[Discussion] Firmware Update of the Marvell 91xx SATA Controller

Hi lordkag,

so I#ve executed everything exactly as you adviced but nothing has changed except error message from the 92xx mvf_mag which end in a loop (picture attached). Also I send you a pic of the executed “mvf_mag -h”.
So do you think the chip is corrupted? I found a piece of SPI chip on the controller, looks same like for my MoBo. Maybe there’s a different way to flash the firmware into it?

regards hanson

IMG_0100[1].JPG

IMG_0101[1].JPG

I looked at your pictures, but they are all from the new flasher: mvf_mag 1.0.0.2439 is 91xx and 1.0.0.2470 is new 92xx. From now let’s avoid using “go -x” and type the actual command, also rename the flashers to be used side by side: 1.0.0.2439 is mvf_mag and new is mvf_mag_new. From the old mvf_mag 1.0.0.2439 I needed “mvf_mag image -newImg -r” to test reading from chip and “mvf_mag -h” to see its list of commands. From the new mvf_mag 1.0.0.2470 I needed “mvf_mag_new -did 9120 -raw -off 0 -len 0x80000 -bkup -name bkimg.bin -aid 0 -cs 3 -fs 0 -y”.

Just a quick question. Do you have the original Marvell firmware on the board and does Windows sees it as 1B4B-9120? The Marvell BIOS (probably Ctrl+M during booting) shows the right ID in its screen? I would need a screenshot from Marvell BIOS to see how it is identified.

As you have noticed from the previous tests, the flasher can’t see the chip. You have two paths from here. If you have a way to read the chip (probably a SPI programmer), you could upload the image to see how it is partitioned. The chip is 512KB and the image is 232KB, so some offsets or padding are needed. The second path is to contact Asus support and ask for a new firmware or flasher. Add all the details, like Asus U3S6 with 9120 chip, BSOD with all drivers, current firmware version, screenshot of the error, chip is not detected etc. and send it to contact page, but also here, in forums. Maybe they will press Marvell to release a bugfix of mvf_mag.exe.

I will investigate the code and also search some older flasher. For now, here is one attached. To save you from endless booting, just place them all in bin folder. Run commands like “mvf_old image2 -newImg -w -y”, “mvf_old image3 -newImg -w -y” where first is the flasher, second the image, third is always -newImg, and last are the arguments like in the read_mvf.txt (minus the first “go”). But always start with “mvf_old image -newImg -r” to test the chip for reading.

To summarize:
0. How is the chip detected from Marvell BIOS? A picture is worth a thousand words.
1. If you have SPI programmer use it for reading the chip.
2. Contact Asus with a request for Marvell flash bugfix for U3S6 with 9120 chip.
3. Place the content of the attached file to bin folder and run the following commands, while all other Marvell controllers are disabled and the board U3S6 has nothing connected to it:

cd bin
mvf_mag -h //a screenshot?
mvf_mag image -newImg -r
mvf_mag_new -did 9120 -raw -off 0 -len 0x80000 -bkup -name bkimg.bin -aid 0 -cs 3 -fs 0 -y
mvf_old image -newImg -r
mvf_old image2 -newImg -w -y
mvf_old image3 -newImg -w -y
mvf_old image4 -newImg -w -y

Details: mvf_mag is 1.0.0.2439, mvf_mag_new is 1.0.0.2470, mvf_mag_old is 1.0.0.2418, image2/3/4 are special built images for 9120.

test2.rar (589 KB)

Been reading this thread with a lot of interest - lordkag - any suggestions for the "No Adapter Found" problem when flashing?

I was one of the unlucky who bricked my onboard Marvell 9120 controller by flashing with the wrong firmware which resulted in a Device ID mismatch. I decided I have to flash the SPI chip with an external programmer and bought a bus pirate that I planned to use with flashrom, but I have never figured out how to get flashrom to run with the bus pirate so I gave this endeavor up a long time ago and just moved all the sata devices to the internal intel controller which has worked out just fine. Besides, I keep reading about how bad Marvell sata controllers are compared to the intel controllers - even if the intel controller is sata II versus the Marvell sata III controller.

@ Stress:

Welcome at Win-RAID Forum!
I hope, that lordkag (or someone else) can help you.

Regards
Fernando

@lordkag

Hi again,

sooo… I did as advised but unfortunately without success. The mvf_mag just can’t find the chip. I’ll write a ticket to ASUS but I read in another forum that one guy already did that. ASUS told him that they recommend the use of this PCIe controller only with certain ASUS mainboards. My board was well as the guy’s board are not in the “offivial support list”. So they say we are a minority and they don’t investigate because we don’t fullfill their recommendet system requirements. Anyway I attached the requested screenshots, maybe you find something interesting.

