EDUX1002A hacking, conversion to DSOX1002G

[alpher]

Hi, I know that there is a multipage thread about DSOX100x hack that Dave posted a couple of years back, nonetheless I'd like to start a new one, dedicated specifically to the conversion of the much cheaper EDUX series scopes into their full-fledged DSOX versions. Intend to do a full hardware mod including the generator, have pretty much everything lined up (except a few func/gen parts) and right of the bat I run into a snag.
To make sure that I have the proper "Product config" installed a serial port connection as in Dave's video, booted the scope numerous times and try as I migh, the U-boot doesnt show that section at all  , To be clear it is this section what I'm looking for (copied from Daves U-boot log) :

Code: [Select]

=========================================
BLT Product Config 24
   Bandwidth   : 200MHz
   #Channel    : 2
   Board Rev   : FPR
   Clk Gating  : Baldwin
   Sample Rate : 4GSa
   LAN PHY     : No
BLT Module Config 02
   Rev         : LP3
   Sample Rate : 5GSa/s
=========================================
BLT_PRODUCT_CONFIG_0, 1.251v, ID4
BLT_PRODUCT_CONFIG_1, 0.692v, ID2
BLT_MODULE_CONFIG_0, 0.687v, ID2
BLT_MODULE_CONFIG_1, 0.005v, ID0
CANINE_BOARD_REV, 0.002v, ID0
CANINE_MODEL_NAME: MARSUPIAL, 1.738v, ID6, MARSUPIAL
CANINE_EXTMODULE, 2.488v, ID8, SWID8
CANINE_MSO_REV, 0.628v, ID2, SWID2
SHIM DLL, LoadRealDll [PalSStorage.dll] for [AgilentPalSStorage.dll]
SHIM [AgilentPalSStorage.dll] Get Process Addresses
Released build, Sep 28 2016, 00:17:51
Initializing FPGA...
************************************
FPGA Type: Marsupial
Ver: 1.067 Released
Build Time: Tue Jun 14 17:13:42 2016
Build Machine: 2UA5461ZWH
************************************

Now here are complete Uboot logs from my EDUX machine, first from a factory firmware that came with the scope  1.10 and the second from the Fercsa hacked version:

Code: [Select]

U-Boot 2010.03 (May 18 2017 - 11:28:22)Agilent P500

CPU:   SPEAr600
DRAM:  128 MiB
Flash: 512 KiB
NAND:  internal ecc 128 MiB

Debug serial initialized ........OK
RTC: 2024-20-4   1:81:32.35 UTC

Microsoft Windows CE Bootloader Common Library Version 1.4 Built Oct 29 2015 01:39:04
Microsoft Windows CE 6.0 Ethernet Bootloader for the Agilent P500 board
Adaptation performed by Agilent Technologies (c) 2008

PHY not found.

System ready!
Preparing for download...
RTC: 2024-20-4   1:81:32.35 UTC
 Loading image 1 from memory at 0xD0600000
O
BL_IMAGE_TYPE_BIN

X
XXXXOOOOXXOOOOOOOOXOXOOOOOOOOXOOOXOOOOXXXOOOOOOOOOXOOOOXOXOXOXXOXOXOXOXXXXOOXXXOOOOOOXXOXXOXXXXXXOOOXXXOOXXOOXXXOXXOOOOXOOXXOOXOXOOOOXOXOOOOOXOOOXOOXOXXOXOXXXXXXOXXXXOOOXOOOXOXOOOOXOOOOXOXOXOOOOOOX
OOOXOOXOOOOXOOOOXOOXXOOXOOOOOOOOOXOOOOXOOOOOOXOXOOOOXOXOOOOOOOXOXOXOOXOXOOOXOOOXOOXOXXOXOOOXOXXXXXOXOXXOXXXXXOXOXOXOOXXXOXXXXXXOXXXXXXXOXXXXXXOXOXXOXOOOXXXXXOXXXXOOOXOXXOOX
XOXXXOOXOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOXXOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOXXXXOXOOXOXOOOXOXXXXXXXXXXXXXrom_offset=0x0.
XXImageStart = 0x80361000, ImageLength = 0x1A84978, LaunchAddr = 0x80362000

