Drobo B810i NAS half bricked after failed firmware update

[JimKnopf]

I got a half bricked Drobo B810i NAS here to fix failed firmware update (https://files.drobo.com/webrelease/b810i/B810i_Firmware_2-0-1.zip). Need some help from either U-Boot or openocd heros. Drobo users are welcome. I never had a Drobo in my hands before. I was able to rescue some other devices by just flashing the firmware on eprom via programmer or by using jtag interface. But this Drobo NAS is hard to fix.

Best solution i guess would be a flash memory dump from a working device. If you can provide one, please contact me.

Device behavior:
I can't find the device via Drobo GUI (https://files.drobo.com/webrelease/dashboard/drobodashboardinstaller_3.5.0.exe). Nmap doesn't show any open port. The only info i have is, it failed to start after firmware update.
The device turns on, gets an ip via dhcp but no interaction via network possible from outside.

I opened the device to find two suspicious looking pin headers and 2x10 pin holes. The pin headers are UART serial ports. Both are active at 115200 8N1. To my surprise, one starts a Marvell U-Boot process which loads VxWorks. It stops at some point and the other UART port gets active, showing a linux boot process with a root shell at the end. There are two eprom IC's. I desoldered both and dumped the content.

Both boot logs are attached. The CPU is a Marvell Armada XP Sheeva SoC:

Code: [Select]

         Marvell PJ4B (584) v7 (Rev 2) LE (cat /proc/cpuinfo tells PJ4Bv7 rev 2 (v71)),
Description: SOC ARMADA XP ARM7 732-Pin FCBGA, (Sheeva)
MV78-BJR2
P35V110.1
1528 B0E
MV78460-B0 C120
SoC MV88F7846 Rev 8 / 562f5842
Board DB-78460-BP rev 2.0
Drobo version kyten-uboot-2.33

On the VxWorks UART port i dont have a shell, but i can stop the boot process to enter the u-boot shell with very limited commands. It's not the u-boot main line shell. A log with available commands and a printenv is attached. No ethernet port is available in u-boot. I found some files using fatls and dumped the files:

Code: [Select]

Marvell>> fatls usb 0:1

17734472   vxworks
3168928   lximage
crashlogs/
224   nocrashmsg
0   hiblog
512   hibhdr
48   amitlog
4   bootcount

1024004   eventlog
556   hdr_prev
256   rebootreason
7698058   vxi2.bin
801272   ubhw.bin
556   ubhw.hdr
556   hdr
556   lxhdr
556   vxi2.hdr

17734472   vxworks_prev
3684024   lximage_prev
556   lxhdr_prev
11319620   rtpi.bin
556   rtpi.hdr
31457280   lxfs.bin
556   lxfs.hdr

To dump files on u-boot i used (for example):

Code: [Select]

fatload usb 0:1 20000000 vxworks_prev
md.b 20000000 <size of content in bytes>

On the linux UART port, i can start telnetd and dropbear. But can't login as root. I don't know what secrets are waiting here. Maybe i can rescue the system from here?

The 2x10 pin holes looked like an arm default connector. I added pin headers and hooked my j-link on it with no luck on either jlink or openocd.

I figured out the needed config files for my olimex tiny-h and openocd. The default config let me halt the system but i couldn't reset the cpu.
The config files are attached. Rename it from .txt to cfg if you want to use it.

Code: [Select]

openocd -d1 -f interface//olimex-arm-usb-tiny-h.cfg -f target/armada370.cfg

After figuring out to circumvent the reset problem, i had to learn, that my dumped files had wrong byte order. I first converted the dump using xxd. But it's easier to use "-endian little" in the target config file to fix this.

I read the ARMADA-XP-Functional-SpecDatasheet (https://datasheet.datasheetarchive.com/originals/crawler/marvell.com/002fa441a27967d992f905776d519926.pdf) and found

Code: [Select]

Table 11: MMU Virtual-to-Physical Address Translation Table
Device Physical Address Virtual Address Size Caching
SDRAM 0x0 0x0 1 GB Non-Cachable
L2-SRAM 0x40000000 0x40000000 1 MB Cachable
PCI-Express 0x80000000 0x80000000 640 MB Non-Cachable
CESA SRAM 0xC8000000 0xC8000000 1 MB Non-Cachable
Internal Register 0xD0000000 0xD0000000 1 MB Non-Cachable
NOR Flash 0xD8000000 0xD8000000 128 MM Non-Cachable
SPI Flash 0xD4000000 0xD4000000 64 MB Cachable
Device Bus 0xD3800000 0xD3800000 711 MB Non-Cachable
BootROM 0xFFF00000 0xFFF00000 1 MB Cachable

I dumped the spi flash again, this time via jtag to compare the content:

Code: [Select]

init
reset halt
dump_image B810i-8MB-spi-rom.bin 0xD4000000 0x800000

Since i'm not a programmer or IT specialist in general, working with address and size values is hard to me.
I just used python to calculate the values by just enter it in the python prompt. The MX25L6406E is a 64Mbit SPI flash, providing 8 MB of memory. 8 MB x 2^20 = 8388608 byte decimal. The get the hex value i enter in python prompt:

Code: [Select]

>>> hex(8388608)

And get 0x800000 as result ( I learned, to get the decimal size from a hex value, just use 0x800000 in python. Be aware this works for the size, you have to subtract -1 from this value when you calculate address space because counting starts at 0. 8388608-1 = 8388607 will give you 0x7fffff as end-address).
To better compare the dump i grabbed via jtag, i used hexdump -v for both files, the jtag dump and the programmer dump of the SPI flash and compared them using diff.

I did the same with the 128 MB NOR-flash. Sadly i couldn't find it's content in the firmware file. The firmware-file has .tdf file extension.
Binwalk show me some complex content:

Code: [Select]

binwalk release.B810i.2-0-1.tdf

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
556           0x22C           ELF, 32-bit LSB executable, ARM, version 1 (ARM)
2537455       0x26B7EF        mcrypt 2.2 encrypted data, algorithm: blowfish-448, mode: CBC, keymode: 4bit
3119831       0x2F9AD7        Neighborly text, "NeighborCacheToLivenet.inet.IcmpRatelimitBucketsize"
3129084       0x2FBEFC        Unix path: /home/buildtest/WindRiver_Vx6.8.3/vxworks-6.8/target/config/comps/src/usrMmuInit.c
3201803       0x30DB0B        Copyright string: "Copyright 1995-2005 Jean-loup Gailly "
3209995       0x30FB0B        uuencoded data, file name: "%s", file permissions: "644"
3243227       0x317CDB        Neighborly text, "NeighborCacheToLives does not appear to be attached"
3310242       0x3282A2        LZMA compressed data, properties: 0x64, dictionary size: -2147483648 bytes, uncompressed size: 191 bytes
3377101       0x3387CD        Copyright string: "Copyright Wind River Systems, Inc., 1984-2012"
3453504       0x34B240        VxWorks WIND kernel version "2.13"
3756176       0x395090        StuffIt Deluxe (data): TDList
3756659       0x395273        StuffIt Deluxe (data): TDs
3756766       0x3952DE        StuffIt Deluxe (data): TD
3756919       0x395377        StuffIt Deluxe (data): TDs
3757433       0x395579        StuffIt Deluxe (data): TD
3757537       0x3955E1        StuffIt Deluxe (data): TDData
3887780       0x3B52A4        Intel x86 or x64 microcode, sig 0x013b3d9c, pf_mask 0x1361b7f, 1B79-01-36, rev 0x0001, size 3
5212665       0x4F89F9        Unix path: /home/buildtest/WindRiver_Vx6.8.3/vxworks-6.8/target/config/comps/src/dataSegPad.c
5436987       0x52F63B        PARity archive data - file number 29540
5759546       0x57E23A        Unix path: /home/buildtest/WindRiver_Vx6.8.3/vxworks-6.8/target/config/comps/src/version.c
5875588       0x59A784        PARity archive data - file number 24943
6590393       0x648FB9        Unix path: /home/buildtest/WindRiver_Vx6.8.3/vxworks-6.8/target/h/types
6593974       0x649DB6        Unix path: /home/buildtest/WindRiver_Vx6.8.3/vxworks-6.8/target/h/types
6594607       0x64A02F        Unix path: /home/buildtest/WindRiver_Vx6.8.3/vxworks-6.8/target/h
6604113       0x64C551        Unix path: /home/buildtest/WindRiver_Vx6.8.3/vxworks-6.8/target/h/base
6604527       0x64C6EF        Unix path: /home/buildtest/WindRiver_Vx6.8.3/vxworks-6.8/target/h/base
6606244       0x64CDA4        Unix path: /home/buildtest/WindRiver_Vx6.8.3/vxworks-6.8/target/h/private
6609213       0x64D93D        Unix path: /home/buildtest/WindRiver_Vx6.8.3/vxworks-6.8/target/config/comps/src
6612136       0x64E4A8        Unix path: /home/buildtest/WindRiver_Vx6.8.3/vxworks-6.8/target/h/types/vxWindCommon.h
6614894       0x64EF6E        Unix path: /home/buildtest/WindRiver_Vx6.8.3/vxworks-6.8/target/h/types/vxWindCommon.h
6617233       0x64F891        Unix path: /home/buildtest/WindRiver_Vx6.8.3/vxworks-6.8/target/h/types/vxWindCommon.h
6619091       0x64FFD3        Unix path: /home/buildtest/WindRiver_Vx6.8.3/vxworks-6.8/target/h/stdio.h
6619590       0x6501C6        Unix path: /home/buildtest/WindRiver_Vx6.8.3/vxworks-6.8/target/h/types/vxWindCommon.h
6620819       0x650693        Unix path: /home/buildtest/WindRiver_Vx6.8.3/vxworks-6.8/target/h/types/vxWindCommon.h
6621968       0x650B10        Unix path: /home/buildtest/WindRiver_Vx6.8.3/vxworks-6.8/target/h/shellInterpCmdLib.h
6622200       0x650BF8        Unix path: /home/buildtest/WindRiver_Vx6.8.3/vxworks-6.8/target/h/sysLib.h
6622371       0x650CA3        Unix path: /home/buildtest/WindRiver_Vx6.8.3/vxworks-6.8/target/h/types/vxWindCommon.h
6624233       0x6513E9        Unix path: /home/buildtest/WindRiver_Vx6.8.3/vxworks-6.8/target/h/types/vxWindCommon.h
6626207       0x651B9F        Unix path: /home/buildtest/WindRiver_Vx6.8.3/vxworks-6.8/target/h/types/vxWindCommon.h
6627736       0x652198        Unix path: /home/buildtest/WindRiver_Vx6.8.3/vxworks-6.8/target/h/types/vxWindCommon.h
6628927       0x65263F        Unix path: /home/buildtest/WindRiver_Vx6.8.3/vxworks-6.8/target/h/ctype.h
6629111       0x6526F7        Unix path: /home/buildtest/WindRiver_Vx6.8.3/vxworks-6.8/target/h/types/vxWindCommon.h
6634433       0x653BC1        Unix path: /home/buildtest/WindRiver_Vx6.8.3/vxworks-6.8/target/h/types/vxWindCommon.h
6637208       0x654698        Unix path: /home/buildtest/WindRiver_Vx6.8.3/vxworks-6.8/target/h/types/vxWindCommon.h
6638776       0x654CB8        Unix path: /home/buildtest/WindRiver_Vx6.8.3/vxworks-6.8/target/h/types/vxWindCommon.h
6639712       0x655060        Unix path: /home/buildtest/WindRiver_Vx6.8.3/vxworks-6.8/target/h/types/vxWindCommon.h
6641724       0x65583C        Unix path: /home/buildtest/WindRiver_Vx6.8.3/vxworks-6.8/target/h/types/vxWindCommon.h
6643254       0x655E36        Unix path: /home/buildtest/WindRiver_Vx6.8.3/vxworks-6.8/target/h/types/vxWindCommon.h
6645267       0x656613        Unix path: /home/buildtest/WindRiver_Vx6.8.3/vxworks-6.8/target/h/types/vxWindCommon.h
6646950       0x656CA6        Unix path: /home/buildtest/WindRiver_Vx6.8.3/vxworks-6.8/target/h/types/vxWindCommon.h
6648413       0x65725D        Unix path: /home/buildtest/WindRiver_Vx6.8.3/vxworks-6.8/target/h/types/vxWind.h
6649544       0x6576C8        Unix path: /home/buildtest/WindRiver_Vx6.8.3/vxworks-6.8/target/h/types/vxWindCommon.h
6652174       0x65810E        Unix path: /home/buildtest/WindRiver_Vx6.8.3/vxworks-6.8/target/h/types/vxWindCommon.h
6654945       0x658BE1        Unix path: /home/buildtest/WindRiver_Vx6.8.3/vxworks-6.8/target/h/types/vxWindCommon.h
6658657       0x659A61        Unix path: /home/buildtest/WindRiver_Vx6.8.3/vxworks-6.8/target/h/types/vxWindCommon.h
6660516       0x65A1A4        Unix path: /home/buildtest/WindRiver_Vx6.8.3/vxworks-6.8/target/h/types/vxWindCommon.h
6663594       0x65ADAA        Unix path: /home/buildtest/WindRiver_Vx6.8.3/vxworks-6.8/target/h/types/vxWindCommon.h
6665437       0x65B4DD        Unix path: /home/buildtest/WindRiver_Vx6.8.3/vxworks-6.8/target/h/types/vxWindCommon.h
6666841       0x65BA59        Unix path: /home/buildtest/WindRiver_Vx6.8.3/vxworks-6.8/target/h/types/vxWindCommon.h
6669902       0x65C64E        Unix path: /home/buildtest/WindRiver_Vx6.8.3/vxworks-6.8/target/h/types/vxWindCommon.h
6671719       0x65CD67        Unix path: /home/buildtest/WindRiver_Vx6.8.3/vxworks-6.8/target/h/types/vxWindCommon.h
6677727       0x65E4DF        Unix path: /home/buildtest/WindRiver_Vx6.8.3/vxworks-6.8/target/h/types/vxWindCommon.h
6680176       0x65EE70        Unix path: /home/buildtest/WindRiver_Vx6.8.3/vxworks-6.8/target/h/types/vxWindCommon.h
6682160       0x65F630        Unix path: /home/buildtest/WindRiver_Vx6.8.3/vxworks-6.8/target/h/types/vxWindCommon.h
6684011       0x65FD6B        Unix path: /home/buildtest/WindRiver_Vx6.8.3/vxworks-6.8/target/h/types/vxWindCommon.h
6686322       0x660672        Unix path: /home/buildtest/WindRiver_Vx6.8.3/vxworks-6.8/target/h/types/vxWindCommon.h
6688411       0x660E9B        Unix path: /home/buildtest/WindRiver_Vx6.8.3/vxworks-6.8/target/h/types/vxWindCommon.h
6689449       0x6612A9        Unix path: /home/buildtest/WindRiver_Vx6.8.3/vxworks-6.8/target/h/types/vxWindCommon.h
6691360       0x661A20        Unix path: /home/buildtest/WindRiver_Vx6.8.3/vxworks-6.8/target/h/types/vxWindCommon.h
6692850       0x661FF2        Unix path: /home/buildtest/WindRiver_Vx6.8.3/vxworks-6.8/target/h/types/vxWindCommon.h
7099515       0x6C547B        Intel x86 or x64 microcode, sig 0x171f8000, pf_mask 0xe00, 1C00-01-05, rev 0x1000000, size 1
7105579       0x6C6C2B        Intel x86 or x64 microcode, pf_mask 0x11ff, 1F00-01-12, rev 0x1000000, size 1
7105947       0x6C6D9B        Intel x86 or x64 microcode, sig 0x1850e000, pf_mask 0x1133200, 1B00-01-13, rev 0x1000000, size 112641
7113627       0x6C8B9B        Intel x86 or x64 microcode, pf_mask 0x11ff, 1C00-01-21, rev 0x1000000, size 1
7114059       0x6C8D4B        Intel x86 or x64 microcode, pf_mask 0x11ff, 1A00-01-22, rev 0x1000000, size 1
7114475       0x6C8EEB        Intel x86 or x64 microcode, pf_mask 0x11ff, 1C00-01-23, rev 0x1000000, size 1
7115579       0x6C933B        Intel x86 or x64 microcode, pf_mask 0x11ff, 1900-01-25, rev 0x1000000, size 1
7116683       0x6C978B        Intel x86 or x64 microcode, sig 0x1a59c800, pf_mask 0x1283200, 2000-01-28, rev 0x1000000, size 175105
7231995       0x6E59FB        Intel x86 or x64 microcode, sig 0x270cf000, pf_mask 0x2042900, 1C00-02-04, rev 0x1001200, size 69633
7234923       0x6E656B        Intel x86 or x64 microcode, sig 0x0b197800, pf_mask 0x2112f00, 1A00-02-11, rev 0x1001200, size 1025
7481721       0x722979        StuffIt Deluxe (data): TD
7481737       0x722989        StuffIt Deluxe (data): TD
7481777       0x7229B1        StuffIt Deluxe (data): TD
7481829       0x7229E5        StuffIt Deluxe (data): TD
7520182       0x72BFB6        StuffIt Deluxe (data): TD
7548080       0x732CB0        StuffIt Deluxe (data): TD
7586280       0x73C1E8        StuffIt Deluxe (data): TDList
7598715       0x73F27B        StuffIt Deluxe (data): TDData
7672522       0x7512CA        StuffIt Deluxe (data): TDs
7693403       0x75645B        StuffIt Deluxe (data): TDs
7698614       0x7578B6        ELF, 32-bit LSB executable, ARM, version 1 (ARM)
13807918      0xD2B12E        Ubiquiti firmware additional data, name: UTED, size: 1634159721 bytes, size2: 1937001583 bytes, CRC32: 0
14211981      0xD8DB8D        Copyright string: "Copyright 1995-2005 Jean-loup Gailly "
14218058      0xD8F34A        CRC32 polynomial table, little endian
14222154      0xD9034A        CRC32 polynomial table, big endian
14228929      0xD91DC1        Copyright string: "Copyright 1995-2005 Mark Adler "
14785144      0xE19A78        Intel x86 or x64 microcode, sig 0x7c6c0000, pf_mask 0x904802c0, 1901-04-28, rev 0x-10000, size 4
15035498      0xE56C6A        Copyright string: "Copyright (c) 1992-2002 by P.J. Plauger, licensed by Dinkumware, Ltd. ALL RIGHTS RESERVED."
15037214      0xE5731E        Copyright string: "Copyright (c) 1992-2002 by P.J. Plauger, licensed by Dinkumware, Ltd. ALL RIGHTS RESERVED."
18825010      0x11F3F32       Private key in DER format (PKCS header length: 4, sequence length: 25856
19018234      0x12231FA       uImage header, header size: 64 bytes, header CRC: 0xE53864B7, created: 2020-09-09 12:29:44, image size: 3168864 bytes, Data Address: 0x20008000, Entry Point: 0x20008000, data CRC: 0xE3EC93A1, OS: Linux, CPU: ARM, image type: OS Kernel Image, compression type: none, image name: "Linux-3.2.96-3"
19018298      0x122323A       Linux kernel ARM boot executable zImage (little-endian)
19036286      0x122787E       gzip compressed data, maximum compression, from Unix, last modified: 1970-01-01 00:00:00 (null date)
22187162      0x1528C9A       JFFS2 filesystem, little endian

