Drobo B810i NAS half bricked after failed firmware update - Page 1
Forum section: electronics / repair

author: JimKnopf
author_rank: Frequent Contributor
timestamp: December 17, 2023, 08:37:02 pm
content: I got a half bricked Drobo B810i NAS here to fix failed firmware update (https://files.drobo.com/webrelease/b810i/B810i_Firmware_2-0-1.zip). Need some help from either U-Boot or openocd heros. Drobo users are welcome. I never had a Drobo in my hands before. I was able to rescue some other devices by just flashing the firmware on eprom via programmer or by using jtag interface. But this Drobo NAS is hard to fix.Best solution i guess would be a flash memory dump from a working device. If you can provide one, please contact me.Device behavior:I can't find the device via Drobo GUI (https://files.drobo.com/webrelease/dashboard/drobodashboardinstaller_3.5.0.exe). Nmap doesn't show any open port. The only info i have is, it failed to start after firmware update.The device turns on, gets an ip via dhcp but no interaction via network possible from outside.I opened the device to find two suspicious looking pin headers and 2x10 pin holes. The pin headers are UART serial ports. Both are active at 115200 8N1. To my surprise, one starts a Marvell U-Boot process which loads VxWorks. It stops at some point and the other UART port gets active, showing a linux boot process with a root shell at the end. There are two eprom IC's. I desoldered both and dumped the content.Both boot logs are attached. The CPU is a Marvell Armada XP Sheeva SoC:Code:Marvell PJ4B (584) v7 (Rev 2) LE (cat /proc/cpuinfo tells PJ4Bv7 rev 2 (v71)),Description: SOC ARMADA XP ARM7 732-Pin FCBGA, (Sheeva)MV78-BJR2P35V110.11528 B0EMV78460-B0 C120SoC MV88F7846 Rev 8 / 562f5842Board DB-78460-BP rev 2.0Drobo version kyten-uboot-2.33On the VxWorks UART port i dont have a shell, but i can stop the boot process to enter the u-boot shell with very limited commands. It's not the u-boot main line shell. A log with available commands and a printenv is attached. No ethernet port is available in u-boot. I found some files using fatls and dumped the files:Code:Marvell>> fatls usb 0:117734472 vxworks3168928 lximagecrashlogs/224 nocrashmsg0 hiblog512 hibhdr48 amitlog4 bootcount1024004 eventlog556 hdr_prev256 rebootreason7698058 vxi2.bin801272 ubhw.bin556 ubhw.hdr556 hdr556 lxhdr556 vxi2.hdr17734472 vxworks_prev3684024 lximage_prev556 lxhdr_prev11319620 rtpi.bin556 rtpi.hdr31457280 lxfs.bin556 lxfs.hdrTo dump files on u-boot i used (for example):Code:fatload usb 0:1 20000000 vxworks_prevmd.b 20000000 <size of content in bytes>On the linux UART port, i can start telnetd and dropbear. But can't login as root. I don't know what secrets are waiting here. Maybe i can rescue the system from here?The 2x10 pin holes looked like an arm default connector. I added pin headers and hooked my j-link on it with no luck on either jlink or openocd.I figured out the needed config files for my olimex tiny-h and openocd. The default config let me halt the system but i couldn't reset the cpu.The config files are attached. Rename it from .txt to cfg if you want to use it.Code:openocd -d1 -f interface//olimex-arm-usb-tiny-h.cfg -f target/armada370.cfgAfter figuring out to circumvent the reset problem, i had to learn, that my dumped files had wrong byte order. I first converted the dump using xxd. But it's easier to use "-endian little" in the target config file to fix this.I read the ARMADA-XP-Functional-SpecDatasheet (https://datasheet.datasheetarchive.com/originals/crawler/marvell.com/002fa441a27967d992f905776d519926.pdf) and foundCode:Table 11: MMU Virtual-to-Physical Address Translation TableDevicePhysical AddressVirtual AddressSizeCachingSDRAM0x00x01 GBNon-CachableL2-SRAM0x400000000x400000001 MBCachablePCI-Express0x800000000x80000000640 MBNon-CachableCESA SRAM0xC80000000xC80000001 MBNon-CachableInternal Register0xD00000000xD00000001 MBNon-CachableNOR Flash0xD80000000xD8000000128 MMNon-CachableSPI Flash0xD40000000xD400000064 MBCachableDevice Bus0xD38000000xD3800000711 MBNon-CachableBootROM0xFFF000000xFFF000001 MBCachableI dumped the spi flash again, this time via jtag to compare the content:Code:initreset haltdump_image B810i-8MB-spi-rom.bin 0xD4000000 0x800000Since i'm not a programmer or IT specialist in general, working with address and size values is hard to me.I just used python to calculate the values by just enter it in the python prompt. The MX25L6406E is a 64Mbit SPI flash, providing 8 MB of memory. 8 MB x 2^20 = 8388608 byte decimal. The get the hex value i enter in python prompt:Code:>>> hex(8388608)And get 0x800000 as result ( I learned, to get the decimal size from a hex value, just use 0x800000 in python. Be aware this works for the size, you have to subtract -1 from this value when you calculate address space because counting starts at 0. 8388608-1 = 8388607 will give you 0x7fffff as end-address).To better compare the dump i grabbed via jtag, i used hexdump -v for both files, the jtag dump and the programmer dump of the SPI flash and compared them using diff.I did the same with the 128 MB NOR-flash. Sadly i couldn't find it's content in the firmware file. The firmware-file has .tdf file extension.Binwalk show me some complex content:Code:binwalk release.B810i.2-0-1.tdfDECIMAL HEXADECIMAL DESCRIPTION--------------------------------------------------------------------------------556 0x22C ELF, 32-bit LSB executable, ARM, version 1 (ARM)2537455 0x26B7EF mcrypt 2.2 encrypted data, algorithm: blowfish-448, mode: CBC, keymode: 4bit3119831 0x2F9AD7 Neighborly text, "NeighborCacheToLivenet.inet.IcmpRatelimitBucketsize"3129084 0x2FBEFC Unix path: /home/buildtest/WindRiver_Vx6.8.3/vxworks-6.8/target/config/comps/src/usrMmuInit.c3201803 0x30DB0B Copyright string: "Copyright 1995-2005 Jean-loup Gailly "3209995 0x30FB0B uuencoded data, file name: "%s", file permissions: "644"3243227 0x317CDB Neighborly text, "NeighborCacheToLives does not appear to be attached"3310242 0x3282A2 LZMA compressed data, properties: 0x64, dictionary size: -2147483648 bytes, uncompressed size: 191 bytes3377101 0x3387CD Copyright string: "Copyright Wind River Systems, Inc., 1984-2012"3453504 0x34B240 VxWorks WIND kernel version "2.13"3756176 0x395090 StuffIt Deluxe (data): TDList3756659 0x395273 StuffIt Deluxe (data): TDs3756766 0x3952DE StuffIt Deluxe (data): TD3756919 0x395377 StuffIt Deluxe (data): TDs3757433 0x395579 StuffIt Deluxe (data): TD3757537 0x3955E1 StuffIt Deluxe (data): TDData3887780 0x3B52A4 Intel x86 or x64 microcode, sig 0x013b3d9c, pf_mask 0x1361b7f, 1B79-01-36, rev 0x0001, size 35212665 0x4F89F9 Unix path: /home/buildtest/WindRiver_Vx6.8.3/vxworks-6.8/target/config/comps/src/dataSegPad.c5436987 0x52F63B PARity archive data - file number 295405759546 0x57E23A Unix path: /home/buildtest/WindRiver_Vx6.8.3/vxworks-6.8/target/config/comps/src/version.c5875588 0x59A784 PARity archive data - file number 249436590393 0x648FB9 Unix path: /home/buildtest/WindRiver_Vx6.8.3/vxworks-6.8/target/h/types6593974 0x649DB6 Unix path: /home/buildtest/WindRiver_Vx6.8.3/vxworks-6.8/target/h/types6594607 0x64A02F Unix path: /home/buildtest/WindRiver_Vx6.8.3/vxworks-6.8/target/h6604113 0x64C551 Unix path: /home/buildtest/WindRiver_Vx6.8.3/vxworks-6.8/target/h/base6604527 0x64C6EF Unix path: /home/buildtest/WindRiver_Vx6.8.3/vxworks-6.8/target/h/base6606244 0x64CDA4 Unix path: /home/buildtest/WindRiver_Vx6.8.3/vxworks-6.8/target/h/private6609213 0x64D93D Unix path: /home/buildtest/WindRiver_Vx6.8.3/vxworks-6.8/target/config/comps/src6612136 0x64E4A8 Unix path: /home/buildtest/WindRiver_Vx6.8.3/vxworks-6.8/target/h/types/vxWindCommon.h6614894 0x64EF6E Unix path: /home/buildtest/WindRiver_Vx6.8.3/vxworks-6.8/target/h/types/vxWindCommon.h6617233 0x64F891 Unix path: /home/buildtest/WindRiver_Vx6.8.3/vxworks-6.8/target/h/types/vxWindCommon.h6619091 0x64FFD3 Unix path: /home/buildtest/WindRiver_Vx6.8.3/vxworks-6.8/target/h/stdio.h6619590 0x6501C6 Unix path: /home/buildtest/WindRiver_Vx6.8.3/vxworks-6.8/target/h/types/vxWindCommon.h6620819 0x650693 Unix path: /home/buildtest/WindRiver_Vx6.8.3/vxworks-6.8/target/h/types/vxWindCommon.h6621968 0x650B10 Unix path: /home/buildtest/WindRiver_Vx6.8.3/vxworks-6.8/target/h/shellInterpCmdLib.h6622200 0x650BF8 Unix path: /home/buildtest/WindRiver_Vx6.8.3/vxworks-6.8/target/h/sysLib.h6622371 0x650CA3 Unix path: /home/buildtest/WindRiver_Vx6.8.3/vxworks-6.8/target/h/types/vxWindCommon.h6624233 0x6513E9 Unix path: /home/buildtest/WindRiver_Vx6.8.3/vxworks-6.8/target/h/types/vxWindCommon.h6626207 0x651B9F Unix path: /home/buildtest/WindRiver_Vx6.8.3/vxworks-6.8/target/h/types/vxWindCommon.h6627736 0x652198 Unix path: /home/buildtest/WindRiver_Vx6.8.3/vxworks-6.8/target/h/types/vxWindCommon.h6628927 0x65263F Unix path: /home/buildtest/WindRiver_Vx6.8.3/vxworks-6.8/target/h/ctype.h6629111 0x6526F7 Unix path: /home/buildtest/WindRiver_Vx6.8.3/vxworks-6.8/target/h/types/vxWindCommon.h6634433 0x653BC1 Unix path: /home/buildtest/WindRiver_Vx6.8.3/vxworks-6.8/target/h/types/vxWindCommon.h6637208 0x654698 Unix path: /home/buildtest/WindRiver_Vx6.8.3/vxworks-6.8/target/h/types/vxWindCommon.h6638776 0x654CB8 Unix path: /home/buildtest/WindRiver_Vx6.8.3/vxworks-6.8/target/h/types/vxWindCommon.h6639712 0x655060 Unix path: /home/buildtest/WindRiver_Vx6.8.3/vxworks-6.8/target/h/types/vxWindCommon.h6641724 0x65583C Unix path: /home/buildtest/WindRiver_Vx6.8.3/vxworks-6.8/target/h/types/vxWindCommon.h6643254 0x655E36 Unix path: /home/buildtest/WindRiver_Vx6.8.3/vxworks-6.8/target/h/types/vxWindCommon.h6645267 0x656613 Unix path: /home/buildtest/WindRiver_Vx6.8.3/vxworks-6.8/target/h/types/vxWindCommon.h6646950 0x656CA6 Unix path: /home/buildtest/WindRiver_Vx6.8.3/vxworks-6.8/target/h/types/vxWindCommon.h6648413 0x65725D Unix path: /home/buildtest/WindRiver_Vx6.8.3/vxworks-6.8/target/h/types/vxWind.h6649544 0x6576C8 Unix path: /home/buildtest/WindRiver_Vx6.8.3/vxworks-6.8/target/h/types/vxWindCommon.h6652174 0x65810E Unix path: /home/buildtest/WindRiver_Vx6.8.3/vxworks-6.8/target/h/types/vxWindCommon.h6654945 0x658BE1 Unix path: /home/buildtest/WindRiver_Vx6.8.3/vxworks-6.8/target/h/types/vxWindCommon.h6658657 0x659A61 Unix path: /home/buildtest/WindRiver_Vx6.8.3/vxworks-6.8/target/h/types/vxWindCommon.h6660516 0x65A1A4 Unix path: /home/buildtest/WindRiver_Vx6.8.3/vxworks-6.8/target/h/types/vxWindCommon.h6663594 0x65ADAA Unix path: /home/buildtest/WindRiver_Vx6.8.3/vxworks-6.8/target/h/types/vxWindCommon.h6665437 0x65B4DD Unix path: /home/buildtest/WindRiver_Vx6.8.3/vxworks-6.8/target/h/types/vxWindCommon.h6666841 0x65BA59 Unix path: /home/buildtest/WindRiver_Vx6.8.3/vxworks-6.8/target/h/types/vxWindCommon.h6669902 0x65C64E Unix path: /home/buildtest/WindRiver_Vx6.8.3/vxworks-6.8/target/h/types/vxWindCommon.h6671719 0x65CD67 Unix path: /home/buildtest/WindRiver_Vx6.8.3/vxworks-6.8/target/h/types/vxWindCommon.h6677727 0x65E4DF Unix path: /home/buildtest/WindRiver_Vx6.8.3/vxworks-6.8/target/h/types/vxWindCommon.h6680176 0x65EE70 Unix path: /home/buildtest/WindRiver_Vx6.8.3/vxworks-6.8/target/h/types/vxWindCommon.h6682160 0x65F630 Unix path: /home/buildtest/WindRiver_Vx6.8.3/vxworks-6.8/target/h/types/vxWindCommon.h6684011 0x65FD6B Unix path: /home/buildtest/WindRiver_Vx6.8.3/vxworks-6.8/target/h/types/vxWindCommon.h6686322 0x660672 Unix path: /home/buildtest/WindRiver_Vx6.8.3/vxworks-6.8/target/h/types/vxWindCommon.h6688411 0x660E9B Unix path: /home/buildtest/WindRiver_Vx6.8.3/vxworks-6.8/target/h/types/vxWindCommon.h6689449 0x6612A9 Unix path: /home/buildtest/WindRiver_Vx6.8.3/vxworks-6.8/target/h/types/vxWindCommon.h6691360 0x661A20 Unix path: /home/buildtest/WindRiver_Vx6.8.3/vxworks-6.8/target/h/types/vxWindCommon.h6692850 0x661FF2 Unix path: /home/buildtest/WindRiver_Vx6.8.3/vxworks-6.8/target/h/types/vxWindCommon.h7099515 0x6C547B Intel x86 or x64 microcode, sig 0x171f8000, pf_mask 0xe00, 1C00-01-05, rev 0x1000000, size 17105579 0x6C6C2B Intel x86 or x64 microcode, pf_mask 0x11ff, 1F00-01-12, rev 0x1000000, size 17105947 0x6C6D9B Intel x86 or x64 microcode, sig 0x1850e000, pf_mask 0x1133200, 1B00-01-13, rev 0x1000000, size 1126417113627 0x6C8B9B Intel x86 or x64 microcode, pf_mask 0x11ff, 1C00-01-21, rev 0x1000000, size 17114059 0x6C8D4B Intel x86 or x64 microcode, pf_mask 0x11ff, 1A00-01-22, rev 0x1000000, size 17114475 0x6C8EEB Intel x86 or x64 microcode, pf_mask 0x11ff, 1C00-01-23, rev 0x1000000, size 17115579 0x6C933B Intel x86 or x64 microcode, pf_mask 0x11ff, 1900-01-25, rev 0x1000000, size 17116683 0x6C978B Intel x86 or x64 microcode, sig 0x1a59c800, pf_mask 0x1283200, 2000-01-28, rev 0x1000000, size 1751057231995 0x6E59FB Intel x86 or x64 microcode, sig 0x270cf000, pf_mask 0x2042900, 1C00-02-04, rev 0x1001200, size 696337234923 0x6E656B Intel x86 or x64 microcode, sig 0x0b197800, pf_mask 0x2112f00, 1A00-02-11, rev 0x1001200, size 10257481721 0x722979 StuffIt Deluxe (data): TD7481737 0x722989 StuffIt Deluxe (data): TD7481777 0x7229B1 StuffIt Deluxe (data): TD7481829 0x7229E5 StuffIt Deluxe (data): TD7520182 0x72BFB6 StuffIt Deluxe (data): TD7548080 0x732CB0 StuffIt Deluxe (data): TD7586280 0x73C1E8 StuffIt Deluxe (data): TDList7598715 0x73F27B StuffIt Deluxe (data): TDData7672522 0x7512CA StuffIt Deluxe (data): TDs7693403 0x75645B StuffIt Deluxe (data): TDs7698614 0x7578B6 ELF, 32-bit LSB executable, ARM, version 1 (ARM)13807918 0xD2B12E Ubiquiti firmware additional data, name: UTED, size: 1634159721 bytes, size2: 1937001583 bytes, CRC32: 014211981 0xD8DB8D Copyright string: "Copyright 1995-2005 Jean-loup Gailly "14218058 0xD8F34A CRC32 polynomial table, little endian14222154 0xD9034A CRC32 polynomial table, big endian14228929 0xD91DC1 Copyright string: "Copyright 1995-2005 Mark Adler "14785144 0xE19A78 Intel x86 or x64 microcode, sig 0x7c6c0000, pf_mask 0x904802c0, 1901-04-28, rev 0x-10000, size 415035498 0xE56C6A Copyright string: "Copyright (c) 1992-2002 by P.J. Plauger, licensed by Dinkumware, Ltd. ALL RIGHTS RESERVED."15037214 0xE5731E Copyright string: "Copyright (c) 1992-2002 by P.J. Plauger, licensed by Dinkumware, Ltd. ALL RIGHTS RESERVED."18825010 0x11F3F32 Private key in DER format (PKCS header length: 4, sequence length: 2585619018234 0x12231FA uImage header, header size: 64 bytes, header CRC: 0xE53864B7, created: 2020-09-09 12:29:44, image size: 3168864 bytes, Data Address: 0x20008000, Entry Point: 0x20008000, data CRC: 0xE3EC93A1, OS: Linux, CPU: ARM, image type: OS Kernel Image, compression type: none, image name: "Linux-3.2.96-3"19018298 0x122323A Linux kernel ARM boot executable zImage (little-endian)19036286 0x122787E gzip compressed data, maximum compression, from Unix, last modified: 1970-01-01 00:00:00 (null date)22187162 0x1528C9A JFFS2 filesystem, little endianMy intention at the beginning was, just flash the firmware file. But it seems some magic is needed.@tv84@DavidAlfaAny hint how to move forward?Any help is welcome.

