Author Topic: DDCSV1.1 4 Axis controller  (Read 437523 times)

Offline Merlin201314

  • Full Member
  • ***
  • Posts: 121
  • Country: gb
  • London
Re: DDCSV1.1 4 Axis controller
« Reply #150 on: November 16, 2016, 11:05:36 AM »
I was wonder if there is any combination in the keyboard to press at the startup than can boot in some programming mode? :med:
If there is a way, then it is through the internal serial console or jtag. The device also always tries to boot from sd card first. I have not inspected the Mainboard too carefully, but maybe there is a header or even an unpopulated sd slot?

Also we can always try fixing the userland stuff. This would fix most problems except for the bootscreen and the axis configuration (i guess at least).
No SD card connections,  just a jumper and 2 touch connectors on the board,  maybe some sort of testing point, nothing on the other side of the board

Sended by my tapatalk

Offline Benedikt

  • Full Member
  • ***
  • Posts: 200
  • Country: de
Re: DDCSV1.1 4 Axis controller
« Reply #151 on: November 16, 2016, 11:09:22 AM »
i'll have a look now and post some pictures, in the meantime my Probe routine is not working anymore, is the 2nd time that happen, any experience in the matter?
It start probing, but it not sense the touch, the connections are good as before
Hmm thanks for checking the SD slot. I am on the train home so I wasn't able to check myself.

Sorry, i am not using probe at all. Instead I manually probe my workpiece.

Here, Merlin201314, the bootlog again:
Code: [Select]
recode complete!
ÿ

Init RTC....OK

DDR size: 32MB

SD Port0 Booting Fail - No/Bad Card Insert

NAND Booting (XtraROM 2K-page 4 Address Cycle) Success

Clock Skew

 DQSODS 0x1010

 CKDQSDS 0x888800

Code Executes at 0x00900000

Nand Boot Loader entry (20120921).

Get NANDLoader image from block 0x0 ..

