Sniffing the Rigol's internal I2C bus

[dtran11]

Does anyone know what the unknown option for the DS1000Z is for yet? I just installed it but would like to know what it is for. Also how do I revert back to DS1074Z?

Thanks

[AndersAnd]

Also how do I revert back to DS1074Z?

I already mention that in a previous answer to your question: https://www.eevblog.com/forum/testgear/sniffing-the-rigol's-internal-i2c-bus/msg355312/#msg355312

Also is there anyway to revert the options if I need to send in for repair?

Use the SCPI command ":SYSTem:OPTion:UNINSTall" to remove installed option keys again. Search this topic for :SYSTem:OPTion:UNINSTall

[m-joy]

neamyalo thank you for your work - would you be willing to upgrade to the latest firmware and repeat the full dump?

Your dump says it is 00.02.00.00.04 and the latest fw I know of is 00.02.01.00.03.

Thanks!

Does that change anything?where is cybernet btw...

[Avotronics]

Thanks!
[/quote]

where is cybernet btw...
[/quote]

What are we, his nannies? Lol ;-)

[tirulerbach]

Hello,

I remembered I'm owning a JTAG-Dongle...  It is an Olimex ARM-USB-OCD. In the meantime I opened my DS2202A, attached the JTAG, downloaded the bfin-uclinux stuff and started urjtag:

Code: [Select]

jtag> cable arm-usb-ocd
Connected to libftdi driver.
jtag> frequency 500000
Setting TCK frequency to 500000 Hz
jtag> detect
warning: TDO seems to be stuck at 0
jtag>

Lower frequencies didn't work either...

So after fiddling a little bit I assume that the U_tst  Voltage (3.3V) on Pin 1 on the JTAG header is to weak. According to the schematic posted above it is connected via a pull-up of 10k to 3.3 Volts. The voltage drops to about 1.8V when I connect the JTAG-dongle. That is about 150uA.

So, do you think I just can use an external 3.3V supply for the JTAG-dongle?

Maybe this is the same issue which neamyalo very slow jtag speed? What do you think?

[Flipp]

Lol:
DS2000 Series is a new generation oscilloscope. It has 2 channels. It has a sibling version with logic analyser DS2000D. The maximum bandwidth is 200M, and the peak sampling rate is up to 1G.
 
From HTML Page inside Jtag Dump

Flip

[AndersAnd]

Hello,

I remembered I'm owning a JTAG-Dongle...  It is an Olimex ARM-USB-OCD. In the meantime I opened my DS2202A, attached the JTAG, downloaded the bfin-uclinux stuff and started urjtag:

Code: [Select]

jtag> cable arm-usb-ocd
Connected to libftdi driver.
jtag> frequency 500000
Setting TCK frequency to 500000 Hz
jtag> detect
warning: TDO seems to be stuck at 0
jtag>

Lower frequencies didn't work either...

So after fiddling a little bit I assume that the U_tst  Voltage (3.3V) on Pin 1 on the JTAG header is to weak. According to the schematic posted above it is connected via a pull-up of 10k to 3.3 Volts. The voltage drops to about 1.8V when I connect the JTAG-dongle. That is about 150uA.

So, do you think I just can use an external 3.3V supply for the JTAG-dongle?

Maybe this is the same issue which neamyalo very slow jtag speed? What do you think?

From what I have understood from Cybernet's posts about Rigol JTAG interfacing you have to add the 10k and 3k9 pull-up resistors externally yourself. Did you measure the resistance from SRST [pin 2] and TRST [pin 10] to 3.3V [pin 1]?

Just managed to discover the BF526 on the JTAG chain  

Pinout:

   3,3V      (1)   (2) /EMU, /SRST (use a 10k pullup to 3,3V)
   no pin   (3)   (4)  unused (seems to be GND)
   nc         (5)   (6) TMS
   GND      (7)   (8) TCK
   GND      (9)   (10) /TRST (use a 10k pullup to 3,3V)
   GND    (11)  (12) TDI
   GND    (13)  (14) TDO

The 14pin header near the Blackfin. I actually think i fried my 3,3V on Pin1 - even if loaded with 10k it drops down to 1V,
so im running the pullup for pin (2) to the 4 pin connector on the opposite side of the PCB labeled VCC (3,3V) instead of pin1

CAUTION: the usual ADI JTAG has pin1 connected to GND (this shorts VCC to GND), which probably killed my VCC there ...
Scope is still fine, so just fried some output stage somewhere i guess

For the jtag adapter itself im using the Amontec JTAG Key Tiny (30$) - TopJTAG eval discovers an Analog Devices BF526 (IDCODE=227E0CBh) ... next up trying urJTAG + bfin-gdb.

JTAG Key: http://www.amontec.com/

started dumping memory via JTAG on the DG4000 - no probs at all exact same layout as the DS2000's JTAG - aux 3,3V can be stolen from the header next to it if needed for jtag adapter.

[tirulerbach]

Code: [Select]

jtag> frequency 5000000
Setting TCK frequency to 5000000 Hz
jtag> detect
IR length: 5
Chain length: 1
Device Id: 00100010011111100100000011001011 (0x227E40CB)
  Manufacturer: Analog Devices, Inc. (0x0CB)
  Part(0):      BF526 (0x27E4)
  Stepping:     2
  Filename:     ./../share/urjtag/analog/bf527/bf527
jtag>
  No risk no fun... There is a "SPI BOOT" header oh the right side of the PCB. Pin 7 has 3.3 Volts and it works... 

So now I'm learning how to dump that beast....

