Hacking around with a SDG800 (SDG805)

Siglent_SDG800_series1I’ve been playing around with an SDG805 arbitrary waveform generator. I’ve previously used the SDG1025 which I found to be a pretty reasonable bit of bit for the price. The SDG805 is a 5MHz generator and costs about 200USD. It has a 125MSPs DAC and is available in version upto 20MHz. In fact the 805 can also generate waveforms far faster than the stated 5MHz by loading a repetitive waveform into the arb memory. It seems likely that there are only software differences between the various version of the SDG800.

It also seems likely that the SDG800 series runs linux. Particular given recent statements by the Siglent CEO that all future Siglent products will be based around Linux. And if I have something that runs Linux… well I’m going to want a console on it.

I opened up by SDG805 and started hunting around on a scope for a pin that was throwing out lowish speed data on boot. After some fiddling around I found that the following pins on J2 expose a 115200 8N1 console. You can watch the Linux scroll past quite happily:

IMG_0430

You can also interrupt uboot and dig around there. From uboot you can dump the flash if you so desire. The SD card slot can be used from uboot (using the mmc commands) and you can read data from nand flash to memory and dump it to flash as follows:

nand read 0x80200000 0x3380000 0x0600000

fatwrite mmc 0:1 0x80200000 flashR1 0x3000000

You’ll need to read out the nand flash in chucks and then stitch them back together but it should be possible to read out the complete rootfs this way. A word or warning, don’t run the “boot” command with a SD card in the slot. It will erase the flash (including uboot) and try and write a new flash image from data on the SD card (which it wont find unless you’ve put it there).

After the system boots, you’ll get a login prompt. However I don’t know what the password is. With access to uboot however it’s most likely reasonable straight forward to craft a new FS and gain access to the system.

Boot console dump:

U-Boot SPL 2013.01.01-svn25739 (Feb 27 2016 - 18:41:59)
config ddr_pll_config()++
config ddr_pll_config()--
nand_init+++++
nand_init-----
Lcd_Init()++
SetUpLCD()++
SetUpLCD()--
len=307252, height=240, width=320
Logo from nandflash: base=0x81000000; end=0x8104b01f; end-base=0x4b01f; rwsize=0x4b020; r=0x0
Lcd_Init()--
spl: nand - using hw ecc

U-Boot 2013.01.01-svn25739 (Feb 27 2016 - 18:41:59)

I2C: ready
DRAM: 128 MiB
NAND: 256 MiB
MMC: OMAP SD/MMC: 0, OMAP SD/MMC: 1
Using default environment

set_default_env::8159
Net: not set. Validating first E-fuse MAC
PHY reset timed out
cpsw
Hit any key to stop autoboot
mmc_send_cmd : timeout: No status update
Card did not respond to voltage select!
Booting from nand ...

NAND read: device 0 offset 0x3080000, size 0x300000
3145728 bytes read: OK
## Booting kernel from Legacy Image at 80200000 ...
Image Name: Linux-3.2.0-svn2240
Image Type: ARM Linux Kernel Image (uncompressed)
Data Size: 2875232 Bytes = 2.7 MiB
Load Address: 80008000
Entry Point: 80008000
Verifying Checksum ... OK
Loading Kernel Image ... OK
OK

Starting kernel ...

