Author Topic: Sniffing the Rigol's internal I2C bus  (Read 1833811 times)

0 Members and 2 Guests are viewing this topic.

Offline AndersAnd

  • Frequent Contributor
  • **
  • Posts: 572
  • Country: dk
Re: Sniffing the Rigol's internal I2C bus
« Reply #1725 on: December 06, 2013, 03:51:45 pm »
Someone had to try running the firmware  ;D Runs fine on my DS2202, but no CAN decoding showing in the options list unfortunately.
So D2000A is different from hardware D2000, right?
The only difference is that DS2000A has a 50 ohm input termination option.
But I think the DS2000 non-A version with HW 2.0 has this too, not sure if the PCB is populated with the 50 ohm termination.
Basically DS2000 with HW 2.0 seems to be the same HW as used by DS2000A.
 

Offline Tom01

  • Newbie
  • Posts: 7
  • Country: pl
Re: Sniffing the Rigol's internal I2C bus
« Reply #1726 on: December 06, 2013, 03:55:07 pm »
But I think the DS2000 non-A version with HW 2.0 has this too, not sure if the PCB is populated with the 50 ohm termination.
Basically DS2000 with HW 2.0 seems to be the same HW as used by DS2000A.

I understand. We can not unlock version A, shows "only" with another, newer firmware?
 

Offline AndersAnd

  • Frequent Contributor
  • **
  • Posts: 572
  • Country: dk
Re: Sniffing the Rigol's internal I2C bus
« Reply #1727 on: December 06, 2013, 04:01:01 pm »
Someone had to try running the firmware  ;D Runs fine on my DS2202, but no CAN decoding showing in the options list unfortunately.
Nice  :-+

Does the DS2000 device options installed via the keygen still work after the FW upgrade?

Does the FW menu still say DS2202 or does it say DS2202A?

Can you downgrade to an older DS2000 FW again?


CAN Analysis kit does not come pre-installed on DS2000A:
http://www.rigol.com/prodserv/DS2000A/
Quote
Decoding Options
RS232,I2C,SPI Decoding Kit     SD-DS2000A
CAN Analysis kit(Trigger+Decoding)     CAN-DS2000A

It is an optional add-on feature you can purchase for both DS2000 and DS2000A according to Tequipment:
http://www.tequipment.net/RigolPricelist.html
Quote
CAN-DS2000A   CAN trigger and decode for DS2000 and DS2000A

« Last Edit: December 06, 2013, 04:04:14 pm by AndersAnd »
 

Offline g***!

  • Contributor
  • Posts: 19
  • Country: gb
Re: Sniffing the Rigol's internal I2C bus
« Reply #1728 on: December 06, 2013, 04:11:46 pm »
The model number is still DS2202 (not A), all keys still install/uninstall OK, but I forgot to try going back to a previous FW...Will do that now and report back!

Update: Tried downgrading FW....not working...OOPs

Panic over lol, now sucessfully downgraded again...Did'nt do it correctly first time. |O
« Last Edit: December 06, 2013, 05:47:06 pm by g***! »
 

Offline Bugware

  • Contributor
  • Posts: 20
  • Country: de
Re: Sniffing the Rigol's internal I2C bus
« Reply #1729 on: December 06, 2013, 04:35:27 pm »
So far I understand, there are at least two differences between DS2000 HW2 and DS2000A:

  • Hardware Version of DS2000 is 1.0.2.0.0 and DS2000A is 1.0.2.0.2
  • The type of the Serial number has changed from DS2Axxxxxxxxx to DS2Dxxxxxxxxx

May the Firmware recognize that?
 

Online PA0PBZ

  • Super Contributor
  • ***
  • Posts: 5127
  • Country: nl
Re: Sniffing the Rigol's internal I2C bus
« Reply #1730 on: December 06, 2013, 04:36:05 pm »
The model number is still DS2202 (not A), all keys still install/uninstall OK,

Just tried the same on a DS2202 (DS2072) hardware version 2, same result.
No CAN option and the 50 ohm input still greyed out. I wonder if it has something to do with these little jumpers on the pcb.
« Last Edit: December 06, 2013, 04:41:21 pm by PA0PBZ »
Keyboard error: Press F1 to continue.
 