author: fzabkar
author_rank: Super Contributor
timestamp: December 17, 2023, 09:23:24 pm
content: Could you upload your two flash dumps?

author: JimKnopf
author_rank: Frequent Contributor
timestamp: December 17, 2023, 09:28:51 pm
content: Uploading here might be a problem. But i can send you a PM with a wetransfer link.

author: fzabkar
author_rank: Super Contributor
timestamp: December 17, 2023, 09:34:08 pm
content: Quote from: JimKnopf on December 17, 2023, 09:28:51 pmOK, as long as I don't have to sign up for anything.

author: fzabkar
author_rank: Super Contributor
timestamp: December 17, 2023, 11:14:21 pm
content: These are my initial observations:This is the header of the TDF payload (0x22C bytes):Code:Offset(h) 00 04 08 0C 10 1400000000 0000022C 00000005 54444948 002BC66B 48656174 77617665 ........TDIH....Heatwave^^^^^^^^size of header = 0x22C00000018 00000000 00000000 00000000 00000000 00000000 03328A6E ........................^^^^^^^^size of payload, excluding header = 0x3328A6E00000030 A6D95511 44617461 20526F62 6F746963 73204669 726D7761 ....Data Robotics Firmwa00000048 72650000 00000000 00000000 00000000 00000000 00000000 re......................00000060 00000000 00000000 00000000 00000000 00000000 00000000........00000108 00000000 00000000 00000000 00000000 00000000 0000000000000120 00000000 00000000 00000000 00000000 00000000 6134BF8B00000138 BD413911 00000000 00000000 00000000 00000000 0000000000000150 00000000 00000000 0000002B 0001C66B 00000000 0000000100000168 00000004 56584932 00000000 0075768A 00000000 002BC66B ....VXI2................^^^^^^^^ ======== -------- ++++++++total modules = 4 name offset size = 0x75768A00000180 BF5B9A0A 52545049 0075768A 00ACB944 00000000 002BC66B ....RTPI................00000198 9EDB53BD 4C584B49 01222FCE 00305AA0 00000000 002BC66B ....LXKI................000001B0 AF700117 4C584653 01528A6E 01E00000 00000000 002BC66B ....LXFS................000001C8 8342D28C 00000000 00000000 00000000 00000000 00000000000001E0 00000000 00000000 00000000 00000000 00000000 00000000000001F8 00000000 00000000 00000000 00000000 00000000 0000000000000210 00000000 00000000 00000000 00000000 00000000 0000000000000228 00000000The payload contains 4 modules (VXI2, RTPI, LXKI, LXFS).The offset is relative to the end of the header (add 0x22C to obtain absolute offset).Each module has a CRC-32 checksum (Ethernet and PKZIP algorithm). I have verified all CRCs with HxD (freeware hex editor).Code:name offset size ???? ???? CRC-32 name-------- -------- -------- -------- -------- -------- ----56584932 00000000 0075768A 00000000 002BC66B BF5B9A0A VXI2 - verified OK -- 0x22C -- ELF, 32-bit LSB executable, ARM, version 1 (ARM)52545049 0075768A 00ACB944 00000000 002BC66B 9EDB53BD RTPI - verified OK -- 0x7578B6 -- ELF, 32-bit LSB executable, ARM, version 1 (ARM)4C584B49 01222FCE 00305AA0 00000000 002BC66B AF700117 LXKI - verified OK -- 0x12231FA -- Linux kernel4C584653 01528A6E 01E00000 00000000 002BC66B 8342D28C LXFS - verified OK -- 0x1528C9A -- JFFS2 filesystem, little endian

author: JimKnopf
author_rank: Frequent Contributor
timestamp: December 19, 2023, 08:13:32 am
content: @fzabkar What tools do you use for analysing the code? I usually use binwalk/hexdump/xxd and imhex for bin files. But i couldn't follow your findings.Opening the file with Malcat (first time i use this tool) showed me closer view to your findings.

author: JimKnopf
author_rank: Frequent Contributor
timestamp: December 19, 2023, 02:58:19 pm
content: @fzabkar As you can see in my prevoius post, the firmware file has two ELF files inside.I inspected the 3 MB UImage from firmware file. It matches exactly to the lximage file i dumped via UART serial console from the Drobo device.For the sake of completeness, here are the commands i used for dumping and post-processing the dump. To connect to the Drobo device i used cheap CP2102 UART to serial TTL adapters, using TX, RX, GND connection. I started minicom with logging option (-l lximage.cap in this case).Code:minicom -D /dev/ttyUSB1 -b 115200 -C lximage.capI did that for each file i dumped to have a logfile for each file.Starting the Drobo device, i saw the log text flowing.After stopping the boot process and entering the Marvell U-Boot shell i checked files:Code:fatls usb 0:1.Then i loaded a file into memory:Code:fatload usb 0:1 20000000 lximageI then displayed the memory from the position til file size end (in bytes):Code:md.b 20000000 3168928This process can take seconds, minutes or hours and hours, depends on filesize, just be patient and wait. If it's done, just hit "Shift+A L" to close the log file. Hit "Shift+A Q" to exit minicom.The new logfile contains data from the file dump, commands entered in minicom and information from boot process. This unneccessary data has to be removed from the logfile. The file looks like this:Code:md.b 0x20000000 3836b8^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H ^H^H^H^H^H^H^H^H^H^H^H^H^H^ H^H^H^H^H^H^H^H^Hfatload usb 0:1 20000000 lximage_prev^H ^H^H ^H^H ^H^H ^H^H ^Hreading lximage.... ... ..............................................................................3168928 bytes readMarvell>> fatload usb 0:1 20000000 lximage^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H ^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^Hmd.b 0x20000000 3836b8^H ^H^ H ^H^H ^H^H ^H^H ^H^H ^H305aa020000000: 27 05 19 56 e5 38 64 b7 5f 58 ca b8 00 30 5a 60 '..V.8d._X...0Z`20000010: 20 00 80 00 20 00 80 00 e3 ec 93 a1 05 02 02 00 ... ...........20000020: 4c 69 6e 75 78 2d 33 2e 32 2e 39 36 2d 33 00 00 Linux-3.2.96-3..***20305a70: 00 00 00 00 26 5a 30 00 74 5a 30 00 44 46 00 00 ....&Z0.tZ0.DF..20305a80: 70 5a 30 00 60 5a 30 00 e0 08 00 00 68 5a 30 00 pZ0.`Z0.....hZ0.20305a90: 6c 5a 30 00 64 5a 30 00 00 00 00 00 00 00 00 00 lZ0.dZ0.........Marvell>>I used vim to clean the file. In vim, i deleted single lines by double hit d (dd) to delete stuff on top of the file until i reached the first line with address information. In this case untilCode:20000000: 27 05 19 56 e5 38 64 b7 5f 58 ca b8 00 30 5a 60 '..V.8d._X...0Z`I hit :$ to reach the end of the file and delete the last line with Marvell>> prompt. Save and exit files in vim with :wq!Now the log file contains only data from the dump. But it's in hex format. To convert the hex file to binary format i used:Code:xxd -r -seek -0x20000000 lximage.cap lximageThats all. Filesize and checksum matches to the file on the Drobo devices.The firmware file has 2 ELF images inside. None of the images matches to the vxworks or vxworks_prev file on the Drobo device. I assume, the update process failed after the lximage file was extracted and saved on the the Drobo device while the vxworks file was not extracted. I assume that because the lximage_prev is a different file, most probably the lximage used before the firmware update.The vxworks and vxworks_prev does not match to the content from firmware file.

author: fzabkar
author_rank: Super Contributor
timestamp: December 19, 2023, 04:29:22 pm
content: That's some really nice work! For my part, I just used a hex editor to visually examine the update file, and I used your binwalk dump to identify the functions of the 4 components. I doubt that you will find any tool to analyse the headers, as these are unique to each update package.