Uncompressing Linux... done, booting the kernel.
[ 0.000000] Linux version 3.2.0-svn2240 (ding@ding-desktop) (gcc version 4.5.3 20110311 (prerelease) (GCC) ) #2 Thu Dec 31 18:12:16 ULAT 2015
[ 0.000000] CPU: ARMv7 Processor [413fc082] revision 2 (ARMv7), cr=10c53c7d
[ 0.000000] CPU: PIPT / VIPT nonaliasing data cache, VIPT aliasing instruction cache
[ 0.000000] Machine: am335xevm
[ 0.000000] Ignoring tag cmdline (using the default kernel command line)
[ 0.000000] Memory policy: ECC disabled, Data cache writeback
[ 0.000000] AM335X ES1.0 (neon )
[ 0.000000] Built 1 zonelists in Zone order, mobility grouping on. Total pages: 32512
[ 0.000000] Kernel command line: console=ttyO0,115200n8 root=ubi0:rootfs ro ubi.mtd=7,2048 rootfstype=ubifs rootwait=1t ip=none
[ 0.000000] PID hash table entries: 512 (order: -1, 2048 bytes)
[ 0.000000] Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)
[ 0.000000] Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)
[ 0.000000] Memory: 128MB = 128MB total
[ 0.000000] Memory: 123724k/123724k available, 7348k reserved, 0K highmem
[ 0.000000] Virtual kernel memory layout:
[ 0.000000] vector : 0xffff0000 - 0xffff1000 ( 4 kB)
[ 0.000000] fixmap : 0xfff00000 - 0xfffe0000 ( 896 kB)
[ 0.000000] vmalloc : 0xc8800000 - 0xff000000 ( 872 MB)
[ 0.000000] lowmem : 0xc0000000 - 0xc8000000 ( 128 MB)
[ 0.000000] modules : 0xbf000000 - 0xc0000000 ( 16 MB)
[ 0.000000] .text : 0xc0008000 - 0xc050d000 (5140 kB)
[ 0.000000] .init : 0xc050d000 - 0xc0544000 ( 220 kB)
[ 0.000000] .data : 0xc0544000 - 0xc05e7140 ( 653 kB)
[ 0.000000] .bss : 0xc05e7164 - 0xc0609be4 ( 139 kB)
[ 0.000000] NR_IRQS:396
[ 0.000000] IRQ: Found an INTC at 0xfa200000 (revision 5.0) with 128 interrupts
[ 0.000000] Total of 128 interrupts on 1 active controller
[ 0.000000] OMAP clockevent source: GPTIMER2 at 25000000 Hz
[ 0.000000] omap_dm_timer_switch_src: Switching to HW default clocksource(sys_clkin_ck) for timer1, this may impact timekeeping in low power state
[ 0.000000] OMAP clocksource: GPTIMER1 at 25000000 Hz
[ 0.000000] sched_clock: 32 bits at 25MHz, resolution 40ns, wraps every 171798ms
[ 0.000000] Console: colour dummy device 80x30
[ 0.000181] Calibrating delay loop... 718.02 BogoMIPS (lpj=3590144)
[ 0.057198] pid_max: default: 32768 minimum: 301
[ 0.057322] Security Framework initialized
[ 0.057423] Mount-cache hash table entries: 512
[ 0.057795] CPU: Testing write buffer coherency: ok
[ 0.077317] omap_hwmod: gfx: failed to hardreset
[ 0.093358] omap_hwmod: pruss: failed to hardreset
[ 0.094443] print_constraints: dummy:
[ 0.094791] NET: Registered protocol family 16
[ 0.096892] OMAP GPIO hardware version 0.1
[ 0.099299] am335x_evm_init()------------ddr
[ 0.099528] omap_mux_init: Add partition: #1: core, flags: 0
[ 0.101605] am335x_evm_i2c_init()++
[ 0.101808] omap_i2c.1: alias fck already exists
[ 0.102012] am335x_evm_i2c_init()--
[ 0.102748] omap2_mcspi.1: alias fck already exists
[ 0.102957] omap2_mcspi.2: alias fck already exists
[ 0.103213] edma.0: alias fck already exists
[ 0.103233] edma.0: alias fck already exists
[ 0.103252] edma.0: alias fck already exists
[ 0.124381] bio: create slab at 0
[ 0.126383] SCSI subsystem initialized
[ 0.128120] usbcore: registered new interface driver usbfs
[ 0.128420] usbcore: registered new interface driver hub
[ 0.128624] usbcore: registered new device driver usb
[ 0.128773] musb-ti81xx musb-ti81xx: musb0, board_mode=0x13, plat_mode=0x3
[ 0.129038] musb-ti81xx musb-ti81xx: musb1, board_mode=0x13, plat_mode=0x1
[ 0.147265] omap_i2c omap_i2c.1: bus 1 rev2.4.0 at 100 kHz
[ 0.149106] tps65910 1-002d: JTAGREVNUM 0x0
[ 0.151479] print_constraints: VRTC:
[ 0.152926] print_constraints: VIO: at 1500 mV
[ 0.155218] print_constraints: VDD1: 600 1500 mV at 1262 mV normal
[ 0.157504] print_constraints: VDD2: 600 1500 mV at 1137 mV normal
[ 0.158500] print_constraints: VDD3: 5000 mV
[ 0.159912] print_constraints: VDIG1: at 1800 mV
[ 0.161330] print_constraints: VDIG2: at 1800 mV
[ 0.162738] print_constraints: VPLL: at 1800 mV
[ 0.164149] print_constraints: VDAC: at 1800 mV
[ 0.165565] print_constraints: VAUX1: at 1800 mV
[ 0.166978] print_constraints: VAUX2: at 3300 mV
[ 0.168413] print_constraints: VAUX33: at 3300 mV
[ 0.169826] print_constraints: VMMC: at 3300 mV
[ 0.170307] tps65910 1-002d: No interrupt support, no core IRQ
[ 0.171731] Switching to clocksource gp timer
[ 0.187129] musb-hdrc: version 6.0, ?dma?, otg (peripheral+host)
[ 0.187301] musb-hdrc musb-hdrc.0: dma type: pio
[ 0.188187] musb-hdrc musb-hdrc.0: USB OTG mode controller at c881c000 using PIO, IRQ 18
[ 0.188341] musb-hdrc musb-hdrc.1: dma type: pio
[ 0.188739] musb-hdrc musb-hdrc.1: MUSB HDRC host driver
[ 0.188809] musb-hdrc musb-hdrc.1: new USB bus registered, assigned bus number 1
[ 0.188940] usb usb1: New USB device found, idVendor=1d6b, idProduct=0002
[ 0.188956] usb usb1: New USB device strings: Mfr=3, Product=2, SerialNumber=1
[ 0.188970] usb usb1: Product: MUSB HDRC host driver
[ 0.188981] usb usb1: Manufacturer: Linux 3.2.0-svn2240 musb-hcd
[ 0.188993] usb usb1: SerialNumber: musb-hdrc.1
[ 0.189750] hub 1-0:1.0: USB hub found
[ 0.189780] hub 1-0:1.0: 1 port detected
[ 0.190293] musb-hdrc musb-hdrc.1: USB Host mode controller at c881e800 using PIO, IRQ 19
[ 0.190712] NET: Registered protocol family 2
[ 0.190906] IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
[ 0.191200] TCP established hash table entries: 4096 (order: 3, 32768 bytes)
[ 0.191289] TCP bind hash table entries: 4096 (order: 2, 16384 bytes)
[ 0.191344] TCP: Hash tables configured (established 4096 bind 4096)
[ 0.191356] TCP reno registered
[ 0.191368] UDP hash table entries: 256 (order: 0, 4096 bytes)
[ 0.191393] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
[ 0.191576] NET: Registered protocol family 1
[ 0.191902] RPC: Registered named UNIX socket transport module.
[ 0.191916] RPC: Registered udp transport module.
[ 0.191925] RPC: Registered tcp transport module.
[ 0.191935] RPC: Registered tcp NFSv4.1 backchannel transport module.
[ 0.192180] NetWinder Floating Point Emulator V0.97 (double precision)
