Products > Test Equipment
Sniffing the Rigol's internal I2C bus
Sparky:
To those experiencing the "License is unavailable!" message that appears on some MSO/DS2000A series scopes when trying to install bandwidth options (200 or 300MHz), it turns out that a solution to this problem has been known since late June 2014! Read on...
I encountered the above error a couple of months ago (read here) and searched the forums but didn't find any solution (must have been poor searching on my part...), and so started an investigation into the obvious possibilities of hardware differences, key generator differences, etc. Read here and here.
Yesterday I read this post regarding the same problem which mentions "NS8N" code for the key generation. As far as I could find, NS8N was discovered way back on June 25 2014 by Purevector.
I found a few other references to use of NS8N related to 300 MHz bandwidth unlocking:
June 27 2014 by KK (mentions "patched key generator" but not NS8N)
June 27 2014 by Purevector
July 8 2014 by AintBigAintClever
August 31 2014 by sm5uiu
I applied an NS8N generated key (for the MSO2072A which gave the "License is unavailable!" message for an NS8H generated key, as output by rigup by default), and it worked. See below for details.
So, there's definitely some mystery surrounding option keys, and why some MSO/DS2072A units need to use different codes for bandwidth, but not other options (memory, decodes, etc).
Edit: Added following details:
You can use the precompiled rigup 0.4 to generate license codes for keys other than the default NS8H, etc. as follows.
--- Code: ---C:\Users\Me\Desktop\rigup-0.4>rigup scan 32M_MemDump.scpi > keys.txt
C:\Users\Me\Desktop\rigup-0.4>rigup license keys.txt NSEH
rigup license - Version 0.4
ABCEEFG-ABCEEFG-ABCEEFG-ABCEEFG (NSEH = 0x1C087)
C:\Users\Me\Desktop\rigup-0.4>rigup license keys.txt NS8N
rigup license - Version 0.4
ABCEEFG-ABCEEFG-ABCEEFG-ABCEEFG (NS8N = 0x1C0C3)
--- End code ---
TitusPullo:
Yes Sparky, I can confirm that. I tried the suggested codes from rigup, but only one (the 100MHz) worked.
By using NS8N instead of NS8H I could activate the 300MHz. From what I gather these codes were "guessed" by trial and error (didn't cybernet write a short routine for that?).
I believe some small detail may be still missing there.
whotopia:
I have a DS2072A with the latest firmware (with the jitter patch). I cleared out all the options but due to previous efforts have serial number of DS2A0000000001. Is there guidance on how to restore this in the FRAM to the correct value? e.g. in case I want to sell the unit?
DS2A0000000001> *IDN?
RIGOL TECHNOLOGIES,DS2072A,DS2A0000000001,00.03.03.SP1
More details on the scope:
Model: DS2072A
Serial: DS2A0000000001
Software Version: 00.03.03.01.00
FPGA Version:
SPU: 04.01.04
WPU: 01.01.03
CCU: 12.29.00
MCU: 02.13
I should add that I've tried older howtos on this board via the SNMODFIX program / firmware downgrade. This works, until I flash to new firmware and then I loose the Serial Number again, the default value as above appears along with the correct model, DS2072A. One other question I have is that I am choosing Model 16 - ds2072 when I patch the .GEL file. However, I actually have a DS2072A. Does anyone know what the model code 0-127 is for my model? Oh, also, my actual serial number starts with DS2D......... .
radiogeek97:
As I promised in previous pages of this thread. I finally purchased a dsa815tg from t-equipment, that being said I am willing to experiment and post in the forum for those that want to work around the locked bootloader issue and some others. I will post all the hardware information when i recieve the unit later. if folks want to PM me or post in this thread on things they would like to try, i will do my best to help everybody
thanks again
cybernet:
after some quiet xmas holidays ....
u-boot preliminary support is done.
linux 3.17 is also booting (tftpboot), but no framebuffer driver (yet) - working on it.
TODO:
fix USB support in kernel/uboot - to support keyboard on the host port
add framebuffer driver to linux
start playing with the hardware, reversing the FPGA interface would be nice to get some samples from the AD
play with DSA815, DG4XXX
DONE:
LCD interface (in part)
Keyboard
LED Front Panel
some IDEAS:
FRAM backup/restore via U-Boot Command
FLASH backup via U-Boot Command
use u-boot to start the rigol LDR instead of their crappy bootloader - then patch it on the fly (e.g. overwrite ECC keys/funcs or model strings etc ..)
reverse engineer the FPGAs and use the board as an open source oscilloscope platform
if somebody wants to test or join development let me know. i will update my wiki the next few days and put u-boot and a linux kernel online (+ patches).
for now i only work with the DS2000 because that allows booting a custom LDR without any hardware mods or even the need to open the device.
