На буржуйском форуме только что опубликовал в общих словах процесс замены жесткого диска NBT.
Процесс оказался несколько сложнее чем ожидалось ранее, но всё осуществимо. Если у кого-то плохо с английским, или не понятны какие-то моменты процесса замены, пишите в эту тему, буду тут отвечать.
I have found a working procedure for replacing a hard drive. It is not the easiest procedure and requires some IT background. The process is too technical for a detailed step-by-step guide, so I am going to describe just high level steps, but that is enough information to succeed.
First off all, you need to select a correct drive for replacement. This is especially important if you are going with SSD.
The drive has to support S.M.A.R.T. and has to support specific subset of S.M.A.R.T. Attributes.
For example, I have tried to use Samsung SSD and failed because it does not support Attribute 194, Temperature.
There is a service in NBT, called srv-hddmgr, located on Intel side in /fs/sda0/repository/istep/opt/sys/bin (you can use my unpacker to find it, it is in bootloader). The service is responsible for following functions:
*Detecting and mounting HDD/SSD
*Managing HDD security - locking, unlocking, setting and recovering passwords.
*Monitoring HDD temperature and shutting down the drive before it overheats.
*Monitoring S.M.A.R.T. parameters and HDD wear and reporting Error Codes when HDD degrades.
*Monitoring altitude and shutting down HDD if the altitude is outside of HDD operating parameters.
Below is the code for srv-hddmgr that I got from disassembler, these are the S.M.A.R.T. attributes that it is looking for:.rodata:0808B55D db 2 .rodata:0808B55E db 3 .rodata:0808B55F db 4 .rodata:0808B560 db 5 .rodata:0808B561 db 7 .rodata:0808B562 db 8 .rodata:0808B563 db 9 .rodata:0808B564 db 0Ah .rodata:0808B565 db 0Ch .rodata:0808B566 db 0C0h .rodata:0808B567 db 0C1h .rodata:0808B568 db 0C2h .rodata:0808B569 db 0C5h
Here is the same list, reported by Tool32. Pay attention to S.M.A.R.T. attribute numbers in boldSatz : 2 STAT_ATA_ID = [B]2[/B] 00 02 .. STAT_ATA_ID_TEXT = Allgemeiner Datendurchsatz STAT_NORMALIZED_VALUE = 100 64 d STAT_TRESHOLD_VALUE = 50 32 2 Satz : 3 STAT_ATA_ID = [B]3[/B] 00 03 .. STAT_ATA_ID_TEXT = Durchschnitt der Startzeit [msec] STAT_NORMALIZED_VALUE = 100 64 d STAT_TRESHOLD_VALUE = 1 01 . Satz : 4 STAT_ATA_ID = [B]4[/B] 00 04 .. STAT_ATA_ID_TEXT = Anzahl der Start/Stop-Vorg***1076;nge STAT_NORMALIZED_VALUE = 100 64 d STAT_TRESHOLD_VALUE = 0 00 . Satz : 5 STAT_ATA_ID = [B]5[/B] 00 05 .. STAT_ATA_ID_TEXT = Anzahl der verbrauchten Reserve-Sektoren STAT_NORMALIZED_VALUE = 100 64 d STAT_TRESHOLD_VALUE = 50 32 2 Satz : 6 STAT_ATA_ID = [B]7[/B] 00 07 .. STAT_ATA_ID_TEXT = Positionierungsproblemrate STAT_NORMALIZED_VALUE = 100 64 d STAT_TRESHOLD_VALUE = 50 32 2 Satz : 7 STAT_ATA_ID = [B]8[/B] 00 08 .. STAT_ATA_ID_TEXT = Positionierungsdurchsatz STAT_NORMALIZED_VALUE = 100 64 d STAT_TRESHOLD_VALUE = 50 32 2 Satz : 8 STAT_ATA_ID = [B]9[/B] 00 09 .. STAT_ATA_ID_TEXT = Laufleistung in Stunden (inklusive Standby) STAT_NORMALIZED_VALUE = 100 64 d STAT_TRESHOLD_VALUE = 0 00 . Satz : 9 STAT_ATA_ID = [B]10[/B] 00 0A .. STAT_ATA_ID_TEXT = Anzahl Wiederholungen Rotationsstart STAT_NORMALIZED_VALUE = 108 6C l STAT_TRESHOLD_VALUE = 30 1E . Satz : 10 STAT_ATA_ID = [B]12[/B] 00 0C .. STAT_ATA_ID_TEXT = Anzahl Einschaltvorg***1076;nge STAT_NORMALIZED_VALUE = 100 64 d STAT_TRESHOLD_VALUE = 0 00 . Satz : 11 STAT_ATA_ID = [B]192[/B] 00 C0 .