[ 0.199357] VFS: Disk quotas dquot_6.5.2
[ 0.199428] Dquot-cache hash table entries: 1024 (order 0, 4096 bytes)
[ 0.199898] msgmni has been set to 241
[ 0.200606] io scheduler noop registered
[ 0.200621] io scheduler deadline registered
[ 0.200681] io scheduler cfq registered (default)
[ 0.201287] ti_cali_init()++
[ 0.201297] ti_cali_init()--
[ 0.201538] fpga_update_start_init()++
[ 0.201854] gpio_value = 0fpga_update_start_init()--
[ 0.202684] omap_uart.0: ttyO0 at MMIO 0x44e09000 (irq = 72) is a OMAP UART0
[ 0.850079] console [ttyO0] enabled
[ 0.854377] omap_uart.1: ttyO1 at MMIO 0x48022000 (irq = 73) is a OMAP UART1
[ 0.862208] omap_uart.2: ttyO2 at MMIO 0x48024000 (irq = 74) is a OMAP UART2
[ 0.869947] omap_uart.3: ttyO3 at MMIO 0x481a6000 (irq = 44) is a OMAP UART3
[ 0.877728] omap_uart.4: ttyO4 at MMIO 0x481a8000 (irq = 45) is a OMAP UART4
[ 0.885489] omap_uart.5: ttyO5 at MMIO 0x481aa000 (irq = 46) is a OMAP UART5
[ 0.902838] brd: module loaded
[ 0.910857] loop: module loaded
[ 0.914261] at24 1-0051: 32768 byte 24c256 EEPROM, writable, 64 bytes/write
[ 0.971772] No daughter card found
[ 0.975363] at24 1-0050: 32768 byte 24c256 EEPROM, writable, 64 bytes/write
[ 0.982632] am335x_evm_setup()++
[ 1.041877] AM335X: EVM Config read fail: -110
[ 1.046509] No board detected, using GPBoard 1.1A as default
[ 1.052567] The board is general purpose EVM in profile 0
[ 1.058192] Found invalid GP EVM revision, falling back to Rev1.1A
[ 1.065532] da8xx_lcdc.0: alias fck already exists
[ 1.071336] caliadc_probe()++
[ 1.074850] ts_dev->cali_base = f9e0d000
[ 1.078991] cali_idle_config()++
[ 1.082374] cali_idle_config()--
[ 1.085733] cali_step_config()++
[ 1.089090] STEPCONFIG1 = 0
[ 1.092005] cali_step_config()--
[ 1.095405] caliadc_probe()--
[ 1.098652] evm_nand_init()++
[ 1.101883] omap_nand_init()++
[ 1.105063] omap_nand_init()--
[ 1.108658] omap-gpmc omap-gpmc: GPMC revision 6.0
[ 1.113685] Registering NAND on CS0
[ 1.117888] evm_nand_init()--
[ 1.121142] _omap_mux_get_by_name: Could not find signal mcasp1_aclkx.mmc0_sdwp
[ 1.129886] haptics_init()++
[ 1.133919] haptics_init()--
[ 1.137358] am335x_evm_setup()--
[ 1.142212] mtdoops: mtd device (mtddev=name/number) must be supplied
[ 1.149444] omap2-nand driver initializing
[ 1.154061] ONFI flash detected
[ 1.157466] ONFI param page 0 valid
[ 1.161106] NAND device: Manufacturer ID: 0x2c, Chip ID: 0xda (Micron MT29F2G08ABAEAWP)
[ 1.169704] Creating 12 MTD partitions on "omap2-nand.0":
[ 1.175362] 0x000000000000-0x000000020000 : "SPL"
[ 1.181698] 0x000000020000-0x000000040000 : "SPL.backup1"
[ 1.188655] 0x000000040000-0x000000060000 : "SPL.backup2"
[ 1.195607] 0x000000060000-0x000000080000 : "SPL.backup3"
[ 1.202544] 0x000000080000-0x000000260000 : "U-Boot"
[ 1.209658] 0x000000260000-0x000000280000 : "U-Boot Env"
[ 1.216454] 0x000000280000-0x000000580000 : "Manufacturedata"
[ 1.224900] 0x000000580000-0x000003080000 : "rootfs"
[ 1.249114] 0x000003080000-0x000003680000 : "kerneldata"
[ 1.258378] 0x000003680000-0x000006880000 : "firmdata0"
[ 1.285815] 0x000006880000-0x000009a80000 : "firmdata1"
[ 1.313255] 0x000009a80000-0x000010000000 : "datafs"
[ 1.361936] OneNAND driver initializing
[ 1.366611] UBI: attaching mtd7 to ubi0
[ 1.370617] UBI: physical eraseblock size: 131072 bytes (128 KiB)
[ 1.377174] UBI: logical eraseblock size: 126976 bytes
[ 1.382808] UBI: smallest flash I/O unit: 2048
[ 1.387706] UBI: sub-page size: 512
[ 1.392523] UBI: VID header offset: 2048 (aligned 2048)
[ 1.398779] UBI: data offset: 4096
[ 1.813856] UBI: max. sequence number: 2
[ 1.832961] UBI: attached mtd7 to ubi0
[ 1.836874] UBI: MTD device name: "rootfs"
[ 1.842170] UBI: MTD device size: 43 MiB
[ 1.847250] UBI: number of good PEBs: 344
[ 1.852068] UBI: number of bad PEBs: 0
[ 1.856694] UBI: number of corrupted PEBs: 0
[ 1.861319] UBI: max. allowed volumes: 128
[ 1.866137] UBI: wear-leveling threshold: 4096
[ 1.871034] UBI: number of internal volumes: 1
[ 1.875669] UBI: number of user volumes: 1
[ 1.880295] UBI: available PEBs: 0
[ 1.884930] UBI: total number of reserved PEBs: 344
[ 1.890009] UBI: number of PEBs reserved for bad PEB handling: 9
[ 1.896274] UBI: max/mean erase counter: 1/0
[ 1.900719] UBI: image sequence number: 32676494
[ 1.905770] UBI: background thread "ubi_bgt0d" started, PID 550
[ 1.912355] Could not set LED4 to fully on
[ 1.917754] da8xx_lcdc da8xx_lcdc.0: GLCD: Found HANSTAR_HSD070IDW1_A panel
[ 2.015769] Logo image from nandflash, color_addr=[0xc88cb034], color_len=[0x4b000]!
[ 2.030945] spidev_probe()++
[ 2.034252] spidev_probe()--
[ 2.037271] spidev_probe()++
[ 2.040485] spidev_probe()--
[ 2.044264] CAN device driver interface
[ 2.048260] CAN bus driver for Bosch D_CAN controller 1.0
[ 2.101795] davinci_mdio davinci_mdio.0: davinci mdio revision 1.6
[ 2.108243] davinci_mdio davinci_mdio.0: no live phy, scanning all
[ 2.115056] davinci_mdio: probe of davinci_mdio.0 failed with error -5
[ 2.122212] usbcore: registered new interface driver zd1201
[ 2.128200] usbcore: registered new interface driver cdc_ether
[ 2.134450] usbcore: registered new interface driver cdc_eem
[ 2.140492] usbcore: registered new interface driver dm9601
[ 2.146359] cdc_ncm: 04-Aug-2011
[ 2.149882] usbcore: registered new interface driver cdc_ncm
[ 2.155800] Initializing USB Mass Storage driver...
[ 2.161107] usbcore: registered new interface driver usb-storage
[ 2.167385] USB Mass Storage support registered.
[ 2.172639] mousedev: PS/2 mouse device common for all mice
[ 2.179088] input: matrix-keypad as /devices/platform/matrix-keypad/input/input0
[ 2.187647] Error: Driver 'tsc' is already registered, aborting...
[ 2.194138] i2c /dev entries driver
[ 2.198183] Linux video capture interface: v2.00
[ 2.203341] usbcore: registered new interface driver uvcvideo
[ 2.209342] USB Video Class driver (1.1.1)
[ 2.215650] OMAP Watchdog Timer Rev 0x01: initial timeout 60 sec
[ 2.224196] cpuidle: using governor ladder
[ 2.228944] cpuidle: using governor menu
[ 2.233067] oprofile: hardware counters not available
