BNT/IBM G8124 firmware upgrade

[Arion]

Super thanks and extra kudos to @fohdeesha for his help with this! This switch threw us some curve balls but fohdeesha was able to over come them at each step. Glad to have a working switch again and ready to put it into the home lab!

 

[Elijah Neo]

@fohdeesha I too have the same problem with a bricked G8124 switch. Could you also share the BDI2000 PPC firmware too, I managed to grab a unit from the bay but not sure what firmware is it running.

Hopefully I can bring the switch back to life.

Thanks.

 

[fohdeesha]

send me a PM or I'll forget

you'll need a cross over / null modem serial cable to program the bdi2000, a regular straight through serial cable will not work

 

[Elijah Neo]

PM sent.

In case anyone who want to get at a used bdi2000 without power supply, please see below link:
Abatron AG BDI2000/C High Speed BDM/JTAG Debug Interface | eBay

There are 3 units left at time of writing, I offered $129 and was accepted, units were not tested, you may try your luck.

 

[fohdeesha]

members here are also welcome to borrow my JTAG unit to recover bricked units, you just need to pay shipping. don't forget you'll need one of these to connect it to the switch https://www.amazon.com/Pc-Accessories-Connectors-Connector-16P-15cm-5PK/dp/B01FB20ISK

 

[Elijah Neo]

Finally, just managed to revive my bricked Blade G8124 switch using the method provided by fohdeesha (Thank You).

It took me some time to gather all the required items, but the update was quite straight forward following the instructions by fohdeesha.

The BDI2000 from the ebay worked, I use a 5V 1A adapter. I did have problem with another similar 5V 1A adapter, I think it does not have enough output so the unit does not turn on.

See latest firmware 7.11.14 by IBM release 8 Mar 19:
IBM Support: Fix Central - Please wait, Select fixes

I managed to update my G8124 to the new 7.11.14 firmware version using the tftp method.

Does anyone know if it is possible to flash the Lenovo G8124E 8.4.10 firmware onto old G8124?

 

[Adeel Akram]

We managed to succesfully revive @Arion 's switch over the weekend via JTAG. Took some figuring out to get the IBM bootloader file split up into the correct 3 pieces (ramdisk, kernel, and uboot). There also seems to be some fpga, cpld, or other component on the board that does something odd with the CPU out of reset that made it very difficult to halt the processor correctly but after some JTAG config trial and error we eventually got it to the point we could read and write flash

here's a zip with the working bdi2000 jtag config, the files needing to be flashed, and instructions. You'll need a BDI2000 running PowerPC firmware. I have one I am willing to lend to existing STH members if they'd like to recover these bricked units

http://fohdeesha.com/data/other/IBM-Recovery.zip

I did a dump of the bricked flash beforehand (the bootloader section anyway), and it was definitely corrupted. The firmware itself is not an issue, it runs just fine on the older G8124's if you write it to flash correctly. However something in the older firmware's flashing process screws up while writing out u-boot. You can see in these screenshots the end gets mangled with garbage data (and the data does not exist anywhere in the firmware file, so it's not like it's just writing the correct information to the wrong place): IBM G8124 brick

Awesome stuff @fohdeesha. I also bricked my switch and am in the same boat as most. Now reading your post i see there is a ray of hope to recover it. Is there any other devise that can perform the same functionality as BDI2000 but is a bit cheaper. I am outside of US and BDI2000 is costing as much as the switch itself. :-(

 

[Adeel Akram]

Finally, just managed to revive my bricked Blade G8124 switch using the method provided by fohdeesha (Thank You).

It took me some time to gather all the required items, but the update was quite straight forward following the instructions by fohdeesha.

The BDI2000 from the ebay worked, I use a 5V 1A adapter. I did have problem with another similar 5V 1A adapter, I think it does not have enough output so the unit does not turn on.

See latest firmware 7.11.14 by IBM release 8 Mar 19:
IBM Support: Fix Central - Please wait, Select fixes

I managed to update my G8124 to the new 7.11.14 firmware version using the tftp method.

Does anyone know if it is possible to flash the Lenovo G8124E 8.4.10 firmware onto old G8124?

Hi @Elijah. Did you try the Lenovo 8.4.10 firmware?

 

[fohdeesha]

Awesome stuff @fohdeesha. I also bricked my switch and am in the same boat as most. Now reading your post i see there is a ray of hope to recover it. Is there any other devise that can perform the same functionality as BDI2000 but is a bit cheaper. I am outside of US and BDI2000 is costing as much as the switch itself. :-(

Awesome stuff @fohdeesha. I also bricked my switch and am in the same boat as most. Now reading your post i see there is a ray of hope to recover it. Is there any other devise that can perform the same functionality as BDI2000 but is a bit cheaper. I am outside of US and BDI2000 is costing as much as the switch itself. :-(

The only other cheap solution I know of is the "codewarrior usb tap", it works with software from freescale that works for a 30 day trial. The issue is there's several different types of JTAG units and they all look the same, you need to find one that has a "COP" sticker on the back like these two:

FREESCALE CODEWARRIOR USB TAP 900-75115 REV G | eBay

Find many great new & used options and get the best deals for FREESCALE CODEWARRIOR USB TAP 900-75115 REV G at the best online prices at eBay! Free shipping for many products!

www.ebay.com

Freescale Codewarrior USB Tap 900-75116 Rev B for sale online | eBay

Find many great new & used options and get the best deals for Freescale Codewarrior USB Tap 900-75116 Rev B at the best online prices at eBay! Free shipping for many products!

www.ebay.com

 

[drew442]

Just stumbled across this page, thanks to all that blazed the trail. Was about to push the big red button on my G8124
I have a working switch at 1.1.1.5, is it possible to use the files provided by fohdeesha to upgrade the firmware? I don't want to have to buy a JTAG box if I don't have to. Thanks in advance!

