I use a lot of Dell MD1200 disk shelves, just got another one in and I needed to know if I need to update the firmware on it (because you can only do so with an H800 or H810 card HBA card, which I would have to dig out). didn't have a spare system with a SAS card to connect to it and poll the firmware version to see if it was outdated, so I got to thinking for a minute:
There's a mini-din "password reset" connector on the controllers, and to me that just screamed debug UART (I mean, the dumb expander MD1200 doesn't even have any functionality to password). Sure enough, after shoving some breadboard jumpers into it, I get a debug shell (RS232, 38400-8-n-1):
Code:
BlueDress.106.000 >?
unknown_cmd -> cmd:? args:1
BlueDress.106.000 >help
unknown_cmd -> cmd:help args:1
BlueDress.106.000 >
Pinout (facing the back of the controller):
However as you can see above, the shell isn't giving up any commands, and nothing I could guess would take. So I downloaded Dell's update package for the shelf, extracted out the firmware binary, and loaded it into Ghidra, then performed a string search until I found some:
those certainly look like commands, and after testing them they indeed were. Better yet, I eventually found the strings "devils" and "_devils", these make the shell spit out all possible commands, which you can find here:
BlueDress.106.000 >_devils _boot Download the boot image (FW image 1 a - Pastebin.com
A few interesting things, such as temp reading:
Code:
BlueDress.106.000 >_temp_rd
BP_1[2] = 20c
BP_2[3] = 19c
SIM0[0] = 25c
SIM1[1] = 25c
EXP0[4] = 41c
EXP1[5] = 45c
AVG = 29c
Arbitrarily control fan speed 0-100:
Code:
BlueDress.106.000 >set_speed 20
##if you go lower than 20%, it'll ramp back up
##if you really want lower than 20, you need to spoof the temp with set_temp
Detailed firmware version (it seems the MD firmware team is using github, or at least a build tool that defaults to owner: github):
Code:
BlueDress.106.000 >_ver
********************* Bench Build **********************
Build Owner : GitHub
Build Number : 000
Build Version : 106
Build Date : Mon Aug 24 12:28:59 2015
FPGA Revision : A9
Board Revision : 8
CPLD Revision : 7
**************Firmware Image Information****************
Image Region 0 (Always Boot)
Revision : 0.0.63.0
Dell Version : 1.01
Total Image Size : 0003d89c [252060]
Fast Boot : Yes
Image Address : 0x14000000
RegionOffset : 0x00000000
RegionSize : 0x00080000
RegionType : 0x00000000
Active--->Image Region 1
Revision : 0.0.63.0
Dell Version : 1.06
Total Image Size : 000414fc [267516]
Fast Boot : Yes
Image Address : 0x14080000
RegionOffset : 0x00080000
RegionSize : 0x00080000
RegionType : 0x00000001
Image Region 2
Revision : 0.0.63.0
Dell Version : 1.06
Total Image Size : 000414fc [267516]
Fast Boot : Yes
Image Address : 0x14100000
RegionOffset : 0x00100000
RegionSize : 0x00080000
RegionType : 0x00000002
********************************************************
The only way to update the firmware on these shelves is with a dell executable, and it will only do it if it's connected via an H800 or H810 HBA, so if you don't have one of those you were out of luck. However looking through the commands here, you can just drop it new firmware over serial via XMODEM.
I think my favorite find however is this:
Code:
BlueDress.106.000 >ps_status
************************************************************************************
This command has not been implemented yet.
If you REALLY need this feature cont(r)act the Devil's firmware team for help.
CAUTION: It may not be wise to make cont(r)act with any of the Devil's team members.
************************************************************************************
This should be nearly the same if not identical on all their disk shelves with this connector, eg the md1000, md12000/md1220, md3000, etc. If you wanna dick around with it and don't wanna have to shove connectors into it, you can buy their "password reset" cable:
New Fit for Dell Password Reset/Service Cable MN657 MD1200 MD3200 US Shipping | eBay - you could connect it to the serial port on your host, and tell your host to run on boot "_shutup 10" for arbitrary fan control for example
