| Electronics > Repair |
| Drobo B810i NAS half bricked after failed firmware update |
| << < (3/5) > >> |
| JimKnopf:
I need some help from either someone who can extract a working vxworks image from this firmware file or someone who can provide the files from a working device. I tried different things now loading the vxworks ELF images i extracted manually from the firmware file and the ones emba extracted automaticly. I tried to load it in u-boot using loady and ymodem in minicom but could not get it to work. I then tried it using kermit in minicom and was able to successfully upload the data using ckermit after creating ~/.kermrc with this content: --- Code: ---set carrier-watch off set handshake none set flow-control none robust set file type bin set rec pack 1000 set send pack 1000 set window 5 --- End code --- I tried the firmware file itself and the extracted ELF files from the firmware file containing the vxworks stuff. The firmware file has more than 50 MB. It took more than 90 minutes to upload it over uart serial connection in u-boot. I't didn't help. When i run --- Code: ---go 0x20000000 --- End code --- and some commands from printenv data like --- Code: ---td_bootargs_confab; run flashload_g0; bootvx 0x20000000 --- End code --- It always complains "No ELF file at 0x20000000". Because of the very slow upload speed using kermit, i tried a combination of Marvell u-boot shell and openocd. Loading a file to memory is way faster in openocd. I started the device, pressed a button to stop boot process and entering the Marvell u-boot shell. In openocd i did: --- Code: ---halt load_image /home/<user>/<some_path>/7698614-19018234.elf32 0x20000000 elf resume --- End code --- In u-boot i tried the same commands like before, go 0x20000000 or td_bootargs_confab; run flashload_g0; bootvx 0x20000000. I don't know why but sometimes the image was not loaded to 0x20000000. Sometimes it was loaded at 0x21000000. I couldn't even load the original vxworks image i dumped from the Drobo device. One time i tried loading it at 0x00000000 and it was loaded at 0x01000000. In this case, i did in openocd a resume 0x01000000 and to my surprise, it started to load but halted at some point. But this time i had blue lights on the device and the bootlog was different: --- Code: ---Marvell>> td_bootargs_confab; run flashload_g0; bootvx 0x21000000 Env Var skipConfabulation=0 Skip Confabulation: NONE ... skipConfabulation: 0x1 skips Vx confab, 0x2 skips Lx confab Current Value of Vx bootargs_g0: ================================================== bootargs_g0=neta(3,0) f=0x6000 o=usb0:eth3:cpus=1:mem=0x20000000;MAC3-00:50:43:11:89:dd;SEe ================================================== EnvVar bootargsStart=neta(3,0) EnvVar vxFlags=f=0x6000 EnvVar vxDev=usb0:eth3:cpus=1:mem=0x20000000 EnvVar eth3addr=00:50:43:11:89:dd EnvVar droboSER=DRB143602000000 EnvVar vxCmd=s=#/romfs/runesa.vxe Confabulated Value of bootargs_g0: ================================================== bootargs_g0=neta(3,0) f=0x6000 o=usb0:eth3:cpus=1:mem=0x20000000;MAC3-00:50:43:11:89:dd;SEe ================================================== Current bootargs_g0 perfectly match the Confabulated bootargs_g0 No Need to Update the Environment reading vxWorks_prev . . . ........................................................................................... 17734472 bytes read ## Ethernet MAC address not copied to NV RAM ## No elf image at address 0x21000000 ## Not an ELF image, assuming binary ## Using bootline (@ 0x1100): neta(3,0) f=0x6000 o=usb0:eth3:cpus=1:mem=0x20000000;MAC3-00e ## Starting vxWorks at 0x21000000 ... MPP33 Config (0xd0018010) == 0x11110040 (Should be: 0xXXXXXX4X) SDRAM Config (0xd0001400) == 0x7201c924 (Should be: 0x72XXXXXX) DRAM TBsAddr (0xd0001580) == 0x20000000 (Should be: 0x??????] Booting from CPU 0 Detected board Heatwave 1.0 DRAM env init....... Done. Detected DRAM size 512MB AMP: Resources - uart0 - pex1 - pex2 - eth3 - xor0 - usb0 - i2c0 - i2c1 - sata - spi - g AMP CPUs = 1 AMP mem size = 0x20000000 TWSI init Channel 0....... Done. Actual freq = 97656Hz Skipping serdes configuration. Ctrl env init....... Done. Addr Dec Win...... Verified CP15 mrvl dbgr 0x000109A7 CP15 mrvl dbgr2 0xEA008208 CP15 mrvl ctrl 0x000001B6 CP15 mrvl dbgr 0x000109A7 CP15 mrvl dbgr2 0xEA008208 CP15 mrvl ctrl 0x000001B6 CPU if init......... Done. GPP init............ Done. DRAM env init....... Done. Using DRAM size 512MB =======================> HW Revision Register == 0x00000881 Detected Board: Heatwave MVT, Spin 0 (No EthDebug) Detect: Tclk 250MHz SysClk 600MHz L2Clk 600MHz pClk 1200MHz Marvell Controller initialization Done. Modules Detected: SPI flash based addr on 0xD4000000= SPI Flash 8MB detected esaXORSystemInit esaXORSystemInit...done esaDMASystemInit Initialising SEEPROM Interface Checking Bootline.......0x00001100 [0x6e] UBOOT Version: UBOOT-2.33 Bootline params = neta(3,0) f=0x6000 o=usb0:eth3:cpus=1:mem=0x20000000;MAC3-00:50:43:11:89 DRAM int Ctrl....... Done IDMA Err int Ctrl... Done IDMA init........... Done NETA Err int Ctrl... Done Neta int Ctrl....... Done GPIO int Ctrl....... Done PCI int Ctrl........ Done PCI-E 0: Not mapped to this OS PCI-E 1: Not mapped to this OS PCI-E 2: Not mapped to this OS PCI-E 3: Not mapped to this OS mvPexIntfInit() ROOT COMPLEX Init pexHWInf: 4 mvSysPexInit() called pexIf: 4 type: 0 MAX_TARGETS: 44 mvSysPexInit() OK from mvCtrlAddrWinMapBuild() mvSysPexInit() OK from mvPexWinInit() mvPexModeGet() configured as ROOT reg: 0x4014032e mvPexInit() configuring as ROOT mvPexLocalBusNumSet() called for pexIf: 4 busNum: 0 localBus: 0 localDev: 0 *******************mvPexLocalDevNumSet(4) localBus: 0 localDev: 0 pexStatus: 0 *********** mvPexInit() call mvPexMasterEnable mvPexInit() call mvPexSlaveEnable mvPexInit() disable int mvPexInit() wait a tick mvPexInit() check for link PEX4 interface detected Link X1 mvPexIntfInit() checking if we should set the localBus pex0flg: 0 pexHWInf: 4 mvPexIntfInit() setting localBusNum to 0 for pexHWInf 4 mvPexLocalBusNumSet() called for pexIf: 4 busNum: 0 localBus: 0 localDev: 0 PCI-E 4/10: Done. PCI-E 5: is power off mvPexIntfInit() ROOT COMPLEX Init pexHWInf: 6 mvSysPexInit() called pexIf: 6 type: 0 MAX_TARGETS: 44 mvSysPexInit() OK from mvCtrlAddrWinMapBuild() mvSysPexInit() OK from mvPexWinInit() mvPexModeGet() configured as ROOT reg: 0x4014022e mvPexInit() configuring as ROOT mvPexLocalBusNumSet() called for pexIf: 6 busNum: 0 localBus: 1 localDev: 0 *******************mvPexLocalDevNumSet(6) localBus: 0 localDev: 0 pexStatus: 0 *********** mvPexInit() call mvPexMasterEnable mvPexInit() call mvPexSlaveEnable mvPexInit() disable int mvPexInit() wait a tick mvPexInit() check for link PEX6 interface detected Link X1 mvPexIntfInit() checking if we should set the localBus pex0flg: 0 pexHWInf: 6 mvPexIntfInit() setting localBusNum to 0 for pexHWInf 6 mvPexLocalBusNumSet() called for pexIf: 6 busNum: 0 localBus: 0 localDev: 0 PCI-E 6/10: Done. mvPexIntfInit() ROOT COMPLEX Init pexHWInf: 7 mvSysPexInit() called pexIf: 7 type: 0 MAX_TARGETS: 44 mvSysPexInit() OK from mvCtrlAddrWinMapBuild() mvSysPexInit() OK from mvPexWinInit() mvPexModeGet() configured as ROOT reg: 0x4014022e mvPexInit() configuring as ROOT mvPexLocalBusNumSet() called for pexIf: 7 busNum: 0 localBus: 2 localDev: 0 *******************mvPexLocalDevNumSet(7) localBus: 0 localDev: 0 pexStatus: 0 *********** mvPexInit() call mvPexMasterEnable mvPexInit() call mvPexSlaveEnable mvPexInit() disable int mvPexInit() wait a tick mvPexInit() check for link PEX7 interface detected Link X1 mvPexIntfInit() checking if we should set the localBus pex0flg: 0 pexHWInf: 7 mvPexIntfInit() setting localBusNum to 0 for pexHWInf 7 mvPexLocalBusNumSet() called for pexIf: 7 busNum: 0 localBus: 0 localDev: 0 PCI-E 7/10: Done. mvPexIntfInit() ROOT COMPLEX Init pexHWInf: 8 mvSysPexInit() called pexIf: 8 type: 0 MAX_TARGETS: 