-
I got a half bricked Drobo B810i NAS here to fix failed firmware update (https://files.drobo.com/webrelease/b810i/B810i_Firmware_2-0-1.zip). Need some help from either U-Boot or openocd heros. Drobo users are welcome. I never had a Drobo in my hands before. I was able to rescue some other devices by just flashing the firmware on eprom via programmer or by using jtag interface. But this Drobo NAS is hard to fix.
Best solution i guess would be a flash memory dump from a working device. If you can provide one, please contact me.
Device behavior:
I can't find the device via Drobo GUI (https://files.drobo.com/webrelease/dashboard/drobodashboardinstaller_3.5.0.exe). Nmap doesn't show any open port. The only info i have is, it failed to start after firmware update.
The device turns on, gets an ip via dhcp but no interaction via network possible from outside.
I opened the device to find two suspicious looking pin headers and 2x10 pin holes. The pin headers are UART serial ports. Both are active at 115200 8N1. To my surprise, one starts a Marvell U-Boot process which loads VxWorks. It stops at some point and the other UART port gets active, showing a linux boot process with a root shell at the end. There are two eprom IC's. I desoldered both and dumped the content.
Both boot logs are attached. The CPU is a Marvell Armada XP Sheeva SoC:Code: [Select]Marvell PJ4B (584) v7 (Rev 2) LE (cat /proc/cpuinfo tells PJ4Bv7 rev 2 (v71)),
Description: SOC ARMADA XP ARM7 732-Pin FCBGA, (Sheeva)
MV78-BJR2
P35V110.1
1528 B0E
MV78460-B0 C120
SoC MV88F7846 Rev 8 / 562f5842
Board DB-78460-BP rev 2.0
Drobo version kyten-uboot-2.33
On the VxWorks UART port i dont have a shell, but i can stop the boot process to enter the u-boot shell with very limited commands. It's not the u-boot main line shell. A log with available commands and a printenv is attached. No ethernet port is available in u-boot. I found some files using fatls and dumped the files:Code: [Select]Marvell>> fatls usb 0:1
17734472 vxworks
3168928 lximage
crashlogs/
224 nocrashmsg
0 hiblog
512 hibhdr
48 amitlog
4 bootcount
1024004 eventlog
556 hdr_prev
256 rebootreason
7698058 vxi2.bin
801272 ubhw.bin
556 ubhw.hdr
556 hdr
556 lxhdr
556 vxi2.hdr
17734472 vxworks_prev
3684024 lximage_prev
556 lxhdr_prev
11319620 rtpi.bin
556 rtpi.hdr
31457280 lxfs.bin
556 lxfs.hdr
To dump files on u-boot i used (for example):Code: [Select]fatload usb 0:1 20000000 vxworks_prev
md.b 20000000 <size of content in bytes>
On the linux UART port, i can start telnetd and dropbear. But can't login as root. I don't know what secrets are waiting here. Maybe i can rescue the system from here?
The 2x10 pin holes looked like an arm default connector. I added pin headers and hooked my j-link on it with no luck on either jlink or openocd.
I figured out the needed config files for my olimex tiny-h and openocd. The default config let me halt the system but i couldn't reset the cpu.
The config files are attached. Rename it from .txt to cfg if you want to use it.Code: [Select]openocd -d1 -f interface//olimex-arm-usb-tiny-h.cfg -f target/armada370.cfg
After figuring out to circumvent the reset problem, i had to learn, that my dumped files had wrong byte order. I first converted the dump using xxd. But it's easier to use "-endian little" in the target config file to fix this.
I read the ARMADA-XP-Functional-SpecDatasheet (https://datasheet.datasheetarchive.com/originals/crawler/marvell.com/002fa441a27967d992f905776d519926.pdf) and foundCode: [Select]Table 11: MMU Virtual-to-Physical Address Translation Table
Device Physical Address Virtual Address Size Caching
SDRAM 0x0 0x0 1 GB Non-Cachable
L2-SRAM 0x40000000 0x40000000 1 MB Cachable
PCI-Express 0x80000000 0x80000000 640 MB Non-Cachable
CESA SRAM 0xC8000000 0xC8000000 1 MB Non-Cachable
Internal Register 0xD0000000 0xD0000000 1 MB Non-Cachable
NOR Flash 0xD8000000 0xD8000000 128 MM Non-Cachable
SPI Flash 0xD4000000 0xD4000000 64 MB Cachable
Device Bus 0xD3800000 0xD3800000 711 MB Non-Cachable
BootROM 0xFFF00000 0xFFF00000 1 MB Cachable
I dumped the spi flash again, this time via jtag to compare the content:Code: [Select]init
reset halt
dump_image B810i-8MB-spi-rom.bin 0xD4000000 0x800000
Since i'm not a programmer or IT specialist in general, working with address and size values is hard to me.
I just used python to calculate the values by just enter it in the python prompt. The MX25L6406E is a 64Mbit SPI flash, providing 8 MB of memory. 8 MB x 2^20 = 8388608 byte decimal. The get the hex value i enter in python prompt:Code: [Select]>>> hex(8388608)
And get 0x800000 as result ( I learned, to get the decimal size from a hex value, just use 0x800000 in python. Be aware this works for the size, you have to subtract -1 from this value when you calculate address space because counting starts at 0. 8388608-1 = 8388607 will give you 0x7fffff as end-address).
To better compare the dump i grabbed via jtag, i used hexdump -v for both files, the jtag dump and the programmer dump of the SPI flash and compared them using diff.
I did the same with the 128 MB NOR-flash. Sadly i couldn't find it's content in the firmware file. The firmware-file has .tdf file extension.
Binwalk show me some complex content:Code: [Select]binwalk release.B810i.2-0-1.tdf
DECIMAL HEXADECIMAL DESCRIPTION
--------------------------------------------------------------------------------
556 0x22C ELF, 32-bit LSB executable, ARM, version 1 (ARM)
2537455 0x26B7EF mcrypt 2.2 encrypted data, algorithm: blowfish-448, mode: CBC, keymode: 4bit
3119831 0x2F9AD7 Neighborly text, "NeighborCacheToLivenet.inet.IcmpRatelimitBucketsize"
3129084 0x2FBEFC Unix path: /home/buildtest/WindRiver_Vx6.8.3/vxworks-6.8/target/config/comps/src/usrMmuInit.c
3201803 0x30DB0B Copyright string: "Copyright 1995-2005 Jean-loup Gailly "
3209995 0x30FB0B uuencoded data, file name: "%s", file permissions: "644"
3243227 0x317CDB Neighborly text, "NeighborCacheToLives does not appear to be attached"
3310242 0x3282A2 LZMA compressed data, properties: 0x64, dictionary size: -2147483648 bytes, uncompressed size: 191 bytes
3377101 0x3387CD Copyright string: "Copyright Wind River Systems, Inc., 1984-2012"
3453504 0x34B240 VxWorks WIND kernel version "2.13"
3756176 0x395090 StuffIt Deluxe (data): TDList
3756659 0x395273 StuffIt Deluxe (data): TDs
3756766 0x3952DE StuffIt Deluxe (data): TD
3756919 0x395377 StuffIt Deluxe (data): TDs
3757433 0x395579 StuffIt Deluxe (data): TD
3757537 0x3955E1 StuffIt Deluxe (data): TDData
3887780 0x3B52A4 Intel x86 or x64 microcode, sig 0x013b3d9c, pf_mask 0x1361b7f, 1B79-01-36, rev 0x0001, size 3
5212665 0x4F89F9 Unix path: /home/buildtest/WindRiver_Vx6.8.3/vxworks-6.8/target/config/comps/src/dataSegPad.c
5436987 0x52F63B PARity archive data - file number 29540
5759546 0x57E23A Unix path: /home/buildtest/WindRiver_Vx6.8.3/vxworks-6.8/target/config/comps/src/version.c
5875588 0x59A784 PARity archive data - file number 24943
6590393 0x648FB9 Unix path: /home/buildtest/WindRiver_Vx6.8.3/vxworks-6.8/target/h/types
6593974 0x649DB6 Unix path: /home/buildtest/WindRiver_Vx6.8.3/vxworks-6.8/target/h/types
6594607 0x64A02F Unix path: /home/buildtest/WindRiver_Vx6.8.3/vxworks-6.8/target/h
6604113 0x64C551 Unix path: /home/buildtest/WindRiver_Vx6.8.3/vxworks-6.8/target/h/base
6604527 0x64C6EF Unix path: /home/buildtest/WindRiver_Vx6.8.3/vxworks-6.8/target/h/base
6606244 0x64CDA4 Unix path: /home/buildtest/WindRiver_Vx6.8.3/vxworks-6.8/target/h/private
6609213 0x64D93D Unix path: /home/buildtest/WindRiver_Vx6.8.3/vxworks-6.8/target/config/comps/src
6612136 0x64E4A8 Unix path: /home/buildtest/WindRiver_Vx6.8.3/vxworks-6.8/target/h/types/vxWindCommon.h
6614894 0x64EF6E Unix path: /home/buildtest/WindRiver_Vx6.8.3/vxworks-6.8/target/h/types/vxWindCommon.h
6617233 0x64F891 Unix path: /home/buildtest/WindRiver_Vx6.8.3/vxworks-6.8/target/h/types/vxWindCommon.h
6619091 0x64FFD3 Unix path: /home/buildtest/WindRiver_Vx6.8.3/vxworks-6.8/target/h/stdio.h
6619590 0x6501C6 Unix path: /home/buildtest/WindRiver_Vx6.8.3/vxworks-6.8/target/h/types/vxWindCommon.h
6620819 0x650693 Unix path: /home/buildtest/WindRiver_Vx6.8.3/vxworks-6.8/target/h/types/vxWindCommon.h
6621968 0x650B10 Unix path: /home/buildtest/WindRiver_Vx6.8.3/vxworks-6.8/target/h/shellInterpCmdLib.h
6622200 0x650BF8 Unix path: /home/buildtest/WindRiver_Vx6.8.3/vxworks-6.8/target/h/sysLib.h
6622371 0x650CA3 Unix path: /home/buildtest/WindRiver_Vx6.8.3/vxworks-6.8/target/h/types/vxWindCommon.h
6624233 0x6513E9 Unix path: /home/buildtest/WindRiver_Vx6.8.3/vxworks-6.8/target/h/types/vxWindCommon.h
6626207 0x651B9F Unix path: /home/buildtest/WindRiver_Vx6.8.3/vxworks-6.8/target/h/types/vxWindCommon.h
6627736 0x652198 Unix path: /home/buildtest/WindRiver_Vx6.8.3/vxworks-6.8/target/h/types/vxWindCommon.h
6628927 0x65263F Unix path: /home/buildtest/WindRiver_Vx6.8.3/vxworks-6.8/target/h/ctype.h
6629111 0x6526F7 Unix path: /home/buildtest/WindRiver_Vx6.8.3/vxworks-6.8/target/h/types/vxWindCommon.h
6634433 0x653BC1 Unix path: /home/buildtest/WindRiver_Vx6.8.3/vxworks-6.8/target/h/types/vxWindCommon.h
6637208 0x654698 Unix path: /home/buildtest/WindRiver_Vx6.8.3/vxworks-6.8/target/h/types/vxWindCommon.h
6638776 0x654CB8 Unix path: /home/buildtest/WindRiver_Vx6.8.3/vxworks-6.8/target/h/types/vxWindCommon.h
6639712 0x655060 Unix path: /home/buildtest/WindRiver_Vx6.8.3/vxworks-6.8/target/h/types/vxWindCommon.h
6641724 0x65583C Unix path: /home/buildtest/WindRiver_Vx6.8.3/vxworks-6.8/target/h/types/vxWindCommon.h
6643254 0x655E36 Unix path: /home/buildtest/WindRiver_Vx6.8.3/vxworks-6.8/target/h/types/vxWindCommon.h
6645267 0x656613 Unix path: /home/buildtest/WindRiver_Vx6.8.3/vxworks-6.8/target/h/types/vxWindCommon.h
6646950 0x656CA6 Unix path: /home/buildtest/WindRiver_Vx6.8.3/vxworks-6.8/target/h/types/vxWindCommon.h
6648413 0x65725D Unix path: /home/buildtest/WindRiver_Vx6.8.3/vxworks-6.8/target/h/types/vxWind.h
6649544 0x6576C8 Unix path: /home/buildtest/WindRiver_Vx6.8.3/vxworks-6.8/target/h/types/vxWindCommon.h
6652174 0x65810E Unix path: /home/buildtest/WindRiver_Vx6.8.3/vxworks-6.8/target/h/types/vxWindCommon.h
6654945 0x658BE1 Unix path: /home/buildtest/WindRiver_Vx6.8.3/vxworks-6.8/target/h/types/vxWindCommon.h
6658657 0x659A61 Unix path: /home/buildtest/WindRiver_Vx6.8.3/vxworks-6.8/target/h/types/vxWindCommon.h
6660516 0x65A1A4 Unix path: /home/buildtest/WindRiver_Vx6.8.3/vxworks-6.8/target/h/types/vxWindCommon.h
6663594 0x65ADAA Unix path: /home/buildtest/WindRiver_Vx6.8.3/vxworks-6.8/target/h/types/vxWindCommon.h
6665437 0x65B4DD Unix path: /home/buildtest/WindRiver_Vx6.8.3/vxworks-6.8/target/h/types/vxWindCommon.h
6666841 0x65BA59 Unix path: /home/buildtest/WindRiver_Vx6.8.3/vxworks-6.8/target/h/types/vxWindCommon.h
6669902 0x65C64E Unix path: /home/buildtest/WindRiver_Vx6.8.3/vxworks-6.8/target/h/types/vxWindCommon.h
6671719 0x65CD67 Unix path: /home/buildtest/WindRiver_Vx6.8.3/vxworks-6.8/target/h/types/vxWindCommon.h
6677727 0x65E4DF Unix path: /home/buildtest/WindRiver_Vx6.8.3/vxworks-6.8/target/h/types/vxWindCommon.h
6680176 0x65EE70 Unix path: /home/buildtest/WindRiver_Vx6.8.3/vxworks-6.8/target/h/types/vxWindCommon.h
6682160 0x65F630 Unix path: /home/buildtest/WindRiver_Vx6.8.3/vxworks-6.8/target/h/types/vxWindCommon.h
6684011 0x65FD6B Unix path: /home/buildtest/WindRiver_Vx6.8.3/vxworks-6.8/target/h/types/vxWindCommon.h
6686322 0x660672 Unix path: /home/buildtest/WindRiver_Vx6.8.3/vxworks-6.8/target/h/types/vxWindCommon.h
6688411 0x660E9B Unix path: /home/buildtest/WindRiver_Vx6.8.3/vxworks-6.8/target/h/types/vxWindCommon.h
6689449 0x6612A9 Unix path: /home/buildtest/WindRiver_Vx6.8.3/vxworks-6.8/target/h/types/vxWindCommon.h
6691360 0x661A20 Unix path: /home/buildtest/WindRiver_Vx6.8.3/vxworks-6.8/target/h/types/vxWindCommon.h
6692850 0x661FF2 Unix path: /home/buildtest/WindRiver_Vx6.8.3/vxworks-6.8/target/h/types/vxWindCommon.h
7099515 0x6C547B Intel x86 or x64 microcode, sig 0x171f8000, pf_mask 0xe00, 1C00-01-05, rev 0x1000000, size 1
7105579 0x6C6C2B Intel x86 or x64 microcode, pf_mask 0x11ff, 1F00-01-12, rev 0x1000000, size 1
7105947 0x6C6D9B Intel x86 or x64 microcode, sig 0x1850e000, pf_mask 0x1133200, 1B00-01-13, rev 0x1000000, size 112641
7113627 0x6C8B9B Intel x86 or x64 microcode, pf_mask 0x11ff, 1C00-01-21, rev 0x1000000, size 1
7114059 0x6C8D4B Intel x86 or x64 microcode, pf_mask 0x11ff, 1A00-01-22, rev 0x1000000, size 1
7114475 0x6C8EEB Intel x86 or x64 microcode, pf_mask 0x11ff, 1C00-01-23, rev 0x1000000, size 1
7115579 0x6C933B Intel x86 or x64 microcode, pf_mask 0x11ff, 1900-01-25, rev 0x1000000, size 1
7116683 0x6C978B Intel x86 or x64 microcode, sig 0x1a59c800, pf_mask 0x1283200, 2000-01-28, rev 0x1000000, size 175105
7231995 0x6E59FB Intel x86 or x64 microcode, sig 0x270cf000, pf_mask 0x2042900, 1C00-02-04, rev 0x1001200, size 69633
7234923 0x6E656B Intel x86 or x64 microcode, sig 0x0b197800, pf_mask 0x2112f00, 1A00-02-11, rev 0x1001200, size 1025
7481721 0x722979 StuffIt Deluxe (data): TD
7481737 0x722989 StuffIt Deluxe (data): TD
7481777 0x7229B1 StuffIt Deluxe (data): TD
7481829 0x7229E5 StuffIt Deluxe (data): TD
7520182 0x72BFB6 StuffIt Deluxe (data): TD
7548080 0x732CB0 StuffIt Deluxe (data): TD
7586280 0x73C1E8 StuffIt Deluxe (data): TDList
7598715 0x73F27B StuffIt Deluxe (data): TDData
7672522 0x7512CA StuffIt Deluxe (data): TDs
7693403 0x75645B StuffIt Deluxe (data): TDs
7698614 0x7578B6 ELF, 32-bit LSB executable, ARM, version 1 (ARM)
13807918 0xD2B12E Ubiquiti firmware additional data, name: UTED, size: 1634159721 bytes, size2: 1937001583 bytes, CRC32: 0
14211981 0xD8DB8D Copyright string: "Copyright 1995-2005 Jean-loup Gailly "
14218058 0xD8F34A CRC32 polynomial table, little endian
14222154 0xD9034A CRC32 polynomial table, big endian
14228929 0xD91DC1 Copyright string: "Copyright 1995-2005 Mark Adler "
14785144 0xE19A78 Intel x86 or x64 microcode, sig 0x7c6c0000, pf_mask 0x904802c0, 1901-04-28, rev 0x-10000, size 4
15035498 0xE56C6A Copyright string: "Copyright (c) 1992-2002 by P.J. Plauger, licensed by Dinkumware, Ltd. ALL RIGHTS RESERVED."
