I don’t think my eMMC has anything on it, it appears to be faulty, which is what brought me here in the first place, so I don’t think trying to load anything from the eMMC will work.
At this point though, I was hoping I could reprogram the 25Q03213 with the Black CH341A with one of the firmware ROMs posted here. Is there something else I’m missing that I should need besides the CH341A to at least try it? At this point I don’t have anything else to lose.
Dell must load that SPI some how, I would suspect via the jtag header, so yes, if you can get a CH341A setup and working to read and write the SPI that should work. My though is that if your spi actually has an emmc image in it there is uboot code there, it is just a mater of getting the reset vector in the H8 to read that, may be possible via jtag, may be possible via some of the other jumpers. There is SOME reason dell has the ability to flash the firmimg.d7 into the SPI, so my conclusion is there is also a way to get it to boot from there.
I’ve backed up my SPI with a CH341A. I can program it in-situ back and forth, no issues. The EMMC seems to be very unresponsive. Maybe it just failed at the same time that I updated. I’ve got two chips bought on ebay, but still no shipping indication.
I’m pondering IF I should try to read the EMMC in-place, but I would need to know the how the CPU is connected to it, 1,8V or 3,3V logic - to not burn it. Also, I’m missing a suitable SD card reader so… yea… I’m committed to revive this board, but at what cost? I did order replacement SPI-chips, just in case… The flashes aren’t cheap either. And the whole server is ~200e shipped to my doorstep.
I’ve even seen the amber flashing id light but… didn’t work either. Haven’t been able to boot from SD for that matter.
I am not certain what SPI chip I have, but it is most probably a 25Q03213 as there are patches to the Dell uboot code to specifically add support for that chip. If we need to find alternate chips I can get a list of supported ones out of uboot. I can get a dump of my spi, I have an R620, but from reading this idrac code all Rx20 should be using the same idrac spi and emmc, this code even runs in the blade servers.
Ignore the 0 capacity emmc, IIRC that is a red hearing caused when the emmc is of "high capacity".
Also from looking at the SPI flash map it looks like you could use binwalk on the firmimg.d7 file on a linux machine to extract the uboot.bin file that is inside it and just write that to the start of the spi, and from my reading the code it has some builtin env defaults and other stuff that should kinda rebuild your spi flash. Since you say you can read and write the SPI all you want I would back it up now, incase these is something there to use, run a binwalk on it, see what it finds. Then try getting the uboot.bin that is insdie the firmimg.d7 and put it in the front of SPI.
Forgot to respond to this, no I have not had much time to work on it, I did manage to finish reading through a good chunk of the source code and have some better understandings now.
Also I am glad your able to read/write the SPI with a ch341, I was worried as I ran into comments in the code that says Dell programs the SPI chip BEFORE putting it on the board, then the emmc is programmed via a tftp. It seems odd to me that anyone does pre-programming of chips in a design that has ISP cabilities and JTAG, but it may be a production rate issue.
I just realized I think I have mixed you and @kur1j up a bit in my last replies.
If you got the SPI reading and writing with the CH341 see my reply to #kurtj, I think you can just stick a uboot.bin extracted using binwalk from the firmimg.d7 file in the front of it and that may get your idrac back to a uboot state.
I would not try to read the emmc in place, and there is no real reason to, everything in the emmc can be replaced easily from what I see, unless they store the idrac enterprise license in there. I would stay focused on getting the SPI working again, as once that is working you should be able to use uboot to backup the emmc.
So how would you determine if the eMMC is actually bad or not? I thought the capacity: 0 seemed to indicate that it was bad but you said it was a red hearing. Unless I missed it in your posts I’m still not quite sure how to determine if I have a bad eMMC. Nothing I write to it works and I get the same response that someone else saw writing to the eMMC. When they replaced the eMMC it seemed to start working.
Granted at this point I’ve got to get my uboot chip working first…still waiting on my programmer from amazon.
At this point I really do not have a "test" solution for the emmc. I cant really mess with mine much until I have a solution that leaves me with an idrac that works at least as good as what I have now, which is one that does boot to linux, but only to the extent that the kernel and initrd load, none of the other file systems come on line. Once I have something better than that working I can then put the emmc at risk, my first thing to try would be to simply erase it. Then use some of the read and write commands to see if I can get data in and out of it. There is actually a fair bit of test built into the uboot "util" command iirc.
So when I initially got my USB-UART working mine got to a linux shell as well, however I could not see any media devices with the df command. I also couldn’t run most of the normal linux commands you would expect. It just gave command not found. I forget exactly which but it was common stuff like cp/mkdir/du/vi
It seems that at least your system is seeing and the card. Mine just seemed completely broken and half there.
Most likely my eMMC is shot. I will verify this in a few weeks when I get my reader. I will also swap the eMMC when the new chip arrives. Yesterday I received my set of SPI-flashes from RS. (MX25L3206EM2I-12G, RS: 914-0637). If you need one, I can send for a few euro/each including shipping (letter) to EU.
