• Xilinx Embedded Development Kit 8.1
• Xilinx ISE 8.1
• Xilinx USB Cable Driver and
• crosstool-ng-1.6.1

on my Debian Squeeze Linux with 2.6.37.3 Kernel. I ran in some ugly linux typical problems, from these i want to show my solutions, to safe me and other people time for the next installation.

But first, some links to tutorials and projects that will help you to syntesize, build, install and use your FPGA linux on a XUPv2 Pro board with the use of one PowerPC core.

• [1] Xilinx Download Center, for EDK,ISE and Service Packs
• [2] XUPV2P demo projects and Base System Builder
• [3] The best tutorial for running Linux on a FPGA i ever seen
• [4] A shortened copy&paste of this tutorial
• [5] Xilinx USB Cable Driver & [6] Installation tutorial (german)
• [7] Programming tutorials for XUPv2

I installed all the Xilinx things in /opt/xilinx/ , maybee you must change some paths to your paths.

Problem 1:

You have created a new project in EDK with the Base System Builder Wizard, but when you try to synthesize it, all runs perfect, but finally you get a "Build Failed" without any explaination.

Solution: Its a upper/lower case problem in the code. Simply install Xilinx ISE 8.1 SP3.

Problem 2:

You want to build the test applications generated from Base System Builder Wizard and got a error like "Can't find gmake".

Solution: ln -s /usr/bin/make /usr/bin/gmake should help.

Problem 3:

You run into problems when you want to install the Jungo USB Driver for the Xilinx USB Cable.

Solution: The Jungo driver doesn't works with Kernel >2.6.18. Use the open source cable driver linked above[5].

Problem 4:

You tried this driver and he doesn't found your cable.

Solution: Maybee you forgot to install the new cable firmware. Follow the instructions from [6](see Firmware). If this not helps, maybee you've a different udev version. Try to use this code here for you /etc/udev/rules.d/xusbdfwu.rules :

iATTRS{idVendor}=="03fd", ATTRS{idProduct}=="0008", SYMLINK+="windrvr6"
SUBSYSTEMS=="usb", ACTION=="add", ATTRS{idVendor}=="03fd",ATTRS{idProduct}=="0007", RUN+="/sbin/fxload -v -t fx2 -I /usr/share/xusbdfwu.hex -D $tempnode"
SUBSYSTEMS=="usb", ACTION=="add", ATTRS{idVendor}=="03fd",ATTRS{idProduct}=="0009", RUN+="/sbin/fxload -v -t fx2 -I /usr/share/xusbdfwu.hex -D $tempnode"
SUBSYSTEMS=="usb", ACTION=="add", ATTRS{idVendor}=="03fd",ATTRS{idProduct}=="000b", RUN+="/sbin/fxload -v -t fx2 -I /usr/share/xusbdfwu.hex -D $tempnode"
SUBSYSTEMS=="usb", ACTION=="add", ATTRS{idVendor}=="03fd",ATTRS{idProduct}=="000d", RUN+="/sbin/fxload -v -t fx2 -I /usr/share/xusbdfwu.hex -D $tempnode"
SUBSYSTEMS=="usb", ACTION=="add", ATTRS{idVendor}=="03fd",ATTRS{idProduct}=="000f", RUN+="/sbin/fxload -v -t fx2 -I /usr/share/xusbdfwu.hex -D $tempnode"
ACTION=="add", SUBSYSTEMS=="usb", ATTRS{idVendor}=="03fd", MODE="666"

Problem 5:

You started impact, tried to initialize the JTAG chain, and impact needed 10 minutes to update the programmer firmware. Then you tried again and got some dynamic linker error messages.

Solution: Maybee you messed up your environment variables. Try first to restart your shell, then maybee the hole system, before you dig deeper in your linux.

Problem 6:

crosstool-ng stops by downloading a file. Mostly one of the debugger-packs.