My intention at the beginning was, just flash the firmware file. But it seems some magic is needed. 
@tv84
@DavidAlfa
Any hint how to move forward?
Any help is welcome.

[fzabkar]

Could you upload your two flash dumps?

[JimKnopf]

Uploading here might be a problem. But i can send you a PM with a wetransfer link.

[fzabkar]

Uploading here might be a problem. But i can send you a PM with a wetransfer link.

OK, as long as I don't have to sign up for anything.

[fzabkar]

These are my initial observations:

This is the header of the TDF payload (0x22C bytes):

Code: [Select]

Offset(h) 00       04       08       0C       10       14

00000000  0000022C 00000005 54444948 002BC66B 48656174 77617665  ........TDIH....Heatwave
          ^^^^^^^^
size of header = 0x22C

00000018  00000000 00000000 00000000 00000000 00000000 03328A6E  ........................
                                                       ^^^^^^^^
                   size of payload, excluding header = 0x3328A6E

00000030  A6D95511 44617461 20526F62 6F746963 73204669 726D7761  ....Data Robotics Firmwa
00000048  72650000 00000000 00000000 00000000 00000000 00000000  re......................
00000060  00000000 00000000 00000000 00000000 00000000 00000000
........
00000108  00000000 00000000 00000000 00000000 00000000 00000000
00000120  00000000 00000000 00000000 00000000 00000000 6134BF8B
00000138  BD413911 00000000 00000000 00000000 00000000 00000000
00000150  00000000 00000000 0000002B 0001C66B 00000000 00000001
00000168  00000004 56584932 00000000 0075768A 00000000 002BC66B  ....VXI2................
          ^^^^^^^^ ======== -------- ++++++++
total modules = 4   name     offset   size = 0x75768A

00000180  BF5B9A0A 52545049 0075768A 00ACB944 00000000 002BC66B  ....RTPI................
00000198  9EDB53BD 4C584B49 01222FCE 00305AA0 00000000 002BC66B  ....LXKI................
000001B0  AF700117 4C584653 01528A6E 01E00000 00000000 002BC66B  ....LXFS................
000001C8  8342D28C 00000000 00000000 00000000 00000000 00000000
000001E0  00000000 00000000 00000000 00000000 00000000 00000000
000001F8  00000000 00000000 00000000 00000000 00000000 00000000
00000210  00000000 00000000 00000000 00000000 00000000 00000000
00000228  00000000
The payload contains 4 modules (VXI2, RTPI, LXKI, LXFS).

The offset is relative to the end of the header (add 0x22C to obtain absolute offset).

Each module has a CRC-32 checksum (Ethernet and PKZIP algorithm). I have verified all CRCs with HxD (freeware hex editor).

Code: [Select]

name      offset   size      ????     ????    CRC-32   name
-------- -------- -------- -------- -------- --------  ----
56584932 00000000 0075768A 00000000 002BC66B BF5B9A0A  VXI2  - verified OK -- 0x22C -- ELF, 32-bit LSB executable, ARM, version 1 (ARM)
52545049 0075768A 00ACB944 00000000 002BC66B 9EDB53BD  RTPI  - verified OK -- 0x7578B6 -- ELF, 32-bit LSB executable, ARM, version 1 (ARM)
4C584B49 01222FCE 00305AA0 00000000 002BC66B AF700117  LXKI  - verified OK -- 0x12231FA -- Linux kernel
4C584653 01528A6E 01E00000 00000000 002BC66B 8342D28C  LXFS  - verified OK -- 0x1528C9A -- JFFS2 filesystem, little endian

[JimKnopf]

@fzabkar What tools do you use for analysing the code? I usually use binwalk/hexdump/xxd and imhex for bin files. But i couldn't follow your findings.

Opening the file with Malcat (first time i use this tool) showed me closer view to your findings.

[JimKnopf]

@fzabkar As you can see in my prevoius post, the firmware file has two ELF files inside.
I inspected the 3 MB UImage from firmware file. It matches exactly to the lximage file i dumped via UART serial console from the Drobo device.

For the sake of completeness, here are the commands i used for dumping and post-processing the dump. To connect to the Drobo device i used cheap CP2102 UART to serial TTL adapters, using TX, RX, GND connection. I started minicom with logging option (-l lximage.cap in this case).

Code: [Select]

minicom -D /dev/ttyUSB1 -b 115200 -C lximage.cap

I did that for each file i dumped to have a logfile for each file.
Starting the Drobo device, i saw the log text flowing.
After stopping the boot process and entering the Marvell U-Boot shell i checked files:

Code: [Select]

fatls usb 0:1.

Then i loaded a file into memory:

Code: [Select]

fatload usb 0:1 20000000 lximage

I then displayed the memory from the position til file size end (in bytes):

Code: [Select]

md.b 20000000 3168928
This process can take seconds, minutes or hours and hours, depends on filesize, just be patient and wait. If it's done, just hit "Shift+A L" to close the log file. Hit "Shift+A Q" to exit minicom.

The new logfile contains data from the file dump, commands entered in minicom and information from boot process. This unneccessary data has to be removed from the logfile. The file looks like this:

Code: [Select]

md.b 0x20000000 3836b8^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H                      ^H^H^H^H^H^H^H^H^H^H^H^H^H^    H^H^H^H^H^H^H^H^Hfatload usb 0:1 20000000 lximage_prev^H ^H^H ^H^H ^H^H ^H^H ^H
reading lximage
.
...    ...    ..............................................................................

3168928 bytes read
Marvell>> fatload usb 0:1 20000000 lximage^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H                                    ^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^Hmd.b 0x20000000 3836b8^H ^H^    H ^H^H ^H^H ^H^H ^H^H ^H305aa0
 20000000: 27 05 19 56 e5 38 64 b7 5f 58 ca b8 00 30 5a 60    '..V.8d._X...0Z`
 20000010: 20 00 80 00 20 00 80 00 e3 ec 93 a1 05 02 02 00     ... ...........
 20000020: 4c 69 6e 75 78 2d 33 2e 32 2e 39 36 2d 33 00 00    Linux-3.2.96-3..
 *
 *
 *
 20305a70: 00 00 00 00 26 5a 30 00 74 5a 30 00 44 46 00 00    ....&Z0.tZ0.DF..
 20305a80: 70 5a 30 00 60 5a 30 00 e0 08 00 00 68 5a 30 00    pZ0.`Z0.....hZ0.
 20305a90: 6c 5a 30 00 64 5a 30 00 00 00 00 00 00 00 00 00    lZ0.dZ0.........
 Marvell>>

I used vim to clean the file. In vim, i deleted single lines by double hit d (dd) to delete stuff on top of the file until i reached the first line with address information. In this case until

Code: [Select]

20000000: 27 05 19 56 e5 38 64 b7 5f 58 ca b8 00 30 5a 60    '..V.8d._X...0Z`
I hit :$ to reach the end of the file and delete the last line with Marvell>> prompt. Save and exit files in vim with :wq!
Now the log file contains only data from the dump. But it's in hex format. To convert the hex file to binary format i used:

Code: [Select]

xxd -r -seek -0x20000000 lximage.cap lximage

Thats all. Filesize and checksum matches to the file on the Drobo devices.


The firmware file has 2 ELF images inside. None of the images matches to the vxworks or vxworks_prev file on the Drobo device. I assume, the update process failed after the lximage file was extracted and saved on the the Drobo device while the vxworks file was not extracted. I assume that because the lximage_prev is a different file, most probably the lximage used before the firmware update.

The vxworks and vxworks_prev does not match to the content from firmware file. 

[fzabkar]

That's some really nice work! For my part, I just used a hex editor to visually examine the update file, and I used your binwalk dump to identify the functions of the 4 components. I doubt that you will find any tool to analyse the headers, as these are unique to each update package.

[JimKnopf]

I found this set of quite very long videos about Drobo bootloader repair https://www.youtube.com/watch?v=G47tneORZOA. There are several usefull videos from this person, up to 9 hours long.

Maybe i'm on the right track with the vxwork image that was not updated during firmware update. The reason that i couldn't find content from  SPI flash in the firmware file might be that the SPI flash was also not updated. The firmware seems to have some content for updating SPI flash. I did a:

Code: [Select]

hexdump -C release.B810i.2-0-1.tdf|grep -A 15 -B 15 BurnBootrom


Code: [Select]

002e1690  44 52 41 4d 20 63 61 6c  63 75 6c 61 74 65 64 20  |DRAM calculated |
002e16a0  45 43 43 20 30 78 25 30  32 78 0a 00 53 75 6e 64  |ECC 0x%02x..Sund|
002e16b0  61 79 00 00 4d 6f 6e 64  61 79 00 00 54 75 65 73  |ay..Monday..Tues|
002e16c0  64 61 79 00 57 65 64 6e  65 73 64 61 79 00 00 00  |day.Wednesday...|
002e16d0  54 68 75 72 73 64 61 79  00 00 00 00 46 72 69 64  |Thursday....Frid|
002e16e0  61 79 00 00 53 61 74 75  72 64 61 79 00 00 00 00  |ay..Saturday....|
002e16f0  00 00 00 00 1f 00 00 00  3b 00 00 00 5a 00 00 00  |........;...Z...|
002e1700  78 00 00 00 97 00 00 00  b5 00 00 00 d4 00 00 00  |x...............|
002e1710  f3 00 00 00 11 01 00 00  30 01 00 00 4e 01 00 00  |........0...N...|
002e1720  57 61 72 6e 69 6e 67 3a  20 63 65 6e 74 75 72 79  |Warning: century|
002e1730  20 63 61 6e 6e 6f 74 20  62 65 20 73 65 74 28 61  | cannot be set(a|
002e1740  6c 77 61 79 73 20 25 64  29 20 0a 00 47 65 74 20  |lways %d) ..Get |
002e1750  44 41 54 45 3a 20 25 34  64 2d 25 30 32 64 2d 25  |DATE: %4d-%02d-%|
002e1760  30 32 64 20 28 25 73 29  20 20 54 49 4d 45 3a 20  |02d (%s)  TIME: |
002e1770  25 32 64 3a 25 30 32 64  3a 25 30 32 64 0a 00 00  |%2d:%02d:%02d...|
002e1780  0a 0a 42 75 72 6e 42 6f  6f 74 72 6f 6d 3a 20 45  |..[b]BurnBootrom[/b]: E|
002e1790  72 72 6f 72 20 64 65 66  61 75 6c 74 20 66 6c 61  |rror default fla|
002e17a0  73 68 20 61 64 64 72 65  73 73 20 69 73 20 30 21  |sh address is 0!|
002e17b0  21 21 0a 00 20 20 20 20  20 20 20 20 20 20 20 20  |!!..            |
002e17c0  20 55 73 65 3a 20 77 20  78 78 78 78 20 77 68 65  | Use: w xxxx whe|
002e17d0  6e 20 78 78 78 78 20 69  73 20 66 6c 61 73 68 20  |n xxxx is flash |
002e17e0  61 64 64 72 65 73 73 0a  00 00 00 00 20 20 20 20  |address.....    |
002e17f0  20 20 20 20 20 20 20 20  20 55 73 65 3a 20 42 75  |         Use: Bu|
002e1800  72 6e 42 6f 6f 74 72 6f  6d 20 62 6f 6f 74 72 6f  |rnBootrom bootro|
002e1810  6d 2e 62 69 6e 2c 20 78  78 78 78 20 77 68 65 6e  |m.bin, xxxx when|
002e1820  20 78 78 78 78 20 69 73  20 66 6c 61 73 68 20 61  | xxxx is flash a|
002e1830  64 64 72 65 73 73 0a 00  75 73 72 4e 65 74 77 6f  |ddress..usrNetwo|
002e1840  72 6b 49 6e 69 74 20 72  65 74 75 72 6e 20 65 72  |rkInit return er|
002e1850  72 6f 72 0a 00 00 00 00  42 75 72 6e 42 6f 6f 74  |ror.....BurnBoot|
002e1860  72 6f 6d 20 28 25 73 2c  25 78 29 0a 00 00 00 00  |rom (%s,%x).....|
002e1870  00 00 00 00 52 45 54 52  20 25 73 00 66 74 70 58  |....RETR %s.ftpX|
--
00368ec0  69 74 69 6f 6e 00 00 00  41 6d 49 43 50 55 00 00  |ition...AmICPU..|
00368ed0  41 6d 69 74 45 72 72 6f  72 49 6e 6a 65 63 74 00  |AmitErrorInject.|
00368ee0  41 72 6d 61 64 61 58 70  44 65 62 75 67 00 00 00  |ArmadaXpDebug...|
00368ef0  42 4c 5f 43 6f 70 79 00  42 53 50 5f 42 6f 6f 74  |BL_Copy.BSP_Boot|
00368f00  65 64 57 69 74 68 42 61  74 74 65 72 79 4f 6e 00  |edWithBatteryOn.|
00368f10  42 53 50 5f 43 70 75 43  6f 72 65 54 65 6d 70 52  |BSP_CpuCoreTempR|
00368f20  65 67 52 65 61 64 5f 45  72 72 61 74 61 00 00 00  |egRead_Errata...|
00368f30  42 53 50 5f 43 70 75 43  6f 72 65 54 65 6d 70 52  |BSP_CpuCoreTempR|
00368f40  65 67 52 65 61 64 5f 4d  69 73 6d 61 74 63 68 43  |egRead_MismatchC|
00368f50  6f 75 6e 74 00 00 00 00  42 53 50 5f 43 70 75 43  |ount....BSP_CpuC|
00368f60  6f 72 65 54 65 6d 70 52  65 67 52 65 61 64 5f 4d  |oreTempRegRead_M|
00368f70  69 73 6d 61 74 63 68 54  6f 6c 65 72 61 6e 63 65  |ismatchTolerance|
00368f80  00 00 00 00 42 73 70 4d  6f 6f 64 4c 69 73 74 00  |....BspMoodList.|
00368f90  42 73 70 4d 6f 6f 64 4c  69 73 74 53 69 7a 65 00  |BspMoodListSize.|
00368fa0  42 75 66 66 65 72 50 61  67 65 43 72 6f 73 73 00  |BufferPageCross.|
00368fb0  42 75 72 6e 42 6f 6f 74  72 6f 6d 00 43 52 43 54  |[b]BurnBootrom[/b].CRCT|
00368fc0  61 62 6c 65 00 00 00 00  43 6f 70 79 41 6c 6c 53  |able....CopyAllS|
00368fd0  44 52 65 67 69 6f 6e 46  72 6f 6d 50 61 72 74 69  |DRegionFromParti|
00368fe0  74 69 6f 6e 53 63 68 65  6d 65 00 00 43 6f 70 79  |tionScheme..Copy|
00368ff0  53 44 52 65 67 69 6f 6e  46 72 6f 6d 50 61 72 74  |SDRegionFromPart|
00369000  69 74 69 6f 6e 00 00 00  43 72 65 61 74 65 44 61  |ition...CreateDa|
00369010  74 61 46 61 73 74 50 61  74 68 53 65 6d 61 70 68  |taFastPathSemaph|
00369020  6f 72 65 73 41 6e 64 4e  61 74 69 76 65 51 75 65  |oresAndNativeQue|
00369030  75 65 73 00 43 72 65 61  74 65 53 68 61 72 65 64  |ues.CreateShared|
00369040  52 65 67 69 6f 6e 53 65  6d 61 70 68 6f 72 65 00  |RegionSemaphore.|
00369050  44 52 49 46 6c 61 73 68  4c 6f 63 6b 00 00 00 00  |DRIFlashLock....|
00369060  44 52 49 46 6c 61 73 68  55 6e 6c 6f 63 6b 00 00  |DRIFlashUnlock..|
00369070  44 61 79 4e 61 6d 65 00  44 69 73 6b 44 65 74 65  |DayName.DiskDete|
00369080  63 74 53 63 00 00 00 00  44 69 73 6b 49 4f 43 6f  |ctSc....DiskIOCo|
00369090  6d 70 6c 65 74 65 51 00  44 69 73 74 77 77 62 00  |mpleteQ.Distwwb.|
003690a0  44 72 69 42 69 6e 64 54  68 69 73 54 68 72 65 61  |DriBindThisThrea|