Grateful regards hanson

IMG_0120[1].JPG

IMG_0122[1].JPG

IMG_0123[1].JPG

@hanson

It is too late to write a full reply right now, but if you have a programmer, could you look at this picture where the chip MXxxx with a blue dot is, remove it from socket and read its content then upload it here?

@strees

The same thing, do you see a MX chip around the Marvell controller, can you read the content of it?

The somewhat good news is that I got a dump from a 91xx chip and I think I can rebuild the image to be flashed with a programmer. But first let see if we need a SPI flash or it is as simple as flashing a standard chip with simple DIP8 connection.

Yes I found that SPI yesterday already during checking the chip’s ID. Good news: I already ordered an “EPZ2010” programmer yesterday via ebay. It is sent from China so I don’T know when it will arrive. As soon as I have it here I will dump the u3s6 spi flash…

Regards hanson

@lordkag

There is a Macronix MX25L4005 EEPROM adjacent to the Marvell 9120 chip that I am certain holds the Marvell 9120 firmware. According to a MX25L4005 data sheet, it is a 512Kb SPI EEPROM. It is soldered to the motherboard. I do have a SOIC clip along with a set of probes and the buspirate, I just never got flashrom to “talk” to the buspirate much less flash the MX25L4005, so I gave up. Perhaps this exchange will inspire me to try again, maybe even get some help from either the buspirate folks or the flashrom folks, both of whom seem to have significant experience with both the buspirate and flashrom. I know the firmware now on my MX25L4005 is Marvell 9123 firmware (I forget which version), not 9120 firmware and it rendered the 9120 chip useless.

When I was researching all this I was contacted via email by someone with a similar problem in Russia with a Marvell 9120 (he originally thought it was a 9123) on a X58 motherboard. He reported to me that he took his motherboard out of the computer case and removed the processor, ram and everything else attached to it, took it to a computer shop in his city and they flashed the EEPROM with a 512Kb firmware file for a U3S6. He reported that he reassembled his computer and that the motherboard bios flashed the Marvell 9120 with firmware in the motherboard bios on the first boot and that the Marvell 9120 worked as it did before he flashed it with the wrong firmware as I had done.


@ hanson

I saw the EPZ2010 programmer after I had ordered my buspirate. I believe it uses a socket to flash EEPROM chips that are removed from a board. Did I see where you found you could remove the EEPROM for your ASUS U3S6 without desoldering it? Also, if lordkag doesn’t offer it, I believe that I have a couple of firmware images for the ASUS U3S6 that I downloaded from StationDrivers before they changed their servers.

@Stress

Yes the chip is removable a winbond but I’m not sure. Check today but surely removeable

Hi everyone (I’m new here)

Have been following this thread with real interest and very closely. I have been trying to flash U3S6 MV-9120 for 2 years now without success. Tried also everything suggested here but still that crazy error: No supported flash found

I looked at the Removable Chip near the MV-9120 and in my card it is an EON EN25F40-100QCP. Hope that helps

Thanks for your efforts

@ bertikul:
Welcome at Win-RAID Forum!

I hope, that you will get very soon a solution for your problem (there are already some Forum members working on it here)

Regards
Fernando

@ Fernando

Thank you for welcoming me.
Yes I hope too to find a solution here. Looks like lordkag here is really trying hard to help.

@stress
Yes, I think the same way, that the firmware is located in the chip next to Marvell controller, usually one from MX. The chip needs to be 512K in size, so you have your mark. If you don’t mind me asking a few question which might assist me in pointing some reasonable steps: - what is the mainboard containing the chip; - what is the bus pirate used (might need its own firmware upgrade for speedup); - what was the firmware that broke your chip, was it 2.2.0.1125b or other; - how is the chip seen now from BIOS and Windows, how it responds.

If you are so kind, could you upload all the Marvell firmwares that you have (even dumps) so I can make a good image for the programmer for both of you? The reason for this is that the image for the flasher is different than the one from programmer, a different way of assembling the parts. I already have a procedure, but more samples are even better.

Flashrom seems to fully support your chip, so it is only a matter of connections. The best way is to use a desolder-write-solder process. If it is not possible, remove power from the mainboard, the clamps must have good grip, and the chip must receive power from the bus pirate. The dot or small circle is pin 1, the rest is explained in the datasheet. Make a similar connection with the bus pirate (chip datasheet and bus pirate), but look especially at pin 4 (GND) and pin 8 (VCC 3.3V). Once the connection is established, test from Linux with “flashrom -r immg1.bin -c MX25L4005 -V”, then “flashrom -r immg2.bin -c MX25L4005 -V”, compare the two images to be identical, then you can write one of the images attached. With the bus pirate you might have to run “flashrom -p buspirate_spi:dev=/dev/ttyUSB0 -r immg1.bin -c MX25L4005 -V” to work. Replace USB0 with the port your bus pirate is detected. I will attach some images in an hour or so, for you to test them.

