Embedded WD Flash

[pcrecovery]

I've been working with several 88i6745 Marvel boards lately. There seem to be numerous differences with these. As you may already know, rom is embedded in this chip. Anyway, on this model, bad programming here on a perfectly good board and drive, and it won't even allow kernel/psv mode access. what to do? You can access the data on drive via hotswap technique which I've done successfully, but you must have an identical match...I've found that even a slight variation and often just a few months and the headmap is different...also, the ROM is 192KB versus 128KB which poses some issues for PCI. Anyway, I am exploring possibility of JTAG programmer for ARM9 cpus...supports many Marvel including this newer 88i6745. Anyone use this? PM or email me if you like.

[BlackST]

That's what I like...

[pcrecovery]

I'm quite familiar with the various methods employed to deal with external ROM. I'm interested in dealing with two scenarios:
1. Marvel 88i6745 (or similar) goes bad. Embedded. You cannot access ROM. Not even Kernel/safe mode will allow reading...
2. GOOD PCB, but corrupt or improper ROM/headmap New drives won't even spin up with incorrect ROM. Nor will you be able to re-write this type. Now what?

I have some knowledge about what can be done, but would like to study two things:

a. the extraction of flash rom contents embedded in Marvel. possibilites and methodologies.
b. the use of M25P20 in usual location (which you will see @ U12 as always)

also, is there some way to force to accept/allow uploading of ROM? (e.g., shorting RDY/RSV, etc) I'm experimenting on several my own drives. I've taken a brand new such drive, corrupted ROM, write back, and now drive won't even spin up or enter kernel/safe mode. Cannot write original rom back either. I know that I can write original rom to m25 then solder to usual location, but other changes are certainly needed to tell marvel to use. Email or PM if you are working on similar. NOTE: I'm looking at two different scenarios...one dealing with a bad Marvel with embedded rom, and another with good pcb and drive, but corrupted or wrong/bad ROM.

[shaun]

Interesting job you are doing!
Did you get any useful information on the Marvell so far? The manufacturers site is down for some time now (maintenance, they call it), so I cannot check whether they had anything online which could be of help. I hope you checked before they became unavailable.
Anyway, from my experience with other CPUs I would guess there are configuration options to enable bootstrapping from the external serial flash - pin-strapping is a bit outdated, so there should be a possibilty to do this via JTAG. The mileage of this will of course vary depending on the availability of information on the chip.
The next step would be to extract the ROM contents. What if they are protected - have you thought about a way to defeat this?

[pcrecovery]

Unfortunately I've gotten no information from them... I have two personal projects I am working on. One is a single-platter Scorpio 2.5" and the other is a dual-platter. Both SATA. Both 88i6745. I have about a dozen different models of these... so I am experimenting on a few. On lots of earlier WD models...the drive will still spin-up if you insulate the preamp commutator...in fact, its a good way to see if a bad preamp is causing your drive not to spin up, however, on these, if you insulate these contacts, the drive will NOT spin up. Quite the opposite. Another difference, and the one i'm interested in here, is the embedded flash. I'm interested in all aspects of dealing with it. Both BAD Marvel scenario, AND the good PCB / Marvel but bad/corrupt flash. I am not sure at all how to approach a bad Marvel scenario. Currently, I have a new drive which I backed up rom and modules, etc. I corrupted the ROM, then wrote bad rom back to it. Now verified that drive is inaccessible..in fact, won't even spin up. Now i plan to take the backup of the ROM and program it onto an M25P20 and connect externally...this is easily done..especially since u12 was not abandoned and appears ready to accept. Next, i need to figure out how to make changes to switch to use external rom instead of embedded. For the bad Marvel scenario, however, I've not gotten many ideas except JTAG... many devices (NAND) support boot strapping via an input pin (i.e., called PRE) that puts the device into a sequential read mode...doubt this does, but don't have any technical info on it yet...

[shaun]

Ok, I see, you also suffer from lack of information. On the other side, there are companies (see google) that offer in circuit emulators for the Marvells in question - they should at least have all the information you need. But I doubt they are willing to share anything except their products for money.
Keep up your work, as I will on my latest project - let you all know if I have success.

[dobrevjetser]

Hi Shaun and PCrecovery.

Interesting stuff you are doing.
I would also like to investigate these WD's but for the moment i lack the time.
First doing Seagate stuff.
Please keep posting the progress. As soon as i got some time I'll look into these WD's also.

