-
Hi, people!
At the sigrok.org was added support for Kingst LA2016, it's good news.
But I have Kingst LA1016 which has the same hardware, PCB almost the same, even PCB marking and model name at the PCB the same.
There is anybody has Kingst LA2016 can you please extract FW and send me, I want to try to use this FW with my LA1016 (Hardware identical even model name at the PCB the same)
As described at the LA2016 page, the sigrok has utility for extracting FW, can you please send me extracted FW.
https://sigrok.org/wiki/Kingst_LA2016
Thank you, Best Regards!
Maksym. -
Dumping the whole EEPROM might be difficult. But it should be feasible to capture the communication with the EEPROM.
So if anybody has a LA2016, please- attach wires to the EEPROM's clock and data lines
- power cycle the LA2016 and start the official software
- capture the communication
- post your findings here
-
Parts of the data in the EEPROM of an LA1016 have been captured:
- address 0x00: c0 a1 77 a2 01 00 00 00
- address 0x08: 03 fc 01 fe 03 fc 10 ef
- address 0x20: ff ff ff ff
-
I have the LA1016 version and I like your idea. Have you ever tried to change the VID/PID stored in the EEPROM? As far as I know, the EEPROM is only responsible to provide the proper VID/PID values and every time you connect the LA to the PC, their software reprograms the FPGA. It's actually a clone of another logic analyzer and by changing those values, you can introduce the LA as another brand (not ethical of course).
Do you the VID/PID values of LA2016? -
I have access to an LA1016. The PCB is labeled LA-2016 v1.3.0. I used fx2tool from https://github.com/whitequark/libfx2 to dump the eeprom. Here are the results:Code: [Select]
$ .local/bin/fx2tool -B -d 77a1:01a2 read_eeprom -W 1 0 256
c0 a1 77 a2 01 00 00 00 09 f6 00 00 09 f6 10 ef
7a fb 93 76 13 dd fb 27 34 a5 26 32 ff e8 a3 81
20 04 df fb ff ff ff ff ff ff ff ff ff ff ff ff
ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff -
Do you the VID/PID values of LA2016?
The VID/PID is the same for LA1016 and LA2016. The logic analyzer is identified by the contents of the EEPROM. The EEPROM does not store a firmware for the FX2. The FX2 firmware is uploaded when the Kingst software is started. Then the right FPGA bitstream is selected based on the magic bytes in the EEPROM. Typically, the Kingst software reads 8 bytes at offset 0x08 and 4 bytes at offset 0x20.
As far as I can tell, different revisions of the LA1016 have different EEPROM contents. So the software may even be able to identify the PCB revision.
So if anybody has the LA2016 with a PCB labeled LA-2016 v1.3.0 and could dump the EEPROM here, that would be nice. You find the fx2tool command line in my previous post. No soldering required. -
You can read/write configurations to EEPROM, some commands for reference are:Code: [Select]
fx2tool read_eeprom -h
fx2tool write_eeprom -h
fx2tool -B -d 77a1:01a2 read_eeprom -W 1 -f LA1016.bin 0 256
fx2tool -B -d 77a1:01a2 write_eeprom -W 1 -a 0 -f ./LA2016.bin
Note that you must pull pin 7 WP of the EEPROM low (wire jumper) before running the write command, or it won't work.
However, this is not enough to convert a LA1016 to LA2016.
There is also an 8 pin SOIC adjacent to the LED. It is marked simply 'IC' and it is some kind of challenge-response authentication device.
When Kingst software starts, this chip has 4.8Mhz clock applied to pin 6, then a reset pulse to pin 7.
Then data activity seen on pin 3 at a fairly low rate (80us+ bit width) for about 100ms [1].
I'm not sure if this data changes every time (probably it does), but anyway it seems to be different between LA1016 and LA2016.
So, software complains and refuses to operate.
If you want to use Sigrok-Pulseview then LA1016 may well work at 200MHz (like LA2016), since the above authentication is not implemented in that software (in theory, not tested).
[1]
This challenge-response authentication is probably related to the unknown commands that Sigrok-Pulseview has in the la2016_init_device() function.
https://sigrok.org/gitweb/?p=libsigrok.git;a=blob;f=src/hardware/kingst-la2016/protocol.c;h=0b4a8bf36019d0a18d97c2412e8af7790c81e162;hb=HEAD -
Bumping an old thread here, also looking for Kingst LA2016 users...
Trying to use my LA2016 with Sigrok PulseView on Win10.
I have extracted the necessary firmware from Kingst software and placed it with other firmwares in:
C:\Program Files\sigrok\PulseView\share\sigrok-firmware
I have used Zadig to select WinUSB driver for the LA2016.
PulseView won't connect and the log shows it finds the device (by VID and PID) but ezusb fails to download the firmwares.
Error log shows:
sr: kingst-la2016: Found a LA2016 device.
sr: kingst-la2016: device at 'usb/1-5' has no firmware loaded!
sr: ezusb: uploading firmware to device on 1.6
ezusb: failed to open device: LIBUSB_ERROR_NOT_SUPPORTED.
sr: kingst-la2016: uC firmware upload failed!
Has anybody else got the LA2016 working with PulseView on Win10? Or even on Linux?
Edit:
Removing other USB devices from the computer fixed the above error, for some unknown reason.
Then different error occurs:
sr: kingst-la2016: Found a LA2016 device.
sr: kingst-la2016: device at 'usb/1-5' has no firmware loaded!
sr: ezusb: uploading firmware to device on 1.7
ezusb: Unable to set configuration: LIBUSB_ERROR_INVALID_PARAM
sr: kingst-la2016: uC firmware upload failed!
I think this is because the USB device descriptors show the configuration index as 0x01 (in USB Tree View) but PulseView tries to set configuration 0x00.
src/hardware/kingst-la2016/protocol.c
505 return ezusb_upload_firmware(sr_ctx, dev, 0, fw_file);
By contrast, the little saleae clone I have works, it also shows configuration index as 0x01 and PulseView sets configuration 0x01 for that
src/hardware/fx2lafw/protocol.h
35 #define USB_CONFIGURATION 1
So, I think LA2016 will not work in PulseView for Windows right now (09DEC2020).
If anyone has this working, please let me know. -
Yes, it's necessary to select configuration 1 before the upload can be done. The ezusb module calls the SetConfiguration in the libusb. The libusb driver running on Linux somehow accepts the wrong value. The libusb on Windows actually sends the SetConfiguration transfer to the device, and this will be rejected.
There is another problem with the build setup in the MXE cross compiler environment. The LA2016 driver is the only piece of software in sigrok that uses the __attribute__((__packed__)). The MXE build setup passes a parameter to the compiler that causes the attribute to be ignored. The result is a Control Transfer
OUT bRequest:20 wValue:0020 wIndex:0000 wLength:0012 [18 bytes].
The correct transfer length is 16 byte. The padding bytes result in a wrong clock_divisor, and the capture last nearly forever.
Other modules use explicit conversion with helper functions instead of defining struct with the desired layout. This is not so sensible for compiler specific extensions like packed structs.
These two issues have been fixed and are available as Git pull request: https://github.com/sigrokproject/libsigrok/pull/112. If you like you can try it and send a comment.
--
This is my first post in eevblog.com