Tom's computer pages

June 17, 2024

Antminer S9 U-boot install - SD boot shortcut

About a month ago I received a bad Antminer S9 board via an Ebay purchase and set up an SD card to help diagnose it.

BAD antminer and an SD card

What I did then was to go to the bitmain site (see the above link) and download an image called: "S9 SD card recovery image for C5 control board" This ended up giving me a 4G image named:

2016 S9-20160607-recovery-sd.img

I used "dd" to put this on a 16G SD card. I dug around someplace to find BOOT.BIN and put it on the card. Since I was trying things with a bad board that may have been needless, I can't say what would happen with the recovery image and a good board.

Try that disk

I found that 16G disk laying around, and plugged it into my ailing Antminer with the jumpers set for SD boot. More than anything I wanted to verify that I had the jumpers right. I fired up U-boot, but doesn't find linux.

But it does boot up U-Boot nicely. The card looks like this:

Disk /dev/sde: 14.84 GiB, 15931539456 bytes, 31116288 sectors
Device     Boot   Start     End Sectors  Size Id Type
/dev/sde1          2048  616448  614401  300M  b W95 FAT32
/dev/sde2        616449 3074049 2457601  1.2G 83 Linux
/dev/sde3       3074050 3094530   20481   10M a2 unknown

The mounted FAT partition looks like:

drwxr-xr-x  2 tom  tom     8192 May 25  2016  bin
-rw-r--r--  1 tom  tom  2559872 May  5 15:50  BOOT.bin
-rw-r--r--  1 tom  tom    17711 Feb  1  2016  soc_system.dtb
-rw-r--r--  1 tom  tom  4244820 Apr 22  2016  soc_system.rbf
drwxr-xr-x  2 tom  tom     8192 Mar  2  2016 'System Volume Information'
-rw-r--r--  1 tom  tom      229 Feb  1  2016  u-boot.scr
-rw-r--r--  1 tom  tom  3459944 Feb  1  2016  zImage

The shortcut

We can apparently set U-boot environment variables and make them stick. It is still a mystery how (see below), but who cares, let's put it to work for us.

Here is what I have added in the past with some modifications:

setenv bootaddr 0x20000000
setenv boot_kyu echo Booting Kyu via dhcp/tftp\; dhcp\; go \${bootaddr}
setenv boot_tftp echo Booting Kyu via tftp \; tftpboot \${bootaddr} bitcoin.bin \; go \${bootaddr}
setenv bootcmd run boot_tftp
setenv ipaddr 192.168.0.144
setenv serverip 192.168.0.5
saveenv

I first try the "boot_kyu" method, but we get the following. I need to add an entry to the dhcpd.conf file on the server for this to work.

DHCP client bound to address 192.168.0.124
*** Warning: no boot file name; using 'C0A8007C.img'
Using Gem.e000b000 device
TFTP from server 192.168.0.1; our IP address is 192.168.0.124
Filename 'C0A8007C.img'.

So, I switch to using the "boot_tftp" method, but now I need to set host and server IP addresses for this to work.

Booting Kyu via tftp
Gem.e000b000 Waiting for PHY auto negotiation to complete........ done
Using Gem.e000b000 device
TFTP from server 10.10.70.101; our IP address is 10.10.70.102
Filename 'bitcoin.bin'.
Load address: 0x20000000

Once I set the IP addresses, it works!.

zynq-uboot> boot
Booting Kyu via tftp
Gem.e000b000 Waiting for PHY auto negotiation to complete........ done
Using Gem.e000b000 device
TFTP from server 192.168.0.5; our IP address is 192.168.0.144
Filename 'bitcoin.bin'.
Load address: 0x20000000
Loading: # 54.7 KiB/s
done
Bytes transferred = 1192 (4a8 hex)
## Starting application at 0x20000000 ...

I test it by cycling power and it works fine -- I'll just have to leave this SD card in this board -- and be aware that the card cannot just be taken to another board, the U-boot environment is saved on NAND someplace.

Setting U-boot variables

So here is a curious thing. I can set U-boot variables like so:

set zzz alligator
set zz2 metamorphic

And then I can do this:

zynq-uboot> saveenv
Saving Environment to NAND...
Erasing NAND...
Erasing at 0xe0000 -- 100% complete.
Writing to NAND... OK

And after a power cycle, those variables are in the environment! Where are they saved? I expected to see uenv.txt in the FAT partition, but there is no such thing (too bad).

I pull the card out and search for "metamorphic" and "alligator" on the first 400M of the SD card, but no luck.

However, when I search for "zynqrsa", I get:

dd if=/dev/sde of=zzz bs=1M count=400
strings zzz | grep zynqrsa
rsa_norboot=echo Copying Image from NOR flash to RAM... && cp.b 0xE2100000 0x100000 ${boot_size} && zynqrsa 0x100000 && bootm 0x3000000 0x2000000 0x2A00000
rsa_nandboot=echo Copying Image from NAND flash to RAM... && nand read 0x100000 0x0 ${boot_size} && zynqrsa 0x100000 && bootm 0x3000000 0x2000000 0x2A00000
rsa_qspiboot=echo Copying Image from QSPI flash to RAM... && sf probe 0 0 0 && sf read 0x100000 0x0 ${boot_size} && zynqrsa 0x100000 && bootm 0x3000000 0x2000000 0x2A00000
rsa_sdboot=echo Copying Image from SD to RAM... && fatload mmc 0 0x100000 ${boot_image} && zynqrsa 0x100000 && bootm 0x3000000 0x2000000 0x2A00000
rsa_jtagboot=echo TFTPing Image to RAM... && tftpboot 0x100000 ${boot_image} && zynqrsa 0x100000 && bootm 0x3000000 0x2000000 0x2A00000