15037214 0xE5731E Copyright string: "Copyright (c) 1992-2002 by P.J. Plauger, licensed by Dinkumware, Ltd. ALL RIGHTS RESERVED."
18825010 0x11F3F32 Private key in DER format (PKCS header length: 4, sequence length: 25856
19018234 0x12231FA uImage header, header size: 64 bytes, header CRC: 0xE53864B7, created: 2020-09-09 12:29:44, image size: 3168864 bytes, Data Address: 0x20008000, Entry Point: 0x20008000, data CRC: 0xE3EC93A1, OS: Linux, CPU: ARM, image type: OS Kernel Image, compression type: none, image name: "Linux-3.2.96-3"
19018298 0x122323A Linux kernel ARM boot executable zImage (little-endian)
19036286 0x122787E gzip compressed data, maximum compression, from Unix, last modified: 1970-01-01 00:00:00 (null date)
22187162 0x1528C9A JFFS2 filesystem, little endian
My intention at the beginning was, just flash the firmware file. But it seems some magic is needed.
@tv84
@DavidAlfa
Any hint how to move forward?
Any help is welcome.
-
Could you upload your two flash dumps?
-
Uploading here might be a problem. But i can send you a PM with a wetransfer link.
-
Uploading here might be a problem. But i can send you a PM with a wetransfer link.
OK, as long as I don't have to sign up for anything. -
These are my initial observations:
This is the header of the TDF payload (0x22C bytes):Code: [Select]Offset(h) 00 04 08 0C 10 14
00000000 0000022C 00000005 54444948 002BC66B 48656174 77617665 ........TDIH....Heatwave
^^^^^^^^
size of header = 0x22C
00000018 00000000 00000000 00000000 00000000 00000000 03328A6E ........................
^^^^^^^^
size of payload, excluding header = 0x3328A6E
00000030 A6D95511 44617461 20526F62 6F746963 73204669 726D7761 ....Data Robotics Firmwa
00000048 72650000 00000000 00000000 00000000 00000000 00000000 re......................
00000060 00000000 00000000 00000000 00000000 00000000 00000000
........
00000108 00000000 00000000 00000000 00000000 00000000 00000000
00000120 00000000 00000000 00000000 00000000 00000000 6134BF8B
00000138 BD413911 00000000 00000000 00000000 00000000 00000000
00000150 00000000 00000000 0000002B 0001C66B 00000000 00000001
00000168 00000004 56584932 00000000 0075768A 00000000 002BC66B ....VXI2................
^^^^^^^^ ======== -------- ++++++++
total modules = 4 name offset size = 0x75768A
00000180 BF5B9A0A 52545049 0075768A 00ACB944 00000000 002BC66B ....RTPI................
00000198 9EDB53BD 4C584B49 01222FCE 00305AA0 00000000 002BC66B ....LXKI................
000001B0 AF700117 4C584653 01528A6E 01E00000 00000000 002BC66B ....LXFS................
000001C8 8342D28C 00000000 00000000 00000000 00000000 00000000
000001E0 00000000 00000000 00000000 00000000 00000000 00000000
000001F8 00000000 00000000 00000000 00000000 00000000 00000000
00000210 00000000 00000000 00000000 00000000 00000000 00000000
00000228 00000000
The payload contains 4 modules (VXI2, RTPI, LXKI, LXFS).
The offset is relative to the end of the header (add 0x22C to obtain absolute offset).
Each module has a CRC-32 checksum (Ethernet and PKZIP algorithm). I have verified all CRCs with HxD (freeware hex editor).Code: [Select]name offset size ???? ???? CRC-32 name
-------- -------- -------- -------- -------- -------- ----
56584932 00000000 0075768A 00000000 002BC66B BF5B9A0A VXI2 - verified OK -- 0x22C -- ELF, 32-bit LSB executable, ARM, version 1 (ARM)
52545049 0075768A 00ACB944 00000000 002BC66B 9EDB53BD RTPI - verified OK -- 0x7578B6 -- ELF, 32-bit LSB executable, ARM, version 1 (ARM)
4C584B49 01222FCE 00305AA0 00000000 002BC66B AF700117 LXKI - verified OK -- 0x12231FA -- Linux kernel
4C584653 01528A6E 01E00000 00000000 002BC66B 8342D28C LXFS - verified OK -- 0x1528C9A -- JFFS2 filesystem, little endian -
@fzabkar What tools do you use for analysing the code? I usually use binwalk/hexdump/xxd and imhex for bin files. But i couldn't follow your findings.
Opening the file with Malcat (first time i use this tool) showed me closer view to your findings.
-
@fzabkar As you can see in my prevoius post, the firmware file has two ELF files inside.
I inspected the 3 MB UImage from firmware file. It matches exactly to the lximage file i dumped via UART serial console from the Drobo device.
For the sake of completeness, here are the commands i used for dumping and post-processing the dump. To connect to the Drobo device i used cheap CP2102 UART to serial TTL adapters, using TX, RX, GND connection. I started minicom with logging option (-l lximage.cap in this case).Code: [Select]minicom -D /dev/ttyUSB1 -b 115200 -C lximage.cap
I did that for each file i dumped to have a logfile for each file.
Starting the Drobo device, i saw the log text flowing.
After stopping the boot process and entering the Marvell U-Boot shell i checked files:Code: [Select]fatls usb 0:1.
Then i loaded a file into memory:Code: [Select]fatload usb 0:1 20000000 lximage
I then displayed the memory from the position til file size end (in bytes):Code: [Select]md.b 20000000 3168928This process can take seconds, minutes or hours and hours, depends on filesize, just be patient and wait. If it's done, just hit "Shift+A L" to close the log file. Hit "Shift+A Q" to exit minicom.
The new logfile contains data from the file dump, commands entered in minicom and information from boot process. This unneccessary data has to be removed from the logfile. The file looks like this:Code: [Select]md.b 0x20000000 3836b8^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H ^H^H^H^H^H^H^H^H^H^H^H^H^H^ H^H^H^H^H^H^H^H^Hfatload usb 0:1 20000000 lximage_prev^H ^H^H ^H^H ^H^H ^H^H ^H
reading lximage
.
... ... ..............................................................................
3168928 bytes read
Marvell>> fatload usb 0:1 20000000 lximage^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H ^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^Hmd.b 0x20000000 3836b8^H ^H^ H ^H^H ^H^H ^H^H ^H^H ^H305aa0
20000000: 27 05 19 56 e5 38 64 b7 5f 58 ca b8 00 30 5a 60 '..V.8d._X...0Z`
20000010: 20 00 80 00 20 00 80 00 e3 ec 93 a1 05 02 02 00 ... ...........
20000020: 4c 69 6e 75 78 2d 33 2e 32 2e 39 36 2d 33 00 00 Linux-3.2.96-3..
*
*
*
20305a70: 00 00 00 00 26 5a 30 00 74 5a 30 00 44 46 00 00 ....&Z0.tZ0.DF..
20305a80: 70 5a 30 00 60 5a 30 00 e0 08 00 00 68 5a 30 00 pZ0.`Z0.....hZ0.
20305a90: 6c 5a 30 00 64 5a 30 00 00 00 00 00 00 00 00 00 lZ0.dZ0.........
Marvell>>
I used vim to clean the file. In vim, i deleted single lines by double hit d (dd) to delete stuff on top of the file until i reached the first line with address information. In this case untilCode: [Select]20000000: 27 05 19 56 e5 38 64 b7 5f 58 ca b8 00 30 5a 60 '..V.8d._X...0Z`I hit :$ to reach the end of the file and delete the last line with Marvell>> prompt. Save and exit files in vim with :wq!
Now the log file contains only data from the dump. But it's in hex format. To convert the hex file to binary format i used:Code: [Select]xxd -r -seek -0x20000000 lximage.cap lximage
Thats all. Filesize and checksum matches to the file on the Drobo devices.
The firmware file has 2 ELF images inside. None of the images matches to the vxworks or vxworks_prev file on the Drobo device. I assume, the update process failed after the lximage file was extracted and saved on the the Drobo device while the vxworks file was not extracted. I assume that because the lximage_prev is a different file, most probably the lximage used before the firmware update.
The vxworks and vxworks_prev does not match to the content from firmware file.
-
That's some really nice work! For my part, I just used a hex editor to visually examine the update file, and I used your binwalk dump to identify the functions of the 4 components. I doubt that you will find any tool to analyse the headers, as these are unique to each update package.
-
I found this set of quite very long videos about Drobo bootloader repair https://www.youtube.com/watch?v=G47tneORZOA. There are several usefull videos from this person, up to 9 hours long.
Maybe i'm on the right track with the vxwork image that was not updated during firmware update. The reason that i couldn't find content from SPI flash in the firmware file might be that the SPI flash was also not updated. The firmware seems to have some content for updating SPI flash. I did a:Code: [Select]hexdump -C release.B810i.2-0-1.tdf|grep -A 15 -B 15 BurnBootromCode: [Select]002e1690 44 52 41 4d 20 63 61 6c 63 75 6c 61 74 65 64 20 |DRAM calculated |
002e16a0 45 43 43 20 30 78 25 30 32 78 0a 00 53 75 6e 64 |ECC 0x%02x..Sund|
002e16b0 61 79 00 00 4d 6f 6e 64 61 79 00 00 54 75 65 73 |ay..Monday..Tues|
002e16c0 64 61 79 00 57 65 64 6e 65 73 64 61 79 00 00 00 |day.Wednesday...|
002e16d0 54 68 75 72 73 64 61 79 00 00 00 00 46 72 69 64 |Thursday....Frid|
002e16e0 61 79 00 00 53 61 74 75 72 64 61 79 00 00 00 00 |ay..Saturday....|
002e16f0 00 00 00 00 1f 00 00 00 3b 00 00 00 5a 00 00 00 |........;...Z...|
002e1700 78 00 00 00 97 00 00 00 b5 00 00 00 d4 00 00 00 |x...............|
002e1710 f3 00 00 00 11 01 00 00 30 01 00 00 4e 01 00 00 |........0...N...|
002e1720 57 61 72 6e 69 6e 67 3a 20 63 65 6e 74 75 72 79 |Warning: century|
002e1730 20 63 61 6e 6e 6f 74 20 62 65 20 73 65 74 28 61 | cannot be set(a|
002e1740 6c 77 61 79 73 20 25 64 29 20 0a 00 47 65 74 20 |lways %d) ..Get |
002e1750 44 41 54 45 3a 20 25 34 64 2d 25 30 32 64 2d 25 |DATE: %4d-%02d-%|
002e1760 30 32 64 20 28 25 73 29 20 20 54 49 4d 45 3a 20 |02d (%s) TIME: |
002e1770 25 32 64 3a 25 30 32 64 3a 25 30 32 64 0a 00 00 |%2d:%02d:%02d...|
002e1780 0a 0a 42 75 72 6e 42 6f 6f 74 72 6f 6d 3a 20 45 |..[b]BurnBootrom[/b]: E|
002e1790 72 72 6f 72 20 64 65 66 61 75 6c 74 20 66 6c 61 |rror default fla|
002e17a0 73 68 20 61 64 64 72 65 73 73 20 69 73 20 30 21 |sh address is 0!|
002e17b0 21 21 0a 00 20 20 20 20 20 20 20 20 20 20 20 20 |!!.. |
002e17c0 20 55 73 65 3a 20 77 20 78 78 78 78 20 77 68 65 | Use: w xxxx whe|
002e17d0 6e 20 78 78 78 78 20 69 73 20 66 6c 61 73 68 20 |n xxxx is flash |
002e17e0 61 64 64 72 65 73 73 0a 00 00 00 00 20 20 20 20 |address..... |
002e17f0 20 20 20 20 20 20 20 20 20 55 73 65 3a 20 42 75 | Use: Bu|
002e1800 72 6e 42 6f 6f 74 72 6f 6d 20 62 6f 6f 74 72 6f |rnBootrom bootro|
002e1810 6d 2e 62 69 6e 2c 20 78 78 78 78 20 77 68 65 6e |m.bin, xxxx when|
002e1820 20 78 78 78 78 20 69 73 20 66 6c 61 73 68 20 61 | xxxx is flash a|
002e1830 64 64 72 65 73 73 0a 00 75 73 72 4e 65 74 77 6f |ddress..usrNetwo|
002e1840 72 6b 49 6e 69 74 20 72 65 74 75 72 6e 20 65 72 |rkInit return er|
002e1850 72 6f 72 0a 00 00 00 00 42 75 72 6e 42 6f 6f 74 |ror.....BurnBoot|
002e1860 72 6f 6d 20 28 25 73 2c 25 78 29 0a 00 00 00 00 |rom (%s,%x).....|
002e1870 00 00 00 00 52 45 54 52 20 25 73 00 66 74 70 58 |....RETR %s.ftpX|
--
00368ec0 69 74 69 6f 6e 00 00 00 41 6d 49 43 50 55 00 00 |ition...AmICPU..|
00368ed0 41 6d 69 74 45 72 72 6f 72 49 6e 6a 65 63 74 00 |AmitErrorInject.|
00368ee0 41 72 6d 61 64 61 58 70 44 65 62 75 67 00 00 00 |ArmadaXpDebug...|
00368ef0 42 4c 5f 43 6f 70 79 00 42 53 50 5f 42 6f 6f 74 |BL_Copy.BSP_Boot|
00368f00 65 64 57 69 74 68 42 61 74 74 65 72 79 4f 6e 00 |edWithBatteryOn.|
00368f10 42 53 50 5f 43 70 75 43 6f 72 65 54 65 6d 70 52 |BSP_CpuCoreTempR|
00368f20 65 67 52 65 61 64 5f 45 72 72 61 74 61 00 00 00 |egRead_Errata...|
00368f30 42 53 50 5f 43 70 75 43 6f 72 65 54 65 6d 70 52 |BSP_CpuCoreTempR|
00368f40 65 67 52 65 61 64 5f 4d 69 73 6d 61 74 63 68 43 |egRead_MismatchC|
00368f50 6f 75 6e 74 00 00 00 00 42 53 50 5f 43 70 75 43 |ount....BSP_CpuC|
00368f60 6f 72 65 54 65 6d 70 52 65 67 52 65 61 64 5f 4d |oreTempRegRead_M|
00368f70 69 73 6d 61 74 63 68 54 6f 6c 65 72 61 6e 63 65 |ismatchTolerance|
00368f80 00 00 00 00 42 73 70 4d 6f 6f 64 4c 69 73 74 00 |....BspMoodList.|
00368f90 42 73 70 4d 6f 6f 64 4c 69 73 74 53 69 7a 65 00 |BspMoodListSize.|
00368fa0 42 75 66 66 65 72 50 61 67 65 43 72 6f 73 73 00 |BufferPageCross.|
00368fb0 42 75 72 6e 42 6f 6f 74 72 6f 6d 00 43 52 43 54 |[b]BurnBootrom[/b].CRCT|
00368fc0 61 62 6c 65 00 00 00 00 43 6f 70 79 41 6c 6c 53 |able....CopyAllS|
00368fd0 44 52 65 67 69 6f 6e 46 72 6f 6d 50 61 72 74 69 |DRegionFromParti|
00368fe0 74 69 6f 6e 53 63 68 65 6d 65 00 00 43 6f 70 79 |tionScheme..Copy|
00368ff0 53 44 52 65 67 69 6f 6e 46 72 6f 6d 50 61 72 74 |SDRegionFromPart|
00369000 69 74 69 6f 6e 00 00 00 43 72 65 61 74 65 44 61 |ition...CreateDa|
00369010 74 61 46 61 73 74 50 61 74 68 53 65 6d 61 70 68 |taFastPathSemaph|
00369020 6f 72 65 73 41 6e 64 4e 61 74 69 76 65 51 75 65 |oresAndNativeQue|
00369030 75 65 73 00 43 72 65 61 74 65 53 68 61 72 65 64 |ues.CreateShared|
00369040 52 65 67 69 6f 6e 53 65 6d 61 70 68 6f 72 65 00 |RegionSemaphore.|
00369050 44 52 49 46 6c 61 73 68 4c 6f 63 6b 00 00 00 00 |DRIFlashLock....|
00369060 44 52 49 46 6c 61 73 68 55 6e 6c 6f 63 6b 00 00 |DRIFlashUnlock..|
00369070 44 61 79 4e 61 6d 65 00 44 69 73 6b 44 65 74 65 |DayName.DiskDete|
00369080 63 74 53 63 00 00 00 00 44 69 73 6b 49 4f 43 6f |ctSc....DiskIOCo|
00369090 6d 70 6c 65 74 65 51 00 44 69 73 74 77 77 62 00 |mpleteQ.Distwwb.|
003690a0 44 72 69 42 69 6e 64 54 68 69 73 54 68 72 65 61 |DriBindThisThrea|
I used binwalk to extract content from firmware file and got some files, one with jffs2 extension.