author: JimKnopf
author_rank: Frequent Contributor
timestamp: December 20, 2023, 07:52:27 pm
content: I found this set of quite very long videos about Drobo bootloader repairhttps://www.youtube.com/watch?v=G47tneORZOA.There are several usefull videos from this person, up to 9 hours long.Maybe i'm on the right track with the vxwork image that was not updated during firmware update. The reason that i couldn't find content from SPI flash in the firmware file might be that the SPI flash was also not updated. The firmware seems to have some content for updating SPI flash. I did a:Code:hexdump -C release.B810i.2-0-1.tdf|grep -A 15 -B 15 BurnBootromCode:002e1690 44 52 41 4d 20 63 61 6c 63 75 6c 61 74 65 64 20 |DRAM calculated |002e16a0 45 43 43 20 30 78 25 30 32 78 0a 00 53 75 6e 64 |ECC 0x%02x..Sund|002e16b0 61 79 00 00 4d 6f 6e 64 61 79 00 00 54 75 65 73 |ay..Monday..Tues|002e16c0 64 61 79 00 57 65 64 6e 65 73 64 61 79 00 00 00 |day.Wednesday...|002e16d0 54 68 75 72 73 64 61 79 00 00 00 00 46 72 69 64 |Thursday....Frid|002e16e0 61 79 00 00 53 61 74 75 72 64 61 79 00 00 00 00 |ay..Saturday....|002e16f0 00 00 00 00 1f 00 00 00 3b 00 00 00 5a 00 00 00 |........;...Z...|002e1700 78 00 00 00 97 00 00 00 b5 00 00 00 d4 00 00 00 |x...............|002e1710 f3 00 00 00 11 01 00 00 30 01 00 00 4e 01 00 00 |........0...N...|002e1720 57 61 72 6e 69 6e 67 3a 20 63 65 6e 74 75 72 79 |Warning: century|002e1730 20 63 61 6e 6e 6f 74 20 62 65 20 73 65 74 28 61 | cannot be set(a|002e1740 6c 77 61 79 73 20 25 64 29 20 0a 00 47 65 74 20 |lways %d) ..Get |002e1750 44 41 54 45 3a 20 25 34 64 2d 25 30 32 64 2d 25 |DATE: %4d-%02d-%|002e1760 30 32 64 20 28 25 73 29 20 20 54 49 4d 45 3a 20 |02d (%s) TIME: |002e1770 25 32 64 3a 25 30 32 64 3a 25 30 32 64 0a 00 00 |%2d:%02d:%02d...|002e1780 0a 0a 42 75 72 6e 42 6f 6f 74 72 6f 6d 3a 20 45 |..BurnBootrom: E|002e1790 72 72 6f 72 20 64 65 66 61 75 6c 74 20 66 6c 61 |rror default fla|002e17a0 73 68 20 61 64 64 72 65 73 73 20 69 73 20 30 21 |sh address is 0!|002e17b0 21 21 0a 00 20 20 20 20 20 20 20 20 20 20 20 20 |!!.. |002e17c0 20 55 73 65 3a 20 77 20 78 78 78 78 20 77 68 65 | Use: w xxxx whe|002e17d0 6e 20 78 78 78 78 20 69 73 20 66 6c 61 73 68 20 |n xxxx is flash |002e17e0 61 64 64 72 65 73 73 0a 00 00 00 00 20 20 20 20 |address..... |002e17f0 20 20 20 20 20 20 20 20 20 55 73 65 3a 20 42 75 | Use: Bu|002e1800 72 6e 42 6f 6f 74 72 6f 6d 20 62 6f 6f 74 72 6f |rnBootrom bootro|002e1810 6d 2e 62 69 6e 2c 20 78 78 78 78 20 77 68 65 6e |m.bin, xxxx when|002e1820 20 78 78 78 78 20 69 73 20 66 6c 61 73 68 20 61 | xxxx is flash a|002e1830 64 64 72 65 73 73 0a 00 75 73 72 4e 65 74 77 6f |ddress..usrNetwo|002e1840 72 6b 49 6e 69 74 20 72 65 74 75 72 6e 20 65 72 |rkInit return er|002e1850 72 6f 72 0a 00 00 00 00 42 75 72 6e 42 6f 6f 74 |ror.....BurnBoot|002e1860 72 6f 6d 20 28 25 73 2c 25 78 29 0a 00 00 00 00 |rom (%s,%x).....|002e1870 00 00 00 00 52 45 54 52 20 25 73 00 66 74 70 58 |....RETR %s.ftpX|--00368ec0 69 74 69 6f 6e 00 00 00 41 6d 49 43 50 55 00 00 |ition...AmICPU..|00368ed0 41 6d 69 74 45 72 72 6f 72 49 6e 6a 65 63 74 00 |AmitErrorInject.|00368ee0 41 72 6d 61 64 61 58 70 44 65 62 75 67 00 00 00 |ArmadaXpDebug...|00368ef0 42 4c 5f 43 6f 70 79 00 42 53 50 5f 42 6f 6f 74 |BL_Copy.BSP_Boot|00368f00 65 64 57 69 74 68 42 61 74 74 65 72 79 4f 6e 00 |edWithBatteryOn.|00368f10 42 53 50 5f 43 70 75 43 6f 72 65 54 65 6d 70 52 |BSP_CpuCoreTempR|00368f20 65 67 52 65 61 64 5f 45 72 72 61 74 61 00 00 00 |egRead_Errata...|00368f30 42 53 50 5f 43 70 75 43 6f 72 65 54 65 6d 70 52 |BSP_CpuCoreTempR|00368f40 65 67 52 65 61 64 5f 4d 69 73 6d 61 74 63 68 43 |egRead_MismatchC|00368f50 6f 75 6e 74 00 00 00 00 42 53 50 5f 43 70 75 43 |ount....BSP_CpuC|00368f60 6f 72 65 54 65 6d 70 52 65 67 52 65 61 64 5f 4d |oreTempRegRead_M|00368f70 69 73 6d 61 74 63 68 54 6f 6c 65 72 61 6e 63 65 |ismatchTolerance|00368f80 00 00 00 00 42 73 70 4d 6f 6f 64 4c 69 73 74 00 |....BspMoodList.|00368f90 42 73 70 4d 6f 6f 64 4c 69 73 74 53 69 7a 65 00 |BspMoodListSize.|00368fa0 42 75 66 66 65 72 50 61 67 65 43 72 6f 73 73 00 |BufferPageCross.|00368fb0 42 75 72 6e 42 6f 6f 74 72 6f 6d 00 43 52 43 54 |BurnBootrom.CRCT|00368fc0 61 62 6c 65 00 00 00 00 43 6f 70 79 41 6c 6c 53 |able....CopyAllS|00368fd0 44 52 65 67 69 6f 6e 46 72 6f 6d 50 61 72 74 69 |DRegionFromParti|00368fe0 74 69 6f 6e 53 63 68 65 6d 65 00 00 43 6f 70 79 |tionScheme..Copy|00368ff0 53 44 52 65 67 69 6f 6e 46 72 6f 6d 50 61 72 74 |SDRegionFromPart|00369000 69 74 69 6f 6e 00 00 00 43 72 65 61 74 65 44 61 |ition...CreateDa|00369010 74 61 46 61 73 74 50 61 74 68 53 65 6d 61 70 68 |taFastPathSemaph|00369020 6f 72 65 73 41 6e 64 4e 61 74 69 76 65 51 75 65 |oresAndNativeQue|00369030 75 65 73 00 43 72 65 61 74 65 53 68 61 72 65 64 |ues.CreateShared|00369040 52 65 67 69 6f 6e 53 65 6d 61 70 68 6f 72 65 00 |RegionSemaphore.|00369050 44 52 49 46 6c 61 73 68 4c 6f 63 6b 00 00 00 00 |DRIFlashLock....|00369060 44 52 49 46 6c 61 73 68 55 6e 6c 6f 63 6b 00 00 |DRIFlashUnlock..|00369070 44 61 79 4e 61 6d 65 00 44 69 73 6b 44 65 74 65 |DayName.DiskDete|00369080 63 74 53 63 00 00 00 00 44 69 73 6b 49 4f 43 6f |ctSc....DiskIOCo|00369090 6d 70 6c 65 74 65 51 00 44 69 73 74 77 77 62 00 |mpleteQ.Distwwb.|003690a0 44 72 69 42 69 6e 64 54 68 69 73 54 68 72 65 61 |DriBindThisThrea|I used binwalk to extract content from firmware file and got some files, one with jffs2 extension.I mounted this file:Code:modprobe mtdram total_size=30720 erase_size=128modprobe mtdblockmkdir /media/mtdtmpdd if=1528C9A.jffs2 of=/dev/mtdblock0mount -t jffs2 /dev/mtdblock0 /media/mtdtmpThe total_size value is in kb (du -sk 1528C9A.jffs2)The files are the same i have on the Drobo-linux shell.I found an interesting command on this linux shell called esa.It seems it interacts with the vxworks side.Code:Drobo:/ # esa helpCommands defined:apropos : Displays all commands with the search term in their name or descriptionclearKnownHostList : clear the list of known hostscrash : Crash the iSCSI target codecthreads : Create threadsdashboard : on|off - Turn dashboard connections on or offdiscAgentDebug : diskAgentDebug [ on | off ] to enable or disable discovery agent outputdiscAgentDebug2 : diskAgentDebug2 [ on | off ] to enable or disable additional discovery agent outputdmesg : print system logdropReads : dropReads [ on | off ] to enable or disable dropping 64K+/all readsdropWrites : dropWrites [ on | off ] to enable or disable dropping write commands (WRITE6/10/16 and ATS)dumpEMPDList : show the list of hosts with EMP connectionsdumpKnownHostList : show the list of known hostsdumpWaitingHostList : show the list of waiting hostsEMPDDebug : EMPDDebug [ on | off ] to enable or disable console outputexit : Kill the iSCSI target subsystemfault : Create a deliberate segfaulthelp : Displays all commands registered with the ConsoleCommand class along with their descriptionhlba : turn hlba list debug on/off/listhostlog : Displays the host-side command and response logsipAddressUpdated : ipAddressUpdated to force IP address information to be resent to known DashboardslunReset : lunReset <LUN>perf : perf perflog : Issue 'state' or 'perf' or 'perf reset' or 'pause' or 'resume' PerfLog commandprint : print [ on | off ] to enable or disable console outputqa : Displays all commands registered with the ConsoleCommand class for use by QA, along with their descriptionrescanj1 : Rescan the J1 free listsreservations : reservations [ take | release ] to show reservations, take one, or release one we tookresetSpliceCount : reset counts of splice statisticsskipConsoleOutput : skipConsoleOutput [ on | off ]spliceCount : print number of splice callsstate : Displays all classes' state (or help to show subcommands)testdynallocator : testdynallocatorthreads : List the threads that have been createdtoggleSpliceTrace : toggle verbose splice tracingversion : Display the version & build informationzeroReadDebug : zeroReadDebug [ on | off ]End of command listCode:Drobo:/ # Drobo:/ # esa dmesgDrobo:/ # [ 0.000000] Booting Linux on physical CPU 1[ 0.000000] Linux version 3.2.96-3 (drobo@7e4315534594) (gcc version 6.4.0 (GCC) ) #1 SMP Wed Sep 9 12:29:26 UTC 2020[ 0.000000] CPU: Marvell PJ4Bv7 Processor  revision 2 (ARMv7), cr=10c53c7d[ 0.000000] CPU: PIPT / VIPT nonaliasing data cache, PIPT instruction cache[ 0.000000] Machine: Marvell Armada XP Development Board[ 0.000000] Using UBoot passing parameters structure[ 0.000000] bootconsole  enabled[ 0.000000] memblock_add_region memory start 0x20000000 size 0x58200000[ 0.000000] memblock_add_region memory start 0x78200000 size 0x7e00000[ 0.000000] memblock_add_region reserved start 0x53000000 size 0x29000000[ 0.000000] memblock_add_region reserved start 0x200081c0 size 0x6e26b4[ 0.000000] memblock_add_region reserved start 0x20004000 size 0x4000[ 0.000000] Memory policy: ECC disabled, Data cache writealloc[ 0.000000] memblock_add_region reserved start 0x52ffc000 size 0x4000[ 0.000000] memblock_add_region reserved start 0x52ff8000 size 0x4000[ 0.000000] memblock_add_region reserved start 0x52ff4000 size 0x4000[ 0.000000] memblock_add_region reserved start 0x52ff0000 size 0x4000[ 0.000000] memblock_add_region reserved start 0x52fec000 size 0x4000[ 0.000000] memblock_add_region reserved start 0x52fe8000 size 0x4000[ 0.000000] memblock_add_region reserved start 0x52fe4000 size 0x4000[ 0.000000] On node 0 totalpages: 98304[ 0.000000] free_area_init_node: node 0, pgdat 8064f800, node_mem_map 806ec000[ 0.000000] DMA zone: 177 pages used for memmap[ 0.000000] DMA zone: 0 pages reserved[ 0.000000] DMA zone: 90063 pages, LIFO batch:7[ 0.000000] HighMem zone: 16 pages used for memmap[ 0.000000] HighMem zone: 8048 pages, LIFO batch:0[ 0.000000] SMP: init cpus[ 0.000000] PERCPU: Embedded 3 pages/cpu @809f8000 s22144 r8192 d18816 u49152[ 0.000000] pcpu-alloc: s22144 r8192 d18816 u49152 alloc=3*16384[ 0.000000] pcpu-alloc:  0  1  2  3[ 0.000000] Built 1 zonelists in Zone order, mobility grouping on. Total pages: 98111[ 0.000000] Kernel command line: rootfstype=jffs2 root=/dev/mtdblock2 rw mtdparts=cfi_flash_0:1m@0m(nor_hdr),3m@1m(var),30m@4m(rfs0),30m@34m(rfs1),32m@64m(rfs2),32m@96m(rfs3) mv_cpu_count=3 mv_rsrc=uart1:eth0:eth1:eth2:spi:mstr mv_sh_mem=0x80000000:0x100000 mv_ipc=0 vmalloc=550M console=ttyS0,115200 earlyprintk=ttyS0,1152000 pm_level=off[ 0.000000] PID hash table entries: 4096 (order: 0, 16384 bytes)[ 0.000000] Dentry cache hash table entries: 262144 (order: 6, 1048576 bytes)[ 0.000000] Inode-cache hash table entries: 131072 (order: 5, 524288 bytes)[ 0.000000] Memory: 1536MB = 1536MB total[ 0.000000] Memory: 889072k/889072k available, 683792k reserved, 65536K highmem[ 0.000000] Virtual kernel memory layout:[ 0.000000] vector : 0xffff0000 - 0xffff4000 ( 16 kB)[ 0.000000] fixmap : 0xffc00000 - 0xfff00000 (3072 kB)[ 0.000000] vmalloc : 0xd8800000 - 0xfa800000 ( 544 MB)[ 0.000000] lowmem : 0x80000000 - 0xd8200000 (1410 MB)[ 0.000000] pkmap : 0x7fe00000 - 0x80000000 ( 2 MB)[ 0.000000] modules : 0x7f000000 - 0x7fe00000 ( 14 MB)[ 0.000000] .text : 0x80008000 - 0x805e4000 (6000 kB)[ 0.000000] .init : 0x805e4000 - 0x80619680 ( 214 kB)[ 0.000000] .data : 0x8061a000 - 0x80651d68 ( 224 kB)[ 0.000000] .bss : 0x80651d8c - 0x806ea874 ( 611 kB)[ 0.000000] Hierarchical RCU implementation.[ 0.000000] NR_IRQS:211[ 0.000000] Initializing ArmadaXP SOC Timer 3[ 0.000000] sched_clock: 32 bits at 25MHz, resolution 40ns, wraps every 171798ms[ 0.000175] Calibrating delay loop... 1196.85 BogoMIPS (lpj=5984256)[ 0.092926] pid_max: default: 32768 minimum: 301[ 0.097739] Security Framework initialized[ 0.101926] SELinux: Initializing.[ 0.105505] SELinux: Starting in permissive mode[ 0.105562] Mount-cache hash table entries: 2048[ 0.110731] CPU: Testing write buffer coherency: ok[ 0.115806] CPU0: thread -1, cpu 1, socket 0, mpidr 80000001[ 0.121542] SMP: prepare CPUs (3 cores)[ 0.125799] Setting Clocks for secondary CPUs[ 0.131102] SMP: CPU 1 Waking up CPU 2[ 0.149031] CPU1: Booted secondary processor[ 0.180055] CPU1: thread -1, cpu 2, socket 0, mpidr 80000002[ 0.180423] SMP: CPU 1 Waking up CPU 3[ 0.211697] CPU2: Booted secondary processor[ 0.250055] CPU2: thread -1, cpu 3, socket 0, mpidr 80000003[ 0.250174] Brought up 3 CPUs[ 0.263268] SMP: Total of 3 processors activated (3590.55 BogoMIPS).[ 0.270345] devtmpfs: initialized[ 0.277267] xor: measuring software checksum speed[ 0.330056] arm4regs : 1160.000 MB/sec[ 0.380051] 8regs : 708.800 MB/sec[ 0.430048] 32regs : 996.800 MB/sec[ 0.434298] xor: using function: arm4regs (1160.000 MB/sec)[ 0.440071] NET: Registered protocol family 16[ 0.445092] Aurora: Working in ARMv7 mode[ 0.449168] L0 cache Enabled[ 0.452129] Speculative Prefetch Disabled[ 0.456211] Support IO coherency.[ 0.464603] Skipping MPP configuration and GPIO interrupt enabling.[ 0.488938] Skipping serdes configuration.[ 0.593108] Warning: AMP Address decode windows reg != 0[ 0.601278] Initialized Address decode windows[ 0.605904][ 0.607473] Marvell Armada-XP DB-78460-BP rev 2.0 Board - Soc: MV78460 B0 LE[ 0.614881] Detected Tclk 250000000, SysClk 600000000, FabricClk 600000000, PClk 1200000000[ 0.623460] LSP version: linux-3.2.58-2014_T2.0p2 (16KB SW Page Size)[ 0.630133] AMP: Resources - uart1 - eth0 - eth1 - eth2 - spi - mstr[ 0.636872][ 0.638552] Register platform device: mv_neta_port_0[ 0.643690] Register platform device: mv_neta_port_1[ 0.648814] Register platform device: mv_neta_port_2[ 0.662422] bio: create slab <bio-0> at 0[ 0.830177] raid6: int32x1 400 MB/s[ 1.000111] raid6: int32x2 371 MB/s[ 1.170147] raid6: int32x4 330 MB/s[ 1.340035] raid6: int32x8 323 MB/s[ 1.343853] raid6: using algorithm int32x1 (400 MB/s)[ 1.349545] SCSI subsystem initialized[ 1.354293] Switching to clocksource axp_clocksource[ 1.371146] NET: Registered protocol family 2[ 1.380841] IP route cache hash table entries: 16384 (order: 2, 65536 bytes)[ 1.388231] TCP established hash table entries: 65536 (order: 5, 524288 bytes)[ 1.396063] TCP bind hash table entries: 65536 (order: 5, 524288 bytes)[ 1.403199] TCP: Hash tables configured (established 65536 bind 65536)[ 1.409795] TCP reno registered[ 1.413012] UDP hash table entries: 1024 (order: 1, 32768 bytes)[ 1.419131] UDP-Lite hash table entries: 1024 (order: 1, 32768 bytes)[ 1.425860] NET: Registered protocol family 1[ 1.430505] RPC: Registered named UNIX socket transport module.[ 1.436485] RPC: Registered udp transport module.[ 1.441276] RPC: Registered tcp transport module.[ 1.446045] RPC: Registered tcp NFSv4.1 backchannel transport module.[ 1.452555] PCI: CLS 0 bytes, default 64[ 1.453107] o 3 Giga ports supported[ 1.456925] o NETA acceleration mode 1[ 1.460928] o RX Queue support: 8 Queues * 128 Descriptors[ 1.466647] o TX Queue support: 8 Queues * 532 Descriptors[ 1.472372] o GSO supported[ 1.475410] o GRO supported[ 1.478447] o Receive checksum offload supported[ 1.483307] o Transmit checksum offload supported[ 1.488246] o Driver ERROR statistics enabled[ 1.492845][ 1.494480] port #0: is_sgmii=1, is_rgmii=1, phy_addr=16[ 1.500071] o Loading network interface(s) for port #0: cpu_mask=0xf, tx_csum_limit=9800[ 1.508410][ 1.509990] o Port 0 is connected to Linux netdevice[ 1.516839] o eth0, ifindex = 2, GbE port = 0[ 1.525048]giga p=0: mtu=1500, mac=00:50:43:89:11:17 (platform)[ 1.531214][ 1.532800] port #1: is_sgmii=1, is_rgmii=1, phy_addr=17[ 1.538371] o Loading network interface(s) for port #1: cpu_mask=0xf, tx_csum_limit=9800[ 1.546713][ 1.548283] o Port 1 is connected to Linux netdevice[ 1.555188] o eth1, ifindex = 3, GbE port = 1[ 1.563402]giga p=1: mtu=1500, mac=00:50:43:dd:11:17 (platform)[ 1.569567][ 1.571153] port #2: is_sgmii=1, is_rgmii=1, phy_addr=18[ 1.576725] o Loading network interface(s) for port #2: cpu_mask=0xf, tx_csum_limit=9800[ 1.585067][ 1.586636] o Port 2 is connected to Linux netdevice[ 1.593561] o eth2, ifindex = 4, GbE port = 2[ 1.601775]giga p=2: mtu=1500, mac=00:50:43:dd:89:17 (platform)[ 1.607931][ 1.610478] audit: initializing netlink socket (disabled)[ 1.615960] type=2000 audit(1.600:1): initialized[ 1.679076] highmem bounce pool size: 64 pages[ 1.684595] JFFS2 version 2.2. (NAND) Â 2001-2006 Red Hat, Inc.