44 mvSysPexInit() OK from mvCtrlAddrWinMapBuild() mvSysPexInit() OK from mvPexWinInit() mvPexModeGet() configured as ROOT reg: 0x4014032e mvPexInit() configuring as ROOT mvPexLocalBusNumSet() called for pexIf: 8 busNum: 0 localBus: 3 localDev: 0 *******************mvPexLocalDevNumSet(8) localBus: 0 localDev: 0 pexStatus: 0 *********** mvPexInit() call mvPexMasterEnable mvPexInit() call mvPexSlaveEnable mvPexInit() disable int mvPexInit() wait a tick mvPexInit() check for link PEX8 interface detected Link X1 mvPexIntfInit() checking if we should set the localBus pex0flg: 0 pexHWInf: 8 mvPexIntfInit() setting localBusNum to 0 for pexHWInf 8 mvPexLocalBusNumSet() called for pexIf: 8 busNum: 0 localBus: 0 localDev: 0 PCI-E 8/10: Done. PCI-E 9: Not mapped to this OS USB0 init........... Done. HOST type selected USB Err int Ctrl.... Done XOR Err int Ctrl.... Done mvSysXorInit: done XOR init............ Done mvCtrlInit2......... done vxbDevInit.........done sysSerialConnectAll.........done Serial Ports...Attached UART2...Baud Rate Adjusted to 38.4K VxBus Loaded.... done bspConfigureI2CTable: Configuring I2C tables for 8-Slot (Kryten) [tRootTask] 1970-01-01 00:00:00: drDrvLaunch ---->> drDrv() <<---- Allocated temp buffer 0x42599a8 [tRootTask] 1970-01-01 00:00:00: Diagnostic Re-Route Device Driver - Version 1.0 - Install. [tRootTask] 1970-01-01 00:00:00: drStartLogging() started _DEF_STD_OUT = 3 _DEF_STD_ERR = 3 _DR_FD = 4 Host Name: bootHost Target Name: vxTarget User: target Ethernet port #3 initialized neta3 Interface Loaded; MAC: 00:50:43:11:89:DD neta3 Interface Started Attempting to register custom syscalls group ipAttached to interface neta3 ip= Can't Set IP address to <neta3> interface..bootline does not have ethernet ipAddress Adding 10511 symbols for standalone. Detected Marvell USB. SettingwdbConfig: error configuring WDB communication interface ]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]] ]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]] ]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]] ]]]]]]]]]]] ]]]] ]]]]]]]]]] ]] ]]]] (R) ] ]]]]]]]]] ]]]]]] ]]]]]]]] ]] ]]]] ]] ]]]]]]] ]]]]]]]] ]]]]]] ] ]] ]]]] ]]] ]]]]] ] ]]] ] ]]]] ]]] ]]]]]]]]] ]]]] ]] ]]]] ]] ]]]]] ]]]] ]]] ]] ] ]]] ]] ]]]]] ]]]]]] ]] ]]]]]]] ]]]] ]] ]]]] ]]]]] ] ]]]] ]]]]] ]]]]]]]] ]]]] ]] ]]]] ]]]]]]] ]]]] ]]]]]] ]]]]] ]]]]]] ] ]]]]] ]]]] ]] ]]]] ]]]]]]]] ]]]] ]]]]]]] ]]]]] ] ]]]]]] ] ]]] ]]]] ]] ]]]] ]]]] ]]]] ]]]] ]]]]]]]] ]]]]] ]]] ]]]]]]] ] ]]]]]]] ]]]] ]]]] ]]]] ]]]]] ]]]]]]]]]]]]]]]]]]]]]]]]]]]]]] ]]]]]]]]]]]]]]]]]]]]]]]]]]]]] Development System ]]]]]]]]]]]]]]]]]]]]]]]]]]]] ]]]]]]]]]]]]]]]]]]]]]]]]]]] VxWorks 6.8 ]]]]]]]]]]]]]]]]]]]]]]]]]] KERNEL: WIND version 2.13 ]]]]]]]]]]]]]]]]]]]]]]]]] Copyright Wind River Systems, Inc., 1984-2012 CPU: Marvell Sheeva 88SV584x, Board= Heatwave 1.0 ARMARCHV7 LE core. Processor #0. Memory Size: 0x1fe70000. BSP version 2.3.1. Created: Feb 3 2016, 20:45:55 ED&R Policy Mode: Deployed WDB Comm Type: WDB_COMM_END WDB: Agent configuration failed. [tRootTask] 1970-01-01 00:00: MV_USB_MODE_RE00: kCmdInit: Initialising kernel command liner [tRootTask] 1970-01-01 00:00:00: diskCmdRegister: Installing k disk Commands G = 0x3 ESA Register Driver Found Board version 2, stuffing option 1 Initialising boot SEEPROM handler Checking boot register values in serialEEPROM ... <<<<Flash Upgrade Driver - version 1.0 - installed. IsFlashForDroboPro: We are NOT running on Drobo Pro deal with flash accordingly Failed to get flash layout...this is expected for Optimus Prime, which does not have NOR F. System Configuration CHIP : MV88F7846 Rev 2 CPU : Marvell PJ4B (584) v7 (Rev 2) BOARD : Heatwave 1.0 (0x0) CLOCKs : tClk = 250MHz, sysClk = 600MHz L2Clk = 600MHz pClk = 1200MHz ETH_JUMBO_SUPPORT = Disabled BRIDGING_SUPPORT = Enabled MULTI_Q_SUPPORT = Disabled NAT_SUPPORT = Disabled VFP_SUPPORT = Enabled L2 Cache = Enabled IO coherency = Enabled Get DATE: 2071-06-19 (Friday) TIME: 21:30:01 [vxWorks *]# =======================> HW Revision Register == 0x00000881 Board Type 4, Rev 2 (Heatwave MVT), Spin = 0 Stuffing Opt = 1 (No EthDebug), DevDebugBitz = 0x0 Drobo B810i Heatwave Ready to take a Byte! ============================================================================== Initializing PMU... Reading PMU Version... PMU Version: 1.2.0x046c, Download Version 108 (Variant 4) [Failsafe Ver 4] Considering an Update to the PMU ... PMU is up to date for this MVT board. Reading 0xac from PMU GPIO Port 1 [ @0x0020 ] Reading 0xef from PMU GPIO Port 2 [ @0x0028 ] Reading 0x71 from PMU GPIO Port 3 [ @0x0018 ] Reading 0x10 from PMU GPIO Port 4 [ @0x001c ] ============================================================================== PMU is Running on AC Power :-) ============================================================================== ============================================================================== 0x48ac278 (BusM A): 0x48ac278 (BusM A): INFO: usb2Msc - Storage driver got a device attach. INFO: usb2Msc - Storage driver got a device attach notification. This Optimus Prime PMU is NOT configured for Early-Follow of DDR3 Reset...Fixing 0x48ac278 (BusM A): 0x48ac278 (BusM A): INFO: usb2Msc - Mounting device (PDT 0x0 PQ 0x0 RMP INFO: usb2Msc - Mounting device (PDT 0x0 PQ 0x0 RMB 0x0) VID = : PID = USB DISK MP 0x48ac278 (BusM A): 0x48ac278 (BusM A): INFO: usb2Msc - Device 0x2 LUN 0 of 1005568 (KB) w0 INFO: usb2Msc - Device 0x2 LUN 0 of 1005568 (KB) will be mounted with base name /bd0 This Optimus Prime Board Supports Self-Refresh only with VRM_EN ...PMU will ENABLE VRM_EN during a reboot/shutdown cycle. PMU BootOnBatt Counter DEFAULT is now 3 /bd0/ - disk check in progress ... /bd0/Crashlogs/crashlog-20160306-1012 PMU BootOnBatt Counter ACTUAL is now 3 ============================================================================== Set temp = Kryten /bd0/ - Volume is OK total # of clusters: 62,580 # of free clusters: 56,607 # of bad clusters: 0 total free space: 905,712 Kb 0, 0, max contiguous free space: 923,697,152 bytes # of files: 58 # of folders: 1 total bytes in files: 94,805 Kb # of lost chains: 0 total bytes in lost chains: 0 0, 0, 0, 0, PMU Skip-OverTemp Setting: 0x0000 PMU Shutdown Status: 0x00 PMU Shutdown IS NOT Pending! PMU Shutdown Reasons are Fully Enabled Disk Array Temp is Within Tolerances CPU Core Temp is Within Tolerances PMU Core Temp is Within Tolerances PMU Shutdown Reason: 0x00 PMUCmd: "A" --> "a" "Y" --> "0x0680,23:20.75,0,0,0" "B" --> "1,0,0,0,0,1" Total = 0:0 in 0 cycles PMU state machine current state is 'NORMAL' [0x06] PMU reports the DRAM data was INVALID at bootup [0x80] Accumulated Up-time = 0 days: 0 hours: 23 minutes: 20.085 seconds (1 Active cycles, 1 Power cycles) Latest battery backup time = 00:00:00 (hh:mm:ss) Longest battery backup time = 00:00:00 (hh:mm:ss) Accumulated battery backup time = 00:00:00 (hh:mm:ss) (0 Backup cycles, 0 Completed cycles, 0 Failed cycles, 0 Backup flags) 0x4011744 (tErfTask): 0x4011744 (tErfTask): INFO: usb2Msc - Device /bd0 has been claimed bm INFO: usb2Msc - Device /bd0 has been claimed by filesystem NOTIFY: hDevice 0x2 lun 0 medium changed (mediumInsert = 1) PMU Reports Voltages: (AC == 12.085V) (Batt == 0.263V) PMU LED Dimming: Default==25, Current==25 PMU Fan Speed AutoAdjust has been ENABLED PMU Fan Speed: Default== 1, Current== 1 Setting Temperature Critical Threshold for Disk from 56 to 65 Temperature Thresholds for Disk: Interest== 52, Warning== 55, Critical== 65 -- Override==F PMU Init Done ============================================================================== **** ArmadaXP is Type B0 Launching LED Sequencer... LED Sequencer...Launched LED Sequencer...Testing... Setup Kernel/RTP Messaging Interface Initialising kernel<->RTP queues with 80 entries USB command/response Q's @ 0xf4102000/0xf4103000 MULTI ISSUE command/response Q's @ 0x0/0xf4105000 FAST PATH QUEUING RTP INTERFACE ENABLED 64-BIT