Friday, November 1, 2013

How to blow up a bladeRF-board and recover from it

My first styled page In the blog of nuand.com I read:
By upgrading to the latest FX3 image ( http://nuand.com/fx3/latest.img ) you can now store FPGA images on the SPI flash by running `bladeRF-cli -L hostedx40.rbf`. This will allow your bladeRF to read an FPGA image from flash and program the FPGA without the need of a host computer.
So, that is what I tried. But -L is not the right command, nothing happens. So, I tried -f instead. I programmed the Flash-memory of the USB-FX3-chip with an FPGA-image. Yes, very stupid. After that I had an expensive board not even useful as a presse-papier.

But don't panic. I easily found an followed the recipe to wake up my precious bladeRF-board from the "booting-sleep" it was in.

How I destroyed the Flash-memory

Microsoft Windows [versie 6.1.7601] Copyright (c) 2009 Microsoft Corporation. Alle rechten voorbehouden. C:\Users\lonneke\Desktop>cd \Program Files (x86)\bladeRF\x64 C:\Program Files (x86)\bladeRF\x64>bladeRF-cli -L hostedx115.rbf 0.5.0-git- C:\Program Files (x86)\bladeRF\x64>bladeRF-cli Usage: bladeRF-cli bladeRF command line interface and test utility (0.4.0-git-) Options: -d, --device Use the specified bladeRF device. -f, --flash-firmware Flash specified firmware file. -l, --load-fpga Load specified FPGA bitstream. -p, --probe Probe for devices, print results, then exit. -s, --script Run provided script. -i, --interactive Enter interactive mode. -L, --lib-version Print libbladeRF version and exit. -v, --verbosity Set the libbladeRF verbosity level. Levels, listed in increasing verbosity, are: critical, error, warning, info, debug, verbose -V, --version Print CLI version and exit. -h, --help Show this help text. Notes: The -d option takes a device specifier string. See the bladerf_open() documentation for more information about the format of this string. If the -d parameter is not provided, the first available device will be used for the provided command, or will be opened prior to entering interactive mode. C:\Program Files (x86)\bladeRF\x64>bladeRF-cli.exe -f ../hostedx115.rbf [INFO] Using libusb version 1.0.16.10774 [INFO] Found a bladeRF [INFO] Claimed all inferfaces successfully [INFO] Change to alternate interface 1 [INFO] Changed into RF link mode: LIBUSB_SUCCESS / LIBUSB_TRANSFER_COMPLETED Flashing firmware... [INFO] Change to alternate interface 2 [INFO] Erasing 55 sectors starting @ sector 0 [INFO] Erased sector 0... [INFO] Erased sector 1... [INFO] Erased sector 2... [INFO] Erased sector 3... [INFO] Erased sector 4... [INFO] Erased sector 5... [INFO] Erased sector 6... [INFO] Erased sector 7... [INFO] Erased sector 8... [INFO] Erased sector 9... [INFO] Erased sector 10... [INFO] Erased sector 11... [INFO] Erased sector 12... [INFO] Erased sector 13... [INFO] Erased sector 14... [INFO] Erased sector 15... [INFO] Erased sector 16... [INFO] Erased sector 17... [INFO] Erased sector 18... [INFO] Erased sector 19... [INFO] Erased sector 20... [INFO] Erased sector 21... [INFO] Erased sector 22... [INFO] Erased sector 23... [INFO] Erased sector 24... [INFO] Erased sector 25... [INFO] Erased sector 26... [INFO] Erased sector 27... [INFO] Erased sector 28... [INFO] Erased sector 29... [INFO] Erased sector 30... [INFO] Erased sector 31... [INFO] Erased sector 32... [INFO] Erased sector 33... [INFO] Erased sector 34... [INFO] Erased sector 35... [INFO] Erased sector 36... [INFO] Erased sector 37... [INFO] Erased sector 38... [INFO] Erased sector 39... [INFO] Erased sector 40... [INFO] Erased sector 41... [INFO] Erased sector 42... [INFO] Erased sector 43... [INFO] Erased sector 44... [INFO] Erased sector 45... [INFO] Erased sector 46... [INFO] Erased sector 47... [INFO] Erased sector 48... [INFO] Erased sector 49... [INFO] Erased sector 50... [INFO] Erased sector 51... [INFO] Erased sector 52... [INFO] Erased sector 53... [INFO] Erased sector 54... [INFO] Change to alternate interface 2 [INFO] Flashing with write size = 64 [INFO] Verifying with read size = 64 Done. C:\Program Files (x86)\bladeRF\x64>bladeRF-cli -i [INFO] Using libusb version 1.0.16.10774 [ERROR] Couldn't populate devinfo - LIBUSB_ERROR_NOT_SUPPORTED [ERROR] Could not open FX3 bootloader device: LIBUSB_ERROR_NOT_SUPPORTED [ERROR] No devices available on the libusb backend. Failed to open device (NULL): No devices available Could not open device bladeRF> exit C:\Program Files (x86)\bladeRF\x64>bladeRF-cli.exe -f ../latest.img [INFO] Using libusb version 1.0.16.10774 [ERROR] Couldn't populate devinfo - LIBUSB_ERROR_NOT_SUPPORTED [ERROR] Could not open FX3 bootloader device: LIBUSB_ERROR_NOT_SUPPORTED [ERROR] No devices available on the libusb backend. Failed to open device (NULL): No devices available Could not open device C:\Program Files (x86)\bladeRF\x64>
Something is very wrong. I programmed the Flash-memory with a completely nonsense FPGA-image. This is not a non-sense image but not code that can be executed by the FX3-chip. The FPGA-code is intended for the setup-configuration for the FPGA.