[ 1.691058] aufs 3.2-20131104[ 1.694107] msgmni has been set to 1608[ 1.698115] SELinux: Registering netfilter hooks[ 1.699020] async_tx: api initialized (async)[ 1.703469] io scheduler noop registered[ 1.707460] io scheduler deadline registered (default)[ 1.712724] io scheduler cfq registered[ 1.721748] Serial: 8250/16550 driver, 2 ports, IRQ sharing disabled[ 1.728814] serial8250.0: ttyS0 at MMIO 0xd0012100 (irq = 42) is a 16550A[ 1.735691] console  enabled, bootconsole disabled[ 1.747020] shared_mem: kernel panic notifier registered[ 1.752362] shared_mem: kernel panic dumper registered[ 1.757530] SHARED_MEM: mapping shared memory Header physical addr 7bffc000 virtual addr 0xd8868000[ 1.766612] SHARED_MEM: INIT: Shared Memory Header in Kernel space at Addr: 0xd8868000[ 1.774574] shared_mem: shm_doorbell_init: IRQ 0x1 requested, doorbell mask 2197c queue_os_info b1768de0[ 1.784100] shared_mem: shared_mem_module_init: Location of shm_dev: b1768dc0[ 1.791265] shared_mem: shared_mem_module_init: Intercore message checksum is enabled[ 1.799509] brd: module loaded[ 1.803369] loop: module loaded[ 1.807667][ 1.807670] INFO: Found cfi_flash_0 0 - base 0xd8000000, size 0x8000000, bus 2[ 1.816243] INFO: flashInfoFill - Found 1 Flash Devices[ 1.821502] INFO: flash_map_init - detected 1 devices[ 1.826753] MTD: Initialize the cfi_flash_0 device at address 0xd8000000[ 1.834489][ 1.834491] INFO: Io remapped successfully - phy addr = 0xd8000000, virt addr = 0xd9000000[ 1.844111] INFO: Using cfi_probe to probe cfi_flash_0 at address 0xd8000000, size 0x8000000, width 2m[ 1.853532] cfi_flash_0: Found 1 x16 devices at 0x0 in 16-bit bank. Manufacturer ID 0x000001 Chip ID 0x002801[ 1.863677] Amd/Fujitsu Extended Query Table at 0x0040[ 1.868840] Amd/Fujitsu Extended Query version 1.5.[ 1.873918] number of CFI chips: 1[ 1.877331] - detected OK[ 1.879898] 6 cmdlinepart partitions found on MTD device cfi_flash_0[ 1.886455] Creating 6 MTD partitions on "cfi_flash_0":[ 1.891706] 0x000000000000-0x000000100000 : "nor_hdr"[ 1.897676] 0x000000100000-0x000000400000 : "var"[ 1.903232] 0x000000400000-0x000002200000 : "rfs0"[ 1.908862] 0x000002200000-0x000004000000 : "rfs1"[ 1.914532] 0x000004000000-0x000006000000 : "rfs2"[ 1.920199] 0x000006000000-0x000008000000 : "rfs3"[ 1.925844] - OK.[ 1.928170] bonding: Ethernet Channel Bonding Driver: v3.7.1 (April 27, 2011)[ 1.938780] md: raid6 personality registered for level 6[ 1.944128] md: raid5 personality registered for level 5[ 1.949465] md: raid4 personality registered for level 4[ 1.954793] oprofile: hardware counters not available[ 1.959867] oprofile: using timer interrupt.[ 1.964233] nf_conntrack version 0.5.0 (13891 buckets, 55564 max)[ 1.970685] ip_tables: (C) 2000-2006 Netfilter Core Team[ 1.976088] TCP cubic registered[ 1.979475] NET: Registered protocol family 10[ 1.984659] ip6_tables: (C) 2000-2006 Netfilter Core Team[ 1.990137] IPv6 over IPv4 tunneling driver[ 1.994986] NET: Registered protocol family 17[ 1.999524] 8021q: 802.1Q VLAN Support v1.8[ 2.003738] VFP support v0.3: implementor 56 architecture 2 part 20 variant 9 rev 6[ 2.011494] registered taskstats version 1[ 2.015865] md: Skipping autodetection of RAID arrays. (raid=autodetect will force)[ 6.863207] JFFS2 notice: (1) jffs2_build_xattr_subsystem: complete building xattr subsystem, 1 of xdatum (0 unchecked, 0 orphan) and 1 of xref (0 dead, 0 orphan) found.[ 6.878816] VFS: Mounted root (jffs2 filesystem) on device 31:2.[ 6.885037] Freeing init memory: 208K[ 10.892425] SELinux: 2048 avtab hash slots, 98348 rules.[ 11.091415] SELinux: 2048 avtab hash slots, 98348 rules.[ 11.118524] SELinux: 6 users, 165 roles, 4443 types, 231 bools, 1 sens, 1024 cats[ 11.118538] SELinux: 81 classes, 98348 rules[ 11.131699] SELinux: Completing initialization.[ 11.131707] SELinux: Setting up existing superblocks.[ 11.131740] SELinux: initialized (dev sysfs, type sysfs), uses genfs_contexts[ 11.131761] SELinux: initialized (dev rootfs, type rootfs), uses genfs_contexts[ 11.131782] SELinux: initialized (dev bdev, type bdev), uses genfs_contexts[ 11.131808] SELinux: initialized (dev proc, type proc), uses genfs_contexts[ 11.131830] SELinux: initialized (dev tmpfs, type tmpfs), uses transition SIDs[ 11.131902] SELinux: initialized (dev devtmpfs, type devtmpfs), uses transition SIDs[ 11.132567] SELinux: initialized (dev sockfs, type sockfs), uses task SIDs[ 11.132587] SELinux: initialized (dev debugfs, type debugfs), uses genfs_contexts[ 11.134132] SELinux: initialized (dev pipefs, type pipefs), uses task SIDs[ 11.134154] SELinux: initialized (dev anon_inodefs, type anon_inodefs), uses genfs_contexts[ 11.134171] SELinux: initialized (dev devpts, type devpts), uses transition SIDs[ 11.134233] SELinux: initialized (dev rpc_pipefs, type rpc_pipefs), uses genfs_contexts[ 11.134257] SELinux: initialized (dev mqueue, type mqueue), uses transition SIDs[ 11.134292] SELinux: initialized (dev selinuxfs, type selinuxfs), uses genfs_contexts[ 11.134357] SELinux: initialized (dev mtd_inodefs, type mtd_inodefs), not configured for labeling[ 11.134376] SELinux: initialized (dev jffs2, type jffs2), uses xattr[ 11.134549] SELinux: initialized (dev sysfs, type sysfs), uses genfs_contexts[ 11.425426] type=1403 audit(11.410:2): policy loaded auid=4294967295 ses=4294967295[ 11.911820] SELinux: initialized (dev tmpfs, type tmpfs), uses transition SIDs[ 11.984668] SELinux: initialized (dev binfmt_misc, type binfmt_misc), uses genfs_contexts[ 12.337352] SELinux: initialized (dev tmpfs, type tmpfs), uses transition SIDs[ 12.399940] SELinux: initialized (dev tmpfs, type tmpfs), uses transition SIDs[ 12.436859] SELinux: initialized (dev aufs, type aufs), not configured for labeling[ 12.473855] SELinux: initialized (dev aufs, type aufs), not configured for labeling[ 12.501432] SELinux: initialized (dev tmpfs, type tmpfs), uses transition SIDs[ 12.529057] SELinux: initialized (dev tmpfs, type tmpfs), uses transition SIDs[ 13.868484] JFFS2 notice: (548) jffs2_build_xattr_subsystem: complete building xattr subsystem, 5 of xdatum (0 unchecked, 0 orphan) and 73 of xref (0 dead, 32 orphan) found.[ 13.884464] SELinux: initialized (dev jffs2, type jffs2), uses xattr[ 16.863111] pool #0: pkt_size=1536, buf_size=1632 - 2048 of 2048 buffers added[ 16.870783] eth0: started[ 16.873764] ADDRCONF(NETDEV_UP): eth0: link is not ready[ 18.070628] eth0: stopped[ 18.110514] eth0: started[ 18.113477] ADDRCONF(NETDEV_UP): eth0: link is not ready[ 18.153545] pool #1: pkt_size=1536, buf_size=1632 - 2048 of 2048 buffers added[ 18.161211] eth1: started[ 18.164184] ADDRCONF(NETDEV_UP): eth1: link is not ready[ 19.312010] eth1: stopped[ 19.352332] eth1: started[ 19.355303] ADDRCONF(NETDEV_UP): eth1: link is not ready[ 19.395447] pool #2: pkt_size=1536, buf_size=1632 - 2048 of 2048 buffers added[ 19.403118] eth2: link up[ 19.405764] eth2: started[ 32.140472] SHARED_MEM: shared_mem_open: About to take semaphore.[ 32.146918] SHARED_MEM: shared_mem_open: Got Semaphore.[ 32.153568] shared_mem: wait_for_init_shared_mem: Entering mutex for shm_dev at b1768dc0[ 32.163069] SHARED_MEM: CPU1: READY TO WAIT FOR INITIALIZATION OF SHARED MEMORYAnd this command crashed the system:Code:Drobo:/ # Drobo:/ # esa state=================================================Thu Jan 1 00:03:25 1970: tDebug: DUMPING DIAGNOSTICSDrobo:/ # =================================================--- Diagnostics : Threads ---ThreadID LWP ThreadName Priority0x2adbb450 1505 tDebug 2450x2af2b450 1506 tIscsiMultiWr0 2060x2b0ef450 1507 tIscsiMultiWr1 2060x2b2bb450 1508 tIscsiMultiWr2 2060x2b61b450 1509 tIscsiMultiWr3 2060x2b69b450 1510 tIscsiMultiWr4 2060x2b6e7450 1511 tIscsiMultiWr5 2060x2b95b450 1512 tIscsiMultiWr6 2060x2ba63450 1513 tIscsiMultiWr7 2060x2bb77450 1514 tIscsiMultiWr8 2060x2bccb450 1515 tIscsiWB0 2060x2be9b450 1516 tIscsiWB1 2060x2c2af450 1517 tIscsiWB2 2060x2c5cb450 1518 tIscsiWB3 2060x2c757450 1519 tIscsiWB4 2060x2c7d7450 1520 tIscsiWB5 2060x2c893450 1521 tIscsiWB6 2060x2c983450 1522 tIscsiWB7 2060x2cadb450 1523 tIscsiWB8 2060x2cbd7450 1524 tIscsiMgr 210--- Diagnostics : Intercore ---iscsiTgtIntercoreShowTag2CmdMapper has 0 recordsIntercore lock --locked : 0count : 0owner : 0 ((null))Intercore command/response logs:These logs show what has been sent over the intercore and what has been receivedThu Jan 1 00:03:25 1970: tDebug: Current timestamp is 205Command Log:tag 0 timestamp 0...tag 0 timestamp 0Response Log:tag 0 timestamp 0...tag 0 timestamp 0End of Intercore command/response logsIntercore Perf:(no samples)Perf for adding to intercore map:(no samples)Perf for removing from intercore map:(no samples)End of Intercore Perf----------------------------------------------------------- Diagnostics : J1 ---J1 stategWbInfo 0xcdaf4 SharedPartitionInfo (nil)TransPoolInfo gTransPool = (nil) sharedPartitionInfo->TransPoolInfo 0xcBulkPoolInfo gBulkPool = (nil) sharedPartitionInfo->BulkPoolInfo 0x50SharedPartitionInfo->VxSharedPartitionDataStart 0x98WriteBufferDescriptor size = 128Using two write buffer pools!Thu Jan 1 00:03:25 1970: tDebug: Signal = SIGSEGVThu Jan 1 00:03:25 1970: tDebug: Thread ID 0x2adbb450Thu Jan 1 00:03:25 1970: tDebug: stackaddr= 0x2ad9c000 : 0x2adbc000 [stacksize= 0x20000], context_addr= 0x2adb5444Thu Jan 1 00:03:25 1970: tDebug: iSCSITgt crash backtrace[ 240.139348] BUG: soft lockup - CPU#0 stuck for 22s! [iscsiTgt:1497][ 240.145635] Modules linked in:[ 240.148708][ 240.150204] Pid: 1497, comm: iscsiTgt[ 240.154923] CPU: 0 Not tainted (3.2.96-3 #1)[ 240.159562] PC is at msleep_interruptible+0x10/0x78[ 240.164455] LR is at msleep_interruptible+0x10/0x78[ 240.169349] pc : [<800710d0>] lr : [<800710d0>] psr: 20070013[ 240.169354] sp : aecb9d10 ip : aecb9d10 fp : aecb9d24[ 240.180872] r10: 00000000 r9 : af152940 r8 : b1768fe0[ 240.186114] r7 : 00000000 r6 : beadcafe r5 : b1768dc0 r4 : 806e25e0[ 240.192660] r3 : cccccccd r2 : 271aef7c r1 : 00000057 r0 : 0000000a[ 240.199209] Flags: nzCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment user[ 240.206366] Control: 10c53c7d Table: 4f50006a DAC: 00000015[ 240.212128] Backtrace:[ 240.214609] [<80011d40>] (dump_backtrace+0x0/0x108) from [<8047b71c>] (dump_stack+0x18/0x1c)[ 240.223072] r7:00000000 r6:ee6b2800 r5:aecb8000 r4:aecb9cc8[ 240.228802] [<8047b704>] (dump_stack+0x0/0x1c) from [<8000f3c4>] (show_regs+0x4c/0x50)[ 240.236752] [<8000f378>] (show_regs+0x0/0x50) from [<800a54f4>] (watchdog_timer_fn+0x16c/0x1a4)[ 240.245476] r5:aecb8000 r4:806146f5[ 240.249095] [<800a5388>] (watchdog_timer_fn+0x0/0x1a4) from [<80086da0>] (__run_hrtimer+0x9c/0x2b4)[ 240.258173] [<80086d04>] (__run_hrtimer+0x0/0x2b4) from [<80087c50>] (hrtimer_interrupt+0x134/0x304)[ 240.267332] r9:7fffffff r8:ffffffff r7:00000000 r6:809f84c0 r5:00000037[ 240.273929] r4:e8dd0845[ 240.276587] [<80087b1c>] (hrtimer_interrupt+0x0/0x304) from [<8001a480>] (axp_localtimer_handler+0x38/0x40)[ 240.286362] [<8001a448>] (axp_localtimer_handler+0x0/0x40) from [<800a93d4>] (handle_percpu_devid_irq+0xa8/0x1b0)[ 240.296660] [<800a932c>] (handle_percpu_devid_irq+0x0/0x1b0) from [<800a5804>] (generic_handle_irq+0x30/0x40)[ 240.306609] [<800a57d4>] (generic_handle_irq+0x0/0x40) from [<8000eb3c>] (handle_IRQ+0x60/0xb4)[ 240.315337] [<8000eadc>] (handle_IRQ+0x0/0xb4) from [<800081d0>] (asm_do_IRQ+0x10/0x14)[ 240.323363] r9:af152940 r8:b1768fe0 r7:aecb9cfc r6:fbb21000 r5:20070013[ 240.329959] r4:800710d0[ 240.332612] [<800081c0>] (asm_do_IRQ+0x0/0x14) from [<80484694>] (__irq_svc+0x34/0xec)[ 240.340553] Exception stack(0xaecb9cc8 to 0xaecb9d10)[ 240.345623] 9cc0: 0000000a 00000057 271aef7c cccccccd 806e25e0 b1768dc0[ 240.353828] 9ce0: beadcafe 00000000 b1768fe0 af152940 00000000 aecb9d24 aecb9d10 aecb9d10[ 240.362031] 9d00: 800710d0 800710d0 20070013 ffffffff[ 240.367106] [<800710c0>] (msleep_interruptible+0x0/0x78) from [<802de444>] (wait_for_init_shared_mem+0x10c/0x174)[ 240.377398] r5:b1768dc0 r4:806e25e0[ 240.381012] [<802de338>] (wait_for_init_shared_mem+0x0/0x174) from [<802e02cc>] (shared_mem_open_main+0xd8/0x140)[ 240.391304] r7:00000000 r6:af152940 r5:b1768dd0 r4:b1768dc0[ 240.397034] [<802e01f4>] (shared_mem_open_main+0x0/0x140) from [<802e035c>] (shared_mem_open+0x28/0x5c)[ 240.406454] r7:b1639588 r6:af152940 r5:b1639588 r4:b1768dc0[ 240.412184] [<802e0334>] (shared_mem_open+0x0/0x5c) from [<801182a4>] (chrdev_open+0x120/0x248)[ 240.420907] r6:806d7884 r5:00000000 r4:b1768fe0[ 240.425580] [<80118184>] (chrdev_open+0x0/0x248) from [<801118b8>] (__dentry_open+0x1c0/0x3b8)[ 240.434223] [<801116f8>] (__dentry_open+0x0/0x3b8) from [<80112c04>] (nameidata_to_filp+0x68/0x78)[ 240.443216] [<80112b9c>] (nameidata_to_filp+0x0/0x78) from [<80122a30>] (do_last.constprop.13+0x31c/0x780)[ 240.452898] r7:00000000 r6:00000000 r5:00000000 r4:aecb9ed8[ 240.458627] [<80122714>] (do_last.constprop.13+0x0/0x780) from [<80122f8c>] (path_openat+0xbc/0x420)[ 240.467792] [<80122ed0>] (path_openat+0x0/0x420) from [<80123428>] (do_filp_open+0x34/0x90)[ 240.476173] [<801233f4>] (do_filp_open+0x0/0x90) from [<80112d00>] (do_sys_open+0xec/0x18c)[ 240.484548] r7:af0b8000 r6:ffffff9c r5:00000001 r4:00000019[ 240.490277] [<80112c14>] (do_sys_open+0x0/0x18c) from [<80112dc0>] (sys_open+0x20/0x24)[ 240.498303] r9:aecb8000 r8:8000ddc8 r7:00000005 r6:000e3554 r5:000cd978[ 240.504900] r4:000cd000[ 240.507553] [<80112da0>] (sys_open+0x0/0x24) from [<8000dc20>] (ret_fast_syscall+0x0/0x30)[ 240.515843] Kernel panic - not syncing: softlockup: hung tasks[ 240.521693] shared_mem_panic_dump: WARNING: LXPM area not initialized yet.[ 240.528591] CPU2: stopping[ 240.531307] Backtrace:[ 240.533785] [<80011d40>] (dump_backtrace+0x0/0x108) from [<8047b71c>] (dump_stack+0x18/0x1c)[ 240.542248] r7:b1128000 r6:00000000 r5:80627070 r4:806520a4[ 240.547977] [<8047b704>] (dump_stack+0x0/0x1c) from [<800138c8>] (handle_IPI+0x150/0x16c)[ 240.556183] [<80013778>] (handle_IPI+0x0/0x16c) from [<800083b8>] (do_IPI+0x10/0x14)[ 240.563949] r9:562f5842 r8:8048ebb0 r7:b1129fa4 r6:fbb21000 r5:600e0013[ 240.570546] r4:8000f088[ 240.573200] [<800083a8>] (do_IPI+0x0/0x14) from [<80484694>] (__irq_svc+0x34/0xec)[ 240.580792] Exception stack(0xb1129f70 to 0xb1129fb8)[ 240.585861] 9f60: 00000021 806262d8 00000002 80019364[ 240.594066] 9f80: 80651ec4 8062c45c 80568c10 b1128000 8048ebb0 562f5842 00000000 b1129fdc[ 240.602271] 9fa0: b1129fb8 b1129fb8 8000eefc 8000f088 600e0013 ffffffff[ 240.608910] [<8000efd8>] (cpu_idle+0x0/0xdc) from [<804783e0>] (secondary_start_kernel+0x164/0x16c)[ 240.617982] r9:562f5842 r8:2000406a r7:8065208c r6:10c03c7d r5:000001d3[ 240.624578] r4:00000004[ 240.627230] [<8047827c>] (secondary_start_kernel+0x0/0x16c) from [<20477c34>] (0x20477c34)[ 240.635518] r5:00000015 r4:5113006a[ 240.639128] CPU1: stopping[ 240.641843] Backtrace:[ 240.644320] [<80011d40>] (dump_backtrace+0x0/0x108) from [<8047b71c>] (dump_stack+0x18/0x1c)[ 240.652784] r7:b10e0000 r6:00000000 r5:80627070 r4:806520a4[ 240.658511] [<8047b704>] (dump_stack+0x0/0x1c) from [<800138c8>] (handle_IPI+0x150/0x16c)[ 240.666715] [<80013778>] (handle_IPI+0x0/0x16c) from [<800083b8>] (do_IPI+0x10/0x14)[ 240.674481] r9:562f5842 r8:8048ebb0 r7:b10e1fa4 r6:fbb21000 r5:60070013[ 240.681075] r4:8000f088[ 240.683729] [<800083a8>] (do_IPI+0x0/0x14) from [<80484694>] (__irq_svc+0x34/0xec)[ 240.691320] Exception stack(0xb10e1f70 to 0xb10e1fb8)[ 240.696389] 1f60: 00000020 806262d8 00000001 80019364[ 240.704595] 1f80: 80651ec4 8062c45c 80568c10 b10e0000 8048ebb0 562f5842 00000000 b10e1fdc[ 240.712800] 1fa0: b10e1fb8 b10e1fb8 8000eefc 8000f088 60070013 ffffffff[ 240.719439] [<8000efd8>] (cpu_idle+0x0/0xdc) from [<804783e0>] (secondary_start_kernel+0x164/0x16c)[ 240.728510] r9:562f5842 r8:2000406a r7:8065208c r6:10c03c7d r5:000001d3[ 240.735103] r4:00000002[ 240.737754] [<8047827c>] (secondary_start_kernel+0x0/0x16c) from [<20477c34>] (0x20477c34)[ 240.746042] r5:00000015 r4:510f006a[ 240.749652] shared_mem_panic_event: Kernel panic event handler called. Notifying VxWorks Core of Kernel panic.

