Electronics > Repair

Drobo B810i NAS half bricked after failed firmware update

<< < (3/5) > >>

JimKnopf:
I need some help from either someone who can extract a working vxworks image from this firmware file or someone who can provide the files from a working device.

I tried different things now loading the vxworks ELF images i extracted manually from the firmware file and the ones emba extracted automaticly. I tried to load it in u-boot using loady and ymodem in minicom but could not get it to work.

I then tried it using kermit in minicom and was able to successfully upload the data using ckermit after creating ~/.kermrc with this content:

--- Code: ---set carrier-watch off
set handshake none
set flow-control none
robust
set file type bin
set rec pack 1000
set send pack 1000
set window 5

--- End code ---

I tried the firmware file itself and the extracted ELF files from the firmware file containing the vxworks stuff. The firmware file has more than 50 MB. It took more than 90 minutes to upload it over uart serial connection in u-boot. I't didn't help. When i run

--- Code: ---go 0x20000000

--- End code ---

and some commands from printenv data like

--- Code: ---td_bootargs_confab; run flashload_g0; bootvx 0x20000000

--- End code ---

It always complains "No ELF file at 0x20000000". Because of the very slow upload speed using kermit, i tried a combination of Marvell u-boot shell and openocd.

Loading a file to memory is way faster in openocd.
I started the device, pressed a button to stop boot process and entering the Marvell u-boot shell. In openocd i did:

--- Code: ---halt
load_image /home/<user>/<some_path>/7698614-19018234.elf32 0x20000000 elf
resume

--- End code ---

In  u-boot i tried the same commands like before, go 0x20000000 or td_bootargs_confab; run flashload_g0; bootvx 0x20000000.

I don't know why but sometimes the image was not loaded to 0x20000000. Sometimes it was loaded at 0x21000000.
I couldn't even load the original vxworks image i dumped from the Drobo device.

One time i tried loading it at 0x00000000 and it was loaded at 0x01000000.
In this case, i did in openocd a resume 0x01000000 and to my surprise, it started to load but halted at some point.
But this time i had blue lights on the device and the bootlog was different:

--- Code: ---Marvell>> td_bootargs_confab; run flashload_g0; bootvx 0x21000000
Env Var skipConfabulation=0
Skip Confabulation: NONE
  ... skipConfabulation: 0x1 skips Vx confab, 0x2 skips Lx confab
Current Value of Vx bootargs_g0:
==================================================
bootargs_g0=neta(3,0) f=0x6000 o=usb0:eth3:cpus=1:mem=0x20000000;MAC3-00:50:43:11:89:dd;SEe
==================================================
EnvVar bootargsStart=neta(3,0)
EnvVar vxFlags=f=0x6000
EnvVar vxDev=usb0:eth3:cpus=1:mem=0x20000000
EnvVar eth3addr=00:50:43:11:89:dd
EnvVar droboSER=DRB143602000000
EnvVar vxCmd=s=#/romfs/runesa.vxe
Confabulated Value of bootargs_g0:
==================================================
bootargs_g0=neta(3,0) f=0x6000 o=usb0:eth3:cpus=1:mem=0x20000000;MAC3-00:50:43:11:89:dd;SEe
==================================================
Current bootargs_g0 perfectly match the Confabulated bootargs_g0
No Need to Update the Environment
reading vxWorks_prev
.
.
.
...........................................................................................

17734472 bytes read
## Ethernet MAC address not copied to NV RAM
## No elf image at address 0x21000000
## Not an ELF image, assuming binary
## Using bootline (@ 0x1100): neta(3,0) f=0x6000 o=usb0:eth3:cpus=1:mem=0x20000000;MAC3-00e
## Starting vxWorks at 0x21000000 ...
MPP33 Config (0xd0018010) == 0x11110040 (Should be: 0xXXXXXX4X)
SDRAM Config (0xd0001400) == 0x7201c924 (Should be: 0x72XXXXXX)
DRAM TBsAddr (0xd0001580) == 0x20000000 (Should be: 0x??????]

Booting from CPU 0
Detected board Heatwave 1.0
DRAM env init....... Done.


Detected DRAM size 512MB
  AMP: Resources - uart0 - pex1 - pex2 - eth3 - xor0 - usb0 - i2c0 - i2c1 - sata - spi - g
AMP CPUs = 1
AMP mem size = 0x20000000
TWSI init Channel 0....... Done. Actual freq = 97656Hz
Skipping serdes configuration.
Ctrl env init....... Done.
Addr Dec Win......
Verified
CP15 mrvl dbgr  0x000109A7
CP15 mrvl dbgr2 0xEA008208
CP15 mrvl ctrl  0x000001B6
CP15 mrvl dbgr  0x000109A7
CP15 mrvl dbgr2 0xEA008208
CP15 mrvl ctrl  0x000001B6
CPU if init......... Done.
GPP init............ Done.
DRAM env init....... Done.


