PfSense on a Celestix S-X MSA 4000


  • Netgate Administrator

    What I would do I were trying to design this…..
    Use a standard keyboard controller IC for the jog wheel and LEDs (num,caps and scroll lock).
    Use a standard USB-serial converter and connect that to a serial LCD.

    You have two USB devices there yes? One is detected as a keyboard already. There are programs in existence that use keyboard LEDs as indicators, it must be possible to try setting them manually. That should be an easy enough test.
    The other USB device seen as ugen1.2 in the first posts here is probably the serial converter. I would try to recompile the cypress driver to recognise the USB vendor and product IDs used by it. If that works then try various LCDproc settings to talk to the LCD across it.

    Steve

    Edit: I can't find a FreeBSD equivalent but in Ubuntu you can try using the setleds command.



  • Actually it's just a single USB device (combined keyboard and LCD).  The problem is there doesn't seem to be any standard way to interface with displays over HID, so without a working system to sniff it is next to impossible to reverse engineer the protocol they have used on the cypress microprocessor.

    Probably the easiest solution, certainly time wise, would be to replace the microprocessor with something LCDproc does support, such as an FTDI FT232 chip.  This would probably mean losing the jog wheel, though there should be a pin spare for the activity LED at least…



  • On another subject I've been tinkering with different CPUs as the P4 3GHz mine came with by standard isn't the most energy efficient chip, and I know that some of the higher spec MSA boxes come with core 2 duo chips (E6420 I believe).  I've tested the following:

    Core2duo E6420 SLA4T (2.13GHz, 1066 FSB, 4M) - boots but unstable
    Core2duo E6320 SLA4U (1.86MHz, 1066 FSB, 4M) - boots but unstable
    Core2duo E4400 SLA98 (2.00GHz, 800 FSB, 2M) - boots, stable, BIOS reports incorrect speed?

    The E4400 gets reported at the BIOS as 50x10 = 500MHz!  This is also reported in the OS I'm using to test (Ubuntu) but performance suggests it's actually running at the 2GHz.  Doesn't look like it will be possible to run powerd in this sort of state however.  You can set the FSB in the BIOS but this seems to get divided down by 4 for some reason with the E4400.

    Not quite sure why the E6x20 1066 FSB chips aren't stable.  It does take a lot to make them crash, I've been running memtest, mprime torture tests but the 'stress' command seems to reliably kill them given a few cycles.  When they crash the system just halts, no input or output but the display remains frozen, very odd.  The E4400 has been running with both mprime and the odd stress command for several hours now stable and has topped out at a core temp of 66c.  All were tested with known good 2x 1Gb and 2x512Mb PC5300.

    The stress command I have been using is

    stress --cpu 8 --io 4 --vm 2 --vm-bytes 128M --timeout 10s
    

    All these oddities suggest to me a BIOS issue, though I cannot find an update for it (perhaps unsurprisingly, it being a custom motherboard).  If time permits I may try to extract the existing BIOS and see if there is anything that can be unlocked settings wise.



  • I found the datasheets for the display they indicates that the module is using a "NT3881 or equivalent" display driver chip.  on the LCDproc hardware page it indicates that that controller is compatible and supported under the hd44780.

    http://media.digikey.com/pdf/Data Sheets/Varitronix PDFs/MDLS40263-01 Specification.pdf
    http://lcdproc.omnipotent.net/hardware.php3
    http://media.digikey.com/pdf/Data Sheets/Varitronix PDFs/MDL(S)40263.pdf
    http://media.digikey.com/pdf/Data Sheets/Varitronix PDFs/Varitronix LCD Initialization Instructions.pdf


  • Netgate Administrator

    Controlling the LCD itself is probably not a problem, there are drivers already in LCDproc for various hd44780 modes. The problem is controlling whatever it is connected to. It appears as a single USB device that does the leds and control wheel as well as the LCD.