I mounted this file:Code: [Select]modprobe mtdram total_size=30720 erase_size=128
modprobe mtdblock
mkdir /media/mtdtmp
dd if=1528C9A.jffs2 of=/dev/mtdblock0
mount -t jffs2 /dev/mtdblock0 /media/mtdtmp
The total_size value is in kb (du -sk 1528C9A.jffs2)
The files are the same i have on the Drobo-linux shell.
I found an interesting command on this linux shell called esa.
It seems it interacts with the vxworks side.Code: [Select]Drobo:/ # esa help
Commands defined:
apropos : Displays all commands with the search term in their name or description
clearKnownHostList : clear the list of known hosts
crash : Crash the iSCSI target code
cthreads : Create threads
dashboard : on|off - Turn dashboard connections on or off
discAgentDebug : diskAgentDebug [ on | off ] to enable or disable discovery agent output
discAgentDebug2 : diskAgentDebug2 [ on | off ] to enable or disable additional discovery agent output
dmesg : print system log
dropReads : dropReads [ on | off [all]] to enable or disable dropping 64K+/all reads
dropWrites : dropWrites [ on | off ] to enable or disable dropping write commands (WRITE6/10/16 and ATS)
dumpEMPDList : show the list of hosts with EMP connections
dumpKnownHostList : show the list of known hosts
dumpWaitingHostList : show the list of waiting hosts
EMPDDebug : EMPDDebug [ on | off ] to enable or disable console output
exit : Kill the iSCSI target subsystem
fault : Create a deliberate segfault
help : Displays all commands registered with the ConsoleCommand class along with their description
hlba : turn hlba list debug on/off/list
hostlog : Displays the host-side command and response logs
ipAddressUpdated : ipAddressUpdated to force IP address information to be resent to known Dashboards
lunReset : lunReset <LUN>
perf : perf [reset]
perflog : Issue 'state' or 'perf' or 'perf reset' or 'pause' or 'resume' PerfLog command
print : print [ on | off ] to enable or disable console output
qa : Displays all commands registered with the ConsoleCommand class for use by QA, along with their description
rescanj1 : Rescan the J1 free lists
reservations : reservations [ take | release ] to show reservations, take one, or release one we took
resetSpliceCount : reset counts of splice statistics
skipConsoleOutput : skipConsoleOutput [ on | off ]
spliceCount : print number of splice calls
state : Displays all classes' state (or help to show subcommands)
testdynallocator : testdynallocator
threads : List the threads that have been created
toggleSpliceTrace : toggle verbose splice tracing
version : Display the version & build information
zeroReadDebug : zeroReadDebug [ on | off ]
End of command listCode: [Select]Drobo:/ # Drobo:/ # esa dmesg
Drobo:/ # [ 0.000000] Booting Linux on physical CPU 1
[ 0.000000] Linux version 3.2.96-3 (drobo@7e4315534594) (gcc version 6.4.0 (GCC) ) #1 SMP Wed Sep 9 12:29:26 UTC 2020
[ 0.000000] CPU: Marvell PJ4Bv7 Processor [562f5842] revision 2 (ARMv7), cr=10c53c7d
[ 0.000000] CPU: PIPT / VIPT nonaliasing data cache, PIPT instruction cache
[ 0.000000] Machine: Marvell Armada XP Development Board
[ 0.000000] Using UBoot passing parameters structure
[ 0.000000] bootconsole [earlycon0] enabled
[ 0.000000] memblock_add_region memory start 0x20000000 size 0x58200000
[ 0.000000] memblock_add_region memory start 0x78200000 size 0x7e00000
[ 0.000000] memblock_add_region reserved start 0x53000000 size 0x29000000
[ 0.000000] memblock_add_region reserved start 0x200081c0 size 0x6e26b4
[ 0.000000] memblock_add_region reserved start 0x20004000 size 0x4000
[ 0.000000] Memory policy: ECC disabled, Data cache writealloc
[ 0.000000] memblock_add_region reserved start 0x52ffc000 size 0x4000
[ 0.000000] memblock_add_region reserved start 0x52ff8000 size 0x4000
[ 0.000000] memblock_add_region reserved start 0x52ff4000 size 0x4000
[ 0.000000] memblock_add_region reserved start 0x52ff0000 size 0x4000
[ 0.000000] memblock_add_region reserved start 0x52fec000 size 0x4000
[ 0.000000] memblock_add_region reserved start 0x52fe8000 size 0x4000
[ 0.000000] memblock_add_region reserved start 0x52fe4000 size 0x4000
[ 0.000000] On node 0 totalpages: 98304
[ 0.000000] free_area_init_node: node 0, pgdat 8064f800, node_mem_map 806ec000
[ 0.000000] DMA zone: 177 pages used for memmap
[ 0.000000] DMA zone: 0 pages reserved
[ 0.000000] DMA zone: 90063 pages, LIFO batch:7
[ 0.000000] HighMem zone: 16 pages used for memmap
[ 0.000000] HighMem zone: 8048 pages, LIFO batch:0
[ 0.000000] SMP: init cpus
[ 0.000000] PERCPU: Embedded 3 pages/cpu @809f8000 s22144 r8192 d18816 u49152
[ 0.000000] pcpu-alloc: s22144 r8192 d18816 u49152 alloc=3*16384
[ 0.000000] pcpu-alloc: [0] 0 [0] 1 [0] 2 [0] 3
[ 0.000000] Built 1 zonelists in Zone order, mobility grouping on. Total pages: 98111
[ 0.000000] Kernel command line: rootfstype=jffs2 root=/dev/mtdblock2 rw mtdparts=cfi_flash_0:1m@0m(nor_hdr),3m@1m(var),30m@4m(rfs0),30m@34m(rfs1),32m@64m(rfs2),32m@96m(rfs3) mv_cpu_count=3 mv_rsrc=uart1:eth0:eth1:eth2:spi:mstr mv_sh_mem=0x80000000:0x100000 mv_ipc=0 vmalloc=550M console=ttyS0,115200 earlyprintk=ttyS0,1152000 pm_level=off
[ 0.000000] PID hash table entries: 4096 (order: 0, 16384 bytes)
[ 0.000000] Dentry cache hash table entries: 262144 (order: 6, 1048576 bytes)
[ 0.000000] Inode-cache hash table entries: 131072 (order: 5, 524288 bytes)
[ 0.000000] Memory: 1536MB = 1536MB total
[ 0.000000] Memory: 889072k/889072k available, 683792k reserved, 65536K highmem
[ 0.000000] Virtual kernel memory layout:
[ 0.000000] vector : 0xffff0000 - 0xffff4000 ( 16 kB)
[ 0.000000] fixmap : 0xffc00000 - 0xfff00000 (3072 kB)
[ 0.000000] vmalloc : 0xd8800000 - 0xfa800000 ( 544 MB)
[ 0.000000] lowmem : 0x80000000 - 0xd8200000 (1410 MB)
[ 0.000000] pkmap : 0x7fe00000 - 0x80000000 ( 2 MB)
[ 0.000000] modules : 0x7f000000 - 0x7fe00000 ( 14 MB)
[ 0.000000] .text : 0x80008000 - 0x805e4000 (6000 kB)
[ 0.000000] .init : 0x805e4000 - 0x80619680 ( 214 kB)
[ 0.000000] .data : 0x8061a000 - 0x80651d68 ( 224 kB)
[ 0.000000] .bss : 0x80651d8c - 0x806ea874 ( 611 kB)
[ 0.000000] Hierarchical RCU implementation.
[ 0.000000] NR_IRQS:211
[ 0.000000] Initializing ArmadaXP SOC Timer 3
[ 0.000000] sched_clock: 32 bits at 25MHz, resolution 40ns, wraps every 171798ms
[ 0.000175] Calibrating delay loop... 1196.85 BogoMIPS (lpj=5984256)
[ 0.092926] pid_max: default: 32768 minimum: 301
[ 0.097739] Security Framework initialized
[ 0.101926] SELinux: Initializing.
[ 0.105505] SELinux: Starting in permissive mode
[ 0.105562] Mount-cache hash table entries: 2048
[ 0.110731] CPU: Testing write buffer coherency: ok
[ 0.115806] CPU0: thread -1, cpu 1, socket 0, mpidr 80000001
[ 0.121542] SMP: prepare CPUs (3 cores)
[ 0.125799] Setting Clocks for secondary CPUs
[ 0.131102] SMP: CPU 1 Waking up CPU 2
[ 0.149031] CPU1: Booted secondary processor
[ 0.180055] CPU1: thread -1, cpu 2, socket 0, mpidr 80000002
[ 0.180423] SMP: CPU 1 Waking up CPU 3
[ 0.211697] CPU2: Booted secondary processor
[ 0.250055] CPU2: thread -1, cpu 3, socket 0, mpidr 80000003
[ 0.250174] Brought up 3 CPUs
[ 0.263268] SMP: Total of 3 processors activated (3590.55 BogoMIPS).
[ 0.270345] devtmpfs: initialized
[ 0.277267] xor: measuring software checksum speed
[ 0.330056] arm4regs : 1160.000 MB/sec
[ 0.380051] 8regs : 708.800 MB/sec
[ 0.430048] 32regs : 996.800 MB/sec
[ 0.434298] xor: using function: arm4regs (1160.000 MB/sec)
[ 0.440071] NET: Registered protocol family 16
[ 0.445092] Aurora: Working in ARMv7 mode
[ 0.449168] L0 cache Enabled
[ 0.452129] Speculative Prefetch Disabled
[ 0.456211] Support IO coherency.
[ 0.464603] Skipping MPP configuration and GPIO interrupt enabling.
[ 0.488938] Skipping serdes configuration.
[ 0.593108] Warning: AMP Address decode windows reg != 0
[ 0.601278] Initialized Address decode windows
[ 0.605904]
[ 0.607473] Marvell Armada-XP DB-78460-BP rev 2.0 Board - Soc: MV78460 B0 LE
[ 0.614881] Detected Tclk 250000000, SysClk 600000000, FabricClk 600000000, PClk 1200000000
[ 0.623460] LSP version: linux-3.2.58-2014_T2.0p2 (16KB SW Page Size)
[ 0.630133] AMP: Resources - uart1 - eth0 - eth1 - eth2 - spi - mstr
[ 0.636872]
[ 0.638552] Register platform device: mv_neta_port_0
[ 0.643690] Register platform device: mv_neta_port_1
[ 0.648814] Register platform device: mv_neta_port_2
[ 0.662422] bio: create slab <bio-0> at 0
[ 0.830177] raid6: int32x1 400 MB/s
[ 1.000111] raid6: int32x2 371 MB/s
[ 1.170147] raid6: int32x4 330 MB/s
[ 1.340035] raid6: int32x8 323 MB/s
[ 1.343853] raid6: using algorithm int32x1 (400 MB/s)
[ 1.349545] SCSI subsystem initialized
[ 1.354293] Switching to clocksource axp_clocksource
[ 1.371146] NET: Registered protocol family 2
[ 1.380841] IP route cache hash table entries: 16384 (order: 2, 65536 bytes)
[ 1.388231] TCP established hash table entries: 65536 (order: 5, 524288 bytes)
[ 1.396063] TCP bind hash table entries: 65536 (order: 5, 524288 bytes)
[ 1.403199] TCP: Hash tables configured (established 65536 bind 65536)
[ 1.409795] TCP reno registered
[ 1.413012] UDP hash table entries: 1024 (order: 1, 32768 bytes)
[ 1.419131] UDP-Lite hash table entries: 1024 (order: 1, 32768 bytes)
[ 1.425860] NET: Registered protocol family 1
[ 1.430505] RPC: Registered named UNIX socket transport module.
[ 1.436485] RPC: Registered udp transport module.
[ 1.441276] RPC: Registered tcp transport module.
[ 1.446045] RPC: Registered tcp NFSv4.1 backchannel transport module.