Offline JDubU

  • Frequent Contributor
  • **
  • Posts: 441
  • Country: us
Re: Sniffing the Rigol's internal I2C bus
« Reply #1731 on: December 06, 2013, 04:40:48 pm »
So far I understand, there are at least two differences between DS2000 HW2 and DS2000A:

  • Hardware Version of DS2000 is 1.0.2.0.0 and DS2000A is 1.0.2.0.2
  • The type of the Serial number has changed from DS2Axxxxxxxxx to DS2Dxxxxxxxxx

May the Firmware recognize that?

There are examples of the DS2000A with each of these hardware versions:

Hardware Version: 1.0.2.0.0
https://www.eevblog.com/forum/testgear/sniffing-the-rigol's-internal-i2c-bus/msg316379/#msg316379

Hardware Version: 1.0.2.0.2
https://www.eevblog.com/forum/testgear/sniffing-the-rigol's-internal-i2c-bus/msg341494/#msg341494
 

Online PA0PBZ

  • Super Contributor
  • ***
  • Posts: 5127
  • Country: nl
Re: Sniffing the Rigol's internal I2C bus
« Reply #1732 on: December 06, 2013, 04:40:55 pm »

Hardware Version of DS2000 is 1.0.2.0.0 and DS2000A is 1.0.2.0.2[/li][/list]

FWIW: My DS2000 has hardware version 1.0.2.0.1
Keyboard error: Press F1 to continue.
 

Offline AndersAnd

  • Frequent Contributor
  • **
  • Posts: 572
  • Country: dk
Re: Sniffing the Rigol's internal I2C bus
« Reply #1733 on: December 06, 2013, 04:47:07 pm »
As promised here is GEL file for DS2000A: http://thetooth.name/dev/DS2000(DSP)update%20(2).rar

Version is 00.02.01.00.03 November 5th, 2013, i have not tested it but hopefully someone here will find it interesting.
Have you asked for a changelog?
 

Offline Bugware

  • Contributor
  • Posts: 20
  • Country: de
Re: Sniffing the Rigol's internal I2C bus
« Reply #1734 on: December 06, 2013, 05:00:03 pm »
The model number is still DS2202 (not A), all keys still install/uninstall OK, but I forgot to try going back to a previous FW...Will do that now and report back!

Update: Tried downgrading FW....not working...OOPs

So you got a DS2202 with a new Firmware 00.02.01.00.03, right?
What are the FPGA version (SPU, WPU, CCU, MCU)? Any changes?
 

Offline ted572

  • Frequent Contributor
  • **
  • Posts: 399
  • Country: us
  • Radio Communications Equipment/System Design Engr.
Re: Sniffing the Rigol's internal I2C bus
« Reply #1735 on: December 06, 2013, 05:08:21 pm »
DG4000 Calibration Restoration:

I just finished calibrating my DG4000 for Channel 1 and 2, and the frequency response is flat up to 200 MHz and well within +/- 0.8 dB.

I very tediously calibrated channel 1 and recorded all the levels and frequencies for each of the 60 steps for HFLAT Cal.
And HFLAT is the only calibration routine that I did.

When I got done and checked channel 1 the response was great as noted above.  But, I said to myself - WT*.  Why? Because in going through the routine I never saw any frequency above 65 MHz, and therefore I never changed changed any of the levels.

So what is calibration? I have concluded that it is removing the un-calibration that you end up with after you install the firmware patch to extend the frequency!   That's right. . .   Now is that unbelievable, or not.

So to calibrate (or rather restore the previous calibration of) your DG4000:

Press - Utility, Test/Cal, Secure Code, (put in PW) 2010, Enter, Secure OFF, (the result should be) Secure ON, Access gained.
Then for Cal. select HFLAT, Call Point (start at HFLAT 1-1), Measure Value, Input Value, press Save and wait for it to complete (about 3 seconds), select Cal Point for the next step.  Repeat for all 60 steps.  Then your done and you didn't have to make measurements or level changes.  You didn't even have to hook anything up to your DG4000 except for AC power. Hi

Repeat for the remaining channel.

   Cheers, Ted

« Last Edit: December 08, 2013, 09:14:15 pm by ted572 »
 

Offline g***!