Load file length 0x3DB1C0, execute address 0x0

Linux version 2.6.35.4 (root@localhost.localdomain) (gcc version 4.2.1) #241 PREEMPT Sun Mar 6 03:31:38 CST 2016
CPU: ARM926EJ-S [41069265] revision 5 (ARMv5TEJ), cr=00053177
CPU: VIVT data cache, VIVT instruction cache
Machine: W55FA93
Memory policy: ECC disabled, Data cache writeback
CPU type 0x00fa5c30 is W55FA93
w55fa93_external_clock = 12.0 MHz
w55fa93_apll_clock = 72000 KHz
w55fa93_upll_clock = 192000 KHz
w55fa93_system_clock = 192000 KHz
w55fa93_cpu_clock = 192000 KHz
w55fa93_ahb_clock = 96000 KHz
w55fa93_apb_clock = 48000 KHz
Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 8128
Kernel command line: root=/dev/ram0 console=ttyS1,115200n8 rdinit=/sbin/init mem=32M vt.global_cursor_default=0
PID hash table entries: 128 (order: -3, 512 bytes)
Dentry cache hash table entries: 4096 (order: 2, 16384 bytes)
Inode-cache hash table entries: 2048 (order: 1, 8192 bytes)
Memory: 32MB = 32MB total
Memory: 28140k/28140k available, 4628k reserved, 0K highmem
Virtual kernel memory layout:
    vector  : 0xffff0000 - 0xffff1000   (   4 kB)
    fixmap  : 0xfff00000 - 0xfffe0000   ( 896 kB)
    DMA     : 0xff600000 - 0xffe00000   (   8 MB)
    vmalloc : 0xc2800000 - 0xe0000000   ( 472 MB)
    lowmem  : 0xc0000000 - 0xc2000000   (  32 MB)
    modules : 0xbf000000 - 0xc0000000   (  16 MB)
      .init : 0xc0008000 - 0xc0142000   (1256 kB)
      .text : 0xc0142000 - 0xc03bd000   (2540 kB)
      .data : 0xc03be000 - 0xc03db140   ( 117 kB)
Hierarchical RCU implementation.
RCU-based detection of stalled CPUs is disabled.
Verbose stalled-CPUs detection is disabled.
NR_IRQS:32
Console: colour dummy device 80x30
console [ttyS1] enabled
Calibrating delay loop... 95.64 BogoMIPS (lpj=478208)
pid_max: default: 32768 minimum: 301
Mount-cache hash table entries: 512
CPU: Testing write buffer coherency: ok
devtmpfs: initialized
NET: Registered protocol family 16
bio: create slab <bio-0> at 0
SCSI subsystem initialized
usbcore: registered new interface driver usbfs
usbcore: registered new interface driver hub
usbcore: registered new device driver usb
Switching to clocksource w55fa93-timer1
register clock device
w55fa93_edma_init
JFFS2 version 2.2. (NAND) © 2001-2006 Red Hat, Inc.
ROMFS MTD (C) 2007 Red Hat, Inc.
msgmni has been set to 54
alg: No test for stdrng (krng)
io scheduler noop registered (default)
---w55fa93fb_init ----w55fa93 frame buffer init
###########w55fa93 frame buffer probe############
1*** fbi->fb->fix.smem_len = 0x3fc00
REG_LCM_LCDCInt = 0x20000 !!!
Vsync flag is encountered !!!
check_var(var=c1c3a020, info=c1c3a000)
w55fa93fb_set_par !!! =================
Console: switching to colour frame buffer device 60x34
w55fa93 LCD driver has been installed successfully
W55FA93 uart driver has been initialized successfully!
w55fa93-uart0: ttyS0 at MMIO 0xb8008000 (irq = 13) is a W55FA93
w55fa93-uart1: ttyS1 at MMIO 0xb8008100 (irq = 24) is a W55FA93
brd: module loaded
loop: module loaded
MTD nand init !!!
NAND device: Manufacturer ID: 0xad, Chip ID: 0xf1 (Hynix NAND 128MiB 3,3V 8-bit)
chip->ecc.bytes = 0x22 !!!!
Scanning device for bad blocks
Bad eraseblock 0 at 0x000000000000
Bad eraseblock 1 at 0x000000020000
Bad eraseblock 2 at 0x000000040000
Bad eraseblock 3 at 0x000000060000
Creating 2 MTD partitions on "NAND 128MiB 3,3V 8-bit":
0x000000600000-0x000007e00000 : "NAND FS 0"
0x000007e00000-0x000008000000 : "NAND FS 1"
ohci_hcd: USB 1.1 'Open' Host Controller (OHCI) Driver
Init CONFIG_W55FA93_USB_HOST_LIKE_PORT1
ohci_hcd_w55fa93_drv_probe
usb_hcd_w55fa93_probe
get_pll
External clock = 12MHz
NF: 32, NR: 2, NO: 1
PLL is 192   ---
div1 = 1
div0 = 1
div0 = 2
div0 = 3
div0 = 4
Div1 = 0,  Div0 = 3
USBH IP  Reset
CONFIG_W55FA93_USB_HOST_LIKE_PORT1
w55fa93-ohci w55fa93-ohci: Nuvoton W55FA93 OHCI Host Controller
w55fa93-ohci w55fa93-ohci: new USB bus registered, assigned bus number 1
w55fa93-ohci w55fa93-ohci: irq 18, io mem 0xb1009000
ohci_w55fa93_start
hub 1-0:1.0: USB hub found
hub 1-0:1.0: 2 ports detected
USB device plug in
Initializing USB Mass Storage driver...
usbcore: registered new interface driver usb-storage
USB Mass Storage support registered.
<--w55fa93_udc_probe-->
mice: PS/2 mouse device common for all mice
input: W55FA93 TouchScreen as /class/input/input0
input: W55FA93 Keypad as /class/input/input1
W55FA93 keypad driver has been initialized successfully!
usbcore: registered new interface driver usbhid
usbhid: USB HID core driver
Freeing init memory: 1256K
usb 1-1: new full speed USB device using w55fa93-ohci and address 2
jffs2_scan_inode_node(): CRC failed on node at 0x021c57d8: Read 0xffffffff, calculated 0x4f7b911d
input: Telink Wireless Receiver as /class/input/input2
generic-usb 0003:248A:8566.0001: input: USB HID v1.11 Keyboard [Telink Wireless Receiver] on usb-w55fa93-ohci-1/input0
input: Telink Wireless Receiver as /class/input/input3
generic-usb 0003:248A:8566.0002: input: USB HID v1.11 Mouse [Telink Wireless Receiver] on usb-w55fa93-ohci-1/input1
USB device plug in
Empty flash at 0x077341fc ends at 0x07734800
Empty flash at 0x077370cc ends at 0x07737800
jffs2_scan_inode_node(): CRC failed on node at 0x0773afe0: Read 0xffffffff, calculated 0xdf63b2ba
Empty flash at 0x0773b46c ends at 0x0773b800
Empty flash at 0x0773eacc ends at 0x0773f000
w55fa93_gpio_configure()-1,14
w55fa93_gpio_configure()-0,1
w55fa93_gpio_configure()-1,13
w55fa93_gpio_configure()-0,0
w55fa93_gpio_configure()-0,3
w55fa93_gpio_configure()-0,4
w55fa93_gpio_configure()-0,5
w55fa93_gpio_configure()-0,6
w55fa93_gpio_configure()-0,7
w55fa93_gpio_configure()-0,5
w55fa93_gpio_configure()-4,2
w55fa93_gpio_configure()-4,3
w55fa93_gpio_configure()-4,4
w55fa93_gpio_configure()-4,5
w55fa93_gpio_configure()-4,6
w55fa93_gpio_configure()-4,7
w55fa93_gpio_configure()-1,2
w55fa93_gpio_configure()-1,3
w55fa93_gpio_configure()-1,4
w55fa93_gpio_configure()-1,5
w55fa93_gpio_configure()-1,6
w55fa93_gpio_configure()-3,0
w55fa93_gpio_configure()-3,1
w55fa93_gpio_configure()-3,2
w55fa93_gpio_configure()-3,12
w55fa93_gpio_configure()-3,13
w55fa93_gpio_configure()-3,14
w55fa93_gpio_configure()-3,15
motion driver has been initialized successfully!