Using DRAM size 512MB


=======================> HW Revision Register == 0x00000881

Detected Board: Heatwave MVT, Spin 0 (No EthDebug)

Detect:  Tclk    250MHz
         SysClk  600MHz
         L2Clk   600MHz
         pClk   1200MHz

Marvell Controller initialization Done.
Modules Detected:

SPI flash based addr on 0xD4000000=
SPI Flash 8MB detected

esaXORSystemInit

esaXORSystemInit...done

esaDMASystemInit
Initialising SEEPROM Interface
Checking Bootline.......0x00001100 [0x6e]
UBOOT Version: UBOOT-2.33


Bootline params = neta(3,0) f=0x6000 o=usb0:eth3:cpus=1:mem=0x20000000;MAC3-00:50:43:11:89

DRAM int Ctrl....... Done
IDMA Err int Ctrl... Done
IDMA init........... Done
NETA Err int Ctrl... Done
Neta int Ctrl....... Done
GPIO int Ctrl....... Done
PCI int Ctrl........ Done
PCI-E 0: Not mapped to this OS
PCI-E 1: Not mapped to this OS
PCI-E 2: Not mapped to this OS
PCI-E 3: Not mapped to this OS
mvPexIntfInit() ROOT COMPLEX Init pexHWInf: 4
mvSysPexInit() called pexIf: 4  type: 0  MAX_TARGETS: 44
mvSysPexInit() OK from mvCtrlAddrWinMapBuild()
mvSysPexInit() OK from mvPexWinInit()
mvPexModeGet()  configured as ROOT reg: 0x4014032e
mvPexInit() configuring as ROOT
mvPexLocalBusNumSet() called for pexIf: 4  busNum: 0 localBus: 0  localDev: 0
*******************mvPexLocalDevNumSet(4) localBus: 0  localDev: 0 pexStatus: 0 ***********
mvPexInit() call mvPexMasterEnable
mvPexInit() call mvPexSlaveEnable
mvPexInit() disable int
mvPexInit() wait a tick
mvPexInit() check for link
PEX4 interface detected Link X1
mvPexIntfInit() checking if we should set the localBus  pex0flg: 0  pexHWInf: 4
mvPexIntfInit() setting localBusNum to 0 for pexHWInf 4
mvPexLocalBusNumSet() called for pexIf: 4  busNum: 0 localBus: 0  localDev: 0
PCI-E 4/10: Done.
PCI-E 5: is power off
mvPexIntfInit() ROOT COMPLEX Init pexHWInf: 6
mvSysPexInit() called pexIf: 6  type: 0  MAX_TARGETS: 44
mvSysPexInit() OK from mvCtrlAddrWinMapBuild()
mvSysPexInit() OK from mvPexWinInit()
mvPexModeGet()  configured as ROOT reg: 0x4014022e
mvPexInit() configuring as ROOT
mvPexLocalBusNumSet() called for pexIf: 6  busNum: 0 localBus: 1  localDev: 0
*******************mvPexLocalDevNumSet(6) localBus: 0  localDev: 0 pexStatus: 0 ***********
mvPexInit() call mvPexMasterEnable
mvPexInit() call mvPexSlaveEnable
mvPexInit() disable int
mvPexInit() wait a tick
mvPexInit() check for link
PEX6 interface detected Link X1
mvPexIntfInit() checking if we should set the localBus  pex0flg: 0  pexHWInf: 6
mvPexIntfInit() setting localBusNum to 0 for pexHWInf 6
mvPexLocalBusNumSet() called for pexIf: 6  busNum: 0 localBus: 0  localDev: 0
PCI-E 6/10: Done.
mvPexIntfInit() ROOT COMPLEX Init pexHWInf: 7
mvSysPexInit() called pexIf: 7  type: 0  MAX_TARGETS: 44
mvSysPexInit() OK from mvCtrlAddrWinMapBuild()
mvSysPexInit() OK from mvPexWinInit()
mvPexModeGet()  configured as ROOT reg: 0x4014022e
mvPexInit() configuring as ROOT
mvPexLocalBusNumSet() called for pexIf: 7  busNum: 0 localBus: 2  localDev: 0
*******************mvPexLocalDevNumSet(7) localBus: 0  localDev: 0 pexStatus: 0 ***********
mvPexInit() call mvPexMasterEnable
mvPexInit() call mvPexSlaveEnable
mvPexInit() disable int
mvPexInit() wait a tick
mvPexInit() check for link
PEX7 interface detected Link X1
mvPexIntfInit() checking if we should set the localBus  pex0flg: 0  pexHWInf: 7
mvPexIntfInit() setting localBusNum to 0 for pexHWInf 7
mvPexLocalBusNumSet() called for pexIf: 7  busNum: 0 localBus: 0  localDev: 0
PCI-E 7/10: Done.
mvPexIntfInit() ROOT COMPLEX Init pexHWInf: 8
mvSysPexInit() called pexIf: 8  type: 0  MAX_TARGETS: 44
mvSysPexInit() OK from mvCtrlAddrWinMapBuild()
mvSysPexInit() OK from mvPexWinInit()
mvPexModeGet()  configured as ROOT reg: 0x4014032e
mvPexInit() configuring as ROOT
mvPexLocalBusNumSet() called for pexIf: 8  busNum: 0 localBus: 3  localDev: 0
*******************mvPexLocalDevNumSet(8) localBus: 0  localDev: 0 pexStatus: 0 ***********
mvPexInit() call mvPexMasterEnable
mvPexInit() call mvPexSlaveEnable
mvPexInit() disable int
mvPexInit() wait a tick
mvPexInit() check for link
PEX8 interface detected Link X1
mvPexIntfInit() checking if we should set the localBus  pex0flg: 0  pexHWInf: 8
mvPexIntfInit() setting localBusNum to 0 for pexHWInf 8
mvPexLocalBusNumSet() called for pexIf: 8  busNum: 0 localBus: 0  localDev: 0
PCI-E 8/10: Done.
PCI-E 9: Not mapped to this OS
USB0 init........... Done. HOST   type selected
USB Err int Ctrl.... Done
XOR Err int Ctrl.... Done
mvSysXorInit: done
XOR init............ Done
mvCtrlInit2......... done
vxbDevInit.........done
sysSerialConnectAll.........done
Serial Ports...Attached
UART2...Baud Rate Adjusted to 38.4K
VxBus Loaded.... done
bspConfigureI2CTable: Configuring I2C tables for 8-Slot (Kryten)
[tRootTask] 1970-01-01 00:00:00: drDrvLaunch
---->> drDrv() <<----
Allocated temp buffer 0x42599a8
[tRootTask] 1970-01-01 00:00:00: Diagnostic Re-Route Device Driver - Version 1.0 - Install.
[tRootTask] 1970-01-01 00:00:00: drStartLogging() started
_DEF_STD_OUT = 3 _DEF_STD_ERR = 3 _DR_FD = 4
Host Name: bootHost
Target Name: vxTarget
User: target
Ethernet port #3 initialized
neta3 Interface Loaded; MAC: 00:50:43:11:89:DD
neta3 Interface Started
Attempting to register custom syscalls group
ipAttached to interface neta3 ip=
Can't Set IP address to <neta3> interface..bootline does not have ethernet ipAddress