[ 1.452555] PCI: CLS 0 bytes, default 64
[ 1.453107] o 3 Giga ports supported
[ 1.456925] o NETA acceleration mode 1
[ 1.460928] o RX Queue support: 8 Queues * 128 Descriptors
[ 1.466647] o TX Queue support: 8 Queues * 532 Descriptors
[ 1.472372] o GSO supported
[ 1.475410] o GRO supported
[ 1.478447] o Receive checksum offload supported
[ 1.483307] o Transmit checksum offload supported
[ 1.488246] o Driver ERROR statistics enabled
[ 1.492845]
[ 1.494480] port #0: is_sgmii=1, is_rgmii=1, phy_addr=16
[ 1.500071] o Loading network interface(s) for port #0: cpu_mask=0xf, tx_csum_limit=9800
[ 1.508410]
[ 1.509990] o Port 0 is connected to Linux netdevice
[ 1.516839] o eth0, ifindex = 2, GbE port = 0
[ 1.525048] giga p=0: mtu=1500, mac=00:50:43:89:11:17 (platform)
[ 1.531214]
[ 1.532800] port #1: is_sgmii=1, is_rgmii=1, phy_addr=17
[ 1.538371] o Loading network interface(s) for port #1: cpu_mask=0xf, tx_csum_limit=9800
[ 1.546713]
[ 1.548283] o Port 1 is connected to Linux netdevice
[ 1.555188] o eth1, ifindex = 3, GbE port = 1
[ 1.563402] giga p=1: mtu=1500, mac=00:50:43:dd:11:17 (platform)
[ 1.569567]
[ 1.571153] port #2: is_sgmii=1, is_rgmii=1, phy_addr=18
[ 1.576725] o Loading network interface(s) for port #2: cpu_mask=0xf, tx_csum_limit=9800
[ 1.585067]
[ 1.586636] o Port 2 is connected to Linux netdevice
[ 1.593561] o eth2, ifindex = 4, GbE port = 2
[ 1.601775] giga p=2: mtu=1500, mac=00:50:43:dd:89:17 (platform)
[ 1.607931]
[ 1.610478] audit: initializing netlink socket (disabled)
[ 1.615960] type=2000 audit(1.600:1): initialized
[ 1.679076] highmem bounce pool size: 64 pages
[ 1.684595] JFFS2 version 2.2. (NAND) Â 2001-2006 Red Hat, Inc.
[ 1.691058] aufs 3.2-20131104
[ 1.694107] msgmni has been set to 1608
[ 1.698115] SELinux: Registering netfilter hooks
[ 1.699020] async_tx: api initialized (async)
[ 1.703469] io scheduler noop registered
[ 1.707460] io scheduler deadline registered (default)
[ 1.712724] io scheduler cfq registered
[ 1.721748] Serial: 8250/16550 driver, 2 ports, IRQ sharing disabled
[ 1.728814] serial8250.0: ttyS0 at MMIO 0xd0012100 (irq = 42) is a 16550A
[ 1.735691] console [ttyS0] enabled, bootconsole disabled
[ 1.747020] shared_mem: kernel panic notifier registered
[ 1.752362] shared_mem: kernel panic dumper registered
[ 1.757530] SHARED_MEM: mapping shared memory Header physical addr 7bffc000 virtual addr 0xd8868000
[ 1.766612] SHARED_MEM: INIT: Shared Memory Header in Kernel space at Addr: 0xd8868000
[ 1.774574] shared_mem: shm_doorbell_init: IRQ 0x1 requested, doorbell mask 2197c queue_os_info b1768de0
[ 1.784100] shared_mem: shared_mem_module_init: Location of shm_dev: b1768dc0
[ 1.791265] shared_mem: shared_mem_module_init: Intercore message checksum is enabled
[ 1.799509] brd: module loaded
[ 1.803369] loop: module loaded
[ 1.807667]
[ 1.807670] INFO: Found cfi_flash_0 0 - base 0xd8000000, size 0x8000000, bus 2
[ 1.816243] INFO: flashInfoFill - Found 1 Flash Devices
[ 1.821502] INFO: flash_map_init - detected 1 devices
[ 1.826753] MTD: Initialize the cfi_flash_0 device at address 0xd8000000
[ 1.834489]
[ 1.834491] INFO: Io remapped successfully - phy addr = 0xd8000000, virt addr = 0xd9000000
[ 1.844111] INFO: Using cfi_probe to probe cfi_flash_0 at address 0xd8000000, size 0x8000000, width 2m
[ 1.853532] cfi_flash_0: Found 1 x16 devices at 0x0 in 16-bit bank. Manufacturer ID 0x000001 Chip ID 0x002801
[ 1.863677] Amd/Fujitsu Extended Query Table at 0x0040
[ 1.868840] Amd/Fujitsu Extended Query version 1.5.
[ 1.873918] number of CFI chips: 1
[ 1.877331] - detected OK
[ 1.879898] 6 cmdlinepart partitions found on MTD device cfi_flash_0
[ 1.886455] Creating 6 MTD partitions on "cfi_flash_0":
[ 1.891706] 0x000000000000-0x000000100000 : "nor_hdr"
[ 1.897676] 0x000000100000-0x000000400000 : "var"
[ 1.903232] 0x000000400000-0x000002200000 : "rfs0"
[ 1.908862] 0x000002200000-0x000004000000 : "rfs1"
[ 1.914532] 0x000004000000-0x000006000000 : "rfs2"
[ 1.920199] 0x000006000000-0x000008000000 : "rfs3"
[ 1.925844] - OK.
[ 1.928170] bonding: Ethernet Channel Bonding Driver: v3.7.1 (April 27, 2011)
[ 1.938780] md: raid6 personality registered for level 6
[ 1.944128] md: raid5 personality registered for level 5
[ 1.949465] md: raid4 personality registered for level 4
[ 1.954793] oprofile: hardware counters not available
[ 1.959867] oprofile: using timer interrupt.
[ 1.964233] nf_conntrack version 0.5.0 (13891 buckets, 55564 max)
[ 1.970685] ip_tables: (C) 2000-2006 Netfilter Core Team
[ 1.976088] TCP cubic registered
[ 1.979475] NET: Registered protocol family 10
[ 1.984659] ip6_tables: (C) 2000-2006 Netfilter Core Team
[ 1.990137] IPv6 over IPv4 tunneling driver
[ 1.994986] NET: Registered protocol family 17
[ 1.999524] 8021q: 802.1Q VLAN Support v1.8
[ 2.003738] VFP support v0.3: implementor 56 architecture 2 part 20 variant 9 rev 6
[ 2.011494] registered taskstats version 1
[ 2.015865] md: Skipping autodetection of RAID arrays. (raid=autodetect will force)
[ 6.863207] JFFS2 notice: (1) jffs2_build_xattr_subsystem: complete building xattr subsystem, 1 of xdatum (0 unchecked, 0 orphan) and 1 of xref (0 dead, 0 orphan) found.
[ 6.878816] VFS: Mounted root (jffs2 filesystem) on device 31:2.
[ 6.885037] Freeing init memory: 208K
[ 10.892425] SELinux: 2048 avtab hash slots, 98348 rules.
[ 11.091415] SELinux: 2048 avtab hash slots, 98348 rules.
[ 11.118524] SELinux: 6 users, 165 roles, 4443 types, 231 bools, 1 sens, 1024 cats
[ 11.118538] SELinux: 81 classes, 98348 rules
[ 11.131699] SELinux: Completing initialization.
[ 11.131707] SELinux: Setting up existing superblocks.
[ 11.131740] SELinux: initialized (dev sysfs, type sysfs), uses genfs_contexts
[ 11.131761] SELinux: initialized (dev rootfs, type rootfs), uses genfs_contexts
[ 11.131782] SELinux: initialized (dev bdev, type bdev), uses genfs_contexts
[ 11.131808] SELinux: initialized (dev proc, type proc), uses genfs_contexts
[ 11.131830] SELinux: initialized (dev tmpfs, type tmpfs), uses transition SIDs
[ 11.131902] SELinux: initialized (dev devtmpfs, type devtmpfs), uses transition SIDs
[ 11.132567] SELinux: initialized (dev sockfs, type sockfs), uses task SIDs
[ 11.132587] SELinux: initialized (dev debugfs, type debugfs), uses genfs_contexts
[ 11.134132] SELinux: initialized (dev pipefs, type pipefs), uses task SIDs
[ 11.134154] SELinux: initialized (dev anon_inodefs, type anon_inodefs), uses genfs_contexts
[ 11.134171] SELinux: initialized (dev devpts, type devpts), uses transition SIDs
[ 11.134233] SELinux: initialized (dev rpc_pipefs, type rpc_pipefs), uses genfs_contexts
[ 11.134257] SELinux: initialized (dev mqueue, type mqueue), uses transition SIDs
[ 11.134292] SELinux: initialized (dev selinuxfs, type selinuxfs), uses genfs_contexts
[ 11.134357] SELinux: initialized (dev mtd_inodefs, type mtd_inodefs), not configured for labeling
[ 11.134376] SELinux: initialized (dev jffs2, type jffs2), uses xattr
[ 11.134549] SELinux: initialized (dev sysfs, type sysfs), uses genfs_contexts
[ 11.425426] type=1403 audit(11.410:2): policy loaded auid=4294967295 ses=4294967295
[ 11.911820] SELinux: initialized (dev tmpfs, type tmpfs), uses transition SIDs
[ 11.984668] SELinux: initialized (dev binfmt_misc, type binfmt_misc), uses genfs_contexts
[ 12.337352] SELinux: initialized (dev tmpfs, type tmpfs), uses transition SIDs
[ 12.399940] SELinux: initialized (dev tmpfs, type tmpfs), uses transition SIDs
[ 12.436859] SELinux: initialized (dev aufs, type aufs), not configured for labeling
[ 12.473855] SELinux: initialized (dev aufs, type aufs), not configured for labeling
[ 12.501432] SELinux: initialized (dev tmpfs, type tmpfs), uses transition SIDs
[ 12.529057] SELinux: initialized (dev tmpfs, type tmpfs), uses transition SIDs
[ 13.868484] JFFS2 notice: (548) jffs2_build_xattr_subsystem: complete building xattr subsystem, 5 of xdatum (0 unchecked, 0 orphan) and 73 of xref (0 dead, 32 orphan) found.
[ 13.884464] SELinux: initialized (dev jffs2, type jffs2), uses xattr
[ 16.863111] pool #0: pkt_size=1536, buf_size=1632 - 2048 of 2048 buffers added
[ 16.870783] eth0: started
[ 16.873764] ADDRCONF(NETDEV_UP): eth0: link is not ready
[ 18.070628] eth0: stopped
[ 18.110514] eth0: started
[ 18.113477] ADDRCONF(NETDEV_UP): eth0: link is not ready
[ 18.153545] pool #1: pkt_size=1536, buf_size=1632 - 2048 of 2048 buffers added
[ 18.161211] eth1: started
[ 18.164184] ADDRCONF(NETDEV_UP): eth1: link is not ready
[ 19.312010] eth1: stopped
[ 19.352332] eth1: started
[ 19.355303] ADDRCONF(NETDEV_UP): eth1: link is not ready
[ 19.395447] pool #2: pkt_size=1536, buf_size=1632 - 2048 of 2048 buffers added
[ 19.403118] eth2: link up
[ 19.405764] eth2: started
[ 32.140472] SHARED_MEM: shared_mem_open: About to take semaphore.
[ 32.146918] SHARED_MEM: shared_mem_open: Got Semaphore.
[ 32.153568] shared_mem: wait_for_init_shared_mem: Entering mutex for shm_dev at b1768dc0
[ 32.163069] SHARED_MEM: CPU1: READY TO WAIT FOR INITIALIZATION OF SHARED MEMORY
And this command crashed the system:Code: [Select]Drobo:/ # Drobo:/ # esa state
=================================================
Thu Jan 1 00:03:25 1970: tDebug: DUMPING DIAGNOSTICS
Drobo:/ # =================================================
--- Diagnostics : Threads ---
ThreadID LWP ThreadName Priority
0x2adbb450 1505 tDebug 245
0x2af2b450 1506 tIscsiMultiWr0 206
0x2b0ef450 1507 tIscsiMultiWr1 206
0x2b2bb450 1508 tIscsiMultiWr2 206
0x2b61b450 1509 tIscsiMultiWr3 206
0x2b69b450 1510 tIscsiMultiWr4 206
0x2b6e7450 1511 tIscsiMultiWr5 206
0x2b95b450 1512 tIscsiMultiWr6 206
0x2ba63450 1513 tIscsiMultiWr7 206
0x2bb77450 1514 tIscsiMultiWr8 206
0x2bccb450 1515 tIscsiWB0 206
0x2be9b450 1516 tIscsiWB1 206
0x2c2af450 1517 tIscsiWB2 206
0x2c5cb450 1518 tIscsiWB3 206
0x2c757450 1519 tIscsiWB4 206
0x2c7d7450 1520 tIscsiWB5 206
0x2c893450 1521 tIscsiWB6 206
0x2c983450 1522 tIscsiWB7 206
0x2cadb450 1523 tIscsiWB8 206
0x2cbd7450 1524 tIscsiMgr 210
--- Diagnostics : Intercore ---
iscsiTgtIntercoreShow
Tag2CmdMapper has 0 records
Intercore lock --
locked : 0
count : 0
owner : 0 ((null))
Intercore command/response logs:
These logs show what has been sent over the intercore and what has been received
Thu Jan 1 00:03:25 1970: tDebug: Current timestamp is 205
Command Log:
tag 0 timestamp 0
...
tag 0 timestamp 0
Response Log:
tag 0 timestamp 0
...
tag 0 timestamp 0
End of Intercore command/response logs
Intercore Perf:
(no samples)
Perf for adding to intercore map:
(no samples)
Perf for removing from intercore map:
(no samples)
End of Intercore Perf
--------------------------------------------------------
--- Diagnostics : J1 ---
J1 state
gWbInfo 0xcdaf4 SharedPartitionInfo (nil)
TransPoolInfo gTransPool = (nil) sharedPartitionInfo->TransPoolInfo 0xc
BulkPoolInfo gBulkPool = (nil) sharedPartitionInfo->BulkPoolInfo 0x50
SharedPartitionInfo->VxSharedPartitionDataStart 0x98
WriteBufferDescriptor size = 128
Using two write buffer pools!