I used binwalk to extract content from firmware file and got some files, one with jffs2 extension.
I mounted this file:

Code: [Select]

modprobe mtdram total_size=30720 erase_size=128
modprobe mtdblock
mkdir /media/mtdtmp
dd if=1528C9A.jffs2 of=/dev/mtdblock0
mount -t jffs2 /dev/mtdblock0 /media/mtdtmp

The total_size value is in kb (du -sk 1528C9A.jffs2)
The files are the same i have on the Drobo-linux shell.

I found an interesting command on this linux shell called esa.
It seems it interacts with the vxworks side.

Code: [Select]

Drobo:/ # esa help
Commands defined:
apropos :              Displays all commands with the search term in their name or description
clearKnownHostList :   clear the list of known hosts
crash :                Crash the iSCSI target code
cthreads :             Create threads
dashboard :            on|off - Turn dashboard connections on or off
discAgentDebug :       diskAgentDebug [ on | off ] to enable or disable discovery agent output
discAgentDebug2 :      diskAgentDebug2 [ on | off ] to enable or disable additional discovery agent output
dmesg :                print system log
dropReads :            dropReads [ on | off [all]] to enable or disable dropping 64K+/all reads
dropWrites :           dropWrites [ on | off ] to enable or disable dropping write commands (WRITE6/10/16 and ATS)
dumpEMPDList :         show the list of hosts with EMP connections
dumpKnownHostList :    show the list of known hosts
dumpWaitingHostList :  show the list of waiting hosts
EMPDDebug :            EMPDDebug [ on | off ] to enable or disable console output
exit :                 Kill the iSCSI target subsystem
fault :                Create a deliberate segfault
help :                 Displays all commands registered with the ConsoleCommand class along with their description
hlba :                 turn hlba list debug on/off/list
hostlog :              Displays the host-side command and response logs
ipAddressUpdated :     ipAddressUpdated to force IP address information to be resent to known Dashboards
lunReset :             lunReset <LUN>
perf :                 perf [reset]
perflog :              Issue 'state' or 'perf' or 'perf reset' or 'pause' or 'resume' PerfLog command
print :                print [ on | off ] to enable or disable console output
qa :                   Displays all commands registered with the ConsoleCommand class for use by QA, along with their description
rescanj1 :             Rescan the J1 free lists
reservations :         reservations [ take | release ] to show reservations, take one, or release one we took
resetSpliceCount :     reset counts of splice statistics
skipConsoleOutput :    skipConsoleOutput [ on | off ]
spliceCount :          print number of splice calls
state :                Displays all classes' state (or help to show subcommands)
testdynallocator :     testdynallocator
threads :              List the threads that have been created
toggleSpliceTrace :    toggle verbose splice tracing
version :              Display the version & build information
zeroReadDebug :        zeroReadDebug [ on | off ]
End of command list


Code: [Select]

