FNIRSI-1013D "100MHz" tablet oscilloscope

[iscle]

I'm looking into thirtythreeforty his work for the console to usb, but he only did it for the linux part. He did not remove the bindings to uart0 in u-boot and linux, so it looks like his version still boots on uart0 and for the linux part maybe using both as communication path. His version of u-boot is newer than what we are using now and looks like stuff has moved to other locations, so would have to find the correct files to edit. I will stick to the older version for now.

I did find settings for u-boot to make it use usb as console interface, but not sure if it will work. So will test this first.

I'm working on porting the latest version of u-boot, so that we can always stay updated and not 3 years behind Same goes for the linux kernel, but that is easier since the f1c100s is already on the mainline kernel

[pcprogrammer]

Ok. When finished we have to see how to get it in the repository.

I noticed that my u-boot usb console finished building, so have to test it. Been working on dmitrkov's touch panel config rewrite code in the mean time.

Will update on both soon

Hmm, no success on the USB boot. Still outputs on uart1 for the boot process. It says "starting USB..." and then "No controllers found". Needs more to get it done.

Added:
CONFIG_USB_DEVICE=y
CONFIG_USB_TTY=y
# CONFIG_USBD_HS is not set
CONFIG_SYS_CONSOLE_IS_IN_ENV=y
# CONFIG_USBD_MANUFACTURER
# CONFIG_USBD_PRODUCT_NAME
# CONFIG_USBD_VENDORID
# CONFIG_USBD_PRODUCTID
to the licheepi_nano_defconfig file in the uboot-configs directory. Found this in the uboot readme file. Guess the usb device needs to be added in the board.c or device tree files too.

Another problem of going this route is when to attach a program to the usb device on the host computer. It is not like with the usb to serial adapter where you can have it open in putty or screen and then turn on the target. So if it is going to work will u-boot be delayed until connected or will we loose the u-boot startup al together, and is that bad?

We can't leave it on uart1 since it might mess with the touch panel.

[ser8989]

Write the sketch to the esp8266 or arduino 3,3v. Connect your touchscreen to the board and apply power, the correct configuration will be written to the gt915 registers and the touchscreen should then work normally with the firmware you had it working normally.

[pcprogrammer]

You beat me to the punch

I just uploaded my writer and reader projects for the bluepill.

https://github.com/pecostm32/STM32F103_GT911_Conf_Writer
https://github.com/pecostm32/STM32F103_GT911_Conf_Reader

Tested them with my old panel and the configuration is changed as wanted.

I noticed in your sketch that you used 0x5D for the slave address. It is possible it does not respond to it when it starts up in the other address mode 0x14. I made a fall through on failure in mine to use the other when it fails on the first.

[pcprogrammer]

Forgot the config files for the CS32 chip. Attached here in a zip.

The cs32f1x.cfg needs to be copied to openocd config folder. The other one needs to be in the project folder from where openocd is run.

Use like this
openocd -f CS32F103C8T6.cfg -c init -c targets -c halt -c "flash write_image erase f103_i2c_tp_conf_writer.elf" -c "verify_image f103_i2c_tp_conf_writer.elf"

[pcprogrammer]

Found the problem with my CH341 programmer. Some idiot designer thought it to be a good idea to make a device targeted at 3.3V flash chips with 5V io levels.  That is why I measured 4.1V on the flash VCC.  Modified the device like pointed out here: https://www.chucknemeth.com/usb-devices/ch341a/3v-ch341a-mod and now it seems to be working, at least with a separate W25Q128 device I had lying around.

[pcprogrammer]

Managed to read the flash chips in my scope. For the main flash it is ok to disconnect the scope from the battery and use the power from the programmer. For the FPGA flash it is a different story. First the scope needs to startup. Then connect the programmer (with or without power of the programmer connected) and read the flash. When tried in the same way as the main flash, without the scope powered on it will fail. Cyclone IV documentation did provide some information about in circuit programming and shows the FPGA needs to be powered on. With the programmer connected before poweron, it will not start.

Uploaded the files to the repository. (https://github.com/pecostm32/FNIRSI-1013D-Hack/tree/main/Binaries)

Found that both the files differ from the others in the forum (also in the repository) For the main flash it is only in the bitmap image part. For the FPGA it looks like the bitstream in the new version is not compressed. Maybe tv84 can verify this.

[tv84]

W25Q80_FPGA seems like an FPGA raw dump (attached is conversion to bitmap).

[pcprogrammer]

I found a function in the code that looks like it is for sending the configuration to the touch panel, but it is not called from within the rest of the code
Can't find the filling in of the ram buffer for the configuration either. So bit of a mystery

Code: [Select]

undefined4 FUN_8001794c(void)  //This is the function that sets up the configuration for the touch panel??