Thu Jan 1 00:03:25 1970: tDebug: Signal = SIGSEGV
Thu Jan 1 00:03:25 1970: tDebug: Thread ID 0x2adbb450
Thu Jan 1 00:03:25 1970: tDebug: stackaddr= 0x2ad9c000 : 0x2adbc000 [stacksize= 0x20000], context_addr= 0x2adb5444
Thu Jan 1 00:03:25 1970: tDebug: iSCSITgt crash backtrace
[ 240.139348] BUG: soft lockup - CPU#0 stuck for 22s! [iscsiTgt:1497]
[ 240.145635] Modules linked in:
[ 240.148708]
[ 240.150204] Pid: 1497, comm: iscsiTgt
[ 240.154923] CPU: 0 Not tainted (3.2.96-3 #1)
[ 240.159562] PC is at msleep_interruptible+0x10/0x78
[ 240.164455] LR is at msleep_interruptible+0x10/0x78
[ 240.169349] pc : [<800710d0>] lr : [<800710d0>] psr: 20070013
[ 240.169354] sp : aecb9d10 ip : aecb9d10 fp : aecb9d24
[ 240.180872] r10: 00000000 r9 : af152940 r8 : b1768fe0
[ 240.186114] r7 : 00000000 r6 : beadcafe r5 : b1768dc0 r4 : 806e25e0
[ 240.192660] r3 : cccccccd r2 : 271aef7c r1 : 00000057 r0 : 0000000a
[ 240.199209] Flags: nzCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment user
[ 240.206366] Control: 10c53c7d Table: 4f50006a DAC: 00000015
[ 240.212128] Backtrace:
[ 240.214609] [<80011d40>] (dump_backtrace+0x0/0x108) from [<8047b71c>] (dump_stack+0x18/0x1c)
[ 240.223072] r7:00000000 r6:ee6b2800 r5:aecb8000 r4:aecb9cc8
[ 240.228802] [<8047b704>] (dump_stack+0x0/0x1c) from [<8000f3c4>] (show_regs+0x4c/0x50)
[ 240.236752] [<8000f378>] (show_regs+0x0/0x50) from [<800a54f4>] (watchdog_timer_fn+0x16c/0x1a4)
[ 240.245476] r5:aecb8000 r4:806146f5
[ 240.249095] [<800a5388>] (watchdog_timer_fn+0x0/0x1a4) from [<80086da0>] (__run_hrtimer+0x9c/0x2b4)
[ 240.258173] [<80086d04>] (__run_hrtimer+0x0/0x2b4) from [<80087c50>] (hrtimer_interrupt+0x134/0x304)
[ 240.267332] r9:7fffffff r8:ffffffff r7:00000000 r6:809f84c0 r5:00000037
[ 240.273929] r4:e8dd0845
[ 240.276587] [<80087b1c>] (hrtimer_interrupt+0x0/0x304) from [<8001a480>] (axp_localtimer_handler+0x38/0x40)
[ 240.286362] [<8001a448>] (axp_localtimer_handler+0x0/0x40) from [<800a93d4>] (handle_percpu_devid_irq+0xa8/0x1b0)
[ 240.296660] [<800a932c>] (handle_percpu_devid_irq+0x0/0x1b0) from [<800a5804>] (generic_handle_irq+0x30/0x40)
[ 240.306609] [<800a57d4>] (generic_handle_irq+0x0/0x40) from [<8000eb3c>] (handle_IRQ+0x60/0xb4)
[ 240.315337] [<8000eadc>] (handle_IRQ+0x0/0xb4) from [<800081d0>] (asm_do_IRQ+0x10/0x14)
[ 240.323363] r9:af152940 r8:b1768fe0 r7:aecb9cfc r6:fbb21000 r5:20070013
[ 240.329959] r4:800710d0
[ 240.332612] [<800081c0>] (asm_do_IRQ+0x0/0x14) from [<80484694>] (__irq_svc+0x34/0xec)
[ 240.340553] Exception stack(0xaecb9cc8 to 0xaecb9d10)
[ 240.345623] 9cc0: 0000000a 00000057 271aef7c cccccccd 806e25e0 b1768dc0
[ 240.353828] 9ce0: beadcafe 00000000 b1768fe0 af152940 00000000 aecb9d24 aecb9d10 aecb9d10
[ 240.362031] 9d00: 800710d0 800710d0 20070013 ffffffff
[ 240.367106] [<800710c0>] (msleep_interruptible+0x0/0x78) from [<802de444>] (wait_for_init_shared_mem+0x10c/0x174)
[ 240.377398] r5:b1768dc0 r4:806e25e0
[ 240.381012] [<802de338>] (wait_for_init_shared_mem+0x0/0x174) from [<802e02cc>] (shared_mem_open_main+0xd8/0x140)
[ 240.391304] r7:00000000 r6:af152940 r5:b1768dd0 r4:b1768dc0
[ 240.397034] [<802e01f4>] (shared_mem_open_main+0x0/0x140) from [<802e035c>] (shared_mem_open+0x28/0x5c)
[ 240.406454] r7:b1639588 r6:af152940 r5:b1639588 r4:b1768dc0
[ 240.412184] [<802e0334>] (shared_mem_open+0x0/0x5c) from [<801182a4>] (chrdev_open+0x120/0x248)
[ 240.420907] r6:806d7884 r5:00000000 r4:b1768fe0
[ 240.425580] [<80118184>] (chrdev_open+0x0/0x248) from [<801118b8>] (__dentry_open+0x1c0/0x3b8)
[ 240.434223] [<801116f8>] (__dentry_open+0x0/0x3b8) from [<80112c04>] (nameidata_to_filp+0x68/0x78)
[ 240.443216] [<80112b9c>] (nameidata_to_filp+0x0/0x78) from [<80122a30>] (do_last.constprop.13+0x31c/0x780)
[ 240.452898] r7:00000000 r6:00000000 r5:00000000 r4:aecb9ed8
[ 240.458627] [<80122714>] (do_last.constprop.13+0x0/0x780) from [<80122f8c>] (path_openat+0xbc/0x420)
[ 240.467792] [<80122ed0>] (path_openat+0x0/0x420) from [<80123428>] (do_filp_open+0x34/0x90)
[ 240.476173] [<801233f4>] (do_filp_open+0x0/0x90) from [<80112d00>] (do_sys_open+0xec/0x18c)
[ 240.484548] r7:af0b8000 r6:ffffff9c r5:00000001 r4:00000019
[ 240.490277] [<80112c14>] (do_sys_open+0x0/0x18c) from [<80112dc0>] (sys_open+0x20/0x24)
[ 240.498303] r9:aecb8000 r8:8000ddc8 r7:00000005 r6:000e3554 r5:000cd978
[ 240.504900] r4:000cd000
[ 240.507553] [<80112da0>] (sys_open+0x0/0x24) from [<8000dc20>] (ret_fast_syscall+0x0/0x30)
[ 240.515843] Kernel panic - not syncing: softlockup: hung tasks
[ 240.521693] shared_mem_panic_dump: WARNING: LXPM area not initialized yet.
[ 240.528591] CPU2: stopping
[ 240.531307] Backtrace:
[ 240.533785] [<80011d40>] (dump_backtrace+0x0/0x108) from [<8047b71c>] (dump_stack+0x18/0x1c)
[ 240.542248] r7:b1128000 r6:00000000 r5:80627070 r4:806520a4
[ 240.547977] [<8047b704>] (dump_stack+0x0/0x1c) from [<800138c8>] (handle_IPI+0x150/0x16c)
[ 240.556183] [<80013778>] (handle_IPI+0x0/0x16c) from [<800083b8>] (do_IPI+0x10/0x14)
[ 240.563949] r9:562f5842 r8:8048ebb0 r7:b1129fa4 r6:fbb21000 r5:600e0013
[ 240.570546] r4:8000f088
[ 240.573200] [<800083a8>] (do_IPI+0x0/0x14) from [<80484694>] (__irq_svc+0x34/0xec)
[ 240.580792] Exception stack(0xb1129f70 to 0xb1129fb8)
[ 240.585861] 9f60: 00000021 806262d8 00000002 80019364
[ 240.594066] 9f80: 80651ec4 8062c45c 80568c10 b1128000 8048ebb0 562f5842 00000000 b1129fdc
[ 240.602271] 9fa0: b1129fb8 b1129fb8 8000eefc 8000f088 600e0013 ffffffff
[ 240.608910] [<8000efd8>] (cpu_idle+0x0/0xdc) from [<804783e0>] (secondary_start_kernel+0x164/0x16c)
[ 240.617982] r9:562f5842 r8:2000406a r7:8065208c r6:10c03c7d r5:000001d3
[ 240.624578] r4:00000004
[ 240.627230] [<8047827c>] (secondary_start_kernel+0x0/0x16c) from [<20477c34>] (0x20477c34)
[ 240.635518] r5:00000015 r4:5113006a
[ 240.639128] CPU1: stopping
[ 240.641843] Backtrace:
[ 240.644320] [<80011d40>] (dump_backtrace+0x0/0x108) from [<8047b71c>] (dump_stack+0x18/0x1c)
[ 240.652784] r7:b10e0000 r6:00000000 r5:80627070 r4:806520a4
[ 240.658511] [<8047b704>] (dump_stack+0x0/0x1c) from [<800138c8>] (handle_IPI+0x150/0x16c)
[ 240.666715] [<80013778>] (handle_IPI+0x0/0x16c) from [<800083b8>] (do_IPI+0x10/0x14)
[ 240.674481] r9:562f5842 r8:8048ebb0 r7:b10e1fa4 r6:fbb21000 r5:60070013
[ 240.681075] r4:8000f088
[ 240.683729] [<800083a8>] (do_IPI+0x0/0x14) from [<80484694>] (__irq_svc+0x34/0xec)
[ 240.691320] Exception stack(0xb10e1f70 to 0xb10e1fb8)
[ 240.696389] 1f60: 00000020 806262d8 00000001 80019364
[ 240.704595] 1f80: 80651ec4 8062c45c 80568c10 b10e0000 8048ebb0 562f5842 00000000 b10e1fdc
[ 240.712800] 1fa0: b10e1fb8 b10e1fb8 8000eefc 8000f088 60070013 ffffffff
[ 240.719439] [<8000efd8>] (cpu_idle+0x0/0xdc) from [<804783e0>] (secondary_start_kernel+0x164/0x16c)
[ 240.728510] r9:562f5842 r8:2000406a r7:8065208c r6:10c03c7d r5:000001d3
[ 240.735103] r4:00000002
[ 240.737754] [<8047827c>] (secondary_start_kernel+0x0/0x16c) from [<20477c34>] (0x20477c34)
[ 240.746042] r5:00000015 r4:510f006a
[ 240.749652] shared_mem_panic_event: Kernel panic event handler called. Notifying VxWorks Core of Kernel panic.
-
I found another very interesting tool for analyzing firmware files and memory dumps: emba https://github.com/e-m-b-a/emba
I have to dig into it. Maybe it helps with all the informations it automaticly analyses. Couldn't get it to work on my Arch Linux Notebook. But it worked like a charm on my SLS2 in WSL using Ubuntu as distribution.
The image is from analyzing the dumped files i found in Marvell U-Boot shell.
-
I need some help from either someone who can extract a working vxworks image from this firmware file or someone who can provide the files from a working device.
I tried different things now loading the vxworks ELF images i extracted manually from the firmware file and the ones emba extracted automaticly. I tried to load it in u-boot using loady and ymodem in minicom but could not get it to work.
I then tried it using kermit in minicom and was able to successfully upload the data using ckermit after creating ~/.kermrc with this content:Code: [Select]set carrier-watch off
set handshake none
set flow-control none
robust
set file type bin
set rec pack 1000
set send pack 1000
set window 5
I tried the firmware file itself and the extracted ELF files from the firmware file containing the vxworks stuff. The firmware file has more than 50 MB. It took more than 90 minutes to upload it over uart serial connection in u-boot. I't didn't help. When i runCode: [Select]go 0x20000000
and some commands from printenv data likeCode: [Select]td_bootargs_confab; run flashload_g0; bootvx 0x20000000
It always complains "No ELF file at 0x20000000". Because of the very slow upload speed using kermit, i tried a combination of Marvell u-boot shell and openocd.
Loading a file to memory is way faster in openocd.
I started the device, pressed a button to stop boot process and entering the Marvell u-boot shell. In openocd i did:Code: [Select]halt
load_image /home/<user>/<some_path>/7698614-19018234.elf32 0x20000000 elf
resume
In u-boot i tried the same commands like before, go 0x20000000 or td_bootargs_confab; run flashload_g0; bootvx 0x20000000.
I don't know why but sometimes the image was not loaded to 0x20000000. Sometimes it was loaded at 0x21000000.
I couldn't even load the original vxworks image i dumped from the Drobo device.
One time i tried loading it at 0x00000000 and it was loaded at 0x01000000.
In this case, i did in openocd a resume 0x01000000 and to my surprise, it started to load but halted at some point.
But this time i had blue lights on the device and the bootlog was different:Code: [Select]Marvell>> td_bootargs_confab; run flashload_g0; bootvx 0x21000000
Env Var skipConfabulation=0
Skip Confabulation: NONE
... skipConfabulation: 0x1 skips Vx confab, 0x2 skips Lx confab
Current Value of Vx bootargs_g0:
==================================================
bootargs_g0=neta(3,0) f=0x6000 o=usb0:eth3:cpus=1:mem=0x20000000;MAC3-00:50:43:11:89:dd;SEe
==================================================
EnvVar bootargsStart=neta(3,0)
EnvVar vxFlags=f=0x6000
EnvVar vxDev=usb0:eth3:cpus=1:mem=0x20000000
EnvVar eth3addr=00:50:43:11:89:dd
EnvVar droboSER=DRB143602000000
EnvVar vxCmd=s=#/romfs/runesa.vxe
Confabulated Value of bootargs_g0:
==================================================
bootargs_g0=neta(3,0) f=0x6000 o=usb0:eth3:cpus=1:mem=0x20000000;MAC3-00:50:43:11:89:dd;SEe
==================================================
Current bootargs_g0 perfectly match the Confabulated bootargs_g0
No Need to Update the Environment
reading vxWorks_prev
.
.
.
...........................................................................................
17734472 bytes read
## Ethernet MAC address not copied to NV RAM
## No elf image at address 0x21000000
## Not an ELF image, assuming binary
## Using bootline (@ 0x1100): neta(3,0) f=0x6000 o=usb0:eth3:cpus=1:mem=0x20000000;MAC3-00e
## Starting vxWorks at 0x21000000 ...
MPP33 Config (0xd0018010) == 0x11110040 (Should be: 0xXXXXXX4X)
SDRAM Config (0xd0001400) == 0x7201c924 (Should be: 0x72XXXXXX)
DRAM TBsAddr (0xd0001580) == 0x20000000 (Should be: 0x??????]
Booting from CPU 0
Detected board Heatwave 1.0
DRAM env init....... Done.
Detected DRAM size 512MB
AMP: Resources - uart0 - pex1 - pex2 - eth3 - xor0 - usb0 - i2c0 - i2c1 - sata - spi - g
AMP CPUs = 1
AMP mem size = 0x20000000
TWSI init Channel 0....... Done. Actual freq = 97656Hz
Skipping serdes configuration.
Ctrl env init....... Done.
Addr Dec Win......
Verified
CP15 mrvl dbgr 0x000109A7
CP15 mrvl dbgr2 0xEA008208
CP15 mrvl ctrl 0x000001B6
CP15 mrvl dbgr 0x000109A7
CP15 mrvl dbgr2 0xEA008208
CP15 mrvl ctrl 0x000001B6
CPU if init......... Done.
GPP init............ Done.
DRAM env init....... Done.
Using DRAM size 512MB
=======================> HW Revision Register == 0x00000881
Detected Board: Heatwave MVT, Spin 0 (No EthDebug)
Detect: Tclk 250MHz
SysClk 600MHz
L2Clk 600MHz
pClk 1200MHz
Marvell Controller initialization Done.
Modules Detected:
SPI flash based addr on 0xD4000000=
SPI Flash 8MB detected
esaXORSystemInit
esaXORSystemInit...done
esaDMASystemInit
Initialising SEEPROM Interface
Checking Bootline.......0x00001100 [0x6e]
UBOOT Version: UBOOT-2.33
Bootline params = neta(3,0) f=0x6000 o=usb0:eth3:cpus=1:mem=0x20000000;MAC3-00:50:43:11:89
DRAM int Ctrl....... Done
IDMA Err int Ctrl... Done
IDMA init........... Done
NETA Err int Ctrl... Done
Neta int Ctrl....... Done
GPIO int Ctrl....... Done
PCI int Ctrl........ Done
PCI-E 0: Not mapped to this OS
PCI-E 1: Not mapped to this OS
PCI-E 2: Not mapped to this OS
PCI-E 3: Not mapped to this OS
mvPexIntfInit() ROOT COMPLEX Init pexHWInf: 4
mvSysPexInit() called pexIf: 4 type: 0 MAX_TARGETS: 44
mvSysPexInit() OK from mvCtrlAddrWinMapBuild()
mvSysPexInit() OK from mvPexWinInit()
mvPexModeGet() configured as ROOT reg: 0x4014032e
mvPexInit() configuring as ROOT
mvPexLocalBusNumSet() called for pexIf: 4 busNum: 0 localBus: 0 localDev: 0
*******************mvPexLocalDevNumSet(4) localBus: 0 localDev: 0 pexStatus: 0 ***********
mvPexInit() call mvPexMasterEnable
mvPexInit() call mvPexSlaveEnable
mvPexInit() disable int
mvPexInit() wait a tick
mvPexInit() check for link
PEX4 interface detected Link X1
mvPexIntfInit() checking if we should set the localBus pex0flg: 0 pexHWInf: 4
mvPexIntfInit() setting localBusNum to 0 for pexHWInf 4
mvPexLocalBusNumSet() called for pexIf: 4 busNum: 0 localBus: 0 localDev: 0
PCI-E 4/10: Done.
