TDS420 Options Possible?

[Igorkasona1233]

Hello,

i hope this topic is not redundant, but i have been resceaching if it is possible to recover the lost options in a TDS420.
As far i found out that no one did achieve ore post about it, just some speculations.
It would be very kind if someone who is in the know can tell if this is possible and when not why especially this is the case.
I also tried some thins, but no luck. Im very open for Suggestion.
Also im not 100% sure the options are stored in the VRam but it seams to be the case.
Thank you for your time

Regards
Igor

[Igorkasona1233]

Hi,

Does no one know if it is even possible would be nice to know,
Thanks

regards

[fenugrec]

i hope this topic is not redundant, but i have been resceaching if it is possible to recover the lost options in a TDS420.

Most probably. And I'd also bet that they're saved in the NVRAM. If you have a firmware ROM dump I can take a quick look.

[Igorkasona1233]

As far as i have look it should be in the NVRAM, Ok i will try to dump the Firmware. It may take a bit until i have dumped it, i think it only works over GPIB not over the serial. I never tried it with my interfaces to do this.
Thanks for the help

regards

[fenugrec]

As far as i have look it should be in the NVRAM, Ok i will try to dump the Firmware. It may take a bit until i have dumped it, i think it only works over GPIB not over the serial. I never tried it with my interfaces to do this

It *is* possible to dump the firmware over the serial console, but it's ridiculously slow. Like < 100 *bytes* per second ! (9600bps, but the data is formatted as an ASCII hex dump. Horrible.)

Actually if you have the serial console hooked up, you could try just viewing the option words with these commands

Code: Select all

libManagerWordAt(0x50006)
libManagerWordAt(0x50007)
...
libManagerWordAt(0x5000F)

If you're lucky, those would match the option #s for later scopes :

libManagerWordAtPut(0x50006, 1) <- Enable option 1M
libManagerWordAtPut(0x50007, 1) <- Enable option 05
libManagerWordAtPut(0x50008, 1) <- Enable option 13
libManagerWordAtPut(0x50009, 1) <- Enable option 2F
libManagerWordAtPut(0x5000a, 1) <- Enable option 1F
libManagerWordAtPut(0x5000c, 1) <- Enable option 2C
libManagerWordAtPut(0x5000d, 1) <- Enable option 3C
libManagerWordAtPut(0x5000e, 1) <- Enable option 4C
libManagerWordAtPut(0x5000f, 1) <- Enable option 2M

[Igorkasona1233]

As far as i have look it should be in the NVRAM, Ok i will try to dump the Firmware. It may take a bit until i have dumped it, i think it only works over GPIB not over the serial. I never tried it with my interfaces to do this

It *is* possible to dump the firmware over the serial console, but it's ridiculously slow. Like < 100 *bytes* per second ! (9600bps, but the data is formatted as an ASCII hex dump. Horrible.)

Actually if you have the serial console hooked up, you could try just viewing the option words with these commands

Code: Select all

libManagerWordAt(0x50006)
libManagerWordAt(0x50007)
...
libManagerWordAt(0x5000F)

If you're lucky, those would match the option #s for later scopes :

libManagerWordAtPut(0x50006, 1) <- Enable option 1M
libManagerWordAtPut(0x50007, 1) <- Enable option 05
libManagerWordAtPut(0x50008, 1) <- Enable option 13
libManagerWordAtPut(0x50009, 1) <- Enable option 2F
libManagerWordAtPut(0x5000a, 1) <- Enable option 1F
libManagerWordAtPut(0x5000c, 1) <- Enable option 2C
libManagerWordAtPut(0x5000d, 1) <- Enable option 3C
libManagerWordAtPut(0x5000e, 1) <- Enable option 4C
libManagerWordAtPut(0x5000f, 1) <- Enable option 2M

I have once tried it over the Serial Port and only a view commands are working like clearing the Log, but all the other ones are not working but i may try it again. I did not got the tekfwtool working yet it does not see the NI ViSA... . I Have read that some did play around with the idea doing it over the Serial Port. Something i found quite odd is that i no one ever succeed in enabling Options on a 420.

