January 21, 2025

Antminer S9 board - U-boot - plan B hack environment variable source

The idea now is to find the strings that set up the compiled in set of environment variables and then change/augment them. This will give me a U-boot build permanently configured for network booting of Kyu.

I search for "splashimage=66000000" and get quick results. I find it in: 

include/config_distro_bootcmd.h
A quick side note. There are a number of files here that begin with "config", notably config.h -- which is marked "do not edit" and includes various other files. Interestingly it includes configs/bitmain_antminer_s9.h which is worth looking at.

As for config_distro_bootcmd.h, what we are interested in is where "BOOTENV" gets defined. It is not just a big static string as I thought it would be, but there are a myriad of MACROS getting substituted to generate this macro. The thing to do would be to look at the output of printenv and decide how to tap into all of this. We want something like this: 

setenv bootaddr 0x20000000
setenv boot_kyu echo Booting Kyu via dhcp/tftp\; dhcp\; go \${bootaddr}
setenv boot_tftp echo Booting Kyu via tftp \; tftpboot \${bootaddr} bitcoin.bin \; go \${bootaddr}
setenv bootcmd run boot_tftp
setenv ipaddr 192.168.0.144
setenv serverip 192.168.0.5
saveenv
The hook to this is replacing "bootcmd", changing it as follows: 
bootcmd=run distro_bootcmd
bootcmd=run boot_tftp
bootcmd=run kyu_bootcmd
Then add these 
bootaddr=0x20000000
ipaddr=192.168.0.144
serverip=192.168.0.5
kyu_bootcmd=echo Booting Kyu via tftp \; tftpboot \${bootaddr} bitcoin.bin \; go \${bootaddr}
I hack this into config_distro_bootcmd.h and just type "make". It seems to rebuild everything, and amazingly enough I get images that boot and run. I see in the environment: 
bootcmd=run kyu_bootcmd
ipaddr=192.168.0.144
serverip=192.168.0.5
bootaddr=0x20000000
kyu_bootcmd=echo Booting Kyu via tftp ; tftpboot ${bootaddr} bitcoin.bin ; go ${bootaddr}
So I did managed to grog the format of the static string and insert what I wanted into the environment variable collection. Two things. Maybe three: the error is: 
Hit any key to stop autoboot:  0
Booting Kyu via tftp
Using ethernet@e000b000 device
TFTP from server 192.168.0.5; our IP address is 192.168.0.144
Filename 'bitcoin.bin'.

TFTP error: trying to overwrite reserved memory...
## Starting application at 0x20000000 ...
undefined instruction
pc : [<20000000>]	   lr : [<1ff68c50>]
So the TFTP transfer failed, but U-boot was happy to jump into that memory address, giving the same fault as if the network cable had not been connected. One last note before digging into this memory issue. When U-boot starts I see the messages: 
U-Boot 2020.04 (Jan 21 2025 - 21:26:39 -0700)

Model: Bitmain Antminer S9 Board
DRAM:  ECC disabled 512 MiB
WDT:   Started without servicing (200s timeout)
NAND:  0 MiB
MMC:   mmc@e0100000: 0
Loading Environment from NAND... *** Warning - readenv() failed, using default environment
Note the NAND size of 0 MiB -- either I have faulty NAND or I don't have U-boot configured right. This doesn't particularly matter right now, but down the road I would like to fool with NAND.

This is on board "A", I see the same message on my board "C" where I saw it just today start to boot from NAND, so this is a U-boot config problem.

What is up with memory

This antminer s9 should have 512M of ram (and it does!) And by the time U-boot is running, this should be from 
0 to 0x20_000_000
So yes, how could this load address ever have worked? It does work on my other system. And it works because this address is aliased to address 0 there.

They are also aliased on the new system in the same way, as show by comparing the outputs of "md 0" with "md 0x20000000". But it isn't that simple. When I write to address 0, the dump at 0x20000000 doesn't see it, and when I write to address 0x20000000 the dump at 0 doesn't see it. It is almost as if there is some cache coherency issue.

Feedback? Questions? Drop me a line!

Tom's Computer Info / tom@mmto.org