ICX7150-C12P booting into DIAG mode - has u-boot not Brocade bootloader

Notice: Page may contain affiliate links for which we may earn a small commission through services like Amazon Affiliates or Skimlinks.

brwainer

New Member
Apr 28, 2015
5
1
3
31
I've picked up a pair of ICX7150-C12P that don't appear to have a Brocade bootloader (pressing any key during boot loads u-boot) and if you let it try to finish booting it ends on a FoxConn DIAG system. It appears very similar to what was described here: https://forums.servethehome.com/ind...issues-with-brocade-switch-not-booting.19694/

Since that post in the forum is about a 6430, I'm not confident in blindly writing the new bootloader into the NAND, I need some help determining which address in the NAND to flash the bootloader into.

I'm hoping @fohdeesha is willing to give me a hand with this, or anyone else.
 

fohdeesha

Kaini Industries
Nov 20, 2016
2,729
3,081
113
33
fohdeesha.com
I'll most likely need to remote in via teamviewer or similar to poke around and gather enough info to fix it.

First, in u-boot can you try running "diagmode disable" the "reset" - it should reload into a more "normal" brocade bootloader, stop it in there and then send me a list of possible commands (just hit ? most likely to list them)
 
  • Like
Reactions: tommybackeast

brwainer

New Member
Apr 28, 2015
5
1
3
31
I'll most likely need to remote in via teamviewer or similar to poke around and gather enough info to fix it.

First, in u-boot can you try running "diagmode disable" the "reset" - it should reload into a more "normal" brocade bootloader, stop it in there and then send me a list of possible commands (just hit ? most likely to list them)
When the switch is booting, it doesn't output the normal brocade "press b to enter boot monitor". Instead it outputs:
Code:
U-Boot 2016.01-Broadcom XLDK-3.8.1-svn20827 (Dec 12 2016 - 09:36:45 +0800)                                                                   

I2C:   ready                                                                                                                                 
DRAM:  Reset XGPLL                                                                                                                           
Release reset                                                                                                                                 
Polling                                                                                                                                       
Locked                                                                                                                                       
DEV ID = 0xb160                                                                                                                               
SKU ID = 0xb160                                                                                                                               
DDR type: DDR4                                                                                                                               
MEMC 0 DDR speed = 800MHz                                                                                                                     
PHY revision version: 0x00a2f001                                                                                                             
ddr_init2: Calling soc_and28_shmoo_dram_info_set                                                                                             
ddr_init2: Calling soc_and28_shmoo_phy_init                                                                                                   
A Series - PHY Initialization (PHY index: 00)                                                                                                 
A01. Turn off CKE                                                                                                                             
A02. Configure timing parameters                                                                                                             
A03. Configure PHY PLL                                                                                                                       
     PHY PLL Configuration                                                                                                                   
     Fref.............:   50 MHz                                                                                                             
     Data rate........: 1600 Mbps                                                                                                             
     PLL locked.                                                                                                                             
A04. Configure reference voltage                                                                                                             
A05. Compute VDL step size                                                                                                                   
     VDL calibration complete.                                                                                                               
     VDL step size....:  10.869 ps                                                                                                           
     UI size..........:  57.500 steps                                                                                                         
A06. Configure ADDR/CTRL VDLs                                                                                                                 
A07. Disable Virtual VTT                                                                                                                     
A08. ZQ calibration                                                                                                                           
     P drive..........: 0x0C                                                                                                                 
     N drive..........: 0x13                                                                                                                 
     P termination....: 0x0C                                                                                                                 
     N termination....: 0x00                                                                                                                 
     P idle...........: 0x0C                                                                                                                 
     N idle...........: 0x00                                                                                                                 
     AQ P drive.......: 0x12                                                                                                                 
     AQ N drive.......: 0x13                                                                                                                 
A09. Configure Static Pad Control                                                                                                             
A10. Configure ODT                                                                                                                           
A11. Configure Write Pre-/Post-amble                                                                                                         
A12. Configure Auto Idle                                                                                                                     
A13. Release PHY control                                                                                                                     
A Series - PHY Initialization complete (PHY index: 00)                                                                                       
Programming controller register                                                                                                               
Enabling mt40a512m8_093_1600                                                                                                                 
ddr_init2: MemC initialization complete                                                                                                       
ddr_init2: Calling soc_and28_shmoo_ctl                                                                                                       
Validate Shmoo parameters stored in flash ..... OK                                                                                           
Press Ctrl-C to run Shmoo ..... skipped                                                                                                       
DDR Tuning Complete                                                                                                                           
Running simple memory test ..... OK                                                                                                           
GPIO Reaset Reason is 0x1                                                                                                                     
WARM BOOT: Retaining persistent memory                                                                                                       
Before CLEAR_DDR, warm mem contents 0xfff7ffef                                                                                               
clear 0x0 to 0x20000000                                                                                                                       
BIST Start 0x0, END 0xffffff                                                                                                                 
clear_ddr: OK                                                                                                                                 
Copying Warm mem from 0x9fe00000 to 0x70000000 --> 0xfff7ffef                                                                                 
clear 0x20000000 to 0x20000000                                                                                                               
BIST Start 0x1000000, END 0x1ffffff                                                                                                           
clear_ddr: OK                                                                                                                                 
Copied back Warm mem from 0x70000000 to 0x9fe00000 --> 0xfff7ffef                                                                             
DDR Interface Ready                                                                                                                           
1022 MiB                                                                                                                                     
arm_clk=1250MHz, axi_clk=400MHz, apb_clk=100MHz, arm_periph_clk=625MHz                                                                       
Flash: 0 Bytes                                                                                                                               
NAND:  PNOR flash is not present - switch mux back for NAND                                                                                   
 Micron MT29F16G08CBACA, blocks per lun: 800 lun count: 1                                                                                     
1024 KiB blocks, 4 KiB pages, 27B OOB, 8-bit                                                                                                 
NAND:   chipsize 2048 MiB                                                                                                                     
MMC:   iproc_sdhci: 0                                                                                                                         
Access set to PRIMARY FL..                                                                                                                   
SF: Detected MX25L6405D with page size 256 Bytes, erase size 64 KiB, total 8 MiB                                                             
In:    serial                                                                                                                                 
Out:   serial                                                                                                                                 
Err:   serial                                                                                                                                 
DDR Tuning Complete                                                                                                                           
Unlocking L2 Cache ...Done                                                                                                                   
Net:   Registering BCM xgs eth                                                                                                               
Broadcom XGS Iproc Ethernet driver 0.1                                                                                                       
Using GMAC0                                                                                                                                   
gmac_mac_init: Chip ID: 0xb160                                                                                                               
r = 0x0, addr = 0x1, devad = 0xffffffff, phy_id = 0x600d84aa                                                                                 
Add phy reset delay                                                                                                                           
Add phy reset delay                                                                                                                           
Basic ethernet functionality initialized                                                                                                     
bcm_xgs_gmac-0 [PRIME] ETH MAC: 78:a6:e1:3e:2e:ae                                                                                             