PCI-E 5: is power off
mvPexIntfInit() ROOT COMPLEX Init pexHWInf: 6
mvSysPexInit() called pexIf: 6 type: 0 MAX_TARGETS: 44
mvSysPexInit() OK from mvCtrlAddrWinMapBuild()
mvSysPexInit() OK from mvPexWinInit()
mvPexModeGet() configured as ROOT reg: 0x4014022e
mvPexInit() configuring as ROOT
mvPexLocalBusNumSet() called for pexIf: 6 busNum: 0 localBus: 1 localDev: 0
*******************mvPexLocalDevNumSet(6) localBus: 0 localDev: 0 pexStatus: 0 ***********
mvPexInit() call mvPexMasterEnable
mvPexInit() call mvPexSlaveEnable
mvPexInit() disable int
mvPexInit() wait a tick
mvPexInit() check for link
PEX6 interface detected Link X1
mvPexIntfInit() checking if we should set the localBus pex0flg: 0 pexHWInf: 6
mvPexIntfInit() setting localBusNum to 0 for pexHWInf 6
mvPexLocalBusNumSet() called for pexIf: 6 busNum: 0 localBus: 0 localDev: 0
PCI-E 6/10: Done.
mvPexIntfInit() ROOT COMPLEX Init pexHWInf: 7
mvSysPexInit() called pexIf: 7 type: 0 MAX_TARGETS: 44
mvSysPexInit() OK from mvCtrlAddrWinMapBuild()
mvSysPexInit() OK from mvPexWinInit()
mvPexModeGet() configured as ROOT reg: 0x4014022e
mvPexInit() configuring as ROOT
mvPexLocalBusNumSet() called for pexIf: 7 busNum: 0 localBus: 2 localDev: 0
*******************mvPexLocalDevNumSet(7) localBus: 0 localDev: 0 pexStatus: 0 ***********
mvPexInit() call mvPexMasterEnable
mvPexInit() call mvPexSlaveEnable
mvPexInit() disable int
mvPexInit() wait a tick
mvPexInit() check for link
PEX7 interface detected Link X1
mvPexIntfInit() checking if we should set the localBus pex0flg: 0 pexHWInf: 7
mvPexIntfInit() setting localBusNum to 0 for pexHWInf 7
mvPexLocalBusNumSet() called for pexIf: 7 busNum: 0 localBus: 0 localDev: 0
PCI-E 7/10: Done.
mvPexIntfInit() ROOT COMPLEX Init pexHWInf: 8
mvSysPexInit() called pexIf: 8 type: 0 MAX_TARGETS: 44
mvSysPexInit() OK from mvCtrlAddrWinMapBuild()
mvSysPexInit() OK from mvPexWinInit()
mvPexModeGet() configured as ROOT reg: 0x4014032e
mvPexInit() configuring as ROOT
mvPexLocalBusNumSet() called for pexIf: 8 busNum: 0 localBus: 3 localDev: 0
*******************mvPexLocalDevNumSet(8) localBus: 0 localDev: 0 pexStatus: 0 ***********
mvPexInit() call mvPexMasterEnable
mvPexInit() call mvPexSlaveEnable
mvPexInit() disable int
mvPexInit() wait a tick
mvPexInit() check for link
PEX8 interface detected Link X1
mvPexIntfInit() checking if we should set the localBus pex0flg: 0 pexHWInf: 8
mvPexIntfInit() setting localBusNum to 0 for pexHWInf 8
mvPexLocalBusNumSet() called for pexIf: 8 busNum: 0 localBus: 0 localDev: 0
PCI-E 8/10: Done.
PCI-E 9: Not mapped to this OS
USB0 init........... Done. HOST type selected
USB Err int Ctrl.... Done
XOR Err int Ctrl.... Done
mvSysXorInit: done
XOR init............ Done
mvCtrlInit2......... done
vxbDevInit.........done
sysSerialConnectAll.........done
Serial Ports...Attached
UART2...Baud Rate Adjusted to 38.4K
VxBus Loaded.... done
bspConfigureI2CTable: Configuring I2C tables for 8-Slot (Kryten)
[tRootTask] 1970-01-01 00:00:00: drDrvLaunch
---->> drDrv() <<----
Allocated temp buffer 0x42599a8
[tRootTask] 1970-01-01 00:00:00: Diagnostic Re-Route Device Driver - Version 1.0 - Install.
[tRootTask] 1970-01-01 00:00:00: drStartLogging() started
_DEF_STD_OUT = 3 _DEF_STD_ERR = 3 _DR_FD = 4
Host Name: bootHost
Target Name: vxTarget
User: target
Ethernet port #3 initialized
neta3 Interface Loaded; MAC: 00:50:43:11:89:DD
neta3 Interface Started
Attempting to register custom syscalls group
ipAttached to interface neta3 ip=
Can't Set IP address to <neta3> interface..bootline does not have ethernet ipAddress
Adding 10511 symbols for standalone.
Detected Marvell USB. SettingwdbConfig: error configuring WDB communication interface
]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]
]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]
]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]
]]]]]]]]]]] ]]]] ]]]]]]]]]] ]] ]]]] (R)
] ]]]]]]]]] ]]]]]] ]]]]]]]] ]] ]]]]
]] ]]]]]]] ]]]]]]]] ]]]]]] ] ]] ]]]]
]]] ]]]]] ] ]]] ] ]]]] ]]] ]]]]]]]]] ]]]] ]] ]]]] ]] ]]]]]
]]]] ]]] ]] ] ]]] ]] ]]]]] ]]]]]] ]] ]]]]]]] ]]]] ]] ]]]]
]]]]] ] ]]]] ]]]]] ]]]]]]]] ]]]] ]] ]]]] ]]]]]]] ]]]]
]]]]]] ]]]]] ]]]]]] ] ]]]]] ]]]] ]] ]]]] ]]]]]]]] ]]]]
]]]]]]] ]]]]] ] ]]]]]] ] ]]] ]]]] ]] ]]]] ]]]] ]]]] ]]]]
]]]]]]]] ]]]]] ]]] ]]]]]]] ] ]]]]]]] ]]]] ]]]] ]]]] ]]]]]
]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]
]]]]]]]]]]]]]]]]]]]]]]]]]]]]] Development System
]]]]]]]]]]]]]]]]]]]]]]]]]]]]
]]]]]]]]]]]]]]]]]]]]]]]]]]] VxWorks 6.8
]]]]]]]]]]]]]]]]]]]]]]]]]] KERNEL: WIND version 2.13
]]]]]]]]]]]]]]]]]]]]]]]]] Copyright Wind River Systems, Inc., 1984-2012
CPU: Marvell Sheeva 88SV584x, Board= Heatwave 1.0 ARMARCHV7 LE core. Processor #0.
Memory Size: 0x1fe70000. BSP version 2.3.1.
Created: Feb 3 2016, 20:45:55
ED&R Policy Mode: Deployed
WDB Comm Type: WDB_COMM_END
WDB: Agent configuration failed.
[tRootTask] 1970-01-01 00:00: MV_USB_MODE_RE00: kCmdInit: Initialising kernel command liner
[tRootTask] 1970-01-01 00:00:00: diskCmdRegister: Installing k disk Commands
G = 0x3
ESA Register Driver Found Board version 2, stuffing option 1
Initialising boot SEEPROM handler
Checking boot register values in serialEEPROM ...
<<<<Flash Upgrade Driver - version 1.0 - installed.
IsFlashForDroboPro: We are NOT running on Drobo Pro deal with flash accordingly
Failed to get flash layout...this is expected for Optimus Prime, which does not have NOR F.
System Configuration
CHIP : MV88F7846 Rev 2
CPU : Marvell PJ4B (584) v7 (Rev 2)
BOARD : Heatwave 1.0 (0x0)
CLOCKs : tClk = 250MHz, sysClk = 600MHz
L2Clk = 600MHz pClk = 1200MHz
ETH_JUMBO_SUPPORT = Disabled
BRIDGING_SUPPORT = Enabled
MULTI_Q_SUPPORT = Disabled
NAT_SUPPORT = Disabled
VFP_SUPPORT = Enabled
L2 Cache = Enabled
IO coherency = Enabled
Get DATE: 2071-06-19 (Friday) TIME: 21:30:01
[vxWorks *]#
=======================> HW Revision Register == 0x00000881
Board Type 4, Rev 2 (Heatwave MVT), Spin = 0
Stuffing Opt = 1 (No EthDebug), DevDebugBitz = 0x0
Drobo B810i
Heatwave
Ready to take a Byte!
==============================================================================
Initializing PMU...
Reading PMU Version...
PMU Version: 1.2.0x046c, Download Version 108 (Variant 4) [Failsafe Ver 4]
Considering an Update to the PMU ...
PMU is up to date for this MVT board.
Reading 0xac from PMU GPIO Port 1 [ @0x0020 ]
Reading 0xef from PMU GPIO Port 2 [ @0x0028 ]
Reading 0x71 from PMU GPIO Port 3 [ @0x0018 ]
Reading 0x10 from PMU GPIO Port 4 [ @0x001c ]
==============================================================================
PMU is Running on AC Power :-)
==============================================================================
==============================================================================
0x48ac278 (BusM A): 0x48ac278 (BusM A): INFO: usb2Msc - Storage driver got a device attach.
INFO: usb2Msc - Storage driver got a device attach notification.
This Optimus Prime PMU is NOT configured for Early-Follow of DDR3 Reset...Fixing
0x48ac278 (BusM A): 0x48ac278 (BusM A): INFO: usb2Msc - Mounting device (PDT 0x0 PQ 0x0 RMP
INFO: usb2Msc - Mounting device (PDT 0x0 PQ 0x0 RMB 0x0) VID = : PID = USB DISK MP
0x48ac278 (BusM A): 0x48ac278 (BusM A): INFO: usb2Msc - Device 0x2 LUN 0 of 1005568 (KB) w0
INFO: usb2Msc - Device 0x2 LUN 0 of 1005568 (KB) will be mounted with base name /bd0
This Optimus Prime Board Supports Self-Refresh only with VRM_EN
...PMU will ENABLE VRM_EN during a reboot/shutdown cycle.
PMU BootOnBatt Counter DEFAULT is now 3
/bd0/ - disk check in progress ...
/bd0/Crashlogs/crashlog-20160306-1012 PMU BootOnBatt Counter ACTUAL is now 3
==============================================================================
Set temp = Kryten
/bd0/ - Volume is OK
total # of clusters: 62,580
# of free clusters: 56,607
# of bad clusters: 0
total free space: 905,712 Kb
0, 0, max contiguous free space: 923,697,152 bytes
# of files: 58
# of folders: 1
total bytes in files: 94,805 Kb
# of lost chains: 0
total bytes in lost chains: 0
0, 0, 0, 0,
PMU Skip-OverTemp Setting: 0x0000
PMU Shutdown Status: 0x00
PMU Shutdown IS NOT Pending!
PMU Shutdown Reasons are Fully Enabled
Disk Array Temp is Within Tolerances
CPU Core Temp is Within Tolerances
PMU Core Temp is Within Tolerances
PMU Shutdown Reason: 0x00
PMUCmd: "A" --> "a"
"Y" --> "0x0680,23:20.75,0,0,0"
"B" --> "1,0,0,0,0,1"
Total = 0:0 in 0 cycles
PMU state machine current state is 'NORMAL' [0x06]
PMU reports the DRAM data was INVALID at bootup [0x80]
Accumulated Up-time = 0 days: 0 hours: 23 minutes: 20.085 seconds
(1 Active cycles, 1 Power cycles)
Latest battery backup time = 00:00:00 (hh:mm:ss)
Longest battery backup time = 00:00:00 (hh:mm:ss)
Accumulated battery backup time = 00:00:00 (hh:mm:ss)
(0 Backup cycles, 0 Completed cycles, 0 Failed cycles, 0 Backup flags)
0x4011744 (tErfTask): 0x4011744 (tErfTask): INFO: usb2Msc - Device /bd0 has been claimed bm
INFO: usb2Msc - Device /bd0 has been claimed by filesystem
NOTIFY: hDevice 0x2 lun 0 medium changed (mediumInsert = 1)
PMU Reports Voltages: (AC == 12.085V) (Batt == 0.263V)
PMU LED Dimming: Default==25, Current==25
PMU Fan Speed AutoAdjust has been ENABLED
PMU Fan Speed: Default== 1, Current== 1
Setting Temperature Critical Threshold for Disk from 56 to 65
Temperature Thresholds for Disk: Interest== 52, Warning== 55, Critical== 65 -- Override==F
PMU Init Done
==============================================================================
**** ArmadaXP is Type B0
Launching LED Sequencer...
LED Sequencer...Launched
LED Sequencer...Testing...
Setup Kernel/RTP Messaging Interface
Initialising kernel<->RTP queues with 80 entries
USB command/response Q's @ 0xf4102000/0xf4103000
MULTI ISSUE command/response Q's @ 0x0/0xf4105000
FAST PATH QUEUING RTP INTERFACE ENABLED
64-BIT HOST LBAs ENABLED
Setup Kernel/RTP Resource Release Messaging Interface
Initialising kernel<->RTP resource release queues with 80 entries
MULTI ISSUE RESOURCE RELEASE Q @ 0xf4107000
FAST PATH QUEUING RTP RESOURCE RELEASE INTERFACE ENABLED
IntConnect pISR==0x01076b9c was Successful for Cause==32 ("PMU Panic")
IntConnect pISR==0x01076c34 was Successful for Cause==40 ("PMU PowerDownReq")
IntConnect pISR==0x01076b20 was Successful for Cause==57 ("PMU OverTemp")
IntConnect pISR==0x01076d48 was Successful for Cause==29 ("Disk Detected")
IntDisable for Cause==65 ("Clear Disk Button")
***** Initializing the Kernel's Thermal Monitor *****
***** Spawning the Kernel's Thermal Monitor *****
***** Executing Auxilliary Task for the Kernel's Thermal Monitor *****
KERNEL BOOTUP: usrAppInit: INFO: bootup with backup battery OFF
Not Turning the battery ON ye
PMUCmd: "~55" --> "~55!"
PMUCmd: "K" --> "k"
Intercore Access Device Driver - Version 1.0 - Installed.
Heatwave MVT Init Compleat!
[tRootTask] 2071-06-19 21:30:04: diskInterfaceInitialise: Starting Disk Driver(s) Initiali.