Solution: Download the tarball manually and copy it to the path where crosstool-ng saves the tarballs.
On my system, this path was "/opt/crosstool-ng-1.6.1/.build/tarballs/".You can download the debugger files here: gdb, duma

Problem 7:

Compiling TestApp_Memory drops the following lines:

./ppc405_0/lib//libxil.a(xil_printf.o)(.text+0x58)

Problem 8:

Compiling the kernel ends with:

DTC: dts->dtb  on file "arch/powerpc/boot/dts/virtex405-mine.dts"
ERROR (duplicate_label): Duplicate label 'DDR_512MB_64Mx64_rank2_row13_col10_cl2_5' on /memory@10000000 and /memory@0
ERROR: Input tree has errors, aborting (use -f to force output)
make[1]: *** [arch/powerpc/boot/virtex405-mine.dtb] Error 2
make: *** [simpleImage.virtex405-mine] Error 2

Solution: Simply delete the lines:

        DDR_512MB_64Mx64_rank2_row13_col10_cl2_5: memory@10000000 {
                device_type = "memory";
                reg = < 0x10000000 0x10000000 >;
        } ;

from your "arch/powerpc/boot/dts/virtex405-mine.dts".

Problem 9:

You try to load a reference design from the xilinx website with EDK newer than 7.1 and get the following error:

Reving up design to EDK 8.1...ERROR:MDT - Unrecoverable error(s) were encountered while updating your project

Solution: This problem happens because of the a hardcoded libname. In my case, I missed libdb-4.1.so. I symlinked a newer version with:

ln -s /usr/lib/libdb-4.2.so /usr/lib/libdb-4.1.so

and all worked like a charm.

to be continued...

Features

• Blogging software specialized for low frequency blogging
• Simple CMS functions
• Included WYSIWYG Editor
• Full configurable over templates
• Resource-Efficient
• No need for SQL-Server because using SQLite
• Logging and statistic functions
• Not used any framework, to make the source as small and simple as possible
• GPL v2 licensed

Integrated Software

• TinyMCE
• TinyMCE picture plugin
• phpLiteAdmin
• accesslogger

Todo

• Limit displayed articles
• Function to delete files from the server
• Some more statistic things
• Show changes in menu without delay
• Add possibility to comment articles
• Human readable date in article editor

Source Code

You will find it on my github site or checkout the recent version with

git clone git://github.com/krater/tichyblog.git

Some time ago, I managed it to start my own software on a Rigol scope. I wrote some lines of code and manually patched the firmware at the right place to start it at the right time. It was hard and time-consuming to develop software in this way, because you have to flash the firmware again and again and again until it works as it should. The fear that your next manual manipulated firmware update will brick your device was always there.

This can't be the way for the masses, either for a big open source community...

To solve this problem, I developed a toolchain that makes it possible to build your own software, link it against the installed firmware, upload and start it in the normal operation of the oscilloscope. Its just need one time to flash a patched firmware that enhances the serial interfaces with some read/write and call functions.

I started a wiki to collect all the work thats done on the Rigol devices with focus to reverse engineering and homebrew programming. You will find it at http://rigolwiki.codenaschen.de. There is the source code of the toolchain and some little installation howto's.

To show you a little example of what's actually possible with the toolchain, I recorded this little video...

I advise you to don't try it at any other version, maybee it could destroy your scope!

Secret 1: Recovering the Key Lock Code and Unlocking

If you locked your Rigol with the key lock function from the utilities menu and forgot the code, you can simply type the command

:info:keys? (alt+numblock 0+numblock 1+numblock 0)

to the serial console of your scope. As result you get the six digit code to unlock it.

Secret 2: Lock and Unlock AUTO-Key

You can lock and unlock the AUTO-Key by putting a file with the name AUTO_KEY_Lock&Unlock.RGL to your USB stick and plug it in your Rigol DS1xxx scope. The file consists of the text
RigolTechnologies,Inc.2005Ds1000.Theprogramemadebygongguiqiang,huangzhenandzhaocaiyun.
bytewise xor'ed with 0x19. I don't know why this function exists, but i suppose a development function or a little easter egg.

If you want to try it out, you can download the file here.

