April 26, 2024

Zedboard -- Zynq booting

Most of this applies not just to the Zedboard, but to any Zynq based system. This comes from chapter 6 of the TRM.

Boot options (selected by "boot pins") --

NOR flash is generally memory mapped, which NAND is usually an SPI peripheral.

The Zeboard makes boot pins MIO-2 through MIO-6 handy and selectable by jumper. To boot from SD card, the Zedboard manual indicates: 

MIO-6 = GND (0) PLL enabled
MIO-5 = 3.3 (1)
MIO-4 = 3.3 (1)
MIO-3 = GNS (0) these 3 select SD card
MIO-2 = GND (0) - only for JTAG, ignored.
SD card boot allows up to a 32G card. It expects a FAT 16 or FAT 32 filesystem. It looks for BOOT.BIN in the root of the filesystem and copies it into OCM as per the required BootROM header, the transfers to it.

NAND and NOR boot are entirely different, do not involve a FAT filesystem, and do not involve a BOOT.BIN file.

JTAG boot uses the DAP (debug access port). The TAP (test access port) is used to fool with the PL (FPGA). Chapter 27 of the TRM talk about DAP and TAP details. There are a variety of security features related to JTAG boot. In particular a fuse can be blown that causes both TAP and DAP to be disabled.

Where the heck is the bootrom? They say it is 128K in size. It is part of OCM which consists of 256K of ram and 128K of bootrom. Section 29 notes that the bootrom is "not user visible". It also notes that on entering "user mode" the BootROM is no longer accessible and that RAM is split with 64K at the high OCM address and 192K at the low address.

The following describes an exploit that allows you to read out the bootrom. He discusses an undocumented bootrom uart loader.

Feedback? Questions? Drop me a line!

Tom's Computer Info / tom@mmto.org