What now?

Take a break, have a coffee, keep calm and count your blessings...
Then, google and find the solution.
I have to use a Cypress tool to flash the right image back on the bladeRF-board


There is not any sign of a libusb-bladeRF-board...


BladeRF is not there… (but physically connected to a USB2-port.


Nuand has a tool!
Let’s try the rescue flasher…


Very short flash of a command-window, but:

Nope


As you can see, I am not trying to show how smart I am, neither how stupid I am. I just want to show what I tried in a situation like this.

Laptop restarted, bladeRF in USB2-port


Nothing yet.
Now trying to re-install bladeRF-CLI using Windows-installer, hoping to re-flash automagically??

Encouraging…


Nothing yet,
Replug bladeRF

Ah, stupid me, it was plugged in an USB3-port instead of USB2.

Try again


Nope




This is the USB Control Center of Cypress.
Beware: there are versions for FX2 and FX3. 
We need the latter, FX3


I could not show what happens here. Normally I press
<Ctrl><Alt><PrtScrn> to get a pastable image. While
doing that, the info simply disappeared. 

Programmed FX3, pointed to latest.img


YES!!! there it is: libusbK USB Devices


And bladeRF as seen by bladeRF-CLI
Only thing is load hostedx115.rbf


Microsoft Windows [versie 6.1.7601] Copyright (c) 2009 Microsoft Corporation. Alle rechten voorbehouden. C:\Users\lonneke\Desktop>cd C:\Program Files (x86)\bladeRF C:\Program Files (x86)\bladeRF>bladerf_winflasher The device is running the FX3 bootloader. Please use the Cypress Control tool to flash the SPI C:\Program Files (x86)\bladeRF>bladerf-cli -i [INFO] Using libusb version 1.0.16.10774 [INFO] Found a bladeRF [INFO] Claimed all inferfaces successfully [WARNING] extract_field: Field checksum mismatch [WARNING] Could not extract VCTCXO trim value [WARNING] extract_field: Field checksum mismatch [WARNING] Could not extract FPGA size bladeRF> load fpga hostedx115.rbf Loading fpga from hostedx115.rbf... [INFO] Change to alternate interface 3 [INFO] Change to alternate interface 1 [INFO] Changed into RF link mode: LIBUSB_SUCCESS / LIBUSB_TRANSFER_COMPLETED [INFO] Setting integer sample rate: 1000000 [INFO] Found r value of: 4 [INFO] MSx a + b/c: 316 + 4/5 [INFO] MSx a + b/c: 316 + 4/5 [INFO] MSx P1: 0x00009c66 (40038) P2: 0x00000002 (2) P3: 0x00000005 (5) [INFO] Calculated samplerate: 1000000 + 0/1 [INFO] Set actual integer sample rate: 1000000 [INFO] Setting integer sample rate: 1000000 [INFO] Found r value of: 4 [INFO] MSx a + b/c: 316 + 4/5 [INFO] MSx a + b/c: 316 + 4/5 [INFO] MSx P1: 0x00009c66 (40038) P2: 0x00000002 (2) P3: 0x00000005 (5) [INFO] Calculated samplerate: 1000000 + 0/1 [INFO] Set actual integer sample rate: 1000000 Done. bladeRF>
Yes, everything ok!

Epilogue

I blew up and repaired my precious bladeRF-board. Later that evening I read something about SDR-radio.com. That is hot stuff!!

Playing with a signal-generator at a frequency adjacent to a tv-channel.

I simply put a whip-antenna on the signal-generator, a HP 8656B signal generator 0.1-990 MHz


What a marvelous piece of software! I played hours with it. First connected a signal genarator, later my active GPS-antenna and still later a 70 cm antenna on the roof. Yes, it was very late that evening. I managed to write some python-software to decode the bladeRF-outputfiles. Plots and FFTs. Later more. 

No comments:

Post a Comment