Difference between revisions of "Voltcraft DSO-3062C"

From Random Projects
Jump to: navigation, search
m (Building a Linux kernel)
m (Loading a Linux kernel into SDRAM via XMODEM)
Line 332: Line 332:
 
=== Loading a Linux kernel into SDRAM via XMODEM ===
 
=== Loading a Linux kernel into SDRAM via XMODEM ===
  
  Tekway> '''load ram 0x30008000 2366840 x'''
+
  Tekway> '''load ram 0x30008000 2366848 x'''
  
Then, in minicom on the host, press '''CTRL-a z''', then press '''s''', select '''xmodem''', and select the file you want to transfer (a '''zImage''' in this case). In this example '''0x30008000''' is the (RAM) location where the file should be stored and '''2366840''' is the size of the file to load.
+
Then, in minicom on the host, press '''CTRL-a z''', then press '''s''', select '''xmodem''', and select the file you want to transfer (a '''zImage''' in this case). In this example '''0x30008000''' is the (RAM) location where the file should be stored and '''2366848''' is the size of the file.
  
 
=== Executing a Linux kernel from RAM ===
 
=== Executing a Linux kernel from RAM ===

Revision as of 00:41, 5 April 2012

Voltcraft DSO-3062C

The Voltcraft DSO-3062C is an inexpensive (299.- Euros as "special offer" from Conrad) 2-channel digital oscilloscope with 60MHz bandwidth and 1GSa/s samplerate (or 500MSa/s when both channels are used) that can be modified to a 200MHz bandwidth scope via a software change.

It is based on the Samsung S3C2440 (ARM9 SoC) and runs Linux, thus is a very nice "hackable" target in general.

My unit

System info

I ordered the device on March 23, 2012 from Conrad, it arrived March 27, 2012. The following versions apply to my unit:

  • Model: DSO3062C
  • SW-Version: 2.06.3(120224.0)
  • HW-Version: 10070x555583e9
  • Serial number: T 1G/012 00xxxx


Photos

Unboxing

How to open the device

To be continued...

PCB

To be continued...

System information

See Voltcraft DSO-3062C/Sysinfo for the output of various commands run from within the Linux system on the scope (via UART).

Creating a backup

You can use this tool to create a backup of the oscilloscope firmware.

$ wget 'http://www.eevblog.com/forum/general-chat/hantek-tekway-dso-hack-get-200mhz-bw-for-free/?action=dlattach;attach=11522' -O fw_backupV3a.zip
$ unzip fw_backupV3a.zip
$ cd Universal
$ mv special_secret_dst1kb_9.99.9_cli\(200101.1\).up 'dst1kb_9.99.9_cli(200101.1).up'

Copy dst1kb_9.99.9_cli(200101.1).up to a USB thumb drive (FAT32 file system), insert the thumb drive in the scope, wait a few seconds, press Utility, press F2 (Firmware upgrade), press F5 (Confirmation that the firmware upgrade should start). Now wait 1-5 minutes, when the process is finished a dialog box tell you to restart the scope.

Afterwards, the USB thumb drive will contain a dump/ directory with boot.bin, kernel.bin, and root.bin files which are dumps of the respective NAND flash partitions.

Upgrading the device to 200MHz bandwidth

USB (Windows)

TODO.

USB (Linux)

You can use this little Python script (edit it to your needs) as root in order to upgrade the scope from 60MHz to 200MHz.

Requirements:

You'll need to download and install PyUSB >= 1.0 first (the python-usb Debian package does not work, that version is too old and incompatible).

$ unzip pyusb-1.0.0a2.zip
$ cd pyusb-1.0.0a2
$ python setup.py install (as root)

Upgrade script:

IMPORTANT: Use at your own risk! In the worst case your scope could be "bricked"! You have been warned!

