Topic: Efudd Z-Series Fuddware 2.3 -Z11/Z11e/Z11j/Z9/Mini - page 17. (Read 45527 times)

PM me and we can discuss.
I have one with 2 psu running 1 apw3 on 2 boards and 1 1200w server psu on the third one.
Also i had a buddy to enable ssh onto my z11.
THanks

Is anyone getting more than 142kSol out of their Z11 on average? I am wondering if the auto-tuning feature is not actually auto-limiting. I cannot confirm this at the moment from a reverse engineering perspective as I am away from my equipment. It's just a hypothesis since I have not heard of anyone with more than 142kSol yet.....

@iceman2k2 - Yes, SSH is disabled. Any image will have to be installed from SD card for now. I agree with you on power. I'm hoping to be able to test as soon as I can get things lined up with a couple of individuals.

Thank you,

Jason

Hey Jason,
Z11 are ssh disabled as the s15.
As I understood you wanna install your firmware via SD?
Also you have to consider power supply constraints as it uses 1450w stock. For over a 2000w at least PSU would be necessary.

Thanks

If someone has A) teamviewer and/or B) (preferred) knowledge enough to create an SSH/web port forward AND C) knowledge enough to do a SD card based install on a Z11, I've got an image to start testing with and see what these things can do.

PM me A and C or B and C with a Z11 are true.

Thank you,

Jason

Folk,

Quick update on the Z11 -- at this point in time, I think I'm going to wait and see what happens with the Z11s as they arrive before deciding on releasing a firmware.

Here is what i know so far:

The stock configuration file defaults to 718mhz (turbo mode).
If that is not specified, it defaults to 681Mhz (Balance mode).

It looks like in both cases, there is an attempt to auto-tune the frequency. It's a little hard to tell what is going on without seeing a running system yet, however.

It does not look like the user can specify a frequency at all -- it is ignored.

Voltage appears controllable, although not exposed to the user.

As your Z11s arrive, I would be interested in seeing logs from the unit via PM and/or teamviewer sessions. If there is a need, I will remove the limits and given an opportunity, I will test other possibilities with the controls... I do not have a unit coming to me this time, however.

It may be that the factory firmware provides you what you'll need... if it doesn't, I will work to do something about it.

Thank you,

Jason

Yes.

https://www.nicehash.com/miner/3CJgXokLQrRCQcEoftS7MbPDSXhXpX6P55
This is the power of the author of the virus that reconfigures the miners to your account in the Nicehash?

if paid by credit card file a reverse charge under the condition that the sellers intent was to fraud you and you will more then likely get your money back and get to keep the miners.

Thanks Jason for this info, I bought a couple of z9minis off Aliexpress, and they have this malware issue. After running for several days, reconfigured to https://www.nicehash.com/miner/3CJgXokLQrRCQcEoftS7MbPDSXhXpX6P55 and stole my hashing power.

regards
Graeme

I will strip the board down later today and get some pictures...It should take me a couple hours or so to do it.

Folk,

First batch of Z11s have shipped as of today: https://blog.bitmain.com/en/z11-shipping/2019-04-11.html

-j

Yes -- that's actually how the product works even with the rest of the power plugged in. During initialization of a hashboard, DC is toggled on. When hashing stops, DC is toggled off. And yeah, I'm sure there is some vampire current somewhere, but I wouldn't expect anything major.

I've almost got my lab rebuilt (physical move) and can start working on the hardware RE again.

-j

Jason would a picture of the top and bottom trace lines help you from a v9/z9 controller. I have a bad one and if it will I can strip it down to the copper traces. There more then likely is a middle layer too but I could only get that if I shave off the top carefully

Also I don't know if you know or not but the pic should power up and take commands from the controller without the 12v being plugged into the hashboard. The v9 I am playing with will initialize everything but the asic power without the hashboard being connected to power. This is allowing me to play with most the commands and such without wasting power while I test other parts.