Adding 10511 symbols for standalone.
Detected Marvell USB. SettingwdbConfig: error configuring WDB communication interface
 

 ]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]
 ]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]
 ]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]
      ]]]]]]]]]]]  ]]]]     ]]]]]]]]]]       ]]              ]]]]         (R)
 ]     ]]]]]]]]]  ]]]]]]     ]]]]]]]]       ]]               ]]]]           
 ]]     ]]]]]]]  ]]]]]]]]     ]]]]]] ]     ]]                ]]]]           
 ]]]     ]]]]] ]    ]]]  ]     ]]]] ]]]   ]]]]]]]]]  ]]]] ]] ]]]]  ]]   ]]]]]
 ]]]]     ]]]  ]]    ]  ]]]     ]] ]]]]] ]]]]]]   ]] ]]]]]]] ]]]] ]]   ]]]] 
 ]]]]]     ]  ]]]]     ]]]]]      ]]]]]]]] ]]]]   ]] ]]]]    ]]]]]]]    ]]]]
 ]]]]]]      ]]]]]     ]]]]]]    ]  ]]]]]  ]]]]   ]] ]]]]    ]]]]]]]]    ]]]]
 ]]]]]]]    ]]]]]  ]    ]]]]]]  ]    ]]]   ]]]]   ]] ]]]]    ]]]] ]]]]    ]]]]
 ]]]]]]]]  ]]]]]  ]]]    ]]]]]]]      ]     ]]]]]]]  ]]]]    ]]]]  ]]]] ]]]]]
 ]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]
 ]]]]]]]]]]]]]]]]]]]]]]]]]]]]]       Development System
 ]]]]]]]]]]]]]]]]]]]]]]]]]]]]
 ]]]]]]]]]]]]]]]]]]]]]]]]]]]       VxWorks 6.8
 ]]]]]]]]]]]]]]]]]]]]]]]]]]       KERNEL: WIND version 2.13
 ]]]]]]]]]]]]]]]]]]]]]]]]]       Copyright Wind River Systems, Inc., 1984-2012

 CPU: Marvell Sheeva 88SV584x, Board= Heatwave 1.0 ARMARCHV7 LE core.  Processor #0.
 Memory Size: 0x1fe70000.  BSP version 2.3.1.
 Created: Feb  3 2016, 20:45:55
 ED&R Policy Mode: Deployed
 WDB Comm Type: WDB_COMM_END
 WDB: Agent configuration failed.
[tRootTask] 1970-01-01 00:00: MV_USB_MODE_RE00: kCmdInit: Initialising kernel command liner
[tRootTask] 1970-01-01 00:00:00: diskCmdRegister: Installing k disk Commands

G = 0x3
ESA Register Driver Found Board version 2, stuffing option 1
Initialising boot SEEPROM handler
Checking boot register values in serialEEPROM ...
<<<<Flash Upgrade Driver - version 1.0 - installed.
IsFlashForDroboPro: We are NOT running on Drobo Pro deal with flash accordingly
Failed to get flash layout...this is expected for Optimus Prime, which does not have NOR F.