[fenugrec]

I have once tried it over the Serial Port and only a view commands are working like clearing the Log, but all the other ones are not working

To be clear, I meant the serial "service console" connection only accessible inside the unit's case, not the regular RS232 interface on the back panel.

[Igorkasona1233]

I have once tried it over the Serial Port and only a view commands are working like clearing the Log, but all the other ones are not working

To be clear, I meant the serial "service console" connection only accessible inside the unit's case, not the regular RS232 interface on the back panel.

I know, going to try some things the in the next view days

[Igorkasona1233]

Im probably to stupid to use a console but i only got the "scopeErrorLogDumpToConsole" to work every other one just is a undefind symbol.

Code: Select all

-> scopeErrorLogDumpToConsole
 No error log entries
alue = 149 = 0x95
-> help
undefined symbol: help
-> libManagerWordAt 0x50006
undefined symbol: libManagerWordAt
->

[fenugrec]

Code: Select all

-> help
undefined symbol: help

Interesting, so this would be a very limited console. Can you paste the whole output produced by a normal boot ?

Some other commands you could try : "lkup" and "lkAddr 0x1000000", those may help find which other commands are defined.

[Igorkasona1233]

Ok here the results

Code: Select all

        Bootrom Header Checksum passed.
        Bootrom Total Checksum passed.
        BootRom Check Sum passed.
        Bus Error Timeout test passed.
        Bus Error Write to Bootrom passed.
        GPIB Test passed.
Kernel Diagnostics Complete.

Calling SDM (monitor) Routine.

SDM (monitor) not enabled.
        Enabling Bus Control register. Value = 0x2
        Flashrom Programming Voltage is OFF.
        Flashrom DSACK and JumpCode test passed.
        Flashrom Checksums passed.
Bootrom Diagnostics Complete.

Transferring control to the Flashrom.
sysDramControllerInit
sysDramByteStrobeTest
sysDramTest
bcopy(<Idata>)
bzero(<bss>)
intVecBaseSet(getVbr())
sysSymTbl=standAloneSymTbl
sysDevDramTest
0x0 bytes of development dram found
validateDataSpace
Outer Kernel DSACK Test
Pending Interrupt Test
Walk IPL to Zero Test
Timer Int Test
Start PowerhOw Diag SAquence
ccountant probe routines
  Probe for unexpected pending ints
  Dsp Instr mem size
  Dsp D2 mem size
  Dsp D1 mem size
  Dsy Vect0 mem size
  Dsy Vect1 mem size
  Dsy Wfm0 mem size
  Dsy Wfm1 mem size
  Dsy Text0 mem size
  Dsy Text1 mem size
  Acq number of digitizers
  Acq mem size
  Cpu timer interval uSec
  Cpu Dram size
  NvRam mem size
  Opt RS232/ Cent presence
  Acq 8051 presence
  Acq ADG209C presence
  Acq record length size
syWaitClock ................... pass
clockCalVerify ................. pass
cpuDiagBatTest ................. pass
cpuDiagAllInts ................. pass
cpuEEromLibDiag ................ pass
calLibDefaultCk ................ pass
dspForcedBus ................... pass
dsp68kD2MemTest ................ pass
optRS232DuartIO ................ UNTESTED
dsp68kMemTest .................. pass
dspRunVerify ................... pass
dspBusRequestTest .............. pass
dspImplicitBusAccess ........... pass
dspTristarMemTest .............. pass
dspDsyToDspInts ................ pass
dspAcqToDspInts ................ pass
nvLibrariansDiag ............... pass
dsyDiagResetReg ................ pass
atBusTest ...................... pass
dsyDiagResetReg ................ pass
dsyDiagVscReg .................. pass
dsyDiagPPRegMem ................ pass
dsyDiagRasRegMem ............... pass
dsyDiagRegSelect ............... pass
dsyDiagRamdacRegMem ............ pass
dsyDiagAllMem .................. pass
dsySeqYTModeV0Intens ........... pass
dsyDiagSeqXYModeV1 ............. pass
dsyRastModeV0Walk .............. pass
dsyRastModeV1Attrib ............ pass
dsyWaitClock ................... pass
attn8051testResult ............. pass
attnDACReadback ................ pass
acq8051testResult .............. pass
adgRegDiag ..................... pass
dsyWaitClock ................... pass
adgMemTestDiag ................. pass
trigComparatorTest ............. pass
trigDBERunsAfter ............... pass
tbiRampTest .................... pass
acqRampDiagAll ................. pass
dsyWaitClock ................... pass
fpDiagConf ..................... pass

