Attention: For security reasons,please choose a user name *different* from your login name.
Also make sure to choose a secure password and change it regularly.

Main Menu

TE0820 Flash eMMC over JTAG

Started by pema, May 31, 2023, 04:37:46 PM

Previous topic - Next topic


Hi there,
I would like to flash the eMMC flash on the TE0820 over JTAG. I already modified my kit so that the boot_mode pins can be changed to JTAG and eMMC bootmodes. Currently is booting over JTAG.
Correct me if I am wrong but isn't it the eMMC @0xFF17 0000 ? and SD card @ 0xFF16 0000 ?
Because when it enters u-boot it selects memory at ff160000 for emmc flashing
sdhci@ff160000: 0
ZynqMP> mmc dev 0 0
switch to partitions #0, OK

The process gets stuck at 0% ZynqMP> 0%...
Any ideas what might be ? I would appreciate any help.

Output from program_flash (hw_server running on a parallel terminal)
$ program_flash -f BOOT.BIN -fsbl zynqmp_fsbl.elf -flash_type emmc -emmc_partition_size large -blank_check -verify -target_id 3 -frequency 15000000 -url tcp:localhost:3121

****** Xilinx Program Flash
****** Program Flash v (64-bit)
  **** SW Build (by xbuild) on 2022-10-05-18:51:07
    ** Copyright 1986-2022 Xilinx, Inc. All Rights Reserved.

Connected to hw_server @ tcp:localhost:3121
Supported Frequency list
125000  250000  500000  1000000  2000000  3000000  3750000  5000000  6000000  7500000  10000000  15000000  30000000 

Retrieving Flash info...

Initialization done
Using default mini u-boot image file - ./55457_zynqmp_emmc.bin.50Mhz
===== mrd->addr=0xFF5E0204, data=0x00000000 =====
BOOT_MODE REG = 0x0000
Downloading FSBL...
Running FSBL...
===== mrd->addr=0xFFD80044, data=0x00000000 =====
===== mrd->addr=0xFFD80044, data=0x00000000 =====
===== mrd->addr=0xFFD80044, data=0x00000000 =====
===== mrd->addr=0xFFD80044, data=0x00000002 =====
===== mrd->addr=0xFFD80044, data=0x00000003 =====
Finished running FSBL.
===== mwr->addr=0xFF18031C, data=0x64406440 =====
===== mwr->addr=0xFF180314, data=0x01150000 =====
===== mwr->addr=0xFF180318, data=0x00450043 =====
NOTICE:  ATF running on XCZU3EG/silicon v4/RTL5.1 at 0xfffea000
NOTICE:  BL31: Secure code at 0x60000000
NOTICE:  BL31: Non secure code at 0x10000
NOTICE:  BL31: v1.3(release):
NOTICE:  BL31: Built : 10:38:42, Feb  1 2017

U-Boot 2022.01-00146-g0526f91 (Jul 27 2022 - 03:13:13 -0600)

Model: ZynqMP MINI EMMC0
Board: Xilinx ZynqMP
DRAM:  512 MiB
EL Level: EL2
MMC:   sdhci@ff160000: 0
Loading Environment from <NULL>... OK
In:    dcc
Out:   dcc
Err:   dcc
ZynqMP> mmc list
sdhci@ff160000: 0
ZynqMP> mmc dev 0 0
switch to partitions #0, OK
mmc0(part 0) is current device
ZynqMP> mmc list
sdhci@ff160000: 0 (eMMC)
ZynqMP> mmc dev 0 0
switch to partitions #0, OK
mmc0(part 0) is current device
ZynqMP> Performing Erase Operation...
mmc dev 0 0
switch to partitions #0, OK
mmc0(part 0) is current device
ZynqMP> 0%...

Here the output from the serial console

TE0820 TE_XFsbl_HookPsuInit_Custom
Configure PLL: SI5338
Si5338 Init Registers Write.
Si5338 Init Complete
PLL Status Register 218:0x8                                       
USB Reset Complete
ETH Reset Complete


Xilinx Zynq MP First Stage ot Loader (TE modified)
Release 2021.2   May 26 2023  -  150:09
Device Name: XCZU3CG
MultiBootOffset: 0x0
Reset Mode : System Reset
Platform: Silicon (4.0), Cluster ID 0x800000
Running on A53-0 (64-bit) Processor, Device Name: XCZU3C
TE0820 TE_XFsbl_BoardInit_Custom

Processor Initialization Done
================= In Ste 2 ============
In JTAG Boot Mode
================= In Ste 4 ============
PMU-FW is not running, certain applications may not be supported.
Protection configuration appliedExit from FSBL


eMMC is not formated by default. easiest way is to boot linux from SD(for example our reference design) and use linux to format eMMC like you want.
SD0 is eMMC(should be @ 0xFF16 0000)
SD1 is SD (shoudl be @0xFF17 0000)
On our reference design SD1 is set as premary boot mode.


Hi John,
thanks for your reply.
Yes I realize that over the SD/QSPI boot and then over Linux format the eMMC is the easy way.And it works . But once we get our product into production we wont have SD card input no more. Just JTAG and eMMC/QSPI.
So we would need to:
1. load over JTAG the pmu_fw,  fsbl_fw, atf, u-boot.
2. From the u-boot format the emmc partition.
3. Load the image to RAM,
4. Copy the image(pmu_fw, fsbl_fw, atf, u-boot, kernel rfs etc) to the emmc.
The provided Xilinx bash script program_flash ( can be found under  ~/petalinux/2023.1/tools/xsct/bin/program_flash) does this but gets stuck when erasing the eMMC from the u-boot.
I also tried the steps provided here But it never executes the u-boot.

From the serial console looks like it gets stuck in stage 4 from the PMU_fw and applies the "Protection configuration". But from the xsct output l looks like it loads even fsbl, atf and the u-boot.
So I am not sure if this could be due to the pmu_fw or fsbl_fw.

Thank you for your support on this matter.

Best Pema


uboot is also possible, but I can't help much more, this is more general AMD(Xilinx) problem...
Other alternative. write QSPI over jtag, boot uboot and uboot load image.ub over eth via tft server and boots linux which automatically write emmc and maybe also overwrite qspi with your factory boot.bin


Hi John,
ended up using the program_flash script provided by xilinx. Unfortunately that script uses an executable. So custom modifications are tricky.
I assume the executable uses xsct. To bad they dont provide the sources. But perhaps as alternative would be to write a .tcl script. Just didnt figure out quite well how to direct the u-boot to XSCT in order to execute some u-boot commands like mmc list, mmc part, etc. 

But the script performs well for flash erase, create partition and copy the .bin, .TIF, u-boot scripts, etc .
Can also make a verify in the end.

Thanks once again for your support !