JFFS2 notice: (291) check_node_data: wrong data CRC in data node at 0x07733c88: read 0x16da4fd0, calculated 0x659bc5b5.




cp: cannot stat '/udisk-sda1/install/*': No such file or directory

Please press Enter to activate this console.

[deleted a few hundred blank new lines here]


set:40000000,io:40001000
GUI_X_InitOS
open /dev/input/mouse1 success,fd is 6
Create thread sucess!
xresis 480
,yresis 272,16,0,0,960
r:11,5,0
g:5,6,0
b:0,5,0
t:0,0,0


recode complete!

Offline Merlin201314

  • Full Member
  • ***
  • Posts: 121
  • Country: gb
  • London
Re: DDCSV1.1 4 Axis controller
« Reply #152 on: November 16, 2016, 11:20:19 AM »
i connected a wireless mouse on the usb port and booted, the controller is reading the mouse in the setting page, as the lines are changing when i press the buttons.
It doesen't make ani sense.....

Offline Benedikt

  • Full Member
  • ***
  • Posts: 200
  • Country: de
Re: DDCSV1.1 4 Axis controller
« Reply #153 on: November 16, 2016, 11:22:50 AM »
i connected a wireless mouse on the usb port and booted, the controller is reading the mouse in the setting page, as the lines are changing when i press the buttons.
It doesen't make ani sense.....
Mouse and keyboard are supported.
The application does not really make any use of them though.
Also inside on the connector there is a secondary usb port.

Offline Merlin201314

  • Full Member
  • ***
  • Posts: 121
  • Country: gb
  • London
Re: DDCSV1.1 4 Axis controller
« Reply #154 on: November 16, 2016, 01:09:28 PM »
Benedikt,
Which program i need to read and modify the "MOTION.OUT" file?
Thanks

Offline Benedikt

  • Full Member
  • ***
  • Posts: 200
  • Country: de
Re: DDCSV1.1 4 Axis controller
« Reply #155 on: November 16, 2016, 01:19:55 PM »
Benedikt,
Which program i need to read and modify the "MOTION.OUT" file?
Thanks
On windows there is a program called notepad++. On linux you can use gedit or nano.
For Mac you can use visual studio code or similar programs.