Drobo:/ # Drobo:/ # esa dmesg
Drobo:/ # [    0.000000] Booting Linux on physical CPU 1
[    0.000000] Linux version 3.2.96-3 (drobo@7e4315534594) (gcc version 6.4.0 (GCC) ) #1 SMP Wed Sep 9 12:29:26 UTC 2020
[    0.000000] CPU: Marvell PJ4Bv7 Processor [562f5842] revision 2 (ARMv7), cr=10c53c7d
[    0.000000] CPU: PIPT / VIPT nonaliasing data cache, PIPT instruction cache
[    0.000000] Machine: Marvell Armada XP Development Board
[    0.000000] Using UBoot passing parameters structure
[    0.000000] bootconsole [earlycon0] enabled
[    0.000000] memblock_add_region memory start 0x20000000  size 0x58200000
[    0.000000] memblock_add_region memory start 0x78200000  size 0x7e00000
[    0.000000] memblock_add_region reserved start 0x53000000  size 0x29000000
[    0.000000] memblock_add_region reserved start 0x200081c0  size 0x6e26b4
[    0.000000] memblock_add_region reserved start 0x20004000  size 0x4000
[    0.000000] Memory policy: ECC disabled, Data cache writealloc
[    0.000000] memblock_add_region reserved start 0x52ffc000  size 0x4000
[    0.000000] memblock_add_region reserved start 0x52ff8000  size 0x4000
[    0.000000] memblock_add_region reserved start 0x52ff4000  size 0x4000
[    0.000000] memblock_add_region reserved start 0x52ff0000  size 0x4000
[    0.000000] memblock_add_region reserved start 0x52fec000  size 0x4000
[    0.000000] memblock_add_region reserved start 0x52fe8000  size 0x4000
[    0.000000] memblock_add_region reserved start 0x52fe4000  size 0x4000
[    0.000000] On node 0 totalpages: 98304
[    0.000000] free_area_init_node: node 0, pgdat 8064f800, node_mem_map 806ec000
[    0.000000]   DMA zone: 177 pages used for memmap
[    0.000000]   DMA zone: 0 pages reserved
[    0.000000]   DMA zone: 90063 pages, LIFO batch:7
[    0.000000]   HighMem zone: 16 pages used for memmap
[    0.000000]   HighMem zone: 8048 pages, LIFO batch:0
[    0.000000] SMP: init cpus
[    0.000000] PERCPU: Embedded 3 pages/cpu @809f8000 s22144 r8192 d18816 u49152
[    0.000000] pcpu-alloc: s22144 r8192 d18816 u49152 alloc=3*16384
[    0.000000] pcpu-alloc: [0] 0 [0] 1 [0] 2 [0] 3
[    0.000000] Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 98111
[    0.000000] Kernel command line: rootfstype=jffs2 root=/dev/mtdblock2 rw mtdparts=cfi_flash_0:1m@0m(nor_hdr),3m@1m(var),30m@4m(rfs0),30m@34m(rfs1),32m@64m(rfs2),32m@96m(rfs3) mv_cpu_count=3 mv_rsrc=uart1:eth0:eth1:eth2:spi:mstr mv_sh_mem=0x80000000:0x100000 mv_ipc=0 vmalloc=550M console=ttyS0,115200 earlyprintk=ttyS0,1152000 pm_level=off
[    0.000000] PID hash table entries: 4096 (order: 0, 16384 bytes)
[    0.000000] Dentry cache hash table entries: 262144 (order: 6, 1048576 bytes)
[    0.000000] Inode-cache hash table entries: 131072 (order: 5, 524288 bytes)
[    0.000000] Memory: 1536MB = 1536MB total
[    0.000000] Memory: 889072k/889072k available, 683792k reserved, 65536K highmem
[    0.000000] Virtual kernel memory layout:
[    0.000000]     vector  : 0xffff0000 - 0xffff4000   (  16 kB)
[    0.000000]     fixmap  : 0xffc00000 - 0xfff00000   (3072 kB)
[    0.000000]     vmalloc : 0xd8800000 - 0xfa800000   ( 544 MB)
[    0.000000]     lowmem  : 0x80000000 - 0xd8200000   (1410 MB)
[    0.000000]     pkmap   : 0x7fe00000 - 0x80000000   (   2 MB)
[    0.000000]     modules : 0x7f000000 - 0x7fe00000   (  14 MB)
[    0.000000]       .text : 0x80008000 - 0x805e4000   (6000 kB)
[    0.000000]       .init : 0x805e4000 - 0x80619680   ( 214 kB)
[    0.000000]       .data : 0x8061a000 - 0x80651d68   ( 224 kB)
[    0.000000]        .bss : 0x80651d8c - 0x806ea874   ( 611 kB)
[    0.000000] Hierarchical RCU implementation.
[    0.000000] NR_IRQS:211
[    0.000000] Initializing ArmadaXP SOC Timer 3
[    0.000000] sched_clock: 32 bits at 25MHz, resolution 40ns, wraps every 171798ms
[    0.000175] Calibrating delay loop... 1196.85 BogoMIPS (lpj=5984256)
[    0.092926] pid_max: default: 32768 minimum: 301
[    0.097739] Security Framework initialized
[    0.101926] SELinux:  Initializing.
[    0.105505] SELinux:  Starting in permissive mode
[    0.105562] Mount-cache hash table entries: 2048
[    0.110731] CPU: Testing write buffer coherency: ok
[    0.115806] CPU0: thread -1, cpu 1, socket 0, mpidr 80000001
[    0.121542] SMP: prepare CPUs (3 cores)
[    0.125799] Setting Clocks for secondary CPUs
[    0.131102] SMP: CPU 1 Waking up CPU 2
[    0.149031] CPU1: Booted secondary processor
[    0.180055] CPU1: thread -1, cpu 2, socket 0, mpidr 80000002
[    0.180423] SMP: CPU 1 Waking up CPU 3
[    0.211697] CPU2: Booted secondary processor
[    0.250055] CPU2: thread -1, cpu 3, socket 0, mpidr 80000003
[    0.250174] Brought up 3 CPUs
[    0.263268] SMP: Total of 3 processors activated (3590.55 BogoMIPS).
[    0.270345] devtmpfs: initialized
[    0.277267] xor: measuring software checksum speed
[    0.330056]    arm4regs  :  1160.000 MB/sec
[    0.380051]    8regs     :   708.800 MB/sec
[    0.430048]    32regs    :   996.800 MB/sec
[    0.434298] xor: using function: arm4regs (1160.000 MB/sec)
[    0.440071] NET: Registered protocol family 16
[    0.445092] Aurora: Working in ARMv7 mode
[    0.449168] L0 cache Enabled
[    0.452129] Speculative Prefetch Disabled
[    0.456211] Support IO coherency.
[    0.464603] Skipping MPP configuration and GPIO interrupt enabling.
[    0.488938] Skipping serdes configuration.
[    0.593108] Warning: AMP Address decode windows reg != 0
[    0.601278] Initialized Address decode windows
[    0.605904]
[    0.607473]   Marvell Armada-XP DB-78460-BP rev 2.0 Board -  Soc: MV78460 B0 LE
[    0.614881]   Detected Tclk 250000000, SysClk 600000000, FabricClk 600000000, PClk 1200000000
[    0.623460]   LSP version: linux-3.2.58-2014_T2.0p2 (16KB SW Page Size)
[    0.630133]   AMP: Resources - uart1 - eth0 - eth1 - eth2 - spi - mstr
[    0.636872]
[    0.638552] Register platform device: mv_neta_port_0
[    0.643690] Register platform device: mv_neta_port_1
[    0.648814] Register platform device: mv_neta_port_2
[    0.662422] bio: create slab <bio-0> at 0
[    0.830177] raid6: int32x1    400 MB/s
[    1.000111] raid6: int32x2    371 MB/s
[    1.170147] raid6: int32x4    330 MB/s
[    1.340035] raid6: int32x8    323 MB/s
[    1.343853] raid6: using algorithm int32x1 (400 MB/s)
[    1.349545] SCSI subsystem initialized
[    1.354293] Switching to clocksource axp_clocksource
[    1.371146] NET: Registered protocol family 2
[    1.380841] IP route cache hash table entries: 16384 (order: 2, 65536 bytes)
[    1.388231] TCP established hash table entries: 65536 (order: 5, 524288 bytes)
[    1.396063] TCP bind hash table entries: 65536 (order: 5, 524288 bytes)
[    1.403199] TCP: Hash tables configured (established 65536 bind 65536)
[    1.409795] TCP reno registered
[    1.413012] UDP hash table entries: 1024 (order: 1, 32768 bytes)
[    1.419131] UDP-Lite hash table entries: 1024 (order: 1, 32768 bytes)
[    1.425860] NET: Registered protocol family 1
[    1.430505] RPC: Registered named UNIX socket transport module.
[    1.436485] RPC: Registered udp transport module.
[    1.441276] RPC: Registered tcp transport module.
[    1.446045] RPC: Registered tcp NFSv4.1 backchannel transport module.
[    1.452555] PCI: CLS 0 bytes, default 64
[    1.453107]   o 3 Giga ports supported
[    1.456925]   o NETA acceleration mode 1
[    1.460928]   o RX Queue support: 8 Queues * 128 Descriptors
[    1.466647]   o TX Queue support: 8 Queues * 532 Descriptors
[    1.472372]   o GSO supported
[    1.475410]   o GRO supported
[    1.478447]   o Receive checksum offload supported
[    1.483307]   o Transmit checksum offload supported
[    1.488246]   o Driver ERROR statistics enabled
[    1.492845]
[    1.494480] port #0: is_sgmii=1, is_rgmii=1, phy_addr=16
[    1.500071]   o Loading network interface(s) for port #0: cpu_mask=0xf, tx_csum_limit=9800
[    1.508410]
[    1.509990]   o Port 0 is connected to Linux netdevice
[    1.516839]     o eth0, ifindex = 2, GbE port = 0
[    1.525048] giga p=0: mtu=1500, mac=00:50:43:89:11:17 (platform)
[    1.531214]
[    1.532800] port #1: is_sgmii=1, is_rgmii=1, phy_addr=17
[    1.538371]   o Loading network interface(s) for port #1: cpu_mask=0xf, tx_csum_limit=9800
[    1.546713]
[    1.548283]   o Port 1 is connected to Linux netdevice
[    1.555188]     o eth1, ifindex = 3, GbE port = 1
[    1.563402] giga p=1: mtu=1500, mac=00:50:43:dd:11:17 (platform)
[    1.569567]
[    1.571153] port #2: is_sgmii=1, is_rgmii=1, phy_addr=18
[    1.576725]   o Loading network interface(s) for port #2: cpu_mask=0xf, tx_csum_limit=9800
[    1.585067]
[    1.586636]   o Port 2 is connected to Linux netdevice
[    1.593561]     o eth2, ifindex = 4, GbE port = 2
[    1.601775] giga p=2: mtu=1500, mac=00:50:43:dd:89:17 (platform)
[    1.607931]
[    1.610478] audit: initializing netlink socket (disabled)
[    1.615960] type=2000 audit(1.600:1): initialized
[    1.679076] highmem bounce pool size: 64 pages
[    1.684595] JFFS2 version 2.2. (NAND) Â 2001-2006 Red Hat, Inc.
[    1.691058] aufs 3.2-20131104
[    1.694107] msgmni has been set to 1608
[    1.698115] SELinux:  Registering netfilter hooks
[    1.699020] async_tx: api initialized (async)
[    1.703469] io scheduler noop registered
[    1.707460] io scheduler deadline registered (default)
[    1.712724] io scheduler cfq registered
[    1.721748] Serial: 8250/16550 driver, 2 ports, IRQ sharing disabled
[    1.728814] serial8250.0: ttyS0 at MMIO 0xd0012100 (irq = 42) is a 16550A
[    1.735691] console [ttyS0] enabled, bootconsole disabled
[    1.747020] shared_mem: kernel panic notifier registered
[    1.752362] shared_mem: kernel panic dumper registered
[    1.757530] SHARED_MEM: mapping shared memory Header physical addr 7bffc000 virtual addr 0xd8868000
[    1.766612] SHARED_MEM: INIT: Shared Memory Header in Kernel space at Addr: 0xd8868000
[    1.774574] shared_mem: shm_doorbell_init: IRQ 0x1 requested, doorbell mask 2197c queue_os_info b1768de0
[    1.784100] shared_mem: shared_mem_module_init: Location of shm_dev: b1768dc0
[    1.791265] shared_mem: shared_mem_module_init: Intercore message checksum is enabled
[    1.799509] brd: module loaded
[    1.803369] loop: module loaded
[    1.807667]
[    1.807670] INFO: Found cfi_flash_0 0 - base 0xd8000000, size 0x8000000, bus 2
[    1.816243] INFO: flashInfoFill - Found 1 Flash Devices
[    1.821502] INFO: flash_map_init - detected 1 devices
[    1.826753] MTD: Initialize the cfi_flash_0 device at address 0xd8000000
[    1.834489]
[    1.834491] INFO: Io remapped successfully - phy addr = 0xd8000000, virt addr = 0xd9000000
[    1.844111] INFO: Using cfi_probe to probe cfi_flash_0 at address 0xd8000000, size 0x8000000, width 2m
[    1.853532] cfi_flash_0: Found 1 x16 devices at 0x0 in 16-bit bank. Manufacturer ID 0x000001 Chip ID 0x002801
[    1.863677] Amd/Fujitsu Extended Query Table at 0x0040
[    1.868840]   Amd/Fujitsu Extended Query version 1.5.
[    1.873918] number of CFI chips: 1
[    1.877331]  - detected OK
[    1.879898] 6 cmdlinepart partitions found on MTD device cfi_flash_0
[    1.886455] Creating 6 MTD partitions on "cfi_flash_0":
[    1.891706] 0x000000000000-0x000000100000 : "nor_hdr"
[    1.897676] 0x000000100000-0x000000400000 : "var"
[    1.903232] 0x000000400000-0x000002200000 : "rfs0"
[    1.908862] 0x000002200000-0x000004000000 : "rfs1"
[    1.914532] 0x000004000000-0x000006000000 : "rfs2"
[    1.920199] 0x000006000000-0x000008000000 : "rfs3"
[    1.925844]  - OK.
[    1.928170] bonding: Ethernet Channel Bonding Driver: v3.7.1 (April 27, 2011)
[    1.938780] md: raid6 personality registered for level 6
[    1.944128] md: raid5 personality registered for level 5
[    1.949465] md: raid4 personality registered for level 4
[    1.954793] oprofile: hardware counters not available
[    1.959867] oprofile: using timer interrupt.
[    1.964233] nf_conntrack version 0.5.0 (13891 buckets, 55564 max)
[    1.970685] ip_tables: (C) 2000-2006 Netfilter Core Team
[    1.976088] TCP cubic registered
[    1.979475] NET: Registered protocol family 10
[    1.984659] ip6_tables: (C) 2000-2006 Netfilter Core Team
[    1.990137] IPv6 over IPv4 tunneling driver
[    1.994986] NET: Registered protocol family 17
[    1.999524] 8021q: 802.1Q VLAN Support v1.8
[    2.003738] VFP support v0.3: implementor 56 architecture 2 part 20 variant 9 rev 6
[    2.011494] registered taskstats version 1
[    2.015865] md: Skipping autodetection of RAID arrays. (raid=autodetect will force)
[    6.863207] JFFS2 notice: (1) jffs2_build_xattr_subsystem: complete building xattr subsystem, 1 of xdatum (0 unchecked, 0 orphan) and 1 of xref (0 dead, 0 orphan) found.
[    6.878816] VFS: Mounted root (jffs2 filesystem) on device 31:2.
[    6.885037] Freeing init memory: 208K
[   10.892425] SELinux: 2048 avtab hash slots, 98348 rules.
[   11.091415] SELinux: 2048 avtab hash slots, 98348 rules.
[   11.118524] SELinux:  6 users, 165 roles, 4443 types, 231 bools, 1 sens, 1024 cats
[   11.118538] SELinux:  81 classes, 98348 rules
[   11.131699] SELinux:  Completing initialization.
[   11.131707] SELinux:  Setting up existing superblocks.
[   11.131740] SELinux: initialized (dev sysfs, type sysfs), uses genfs_contexts
[   11.131761] SELinux: initialized (dev rootfs, type rootfs), uses genfs_contexts
[   11.131782] SELinux: initialized (dev bdev, type bdev), uses genfs_contexts
[   11.131808] SELinux: initialized (dev proc, type proc), uses genfs_contexts
[   11.131830] SELinux: initialized (dev tmpfs, type tmpfs), uses transition SIDs
[   11.131902] SELinux: initialized (dev devtmpfs, type devtmpfs), uses transition SIDs
[   11.132567] SELinux: initialized (dev sockfs, type sockfs), uses task SIDs
[   11.132587] SELinux: initialized (dev debugfs, type debugfs), uses genfs_contexts
[   11.134132] SELinux: initialized (dev pipefs, type pipefs), uses task SIDs
[   11.134154] SELinux: initialized (dev anon_inodefs, type anon_inodefs), uses genfs_contexts
[   11.134171] SELinux: initialized (dev devpts, type devpts), uses transition SIDs
[   11.134233] SELinux: initialized (dev rpc_pipefs, type rpc_pipefs), uses genfs_contexts
[   11.134257] SELinux: initialized (dev mqueue, type mqueue), uses transition SIDs
[   11.134292] SELinux: initialized (dev selinuxfs, type selinuxfs), uses genfs_contexts
[   11.134357] SELinux: initialized (dev mtd_inodefs, type mtd_inodefs), not configured for labeling
[   11.134376] SELinux: initialized (dev jffs2, type jffs2), uses xattr
[   11.134549] SELinux: initialized (dev sysfs, type sysfs), uses genfs_contexts
[   11.425426] type=1403 audit(11.410:2): policy loaded auid=4294967295 ses=4294967295
[   11.911820] SELinux: initialized (dev tmpfs, type tmpfs), uses transition SIDs
[   11.984668] SELinux: initialized (dev binfmt_misc, type binfmt_misc), uses genfs_contexts
[   12.337352] SELinux: initialized (dev tmpfs, type tmpfs), uses transition SIDs
[   12.399940] SELinux: initialized (dev tmpfs, type tmpfs), uses transition SIDs
[   12.436859] SELinux: initialized (dev aufs, type aufs), not configured for labeling
[   12.473855] SELinux: initialized (dev aufs, type aufs), not configured for labeling
[   12.501432] SELinux: initialized (dev tmpfs, type tmpfs), uses transition SIDs
[   12.529057] SELinux: initialized (dev tmpfs, type tmpfs), uses transition SIDs
[   13.868484] JFFS2 notice: (548) jffs2_build_xattr_subsystem: complete building xattr subsystem, 5 of xdatum (0 unchecked, 0 orphan) and 73 of xref (0 dead, 32 orphan) found.
[   13.884464] SELinux: initialized (dev jffs2, type jffs2), uses xattr
[   16.863111] pool #0: pkt_size=1536, buf_size=1632 - 2048 of 2048 buffers added
[   16.870783] eth0: started
[   16.873764] ADDRCONF(NETDEV_UP): eth0: link is not ready
[   18.070628] eth0: stopped
[   18.110514] eth0: started
[   18.113477] ADDRCONF(NETDEV_UP): eth0: link is not ready
[   18.153545] pool #1: pkt_size=1536, buf_size=1632 - 2048 of 2048 buffers added
[   18.161211] eth1: started
[   18.164184] ADDRCONF(NETDEV_UP): eth1: link is not ready
[   19.312010] eth1: stopped
[   19.352332] eth1: started
[   19.355303] ADDRCONF(NETDEV_UP): eth1: link is not ready
[   19.395447] pool #2: pkt_size=1536, buf_size=1632 - 2048 of 2048 buffers added
[   19.403118] eth2: link up
[   19.405764] eth2: started
[   32.140472] SHARED_MEM: shared_mem_open: About to take semaphore.
[   32.146918] SHARED_MEM: shared_mem_open: Got Semaphore.
[   32.153568] shared_mem: wait_for_init_shared_mem: Entering mutex for shm_dev at b1768dc0
[   32.163069] SHARED_MEM: CPU1: READY TO WAIT FOR INITIALIZATION OF SHARED MEMORY



And this command crashed the system:

Code: [Select]

Drobo:/ # Drobo:/ # esa state
=================================================
Thu Jan  1 00:03:25 1970: tDebug:  DUMPING DIAGNOSTICS
Drobo:/ # =================================================

--- Diagnostics : Threads ---


ThreadID       LWP      ThreadName Priority
0x2adbb450    1505          tDebug      245
0x2af2b450    1506  tIscsiMultiWr0      206
0x2b0ef450    1507  tIscsiMultiWr1      206
0x2b2bb450    1508  tIscsiMultiWr2      206
0x2b61b450    1509  tIscsiMultiWr3      206
0x2b69b450    1510  tIscsiMultiWr4      206
0x2b6e7450    1511  tIscsiMultiWr5      206
0x2b95b450    1512  tIscsiMultiWr6      206
0x2ba63450    1513  tIscsiMultiWr7      206
0x2bb77450    1514  tIscsiMultiWr8      206
0x2bccb450    1515       tIscsiWB0      206
0x2be9b450    1516       tIscsiWB1      206
0x2c2af450    1517       tIscsiWB2      206
0x2c5cb450    1518       tIscsiWB3      206
0x2c757450    1519       tIscsiWB4      206
0x2c7d7450    1520       tIscsiWB5      206
0x2c893450    1521       tIscsiWB6      206
0x2c983450    1522       tIscsiWB7      206
0x2cadb450    1523       tIscsiWB8      206
0x2cbd7450    1524       tIscsiMgr      210

--- Diagnostics : Intercore ---

iscsiTgtIntercoreShow
Tag2CmdMapper has 0 records
Intercore lock --
  locked                      : 0
  count                       : 0
  owner                       : 0 ((null))
Intercore command/response logs:
These logs show what has been sent over the intercore and what has been received
Thu Jan  1 00:03:25 1970: tDebug: Current timestamp is 205
Command Log:
 tag 0 timestamp 0
 ...
 tag 0 timestamp 0
Response Log:
 tag 0 timestamp 0
 ...
 tag 0 timestamp 0
End of Intercore command/response logs
Intercore Perf:
(no samples)

Perf for adding to intercore map:
(no samples)

Perf for removing from intercore map:
(no samples)