[tRootTask] 2071-06-19 21:30:04: bspDiskConfigureDiskTable: Configuring drive tables for 8e
[tRootTask] 2071-06-19 21:30:04: diskInterfaceInitialise: System has 8 slots
[tRootTask] 2071-06-19 21:30:04: diskDriverInstall:
[tRootTask] 2071-06-19 21:30:04: showDiskTbs: Dumping Disk Driver Config Tables:
[New Disk Thread] 2071-06-19 21:30:04: diskConfigureNewDiskThread: Starting thread
[tRootTask] 2071-06-19 21:30:04:
[tRootTask] 2071-06-19 21:30:04: Dumping Disk Adapter Table
[tRootTask] 2071-06-19 21:30:04: Adapter Instance Adapter Address Adapter Data Adds
[tRootTask] 2071-06-19 21:30:04: 0 0x01E59238 0x00000000
[tRootTask] 2071-06-19 21:30:04: 1 0x01E59238 0x00000000
[tRootTask] 2071-06-19 21:30:04: 2 0x01E59238 0x00000000
[tRootTask] 2071-06-19 21:30:04: 3 0x01E59238 0x00000000
[tRootTask] 2071-06-19 21:30:04:
[tRootTask] 2071-06-19 21:30:04: Dumping Disk Slot Config Table:
[tRootTask] 2071-06-19 21:30:04: Adapter Instance Connection Physical Slot Adapr
[tRootTask] 2071-06-19 21:30:04: 0 DRIVE 0 8
[tRootTask] 2071-06-19 21:30:04: 0 DRIVE 1 C
[tRootTask] 2071-06-19 21:30:04: 1 DRIVE 2 0
[tRootTask] 2071-06-19 21:30:04: 1 DRIVE 3 4
[tRootTask] 2071-06-19 21:30:04: 2 DRIVE 4 8
[tRootTask] 2071-06-19 21:30:04: 2 DRIVE 5 C
[tRootTask] 2071-06-19 21:30:04: 3 DRIVE 6 0
[tRootTask] 2071-06-19 21:30:04: 3 DRIVE 7 4
[tRootTask] 2071-06-19 21:30:04: diskInterfaceInitialise: Calling init with adapter 0 (0x0)
[tRootTask] 2071-06-19 21:30:04: ahciPerformPhyConfig: Loading phy regs for 9170
0x69cf2bMax Disk Temp: c
Data abort
Exception address: 0x010ca130
Current Processor Status Register: 0x80000013
Task: 0x69cf2bc "tRootTask"
(tRootTask): 0x69cf2bc (tRootTask): diskDriAhciStorageRegister:
diskDriAhciStorageRegister:
0x69cf2bc (tRootTask): 0x69cf2bc (tRootTask): diskDriAhciInstInit:
diskDriAhciInstInit:
0x69cf2bc (tRootTask): 0x69cf2bc (tRootTask): diskDriAhciInstInit2:
diskDriAhciInstInit2:
0x69cf2bc (tRootTask): 0x69cf2bc (tRootTask): diskDriAhciInstInit2: Storing 0x04AE9148 to 0
diskDriAhciInstInit2: Storing 0x04AE9148 to adapter table entry 0
0x69cf2bc (tRootTask): 0x69cf2bc (tRootTask): diskDriAhciInstConnect:
diskDriAhciInstConnect:
0x69cf2bc (tRootTask): 0x69cf2bc (tRootTask): task 0x69cf2bc has had a failure and has bee.
task 0x69cf2bc has had a failure and has been stopped.
0x69cf2bc (tRootTask): 0x69cf2bc (tRootTask): fatal exception in a kernel task or stack ov!
fatal exception in a kernel task or stack overflow!
24 C, Ave Disk Temp: 23 C, Fan Speed = 1, Sampling Period = 36 sec
C, Slot 1: 23 C, Slot 2: 23 C, Slot 3: 24 C,
Slot 4: 24 C, Slot 5: 24 C, Slot 6: 24 C, Slot 7: 24 C,
CPU Core Temp: 55 C, PMU Core Temp = 33 C
Temperature Thresholds for Disk: Interest== 52, Warning== 55, Critical== 65 -- Override==F
Temperature Thresholds for CPU : Interest== 95, Warning==101, Critical==104 -- Override==F
Temperature Thresholds for PMU : Interest== 78, Warning== 82, Critical== 84 -- Override==F
It did not load the linux stuff. The device was not accessible and i had to reset the device in openocd using reset.
Reverseenginering the firmware flashing process or something like in the videos i mentioned above is way beyound my abilities.
So please let me know if you can provide files from a working device.
For now i will stop my experiments with this device. -
As i mentioned earlier "working with address and size values is hard to me". I had a address mismatch in my load_image command in openocd. In #openocd IRC channel (LibraChat) some nice guy informed me that my load address should be:
0x02000000 instead of:
0x20000000
He also told me not to load the firmware file or ELF files as elf format but as bin format in openocd.
This time i could load an image:Code: [Select]haltIt was successfully loaded to 0x02000000.
load_image /home/<user>/<some_path>/22c.ELF 0x02000000 bin
resume
In Marvell u-boot i tried:Code: [Select]bootvx 0x02000000It started to load the image from 0x02000000 but stuck after some lines:Code: [Select]Executing: bootvx 0x02000000
## Ethernet MAC address not copied to NV RAM
## Using bootline (@ 0x1100): neta(3,0) f=0x6000 o=usb0:eth3:cpus=1:mem=0x20000000;MAC3-00e
## Starting vxWorks at 0x01000000 ...
After some trial and errors i found out, i have to load an image in openocd, use bootvx in u-boot, switch back to openocd and resume at the load address like this:Code: [Select]In openocd:
halt
load_image /home/<user>/<some_path>/22c.ELF 0x02000000 bin
resume
switch to Marvell u-boot:
td_bootargs_confab; bootvx 0x02000000 (wait until it get stuck)
switch back to openocd:
halt
resume 0x020000000
And it loads the extracted ELF file from firmware file. I even could load the whole firmware file in openocd and use bootvx with an offset of 0x22c. The ELF image starts at 0x22c in the firmware file. To my surprise, i also could load the vxworks image i dumped from the device. At the end of the boot process i ended up in a vxworks shell with very limited commands.Code: [Select]help
List of the registered topics:
EDR List of the shell commands related to ED&R.
RTP List of the shell commands related to RTP.
SD List of the shell commands related to shared data regions.
SHL List of the shell commands related to shared library.
VM List of the shell commands related to virtual memory.
address_space List of the shell commands related to address space.
basic List of basic shell commands.
breakpoint List of the shell commands related to breakpoints.
esa Commands for the ESA array.
filesystem List of the shell commands related to file system.
history List of commands relative to history management.
interpreter Interpreter shell commands.
k Drobo specific commands for the kernel.
memory List of the shell commands related to memory.
mmap List of the shell commands related to memory mapped objects.
modules List of the shell commands related to kernel modules.
network Network commands
object List of the shell commands related to objects.
symbols List of the shell commands related to symbols.
tasks List of the shell commands related to tasks.
List of the registered commands:
C Switch to C interpreter
adrsp Display information on the address space.
alias Add an alias or display alias
bp Display, set or unset a breakpoint
cd Change current directory.
demangle Display demangled string
dprintf Insert a dynamic printf eventpoint
echo Display a line of text
edr ...
esa Wrapper command to pass commands through to the esa array
user app
exit Exit the shell session.
expr Evaluate expressions
file ...
func ...
getenv Get an environment variable
help Display the list of the shell commands
history ...
ifconfig IPNET interface configuration
k ...
logout Logout the shell session.
lookup Lookup a symbol
mem ...
mmap ...
module ...
more Browse and page through a text file.
object ...
ping IPNET ping utility
print ...
printf Write formatted output
pwd Display current working directory.
reboot Reboot the system
repeat Repeat a command
route IPNET route table control
rtp ...
sd ...
set ...
setenv Set an environment variable
shl ...
show ...
slab Print slab cache information
sleep Suspend execution for an interval.
string ...
syscall ...
syscalls Display system call group information in the system.
sysctl IPNET sysctl configuration
task ...
unalias Remove an alias
unset ...
version Display VxWorks version information.
vm ...
The linux side did not load this way. I only had the vxworks shell. I found some interesting commands and files.Code: [Select]show devices
drv name
0 /null
1 /tyCo/0
1 /tyCo/2
1 /tyCo/3
2 diagLog
8 /proc
10 bootHost:
11 /vio
12 /tgtsvr
13 /ESA_REGISTER
14 fl
4 /bd0
15 /lxdmesg
15 /lxiscsitgtlog
15 /lxcrashlog
15 /lxlastbootlog
15 /lxiscsitgtcore
16 /networkinfo
17 /serialnuminfoCode: [Select]ls /bd0
/bd0/vxWorks
/bd0/LxImage
/bd0/Crashlogs
/bd0/NoCrashMsg
/bd0/hibLog
/bd0/hibHdr
/bd0/amitLog
/bd0/bootCount
/bd0/eventLog
/bd0/hdr_prev
/bd0/RebootReason
/bd0/VXI2.bin
/bd0/UBHW.bin
/bd0/UBHW.hdr
/bd0/hdr
/bd0/LxHdr
/bd0/VXI2.hdr
/bd0/vxWorks_prev
/bd0/LxImage_prev
/bd0/LxHdr_prev
/bd0/RTPI.bin
/bd0/RTPI.hdr
/bd0/LXFS.bin
/bd0/LXFS.hdr
I replaced all files where i had a _prev version of a file:Code: [Select]file move LxImage LxImage-orig
file move vxWorks vxWorks-orig
file move LxHdr LxHdr-orig
file move hdr hdr-orig
file copy LxImage_prev LxImage
file copy vxWorks_prev vxWorks
file copy LxHdr_prev LxHdr
file copy hdr_prev hdr
I found out that i could execute .bin files from this directory.
In openocd i did a reset and the device startet vxworks AND linux!Code: [Select][vxWorks *]# version
VxWorks (for Marvell Sheeva 88SV584x, Board= Heatwave 1.0 ARMARCHV7 LE core) version 6.8.
Kernel: WIND version 2.13.
Made on Feb 3 2016, 20:45:55.
Boot line:
neta(3,0) f=0x6000 o=usb0:eth3:cpus=1:mem=0x20000000;MAC3-00:50:43:11:89:dd;SER-DRB143602000000 s=#/romfs/runesa.vxeCode: [Select]Drobo:/ # uname -a
Linux Drobo 3.2.96-3 #1 SMP Wed Sep 9 12:29:26 UTC 2020 armv7l GNU/Linux
The downside is, still no network service running. But both shells working and (one) green light on the device.
Both bootlogs are attached.
I searched for older firmware files and found two using the wayback archive (https://web.archive.org/web/20200923005204/https://www.drobo.com/docs/start-drobo-b810i/):
The failed update version was 2.0.1. I found Version
2-0-0 https://web.archive.org/web/20200923005204/https://www.drobo.com/docs/start-drobo-b810i/ and
1-3-5 https://web.archive.org/web/20170716181543/http://files.drobo.com/webrelease/b810i/B810i_Firmware_1-3-5.zip
I was able to load both firmware files and boot with the offset for the first ELF image. The trick did not work with an offset for the second ELF image in the firmware files.
-
I compared the md5sum of the files i dumped from the vxworks side with the 3 firmware files:Code: [Select]
Drobo filedump
MD5 4639529020298b3671d3517c10c09522 vxi2.bin = 22c.ELF found in release.B810i.2-0-1.tdf (first ELF image)
MD5 40104317c0dbdd43e84df334dbc1fac6 lximage = 12231fa.UImage found in release.B810i.2-0-1.tdf
MD5 e0a1c6d97bd614cfaaebed36c619d83e rtpi.bin = 7578b6.ELF found in release.B810i.2-0-1.tdf (second ELF image)
MD5 1bf5585eb18318837a3d4fd4e6fb90a4 LxHdr = selection_0-22b found in release.B810i.2-0-1.tdf (right before the first ELF image)
drobo_2-0-1_extracted-parts# md5sum * [size in bytes]
+ 40104317c0dbdd43e84df334dbc1fac6 12231fa.UImage 3168928
624b46f91b061795ce641a36f096ed90 1528d16.JFFS2 11858012
+ 4639529020298b3671d3517c10c09522 22c.ELF 7698058
+ e0a1c6d97bd614cfaaebed36c619d83e 7578b6.ELF 11319620
+ 1bf5585eb18318837a3d4fd4e6fb90a4 selection_0-22b 556
drobo_2-0-0_extracted-parts# md5sum * [size in bytes]
ffe68f761c88d77cfed8df5d7619b3c3 11e355c.UImage 3168936
cd4881229a64f702a6e002aa9c3cb51b 14e9080.JFFS2 10330556
66fb7d8f75c09a7e99cf7910bd9da934 22c.ELF 7690876
955691ee15ebedc9f9fc6806c773d522 755ca8.ELF 11065524
497aca92106d4ae411af2e7f63e86e52 selection_0-22b 556
drobo_1-3-5_extracted-parts# md5sum *
cad166fb818c55767df926033faa4ef4 110c4f6.UImage 3750024
8ee2ed4a45a895bbbe6d7d0bedc7f772 149ff4a.JFFS2 25529652
5e96eae5bac03992bbfd82961bb67182 22c.ELF 7569558
d315b81c0eaf33b84a71e7be84638f65 7382c2.ELF 10306100
8be984ce60d9d34284116926b6edffab selection_0-22b 556
openocd-dump_20231230# md5sum *
7351e5dadd74474690b1f014f3b69570 hdr 556
7351e5dadd74474690b1f014f3b69570 hdr_prev 556
4cabb259c8abf4a5adafe2aa07a982c5 hibhdr 512
+ 1bf5585eb18318837a3d4fd4e6fb90a4 LxHdr 556
+ 1bf5585eb18318837a3d4fd4e6fb90a4 LxHdr_prev 556
+ 40104317c0dbdd43e84df334dbc1fac6 lximage 3168928
+ 40104317c0dbdd43e84df334dbc1fac6 lximage_prev 3168928
+ e0a1c6d97bd614cfaaebed36c619d83e rtpi.bin 11319620
1bf5585eb18318837a3d4fd4e6fb90a4 RTPI.hdr 556
9e30738c85838a54dea0271fd743bfca runesa.vxe 10177608
ecfdbaed33efb962865e71d456349683 ubhw.bin 801272
7351e5dadd74474690b1f014f3b69570 UBHW.hdr 556
+ 4639529020298b3671d3517c10c09522 vxi2.bin 7698058
+ 1bf5585eb18318837a3d4fd4e6fb90a4 VXI2.hdr 556
e83b73a0859310cc8705fe1ad3dfb0d8 vxworks 17734472
e83b73a0859310cc8705fe1ad3dfb0d8 vxworks_prev 17734472
I found LxHdr, LxHdr,_prev, RTPI.hdr, VXI2.hdr are the same files, located at the beginning until 0x22c of the firmware file. VXI2.bin is the first ELF image in the firmware file. The second ELF image in the firmware file is RTPI.bin. The LxImage is the called UImage in the firmware file. The firmware contains one more data block, a JFFS2 part.
I didn't found the vxWorks stuff in the firmware files. I don't know if that part was ever updated.
-
Accessing the files on the internal memory, which is only accessible on the vxworks side is waaaaayyyyyyy easier than i tought. It's not possible transfering data over network to the vxworks side. On Marvell U-boot i only have read access. But, during boot, it enables a internal usb drive. I re-checked the board. And there is a small daughterboard containing two memory chips. It is connected with 2x5 pinheader to the mainboard. One pin was removed.
It looked like an ordinary USB connector like the ones on a Desktop Mainboard. The daughterboard has a product label "Apacer". It turns out its a common SSD. I checked the pins on the pinheader and compared the voltage to a default USB port and it matches. Using a USB-A connector and some flying wires, it was immediately recognized as USB-drive on my Laptop.
I was able to replace VXI2.bin, LxHdr, RTPI.bin and LxImage with the matching sections from firmware file. LxHdr is needed because it contains a checksum for LxImage file (0-22c of firmware file). The firmware release 2-0-0 had same boot problem like the 2-0-1. But the content from firmware release 1-3-5 let the vxworks side boot. At the moment there is an error on the linux side. And still not recognized by Drobo Dashboard.
-
I did some tests with u-boot settings and managed to freeze the Bootrom 1.2 because of header checksum mismatch.
To make things easier, i placed the MX25L6406E cmos serial flash outside the board and used flying wires to connect the IC-adapter to the board.
