May 16, 2024

Zynq bootrom - the secret uart loader

Here are the articles.

Python scripts

Courtesy of "404" and preserved here. The "02" script just tickles the loader and demonstrates we can start talking to it.
The dumper script actually dumps the whole thing (128K).

Let's do it!!

A have an Antminer S9 board sitting right here, all powered up and with a USB to serial gadget hooked up to the serial port. It should just be a matter of changing the boot jumpers and running the python script that 404 wrote.

The jumpers are now set to boot from onboard NAND flash, i.e. 

JP4 (BM0-MIO5) ---*  0
JP3 (BM1-MIO3) ---*  0
JP2 (BM2-MIO4) *---  1
JP1 (BM3-MIO2) ---*  0
There is endless double think and stupidity here. Note that you can ignore JP1 (we just leave it set to 0). The Antminer engineers were smart and put the jumpers in the same order as the BM (boot mode) values.

If you look at the Zynq TRM on page 166, you will see 0 1 0 for NAND boot, but this is the order as per the MIO pins, this is really 100 (4) for NAND boot. To get the secre UART boot, you want the BM setting of 3, which you get from the following jumper settings: 

JP4 (BM0-MIO5) *---  1
JP3 (BM1-MIO3) *---  1
JP2 (BM2-MIO4) ---*  0
JP1 (BM3-MIO2) ---*  0
I make these setting and I see "XLNX-ZYNQ" on my terminal window.
Feedback? Questions? Drop me a line!

Tom's Computer Info / [email protected]