  • Contributor
  • Posts: 19
  • Country: gb
Re: Sniffing the Rigol's internal I2C bus
« Reply #1736 on: December 06, 2013, 05:16:51 pm »
The model number is still DS2202 (not A), all keys still install/uninstall OK, but I forgot to try going back to a previous FW...Will do that now and report back!

Update: Tried downgrading FW....not working...OOPs

So you got a DS2202 with a new Firmware 00.02.01.00.03, right?
What are the FPGA version (SPU, WPU, CCU, MCU)? Any changes?

SPU  03.01.09
WPU 00.07.01
CCU  12.29.00
MCU  02.12

I think there has been changes, but I dont have a record of the origional data.

The SCPI command no longer switches in the 50 Ohm termination :--
« Last Edit: December 07, 2013, 01:29:56 pm by g***! »
 

Offline Bugware

  • Contributor
  • Posts: 20
  • Country: de
Re: Sniffing the Rigol's internal I2C bus
« Reply #1737 on: December 06, 2013, 05:22:59 pm »

...

SPU  03.01.09
WPU 00.07.01
CCU  12.29.00
MCU  02.12

I think there has been changes, but I dont have a record of the origional data.

Cool, thanx.  :-+

I think only the SPU and WPU were changed.
« Last Edit: December 06, 2013, 05:27:16 pm by Bugware »
 

Offline neslekkim

  • Super Contributor
  • ***
  • Posts: 1305
  • Country: no
Re: Sniffing the Rigol's internal I2C bus
« Reply #1738 on: December 06, 2013, 05:28:59 pm »
does it exist any windows program to take apart the GEL files?
 

Offline marmad

  • Super Contributor
  • ***
  • Posts: 2979
  • Country: aq
    • DaysAlive
Re: Sniffing the Rigol's internal I2C bus
« Reply #1739 on: December 06, 2013, 05:32:53 pm »
The model number is still DS2202 (not A), all keys still install/uninstall OK, but I forgot to try going back to a previous FW...Will do that now and report back!

Update: Tried downgrading FW....not working...OOPs

I didn't have any problems downgrading again - but I did have some problems when running the new FW version on my DS2000.

I had a few complete hangs - some of which I was able to clear by re-booting - and the final one I couldn't get rid of (the DSO would be frozen even after booting) until I downgraded. It's clear the "saved" selections for each menu item (that have more than 2 settings) get out-of-whack and can cause problems. You have to cycle through menu selections to get a feature to operate correctly sometimes.

According to Drieg, they've changed the structure of unit settings stored in FRAM memory - and he mentioned these hints for the update process:

- use boot method to flash it
- you may experience the unit will hang up in splash screen (RIGOL logo) - reseting FRAM to default will help: keep pressing left menu key F6 (sixth)
- load default settings

I couldn't get my DSO to stop hanging by using the F6 method - so I downgraded. But perhaps the best thing (for non-A owners) is to follow these steps:

1) Before upgrading - set 'Default' for System->Power On
2) Upgrade via boot method
3) During first boot up after upgrade, hold in left-menu F6 (sixth gray button) during the boot

Maybe this will prevent hang-ups while running the FW.

More info about any improvements found, bug fixes, or new bugs added since v.01.01.00.02 will be posted over in the DS2000 thread.
« Last Edit: December 07, 2013, 02:49:18 pm by marmad »
 

Offline ted572

  • Frequent Contributor
  • **
  • Posts: 399
  • Country: us
  • Radio Communications Equipment/System Design Engr.
Re: Sniffing the Rigol's internal I2C bus
« Reply #1740 on: December 06, 2013, 08:47:42 pm »
DG4000 Calibration Restoration:
Re. My previous post #1771 above.

I now believe that the Restoration of the DG4000 calibration should be done for AC, LFLAT, and HFLAT to correct some other potential glitches.  Nothing is being changed, or has to be connected to the DG4000, so the process goes fast.  Just bring up and save all the default values for each step, starting with 1, or 1-1 (A/R).
You can also do this for 'Inner Imped' and 'Offset', although I haven't seen a case or benefit for it yet.

I just wouldn't do this for Freq Accuracy, or Counter, unless you see a need for it, and then you should complete this cal. process as prompted.