author: JimKnopf
author_rank: Frequent Contributor
timestamp: December 23, 2023, 05:03:43 pm
content: I found another very interesting tool for analyzing firmware files and memory dumps: embahttps://github.com/e-m-b-a/embaI have to dig into it. Maybe it helps with all the informations it automaticly analyses. Couldn't get it to work on my Arch Linux Notebook. But it worked like a charm on my SLS2 in WSL using Ubuntu as distribution.The image is from analyzing the dumped files i found in Marvell U-Boot shell.

author: JimKnopf
author_rank: Frequent Contributor
timestamp: December 25, 2023, 07:27:30 pm
content: I need some help from either someone who can extract a working vxworks image from this firmware file or someone who can provide the files from a working device.I tried different things now loading the vxworks ELF images i extracted manually from the firmware file and the ones emba extracted automaticly. I tried to load it in u-boot using loady and ymodem in minicom but could not get it to work.I then tried it using kermit in minicom and was able to successfully upload the data using ckermit after creating ~/.kermrc with this content:Code:set carrier-watch offset handshake noneset flow-control nonerobustset file type binset rec pack 1000set send pack 1000set window 5I tried the firmware file itself and the extracted ELF files from the firmware file containing the vxworks stuff. The firmware file has more than 50 MB. It took more than 90 minutes to upload it over uart serial connection in u-boot. I't didn't help. When i runCode:go 0x20000000and some commands from printenv data likeCode:td_bootargs_confab; run flashload_g0; bootvx 0x20000000It always complains "No ELF file at 0x20000000". Because of the very slow upload speed using kermit, i tried a combination of Marvell u-boot shell and openocd.Loading a file to memory is way faster in openocd.I started the device, pressed a button to stop boot process and entering the Marvell u-boot shell. In openocd i did:Code:haltload_image /home/<user>/<some_path>/7698614-19018234.elf32 0x20000000 elfresumeIn u-boot i tried the same commands like before, go 0x20000000 or td_bootargs_confab; run flashload_g0; bootvx 0x20000000.I don't know why but sometimes the image was not loaded to 0x20000000. Sometimes it was loaded at 0x21000000.I couldn't even load the original vxworks image i dumped from the Drobo device.One time i tried loading it at 0x00000000 and it was loaded at 0x01000000.In this case, i did in openocd a resume 0x01000000 and to my surprise, it started to load but halted at some point.But this time i had blue lights on the device and the bootlog was different:Code:Marvell>> td_bootargs_confab; run flashload_g0; bootvx 0x21000000Env Var skipConfabulation=0Skip Confabulation: NONE... skipConfabulation: 0x1 skips Vx confab, 0x2 skips Lx confabCurrent Value of Vx bootargs_g0:==================================================bootargs_g0=neta(3,0) f=0x6000 o=usb0:eth3:cpus=1:mem=0x20000000;MAC3-00:50:43:11:89:dd;SEe==================================================EnvVar bootargsStart=neta(3,0)EnvVar vxFlags=f=0x6000EnvVar vxDev=usb0:eth3:cpus=1:mem=0x20000000EnvVar eth3addr=00:50:43:11:89:ddEnvVar droboSER=DRB143602000000EnvVar vxCmd=s=#/romfs/runesa.vxeConfabulated Value of bootargs_g0:==================================================bootargs_g0=neta(3,0) f=0x6000 o=usb0:eth3:cpus=1:mem=0x20000000;MAC3-00:50:43:11:89:dd;SEe==================================================Current bootargs_g0 perfectly match the Confabulated bootargs_g0No Need to Update the Environmentreading vxWorks_prev..............................................................................................17734472 bytes read## Ethernet MAC address not copied to NV RAM## No elf image at address 0x21000000## Not an ELF image, assuming binary## Using bootline (@ 0x1100): neta(3,0) f=0x6000 o=usb0:eth3:cpus=1:mem=0x20000000;MAC3-00e## Starting vxWorks at 0x21000000 ...MPP33 Config (0xd0018010) == 0x11110040 (Should be: 0xXXXXXX4X)SDRAM Config (0xd0001400) == 0x7201c924 (Should be: 0x72XXXXXX)DRAM TBsAddr (0xd0001580) == 0x20000000 (Should be: 0x??????]Booting from CPU 0Detected board Heatwave 1.0DRAM env init....... Done.Detected DRAM size 512MBAMP: Resources - uart0 - pex1 - pex2 - eth3 - xor0 - usb0 - i2c0 - i2c1 - sata - spi - gAMP CPUs = 1AMP mem size = 0x20000000TWSI init Channel 0....... Done. Actual freq = 97656HzSkipping serdes configuration.Ctrl env init....... Done.Addr Dec Win......VerifiedCP15 mrvl dbgr 0x000109A7CP15 mrvl dbgr2 0xEA008208CP15 mrvl ctrl 0x000001B6CP15 mrvl dbgr 0x000109A7CP15 mrvl dbgr2 0xEA008208CP15 mrvl ctrl 0x000001B6CPU if init......... Done.GPP init............ Done.DRAM env init....... Done.Using DRAM size 512MB=======================> HW Revision Register == 0x00000881Detected Board: Heatwave MVT, Spin 0 (No EthDebug)Detect: Tclk 250MHzSysClk 600MHzL2Clk 600MHzpClk 1200MHzMarvell Controller initialization Done.Modules Detected:SPI flash based addr on 0xD4000000=SPI Flash 8MB detectedesaXORSystemInitesaXORSystemInit...doneesaDMASystemInitInitialising SEEPROM InterfaceChecking Bootline.......0x00001100 UBOOT Version: UBOOT-2.33Bootline params = neta(3,0) f=0x6000 o=usb0:eth3:cpus=1:mem=0x20000000;MAC3-00:50:43:11:89DRAM int Ctrl....... DoneIDMA Err int Ctrl... DoneIDMA init........... DoneNETA Err int Ctrl... DoneNeta int Ctrl....... DoneGPIO int Ctrl....... DonePCI int Ctrl........ DonePCI-E 0: Not mapped to this OSPCI-E 1: Not mapped to this OSPCI-E 2: Not mapped to this OSPCI-E 3: Not mapped to this OSmvPexIntfInit() ROOT COMPLEX Init pexHWInf: 4mvSysPexInit() called pexIf: 4 type: 0 MAX_TARGETS: 44mvSysPexInit() OK from mvCtrlAddrWinMapBuild()mvSysPexInit() OK from mvPexWinInit()mvPexModeGet() configured as ROOT reg: 0x4014032emvPexInit() configuring as ROOTmvPexLocalBusNumSet() called for pexIf: 4 busNum: 0 localBus: 0 localDev: 0*******************mvPexLocalDevNumSet(4) localBus: 0 localDev: 0 pexStatus: 0 ***********mvPexInit() call mvPexMasterEnablemvPexInit() call mvPexSlaveEnablemvPexInit() disable intmvPexInit() wait a tickmvPexInit() check for linkPEX4 interface detected Link X1mvPexIntfInit() checking if we should set the localBus pex0flg: 0 pexHWInf: 4mvPexIntfInit() setting localBusNum to 0 for pexHWInf 4mvPexLocalBusNumSet() called for pexIf: 4 busNum: 0 localBus: 0 localDev: 0PCI-E 4/10: Done.PCI-E 5: is power offmvPexIntfInit() ROOT COMPLEX Init pexHWInf: 6mvSysPexInit() called pexIf: 6 type: 0 MAX_TARGETS: 44mvSysPexInit() OK from mvCtrlAddrWinMapBuild()mvSysPexInit() OK from mvPexWinInit()mvPexModeGet() configured as ROOT reg: 0x4014022emvPexInit() configuring as ROOTmvPexLocalBusNumSet() called for pexIf: 6 busNum: 0 localBus: 1 localDev: 0*******************mvPexLocalDevNumSet(6) localBus: 0 localDev: 0 pexStatus: 0 ***********mvPexInit() call mvPexMasterEnablemvPexInit() call mvPexSlaveEnablemvPexInit() disable intmvPexInit() wait a tickmvPexInit() check for linkPEX6 interface detected Link X1mvPexIntfInit() checking if we should set the localBus pex0flg: 0 pexHWInf: 6mvPexIntfInit() setting localBusNum to 0 for pexHWInf 6mvPexLocalBusNumSet() called for pexIf: 6 busNum: 0 localBus: 0 localDev: 0PCI-E 6/10: Done.mvPexIntfInit() ROOT COMPLEX Init pexHWInf: 7mvSysPexInit() called pexIf: 7 type: 0 MAX_TARGETS: 44mvSysPexInit() OK from mvCtrlAddrWinMapBuild()mvSysPexInit() OK from mvPexWinInit()mvPexModeGet() configured as ROOT reg: 0x4014022emvPexInit() configuring as ROOTmvPexLocalBusNumSet() called for pexIf: 7 busNum: 0 localBus: 2 localDev: 0*******************mvPexLocalDevNumSet(7) localBus: 0 localDev: 0 pexStatus: 0 ***********mvPexInit() call mvPexMasterEnablemvPexInit() call mvPexSlaveEnablemvPexInit() disable intmvPexInit() wait a tickmvPexInit() check for linkPEX7 interface detected Link X1mvPexIntfInit() checking if we should set the localBus pex0flg: 0 pexHWInf: 7mvPexIntfInit() setting localBusNum to 0 for pexHWInf 7mvPexLocalBusNumSet() called for pexIf: 7 busNum: 0 localBus: 0 localDev: 0PCI-E 7/10: Done.mvPexIntfInit() ROOT COMPLEX Init pexHWInf: 8mvSysPexInit() called pexIf: 8 type: 0 MAX_TARGETS: 44mvSysPexInit() OK from mvCtrlAddrWinMapBuild()mvSysPexInit() OK from mvPexWinInit()mvPexModeGet() configured as ROOT reg: 0x4014032emvPexInit() configuring as ROOTmvPexLocalBusNumSet() called for pexIf: 8 busNum: 0 localBus: 3 localDev: 0*******************mvPexLocalDevNumSet(8) localBus: 0 localDev: 0 pexStatus: 0 ***********mvPexInit() call mvPexMasterEnablemvPexInit() call mvPexSlaveEnablemvPexInit() disable intmvPexInit() wait a tickmvPexInit() check for linkPEX8 interface detected Link X1mvPexIntfInit() checking if we should set the localBus pex0flg: 0 pexHWInf: 8mvPexIntfInit() setting localBusNum to 0 for pexHWInf 8mvPexLocalBusNumSet() called for pexIf: 8 busNum: 0 localBus: 0 localDev: 0PCI-E 8/10: Done.PCI-E 9: Not mapped to this OSUSB0 init........... Done. HOST type selectedUSB Err int Ctrl.... DoneXOR Err int Ctrl.... DonemvSysXorInit: doneXOR init............ DonemvCtrlInit2......... donevxbDevInit.........donesysSerialConnectAll.........doneSerial Ports...AttachedUART2...Baud Rate Adjusted to 38.4KVxBus Loaded.... donebspConfigureI2CTable: Configuring I2C tables for 8-Slot (Kryten) 1970-01-01 00:00:00: drDrvLaunch---->> drDrv() <<----Allocated temp buffer 0x42599a8 1970-01-01 00:00:00: Diagnostic Re-Route Device Driver - Version 1.0 - Install. 1970-01-01 00:00:00: drStartLogging() started_DEF_STD_OUT = 3 _DEF_STD_ERR = 3 _DR_FD = 4Host Name: bootHostTarget Name: vxTargetUser: targetEthernet port #3 initializedneta3 Interface Loaded; MAC: 00:50:43:11:89:DDneta3 Interface StartedAttempting to register custom syscalls groupipAttached to interface neta3 ip=Can't Set IP address to <neta3> interface..bootline does not have ethernet ipAddressAdding 10511 symbols for standalone.Detected Marvell USB. SettingwdbConfig: error configuring WDB communication interface]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]] ]]]] ]]]]]]]]]] ]] ]]]] (R)] ]]]]]]]]] ]]]]]] ]]]]]]]] ]] ]]]]]] ]]]]]]] ]]]]]]]] ]]]]]] ] ]] ]]]]]]] ]]]]] ] ]]] ] ]]]] ]]] ]]]]]]]]] ]]]] ]] ]]]] ]] ]]]]]]]]] ]]] ]] ] ]]] ]] ]]]]] ]]]]]] ]] ]]]]]]] ]]]] ]] ]]]]]]]]] ] ]]]] ]]]]] ]]]]]]]] ]]]] ]] ]]]] ]]]]]]] ]]]]]]]]]] ]]]]] ]]]]]] ] ]]]]] ]]]] ]] ]]]] ]]]]]]]] ]]]]]]]]]]] ]]]]] ] ]]]]]] ] ]]] ]]]] ]] ]]]] ]]]] ]]]] ]]]]]]]]]]]] ]]]]] ]]] ]]]]]]] ] ]]]]]]] ]]]] ]]]] ]]]] ]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]] Development System]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]] VxWorks 6.8]]]]]]]]]]]]]]]]]]]]]]]]]] KERNEL: WIND version 2.13]]]]]]]]]]]]]]]]]]]]]]]]] Copyright Wind River Systems, Inc., 1984-2012CPU: Marvell Sheeva 88SV584x, Board= Heatwave 1.0 ARMARCHV7 LE core. Processor #0.Memory Size: 0x1fe70000. BSP version 2.3.1.Created: Feb 3 2016, 20:45:55ED&R Policy Mode: DeployedWDB Comm Type: WDB_COMM_ENDWDB: Agent configuration failed. 1970-01-01 00:00: MV_USB_MODE_RE00: kCmdInit: Initialising kernel command liner 1970-01-01 00:00:00: diskCmdRegister: Installing k disk CommandsG = 0x3ESA Register Driver Found Board version 2, stuffing option 1Initialising boot SEEPROM handlerChecking boot register values in serialEEPROM ...<<<<Flash Upgrade Driver - version 1.0 - installed.IsFlashForDroboPro: We are NOT running on Drobo Pro deal with flash accordinglyFailed to get flash layout...this is expected for Optimus Prime, which does not have NOR F.System ConfigurationCHIP : MV88F7846 Rev 2CPU : Marvell PJ4B (584) v7 (Rev 2)BOARD : Heatwave 1.0 (0x0)CLOCKs : tClk = 250MHz, sysClk = 600MHzL2Clk = 600MHz pClk = 1200MHzETH_JUMBO_SUPPORT = DisabledBRIDGING_SUPPORT = EnabledMULTI_Q_SUPPORT = DisabledNAT_SUPPORT = DisabledVFP_SUPPORT = EnabledL2 Cache = EnabledIO coherency = EnabledGet DATE: 2071-06-19 (Friday) TIME: 21:30:01[vxWorks *]#=======================> HW Revision Register == 0x00000881Board Type 4, Rev 2 (Heatwave MVT), Spin = 0Stuffing Opt = 1 (No EthDebug), DevDebugBitz = 0x0Drobo B810iHeatwaveReady to take a Byte!==============================================================================Initializing PMU...Reading PMU Version...PMU Version: 1.2.0x046c, Download Version 108 (Variant 4) [Failsafe Ver 4]Considering an Update to the PMU ...PMU is up to date for this MVT board.Reading 0xac from PMU GPIO Port 1 [ @0x0020 ]Reading 0xef from PMU GPIO Port 2 [ @0x0028 ]Reading 0x71 from PMU GPIO Port 3 [ @0x0018 ]Reading 0x10 from PMU GPIO Port 4 [ @0x001c ]==============================================================================PMU is Running on AC Power :-)============================================================================================================================================================0x48ac278 (BusM A): 0x48ac278 (BusM A): INFO: usb2Msc - Storage driver got a device attach.INFO: usb2Msc - Storage driver got a device attach notification.This Optimus Prime PMU is NOT configured for Early-Follow of DDR3 Reset...Fixing0x48ac278 (BusM A): 0x48ac278 (BusM A): INFO: usb2Msc - Mounting device (PDT 0x0 PQ 0x0 RMPINFO: usb2Msc - Mounting device (PDT 0x0 PQ 0x0 RMB 0x0) VID = : PID = USB DISK MP0x48ac278 (BusM A): 0x48ac278 (BusM A): INFO: usb2Msc - Device 0x2 LUN 0 of 1005568 (KB) w0INFO: usb2Msc - Device 0x2 LUN 0 of 1005568 (KB) will be mounted with base name /bd0This Optimus Prime Board Supports Self-Refresh only with VRM_EN...PMU will ENABLE VRM_EN during a reboot/shutdown cycle.PMU BootOnBatt Counter DEFAULT is now 3/bd0/ - disk check in progress .../bd0/Crashlogs/crashlog-20160306-1012 PMU BootOnBatt Counter ACTUAL is now 3==============================================================================Set temp = Kryten/bd0/ - Volume is OKtotal # of clusters: 62,580# of free clusters: 56,607# of bad clusters: 0total free space: 905,712 Kb0, 0, max contiguous free space: 923,697,152 bytes# of files: 58# of folders: 1total bytes in files: 94,805 Kb# of lost chains: 0total bytes in lost chains: 00, 0, 0, 0,PMU Skip-OverTemp Setting: 0x0000PMU Shutdown Status: 0x00PMU Shutdown IS NOT Pending!PMU Shutdown Reasons are Fully EnabledDisk Array Temp is Within TolerancesCPU Core Temp is Within TolerancesPMU Core Temp is Within TolerancesPMU Shutdown Reason: 0x00PMUCmd: "A" --> "a""Y" --> "0x0680,23:20.75,0,0,0""B" --> "1,0,0,0,0,1"Total = 0:0 in 0 cyclesPMU state machine current state is 'NORMAL' PMU reports the DRAM data was INVALID at bootup Accumulated Up-time = 0 days: 0 hours: 23 minutes: 20.085 seconds(1 Active cycles, 1 Power cycles)Latest battery backup time = 00:00:00 (hh:mm:ss)Longest battery backup time = 00:00:00 (hh:mm:ss)Accumulated battery backup time = 00:00:00 (hh:mm:ss)(0 Backup cycles, 0 Completed cycles, 0 Failed cycles, 0 Backup flags)0x4011744 (tErfTask): 0x4011744 (tErfTask): INFO: usb2Msc - Device /bd0 has been claimed bmINFO: usb2Msc - Device /bd0 has been claimed by filesystemNOTIFY: hDevice 0x2 lun 0 medium changed (mediumInsert = 1)PMU Reports Voltages: (AC == 12.085V) (Batt == 0.263V)PMU LED Dimming: Default==25, Current==25PMU Fan Speed AutoAdjust has been ENABLEDPMU Fan Speed: Default== 1, Current== 1Setting Temperature Critical Threshold for Disk from 56 to 65Temperature Thresholds for Disk: Interest== 52, Warning== 55, Critical== 65 -- Override==FPMU Init Done==============================================================================**** ArmadaXP is Type B0Launching LED Sequencer...LED Sequencer...LaunchedLED Sequencer...Testing...Setup Kernel/RTP Messaging InterfaceInitialising kernel<->RTP queues with 80 entriesUSB command/response Q's @ 0xf4102000/0xf4103000MULTI ISSUE command/response Q's @ 0x0/0xf4105000FAST PATH QUEUING RTP INTERFACE ENABLED64-BIT HOST LBAs ENABLEDSetup Kernel/RTP Resource Release Messaging InterfaceInitialising kernel<->RTP resource release queues with 80 entriesMULTI ISSUE RESOURCE RELEASE Q @ 0xf4107000FAST PATH QUEUING RTP RESOURCE RELEASE INTERFACE ENABLEDIntConnect pISR==0x01076b9c was Successful for Cause==32 ("PMU Panic")IntConnect pISR==0x01076c34 was Successful for Cause==40 ("PMU PowerDownReq")IntConnect pISR==0x01076b20 was Successful for Cause==57 ("PMU OverTemp")IntConnect pISR==0x01076d48 was Successful for Cause==29 ("Disk Detected")IntDisable for Cause==65 ("Clear Disk Button")***** Initializing the Kernel's Thermal Monitor ********** Spawning the Kernel's Thermal Monitor ********** Executing Auxilliary Task for the Kernel's Thermal Monitor *****KERNEL BOOTUP: usrAppInit: INFO: bootup with backup battery OFFNot Turning the battery ON yePMUCmd: "~55" --> "~55!"PMUCmd: "K" --> "k"Intercore Access Device Driver - Version 1.0 - Installed.Heatwave MVT Init Compleat! 2071-06-19 21:30:04: diskInterfaceInitialise: Starting Disk Driver(s) Initiali. 2071-06-19 21:30:04: bspDiskConfigureDiskTable: Configuring drive tables for 8e 2071-06-19 21:30:04: diskInterfaceInitialise: System has 8 slots 2071-06-19 21:30:04: diskDriverInstall: 2071-06-19 21:30:04: showDiskTbs: Dumping Disk Driver Config Tables:[New Disk Thread] 2071-06-19 21:30:04: diskConfigureNewDiskThread: Starting thread 2071-06-19 21:30:04: 2071-06-19 21:30:04: Dumping Disk Adapter Table 2071-06-19 21:30:04: Adapter Instance Adapter Address Adapter Data Adds 2071-06-19 21:30:04: 0 0x01E59238 0x00000000 2071-06-19 21:30:04: 1 0x01E59238 0x00000000 2071-06-19 21:30:04: 2 0x01E59238 0x00000000 2071-06-19 21:30:04: 3 0x01E59238 0x00000000 2071-06-19 21:30:04: 2071-06-19 21:30:04: Dumping Disk Slot Config Table: 2071-06-19 21:30:04: Adapter Instance Connection Physical Slot Adapr 2071-06-19 21:30:04: 0 DRIVE 0 8 2071-06-19 21:30:04: 0 DRIVE 1 C 2071-06-19 21:30:04: 1 DRIVE 2 0 2071-06-19 21:30:04: 1 DRIVE 3 4 2071-06-19 21:30:04: 2 DRIVE 4 8 2071-06-19 21:30:04: 2 DRIVE 5 C 2071-06-19 21:30:04: 3 DRIVE 6 0 2071-06-19 21:30:04: 3 DRIVE 7 4 2071-06-19 21:30:04: diskInterfaceInitialise: Calling init with adapter 0 (0x0) 2071-06-19 21:30:04: ahciPerformPhyConfig: Loading phy regs for 91700x69cf2bMax Disk Temp: cData abortException address: 0x010ca130Current Processor Status Register: 0x80000013Task: 0x69cf2bc "tRootTask"(tRootTask): 0x69cf2bc (tRootTask): diskDriAhciStorageRegister:diskDriAhciStorageRegister:0x69cf2bc (tRootTask): 0x69cf2bc (tRootTask): diskDriAhciInstInit:diskDriAhciInstInit:0x69cf2bc (tRootTask): 0x69cf2bc (tRootTask): diskDriAhciInstInit2:diskDriAhciInstInit2:0x69cf2bc (tRootTask): 0x69cf2bc (tRootTask): diskDriAhciInstInit2: Storing 0x04AE9148 to 0diskDriAhciInstInit2: Storing 0x04AE9148 to adapter table entry 00x69cf2bc (tRootTask): 0x69cf2bc (tRootTask): diskDriAhciInstConnect:diskDriAhciInstConnect:0x69cf2bc (tRootTask): 0x69cf2bc (tRootTask): task 0x69cf2bc has had a failure and has bee.task 0x69cf2bc has had a failure and has been stopped.0x69cf2bc (tRootTask): 0x69cf2bc (tRootTask): fatal exception in a kernel task or stack ov!fatal exception in a kernel task or stack overflow!24 C, Ave Disk Temp: 23 C, Fan Speed = 1, Sampling Period = 36 secC, Slot 1: 23 C, Slot 2: 23 C, Slot 3: 24 C,Slot 4: 24 C, Slot 5: 24 C, Slot 6: 24 C, Slot 7: 24 C,CPU Core Temp: 55 C, PMU Core Temp = 33 CTemperature Thresholds for Disk: Interest== 52, Warning== 55, Critical== 65 -- Override==FTemperature Thresholds for CPU : Interest== 95, Warning==101, Critical==104 -- Override==FTemperature Thresholds for PMU : Interest== 78, Warning== 82, Critical== 84 -- Override==FIt did not load the linux stuff. The device was not accessible and i had to reset the device in openocd using reset.Reverseenginering the firmware flashing process or something like in the videos i mentioned above is way beyound my abilities.So please let me know if you can provide files from a working device.For now i will stop my experiments with this device.