Booted From: Uboot partition 1                                                                                                               
Hit any key to stop autoboot:  3                                                                                                            
u-boot>

Code:
u-boot> ?
?       - alias for 'help'                                                                                                                     
base    - print or set address offset                                                                                                        
bdinfo - print Board Info structure
boot - boot default, i.e., run 'bootcmd'
bootd - boot default, i.e., run 'bootcmd'
bootelf - Boot from an ELF image in memory
bootm - boot application image from memory
bootp - boot image via network using BOOTP/TFTP protocol
bootvx - Boot vxWorks from an ELF image
bootz - boot Linux zImage image from memory
chpart - change active partition
cmp - memory compare
coninfo - print console devices and information
cp - memory copy
cplddl - cplddl - To perform cpld download

crc32 - checksum calculation
dhcp - boot image via network using DHCP/TFTP protocol
echo - echo args to console
editenv - edit environment variable
env - environment handling commands
erase - erase FLASH memory
exit - exit script
ext2load- load binary file from a Ext2 filesystem
ext2ls - list files in a directory (default /)
false - do nothing, unsuccessfully
fatinfo - print information about filesystem
fatload - load binary file from a dos filesystem
fatls - list files in a directory (default /)
fatsize - determine a file's size
fatwrite- write file into a dos filesystem
fdt - flattened device tree utility commands
flinfo - print FLASH memory information
go - start application at address 'addr'
gpio_read- Read from GPIO
gpio_write- write to GPIO
hash - compute hash message digest
help - print command description/usage
i2c - I2C sub-system
iminfo - print header information for application image
imxtract- extract a part of a multi-image
itest - return true/false on integer compare
loadb - load binary file over serial line (kermit mode)
loads - load S-Record file over serial line
loadx - load binary file over serial line (xmodem mode)
loady - load binary file over serial line (ymodem mode)
loop - infinite loop on address range
md - memory display
mdc - memory display cyclic
mdio - MDIO utility commands
mii - MII utility commands
mm - memory modify (auto-incrementing address)
mtdparts- define flash/nand partitions
mtest - simple RAM read/write test
mw - memory write (fill)
mwc - memory write cyclic
nand - NAND sub-system
nboot - boot from NAND device
nfs - boot image via network using NFS protocol
nm - memory modify (constant address)
ping - send ICMP ECHO_REQUEST to network host
printenv- print environment variables
protect - enable or disable FLASH write protection
reset - Perform RESET of the CPU
run - run commands in an environment variable
saveenv - save environment variables to persistent storage
setenv - set environment variables
sf - SPI flash sub-system
showvar - print local hushshell variables
sleep - delay execution for some time
source - run script from memory
test - minimal test like /bin/sh
tftp -
tftpboot- boot image via network using TFTP protocol
tftpput - TFTP put command, for uploading files to a server
time - run commands and summarize execution time
true - do nothing, successfully
ubi - ubi commands
ubifsload- load file from an UBIFS filesystem
ubifsls - list files in a directory
ubifsmount- mount UBIFS volume
ubifsumount- unmount UBIFS volume
usb - USB sub-system
usbboot - boot from USB device
version - print monitor, compiler and linker version
Code:
u-boot> diagmode disable
Unknown command 'diagmode' - try 'help'
Code:
u-boot> printenv
baudrate=9600
bootImg=Minions_UBOOT_1.1.2.bin
bootargs=console=ttyS0,9600n8 maxcpus=1 mem=1000M mtdparts=brcmnand.0:64m(brcd_primary_image),64m(brcd_secondary_image),1408m(configs_logs),-t
bootcmd=run nand2boot
bootdelay=3
cpldImg=minion_syscpld_rev0403.jbc
dhcp2boot=dhcp ${fileaddr} ${diagImg}; bootm ${fileaddr};
diagImg=Minions_DIAG_1.2.4.img
et0phyaddr=1
ethact=bcm_xgs_gmac-0
ethaddr=78:A6:E1:3E:2E:AE
ethprime=bcm_xgs_gmac-0
fdt_high=0xffffffff
fileaddr=0x65000000
ipaddr=172.21.25.121
loadaddr=0x64000000
mtdids=nand0=brcmnand.0
mtdparts=mtdparts=brcmnand.0:64m(brcd_primary_image),64m(brcd_secondary_image),1408m(configs_logs),-(resources)
nand2boot=nand read ${fileaddr} 0x0 0x5000000; bootm ${fileaddr}
serverip=172.21.7.249
stderr=serial
stdin=serial
stdout=serial
tftp2boot=tftp ${fileaddr} ${diagImg}; bootm ${fileaddr};
ubifsImg=Minions_DIAG_1.1.0_rootfs.ubifs
usb2boot=usb start; fatload usb 0:1 ${fileaddr} ${diagImg}; bootm ${fileaddr};
ver=U-Boot 2016.01-Broadcom XLDK-3.8.1-svn20827 (Dec 12 2016 - 09:36:45 +0800)

Environment size: 1105/65532 bytes
u-boot>

If I do let the switch keep booting (don't press anything to enter U-Boot) then it boots this:
Code:
****************************************************                                                                                         
*  FoxDiag: FoxDiag_1.2.4                                                                                                                     
*  CPLD: Rev4 release 3                                                                                                                       
*  Platform: Minions-C12P PVT 0                                                                                                               
*                                                                                                                                             
*  Copyright: Copyright 2016 Foxconn Corporation.                                                                                             
****************************************************                                                                                         

