HP T5325 Thin Client U-Boot-2017.07-tld-1

Well, I gave it a shot using the latest kernel and rootfs and I managed to flash /dev/mtd0 (the mtd definition looks correct, according to the first post):

root@debian:/boot# cat /proc/mtd 
dev:    size   erasesize  name
mtd0: 00080000 00010000 "uboot"
mtd1: 00040000 00010000 "sdd_firmware"
mtd2: 00010000 00010000 "uboot_env"
mtd3: 00010000 00010000 "permanent_uboot_env"
mtd4: 00010000 00010000 "hp_env"

The only thing that failed was flashing the default env:

root@debian:/boot# flash_unlock /dev/mtd2
flash_unlock: error!: could not unlock device: /dev/mtd2
error 22 (Invalid argument)

root@debian:/boot# flashcp -v uboot.2016.05-tld-1.environment.64K.img  /dev/mtd2
Erasing blocks: 1/1 (100%)
Writing data: 64k/64k (100%)
Verifying data: 10k/64k (15%)
File does not seem to match flash data. First mismatch at 0x00000000-0x00002800

strace log, in case it's of use

root@debian:/boot# cat log
execve("/usr/sbin/flash_unlock", ["flash_unlock", "/dev/mtd2"], 0x7ee0bde4 /* 14 vars */) = 0
brk(NULL)                               = 0x9d5000
uname({sysname="Linux", nodename="debian", ...}) = 0
access("/etc/ld.so.preload", R_OK)      = -1 ENOENT (No such file or directory)
openat(AT_FDCWD, "/etc/ld.so.cache", O_RDONLY|O_LARGEFILE|O_CLOEXEC) = 3
fstat64(3, {st_mode=S_IFREG|0644, st_size=13745, ...}) = 0
mmap2(NULL, 13745, PROT_READ, MAP_PRIVATE, 3, 0) = 0x76f1c000
close(3)                                = 0
openat(AT_FDCWD, "/lib/arm-linux-gnueabi/libc.so.6", O_RDONLY|O_LARGEFILE|O_CLOEXEC) = 3
read(3, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0(\0\1\0\0\0\354\255\1\0004\0\0\0"..., 512) = 512
fstat64(3, {st_mode=S_IFREG|0755, st_size=1341968, ...}) = 0
mmap2(NULL, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x76f1a000
mmap2(NULL, 1411240, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x76d96000
mprotect(0x76eda000, 61440, PROT_NONE)  = 0
mmap2(0x76ee9000, 16384, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x143000) = 0x76ee9000
mmap2(0x76eed000, 6312, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x76eed000
close(3)                                = 0
set_tls(0x76f1ac00)                     = 0
mprotect(0x76ee9000, 8192, PROT_READ)   = 0
mprotect(0x4c1000, 4096, PROT_READ)     = 0
mprotect(0x76f20000, 4096, PROT_READ)   = 0
munmap(0x76f1c000, 13745)               = 0
openat(AT_FDCWD, "/dev/mtd2", O_RDWR)   = 3
ioctl(3, MIXER_READ(1) or MEMGETINFO, {type=MTD_NORFLASH, flags=MTD_WRITEABLE|MTD_BIT_WRITEABLE, size=0x10000, erasesize=0x10000, writesize=0x1, oobsize=0, padding=0}) = 0
ioctl(3, MIXER_WRITE(6) or MEMUNLOCK, {start=0, length=0x10000}) = -1 EINVAL (Invalid argument)
write(2, "flash_unlock: error!: could not "..., 58flash_unlock: error!: could not unlock device: /dev/mtd2

) = 58
write(2, "              error 22 (Invalid "..., 42              error 22 (Invalid argument)
) = 42
exit_group(-1)                          = ?
+++ exited with 255 +++

Edit:

As expected, the new uBoot works just fine with the exception that it obviously fails when reading the env:

U-Boot 2017.07-tld-1 (Nov 01 2017 - 00:58:19 -0700)
HP Thin Client T5325

SoC:   Kirkwood 88F6281_A1
SPI:   ready
DRAM:  512 MiB
WARNING: Caches not enabled
MMC:   
SF: Detected m25p80 with page size 256 Bytes, erase size 64 KiB, total 1 MiB
*** Warning - bad CRC, using default environment

In:    serial
Out:   serial
Err:   serial
Net:   egiga0
88E3016 Initialized on egiga0

Edit 2: I tried issuing a saveenv and it succedeed, but the CRC mismatch message is still appearing.