--- Code: ---bfin> bootm
## Booting kernel from Legacy Image at 00800000 ...
Image Name: bf526-0.0-3.16.0-ADI-2014R1-prec
Created: 2015-01-05 2:54:11 UTC
Image Type: Blackfin Linux Kernel Image (gzip compressed)
Data Size: 4415220 Bytes = 4.2 MiB
Load Address: 00001000
Entry Point: 0028cdc0
Verifying Checksum ... OK
Linux version 3.16.0-ADI-2014R1-precybernet-00397-g4d88578-dirty (cn@cynlaptop) (gcc version 4.3.5 (ADI-2013R1-RC1) ) #15 Mon Jan 5 03:54:08 CET 2015
register early platform devices
bootconsole [early_shadow0] enabled
Board Memory: 32MB
Kernel Managed Memory: 32MB
Memory map:
fixedcode = 0x00000400-0x00000490
text = 0x00001000-0x001b6b68
rodata = 0x001b6b68-0x0024939c
bss = 0x0024a000-0x002604e8
data = 0x00260500-0x00284000
stack = 0x00282000-0x00284000
init = 0x00284000-0x00573000
available = 0x00573000-0x01f00000
DMA Zone = 0x01f00000-0x02000000
Hardware Trace active and enabled
Boot Mode: 1
Blackfin support (C) 2004-2010 Analog Devices, Inc.
Compiled for ADSP-BF526 Rev 0.0
Warning: Compiled for Rev 0, but running on Rev 2
Blackfin Linux support by http://blackfin.uclinux.org/
Processor Speed: 400 MHz core clock and 100 MHz System Clock
boot memmap: 0000000000573000 - 0000000001f00000 (usable)
On node 0 totalpages: 7936
free_area_init_node: node 0, pgdat 00281350, node_mem_map 00575000
DMA zone: 62 pages used for memmap
DMA zone: 0 pages reserved
DMA zone: 7936 pages, LIFO batch:0
NOMPU: setting up cplb tables
Instruction Cache Enabled for CPU0
External memory: cacheable in instruction cache
Data Cache Enabled for CPU0
External memory: cacheable (write-back) in data cache
pcpu-alloc: s0 r0 d32768 u32768 alloc=1*32768
pcpu-alloc: [0] 0
Built 1 zonelists in Zone order, mobility grouping off. Total pages: 7874
Kernel command line: netconsole=6666@10.146.248.28/eth0,6666@10.146.248.20/0:30:48:db:6:6 mem=32M
PID hash table entries: 128 (order: -3, 512 bytes)
Dentry cache hash table entries: 4096 (order: 2, 16384 bytes)
Inode-cache hash table entries: 2048 (order: 1, 8192 bytes)
Kernel managed physical pages: 7936
Memory: 25836K/31744K available (1750K kernel code, 142K rwdata, 586K rodata, 3004K init, 89K bss, 5908K reserved, 1024K DMA)
NR_IRQS:159
Configuring Blackfin Priority Driven Interrupts
Console: colour dummy device 80x25
console [tty0] enabled
bootconsole [early_shadow0] disabled
Calibrating delay loop... 792.57 BogoMIPS (lpj=1585152)
pid_max: default: 32768 minimum: 301
Mount-cache hash table entries: 1024 (order: 0, 4096 bytes)
Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes)
devtmpfs: initialized
Blackfin Scratchpad data SRAM: 4 KB
Blackfin L1 Data A SRAM: 16 KB (16 KB free)
Blackfin L1 Data B SRAM: 16 KB (16 KB free)
Blackfin L1 Instruction SRAM: 48 KB (42 KB free)
NET: Registered protocol family 16
Blackfin DMA Controller
ezbrd_init(): registering device resources
SCSI subsystem initialized
bfin-spi bfin-spi.0: master is unqueued, this is deprecated
bfin-spi bfin-spi.0: Blackfin on-chip SPI Controller Driver, Version 1.0, regs@ffc00500, dma channel@7
usbcore: registered new interface driver usbfs
usbcore: registered new interface driver hub
usbcore: registered new device driver usb
i2c-bfin-twi i2c-bfin-twi.0: Blackfin on-chip I2C TWI Contoller, regs_base@ffc01400
NET: Registered protocol family 2
TCP established hash table entries: 1024 (order: 0, 4096 bytes)
TCP bind hash table entries: 1024 (order: 0, 4096 bytes)
TCP: Hash tables configured (established 1024 bind 1024)
TCP: reno registered
UDP hash table entries: 256 (order: 0, 4096 bytes)
UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
NET: Registered protocol family 1
debug-mmrs: setting up Blackfin MMR debugfs
msgmni has been set to 50
io scheduler noop registered (default)
bfin-uart: Blackfin serial driver
bfin-uart.1: ttyBF1 at MMIO 0xffc02000 (irq = 31, base_baud = 6250000) is a BFIN-UART
bfin-otp: initialized
brd: module loaded
physmap platform flash device: 00400000 at 20000000
physmap-flash.0: Found 1 x16 devices at 0x0 in 16-bit bank. Manufacturer ID 0x000001 Chip ID 0x002101
NOR chip too large to fit in mapping. Attempting to cope...