System Configuration

CHIP   : MV88F7846 Rev 2
CPU    : Marvell PJ4B (584) v7 (Rev 2)
BOARD  : Heatwave 1.0 (0x0)
CLOCKs : tClk  =  250MHz, sysClk =  600MHz
         L2Clk =  600MHz  pClk   = 1200MHz

ETH_JUMBO_SUPPORT   = Disabled
BRIDGING_SUPPORT    = Enabled
MULTI_Q_SUPPORT     = Disabled
NAT_SUPPORT         = Disabled
VFP_SUPPORT         = Enabled
L2 Cache            = Enabled
IO coherency        = Enabled
Get DATE: 2071-06-19 (Friday)  TIME: 21:30:01
[vxWorks *]#

=======================> HW Revision Register == 0x00000881

Board Type 4, Rev 2 (Heatwave MVT), Spin = 0
Stuffing Opt = 1 (No EthDebug), DevDebugBitz = 0x0


        Drobo B810i
        Heatwave
        Ready to take a Byte!

==============================================================================
Initializing PMU...
Reading PMU Version...
PMU Version: 1.2.0x046c, Download Version 108 (Variant 4) [Failsafe Ver 4]
Considering an Update to the PMU ...
PMU is up to date for this MVT board.

    Reading 0xac from PMU GPIO Port 1 [ @0x0020 ]

    Reading 0xef from PMU GPIO Port 2 [ @0x0028 ]

    Reading 0x71 from PMU GPIO Port 3 [ @0x0018 ]

    Reading 0x10 from PMU GPIO Port 4 [ @0x001c ]
==============================================================================
        PMU is Running on AC Power :-)
==============================================================================
==============================================================================
0x48ac278 (BusM A): 0x48ac278 (BusM A): INFO: usb2Msc - Storage driver got a device attach.
INFO: usb2Msc - Storage driver got a device attach notification.
This Optimus Prime PMU is NOT configured for Early-Follow of DDR3 Reset...Fixing
0x48ac278 (BusM A): 0x48ac278 (BusM A): INFO: usb2Msc - Mounting device (PDT 0x0 PQ 0x0 RMP
INFO: usb2Msc - Mounting device (PDT 0x0 PQ 0x0 RMB 0x0) VID =          : PID = USB DISK MP
0x48ac278 (BusM A): 0x48ac278 (BusM A): INFO: usb2Msc - Device 0x2 LUN 0 of 1005568 (KB) w0
INFO: usb2Msc - Device 0x2 LUN 0 of 1005568 (KB) will be mounted with base name /bd0
This Optimus Prime Board Supports Self-Refresh only with VRM_EN
        ...PMU will ENABLE VRM_EN during a reboot/shutdown cycle.
        PMU BootOnBatt Counter DEFAULT is now 3
/bd0/  - disk check in progress ...
/bd0/Crashlogs/crashlog-20160306-1012   PMU BootOnBatt Counter ACTUAL is now 3
==============================================================================
Set temp = Kryten
/bd0/  - Volume is OK                               

          total # of clusters:  62,580
         # of free clusters:  56,607
          # of bad clusters:  0
           total free space:  905,712 Kb
  0,   0,     max contiguous free space:  923,697,152 bytes
                 # of files:  58
               # of folders:  1
       total bytes in files:  94,805 Kb
           # of lost chains:  0
   total bytes in lost chains:  0
  0,   0,   0,   0,
PMU Skip-OverTemp Setting: 0x0000
PMU Shutdown Status: 0x00
        PMU Shutdown IS NOT Pending!
        PMU Shutdown Reasons are Fully Enabled
        Disk Array Temp is Within Tolerances
        CPU Core Temp   is Within Tolerances
        PMU Core Temp   is Within Tolerances
PMU Shutdown Reason: 0x00
PMUCmd: "A" --> "a"
"Y" --> "0x0680,23:20.75,0,0,0"
"B" --> "1,0,0,0,0,1"
 Total = 0:0 in 0 cycles