Completed file(s):
-------------------------------------------------------------------------------
[0]: Address=0x80361000  Length=0x1A84978  Name="" Target=RAM
 Loading image 1 succeeded.
ROMHDR at Address 80361044h
Preparing launch...
RTC: 2024-20-4   1:81:32.38 UTC
Launching windows CE image by jumping at address 0x  362000

Windows CE Kernel for ARM (Thumb Enabled) Built on Mar  8 2013 at 17:05:33
Setting up for a Cold Reboot
Done Setting up for a Cold Reboot
Windows CE Firmware Init
BSP 1.0.0 for the SPEARHEAD600AB board (built Jan 28 2018)
Adaptation performed by ADENEO (c) 2005
+OALIntrInit
-OALIntrInit(rc = 1)
Initialize driver globals Zeros area...
pDrvGlobalArea 0xa0060000  size 0x800 (0xa0060800 -0xa0060000)
Initialize driver globals Zeros area...done
 OALKitlStart
Firmware Init Done.
OALIoctlHalEnterI2cCriticalSection init i2c cs
++SER_Init: context Drivers\Active\14
SER_Init, dwIndex:2
SER2 got sysintr:0x00000017
SER2 Serial Port, new baud rate:0x1c200  (UARTCLK:48000000 IBRD:0x1a FBRD:0x2)
OHCI\system.c, GCFG_USBH1_SW_RST
OHCI\system.c, GCFG_USBH2_SW_RST
LAN PHY NOT detected.
DeleteP500EnetRegistry:
   \Comm\GMAC 0x0
   \Comm\GMAC1 0x0
   \Comm\Tcpip\Linkage 0x0
   \Drivers\Virtual 0x0
   \Drivers\BuiltIn\LIN 0x5
LIN: Data Valid
BALDWIN_DDI: cBaldwinHwIf::Init: Initializing...
BALDWIN_DDI: cBaldwinHwIf::Init: Scope successfully identified.
BALDWIN_DDI: cBaldwinHwIf::Init: Success!
Device load time:
   NANDFLASH: 0 ms
   SNANDFLASH: 0 ms
SHIM DLL, LoadRealDll [PalIO.dll] for [AgilentPalIO.dll]
SHIM [AgilentPalIO.dll] Get Process Addresses
LaunchInfiniiVision:
SHIM DLL, LoadRealDll [PalSStorage.dll] for [AgilentPalSStorage.dll]
SHIM [AgilentPalSStorage.dll] Get Process Addresses
Released build, Jan 28 2018, 21:24:15
Initializing FPGA...
************************************
Ver: 1.067 Released
************************************
Calibration mode User
Cal Date Fri Mar 29 10:57:54 2019
Startup sequence is complete.
System has been running 14.401954 seconds
Start Up Sequence 5.340947
Memory Load 49%
   System Physical Memory 35.984 / 73.465 MB
   Process Virtual Memory 44.000 / 1024.000 MB
-----> InfiniiVision is running <-----
will do USB phy workaround: CheckCRC



FERCSA firmaware bootlog:

Code: [Select]

U-Boot 2010.03 (May 18 2017 - 11:28:22)Agilent P500

CPU:   SPEAr600
DRAM:  128 MiB
Flash: 512 KiB
NAND:  internal ecc 128 MiB

Debug serial initialized ........OK
RTC: 2024-20-4   7:97:57.14 UTC

Microsoft Windows CE Bootloader Common Library Version 1.4 Built Oct 29 2015 01:39:04
Microsoft Windows CE 6.0 Ethernet Bootloader for the Agilent P500 board
Adaptation performed by Agilent Technologies (c) 2008

PHY not found.

