May 5, 2024
Zynq bootrom - poking around
The bootrom is 128K in size according to the TRM and it is described as being part
of OCM (on chip memory) along with 256K of ram. This is discussed in chapter 29
of the TRM. I have played a bit with using JTAG to set breakbpoints, then having
U-Boot perform a reset, but have not yet convinced myself that this has given me
what I want.
Online articles
When I saw the "ropcha.in" domain I assumed the author was from the Ukraine.
Indeed "Ropcha" is a city in the Ukraine, but the domain name was chosen for
other reasons entirely and that was simply misleading.
The "hard way" describes a glitching approach, which involved an incredible amount
of hardware work. But the final result yielded the bootrom and a study of it led to
the discovery of an undocumented UART boot load mode, and that leads to a much easier
way to dump the boot rom (that I am still trying to get to work).
The Zynq bootrom contains an undocumented UART loader.
And it is possible to trick this loader into copying the entire bootrom for us.
The articles talk about using a "Cora" board.
This is a "cost optimized" Zynq board from digilent.
I like the term "cost optimized".
They say the chip on it is a single core Zynq (undoubtedly part of being
cost optimized if they have a source of cheap Zynq chips with only one
functioning core), but we are drifting off topic.
Interesting nonetheless, but just buy an Antminer S9 or even an Ebaz.
Feedback? Questions?
Drop me a line!
Tom's Computer Info / [email protected]