#!/usr/bin/env python
# Written by Uwe Hermann <uwe@hermann-uwe.de>, released as public domain.

from array import array
import usb

# Uncomment the line you want to run, or add your own for other variants.
# Filenames: 60MHz = dst1062b, 100MHz = dst1102b, 200MHz = dst1202b
cmd_str = 'mv /dst1062b /dst1202b' # 60MHz -> 200MHz
# cmd_str = 'mv /dst1202b /dst1062b' # 200MHz -> 60MHz

# Find and open the device.
dev = usb.core.find(idVendor = 0x049f, idProduct = 0x505a)
if dev is None:
    print("Voltcraft DSO-3062C not found. Did you connect it via USB?")
    exit()

# On Linux the 'cdc_subset' driver grabs the device, unload it first.
if dev.is_kernel_driver_active(0):
    dev.detach_kernel_driver(0)

cmd = [0x43, 0x18, 0x00, 0x11] + map(ord, cmd_str)
checksum = sum(cmd) & 0xff

dev.write(0x01, cmd + [checksum])
# print("Reply: " + str(dev.read(0x82, 64))) # Ignore reply for now.

print("Upon the next boot the scope should be upgraded if nothing went wrong.")

UART

Press CTRL-C to kill dso.exe, press enter to get a shell, then run:

$ mv /dst1062b /dst1202b

Reboot the scope. That's it.

Example captures before and after the 200MHz upgrade

This is a set of example captures done using the Voltcraft DSO-3062C oscilloscope. I used the original PP-80 probes it ships with (60MHz, 10X, 1.2 meters), as well as Tektronix P6139A probes (500MHz, 8.0pF, 10MOhm, 10X, 1.3 meters) for comparison.

50MHz clock signal

This is a set of captures of a 50MHz digital (clock) signal from an FPGA to an SRAM chip.

As a reference, a capture (of the same signal) was done on a Tektronix TDS744A oscilloscope (500MHz bandwidth, 2GSa/s) using the Tektronix P6243 active probe (1GHz, 1MOhm, <1pF, 10X).

100MHz clock signal

This is a set of captures of a 100MHz digital (clock) signal from an FPGA to an SRAM chip.

As a reference, a capture (of the same signal) was done on a Tektronix TDS744A oscilloscope (500MHz bandwidth, 2GSa/s) using the Tektronix P6243 active probe (1GHz, 1MOhm, <1pF, 10X).

UART

Use the J801 header. (TODO: Photos, pinout)

My modular UART cable setup

I'm using a standard FTDI TTL-232R-3V3 cable with some additional custom soldered cables which connect to the three UART pins (RXD0, TXD0, GND) on the PCB. I soldered three individual pins on the PCB for that.

The FTDI cable fits nicely through the space at the back side of the scope which is intended for an Ethernet jack (but not used in this model).

Bootlog

See Voltcraft DSO-3062C/Bootlog for the debug messages output during the boot process.

Login shell via UART

Press CTRL-C to kill dso.exe, then press enter to get a shell.

JTAG (for Samsung S3C2440)

Connector/cable

The board has a standard 20pin ARM JTAG connector (just the vias/holes, no pins) onboard. However, it's in 2mm pitch, not the usual 2.54mm pitch most JTAG adapters can attach to per default. You can either solder a 2mm pinheader if you have a proper cable, or build a small converter PCB to 2.54mm pitch, or abuse an old IDE cable (like I did) to solder your own 20pin 2.54mm pitch adapter directly to the PCB. This allows you to attach any standard JTAG adapter easily.

OpenOCD config

(This has been sent upstream and should be obsolete soon)

Copy this file into OpenOCD's board directory (in the OpenOCD install location).