Offline Merlin201314

  • Full Member
  • ***
  • Posts: 121
  • Country: gb
  • London
Re: DDCSV1.1 4 Axis controller
« Reply #156 on: November 16, 2016, 01:34:45 PM »
I already tried notepad days ago, it just read a nonsense caracters, nothing to modify rather than a fef ascii code which is not what we need

Offline Benedikt

  • Full Member
  • ***
  • Posts: 200
  • Country: de
Re: DDCSV1.1 4 Axis controller
« Reply #157 on: November 16, 2016, 01:39:07 PM »
I already tried notepad days ago, it just read a nonsense caracters, nothing to modify rather than a fef ascii code which is not what we need
https://notepad-plus-plus.org/

If you mean the original file (or the new motion.elf) then you need bless or hxd

Offline Merlin201314

  • Full Member
  • ***
  • Posts: 121
  • Country: gb
  • London
Re: DDCSV1.1 4 Axis controller
« Reply #158 on: November 16, 2016, 01:54:01 PM »
Thanks a lot!!! :beer:

Offline Merlin201314

  • Full Member
  • ***
  • Posts: 121
  • Country: gb
  • London
Re: DDCSV1.1 4 Axis controller
« Reply #159 on: November 16, 2016, 05:34:01 PM »
The splash is resident in the bootloader!!!


I deleted all the files in the nand1/nand2 and the main root, the controller is bricked and it turn on with a persistent splash screen(the original one), nothing more..DEAD!!
Now i am going to try to reload the files from the usb and see what happens :palm:
 :lol:
Good luck Emanuel

Offline Benedikt

  • Full Member
  • ***
  • Posts: 200
  • Country: de
Re: DDCSV1.1 4 Axis controller
« Reply #160 on: November 16, 2016, 05:37:17 PM »
The splash is resident in the bootloader!!!


I deleted all the files in the nand1/nand2 and the main root, the controller is bricked and it turn on with a persistent splash screen(the original one), nothing more..DEAD!!
Now i am going to try to reload the files from the usb and see what happens :palm:
 :lol:
Good luck Emanuel
That's expected to happen. Changing the bootlogo is also possible by altering the command line that is passed to the kernel by the bootloader.
If we knew how the bootloader was called, we could try finding a way in through it.

Just install the full firmware upgrade and everything should work again.
After that, just reinstall the latest mod to get the custom splash screen back.

Offline Merlin201314

  • Full Member
  • ***
  • Posts: 121
  • Country: gb
  • London
Re: DDCSV1.1 4 Axis controller
« Reply #161 on: November 16, 2016, 05:41:08 PM »
Just done, all good as before :med:
The OMIO cnc clearly bought the entire firmware, as they have their own logo on the machines with the same controller
the question is: where they got the boot loader from?

Offline Benedikt

  • Full Member
  • ***
  • Posts: 200
  • Country: de
Re: DDCSV1.1 4 Axis controller
« Reply #162 on: November 16, 2016, 05:42:52 PM »
Just done, all good as before :med:
The OMIO cnc clearly bought the entire firmware, as they have their own logo on the machines with the same controller
the question is: where they got the boot loader from?
I guess the just changed the splash screen. Or the company who made these did that.
It is absolutely trivial to do so, as soon as we have more info on how the controller's bootloader works and which one it is (uboot - probably not, blob, etc.)

