Hack of Sigllent spectrum analyzer ssa3021X?

[TurboTom]

Dimitar,

this may be an indication for a bad block in your NAND FLASH. That's actually not uncommon, the same as you (almost) won't find hard disks without bad blocks, yet they are automatically remapped inthe HDs. The OS should hide the bad blocks in NAND memory as well, yet, since "dd" accesses the raw data of the chip, errors may appear. To read the partition, you may try the command

Code: [Select]

dd conv=noerror,sync if=/dev/mtdblock7 of=/usr/bin/siglent/usr/mass_storage/U-disk0/mtdblock7-P0707.img
I'm not sure if this switch works on the DD version implemented in the SSA3000X since I haven't got a machine with bad blocks to test. In case you need to restore your machine, you should be fine as long as you write back the original file as "dd'ed".

Cheers,
Thomas

[rf-loop]

Dimitar,

this may be an indication for a bad block in your NAND FLASH. That's actually not uncommon, the same as you (almost) won't find hard disks without bad blocks, yet they are automatically remapped inthe HDs. The OS should hide the bad blocks in NAND memory as well, yet, since "dd" accesses the raw data of the chip, errors may appear. To read the partition, you may try the command

Code: [Select]

dd conv=noerror,sync if=/dev/mtdblock7 of=/usr/bin/siglent/usr/mass_storage/U-disk0/mtdblock7-P0707.img
I'm not sure if this switch works on the DD version implemented in the SSA3000X since I haven't got a machine with bad blocks to test. In case you need to restore your machine, you should be fine as long as you write back the original file as "dd'ed".

Cheers,
Thomas

dd conv=noerror

 is not implemented in this "busybox".

[dpenev]

Hi Gents,

OK, so in case of bad blocks we don't have a way to backup at the mtd level.
Has anyone managed to reflash some MTD partition from uboot?
Has anyone managed to reflash an UBI volume from uboot?
Do you know what nand flash chip the Analyzer is using (if I have to replace it)
Are only those two directories unique as per instrument
   /usr/bin/siglent/firmdata0
   /usr/bin/siglent/usr/backup
Do we know where the update script is located for 7.07?
I want to check what it does so eventually get some idea what can happen.

I hope I will not need all this info but knowing me I will update to 8.01 soon

Sorry for the long questions list and thank you in advance!
Dimitar 

[Dima]

Hi Dimitar,
I guess the flash chip is the Micron-MT29F2G08ABAEAWP.
You can see it on Dave's tear down video. Datasheet is easy to find, just google.
The chip you get for a few bugs at digikey.
Reading and writing to the flash you will find many projects on the web. A cheap method would be
to use the FT 2232h -56Q mini module via usb. Best buy also a TSOP 48 socket adaptor, so contacting  the chip will get no pain.
But i am afraid you will need some good soldering skills and have to open the analyzer.
Anyway, this is great idea.

Cheers
Dima

[steverino]

...
The chip you get for a few bugs at digikey.
...

Any particular species of bug? 

[rf-loop]

Hi Gents,

OK, so in case of bad blocks we don't have a way to backup at the mtd level.
Has anyone managed to reflash some MTD partition from uboot?
Has anyone managed to reflash an UBI volume from uboot?
Do you know what nand flash chip the Analyzer is using (if I have to replace it)
Are only those two directories unique as per instrument
   /usr/bin/siglent/firmdata0
   /usr/bin/siglent/usr/backup
Do we know where the update script is located for 7.07?
I want to check what it does so eventually get some idea what can happen.

I hope I will not need all this info but knowing me I will update to 8.01 soon

Sorry for the long questions list and thank you in advance!
Dimitar

What is problem?

If normal FW update fails due to flash problem, your SSA have 3 year factory warranty (if not expanded to 4 or 5 year warranty) . If it fails just call Siglent for repair.

[dpenev]

Hi rf-loop,

Yes you are perfectly right. I am just such a kind of person who tries so solve his problem himself if possible. (often it is better for the nature)
Keep also in mind that if I have to send the instrument back for repairmen it means 1 month without it right?
Take into account we already have MT29F2G08ABAEAWP in stock and we have facility to replace it if necessary.
If I know that reflashing wouldn't take me much time I will go to this option for sure.
But as far as i understand no one has done it yet?
 
In addition I thought talking about my Analyzer here may be interesting for somebody else.

But once again I still don't have issue, probably just some small possibility for an issue in the future.

Additional note. nand flashes often goes in two flavors. Free and not free (less expensive) of bad blocks.
Our experience with the version having bad blocks is that it is often problematic later in the product life.
It is bad that Siglent has used nand flash chips having bad blocks. They use read only file systems but still ...

