Donec Facilisis Lacinia

You could try to compile the sources from git…

Fan control has arrived!

kill `pidof wdhws`              # careful with this!
opkg install python python-pip
pip install pyserial ipython==5.2

ipython

Now do this

import serial
ser = serial.Serial('/dev/ttyS2', 9600, timeout=1)

# get status
ser.write('STA\r')
print ser.readline()
STA=6a      >> means all is good

# set fan speed
ser.write('FAN=10\r')
print ser.readline()
ACK

# read fan speed
ser.write('RPM')
print ser.readline()
RPM=01a4     >> this is 420 rpm

# increase fan speed x 4
ser.write('FAN=40\r')
print ser.readline()
ACK

# read fan speed
ser.write('RPM')
print ser.readline()
RPM=0618     >> this is 1560 rpm

I’ll now look into the config values.

When you kill all wdhws, the fan remains in manual config mode and it will not spin faster when temperature becomes too high. That’s why I added a warning for people that live in the desert or on planet Venus.

I digged through the wdhws traces: http://sprunge.us/GfLI
Here is the wdtms trace that triggers some communication on the bus. http://sprunge.us/EBLD

Search for tty, readv(7 and writev(7

I used this cool script in my /etc/profile to upload it: http - How to use pastebin from shell script? - Stack Overflow

You may see this command

i2cget -y 8 0x4c 0x1

This is the temperature sensor, see the post half-way this topic.
Datasheet for the EMC1403: http://www.mouser.com/ds/2/268/20005272A-468064.pdf

wdtms polls the temperature and requests fan status / rpm from the wdhws.

Next step is to branch of lm-sensors and adapt it to this box.

Temperatures are in celcius. See also the fancontrol -g 0 output.
Compare it with polling address 0x00, 0x01 and 0x23.
Address 0x10 is rubbish, I guess it’s a bug. Who cares about the digits behind the comma…

These are fan related commands I see during startup of wdhws.

get config with 'CFG'       --> CFG=02
set config with 'CFG=2'
set DLS with 'DLS=f'     
get version with 'VER'      --> VER=WD BBC v01
get ISR with 'ISR'          --> ISR=00
set IMR with 'IMR=FF'
get status with 'STA'       --> STA=6a
get temperature with 'TMP'  --> TMP=22 ... 34 degrees celcius

Then it sets fan speed and checks RPM + status.

Polling all possible 3 letter fields results in:

BKL=3C
BLK=00
CFG=02
DLB=00
ECH=00
FAN=14
IMR=ff
ISR=00
LED=02
PLS=00
RPM=01fe
STA=6a
TAC=0011
TMP=23   ---> clearly temperature

Then suddenly I got this after sending 'UPD'

========= WDPMC Update Menu v1.0 =============
Reset PMC -------------------------------- 0
Write Image To PMC Internal Flash -------- 1
Read Image From PMC Internal Flash ------- 2
Execute The New Program ------------------ 3
==============================================
Invalid Number ! ==> The number should be either 1, 2 or 3

I guess I bricked something. Be careful not to spam the poor box with unknown commands!

I had a script running for about an hour that tried all 3 letter combinations… I’ll reboot when I get home.

What a relief. When you do a full power down and pulling the power cable, the module is reloaded.
No damage was done :slight_smile:

Honestly I care little about that chip :slight_smile:
ZFS here I come!

hello,now I created an emmc image with the partition table information in your posts.I booted latest firmware in virtualbox but there is no network.
The GRUB bootloader in the WD firmware could not load the linux kernel ,so I used ubuntu GRUB2 and a modified grub.cfg.
The firmware seems working in virtualbox, and I can see serial outputs from the virtualbox,although lots of device not found.i got a root terminal and using ifconfig ican only see the bonding and loopback interface (there should be two more ,egiga0 and egiga1),

so I wonder how to fix the network problem
and contact me if anyone want these virtualbox images

1 Like

Please find a forum, such as the https://forum.doozan.com/read.php?2,34103 link, and keep posting your discoveries. Or start a free Google Blog. Would much like to see your work evolve and get some help. Please post your code collection on github. Thanks for considering.

how do I get this access to my NAS.
firmware recovery in SAFE MODE
Thanks.

My pro4100 is not booting any more, display shows the welcome message but stuck in blinking blue power btn. ethernet port will never go up so theres no connectivity. (BTW I removed all HD from the unit). Tried already all reset procedures with no success. is it possible to share the img of the booting usb so that I can get into recovery? You can imagine that at this point i do have no concern about fan control not working or leds not properly mapped. Just need a valid img which will allow me to boot from usb into recovery to flash the latest firmware. BTW, so far im not having success with UART port, will test later at night…

Here are the rescue files. Put them on a FAT32 formatted USB drive and reinstall the firmware via the rescue wizard in the web interface.

Thanks Tfl, tried but didnt boot. I dont actually see any activity in the USB as if it didnt even tried to read from it. I tested the USB ports and at least they do have power.
Blinking blue led starts almost immediately as turned on, I just tried the mems in my laptop and both banks are fine but I also tried booting the NAS without memory, expecting another behavior or even a different message in the display but again nothing different happened, same blue led almost instantly and Welcome message.
any other suggestion from you or the experts here will be greatly appreciated

Thanks dswv42. Correct here is the structure of the USB

I tested the pendrive in a notebook just to make sure that grub is properly configured and I was able to reach the grub menu so the pendrive seems to be fine. Even when trying to boot the NAS from the pendrive I still get the flashing blue led is that normal? it happens almost instantly as I power it on. Also checked my DNS and the NAS is never pulling for an IP. Thanks

Will try with different pendrive later today. As you mentioned Fan starts at full speed but never slows down, will keep running full speed for hours until I shut it down. I followed your UART guide but im not receiving any data in the terminal app. I do know my board works fine but its based on another processor (CP2102), yours is based on FT232 chip, maybe thats why Im not able to see the boot process.

dswv42, Finally I borrowed one Ft232 board but still no getting info from the UART. I also used a different pendrive to check if it will boot into recovery but again nothing happened. I left the UARt connected while reseting (both 4 and 40sec) expecting to get some data but nothing was displayed. After some time I downloaded the debian iso found in other thread wondering if will install it to the first disk but nothing happened. Im wondering if the BIOS may be corrupted. Is there any way to check that? Or any other test suggested? Thanks

Agree. Tested with linux and W10 with putty and also minicom in linux. Also tested continuity in JST 4 connector and cable. Never connected the VCC pin, Actually the righter pin in my JST connector has no cable connected (to avoid any connection by mistake :slight_smile: ). Also tested that pin for VCC.

FT board seems to be working fine (VCC pin also without cable just in case…). tested RX & TX jumping both pins with success. Voltage selector is in 3.3V
I will fine another device at home with UART port to test, already opened 2 old cablemodem but none had UART ports at least easily identifiable.
Will keep checking and keep posting…