 

[fohdeesha]

Just stumbled across this page, thanks to all that blazed the trail. Was about to push the big red button on my G8124
I have a working switch at 1.1.1.5, is it possible to use the files provided by fohdeesha to upgrade the firmware? I don't want to have to buy a JTAG box if I don't have to. Thanks in advance!

the files/zip I provded are for use recovering a bricked unit with a JTAG device, IBMs OS isn't going to load them. I would just upgrade normally

 

[drew442]

the files/zip I provded are for use recovering a bricked unit with a JTAG device, IBMs OS isn't going to load them. I would just upgrade normally

Bricked my switch. LOL.
I looked on ebay for "jtag writer" and found a bunch of high dollar devices that look about identical to a raspberry pi.
Going to spend the weekend finding out if I can use the RPI as a poor man's JTAG writer and dig myself out of the hole

 

[drew442]

picked up an identical switch on ebay for cheap. upgraded to the latest 7.11 firmware. works great.
This is the upgrade path I went with. My switch started at 1.1.1

1.1.1 -> 6.8.12 (this seemed to be the biggest step, lots of stuff on the console about conversion / upgrades at next boot)
6.8.12 -> 6.8.19
6.8.19 -> 7.6.2
7.6.2 -> 7.7.5
7.7.5 -> 7.11.19

I did try to upload the 8.x OS code from Lenovo's site, the switch kicked it out & said "not supported"

 

[drew442]

Also, u-boot information if this is helpful for future reference

U-Boot 2009.06 (Aug 20 2014 - 02:00:10)

CPU: 8543, Version: 2.1, (0x80320021)
Core: E500, Version: 2.2, (0x80210022)
Clock Configuration:
CPU0:800 MHz,
CCB:400 MHz,
DDR:200 MHz (400 MT/s data rate), LBC:25 MHz
L1: D-cache 32 kB enabled
I-cache 32 kB enabled
I2C: ready
DRAM: 1 GB

 

[fohdeesha]

Bricked my switch. LOL.
I looked on ebay for "jtag writer" and found a bunch of high dollar devices that look about identical to a raspberry pi.
Going to spend the weekend finding out if I can use the RPI as a poor man's JTAG writer and dig myself out of the hole

you'll need a powerPC specific JTAG unit, like a BDI2000 - I have one I may be able to lend you if you pay shipping both ways (fits in a medium flat rate box USPS)

 

[drew442]

you'll need a powerPC specific JTAG unit, like a BDI2000 - I have one I may be able to lend you if you pay shipping both ways (fits in a medium flat rate box USPS)

I managed to get a codewarrior usb tap (COP) really cheaply. Going to give that a shot first. If that does not pan out I will hit you up for borrowing the BDI2000.

 

[fohdeesha]

I managed to get a codewarrior usb tap (COP) really cheaply. Going to give that a shot first. If that does not pan out I will hit you up for borrowing the BDI2000.

That'll work, the software is just huge and a pita. Let me know if you need teamviewer assistance. The software is also only good for 30 days before it locks itself but I'm sure you saw that

 

[drew442]

That'll work, the software is just huge and a pita. Let me know if you need teamviewer assistance. The software is also only good for 30 days before it locks itself but I'm sure you saw that

Probably all I will need is some pointers on a config file for the flash utility. I can deduce most of the parms from the BDI2000 config (thanks by the way)

 

[drew442]

Probably all I will need is some pointers on a config file for the flash utility. I can deduce most of the parms from the BDI2000 config (thanks by the way)

did some basic translation on the init file for the bdi 2000, this is what i came up with.
still telling me "cannot connect to core 0"


reset 0

WRITESPR 63 0xffff0000 ;IVPR to boot core
WRITESPR 415 0x0000f000 ;IVOR15 : Debug exception

writemem.l 0xFF700000 0x000e0000

writemem.l 0xe0000C08 0x000c0000 ;LAWBAR1 : @0xc0000000
writemem.l 0xe0000C10 0x8040001d ;LAWAR1 : Local Bus 1GB

writemem.l 0xe0005000 0xf8001001 ;BR0
writemem.l 0xe0005004 0xf8006E65 ;OR0

writemem.w 0xfe000000 0x0060
writemem.w 0xfe000000 0x00d0

sleep 1000

writemem.w 0xfe000000 0xffff

 

[fohdeesha]

which software are you using? If I recall I basically had to select a project template for e500, then add a flash IC to the project matching what was in the switch