$Header: scopeSTR.version,v 1.94 93/03/29 14:05:04 aland Exp $
->
Smalltalk/V Sun Version 1.12
Copyright (C) 1990 Object Technology International Inc.

Something interesting is that i always get something weird in the two lines
"Start PowerhOw Diag SAquence
ccountant probe routines"
they seem to be different every time i start the instrument, I dont know what is causing that, i might look at the signals with an analyser and see what is going on there.

interesting command Lkup, at the end i also tried the lkAddr but as suspected also did not work

Code: Select all

lkup
_verState       0x01001bcb text
_verSource      0x01001beb text
_verRevision    0x01001bd9 text
_verHeader      0x01001b60 text
_verDate        0x01001bb0 text
_verAuthor      0x01001b9f text
_v              0x01152d80 text
_ttExcludeSetup 0x01153aae text
_tt             0x01000a82 text
_ts             0x01004954 text
_tr             0x010049ac text
_ti             0x01004aa2 text
_td             0x01004a1a text
_sysNvRamSet    0x0100215a text
_sysNvRamGet    0x01002134 text
_syncClock      0x01153284 text
_sdata          0x02f01000 data
_scopeErrorLogDumpToConsole 0x01117b8c text
_scopeErrorLogClear 0x01117222 text
_runScope       0x01001a0c text
_repeatRun      0x01004102 text
_repeat         0x0100415a text
_repairSemOn    0x0116a408 text
_repairSemOff   0x0116a3fa text
_pu_diag        0x0110c246 text
_periodi        0x010040b2 text
_periodRun      0x01004064 text
_patGen         0x011491c0 text
_pL             0x02f12478 bss
_mRegs          0x01005f20 text
_m              0x01004c2e text
_logIBuffer     0x0110bcce text
_lkup           0x01005808 text
_i              0x01004708 text
_dumpPort       0x01118ef4 text
_dumpMepe       0x011190ae text
_dumpConstants  0x01142424 text
_dumpCalSet     0x011426c8 text
_dumpBuffer     0x01118c80 text
_devs           0x010057fa text
_debugMode      0x02f2811c bss
_d              0x01004d5e text
_centronicsPutMsgHardcopy 0x01132b34 text
_centronicsPutC 0x01132a5c text
_bzero          0x0115ca88 text
_bfill          0x0115c930 text
_bcopy          0x0115c722 text
_bcmp           0x0115c9d2 text
value = 1 = 0x1
-> lkAddr 0x1000000
undefined symbol: lkAddr
->

Also i tried to dump the NVRAM and firmare through GPIB but not really successful only got a part of the Firmware i think. Maybe the address space is different in the TDS420 this was only a crude attempt

[fenugrec]

Code: Select all

nvLibrariansDiag 

The "Librarians" functions is how these scopes store cal, config and option data in the NVRAM, so this is a good sign - it's the same mechanism as on the later scopes.

"Start PowerhOw Diag SAquence ccountant probe routines"
they seem to be different every time i start the instrument,

Funny, that looks like a buffering bug in the firmware where "Start PowerOn Diag Sequence" gets
interleaved with "hwAccountant probe routines", but that wouldn't explain why a few characters are dropped. I wouldn't worry too much about it.