    Steve



  • Following…



  • Here's the pinout of the LCD module:

    
    +--------------------+    PIN   FUNCTION                                            
    | 02  04  06  08  10 |   +---+ +--------+                                           
    |                    |     01   USB 5v                                              
    | 01  03  05  07  09 |     02   USB D-                                              
    +--------|  |--------+     03   USB D+                                              
                               04   USB GND                                             
       Connector on PCB        05   LED Green (Power)                                   
                               06   LED Red (Fault)                                     
                               07   LED Ambert (Disk)                                   
              ++               08   System Power (short to GND to boot machine)         
    +--------------------+     09   3v                                                  
    | 01  03  05  07  09 |     10   State detect ("System On" -> "System Ready")        
    |                    |                                                              
    | 02  04  06  08  10 |     USB is only enabled when "Ready" state is achieved       
    +--------------------+     When module is outside of system, short pin 10 to any LED
                               to force "Ready" state and USB communication             
      Connector on cable                                                                
    
    


  • If you want to replace the Cavium Nitrox miniPCI card you could go by using a
    Soekris vpn1411 miniPCI card that is supported by pfSense.



  • I have a couple of Celestix boxes with intact stock software. Will be posting USB captures soon, stay tuned…



  • @pkirkovsky:

    I have a couple of Celestix boxes with intact stock software. Will be posting USB captures soon, stay tuned…

    How's this going? I received my MSA 4000 today, put pfSense on it, would like to get the front panel running and help where possible. ;- )
    Also noticed a red LED flashes above the exclamation symbol, does this happen on yours too?



  • I have one of these boxes as well as 2 x RSA Securid boxes (Celestix Scorpio) with the same LCD/jog wheel combo.  It would be nice to have it all working nicely with lcdproc/pfsense.  Nice work so far.  : )

    Following.




  • Netgate Administrator

    Looks like a binary Linux driver they're using. Not much use in pfSense/FreeBSD.

    Steve



  • Ok.  I feel like I've seen a (possibly Windows) driver for this before in searching around the web when I first got the box.

    I think that I still have an in-tact system drive from the original appliance ,and I was able to find the driver details for the display/wheel in Windows, then research it online to find more information.  I didn't know what to do with it once I found it, so I think I've long since deleted whatever it was I found.  But if I found it once, I might possibly be able to find it again.

    I'll have to dig up the drive that has the original Win2K3 install on it and see if I can find the driver info.  If I can find the .inf file would that be of any help?



  • The device is listed in Win2K3 as a Jungo lcd.  The driver is windrvr6.sys.  Googlefu: http://www.jungo.com/st/products/windriver/

    Not sure if that helps or not.  Let me know if I can provide anything else.



  • Oops/

    Celestix S-X MSA 4000 Windows LCD driver info:



    Manufacturer: Varitronix
    Model: MDLS-40263-LV-B-LED
    Product: LCD Character Display Modules
    Character Count x Line: 40 x 2



  • I been doing some research on the same hardware that seems to be used by celestix all across it's product line.

    For now I've been able to fetch some characteristics about the device:

    • It's a composite USB HID device (Keyboard + Alphanumeric LCD pages)
    • It will output 8 fields (1 bit each) when a keyboard event occurs.
    • The input for the LCD is a 88 byte array probably some 8 byte control preamble followed to up to 80 characters (40x2 chars)

    HID table for those interested:

    
    USAGE_PAGE (Generic Desktop Controls)
    USAGE (Keyboard)
    COLLECTION (Application)
      REPORT_ID(1)
      USAGE_PAGE (Keyboard)
      USAGE_MINIMUM(Control Left)
      USAGE_MAXIMUM(GUI Right)
      LOGICAL_MINIMUM(0)
      LOGICAL_MAXIMUM(1)
      REPORT_SIZE(1)
      REPORT_COUNT(8)
      INPUT(Data, Var, Absolute, No Wrap, Linear, Preferred_State, No_Null_Position,Non_Volatile, Bitfield)
      REPORT_SIZE(8)
      REPORT_COUNT(1)
      LOGICAL_MINIMUM(0)
      LOGICAL_MAXIMUM(104)
      USAGE_PAGE (Keyboard)
      USAGE_MINIMUM(0)
      USAGE_MAXIMUM(104)
      INPUT(Data, Array, Absolute, No Wrap, Linear, Preferred_State, No_Null_Position,Non_Volatile, Bitfield)
    END COLLECTION
    USAGE_PAGE (Alphanumeric Display)
    USAGE (Alphanumeric Display)
    COLLECTION (Application)
      REPORT_ID(2)
      USAGE(Display Data)
      LOGICAL_MINIMUM(128)
      LOGICAL_MAXIMUM(127)
      REPORT_SIZE(8)
      REPORT_COUNT(88)
      OUTPUT(Data, Var, Absolute, No Wrap, Linear, Preferred_State, No_Null_Position,Non_Volatile, Bitfield)
    END COLLECTION
    
    

    If any of you have access to binaries (either windows or linux) please let me know because they can be very helpful in decoding the command schema for the LCD operation.