[ 2.238336] oprofile: using timer interrupt.
[ 2.242826] nf_conntrack version 0.5.0 (1933 buckets, 7732 max)
[ 2.249441] ip_tables: (C) 2000-2006 Netfilter Core Team
[ 2.255120] TCP cubic registered
[ 2.258487] NET: Registered protocol family 17
[ 2.263145] can: controller area network core (rev 20090105 abi 8)
[ 2.269667] NET: Registered protocol family 29
[ 2.274312] can: raw protocol (rev 20090105)
[ 2.278764] can: broadcast manager protocol (rev 20090105 t)
[ 2.284707] Registering the dns_resolver key type
[ 2.289675] VFP support v0.3: implementor 41 architecture 3 part 30 variant c rev 3
[ 2.297684] ThumbEE CPU extension supported.
[ 2.302204] mux: Failed to setup hwmod io irq -22
[ 2.307696] Power Management for AM33XX family
[ 2.312533] Trying to load am335x-pm-firmware.bin (60 secs timeout)
[ 2.319183] Copied the M3 firmware to UMEM
[ 2.323484] omap_hwmod: wkup_m3: wkup_m3: hwmod data error: OMAP4 does not support st_shift
[ 2.335447] clock: disabling unused clocks to save power
[ 2.343019] Detected MACID=ec:24:b8:d9:ec:ef
[ 2.495320] UBIFS: mounted UBI device 0, volume 0, name "rootfs"
[ 2.501601] UBIFS: mounted read-only
[ 2.505353] UBIFS: file system size: 40632320 bytes (39680 KiB, 38 MiB, 320 LEBs)
[ 2.513368] UBIFS: journal size: 9023488 bytes (8812 KiB, 8 MiB, 72 LEBs)
[ 2.520985] UBIFS: media format: w4/r0 (latest is w4/r0)
[ 2.527075] UBIFS: default compressor: lzo
[ 2.531340] UBIFS: reserved for root: 0 bytes (0 KiB)
[ 2.540872] VFS: Mounted root (ubifs filesystem) readonly on device 0:13.
[ 2.548307] Freeing init memory: 220K
init started: BusyBox v1.13.2 (2012-04-08 17:28:57 CDT)
starting pid 607, tty '': '/etc/init.d/rcS'
rS in
[ 3.341995] PHY 0:00 not found
[ 3.345203] PHY 0:01 not found
/etc/init.d/rcS: line 15: setterm: not found
==============================================================================================
----------------------------------------------------------------------------------------------
\C8\ED\BC\FE\B0\E6\BA\C5 || 1.08.01.12R1
|| svn://10.11.13.249/scope_sw/SDG1022/trunk/SDG800/src (SVN ID:26676)
----------------------------------------------------------------------------------------------
\C4ں˰汾 || 03.02.R02.04
|| svn://10.11.13.250/SDG800/board-support/linux-3.2 (SVN ID:3161)
----------------------------------------------------------------------------------------------
UBOOT\B0汾 || 00-00-R00.00
|| svn://10.11.13.249/scope_sw/uniform/uboot_sdk6.0 (SVN ID:25753)
----------------------------------------------------------------------------------------------
rootfs || svn://10.11.13.250/SDG800/board-support/ubi/rootfs_ubi (SVN ID:3385)
|| Դ\C2\EB\B0\FC:rootfs-ubi-sdg800-p12.tar.gz
----------------------------------------------------------------------------------------------
datafs || svn://10.11.13.249/scope_sw/SDG1022/trunk/Numen/document/\B0汾\CEļ\FE/public/datafs_ubi(SVN ID:25859)
|| Դ\C2\EB\B0\FC:datafs-ubi-sdg800-p12.tar.gz
----------------------------------------------------------------------------------------------
firmdata0 || svn://10.11.13.249/scope_sw/SDG1022/trunk/Numen/document/\B0汾\CEļ\FE/public/firmdata0_ubi(SVN ID:25859)
|| Դ\C2\EB\B0\FC:firmdata0-ubi-sdg800-p12.tar.gz
----------------------------------------------------------------------------------------------
FPGA\B0汾 || sdg800_fpga_top_0x05_20150506.bin
----------------------------------------------------------------------------------------------
\D7\F7\D5\DF || Leon
----------------------------------------------------------------------------------------------
\B7\A2\B2\BC\C8\D5\C6\DA || 2016-03-17
----------------------------------------------------------------------------------------------
\D0޸ļ\C7¼\A3\BA
1.\D0޸\C4\C6\C1\B1\A3\BB\E1\BD\F8\C8\EB˯\C3߰\B4\B0\B4\BC\FC\B2\BB\CF\ECӦ\B5\C4\CE\CA\CC\E2
2.\C6\C1\B1δ\F8\BF\ED\C9\FD\BC\B6
3.\D0޸\C4\C9\FD\BC\B6\BDű\BE,\BD\E2\BE\F6\BF\AA\BB\FA\BB\AD\C3\E6\D0\E8Ҫ\C9\FD\BC\B6\C1\BD\B4β\C5\C9\FAЧ\B5\C4\CE\CA\CC\E2
----------------------------------------------------------------------------------------------
==============================================================================================
chmod: ./sdg800.app: Read-only file system
chmod: ./sdg800.app: Read-only file system
chmod: ./fpga.bin: Read-only file system
chmod: ./g_usbtmc.ko: Read-only file system
starting pid 631, tty '/dev/ttyO0': '-/bin/login'
(none) login: Current directory is g_current_dir=/usr/bin/sdg800
[check_and_upgrade()]:starting++++++++++++++++++++++++++++++++++++++++++++
[mount_fs()]: starting+++++++++++++++++
[run command]:mount_fs datafs,/usr/bin/sdg800/usr,ubi1_0,/usr/bin/sdg800/upgrade/datafs.img,rw
[is_ubi_fs_attached()]UBI_INDEX=ubi1_0 unattached return 0
MTD_NUM=11
[attach_ubi()]MTD_NAME=datafs
[attach_ubi()]MTD_NUM=11
[ 3.856271] UBI: attaching mtd11 to ubi1
[ 3.860390] UBI: physical eraseblock size: 131072 bytes (128 KiB)
[ 3.866947] UBI: logical eraseblock size: 126976 bytes
[ 3.872626] UBI: smallest flash I/O unit: 2048
[ 3.877526] UBI: sub-page size: 512
[ 3.882352] UBI: VID header offset: 2048 (aligned 2048)
[ 3.888609] UBI: data offset: 4096
[ 4.861777] UBI: max. sequence number: 511
[ 4.890303] UBI: attached mtd11 to ubi1
[ 4.894387] UBI: MTD device name: "datafs"
[ 4.899652] UBI: MTD device size: 101 MiB
[ 4.904836] UBI: number of good PEBs: 812
[ 4.909643] UBI: number of bad PEBs: 0
[ 4.914315] UBI: number of corrupted PEBs: 0
[ 4.918946] UBI: max. allowed volumes: 128
[ 4.923769] UBI: wear-leveling threshold: 4096
[ 4.928669] UBI: number of internal volumes: 1
[ 4.933305] UBI: number of user volumes: 1
[ 4.937931] UBI: available PEBs: 0
[ 4.942568] UBI: total number of reserved PEBs: 812
[ 4.947647] UBI: number of PEBs reserved for bad PEB handling: 24
[ 4.954011] UBI: max/mean erase counter: 3/1
[ 4.958456] UBI: image sequence number: 2104710910
[ 4.963595] UBI: background thread "ubi_bgt1d" started, PID 652
UBI device number 1, total 812 LEBs (103104512 bytes, 98.3 MiB), available 0 LEBs (0 bytes), LEB size 126976 bytes (124.0 KiB)
MOUNT_DIR_NAME = /usr/bin/sdg800/usr
TEST_RESTURN =
[is_fs_mounted()]return 0 ---

