General > General Technical Chat

The Rigol DS1052E

<< < (134/166) > >>

Meiner:

--- Quote from: halman on June 29, 2010, 04:05:23 pm ---Hello,

I seem to have bricked my scope while performing the firmware downgrade… When I restart the scope it does not boot up but one can see that the lcd is turned on but there is no image…

Any tips, can I somehow trigger a reflash from this state?

I have access to the necessary equipment to desolder and reflash most types of memories in a programmer .. but i rather not if there is any other way… 



--- End quote ---

Hello Everybody,

I'm new on this forum... also tried the firmware downgrade, but unfortunately used the 02.01.01 Firmware for downgrading. Result was the same as Halman's:
Fan running, but no image on the screen and no response on USB and RS232.
I was trying to figure out the pinning of the internal JTAG header:


                --------
                | o   o |
                |        |
                |      o |>  GND
                |        |
       GND  <| o   o |>  CPU Pin85 = TMS
                |        |
       GND  <| o   o |>  CPU Pin94 = TCK
                |        |
       GND  <| o   o |
                |        |
       GND  <| o   o |>  CPU Pin86 = TDI
                |        |
       GND  <| o   o |>  CPU Pin87 = TDO
                --------

There should also be a 3V3 Pin at least on the header, I haven't checked it yet.

Flash S29GL064N90TFI04 runs at 3.3V, word-mode

CPU ADSP - BF531

    Pin95-BMODE1 = 0V
    Pin96-BMODE0 = 3V3
--> Boot from (16bit) Flash

The CPU's datasheet mentions a internal ROM; I'm not sure if it's really a ROM (meaning that even Rigol hasn't changed it) and I want to find out it's content. My goal is to get access to the CPU via the JTAG interface to try to reflash the FLASH.

Has anybody found out about the Flash's layout? It's 8MBytes large, but the *.rgl files are only 2MBytes large...?

@halman, shafri: Please give an update about your work.

Thanks
Meiner

Mechatrommer:
*.rgl is 4MB (thats in my keeping 2.02 and 2.04) but mostly blank inside, i havent thought of the ROM thing, might some useful data from inside. JTAG i found is similar to yours. i remember those ground"s" pin"s". but i dont have the JTAG programmer, so whats the point? for me! i cannot trace the Altera connection to the spansion since its BGA underground, rigol PCB is at least 3 layers, so ???.

my only hope lies in the dissambly of the rigol FW, finding where the important interrupts point will be and crack it to take control from there. but i never got strong feeling for it, i want to continue to make some productive work to do. and.... nobody seems interesting, since i guess, its the software thing, and... the undocumented one ??? btw: if anyone want the nicely (well... not so nice) compiled opcodes for blackfin BF531 in csv/xls format, be happy to ask. i've done it in the hardway.

your problem same with halman is worst since i dont see your rigol will ever reach the interrupt (USB FW re-upgrade, RS232 comm etc), probably you've tossed your bootloader as well! a brighter hope lies in halman, since he got parallel programmer as he mentioned.

Meiner:

--- Quote from: shafri on July 09, 2010, 11:43:37 am ---*.rgl is 4MB (thats in my keeping 2.02 and 2.04) but mostly blank inside, i havent thought of the ROM thing, might some useful data from inside. JTAG i found is similar to yours. i remember those ground"s" pin"s". but i dont have the JTAG programmer, so whats the point? for me! i cannot trace the Altera connection to the spansion since its BGA underground, rigol PCB is at least 3 layers, so ???.

my only hope lies in the dissambly of the rigol FW, finding where the important interrupts point will be and crack it to take control from there. but i never got strong feeling for it, i want to continue to make some productive work to do. and.... nobody seems interesting, since i guess, its the software thing, and... the undocumented one ??? btw: if anyone want the nicely (well... not so nice) compiled opcodes for blackfin BF531 in csv/xls format, be happy to ask. i've done it in the hardway.

your problem same with halman is worst since i dont see your rigol will ever reach the interrupt (USB FW re-upgrade, RS232 comm etc), probably you've tossed your bootloader as well! a brighter hope lies in halman, since he got parallel programmer as he mentioned.


--- End quote ---

You are right, the *.rgl is 4 MBytes. That's exact the size of the 4 async memory banks in the ADSP CPU (datasheet page6, starting at address 0x20000000). That's the cause why the *.rgl is only 4 MBytes while the flash is bigger (but cannot be fully accessed by the ADSP CPU). Boot mode 01 (Use boot ROM to load from 8-bit or 16-bit flash) starts the internal boot ROM with a 10-byte header read from the external flash to load the internal code memory and start executation from there afterwards.

I didin't understand why you want to trace from the altera to the spansion flash? In my opinion the flash is connected to the ADSP-BF531, not to the altera. I'm still trying to find a way to reflash the spansion via the ADSP's JTAG interface? If not possible, Plan B would be to desolder the flash and replace it with a new one flashed in an external programmer.

I think the 02.01.01 firmware I used for downgrading uses a different boot block inside the flash which is not compatible with my hardware. Replacing the whole 4MBytes flash content should therefore make the scope work again. I only hope that the 4 MBytes used are at the beginning of the entire 8MBytes flash...

Mechatrommer:

--- Quote from: Meiner on July 11, 2010, 11:33:57 pm ---I didin't understand why you want to trace from the altera to the spansion flash? In my opinion the flash is connected to the ADSP-BF531, not to the altera.

--- End quote ---
some other forumers speculated that the 8MB spansion is shared between the blackfin and altera. and my specific problem is with the internal calibration data which possibly lies in the next 4MB which inaccessible to blackfin.


--- Quote from: Meiner on July 11, 2010, 11:33:57 pm ---I'm still trying to find a way to reflash the spansion via the ADSP's JTAG interface?

--- End quote ---
if you have the JTAG programmer, then i think you should find the manual for the adsp on how to say... program it, read or write to spansion from the programmer. but be sure to backup at least the bootloader. if you lost it, i think you can program the adsp for other kind of DSO :), i've found one open source attempt on a certain dso brand, cant remember whats it, its somewhere here in the net. the hardware is pretty close to our rigol.


--- Quote from: Meiner on July 11, 2010, 11:33:57 pm ---If not possible, Plan B would be to desolder the flash and replace it with a new one flashed in an external programmer.

--- End quote ---
do you have the original content? if not, how u gonna fill the blank flash?


--- Quote from: Meiner on July 11, 2010, 11:33:57 pm ---I think the 02.01.01 firmware I used for downgrading uses a different boot block inside the flash which is not compatible with my hardware.

--- End quote ---
why go down further to 2.01? ppl suggesting just downgrade to 2.02? i might have missed the earlier forum/posts


--- Quote from: Meiner on July 11, 2010, 11:33:57 pm ---Replacing the whole 4MBytes flash content should therefore make the scope work again. I only hope that the 4 MBytes used are at the beginning of the entire 8MBytes flash...

--- End quote ---
i really hope so, and you can report your success and more usefull data for this rigol hacking.

akschu:
I'm been reading about this for a little while, but I still am not making much sense of this.

Can someone tell me if this mod still works on the currently shipping scopes or did they fix the problem in the newer firmware with no way to revert?  I would like to do this if it's not too late.

schu

Navigation

[0] Message Index

[#] Next page

[*] Previous page

There was an error while thanking
Thanking...
Go to full version
Powered by SMFPacks Advanced Attachments Uploader Mod