HOST LBAs ENABLED Setup Kernel/RTP Resource Release Messaging Interface Initialising kernel<->RTP resource release queues with 80 entries MULTI ISSUE RESOURCE RELEASE Q @ 0xf4107000 FAST PATH QUEUING RTP RESOURCE RELEASE INTERFACE ENABLED IntConnect pISR==0x01076b9c was Successful for Cause==32 ("PMU Panic") IntConnect pISR==0x01076c34 was Successful for Cause==40 ("PMU PowerDownReq") IntConnect pISR==0x01076b20 was Successful for Cause==57 ("PMU OverTemp") IntConnect pISR==0x01076d48 was Successful for Cause==29 ("Disk Detected") IntDisable for Cause==65 ("Clear Disk Button") ***** Initializing the Kernel's Thermal Monitor ***** ***** Spawning the Kernel's Thermal Monitor ***** ***** Executing Auxilliary Task for the Kernel's Thermal Monitor ***** KERNEL BOOTUP: usrAppInit: INFO: bootup with backup battery OFF Not Turning the battery ON ye PMUCmd: "~55" --> "~55!" PMUCmd: "K" --> "k" Intercore Access Device Driver - Version 1.0 - Installed. Heatwave MVT Init Compleat! [tRootTask] 2071-06-19 21:30:04: diskInterfaceInitialise: Starting Disk Driver(s) Initiali. [tRootTask] 2071-06-19 21:30:04: bspDiskConfigureDiskTable: Configuring drive tables for 8e [tRootTask] 2071-06-19 21:30:04: diskInterfaceInitialise: System has 8 slots [tRootTask] 2071-06-19 21:30:04: diskDriverInstall: [tRootTask] 2071-06-19 21:30:04: showDiskTbs: Dumping Disk Driver Config Tables: [New Disk Thread] 2071-06-19 21:30:04: diskConfigureNewDiskThread: Starting thread [tRootTask] 2071-06-19 21:30:04: [tRootTask] 2071-06-19 21:30:04: Dumping Disk Adapter Table [tRootTask] 2071-06-19 21:30:04: Adapter Instance Adapter Address Adapter Data Adds [tRootTask] 2071-06-19 21:30:04: 0 0x01E59238 0x00000000 [tRootTask] 2071-06-19 21:30:04: 1 0x01E59238 0x00000000 [tRootTask] 2071-06-19 21:30:04: 2 0x01E59238 0x00000000 [tRootTask] 2071-06-19 21:30:04: 3 0x01E59238 0x00000000 [tRootTask] 2071-06-19 21:30:04: [tRootTask] 2071-06-19 21:30:04: Dumping Disk Slot Config Table: [tRootTask] 2071-06-19 21:30:04: Adapter Instance Connection Physical Slot Adapr [tRootTask] 2071-06-19 21:30:04: 0 DRIVE 0 8 [tRootTask] 2071-06-19 21:30:04: 0 DRIVE 1 C [tRootTask] 2071-06-19 21:30:04: 1 DRIVE 2 0 [tRootTask] 2071-06-19 21:30:04: 1 DRIVE 3 4 [tRootTask] 2071-06-19 21:30:04: 2 DRIVE 4 8 [tRootTask] 2071-06-19 21:30:04: 2 DRIVE 5 C [tRootTask] 2071-06-19 21:30:04: 3 DRIVE 6 0 [tRootTask] 2071-06-19 21:30:04: 3 DRIVE 7 4 [tRootTask] 2071-06-19 21:30:04: diskInterfaceInitialise: Calling init with adapter 0 (0x0) [tRootTask] 2071-06-19 21:30:04: ahciPerformPhyConfig: Loading phy regs for 9170 0x69cf2bMax Disk Temp: c Data abort Exception address: 0x010ca130 Current Processor Status Register: 0x80000013 Task: 0x69cf2bc "tRootTask" (tRootTask): 0x69cf2bc (tRootTask): diskDriAhciStorageRegister: diskDriAhciStorageRegister: 0x69cf2bc (tRootTask): 0x69cf2bc (tRootTask): diskDriAhciInstInit: diskDriAhciInstInit: 0x69cf2bc (tRootTask): 0x69cf2bc (tRootTask): diskDriAhciInstInit2: diskDriAhciInstInit2: 0x69cf2bc (tRootTask): 0x69cf2bc (tRootTask): diskDriAhciInstInit2: Storing 0x04AE9148 to 0 diskDriAhciInstInit2: Storing 0x04AE9148 to adapter table entry 0 0x69cf2bc (tRootTask): 0x69cf2bc (tRootTask): diskDriAhciInstConnect: diskDriAhciInstConnect: 0x69cf2bc (tRootTask): 0x69cf2bc (tRootTask): task 0x69cf2bc has had a failure and has bee. task 0x69cf2bc has had a failure and has been stopped. 0x69cf2bc (tRootTask): 0x69cf2bc (tRootTask): fatal exception in a kernel task or stack ov! fatal exception in a kernel task or stack overflow! 24 C, Ave Disk Temp: 23 C, Fan Speed = 1, Sampling Period = 36 sec C, Slot 1: 23 C, Slot 2: 23 C, Slot 3: 24 C, Slot 4: 24 C, Slot 5: 24 C, Slot 6: 24 C, Slot 7: 24 C, CPU Core Temp: 55 C, PMU Core Temp = 33 C Temperature Thresholds for Disk: Interest== 52, Warning== 55, Critical== 65 -- Override==F Temperature Thresholds for CPU : Interest== 95, Warning==101, Critical==104 -- Override==F Temperature Thresholds for PMU : Interest== 78, Warning== 82, Critical== 84 -- Override==F --- End code --- It did not load the linux stuff. The device was not accessible and i had to reset the device in openocd using reset. Reverseenginering the firmware flashing process or something like in the videos i mentioned above is way beyound my abilities. So please let me know if you can provide files from a working device. For now i will stop my experiments with this device. |
