[Problem] Dell R720xd iDRAC BIOS Recovery

Having some weird results at the moment, long story short still no progress.
I’ve found that leaving the server on with a SD card in that has a firmware, idrac eventually kicks in. I don’t now how functional it is though as when I try to set a manual IP and subnet via the front panel it ends up going unresponsive. If I also go to View the IPv4 address it gives IP Undiscoverable, a google for this doesn’t really show much at all. I’ve currently tried connecting a laptop to the server via LAN to the iDrac directly in a hope that I can scan the 192.168.0 range.

My little experience on my R320 server after a dead eMMC :
New bootloader doesn’t accept firmware debug mode (the idrac7=> prompt) when there’s a short on pin 2.
So
- I Used a simple CH341A programmer to put the firmware of the BMC backwards to a version who accepts the stop with the 2 : this file could be extracted from the firmware firming.d7, search the starting sequence “a0 0c 00 09 9a” in hex and cut the file till the, pad to 4Mb
- The old firmware is overwritten by the one in the corrupt nand => Removing the Emmc with hot air gun.
- Put back old firmware
- Tried to boot from SDCard => it always step back to boot from eMMC … (perhaps something flashed with latest firmware?!)
- Put a new eMMC on the board with hot air gun (not so terrible, need nice cleaning, flux and patience…) put a 8Gb on board…
- Get from TFTP the firming.d7 and restore back the good old firmware … WHO HANGS BECAUSE OF NEW NAND TOO BIG !!
- Put the firmware with the latest from TFTP… wait for while (very long first boot) and … everythings works fine ! (BUT I HAD LOST THE LICENCE !)

Now looking to extract the licence from the old emmc but without luck (4Gb dump and no result inside :-/ ) If someone has a trick for this…

Sorry to be that guy replying to the old thread, but looks like I’m up against similar issues, after soldering up the uart I can see some signs of life:

U-Boot 2009.08 (Feb 21 2020 - 03:41:43) Avocent (0.0.3) EVB

CPU: SH-4A
BOARD: R0P7757LC00xxRL (Cn step) board
BOOT: Secure, HRK generated
DRAM: 240MB
(240MB of 256MB total DRAM is available on U-Boot)
ENV: Using primary env area.
Undefined env fwu_act
Undefined env Failsafe_PowerON_Lockout
Undefined env wdt2cnt
Undefined env wdt0cnt
Undefined env cpld_recover_cnt
Undefined env ddr_recover_cnt
Restore env FWN=0x2f08ab_0xeb03d4d7,0x6696000_0x7f28e0fa,0x6db9c_0xe7389f02,0x139000_0x3746287a
Restore env FWN1=0x26b011_0x4d21804a,0x30fe000_0x40007db7,0x57a48_0x52bacf05,0x43000_0xd1d79848
Restore env etherc0=5C:F9:DD:F1:2A:A3
Restore env getherc0=5C:F9:DD:F1:2A:A4
Restore env first_ac=no
Restore env ethaddr=5C:F9:DD:F1:2A:A3
Restore env eth2addr=5C:F9:DD:F1:2A:A4
Restore env macs_in_res1=yes
Restore env ethact=sh_g_eth.0
Restore env dmn=disabled
In: serial
Out: serial
Err: serial
WDT2: Booted Lower Vector, ‘uboot1’
sh_mmcif: 0, sh-sdhi: 1
Net: sh_eth.0, sh_g_eth.0
INFO: 00:002 Start-up -to- util_idrac_main()
INFO: 00:005 U-Boot 2009.08 (Feb 21 2020 - 03:41:43) Avocent (0.0.3) EVB
INFO: 00:006 U-Boot checkin date(10-04-2018) Version(1.1.34)
INFO: 00:006 iDRAC PPID
INFO: 00:003 SPI NOR init 4096 KiB MX25L3206E bus=0 cs=0, speed=1000000, mode=3
INFO: 00:007 SH-4A Product: Major Ver=0x31 Minor Ver=0x13 C3 Little endian
Family=0x10 Major Ver=0x30 Minor Ver=0x0b
INFO: 00:140 BCM54610 OUI=0x00d897 Model=0x26 Revision=0x0a PhyAddr=1
INFO: 00:007 Dedicated monolithic mgmt NIC disabled
mmc read failed, err=65452
** Can’t read Driver Desriptor Block **
mmc read failed, err=65452
INFO: 00:163 SD CARD: Device: sh-sdhi Manufacturer ID: 3 OEM: 5344
Name: SC16G Tran Speed: 25000000 Rd Blk Len: 512
SD ver 2.0 HC: Yes cap(<2gb): 3046637568 cap(>2gb): 0
ext_rev: 0 rst_n: 0 ext[96]: 0
mmc read failed, err=-84
** Can’t read Driver Desriptor Block **

Then boot loops, not sure if I need to be using a smaller SD card to attempt recovery as this one is 16GB formatted at FAT32, also cant seem to break the boot loop to get any command line access

Hello there:

I have a R720 with a dead eMMC (bravo Dell!). I’m in the process of replacing the module and already contacted to a professional service to do it, but I would like to read the module first to extract the enterprise license and to have a way to know if the new eMMC works when it’s soldered without having to reinstall all the components.

My questions is: Do we need the 9 wires from the SD card? I read that only 1 DAT cable is necessary to do a read (which for me is fine), but more cables adds more speed. All the posts on this thread talks about wiring the nine contacts from the SD card (which is also a problem because the microsd-to-sd adapters only has 9) and it would be convenient to use the less possible amount of wires.