PMU state machine current state is 'NORMAL' [0x06]
PMU reports the DRAM data was INVALID at bootup [0x80]
Accumulated Up-time = 0 days: 0 hours: 23 minutes: 20.085 seconds
  (1 Active cycles, 1 Power cycles)
  Latest battery backup time      = 00:00:00 (hh:mm:ss)
  Longest battery backup time     = 00:00:00 (hh:mm:ss)
  Accumulated battery backup time = 00:00:00 (hh:mm:ss)
  (0 Backup cycles, 0 Completed cycles, 0 Failed cycles, 0 Backup flags)
0x4011744 (tErfTask): 0x4011744 (tErfTask): INFO: usb2Msc - Device /bd0 has been claimed bm
INFO: usb2Msc - Device /bd0 has been claimed by filesystem
NOTIFY: hDevice 0x2 lun 0 medium changed (mediumInsert = 1)
PMU Reports Voltages:  (AC == 12.085V)    (Batt ==  0.263V)
PMU LED Dimming: Default==25, Current==25
PMU Fan Speed AutoAdjust has been ENABLED
PMU Fan Speed: Default== 1, Current== 1
        Setting Temperature Critical Threshold for Disk from 56 to 65
Temperature Thresholds for Disk:  Interest== 52, Warning== 55, Critical== 65 -- Override==F
PMU Init Done
==============================================================================
****    ArmadaXP is Type B0
Launching LED Sequencer...
LED Sequencer...Launched
LED Sequencer...Testing...
Setup Kernel/RTP Messaging Interface
Initialising kernel<->RTP queues with 80 entries
USB command/response Q's @ 0xf4102000/0xf4103000
MULTI ISSUE command/response Q's @ 0x0/0xf4105000
FAST PATH QUEUING RTP INTERFACE ENABLED
64-BIT HOST LBAs ENABLED
Setup Kernel/RTP Resource Release Messaging Interface
Initialising kernel<->RTP resource release queues with 80 entries
MULTI ISSUE RESOURCE RELEASE Q @ 0xf4107000
FAST PATH QUEUING RTP RESOURCE RELEASE INTERFACE ENABLED
IntConnect pISR==0x01076b9c was Successful for Cause==32 ("PMU Panic")
IntConnect pISR==0x01076c34 was Successful for Cause==40 ("PMU PowerDownReq")
IntConnect pISR==0x01076b20 was Successful for Cause==57 ("PMU OverTemp")
IntConnect pISR==0x01076d48 was Successful for Cause==29 ("Disk Detected")
IntDisable for Cause==65 ("Clear Disk Button")


  ***** Initializing the Kernel's Thermal Monitor *****
   ***** Spawning the Kernel's Thermal Monitor *****
   ***** Executing Auxilliary Task for the Kernel's Thermal Monitor *****

KERNEL BOOTUP: usrAppInit: INFO: bootup with backup battery OFF

Not Turning the battery ON ye
PMUCmd: "~55" --> "~55!"
PMUCmd: "K" --> "k"
Intercore Access Device Driver - Version 1.0 - Installed.


        Heatwave MVT Init Compleat!

[tRootTask] 2071-06-19 21:30:04: diskInterfaceInitialise: Starting Disk Driver(s) Initiali.
[tRootTask] 2071-06-19 21:30:04: bspDiskConfigureDiskTable: Configuring drive tables for 8e
[tRootTask] 2071-06-19 21:30:04: diskInterfaceInitialise: System has 8 slots
[tRootTask] 2071-06-19 21:30:04: diskDriverInstall:
[tRootTask] 2071-06-19 21:30:04: showDiskTbs: Dumping Disk Driver Config Tables:
[New Disk Thread] 2071-06-19 21:30:04: diskConfigureNewDiskThread: Starting thread
[tRootTask] 2071-06-19 21:30:04:
[tRootTask] 2071-06-19 21:30:04:   Dumping Disk Adapter Table
[tRootTask] 2071-06-19 21:30:04:     Adapter Instance   Adapter Address   Adapter Data Adds
[tRootTask] 2071-06-19 21:30:04:            0            0x01E59238            0x00000000
[tRootTask] 2071-06-19 21:30:04:            1            0x01E59238            0x00000000
[tRootTask] 2071-06-19 21:30:04:            2            0x01E59238            0x00000000
[tRootTask] 2071-06-19 21:30:04:            3            0x01E59238            0x00000000
[tRootTask] 2071-06-19 21:30:04:
[tRootTask] 2071-06-19 21:30:04:    Dumping Disk Slot Config Table:
[tRootTask] 2071-06-19 21:30:04:     Adapter Instance   Connection    Physical Slot   Adapr
[tRootTask] 2071-06-19 21:30:04:         0                DRIVE             0             8
[tRootTask] 2071-06-19 21:30:04:         0                DRIVE             1             C
[tRootTask] 2071-06-19 21:30:04:         1                DRIVE             2             0
[tRootTask] 2071-06-19 21:30:04:         1                DRIVE             3             4
[tRootTask] 2071-06-19 21:30:04:         2                DRIVE             4             8
[tRootTask] 2071-06-19 21:30:04:         2                DRIVE             5             C
[tRootTask] 2071-06-19 21:30:04:         3                DRIVE             6             0
[tRootTask] 2071-06-19 21:30:04:         3                DRIVE             7             4
[tRootTask] 2071-06-19 21:30:04: diskInterfaceInitialise: Calling init with adapter 0 (0x0)
[tRootTask] 2071-06-19 21:30:04: ahciPerformPhyConfig: Loading phy regs for 9170
0x69cf2bMax Disk Temp: c
Data abort
Exception address: 0x010ca130
Current Processor Status Register: 0x80000013
Task: 0x69cf2bc "tRootTask"
 (tRootTask): 0x69cf2bc (tRootTask): diskDriAhciStorageRegister:
diskDriAhciStorageRegister:
0x69cf2bc (tRootTask): 0x69cf2bc (tRootTask): diskDriAhciInstInit:
diskDriAhciInstInit:
0x69cf2bc (tRootTask): 0x69cf2bc (tRootTask): diskDriAhciInstInit2:
diskDriAhciInstInit2:
0x69cf2bc (tRootTask): 0x69cf2bc (tRootTask): diskDriAhciInstInit2: Storing 0x04AE9148 to 0
diskDriAhciInstInit2: Storing 0x04AE9148 to adapter table entry 0
0x69cf2bc (tRootTask): 0x69cf2bc (tRootTask): diskDriAhciInstConnect:
diskDriAhciInstConnect:
0x69cf2bc (tRootTask): 0x69cf2bc (tRootTask): task 0x69cf2bc has had a failure and has bee.
task 0x69cf2bc has had a failure and has been stopped.
0x69cf2bc (tRootTask): 0x69cf2bc (tRootTask): fatal exception in a kernel task or stack ov!
fatal exception in a kernel task or stack overflow!
24 C, Ave Disk Temp: 23 C, Fan Speed =  1, Sampling Period = 36 sec
   C, Slot 1: 23 C, Slot 2: 23 C, Slot 3: 24 C,
  Slot 4: 24 C, Slot 5: 24 C, Slot 6: 24 C, Slot 7: 24 C,
  CPU Core Temp: 55 C, PMU Core Temp = 33 C
Temperature Thresholds for Disk:  Interest== 52, Warning== 55, Critical== 65 -- Override==F
Temperature Thresholds for CPU :  Interest== 95, Warning==101, Critical==104 -- Override==F
Temperature Thresholds for PMU :  Interest== 78, Warning== 82, Critical== 84 -- Override==F