DIAG>?                                                                                                                                       
?       - alias for 'help'                                                                                                                   
bcm_shell - Invoke Broadcom Backdoor                                                                                                         
bcmcall - Execute bcm-shell call for kernel layer debugbing.                                                                                 
bcmscript - execute uploaded bcm script.                                                                                                     
bypassmux - This command bypass mux mode.                                                                                                     
cpldread - To read cpld register                                                                                                             
cpldtest - To perform cpld test                                                                                                               
cpldupdate - To perform cpld update                                                                                                           
cpldwrite - To write special value to cpld register                                                                                           
eeprom - EEPROM dump or program command                                                                                                       
fanread - To read fan speed and status                                                                                                       
fantask - To enable/disable fan task for thermal policy                                                                                       
fantest - This test validates the fantrays can be controlled by I2C.                                                                         
fanwrite - To configure DC output for all fan                                                                                                 
fiberLbMode - This command config fiber ports loopback mode.                                                                                 
fluffydelay - To adjust read delay of Fluffyread                                                                                             
fluffyeeprom - Fluffy EEPROM dump or program command                                                                                         
fluffyeepromwrite - Fluffy EEPROM write command                                                                                               
fluffyfwupgrade - Upgrade MCU firware                                                                                                         
fluffyintrdelay - To adjust LRM transceiver interrupt delay                                                                                   
fluffyioexpinit - To init IOEXP 9536 in Fluffy for debug.                                                                                     
fluffyioexpread - To read IOEXP 9536 in Fluffy for debug.                                                                                     
fluffyioexpwrite - To write value to IOEXP 9536 in Fluffy for debug.                                                                         
fluffyread - Get MCU info for debug                                                                                                           
fluffyreadonly - Get MCU info for debug                                                                                                       
fluffystatus - To get LRM transceiver present status                                                                                         
fluffytoggle - To toggle EEPROM between LRM transceiver and Fluffy                                                                           
fluffywrite - Set MCU info for debug                                                                                                         
gpioinit - To init GPIO                                                                                                                       
gpioread - To read GPIO pin status                                                                                                           
gpioreset - To reset used by GPIO pin                                                                                                         
gpiotest - To test used by GPIO pin                                                                                                           
gpiowrite - To write gpio pin status                                                                                                         
help    - print online help                                                                                                                   
i2clist - Display all entries of i2c device info table                                                                                       
i2cread - Get special i2c device id                                                                                                           
i2ctest - Test special i2c device id                                                                                                         
i2cwrite - Set special i2c register                                                                                                           
intrtest - This test interrupt pins from devices to CPU                                                                                       
ioexpinit - To init io expanders                                                                                                             
ioexpread - To read io expander pin status                                                                                                   
ioexpwrite - To write io expander pin status                                                                                                 
leddump - This test is used to dump LED processor contents                                                                                   
ledtest - This test validates all led.                                                                                                       
linux_shell - Enter Linux shell for kernel layer debugbing.                                                                                   
memread - To perform memory read
memtest - To perform memory test
memwrite - To perform memory write
mgmt - To perform management port test
minicycle - Packets generated by CPU
nandtest        - To perform NAND test
pdtest - Test Power Source config
phyUpgrade - AQ409 firmware upgrade.
pktTolerance - This command config packet tolerance mode.
poeafonly - set PoE in at/af mode
poecmd - transmit a SCP packet with 0x00 as the KEY
poedownload - Download firware
poeforcepw - Force power
poeprogram - transmit a SCP packet with 0x01 as the KEY
poepwshow - Show power
poerequest - transmit a SCP packet with 0x02 as the KEY
poestatus - set PoE in enable/disable
poetest - test if the PoE system is working correctly
pohfourpair - set PoH port 4 pair status
port - Dump status or counter of all switch ports.
pseenable - Enable or Disable all PSE ports
pseoverstress - Enable or Disable PSE ports with overstress ability
pwrReboot - Power reset to reboot system.
qsberpara - To display QSGMII ber test parameters
qsbertest - This test is used to measure the link quality and robustness of the system.
qsbertxdrv - To set TSC-E ber test tx_driver
qsbertxfir - To set TSC-E ber test tx_fir
reboot - Reboot system.
rtcread - Get rtc time
rtctest - test the rtc function
rtcwrite - Set rtc time
sflashtest - To perform SFLASH test
sfpIoDetection - This command sfp I/O detection mode.
sfptxdisable - To init io expanders
sfptxenable - To init io expanders
showThermalSensor - This command enable/disable thermal information flag for traffic test.
smi - PHY test.
snaketest - This test validates the QSGMII/SFI interfaces between MAC, and PHY.
swlbtest - Packets generated by CPU
swsnaketest - This test validates the MDI/QSGMII interfaces between MAC, and PHY.
syscall - Execute SysCall for kernel layer debugbing.
tempread - To read temperature
thermal_threshold - Set thermal threshold
tscberpara - To display TSC-E ber test parameters
tscbershow - To display TSC-E ber test result
tscbertest - This test is used to measure the link quality and robustness of the system.
tscbertxdrv - To set TSC-E ber test tx_driver
usb - USB test function
version - print diagnostic firmware version
voltagemargin - adjust VCC margin
voltageread - To read voltage source
voltagetest - test the margin
xsmi - PHY test.
DIAG>
 

fohdeesha

Kaini Industries
Nov 20, 2016
2,729
3,081
113
33
fohdeesha.com
OK yeah that's definitely broadcom's SDK environment for OEMs. It can be replaced but I'll have to poke around, the 7 series has a much different boot layout than the 6 series (two redundant SPI chips for starters if I remember right)
 

brwainer

New Member
Apr 28, 2015
5
1
3
31
OK yeah that's definitely broadcom's SDK environment for OEMs. It can be replaced but I'll have to poke around, the 7 series has a much different boot layout than the 6 series (two redundant SPI chips for starters if I remember right)
As I said in my first post I have two..... but I bricked one, and I doubt it can be recovered:
Code:
u-boot> tftp 3000000 mnz10115.bin                                                                                                             
Change GMAC speed to 1000MB                                                                                                                   
Using bcm_xgs_gmac-0 device                                                                                                                   
TFTP from server 192.168.10.1; our IP address is 192.168.10.100                                                                               
Filename 'mnz10115.bin'.                                                                                                                     
Load address: 0x3000000                                                                                                                       
Loading: ######################################################                                                                               