author: JimKnopf
author_rank: Frequent Contributor
timestamp: December 27, 2023, 07:01:20 pm
content: As i mentioned earlier "working with address and size values is hard to me". I had a address mismatch in my load_image command in openocd. In #openocd IRC channel (LibraChat) some nice guy informed me that my load address should be:0x02000000 instead of:0x20000000He also told me not to load the firmware file or ELF files as elf format but as bin format in openocd.This time i could load an image:Code:haltload_image /home/<user>/<some_path>/22c.ELF 0x02000000 binresumeIt was successfully loaded to 0x02000000.In Marvell u-boot i tried:Code:bootvx 0x02000000It started to load the image from 0x02000000 but stuck after some lines:Code:Executing: bootvx 0x02000000## Ethernet MAC address not copied to NV RAM## Using bootline (@ 0x1100): neta(3,0) f=0x6000 o=usb0:eth3:cpus=1:mem=0x20000000;MAC3-00e## Starting vxWorks at 0x01000000 ...After some trial and errors i found out, i have to load an image in openocd, use bootvx in u-boot, switch back to openocd and resume at the load address like this:Code:In openocd:haltload_image /home/<user>/<some_path>/22c.ELF 0x02000000 binresumeswitch to Marvell u-boot:td_bootargs_confab; bootvx 0x02000000 (wait until it get stuck)switch back to openocd:haltresume 0x020000000And it loads the extracted ELF file from firmware file. I even could load the whole firmware file in openocd and use bootvx with an offset of 0x22c. The ELF image starts at 0x22c in the firmware file. To my surprise, i also could load the vxworks image i dumped from the device. At the end of the boot process i ended up in a vxworks shell with very limited commands.Code:helpList of the registered topics:EDR List of the shell commands related to ED&R.RTP List of the shell commands related to RTP.SD List of the shell commands related to shared data regions.SHL List of the shell commands related to shared library.VM List of the shell commands related to virtual memory.address_space List of the shell commands related to address space.basic List of basic shell commands.breakpoint List of the shell commands related to breakpoints.esa Commands for the ESA array.filesystem List of the shell commands related to file system.history List of commands relative to history management.interpreter Interpreter shell commands.k Drobo specific commands for the kernel.memory List of the shell commands related to memory.mmap List of the shell commands related to memory mapped objects.modules List of the shell commands related to kernel modules.network Network commandsobject List of the shell commands related to objects.symbols List of the shell commands related to symbols.tasks List of the shell commands related to tasks.List of the registered commands:C Switch to C interpreteradrsp Display information on the address space.alias Add an alias or display aliasbp Display, set or unset a breakpointcd Change current directory.demangle Display demangled stringdprintf Insert a dynamic printf eventpointecho Display a line of textedr ...esa Wrapper command to pass commands through to the esa arrayuser appexit Exit the shell session.expr Evaluate expressionsfile ...func ...getenv Get an environment variablehelp Display the list of the shell commandshistory ...ifconfig IPNET interface configurationk ...logout Logout the shell session.lookup Lookup a symbolmem ...mmap ...module ...more Browse and page through a text file.object ...ping IPNET ping utilityprint ...printf Write formatted outputpwd Display current working directory.reboot Reboot the systemrepeat Repeat a commandroute IPNET route table controlrtp ...sd ...set ...setenv Set an environment variableshl ...show ...slab Print slab cache informationsleep Suspend execution for an interval.string ...syscall ...syscalls Display system call group information in the system.sysctl IPNET sysctl configurationtask ...unalias Remove an aliasunset ...version Display VxWorks version information.vm ...The linux side did not load this way. I only had the vxworks shell. I found some interesting commands and files.Code:show devicesdrv name0 /null1 /tyCo/01 /tyCo/21 /tyCo/32 diagLog8 /proc10 bootHost:11 /vio12 /tgtsvr13 /ESA_REGISTER14 fl4 /bd015 /lxdmesg15 /lxiscsitgtlog15 /lxcrashlog15 /lxlastbootlog15 /lxiscsitgtcore16 /networkinfo17 /serialnuminfoCode:ls /bd0/bd0/vxWorks/bd0/LxImage/bd0/Crashlogs/bd0/NoCrashMsg/bd0/hibLog/bd0/hibHdr/bd0/amitLog/bd0/bootCount/bd0/eventLog/bd0/hdr_prev/bd0/RebootReason/bd0/VXI2.bin/bd0/UBHW.bin/bd0/UBHW.hdr/bd0/hdr/bd0/LxHdr/bd0/VXI2.hdr/bd0/vxWorks_prev/bd0/LxImage_prev/bd0/LxHdr_prev/bd0/RTPI.bin/bd0/RTPI.hdr/bd0/LXFS.bin/bd0/LXFS.hdrI replaced all files where i had a _prev version of a file:Code:file move LxImage LxImage-origfile move vxWorks vxWorks-origfile move LxHdr LxHdr-origfile move hdr hdr-origfile copy LxImage_prev LxImagefile copy vxWorks_prev vxWorksfile copy LxHdr_prev LxHdrfile copy hdr_prev hdrI found out that i could execute .bin files from this directory.In openocd i did a reset and the device startet vxworks AND linux!Code:[vxWorks *]# versionVxWorks (for Marvell Sheeva 88SV584x, Board= Heatwave 1.0 ARMARCHV7 LE core) version 6.8.Kernel: WIND version 2.13.Made on Feb 3 2016, 20:45:55.Boot line:neta(3,0) f=0x6000 o=usb0:eth3:cpus=1:mem=0x20000000;MAC3-00:50:43:11:89:dd;SER-DRB143602000000 s=#/romfs/runesa.vxeCode:Drobo:/ # uname -aLinux Drobo 3.2.96-3 #1 SMP Wed Sep 9 12:29:26 UTC 2020 armv7l GNU/LinuxThe downside is, still no network service running. But both shells working and (one) green light on the device.Both bootlogs are attached.I searched for older firmware files and found two using the wayback archive (https://web.archive.org/web/20200923005204/https://www.drobo.com/docs/start-drobo-b810i/):The failed update version was 2.0.1. I found Version2-0-0https://web.archive.org/web/20200923005204/https://www.drobo.com/docs/start-drobo-b810i/and1-3-5https://web.archive.org/web/20170716181543/http://files.drobo.com/webrelease/b810i/B810i_Firmware_1-3-5.zipI was able to load both firmware files and boot with the offset for the first ELF image. The trick did not work with an offset for the second ELF image in the firmware files.