The calibration restoration is effective for both channels, so it isn't necessary to repeat each cal. routine for the other channel.
« Last Edit: December 08, 2013, 09:16:09 pm by ted572 »
 

Offline Teneyes

  • Frequent Contributor
  • **
  • Posts: 498
  • Country: ca
Re: Sniffing the Rigol's internal I2C bus
« Reply #1741 on: December 07, 2013, 11:33:53 am »
DG4000 Calibration Restoration:
   So to calibrate (or rather restore the previous calibration of) your DG4000:

Press - Utility, Test/Cal, Secure Code, (put in PW) 2010, Enter, Secure OFF, (the result should be) Secure ON, Access gained.
Then for Cal. select HFLAT, Call Point (start at HFLAT 1-1), Measure Value, Input Value, press Save and wait for it to complete (about 3 seconds), select Cal Point for the next step.  Repeat for all 60 steps.  Then your done and you didn't have to make measurements or level changes.  You didn't even have to hook anything up to your DG4000 except for AC power. Hi


DG4000 Calibration Restoration:
I think the  steps:
   "Measure Value",
   "Input Value",
   "Rotate select next cal Point"
 can be stepped thru the 62 points and then save only once to save time ,

Does anyone else see the output drop-off increases from 160-200 MHz?
or is that just my scope.

or is that why Rigol only offered  up to DG4162

ps should this Discussion be moved to the DG4000 Blog
DG4000-a-firmware-investigation
IiIiIiIiIi  --  curiosity killed the cat but, satisfaction brought it back
 

Offline ted572

  • Frequent Contributor
  • **
  • Posts: 399
  • Country: us
  • Radio Communications Equipment/System Design Engr.
Re: Sniffing the Rigol's internal I2C bus
« Reply #1742 on: December 07, 2013, 01:34:57 pm »
DG4000 Calibration Restoration:
   So to calibrate (or rather restore the previous calibration of) your DG4000:

Press - Utility, Test/Cal, Secure Code, (put in PW) 2010, Enter, Secure OFF, (the result should be) Secure ON, Access gained.
Then for Cal. select HFLAT, Call Point (start at HFLAT 1-1), Measure Value, Input Value, press Save and wait for it to complete (about 3 seconds), select Cal Point for the next step.  Repeat for all 60 steps.  Then your done and you didn't have to make measurements or level changes.  You didn't even have to hook anything up to your DG4000 except for AC power. Hi


DG4000 Calibration Restoration:
I think the  steps:
   "Measure Value",
   "Input Value",
   "Rotate select next cal Point"
 can be stepped thru the 62 points and then save only once to save time ,

Does anyone else see the output drop-off increases from 160-200 MHz?
or is that just my scope.

or is that why Rigol only offered  up to DG4162

ps should this Discussion be moved to the DG4000 Blog
DG4000-a-firmware-investigation

Yes, everyone with the DG4000 freq. expansion patch will have the issue of level drop-off starting somewhere above 120 MHz, although the Calibration Restoration  corrects it.

Thanks for the tip on speeding up the process by Saving at the end.
 

Offline cybernet

  • Regular Contributor
  • *
  • Posts: 247
  • Country: 00
  • pm deactivated, use the search function ...
Re: Sniffing the Rigol's internal I2C bus
« Reply #1743 on: December 07, 2013, 03:54:30 pm »
had some questions in my inbox, pretty busy atm so not really time to further play with rigols until xmas.

anyhow for those playing with IDA here is an updated bundle of DG/DS flirt signatures for IDA - somehow signatures for bfin suck (cpu module needs updating) but its better than nothing.

http://www.sendspace.com/file/xdvlw2

and here is a bfin loader/cpu module for ida that supports reading LDR format (extracted dump_00_XXX from GEL files which i postet earlier) - geltool kit will
take some time to release, its to dangerous right now, because u could f***up your bootloader if not careful.

http://www.sendspace.com/file/ymtg9g
___________________
"all rights reversed :-)"
R0=-0x18;
UNLINK;
RTS;
 

Offline Mark_O

  • Frequent Contributor
  • **
  • Posts: 939
  • Country: us
Re: Sniffing the Rigol's internal I2C bus
« Reply #1744 on: December 07, 2013, 07:26:56 pm »
So DS2000 and DS2000A series are the same then, almost?, signature in the top are similar/same? DS2202
00.02.01.00.03...
The .GEL firmware name is also exactly the same for both the DS2000 and DS2000A series: DS2000Update.GEL
So maybe the DS2000 series can also be updated with the DS2000A firmware.