From an odx dump, I see:

0334e690 0202 0202 0210 0202 0202 0202 0202 626f                 bo
0334e6a0 6f74 636d 643d 7275 6e20 246d 6f64 6562   otcmd=run $modeb
0334e6b0 6f6f 7400 626f 6f74 6465 6c61 793d 3300   oot bootdelay=3
0334e6c0 6261 7564 7261 7465 3d31 3135 3230 3000   baudrate=115200
0334e6d0 6970 6164 6472 3d31 302e 3130 2e37 302e   ipaddr=10.10.70.
0334e6e0 3130 3200 7365 7276 6572 6970 3d31 302e   102 serverip=10.
0334e6f0 3130 2e37 302e 3130 3100 6574 6861 6464   10.70.101 ethadd
0334e700 723d 3030 3a30 613a 3335 3a30 303a 3031   r=00:0a:35:00:01
0334e710 3a32 3200 6b65 726e 656c 5f69 6d61 6765   :22 kernel_image
0334e720 3d75 496d 6167 6500 7261 6d64 6973 6b5f   =uImage ramdisk_
0334e730 696d 6167 653d 7572 616d 6469 736b 2e69   image=uramdisk.i
0334e740 6d61 6765 2e67 7a00 6465 7669 6365 7472   mage.gz devicetr
0334e750 6565 5f69 6d61 6765 3d64 6576 6963 6574   ee_image=devicet
0334e760 7265 652e 6474 6200 6269 7473 7472 6561   ree.dtb bitstrea
0334e770 6d5f 696d 6167 653d 7379 7374 656d 2e62   m_image=system.b
0334e780 6974 2e62 696e 0062 6f6f 745f 696d 6167   it.bin boot_imag
0334e790 653d 424f 4f54 2e62 696e 006c 6f61 6462   e=BOOT.bin loadb
0334e7a0 6974 5f61 6464 723d 3078 3130 3030 3030   it_addr=0x100000
0334e7b0 006c 6f61 6462 6f6f 7465 6e76 5f61 6464    loadbootenv_add
...
...
0334f180 6265 2030 2030 2030 2026 2620 7366 2072   be 0 0 0 && sf r
0334f190 6561 6420 3078 3130 3030 3030 2030 7830   ead 0x100000 0x0
0334f1a0 2024 7b62 6f6f 745f 7369 7a65 7d20 2626    ${boot_size} &&
0334f1b0 207a 796e 7172 7361 2030 7831 3030 3030    zynqrsa 0x10000
0334f1c0 3020 2626 2062 6f6f 746d 2030 7833 3030   0 && bootm 0x300
0334f1d0 3030 3030 2030 7832 3030 3030 3030 2030   0000 0x2000000 0
0334f1e0 7832 4130 3030 3030 0072 7361 5f73 6462   x2A00000 rsa_sdb
0334f1f0 6f6f 743d 6563 686f 2043 6f70 7969 6e67   oot=echo Copying
0334f200 2049 6d61 6765 2066 726f 6d20 5344 2074    Image from SD t
0334f210 6f20 5241 4d2e 2e2e 2026 2620 6661 746c   o RAM... && fatl
0334f220 6f61 6420 6d6d 6320 3020 3078 3130 3030   oad mmc 0 0x1000
0334f230 3030 2024 7b62 6f6f 745f 696d 6167 657d   00 ${boot_image}
0334f240 2026 2620 7a79 6e71 7273 6120 3078 3130    && zynqrsa 0x10
0334f250 3030 3030 2026 2620 626f 6f74 6d20 3078   0000 && bootm 0x
0334f260 3330 3030 3030 3020 3078 3230 3030 3030   3000000 0x200000
0334f270 3020 3078 3241 3030 3030 3000 7273 615f   0 0x2A00000 rsa_
0334f280 6a74 6167 626f 6f74 3d65 6368 6f20 5446   jtagboot=echo TF
0334f290 5450 696e 6720 496d 6167 6520 746f 2052   TPing Image to R
0334f2a0 414d 2e2e 2e20 2626 2074 6674 7062 6f6f   AM... && tftpboo
0334f2b0 7420 3078 3130 3030 3030 2024 7b62 6f6f   t 0x100000 ${boo
0334f2c0 745f 696d 6167 657d 2026 2620 7a79 6e71   t_image} && zynq
0334f2d0 7273 6120 3078 3130 3030 3030 2026 2620   rsa 0x100000 &&
0334f2e0 626f 6f74 6d20 3078 3330 3030 3030 3020   bootm 0x3000000
0334f2f0 3078 3230 3030 3030 3020 3078 3241 3030   0x2000000 0x2A00
0334f300 3030 3000 0000 2c20 0030 3132 3334 3536   000   ,  0123456
0334f310 3738 3941 4243 4445 4661 726f 6300 7364   789ABCDEFaroc sd
0334f320 7862 696d 0008 2008 0030 3132 3334 3536   xbim     0123456

Feedback? Questions? Drop me a line!

Tom's Computer Info / tom@mmto.org