| JimKnopf:
As i mentioned earlier "working with address and size values is hard to me". I had a address mismatch in my load_image command in openocd. In #openocd IRC channel (LibraChat) some nice guy informed me that my load address should be: 0x02000000 instead of: 0x20000000 He also told me not to load the firmware file or ELF files as elf format but as bin format in openocd. This time i could load an image: --- Code: ---halt load_image /home/<user>/<some_path>/22c.ELF 0x02000000 bin resume --- End code --- It was successfully loaded to 0x02000000. In Marvell u-boot i tried: --- Code: ---bootvx 0x02000000 --- End code --- It started to load the image from 0x02000000 but stuck after some lines: --- Code: ---Executing: bootvx 0x02000000 ## Ethernet MAC address not copied to NV RAM ## Using bootline (@ 0x1100): neta(3,0) f=0x6000 o=usb0:eth3:cpus=1:mem=0x20000000;MAC3-00e ## Starting vxWorks at 0x01000000 ... --- End code --- After some trial and errors i found out, i have to load an image in openocd, use bootvx in u-boot, switch back to openocd and resume at the load address like this: --- Code: ---In openocd: halt load_image /home/<user>/<some_path>/22c.ELF 0x02000000 bin resume switch to Marvell u-boot: td_bootargs_confab; bootvx 0x02000000 (wait until it get stuck) switch back to openocd: halt resume 0x020000000 --- End code --- And it loads the extracted ELF file from firmware file. I even could load the whole firmware file in openocd and use bootvx with an offset of 0x22c. The ELF image starts at 0x22c in the firmware file. To my surprise, i also could load the vxworks image i dumped from the device. At the end of the boot process i ended up in a vxworks shell with very limited commands. --- Code: ---help List of the registered topics: EDR List of the shell commands related to ED&R. RTP List of the shell commands related to RTP. SD List of the shell commands related to shared data regions. SHL List of the shell commands related to shared library. VM List of the shell commands related to virtual memory. address_space List of the shell commands related to address space. basic List of basic shell commands. breakpoint List of the shell commands related to breakpoints. esa Commands for the ESA array. filesystem List of the shell commands related to file system. history List of commands relative to history management. interpreter Interpreter shell commands. k Drobo specific commands for the kernel. memory List of the shell commands related to memory. mmap List of the shell commands related to memory mapped objects. modules List of the shell commands related to kernel modules. network Network commands object List of the shell commands related to objects. symbols List of the shell commands related to symbols. tasks List of the shell commands related to tasks. List of the registered commands: C Switch to C interpreter adrsp Display information on the address space. alias Add an alias or display alias bp Display, set or unset a breakpoint cd Change current directory. demangle Display demangled string dprintf Insert a dynamic printf eventpoint echo Display a line of text edr ... esa Wrapper command to pass commands through to the esa array user app exit Exit the shell session. expr Evaluate expressions file ... func ... getenv Get an environment variable help Display the list of the shell commands history ... ifconfig IPNET interface configuration k ... logout Logout the shell session. lookup Lookup a symbol mem ... mmap ... module ... more Browse and page through a