(none) login: [ 5.078335] UBIFS: recovery needed
[ 5.264732] UBIFS: recovery completed
[ 5.268653] UBIFS: mounted UBI device 1, volume 0, name "rootfs"
[ 5.274966] UBIFS: file system size: 98152448 bytes (95852 KiB, 93 MiB, 773 LEBs)
[ 5.282962] UBIFS: journal size: 9023488 bytes (8812 KiB, 8 MiB, 72 LEBs)
[ 5.290578] UBIFS: media format: w4/r0 (latest is w4/r0)
[ 5.296667] UBIFS: default compressor: lzo
[ 5.300932] UBIFS: reserved for root: 0 bytes (0 KiB)
[mount_fs()]: ending-----------------------

[info]can't find the file /usr/bin/sdg800/usr/usr/upgrade/upgrade_info. No need to upgrade!
cat: can't open './upgrade/upgrade_info': No such file or directory
sh: ==: argument expected
[check_and_upgrade()]:on need upgrade!!!!!!!!!!!!!!!!!!!!!
[check_and_upgrade()]:end---------------------------------

[INFO]:command_system():line=830:execute ret=system(comand=". /usr/lib/siglentlib.sh;check_and_upgrade")=0 OK! return 1;

Current directory is g_current_dir=/usr/bin/sdg800
[mount_check_copy_appdata()]: starting+++++++++++++++++++++++++++++++++++++++
[mount_fs()]: starting+++++++++++++++++
[run command]:mount_fs firmdata0,/usr/bin/sdg800/firmdata0,ubi2_0,/usr/bin/sdg800/upgrade/firmdata0.img,ro
[is_ubi_fs_attached()]UBI_INDEX=ubi2_0 unattached return 0
MTD_NUM=9
[attach_ubi()]MTD_NAME=firmdata0
[attach_ubi()]MTD_N[ 5.389063] UBI: attaching mtd9 to ubi2
UM=9
[ 5.394229] UBI: physical eraseblock size: 131072 bytes (128 KiB)
[ 5.401218] UBI: logical eraseblock size: 126976 bytes
[ 5.406858] UBI: smallest flash I/O unit: 2048
[ 5.411770] UBI: sub-page size: 512
[ 5.416579] UBI: VID header offset: 2048 (aligned 2048)
[ 5.422844] UBI: data offset: 4096

(none) login:
(none) login: [ 5.905205] UBI: max. sequence number: 377
[ 5.933324] UBI: attached mtd9 to ubi2
[ 5.937248] UBI: MTD device name: "firmdata0"
[ 5.942827] UBI: MTD device size: 50 MiB
[ 5.947907] UBI: number of good PEBs: 400
[ 5.952760] UBI: number of bad PEBs: 0
[ 5.957391] UBI: number of corrupted PEBs: 0
[ 5.962032] UBI: max. allowed volumes: 128
[ 5.966843] UBI: wear-leveling threshold: 4096
[ 5.971739] UBI: number of internal volumes: 1
[ 5.976375] UBI: number of user volumes: 1
[ 5.981004] UBI: available PEBs: 0
[ 5.985640] UBI: total number of reserved PEBs: 400
[ 5.990721] UBI: number of PEBs reserved for bad PEB handling: 12
[ 5.997083] UBI: max/mean erase counter: 2/1
[ 6.001532] UBI: image sequence number: 1544593674
[ 6.006674] UBI: background thread "ubi_bgt2d" started, PID 679
UBI device number 2, total 400 LEBs (50790400 bytes, 48.4 MiB), available 0 LEBs (0 bytes), LEB size 126976 bytes (124.0 KiB)
MOUNT_DIR_NAME = /usr/bin/sdg800/firmdata0
TEST_RESTURN =
[is_fs_mounted()]return 0 ---

