I have checked the contents of the updater available from keysight.
It appears to be controlled via FTP or SSH (?) It seems to update the firmware by controlling it.
I don't think it's linux, but it seems to be running shell commands commonly seen in Linux. chmod,chown etc...
The E4406A CPU board is based on a PA-RISC PA-7300LC CPU. As shown in the boot screen image attached to the first post of this thread, it boots HP-RT Version A.03.01 from flash.
https://www.openpa.net/hp-rt_realtime-vme.htmlThe same CPU board is also used in HP / Agilent 16600/16700-series logic analyzers, although in that usage scenario the CPU board is populated slightly differently. One difference is that while the 9914 GPIB controller IC is still populated on the PCB, the external GPIB connector is not populated. Also, instead of booting HP-RT from a flash memory daughter board, the 16600/16700-series logic analyzers boot HP-UX from a SCSI hard drive. While the SCSI controller is contained in the "LASI" chip on the CPU board, a separate board that attaches to the CPU board provides the SCSI bus connectors.
If the flash memory containing the HP-RT OS image is corrupted to the point where the E4406A cannot boot from it, I wonder if the initial power on firmware can boot from a TFTP image of the OS through the LAN interface.
On the 16600/16700-series logic analyzers, you can hit keys on an attached PS/2 keyboard to stop the power on firmware from attempting to auto boot an OS. If the E4406A CPU board has basically the same power on firmware, maybe the SEARCH command can find a TFTP server that has been set up appropriately to serve a boot image to the E4406A, and then the BOOT command can be used to boot from that TFTP server.
Without installing the E4406A firmware update files on a PC and taking a look at the files that it configures to be served by the TFTP server, I don't know if the firmware update include whatever files that would be necessary for a LAN boot of a E4406A. And then even if the E4406A could be booted from the LAN, I don't know if the firmware update procedure could then be run to correct and update a corrupt OS flash image on the E4406A.
Below is sample power on firmware console output on a 16600/16700-series logic analyzer that is stopped before attempting to auto boot an OS from a boot device. Can you get to basically the same power on firmware console interface on an E4406A?
Firmware Version 2.1
Duplex Console IO Dependent Code (IODC) revision 1
Memory Test/Initialization Completed
------------------------------------------------------------------------------
(c) Copyright 1995-1998, Hewlett-Packard Company, All rights reserved
------------------------------------------------------------------------------
Processor Speed State Coprocessor State Cache Size
--------- -------- --------------------- ----------------- ----------
0 150 MHz Active Functional 64 KB
Available memory (bytes) : 67108864
Good memory required (bytes): 67108864
Primary boot path: 255.0
Alternate boot path: SESCSI.6.0
Console path: GRAPHICS(0)
Keyboard path: PS2
------- Main Menu -------------------------------------------------------------
Command Description
------- -----------
BOot [PRI|ALT|<path>] Boot from specified path
PAth [PRI|ALT|CON|KEY] [<path>] Display or modify a path
SEArch [DIsplay|IPL] [<path>] Search for boot devices
COnfiguration [<command>] Access Configuration menu/commands
INformation [<command>] Access Information menu/commands
SERvice [<command>] Access Service menu/commands
DIsplay Redisplay the current menu
HElp [<menu>|<command>] Display help for menu or command
RESET Restart the system
-------
Main Menu: Enter command > HELP
------- Main Help -------------------------------------------------------------
The Main menu is the first menu displayed when the firmware user
interface is executed. The other menus available to the user are
listed here.
Type DIsplay to view the commands available from this menu.
Other menus can be accessed by entering the name of the menu at the
command prompt. From a given menu, a command from any other menu can
be executed by entering the menu name that is associated with the
command, followed by the command.
For example, to execute the TIme command (in the Configuration menu)
from the Main menu, type "co ti".
Type HElp MAin to see all available commands listed under their
respective menus.
-------
Main Menu: Enter command > HELP MAIN
---- Main Menu Help -----------------------------------------------------------
COnfiguration------------------------------------AUto
INformation-----------------------ALL BootID
SERvice-------------ChassisCodes BootINfo BootINfo
CLEARPIM CAche BootTimer
EepromRead ChipRevisions DEfault
MemRead CoProcessor FAn
PciDelay FwrVersion FastBoot
PIM IO LanConfig
LanAddress MOnitor
MEmory PAth
PRocessor SEArch
WArnings SECure
TIme
BOot BOot BOot
DIsplay DIsplay DIsplay
HElp HElp HElp
RESET RESET RESET
MAin MAin MAin
Type DIsplay to show the commands available from the current menu.
Main Menu: Enter command > HELP BOOT
------- Boot Help -------------------------------------------------------------
BOot continues the boot sequence from the specified path.
The primary boot path is normally the disk containing
the operating system.
The alternate path is normally a tape device.
BOot Boot from primary path
BOot PRImary Boot from primary path
BOot ALTernate Boot from alternate path
BOot LAN<.lan path> INSTALL Boot from HP-UX install server
BOot <path> Boot from specified path
<.lan path> is a delimiter '.' followed by either
an IP address, such as 10.6.6.6
or a lan address, such as 080009-123abc.
"lan path" can be omitted to broadcast the
request for boot from an install server.
<path> is either in I/O notation, such as 8/16/5.6,
a mnemonic path such as SESCSI.6,
or path label format, such as P0, P1, ... P19
generated from the last SEArch command.
Short command for BOot: bo
-------
Main Menu: Enter command > CONFIGURATION
------- Configuration Menu ----------------------------------------------------
Command Description
------- -----------
AUto [BOot|SEArch|STart] [ON|OFF] Display or set specified flag
BootID [<proc>] [<boot ID>] Display or modify processor boot ID
BootINfo Display boot-related information
BootTimer [0 - 200] Seconds allowed for boot attempt
DEfault Set the system to predefined values
FastBoot [ON|OFF] Display or set boot tests execution
LanConfig [<params>] Display or set LAN configuration
LanSElect [builtin|100bt] Display or set which LAN to use
MOnitor [LIST|<path> <type>] Change the current monitor type
PAth [PRI|ALT|CON|KEY] [<path>] Display or modify a path
SEArch [DIsplay|IPL] [<path>] Search for boot devices
SECure [ON|OFF] Set/show security mode
TIme [c:y:m:d:h:m:[s]] Read or set the real time clock in GMT
BOot [PRI|ALT|<path>] Boot from specified path
DIsplay Redisplay the current menu
HElp [<menu>|<command>] Display help for menu or command
RESET Restart the system
MAin Return to Main menu
-------
-------
Configuration Menu: Enter command > HELP SEARCH
------- Search Help -----------------------------------------------------------
SEArch is used to search for boot devices in the system.
SEArch Search for all potential boot devices
SEArch <path> Search specified path for potential boot devices
SEArch IPL Search for all bootable devices with IPL
SEArch IPL <path> Search specified path for bootable devices with IPL
SEArch LAN INSTALL Search for HP-UX install server
SEArch DIsplay Display the results of the previous search
<path> is a module path defined in I/O notation, such as 8/16/5
(layers are ignored), or a mnemonic path such as SESCSI.
The first 20 devices found will be displayed.
The devices found will have a path label such as P0, P1, ... P19.
These labels can be used in the BOot command to select
a specific device.
Example: boot P1
Short command for SEArch: sea
-------