text file. object ... ping IPNET ping utility print ... printf Write formatted output pwd Display current working directory. reboot Reboot the system repeat Repeat a command route IPNET route table control rtp ... sd ... set ... setenv Set an environment variable shl ... show ... slab Print slab cache information sleep Suspend execution for an interval. string ... syscall ... syscalls Display system call group information in the system. sysctl IPNET sysctl configuration task ... unalias Remove an alias unset ... version Display VxWorks version information. vm ... --- End code --- The linux side did not load this way. I only had the vxworks shell. I found some interesting commands and files. --- Code: ---show devices drv name 0 /null 1 /tyCo/0 1 /tyCo/2 1 /tyCo/3 2 diagLog 8 /proc 10 bootHost: 11 /vio 12 /tgtsvr 13 /ESA_REGISTER 14 fl 4 /bd0 15 /lxdmesg 15 /lxiscsitgtlog 15 /lxcrashlog 15 /lxlastbootlog 15 /lxiscsitgtcore 16 /networkinfo 17 /serialnuminfo --- End code --- --- Code: ---ls /bd0 /bd0/vxWorks /bd0/LxImage /bd0/Crashlogs /bd0/NoCrashMsg /bd0/hibLog /bd0/hibHdr /bd0/amitLog /bd0/bootCount /bd0/eventLog /bd0/hdr_prev /bd0/RebootReason /bd0/VXI2.bin /bd0/UBHW.bin /bd0/UBHW.hdr /bd0/hdr /bd0/LxHdr /bd0/VXI2.hdr /bd0/vxWorks_prev /bd0/LxImage_prev /bd0/LxHdr_prev /bd0/RTPI.bin /bd0/RTPI.hdr /bd0/LXFS.bin /bd0/LXFS.hdr --- End code --- I replaced all files where i had a _prev version of a file: --- Code: ---file move LxImage LxImage-orig file move vxWorks vxWorks-orig file move LxHdr LxHdr-orig file move hdr hdr-orig file copy LxImage_prev LxImage file copy vxWorks_prev vxWorks file copy LxHdr_prev LxHdr file copy hdr_prev hdr --- End code --- I found out that i could execute .bin files from this directory. In openocd i did a reset and the device startet vxworks AND linux! --- Code: ---[vxWorks *]# version VxWorks (for Marvell Sheeva 88SV584x, Board= Heatwave 1.0 ARMARCHV7 LE core) version 6.8. Kernel: WIND version 2.13. Made on Feb 3 2016, 20:45:55. Boot line: neta(3,0) f=0x6000 o=usb0:eth3:cpus=1:mem=0x20000000;MAC3-00:50:43:11:89:dd;SER-DRB143602000000 s=#/romfs/runesa.vxe --- End code --- --- Code: ---Drobo:/ # uname -a Linux Drobo 3.2.96-3 #1 SMP Wed Sep 9 12:29:26 UTC 2020 armv7l GNU/Linux --- End code --- The downside is, still no network service running. But both shells working and (one) green light on the device. Both bootlogs are attached. I searched for older firmware files and found two using the wayback archive (https://web.archive.org/web/20200923005204/https://www.drobo.com/docs/start-drobo-b810i/): The failed update version was 2.0.1. I found Version 2-0-0 https://web.archive.org/web/20200923005204/https://www.drobo.com/docs/start-drobo-b810i/ and 1-3-5 https://web.archive.org/web/20170716181543/http://files.drobo.com/webrelease/b810i/B810i_Firmware_1-3-5.zip I was able to load both firmware files and boot with the offset for the first ELF image. The trick did not work with an offset for the second ELF image in the firmware files. |
| JimKnopf:
I compared the md5sum of the files i dumped from the vxworks side with the 3 firmware files: --- Code: ---Drobo filedump MD5 4639529020298b3671d3517c10c09522 vxi2.bin = 22c.ELF found in release.B810i.2-0-1.tdf (first ELF image) MD5 40104317c0dbdd43e84df334dbc1fac6 lximage = 12231fa.UImage found in release.B810i.2-0-1.tdf MD5 e0a1c6d97bd614cfaaebed36c619d83e rtpi.bin = 7578b6.ELF found in release.B810i.2-0-1.tdf (second ELF image) MD5 1bf5585eb18318837a3d4fd4e6fb90a4 LxHdr = selection_0-22b found in release.B810i.2-0-1.tdf (right before the first ELF image) drobo_2-0-1_extracted-parts# md5sum * [size in bytes] + 40104317c0dbdd43e84df334dbc1fac6 12231fa.UImage 3168928 624b46f91b061795ce641a36f096ed90 1528d16.JFFS2 11858012 + 4639529020298b3671d3517c10c09522 22c.ELF 7698058 + e0a1c6d97bd614cfaaebed36c619d83e 7578b6.ELF 11319620 + 1bf5585eb18318837a3d4fd4e6fb90a4 selection_0-22b 556 drobo_2-0-0_extracted-parts# md5sum * [size in