  • Got it working!




  • The alert LED is GPIO. Here's the linux source. Please share back if anyone can get it to work on FreeBSD.

    #include <stdio.h>#include <stdlib.h>#include <sys io.h="">/* for outb() and inb() */

    #define IOADDR 0x50e

    void usage()
    {
        printf("ngled [0|1|2]\n");
        printf("            0 : off  \n");
        printf("            1 : on  \n");
        printf("            2 : blink  \n");
        printf("\nShows status if no command is passed.\n");
        exit(1);
    }

    int main(int argc, char **argv)
    {
      if (iopl(3) < 0) {
            printf("iopl fail\n");
            return;
    }

    if (argc < 2)
    {
      if ( inb(0x51a) == 0x84 ) printf("2\n");
      else if ( inb(IOADDR) == 0x7b ) printf("0\n");
      else printf("1\n");
      return;
    } else if ( argc > 2 ) usage();

    switch (*argv[1])
    {
      case '0':
    /fprintf(stderr, "OFF!!");/
    outb(inb(0x50e)&0x7f,IOADDR);
    outb(0x4,0x51a);
      break;

    case '1':
    /fprintf(stderr, "ON!!");/
    outb(inb(0x51a)&0x7f,0x51a);
    outb(inb(0x50e)|0x80,IOADDR);
    break;
      case '2':
    outb(inb(0x50e)&0x7f,IOADDR);
    outb(inb(0x51a)|0x80,0x51a);
    break;
      default:
    usage();
    }

    return 0;
    }</sys></stdlib.h></stdio.h>



  • @HammyHavoc:

    @pkirkovsky:

    I have a couple of Celestix boxes with intact stock software. Will be posting USB captures soon, stay tuned…

    How's this going? I received my MSA 4000 today, put pfSense on it, would like to get the front panel running and help where possible. ;- )

    Sorry this took so long!

    Here is a ZIP file containing captures of LCD and jogdial activity:
    https://kirkovsky.com/junkbin/celestix.zip

    This activity was captured on the stock Windows system that comes with these boxes. Included in the ZIP is USBLyzer (Windows only AFAIK) format, HTML & CSV export from USBLyzer, and standard pcap USB capture format (should be Wireshark compatible). Hope this helps!

    @HammyHavoc:

    Also noticed a red LED flashes above the exclamation symbol, does this happen on yours too?

    Yes, this happens on mine too. It looks like there's some kind of watchdog function that allows the OS to tell the LCD module not to flash that LED, but if no signal is being sent it flashes constantly.



  • @yeyus:

    If any of you have access to binaries (either windows or linux) please let me know because they can be very helpful in decoding the command schema for the LCD operation.

    I have default/stock system images for both Windows and Linux (recovery partition) of the ScorpioX machines (the Celestix MSA/WSA/etc and certain RSA-branded boxes all share the same base platform).

    The Linux recovery partition has some control binaries and kernel modules (a module for the LCD + jogdial and a module for the alert LED). The Windows side has basically the same setup, but the display/jogdial/LED are all rolled into one driver binary.

    I don't want to widely distribute these due to copyright concerns. PM me for further details.



  • @yeyus:

    Got it working!

    Was this Linux or FreeBSD?

    EDIT: Must be Linux; hidtest-hidraw appears to be a https://github.com/signal11/hidapi utility.  I'm curious what the equivalent FreeBSD approach is - when I looked at LCDProc, the [pfSense] config asked a lot of questions I didn't know!



  • @twisted2k3:

    The alert LED is GPIO. Here's the linux source….

    @stephenw10 - your WGXepc program set GPIO values for the arm/disarm LED on the WG FB boxes, didn't it?  (I don't know much about this….)  Could the program be used in similar way to probe the GPIO for the LCD/Keyboard controls of this device?