I will post my results after the soldering is done.

Thanks!

Hi there!

Today I were able to extract the enterprise license from the eMMC by using an external reader and soldering the pins. I must say that the schematic posted tby @oh2ftu is wrong, and also that I tried with only DAT0 cable and were not able to read the partition table (the eMMC were detected but unable to read it).

I tried with a trascend card reader (model TS-RDP8K), which I used previously to read a 3DS eMMC, but it wasn’t able to read the memory. I suspect that it has not enough power to power up the memory (the led did not turn on and I measured 1.1V instead 3.3V between vcc and ground). However with an internal reader from a lenovo laptop I were able to read the chip and extract the xml of the license.

Next week I’ll bring the motherboard to a professional service to change the eMMC.

I have another problem trying to solder the new eMMC: we are not able to dissasembly the motherboard from its tray. We removed all the screws (which are a lot of them) but the motherboard seem to be fixed to the tray. Am I missing something? Is there thermal pads between the motherboard and the tray?

I hope that someone can help me.

Thanks!

edit: I were able to remove the board tray by removing all the screws from the cpu sockets. Unfortunately, there was components in the other side of the board, so we were unable to preheat the board.

Just want to thank you for all the valuable info and add my findings. I have a R720 where the iDrac wouldn’t initialize with the amber light blinking. I tried placing firmimg.d7 on the the SD-card in the front but nothing happens.
So I got hold of a few replacement eMMC chips of the same type from eBay, H26M31001FPR. You have to remove the PCB from the backing plate by removing all screws and the CPU frames. No problem preheating the board as long as it’s not too hot and for too long. I used hot air and flux to replace the eMMC, similar to this https://www.youtube.com/watch?v=eDZuS2PZh4I

Now, the same happened again, amber blinking light and nothing more. I connected a FTDI cable to the iDrac UART pins to see the log. It hangs on “sd card did not respond to voltage select” or something similar. I used a 4 GB card here. The log doesn’t show any eMMC related errors. I though maybe the card was too large for the bootloader to be able to ready it, so I formatted the card to 2 GB as I didn’t have a smaller card on hand, using this procedure: https://timescience.wordpress.com/2010/08/09/how-to-downsize-a-4gb-compact-flash-card-to-2gb/

This time it loaded the FW from the card and the light changed to blue!

As I didn’t connect the UART before I replaced the eMMC, I don’t know if the chip or the FW was the problem in the beginning. But if anyone is trying this, it seems the card can’t be too large.

Hello everyone:

I shipped to a professional mobile repair shop my r720 motherboard and they soldered the EMMC. But now I have a problem, I can access normally the memory by using the SD card method by soldering the wires to the header but the idrac recovery says there are problems writing the memory and mmc info 0 shows the “Card did not respond to voltage select!” error.

I read that the bootloader has problems with big SD cards, so maybe could be the same for the eMMC? Maybe it expects some kind of partition table? I tried to replicate the same partition scheme than the original memory but fdisk does not allows me to make the first partition on the first sector, only at sector 2048th.

Is there any dump of a working eMMC? I tried to dump mine prior to the replacement but it was corrupted, I only got the license file. Could anyone share a dump or at least the partition table of a working eMMC?

Thank you!

There shouldn’t be any need to do anything with the emmc, the bootloader will handle the partitioning. Have you tried a smaller SD card? See my post above. I had the same problem untill I tried a 2GB card

Hello there @ketiljo, thank you for your reply!

My problem seems to be with the emmc, not the SD. And it is very strange because I bring to a professional center and they assured me that it was good, and visually it is perfect. They did a reflux on it but I have the same results, and being able to read and write it by the debug port in linux makes it even more weird.

Here is a log: U-Boot 2009.08 (Nov 04 2012 - 19:53:53) Avocent (0.0.3) EVB, Build: jenkins-idra - Pastebin.com

As you can see the I get the error “sh_mmcif: Cmd(d’1) err” as soon as the system boots and mmcinfo 0 returns and error while mmcinfo 1 (for the SD) works fine. Also the command “util recover -emmc -from sd -f firmimg.d7” finds the file without problems but fails to write in the eMMC. I followed your instructions and tried with different cards and capacity, and it seems that for some of them with larger capacities does not work, but the original 8Gb card from dell and another one of 2Gb works without problems after creating a small partition and format it as FAT (not FAT32)

I will try to tftpd the firmware but I don’t think that will work. I would like to try to write a dd image of the eMMC into it and see if that works, but I need an image of the eMMC (from mine I only have the license partition) or a way to do it from the firmimg.d7 file which I don’t know how. Other posibility is that the eMMC that I bought is some kind of ripoff of the original and because of that the software does not recognize it. I bought it from Aliexpress beacuse i could’t find from any european electronics reseller, however linux identifies it as an original and i could’t find any information about the existence of fake hynix emmc chips.

Wonderful topic!
I’ll tell you my horror story!
I have an R430 that corrupted the idrac.
During maintenance I updated the idrac and missed the uboot boot interruption.
When trying to downgrade the SPI I lost the SPI backup file.
I tried to boot from R720 and 420. No success.
I noticed now that the machine stopped booting.
It turns on the electrical part, but it is not giving POST.
My questions, without the SPI it doesn’t really turn on?
Does anyone have or know how to extract the SPI from firming.d7?
Can someone please help?
Thanks!