--- End code ---


It did not load the linux stuff. The device was not accessible and i had to reset the device in openocd using reset.

Reverseenginering the firmware flashing process or something like in the videos i mentioned above is way beyound my abilities.
So please let me know if you can provide files from a working device.

For now i will stop my experiments with this device.

JimKnopf:
As i mentioned earlier "working with address and size values is hard to me". I had a address mismatch in my load_image command in openocd. In #openocd IRC channel (LibraChat) some nice guy informed me that my load address should be:
0x02000000 instead of:
0x20000000

He also told me not to load the firmware file or ELF files as elf format but as bin format in openocd.
This time i could load an image:

--- Code: ---halt
load_image /home/<user>/<some_path>/22c.ELF 0x02000000 bin
resume

--- End code ---
It was successfully loaded to 0x02000000.
In Marvell u-boot i tried:

--- Code: ---bootvx 0x02000000

--- End code ---
It started to load the image from 0x02000000 but stuck after some lines:

--- Code: ---Executing: bootvx 0x02000000
## Ethernet MAC address not copied to NV RAM
## Using bootline (@ 0x1100): neta(3,0) f=0x6000 o=usb0:eth3:cpus=1:mem=0x20000000;MAC3-00e
## Starting vxWorks at 0x01000000 ...

--- End code ---

After some trial and errors i found out, i have to load an image in openocd, use bootvx in u-boot, switch back to openocd and resume at the load address like this:


--- Code: ---In openocd:
halt
load_image /home/<user>/<some_path>/22c.ELF 0x02000000 bin
resume

     switch to Marvell u-boot:
     td_bootargs_confab; bootvx 0x02000000     (wait until it get stuck)

switch back to openocd:
halt
resume 0x020000000

--- End code ---

And it loads the extracted ELF file from firmware file. I even could load the whole firmware file in openocd and use bootvx with an offset of 0x22c. The ELF image starts at 0x22c in the firmware file. To my surprise, i also could load the vxworks image i dumped from the device. At the end of the boot process i ended up in a vxworks shell with very limited commands.

--- Code: ---help

List of the registered topics:
EDR                 List of the shell commands related to ED&R.
RTP                 List of the shell commands related to RTP.
SD                  List of the shell commands related to shared data regions.
SHL                 List of the shell commands related to shared library.
VM                  List of the shell commands related to virtual memory.
address_space       List of the shell commands related to address space.
basic               List of basic shell commands.
breakpoint          List of the shell commands related to breakpoints.
esa                 Commands for the ESA array.
filesystem          List of the shell commands related to file system.
history             List of commands relative to history management.
interpreter         Interpreter shell commands.
k                   Drobo specific commands for the kernel.
memory              List of the shell commands related to memory.
mmap                List of the shell commands related to memory mapped objects.
modules             List of the shell commands related to kernel modules.
network             Network commands
object              List of the shell commands related to objects.
symbols             List of the shell commands related to symbols.
tasks               List of the shell commands related to tasks.

List of the registered commands:
C                   Switch to C interpreter
adrsp               Display information on the address space.
alias               Add an alias or display alias
bp                  Display, set or unset a breakpoint
cd                  Change current directory.
demangle            Display demangled string
dprintf             Insert a dynamic printf eventpoint
echo                Display a line of text
edr ...
esa                 Wrapper command to pass commands through to the esa array
                    user app
exit                Exit the shell session.
expr                Evaluate expressions
file ...
func ...
getenv              Get an environment variable
help                Display the list of the shell commands
history ...
ifconfig            IPNET interface configuration
k ...
logout              Logout the shell session.
lookup              Lookup a symbol
mem ...
mmap ...
module ...
more                Browse and page through a text file.
object ...
ping                IPNET ping utility
print ...
printf              Write formatted output
pwd                 Display current working directory.
reboot              Reboot the system
repeat              Repeat a command
route               IPNET route table control
rtp ...
sd ...
set ...
setenv              Set an environment variable
shl ...
show ...
slab                Print slab cache information
sleep               Suspend execution for an interval.
string ...
syscall ...
syscalls            Display system call group information in the system.
sysctl              IPNET sysctl configuration
task ...
unalias             Remove an alias
unset ...
version             Display VxWorks version information.
vm ...