Secret 3: Key Combinations

If you want more infos about firmware and hardware version, you can type

CH1,CH1,CH2,CH2,MATH

at the Utility->System Information. Another combination is

TRIGGER MENU,ACQUIRE,ACQUIRE,UTILITY,MEASURE,STORAGE,CURSOR,CH1,CH1,REF,TRIGGER MENU

at the same screen. What happens is.....nothing.....
Okay, not really nothing, it happens the same as when you send :info:systemservice on to the serial console, but i seen no difference between systemservice on or off. Maybee someone else knows more (?)

I found a third key combination but i don't know from where you must use it. I don't know what it does, so maybee you should be careful.

50%,STORAGE,DISPLAY,MEASURE,CH1,REF,MATH,AUTO

I reverse engineered some pieces of the firmware and replaced the code thats used to execute the ":FFT" console command with my own "Hello World!". Flashed this new firmware to the scope and started it with the serial console.

It's only a few lines of code:

Next step is to find a free position in the RAM to upload and execute homebrew software over the serial port.

Later, i found out that it's a nice tool to open some disabled functions from stupid programmed shareware tools ;D
I don't want that this nice tool will rot away some more years on my harddisc. So here is the source for it.

Grab it from my github site or checkout the recent version with

git clone git://github.com/krater/WindowBuster.git

Attention ! It's pre Alpha ! I only did play around with the possibilities. It was never planned as productive software. Press the wrong button to the wrong time and it will crash.

Have Fun !

Source Code

Grab it from my github site or checkout the recent version with

git clone git://github.com/krater/logaccess.git

Usage

Add the lines:

include "logaccess.php"; 
logaccess::log([logfile],[event]);

to your index.php or any other file from where the access shall be logged. Replace [logfile] with a filename like "access.log" and [event] with a number to distinguish between different events. The most people simply can insert 1. Do not use 0. This should then look like this:

logaccess::log("access.log",1);

Add the lines:

 .bar {
 background-color:#738f14;
 border:1px solid #839f24;
 line-height:14px;
 }

 .barlabel {
 margin:-16px 0 0 0;
 line-height:16px;
 white-space:pre;
 vertical-align: middle;
 }

to your CSS file and change the colors for your need. Now your Website has logging support. To show the logged informations, you can use this functions:

logaccess::display_requests([logfile],[event],[starttime],[endtime];
logaccess::display_referers([logfile],[event],[displayfull],[starttime],[endtime]);
logaccess::display_useragents([logfile],[event],[starttime],[endtime]);
logaccess::display_systems([logfile],[event],[starttime],[endtime]);
logaccess::display_hosts([logfile],[event],[starttime],[endtime]);

Remember to include the logaccess.php in your file.

Preview

When all things are working, it could look like this:

A firmware image was found fastly, but to find a Blackfin disassembler was a real problem. The only one i found was objdump from the Blackfin toolchain. Because i don't want to struggle myself by grepping through a huge textfile, i had to write my own disassembler.

Because IDA Pro from hexworks is one of the best reverse engineering tools on the market, i decided to write a processor plugin for it. My plugin is based upon the 'Simply Python Byte Code Module' from Chris Eagle and the Blackfin disassemler part of libopcodes.

Update: In the meantime there exists a possibility to downgrade the oscilloscope and patch it, but i didn't tried it yet.

Features

• Disassemble Blackfin instructions...obviously...
• Syntax highlighting
• Code-/Data- references
• Memory Mapped Register adresses for ADSP-BF53x/ADSP-BF56x

Todos and Known Bugs

• Function frame sizes are sometimes wrong
• Add known function starts/ends
• Some coloring problems
• LOOP references missing
• Offset references missing
• Add DMA registers for BF561

Source Code

You can find the source code on my github site.
You can checkout the recent code with

git clone git://github.com/krater/Blackfin-IDA-Pro-Plugin.git

or download the tarball direct over https://github.com/krater/Blackfin-IDA-Pro-Plugin/tarball/idabfin-1.0

Feel free to contact me for feedback and questions at andreas(at)schulerdev.de.

License

This code is released under the terms of the GNU GENERAL PUBLIC LICENSE Version 2