I have some more for you...… This is the Pic code for a V9... It is a full code. You may be able to dump theZ9 pic using the eeprom dump  binary which is part of the z9 firmware. You need to know the address you want to start at but it may be possible.


Here is a link to download the hex version without the cr/lf     https://app.nihaocloud.com/f/c6089754ca7f4878ab30/?dl=1

31862E0231872FD43010003D00A0301100A1002401910020080E00F1300336F10B892E0F0871390 7070938A0002400923036009514161617159708123189211A000800201D910008002419142E441A 942E300811002000E7086700E9002416151E942E441F952E3C0811002000E7086700E9002413952 E42318B23A63186318626F33186002416151D142EF01A942EED318A22A231860021084C19032E6D 0020086F1D032E6D002101CC01C801D0002001EA01EB3000026B30FF1903026A18032E6C300107E A30003DEB3000026B30FF1903026A1C032E6100010021084304420441044019032EA30020086F1D 032EA33000002100C3300000C2300000C1300000C008530022009900210853002000E701E808670 02200C000200868002200C1303F00C2300000C330E000F8300F00F9304000FA300100FB300100FC 300000FD318C24D131860021084B19032EBC0020086F1D032EBC002101CB30FF00F8300F00F930D 400FA300000FB300100FC300000FD318C24D131860021084A19032ED50020086F1D032ED5002101 CA30F000F8300F00F9304000FA300100FB300C00FC300000FD318C24D131860021084919032EED0 020086F1D032EED002101C930E100F8300F00F9304000FA300100FB300400FC300000FD318C24D1 00241A941615002011910008002001C901CA01CD01CE01CB01CC30A000863001008730290084300 00085302000A70016001A0BA72F040021084D1903000801CD002001EE00220822002000A701A808 2700CB082800CC01CD01CE084C024E1D032F20084B024D18032F3B084D3E023E200086300100870 80100A7084D3E290086018708270081084D3E200086300100870181300107CD30003DCE2F1A0022 01A001A130553189211A318630AA3189211A3186002001CD01CE084C024E1D032F4F084B024D180 32F5F084D3E290086018708013189211A31863001002007CD30003DCE2F4901CD01CE084B3EFE00 A730FF3D4C00A80828024E1D032F6D0827024D18032F7F084D3E2900860187080100A701A808270 7C908283DCA300107CD30003DCE2F61084B3EFE3E2900860187084A00A8084900A7082800A701A8 082706011D032FBC084B3EFF3E2900860187080106491D032FBC01CD01CE3000024E30201903024 D18032FB4304500A7084D3EA00086018708270081300107CD30003DCE3000024E30201903024D1C 032FA1084B00A7082700F23029318A221F000830FC3189211A0020082A00A70827002100A001A13 002002000A7082700EF002101CE3001002000A70827002100CF0008300F00843089008500210012 00D1001200D2001200D3001200D4001200D5002001EE01EF30A0008430000085303131892114318 73020008430010085304031892114318730A00084300100853020318921140020318C2C5C3FFF3F FF3FFF3FFF3FFF3FFF3FFF3FFF3FFF3FFF3FFF3FFF3FFF3FFF3FFF3FFF3FFF3FFF3FFF3FFF3FFF3 FFF3FFF3FFF3FFF3FFF3FFF3FFF3FFF3FFF3FFF3FFF3FFF3FFF3FFF3FFF3FFF3FFF3FFF3FFF3FFF 3FFF3FFF3FFF3FFF3FFF3FFF3FFF3FFF3FFF3FFF3FFF3FFF3FFF3FFF3FFF3FFF3FFF3FFF3FFF3FF F3FFF3FFF3FFF3FFF3FFF3FFF3FFF3FFF3FFF3FFF3FFF3FFF3FFF3FFF3FFF3FFF3FFF3FFF3FFF3F FF3FFF3FFF3FFF3FFF3FFF3FFF3FFF3FFF3FFF3FFF3FFF3FFF3FFF3FFF3FFF3FFF3FFF3FFF3FFF3 FFF3FFF3FFF3FFF3FFF3FFF3FFF3FFF3FFF3FFF3FFF3FFF3FFF3FFF3FFF3FFF3FFF3FFF3FFF3FFF 3FFF3FFF3FFF3FFF3FFF3FFF3FFF3FFF3FFF3FFF3FFF3FFF3FFF3FFF3FFF3FFF3FFF3FFF3FFF3FF F3FFF3FFF3FFF3FFF3FFF3FFF3FFF3FFF3FFF3FFF3FFF3FFF3FFF3FFF3FFF3FFF3FFF3FFF3FFF3F FF3FFF3FFF3FFF3FFF3FFF3FFF3FFF3FFF3FFF3FFF3FFF3FFF3FFF3FFF3FFF3FFF3FFF3FFF3FFF3 FFF3FFF3FFF3FFF3FFF3FFF3FFF3FFF3FFF3FFF3FFF3FFF3FFF3FFF3FFF3FFF3FFF3FFF3FFF3FFF 3FFF3FFF3FFF3FFF3FFF3FFF3FFF3FFF3FFF3FFF3FFF3FFF3FFF3FFF3FFF3FFF3FFF3FFF3FFF3FF F3FFF3FFF3FFF3FFF3FFF3FFF3FFF3FFF3FFF3FFF3FFF3FFF3FFF3FFF3FFF3FFF3FFF3FFF3FFF3F