Dell R610

[StidOfficial]

The board Dell R610 have :

CPU : Nuvoton WPCM450DA0BX
Mem : Hynix HY5PS1G1631CFP-Y5 1Gb DDR2 SDRAM (https://hands.com/~lkcl/eoma/jz4760/HY5PS1G1631CFP(Rev1.4).pdf)
CPDL : Lattice LCMXO1200C-3FT256C (https://www.latticesemi.com/~/media/LatticeSemi/Documents/DataSheets/MachXO23/MachXOFamilyDataSheet.pdf)
SPI Flash : PCT 16 Mbit SPI Serial Flash https://www.pct.com.tw/attachments/files/files/248_25VF016B-P.pdf

U_IBMC_FRU
432FP
ST B025

U_IBMC_SPI
BMC A09

PCT 25VF016B

J_IBMC_UART
[] () () ()
1  2  3  4

pin	function
1	3.3V
2	RX
3	TX
4	GND

J_IBMC_RST
[] ()
1  2

pin	function
1	?
2	GND

J_IBMC_MFG
[] ()
1  2

pin	function
1	?
2	GND

J_IBMC_S12
[] ()
1  2

pin	function
1	?
2	?

J_IBMC_JTAG
2                                                     20
() () () () () () () () () () () () () () () () () () ()
[] () () () () () () () () () () () () () () () () () ()

Standard JTAG. (VTref and VCC are 3.3V)

pin	function
1	VTref
2	VCC
3	TRST
4	GND
5	TDI
6	GND
7	TMS/SWDIO
8	GND
9	TCK/SWCLK
10	GND
11	NC
12	GND
13	TDO/SWO
14	GND
15	RESET
16	GND
17	NC
18	GND
19	NC
20	GND

J_IBMC_S10
[*] (*)
1   2

pin	function
1	?
2	?

J_CPLD_JTAG
[] () () () () ()
1 2 3 4 5 6

pin	function
1	?
2	?
3	?
4	?
5	?
6	GND

J_CPLD_DBG_1
[] ()
1  2

pin	function
1	?
2	?

I added the board page : https://github.com/neuschaefer/linux/wiki/Dell-PowerEdge-R610

[neuschaefer]

Hi Stid, thanks!

Does this board also have these upgrade slots for iDRAC Express and iDRAC Enterprise modules?

[StidOfficial]

Hi,

Yes, the Express is a 1Gb SPI FLASH where is stored Linux (U-boot cannot boot on Linux without him) and the Enterpise is an SDCard reader and dedicated ethernet.

By the way, i can enable Enterprise mode without the module by running :

/avct/sbin/aim_config_set_bool ameastatus_bool_amea_present 1
/avct/sbin/aim_config_set_int pm_int_systemstatus_oemflag 1

/etc/sysapps_script/K_4000_RemotePresence.sh
/etc/sysapps_script/K_1170_UsbDrivers.sh
/etc/sysapps_script/S_3157_UsbDrivers_.sh
/etc/sysapps_script/S_4000_RemotePresence.sh

I try to see if i can exploit the JTAG but i'am not familiar with openocd and the target i need to use.
I don't known if you do something on this side ?

IRQ's and io map seem to match :

[WPCM450 ~]$ cat /proc/interrupts 
           CPU0
  2:          0  WPCM_IRQ_MASKACK  GPIO ISR 0
  3:      20372  WPCM_IRQ_MASKACK  aess_sdhci, GPIO ISR 1
  4:          0  WPCM_IRQ_MASKACK  GPIO ISR 2
  5:          0  WPCM_IRQ_MASKACK  GPIO ISR 3
  6:          0  WPCM_IRQ_MASKACK  PECI
  7:       4355  WPCM_IRQ_MASKACK  wpcm450-uart
  9:          0  WPCM_IRQ_MASKACK  KCS, BIOSPOST
 12:      23613  WPCM_IRQ_MASKACK  WPCM450 Timer Tick
 13:          0  WPCM_IRQ_MASKACK  Timer 1
 14:          0  WPCM_IRQ_MASKACK  Timer 2,3,4
 15:        519  WPCM_IRQ_MASKACK  WPCM450-MAC RX
 16:        521  WPCM_IRQ_MASKACK  WPCM450-MAC TX
 20:          0  WPCM_IRQ_MASKACK  g_ci13410_hs
 23:         82  WPCM_IRQ_MASKACK  I2C3
 24:        771  WPCM_IRQ_MASKACK  WPCM450-MFT0
 25:        262  WPCM_IRQ_MASKACK  WPCM450-MFT1
 26:         12  WPCM_IRQ_MASKACK  I2CG
 27:       2469  WPCM_IRQ_MASKACK  I2C4
 29:       2469  WPCM_IRQ_MASKACK  I2C5
 31:    1548686  WPCM_IRQ_MASKACK  SSPI
Err:          0
[WPCM450 ~]$ cat /proc/iomem 
00000000-06ffffff : System RAM
  00025000-0042ffff : Kernel text
  00430000-0048242b : Kernel data
b0005000-b0005200 : g_ci13410_hs.0
b0007000-b00070ff : aess_sdhci
  b0007000-b00070ff : aess_sdhci
b8000000-b80000ff : wpcm450-uart.0
  b8000000-b80000ff : wpcm450-uart
b8000100-b80001ff : wpcm450-uart.6
  b8000100-b80001ff : wpcm450-uart.5
    b8000100-b80001ff : wpcm450-uart.4
      b8000100-b80001ff : wpcm450-uart.3
        b8000100-b80001ff : wpcm450-uart.2
          b8000100-b80001ff : wpcm450-uart.1
          b8000100-b80001ff : wpcm450-uart
[WPCM450 ~]$ cat /proc/cpuinfo 
Processor       : ARM926EJ-S rev 5 (v5l)
BogoMIPS        : 109.77
Features        : swp half thumb fastmult edsp java 
CPU implementer : 0x41
CPU architecture: 5TEJ
CPU variant     : 0x0
CPU part        : 0x926
CPU revision    : 5
Cache type      : write-back
Cache clean     : cp15 c7 ops
Cache lockdown  : format C
Cache format    : Harvard
I size          : 16384
I assoc         : 4
I line length   : 32
I sets          : 128
D size          : 16384
D assoc         : 4
D line length   : 32
D sets          : 128

Hardware        : wpcm450
Revision        : 0000
Serial          : 0000000000000000

[StidOfficial]

J_IBMC_MFG is a jumper to enable the manufacturer mode that unlock uboot shell with escape.
J_IBMC_RST is a jumper to reset the CPU