I also replaced the internal USB-SSD temporary with a Pi zero 2w. The advantage is, i don't need to plug/unplug the drive to copy files to the device. Using the pi zero as a usb drive, i can copy files via wifi. I copy files using sftp in linux (or WinSCP in windows).
The 9-pin USB connector (only the 4-pin row is used) has 2mm pitch wide. Default dupont connectors have 2,54mm pitch wide. I crimped flying wires to a JST-HX 4-pin connector.
Burning the cmos serial flash dump brought the device back to life.
-
I managed to boot Firmware 1.3.5 and getting Drobo-Dashboard to recognize the device.
The App couldn't find an update server
and manual update failed for now. The solution with the wired-out SPI cmos flash and Pi-zero as Wifi-SSD is perfect. Easy to handle.
-
I don't know why but i can't reproduce recognizing the Drobo by the Dashboard.
I will give up on that device. I found out some things, maybe it will help others.
The Marvell U-Boot on that device, which is located in the CMOS flash chip doesn't have the typical U-Boot Magic Number (27 05 19 56) and CRC32 checksum in the header (Byte 4 to 7). It starts with 5A. The ARMADA-XP-Functional-SpecDatasheet.pdf tells 0x5A = Boot from SPI/NOR flash. Have a look at the SpecDatasheet for more information.
If you corrupt the CMOS flash data, don't worry. There is a file on the internal USB-SSD called UBHW.bin (and the header file UBHW.hdr for it). Most probably UBHW means U-Boot Heatwave, a hint to the board name i guess. The binary contains the U-Boot data without environment data. The individual env settings are stored at 0xd0000 to 0xdffff. If you dump the CMOS flash data, you can cut off the zeros after 0xe0000. The file is less than 1 MB.
To start the drobo, you need just LxImage and vxWorks files on the USB-SSD. Thats it.
I attached both log files (linux side and vxworks side) from last sunday when the drobo was recognized. You can see in the logfile what files i had on the USB-SSD.
The reason why i give up on the device is, it only starts with release 1-3-5 properly. The 2-0-0 and 2-0-1 releases won't start up. I think either vxWorks or Lximage (LXKI Linux Kernel Image) has wrong version to interact with the other side.
The LxImage starts with this mtd settings:Code: [Select]INFO: Found cfi_flash_0 0 - base 0xd8000000, size 0x8000000, bus 2
INFO: flashInfoFill - Found 1 Flash Devices
INFO: flash_map_init - detected 1 devices
MTD: Initialize the cfi_flash_0 device at address 0xd8000000
INFO: Io remapped successfully - phy addr = 0xd8000000, virt addr = 0xd9000000
INFO: Using cfi_probe to probe cfi_flash_0 at address 0xd8000000, size 0x8000000, width 2m
cfi_flash_0: Found 1 x16 devices at 0x0 in 16-bit bank. Manufacturer ID 0x000001 Chip ID 0x002801
Amd/Fujitsu Extended Query Table at 0x0040
Amd/Fujitsu Extended Query version 1.5.
number of CFI chips: 1
- detected OK
6 cmdlinepart partitions found on MTD device cfi_flash_0
Creating 6 MTD partitions on "cfi_flash_0":
0x000000000000-0x000000100000 : "nor_hdr"
0x000000100000-0x000000400000 : "var"
0x000000400000-0x000002200000 : "rfs0"
0x000002200000-0x000004000000 : "rfs1"
0x000004000000-0x000006000000 : "rfs2"
0x000006000000-0x000008000000 : "rfs3"
- OK.
That is a U-Boot env setting:Code: [Select]LxMtd=mtdparts=cfi_flash_0:1m@0m(nor_hdr),3m@1m(var),30m@4m(rfs0),30m@34m(rfs1),32m@64m(rfs2),32m@96m(rfs3)And there is additionally this line:Code: [Select]LxRoot=rootfstype=jffs2 root=/dev/mtdblock2 rw
With this settings, release 1-3-5 starts, but has an issue with rfs0 and therefore it can't mount /bin and /etc:Code: [Select][1970-01-01,00:00:12.132085843] 10: INFO: Mounting /bin as rw
mount: mounting /tmp/bin on /bin failed: No such device
[1970-01-01,00:00:12.166910723] 10: ERROR: Failed to mount /bin as rw
[1970-01-01,00:00:12.185068643] 10: INFO: Mounting /etc as rw
mount: mounting /tmp/etc on /etc failed: No such device
[1970-01-01,00:00:12.219105483] 10: ERROR: Failed to mount /etc as rw
The whole logfile has errors like this:Code: [Select]chmod: /etc/monitrc: Read-only file system
awk: /etc/resolv.conf: No such file or directory
chmod: /etc/monitrc: Read-only file system
If i changeCode: [Select]LxRoot=rootfstype=jffs2 root=/dev/mtdblock2 rwtoCode: [Select]LxRoot=rootfstype=jffs2 root=/dev/mtdblock3 rwIt starts without this Read-only errors. But it didn't recognized the drobo.
I also could setCode: [Select]setenv LxForceRootFS yes
It will force to use mtd3, no Read-only errors, but still not recognized.
When the drobo was recognized, it had this message in my logfile:Code: [Select]Sun Jan 14 13:37:44 2024: tCoreCtrl: setLinuxCommonInfo: SUCCESS: Setting Serial Number Config. New serial number = dra160401c00313
Sun Jan 14 13:37:44 2024: tCoreCtrl: Unexpected reboot - generate crash log from last boot logs
Sun Jan 14 13:37:44 2024: tCoreCtrl: copy iscsitgtlog.old to iscsitgtlog.crash
Sun Jan 14 13:37:59 2024: tCoreCtrl: iSCSI stack ENABLE message received
Sun Jan 14 13:37:59 2024: tCoreCtrl: Initializing network settings
Sun Jan 14 13:37:59 2024: tCoreCtrl: InitializeNetworConfigEx: Called
Sun Jan 14 13:38:01 2024: tCoreCtrl: iscsiTgtPortalUpdateIPAddress: Old Ipaddr: 0:0:0:0
Sun Jan 14 13:38:01 2024: tCoreCtrl: iscsiTgtPortalUpdateIPAddress: Updated Portal Id: 0x11dd38 ipaddress length: 4
Sun Jan 14 13:38:01 2024: tCoreCtrl: iscsiTgtPortalUpdateIPAddress: New Ipaddr: 169:254:4:0
Sun Jan 14 13:38:01 2024: tCoreCtrl: iscsiTgtPortalUpdateIPAddress: Old Ipaddr: 0:0:0:0
Sun Jan 14 13:38:01 2024: tCoreCtrl: iscsiTgtPortalUpdateIPAddress: Updated Portal Id: 0x11df30 ipaddress length: 4
Sun Jan 14 13:38:01 2024: tCoreCtrl: iscsiTgtPortalUpdateIPAddress: New Ipaddr: 169:254:5:0
Sun Jan 14 13:38:01 2024: tCoreCtrl: File /var/discWhiteList not found. Allowing all hosts for discovery.
Sun Jan 14 13:38:01 2024: tCoreCtrl: Starting Discovery!!
Sun Jan 14 13:38:01 2024: tIscsiMgr: Setting SO_BINDTODEVICE, for device eth0
Sun Jan 14 13:38:01 2024: tCoreCtrl: *************** sending stack UP across icore ***************
Sun Jan 14 13:38:01 2024: tIscsiMgr: Setting SO_BINDTODEVICE, for device eth1
Sun Jan 14 13:38:01 2024: tDiscListen: Discovery: Listener loop starting
Sun Jan 14 13:38:01 2024: tDiscAgent: Discovery: Agent starting
Sun Jan 14 13:38:02 2024: tDiscListen: Added client info for 192.168.10.43:65359 (flags 0x3e, 0x3e)
Sun Jan 14 13:38:02 2024: tDiscListen: Client info received from host: IP: 192.168.10.43 Port: 65359 (iqn.1991-05.com.microsoft:sls2 2b0aa8c0-32646)
Sun Jan 14 13:38:02 2024: tDiscListen: QueueWaitingHost: Found host 192.168.10.43 on port 65359
Sun Jan 14 13:38:05 2024: tEMPDConn00000: EMPDConnection::Starting thread tEMPDConn00000 and clientID SLS231727.0000028690
Sun Jan 14 13:38:05 2024: tEMPDConn00000: EMPDListener::AddConnection - for SLS231727 NEW (192.168.10.43 7876 via )
Sun Jan 14 13:38:05 2024: tHBConn00000: HBConnection: Starting thread tHBConn00000 and clientID SLS231727.0000028690
Sun Jan 14 13:38:05 2024: tHBConn00000: HBConnection::Start- The Unique ID received is : 0000028690
Sun Jan 14 13:38:05 2024: tHBConn00000: HBConnection::Start- The host ID received is : SLS231727
Sun Jan 14 13:38:05 2024: tHBConn00000: HBConnection::Start- Received new connection!!
Sun Jan 14 13:38:05 2024: tHBConn00000: HBConnection::Start- Now starting to send heart beat messages -
I tried Drobo-Dashboard 3.5.0 and the older 2.6.4 on Windows. If i manually set the IP for the Drobo, it never find it. There is always an error message about incomplete header like this:Code: [Select]chmod: /etc/monitrc: Read-only file system
chmod: /etc/monitrc: Read-only file system
chmod: /etc/monitrc: Read-only file system
Thu Jan 18 15:23:24 2024: tEMPDConn00000: EMPDConnection: did not receive complete header! (recv len 0, hdr len 47, error 0)
Thu Jan 18 15:23:24 2024: tEMPDConn00000: EMPDConnection: Error 0 receiving login header.
Thu Jan 18 15:23:24 2024: tEMPDConn00000: EMPDConnection: Cleaning up thread tEMPDConn00000 for host with UID
Thu Jan 18 15:23:24 2024: tEMPDConn00000: HBListener::SetupCleanup for
Thu Jan 18 15:23:24 2024: tEMPDConn00000: HBListener::SetupCleanup for . Done
Thu Jan 18 15:23:24 2024: tEMPDConn00000: EMPDListener::RemoveConnection - for
chmod: /etc/monitrc: Read-only file system
chmod: /etc/monitrc: Read-only file system
chmod: /etc/monitrc: Read-only file system
I sniffed the packet with wireshark but couldn't find any suspicious fault in the data. I don't have a working datastream for comparison.
I also tried tricks i found somewhere like using nc to redirect port 5002 to the drobo with this command without success:Code: [Select]nc -lvu 5002 | nc 192.168.10.72 (Drobo ip)
-
I tried one last thing because of the "Read-only file system" error message on mtdblock1.
The 128 MB NOR-flash chip (Spansion S29GL01GS10TFI01) is on the backside of the mainboard. The internal USB-SSD has all the system files on it like vxWorks, the LxImage that starts every time from USB-SSD and LXFS which is a JFFS2 filesystem. I thought, what if i erase the NOR-flash. Maybe something is wrong with the data and therefore mtdblock2 can't be mounted. I desoldered the 56 pin NOR-flash and dumped the data using a RT809H programmer and compard the data with my two memory dumps i did earlier using openocd. The openocd dumps had 3 JFFS2 sections. The dump from RT809H programmer had 7 JFFS2 sections.
After erasing the chip, the Linux side didn't came up because it couldn't init the NOR-flash.Code: [Select]2.164160] md: Waiting for all devices to be available before autodetect
[ 2.170982] md: If you don't use raid, use raid=noautodetect
[ 2.177276] md: Autodetecting RAID arrays.
[ 2.181399] md: Scanned 0 and added 0 devices.
[ 2.185857] md: autorun ...
[ 2.188657] md: ... autorun DONE.
[ 2.215786] JFFS2 notice: (1) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found.
[ 2.231091] VFS: Mounted root (jffs2 filesystem) on device 31:3.
[ 2.237291] Freeing init memory: 240K
[ 2.241015] Kernel panic - not syncing: No init found. Try passing init= option to kernel. See Linux Documentation/init.txt for guidance.
[ 2.253499] CPU0: stopping
[ 2.256215] Backtrace:
[ 2.258701] [<80011acc>] (dump_backtrace+0x0/0x10c) from [<8055958c>] (dump_stack+0x18/0x1c)
[ 2.267166] r7:8074bf8c r6:fbb21000 r5:00000000 r4:807958dc
[ 2.272899] [<80559574>] (dump_stack+0x0/0x1c) from [<800132dc>] (handle_IPI+0x108/0x184)
[ 2.281106] [<800131d4>] (handle_IPI+0x0/0x184) from [<80008394>] (do_IPI+0x10/0x14)
[ 2.288873] r5:60000013 r4:8000f090
[ 2.292488] [<80008384>] (do_IPI+0x0/0x14) from [<8055c8b4>] (__irq_svc+0x34/0xe8)
[ 2.300082] Exception stack(0x8074bf58 to 0x8074bfa0)
[ 2.305150] bf40: 0000001f 807562fc
[ 2.313357] bf60: 8074bf90 80018ea4 8074a000 8075c36c 807956c4 8056721c 2000406a 562f5842
[ 2.321565] bf80: 00000000 8074bfbc 8074bfa0 8074bfa0 8000ec5c 8000f090 60000013 ffffffff
[ 2.329774] [<8000f008>] (cpu_idle+0x0/0xcc) from [<8054ef34>] (rest_init+0x64/0x7c)
[ 2.337541] r7:8075c364 r6:80738a40 r5:00000000 r4:80756e84
[ 2.343274] [<8054eed0>] (rest_init+0x0/0x7c) from [<8070c89c>] (start_kernel+0x204/0x240)
[ 2.351569] [<8070c698>] (start_kernel+0x0/0x240) from [<20008040>] (0x20008040)
[ 2.358990] CPU2: stopping
[ 2.361705] Backtrace:
[ 2.364184] [<80011acc>] (dump_backtrace+0x0/0x10c) from [<8055958c>] (dump_stack+0x18/0x1c)
[ 2.372648] r7:b1119fac r6:fbb21000 r5:00000002 r4:807958dc
[ 2.378377] [<80559574>] (dump_stack+0x0/0x1c) from [<800132dc>] (handle_IPI+0x108/0x184)
[ 2.386585] [<800131d4>] (handle_IPI+0x0/0x184) from [<80008394>] (do_IPI+0x10/0x14)
[ 2.394351] r5:60000013 r4:8000f090
[ 2.397965] [<80008384>] (do_IPI+0x0/0x14) from [<8055c8b4>] (__irq_svc+0x34/0xe8)
[ 2.405558] Exception stack(0xb1119f78 to 0xb1119fc0)
[ 2.410626] 9f60: 00000021 807562fc
[ 2.418834] 9f80: b1119fb0 80018ea4 b1118000 8075c36c 807956c4 8056721c 2000406a 562f5842
[ 2.427042] 9fa0: 00000000 b1119fdc b1119fc0 b1119fc0 8000ec5c 8000f090 60000013 ffffffff
[ 2.435251] [<8000f008>] (cpu_idle+0x0/0xcc) from [<8055698c>] (secondary_start_kernel+0x140/0x164)
[ 2.444324] r7:807958e4 r6:10c03c7d r5:00000015 r4:00000004
[ 2.450050] [<8055684c>] (secondary_start_kernel+0x0/0x164) from [<20556494>] (0x20556494)
[ 2.458340] r5:00000015 r4:5112006a
[ 2.461949] shared_mem_panic_event: Kernel panic event handler called. Notifying VxWorks Core of Kernel panic.
As you can see in the image, there are 16 Bytes (0x0 - 0x1f) at the beginning before a large empty block. After inserting the 16 bytes (i desoldered/resoldered the chip six times) the system started with errors, missing Magic Bytes at specific offset addresses.
It didn't work this way. I put all dumped data back on the NOR-flash to get the system status i already had before.