FF3FFF3FFF3FFF3FFF3FFF3FFF3FFF3FFF3FFF3FFF3FFF3FFF3FFF3FFF3FFF3FFF3FFF3FFF3FFF3 FFF3FFF3FFF3FFF3FFF3FFF3FFF3FFF3FFF3FFF3FFF3FFF3FFF343D340034FF34F4340100640180 31010B892915340000F000231C9E291B0870009A000800F000241395087000911B9529221615000 830550023009630AA0096149500000000000830780020049C3003049C3026009B00211091002010 91002101D0000808700023009108710092131512951415000000000023081400F1081300F000080 0F1300400F0087000F230FA00F0087000F3300102F31D03295A300102F21D032956300102F11903 0008295230880022009730FB00F008700023058E3092002A00913088002200980020150C3007002 10095170B159100083006027130001903027018032988300000F0300600F1087100230092087000 911315161515153189212A000000000023111500083014003D00910023151E159F3022009B019C1 21E179D169E300531892151318930553189211A318930413189211A318930523189211A31893054 3189211A000801F901FA30E000F0300F00F1307900F8087800F2300100F3300000F4318A2242318 9087900F80878002100D30A53190329D2085329D3307F0022009908193189211A0008002008253E 02072200F308730086018708011D0329E6150C29E7110C301500F30873002100A0300100F308730 0A1300200F30873002000EF002101CE300100F3087300CF000800200822008601873F42002100D3 301000F3087300A0300100F3087300A1300200F30873002000EF002101CE300100F3087300CF300 000C3300000C2300000C1300100C00008002000A201A501A601A001A101A301A4318F2F46300700 F30873002100A0300100F3087300A1300200F30873002000EF002101CE300100F3087300CF30010 0F3087300CC00080871002300920870009101F7087700F501F6087402761D032A51087302751803 000813151415000000003577077200F5087500860187002308133FC008143FC13001079130003D9 2300100F5087507F72A48300500F30873002100A0301700F3087300A1308100F3087300A2082200 F301F40820072100F501F60DF60873077500F708743D7600F80877002000A3087800A4082400F30 873002100A30020082300F30873002100A4300500F30873002000EF002101CE300100F3087300CF 00080024081100F1087100F20021084F19032AD10020086F190300080021084E3EA000860187080 13189211A318A0021084E3EA000860187080131892121318A300100F10871002107CE3001002002 EF086F1D032ACE002101CF00241615000830FF31892121318A30FF3189211A00241615000801F20 0201C9100081091019A300100F10871002107D0301902501C030008002001EE01F2302002721803 2AFF08723E200086300100870181300100F1087107F2302002721C032AF10020111C002101D0305 43189211A318A30493189211A318A304D3189211A318A30453189211A318A30523189211A318A30 323189211A0008002001A501A630000226300C1903022518032B4508253E02072200F3087300860 1873000040100F4303F00F535253E4000863001008708743FC008753FC1300107A530003DA63000 0226300C190302251C032B25301200F30873002100A0300100F3087300A1300200F30873002000E F002101CE300100F3087300CF300100F3087300CA0008002101D101D201C401C5300600F3087300 A0301600F3087300A1300100F3087300A2084800F3087300A3082300F301F4082200F501F608200 72100F701F80DF80875077700F908763D7800FA0873077900FB08743D7A00FC087B002000A3087C 00A4082400F30873002100A40020082300F30873002100A5300600F30873002000EF002101CE300 100F3087300CF00080024081100F0087000F20020086E1D032BB3305506721D032BBA036E1D032B C030AA067219032BC001EE111C019A002101D02BED0020086E1D032BC6019A151C087200F0086E3 E2000863001008708700081300100F0087007EE3003026E1C032BED002208223E0200F030001803 300100F10020086E067004711D032BED111C019A002101D0300100F0087000CD002416150008301 000F30873002100A0301300F3087300A10820072100F301F40DF40873002000A3087400A430F000 2100C6300F00C7002001A501A630000226300C1903022518032C450021084700F1084600F031892 141318B0871002000A1087000A0082000F308253E023EA0008601870873008108253E023EA00086 0187080100F301F4087307A308743DA43001002107C630003DC73001002007A530003DA63000022 