***1040; STAT_ATA_ID_TEXT = Anzahl Not-Auschaltvorg***1076;nge STAT_NORMALIZED_VALUE = 100 64 d STAT_TRESHOLD_VALUE = 0 00 . Satz : 12 STAT_ATA_ID = [B]193[/B] 00 C1 .***1041; STAT_ATA_ID_TEXT = Anzahl Parkvorg***1076;nge STAT_NORMALIZED_VALUE = 100 64 d STAT_TRESHOLD_VALUE = 0 00 . Satz : 13 STAT_ATA_ID = [B]194[/B] 00 C2 .***1042; STAT_ATA_ID_TEXT = Temperatur des Laufwerkes STAT_NORMALIZED_VALUE = 100 64 d STAT_TRESHOLD_VALUE = 0 00 . Satz : 14 STAT_ATA_ID = [B]197[/B] 00 C5 .***1045; STAT_ATA_ID_TEXT = Anzahl aktuell instabiler Sektoren STAT_NORMALIZED_VALUE = 100 64 d STAT_TRESHOLD_VALUE = 0 00 . Satz : 15 STAT_ATA_ID = [B]196[/B] 00 C4 .***1044; STAT_ATA_ID_TEXT = Nicht definiert STAT_NORMALIZED_VALUE = 100 64 d STAT_TRESHOLD_VALUE = 0 00 . Satz : 16
When selecting the HDD or SSD to for NBT, make sure your new HDD/SDD accurately reports these attributes.
I have tried replacing the drive with Samsung SSD and failed because Samsung SSDs do not report attribute 194, HDD temperature. Instead they report air temperature in attribute 190. That is not good enough for srv-hddmgr, and it was shutting down my SSD because it could not detect the temperature.
You will need a copy of QNX 6.5 SDK to replace the drive. QNX can be installed on a spare PC, or you can run it within VMware or VirtualBox - SDK comes with pre-built virtual machine. You can download QNX with a free, educational license, or just find an ISO on the Internet - google for "qnxsdp-6.5.0-201007091524-dvd.iso".
If you have linux experience that would help, but QNX is still very different from linux and is closer to NetBSD.
The next step is getting your hands on full psdzdata. You will need to extract some files out of it.
First, find an NBT bootloader, it should have btld_00001275.bin in its name. Unpack it with my unpacker.
You will need create_hdd.sh file out of it. Open the file and get an understanding on how it works. You will use it as a reference in partitioning the new drive. Pay attention to the sizes of the partitions - they are specified in cylinders, so for the same size the numbers are likely to be different for replacement drive - you will need to calculate the new numbers.
Mount the new HDD to your QNX VM or PC. Partition the new drive with fdisk. You will need partitions with numbers 177, 178, 179 and 180. Keep the size of partitions 177, 178 and 180 the same as on original drive. If your drive is larger than 200Gb, make partition 179 larger - that is the Multimedia partition. Here are the partition details on original 200Gb drive for your reference:hu-intel:/dev/shmem> df -h /dev/hd0t180 1.2G 51M 1.2G 4% /mnt/quota/sys/ /dev/hd0t179 46G 1.5G 45G 4% /mnt/quota/mm/ /dev/hd0t178 17G 606M 16G 4% /mnt/share/ /dev/hd0t177 122G 43G 79G 36% /mnt/data/ hu-intel:/dev/shmem> df -hg /dev/hd0t180 /mnt/quota/sys/ Blocks: 1355760 total 1303949 avail [1024-byte blocks] Files : 42368 total 42359 avail Type : qnx6 Flags : 00000020 [noatime] Option: /dev/hd0t179 /mnt/quota/mm/ Blocks: 48654320 total 46990253 avail [1024-byte blocks] Files : 760224 total 759967 avail Type : qnx6 Flags : 00000020 [noatime] Option: /dev/hd0t178 /mnt/share/ Blocks: 17674224 total 17054020 avail [1024-byte blocks] Files : 276160 total 275928 avail Type : qnx6 Flags : 00000020 [noatime] Option: /dev/hd0t177 /mnt/data/ Blocks: 127675376 total 82641407 avail [1024-byte blocks] Files : 1994928 total 1994726 avail Type : qnx6 Flags : 00000021 [noatime, rdonly] Option:
Format the partitions with the command like below, for each of the four partitions:mkqnx6fs -b1024 /dev/hd1t177
Congrats. Now you have a properly formatted replacement drive.
