DS 5100 Linux Fan Control (reverse engineer driver)

Legacy Products WD Sentinel
1

Hello,

I installed Ubuntu Server on my Sentinel DS 5100 and everything is fine, except for the system fan. I cannot get this working. The default installation is unable to find anything.

So far I found out that the fan is connected to the PCB in the back (with the 6 SATA ports), through PCI to the motherboard.

I examined the PCB to see if there’s a SuperIO chip on it or something, but as far as I understand, the fan is connected to a MSP430 microcontroller so I think WD is controlling the fan with PWM through the MSP430. So probably there is no standard way to control it. Unlike the DX 4000 which has a Nuvoton chip that can be controlled through the nct6775 driver.

In Windows I notice the hwlib.dll library (which the dashboard monitor uses for example) has methods like:

  • HWGetFanRPM
  • HWSetFanSpeed

They both use the methods HWD2FCCommand and HWMailboxRequest.
HWD2FCCommand seems to call the WdSMBusDev driver through opcode 0x9c456644 and HWMailboxRequest calls the lpcdev driver through opcode 0x9c42a5c0.
After disassembling the lpcdriver.sys driver I found the opcode 0x9c42a5c0 but the instructions thereafter I cannot make sense of.

Is there anyone here that succeeded in controlling the fan, or that can help reverse engineer the driver, or give some guidance?

Thank you for any information!

Dean

Here are some commands I ran:

$ lspci -k 

00:00.0 Host bridge: Intel Corporation Xeon E3-1200 v2/Ivy Bridge DRAM Controller (rev 09) 
    Subsystem: Intel Corporation Xeon E3-1200 v2/Ivy Bridge DRAM Controller 
    Kernel driver in use: ie31200_edac 
    Kernel modules: ie31200_edac 

00:01.0 PCI bridge: Intel Corporation Xeon E3-1200 v2/3rd Gen Core processor PCI Express Root Port (rev 09) 
    Kernel driver in use: pcieport 

00:14.0 USB controller: Intel Corporation 7 Series/C210 Series Chipset Family USB xHCI Host Controller (rev 04) 
    Subsystem: Intel Corporation 7 Series/C210 Series Chipset Family USB xHCI Host Controller 
    Kernel driver in use: xhci_hcd 

00:16.0 Communication controller: Intel Corporation 7 Series/C216 Chipset Family MEI Controller #1 (rev 04) 
    Subsystem: Intel Corporation 7 Series/C216 Chipset Family MEI Controller 
    Kernel driver in use: mei_me 
    Kernel modules: mei_me 

00:16.3 Serial controller: Intel Corporation 7 Series/C210 Series Chipset Family KT Controller (rev 04) 
    Subsystem: Intel Corporation 7 Series/C210 Series Chipset Family KT Controller 
    Kernel driver in use: serial 

00:1a.0 USB controller: Intel Corporation 7 Series/C216 Chipset Family USB Enhanced Host Controller #2 (rev 04) 
    Subsystem: Intel Corporation 7 Series/C216 Chipset Family USB Enhanced Host Controller 
    Kernel driver in use: ehci-pci 

00:1c.0 PCI bridge: Intel Corporation 7 Series/C216 Chipset Family PCI Express Root Port 1 (rev c4) 
    Kernel driver in use: pcieport 

00:1c.3 PCI bridge: Intel Corporation 7 Series/C216 Chipset Family PCI Express Root Port 4 (rev c4) 
    Kernel driver in use: pcieport 

00:1c.4 PCI bridge: Intel Corporation 7 Series/C210 Series Chipset Family PCI Express Root Port 5 (rev c4) 
    Kernel driver in use: pcieport 

00:1d.0 USB controller: Intel Corporation 7 Series/C216 Chipset Family USB Enhanced Host Controller #1 (rev 04) 
    Subsystem: Intel Corporation 7 Series/C216 Chipset Family USB Enhanced Host Controller 
    Kernel driver in use: ehci-pci 

00:1f.0 ISA bridge: Intel Corporation C216 Series Chipset LPC Controller (rev 04) 
    Subsystem: Intel Corporation C216 Series Chipset LPC Controller 
    Kernel driver in use: lpc_ich 
    Kernel modules: lpc_ich 