End of Intercore Perf
--------------------------------------------------------

--- Diagnostics : J1 ---

J1 state

gWbInfo 0xcdaf4 SharedPartitionInfo (nil)
TransPoolInfo gTransPool = (nil) sharedPartitionInfo->TransPoolInfo 0xc
BulkPoolInfo gBulkPool = (nil) sharedPartitionInfo->BulkPoolInfo 0x50
SharedPartitionInfo->VxSharedPartitionDataStart 0x98
WriteBufferDescriptor size = 128
Using two write buffer pools!
Thu Jan  1 00:03:25 1970: tDebug: Signal = SIGSEGV
Thu Jan  1 00:03:25 1970: tDebug: Thread ID 0x2adbb450
Thu Jan  1 00:03:25 1970: tDebug: stackaddr= 0x2ad9c000 : 0x2adbc000 [stacksize= 0x20000],  context_addr= 0x2adb5444
Thu Jan  1 00:03:25 1970: tDebug: iSCSITgt crash backtrace
[  240.139348] BUG: soft lockup - CPU#0 stuck for 22s! [iscsiTgt:1497]
[  240.145635] Modules linked in:
[  240.148708]
[  240.150204] Pid: 1497, comm:             iscsiTgt
[  240.154923] CPU: 0    Not tainted  (3.2.96-3 #1)
[  240.159562] PC is at msleep_interruptible+0x10/0x78
[  240.164455] LR is at msleep_interruptible+0x10/0x78
[  240.169349] pc : [<800710d0>]    lr : [<800710d0>]    psr: 20070013
[  240.169354] sp : aecb9d10  ip : aecb9d10  fp : aecb9d24
[  240.180872] r10: 00000000  r9 : af152940  r8 : b1768fe0
[  240.186114] r7 : 00000000  r6 : beadcafe  r5 : b1768dc0  r4 : 806e25e0
[  240.192660] r3 : cccccccd  r2 : 271aef7c  r1 : 00000057  r0 : 0000000a
[  240.199209] Flags: nzCv  IRQs on  FIQs on  Mode SVC_32  ISA ARM  Segment user
[  240.206366] Control: 10c53c7d  Table: 4f50006a  DAC: 00000015
[  240.212128] Backtrace:
[  240.214609] [<80011d40>] (dump_backtrace+0x0/0x108) from [<8047b71c>] (dump_stack+0x18/0x1c)
[  240.223072]  r7:00000000 r6:ee6b2800 r5:aecb8000 r4:aecb9cc8
[  240.228802] [<8047b704>] (dump_stack+0x0/0x1c) from [<8000f3c4>] (show_regs+0x4c/0x50)
[  240.236752] [<8000f378>] (show_regs+0x0/0x50) from [<800a54f4>] (watchdog_timer_fn+0x16c/0x1a4)
[  240.245476]  r5:aecb8000 r4:806146f5
[  240.249095] [<800a5388>] (watchdog_timer_fn+0x0/0x1a4) from [<80086da0>] (__run_hrtimer+0x9c/0x2b4)
[  240.258173] [<80086d04>] (__run_hrtimer+0x0/0x2b4) from [<80087c50>] (hrtimer_interrupt+0x134/0x304)
[  240.267332]  r9:7fffffff r8:ffffffff r7:00000000 r6:809f84c0 r5:00000037
[  240.273929] r4:e8dd0845
[  240.276587] [<80087b1c>] (hrtimer_interrupt+0x0/0x304) from [<8001a480>] (axp_localtimer_handler+0x38/0x40)
[  240.286362] [<8001a448>] (axp_localtimer_handler+0x0/0x40) from [<800a93d4>] (handle_percpu_devid_irq+0xa8/0x1b0)
[  240.296660] [<800a932c>] (handle_percpu_devid_irq+0x0/0x1b0) from [<800a5804>] (generic_handle_irq+0x30/0x40)
[  240.306609] [<800a57d4>] (generic_handle_irq+0x0/0x40) from [<8000eb3c>] (handle_IRQ+0x60/0xb4)
[  240.315337] [<8000eadc>] (handle_IRQ+0x0/0xb4) from [<800081d0>] (asm_do_IRQ+0x10/0x14)
[  240.323363]  r9:af152940 r8:b1768fe0 r7:aecb9cfc r6:fbb21000 r5:20070013
[  240.329959] r4:800710d0
[  240.332612] [<800081c0>] (asm_do_IRQ+0x0/0x14) from [<80484694>] (__irq_svc+0x34/0xec)
[  240.340553] Exception stack(0xaecb9cc8 to 0xaecb9d10)
[  240.345623] 9cc0:                   0000000a 00000057 271aef7c cccccccd 806e25e0 b1768dc0
[  240.353828] 9ce0: beadcafe 00000000 b1768fe0 af152940 00000000 aecb9d24 aecb9d10 aecb9d10
[  240.362031] 9d00: 800710d0 800710d0 20070013 ffffffff
[  240.367106] [<800710c0>] (msleep_interruptible+0x0/0x78) from [<802de444>] (wait_for_init_shared_mem+0x10c/0x174)
[  240.377398]  r5:b1768dc0 r4:806e25e0
[  240.381012] [<802de338>] (wait_for_init_shared_mem+0x0/0x174) from [<802e02cc>] (shared_mem_open_main+0xd8/0x140)
[  240.391304]  r7:00000000 r6:af152940 r5:b1768dd0 r4:b1768dc0
[  240.397034] [<802e01f4>] (shared_mem_open_main+0x0/0x140) from [<802e035c>] (shared_mem_open+0x28/0x5c)
[  240.406454]  r7:b1639588 r6:af152940 r5:b1639588 r4:b1768dc0
[  240.412184] [<802e0334>] (shared_mem_open+0x0/0x5c) from [<801182a4>] (chrdev_open+0x120/0x248)
[  240.420907]  r6:806d7884 r5:00000000 r4:b1768fe0
[  240.425580] [<80118184>] (chrdev_open+0x0/0x248) from [<801118b8>] (__dentry_open+0x1c0/0x3b8)
[  240.434223] [<801116f8>] (__dentry_open+0x0/0x3b8) from [<80112c04>] (nameidata_to_filp+0x68/0x78)
[  240.443216] [<80112b9c>] (nameidata_to_filp+0x0/0x78) from [<80122a30>] (do_last.constprop.13+0x31c/0x780)
[  240.452898]  r7:00000000 r6:00000000 r5:00000000 r4:aecb9ed8
[  240.458627] [<80122714>] (do_last.constprop.13+0x0/0x780) from [<80122f8c>] (path_openat+0xbc/0x420)
[  240.467792] [<80122ed0>] (path_openat+0x0/0x420) from [<80123428>] (do_filp_open+0x34/0x90)
[  240.476173] [<801233f4>] (do_filp_open+0x0/0x90) from [<80112d00>] (do_sys_open+0xec/0x18c)
[  240.484548]  r7:af0b8000 r6:ffffff9c r5:00000001 r4:00000019
[  240.490277] [<80112c14>] (do_sys_open+0x0/0x18c) from [<80112dc0>] (sys_open+0x20/0x24)
[  240.498303]  r9:aecb8000 r8:8000ddc8 r7:00000005 r6:000e3554 r5:000cd978
[  240.504900] r4:000cd000
[  240.507553] [<80112da0>] (sys_open+0x0/0x24) from [<8000dc20>] (ret_fast_syscall+0x0/0x30)
[  240.515843] Kernel panic - not syncing: softlockup: hung tasks
[  240.521693] shared_mem_panic_dump: WARNING: LXPM area not initialized yet.
[  240.528591] CPU2: stopping
[  240.531307] Backtrace:
[  240.533785] [<80011d40>] (dump_backtrace+0x0/0x108) from [<8047b71c>] (dump_stack+0x18/0x1c)
[  240.542248]  r7:b1128000 r6:00000000 r5:80627070 r4:806520a4
[  240.547977] [<8047b704>] (dump_stack+0x0/0x1c) from [<800138c8>] (handle_IPI+0x150/0x16c)
[  240.556183] [<80013778>] (handle_IPI+0x0/0x16c) from [<800083b8>] (do_IPI+0x10/0x14)
[  240.563949]  r9:562f5842 r8:8048ebb0 r7:b1129fa4 r6:fbb21000 r5:600e0013
[  240.570546] r4:8000f088
[  240.573200] [<800083a8>] (do_IPI+0x0/0x14) from [<80484694>] (__irq_svc+0x34/0xec)
[  240.580792] Exception stack(0xb1129f70 to 0xb1129fb8)
[  240.585861] 9f60:                                     00000021 806262d8 00000002 80019364
[  240.594066] 9f80: 80651ec4 8062c45c 80568c10 b1128000 8048ebb0 562f5842 00000000 b1129fdc
[  240.602271] 9fa0: b1129fb8 b1129fb8 8000eefc 8000f088 600e0013 ffffffff
[  240.608910] [<8000efd8>] (cpu_idle+0x0/0xdc) from [<804783e0>] (secondary_start_kernel+0x164/0x16c)
[  240.617982]  r9:562f5842 r8:2000406a r7:8065208c r6:10c03c7d r5:000001d3
[  240.624578] r4:00000004
[  240.627230] [<8047827c>] (secondary_start_kernel+0x0/0x16c) from [<20477c34>] (0x20477c34)
[  240.635518]  r5:00000015 r4:5113006a
[  240.639128] CPU1: stopping
[  240.641843] Backtrace:
[  240.644320] [<80011d40>] (dump_backtrace+0x0/0x108) from [<8047b71c>] (dump_stack+0x18/0x1c)
[  240.652784]  r7:b10e0000 r6:00000000 r5:80627070 r4:806520a4
[  240.658511] [<8047b704>] (dump_stack+0x0/0x1c) from [<800138c8>] (handle_IPI+0x150/0x16c)
[  240.666715] [<80013778>] (handle_IPI+0x0/0x16c) from [<800083b8>] (do_IPI+0x10/0x14)
[  240.674481]  r9:562f5842 r8:8048ebb0 r7:b10e1fa4 r6:fbb21000 r5:60070013
[  240.681075] r4:8000f088
[  240.683729] [<800083a8>] (do_IPI+0x0/0x14) from [<80484694>] (__irq_svc+0x34/0xec)
[  240.691320] Exception stack(0xb10e1f70 to 0xb10e1fb8)
[  240.696389] 1f60:                                     00000020 806262d8 00000001 80019364
[  240.704595] 1f80: 80651ec4 8062c45c 80568c10 b10e0000 8048ebb0 562f5842 00000000 b10e1fdc
[  240.712800] 1fa0: b10e1fb8 b10e1fb8 8000eefc 8000f088 60070013 ffffffff
[  240.719439] [<8000efd8>] (cpu_idle+0x0/0xdc) from [<804783e0>] (secondary_start_kernel+0x164/0x16c)
[  240.728510]  r9:562f5842 r8:2000406a r7:8065208c r6:10c03c7d r5:000001d3
[  240.735103] r4:00000002
[  240.737754] [<8047827c>] (secondary_start_kernel+0x0/0x16c) from [<20477c34>] (0x20477c34)
[  240.746042]  r5:00000015 r4:510f006a
[  240.749652] shared_mem_panic_event: Kernel panic event handler called. Notifying VxWorks Core of Kernel panic.


[JimKnopf]

I found another very interesting tool for analyzing firmware files and memory dumps: emba  https://github.com/e-m-b-a/emba

I have to dig into it. Maybe it helps with all the informations it automaticly analyses. Couldn't get it to work on my Arch Linux Notebook. But it worked like a charm on my SLS2 in WSL using Ubuntu as distribution.

The image is from analyzing the dumped files i found in Marvell U-Boot shell.

[JimKnopf]

I need some help from either someone who can extract a working vxworks image from this firmware file or someone who can provide the files from a working device.

I tried different things now loading the vxworks ELF images i extracted manually from the firmware file and the ones emba extracted automaticly. I tried to load it in u-boot using loady and ymodem in minicom but could not get it to work.

I then tried it using kermit in minicom and was able to successfully upload the data using ckermit after creating ~/.kermrc with this content:

Code: [Select]

set carrier-watch off
set handshake none
set flow-control none
robust
set file type bin
set rec pack 1000
set send pack 1000
set window 5

I tried the firmware file itself and the extracted ELF files from the firmware file containing the vxworks stuff. The firmware file has more than 50 MB. It took more than 90 minutes to upload it over uart serial connection in u-boot. I't didn't help. When i run

Code: [Select]

go 0x20000000

and some commands from printenv data like

Code: [Select]

td_bootargs_confab; run flashload_g0; bootvx 0x20000000

It always complains "No ELF file at 0x20000000". Because of the very slow upload speed using kermit, i tried a combination of Marvell u-boot shell and openocd.

Loading a file to memory is way faster in openocd.
I started the device, pressed a button to stop boot process and entering the Marvell u-boot shell. In openocd i did:

Code: [Select]

halt
load_image /home/<user>/<some_path>/7698614-19018234.elf32 0x20000000 elf
resume

In  u-boot i tried the same commands like before, go 0x20000000 or td_bootargs_confab; run flashload_g0; bootvx 0x20000000.

I don't know why but sometimes the image was not loaded to 0x20000000. Sometimes it was loaded at 0x21000000.
I couldn't even load the original vxworks image i dumped from the Drobo device.

One time i tried loading it at 0x00000000 and it was loaded at 0x01000000.
In this case, i did in openocd a resume 0x01000000 and to my surprise, it started to load but halted at some point.
But this time i had blue lights on the device and the bootlog was different:

Code: [Select]

Marvell>> td_bootargs_confab; run flashload_g0; bootvx 0x21000000
Env Var skipConfabulation=0
Skip Confabulation: NONE
  ... skipConfabulation: 0x1 skips Vx confab, 0x2 skips Lx confab
Current Value of Vx bootargs_g0:
==================================================
bootargs_g0=neta(3,0) f=0x6000 o=usb0:eth3:cpus=1:mem=0x20000000;MAC3-00:50:43:11:89:dd;SEe
==================================================
EnvVar bootargsStart=neta(3,0)
EnvVar vxFlags=f=0x6000
EnvVar vxDev=usb0:eth3:cpus=1:mem=0x20000000
EnvVar eth3addr=00:50:43:11:89:dd
EnvVar droboSER=DRB143602000000
EnvVar vxCmd=s=#/romfs/runesa.vxe
Confabulated Value of bootargs_g0:
==================================================
bootargs_g0=neta(3,0) f=0x6000 o=usb0:eth3:cpus=1:mem=0x20000000;MAC3-00:50:43:11:89:dd;SEe
==================================================
Current bootargs_g0 perfectly match the Confabulated bootargs_g0
No Need to Update the Environment
reading vxWorks_prev
.
.
.
...........................................................................................

17734472 bytes read
## Ethernet MAC address not copied to NV RAM
## No elf image at address 0x21000000
## Not an ELF image, assuming binary
## Using bootline (@ 0x1100): neta(3,0) f=0x6000 o=usb0:eth3:cpus=1:mem=0x20000000;MAC3-00e
## Starting vxWorks at 0x21000000 ...
MPP33 Config (0xd0018010) == 0x11110040 (Should be: 0xXXXXXX4X)
SDRAM Config (0xd0001400) == 0x7201c924 (Should be: 0x72XXXXXX)
DRAM TBsAddr (0xd0001580) == 0x20000000 (Should be: 0x??????]

Booting from CPU 0
Detected board Heatwave 1.0
DRAM env init....... Done.


Detected DRAM size 512MB
  AMP: Resources - uart0 - pex1 - pex2 - eth3 - xor0 - usb0 - i2c0 - i2c1 - sata - spi - g
AMP CPUs = 1
AMP mem size = 0x20000000
TWSI init Channel 0....... Done. Actual freq = 97656Hz
Skipping serdes configuration.
Ctrl env init....... Done.
Addr Dec Win......
Verified
CP15 mrvl dbgr  0x000109A7
CP15 mrvl dbgr2 0xEA008208
CP15 mrvl ctrl  0x000001B6
CP15 mrvl dbgr  0x000109A7
CP15 mrvl dbgr2 0xEA008208
CP15 mrvl ctrl  0x000001B6
CPU if init......... Done.
GPP init............ Done.
DRAM env init....... Done.


