HP E4406A Repair - /dev/ffs I/O Error

[sophiecat]

Hi all,

I picked up a broken HP E4406A a few months ago at Dayton Hamvention. I have been working on getting it up and running. When I boot it, it eventually gets stuck trying to mount /dev/ffs. I've attached a screenshot.

I believe I need a new flash module, but I also recognize the issue could be somewhere else on the CPU/system board. I'm having trouble locating either of these for a halfway-reasonable price. I've also considered doing a board-level repair, but even Googling the part numbers on the flash chips returns nothing of value.

Even if I can get the flash memory replaced, I'm not sure how much effort it'll be to re-calibrate everything. It seems like it may be an ordeal.

Is this a lost cause? Should I just part it out? I would really prefer getting it working if possible, even if it means making my own flash board. I've been having trouble locating schematics but if anyone has any, it would be greatly appreciated.

Thanks!

Sophie

[EggertEnjoyer123]

You could potentially try reflashing the firmware:

https://www.keysight.com/us/en/lib/software-detail/computer-software/e4406a-vsa-transmitter-tester-firmware-201154.html

[PA0PBZ]

Here's the "Service Guide" but it doesn't contain any schematics so it's useless:

http://www.bitsavers.org/test_equipment/hp/vxi/E4406_Transmitter_Tester/E4406-90178_E4406A_Service_Guide_200603.pdf

Updating the firmware requires a running OS on the VSA, it doesn't look like it gets that far in the boot process.

If you download and unpack the firmware files you can see how it is done.

[squadchannel]

do not understand the internal structure.

Fortunately I think the CPU, display and boot ROM are working. Perhaps it failed during the update process and is an incomplete OS.

What is the model number of the flash? Have you backed it up? Please back up the contents of the flash first. lucky if the adjustment data is not corrupted. Then you may be able to restore from the firmware update file available from Keysight.

There may be a "DFU" mode that is not documented. We do not know.

[squadchannel]

I have checked the contents of the updater available from keysight.
It appears to be controlled via FTP or SSH (?) It seems to update the firmware by controlling it.
I don't think it's linux, but it seems to be running shell commands commonly seen in Linux. chmod,chown etc...

The data_files folder in the updater is very interesting. There is even what appears to be a way to enable options.

can you run the updater anyway?

However, it is quite possible that the flash or its peripheral circuits are damaged, as inferred from the IO error.

[PA0PBZ]

The update program runs an FTP server (tftpdnt.exe) and the VSA connect to that. If the OS is running you can also connect to the VSA via FTP, the name/password are in the comm.txt file.
The data_files folder contains the method to install the binaries for the options, not the options itself but that also is trivial to do.
The update program will not run if it can't connect to the VSA, and for that to happen the OS needs to be running.

They had a way to upgrade the OS (zip drive anyone?)   https://www.keysight.com/us/en/assets/9018-40187/installation-guides/9018-40187.pdf
Maybe the package can be found online somewhere, it includes a boot disk so maybe not all is lost?

[squadchannel]

They had a way to upgrade the OS (zip drive anyone?)   https://www.keysight.com/us/en/assets/9018-40187/installation-guides/9018-40187.pdf

https://groups.io/g/HP-Agilent-Keysight-equipment/message/131856

It is worth contacting them.
Perhaps Marcelo in this message is you?

MOD
Marcelo thought it was you, but upon closer inspection it was not. Thermal Camera

[PA0PBZ]

Marcelo thought it was you, but upon closer inspection it was not. Thermal Camera

Same camera and same color palette it seems, I don't blame you 

[gslick]

I have checked the contents of the updater available from keysight.
It appears to be controlled via FTP or SSH (?) It seems to update the firmware by controlling it.
I don't think it's linux, but it seems to be running shell commands commonly seen in Linux. chmod,chown etc...

The E4406A CPU board is based on a PA-RISC PA-7300LC CPU. As shown in the boot screen image attached to the first post of this thread, it boots HP-RT Version A.03.01 from flash.

https://www.openpa.net/hp-rt_realtime-vme.html

The same CPU board is also used in HP / Agilent 16600/16700-series logic analyzers, although in that usage scenario the CPU board is populated slightly differently. One difference is that while the 9914 GPIB controller IC is still populated on the PCB, the external GPIB connector is not populated. Also, instead of booting HP-RT from a flash memory daughter board, the 16600/16700-series logic analyzers boot HP-UX from a SCSI hard drive. While the SCSI controller is contained in the "LASI" chip on the CPU board, a separate board that attaches to the CPU board provides the SCSI bus connectors.

If the flash memory containing the HP-RT OS image is corrupted to the point where the E4406A cannot boot from it, I wonder if the initial power on firmware can boot from a TFTP image of the OS through the LAN interface.

On the 16600/16700-series logic analyzers, you can hit keys on an attached PS/2 keyboard to stop the power on firmware from attempting to auto boot an OS. If the E4406A CPU board has basically the same power on firmware, maybe the SEARCH command can find a TFTP server that has been set up appropriately to serve a boot image to the E4406A, and then the BOOT command can be used to boot from that TFTP server.

Without installing the E4406A firmware update files on a PC and taking a look at the files that it configures to be served by the TFTP server, I don't know if the firmware update include whatever files that would be necessary for a LAN boot of a E4406A. And then even if the E4406A could be booted from the LAN, I don't know if the firmware update procedure could then be run to correct and update a corrupt OS flash image on the E4406A.

Below is sample power on firmware console output on a 16600/16700-series logic analyzer that is stopped before attempting to auto boot an OS from a boot device. Can you get to basically the same power on firmware console interface on an E4406A?