00:1f.2 SATA controller: Intel Corporation 7 Series/C210 Series Chipset Family 6-port SATA Controller [AHCI mode] (rev 04) 
    Subsystem: Intel Corporation 7 Series/C210 Series Chipset Family 6-port SATA Controller [AHCI mode] 
    Kernel driver in use: ahci 
    Kernel modules: ahci 

00:1f.3 SMBus: Intel Corporation 7 Series/C216 Chipset Family SMBus Controller (rev 04) 
    Subsystem: Intel Corporation 7 Series/C216 Chipset Family SMBus Controller 
    Kernel driver in use: i801_smbus 
    Kernel modules: i2c_i801 

00:1f.6 Signal processing controller: Intel Corporation 7 Series/C210 Series Chipset Family Thermal Management Controller (rev 04) 
    Subsystem: Intel Corporation 7 Series/C210 Series Chipset Family Thermal Management Controller 

01:00.0 RAID bus controller: Marvell Technology Group Ltd. 88SE9480 SAS/SATA 6Gb/s RAID controller (rev c3) 
    Subsystem: Marvell Technology Group Ltd. 88SE9480 SAS/SATA 6Gb/s RAID controller 
    Kernel driver in use: mvsas 
    Kernel modules: mvsas 

02:00.0 PCI bridge: ASPEED Technology, Inc. AST1150 PCI-to-PCI Bridge (rev 02) 

03:00.0 VGA compatible controller: ASPEED Technology, Inc. ASPEED Graphics Family (rev 21) 
    Subsystem: ASPEED Technology, Inc. ASPEED Graphics Family 
    Kernel driver in use: ast 
    Kernel modules: ast 

04:00.0 Ethernet controller: Intel Corporation 82574L Gigabit Network Connection 
    Subsystem: Intel Corporation 82574L Gigabit Network Connection 
    Kernel driver in use: e1000e 
    Kernel modules: e1000e 

05:00.0 Ethernet controller: Intel Corporation 82574L Gigabit Network Connection 
    Subsystem: Intel Corporation 82574L Gigabit Network Connection 
    Kernel driver in use: e1000e 
    Kernel modules: e1000e 

$ sudo i2cdetect 0 
WARNING! This program can confuse your I2C bus, cause data loss and worse! 
I will probe file /dev/i2c-0. 

I will probe address range 0x08-0x77. 

Continue? [Y/n] 
     0  1  2  3  4  5  6  7  8  9  a  b  c  d  e  f 
00:                         08 -- -- -- -- -- -- -- 
10: -- -- -- -- -- -- -- -- -- 19 -- 1b -- -- -- -- 
20: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- 
30: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- 
40: -- -- -- -- 44 -- -- -- 48 -- -- -- 4c -- -- -- 
50: -- UU -- UU -- -- -- -- -- -- -- -- -- -- -- -- 
60: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- 
70: -- -- -- -- -- -- -- --