[m-joy]

Dumpy dumpy dooo!
The only Problem that i see is.... Cybernet seems to be the only one that can handle the dump xD

[tirulerbach]

Yeah, looks like that dumping works. About 50 KByte/s. 
Results are consistent. 

So, I have questions: 

a.) How large is the RAM? 64 Meg?
b.) How to enter into the boot-loader on startup? I read somewhere the dump in boot-loader mode is also needed?

[Avotronics]

Cybernet surely does love them big fresh dumps :-)

[neamyalo]

a.) How large is the RAM? 64 Meg?

I think the SDRAM is only 32 MB. I could only see one 32 MB IC connected on the PCBA and in a post a while back Alan2k (I think) also mentioned that the register values corresponded with only 32MB of SDRAM, starting at address 0.

[Dave Turner]

My DS1074Z-S reports a software version - 00.02.00.SP1.

Has anyone seen a later version?

[dtran11]

Also how do I revert back to DS1074Z?

I already mention that in a previous answer to your question: https://www.eevblog.com/forum/testgear/sniffing-the-rigol's-internal-i2c-bus/msg355312/#msg355312

Also is there anyway to revert the options if I need to send in for repair?

Use the SCPI command ":SYSTem:OPTion:UNINSTall" to remove installed option keys again. Search this topic for :SYSTem:OPTion:UNINSTall

Sorry, I thought the 100mhz was a different animal. So that command will remove all options (keys) at once? thanks

[neamyalo]

neamyalo thank you for your work - would you be willing to upgrade to the latest firmware and repeat the full dump?

Your dump says it is 00.02.00.00.04 and the latest fw I know of is 00.02.01.00.03.

Thanks!

Hi Alan, no problem with the dumps so far - my pleasure - but I'd rather not do another if I can help it - my JTAG link's so slow (its 14 hours of continuous dumping just for one snapshot).

I think S/W 00.02.00.00.04 will be good enough for our purposes  Also, let's see how tirulerbach gets on - it sounds like his link is blazing @ 50 kB/s 

[alank2]

Your dump says it is 00.02.00.00.04 and the latest fw I know of is 00.02.01.00.03.
I think S/W 00.02.00.00.04 will be good enough for our purposes

The only problem is that 00.02.00.00.04 is an unknown one in that nobody has a gel file for it.  I know it is a lot to ask for another dump, but the 00.02.01.00.03 is available in gel and can be analyzed.  If you can at some point that would be appreciated - either way thank you for your work!

[tirulerbach]

My first dump is completed. 

DS2202A unmodified, firmware 00.02.00.00.04 and booted to normal operating mode...

Now, somebody would like to tell me how to enter the boot loader?

Have fun!

https://mega.co.nz/#!6FcXUKYT!XsgK-3tIaJp2inP6UBlzWXDfs8VIkfkpQJNPXjY5_yA

(Sorry for the file hosting...    Do you have some better site?)

[AndersAnd]

(Sorry for the file hosting...    Do you have some better site?)

https://mega.co.nz very fast and the same site as neamyalo used to host his dump: https://www.eevblog.com/forum/testgear/sniffing-the-rigol's-internal-i2c-bus/msg355266/#msg355266

And you can get the Avotronics who posted in this topic earlier today to host it on his Rigol hacking site: http://rigol.avotronics.co.uk

[Avotronics]

I'm on ipad now, but tomorrow I'll post them up on rigol.avotronics.co.uk just in case they get removed.
Lot of dumps today... I should lay off the eggs :-/

[AndersAnd]

Lot of dumps today...

I blame all the christmas food 

[Avotronics]

true, combined with not knowing when to stop eating ;-)

[tirulerbach]

I updated my DS2202A to latest firmware 00.02.01.00.03 and made a new dump (just after reboot from update): 

https://mega.co.nz/#!uUUBXJQC!U8smoyLwcdVIXXxy82DoGSy457oJDYQhZUIRccF9ZSU

Have Fun! 

[jkw13]

I really apologize if this has been answered already in this thread, but I'm late to the game and pouring over 141 pages of posts is a bit daunting.  But are there firmware limitations on the use of Keygens on Rigol equipment (namely the DP832 and DS1074Z)?  For instance, do the keys not work with newer firmwares, and has anyone lost keygen activated features after upgrading the firmware on the equipment?

Well I have lost keygen feaures on DP832 after down/upgrade and ADC not working,
The output meters mean nothing now

[nerdms]

Hi, I have the DS2072 with HW version 2.0 and FW version 01_01_00_02.  I used the DSAZ to generate the key and everything seems to have gone fine (all options enabled) but I discovered that the vertical and horizontal position knobs are acting funny.  If I move the vertical knob in one direction then it always moves in that direction no matter which way I rotate the knob and the horizontal always moves in one direction.  I updated the FW to 02_01_00_03 thinking that would fix the issue but nope.  Pushing the knobs centers everything fine.  Has anyone encountered that?  Very weird.

Thanks.

[cybermaus]

Hi guys

sorry if I missed it during search, but was any download location or change-list given for the latest DS1000Z (DS1074Z-S) firmware?

Also, if anyone wants to know, the DSAB Adv Trigger / DSAC Decoders / DSAE 24M Memory / DSAJ Recorder features work on the -S model without any apparent side effects.

Did not try the "DSFR All Options" though because it is described as "turns it into a DS1104Z".
I do not want it to turn into a DS1104Z ! Not without the -S !

I wonder if the 'unknown' feature is the signal generator. People without the hardware would not notice it active or missing. Except maybe for the grayed out tabs under the screen.


To be honest, for the stuff I do i do not really need the bandwidth (or any of the other features for that matter). Only two month ago I was still happy with my 20MHz analog.