done                                                                                                                                         
Bytes transferred = 786944 (c0200 hex)                                                                                                       
u-boot> md 3000000 20                                                                                                                         
03000000: 00000000 00000000 00000000 00000000    ................                                                                             
03000010: 00000000 00000000 00000000 00000000    ................                                                                             
03000020: 00000000 00000000 00000000 00000000    ................                                                                             
03000030: 00000000 00000000 00000000 00000000    ................                                                                             
03000040: 00000000 00000000 00000000 00000000    ................                                                                             
03000050: 00000000 00000000 00000000 00000000    ................                                                                             
03000060: 00000000 00000000 00000000 00000000    ................                                                                             
03000070: 00000000 00000000 00000000 00000000    ................                                                                             
u-boot> tftp 0x64000000 mnz10115.bin                                                                                                         
Change GMAC speed to 1000MB                                                                                                                   
Using bcm_xgs_gmac-0 device                                                                                                                   
TFTP from server 192.168.10.1; our IP address is 192.168.10.100                                                                               
Filename 'mnz10115.bin'.                                                                                                                     
Load address: 0x64000000                                                                                                                     
Loading: ######################################################                                                                               

done                                                                                                                                         
Bytes transferred = 786944 (c0200 hex)                                                                                                       
u-boot> md 0x64000000 20                                                                                                                     
64000000: 4c494e58 02250000 000c0200 caa6a6d4    LINX.%..........                                                                             
64000010: f660a284 00000000 00000000 64000000    .`..........d...                                                                             
64000020: 00000000 00000000 00000000 00000000    ................                                                                             
64000030: 079f525c 0a010f00 6d6e7a31 30313135    ..R\....mnz10115                                                                             
64000040: 00000000 00000000 00000000 00000000    ................                                                                             
64000050: 00000000 00000000 00000000 00000000    ................                                                                             
64000060: 00000000 00000000 00000000 00000000    ................                                                                             
64000070: 00000000 00000000 00000000 00000000    ................                                                                             
u-boot> help dm                                                                                                                               
Unknown command 'dm' - try 'help' without arguments for list of all known commands                                                           

u-boot> help md                                                                                                                               
md - memory display                                                                                                                           