Using DRAM size 512MB


=======================> HW Revision Register == 0x00000881

Detected Board: Heatwave MVT, Spin 0 (No EthDebug)

Detect:  Tclk    250MHz
         SysClk  600MHz
         L2Clk   600MHz
         pClk   1200MHz

Marvell Controller initialization Done.
Modules Detected:

SPI flash based addr on 0xD4000000=
SPI Flash 8MB detected

esaXORSystemInit

esaXORSystemInit...done

esaDMASystemInit
Initialising SEEPROM Interface
Checking Bootline.......0x00001100 [0x6e]
UBOOT Version: UBOOT-2.33


Bootline params = neta(3,0) f=0x6000 o=usb0:eth3:cpus=1:mem=0x20000000;MAC3-00:50:43:11:89

DRAM int Ctrl....... Done
IDMA Err int Ctrl... Done
IDMA init........... Done
NETA Err int Ctrl... Done
Neta int Ctrl....... Done
GPIO int Ctrl....... Done
PCI int Ctrl........ Done
PCI-E 0: Not mapped to this OS
PCI-E 1: Not mapped to this OS
PCI-E 2: Not mapped to this OS
PCI-E 3: Not mapped to this OS
mvPexIntfInit() ROOT COMPLEX Init pexHWInf: 4
mvSysPexInit() called pexIf: 4  type: 0  MAX_TARGETS: 44
mvSysPexInit() OK from mvCtrlAddrWinMapBuild()
mvSysPexInit() OK from mvPexWinInit()
mvPexModeGet()  configured as ROOT reg: 0x4014032e
mvPexInit() configuring as ROOT
mvPexLocalBusNumSet() called for pexIf: 4  busNum: 0 localBus: 0  localDev: 0
*******************mvPexLocalDevNumSet(4) localBus: 0  localDev: 0 pexStatus: 0 ***********
mvPexInit() call mvPexMasterEnable
mvPexInit() call mvPexSlaveEnable
mvPexInit() disable int
mvPexInit() wait a tick
mvPexInit() check for link
PEX4 interface detected Link X1
mvPexIntfInit() checking if we should set the localBus  pex0flg: 0  pexHWInf: 4
mvPexIntfInit() setting localBusNum to 0 for pexHWInf 4
mvPexLocalBusNumSet() called for pexIf: 4  busNum: 0 localBus: 0  localDev: 0
PCI-E 4/10: Done.
PCI-E 5: is power off
mvPexIntfInit() ROOT COMPLEX Init pexHWInf: 6
mvSysPexInit() called pexIf: 6  type: 0  MAX_TARGETS: 44
mvSysPexInit() OK from mvCtrlAddrWinMapBuild()
mvSysPexInit() OK from mvPexWinInit()
mvPexModeGet()  configured as ROOT reg: 0x4014022e
mvPexInit() configuring as ROOT
mvPexLocalBusNumSet() called for pexIf: 6  busNum: 0 localBus: 1  localDev: 0
*******************mvPexLocalDevNumSet(6) localBus: 0  localDev: 0 pexStatus: 0 ***********
mvPexInit() call mvPexMasterEnable
mvPexInit() call mvPexSlaveEnable
mvPexInit() disable int
mvPexInit() wait a tick
mvPexInit() check for link
PEX6 interface detected Link X1
mvPexIntfInit() checking if we should set the localBus  pex0flg: 0  pexHWInf: 6
mvPexIntfInit() setting localBusNum to 0 for pexHWInf 6
mvPexLocalBusNumSet() called for pexIf: 6  busNum: 0 localBus: 0  localDev: 0
PCI-E 6/10: Done.
mvPexIntfInit() ROOT COMPLEX Init pexHWInf: 7
mvSysPexInit() called pexIf: 7  type: 0  MAX_TARGETS: 44
mvSysPexInit() OK from mvCtrlAddrWinMapBuild()
mvSysPexInit() OK from mvPexWinInit()
mvPexModeGet()  configured as ROOT reg: 0x4014022e
mvPexInit() configuring as ROOT
mvPexLocalBusNumSet() called for pexIf: 7  busNum: 0 localBus: 2  localDev: 0
*******************mvPexLocalDevNumSet(7) localBus: 0  localDev: 0 pexStatus: 0 ***********
mvPexInit() call mvPexMasterEnable
mvPexInit() call mvPexSlaveEnable
mvPexInit() disable int
mvPexInit() wait a tick
mvPexInit() check for link
PEX7 interface detected Link X1
mvPexIntfInit() checking if we should set the localBus  pex0flg: 0  pexHWInf: 7
mvPexIntfInit() setting localBusNum to 0 for pexHWInf 7
mvPexLocalBusNumSet() called for pexIf: 7  busNum: 0 localBus: 0  localDev: 0
PCI-E 7/10: Done.
mvPexIntfInit() ROOT COMPLEX Init pexHWInf: 8
mvSysPexInit() called pexIf: 8  type: 0  MAX_TARGETS: 44
mvSysPexInit() OK from mvCtrlAddrWinMapBuild()
mvSysPexInit() OK from mvPexWinInit()
mvPexModeGet()  configured as ROOT reg: 0x4014032e
mvPexInit() configuring as ROOT
mvPexLocalBusNumSet() called for pexIf: 8  busNum: 0 localBus: 3  localDev: 0
*******************mvPexLocalDevNumSet(8) localBus: 0  localDev: 0 pexStatus: 0 ***********
mvPexInit() call mvPexMasterEnable
mvPexInit() call mvPexSlaveEnable
mvPexInit() disable int
mvPexInit() wait a tick
mvPexInit() check for link
PEX8 interface detected Link X1
mvPexIntfInit() checking if we should set the localBus  pex0flg: 0  pexHWInf: 8
mvPexIntfInit() setting localBusNum to 0 for pexHWInf 8
mvPexLocalBusNumSet() called for pexIf: 8  busNum: 0 localBus: 0  localDev: 0
PCI-E 8/10: Done.
PCI-E 9: Not mapped to this OS
USB0 init........... Done. HOST   type selected
USB Err int Ctrl.... Done
XOR Err int Ctrl.... Done
mvSysXorInit: done
XOR init............ Done
mvCtrlInit2......... done
vxbDevInit.........done
sysSerialConnectAll.........done
Serial Ports...Attached
UART2...Baud Rate Adjusted to 38.4K
VxBus Loaded.... done
bspConfigureI2CTable: Configuring I2C tables for 8-Slot (Kryten)
[tRootTask] 1970-01-01 00:00:00: drDrvLaunch
---->> drDrv() <<----
Allocated temp buffer 0x42599a8
[tRootTask] 1970-01-01 00:00:00: Diagnostic Re-Route Device Driver - Version 1.0 - Install.
[tRootTask] 1970-01-01 00:00:00: drStartLogging() started
_DEF_STD_OUT = 3 _DEF_STD_ERR = 3 _DR_FD = 4
Host Name: bootHost
Target Name: vxTarget
User: target
Ethernet port #3 initialized
neta3 Interface Loaded; MAC: 00:50:43:11:89:DD
neta3 Interface Started
Attempting to register custom syscalls group
ipAttached to interface neta3 ip=
Can't Set IP address to <neta3> interface..bootline does not have ethernet ipAddress

Adding 10511 symbols for standalone.
Detected Marvell USB. SettingwdbConfig: error configuring WDB communication interface
 

 ]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]
 ]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]
 ]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]
      ]]]]]]]]]]]  ]]]]     ]]]]]]]]]]       ]]              ]]]]         (R)
 ]     ]]]]]]]]]  ]]]]]]     ]]]]]]]]       ]]               ]]]]           
 ]]     ]]]]]]]  ]]]]]]]]     ]]]]]] ]     ]]                ]]]]           
 ]]]     ]]]]] ]    ]]]  ]     ]]]] ]]]   ]]]]]]]]]  ]]]] ]] ]]]]  ]]   ]]]]]
 ]]]]     ]]]  ]]    ]  ]]]     ]] ]]]]] ]]]]]]   ]] ]]]]]]] ]]]] ]]   ]]]] 
 ]]]]]     ]  ]]]]     ]]]]]      ]]]]]]]] ]]]]   ]] ]]]]    ]]]]]]]    ]]]]
 ]]]]]]      ]]]]]     ]]]]]]    ]  ]]]]]  ]]]]   ]] ]]]]    ]]]]]]]]    ]]]]
 ]]]]]]]    ]]]]]  ]    ]]]]]]  ]    ]]]   ]]]]   ]] ]]]]    ]]]] ]]]]    ]]]]
 ]]]]]]]]  ]]]]]  ]]]    ]]]]]]]      ]     ]]]]]]]  ]]]]    ]]]]  ]]]] ]]]]]
 ]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]
 ]]]]]]]]]]]]]]]]]]]]]]]]]]]]]       Development System
 ]]]]]]]]]]]]]]]]]]]]]]]]]]]]
 ]]]]]]]]]]]]]]]]]]]]]]]]]]]       VxWorks 6.8
 ]]]]]]]]]]]]]]]]]]]]]]]]]]       KERNEL: WIND version 2.13
 ]]]]]]]]]]]]]]]]]]]]]]]]]       Copyright Wind River Systems, Inc., 1984-2012

 CPU: Marvell Sheeva 88SV584x, Board= Heatwave 1.0 ARMARCHV7 LE core.  Processor #0.
 Memory Size: 0x1fe70000.  BSP version 2.3.1.
 Created: Feb  3 2016, 20:45:55
 ED&R Policy Mode: Deployed
 WDB Comm Type: WDB_COMM_END
 WDB: Agent configuration failed.
[tRootTask] 1970-01-01 00:00: MV_USB_MODE_RE00: kCmdInit: Initialising kernel command liner
[tRootTask] 1970-01-01 00:00:00: diskCmdRegister: Installing k disk Commands

G = 0x3
ESA Register Driver Found Board version 2, stuffing option 1
Initialising boot SEEPROM handler
Checking boot register values in serialEEPROM ...
<<<<Flash Upgrade Driver - version 1.0 - installed.
IsFlashForDroboPro: We are NOT running on Drobo Pro deal with flash accordingly
Failed to get flash layout...this is expected for Optimus Prime, which does not have NOR F.

System Configuration

CHIP   : MV88F7846 Rev 2
CPU    : Marvell PJ4B (584) v7 (Rev 2)
BOARD  : Heatwave 1.0 (0x0)
CLOCKs : tClk  =  250MHz, sysClk =  600MHz
         L2Clk =  600MHz  pClk   = 1200MHz

ETH_JUMBO_SUPPORT   = Disabled
BRIDGING_SUPPORT    = Enabled
MULTI_Q_SUPPORT     = Disabled
NAT_SUPPORT         = Disabled
VFP_SUPPORT         = Enabled
L2 Cache            = Enabled
IO coherency        = Enabled
Get DATE: 2071-06-19 (Friday)  TIME: 21:30:01
[vxWorks *]#

=======================> HW Revision Register == 0x00000881

Board Type 4, Rev 2 (Heatwave MVT), Spin = 0
Stuffing Opt = 1 (No EthDebug), DevDebugBitz = 0x0


        Drobo B810i
        Heatwave
        Ready to take a Byte!

==============================================================================
Initializing PMU...
Reading PMU Version...
PMU Version: 1.2.0x046c, Download Version 108 (Variant 4) [Failsafe Ver 4]
Considering an Update to the PMU ...
PMU is up to date for this MVT board.

    Reading 0xac from PMU GPIO Port 1 [ @0x0020 ]

    Reading 0xef from PMU GPIO Port 2 [ @0x0028 ]

    Reading 0x71 from PMU GPIO Port 3 [ @0x0018 ]

    Reading 0x10 from PMU GPIO Port 4 [ @0x001c ]
==============================================================================
        PMU is Running on AC Power :-)
==============================================================================
==============================================================================
0x48ac278 (BusM A): 0x48ac278 (BusM A): INFO: usb2Msc - Storage driver got a device attach.
INFO: usb2Msc - Storage driver got a device attach notification.
This Optimus Prime PMU is NOT configured for Early-Follow of DDR3 Reset...Fixing
0x48ac278 (BusM A): 0x48ac278 (BusM A): INFO: usb2Msc - Mounting device (PDT 0x0 PQ 0x0 RMP
INFO: usb2Msc - Mounting device (PDT 0x0 PQ 0x0 RMB 0x0) VID =          : PID = USB DISK MP
0x48ac278 (BusM A): 0x48ac278 (BusM A): INFO: usb2Msc - Device 0x2 LUN 0 of 1005568 (KB) w0
INFO: usb2Msc - Device 0x2 LUN 0 of 1005568 (KB) will be mounted with base name /bd0
This Optimus Prime Board Supports Self-Refresh only with VRM_EN
        ...PMU will ENABLE VRM_EN during a reboot/shutdown cycle.
        PMU BootOnBatt Counter DEFAULT is now 3
/bd0/  - disk check in progress ...
/bd0/Crashlogs/crashlog-20160306-1012   PMU BootOnBatt Counter ACTUAL is now 3
==============================================================================
Set temp = Kryten
/bd0/  - Volume is OK                               

          total # of clusters:  62,580
         # of free clusters:  56,607
          # of bad clusters:  0
           total free space:  905,712 Kb
  0,   0,     max contiguous free space:  923,697,152 bytes
                 # of files:  58
               # of folders:  1
       total bytes in files:  94,805 Kb
           # of lost chains:  0
   total bytes in lost chains:  0
  0,   0,   0,   0,
PMU Skip-OverTemp Setting: 0x0000
PMU Shutdown Status: 0x00
        PMU Shutdown IS NOT Pending!
        PMU Shutdown Reasons are Fully Enabled
        Disk Array Temp is Within Tolerances
        CPU Core Temp   is Within Tolerances
        PMU Core Temp   is Within Tolerances
PMU Shutdown Reason: 0x00
PMUCmd: "A" --> "a"
"Y" --> "0x0680,23:20.75,0,0,0"
"B" --> "1,0,0,0,0,1"
 Total = 0:0 in 0 cycles

PMU state machine current state is 'NORMAL' [0x06]
PMU reports the DRAM data was INVALID at bootup [0x80]
Accumulated Up-time = 0 days: 0 hours: 23 minutes: 20.085 seconds
  (1 Active cycles, 1 Power cycles)
  Latest battery backup time      = 00:00:00 (hh:mm:ss)
  Longest battery backup time     = 00:00:00 (hh:mm:ss)
  Accumulated battery backup time = 00:00:00 (hh:mm:ss)
  (0 Backup cycles, 0 Completed cycles, 0 Failed cycles, 0 Backup flags)
0x4011744 (tErfTask): 0x4011744 (tErfTask): INFO: usb2Msc - Device /bd0 has been claimed bm
INFO: usb2Msc - Device /bd0 has been claimed by filesystem
NOTIFY: hDevice 0x2 lun 0 medium changed (mediumInsert = 1)
PMU Reports Voltages:  (AC == 12.085V)    (Batt ==  0.263V)
PMU LED Dimming: Default==25, Current==25
PMU Fan Speed AutoAdjust has been ENABLED
PMU Fan Speed: Default== 1, Current== 1
        Setting Temperature Critical Threshold for Disk from 56 to 65
Temperature Thresholds for Disk:  Interest== 52, Warning== 55, Critical== 65 -- Override==F
PMU Init Done
==============================================================================
****    ArmadaXP is Type B0
Launching LED Sequencer...
LED Sequencer...Launched
LED Sequencer...Testing...
Setup Kernel/RTP Messaging Interface
Initialising kernel<->RTP queues with 80 entries
USB command/response Q's @ 0xf4102000/0xf4103000
MULTI ISSUE command/response Q's @ 0x0/0xf4105000
FAST PATH QUEUING RTP INTERFACE ENABLED
64-BIT HOST LBAs ENABLED
Setup Kernel/RTP Resource Release Messaging Interface
Initialising kernel<->RTP resource release queues with 80 entries
MULTI ISSUE RESOURCE RELEASE Q @ 0xf4107000
FAST PATH QUEUING RTP RESOURCE RELEASE INTERFACE ENABLED
IntConnect pISR==0x01076b9c was Successful for Cause==32 ("PMU Panic")
IntConnect pISR==0x01076c34 was Successful for Cause==40 ("PMU PowerDownReq")
IntConnect pISR==0x01076b20 was Successful for Cause==57 ("PMU OverTemp")
IntConnect pISR==0x01076d48 was Successful for Cause==29 ("Disk Detected")
IntDisable for Cause==65 ("Clear Disk Button")


  ***** Initializing the Kernel's Thermal Monitor *****
   ***** Spawning the Kernel's Thermal Monitor *****
   ***** Executing Auxilliary Task for the Kernel's Thermal Monitor *****

KERNEL BOOTUP: usrAppInit: INFO: bootup with backup battery OFF

Not Turning the battery ON ye
PMUCmd: "~55" --> "~55!"
PMUCmd: "K" --> "k"
Intercore Access Device Driver - Version 1.0 - Installed.


        Heatwave MVT Init Compleat!