Edit 3: Saved env vars are not persisting across cold boots. I've been reading the M25P80 datasheet and it seems to have some non-volatile bits to protect certain memory regions. I do have an SPI flash reader in hand and I can get some compatible ICs. Do you think that could be related? If it's worth it I might give it a shot, at least for the sake of finding it out for the next guy :)

Datasheet: https://media-www.micron.com/-/media/client/global/documents/products/data-sheet/nor-flash/serial-nor/m25p/m25p80.pdf?rev=c3236118aac04069a628d41fe50d26eb



Edited 4 time(s). Last edit at 09/21/2023 07:12PM by fermino.

(I wrote this before seeing your post).

==============

Power up, interrupt serial console and,

setenv mtdparts 'mtdparts=spi0.0:512K(uboot),256K(sdd_firmware),64K(uboot_env),64K(permanent_uboot_env),64K(hp_env)'
setenv usb_set_bootargs 'setenv bootargs console=ttyS0,115200 root=LABEL=rootfs rootdelay=10 $mtdparts earlyprintk=serial'

And then

boot

After it booted into Debian,

dmesg
cat /proc/mtd

Now you should see

dev: size erasesize name 
mtd0: 00080000 00010000 "uboot" 
mtd1: 00040000 00010000 "sdd_firmware" 
mtd2: 00010000 00010000 "uboot_env" 
mtd3: 00010000 00010000 "permanent_uboot_env" 
mtd4: 00010000 00010000 "hp_env"

If it is confirmed, flash u-boot and envs images again. If flash_unlock spits out error, ignore it (just a warning).

If there is flashing errrors, post the entire serial console log of this session (from u-boot banner until the flashing errors).

-bodhi
===========================
Forum Wiki
bodhi's corner (buy bodhi a beer)

> across cold boots. I've been reading the M25P80
> datasheet and it seems to have some non-volatile
> bits to protect certain memory regions. I do have
> an SPI flash reader in hand and I can get some
> compatible ICs. Do you think that could be
> related? If it's worth it I might give it a shot,
> at least for the sake of finding it out for the
> next guy :)
>
> Datasheet:
> https://media-www.micron.com/-/media/client/global/documents/products/data-sheet/nor-flash/serial-nor/m25p/m25p80.pdf?rev=c3236118aac04069a628d41fe50d26eb

Don't worry about this, it's been figured out before.

I just need to see your dmesg to explain why. Your kernel bootargs was probably messed up.

-bodhi
===========================
Forum Wiki
bodhi's corner (buy bodhi a beer)



Edited 2 time(s). Last edit at 09/21/2023 09:18PM by bodhi.

Hi again!

I tried setting mtdparts in the cmdline as you suggested but so far no luck :(

Here's the log (I tried unlocking and flashing mtd0 too without luck too, just in case): https://pastebin.com/ap1tqgsm

Edit: the default env after a cold boot is the following:

U-Boot 2017.07-tld-1 (Nov 01 2017 - 00:58:19 -0700)
HP Thin Client T5325

SoC:   Kirkwood 88F6281_A1
SPI:   ready
DRAM:  512 MiB
WARNING: Caches not enabled
MMC:   
SF: Detected m25p80 with page size 256 Bytes, erase size 64 KiB, total 1 MiB
*** Warning - bad CRC, using default environment