Code: [Select]

Firmware Version  2.1

Duplex Console IO Dependent Code (IODC) revision 1

Memory Test/Initialization Completed

------------------------------------------------------------------------------
   (c) Copyright 1995-1998, Hewlett-Packard Company, All rights reserved
------------------------------------------------------------------------------

  Processor   Speed            State           Coprocessor State  Cache Size
  ---------  --------   ---------------------  -----------------  ----------
      0      150 MHz    Active                 Functional          64 KB


  Available memory (bytes)    :   67108864
  Good memory required (bytes):   67108864

  Primary boot path:    255.0
  Alternate boot path:  SESCSI.6.0
  Console path:         GRAPHICS(0)
  Keyboard path:        PS2

------- Main Menu -------------------------------------------------------------

        Command                         Description
        -------                         -----------
        BOot [PRI|ALT|<path>]           Boot from specified path
        PAth [PRI|ALT|CON|KEY] [<path>] Display or modify a path
        SEArch [DIsplay|IPL] [<path>]   Search for boot devices

        COnfiguration [<command>]       Access Configuration menu/commands
        INformation [<command>]         Access Information menu/commands
        SERvice [<command>]             Access Service menu/commands

        DIsplay                         Redisplay the current menu
        HElp [<menu>|<command>]         Display help for menu or command
        RESET                           Restart the system
-------
Main Menu: Enter command > HELP

------- Main Help -------------------------------------------------------------

        The Main menu is the first menu displayed when the firmware user
        interface is executed. The other menus available to the user are
        listed here.

        Type DIsplay to view the commands available from this menu.

        Other menus can be accessed by entering the name of the menu at the
        command prompt. From a given menu, a command from any other menu can
        be executed by entering the menu name that is associated with the
        command, followed by the command.
        For example, to execute the TIme command (in the Configuration menu)
        from the Main menu, type "co ti".

        Type HElp MAin to see all available commands listed under their
        respective menus.

-------
Main Menu: Enter command > HELP MAIN

---- Main Menu Help -----------------------------------------------------------

     COnfiguration------------------------------------AUto
     INformation-----------------------ALL            BootID
     SERvice-------------ChassisCodes  BootINfo       BootINfo
                         CLEARPIM      CAche          BootTimer
                         EepromRead    ChipRevisions  DEfault
                         MemRead       CoProcessor    FAn
                         PciDelay      FwrVersion     FastBoot
                         PIM           IO             LanConfig
                                       LanAddress     MOnitor
                                       MEmory         PAth
                                       PRocessor      SEArch
                                       WArnings       SECure
                                                      TIme

                         BOot          BOot           BOot
                         DIsplay       DIsplay        DIsplay
                         HElp          HElp           HElp
                         RESET         RESET          RESET
                         MAin          MAin           MAin

     Type DIsplay to show the commands available from the current menu.

Main Menu: Enter command > HELP BOOT

------- Boot Help -------------------------------------------------------------

        BOot continues the boot sequence from the specified path.
        The primary boot path is normally the disk containing
        the operating system.
        The alternate path is normally a tape device.

        BOot                           Boot from primary path
        BOot PRImary                   Boot from primary path
        BOot ALTernate                 Boot from alternate path
        BOot LAN<.lan path> INSTALL    Boot from HP-UX install server
        BOot <path>                    Boot from specified path

             <.lan path> is a delimiter '.' followed by either
                         an IP address, such as 10.6.6.6
                         or a lan address, such as 080009-123abc.
                         "lan path" can be omitted to broadcast the
                         request for boot from an install server.

             <path> is either in I/O notation, such as 8/16/5.6,
                    a mnemonic path such as SESCSI.6,
                    or path label format, such as P0, P1, ... P19
                    generated from the last SEArch command.

        Short command for BOot: bo
-------
Main Menu: Enter command > CONFIGURATION

------- Configuration Menu ----------------------------------------------------

        Command                           Description
        -------                           -----------
        AUto [BOot|SEArch|STart] [ON|OFF] Display or set specified flag
        BootID [<proc>] [<boot ID>]       Display or modify processor boot ID
        BootINfo                          Display boot-related information
        BootTimer [0 - 200]               Seconds allowed for boot attempt
        DEfault                           Set the system to predefined values
        FastBoot [ON|OFF]                 Display or set boot tests execution
        LanConfig [<params>]              Display or set LAN configuration
        LanSElect [builtin|100bt]         Display or set which LAN to use
        MOnitor [LIST|<path> <type>]      Change the current monitor type
        PAth [PRI|ALT|CON|KEY] [<path>]   Display or modify a path
        SEArch [DIsplay|IPL] [<path>]     Search for boot devices
        SECure [ON|OFF]                   Set/show security mode
        TIme [c:y:m:d:h:m:[s]]            Read or set the real time clock in GMT

        BOot [PRI|ALT|<path>]           Boot from specified path
        DIsplay                         Redisplay the current menu
        HElp [<menu>|<command>]         Display help for menu or command
        RESET                           Restart the system
        MAin                            Return to Main menu
-------
-------
Configuration Menu: Enter command > HELP SEARCH

------- Search Help -----------------------------------------------------------

        SEArch is used to search for boot devices in the system.

        SEArch              Search for all potential boot devices
        SEArch <path>       Search specified path for potential boot devices
        SEArch IPL          Search for all bootable devices with IPL
        SEArch IPL <path>   Search specified path for bootable devices with IPL
        SEArch LAN INSTALL  Search for HP-UX install server
        SEArch DIsplay      Display the results of the previous search

             <path> is a module path defined in I/O notation, such as 8/16/5
             (layers are ignored), or a mnemonic path such as SESCSI.

             The first 20 devices found will be displayed.
             The devices found will have a path label such as P0, P1, ... P19.
             These labels can be used in the BOot command to select
             a specific device.
             Example:  boot P1

        Short command for SEArch: sea
-------