Support for command set 0002 not present
gen_probe: No supported Vendor Command Set found
Creating 3 MTD partitions on "physmap-flash.0":
0x000000000000-0x000000040000 : "bootloader(nor)"
0x000000040000-0x000000200000 : "linux kernel(nor)"
0x000000200000-0x000000400000 : "file system(nor)"
m25p80 spi0.1: unrecognized JEDEC id ffffff
libphy: bfin_mii_bus: probed
bfin_mac: attached PHY driver [Generic PHY] (mii_bus:phy_addr=bfin_mii_bus-0:00, irq=-1, mdc_clk=2500000Hz(mdc_div=19)@sclk=100MHz)
bfin_mac bfin_mac.0 eth0: Blackfin on-chip Ethernet MAC driver, Version 1.1
usbcore: registered new interface driver usb-storage
musb-hdrc musb-hdrc.0.auto: musb_init_controller failed with status -517
platform musb-hdrc.0.auto: Driver musb-hdrc requests probe deferral
rtc (null): invalid alarm value: 1900-1-14 0:0:0
rtc-bfin rtc-bfin: rtc core: registered rtc-bfin as rtc0
bfin_wdt: initialized: timeout=20 sec (nowayout=0)
usbcore: registered new interface driver usbhid
usbhid: USB HID core driver
TCP: cubic registered
NET: Registered protocol family 17
musb-hdrc musb-hdrc.0.auto: musb_init_controller failed with status -517
platform musb-hdrc.0.auto: Driver musb-hdrc requests probe deferral
rtc-bfin rtc-bfin: setting system clock to 1989-09-14 07:46:22 UTC (621762382)
Freeing unused kernel memory: 3004K (00284000 - 00573000)
dma_alloc_init: dma_page @ 0x008ea000 - 256 pages at 0x01f00000
bfin_mac bfin_mac.0 eth0: Link is Up - 100Mbps/Full - flow control off
random: nonblocking pool is initialized
buildroot login: root
_______________________________________
a8888b. / Welcome to the buildroot distribution \
d888888b. / _ _ \
8P"YP"Y88 / | | |_| __ __ (TM) |
8|o||o|88 _____/ | | _ ____ _ _ \ \/ / |
8' .88 \ | | | | _ \| | | | \ / |
8`._.' Y8. \ | |__ | | | | | |_| | / \ |
d/ `8b. \ \____||_|_| |_|\____|/_/\_\ |
dP . Y8b. \ For embedded processors including |
d8:' " `::88b \ the Analog Devices Blackfin /
d8" 'Y88b \_____________________________________/
:8P ' :888
8a. : _a88P For further information, check out:
._/"Yaa_: .| 88P| - http://blackfin.uclinux.org/
\ YP" `| 8P `. - http://docs.blackfin.uclinux.org/
/ \.___.d| .' - http://www.uclinux.org/
`--..__)8888P`._.' jgs/a:f - http://buildroot.org/
Have a lot of fun...
BusyBox v1.22.1 (2015-01-05 01:17:41 CET) hush - the humble shell
root:~> cat /proc/cpuinfo
processor : 0
vendor_id : Analog Devices
cpu family : 0x27e4
model name : ADSP-BF526 400(MHz CCLK) 100(MHz SCLK) (mpu off)
stepping : 2 (Compiled for Rev 0)
cpu MHz : 400.000000/100.000000
bogomips : 792.57
Calibration : 396288000 loops
cache size : 16 KB(L1 icache) 32 KB(L1 dcache) 0 KB(L2 cache)
dbank-A/B : cache/cache
external memory : cacheable in instruction cache
external memory : cacheable (write-back) in data cache
icache setup : 4 Sub-banks/4 Ways, 32 Lines/Way
dcache setup : 2 Super-banks/4 Sub-banks/2 Ways, 64 Lines/Way
board name : ADI BF526-EZBRD
board memory : 32768 kB (0x00000000 -> 0x02000000)
kernel memory : 31740 kB (0x00001000 -> 0x01f00000)
root:~> free
total used free shared buffers
Mem: 28840 18284 10556 0 0
-/+ buffers: 18284 10556
root:~> ps
PID USER VSZ STAT COMMAND
1 root 592 S init
2 root 0 SW [kthreadd]
3 root 0 SW [ksoftirqd/0]
4 root 0 SW [kworker/0:0]
5 root 0 SW< [kworker/0:0H]
6 root 0 SW [kworker/u2:0]
7 root 0 SW< [khelper]
8 root 0 SW [kdevtmpfs]
59 root 0 SW [khungtaskd]
60 root 0 SW< [writeback]
61 root 0 SW< [bioset]
62 root 0 SW< [kblockd]
64 root 0 SW< [bfin-spi.0]
66 root 0 SW [kworker/u2:2]
97 root 0 SW [khubd]
201 root 0 SW [kworker/0:1]
210 root 0 SW [kswapd0]
211 root 0 SW [fsnotify_mark]
325 root 0 SW< [deferwq]
359 root 596 R {busybox} /sbin/telnetd -p 23
365 root 592 S /sbin/inetd -f
366 root 588 S /sbin/watchdog -F -T 20 -t 10 /dev/watchdog
367 root 600 S -/bin/sh
368 root 592 S /sbin/syslogd -n -m 0
369 root 588 S /sbin/klogd -n
370 root 624 S -sh
377 root 592 R ps
--- End code ---
Navigation
[0] Message Index
[#] Next page
[*] Previous page
Go to full version