Usage:                                                                                                                                       
md [.b, .w, .l] address [# of objects]                                                                                                       
u-boot> md 0x64000000 220                                                                                                                     
64000000: 4c494e58 02250000 000c0200 caa6a6d4    LINX.%..........                                                                             
64000010: f660a284 00000000 00000000 64000000    .`..........d...                                                                             
64000020: 00000000 00000000 00000000 00000000    ................                                                                             
64000030: 079f525c 0a010f00 6d6e7a31 30313135    ..R\....mnz10115                                                                             
64000040: 00000000 00000000 00000000 00000000    ................                                                                             
64000050: 00000000 00000000 00000000 00000000    ................                                                                             
64000060: 00000000 00000000 00000000 00000000    ................                                                                             
64000070: 00000000 00000000 00000000 00000000    ................                                                                             
64000080: 00000000 00000000 00000000 00000000    ................                                                                             
64000090: 00000000 00000000 00000000 00000000    ................                                                                             
640000a0: 00000000 00000000 00000000 00000000    ................                                                                             
640000b0: 00000000 00000000 00000000 00000000    ................                                                                             
640000c0: 00000000 00000000 00000000 00000000    ................                                                                             
640000d0: 00000000 00000000 00000000 00000000    ................                                                                             
640000e0: 00000000 00000000 00000000 00000000    ................                                                                             
640000f0: 00000000 00000000 00000000 00000000    ................                                                                             
64000100: 00000000 00000000 00000000 00000000    ................                                                                             
64000110: 00000000 00000000 00000000 00000000    ................                                                                             
64000120: 00000000 00000000 00000000 00000000    ................                                                                             
64000130: 00000000 00000000 00000000 00000000    ................                                                                             
64000140: 00000000 00000000 00000000 00000000    ................                                                                             
64000150: 00000000 00000000 00000000 00000000    ................                                                                             
64000160: 00000000 00000000 00000000 00000000    ................                                                                             
64000170: 00000000 00000000 00000000 00000000    ................                                                                             
64000180: 00000000 00000000 00000000 00000000    ................                                                                             
64000190: 00000000 00000000 00000000 00000000    ................                                                                             
640001a0: 00000000 00000000 00000000 00000000    ................                                                                             
640001b0: 00000000 00000000 00000000 00000000    ................                                                                             
640001c0: 00000000 00000000 00000000 00000000    ................                                                                             
640001d0: 00000000 00000000 00000000 00000000    ................                                                                             
640001e0: 00000000 00000000 00000000 00000000    ................                                                                             
640001f0: 00000000 00000000 00000000 00000000    ................                                                                             
64000200: be0000ea 14f09fe5 14f09fe5 14f09fe5    ................                                                                             
64000210: 14f09fe5 14f09fe5 14f09fe5 14f09fe5    ................                                                                             
64000220: f0000060 f00000c0 f0000120 f0000180    ...`....... ....                                                                             
64000230: f00001e0 f0000240 f00002a0 deadbeef    .......@........                                                                             
64000240: 0badc0de 00f020e3 00f020e3 00f020e3    ...... ... ... .                                                                             
64000250: 00f020e3 00f020e3 00f020e3 00f020e3    .. ... ... ... .                                                                             
64000260: 28d01fe5 00e08de5 00e04fe1 04e08de5    (.........O.....                                                                             
64000270: 13d0a0e3 0df069e1 0fe0a0e1 0ef0b0e1    ......i.........                                                                             
64000280: 48d04de2 ff1f8de8 50201fe5 0c0092e8    H.M.....P ......                                                                             
64000290: 48008de2 34508de2 0e10a0e1 0f0085e8    H...4P..........                                                                             
640002a0: 0d00a0e1 182600eb 00f020e3 00f020e3    .....&.... ... .                                                                             
640002b0: 00f020e3 00f020e3 00f020e3 00f020e3    .. ... ... ... .                                                                             
640002c0: 88d01fe5 00e08de5 00e04fe1 04e08de5    ..........O.....                                                                             
640002d0: 13d0a0e3 0df069e1 0fe0a0e1 0ef0b0e1    ......i.........                                                                             
640002e0: 48d04de2 ff1f8de8 b0201fe5 0c0092e8    H.M...... ......                                                                             
640002f0: 48008de2 34508de2 0e10a0e1 0f0085e8    H...4P..........                                                                             
64000300: 0d00a0e1 082600eb 00f020e3 00f020e3    .....&.... ... .                                                                             
64000310: 00f020e3 00f020e3 00f020e3 00f020e3    .. ... ... ... .                                                                             
64000320: e8d01fe5 00e08de5 00e04fe1 04e08de5    ..........O.....                                                                             
64000330: 13d0a0e3 0df069e1 0fe0a0e1 0ef0b0e1    ......i.........                                                                             
64000340: 48d04de2 ff1f8de8 10211fe5 0c0092e8    H.M......!......                                                                             
64000350: 48008de2 34508de2 0e10a0e1 0f0085e8    H...4P..........                                                                             
64000360: 0d00a0e1 f82500eb 00f020e3 00f020e3    .....%.... ... .                                                                             
64000370: 00f020e3 00f020e3 00f020e3 00f020e3    .. ... ... ... .                                                                             
64000380: 48d11fe5 00e08de5 00e04fe1 04e08de5    H.........O.....                                                                             
64000390: 13d0a0e3 0df069e1 0fe0a0e1 0ef0b0e1    ......i.........                                                                             
640003a0: 48d04de2 ff1f8de8 70211fe5 0c0092e8    H.M.....p!......                                                                             
640003b0: 48008de2 34508de2 0e10a0e1 0f0085e8    H...4P..........                                                                             
640003c0: 0d00a0e1 e82500eb 00f020e3 00f020e3    .....%.... ... .                                                                             
640003d0: 00f020e3 00f020e3 00f020e3 00f020e3    .. ... ... ... .                                                                             
640003e0: a8d11fe5 00e08de5 00e04fe1 04e08de5    ..........O.....                                                                             
640003f0: 13d0a0e3 0df069e1 0fe0a0e1 0ef0b0e1    ......i.........                                                                             
64000400: 48d04de2 ff1f8de8 d0211fe5 0c0092e8    H.M......!......                                                                             
64000410: 48008de2 34508de2 0e10a0e1 0f0085e8    H...4P..........                                                                             
64000420: 0d00a0e1 d82500eb 00f020e3 00f020e3    .....%.... ... .                                                                             
64000430: 00f020e3 00f020e3 00f020e3 00f020e3    .. ... ... ... .                                                                             
64000440: 08d21fe5 00e08de5 00e04fe1 04e08de5    ..........O.....                                                                             
64000450: 13d0a0e3 0df069e1 0fe0a0e1 0ef0b0e1    ......i.........                                                                             
64000460: 48d04de2 ff1f8de8 30221fe5 0c0092e8    H.M.....0"......                                                                             
64000470: 48008de2 34508de2 0e10a0e1 0f0085e8    H...4P..........                                                                             
64000480: 0d00a0e1 d02500eb 00f020e3 00f020e3    .....%.... ... .                                                                             
64000490: 00f020e3 00f020e3 00f020e3 00f020e3    .. ... ... ... .                                                                             
640004a0: 68d21fe5 00e08de5 00e04fe1 04e08de5    h.........O.....                                                                             
640004b0: 13d0a0e3 0df069e1 0fe0a0e1 0ef0b0e1    ......i.........                                                                             
640004c0: 48d04de2 ff1f8de8 90221fe5 0c0092e8    H.M......"......                                                                             
640004d0: 48008de2 34508de2 0e10a0e1 0f0085e8    H...4P..........                                                                             
640004e0: 0d00a0e1 b02500eb 00f020e3 00f020e3    .....%.... ... .                                                                             
640004f0: 00f020e3 00f020e3 00f020e3 00f020e3    .. ... ... ... .                                                                             
64000500: 000201f1 120000ea 00000fe1 1f1000e2    ................                                                                             
64000510: 1a0031e3 1f00c013 13008013 c00080e3    ..1.............                                                                             
64000520: 00f029e1 100f11ee 020ac0e3 100f01ee    ..).............                                                                             
64000530: 78009fe5 100f0cee 060000eb 1a0000eb    x...............                                                                             
64000540: 9e2300eb 150f07ee 9a0f07ee 950f07ee    .#..............                                                                             
64000550: 1eff2fe1 ebffffea 0000a0e3 170f08ee    ../.............                                                                             
64000560: 150f07ee d50f07ee 9a0f07ee 950f07ee    ................                                                                             
64000570: 100f11ee 020ac0e3 0700c0e3 020080e3    ................                                                                             
64000580: 020b80e3 010a80e3 100f01ee 0e50a0e1    .............P..                                                                             
64000590: 101f10ee 213aa0e1 0f3003e2 0f4001e2    ....!:...0...@..                                                                             
640005a0: 0322a0e1 022084e1 05f0a0e1 010000ea    ."... ..........                                                                             
640005b0: f0000000 f0080000 00000fe1 c00080e3    ................                                                                             
640005c0: 00f029e1 0010a0e3 101f05ee 301f05ee    ..).........0...                                                                             
640005d0: 101f06ee 301f06ee 101f11ee 0110c1e3    ....0...........                                                                             
640005e0: 101f01ee 101f11ee 011ac1e3 0410c1e3    ................                                                                             
640005f0: 101f01ee 0010a0e3 151f07ee d50f07ee    ................                                                                             
64000600: 9a1f07ee 950f07ee 100f11ee 060b80e3    ................                                                                             
64000610: 100f01ee 0000a0e3 100f40ee 950f07ee    ..........@.....                                                                             
64000620: 100f30ee 6c419fe5 a04104e0 014084e2    ..0.lA...A...@..                                                                             
64000630: 64319fe5 a00603e0 010080e2 0010a0e3    d1..............                                                                             
64000640: 0030a0e3 012fa0e1 832282e1 562f07ee    .0.../..."..V/..                                                                             
64000650: 013083e2 030050e1 f9ffff1a 011081e2    .0....P.........                                                                             
64000660: 040051e1 f5ffff1a 9a1f07ee 100f11ee    ..Q.............                                                                             
64000670: 040080e3 100f01ee 950f07ee 171f08ee    ................                                                                             
64000680: 18019fe5 ff10a0e3 311fbfe6 001080e5    ........1.......                                                                             
64000690: 0c019fe5 001090e5 311fbfe6 011081e3    ........1.......                                                                             
640006a0: 311fbfe6 001080e5 0000a0e3 500f02ee    1...........P...                                                                             
640006b0: 04011fe5 100f02ee e8009fe5 100f03ee    ................                                                                             
640006c0: 101f11ee 011081e3 101f01ee 950f07ee    ................                                                                             
640006d0: d4009fe5 041190e5 311fbfe6 0f18c1e3    ........1.......                                                                             
640006e0: c8209fe5 021081e1 311fbfe6 041180e5    . ......1.......                                                                             
640006f0: ff10a0e3 311fbfe6 7c1780e5 0020a0e3    ....1...|.... ..                                                                             
64000700: 7c1790e5 020051e1 fcffff1a 84109fe5    |.....Q.........                                                                             
64000710: 311fbfe6 201280e5 0110a0e3 311fbfe6    1... .......1...                                                                             
64000720: 001180e5 0010a0e3 9a1f07ee 950f07ee    ................                                                                             
64000730: 0512a0e3 78209fe5 78409fe5 74509fe5    ....x ..x@..tP..                                                                             
64000740: 70609fe5 6c709fe5 68809fe5 64909fe5    p`..lp..h...d...                                                                             
64000750: 60a09fe5 5cb09fe5 0130a0e3 48009fe5    `...\....0..H...                                                                             
64000760: 333fbfe6 503980e5 f00fa1e8 1030a0e3    3?..P9.......0..                                                                             
64000770: 013043e2 000053e3 fcffff1a 020051e1    .0C...S.......Q.                                                                             
64000780: f8ffff1a 0030a0e3 1c009fe5 333fbfe6    .....0......3?..                                                                             
64000790: 503980e5 0ef0a0e1 000001ff 00007fff    P9..............                                                                             
640007a0: 1902000c 19020000 55555555 19022000    ........UUUU.. .                                                                             
640007b0: 0a120000 50020000 a5a5a5a5 f0412de9    ....P........A-.                                                                             
640007c0: 30ef30ee 0010a0e3 81c0a0e1 01308ce0    0.0..........0..                                                                             
640007d0: 3e33a0e1 073003e2 023043e2 020053e3    >3...0...0C...S.                                                                             
640007e0: 2400008a 10cf40ee 104f30ee d431e9e7    $.....@..O0..1..                                                                             
640007f0: 075004e2 017083e2 045085e2 d446eee7    .P...p...P...F..                                                                             
64000800: 0020e0e3 0760a0e1 a660b0e1 012082e2    . ...`...`... ..                                                                             
64000810: fcffff1a 030017e1 01208212 010050e3    ......... ....P.                                                                             
64000820: 202062e2 0800001a 13828ce1 0460a0e1      b..........`..                                                                             
64000830: 167588e1 567f07ee 016056e2 fbffff2a    .u..V....`V....*                                                                             
64000840: 013053e2 f7ffff2a 090000ea 020050e3    .0S....*......P.                                                                             
64000850: 0800001a 13828ce1 0460a0e1 167588e1    .........`...u..                                                                             
64000860: 5e7f07ee 016056e2 fbffff2a 013053e2    ^....`V....*.0S.                                                                             
64000870: f7ffff2a 4ff07ff5 011081e2 070051e3    ...*O.........Q.                                                                             
u-boot> prot off f8000000 f80fffff                                                                                                           
Error: start and/or end address not on sector boundary                                                                                                                                                                                               
u-boot> prot off f8000000 f80bffff                                                                                                           
Error: start and/or end address not on sector boundary                                                                                       
u-boot> sf write 0x64000200 0 0xC0000
No SPI flash selected. Please run `sf probe'
u-boot> sf probe
Access set to PRIMARY FL..
SF: Detected MX25L6405D with page size 256 Bytes, erase size 64 KiB, total 8 MiB
u-boot> sf write 0x64000200 0 0xC0000
device 0 offset 0x0, size 0xc0000
SF: 786432 bytes @ 0x0 Written: OK
u-boot> reset
resetting ...
using GPIO[7] to reset
After that the switch never outputs anything on serial whenever it is powered on. I expect it would need a manual flash of the SPI, which is way outside what you can or are willing to help with I'm sure. But the other one, is still in the condition of getting into u-boot and/or FoxDiag. Let me know when you'd like to get into it and how you'd like to do it.
 