6300C190302251C032C12082400F30873002100AE0020082300F30873002100AF301000F3087300 2000EF002101CE300100F3087300CF000831892167318C31892133318C31892197318C318626043 18C318921B7318C00641D0B2CCA0020190C2CCA110B3001002102D130003BD20A511D032CCA0A52 1D032CCA303D00D1300000D20845002000ED00210844002000EC00210AC419030AC530000020026 D303D1903026C1C032CCA150C30433189211A318C304C3189211A318C304F3189211A318C305331 89211A318C30453189211A318C30203189211A318C30443189211A318C30433189211A318C302D3 189211A318C30443189211A318C30433189211A318C002101C401C53001002000EC086C002100C8 31862621318C318A22DB318C2C6B3006027930001903027818032CDC300000F8300600F930E0057 8002000E430FF057900E5086500F1086400F0302400A0082000F2302000F3300000F4318A224231 8C002001E6086600A001A1087D02211D032CFD087C022018032D1A086600A001A135A00DA108200 77A008608213D7B00870878391F076607093E24008401853F403F803F413F81300100A0082007E6 2CF4086500F1086400F03189217D318C00231315002008650023009200200864002300911215169 51515002001E6301F026618032D7335663E24008601873F4000A03F4100A1082100A001A130FF05 2000A23000052100A3300002233040190302221C032D5930AA0023009A002035663E24008601873 0FF05813141303F058135663E24008601873F40002300933F4100943189212A318C300100230791 30003D923001002000A0082007E6301F02661C032D3435663E24008601873F40002300933F41009 412953189212A002311150008300500F30873002100A0301800F3087300A1085300F3087300A208 2200F301F40820072100F501F60DF60873077500F708743D7600F80877002000A3087800A408240 0F30873002100A30020082300F30873002100A4300500F30873002000EF002101CE300100F30873 00CF0008002001A501A63000022630041903022518032E1235253E03072200F3087300860187080 100F401F535253E02072200F6087600860187080100F701F8087700F801F73000057700FA30FF05 7800FB0874047A00FC0875047B00FD35253E40008630010087087C3FC0087D3FC135253E0207220 0F308730086018708013189211A318D002035253E03072200F308730086018708013189211A318D 3001002007A530003DA6300002263004190302251C032DC3302200F30873002100A0300100F3087 300A1300200F30873002000EF002101CE300100F3087300CF300100F3087300C90008300C00F308 73002100A0302300F3087300A10820072100F301F40DF40873002000A3087400A430E1002100C63 00F00C7002001A501A63000022630041903022518032E950021084700F1084600F031892141318D 0871002000A1087000A0082100F335253E023EA00086018708730081082000F335253E033EA0008 601870873008135253E023EA000860187080100F301F4087307A308743DA435253E033EA0008601 87080100F301F4087307A308743DA43001002107C630003DC73001002007A530003DA6300002263 004190302251C032E4D082400F30873002100AA0020082300F30873002100AB300C00F308730020 00EF002101CE300100F3087300CF0008002008223E020086018708013189211A318D002008223E0 30086018708013189211A318D002008223E0300860187080100F301F408223E0200860187080100 F501F6087500F601F508730475002100D40874047600D5302400F3087300A0300100F3087300A13 00200F30873002000EF002101CE300100F3087300CF300100F3087300CB0008300600F308730021 00A0302500F3087300A10820072100F301F40DF40873002000A3087400A430FF002100C6300F00C 7084700F1084600F031892141318D0871002000A1087000A0082100F30873002100A20020082000 F30873002100A3082200F301F40873002007A308743DA40021082300F301F40873002007A308743 DA4082400F30873002100A40020082300F30873002100A5300600F30873002000EF002101CE3001 00F3087300CF000800200A220086018708013A0719032F713A1719032F733A0219032F753A01190 32F773A0619032F793A0319032F7B3A0119032F7D3A0F19032D823A3A19032DB93A0119032E2B3A 0719032EAC3A0119032EEF2F700008318A2A29318929FC318B2B1B318B2BF0318929D9318B2B5E3 18A2A6B3FFF