(none) login:
(none) login: [ 6.201253] UBIFS: mounted UBI device 2, volume 0, name "firmdata0"
[ 6.208628] UBIFS: mounted read-only
[ 6.212376] UBIFS: file system size: 47362048 bytes (46252 KiB, 45 MiB, 373 LEBs)
[ 6.220367] UBIFS: journal size: 9023488 bytes (8812 KiB, 8 MiB, 72 LEBs)
[ 6.228006] UBIFS: media format: w4/r0 (latest is w4/r0)
[ 6.234120] UBIFS: default compressor: lzo
[ 6.238394] UBIFS: reserved for root: 0 bytes (0 KiB)
[mount_fs()]: ending-----------------------

[mount_check_copy_appdata()]mount firmdata0 OK!!!
[move_cali_data()]:starting+++[ 6.256321] UBIFS: un-mount UBI device 2, volume 0
++++++++++++++++++++
OLD_CALI_PATH=/usr/bin/sdg800/cali
NEW_CALI_PATH=/usr/bin/sdg800/firmdata0/cali
[INFO]: The file exists,you need not to do anything OK!
[move_cali_data()]:ending-------------------------

[move_encryption_id()]:starting+++++++++++++++++++++++
OLD_CALI_PATH=/usr/bin/sdg800/encryption_id.bin
NEW_CALI_PATH=/usr/bin/sdg800/firmdata0/encryption_id.bin
[mount_firmdata0()]:starting+++++++++++++++++++++++
[mount_fs()]: starting+++++++++++++++++
[run command]:mount_fs firmdata0,/usr/bin/sdg800/firmdata0,ubi2_0,/usr/bin/sdg800/upgrade/,rw
[is_ubi_fs_attached()]UBI_INDEX=ubi2_0 attached return 1
MOUNT_DIR_NAME = /usr/bin/sdg800/firmdata0
TEST_RESTURN =
[is_fs_mounted()]return 0 ---

(none) login: [ 6.463863] UBIFS: mounted UBI device 2, volume 0, name "firmdata0"
[ 6.470415] UBIFS: file system size: 47362048 bytes (46252 KiB, 45 MiB, 373 LEBs)
[ 6.478457] UBIFS: journal size: 9023488 bytes (8812 KiB, 8 MiB, 72 LEBs)
[ 6.486092] UBIFS: media format: w4/r0 (latest is w4/r0)
[ 6.492179] UBIFS: default compressor: lzo
[ 6.496448] UBIFS: reserved for root: 0 bytes (0 KiB)

(none) login: [mount_fs()]: ending-----------------------

[mount_firmdata0()]:ending-------------------------

mv: cannot rename '/usr/bin/sdg800/encryption_id.bin': No such file or directory
[Run command]:mv /usr/b[ 6.522798] UBIFS: un-mount UBI device 2, volume 0
in/sdg800/encryption_id.bin /usr/bin/sdg800/firmdata0/encryption_id.bin FAIL!!!!!!!!!!!
[mount_firmdata0()]:starting+++++++++++++++++++++++
[mount_fs()]: starting+++++++++++++++++
[run command]:mount_fs firmdata0,/usr/bin/sdg800/firmdata0,ubi2_0,/usr/bin/sdg800/upgrade/,ro
[is_ubi_fs_attached()]UBI_INDEX=ubi2_0 attached return 1
MOUNT_DIR_NAME = /usr/bin/sdg800/firmdata0
TEST_RESTURN =
[is_fs_mounted()]return 0 ---

(none) login: [ 6.726747] UBIFS: mounted UBI device 2, volume 0, name "firmdata0"
[ 6.733324] UBIFS: mounted read-only
[ 6.737053] UBIFS: file system size: 47362048 bytes (46252 KiB, 45 MiB, 373 LEBs)
[ 6.745047] UBIFS: journal size: 9023488 bytes (8812 KiB, 8 MiB, 72 LEBs)
[ 6.752690] UBIFS: media format: w4/r0 (latest is w4/r0)
[ 6.758770] UBIFS: default compressor: lzo
[ 6.763048] UBIFS: reserved for root: 0 bytes (0 KiB)
[mount_fs()]: ending-----------------------

[mount_firmdata0()]:ending-------[ 6.777960] UBIFS: un-mount UBI device 2, volume 0
------------------

[move_encryption_id()]:ending-------------------------

[move_band_width_file()]:starting+++++++++++++++++++++++
OLD_CALI_PATH=/usr/bin/sdg800/band_width.bin
NEW_CALI_PATH=/usr/bin/sdg800/firmdata0/band_width.bin
[INFO]: The file exists,you need not to do anything OK!
\A1\BEmove_band_width_file()::the file name is /usr/bin/sdg800/firmdata0/band_width.bin\A1\BF
[move_band_width_file()]:ending-------------------------

[move_band_width_file()]:starting+++++++++++++++++++++++
OLD_CALI_PATH=/usr/bin/sdg800/bandwidth_license
NEW_CALI_PATH=/usr/bin/sdg800/firmdata0/bandwidth_license
[mount_firmdata0()]:starting+++++++++++++++++++++++
[mount_fs()]: starting+++++++++++++++++
[run command]:mount_fs firmdata0,/usr/bin/sdg800/firmdata0,ubi2_0,/usr/bin/sdg800/upgrade/,rw
[is_ubi_fs_attached()]UBI_INDEX=ubi2_0 attached return 1
MOUNT_DIR_NAME = /usr/bin/sdg800/firmdata0
TEST_RESTURN =
[is_fs_mounted()]return 0 ---
[ 6.979949] UBIFS: mounted UBI device 2, volume 0, name "firmdata0"
[ 6.986532] UBIFS: file system size: 47362048 bytes (46252 KiB, 45 MiB, 373 LEBs)
[ 6.994550] UBIFS: journal size: 9023488 bytes (8812 KiB, 8 MiB, 72 LEBs)
[ 7.002185] UBIFS: media format: w4/r0 (latest is w4/r0)
[ 7.008261] UBIFS: default compressor: lzo
[ 7.012537] UBIFS: reserved for root: 0 bytes (0 KiB)
[mount_fs()]: ending-----------------------

