is in the 68k part (target.bin) - did you recompile the 68k code, or did you take it from somewhere else?

Regards,
Ragnar

[madao]

this c-sourcefile and all file (inlc. target.bin) came from stackframe.org and i have  compiled it (it is called  tekfwtool0.exe)
 tekfwtool.exe is orginal and present in same folder as tekfwtool0.exe. Orginal runs, my compiled can't erase & program.  read & write  -> no problem.

I have tektool.c source file form stackframe.org (it is downloaded over waybackmachine).  This is wreid,  because,  GPIB-Device address is 1 and uses "*IDN?" GPIB command, which bootloader of TDS-instrument doesn't replies. This source file is too wrong, i think. After reading of this source file, i have  a guess: It works on Instruments after normal start.  I will not attached this sourcefile.