  • Like
Reactions: klui

fohdeesha

Kaini Industries
Nov 20, 2016
2,729
3,081
113
33
fohdeesha.com
Well, you had the right idea, but flash needs to be erased before written to, otherwise you'll get nonsensical data (which is what bricked your switch). Writing to flash can only turn flash bits off, it cannot turn them on. This is what the erase routine does, it flips all (specified) flash bits on, so the write step afterwords can set bits back off as needed. If there's already data on that flash sector and you go to write to it, bits that are off but need to be on, the write routine can't do anything about it

It probably is indeed bricked, the 7 series has 2 SPI boot chips (which is why you had to select one of them with "sf_probe"). The CPLD has a watchdog that monitors boot, if it fails to boot, it's supposed to kick the SPI flash over to the second backup flash chip, and it'll boot off that instead. However that's with the production firmware, I'm guessing this BRDCM testbed firmware has none of that functionality. If you want to try, you can plug the switch back in and wait about 1 - 2 minutes, it would eventually reset and start outputting stuff over serial as it boots into the second SPI flash. The baudrate in the second u-boot copy might be set differently, so it's possible you still wouldn't see anything on the serial port unless you change your serial adapter baud as well

I might be around later tonight for teamviewer if you are
 
  • Like
Reactions: klui

brwainer

New Member
Apr 28, 2015
5
1
3
31
If you want to try, you can plug the switch back in and wait about 1 - 2 minutes, it would eventually reset and start outputting stuff over serial as it boots into the second SPI flash.
I can't re-test that one right now as I stole the PSU out of it to repair another switch that had its PSU died (and that third switch is working great now, got updated to the latest UFI firmware without an issue). But I am certain that it didn't swap over to the secondary SPI after being booted for several minutes. I have replacement PSUs coming, so later on I can try to work on that switch some more.