$ cat voltcraft_dso-3062c.cfg
#
# Voltcraft DSO-3062C digital oscilloscope (uses a Samsung S3C2440)
#
# http://www.eevblog.com/forum/general-chat/hantek-tekway-dso-hack-get-200mhz-bw-for-free/
# http://www.mikrocontroller.net/topic/249628
# http://elinux.org/Das_Oszi
# http://randomprojects.org/wiki/Voltcraft_DSO-3062C
#

# Enable this if your JTAG adapter supports multiple transports (JTAG or SWD).
# Otherwise comment it out, as it will cause an OpenOCD error.
### transport select jtag

source [find target/samsung_s3c2440.cfg]

adapter_khz 16000

# Samsung K9F1208U0C NAND flash chip (64MiB, 3.3V, 8-bit)
nand device $_CHIPNAME.nand s3c2440 $_TARGETNAME

# arm7_9 fast_memory_access enable
# arm7_9 dcc_downloads enable

init
reset
halt
scan_chain
targets
nand probe 0
nand list

# TODO: RAM init etc. later for U-Boot/Kernel usage (probably based on mini2440.cfg).

Starting OpenOCD

I'm using a Floss-JTAG adapter here, replace flossjtag-noeeprom.cfg with the config file for your adapter.

$ openocd -f interface/flossjtag-noeeprom.cfg -f board/voltcraft_dso-3062c.cfg
Open On-Chip Debugger 0.6.0-dev-00493-gd40cb56 (2012-04-01-02:14)
Licensed under GNU GPL v2
For bug reports, read
        http://openocd.sourceforge.net/doc/doxygen/bugs.html
Info : only one transport option; autoselect 'jtag'
trst_and_srst separate srst_gates_jtag trst_push_pull srst_open_drain
12000 kHz
Info : max TCK change to: 30000 kHz
Info : clock speed 10000 kHz
Info : JTAG tap: s3c2440.cpu tap/device found: 0x0032409d (mfg: 0x04e, part: 0x0324, ver: 0x0)
Info : Embedded ICE version 2
Info : s3c2440.cpu: hardware has 2 breakpoint/watchpoint units
target state: halted
target halted in ARM state due to debug-request, current mode: Supervisor
cpsr: 0x200000d3 pc: 0x00000480
MMU: disabled, D-Cache: disabled, I-Cache: disabled

Using OpenOCD

In another xterm run:

$ telnet 127.0.0.1 4444

You can now dispatch any OpenOCD commands you want, for example:

> targets
    TargetName         Type       Endian TapName            State       
--  ------------------ ---------- ------ ------------------ ------------
 0* s3c2440.cpu        arm920t    little s3c2440.cpu        halted

> scan_chain
   TapName             Enabled  IdCode     Expected   IrLen IrCap IrMask
-- ------------------- -------- ---------- ---------- ----- ----- ------
 0 s3c2440.cpu            Y     0x0032409d 0x0032409d     4 0x01  0x0f

> nand probe 0
NAND flash device 'NAND 64MiB 3.3V 8-bit (unknown)' found

> nand list
#0: NAND 64MiB 3.3V 8-bit (unknown) pagesize: 512, buswidth: 8,
        blocksize: 16384, blocks: 4096

Dumping the NAND flash

You can dump the full NAND flash contents to a file using JTAG, however this seems to take many hours. It probably depends a lot on the JTAG adapter used, and maybe there's something wrong in my setup which causes the slowness, this will be investigated later.

> init_2440
> nand dump 0 voltcraft_dso-3062c_nand_dump_normal.dd 0 0x4000000
Info : s3c2440_read_block_data: reading data: 0xfae650, 0xfeae80, 512
[...]
Info : s3c2440_read_block_data: reading data: 0xfae650, 0xfeae80, 512
dumped 67108864 bytes in 35135.664062s (1.865 KiB/s)

You can also dump the full NAND flash chip contents including the OOB data:

> init_2440
> nand dump 0 voltcraft_dso-3062c_nand_dump_oob_raw.dd 0 0x4000000 oob_raw
[...]
dumped 69206016 bytes in 36184.039062s (1.868 KiB/s)

JTAG (for FPGA)

TODO.

JTAG (for CPLD)

TODO.

vivi bootloader

System info

See Voltcraft_DSO-3062C/Sysinfo#vivi_bootloader.

Loading a Linux kernel into SDRAM via XMODEM

Tekway> load ram 0x30008000 2366848 x

Then, in minicom on the host, press CTRL-a z, then press s, select xmodem, and select the file you want to transfer (a zImage in this case). In this example 0x30008000 is the (RAM) location where the file should be stored and 2366848 is the size of the file.

