Rigol 1054Z baremetal - Page 1
Forum section: electronics / testgear

author: WaveyDipole
author_rank: Frequent Contributor
timestamp: March 03, 2023, 06:09:18 pm
content: I was wondering whether anyone has had any success accessing the Rigol 1054Z via its internal JTAG connector? Also is there an internal UART somewhere. The main MCU has UART pins but I have checked various pins and pads but have so far failed to find it exposed anywhere. Also, is it possible to enable Telnet or SSH?I have board version V01.04_20141024. Its the later version without the printed position for the logic analyser chip. I think there was a very long thread about the 1054Z on here a very long time ago that may have discussed some of these things, but I am unable to find that now. BTW, I know the scope can be 'unlocked' without the need for any of this, but that is not my objective.

author: Fungus
author_rank: Super Contributor
timestamp: March 03, 2023, 06:22:00 pm
content: I don't think the DS12054Z uses an OS with a command line so there's no Telnet or SSH.

author: WaveyDipole
author_rank: Frequent Contributor
timestamp: March 04, 2023, 09:54:43 am
content: Quote from: Fungus on March 03, 2023, 06:22:00 pmA lot of devices run on some form of Linux kernel so I figured that might be the case here. The device does implement USB storage, a FAT file system and Ethernet which was suggestive of OS-like features. However, an Arduino has USB and can implement an SD Card as well as Ethernet, yet it does NOT run an OS so I guess its not essential for the Rigol to run one either. That would explain the absence a command line interface, even though it does separately have Telnet access for SCPI commands and a web server.Quote from: PeDre on March 03, 2023, 08:20:55 pmThank you for the information. I have oe of those Olimex adapters and that is what I am intending to use. Curiously, I probed (in a somewhat clumsy fashion) the 6-pin port on the left of my photo, using the jtagenum project code uploaded to a Pico (having first determined a voltage level of 3.3V on the pads). This was able to detect 4 of the JTAG pin functions and also returned a ID of 0x24004093. Googling suggests that this might be a Xilinx XC6SLX25 FPGA, but I am not certain. I don't see one of those on the PCB?I had also probed the port shown connected in your photo (marked yellow) but so far, only with with an oscilloscope. There were bursts of what looked like a clock and another signal on a couple of the pins, but I had not got around to exploring that port any further.I am still waiting on a Jtagulator PCB and will be building one from scratch and had intended to probe both ports once it was ready. However since I can now deduce the connections from your photo, I can probably just solder in the headers and go ahead and dump the code as you have done. The warranty is long expired, so there is no voiding risk anymore. I appreciate you posting that information.I am now curious as to the purpose of the other port. It is not another presentation of the same JTAG port as is present on the right hand side of the PCB. With the exception of the ground, there is no continuity between any of the pins on those two ports.

author: Fungus
author_rank: Super Contributor
timestamp: March 04, 2023, 10:55:59 am
content: Quote from: WaveyDipole on March 04, 2023, 09:54:43 amThat's meaningless."Telnet" is just a manual IP connection. You can Telnet to any open IP port on any device, it doesn't imply "command line access" or anything like that.eg. Telnet to port 80 on a web server and type "GET /" and it will send you the home page's HTML.

author: WaveyDipole
author_rank: Frequent Contributor
timestamp: March 05, 2023, 03:39:03 pm
content: Well I managed to dump the contents of the IMX memory as per provided information. Since I am working on Linux I had to modify the openocd.cfg file to suit. My next step will be to do some analysis on the dump.I tried connecting the Olimex to the other port. Some guesswork involved since the information I got from JtagEnum was incomplete but its just two wires so I simply tried them both ways around. Unfortunately I had no success in getting a JTAG session or identifying anything yet. I was not fully convinced about the JtagEnum output, although it did correctly ID the on-board Xilinx Spartan 6 FPGA. It has a heatsink on top so I did not know what device was underneath, but Dave's teardown video shows the chip with the heatsink removed and it is indeed a Xilinx Sparten 6 XC6SLX25. I may have to wait on the jtagulator to identify the pin order correctly.BTW, Interesting that linked thread. Never seen a Linux kernel running on a Rigol 1045z before!

author: WaveyDipole
author_rank: Frequent Contributor
timestamp: March 06, 2023, 10:58:33 am
content: Thanks. I did indeed find that very interesting along with one other that was linked from it.Some time ago I also chanced upon a thread where someone was discussing the internal display connector and had mapped all the pins, but annoyingly, I cannot find that thread now. I guess I need to get the search terms just so and will keep looking. I did not know that the scope had been discussed in such detail!

author: WaveyDipole
author_rank: Frequent Contributor
timestamp: March 06, 2023, 01:44:54 pm
content: Peter, yes that was the one! Thank you. I searched quite literally for hours for that and another thread! The search on EEVBlog only allows so many clicks through pages of search results before it gives up and one has to wait before trying again. I imagine it does this for anti-DoS reasons. That list of Rigol threads is a handy reference. I have saved a copy of it.I am curious as to whether anyone has mapped the 20-way connector on the top right in the photo? I did pick up a clock signal and another signal on it and have identified some pins as grounds but that was about it. I haven't seen it mentioned in any of the threads yet.