Offline Merlin201314

  • Full Member
  • ***
  • Posts: 121
  • Country: gb
  • London
Re: DDCSV1.1 4 Axis controller
« Reply #163 on: November 16, 2016, 05:45:15 PM »
The Digital Dream has shutted down, they no longer exist, maybe someone else took over the project

Offline Merlin201314

  • Full Member
  • ***
  • Posts: 121
  • Country: gb
  • London
Re: DDCSV1.1 4 Axis controller
« Reply #164 on: November 17, 2016, 04:51:15 AM »
My question is:
If without firmware in the nand the bootLogo still working, that mean the image is embedded inside the bootloader no?
Am i wrong?
SO, how they uploaded the Bootloader into the ROM?  by the second usb port? Or they can connect the controller via a debug interface?
Be an ignorant like me is very frustrating :palm:  (some times)

Offline Benedikt

  • Full Member
  • ***
  • Posts: 200
  • Country: de
Re: DDCSV1.1 4 Axis controller
« Reply #165 on: November 17, 2016, 10:17:46 AM »
Can somebody with a 4-axis controller please send me their linuxrc file?

That would be great!
Thanks in advance!

Offline Merlin201314

  • Full Member
  • ***
  • Posts: 121
  • Country: gb
  • London
Re: DDCSV1.1 4 Axis controller
« Reply #166 on: November 17, 2016, 10:30:47 AM »
Mine is the one i downloaded from you, i'm assuming is a 3 axis,  Sorry


Offline BrokenEye

  • Jr. Member
  • **
  • Posts: 30
  • Country: gb
Re: DDCSV1.1 4 Axis controller
« Reply #167 on: November 17, 2016, 11:07:13 AM »
Hi everyone, newbie here, I got myself a DDCSV1.1 box too, the hardware looks spot on , been fiddling about in the filesystem already , looking for the flag that makes a 4 axis system too, has anyone found the config data for the FPGA yet, it may be in there IDK , glad I found this place though  :zap: OOPS
Backup, then Backup the Backup then Backup again

Offline Merlin201314

  • Full Member
  • ***
  • Posts: 121
  • Country: gb
  • London
Re: DDCSV1.1 4 Axis controller
« Reply #168 on: November 17, 2016, 11:12:12 AM »
Welcome,
Benedikt is looking into the firmware, is a hard task, but the guy know what he's doing.
I am thinking about buy another 4 axis and get the firmware from it.....

Offline Benedikt

  • Full Member
  • ***
  • Posts: 200
  • Country: de
Re: DDCSV1.1 4 Axis controller
« Reply #169 on: November 17, 2016, 11:16:35 AM »
Hi everyone, newbie here, I got myself a DDCSV1.1 box too, the hardware looks spot on , been fiddling about in the filesystem already , looking for the flag that makes a 4 axis system too, has anyone found the config data for the FPGA yet, it may be in there IDK , glad I found this place though  :zap: OOPS
Hey there!

It's most likely not in the file system. I guess it is just a check inside the main program (motion.[out|elf]) which disables the A axis commands and hides the A field in the UI.
The driver does not seem to check anything (motiondev.ko) and I personally doubt the busybox is doing anything interesting either. I was going to play wth the bootloader soon and see if it can do anything of interest (e.g. some processor / nand / commandline flags maybe?).
My initial idea was if there is maybe a special file in /mnt/nand1-x but I doubt it.
However nand1-1 seems to be a very interesting place. It is often referenced and some old unused scripts use it as a place for /lib and add a bin folder to $PATH.
The nand1-2 holds config data. It could be a perfect place for a special file. I have not found any interesting string references yet, but maybe a 4 axis owner could have a look inside and tell me what files he finds there.

Offline Benedikt

  • Full Member
  • ***
  • Posts: 200
  • Country: de
Re: DDCSV1.1 4 Axis controller
« Reply #170 on: November 17, 2016, 12:40:43 PM »
Interesting news:

Busybox, the FPGA driver and the main program are 100% the same for both models!
They have just been compared from one 3-axis machine to one 4-axis machine using SHA256 checksums.

So replacing the linuxrc file won't help anything and can't downgrade a machine either.

Offline BrokenEye

  • Jr. Member
  • **
  • Posts: 30
  • Country: gb
Re: DDCSV1.1 4 Axis controller
« Reply #171 on: November 17, 2016, 01:24:36 PM »
Interesting news:

Busybox, the FPGA driver and the main program are 100% the same for both models!
They have just been compared from one 3-axis machine to one 4-axis machine using SHA256 checksums.

So replacing the linuxrc file won't help anything and can't downgrade a machine either.