Best regards,

Dobre

[shaun]

Lack of time is one major problem for all of us I'd guess.
I'm working on an update for the clean bench and on a new hdd solution additionally to daily work - so I know what you're talking about.

[BlackST]

I had no problems buying dev kits or ICE. Yes, everyone wants money,money,money... Try on your own or pay and save a lot of time. :S

[pcrecovery]

Paying and saving lots of time sounds good...since time=money....looking at Lauterbach and couple others' right now...

[BlackST]

Please pm me. We should talk one on one on IM or voice if you wish. I am half way with research and so some other people. Maybe together we win, alone we all lose.

[P Smith]

Unfortunately I've gotten no information from them... I have two personal projects I am working on. One is a single-platter Scorpio 2.5" and the other is a dual-platter. Both SATA. Both 88i6745. I have about a dozen different models of these... so I am experimenting on a few. On lots of earlier WD models...the drive will still spin-up if you insulate the preamp commutator...in fact, its a good way to see if a bad preamp is causing your drive not to spin up, however, on these, if you insulate these contacts, the drive will NOT spin up. Quite the opposite. Another difference, and the one i'm interested in here, is the embedded flash. I'm interested in all aspects of dealing with it. Both BAD Marvel scenario, AND the good PCB / Marvel but bad/corrupt flash. I am not sure at all how to approach a bad Marvel scenario. Currently, I have a new drive which I backed up rom and modules, etc. I corrupted the ROM, then wrote bad rom back to it. Now verified that drive is inaccessible..in fact, won't even spin up. Now i plan to take the backup of the ROM and program it onto an M25P20 and connect externally...this is easily done..especially since u12 was not abandoned and appears ready to accept. Next, i need to figure out how to make changes to switch to use external rom instead of embedded. For the bad Marvel scenario, however, I've not gotten many ideas except JTAG... many devices (NAND) support boot strapping via an input pin (i.e., called PRE) that puts the device into a sequential read mode...doubt this does, but don't have any technical info on it yet...

pcrecovery, could you please share your method ( in details ) of backup those parts of WD disk ?

[scratchy]

also, is there some way to force to accept/allow uploading of ROM? (e.g., shorting RDY/RSV, etc) I'm experimenting on several my own drives.

Is there a pullup resistor near one of the leads or is there one missing?

I saw a photo on here somewhere where I noticed there was a resistor space near ROM and Processor but no resistor. If a pullup resistor was put in here it may change the state of the boot flag.

[Doomer]

Somewhere should be pin (one of the legs of MCU) which you can short and drive supposed to go to kernel (This is my guessing). Sometimes drive goes to kernel by itself (if ROM is blank for example)
In kernel mode drive wouldn't accept any IDE command except for command 92h (that's I know for sure)
And drive will wait a piece of code with special header (no more than 80h sectors in length) which supposed to upload the flash image and write it into the ROM. This piece of code supposed to be written by somebody
Such piece of code might be located in SA too and this module supposed to have string "uCODE" at the beginning (this is my guessing too)

[guru]

I don't have the latest PC3k UDMA but does that not support incorrect PCB swapping with embedded flash?

[pepe]

Hi,

yes, it has some functions I saw, but didn't have a chance to try.

pepe

[Doomer]

This function has nothing to do with fixing unresponsible PCB

[pcrecovery]

I don't have the latest PC3k UDMA but does that not support incorrect PCB swapping with embedded flash?

I saw this update Dec 2008, and I think that this will solve making original and writing to replacement PCB. To me, this implies that they are reading SA area, and using data on SA to make ORIGINAL ROM w/adaptives.

I already know how to repair original PCB when embedded is corrupted or damaged. Sometimes is faster to solder chips than to source or order PCB. WD Marvell ROYL series don't when corrupted or damaged. I solved this problem already, so I know how to fix PCB, but now I like to know how to make original ROM from SA area on WD ROYL. This is strictly an academic exercise at this point.

[cryoborgofthevenus]

Please pm me. We should talk one on one on IM or voice if you wish. I am half way with research and so some other people. Maybe together we win, alone we all lose.

Count me in, I'm more than eager to discuss this matter further.

I am still in progress doing my own research on newer WD drives, and may be we can exchange info about Marvel

[futland]

me toooo

is there any modification in the pcb can be done to deal with external rom