System ready!
Preparing for download...
RTC: 2024-20-4   7:97:57.14 UTC
 Loading image 1 from memory at 0xD0600000
O
BL_IMAGE_TYPE_BIN

X
XXXXOOOOXXOOOOOOOOXOXOOOOOOOOXOOOXOOOOXXXOOOOOOOOOXOOOOXOXOXOXXOXOXOXOXXXXOOXXXOOOOOOXXOXXOXXXXXXOOOXXXOOXXOOXXXOXXOOOOXOOXXOOXOXOOOOXOXOOOOOXOOOXOOXOXXOXOXXXXXXOXXXXOOOXOOOXOXOOOOXOOOOXOXOXOOOOOOX
OOOXOOXOOOOXOOOOXOOXXOOXOOOOOOOOOXOOOOXOOOOOOXOXOOOOXOXOOOOOOOXOXOXOOXOXOOOXOOOXOOXOXXOXOOOXOXXXXXOXOXXOXXXXXOXOXOXOOXXXOXXXXXXOXXXXXXXOXXXXXXOXOXXOXOOOXXXXXOXXXXOOOXOXXOOX
XOXXXOOXOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOXXOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOXXXXOXOOXOXOOOXOXXXXXXXXXXXXXrom_offset=0x0.
XXImageStart = 0x80361000, ImageLength = 0x1A84978, LaunchAddr = 0x80362000

Completed file(s):
-------------------------------------------------------------------------------
[0]: Address=0x80361000  Length=0x1A84978  Name="" Target=RAM
 Loading image 1 succeeded.
ROMHDR at Address 80361044h
Preparing launch...
RTC: 2024-20-4   7:97:57.17 UTC
Launching windows CE image by jumping at address 0x  362000