author: JimKnopf
author_rank: Frequent Contributor
timestamp: December 30, 2023, 10:19:31 pm
content: I compared the md5sum of the files i dumped from the vxworks side with the 3 firmware files:Code:Drobo filedumpMD5 4639529020298b3671d3517c10c09522 vxi2.bin=22c.ELFfound in release.B810i.2-0-1.tdf (first ELF image)MD5 40104317c0dbdd43e84df334dbc1fac6 lximage =12231fa.UImagefound in release.B810i.2-0-1.tdfMD5 e0a1c6d97bd614cfaaebed36c619d83e rtpi.bin=7578b6.ELFfound in release.B810i.2-0-1.tdf (second ELF image)MD5 1bf5585eb18318837a3d4fd4e6fb90a4 LxHdr=selection_0-22bfound in release.B810i.2-0-1.tdf (right before the first ELF image)drobo_2-0-1_extracted-parts#md5sum * [size in bytes]+40104317c0dbdd43e84df334dbc1fac6 12231fa.UImage3168928624b46f91b061795ce641a36f096ed90 1528d16.JFFS211858012+4639529020298b3671d3517c10c09522 22c.ELF7698058+e0a1c6d97bd614cfaaebed36c619d83e 7578b6.ELF11319620+1bf5585eb18318837a3d4fd4e6fb90a4 selection_0-22b556drobo_2-0-0_extracted-parts#md5sum * [size in bytes]ffe68f761c88d77cfed8df5d7619b3c3 11e355c.UImage3168936cd4881229a64f702a6e002aa9c3cb51b 14e9080.JFFS21033055666fb7d8f75c09a7e99cf7910bd9da934 22c.ELF7690876955691ee15ebedc9f9fc6806c773d522 755ca8.ELF11065524497aca92106d4ae411af2e7f63e86e52 selection_0-22b556drobo_1-3-5_extracted-parts#md5sum *cad166fb818c55767df926033faa4ef4 110c4f6.UImage37500248ee2ed4a45a895bbbe6d7d0bedc7f772 149ff4a.JFFS2255296525e96eae5bac03992bbfd82961bb67182 22c.ELF7569558d315b81c0eaf33b84a71e7be84638f65 7382c2.ELF103061008be984ce60d9d34284116926b6edffab selection_0-22b556openocd-dump_20231230# md5sum *7351e5dadd74474690b1f014f3b69570 hdr5567351e5dadd74474690b1f014f3b69570 hdr_prev5564cabb259c8abf4a5adafe2aa07a982c5 hibhdr512+1bf5585eb18318837a3d4fd4e6fb90a4 LxHdr556+1bf5585eb18318837a3d4fd4e6fb90a4 LxHdr_prev556+40104317c0dbdd43e84df334dbc1fac6 lximage3168928+40104317c0dbdd43e84df334dbc1fac6 lximage_prev3168928+e0a1c6d97bd614cfaaebed36c619d83e rtpi.bin113196201bf5585eb18318837a3d4fd4e6fb90a4 RTPI.hdr5569e30738c85838a54dea0271fd743bfca runesa.vxe10177608ecfdbaed33efb962865e71d456349683 ubhw.bin8012727351e5dadd74474690b1f014f3b69570 UBHW.hdr556+4639529020298b3671d3517c10c09522 vxi2.bin7698058+1bf5585eb18318837a3d4fd4e6fb90a4 VXI2.hdr556e83b73a0859310cc8705fe1ad3dfb0d8 vxworks17734472e83b73a0859310cc8705fe1ad3dfb0d8 vxworks_prev17734472I found LxHdr, LxHdr,_prev, RTPI.hdr, VXI2.hdr are the same files, located at the beginning until 0x22c of the firmware file. VXI2.bin is the first ELF image in the firmware file. The second ELF image in the firmware file is RTPI.bin. The LxImage is the called UImage in the firmware file. The firmware contains one more data block, a JFFS2 part.I didn't found the vxWorks stuff in the firmware files. I don't know if that part was ever updated.

author: JimKnopf
author_rank: Frequent Contributor
timestamp: January 01, 2024, 06:42:00 pm
content: Accessing the files on the internal memory, which is only accessible on the vxworks side is waaaaayyyyyyy easier than i tought. It's not possible transfering data over network to the vxworks side. On Marvell U-boot i only have read access. But, during boot, it enables a internal usb drive. I re-checked the board. And there is a small daughterboard containing two memory chips. It is connected with 2x5 pinheader to the mainboard. One pin was removed.It looked like an ordinary USB connector like the ones on a Desktop Mainboard. The daughterboard has a product label "Apacer". It turns out its a common SSD. I checked the pins on the pinheader and compared the voltage to a default USB port and it matches. Using a USB-A connector and some flying wires, it was immediately recognized as USB-drive on my Laptop.I was able to replace VXI2.bin, LxHdr, RTPI.bin and LxImage with the matching sections from firmware file. LxHdr is needed because it contains a checksum for LxImage file (0-22c of firmware file). The firmware release 2-0-0 had same boot problem like the 2-0-1. But the content from firmware release 1-3-5 let the vxworks side boot. At the moment there is an error on the linux side. And still not recognized by Drobo Dashboard.

author: JimKnopf
author_rank: Frequent Contributor
timestamp: January 10, 2024, 08:31:58 pm
content: I did some tests with u-boot settings and managed to freeze the Bootrom 1.2 because of header checksum mismatch.To make things easier, i placed the MX25L6406E cmos serial flash outside the board and used flying wires to connect the IC-adapter to the board.I also replaced the internal USB-SSD temporary with a Pi zero 2w. The advantage is, i don't need to plug/unplug the drive to copy files to the device. Using the pi zero as a usb drive, i can copy files via wifi. I copy files using sftp in linux (or WinSCP in windows).The 9-pin USB connector (only the 4-pin row is used) has 2mm pitch wide. Default dupont connectors have 2,54mm pitch wide. I crimped flying wires to a JST-HX 4-pin connector.Burning the cmos serial flash dump brought the device back to life.

author: JimKnopf
author_rank: Frequent Contributor
timestamp: January 14, 2024, 10:04:06 pm
content: I managed to boot Firmware 1.3.5 and getting Drobo-Dashboard to recognize the device.The App couldn't find an update serverand manual update failed for now. The solution with the wired-out SPI cmos flash and Pi-zero as Wifi-SSD is perfect. Easy to handle.