{
  char *pcVar1;
  undefined4 uVar2;
  byte bVar3;
  uint uVar4;
  undefined4 in_r3;
  int iVar5;
  undefined4 local_10;
  
  uVar2 = DAT_80017ab4;                        //DAT_80017ab4 = 0x01C20800 (config register of port A)
  local_10 = in_r3;
  FUN_8001764c(DAT_80017ab4,3,1,0);   //Maybe generation of start condition and sending slave address in next part
  FUN_8001764c(uVar2,2,1,0);
  FUN_8001774c(uVar2,3);
  FUN_8001774c(uVar2,2);
  FUN_8001764c(uVar2,0,1);
  FUN_8001764c(uVar2,1,1,0);
  FUN_80017738(uVar2,0);
  FUN_80017738(uVar2,1);
  FUN_8000bc34(100);
  FUN_8001774c(uVar2,1);
  FUN_8000bc34(DAT_80017ab8);
  FUN_8001774c(uVar2,0);
  FUN_8000bc34(DAT_80017abc);
  FUN_8001764c(uVar2,1,0);
  FUN_8000bc34(DAT_80017ac0);
  uVar2 = DAT_80017ac4;
  local_10._0_1_ = 2;
  FUN_80017d2c(DAT_80017ac4,&local_10,1);
  bVar3 = 0;
  uVar4 = 0;
  do {
    pcVar1 = (char *)(DAT_80017ac8 + uVar4);              //There is a buffer at 0x8019CF82 in RAM where it calculates the checksum for the config of the touch panel
    iVar5 = DAT_80017ac8 + uVar4;
    uVar4 = uVar4 + 2 & 0xfffeffff;
    bVar3 = *(char *)(iVar5 + 1) + bVar3 + *pcVar1;
  } while (uVar4 < 0xb8);
  *(byte *)(DAT_80017ac8 + 0xb8) = ~bVar3 + 1;
  FUN_80017d2c(DAT_80017acc,DAT_80017ac8,0xba);          //Function to write data to I2C bus?? (DAT_80017acc = 0x8047, DAT_80017ac8 = 0x8019CF82, 186 bytes)
  FUN_8000bc34(DAT_80017ad0);
  local_10 = (uint)local_10._1_3_ << 8;
  FUN_80017d2c(uVar2,&local_10,1);
  return 0;
}

[alangave]

Hi,
New to this forum and thanks for helping if any idea:
Mine has a strange behavior : when power up, let's say, once a day, it works for a while, then signal is superseeded/mixed by a sine like signal, 25Khz ~20PP

Very strange, I have tested all my probe, both channel, cable between generator and probe etc...

I'm in audio (modular synth), and mainly using this scope for audio signal visualisation, no high frequency.

don't know what to look after inside the scope to fix.
Below, same signal (2 probes from same point), bare square wave: FnIRSI and old Hitachi scope

[pcprogrammer]

Can you open up your scope and do measurements with the other in the analog part to see if the signal is there?
Look at the schematics here: https://github.com/pecostm32/FNIRSI-1013D-Hack/tree/main/Schematics
It is for the new version of the scope, but the analog did not change that much I think.
In the pictures folder in the repository there is also a good picture of the old scope pcb. You can figure out where to measure based on this information.
If it's cause is in the analog part you should see it with your other scope on the output of the opamp. Also check the 2.5V power rail of the opamp and the VRF1 voltage.
The faulty scope says it is 20Vpp but when it is introduced in the opamp section it will be much smaller.

[pcprogrammer]

Not a happy camper
Tried flashing my scopes flash with the CH341 programmer, but did not go that well. Took a long time, and I canceled the process. Reading the flash showed nothing changed, so I thought I need to erase first. That did work. So tried flashing again, this time with verbose on and it showed progress until 54% done. Canceled again. Read the flash and it was not written properly

Tried the FEL way, but the sunxi tools I compiled do not support the flash programming.

So left with kind of a brick for now.

How did any of you out there who flashed the scope did it? (eljot, dmitrkov)

[dmitrkov]

How did any of you out there who flashed the scope did it? (eljot, dmitrkov)

1. I desolder w25q32 from the board
2. using an adapter SOP8-208mil(https://aliexpress.ru/item/32827349954.html?spm=a2g0o.cart.0.0.19233c00EaUwqh&mp=1), I connected the chip to the programmer
3. I used the CH341A Programmer software in windows 10 (settings in the screenshot)
" alt="" class="bbc_img" />
4. Read/Write
5. Solder w25q32 on the board

[pcprogrammer]

Had some idea that you did it like that (de-solder) from one of your posts. Just ordered such an adapter from aliexpress together with 10 w25q32 chips.
I have the same programmer you have, so be aware the io signals might be on 5V (https://www.chucknemeth.com/usb-devices/ch341a/3v-ch341a-mod)

Did modify mine a bit different than he did. Will add some pictures.