So I got my CH341A and can read and write to the 25Q03213 seemingly without a problem. I was able to make a backup of the current ROM and then was able to program the ROMs I found here in this thread (early on page 1 or 2). However, it does not get me back into any type of working state (I get no output on my UART–>USB console). I tried to extract the uBoot image from the firmimg.d7 but it said it was too large (was like 4,219KB, these images that were uploaded are all 4,096).
I’m wondering if my 25Q0313 isn’t working because the ROMs were for other chips?
Edit: holy shit! I’m back in business! I tried this ROM from here (https://mega.nz/folder/Noh0CSII#YJp6qHlHyUPQ0r2Uw04vfA) in this post Dell R720xd iDRAC BIOS recovery and I’m now back into getting the “polling for SD card state change /” and if I short SW2 into the CLI where you can write stuff to memory and run the tftpboot commands! So I’m back to where I was, before I hosed this thing.
Aww crap. So the story is, I’ve got two R720’s here. One has a working iDRAC but CPU1 socket is busted for memory channels 3 and 4. Hence the second, which now has the busted iDRAC. I looked into the FIRST one, and ordered two EMMC’s as it has: KLM4G1EEHM-B101. These are BGA-169. Would you like to venture a guess, if the one with busted iDRAC has the same eMMC? bzzt, no it does NOT! It has a Hynix H26M31001FPR, which in turn is BGA-153. So now to order two of them also…
Search through the thread, someone someplace talked about that the BGA-169 and BGA-153 should be compatible chips, but I can’t seem to find it right now. These are suppose to be JEDEC chips, but I can not get the JEDEC standards as they want $$$$.
Replaced the emmc on one. Lost the enterprise-license. Any idea where it might be located on the old flash? Also, accidentally recovered directly to 2.75.75… which is not really supported. Any ideas how to downgrade to 2.65.65? rollback is not available. I’m not able to interrupt boot from console? or should I be able?
I replaced it with a similar Hynix H26M31001FPR. These are available on eBay as xbox360 slim -replacements, Jotrin or directly from Hynix themselves.
Flashing the SPI with 1.57 (original) did not land me in a iDRAC-console. DAMN. Seems like the only way to downgrade is to (somehow) wipe the EMMC, drop in the original 1.57 to the SPI and THEN recover to 2.65.
D’oh!
Also, if you are able to land in any way that makes it possible to dump the eMMC prior to swapping it, do so. You might be able to recover the XML for enterprise license. I will look into that one dump if it’s present.
If possible, ALWAYS export your enterprise-license. It will vanish, when the eMMC is replaced. Buy an SPI-programmer +clip and READ the SPI-chip. Use 3,3V levels! Make a backup of the binary. Using the CH341a MIGHT cause some problems, as some say it uses 5V for data. And the SPI is just 3,3V (vcc). Not to mention, what the CPU might be (1.8V?).
If you have an enterprise license, and were unable to export it; do the needful. Read the eMMC from the debug BEFORE you remove it. You can do this with dd if you are sent to the linux-terminal. (Dell R720xd iDRAC BIOS recovery (7)): Here’s the pinout for eMMC_dbg and connection to an SD-card reader (as seen on card, pins topside and to the right. 1 on top (chipped corner), 9 lowest): - 1 GND - 2 CLK -> 6 - 3 GND -> 7 - 4 D0 -> 8 - 5 D1 -> 9 - 6 D2 -> 1 - 7 D3 -> 2 - 8 GND - 9 D4 - 10 D5 - 11 GND -> 4 - 12 D6 - 13 D7 - 14 VCC (3,3V!!) -> 5 - 15 CMD -> 3 - 16 GND This will allow you to use a suitable SD/MMC card reader and linux to dump the complete card. Might, or might not work.
I used this method to completely erase the newly swapped EMMC that I accidentally flashed with 2.75.75; - Using cfdisk in linux, I deleted all partitions, and then I ran (replace sdX with your card) ‘dd if=/dev/zero of=/dev/sdX bs=512k’ to wipe it. - Flashed an older, backup to the SPI. - had an SD with firmimg.d7 from 2.65.65 waiting in the vflash-slot Turned on power and voilá! it recovered completely. note! you must nuke the eMMC with zeroes if you wish to recover it. Deleting the partition table is not enough.
Now I just need to find out how to get back those enterprice-licenses WITHOUT changing service tag (tried that, and it works)
Hope this helps someone. All errors regarding emmc not being able to write or similar == faulty emmc and it needs to be replaced. What a pain to remove the motherboard PCB from the backplate.
Edit: The license is located on partition 11, type ext3. Folder rsdsafe/lm.
Congrats! Sounds like you have your system working. I unfortunately tried replacing my eMMC and it seems I ended up pulling some of the pads, or at least that’s what it looks like to me. These things are so damn small I have no idea how you would even start to repair them if even possible.
As a last ditch effort, I did order a NAND flash TSOP package (MT29F32G08CBADBWP-12IT:D TR) just as a hope and a prayer that it would function the same as the eMMC. But I’m highly doubtful. I’m about 99% sure that if I could have swapped the eMMC it would have worked. It kind of stings to feel to be this close and something silly happens like this. But I guess it is what it is.
I’ll report back if the TSOP package works but since someone else here already tried it…i am doubtful.