Thanks
Dimitar 

[tautech]

Hi rf-loop,

Yes you are perfectly right. I am just such a kind of person who tries so solve his problem himself if possible. (often it is better for the nature)
Keep also in mind that if I have to send the instrument back for repairmen it means 1 month without it right?
Take into account we already have MT29F2G08ABAEAWP in stock and we have facility to replace it if necessary.
If I know that reflashing wouldn't take me much time I will go to this option for sure.
But as far as i understand no one has done it yet?

Maybe not, but to do so would ruin any chance of a future warranty claim if needed.
 

In addition I thought talking about my Analyzer here may be interesting for somebody else.

It is, but not at the cost of possibly losing your warranty.

[dpenev]

Indeed!

[Bicurico]

It is OK to discuss hardware-modifications and repairs. The SSA3021X is still a fairly new device and probably all units are still covered by maintenance.

However, in 2 years time, many will be without warranty and I expect to see some being sold in the second hand market.

People will start hacking them and sooner or later the need of flash repair will arise. So why not discuss it now?

I am by no means an expert in flash memory IC's, but there is something very positive about the SSA3021X: the serial number is stored in a regular file within the file system contained in the flash. Some manufacturers chose to store some special data like serial numbers in READ/WRITE protected memory banks of flash IC's. In these cases, exchanging such IC is difficult!

With the SSA3021X I would expect it to be fairly doable: desolder the flash IC, get a replacement flash IC, program it externally (at least up to U-Boot), solder it and use the U-Boot console to flash the reamining firmware.

But I agree with tautech and rf-loop: nobody tried to do that, because it wasn't necessary to do so up to now and because all devices are covered by warranty - if the flash fails, including the hacked ones!

Regards,
Vitor

[TurboTom]

Hi Gents,

OK, so in case of bad blocks we don't have a way to backup at the mtd level.
Has anyone managed to reflash some MTD partition from uboot?
Has anyone managed to reflash an UBI volume from uboot?
....

I can confirm that some individuals successfully re-flashed their kernel / root partitions from U-Boot. I'm not sure if they had bad blocks in their FLASH chips but I doubt it, at least not in the corresponding partitions.

The easy road (and the only that I know of) is via the internal Micro SD card socket since U-Boot checks for presence of a memory card during boot-up. It may well be possible to run the whole SA via a properly configured FS on a Micro SD - that's probably the way initial installation is accomplished at the factory. To gain access to the Micro SD card slot, the instrument needs to be disassembled (case opened / IIRC rear shielding removed). It's probably also possible to back-up the NAND partitions (with proper defect management) via U-Boot to Micro SD. But all this can be considered high-risk activity since a mistake may ruin your day... (read: your SA).

Anyway, we've got complete NAND images of F/W 7.03 and 8.01 in the "community" so what's really important is to back up the configuration and calibration of your machine (on a FS base) since this is individual to each SA. If you need other images that are common to all machines, there will be a way to help.

All the best,
Thomas

[rf-loop]

Anyway, we've got complete NAND images of F/W 7.03 and 8.01 in the "community" so what's really important is to back up the configuration and calibration of your machine (on a FS base) since this is individual to each SA. If you need other images that are common to all machines, there will be a way to help.

All the best,
Thomas

And this is important to do.  In FW 7 least calibration data because this can not copy from any other maachine.
And if FW 8  cal data but now there is  also other extremely important things what can not copy from other unit. There is example individual product model license. Without it, it is SSA3010X.

Also all other technical things are intersting and and also for possible some future needs it is good to have more and more valid information and knowledge collected.  All this is good and finally it may even rise product value for users and including also users after 3 year or  after >10 years.

[dpenev]

I agree, the calibration is important.
In this respect can someone confirm(or share some thoughts) that those two directories contain all the unique data for a given Analyzer?
    /usr/bin/siglent/firmdata0
   /usr/bin/siglent/usr/backup

As per the update I did a quick check and the update is happening calling functions from /usr/lib/siglentlib.sh
Probably "check_and_upgrade()"
So basically they just do "nandwrite mtdN image" from linux. In theory nandwrite is bad block aware, so I and other having bad blocks should be OK.
But I will cross fingers when I do my update



   

[rf-loop]

I agree, the calibration is important.
In this respect can someone confirm(or share some thoughts) that those two directories contain all the unique data for a given Analyzer?
    /usr/bin/siglent/firmdata0
   /usr/bin/siglent/usr/backup

As per the update I did a quick check and the update is happening calling functions from /usr/lib/siglentlib.sh
Probably "check_and_upgrade()"
So basically they just do "nandwrite mtdN image" from linux. In theory nandwrite is bad block aware, so I and other having bad blocks should be OK.
But I will cross fingers when I do my update

   

I can not true confirm these two directories but I can confirm with disclaimer: as far as I know.
As also can find in someone made instruction text V05 what can find in this thread.

bad block.