In:    serial
Out:   serial
Err:   serial
Net:   egiga0
88E3016 Initialized on egiga0
Hit any key to stop autoboot:  0 
T5325> printenv
arcNumber=2846
baudrate=115200
bootcmd=run bootcmd_uenv; run scan_disk; run set_bootargs; run bootcmd_exec; reset
bootcmd_exec=run load_uimage; if run load_initrd; then if run load_dtb; then bootm $load_uimage_addr $load_initrd_addr $load_dtb_addr; else bootm $load_uimage_addr $load_initrd_addr; fi; else if run load_dtb; then bootm $load_uimage_addr - $load_dtb_addr; else bootm$load_
uimage_addr; fi; fi
bootcmd_uenv=run uenv_load; if test $uenv_loaded -eq 1; then run uenv_import; fi
bootdelay=10
bootdev=usb
console=ttyS0,115200
device=0:1
devices=usb ide
disks=0 1 2 3
dtb_file=/boot/dts/kirkwood-t5325.dtb
ethact=egiga0
ethaddr=52:3b:20:9c:11:51
if_netconsole=ping $serverip
ipaddr=192.168.0.231
led_error=orange blinking
led_exit=green off
led_init=green blinking
load_dtb=echo loading DTB $dtb_file ...; load $bootdev $device $load_dtb_addr $dtb_file
load_dtb_addr=0x1c00000
load_initrd=echo loading uInitrd ...; load $bootdev $device $load_initrd_addr /boot/uInitrd
load_initrd_addr=0x1100000
load_uimage=echo loading uImage ...; load $bootdev $device $load_uimage_addr /boot/uImage
load_uimage_addr=0x800000
mainlineLinux=yes
mtdparts=mtdparts=spi0.0:512K(uboot),256K(sdd_firmware),64K(uboot_env),64K(permanent_uboot_env),64K(hp_env)
preboot_nc=run if_netconsole start_netconsole
scan_disk=echo running scan_disk ...; scan_done=0; setenv scan_usb "usb start";  setenv scan_ide "ide reset";  setenv scan_mmc "mmc rescan"; for dev in $devices; do if test $scan_done -eq 0; then echo Scan device $dev; run scan_$dev; for disknum in $disks; do if test $sca
n_done -eq 0; then echo device $dev $disknum:1; if load $dev $disknum:1 $load_uimage_addr /boot/uImage 1; then scan_done=1; echo Found bootable drive on $dev $disknum; setenv device $disknum:1; setenv bootdev $dev; fi; fi; done; fi; done
serverip=192.168.0.220
set_bootargs=setenv bootargs console=ttyS0,115200 root=LABEL=rootfs rootdelay=10 $mtdparts $custom_params
start_netconsole=setenv ncip $serverip; setenv bootdelay 10; setenv stdin nc; setenv stdout nc; setenv stderr nc; version;
stderr=serial
stdin=serial
stdout=serial
uenv_addr=0x810000
uenv_import=echo importing envs ...; env import -t $uenv_addr $filesize
uenv_init_devices=setenv init_usb "usb start";  setenv init_ide "ide reset";  setenv init_mmc "mmc rescan"; for devtype in $devices; do run init_$devtype; done;
uenv_load=run uenv_init_devices; setenv uenv_loaded 0; for devtype in $devices;  do for disknum in 0; do run uenv_read_disk; done; done;
uenv_read=echo loading envs from $devtype $disknum ...; if load $devtype $disknum:1 $uenv_addr /boot/uEnv.txt; then setenv uenv_loaded 1; fi
uenv_read_disk=if test $devtype -eq mmc; then if $devtype part; then run uenv_read;  fi; else if $devtype part $disknum; then run uenv_read; fi;  fi
usb_ready_retry=15

Environment size: 2876/65532 bytes

Edited 1 time(s). Last edit at 09/22/2023 11:34AM by fermino.

fermino,

As I said above,

Quote

I just need to see your dmesg to explain why. Your kernel bootargs was probably messed up.

So cold start again with serial console connected, let it boot automatically and then log in,

cat /proc/mtd

And then copy the entire log and post here.

-bodhi
===========================
Forum Wiki
bodhi's corner (buy bodhi a beer)

Hi again! Sorry for the long delay!

Here is the log; I have tested it in two devices and both show the same behavior.

https://pastebin.com/6N8SzjbE

OK. But your log stopped at

root@debian:~# flash_unlock /dev/mtd2
flash_unlock: error!: could not unlock device: /dev/mtd2

This error should be ignored. Nowadays Linux does not care to lock the flash anymore.

And did the actual flashing of the envs give out the same error as before?

=======

Let's do it this way.

Start a serial console server (instead of kwboot), and power up the box.

After stock u-boot started, interrupt the countdown and,

help

Check flash protection

flinfo

if you see

Write Protection    : All

Unprotect the flash (this probably is the right syntax, it's been a long time I'm not sure I remember correctly).

protect off all

And then

reset

After stock u-boot restart, interrupt the countdown , and check the flash protection again. If it shows

Write Protection    : All

Do

protect off all

and then boot all the way into Debian.

And flash both u-boot image and envs image again.

-bodhi
===========================
Forum Wiki
bodhi's corner (buy bodhi a beer)

It worked!

I reflashed stock uboot and as I noticed the flash locking state was persistent across resets, in order to just use the same rootfs I unlocked it and then used kwboot to UART boot the latest uboot and use the rootfs and kernel I had already working.

HP>> flinfo
Bank # 1:
Flash Base Address  : 0xf8000000
Flash Model         : Numonyx-25P80
Manufacturer ID     : 0x20
Device Id           : 0x2014
Sector Size         : 64K
Number of sectors   : 16
Page Size           : 256
Write Protection    : Upper 1 of 8

HP>> protect off all
Un-Protect Flash Bank # 1
................ done

HP>> flinfo
Bank # 1:
Flash Base Address  : 0xf8000000
Flash Model         : Numonyx-25P80
Manufacturer ID     : 0x20
Device Id           : 0x2014
Sector Size         : 64K
Number of sectors   : 16
Page Size           : 256
Write Protection    : Off

Then close the serial terminal without resetting it (in minicom, CTRL+A then Z then Q); and then:

echo -e "reset\n" > /dev/ttyUSB0 && kwboot -t -B 115200 /dev/ttyUSB0 -b uboot.2017.07-tld-1.t5325.mtd0.kwb

Errata: it seems the lock bits are persistent across reboots too, so long as the power is not removed. Instead of issuing a reset and then kwboot'ing (which can be succeptible to timing issues), I've found it's more reliable to power it off by keeping the power button pressed for ~7 seconds, exec kwboot, and then power it back on.