I might be around later tonight for teamviewer if you are
I'll be available for a few hours, probably until 3AM EST / 8AM UTC. You can reach me on Discord at brwainer#6694 if you still use that.
 

fohdeesha

Kaini Industries
Nov 20, 2016
2,729
3,081
113
33
fohdeesha.com
I can't re-test that one right now as I stole the PSU out of it to repair another switch that had its PSU died (and that third switch is working great now, got updated to the latest UFI firmware without an issue). But I am certain that it didn't swap over to the secondary SPI after being booted for several minutes. I have replacement PSUs coming, so later on I can try to work on that switch some more.


I'll be available for a few hours, probably until 3AM EST / 8AM UTC. You can reach me on Discord at brwainer#6694 if you still use that.
sent a request
 

fohdeesha

Kaini Industries
Nov 20, 2016
2,729
3,081
113
33
fohdeesha.com
fixed via mcdonalds cinnamon roll, @brwainer was even nice enough to let me dump the broadcom dev bootloader and OS off his flash before wiping it. If anyone wants that just PM me

as for fixing it (ICX7150-C12P ONLY):

Code:
#give it a temporary IP:
setenv ipaddr 192.168.1.50

#set the IP of your tftp server hosting these files:
setenv serverip 192.168.1.49

##RECOVER
##this example uses the mnz10114 bootloader from the 8080 codetrain/zip
tftp 0x80000000 mnz10114.bin
sf probe 0:0
sf erase 0 +11F3D8
sf write 0x80000200 0 0x11F3D8


##VERIFY
sf probe 0:0
sf read 0x80000000 0 100
md 0x80000000

First few bytes should match the below exactly:
BE0000EA 14F09FE5 14F09FE5 14F09FE5

##if they don't, the bootloader is corrupted, do NOT pull power or reboot it until fixed
#if they do match, reboot
reset
#it should reboot into the brocade bootloader after running a bunch of memory timing tests
#once you're in the brocade bootloader, flash the bootloader using the "proper" commands
#this ensures brocade's software writes the bootloader to both pri/sec SPI chips
#give it temp IP
setenv ipaddr 192.168.1.50
setenv netmask 255.255.255.0

#tell the switch the IP of your tftp server:
setenv serverip 192.168.1.51

setenv uboot mnz10114.bin
update_uboot
#it'll update uboot the "proper" way, then reset it. it might switch boot SPI chips, so it will run RAM testing again
reset
##now flash an OS:
setenv ipaddr 192.168.1.50
setenv netmask 255.255.255.0
setenv serverip 192.168.1.51
setenv image_name SPR08080f.bin
update_primary
reset

It should reboot and boot fully into fastiron, it will take a while as it flashes CPLD firmware, PoE firmware, etc. It will complain about missing certs, because they were never programmed if it was a dev box. To stop these errors just run "sz disable" from the conf t level, and write mem
 
Last edited:

klui

Well-Known Member
Feb 3, 2019
824
453
63
Writing to flash can only turn flash bits off, it cannot turn them on. This is what the erase routine does, it flips all (specified) flash bits on, so the write step afterwords can set bits back off as needed. If there's already data on that flash sector and you go to write to it, bits that are off but need to be on, the write routine can't do anything about it
Is this true for all NV memory in general (EEPROM, EAROM, NOR, NAND, etc. can only write 0s and not 1s)? As someone who isn't hardware literate this is something where I hadn't connected the dots. And I have worse memory than you! I just know blocks need to be erased and rewritten instead of sectors.
 
Jul 19, 2020
51
19
8
Is this true for all NV memory in general (EEPROM, EAROM, NOR, NAND, etc. can only write 0s and not 1s)? As someone who isn't hardware literate this is something where I hadn't connected the dots. And I have worse memory than you! I just know blocks need to be erased and rewritten instead of sectors.
No. This is at least true for all "floating gate" style NV memory (EPROM, EEPROM, and Flash) - erase sets sections (bytes, blocks, pages, sectors, whole die etc.) to 1 by kicking the electrons out of the floating gates via quantum tunnelling, writing sets bits to 0 by pushing electrons into the floating gates via hot carrier injection. Same story with PROMs as well, except you can't erase those and the 'unprogrammed' state could be either 0 or 1 depending on the technology. Other nonvolatile technologies (MRAM, FRAM, ReRAM, etc.) are more symmetrical and can simply be written directly, no erasing required.

Now, something like high-density NAND flash is a bit of a different animal for a number of reasons - the cells are very small and hence noisy, so data is encoded, protected with FEC, and scrambled/whitened before being written, and cells can even support multiple levels to increase density by storing multiple bits in each cell, so in that case you can't really program individual bits. However, you still have the asymmetry of adding electrons via hot carrier injection to write on a per-cell granularity, and removing electrons via quantum tunneling to erase on a per-block or per-page granularity.

Other storage media can have similar characteristics. For instance, magnetic media like tapes or hard drives don't need to be erased, new data is simply written over old data. On the other hand, something like a CD-RW uses different processes to write data to the disc vs. to erase old data and prepare for new data to be written. Or even take something like a punch card - it's a bit difficult to un-punch a hole after it has been punched, you just get a new card.
 