Windows CE Kernel for ARM (Thumb Enabled) Built on Mar  8 2013 at 17:05:33
Setting up for a Cold Reboot
Done Setting up for a Cold Reboot
Windows CE Firmware Init
BSP 1.0.0 for the SPEARHEAD600AB board (built Jan 28 2018)
Adaptation performed by ADENEO (c) 2005
+OALIntrInit
-OALIntrInit(rc = 1)
Initialize driver globals Zeros area...
pDrvGlobalArea 0xa0060000  size 0x800 (0xa0060800 -0xa0060000)
Initialize driver globals Zeros area...done
 OALKitlStart
Firmware Init Done.
OALIoctlHalEnterI2cCriticalSection init i2c cs
++SER_Init: context Drivers\Active\14
SER_Init, dwIndex:2
SER2 got sysintr:0x00000017
SER2 Serial Port, new baud rate:0x1c200  (UARTCLK:48000000 IBRD:0x1a FBRD:0x2)
OHCI\system.c, GCFG_USBH1_SW_RST
OHCI\system.c, GCFG_USBH2_SW_RST
LAN PHY NOT detected.
DeleteP500EnetRegistry:
   \Comm\GMAC 0x0
   \Comm\GMAC1 0x0
   \Comm\Tcpip\Linkage 0x0
   \Drivers\Virtual 0x0
   \Drivers\BuiltIn\LIN 0x5
LIN: Data Valid
BALDWIN_DDI: cBaldwinHwIf::Init: Initializing...
BALDWIN_DDI: cBaldwinHwIf::Init: Scope successfully identified.
BALDWIN_DDI: cBaldwinHwIf::Init: Success!
Device load time:
   NANDFLASH: 0 ms
   SNANDFLASH: 0 ms
SHIM DLL, LoadRealDll [PalIO.dll] for [AgilentPalIO.dll]
SHIM [AgilentPalIO.dll] Get Process Addresses
LaunchInfiniiVision:
SHIM DLL, LoadRealDll [PalSStorage.dll] for [AgilentPalSStorage.dll]
SHIM [AgilentPalSStorage.dll] Get Process Addresses
Released build, Jan 28 2018, 21:24:15
Initializing FPGA...
Ver: 1.067 Released
#Kirk -Without freedom of choice there is no creativity
#FERCSA -Exactly!
*** Reset, energize: MSO
*** Reset, energize: FPGA Probe
*** Reset, energize: Acq Memory Dflt
*** Reset, energize: Acq Memory Max
*** Reset, energize: Acq Memory Max
*** Reset, energize: Embedded serial decode and trigger
*** Reset, energize: Automotive serial decode and trigger
*** Reset, energize: FPGA Altera
*** Reset, energize: Flex Ray serial decode
*** Reset, energize: Power application
*** Reset, energize: Segmented Memory
*** Reset, energize: Mask limit testing
*** Reset, energize: Telecom Mask Test
*** Reset, energize: 500MHz Bandwidth
*** Reset, energize: 200MHz Bandwidth
*** Reset, energize: 100MHz Bandwidth
*** Reset, energize: 70MHz Bandwidth
*** Reset, energize: Flex Ray Compliance
*** Reset, energize: Audio serial decode and trigger
*** Reset, energize: Distributor license
*** Reset, energize: Education kit license
*** Reset, energize: WaveGen license
*** Reset, energize: 1553 & 429 serial decodes
*** Reset, energize: Enhanced Video Triggering
*** Reset, energize: Advance Math
*** Reset, energize: Flex Ray Plus
*** Reset, energize: Distributor license
*** Reset, energize: Distributor license
*** Reset, energize: Enhanced Video Triggering
*** Reset, energize: Digital Voltmeter
*** Reset, energize: ASV
*** Reset, energize: Cable Calibration
*** Reset, energize: Infiniium Mode
*** Reset, energize: Remote Log
*** Reset, energize: Circular Segmented Memory
*** Reset, energize: Tomotherapy
*** Reset, energize: F8AEAE82
Calibration mode User
Cal Date Fri Mar 29 10:57:54 2019
Startup sequence is complete.
System has been running 14.541350 seconds
Start Up Sequence 5.218473
Memory Load 50%
   System Physical Memory 36.188 / 73.465 MB
   Process Virtual Memory 44.750 / 1024.000 MB
-----> InfiniiVision is running <-----
will do USB phy workaround: CheckCRC



I'm I missing something obvious here?

[TK]

The product ID is changed by replacing the resistors in the main board, under the BLT.  ID for DSOX1102G is 24.  You can check if it was set correctly by checking the scope info page under utility.  If it shows segmented memory, waveform generator, then you are in the correct DSOX1102G mode.  No need to look at the serial port dump

[alpher]

That I understand, but why my Uboot logs dont show any BLT info?
It looks like the FPGA is not there at all? My scope is from 2018 and came with 1.10
firmware, anybody else run into this issue?

[tv84]

I'm I missing something obvious here?

Yes, you are.  Look at Dave's FW version (attached).

You have 1.10. I think it's obvious that KS removed that from the FW, after Dave released his investigations, in order to make the hack harder.

What I don't understand is why do you need to change the config resistors since it can be done by software.

Can't FERCSA hack open all the limitations (minus the HW missing)? What is missing?

[TK]

When using the FERCSA hack on an EDUX scope, you need to mod the external trigger section and the CH1-CH2 front end.  The EDUX is hardware limited to 50MHz.  You should not need the resistor mod.  Resistor mod is only when changing the EDUX to DSOX without any software hack to enable 70MHz and all the features included in the standard DSOX (segmented memory, more sample memory, external digital input and so on)

[alpher]

I did mod the trigger and front end sections, but i still believe that to get the full 200MHz bandwidth I had to change the product Id from the 21 (EDUX1002A) to  23 (DSOX1102A). Not sure now, still waiting for some crucial parts to install missing wavegen, when I do, i will try to go back to id 21 and see if it makes any difference.

[tv84]

Look here.

And continue this thread there.