Afterwards:

root@debian:/boot# flash_unlock -i /dev/mtd0
Device: /dev/mtd0
Start: 0
Len: 0x80000
Lock status: unlocked
Return code: 0
root@debian:/boot# flash_unlock -i /dev/mtd2
Device: /dev/mtd2
Start: 0
Len: 0x10000
Lock status: unlocked

root@debian:/boot# flashcp -v uboot.2017.07-tld-1.t5325.mtd0.kwb /dev/mtd0
Erasing blocks: 8/8 (100%)
Writing data: 512k/512k (100%)
Verifying data: 512k/512k (100%)

root@debian:/boot# flashcp -v uboot.2016.05-tld-1.environment.64K.img  /dev/mtd2
Erasing blocks: 1/1 (100%)
Writing data: 64k/64k (100%)
Verifying data: 64k/64k (100%)

Thank you, very very much!



Edited 8 time(s). Last edit at 09/27/2023 04:00PM by fermino.

Cool!

I'm glad you got it work without the drastic step of reprogramming. I think I need a warning in my installation steps about how to unprotect the flash if it a box was shipped with that protected bit on.

The later u-boot (circa 2023) can do this flash unprotection automatically. Perhaps a new u-boot 2023.04 is needed for this box to make it transparent. Just that it has been a long time since somebody is interested in this box, I dit not think a rebase to 2023.04 is worth it.

-bodhi
===========================
Forum Wiki
bodhi's corner (buy bodhi a beer)

Small errata: I couldn't get that to work reliably. Adding a bit of delay in stock uboot helped, but even then I couldn't get kwboot to work reliably.

I did find, though, that the lock bits are preserved so long as the power is not removed, so I updated my previous comment accordingly, in case anyone has the same issue.

I do not think a rebase would be worth the hassle, it's just one more step to get it fully working as it is now!
In any case, many thanks again! I guess it is an old box, but my dad got like 6 of them for pretty cheap and now we need to figure something out to do with them!

Kind regards,
Fermín Olaiz.

Fermín,

Look at using uEnv.txt to change the envs without actually saving to flash, in the main u-boot thread.

https://forum.doozan.com/read.php?3,12381

Quote

C. Add uEnv.txt to /boot directory (Optional)

-bodhi
===========================
Forum Wiki
bodhi's corner (buy bodhi a beer)

Quick update: I just noticed the network interface wasn't working, and I noticed that the wrong dtb_file was being loaded by the stock config.

I did the following and now it's working:

T5325> setenv dtb_file /boot/dts/kirkwood-t5325.dtb
T5325> saveenv
Saving Environment to SPI Flash...
SF: Detected m25p80 with page size 256 Bytes, erase size 64 KiB, total 1 MiB
Erasing SPI flash...Writing to SPI flash...done

Edited 1 time(s). Last edit at 10/03/2023 02:46PM by fermino.

fermino,

You've missed this in the installation Steps.

Quote

6. And add fw_env.config to your stock OS. And then reference your saved current_envs.txt in step 2 to restore box specific info in u-boot envs.

a. Add fw_env.config to your stock OS.

echo "/dev/mtd0 0x00000 0x10000 0x10000" > /etc/fw_env.config

b. Modify envs and also setup netconsole. Replace xx below with your box specific settings.

Note that the mtdparts layout are changed in the following fw_setenv commands. So when you reboot into Debian roots, the mtdparts will have a new layout.

/tmp/sdb1/usr/bin/fw_setenv arcNumber '2846'
/tmp/sdb1/usr/bin/fw_setenv mtdparts 'mtdparts=spi0.0:512K(uboot),256K(sdd_firmware),64K(uboot_env),64K(permanent_uboot_env),64K(hp_env)'
/tmp/sdb1/usr/bin/fw_setenv ethaddr 'xx:xx:xx:xx:xx:xx'
/tmp/sdb1/usr/bin/fw_setenv devices 'usb ide'
/tmp/sdb1/usr/bin/fw_setenv dtb_file '/boot/dts/kirkwood-t5325.dtb'

-bodhi
===========================
Forum Wiki
bodhi's corner (buy bodhi a beer)