Most of the possibilities are nailed down pretty tightly by the data sheets. A rather modest amount of testing should find the correct FPGA pins without doing anything as drastic as removing the ADC. Unless I missed something, the Zybq 7010 used in the Instek only has 32 GPIOs. The whole point of getting the Zybo was to be able to test FW before loading it to the DSO.
What makes you think that ADC is connected to PS GPIO? I would bet they are connected to PL ...
What makes you think that ADC is connected to PS GPIO? I would bet they are connected to PL ...
That's true. What's the point in using Zynq if you only use PS?
What makes you think that ADC is connected to PS GPIO? I would bet they are connected to PL ...
That's true. What's the point in using Zynq if you only use PS?
I never thought the DSO ADC was connected to the PS. Why on earth would anyone do that or think I suggested that?
Please forgive my having conflated the specs for the Zybo Z7-10 and Z7-20 with the chips themselves. I've been reading a lot of documentation the last few days. But testing 54 PL GPIOs (7010) is not a lot worse than testing 32. Dump all the pins into memory via DMA with a square wave on the DSO inputs and then have the PS look for the pins that change at that rate. I'm sure there are annoying little gotchas, but hardly rocket science. And much easier than removing and reinstalling a BGA. The UI is likely to be a bit more difficult as the front panel and LCD are connected to a Spartan 6. But the ADC traces are easy to identify going to the Zynq. Avoiding stomping on the Spartan bitstream is probably going to take some study. But it might be static.
In any case, the devices in the DSO place rather tight bounds on how the DSO is wired. And I'm sure the ARM cores wouldn't mind testing a few possibilities if one asked them politely.
I found reference to examples for DMA, CDMA and VDMA in Xilinx documentation about the DMA engines which also made clear the distinction among the three. I haven't looked at them yet because I'm still battling Vivado. It should be pretty straightforward once I get Vivado to talk to the Zybo. My first objective is to get the PL to scribble into DRAM as fast as possible. But once I can read and write the Zybo memory I should be able to hook a JTAG to the DSO and read out the FW to a file for safe keeping. I don't want to stomp on the DSO FSBL or SSBL, but it may be necessary, so I want to be sure I can recover if I have to do that.
PS Aside from being able to fix bugs and bad UIs, I want to add features such as computing mean and standard deviation of the trace relative to the trigger and stop the sweep if the trace goes outside of a user specified deviation. Essentially a statistical automask function. To do that one has to be able to change the bitstream itself.
Yes.
BTW there is also a 'Red Pitaya' which IIRC is an open source oscilloscope/data aqcuisition board. That may be a good start as well to look at working examples. IMHO for this project to succeed it shouldn't be started from scratch.
Yes.
BTW there is also a 'Red Pitaya' which IIRC is an open source oscilloscope/data aqcuisition board. That may be a good start as well to look at working examples. IMHO for this project to succeed it shouldn't be started from scratch.
has anyone checked if the PL is secured on the DSO? afair there is no way to reconfigure a PL that has been loaded with encryption except a hardware reset, so you'll have to rebuild the bootloader. It is also possible to require encrypted configuration then the chip is useless without the key
I don't think 50Ms/s scopes have much in common with 2Gs/s scopes, so I doubt the Red Pitaya is of any help.
Well, I'm finally getting moving on this again.
(1) The "Copying Linux from USB to RAM..." in the boot log for the 1104X-E (https://www.eevblog.com/forum/blog/eevblog-1044-siglent_s-$499-sds1104x-e-4ch-oscilloscope-teardown/msg1358858/#msg1358858) looks promising.
(1) The "Copying Linux from USB to RAM..." in the boot log for the 1104X-E (https://www.eevblog.com/forum/blog/eevblog-1044-siglent_s-$499-sds1104x-e-4ch-oscilloscope-teardown/msg1358858/#msg1358858) looks promising.
Getting into Linux should really be first order of business. With any luck they have the whole UI+configuration logic in user space and only handle the ADC high speed data through the FPGA. Then you can just shim their software, only doing something special on a specific key-combo captured by the shim, and reduce the amount of software you have to create to get started. Doesn't solve the reverse engineering of the FPGA part of course, but every little bit helps.
(1) The "Copying Linux from USB to RAM..." in the boot log for the 1104X-E (https://www.eevblog.com/forum/blog/eevblog-1044-siglent_s-$499-sds1104x-e-4ch-oscilloscope-teardown/msg1358858/#msg1358858) looks promising.
Getting into Linux should really be first order of business. With any luck they have the whole UI+configuration logic in user space and only handle the ADC high speed data through the FPGA. Then you can just shim their software, only doing something special on a specific key-combo captured by the shim, and reduce the amount of software you have to create to get started. Doesn't solve the reverse engineering of the FPGA part of course, but every little bit helps.
The UI is just a program running in user space on the Instek and I'd be really surprised if that's not the case for the Siglent. The root passwords are known. So by loading older FW one has full root access.
You've brought up an important point about the UI. I'll need to check if it is using dynamic linking or not. I don't know of a way to "shim" a staticly linked executable. If you do, please enlighten me. That would make it much easier to reverse engineer the front panel interface. I'd assumed putting an LA on the lines from the Zynq to the front panel FPGA which is a Spartan 6 in the Instek.
I have no intention of trying to reverse engineer the FPGA. I'm just going to start from scratch as that is *much* easier. It will also result in a much better UI. So initially this will be an AWG + DSO + LA + SA simulator displaying to a screen under keyboard control. Actually loading it on the scope will be the last step.
I think you have to use the JTAG interface to change the FSBL on the Zynq. At present the FSBL is very simple and doesn't use encryption, so if it is necessary to use the JTAG interface to change the FSBL then my biggest concern is moot.
The Altera may be more challenging as I could not download their software for the DE10-Nano. Everything produced 404s ;-(
My next post will be on the subject of aliasing, impulse responses and minimum phase so that we have a well defined model and terminology. While DSP is done in a lot of fields, the jargon tends to vary a lot.