[mount_firmdata0()]:ending-------------------------

mv: cannot rename '/usr/bin/sdg800/bandwidth_license': No such file or di[ 7.034815] UBIFS: un-mount UBI device 2, volume 0
rectory
\A1\BE[Run command]:mv /usr/bin/sdg800/bandwidth_license /usr/bin/sdg800/firmdata0/bandwidth_license FAIL!\A1\BF
[mount_firmdata0()]:starting+++++++++++++++++++++++
[mount_fs()]: starting+++++++++++++++++
[run command]:mount_fs firmdata0,/usr/bin/sdg800/firmdata0,ubi2_0,/usr/bin/sdg800/upgrade/,ro
[is_ubi_fs_attached()]UBI_INDEX=ubi2_0 attached return 1
MOUNT_DIR_NAME = /usr/bin/sdg800/firmdata0
TEST_RESTURN =
[is_fs_mounted()]return 0 ---
[ 7.239014] UBIFS: mounted UBI device 2, volume 0, name "firmdata0"
[ 7.245586] UBIFS: mounted read-only
[ 7.249318] UBIFS: file system size: 47362048 bytes (46252 KiB, 45 MiB, 373 LEBs)
[ 7.257310] UBIFS: journal size: 9023488 bytes (8812 KiB, 8 MiB, 72 LEBs)
[ 7.264940] UBIFS: media format: w4/r0 (latest is w4/r0)
[ 7.271015] UBIFS: default compressor: lzo
[ 7.275308] UBIFS: reserved for root: 0 bytes (0 KiB)
[mount_fs()]: ending-----------------------

[mount_firmdata0()]:ending-------------------------

[move_band_width_file()]:ending-------------------------

[move_cali_sys()]:starting+++++++++++++++++++++++
OLD_CALI_PATH=/usr/bin/sdg800/cali_sys.bin
NEW_CALI_PATH=/usr/bin/sdg800/firmdata0/cali_sys.bin
sh: /usr/bin/sdg800/firmdata0/cali_sys.bin: unknown operand
[INFO]: The file exists,you need not to do anything OK!
\A1\BEmove_band_width_file()::the file name is /usr/bin/sdg800/firmdata0/cali_sys.bin\A1\BF
[move_cali_sys()]:ending-------------------------

[recover_datafs_all_files()]:starting+++++++++++++++++++++++
[recover_datafs_old_fileprocess '-/bin/login' (pid 631) exited. Scheduling for restart.
starting pid 727, tty '/dev/ttyO0': '-/bin/login'
[recover_datafs_old_file()]:ending-------------------------

arg=arb1.bin
arg=arb2.bin
arg=arb3.bin
arg=arb4.bin
arg=arb5.bin
arg=arb6.bin
arg=arb7.bin
arg=arb8.bin
arg=arb9.bin
arg=arb10.bin
arg=arb_para.set
[recover_datafs_all_files()]:ending-------------------------

[check_upgrade_status_is_unfinish()]:+++++++++++++++++++
[check_upgrade_st[ 7.382525] spidev_open()++
atus_is_unfinish[ 7.385979] spidev_open()--
()]:-------------------
==================================good job!=================================
[mount_check_copy_appdata()]: ending----------------------------------------------
[INFO]:command_system():line=830:execute ret=system(comand=". /usr/lib/siglentlib.sh;mount_check_copy_appdata")=0 OK! return 1;

main()+++++++++
g_vinfo.xres = 320
g_vinfo.yres = 240
g_vinfo.bits_per_pixel = 32
g_lcdbuf = 0x403cb000
(none) login:
(none) login:
(none) login:
(none) login:
(none) login:
(none) login:
(none) login:
(none) login: [ 7.638608] spidev_release()++
[ 7.641828] spidev_release()--
[ 7.645839] spidev_open()++
[ 7.648758] spidev_open()--
g_spi = 4[ 7.651907] sw_rev_open()++

(none) login: [ 7.685145] fpga_key_open()++
[ 7.688377] fpga_key_open()--
[ 7.691568] fpga_key_fasync()++
[ 7.694924] fpga_key_fasync()--

(none) login: [INFO]:cali_new_load_sys_file_data():line=1445:sysInformation.DdsVersionNum = "SDG805"
[INFO]:cali_new_load_sys_file_data():line=1445:sysInformation.DdsVersionNum = "SDG805"
[INFO]:InitVersionRelativeParameter():line=505:Get from bandwidth_license type=5
[INFO]:if_set_bandwidth():line=438:bandwidth=5
[INFO

cali_new_save_sys_info_file::sysInformation.DdsVersionNum =

[INFO]:get_sys_info_file_backup_path():line=282:path ="./firmdata0/cali/sys_info.bak"

[INFO]:cali_new_save_sys_info():line=1552:Save default sys_info file p_path = "./firmdata0/cali" OK!

[ 8.122198] usbtmc_bind+++
[ 8.130391] SDG1050: SDG1050, version: 2007 OCT 06
[ 8.135498] musb-hdrc musb-hdrc.0: MUSB HDRC host driver
[ 8.141078] musb-hdrc musb-hdrc.0: new USB bus registered, assigned bus number 2
[ 8.148950] usb usb2: New USB device found, idVendor=1d6b, idProduct=0002
[ 8.156080] usb usb2: New USB device strings: Mfr=3, Product=2, SerialNumber=1
[ 8.163621] usb usb2: Product: MUSB HDRC host driver
[ 8.168797] usb usb2: Manufacturer: Linux 3.2.0-svn2240 musb-hcd
[ 8.175065] usb usb2: SerialNumber: musb-hdrc.0

[ 8.189569] hub 2-0:1.0: USB hub found
[ 8.193623] hub 2-0:1.0: 1 port detected
insmod ./g_usbtm[ 8.207762] usbtmc_open()++
c.ko iProduct=SD[ 8.212030] dev->usbtmc_cdev_open ret = 0
G805 iSerialNum=[ 8.217594] ret = 0
SDG08BA2161166
[ 8.221167] usbtmc_open--

g_usbtmc = 8

process '-/bin/login' (pid 727) exited. Scheduling for restart.
starting pid 821, tty '/dev/ttyO0': '-/bin/login'
(none) login:

This picture is all wrong

osc

So, this picture was doing the round a few months back. But it’s now made me feel cheated, confused and ashamed. It turns out it’s wrong, all very very wrong.

Firstly as my friend Akiba pointed out, the Tektronix 2245A wasn’t a storage scope. Tektronix’s analogue storage scopes I believe started with the 2400 series, I’ve recently been reading about the analogue CCD memory used in these instruments as a friend has been repairing one. It’s an interesting architecture, a historical quirk which has largely fallen into disuse.