[tRootTask] 2071-06-19 21:30:04: diskInterfaceInitialise: Starting Disk Driver(s) Initiali.
[tRootTask] 2071-06-19 21:30:04: bspDiskConfigureDiskTable: Configuring drive tables for 8e
[tRootTask] 2071-06-19 21:30:04: diskInterfaceInitialise: System has 8 slots
[tRootTask] 2071-06-19 21:30:04: diskDriverInstall:
[tRootTask] 2071-06-19 21:30:04: showDiskTbs: Dumping Disk Driver Config Tables:
[New Disk Thread] 2071-06-19 21:30:04: diskConfigureNewDiskThread: Starting thread
[tRootTask] 2071-06-19 21:30:04:
[tRootTask] 2071-06-19 21:30:04:   Dumping Disk Adapter Table
[tRootTask] 2071-06-19 21:30:04:     Adapter Instance   Adapter Address   Adapter Data Adds
[tRootTask] 2071-06-19 21:30:04:            0            0x01E59238            0x00000000
[tRootTask] 2071-06-19 21:30:04:            1            0x01E59238            0x00000000
[tRootTask] 2071-06-19 21:30:04:            2            0x01E59238            0x00000000
[tRootTask] 2071-06-19 21:30:04:            3            0x01E59238            0x00000000
[tRootTask] 2071-06-19 21:30:04:
[tRootTask] 2071-06-19 21:30:04:    Dumping Disk Slot Config Table:
[tRootTask] 2071-06-19 21:30:04:     Adapter Instance   Connection    Physical Slot   Adapr
[tRootTask] 2071-06-19 21:30:04:         0                DRIVE             0             8
[tRootTask] 2071-06-19 21:30:04:         0                DRIVE             1             C
[tRootTask] 2071-06-19 21:30:04:         1                DRIVE             2             0
[tRootTask] 2071-06-19 21:30:04:         1                DRIVE             3             4
[tRootTask] 2071-06-19 21:30:04:         2                DRIVE             4             8
[tRootTask] 2071-06-19 21:30:04:         2                DRIVE             5             C
[tRootTask] 2071-06-19 21:30:04:         3                DRIVE             6             0
[tRootTask] 2071-06-19 21:30:04:         3                DRIVE             7             4
[tRootTask] 2071-06-19 21:30:04: diskInterfaceInitialise: Calling init with adapter 0 (0x0)
[tRootTask] 2071-06-19 21:30:04: ahciPerformPhyConfig: Loading phy regs for 9170
0x69cf2bMax Disk Temp: c
Data abort
Exception address: 0x010ca130
Current Processor Status Register: 0x80000013
Task: 0x69cf2bc "tRootTask"
 (tRootTask): 0x69cf2bc (tRootTask): diskDriAhciStorageRegister:
diskDriAhciStorageRegister:
0x69cf2bc (tRootTask): 0x69cf2bc (tRootTask): diskDriAhciInstInit:
diskDriAhciInstInit:
0x69cf2bc (tRootTask): 0x69cf2bc (tRootTask): diskDriAhciInstInit2:
diskDriAhciInstInit2:
0x69cf2bc (tRootTask): 0x69cf2bc (tRootTask): diskDriAhciInstInit2: Storing 0x04AE9148 to 0
diskDriAhciInstInit2: Storing 0x04AE9148 to adapter table entry 0
0x69cf2bc (tRootTask): 0x69cf2bc (tRootTask): diskDriAhciInstConnect:
diskDriAhciInstConnect:
0x69cf2bc (tRootTask): 0x69cf2bc (tRootTask): task 0x69cf2bc has had a failure and has bee.
task 0x69cf2bc has had a failure and has been stopped.
0x69cf2bc (tRootTask): 0x69cf2bc (tRootTask): fatal exception in a kernel task or stack ov!
fatal exception in a kernel task or stack overflow!
24 C, Ave Disk Temp: 23 C, Fan Speed =  1, Sampling Period = 36 sec
   C, Slot 1: 23 C, Slot 2: 23 C, Slot 3: 24 C,
  Slot 4: 24 C, Slot 5: 24 C, Slot 6: 24 C, Slot 7: 24 C,
  CPU Core Temp: 55 C, PMU Core Temp = 33 C
Temperature Thresholds for Disk:  Interest== 52, Warning== 55, Critical== 65 -- Override==F
Temperature Thresholds for CPU :  Interest== 95, Warning==101, Critical==104 -- Override==F
Temperature Thresholds for PMU :  Interest== 78, Warning== 82, Critical== 84 -- Override==F


It did not load the linux stuff. The device was not accessible and i had to reset the device in openocd using reset.

Reverseenginering the firmware flashing process or something like in the videos i mentioned above is way beyound my abilities.
So please let me know if you can provide files from a working device.

For now i will stop my experiments with this device.

[JimKnopf]

As i mentioned earlier "working with address and size values is hard to me". I had a address mismatch in my load_image command in openocd. In #openocd IRC channel (LibraChat) some nice guy informed me that my load address should be:
0x02000000 instead of:
0x20000000

He also told me not to load the firmware file or ELF files as elf format but as bin format in openocd.
This time i could load an image:

Code: [Select]

halt
load_image /home/<user>/<some_path>/22c.ELF 0x02000000 bin
resume
It was successfully loaded to 0x02000000.
In Marvell u-boot i tried:

Code: [Select]

bootvx 0x02000000
It started to load the image from 0x02000000 but stuck after some lines:

Code: [Select]

Executing: bootvx 0x02000000
## Ethernet MAC address not copied to NV RAM
## Using bootline (@ 0x1100): neta(3,0) f=0x6000 o=usb0:eth3:cpus=1:mem=0x20000000;MAC3-00e
## Starting vxWorks at 0x01000000 ...

After some trial and errors i found out, i have to load an image in openocd, use bootvx in u-boot, switch back to openocd and resume at the load address like this:

Code: [Select]

In openocd:
halt
load_image /home/<user>/<some_path>/22c.ELF 0x02000000 bin
resume

     switch to Marvell u-boot:
     td_bootargs_confab; bootvx 0x02000000     (wait until it get stuck)

switch back to openocd:
halt
resume 0x020000000

And it loads the extracted ELF file from firmware file. I even could load the whole firmware file in openocd and use bootvx with an offset of 0x22c. The ELF image starts at 0x22c in the firmware file. To my surprise, i also could load the vxworks image i dumped from the device. At the end of the boot process i ended up in a vxworks shell with very limited commands.

Code: [Select]

help

List of the registered topics:
EDR                 List of the shell commands related to ED&R.
RTP                 List of the shell commands related to RTP.
SD                  List of the shell commands related to shared data regions.
SHL                 List of the shell commands related to shared library.
VM                  List of the shell commands related to virtual memory.
address_space       List of the shell commands related to address space.
basic               List of basic shell commands.
breakpoint          List of the shell commands related to breakpoints.
esa                 Commands for the ESA array.
filesystem          List of the shell commands related to file system.
history             List of commands relative to history management.
interpreter         Interpreter shell commands.
k                   Drobo specific commands for the kernel.
memory              List of the shell commands related to memory.
mmap                List of the shell commands related to memory mapped objects.
modules             List of the shell commands related to kernel modules.
network             Network commands
object              List of the shell commands related to objects.
symbols             List of the shell commands related to symbols.
tasks               List of the shell commands related to tasks.

List of the registered commands:
C                   Switch to C interpreter
adrsp               Display information on the address space.
alias               Add an alias or display alias
bp                  Display, set or unset a breakpoint
cd                  Change current directory.
demangle            Display demangled string
dprintf             Insert a dynamic printf eventpoint
echo                Display a line of text
edr ...
esa                 Wrapper command to pass commands through to the esa array
                    user app
exit                Exit the shell session.
expr                Evaluate expressions
file ...
func ...
getenv              Get an environment variable
help                Display the list of the shell commands
history ...
ifconfig            IPNET interface configuration
k ...
logout              Logout the shell session.
lookup              Lookup a symbol
mem ...
mmap ...
module ...
more                Browse and page through a text file.
object ...
ping                IPNET ping utility
print ...
printf              Write formatted output
pwd                 Display current working directory.
reboot              Reboot the system
repeat              Repeat a command
route               IPNET route table control
rtp ...
sd ...
set ...
setenv              Set an environment variable
shl ...
show ...
slab                Print slab cache information
sleep               Suspend execution for an interval.
string ...
syscall ...
syscalls            Display system call group information in the system.
sysctl              IPNET sysctl configuration
task ...
unalias             Remove an alias
unset ...
version             Display VxWorks version information.
vm ...

The linux side did not load this way. I only had the vxworks shell. I found some interesting commands and files.

Code: [Select]

show devices
drv name               
  0 /null               
  1 /tyCo/0             
  1 /tyCo/2             
  1 /tyCo/3             
  2 diagLog             
  8 /proc               
10 bootHost:           
11 /vio               
12 /tgtsvr             
13 /ESA_REGISTER       
14 fl                 
  4 /bd0               
15 /lxdmesg           
15 /lxiscsitgtlog     
15 /lxcrashlog         
15 /lxlastbootlog     
15 /lxiscsitgtcore     
16 /networkinfo       
17 /serialnuminfo     


Code: [Select]

ls /bd0
/bd0/vxWorks
/bd0/LxImage
/bd0/Crashlogs
/bd0/NoCrashMsg
/bd0/hibLog
/bd0/hibHdr
/bd0/amitLog
/bd0/bootCount
/bd0/eventLog
/bd0/hdr_prev
/bd0/RebootReason
/bd0/VXI2.bin
/bd0/UBHW.bin
/bd0/UBHW.hdr
/bd0/hdr
/bd0/LxHdr
/bd0/VXI2.hdr
/bd0/vxWorks_prev
/bd0/LxImage_prev
/bd0/LxHdr_prev
/bd0/RTPI.bin
/bd0/RTPI.hdr
/bd0/LXFS.bin
/bd0/LXFS.hdr

I replaced all files where i had a _prev version of a file:

Code: [Select]

file move LxImage LxImage-orig
file move vxWorks vxWorks-orig
file move LxHdr LxHdr-orig
file move hdr hdr-orig

file copy LxImage_prev LxImage
file copy vxWorks_prev vxWorks
file copy LxHdr_prev LxHdr
file copy hdr_prev hdr

I found out that i could execute .bin files from this directory.
In openocd i did a reset and the device startet vxworks AND linux!

Code: [Select]

[vxWorks *]# version
VxWorks (for Marvell Sheeva 88SV584x, Board= Heatwave 1.0 ARMARCHV7 LE core) version 6.8.
Kernel: WIND version 2.13.
Made on Feb  3 2016, 20:45:55.
Boot line:
neta(3,0) f=0x6000 o=usb0:eth3:cpus=1:mem=0x20000000;MAC3-00:50:43:11:89:dd;SER-DRB143602000000 s=#/romfs/runesa.vxe


Code: [Select]

Drobo:/ # uname -a
Linux Drobo 3.2.96-3 #1 SMP Wed Sep 9 12:29:26 UTC 2020 armv7l GNU/Linux

The downside is, still no network service running. But both shells working and (one) green light on the device.
Both bootlogs are attached.

I searched for older firmware files and found two using the wayback archive (https://web.archive.org/web/20200923005204/https://www.drobo.com/docs/start-drobo-b810i/):

The failed update version was 2.0.1. I found Version

2-0-0 https://web.archive.org/web/20200923005204/https://www.drobo.com/docs/start-drobo-b810i/  and
1-3-5 https://web.archive.org/web/20170716181543/http://files.drobo.com/webrelease/b810i/B810i_Firmware_1-3-5.zip

I was able to load both firmware files and boot with the offset for the first ELF image. The trick did not work with an offset for the second ELF image in the firmware files.




 

[JimKnopf]

I compared the md5sum of the files i dumped from the vxworks side with the 3 firmware files:

Code: [Select]

Drobo filedump
MD5 4639529020298b3671d3517c10c09522  vxi2.bin =     22c.ELF found in release.B810i.2-0-1.tdf (first ELF image)
MD5 40104317c0dbdd43e84df334dbc1fac6  lximage   = 12231fa.UImage found in release.B810i.2-0-1.tdf
MD5 e0a1c6d97bd614cfaaebed36c619d83e  rtpi.bin = 7578b6.ELF found in release.B810i.2-0-1.tdf (second ELF image)
MD5 1bf5585eb18318837a3d4fd4e6fb90a4  LxHdr = selection_0-22b found in release.B810i.2-0-1.tdf (right before the first ELF image)



drobo_2-0-1_extracted-parts# md5sum * [size in bytes]
+ 40104317c0dbdd43e84df334dbc1fac6  12231fa.UImage 3168928
624b46f91b061795ce641a36f096ed90  1528d16.JFFS2 11858012
+ 4639529020298b3671d3517c10c09522  22c.ELF 7698058
+ e0a1c6d97bd614cfaaebed36c619d83e  7578b6.ELF 11319620
+ 1bf5585eb18318837a3d4fd4e6fb90a4  selection_0-22b 556




drobo_2-0-0_extracted-parts# md5sum * [size in bytes]
ffe68f761c88d77cfed8df5d7619b3c3  11e355c.UImage 3168936
cd4881229a64f702a6e002aa9c3cb51b  14e9080.JFFS2 10330556
66fb7d8f75c09a7e99cf7910bd9da934  22c.ELF 7690876
955691ee15ebedc9f9fc6806c773d522  755ca8.ELF 11065524
497aca92106d4ae411af2e7f63e86e52  selection_0-22b 556


drobo_1-3-5_extracted-parts# md5sum *
cad166fb818c55767df926033faa4ef4  110c4f6.UImage 3750024
8ee2ed4a45a895bbbe6d7d0bedc7f772  149ff4a.JFFS2 25529652
5e96eae5bac03992bbfd82961bb67182  22c.ELF 7569558
d315b81c0eaf33b84a71e7be84638f65  7382c2.ELF 10306100
8be984ce60d9d34284116926b6edffab  selection_0-22b 556



openocd-dump_20231230# md5sum *
7351e5dadd74474690b1f014f3b69570  hdr 556
7351e5dadd74474690b1f014f3b69570  hdr_prev 556
4cabb259c8abf4a5adafe2aa07a982c5  hibhdr 512
+ 1bf5585eb18318837a3d4fd4e6fb90a4  LxHdr 556
+ 1bf5585eb18318837a3d4fd4e6fb90a4  LxHdr_prev         556
+ 40104317c0dbdd43e84df334dbc1fac6  lximage 3168928
+ 40104317c0dbdd43e84df334dbc1fac6  lximage_prev         3168928
+ e0a1c6d97bd614cfaaebed36c619d83e  rtpi.bin 11319620
1bf5585eb18318837a3d4fd4e6fb90a4  RTPI.hdr 556
9e30738c85838a54dea0271fd743bfca  runesa.vxe         10177608
ecfdbaed33efb962865e71d456349683  ubhw.bin 801272
7351e5dadd74474690b1f014f3b69570  UBHW.hdr 556
+ 4639529020298b3671d3517c10c09522  vxi2.bin 7698058
+ 1bf5585eb18318837a3d4fd4e6fb90a4  VXI2.hdr 556
e83b73a0859310cc8705fe1ad3dfb0d8  vxworks         17734472
e83b73a0859310cc8705fe1ad3dfb0d8  vxworks_prev         17734472

I found LxHdr, LxHdr,_prev, RTPI.hdr, VXI2.hdr are the same files, located at the beginning until 0x22c of the firmware file. VXI2.bin is the first ELF image in the firmware file. The second ELF image in the firmware file is RTPI.bin. The LxImage is the called UImage in the firmware file. The firmware contains one more data block, a JFFS2 part.
I didn't found the vxWorks stuff in the firmware files. I don't know if that part was ever updated.

[JimKnopf]

Accessing the files on the internal memory, which is only accessible on the vxworks side is waaaaayyyyyyy easier than i tought. It's not possible transfering data over network to the vxworks side. On Marvell U-boot i only have read access. But, during boot, it enables a internal usb drive. I re-checked the board. And there is a small daughterboard containing two memory chips. It is connected with 2x5 pinheader to the mainboard. One pin was removed.

It looked like an ordinary USB connector like the ones on a Desktop Mainboard. The daughterboard has a product label "Apacer". It turns out its a common SSD. I checked the pins on the pinheader and compared the voltage to a default USB port and it matches. Using a USB-A connector and some flying wires, it was immediately recognized as USB-drive on my Laptop.

I was able to replace VXI2.bin, LxHdr, RTPI.bin and LxImage with the matching sections from firmware file. LxHdr is needed because it contains a checksum for LxImage file (0-22c of firmware file). The firmware release 2-0-0 had same boot problem like the 2-0-1. But the content from firmware release 1-3-5 let the vxworks side boot. At the moment there is an error on the linux side. And still not recognized by Drobo Dashboard.

 

[JimKnopf]

I did some tests with u-boot settings and managed to freeze the Bootrom 1.2 because of header checksum mismatch.

To make things easier, i placed the MX25L6406E cmos serial flash outside the board and used flying wires to connect the IC-adapter to the board.