There are two ways to populate it with the information. You can just plug it into NBT, then program the NBT - that would deploy the IBA files (manuals). You would also need to go to service menu and install GraceNote database (ENTD) and install the map (NAVD) from flash drive, or USB.
The other method is a little more technical, but will make the drive work right away - for this we need to copy the information from the old drive.
There are two ways of accomplishing it. First method involves letting NBT to unlock the drive and preventing the drive from powering down.
Open the top lid of NBT. Remove the DVD drive without disconnecting it and set it aside. Watch for the exposed elements on the bottom PCB - don't short them.
Power NBT from the same 12v ATX power supply as your PC. You would need something like USB-CAN adapter, CAN bridge, E-series retrofit adapter, or Adruino DUE to wake up NBT so that it unlocks the drive on the bench.
Get a SATA extension cable. Connect NBT HDD to NBT using this extension cable. Use power supply cable from ATX PSU for power. Once NBT boots up, disconnect SATA extension cable, but keep the power connected. While the drive is powered, it is still unlocked. Connect it to your QNX PC or VM and copy the data from old drive to the new partitions that you have created. It's best to use a tar pipe to preserve permissions and folder structures. Or you can just copy partitions 177, 178 and 180 completely over the new ones with something like parted or gparted under Linux and copy files for partition 179 with QNX.
The second method involves unlocking the existing 200Gb hard drive.
Read the previous posts in the thread and get Ethernet MAC, Bluetooth MAC and long serial number of NBT (instructions are in the posts above).
Now we need to get a few more files - hddsecurity and the .so libraries it depends on from NBT bootloader images. BMW has removed hddsecurity from NBT bootloader to prevent us from unlocking the drives. But they left this file in the bootloader for RSE - rear-seat entertainment computer that is based on the same architecture as NBT. Get a bootloader for RSE and unpack it with my tool - you need a file with btld_00001283.bin in its name.
Copy hddsecurity to our QNX image. Make sure to give it executable permissions with chmod. It will not work right away - we will also need some libraries. Use "ldd hddsecurity" command to find the names of missing libraries. Copy them from NBT and RSE bootloaders to your QNX image. Don't forget about the permissions - NBT uses 775 for them.
Once you have all the dependencies installed, you can run hddsecurity - it will display the capabilitues of your hard drives.hddsecurty -m /dev/hd2
Depending on your virtualization environment, you may not see security capabilities exposed by your virtual machine hypervisor. If you don't see security capabilities, install QNX on real hardware for this process.
Now we need to unlock the original NBT hard drive and disable its password protection.
Let's say our credentials are below:
Ethernet MAC Address: 9CDF03A174BB
BT MAC Address: 9CDF03CDB431
Long (hex) NBT Serial: 00314533323334343533
NBT HDD mount point: /dev/hd2
Use the following commands:hddsecurity -u 9CDF03A174BB,9CDF03CDB431,00314533323334343533 -m /dev/hd2 hddsecurity -d 9CDF03A174BB,9CDF03CDB431,00314533323334343533 -m /dev/hd2
The first command unlocks the drive. The second removes the drive security.
Run hddsecurity on your drive again to confirm that it is unlocked and the security is disabled.
Now just follow the steps from the first method above to move the data to the new drive.
You don't need to set the password on replacement drive or lock it before installing into NBT. srv-hddmgr will do this to your drive on NBT boot automatically.
Unfortunately Linux driver for QNX6fs is read-only, so there is no alternative to installing QNX if you want to copy the data.