Giving them the benefit of the doubt, it’s possible 2245A is a typo for 2445A. But the 2445A started at 150MHz, no 100MHz version was available.

Finally, what exactly is the scope he’s carrying? Here’s a close up:

osc1This makes little sense to me. I really don’t know of any scopes with a CRT on the right hand side. Maybe someone can point one out? But I’m pretty confused here (based on the fact that the Nike swipe is also fipped, I’d guess the image is mirrored but I’m going to run with this..).

Flipping the image, the scope does indeed look like a 2245a:

osc2Tektronix 2245A

 

 

 

 

 

And not much like a 2445a:

 

osc2tek2445a

 

 

 

 

 

 

Also, Tektronix is spelled incorrectly? Perhaps this image comes from a bizarre parallel earth where Tektronix is called Tectronix and everyone is left handed? Perhaps taking your oscilloscope to a club is an entirely normal activity, and people hang out discussing the finer points of trigger mode selection. In the immoral words of Liz Lemon “I want to go to there”.

I’ll let you draw your own conclusions, however in the meantime:

osc3

Sony WPSD5 Surround Sound System “repair” Notes

sony_sur

I was offered a broken WPSD5 Surround Sound system and of course snapped it up. A couple of weeks back someone also offered me a working one but I turned it down. Positioning all those speakers felt like too much for an audio-luddite like me. But a broken one… well that’s an adventure!

While economically un-viable repairing broken consumer electronics gives an interesting insight into the design discussions taken. And for someone like myself who isn’t an experienced EE, wandering through the schematics teaches me all sorts of things. Gratifyingly a service manual is available with both detailed schematics and a overall block diagram:

sony_blockdiaWorryingly the digital side is built about a proprietary microcontroller (IC701). The microcontroller is powered by EVER+5.6V which comes off the main power supply and is always up. Other supply voltages (for the analogue section) are brought up by the microcontroller on soft power on.

The microcontroller itself however doesn’t do very much, it just brings up the system and controls the surround sound DAC. The DAC is an AK4527, for which a datasheet is readily available. This is a fun part, it’s a I2C controlled surround sound synthesizer. It includes ADCs to sample analogue input or can also accept digital signals (S/PDIF via some external ICs). Analogue signals head out of this IC and out of the digital board toward the analogue section.

On the analogue board we find 3 TA2022 power amplifiers. These are 2 channel 90W “class-T” amplifiers. Class-T is Tripaths proprietary, switching, class-D amplifier implementation. The TA2020 from this series was listed as one of the 25 microchips that shook the world. It was my first time encountering class-D amps and it was interesting reviewing this part of the design. A datasheet for the ta2022  is also available, and TA2022 modules can be found on eBay easily for about 15USD. They look like fun modules and I’ve seen a number of amateur projects using them.

So… on my system the fault signal was being asserted, by this funky transistor network:

faultThat signaled a fault to the microcontroller, which in turn stopped the main powersupply from coming up and didn’t enable the relays on the speaker outputs so you wouldn’t be able to hear anything anyway. In order to debug further I need to get the amplifiers to come up. I removed the digital board and started digging around.

First of all, you can pull pin 16 (POWER) on CN123 to +4.7V DIRECT (which is also always up). That switches IC906 on. This is a regulator (datasheet) which generates a bunch of supply voltages. I then shorted Q394 which is the transistor controlling the output relays. The amplifiers where still muted (controlled via AMP-MUTE) so I pulled AMP-MUTE high (I think using +4.7V DIRECT again) to turn them out.

In debugging the system I found that 2 of the amplifier ICs weren’t coming up. The TA2022s have built in fault detection and 2 of them were muting themselves. The layout of the 3 TA2022s the largely identical, IC301 however does also generate a reference signal that is fed to the other two:

amps

Strangely the system doesn’t used the HMUTE signal from the TA2022s but has additional fault detection circuitry, and this was causing the fault signal that was being sent to the microcontroller. The TA2022s own fault detection circuitry was also firing however. This is basically where my debugging stopped. I would likely continue by replacing the TA2022s, but it wasn’t worth it for me.

Now… what I’ve actually been wanting is a cheap 2 channel stereo speaker system. So I hacked a 3.5mm stereo jack on to the input of the analogue board and am using the surround sound system as a stereo speaker set. I’m just using a couple of the satellite speakers. This is probably a pretty awful thing to do, I’d guess they don’t produce low frequencies particularly well, but it sounds fine to me and is and order of magnitude better than my laptop speakers so I’m happy… I also had an interesting adventure and learned a lot about how consumer Hi-Fi equipment is put together.

A Note On The Ion Torrent Flow Order

The Ion torrent DNA sequencers don’t just flow in A,T,G and C bases in a 4base cycle but use a more complex 32bp flow order. I was trying to figure out exactly what was going on and found this comment on the ioncommunity forum which somewhat explains what’s going on. Here’s the flow order they use (32 bases long!):

TACGTACGTCTGAGCATCGATCGATGTACAGC

The 32 base sequence, is composed of 2 16bp sub-sequences. These subsequences have the same structure but the bases are transposed. The 16bp sequences contain one flow of every base followed by every 2bp combination [1]. In the general case a string containing every possible substring of length k exactly once is called a de Bruijn sequence [2].

Why they do this is less clear, it might be that hitting bases in order assists with phasing or other characteristic errors. It’s also possible that there are other aspects of the base flow order that improve the sequencing process.

[1] The following is a verification of the statement above:

Original Sequence: TACGTACGTCTGAGCATCGATCGATGTACAGC

The following are the 16bp sequences, below these I’ve labelled each base by the position it first occurs in the sequence. These patterns are identical. The conclusion is that if you swap A with C, and swap C with G you can change the first sequence into the second:

TACGTACGTCTGAGCA
1234123413142432

TCGATCGATGTACAGC
1234123413142432

Taking the 12bp sequence, you can see that it contains every 2bp combination exactly one:

TACGTCTGAGCA
new@navlaptop:~/biotech/dnae/floworder$ ./a.out | sort | uniq -c
1 AC
1 AG
1 CA
1 CG
1 CT
1 GA
1 GC
1 GT
1 TA
1 TC
1 TG

[2] https://en.wikipedia.org/wiki/De_Bruijn_sequence