Extract (read back) configuration data from a Zynq-7000 FPGA

Introduction

This article will show you how to use Vivado to read back the bitstream programmed into a physical Zynq-7000 device.

The bitstream that is read back will differ from the bitstream generated by Vivado because Vivado generates a bitstream containing configuration commands, whereas the readback file contains only the configuration data. However, comparing the two files to verify that they match is possible. We have another post on the multiple bitstream data formats and how to analyze a bitstream: (coming soon).

Note that the hardware will disable bitstream readback while an encrypted bitstream is programmed. Readback only works for non-encrypted bitstreams.

Program the device

As a prerequisite, you’ll need a Zynq-7000 with a bitstream programmed into it. You can skip this section if you already have a bitstream programmed into your device.

You can generate a bitstream by following Part 1 (through step 25) of Run Hello World on a ZC702. That guide was written for Vivado 2018.2, but those steps still work in 2023.1.

That will generate ps7_init.tcl and the bitstream, located at:

<vivado project directory>/project_1/project_1.gen/sources_1/bd/design_1/ip/design_1_processing_system7_0_0/ps7_init.tcl

<vivado project directory>/project_1/project_1.runs/impl_1/design_1_wrapper.bit

Set your board to JTAG boot mode – on a ZC702, all pins in blue SW16 should be to the side opposite the SD card / power connector / power switch.

Program the bitstream into the device using xsct:

/tools/Xilinx/Vitis/2023.1/bin/xsct

connect

source /path/to/ps7_init.tcl

targets 1
# (select the APU target; run just `targets` to see the list of targets and their numbers)

ps7_init
ps7_post_config

targets 4
# (select the FPGA target)

fpga /path/to/bitstream.bit

At this point, the INIT_B and DONE pins should both be high. On the ZC702 dev board, the corresponding LEDs should be green.

Read back the bitstream

Launch Vivado into Tcl mode. Alternatively, you can use the Tcl console from inside the Vivado GUI. Connect to your SmartLynq, or to your local hw_server instance if you are using USB-JTAG. xsct should have already launched hw_server while programming the bitstream. If not, you can launch it manually by running "/tools/Xilinx/Vitis/2023.1/bin/hw_server -s tcp::3121"

/tools/Xilinx/Vivado/2023.1/bin/vivado -mode tcl

open_hw_manager

connect_hw_server -url localhost:3121

get_hw_targets
=> 10.209.202.1:3121/xilinx_tcf/Digilent/210203AB90E5A

current_hw_target
=> 10.209.202.1:3121/xilinx_tcf/Digilent/210203AB90E5A

open_hw_target

get_hw_devices
=> arm_dap_0 xc7z020_1

current_hw_device
=> xc7z020_1

readback_hw_device -readback_file /path/to/readback.rbd -bin_file /path/to/readback.bin -force

This will create two copies of the bitstream, one in rbd format and one in bin format. You can also read back the bitstream in other formats – see readback_hw_device -help.

References

UG908 – Vivado Design Suite User Guide: Programming and Debugging

Section “Bitstream Verify and Readback for FPGAs and MPSoCs” (link to section)

Logo from https://library.amd.com/media/ (requires a password)