I figured I would not need the 5V on the header pins, so I cut the trace on the bottom of the pcb. Then soldered a wire between c3 and the middle pin of the AMS1117 and a wire between the 3.3V and 5V pins.

[pcprogrammer]

Finally found the correct version of sunxi-fel with spi support and tried flashing with it and again failure, so I think my flash is broken.

There are fragments of the code in there but large parts are FF.

It still works with the sd card and can run linux on it, so will continue with that part of the project.

Too bad, because I wanted to test if the function I found is actually the part that sends the touch panel config. To remove it from the code I patched the instruction right after the push function to be the pop function found at the end of the function. Probably has to wait until I get my new flash chips.

[pcprogrammer]

I just had to know.

And I was right. De-soldered the flash chip and connected a w25q128 board I had lying around. Was able to use sunxi-fel to write the flash with my modified image and it worked. Used my stm32 with the GT911_Conf_Writer code to bring the touch panel back to the correct configuration and attached it to the modified scope. I can now use it as it was, except for the missing front glass panel Still have to find a fix for that.

The hacked image file is here:
https://github.com/pecostm32/FNIRSI-1013D-Hack/tree/main/Binaries/Hacked%20files

The function that writes the configuration to the touch panel is bypassed, so the scope writes no configuration anymore.

Updated the readme in the https://github.com/pecostm32/FNIRSI-1013D-Hack/tree/main/Linux/images/fel_boot directory to indicate where the correct sources for the sunxi tools can be found and instructions for writing the flash of the scope.

[ser8989]

You and I did it at the same time, I found this function today too, only I replaced its call with NOP.
I corrected the configuration of the gt915 with the arduino 3.3v (esp8266) sketch I posted earlier.

[pcprogrammer]

Well done
So you found where the function is called from. In the Ghidra analysis it did not show any reference to the function I found, but my mod showed it is being called.
Did you find where the ram buffer is being filled with the configuration bytes?

[ser8989]

Well done
So you found where the function is called from. In the Ghidra analysis it did not show any reference to the function I found, but my mod showed it is being called.
Did you find where the ram buffer is being filled with the configuration bytes?

I couldn't find it.
Let's chat on some messenger or social network. How do I find you?

[ser8989]

I use AsProgrammer for flashing, in my opinion it is better than the standard software ch340.

[pcprogrammer]

The linux console on the USB-OTG seems to be a bit tricky. Still not found a solution.

https://stackoverflow.com/questions/63104542/can-usb-otg-be-used-for-u-boot-and-linux-consoles

Here it says it is possible, but none of the startup messages will be show. So maybe easier to disable u-boot and linux serial console and use the USB_G_Serial only for communicating with linux from a login. The display of the scope can be used to show the messages. For that I have to find how to control the brightness in the FPGA. This kind of research has more my interest than linux kernel work.

[alangave]

Can you open up your scope and do measurements with the other in the analog part to see if the signal is there?
Look at the schematics here: https://github.com/pecostm32/FNIRSI-1013D-Hack/tree/main/Schematics
It is for the new version of the scope, but the analog did not change that much I think.
In the pictures folder in the repository there is also a good picture of the old scope pcb. You can figure out where to measure based on this information.
If it's cause is in the analog part you should see it with your other scope on the output of the opamp. Also check the 2.5V power rail of the opamp and the VRF1 voltage.
The faulty scope says it is 20Vpp but when it is introduced in the opamp section it will be much smaller.

Thank you
I just checked, the signal looks ok ( I mean square wave) till the ADC pin but screen still sowing weird stuff, I'll dig into further tomorrow

[pcprogrammer]

Hmm very strange. Do you have the problem on both channels?

Check the following signals on the ADC's to see what is there. Should be stable DC levels. REFOUT (pin 6), AINA = AINB (pin 3 and 10).

Also check if there is distortion on the 3.3V supply, since the ADC's are powered with it. And take a look at the ADC1_OFFSET and ADC2_OFFSET signals coming from the FPGA.

[dmitrkov]

I'm still waiting for the touchscreen connectors. I decided to download the modified firmware for now. I found out such a feature - the touchscreen does not work at all on the modified firmware (i checked both versions pcprogrammer,ser8989). At first I thought that I broke the touchscreen, but after returning the stock firmware, the touchscreen worked again in reverse.

[pcprogrammer]

Interesting, Maybe the touchscreen initialization to slave address 0x14 is also removed by killing that one function. Not sure how the touchscreen chooses its address when not programmed with the rst and int line. The scope uses address 0x14 to communicate with it. I noticed while making the configuration writer code the touch panel was a bit random in which address it responded on. (0x14 or 0x5D) I did not implement the address select with the rst and int line and left them floating.

Have to investigate the function a bit further and see if I can fix it.