Last edited:
  • Like
Reactions: fohdeesha and klui

cyanchan15

New Member
Jul 6, 2022
10
1
3
fixed via mcdonalds cinnamon roll, @brwainer was even nice enough to let me dump the broadcom dev bootloader and OS off his flash before wiping it. If anyone wants that just PM me

as for fixing it (ICX7150-C12P ONLY):

Code:
##RECOVER
##this example uses the mnz10114 bootloader from the 8080 codetrain/zip
tftp 0x80000000 mnz10114.bin
sf probe 0:0
sf erase 0 +11F3D8
sf write 0x80000200 0 0x11F3D8


##VERIFY
sf probe 0:0
sf read 0x80000000 0 100
md 0x80000000

First few bytes should match the below exactly:
BE0000EA 14F09FE5 14F09FE5 14F09FE5

##if they don't, the bootloader is corrupted, do NOT pull power or reboot it until fixed
#if they do match, reboot
reset
#it should reboot into the brocade bootloader after running a bunch of memory timing tests
#once you're in the brocade bootloader, flash the bootloader using the "proper" commands
#this ensures brocade's software writes the bootloader to both pri/sec SPI chips
#give it temp IP
setenv ipaddr 192.168.1.50
setenv netmask 255.255.255.0

#tell the switch the IP of your tftp server:
setenv serverip 192.168.1.51

setenv uboot mnz10114.bin
update_uboot
#it'll update uboot the "proper" way, then reset it. it might switch boot SPI chips, so it will run RAM testing again
reset
##now flash an OS:
setenv ipaddr 192.168.1.50
setenv netmask 255.255.255.0
setenv serverip 192.168.1.51
setenv image_name SPR08080f.bin
update_primary
reset

It should reboot and boot fully into fastiron, it will take a while as it flashes CPLD firmware, PoE firmware, etc. It will complain about missing certs, because they were never programmed if it was a dev box. To stop these errors just run "sz disable" from the conf t level, and write mem
I am running into the same problem u-boot or diag. I will try figure it out first

edit: just saw the fix only works for C12P model but I am with a 48PF unit. Would you help me out on this @fohdeesha

I can confirm it’s a Broadcom system as as I poke around I see there’s a Broadcom command available bcmshell that supposedly takes me to another shell from the DIAG prompt.
 
Last edited:

cyanchan15

New Member
Jul 6, 2022
10
1
3
A quick update: my bootloader is a little different in that no tftp is loaded in it. I managed to get the mnz10114.bin to 0x80000000 memory by YMODEM protocol over serial just like any embedded stuff.

Now do I also erase nand by 0x11F3D8 length and write starting from memory 0x200 offset (0x80000200) memory address to nand? Or should I do it differently than the OP’s case? Much appreciated if @fohdeesha or anyone else may take a look.
 

fohdeesha

Kaini Industries
Nov 20, 2016
2,729
3,081
113
33
fohdeesha.com
A quick update: my bootloader is a little different in that no tftp is loaded in it. I managed to get the mnz10114.bin to 0x80000000 memory by YMODEM protocol over serial just like any embedded stuff.

Now do I also erase nand by 0x11F3D8 length and write starting from memory 0x200 offset (0x80000200) memory address to nand? Or should I do it differently than the OP’s case? Much appreciated if @fohdeesha or anyone else may take a look.
there's no tftp at all? can you post the full output (use pastebin or something) of sending the "?" key and also from running "help". to see if the bootloader/flash structure is the same also paste the output of the following (do this AFTER a reboot if you've transferred stuff into memory already):

sf probe 0:0
sf read 0x80000000 0 100
md 0x80000000
 

cyanchan15

New Member
Jul 6, 2022
10
1
3
there's no tftp at all? can you post the full output (use pastebin or something) of sending the "?" key and also from running "help". to see if the bootloader/flash structure is the same also paste the output of the following (do this AFTER a reboot if you've transferred stuff into memory already):

sf probe 0:0
sf read 0x80000000 0 100
md 0x80000000
It’s too late sorry. I already erased and wrote the bootloader (mnzxxxxx.bin file) sent via serial YMODEM. Later with a normal firmware update now my unit is running 08095g perfectly.

In that u-boot, ? returns a list with no tftp at all. It does have a Kermit transfer which I don’t know how to use, a YMODEM (loady) and of course a SPI subsystem (sf). Also my unit has a lower u-boot version number.

Please please shed some light on how you came up with this fix. The 0x200 offset in the bootloader is understandable since it should be 512 bytes maintenance/metadata from the manufacturer so you trim that out. But erasing 0x11F3D8 long of flash and later writing that many into flash is total magic. How did you find out that 0x11F3D8 length is enough for the switch to boot?
 

fohdeesha

Kaini Industries
Nov 20, 2016
2,729
3,081
113
33
fohdeesha.com
It’s too late sorry. I already erased and wrote the bootloader (mnzxxxxx.bin file) sent via serial YMODEM. Later with a normal firmware update now my unit is running 08095g perfectly.

In that u-boot, ? returns a list with no tftp at all. It does have a Kermit transfer which I don’t know how to use, a YMODEM (loady) and of course a SPI subsystem (sf). Also my unit has a lower u-boot version number.

Please please shed some light on how you came up with this fix. The 0x200 offset in the bootloader is understandable since it should be 512 bytes maintenance/metadata from the manufacturer so you trim that out. But erasing 0x11F3D8 long of flash and later writing that many into flash is total magic. How did you find out that 0x11F3D8 length is enough for the switch to boot?
the length is simple, it's just byte count in hex, and it needs to be large enough to get the entirety of the bootloader we transferred in. Doesn't matter if you get extra afterwords, it'll just be empty or random RAM, written to a bit of flash that is currently unused. That said, I have no recollection of why I rounded the length so much higher (the bootloader is only ~760kb if I recall, and 0x11F3D8 is ~1.1MB) again no downside with overshooting though. I vaguely remember something about it not wanting to erase a smaller sector count than that or something
 
Last edited:

cyanchan15

New Member
Jul 6, 2022
10
1
3
the length is simple, it's just byte count in hex, and it needs to be large enough to get the entirety of the bootloader we transferred in. Doesn't matter if you get extra afterwords, it'll just be empty or random RAM, written to a bit of flash that is currently unused. That said, I have no recollection of why I rounded the length so much higher (the bootloader is only ~760kb if I recall, and 0x11F3D8 is ~1.1MB) again no downside with overshooting though. I vaguely remember something about it not wanting to erase a smaller sector count than that or something
Oh I see. Still you work the magic and thank you again.
Any speculation on how and why these units are on the market? I have bought in the past used gears with buggy or ancient firmwares/systems and maybe that’s why they got sold as second hand in perfect condition. But never seen any of these “factory units”.