bytes] ffe68f761c88d77cfed8df5d7619b3c3 11e355c.UImage 3168936 cd4881229a64f702a6e002aa9c3cb51b 14e9080.JFFS2 10330556 66fb7d8f75c09a7e99cf7910bd9da934 22c.ELF 7690876 955691ee15ebedc9f9fc6806c773d522 755ca8.ELF 11065524 497aca92106d4ae411af2e7f63e86e52 selection_0-22b 556 drobo_1-3-5_extracted-parts# md5sum * cad166fb818c55767df926033faa4ef4 110c4f6.UImage 3750024 8ee2ed4a45a895bbbe6d7d0bedc7f772 149ff4a.JFFS2 25529652 5e96eae5bac03992bbfd82961bb67182 22c.ELF 7569558 d315b81c0eaf33b84a71e7be84638f65 7382c2.ELF 10306100 8be984ce60d9d34284116926b6edffab selection_0-22b 556 openocd-dump_20231230# md5sum * 7351e5dadd74474690b1f014f3b69570 hdr 556 7351e5dadd74474690b1f014f3b69570 hdr_prev 556 4cabb259c8abf4a5adafe2aa07a982c5 hibhdr 512 + 1bf5585eb18318837a3d4fd4e6fb90a4 LxHdr 556 + 1bf5585eb18318837a3d4fd4e6fb90a4 LxHdr_prev 556 + 40104317c0dbdd43e84df334dbc1fac6 lximage 3168928 + 40104317c0dbdd43e84df334dbc1fac6 lximage_prev 3168928 + e0a1c6d97bd614cfaaebed36c619d83e rtpi.bin 11319620 1bf5585eb18318837a3d4fd4e6fb90a4 RTPI.hdr 556 9e30738c85838a54dea0271fd743bfca runesa.vxe 10177608 ecfdbaed33efb962865e71d456349683 ubhw.bin 801272 7351e5dadd74474690b1f014f3b69570 UBHW.hdr 556 + 4639529020298b3671d3517c10c09522 vxi2.bin 7698058 + 1bf5585eb18318837a3d4fd4e6fb90a4 VXI2.hdr 556 e83b73a0859310cc8705fe1ad3dfb0d8 vxworks 17734472 e83b73a0859310cc8705fe1ad3dfb0d8 vxworks_prev 17734472 --- End code --- I found LxHdr, LxHdr,_prev, RTPI.hdr, VXI2.hdr are the same files, located at the beginning until 0x22c of the firmware file. VXI2.bin is the first ELF image in the firmware file. The second ELF image in the firmware file is RTPI.bin. The LxImage is the called UImage in the firmware file. The firmware contains one more data block, a JFFS2 part. I didn't found the vxWorks stuff in the firmware files. I don't know if that part was ever updated. |
| JimKnopf:
Accessing the files on the internal memory, which is only accessible on the vxworks side is waaaaayyyyyyy easier than i tought. It's not possible transfering data over network to the vxworks side. On Marvell U-boot i only have read access. But, during boot, it enables a internal usb drive. I re-checked the board. And there is a small daughterboard containing two memory chips. It is connected with 2x5 pinheader to the mainboard. One pin was removed. It looked like an ordinary USB connector like the ones on a Desktop Mainboard. The daughterboard has a product label "Apacer". It turns out its a common SSD. I checked the pins on the pinheader and compared the voltage to a default USB port and it matches. Using a USB-A connector and some flying wires, it was immediately recognized as USB-drive on my Laptop. I was able to replace VXI2.bin, LxHdr, RTPI.bin and LxImage with the matching sections from firmware file. LxHdr is needed because it contains a checksum for LxImage file (0-22c of firmware file). The firmware release 2-0-0 had same boot problem like the 2-0-1. But the content from firmware release 1-3-5 let the vxworks side boot. At the moment there is an error on the linux side. And still not recognized by Drobo Dashboard. |
| JimKnopf:
I did some tests with u-boot settings and managed to freeze the Bootrom 1.2 because of header checksum mismatch. To make things easier, i placed the MX25L6406E cmos serial flash outside the board and used flying wires to connect the IC-adapter to the board. I also replaced the internal USB-SSD temporary with a Pi zero 2w. The advantage is, i don't need to plug/unplug the drive to copy files to the device. Using the pi zero as a usb drive, i can copy files via wifi. I copy files using sftp in linux (or WinSCP in windows). The 9-pin USB connector (only the 4-pin row is used) has 2mm pitch wide. Default dupont connectors have 2,54mm pitch wide. I crimped flying wires to a JST-HX 4-pin connector. Burning the cmos serial flash dump brought the device back to life. |
| Navigation |
| Message Index |
| Next page |
| Previous page |