Products > Test Equipment

Sniffing the Rigol's internal I2C bus

<< < (481/899) > >>

granz:
OK,

I have an update after trying some more today.  I've gotten the Altera USB-Blaster JTAG adapter to work with the blackfin tool chain.  It seems to work fine on a 32-bit Linux box.

I now have a working gdb interface after starting bfin-gdbproxy and connecting to it.  I can freely access memory and registers at this point.

If anyone else is looking for a JTAG interface for this, the knock-off Altera one (called "mini") is < $10 on eBay (US).  Working on memory dump now.

granz:

--- Quote from: nonosoft on January 10, 2014, 08:51:28 pm ---For now I have only a Bus Pirate that can act as a slow JTAG device, but if needed I could buy a real JTAG programmer.

--- End quote ---

I don't think it's worth the time to try to use a Bus Pirate.  You need access to all of the memory available to the Blackfin DSP (BF526), so, the software needs to be aware of the specific bus interface (DRAM for example is attached to the BF526 but not directly to JTAG port).  Since JTAG is just a low-level generic interface, there is more involved in accessing the system.  The Blackfin toolchain uses a modified version of UrJTAG.  Have a look here for supported cables:

http://urjtag.org/book/_system_requirements.html#_supported_jtag_adapters_cables

The blackfin-specific tools can be found at blackfin.uclinux.org.  For the least headache it probably makes sense to just use the provided dev tools.

Essentially you run a proxy server (bfin-gdbproxy) which uses the physical JTAG cable and is aware of the BF526 and acts as a server for gdb (GNU debugger).  Then you start up gdb and connect to the server (locally, but using TCP/IP).  In case you're not familiar with why this is the way it is: In the UNIX/Linux world it's fairly common practice to run a gdb server on an embedded system and then connect to it from a development host for debugging.  In this case, we just use JTAG for the physical interface and a local server to make gdb happy. 

Hope that helps.

-Chris

granz:
OK, memory dumps complete!

I put everything in the same format that tirulerbach posted and followed the same procedure (only interaction was entering code AAAAAAA BBBBBBB CCCCCCC DDDDDDD and pressing apply once).

For some reason I couldn't get the processor instruction cache locations, but I got all dram, and everything else.  I see the dummy code in there when I look at it with a hex editor and also readable strings).

I did the initial dumps with my original firmware 00.02.00.00.04, then updated to 00.02.01.00.03 and did everything again.

Also, until a few days ago I had no experience with this or any Rigol product so I didn't realize that it didn't display full version number without following the procedure in marmad's thread.  I've done that, and updated the README.txt files in each package to match my information.  It's exactly the same as tirulerbach's except for being a DS2072A instead of a DS2202A.

I'm planning to re-assemble my scope now, because I'd like to use it again.  Before I do that is there anything else that would be useful to folks?

https://mega.co.nz/#!MhE22KKZ!Uj3JHCyWlyoLwRNBRO2QxBr46-9sZ1GlDnYA5A73I1Y

https://mega.co.nz/#!8lk2jDRT!do2XD3qit0R9Je7qBaY9GitFSfFUqG6zPuw5I0dDyaI

https://mega.co.nz/#!MpUTXKTS!X9H7S2fEccgtJ5S_xRhizQqIS2QG4XU8ETlDDqIj_yY

https://mega.co.nz/#!s0tHDKYY!RoQZ1XR5ecREZNLoEFXJkRJ_YFhdCeikPaEczS07pb4


AndersAnd:

--- Quote from: granz on January 11, 2014, 03:27:27 am ---I'm planning to re-assemble my scope now, because I'd like to use it again.  Before I do that is there anything else that would be useful to folks?
--- End quote ---
People have asked for pictures of the  input stage and the SMD jumper settings earlier in this topic: https://www.eevblog.com/forum/testgear/sniffing-the-rigol%27s-internal-i2c-bus/msg352206/#msg352206

--- Quote from: fcab100 on December 23, 2013, 08:45:51 am ---
--- Quote from: apelly on December 23, 2013, 07:53:08 am ---
--- Quote from: Carrington on December 21, 2013, 07:45:26 pm ---
--- Quote from: apelly on December 20, 2013, 10:30:23 pm ---
--- Quote from: Carrington on December 16, 2013, 02:43:24 pm ---Someone can take a better picture of the DS2xxxA's input stage?    Apelly for example.

--- End quote ---
Busy, but I'll take a look in the next 48 hrs.

--- End quote ---
Ok, perfect, if you can take pictures of the rest, jumpers, DC / DC ...
Thanks.  :-+

--- End quote ---
No susprises.

These will have to do for now... The 'scpoe's still open, so can take more, but even a linux buff like me needed to look up a quick way to resize pics.

Just let me know what you want to see.

--- End quote ---
Can you take pics of the jumper resistor divider just by the battery. Thanks

--- End quote ---

--- Quote from: Carrington on December 23, 2013, 06:56:34 pm ---Jumpers:

HW v1.0:


A or v2.0:


--- End quote ---

tirulerbach:
Thank you for the dumps. They look good.


--- Quote from: granz on January 11, 2014, 03:27:27 am ---I'm planning to re-assemble my scope now, because I'd like to use it again.  Before I do that is there anything else that would be useful to folks?

--- End quote ---

People are asking for the JTAG connection and so on. Maybe some photos how and where to connect the JTAG dongle are useful.

Beside this, dumps with the old firmware 00.02.00.00.04 are not needed, as far as I know.

Regarding the keygen: Basically it is finished and work nice. Release date: TBD.

Navigation

[0] Message Index

[#] Next page

[*] Previous page

There was an error while thanking
Thanking...
Go to full version
Powered by SMFPacks Advanced Attachments Uploader Mod