https://github.com/zelea2/rigol_vendor_bin
I've added a native utility program 'nv-mem' which allows you to read/write/compare the FRAM content and
also covers the functionality of 'spi2erase' 'spi2flash' 'spi2fpga' and 'spi2boot' programs.
This should allow easy experimentation and identification of what's stored in the FRAM.
I was about to ask.....
1) what function does the FPGA serve, "what does it do" ? My comment (the value appears to be width to flash and not an actual address in the flash mem, the micron NOR flash notes suggest it must be flashed to nearest 256k, and the bin file is very close to 4M, so the tool will err if the value is less than 0x400000)
Can you breakdown what these commands do
2) spi2flash /rigol/FPGA/BOOT.ini 0x400000
3) spi2boot 0x000000
4) spi2boot 0x400000
I assume spi2flash talks to the flash mem addressable on SPI bus via /dev/spidev1.0 character device, and spi2boot talks to FPGA on SPI bus via same chacaretr device (as seen in ghidra)?
Here's an observation on my non-updated 804, came with FW 00.01.02.00.00
The GEL update script "do_extract.sh" will flash BOOT.bin (
only this one file) to "${fpga_download_addr}" , and it will do a "setprop persist.rigol.fpga.boot.addr ${fpga_download_addr}", that variable is set to 0x400000
fpga_download_addr=0x400000
fpga_fw=/rigol/FPGA/BOOT.binNow, on my non-updated 804, that property in Android is set to 0x000000, and it is this value that is used in the "start_rigol_app.sh" script using the spi2boot command.
Also odd, the reload_fpga.sh script uses 0x000000 as the default download address used by spi2flash, if you pass "--default" as arg 1, but this script has syntax $1 or $1 and $2. This script also uses flash file "BOOT.bit"
If you try and flash to 0x000000 the spi2fash throws err
This script does not appear to be used during a GEL update. I also find commented reference to "ds7000".
#build_out=DS70000Update.GEL, so maybe the reload_fpga.sh is from another platform?
I had also flashed the Test bin to 0x400000, I did not observe any functional diffs after the flashing and spi2boot, or upon reboot of scope.
Also noted: I think Rigol goofed on naming their scripts, "do_extract.sh" actually carries out updating FPGA and APK's, while "do_update.sh" actually carries out unpacking the GEL file.
***********************************************
So, can some of you check the property setting on your scope, and list the value and whether or not you had done a FW GEL update.
getprop persist.rigol.fpga.boot.addr***********************************************
Another side note: I think it was @zelea2 noted the spi2flash binary file makes reference to use one of the spi devices "/dev/spidev1.0" from Android /dev/. Yes, the linux kernel at boot recognizes two "spi" character devices, so probably like normal the binary tools send serial data to the spi character devies to talk to devices on spi bus. Makes sense.