author: JimKnopf
author_rank: Frequent Contributor
timestamp: January 19, 2024, 09:37:39 pm
content: I don't know why but i can't reproduce recognizing the Drobo by the Dashboard.I will give up on that device. I found out some things, maybe it will help others.The Marvell U-Boot on that device, which is located in the CMOS flash chip doesn't have the typical U-Boot Magic Number (27 05 19 56) and CRC32 checksum in the header (Byte 4 to 7). It starts with 5A. The ARMADA-XP-Functional-SpecDatasheet.pdf tells 0x5A = Boot from SPI/NOR flash. Have a look at the SpecDatasheet for more information.If you corrupt the CMOS flash data, don't worry. There is a file on the internal USB-SSD called UBHW.bin (and the header file UBHW.hdr for it). Most probably UBHW means U-Boot Heatwave, a hint to the board name i guess. The binary contains the U-Boot data without environment data. The individual env settings are stored at 0xd0000 to 0xdffff. If you dump the CMOS flash data, you can cut off the zeros after 0xe0000. The file is less than 1 MB.To start the drobo, you need just LxImage and vxWorks files on the USB-SSD. Thats it.I attached both log files (linux side and vxworks side) from last sunday when the drobo was recognized. You can see in the logfile what files i had on the USB-SSD.The reason why i give up on the device is, it only starts with release 1-3-5 properly. The 2-0-0 and 2-0-1 releases won't start up. I think either vxWorks or Lximage (LXKI Linux Kernel Image) has wrong version to interact with the other side.The LxImage starts with this mtd settings:Code:INFO: Found cfi_flash_0 0 - base 0xd8000000, size 0x8000000, bus 2INFO: flashInfoFill - Found 1 Flash DevicesINFO: flash_map_init - detected 1 devicesMTD: Initialize the cfi_flash_0 device at address 0xd8000000INFO: Io remapped successfully - phy addr = 0xd8000000, virt addr = 0xd9000000INFO: Using cfi_probe to probe cfi_flash_0 at address 0xd8000000, size 0x8000000, width 2mcfi_flash_0: Found 1 x16 devices at 0x0 in 16-bit bank. Manufacturer ID 0x000001 Chip ID 0x002801Amd/Fujitsu Extended Query Table at 0x0040Amd/Fujitsu Extended Query version 1.5.number of CFI chips: 1- detected OK6 cmdlinepart partitions found on MTD device cfi_flash_0Creating 6 MTD partitions on "cfi_flash_0":0x000000000000-0x000000100000 : "nor_hdr"0x000000100000-0x000000400000 : "var"0x000000400000-0x000002200000 : "rfs0"0x000002200000-0x000004000000 : "rfs1"0x000004000000-0x000006000000 : "rfs2"0x000006000000-0x000008000000 : "rfs3"- OK.That is a U-Boot env setting:Code:LxMtd=mtdparts=cfi_flash_0:1m@0m(nor_hdr),3m@1m(var),30m@4m(rfs0),30m@34m(rfs1),32m@64m(rfs2),32m@96m(rfs3)And there is additionally this line:Code:LxRoot=rootfstype=jffs2 root=/dev/mtdblock2 rwWith this settings, release 1-3-5 starts, but has an issue with rfs0 and therefore it can't mount /bin and /etc:Code:[1970-01-01,00:00:12.132085843] 10: INFO: Mounting /bin as rwmount: mounting /tmp/bin on /bin failed: No such device[1970-01-01,00:00:12.166910723] 10: ERROR: Failed to mount /bin as rw[1970-01-01,00:00:12.185068643] 10: INFO: Mounting /etc as rwmount: mounting /tmp/etc on /etc failed: No such device[1970-01-01,00:00:12.219105483] 10: ERROR: Failed to mount /etc as rwThe whole logfile has errors like this:Code:chmod: /etc/monitrc: Read-only file systemawk: /etc/resolv.conf: No such file or directorychmod: /etc/monitrc: Read-only file systemIf i changeCode:LxRoot=rootfstype=jffs2 root=/dev/mtdblock2 rwtoCode:LxRoot=rootfstype=jffs2 root=/dev/mtdblock3 rwIt starts without this Read-only errors. But it didn't recognized the drobo.I also could setCode:setenv LxForceRootFS yesIt will force to use mtd3, no Read-only errors, but still not recognized.When the drobo was recognized, it had this message in my logfile:Code:Sun Jan 14 13:37:44 2024: tCoreCtrl: setLinuxCommonInfo: SUCCESS: Setting Serial Number Config. New serial number = dra160401c00313Sun Jan 14 13:37:44 2024: tCoreCtrl: Unexpected reboot - generate crash log from last boot logsSun Jan 14 13:37:44 2024: tCoreCtrl: copy iscsitgtlog.old to iscsitgtlog.crashSun Jan 14 13:37:59 2024: tCoreCtrl: iSCSI stack ENABLE message receivedSun Jan 14 13:37:59 2024: tCoreCtrl: Initializing network settingsSun Jan 14 13:37:59 2024: tCoreCtrl: InitializeNetworConfigEx: CalledSun Jan 14 13:38:01 2024: tCoreCtrl: iscsiTgtPortalUpdateIPAddress: Old Ipaddr: 0:0:0:0Sun Jan 14 13:38:01 2024: tCoreCtrl: iscsiTgtPortalUpdateIPAddress: Updated Portal Id: 0x11dd38 ipaddress length: 4Sun Jan 14 13:38:01 2024: tCoreCtrl: iscsiTgtPortalUpdateIPAddress: New Ipaddr: 169:254:4:0Sun Jan 14 13:38:01 2024: tCoreCtrl: iscsiTgtPortalUpdateIPAddress: Old Ipaddr: 0:0:0:0Sun Jan 14 13:38:01 2024: tCoreCtrl: iscsiTgtPortalUpdateIPAddress: Updated Portal Id: 0x11df30 ipaddress length: 4Sun Jan 14 13:38:01 2024: tCoreCtrl: iscsiTgtPortalUpdateIPAddress: New Ipaddr: 169:254:5:0Sun Jan 14 13:38:01 2024: tCoreCtrl: File /var/discWhiteList not found. Allowing all hosts for discovery.Sun Jan 14 13:38:01 2024: tCoreCtrl: Starting Discovery!!Sun Jan 14 13:38:01 2024: tIscsiMgr: Setting SO_BINDTODEVICE, for device eth0Sun Jan 14 13:38:01 2024: tCoreCtrl: *************** sending stack UP across icore ***************Sun Jan 14 13:38:01 2024: tIscsiMgr: Setting SO_BINDTODEVICE, for device eth1Sun Jan 14 13:38:01 2024: tDiscListen: Discovery: Listener loop startingSun Jan 14 13:38:01 2024: tDiscAgent: Discovery: Agent startingSun Jan 14 13:38:02 2024: tDiscListen: Added client info for 192.168.10.43:65359 (flags 0x3e, 0x3e)Sun Jan 14 13:38:02 2024: tDiscListen: Client info received from host: IP: 192.168.10.43 Port: 65359 (iqn.1991-05.com.microsoft:sls2 2b0aa8c0-32646)Sun Jan 14 13:38:02 2024: tDiscListen: QueueWaitingHost: Found host 192.168.10.43 on port 65359Sun Jan 14 13:38:05 2024: tEMPDConn00000: EMPDConnection::Starting thread tEMPDConn00000 and clientID SLS231727.0000028690Sun Jan 14 13:38:05 2024: tEMPDConn00000: EMPDListener::AddConnection - for SLS231727 NEW (192.168.10.43 7876 via )Sun Jan 14 13:38:05 2024: tHBConn00000: HBConnection: Starting thread tHBConn00000 and clientID SLS231727.0000028690Sun Jan 14 13:38:05 2024: tHBConn00000: HBConnection::Start- The Unique ID received is : 0000028690Sun Jan 14 13:38:05 2024: tHBConn00000: HBConnection::Start- The host ID received is : SLS231727Sun Jan 14 13:38:05 2024: tHBConn00000: HBConnection::Start- Received new connection!!Sun Jan 14 13:38:05 2024: tHBConn00000: HBConnection::Start- Now starting to send heart beat messages -I tried Drobo-Dashboard 3.5.0 and the older 2.6.4 on Windows. If i manually set the IP for the Drobo, it never find it. There is always an error message about incomplete header like this:Code:chmod: /etc/monitrc: Read-only file systemchmod: /etc/monitrc: Read-only file systemchmod: /etc/monitrc: Read-only file systemThu Jan 18 15:23:24 2024: tEMPDConn00000: EMPDConnection: did not receive complete header! (recv len 0, hdr len 47, error 0)Thu Jan 18 15:23:24 2024: tEMPDConn00000: EMPDConnection: Error 0 receiving login header.Thu Jan 18 15:23:24 2024: tEMPDConn00000: EMPDConnection: Cleaning up thread tEMPDConn00000 for host with UIDThu Jan 18 15:23:24 2024: tEMPDConn00000: HBListener::SetupCleanup forThu Jan 18 15:23:24 2024: tEMPDConn00000: HBListener::SetupCleanup for . DoneThu Jan 18 15:23:24 2024: tEMPDConn00000: EMPDListener::RemoveConnection - forchmod: /etc/monitrc: Read-only file systemchmod: /etc/monitrc: Read-only file systemchmod: /etc/monitrc: Read-only file systemI sniffed the packet with wireshark but couldn't find any suspicious fault in the data. I don't have a working datastream for comparison.I also tried tricks i found somewhere like using nc to redirect port 5002 to the drobo with this command without success:Code:nc -lvu 5002 | nc 192.168.10.72 (Drobo ip)

author: JimKnopf
author_rank: Frequent Contributor
timestamp: January 22, 2024, 06:02:10 am
content: I tried one last thing because of the "Read-only file system" error message on mtdblock1.The 128 MB NOR-flash chip (Spansion S29GL01GS10TFI01) is on the backside of the mainboard. The internal USB-SSD has all the system files on it like vxWorks, the LxImage that starts every time from USB-SSD and LXFS which is a JFFS2 filesystem. I thought, what if i erase the NOR-flash. Maybe something is wrong with the data and therefore mtdblock2 can't be mounted. I desoldered the 56 pin NOR-flash and dumped the data using a RT809H programmer and compard the data with my two memory dumps i did earlier using openocd. The openocd dumps had 3 JFFS2 sections. The dump from RT809H programmer had 7 JFFS2 sections.After erasing the chip, the Linux side didn't came up because it couldn't init the NOR-flash.Code:2.164160] md: Waiting for all devices to be available before autodetect[ 2.170982] md: If you don't use raid, use raid=noautodetect[ 2.177276] md: Autodetecting RAID arrays.[ 2.181399] md: Scanned 0 and added 0 devices.[ 2.185857] md: autorun ...[ 2.188657] md: ... autorun DONE.[ 2.215786] JFFS2 notice: (1) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found.[ 2.231091] VFS: Mounted root (jffs2 filesystem) on device 31:3.[ 2.237291] Freeing init memory: 240K[ 2.241015] Kernel panic - not syncing: No init found. Try passing init= option to kernel. See Linux Documentation/init.txt for guidance.[ 2.253499] CPU0: stopping[ 2.256215] Backtrace:[ 2.258701] [<80011acc>] (dump_backtrace+0x0/0x10c) from [<8055958c>] (dump_stack+0x18/0x1c)[ 2.267166] r7:8074bf8c r6:fbb21000 r5:00000000 r4:807958dc[ 2.272899] [<80559574>] (dump_stack+0x0/0x1c) from [<800132dc>] (handle_IPI+0x108/0x184)[ 2.281106] [<800131d4>] (handle_IPI+0x0/0x184) from [<80008394>] (do_IPI+0x10/0x14)[ 2.288873] r5:60000013 r4:8000f090[ 2.292488] [<80008384>] (do_IPI+0x0/0x14) from [<8055c8b4>] (__irq_svc+0x34/0xe8)[ 2.300082] Exception stack(0x8074bf58 to 0x8074bfa0)[ 2.305150] bf40: 0000001f 807562fc[ 2.313357] bf60: 8074bf90 80018ea4 8074a000 8075c36c 807956c4 8056721c 2000406a 562f5842[ 2.321565] bf80: 00000000 8074bfbc 8074bfa0 8074bfa0 8000ec5c 8000f090 60000013 ffffffff[ 2.329774] [<8000f008>] (cpu_idle+0x0/0xcc) from [<8054ef34>] (rest_init+0x64/0x7c)[ 2.337541] r7:8075c364 r6:80738a40 r5:00000000 r4:80756e84[ 2.343274] [<8054eed0>] (rest_init+0x0/0x7c) from [<8070c89c>] (start_kernel+0x204/0x240)[ 2.351569] [<8070c698>] (start_kernel+0x0/0x240) from [<20008040>] (0x20008040)[ 2.358990] CPU2: stopping[ 2.361705] Backtrace:[ 2.364184] [<80011acc>] (dump_backtrace+0x0/0x10c) from [<8055958c>] (dump_stack+0x18/0x1c)[ 2.372648] r7:b1119fac r6:fbb21000 r5:00000002 r4:807958dc[ 2.378377] [<80559574>] (dump_stack+0x0/0x1c) from [<800132dc>] (handle_IPI+0x108/0x184)[ 2.386585] [<800131d4>] (handle_IPI+0x0/0x184) from [<80008394>] (do_IPI+0x10/0x14)[ 2.394351] r5:60000013 r4:8000f090[ 2.397965] [<80008384>] (do_IPI+0x0/0x14) from [<8055c8b4>] (__irq_svc+0x34/0xe8)[ 2.405558] Exception stack(0xb1119f78 to 0xb1119fc0)[ 2.410626] 9f60: 00000021 807562fc[ 2.418834] 9f80: b1119fb0 80018ea4 b1118000 8075c36c 807956c4 8056721c 2000406a 562f5842[ 2.427042] 9fa0: 00000000 b1119fdc b1119fc0 b1119fc0 8000ec5c 8000f090 60000013 ffffffff[ 2.435251] [<8000f008>] (cpu_idle+0x0/0xcc) from [<8055698c>] (secondary_start_kernel+0x140/0x164)[ 2.444324] r7:807958e4 r6:10c03c7d r5:00000015 r4:00000004[ 2.450050] [<8055684c>] (secondary_start_kernel+0x0/0x164) from [<20556494>] (0x20556494)[ 2.458340] r5:00000015 r4:5112006a[ 2.461949] shared_mem_panic_event: Kernel panic event handler called. Notifying VxWorks Core of Kernel panic.As you can see in the image, there are 16 Bytes (0x0 - 0x1f) at the beginning before a large empty block. After inserting the 16 bytes (i desoldered/resoldered the chip six times) the system started with errors, missing Magic Bytes at specific offset addresses.It didn't work this way. I put all dumped data back on the NOR-flash to get the system status i already had before.

author: Mudgho
author_rank: Newbie
timestamp: September 14, 2024, 11:09:23 am
content: I found this thread interesting but sadly I don't have much to add in terms of trying to fix your bricked unit. I did however recently come across a 4-bay Drobo gen 3 USB (DAS). I dont really have any use for the beyondraid and was thinking of possibly just making a JBOD enclosure out of it but looking around it seems its quite the task. Given your experience with the firmware things youve done I was wondering if you think its doable. By doable I mean can it be done using the current hardware. I'm not as versed as you with these things but I do like tinkering with stuff.

author: JimKnopf
author_rank: Frequent Contributor
timestamp: September 14, 2024, 11:29:29 am
content: @Mudgho This is not a PC. It's a special piece of hardware and the manufacturer is gone. You need driver blobs to get the hardware working. I'm not a Drobo expert. I think it will be difficult to reach your goal.

author: Mudgho
author_rank: Newbie
timestamp: September 14, 2024, 03:13:22 pm
content: Thanks for your quick response, I am aware that its not a PC, for what I'm thinking of it doesnt have to be. I'm just looking to make use of the hardware in a different way but looking into it I understand it's a big ask. Just thought I'd ask your opinion since you did some findings regarding the firmware, thanks for your input though.

author: coromonadalix
author_rank: Super Contributor
timestamp: September 14, 2024, 04:17:15 pm
content: best luck would be finding one working and duplicate the contents ??