General > General Technical Chat
The Rigol DS1052E
<< < (106/166) > >>
drieg:
Wow, many question raised. I'll try to answer them, but first I'd like to say, that my intention was not to cause panic or hold Dave liable for this. I just wanted to warn people of this issue and remind them that it's always a risk unless you exactly know, what is going on inside.

OK, here's my experience.

The safest "upgrade" method is to backup flash memory and modify just the fields that are needed to modify. You can do it through external programmer or JTAG, which I beleive is the way how they do it in production.

I didn't use any "command" method (serial or USB) because I didn't find it reliable. To be honest I have only little experience with USB, but I have some bad experience with serial cable. As I didn't monitor the serial communication between my laptop and scope, I can't exactly say if the problem was terminal software which I used (HyperTerminal, Realterm), cable, my serial port or SCPI command implementation inside firmware. I'm only sure that I didn't hit Enter key accidentally and the data gets corrupted even so. Another thing is, that sometimes I get different answers from scope for same commands. The good example is :INFO:MODEL command. Sometimes you have to perform it several times, till the new value is written into flash. The same problem with another command which writes HW revision into this area. And finally... I didn't like the fact, that even if you hit Enter by mistake, the whole part of flash is written by "random" data. It makes me think, that command implementation inside is not done well. The firmware should be immune to these mistakes. These are the reasons, why I gave up on these "command" methods totaly and did it another way.

@dimlow
You are on the good way to ruin your scope totally :o Be caferul, there is limited space for model and serial info inside flash and I don't know, if the string is truncated before writting into flash. Right after these fields there are other vitally important data (HW revision, and others)...
Anyway, let me know, when you need repair ;)



dimlow:

--- Quote from: drieg on April 09, 2010, 09:40:20 am ---OK, here's my experience.

The safest "upgrade" method is to backup flash memory and modify just the fields that are needed to modify. You can do it through external programmer or JTAG, which I beleive is the way how they do it in production.

--- End quote ---
Please give details of how you did it ?


--- Quote from: drieg on April 09, 2010, 09:40:20 am ---@dimlow
You are on the good way to ruin your scope totally :o Be caferul, there is limited space for model and serial info inside flash and I don't know, if the string is truncated before writting into flash. Right after these fields there are other vitally important data (HW revision, and others)...
Anyway, let me know, when you need repair ;)

--- End quote ---
Please how do you know what data is stored where ? more detail please. And i have another two scopes, not really bothered now if i scrap the scope or not. So were do i start if i want to dump the data ?

Oh i so you can repair my scope ? Great, lets get started. who are you, what your is relationship with the Rigol scope. what it the timescale for the repair. where do i send it to ? maybe we should do this via PM.

@others
 wont be doing any  testing today, well maybe later, went out on the beer yesterday, head hurts today! will try to answer more questions later. Oh and the scope has not changed since i put in the long serial numbers.

darkith:

--- Quote from: drieg on April 09, 2010, 09:40:20 am --- Be caferul, there is limited space for model and serial info inside flash and I don't know, if the string is truncated before writting into flash. Right after these fields there are other vitally important data (HW revision, and others)...

--- End quote ---

As you say, that's the kicker.  It's not the communication method per se, it's the code that takes the argument string for the ":INFO:MODEL" command, and conceivably writes the entire string length to memory without truncating/verifying length.  If the code did a sanity check (model_arg < model_max_len), it would prevent truly breaking things.  At worst, a mistaken control character (backspace, enter, etc) would munge the value, but could be easily fixed.  Not verifying the length means that the corruption can be pushed outside of the model and serial fields, and that could be very bad...



--- Quote from: drieg on April 09, 2010, 09:40:20 am ---Anyway, let me know, when you need repair ;)

--- End quote ---

So....you're saying you have a method using an external or JTAG programmer, would you be willing to share that?  It sounds like there are a few people who need this procedure, and probably a known-good flash dump to over-write their corrupted settings.

D.
Mechatrommer:
Mr dimlow: you've made a very brave attempt (long serial). then it proved that it will not get things even worst. as somebody else did with backspace and enter key. now i'm stumbled even more.

"drieg: The safest "upgrade" method is to backup flash memory and modify just the fields that are needed to modify. You can do it through external programmer or JTAG, which I beleive is the way how they do it in production."

the header sits right next to the blackfin is connected to EMU, TMS, TCK, TRST, TDI, TDO. i heard with my brain, it sounds like JTAG (MOSI, MISO CLK, ISPDAT, ISPCLK sounds pretty similar). will study more on this. i dont have any programmer, any suggestion? can i program arduino mega to do that? blackfin 531 is a way much more powerful than atmega1280, i dont know if i can make arduino outruns blackfin. :)

i hope the precaution to not make any mistake while hyperterminaling is spoken out loud.

p/s: i corrupted the EEPROM data, but i dont know how it happened. now, i have to fix it, but how? i dont know what will happen.
bushing:

--- Quote from: dimlow on April 09, 2010, 12:02:02 pm ---
--- Quote from: drieg on April 09, 2010, 09:40:20 am ---OK, here's my experience.

The safest "upgrade" method is to backup flash memory and modify just the fields that are needed to modify. You can do it through external programmer or JTAG, which I beleive is the way how they do it in production.

--- End quote ---
Please give details of how you did it ?

--- End quote ---

Seconded.  FWIW, I doubt they do it that way in the factory -- I think they probably do the initial programming via the card-edge SPI connector on the PCB that I posted about earlier in the thread -- that would be a lot faster than plugging in a JTAG cable, and it would explain why the connector is there in the first place.  I would also expect that they then use the serial or USB interface to write the device-unique information -- they have to hook one of those cables up anyway to perform automated testing/calibration, and it would explain why those commands exist on the USB/serial interfaces.

That being said, you seem to have ... more insight into all of this than I do, so I'd also love to hear more about the flash memory and how you've modified it -- I've considered desoldering it (the NOR flash) and reading it externally, but reading it out over JTAG would be safer.   Sadly, I don't think OpenOCD supports BlackFin, but my FT2232D-based JTAG dongle is similar enough to http://docs.blackfin.uclinux.org/doku.php?id=hw:jtag:gnice that we might be able to just use their tools.   Hmmm...
Navigation
Message Index
Next page
Previous page
There was an error while thanking
Thanking...

Go to full version
Powered by SMFPacks Advanced Attachments Uploader Mod