Executing a Linux kernel from RAM

Tekway> go 0x30008000
go to 0x30008000
  argument 0 = 0x00000000
  argument 1 = 0x00000000
  argument 2 = 0x00000000
  argument 3 = 0x00000000
Uncompressing Linux... done, booting the kernel.
[...]

Building buildroot and an arm-linux cross toolchain

TODO.

Building a Linux kernel

Download and extract the latest release of the mainline Linux kernel:

$ wget https://www.kernel.org/pub/linux/kernel/v3.0/linux-3.3.1.tar.bz2
$ tar xfvj linux-3.3.1.tar.bz2
$ cd linux-3.3.1

Configure the kernel:

$ make ARCH=arm menuconfig

TODO: Describe config options to use.

Build the kernel:

$ export PATH=$PATH:$HOME/buildroot-git-eabi/output/host/usr/bin
$ make ARCH=arm CROSS_COMPILE=arm-linux- uImage
[...]
  LD      arch/arm/boot/compressed/vmlinux
  OBJCOPY arch/arm/boot/zImage
  Kernel: arch/arm/boot/zImage is ready
  UIMAGE  arch/arm/boot/uImage
Image Name:   Linux-3.3.1
Created:      Thu Apr  5 00:31:52 2012
Image Type:   ARM Linux Kernel Image (uncompressed)
Data Size:    2366848 Bytes = 2311.38 kB = 2.26 MB
Load Address: 30008000
Entry Point:  30008000
  Image arch/arm/boot/uImage is ready

You'll get an arch/arm/boot/uImage file (for use with the U-Boot bootloader) and also the "traditional" arch/arm/boot/zImage' file (e.g. for use with the vivi bootloader).

Building U-Boot

TODO.

Building Barebox

Note: This is work in progress!

Add the bin directory (where the toolchain you built above resides) to your $PATH:

$ export PATH=$PATH:~/buildroot-git/output/host/usr/bin

Get the Barebox source code via git:

$ git clone git://git.pengutronix.de/git/barebox.git
$ cd barebox

Configure Barebox:

$ make ARCH=arm menuconfig

You have to select a few important options, the other ones are optional and you can configure them as you see fit.

  • ARM system type (Samsung S3C2410, S3C2412, S3C2413, S3C2440, S3C2442, S3C2443)
  • S3C24xx Board Type (Mini 2440) (for now)
  • ...

Build Barebox:

$ make ARCH=arm CROSS_COMPILE=arm-linux-
LD      barebox
SYSMAP  System.map
OBJCOPY barebox.bin
CHKSIZE barebox.bin

Running Barebox from RAM

In OpenOCD run:

> init_2440
> load_image barebox.bin 0x31fc0000
95984 bytes written at address 0x31fc0000
downloaded 95984 bytes in 3.942175s (23.777 KiB/s)
> resume 0x31fc0000

On UART you will see something like this (for now):

barebox 2012.03.0-00113-g96a43ca (Apr  1 2012 - 23:34:21)

Board: Mini 2440
NAND device: Manufacturer ID: 0xec, Chip ID: 0x76 (Samsung NAND 64MiB 3,3V 8-bi)
Bad block table not found for chip 0
Bad block table not found for chip 0
Scanning device for bad blocks
Bad block table written to 0x03ffc000, version 0x01
Bad block table written to 0x03ff8000, version 0x01
refclk:    12000 kHz
mpll:     405000 kHz
upll:      48000 kHz
fclk:     405000 kHz
hclk:     101250 kHz
pclk:      50625 kHz
SDRAM1:   CL4@101MHz
SDRAM2:   CL4@101MHz
Malloc space: 0x31bc0000 -> 0x31fbffff (size  4 MB)
Stack space : 0x31bb8000 -> 0x31bc0000 (size 32 kB)
envfs: wrong magic on /dev/env0
no valid environment found on /dev/env0. Using default environment
running /env/bin/init...
not found
barebox:/

Resources