0x19 
00: 00 00 00 00 00 c1 00 29 00 00 00 00 00 00 00 00 

0x1b 
00: 00 00 00 00 00 c1 00 29 00 00 00 00 00 00 00 00 

0x44 
00: 00 00 00 04 00 00 00 00 00 57 52 18 01 27 02 23 

Next adapter: SMBus I801 adapter at f000 (i2c-0) 
Do you want to scan it? (YES/no/selectively): 
Client found at address 0x19 
Probing for `Analog Devices ADM1021'...                     No 
Probing for `Analog Devices ADM1021A/ADM1023'...            No 
Probing for `Maxim MAX1617'...                              No 
Probing for `Maxim MAX1617A'...                             No 
Probing for `Maxim MAX1668'...                              No 
Probing for `Maxim MAX1805'...                              No 
Probing for `Maxim MAX1989'...                              No 
Probing for `Maxim MAX6655/MAX6656'...                      No 
Probing for `TI THMC10'...                                  No 
Probing for `National Semiconductor LM84'...                No 
Probing for `Genesys Logic GL523SM'...                      No 
Probing for `Onsemi MC1066'...                              No 
Probing for `Maxim MAX1618'...                              No 
Probing for `Maxim MAX1619'...                              No 
Probing for `National Semiconductor LM82/LM83'...           No 
Probing for `Maxim MAX6654'...                              No 
Probing for `Maxim MAX6690'...                              No 
Probing for `Maxim MAX6680/MAX6681'...                      No 
Probing for `Maxim MAX6695/MAX6696'...                      No 
Probing for `Texas Instruments TMP400'...                   No 
Probing for `Texas Instruments AMC6821'...                  No 
Probing for `National Semiconductor LM95231'...             No 
Probing for `National Semiconductor LM95241'...             No 
Probing for `National Semiconductor LM95245'...             No 
Probing for `ST STTS424'...                                 No 
Probing for `ST STTS424E'...                                No 
Probing for `ST STTS2002'...                                No 
Probing for `ST STTS3000'...                                No 
Probing for `NXP SE97/SE97B'...                             No 
Probing for `NXP SE98'...                                   No 
Probing for `Analog Devices ADT7408'...                     No 
Probing for `IDT TS3000/TSE2002'...                         Success! 
    (confidence 5, driver `jc42') 
Probing for `IDT TSE2004'...                                No 
Probing for `IDT TS3001'...                                 No 
Probing for `Maxim MAX6604'...                              No 
Probing for `Microchip MCP9804'...                          No 
Probing for `Microchip MCP9808'...                          No 
Probing for `Microchip MCP98242'...                         No 
Probing for `Microchip MCP98243'...                         No 
Probing for `Microchip MCP98244'...                         No 
Probing for `Microchip MCP9843'...                          No 
Probing for `ON CAT6095/CAT34TS02'...                       No 
Probing for `ON CAT34TS02C'...                              No 
Probing for `ON CAT34TS04'...                               No 
Probing for `Atmel AT30TS00'...                             No 
Probing for `Giantec GT30TS00'...                           No 
Client found at address 0x1b 
Probing for `ST STTS424'...                                 No 
Probing for `ST STTS424E'...                                No 
Probing for `ST STTS2002'...                                No 
Probing for `ST STTS3000'...                                No 
Probing for `NXP SE97/SE97B'...                             No 
Probing for `NXP SE98'...                                   No 
Probing for `Analog Devices ADT7408'...                     No 
Probing for `IDT TS3000/TSE2002'...                         Success! 
    (confidence 5, driver `jc42') 
Probing for `IDT TSE2004'...                                No 
Probing for `IDT TS3001'...                                 No 
Probing for `Maxim MAX6604'...                              No 
Probing for `Microchip MCP9804'...                          No 
Probing for `Microchip MCP9808'...                          No 
Probing for `Microchip MCP98242'...                         No 
Probing for `Microchip MCP98243'...                         No 
Probing for `Microchip MCP98244'...                         No 
Probing for `Microchip MCP9843'...                          No 
Probing for `ON CAT6095/CAT34TS02'...                       No 
Probing for `ON CAT34TS02C'...                              No 
Probing for `ON CAT34TS04'...                               No 
Probing for `Atmel AT30TS00'...                             No 
Probing for `Giantec GT30TS00'...                           No 
Client found at address 0x48 
Probing for `National Semiconductor LM75'...                No 
Probing for `National Semiconductor LM75A'...               No 
Probing for `Dallas Semiconductor DS75'...                  No 
Probing for `National Semiconductor LM77'...                No 
Probing for `Analog Devices ADT7410/ADT7420'...             No 
Probing for `Analog Devices ADT7411'...                     No 
Probing for `Maxim MAX6642'...                              No 
Probing for `Texas Instruments TMP435'...                   No 
Probing for `National Semiconductor LM73'...                No 
Probing for `National Semiconductor LM92'...                No 
Probing for `National Semiconductor LM76'...                No 
Probing for `Maxim MAX6633/MAX6634/MAX6635'...              No 
Probing for `NXP/Philips SA56004'...                        No 
Probing for `SMSC EMC1023'...                               No 
Probing for `SMSC EMC1043'...                               No 
Probing for `SMSC EMC1053'...                               No 
Probing for `SMSC EMC1063'...                               No 
Client found at address 0x51 
Handled by driver `at24' (already loaded), chip type `spd' 
    (note: this is probably NOT a sensor chip!) 
Client found at address 0x53 
Handled by driver `at24' (already loaded), chip type `spd' 
    (note: this is probably NOT a sensor chip!) 