@lordkag

I checked my SPI today and the chip is as well EN25F40-100CP. This may help to build the file or do you need anything else? The flasher I will use is EZP2010…

regards hanson

@hanson

The chip’s manufacturer is only important for the programmer. It is possible that it might not recognize it, if the programmer’s database is rather limited. But this can be tested with a simple read.

For hanson, stress and anyone else with Marvell 9120 and programmer. I have attached some images to be used only with a programmer. I would still need the dump from your chips, to compare some bytes from the end, as it might be possible that the full image has some checks for corruption or unique identifiers. Make this dump first to have a safe backup.

Image1.bin = changed Autoload and BIOS to Device ID 9120
Image2.bin = changed Autoload and BIOS and DSRAM_DATA to Device ID 9120, the signature of the inner firmware image is intact, uses 00 for padding after inner firmware
Image3.bin = changed Autoload and BIOS and DSRAM_DATA to Device ID 9120, the signature of the inner firmware image maybe still intact, but uses FF padding after inner firmware, same as dump
Image4.bin = changed Autoload and BIOS and DSRAM_DATA to Device ID 9120, the signature of the inner firmware image is intact, uses 00 for padding after inner firmware, BIOS changed from 1.0.0.1033 to 1.0.0.1038

Test them in order.

Hanson, if the programmer has some software, use it for storing a backup of the chip, upload one here to check it. If it doesn’t detect anything, we will have to look if flashrom supports the programmer (the chip EN25F40 is supported).

Stress, read the previous message for connections. Use “flashrom -p buspirate_spi:dev=/dev/ttyUSB0 -r imgbk.bin -c MX25L4005 -V” for reading and “flashrom -p buspirate_spi:dev=/dev/ttyUSB0 -w ImageX.bin -c MX25L4005 -V” for writing. Replace ImageX.bin with Image1.bin, Image2.bin and so on.

I must warn you that I have never used flashrom and all the commands from the above can be found online.

Images.rar (456 KB)

Hey lordkag,

thanks a lot for the support!! I also checked the data sheet of my hopefully soon arriving programmer and found my flash supported. I think it should be easy to dump it using the software that comes with it. I will upload everything here in this thread as soon as I have done it :slight_smile:

reagrds hanson

@lordkag

Thanks for your interest in my problem. The mainboard is a ASUS P7P55D-E LX. I planned to use the buspirate as an external EEPROM programmer, but it seems to have lots of other uses as well. The main reason I selected it was because (at the time) it was cheap and there seemed to be a lot of good experience with it flashing SPI EEPROM chips. I did mange to update its firmware (to 6.2 beta I believe). I don’t remember the firmware version that broke the 9120 but it was well before 2.2.0.1125b was issued.

I really don’t want to desolder the EEPROM chip. While I have managed to desolder and resolder a few capacitors on circuit boards, my soldering equipment and skills are much more appropriate for copper pipe joints than EEPROM chip legs and this board is my production computer. I have studied the buspirate connection diagrams and I feel confident that I can make the connections and put voltage on the chip from the buspirate in place on the board using my SOIC clip. My problem is controlling the buspirate with flashrom. I don’t have any experience with Linux or even have a Linux installation. My attempts at running flashrom under DOS and Windows were unsuccessful. I am considering installing Linux on an older backup computer that is currently running Vista x64 (probably in a dual boot configuration) to get some experience with Linux and to use it to compile and run flashrom, but this probably won’t happen very soon.

I am uploading U3S6R0.zip and U3S6R1.zip which I obtained from StationDrivers before the server changes. Ideally I would use a image of firmware 1025 from a P7P55D-E LX to flash to the EEPROM, but that probably is very hard to obtain so I will probably flash the EEPROM with IMAGE_RBasus1025.BIN from U3S6R1.zip.

Again, I’m not in a hurry to try to flash the EEPROM on this board but if and when I do I’ll certainly report my results.

Thanks again.

Oops - lets try again uploading files - I think I got it this time.

U3S6R0.zip (454 KB)

U3S6R1.zip (402 KB)

If you go the Linux way, I would try Wubi, as it was pretty easy the last time I tried it. Give it 10-15GB of space for use, let it install and update its packages, then follow the simple guide from here to install flashrom. Removing Wubi is even simpler than installing and if it breaks your Windows boot, just use this guide. Those 3 lines have saved me more than once.

You could try it again from Windows. Download a snapshot from here, read the first part of this guide. I can assume your bus pirate has already the needed drivers from Windows, so install libusb-win32 only if flashrom asks for it, like missing libusb0.dll. Then it is simply using the command prompt with the commands from the previous post. There is no rush to flash the images right now, but a dump from the chip could be most useful to start assembling a firmware image.

Thanks for the files. I can see why it failed for U3S6 and how to build an image that might even be flashed from DOS. Now I would just need a dump from your chip as well.


Hi lordkag

Any news about the possibility to flash U3S6 from DOS please?

Thanks