Code: Select all

lkup

If you run lkup a second time, does it continue listing different syms ?


ROM dump : from what I see you seem to have succesfully dumped the main ROM mapped at 0x0100 0000, but there's probably a part missing - you stopped at 3MB (0x012f ffff) but I'm pretty sure there's more. I see references to lkAddr , help, and the usual vxworks commands inside it; I'm not sure why they're not available. Perhaps only available under certain conditions ?

In any case, I've found some interesting things that look very similar to the later firmwares I'm more familiar with. What options are you missing ? So far, I see

Code: Select all

1M	0x50006
Math	0x5000F

Note, those aren't memory addresses. On later scopes, one would call "libManagerWordAtPut(0x50006, 1)" to enable option 1M.
0x50006 actually means "librarian #5, item #0006". The "librarian" is a piece of code + some data tables which associate the librarian #, and item #, to an NVRAM address. So it is possible to manually figure out where it's stored in the NVRAM, but way easier to just use libManagerWordAtPut. Your firmware almost certainly has that function, it's just a matter of finding and running it.

[Igorkasona1233]

Funny, that looks like a buffering bug in the firmware where "Start PowerOn Diag Sequence" gets
interleaved with "hwAccountant probe routines", but that wouldn't explain why a few characters are dropped. I wouldn't worry too much about it.

I know, that it is not important but found it funny, saw it also this in someones else's scope.

No, lkup returns the same commands

Yup that dump is the Main Firmware but i got an error before it all was dumped, im maybe using the wrong address range.
You have quite a knowledge about those systems like vxworks, is there anything to read about it or is it just accumulated knowledge
I did not intentionally stop at 0x012f ffff, i used the Tekfwtool and got always the error "read_memory: invalid response: S" either S or + as invalid response. Maybe im using wrong arguments.

The options 1M and Math are missing, interesting to know about the libManager.
I dont want to occupy your time with my dumb questions, sorry.

[fenugrec]

Yup that dump is the Main Firmware but i got an error before it all was dumped, im maybe using the wrong address range.

Well I'm almost 100% sure you have the correct start address 0x0100 0000, because I recognize the first few hundred bytes as very similar to other ROMs.
About your tekfwtool error, that's strange. You could try starting a short dump at 0x0130 0000 with debugging enabled, see what it says.

is there anything to read about it or is it just accumulated knowledge

Hmm, mostly accumulated knowledge from looking at my scope's firmware disassembly, as well as some threads here, in particular posts by @strick and @cap . I don't know a lot about vxworks but I played with the console a bit, so I know it can usually look into a global symbol table to find the requested function, and calls it directly. In your case, it seems the default "smalltalk" console is independant from vxworks; you'd have to find out how to get the vxworks console enabled.

The options 1M and Math are missing, interesting to know about the libManager.
I dont want to occupy your time with my dumb questions, sorry.

Yep the options are definitely verified/changed through the libManager mechanism that I described. Your questions are not dumb at all, this stuff is very undocumented.

[Igorkasona1233]

I thought so too, also besause of "COPYRIGHT TEKTRONIX INC, 1989,1990,1991,1992" in the beginning.

Ok i will try it to see what is causing the error, with debugging enabled.

That is also what i encountered that there is little to none information about this anywhere.
I will try to read up things about others scopes etc. maybe i can find a way to get access to the commands.

Thank you for your Help so far!

[Igorkasona1233]

How do i actually use the debug feature, i tried some things, looking in the "tekfwtool.c" i found the arguments, maybe you can give me a hint how to type the command, just using the -d is not working

[fenugrec]

How do i actually use the debug feature, just using the -d is not working :)

strange, either -d or --debug should work... did you compile yourself ?

[Igorkasona1233]

No, i used the EXE, -d or --debug did not return more info, i think im cursed or something else.