--- End code ---

The linux side did not load this way. I only had the vxworks shell. I found some interesting commands and files.

--- Code: ---show devices
drv name               
  0 /null               
  1 /tyCo/0             
  1 /tyCo/2             
  1 /tyCo/3             
  2 diagLog             
  8 /proc               
10 bootHost:           
11 /vio               
12 /tgtsvr             
13 /ESA_REGISTER       
14 fl                 
  4 /bd0               
15 /lxdmesg           
15 /lxiscsitgtlog     
15 /lxcrashlog         
15 /lxlastbootlog     
15 /lxiscsitgtcore     
16 /networkinfo       
17 /serialnuminfo     

--- End code ---


--- Code: ---ls /bd0
/bd0/vxWorks
/bd0/LxImage
/bd0/Crashlogs
/bd0/NoCrashMsg
/bd0/hibLog
/bd0/hibHdr
/bd0/amitLog
/bd0/bootCount
/bd0/eventLog
/bd0/hdr_prev
/bd0/RebootReason
/bd0/VXI2.bin
/bd0/UBHW.bin
/bd0/UBHW.hdr
/bd0/hdr
/bd0/LxHdr
/bd0/VXI2.hdr
/bd0/vxWorks_prev
/bd0/LxImage_prev
/bd0/LxHdr_prev
/bd0/RTPI.bin
/bd0/RTPI.hdr
/bd0/LXFS.bin
/bd0/LXFS.hdr

--- End code ---

I replaced all files where i had a _prev version of a file:

--- Code: ---file move LxImage LxImage-orig
file move vxWorks vxWorks-orig
file move LxHdr LxHdr-orig
file move hdr hdr-orig

file copy LxImage_prev LxImage
file copy vxWorks_prev vxWorks
file copy LxHdr_prev LxHdr
file copy hdr_prev hdr

--- End code ---

I found out that i could execute .bin files from this directory.
In openocd i did a reset and the device startet vxworks AND linux!

--- Code: ---[vxWorks *]# version
VxWorks (for Marvell Sheeva 88SV584x, Board= Heatwave 1.0 ARMARCHV7 LE core) version 6.8.
Kernel: WIND version 2.13.
Made on Feb  3 2016, 20:45:55.
Boot line:
neta(3,0) f=0x6000 o=usb0:eth3:cpus=1:mem=0x20000000;MAC3-00:50:43:11:89:dd;SER-DRB143602000000 s=#/romfs/runesa.vxe

--- End code ---


--- Code: ---Drobo:/ # uname -a
Linux Drobo 3.2.96-3 #1 SMP Wed Sep 9 12:29:26 UTC 2020 armv7l GNU/Linux

--- End code ---

The downside is, still no network service running. But both shells working and (one) green light on the device.
Both bootlogs are attached.

I searched for older firmware files and found two using the wayback archive (https://web.archive.org/web/20200923005204/https://www.drobo.com/docs/start-drobo-b810i/):

The failed update version was 2.0.1. I found Version

2-0-0 https://web.archive.org/web/20200923005204/https://www.drobo.com/docs/start-drobo-b810i/  and
1-3-5 https://web.archive.org/web/20170716181543/http://files.drobo.com/webrelease/b810i/B810i_Firmware_1-3-5.zip

I was able to load both firmware files and boot with the offset for the first ELF image. The trick did not work with an offset for the second ELF image in the firmware files.




 

JimKnopf:
I compared the md5sum of the files i dumped from the vxworks side with the 3 firmware files:

--- Code: ---Drobo filedump
MD5 4639529020298b3671d3517c10c09522  vxi2.bin =     22c.ELF found in release.B810i.2-0-1.tdf (first ELF image)
MD5 40104317c0dbdd43e84df334dbc1fac6  lximage   = 12231fa.UImage found in release.B810i.2-0-1.tdf
MD5 e0a1c6d97bd614cfaaebed36c619d83e  rtpi.bin = 7578b6.ELF found in release.B810i.2-0-1.tdf (second ELF image)
MD5 1bf5585eb18318837a3d4fd4e6fb90a4  LxHdr = selection_0-22b found in release.B810i.2-0-1.tdf (right before the first ELF image)



drobo_2-0-1_extracted-parts# md5sum * [size in bytes]
+ 40104317c0dbdd43e84df334dbc1fac6  12231fa.UImage 3168928
624b46f91b061795ce641a36f096ed90  1528d16.JFFS2 11858012
+ 4639529020298b3671d3517c10c09522  22c.ELF 7698058
+ e0a1c6d97bd614cfaaebed36c619d83e  7578b6.ELF 11319620
+ 1bf5585eb18318837a3d4fd4e6fb90a4  selection_0-22b 556




