April 24, 2024

EBAZ4205 Bitcoin miner board - Dirty JTAG

Dirty JTAG is by no means specific to the EBAZ boards and the ZYNQ chip, but that is what I am using it for now, so here we are.

My interest is in using JTAG to read and more importantly to write NAND flash. This could be a way of patching the NAND image (which I now do via U-Boot) or of installing a Kyu image into a NAND partition (which could also be done by way of U-Boot and tftp).

Use a blue pill

I have at least a dozen of these (STM32F103 blue pill boards). Pi Pico boards are rare and currently unavailable. The download page offers 3 different bin files with essentially no explanation. Another source of confusion is that with version 2.0 they changed the pins they use. For a good reason, they want to use SPI hardware in the F103 chip, but now you have to beware not to reference old documentation with the obsolete pinout. The 2.0 release is dated December 13, 2022.
Nothing is ever easy or simple.

Here is the new pinout: 

STM32	JTAG
PA7	TDI
PA6	TDO
PA5	TCK
PA3	TMS
PA4	TRST
PA2	SRST
The original (old and obsolete) pinout used PA0 through PA5, as per the CNX article above.

All 3 "bin" files are the same size (9224 bytes) and after I clone the repository and look at the Makefile, I see the only difference is the link address, which is as follows: 

dirtyjtag.bluepill.loader2k.bin  --  0x08002000
dirtyjtag.bluepill.loader4k.bin  --  0x08004000
dirtyjtag.bluepill.noloader.bin  --  0x08000000
So, it is all a question of leaving room at the start of rom for a serial bootloader. I will just use an ST-Link dongle to flash my blue pill, so I don't need to worry about a serial bootloader and should just use the "noloader" bin file.

Now on fedora (fedora 39) at the time of this writing), I need: 

dnf install stlink
Now, dig up a ST-Link v2 dongle and a "blue pill" board. My ST-link has a 4 conductor cable already carefully set up to attach to a "blue pill" otherwise we would have to fuss with that.

I plug in the ST-link and the pill starts a blink demo that I installed once to test all my boards. The linux logs show this: 

Apr 24 21:29:23 trona kernel: usb 4-1.2: new full-speed USB device number 104 using ehci-pci
Apr 24 21:29:23 trona kernel: usb 4-1.2: New USB device found, idVendor=0483, idProduct=3748, bcdDevice= 1.00
Apr 24 21:29:23 trona kernel: usb 4-1.2: New USB device strings: Mfr=1, Product=2, SerialNumber=3
Apr 24 21:29:23 trona kernel: usb 4-1.2: Product: STM32 STLink
Apr 24 21:29:23 trona kernel: usb 4-1.2: Manufacturer: STMicroelectronics
Then we do it (I put the command in a Makefile). 
make burn
st-flash write dirtyjtag.bluepill.noloader.bin 0x08000000
st-flash 1.8.0
2024-04-24T21:34:06 INFO common.c: STM32F1xx_MD: 20 KiB SRAM, 64 KiB flash in at least 1 KiB pages.
file dirtyjtag.bluepill.noloader.bin md5 checksum: dc87643c89d1b379476ddda919fbc853, stlink checksum: 0x000db627
2024-04-24T21:34:06 INFO common_flash.c: Attempting to write 9224 (0x2408) bytes to stm32 address: 134217728 (0x8000000)
-> Flash page at 0x8002400 erased (size: 0x400)
2024-04-24T21:34:06 INFO flash_loader.c: Starting Flash write for VL/F0/F3/F1_XL
2024-04-24T21:34:06 INFO flash_loader.c: Successfully loaded flash loader in sram
2024-04-24T21:34:06 INFO flash_loader.c: Clear DFSR
 10/10  pages written
2024-04-24T21:34:07 INFO common_flash.c: Starting verification of write complete
2024-04-24T21:34:07 INFO common_flash.c: Flash written and verified! jolly good!
Now I find a micro-USB cable and plug it in. The linux logs show: 
Apr 24 21:36:19 trona kernel: usb 4-1.2: new full-speed USB device number 105 using ehci-pci
Apr 24 21:36:19 trona kernel: usb 4-1.2: New USB device found, idVendor=1209, idProduct=c0ca, bcdDevice= 2.00
Apr 24 21:36:19 trona kernel: usb 4-1.2: New USB device strings: Mfr=1, Product=2, SerialNumber=3
Apr 24 21:36:19 trona kernel: usb 4-1.2: Product: DirtyJTAG
Apr 24 21:36:19 trona kernel: usb 4-1.2: Manufacturer: Jean THOMAS
Apr 24 21:36:19 trona kernel: usb 4-1.2: SerialNumber: 56FF6C065186525453470487
I am particularly satisfied to see that Serial Number! Looks like a success. Also urjtag accepts it as a cable. We cannot go farther without soldering some wires.
Feedback? Questions? Drop me a line!

Tom's Computer Info / tom@mmto.org