Author Topic: Sniffing the Rigol's internal I2C bus  (Read 1552821 times)

0 Members and 1 Guest are viewing this topic.

Offline KK1L

  • Contributor
  • Posts: 10
  • Country: us
    • KK1L
Re: Sniffing the Rigol's internal I2C bus
« Reply #4475 on: January 05, 2021, 10:55:10 pm »
I have been trying to get a memory dump of my DS1074Z-S Plus through the JTAG port having given up getting a back level firmware loaded to access via SCPI on the LAN. I hesitate to ask here, but I am at my wits end. I have learned a great deal about OCD, JTAG access, etc in the many days I have dedicated to this endeavor. And am grateful for the all the great information especially on EEVBLOG which has allowed me to make the progress I have.

Using SiSpeed dongle with FT2232 with TMS/TCK/TDI/TDO and RST. RST is connected to SRST on the 1074Z. There is only the one reset signal, so I have to soft reset the TAP.
I seem have the interface signals defined correctly (finally!) as I can reset the scope with a reset command, and jtag arp_init comes back clean.
My problem is that I eventually get a timeout error "waiting for SYSCOMP & DBGACK". I have gotten as large as a 2MB file or so, and as small as 8k. Driving me nuts.

> jtag init
> halt
target halted in ARM state due to debug-request, current mode: Supervisor
cpsr: 0x20000013 pc: 0x4003957c
MMU: enabled, D-Cache: enabled, I-Cache: enabled
> dump_image mso1074z.bin 0x40000000 0x3FFFFFF
timeout waiting for SYSCOMP & DBGACK, last DBG_STATUS: 4

I have been trying a variety of adapter speeds, delay and timing configurations, TDO clocking edge rise/fall, etc. I do not rely on a reset command between tries. I will power cycle both the dongle and the 1074Z.

Is there a clue someone might have for me? Happy to share more detail about what I have tried.


73 es God Bless, KK1L Ron <><
73 es God Bless de KK1L, Ron <><

Online up8051

  • Regular Contributor
  • *
  • Posts: 155
  • Country: pl
Re: Sniffing the Rigol's internal I2C bus
« Reply #4476 on: January 07, 2021, 05:25:02 pm »
What is the latest firmware version for DS2072 (non-A).

At Rigol page there are only for DS2000A, is the same for non-A version?

Offline geo999

  • Contributor
  • Posts: 8
  • Country: ro
Re: Sniffing the Rigol's internal I2C bus
« Reply #4477 on: January 12, 2021, 04:29:22 pm »
Hi guys,

I got myself a DSO1074Z-plus thinking the upgrade to 100Mhz is as easy as for DS1054Z.
After introducing the wrong serial codes for a few times I ended up on this page reading tens of pages.

I also did a :SYSTem:OPTion:UNINSTall such that now I'm left without any option that came preinstalled.

In the end the rigol seal lasted for less than 4 hours since it got into my possession :).

I hooked up the Olimex-JTAG/OpenOCD and did a dump of the memory.
I double checked that the dump is correct by doing a second dump and comparing md5sums.
The dump was done after the scope completed booting - ready to work.

now for the fun part,
I tried different rigup versions with different results, none of them providing valid keys.

        RC5KEY1:        xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
        RC5KEY2:        xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
        XXTEAKEY:      xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
        PUBKEY:         xxxxxxxxxxxxxxxx
        PRIVKEY:        xxxxxxxxxxxxxxxx
    --> SERIAL: this line is not present in the output of the scan command,
    even if I can find the serial in the dump with grep.

    the search command crashes with a segfault.
    after a little debugging it turns out that this is due to the missing SERIAL like in the scan output.
    after adding manually the SERIAL line entry with the serial from the label on the back of the scope the output of search command is:
        6 lines with serial numbers all failed
        xxxxxxx-xxxxxxx-xxxxxxx-xxxxxxx                        Failed.
    failed: No keys
    failed: No keys

rig-up from,
    failed: No keys

DS1074Z plus
Board: 2.1.4

labels on the board:
Hardware Version: V[654][32].[10]
SP Version: [987]

a firmware update attempt it's saying that it's already at the same version.
question is: what I'm doing wrong here ?
- do I need to do a dump at a different stage ?
- do I need a different rigup tool version ?

later edit:
the serial number starts with: DS1ZC
rigup, compiled on Linux x86-64

thank you

« Last Edit: January 12, 2021, 05:52:50 pm by geo999 »

Offline KK1L

  • Contributor
  • Posts: 10
  • Country: us
    • KK1L
Re: Sniffing the Rigol's internal I2C bus
« Reply #4478 on: January 14, 2021, 08:58:42 pm »
Hi GEO999,

I would not be surprised if Rigol support wouldn't send you the code to open up the options they now ship with these rigs. It is worth a shot! Tech Support under "Support" on for me!

You have gotten further than me with the memory dump. I think I am going have to buy an ARM ready debugger (like the Olimex) to get past my timeout issue. There is a post maybe in this quite expansive thread where there were a pair of leading zeroes in the keys which needed to be removed. I do not recall if this was automatically handled in rigup. 
73 es God Bless de KK1L, Ron <><

Share me

Digg  Facebook  SlashDot  Delicious  Technorati  Twitter  Google  Yahoo