drobo_2-0-0_extracted-parts# md5sum * [size in bytes]
ffe68f761c88d77cfed8df5d7619b3c3  11e355c.UImage 3168936
cd4881229a64f702a6e002aa9c3cb51b  14e9080.JFFS2 10330556
66fb7d8f75c09a7e99cf7910bd9da934  22c.ELF 7690876
955691ee15ebedc9f9fc6806c773d522  755ca8.ELF 11065524
497aca92106d4ae411af2e7f63e86e52  selection_0-22b 556


drobo_1-3-5_extracted-parts# md5sum *
cad166fb818c55767df926033faa4ef4  110c4f6.UImage 3750024
8ee2ed4a45a895bbbe6d7d0bedc7f772  149ff4a.JFFS2 25529652
5e96eae5bac03992bbfd82961bb67182  22c.ELF 7569558
d315b81c0eaf33b84a71e7be84638f65  7382c2.ELF 10306100
8be984ce60d9d34284116926b6edffab  selection_0-22b 556



openocd-dump_20231230# md5sum *
7351e5dadd74474690b1f014f3b69570  hdr 556
7351e5dadd74474690b1f014f3b69570  hdr_prev 556
4cabb259c8abf4a5adafe2aa07a982c5  hibhdr 512
+ 1bf5585eb18318837a3d4fd4e6fb90a4  LxHdr 556
+ 1bf5585eb18318837a3d4fd4e6fb90a4  LxHdr_prev         556
+ 40104317c0dbdd43e84df334dbc1fac6  lximage 3168928
+ 40104317c0dbdd43e84df334dbc1fac6  lximage_prev         3168928
+ e0a1c6d97bd614cfaaebed36c619d83e  rtpi.bin 11319620
1bf5585eb18318837a3d4fd4e6fb90a4  RTPI.hdr 556
9e30738c85838a54dea0271fd743bfca  runesa.vxe         10177608
ecfdbaed33efb962865e71d456349683  ubhw.bin 801272
7351e5dadd74474690b1f014f3b69570  UBHW.hdr 556
+ 4639529020298b3671d3517c10c09522  vxi2.bin 7698058
+ 1bf5585eb18318837a3d4fd4e6fb90a4  VXI2.hdr 556
e83b73a0859310cc8705fe1ad3dfb0d8  vxworks         17734472
e83b73a0859310cc8705fe1ad3dfb0d8  vxworks_prev         17734472

--- End code ---

I found LxHdr, LxHdr,_prev, RTPI.hdr, VXI2.hdr are the same files, located at the beginning until 0x22c of the firmware file. VXI2.bin is the first ELF image in the firmware file. The second ELF image in the firmware file is RTPI.bin. The LxImage is the called UImage in the firmware file. The firmware contains one more data block, a JFFS2 part.
I didn't found the vxWorks stuff in the firmware files. I don't know if that part was ever updated.

JimKnopf:
Accessing the files on the internal memory, which is only accessible on the vxworks side is waaaaayyyyyyy easier than i tought. It's not possible transfering data over network to the vxworks side. On Marvell U-boot i only have read access. But, during boot, it enables a internal usb drive. I re-checked the board. And there is a small daughterboard containing two memory chips. It is connected with 2x5 pinheader to the mainboard. One pin was removed.

It looked like an ordinary USB connector like the ones on a Desktop Mainboard. The daughterboard has a product label "Apacer". It turns out its a common SSD. I checked the pins on the pinheader and compared the voltage to a default USB port and it matches. Using a USB-A connector and some flying wires, it was immediately recognized as USB-drive on my Laptop.

I was able to replace VXI2.bin, LxHdr, RTPI.bin and LxImage with the matching sections from firmware file. LxHdr is needed because it contains a checksum for LxImage file (0-22c of firmware file). The firmware release 2-0-0 had same boot problem like the 2-0-1. But the content from firmware release 1-3-5 let the vxworks side boot. At the moment there is an error on the linux side. And still not recognized by Drobo Dashboard.

 

JimKnopf:
I did some tests with u-boot settings and managed to freeze the Bootrom 1.2 because of header checksum mismatch.

To make things easier, i placed the MX25L6406E cmos serial flash outside the board and used flying wires to connect the IC-adapter to the board.

I also replaced the internal USB-SSD temporary with a Pi zero 2w. The advantage is, i don't need to plug/unplug the drive to copy files to the device. Using the pi zero as a usb drive, i can copy files via wifi. I copy files using sftp in linux (or WinSCP in windows).
The 9-pin USB connector (only the 4-pin row is used) has 2mm pitch wide. Default dupont connectors have 2,54mm pitch wide. I crimped flying wires to a JST-HX 4-pin connector.

Burning the cmos serial flash dump brought the device back to life.

Navigation

[0] Message Index

[#] Next page

[*] Previous page

There was an error while thanking
Thanking...
Go to full version
Powered by SMFPacks Advanced Attachments Uploader Mod