I have updated equipment what have this situation  and in this case not any problem.

calibration is important.

Yes, and also very important model license key. (it is in one .xml file in these folders if SSA have FW 8.
In FW 7  update process to FW 8 system generate this license key for model what it is currently when it have FW 7.  Later it can not generate (exept factory) (1).  FW 7 update to FW 8 is big upgrade. It also make big improvement for TG.

(1) exept: roll back to FW 7 and  again to FW 8  but this need - know how to do.

[dpenev]

Quote
bad block.
I have updated equipment what have this situation  and in this case not any problem.

Oh rf-loop, this is  very relaxing!
How do you know you have bad blocks, partition dump from using dd command?
Was your bad blocks on the mtdblock7/rootfs?

Thanks

[rf-loop]

Quote
bad block.
I have updated equipment what have this situation  and in this case not any problem.

Oh rf-loop, this is  very relaxing!
How do you know you have bad blocks, partition dump from using dd command?
Was your bad blocks on the mtdblock7/rootfs?

Thanks

Yes in block7 (after around 10M...err, others all ok. )

[dpenev]

good! I will update later on today.
Thanks

[Mark11]

Thanks Vitor, kcbrown and Thomas for pointing me to the right direction.
As you have suggested I started with Linux.
I bought a book Just Enough Linux by Malcolm Maclean two months ago.
My intention was to start playing with Raspberry Pi but now it has
proved to be best spent two dollars (yes 2 US$). It was not necessary
to learn a lot about Linux. Just a few basic commands to navigate file
system in the terminal and some commands as /, cd, ls, cp, pwd, mkdir,
rm, mv ... and I finaly understood what I have to do. I installed Ubuntu,
opened terminal and practised until I got the basic idea how it all works.
Then I read Mr. Li Xiu Ying's instruction again.
The rest is history. 

Thans guys. You are the best!

Martin

[dpenev]

Hi All,

I have updated my Analyzer to V01.02.08.01.
Even thought I seems to have some bad blocks (dd dump reports input/output error) on the mtdblock7 the update went OK
I got few reboots during the update and now I am on V01.02.08.01.

Thank you all for the help!
Dimitar

[arturfra]

Hi guys, I've a SSA3021X with 7.07 fw hacked with all options permanent enabled and until 3.2Ghz, just now I've upgraded to fw 8.01 and now it remains with 3.2Ghz feature but with all option OFF (only TG on because I've a valid licence key), Is it possible to activate all the options as before I made without loosing the serial number and then without delete the famous files ??

thanks in advance

[videobruce]

V 1.2.8.2 is out. Who will be the 1st to try??? 

http://www.siglentamerica.com/USA_website_2014/Firmware&Software/firmware/SSA3000X-Firmware-Update.rar

1. This firmware must be upgraded from V1.2.8.1 or later. If your SSA3000X has an earlier version, please to V1.2.8.1 first and then proceed to uplate to the latest version.
 2. Add socket/telnet-scpi, you can operate remote control through LAN port without NI-VISA installed. Please check SSA3000X Programming Guide for more details.
 3. Change two limit lines in different colours.
 4. When quit from TG, stay in“Auto”sweep.
 5. Lower some spurs when FFT.
 6. Improve the stability.

(Link updated to a direct link for download)

[nugglix]

V 1.2.8.2 is out. Who will be the 1st to try??? 

http://siglentamerica.com/prodcut-gjjrj.aspx?id=5113&tid=227&T=2

Thanks for the info!

Download doesn't work atm, so I can't!

[tautech]

V 1.2.8.2 is out. Who will be the 1st to try??? 

http://siglentamerica.com/prodcut-gjjrj.aspx?id=5113&tid=227&T=2

Thanks for the info!

Download doesn't work atm, so I can't!

This one does,(the Download button) just clicked on it to get a copy for my archives.
http://www.siglentamerica.com/gjjrj-xq.aspx?id=5128&tid=15

7.36 Mb .rar

[nugglix]

Tried that already.
There is something seriously broken atm.
Transfer stops after a few kB, if you pause/resume it works for another few kB.
Transfer rate is around 5kB/s, which I consider a bit on the low side...

Will have a look at it from time to time.

[Bicurico]

Strange.

I could download the file without problems and did so a few times, just to check.

I downloaded the new EasySpectrum and Programming Manual, with no issues either.

I guess your ISP must be having some issues.

Try this link: https://mediacdn.eu/m/media/wysiwyg/siglent/Downloads/Firmware/SSA3000X-Firmware-Update.rar

It is from http://www.siglent.eu/Downloads

Regards,
Vitor