  • Here are the kernel modules and utility scripts for the LCD and warning LED from the Linux restore partition on my Celestix device. Running strings suggests that these are under GPL, so I'm putting them here:

    https://kirkovsky.com/junkbin/MSA2000i_ScorpioX.zip



  • Any progress on this? I would love to see it working. Just picked up a wsa-4200, and all that is left is the LCD :)



  • Waiting on this too, would be great if we could get it working.

    Also, anybody know how to make this thing any more quiet? Different fans? Mulling over swapping out the motherboard, just not sure how the daughter board of NICs connects.



  • Has anybody gotten the screens to work under pfSense? I just picked one up, got it installed, and would love for the LCD / Jog to do something other than –------------ SYSTEM READY -------------



  • @yeyus:

    Got it working!

    Hi yeyus,

    Would it be possible to post the code you used to get the display working please?

    Thanks!



  • @twisted2k3:

    The alert LED is GPIO. Here's the linux source. Please share back if anyone can get it to work on FreeBSD.

    Hi twisted2k3,

    How did you determine the IOADDR (base address?) of the GPIO controller?  I am trying to recompile for Linux with an WSA-4200 which has a different motherboard to the MSA…

    Thanks!



  • Sorry to bring back an older thread but did you guys ever get this working?


  • Netgate Administrator

    Yeah so in Linux it is recognised and creates /dev/hidraw0. That doesn't happen in FreeBSD so you would need to address the USB device directly or create some other driver.

    The GPIO LED is probably controllable though.

    Steve



  • I was able to find this out there not sure if it would help:

    https://github.com/camerongray1515/Celestix-Scorpio-X-LCD


  • Netgate Administrator

    Unfortunately it doesn't. It still uses the same Linux driver:

    def lcd_display(message, line=1):
        message = str(message)
        line_selection = "\x00" if line == 1 else "\x01"
        preamble = "\x02\x00\x00{0}\x28\x00\x00\x00".format(line_selection)
        endpad = "\x20"*(40-len(message))
    
        data = preamble + message + endpad
        with open("/dev/hidraw0", "w") as lcd:
    lcd.write(data)
    

    Addresses /dev/hidraw0.

    Interesting that that driver is in VyOS though…. if it's a standard Linux driver we might be able to see some clues.

    Steve



  • dmesg on system yields:

    ukbd0: <vendor 0="" 2="" 0x0cb6="" keyboard="" +="" lcd,="" class="" 0,="" rev="" 1.10="" 1.00,="" addr="">on usbus1</vendor>



  • Looks like there is something testable with the information published this far.

    The Python code shows a sequence of hex codes

    The device is known

    The BSD shell has the printf built-in, and it accepts codes on octal format.

    So, to hexadecimal 0x20 becomes octal \40

    Try something like this:

    printf "\02\00\00\61\50\00\00\00Some Message" > /dev/ukbd0
    

    Try this for line 2:

    printf "\02\00\00\62\50\00\00\00Some Message" > /dev/ukbd0
    


  • So something interesting happened. I rebooted the machine and now dmesg shows:

    ukbd1: <vendor 0="" 2="" 0x0cb6="" keyboard="" +="" lcd,="" class="" 0,="" rev="" 1.10="" 1.00,="" addr="">on usbus1

    This is what I get while running the printf command

    [2.3.5-RELEASE][root@pfSense.geek.local]/: printf "\02\00\00\61\50\00\00\00Some Message" > /dev/ukbd1
    /dev/ukbd1: Device busy.</vendor>


  • Netgate Administrator

    Hmm, that's not good. Changing device names makes it that much harder to work with even we could get it to accept any input.  :-\

    Steve



  • Good reading here:

    https://www.freebsd.org/cgi/man.cgi?query=ukbd&sektion=4

    Seems like we would need that character device. Once it shows as /dev/kbd1, that printf should be directed to it. Worth a try…



  • @fmertz:

    Good reading here:

    https://www.freebsd.org/cgi/man.cgi?query=ukbd&sektion=4

    Seems like we would need that character device. Once it shows as /dev/kbd1, that printf should be directed to it. Worth a try…

    I’m relatively new to pfsense here and have read that. How would I go about compiling that in the kernel and config to test? May need a little guidance here but looks like we’re getting somewhere here!



  • Actually, looking at the Linux device, it suggests it is a raw device. Maybe the character device is not needed.

    Maybe it needs to be initialized read/write:

    exec 3<> /dev/ukbd1