I will see if I can cleanup the fullsize chip enough to read a part number...it may be a day or two till I can do it.

if the test spots marked pwm1-pwm4 are what controls the output by pwm signal then there could be a few ways to get more out of these via voltage. Either software, hardware/software mod, or hardware mod only.

Also if you need some longer ribbon cables so you can test a board out of the case you can try what I use.... I took the 18 pin connectors off of some bad boards for a v9 then cleaned the pins good....slide the pins into 1 18 pin cable then plug another cable into it....quick extension cord for the ribbon cables, Just make sure you plug the pins so it keep the original pinout and doesn't swap them opposite.

Mind taking pictures of the board with the IC you've identified?

I only have a Z9 around, no minis.

-j

Jason I have the part number for the voltage IC …. This is from a Z9 Mini Batch 4 all 4 IC's have the same numbers. The datasheet the IC looks different but they are only showing 1 package the one on the Z9 may be a package they haven't updated the sheet for. Your Welcome

Infineon
TDA21470
H1831
4N42

The only way I know of to trick the lock bit on a pic is to trick it into thinking it is not set. In the past there was a method to short a couple of pins or apply voltage or ground to a certain pin as you try to read it. But I believe you had to have a pic programmer to do it. I have a emp11 which cover a lot of pics but it is about 10yrs old and don't have the settings for the newer pic's. A pic programmer isn't hard to build though. I wonder if any of the chips on the V9 are the same as the one your looking at. They are still readable on a v9.

The V9 VRM chip number is 27402S digikey lists as a slightly different number TI lists as a 27402. The TI spec sheet has good diagrams also. I would assume they are using the same VRM on most of their machines since they are pretty versatile.