 

Driver `jc42': 

  * Bus `SMBus I801 adapter at f000' 
    Busdriver `i2c_i801', I2C address 0x19 
    Chip `IDT TS3000/TSE2002' (confidence: 5) 

  * Bus `SMBus I801 adapter at f000' 
    Busdriver `i2c_i801', I2C address 0x1b 
    Chip `IDT TS3000/TSE2002' (confidence: 5)

jc42 only provides temperatures.

pwmconfig says no fans are found
May be GitHub - hirschmann/nbfc: NoteBook FanControl (and the Linux port) can help, but using ec-probe the dump has all zeroes, so it seems that the EC cannot be read correctly.

2

Hi @DeanWy ,

Have you opened a Support Case? If not opened, for more information, please contact the WD Technical Support team for the best assistance and troubleshooting:

3

I did but they won’t help because it’s too old.

Meanwhile it doesn’t boot anymore. It seems like the second BIOS failed also. Connecting through serial and it fails to mount mtdblock0 and mtdblock1 to /dev/flash0 and /dev/flash1. It just sits there doing nothing after trying to boot the second BIOS.

I want to try to desolder the BIOS chips and replace them but without an original BIOS dump it is useless I guess.

Does anyone have a dump of the BIOS for DS 5100, or may be even DS 6100 ?

Thank you.

4

The fan, as you surmised, is controlled by the MSP430. The MSP430 comms with the main board over an I2C bus from the AST2300 chip.

I can’t simply describe what the AST2300 does, but it contains an ARM CPU running Linux. It provides an emulated Matrox video controller, an Ethernet port of its own and takes the place of the Super I/O chip on earlier designs.

The fan device driver is supplied with SMART temp data from the hdds in addition to cpu temp data and writes to AST2300 registers to get it to relay fan controller cmds to the MSP430 via dedicated I2C interface.

That is as much as I know about how it works.

1 Like
5

Thank you so much for the info @User000001 ! Very interesting.

Unfortunately I haven’t been able to experiment with controlling the fan anymore. It was such an interesting and fun project! Sadly I can’t get the device to boot anymore.

I am having two issues:

  • The front panel PCB is broken (the FPC connector is broken) so I am not able to press the power button (but this wasn’t really an issue since plugging in the power did make it boot). But now I am unsure if the issue I am experiencing could be related to the power button not being pressed haha. I wish I knew which pins to short to simulate a button press, but I am not clever enough to follow the traces on the PCB. I found a replacement PCB on eBay but it’s located in the US and it’s like 37$ shipping to the EU.
  • I replaced both BIOS chips (I was able to dump the BIOS ROM of the second BIOS chip) but I am not sure if they work properly now and whether my soldering job succeeded.

I am still able to connect to the AST2300 through serial.

Previously (before replacing the BIOS chips) the logs showed:

...
Scheduled delayed BIOS check - SLP_S3#=high, PCH_BIOS_OK=low
timer event# 11 start: 30 sec
...
# timer event 11
CMD_DELAYED_CHECK
Switched to Backup BIOS - SLP_S3#=high, PCH_BIOS_OK=low
PWRBTSW
timer event 8
CMD_REBOOT_HOST
timer event 9
PWRBTSW
CMD_REBOOT_HOST_SM1
timer event 0
CMD_RELEASE_RST
SLP_S3# -> HI count=1
MEM_EVENT[3:0]=0xf
tasklet count=1
timer event# 10 start: 90 sec
timer event 10
CMD_IS_BIOS_OK?
In Backup BIOS already

But nothing happened (fan running at 100% and black screen).

Now after replacing the chips it doesn’t schedule the delayed BIOS check anymore and eventually says:

SLP_S3# -> HI count=1
MEM_EVENT[3:0]=0xf
tasklet count=1
timer event# 10 start: 90 sec
SLP_S3# -> HI count=2
MEM_EVENT[3:0]=0xf
tasklet count=2
timer event# 10 start: 90 sec
SLP_S3# -> HI count=3
MEM_EVENT[3:0]=0xf
tasklet count=3
timer event# 10 start: 90 sec
SLP_S3# -> HI count=4
MEM_EVENT[3:0]=0xf
tasklet count=4
timer event# 10 start: 90 sec
SLP_S3# -> HI count=5
MEM_EVENT[3:0]=0xf
tasklet count=5
timer event# 10 start: 90 sec
SLP_S3# -> HI count=6
MEM_EVENT[3:0]=0xf
tasklet count=6
timer event# 10 start: 90 sec
SLP_S3# -> HI count=7
Switched to Backup BIOS - count exceeded
MEM_EVENT[3:0]=0xf
SLP_S3# -> HI count=1
MEM_EVENT[3:0]=0xf
tasklet count=1
timer event# 10 start: 90 sec
SLP_S3# -> HI count=2
MEM_EVENT[3:0]=0xf
tasklet count=2
timer event# 10 start: 90 sec
SLP_S3# -> HI count=3
MEM_EVENT[3:0]=0xf
tasklet count=3
timer event# 10 start: 90 sec
SLP_S3# -> HI count=4
MEM_EVENT[3:0]=0xf
tasklet count=4
timer event# 10 start: 90 sec
SLP_S3# -> HI count=5
MEM_EVENT[3:0]=0xf
tasklet count=5
timer event# 10 start: 90 sec
timer event# 10 start: 90 sec
SLP_S3# -> HI count=7
Main & Backup failed - Hold backplane in reset.
MEM_EVENT[3:0]=0xf
SLP_S3# -> HI count=8
Main & Backup failed - Hold backplane in reset.
MEM_EVENT[3:0]=0xf
... this loops endlessly

And also nothing happens. The fan runs at 5-10% it seems.

I am not sure what is going on. Did I kill the main system? I tried switching the RAM sticks around, and also only with one instead of two, but didn’t make a difference.

Next thing I am going to try is to replace the CPU and/or RAM, but maybe I am trying to save a system I already broke haha.

Thanks for any advice!

6

Pin 14 on J2 is the pwr button. Ground that pin and it simulates pressing the pwr button.

I have some non-working 5100/6000 PCBAs laying around. Unfortunately, these boards don’t have a programming header for the bios flash and the package for this flash chip, I don’t have the equipment to remove. Even if I did manage to remove it, I don’t have any adapter for the flash programmer. So, I wouldn’t be able to read it anyway.

I might be able to create a programming header and access it through the flash programmer, in situ. Might not be that difficult.

1 Like
7

Thank you for the info.

So I replaced the CPU and RAM and now the logs on the AST2300 are different.

It doesn’t log this anymore:

SLP_S3# -> HI count=1
MEM_EVENT[3:0]=0xf
tasklet count=1
timer event# 10 start: 90 sec

It goes straight to ‘press enter to activate this console’:

WD BMC mailbox driver ver 1.0 loaded major=247
thermald v1.0
udhcpc (v1.13.4) started
FTGMAC100: eth0:ftgmac100_open
FTGMAC100: eth0:ftgmac100_reset, phyAddr=0x0, miiPhyId=0x001c_c915
FTGMAC100: eth0:ftgmac100_reset, BMSR=0x7949
FTGMAC100: eth0:ftgmac100_reset, phyLinkSpeed=1 Full Duplex
FTGMAC100: PHYSTS_CHG
FTGMAC100: eth0: PHY interrupt status, read_phy_reg(0x13) INSR  = 0x0040
FTGMAC100: eth0: PHY interrupt status, read_phy_reg(0x11) PHYSR = 0x4000
FTGMAC100: eth0:ftgmac100_phy_cfg, LCR reg=0x24
Sending discover...
Sending discover...
Sending discover...
No lease, failing

Please press Enter to activate this console.
# PWRBTSW

As you can see I was able to trigger the power button (PWRBTSW) by grounding the pin you mentioned but nothing happened unfortunately. Did I fry the system?

Here is the ROM file: ROM.bin - Google Drive

Edit:
Btw, do you have any idea what the MTD devices are?
I see this:

mount: mounting dev/mtdblock0 on /mnt/flash0 failed: No such device or address
mount: mounting dev/mtdblock1 on /mnt/flash1 failed: No such device or address

cat /proc/mtd only outputs the header but not any devices.

I thought these were the BIOS chips.

8

I cannot remember which unit had this. But one of them had a port like HP DRAC whatever where you could connect remotely and see the system. But it does not look like you are getting an ip for it.

Here is the software if you want to play with it
https://www.dropbox.com/scl/fi/0u6msjpkqqk7a5vouypud/WDBMCUpdate_v25.zip?rlkey=u3wk0bga1excrju3crsg9tet7&st=bkedzhk9&dl=0