Yes, that is actually a possibility.

Quote
From the .GEL file it looks like Rigol has plans to also release a MSO2000/MS2000A series with built-in logic analyzer.

Yes, this has been known for some time.  Ever since a DS2000 with the Rev2 hardware was opened, and the motherboard revealed spots for the LA FPGA, and the optional SigGen.  They're doing things in stages.  Someday there's likely to be an MSO2xx2A-S too.  What some would like to see is an MSO/DS2xx4A, but no indications of that happening.
 

Online PA0PBZ

  • Super Contributor
  • ***
  • Posts: 5127
  • Country: nl
Re: Sniffing the Rigol's internal I2C bus
« Reply #1745 on: December 07, 2013, 08:25:02 pm »
So maybe the DS2000 series can also be updated with the DS2000A firmware.

Yes, that is actually a possibility.


Yesterday in this thread myself and someone else posted that we updated our DS2000 with this software.
Keyboard error: Press F1 to continue.
 

Offline NikWing

  • Regular Contributor
  • *
  • Posts: 139
  • Country: de
Re: Sniffing the Rigol's internal I2C bus
« Reply #1746 on: December 07, 2013, 11:20:28 pm »
Hello all :)

I was looking around for a new DSO and a colleague pointed me to the Rigol series.
I decided to get a DS2102, did some search about them and found this place after watching the video on youtube :D
Then I found out about a cookie generator to unlock the options.

After reading several postings here on the forum I'm still not sure what to do, especially since I  just found out that now there's a DS2102A and a DS2102A-S a few minutes ago.
And now I have some quick questions, I hope this thread is the correct one to ask (please don't shoot me if not D:)

What  would you suggest me? Is the -S version useful since it has a waveform generator or does the A-version also have this generator but it needs to be unlocked?
Can I unlock the A-version and the A-S-versions without problems at this moment?
The 200 MHz option makes the 2102 into "the same" 2202, that can be bought as an independent device?

Thanks for quick replies and a little help :)
 

Offline jboard146

  • Contributor
  • Posts: 38
  • Country: us
Re: Sniffing the Rigol's internal I2C bus
« Reply #1747 on: December 08, 2013, 12:59:00 am »
had some questions in my inbox, pretty busy atm so not really time to further play with rigols until xmas.

anyhow for those playing with IDA here is an updated bundle of DG/DS flirt signatures for IDA - somehow signatures for bfin suck (cpu module needs updating) but its better than nothing.

http://www.sendspace.com/file/xdvlw2

and here is a bfin loader/cpu module for ida that supports reading LDR format (extracted dump_00_XXX from GEL files which i postet earlier) - geltool kit will
take some time to release, its to dangerous right now, because u could f***up your bootloader if not careful.

http://www.sendspace.com/file/ymtg9g


I may have sometime in the next week or two to use IDA to look at the firmware files. I'm not a IDA guru, but have access to. Do you have some sort quick how-to on how to open the GEL files in IDA?
 

Offline alank2

  • Super Contributor
  • ***
  • Posts: 2185
Re: Sniffing the Rigol's internal I2C bus
« Reply #1748 on: December 08, 2013, 02:18:24 am »
and here is a bfin loader/cpu module for ida that supports reading LDR format

Should there be a rigol_ldr.ldw file in that release directory too?
 

Offline ted572

  • Frequent Contributor
  • **
  • Posts: 399
  • Country: us
  • Radio Communications Equipment/System Design Engr.
Re: Sniffing the Rigol's internal I2C bus
« Reply #1749 on: December 08, 2013, 03:11:36 am »
DG4000 Calibration Information is attached that includes the basic factory default level settings:

These documents are preliminary, although they provide a good insight into the DG400 calibration.

Applies to models DG4062 through DG4202.
« Last Edit: December 08, 2013, 09:12:54 pm by ted572 »
 


Share me

Digg  Facebook  SlashDot  Delicious  Technorati  Twitter  Google  Yahoo
Smf