With looking at the diagrams the output voltage possibly can be changed by switching 1 resistor on the hashboard, by changing the resistor connected to the comparator line and ground (marked Rfb2) the output voltage would automatically raise or lower depending on the resistor used. It also looks like it is creating its own PWM internally based on other voltage values. The fadj pin also determines the maximum output current. Kind of interesting how it can be hardware modified as easy as it is. I went about it the wrong way and I think I figured out the extra heat problem now.

Brain is working with ideas too fast now....LOL

I tell ya what I know we are both assholes but I think we can work together to get a good solution to get past voltage issues on all miners. I have a few V9's laying around and I will try some mods to them since they use the same controller. If I have any luck on the regulator section I will share it with you. I would rather burn them out testing voltage stuff then a good z9 board. This ain't no partnership its more like democrats and republicans coming together to screw the Chinese manufacturers.

update ….. on the V9 circuit they are using what looks like to be diagram 41 in the spec sheet. I stripped one board down and will post pics of the circuit. If they used the same design pattern then all should be ok with comparisons. I need to pull a mini or full board and get a pic of the vrm circuit area

Update... on my V9 Adding some voltage via 2-wires and resistor hardware mod gave about 1-2gh increase and reduced the HW errors from 4k+ to less than 1k with a little heat....tweaked resistor a little more got it to 0 HW errors at 825 mhz sorry it is off topic

The simpler thing is to simply not check for the fans if that is the needed.

Data logging is not a problem I have.
The chip is question has not been identified as best I am aware by any method ... go run your finger over the white part of that chip... it's actually been cut into to remove the top layers and hide the markings.

... my office/lab is better equipped than any radio shack ever was.

Voltage path: FPGA->(via i2c) PIC->(via separate i2c/i2s) ISL->VRM->hashboard
Fan Path: FPGA->fans (FPGA generates the pulse, "pulling to ground" does not make sense in this context).
Communications to the hashboard are a combination of things: FPGA->PIC->(Magic i2c interface over rs232 end-point terminated in fpga memory [kind of like a poor man's rDMA])->hashboard

Certain components downstream of the PIC are mapped to FPGA space through the use of the PIC as an interface. The PIC firmware on the z9/mini does not implement a couple of calls that are implemented (I think) on the Z11 PIC firmware. Voltage controls are included in this statement.

There is also another communication path I have not yet isolated directly related to how Z9/Z9mini ISL is communicated with. In bitmain's cgminer implementation, the payload is set up to communicate on an i2c bus (i.e., the bytes are what would be necessary to send out SDA), but since i2c is open-collector and the backend i2c is always low... it is not in use.

A useful endeavor would do know if the read protect bit is set on the PIC and then the FPGA, in that order.

... yeah, my self teaching covers a lot.

-j

If you have a good magnifier you can try to rub an eraser on the chip then try to read it or you can take a wet finger and rub across the chip. Sometime either method can bring out the chip markings. They can only scratch so deep on the chip and usually the etching of the chip can be barely read doing the above method. On chip where a drop of epoxy was put on top, use some heat and it will soften the epoxy and you can carefully get it off to a point where you can read the chip markings I will also add you can log just about any data with a terminal program and a serial port on a pc. Some stuff is inverted if not ran thru a max232 and some may not be. I built a logging board with a max232. The i2c can also be read and programmed via the same serial port without a max232. The pic is not as easy, I have a emp11 I use for all other micro's and eeproms


From what I have found so far the fan PWM is pulling to ground to slow the fan, so if that is the case the pwm for the voltage should have to be pulled down or raised up depending on the vrm's specs. If that is the case then somewhere on the hashboard there should be a resistor or 2 that could be changed allowing a different range of the modified pwm or the voltage pwm could be swapped with the fan pwm allowing changes to the pwm signal via the fan control if that is what the pwm line is doing to the voltage.

We know all we need is rpm signal for fan to detect correctly and that can be provided by a fan emulator leaving the pwm line unused and available for other things. You can also build a pulse generator if you have a radioshack near they have the parts and it is easy to build. The fan emulator with a variable resistor is basically the same thing