The plot thickens , there is not another Rom on the other side of the board is there, I haven't been that far yet ?
Backup, then Backup the Backup then Backup again

Offline Benedikt

  • Full Member
  • ***
  • Posts: 200
  • Country: de
Re: DDCSV1.1 4 Axis controller
« Reply #172 on: November 17, 2016, 03:11:15 PM »
I have managed to put it into USB boot mode so it can boot linux from an USB stick.
To do this you have to put a 10KOhm resistor across R91.

CPU datasheet can be found here:
http://www.nuvoton.com/resource-files/N3290xDataSheetrevisionA5.1.pdf (Pinout at 3.4)

Also we have a ridiculus amount of Flash memory: 1 Gigabit (128 MB).
Datasheet here: http://www.hynix.com/product/filedata/fileDownload.do?seq=4176

However it does not seem like the bootloader responds to anything sent over serial, so I fear this is the end of the road (for now from this side).
I have no idea how to get the bootloader to do anything more than to try to boot from USB, there is absolutely no documentation on it and I am not able to get it's source code nor can I actually dump the bootloader. I would not be surprised if it actually resides in a mask rom in the CPU.

I am not going to put uboot on it for a couple of reasons:
   - If I brick the controller I will have to pay another 160€, which I just can't spend atm (or learn to use my JTAG, but then I would still have nothing to copy back)
   - Getting uboot to work will require a lot of work, however somebody else has actually started to work on uboot on this CPU and it might work)
   - Nobody without a JTAG is most likely going to be able to flash uboot. While USB boot is there I have no clue if this would somehow make us able to install uboot from a usb stick. And even then would you have to put a 10KOhm jumper across the two pins.

Now we should focus on finding a way of mounting the flash chip from Linux and getting access to the boot loader configuration from there.
Or we could work on the translations some more.

Any input from you, fellow modders?
« Last Edit: November 17, 2016, 03:59:22 PM by Benedikt M. »

Offline John Stevenson

  • In Memoriam
  • Hero Member
  • *****
  • Posts: 1643
  • Nottingham, England.
Re: DDCSV1.1 4 Axis controller
« Reply #173 on: November 17, 2016, 05:27:34 PM »
I have the so called V2..1 version as sold by Ratn Machine on Ebay.
This one boots up with their screen set on it and it's 4 axis.
I'll copy anything off mine provided that someone tells me in words of one syllable how to and it doesn't stop this one working
John Stevenson

Offline Benedikt

  • Full Member
  • ***
  • Posts: 200
  • Country: de
Re: DDCSV1.1 4 Axis controller
« Reply #174 on: November 17, 2016, 05:44:05 PM »
I have the so called V2..1 version as sold by Ratn Machine on Ebay.
This one boots up with their screen set on it and it's 4 axis.
I'll copy anything off mine provided that someone tells me in words of one syllable how to and it doesn't stop this one working
Thanks a lot. Could you please copy the /mnt/nand1-1/motion.out file please?
This is all that is needed for now because I need to make a little script. Later I would love if you could that script from a USB stick that will copy the other required files.

First, insert the USB stick that came with it or any other FAT32 formatted stick into the controller. Now you need to go to press the button to switch between Pages until you land on the File page for the second time. This is important as there is a glitch with the copying.
Now you need to go to the .. entry and press enter. Now do that until you reach the uppermost level (/) where you won't see the .. entry anymore.
When that's done, you head over to the mnt folder, then to the nand1-1 folder and hover over the motion.out file (just make sure the blue bar is over it). Now press the FRO/SRO button. Then you go to the .. again until you reach the uppermost level again.
Enter the udisk-sda1 folder and now just press 2ND. Now go back to the Main page.
You can now power the controller off and remove the USB. After you have send me the file I will craft you a little "firmware upgrade" that will not do anything but copy a few files I need for further analysis. Thanks a lot in advance for your participation.

This is how the new bootlogo looks like:


And this is the output of the bootloader when bridging the resistor:


I have posted some more pictures in my article over here:
http://bmuessig.eu/posts/ddcsv11-cnc-controller-modding-part-2