Tripp Lite B093 boot and recovery: no A/B fallback, a watchdog and the ERASE button
What I learned about how a Tripp Lite B093 boots and how it recovers from a bad firmware write. It always boots one image slot, a watchdog reboots it after about four minutes, and the way back is the ERASE button and a serial cable.
Before writing firmware to a console server you can’t easily reach, you want to know exactly what happens if the write goes wrong. These are the things I found on my lab B093, from reading its bootloader and from testing it with a serial cable attached.
There is no A/B fallback
U-Boot always boots image_1. If image_1 is bad, nothing else is tried. There is a second image slot on the flash, but the bootloader never boots from it. Without a serial cable, a failed write means someone has to go to the box.
That’s why any write should end with a read-back check of image_1 before the unit reboots.
How the image slots are written
The image slots are UBI volumes exposed as MTD devices through gluebi. Besides netflash (part 2), two lower-level writes also worked:
ubiupdatevolon the UBI volume, andddonto the gluebi MTD device, as long as the writes are aligned to the erase-block size reported in/proc/mtd.
A watchdog reboots it after about 258 seconds
A hardware watchdog resets the unit after about 258 seconds without being fed. A unit that hangs mid-upgrade reboots on its own into whatever is in image_1. That’s only safe if image_1 is complete and verified, so the write and verify window has to be short.
The serial way back is the ERASE button
Holding ERASE while powering on stops at the U-Boot prompt on Port 1, and from there TFTP plus the unit’s own program_image command rewrites image_1.
U-Boot could not bring up the USB ports on this board, so USB-stick recovery is out.
Watch out for the factory fallback
If ERASE is held at power-on and U-Boot doesn’t detect the Port 1 serial line, its stored factory script erases the whole NAND and restores the factory image from SPI flash. On my unit that factory image is an old Opengear release, not Tripp Lite. I worked this out from the bootloader; I haven’t triggered it and don’t plan to.
The practical rule: if holding ERASE at power-on gives you no output on Port 1 within a few seconds, power off at once.
A config reset is not a firmware reset
Pressing ERASE twice while the unit is running wipes the configuration only. The firmware stays whatever is in image_1. People call both of these a “factory reset”, and they are very different:
| Config reset | Full factory reflash | |
|---|---|---|
| How | ERASE pressed twice while running | Bootloader’s stored factory script (ERASE at power-on with no Port 1 detected) |
| What it wipes | The configuration | The whole NAND: both image slots and the configuration |
| Firmware afterwards | Unchanged | The factory image from SPI flash |
| Tested | Yes | No, read from the bootloader |
Going back to Tripp Lite with an Opengear config locks you out
After a downgrade to Tripp Lite firmware that kept the Opengear configuration, SSH and the web UI refused connections and no password worked on serial. A config reset fixed it. The clean way back is to wipe the configuration as part of the write: a web UI downgrade with Firmware Options -H -i -E came back on factory settings and new SSH host keys, with no lockout. Either way, plan on reconfiguring the unit afterwards.
Other models may be different hardware
All of this is from one B093. The B097 and B098 are treated as unknown until someone checks one with a serial cable attached.