I also replaced the internal USB-SSD temporary with a Pi zero 2w. The advantage is, i don't need to plug/unplug the drive to copy files to the device. Using the pi zero as a usb drive, i can copy files via wifi. I copy files using sftp in linux (or WinSCP in windows).
The 9-pin USB connector (only the 4-pin row is used) has 2mm pitch wide. Default dupont connectors have 2,54mm pitch wide. I crimped flying wires to a JST-HX 4-pin connector.

Burning the cmos serial flash dump brought the device back to life.

[JimKnopf]

I managed to boot Firmware 1.3.5 and getting Drobo-Dashboard to recognize the device.
The App couldn't find an update server  and manual update failed for now. The solution with the wired-out SPI cmos flash and Pi-zero as Wifi-SSD is perfect. Easy to handle.

[JimKnopf]

I don't know why but i can't reproduce recognizing the Drobo by the Dashboard.

I will give up on that device. I found out some things, maybe it will help others.

The Marvell U-Boot on that device, which is located in the CMOS flash chip doesn't have the typical U-Boot Magic Number (27 05 19 56) and CRC32 checksum in the header (Byte 4 to 7). It starts with 5A. The ARMADA-XP-Functional-SpecDatasheet.pdf tells 0x5A = Boot from SPI/NOR flash. Have a look at the SpecDatasheet for more information.

If you corrupt the CMOS flash data, don't worry. There is a file on the internal USB-SSD called UBHW.bin (and the header file UBHW.hdr for it). Most probably UBHW means U-Boot Heatwave, a hint to the board name i guess. The binary contains the U-Boot data without environment data. The individual env settings are stored  at 0xd0000 to 0xdffff. If you dump the CMOS flash data, you can cut off the zeros after 0xe0000. The file is less than 1 MB.
To start the drobo, you need just LxImage and vxWorks files on the USB-SSD. Thats it.

I attached both log files (linux side and vxworks side) from last sunday when the drobo was recognized. You can see in the logfile what files i had on the USB-SSD.

The reason why i give up on the device is, it only starts with release 1-3-5 properly. The 2-0-0 and 2-0-1 releases won't start up. I think either vxWorks or Lximage (LXKI Linux Kernel Image) has wrong version to interact with the other side.

The LxImage starts with this mtd settings:

Code: [Select]

INFO: Found cfi_flash_0 0 - base 0xd8000000, size 0x8000000, bus 2
INFO: flashInfoFill - Found 1 Flash Devices
INFO: flash_map_init - detected 1 devices
MTD: Initialize the cfi_flash_0 device at address 0xd8000000
INFO: Io remapped successfully - phy addr = 0xd8000000, virt addr = 0xd9000000
INFO: Using cfi_probe to probe cfi_flash_0 at address 0xd8000000, size 0x8000000, width 2m
cfi_flash_0: Found 1 x16 devices at 0x0 in 16-bit bank. Manufacturer ID 0x000001 Chip ID 0x002801
Amd/Fujitsu Extended Query Table at 0x0040
Amd/Fujitsu Extended Query version 1.5.
number of CFI chips: 1
- detected OK
6 cmdlinepart partitions found on MTD device cfi_flash_0
Creating 6 MTD partitions on "cfi_flash_0":
0x000000000000-0x000000100000 : "nor_hdr"
0x000000100000-0x000000400000 : "var"
0x000000400000-0x000002200000 : "rfs0"
0x000002200000-0x000004000000 : "rfs1"
0x000004000000-0x000006000000 : "rfs2"
0x000006000000-0x000008000000 : "rfs3"
- OK.

That is a U-Boot env setting:

Code: [Select]

LxMtd=mtdparts=cfi_flash_0:1m@0m(nor_hdr),3m@1m(var),30m@4m(rfs0),30m@34m(rfs1),32m@64m(rfs2),32m@96m(rfs3)
And there is additionally  this line:

Code: [Select]

LxRoot=rootfstype=jffs2 root=/dev/mtdblock2 rw

With this settings, release 1-3-5 starts, but has an issue with rfs0 and therefore it can't mount /bin and /etc:

Code: [Select]

[1970-01-01,00:00:12.132085843] 10: INFO: Mounting /bin as rw
mount: mounting /tmp/bin on /bin failed: No such device
[1970-01-01,00:00:12.166910723] 10: ERROR: Failed to mount /bin as rw
[1970-01-01,00:00:12.185068643] 10: INFO: Mounting /etc as rw
mount: mounting /tmp/etc on /etc failed: No such device
[1970-01-01,00:00:12.219105483] 10: ERROR: Failed to mount /etc as rw

The whole logfile has errors like this:

Code: [Select]

chmod: /etc/monitrc: Read-only file system
awk: /etc/resolv.conf: No such file or directory
chmod: /etc/monitrc: Read-only file system

If i change

Code: [Select]

LxRoot=rootfstype=jffs2 root=/dev/mtdblock2 rw
to

Code: [Select]

LxRoot=rootfstype=jffs2 root=/dev/mtdblock3 rw
It starts without this Read-only errors. But it didn't recognized the drobo.
I also could set

Code: [Select]

setenv LxForceRootFS yes
It will force to use mtd3, no Read-only errors, but still not recognized.

When the drobo was recognized, it had this message in my logfile:

Code: [Select]

Sun Jan 14 13:37:44 2024: tCoreCtrl:  setLinuxCommonInfo: SUCCESS: Setting Serial Number Config. New serial number = dra160401c00313
Sun Jan 14 13:37:44 2024: tCoreCtrl:  Unexpected reboot - generate crash log from last boot logs
Sun Jan 14 13:37:44 2024: tCoreCtrl: copy iscsitgtlog.old to iscsitgtlog.crash
Sun Jan 14 13:37:59 2024: tCoreCtrl:  iSCSI stack ENABLE message received
Sun Jan 14 13:37:59 2024: tCoreCtrl:  Initializing network settings
Sun Jan 14 13:37:59 2024: tCoreCtrl:  InitializeNetworConfigEx: Called
Sun Jan 14 13:38:01 2024: tCoreCtrl:  iscsiTgtPortalUpdateIPAddress: Old Ipaddr: 0:0:0:0
Sun Jan 14 13:38:01 2024: tCoreCtrl:  iscsiTgtPortalUpdateIPAddress: Updated Portal Id: 0x11dd38 ipaddress length: 4
Sun Jan 14 13:38:01 2024: tCoreCtrl:  iscsiTgtPortalUpdateIPAddress: New Ipaddr: 169:254:4:0
Sun Jan 14 13:38:01 2024: tCoreCtrl:  iscsiTgtPortalUpdateIPAddress: Old Ipaddr: 0:0:0:0
Sun Jan 14 13:38:01 2024: tCoreCtrl:  iscsiTgtPortalUpdateIPAddress: Updated Portal Id: 0x11df30 ipaddress length: 4
Sun Jan 14 13:38:01 2024: tCoreCtrl:  iscsiTgtPortalUpdateIPAddress: New Ipaddr: 169:254:5:0
Sun Jan 14 13:38:01 2024: tCoreCtrl: File /var/discWhiteList not found. Allowing all hosts for discovery.
Sun Jan 14 13:38:01 2024: tCoreCtrl:  Starting Discovery!!
Sun Jan 14 13:38:01 2024: tIscsiMgr:  Setting SO_BINDTODEVICE, for device eth0
Sun Jan 14 13:38:01 2024: tCoreCtrl:  *************** sending stack UP across icore ***************
Sun Jan 14 13:38:01 2024: tIscsiMgr:  Setting SO_BINDTODEVICE, for device eth1
Sun Jan 14 13:38:01 2024: tDiscListen: Discovery: Listener loop starting
Sun Jan 14 13:38:01 2024: tDiscAgent: Discovery: Agent starting
Sun Jan 14 13:38:02 2024: tDiscListen: Added client info for 192.168.10.43:65359 (flags 0x3e, 0x3e)
Sun Jan 14 13:38:02 2024: tDiscListen: Client info received from host: IP: 192.168.10.43 Port: 65359 (iqn.1991-05.com.microsoft:sls2 2b0aa8c0-32646)
Sun Jan 14 13:38:02 2024: tDiscListen: QueueWaitingHost: Found host 192.168.10.43 on port 65359
Sun Jan 14 13:38:05 2024: tEMPDConn00000: EMPDConnection::Starting thread tEMPDConn00000 and clientID SLS231727.0000028690
Sun Jan 14 13:38:05 2024: tEMPDConn00000: EMPDListener::AddConnection - for SLS231727 NEW (192.168.10.43 7876 via )
Sun Jan 14 13:38:05 2024: tHBConn00000: HBConnection: Starting thread tHBConn00000 and clientID SLS231727.0000028690
Sun Jan 14 13:38:05 2024: tHBConn00000: HBConnection::Start- The Unique ID received is : 0000028690
 Sun Jan 14 13:38:05 2024: tHBConn00000: HBConnection::Start- The host ID received is : SLS231727
Sun Jan 14 13:38:05 2024: tHBConn00000: HBConnection::Start- Received new connection!!
Sun Jan 14 13:38:05 2024: tHBConn00000:  HBConnection::Start- Now starting to send heart beat messages -

I tried Drobo-Dashboard 3.5.0 and the older 2.6.4 on Windows. If i manually set the IP for the Drobo, it never find it. There is always an error message about incomplete header like this:

Code: [Select]

chmod: /etc/monitrc: Read-only file system
chmod: /etc/monitrc: Read-only file system
chmod: /etc/monitrc: Read-only file system
Thu Jan 18 15:23:24 2024: tEMPDConn00000: EMPDConnection: did not receive complete header! (recv len 0, hdr len 47, error 0)
Thu Jan 18 15:23:24 2024: tEMPDConn00000: EMPDConnection: Error 0 receiving login header.
Thu Jan 18 15:23:24 2024: tEMPDConn00000: EMPDConnection: Cleaning up thread tEMPDConn00000 for host  with UID
 Thu Jan 18 15:23:24 2024: tEMPDConn00000: HBListener::SetupCleanup for 
Thu Jan 18 15:23:24 2024: tEMPDConn00000: HBListener::SetupCleanup for . Done
Thu Jan 18 15:23:24 2024: tEMPDConn00000: EMPDListener::RemoveConnection - for 
chmod: /etc/monitrc: Read-only file system
chmod: /etc/monitrc: Read-only file system
chmod: /etc/monitrc: Read-only file system

I sniffed the packet with wireshark but couldn't find any suspicious fault in the data. I  don't have a working datastream for comparison.

I also tried tricks i found somewhere like using nc to redirect port 5002 to the drobo with this command without success:

Code: [Select]

nc -lvu 5002 | nc 192.168.10.72  (Drobo ip)

[JimKnopf]

I tried one last thing because of the "Read-only file system" error message on mtdblock1.
The 128 MB NOR-flash chip (Spansion S29GL01GS10TFI01) is on the backside of the mainboard. The internal USB-SSD has all the system files on it like vxWorks, the LxImage that starts every time from USB-SSD and LXFS which is a JFFS2 filesystem. I thought, what if i erase the NOR-flash. Maybe something is wrong with the data and therefore mtdblock2 can't be mounted. I desoldered the 56 pin NOR-flash and dumped the data using a RT809H programmer and compard the data with my two memory dumps i did earlier using openocd. The openocd dumps had 3 JFFS2 sections. The dump from RT809H programmer had 7 JFFS2 sections.

After erasing the chip, the Linux side didn't came up because it couldn't init the NOR-flash.

Code: [Select]

2.164160] md: Waiting for all devices to be available before autodetect
[    2.170982] md: If you don't use raid, use raid=noautodetect
[    2.177276] md: Autodetecting RAID arrays.
[    2.181399] md: Scanned 0 and added 0 devices.
[    2.185857] md: autorun ...
[    2.188657] md: ... autorun DONE.
[    2.215786] JFFS2 notice: (1) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found.
[    2.231091] VFS: Mounted root (jffs2 filesystem) on device 31:3.
[    2.237291] Freeing init memory: 240K
[    2.241015] Kernel panic - not syncing: No init found.  Try passing init= option to kernel. See Linux Documentation/init.txt for guidance.
[    2.253499] CPU0: stopping
[    2.256215] Backtrace:
[    2.258701] [<80011acc>] (dump_backtrace+0x0/0x10c) from [<8055958c>] (dump_stack+0x18/0x1c)
[    2.267166]  r7:8074bf8c r6:fbb21000 r5:00000000 r4:807958dc
[    2.272899] [<80559574>] (dump_stack+0x0/0x1c) from [<800132dc>] (handle_IPI+0x108/0x184)
[    2.281106] [<800131d4>] (handle_IPI+0x0/0x184) from [<80008394>] (do_IPI+0x10/0x14)
[    2.288873]  r5:60000013 r4:8000f090
[    2.292488] [<80008384>] (do_IPI+0x0/0x14) from [<8055c8b4>] (__irq_svc+0x34/0xe8)
[    2.300082] Exception stack(0x8074bf58 to 0x8074bfa0)
[    2.305150] bf40:                                                       0000001f 807562fc
[    2.313357] bf60: 8074bf90 80018ea4 8074a000 8075c36c 807956c4 8056721c 2000406a 562f5842
[    2.321565] bf80: 00000000 8074bfbc 8074bfa0 8074bfa0 8000ec5c 8000f090 60000013 ffffffff
[    2.329774] [<8000f008>] (cpu_idle+0x0/0xcc) from [<8054ef34>] (rest_init+0x64/0x7c)
[    2.337541]  r7:8075c364 r6:80738a40 r5:00000000 r4:80756e84
[    2.343274] [<8054eed0>] (rest_init+0x0/0x7c) from [<8070c89c>] (start_kernel+0x204/0x240)
[    2.351569] [<8070c698>] (start_kernel+0x0/0x240) from [<20008040>] (0x20008040)
[    2.358990] CPU2: stopping
[    2.361705] Backtrace:
[    2.364184] [<80011acc>] (dump_backtrace+0x0/0x10c) from [<8055958c>] (dump_stack+0x18/0x1c)
[    2.372648]  r7:b1119fac r6:fbb21000 r5:00000002 r4:807958dc
[    2.378377] [<80559574>] (dump_stack+0x0/0x1c) from [<800132dc>] (handle_IPI+0x108/0x184)
[    2.386585] [<800131d4>] (handle_IPI+0x0/0x184) from [<80008394>] (do_IPI+0x10/0x14)
[    2.394351]  r5:60000013 r4:8000f090
[    2.397965] [<80008384>] (do_IPI+0x0/0x14) from [<8055c8b4>] (__irq_svc+0x34/0xe8)
[    2.405558] Exception stack(0xb1119f78 to 0xb1119fc0)
[    2.410626] 9f60:                                                       00000021 807562fc
[    2.418834] 9f80: b1119fb0 80018ea4 b1118000 8075c36c 807956c4 8056721c 2000406a 562f5842
[    2.427042] 9fa0: 00000000 b1119fdc b1119fc0 b1119fc0 8000ec5c 8000f090 60000013 ffffffff
[    2.435251] [<8000f008>] (cpu_idle+0x0/0xcc) from [<8055698c>] (secondary_start_kernel+0x140/0x164)
[    2.444324]  r7:807958e4 r6:10c03c7d r5:00000015 r4:00000004
[    2.450050] [<8055684c>] (secondary_start_kernel+0x0/0x164) from [<20556494>] (0x20556494)
[    2.458340]  r5:00000015 r4:5112006a
[    2.461949] shared_mem_panic_event: Kernel panic event handler called. Notifying VxWorks Core of Kernel panic.

As you can see in the image, there are 16 Bytes (0x0 - 0x1f) at the beginning before a large empty block. After inserting the 16 bytes  (i desoldered/resoldered the chip six times) the system started with errors, missing Magic Bytes at specific offset addresses.
It didn't work this way. I put all dumped data back on the NOR-flash to get the system status i already had before.