diff --git a/cmds.sh b/cmds.sh
index 35daa3e..bc62982 100644
--- a/cmds.sh
+++ b/cmds.sh
@@ -1,21 +1,25 @@
+# UNPROTECT COMPLETE FLASH
+openFPGALoader -b colorlight-i9 -f --bulk-erase --unprotect-flash
+
 # BOOTLOADER BITSTREAM
 
-# Build the bitstream (provide --flash-boot = 0x200000 (memmapped spi flash) + 0xE0000 (firmware offset in flash))
-python3 example-colorlight-i5.py --ecppack-compress --flash-boot=0x2E0000 --ecppack-bootaddr 0x100000 --cpu-type vexriscv --cpu-variant imac --csr-svd build/colorlight_i5/csr.svd --uart-baudrate=1000000 --build
+# Build the bitstream (provide --flash-boot = 0x800000 (memmapped spi flash) + 0xE0000 (firmware offset in flash))
+python3 example-colorlight-i5.py --ecppack-compress --flash-boot=0x8E0000 --ecppack-bootaddr 0x100000 --cpu-type vexriscv --cpu-variant imac --csr-svd build/colorlight_i5/csr.svd --uart-baudrate=1000000 --timer-uptime --build
 # Flash at correct address using dev board / JTAG
-openFPGALoader -b colorlight-i5 -o 0x0 -f <bitstream>.bit
+openFPGALoader -b colorlight-i9 -o 0x0 -f <bitstream>.bit
 
 # BOOTLOADER FIRMWARE
 
 # Turn into FBI with
-./bin/crcfbigen.py bootloader/oc-fw.bin -f -l -o oc-fw.fbi
+./bin/crcfbigen.py build/colorlight_i5/bootloader.bin -f -l -o bootloader.fbi
 # Flash at correct address using dev board / JTAG
-openFPGALoader -b colorlight-i5 -o 0x0E0000 -f oc-fw.fbi
+openFPGALoader -b colorlight-i9 -o 0x0E0000 -f bootloader.fbi
 
 # USER BITSTREAM
 
-# Build the bitstream (provide --flash-boot = 0x200000 (memmapped spi flash) + 0x1E0000 (firmware offset in flash))
-python3 example-colorlight-i5.py --ecppack-compress --flash-boot=0x3E0000 --ecppack-bootaddr 0x100000 --cpu-type vexriscv --cpu-variant imac --csr-svd build/colorlight_i5/csr.svd --uart-baudrate=1000000 --timer-uptime --build
+# Build the bitstream (provide --flash-boot = 0x800000 (memmapped spi flash) + 0x1E0000 (firmware offset in flash))
+# ecppack-bootaddr set to switch back to bootloader on PROGRAMN
+python3 example-colorlight-i5.py --ecppack-compress --flash-boot=0x9E0000 --ecppack-bootaddr 0x000000 --cpu-type vexriscv --cpu-variant imac --csr-svd build/colorlight_i5/csr.svd --uart-baudrate=1000000 --timer-uptime --build
 # Hold BUTTON while turning on, then flash over DFU device ALT 0
 sudo dfu-util --alt 0 --download build/colorlight_i5/gateware/colorlight_i5.bit
 
diff --git a/example-colorlight-i5.py b/example-colorlight-i5.py
index 784aec7..990a5b9 100755
--- a/example-colorlight-i5.py
+++ b/example-colorlight-i5.py
@@ -244,9 +244,9 @@ def add_uart_midi(soc):
 
 def main():
     from litex.build.parser import LiteXArgumentParser
-    parser = LiteXArgumentParser(platform=colorlight_i5.Platform, description="LiteX SoC on Colorlight I5.")
-    parser.add_target_argument("--board",            default="i5",             help="Board type (i5).")
-    parser.add_target_argument("--revision",         default="7.0",            help="Board revision (7.0).")
+    parser = LiteXArgumentParser(platform=colorlight_i5.Platform, description="LiteX SoC on Colorlight I9.")
+    parser.add_target_argument("--board",            default="i9",             help="Board type (i9).")
+    parser.add_target_argument("--revision",         default="7.2",            help="Board revision (7.2).")
     parser.add_target_argument("--sys-clk-freq",     default=60e6, type=float, help="System clock frequency.")
     # This argument is 0x200000 + (address in flash of firmware image to boot from LiteX BIOS)
     parser.add_target_argument("--flash-boot",       default=0x3E0000, type=lambda x: int(x,0), help="Flash boot address.")
diff --git a/firmware/polyboot/src/main.rs b/firmware/polyboot/src/main.rs
index edda5d1..25cbb3a 100644
--- a/firmware/polyboot/src/main.rs
+++ b/firmware/polyboot/src/main.rs
@@ -137,7 +137,7 @@ pub trait SpiFlash {
 
 const SPI_FLASH_BLOCK_SIZE: usize = 256;
 const SPI_FLASH_PAGE_SIZE: usize = 64*1024;
-const SPIFLASH_BASE: *mut u8 = 0x00200000 as *mut u8;
+const SPIFLASH_BASE: *mut u8 = 0x00800000 as *mut u8;
 
 macro_rules! spi_flash {
     ($($t:ty),+ $(,)?) => {
@@ -248,7 +248,7 @@ macro_rules! spi_flash {
                 let mut w_len: usize = usize::min(data.len(), SPI_FLASH_BLOCK_SIZE);
                 let mut offset: usize = 0;
                 while w_len > 0 {
-                    //info!("write @ 0x{:#x}", addr+offset);
+                    //info!("write {} bytes @ {:#x}", w_len, addr+offset);
                     self.write_enable();
                     self.page_program(addr+offset, &data[offset..offset+w_len]);
                     while self.status_busy() { }
@@ -338,9 +338,16 @@ pub extern "C" fn _putchar(c: u8)  {
 fn main() -> ! {
     let peripherals = unsafe { pac::Peripherals::steal() };
 
-    log::init(peripherals.UART_MIDI);
+    log::init(peripherals.UART);
     info!("hello from litex-fw!");
 
+    /*
+    unsafe {
+    let data: [u8; 512] = [42u8; 512];
+    tud_dfu_download_cb(0, 0, data.as_ptr(), data.len() as u16);
+    }
+    */
+
     let mut timer = Timer::new(peripherals.TIMER0, SYSTEM_CLOCK_FREQUENCY);
 
     let pmod0 = peripherals.EURORACK_PMOD0;
diff --git a/firmware/polyvec-hal/src/gw.rs b/firmware/polyvec-hal/src/gw.rs
index 3e8fdb6..68e5895 100644
--- a/firmware/polyvec-hal/src/gw.rs
+++ b/firmware/polyvec-hal/src/gw.rs
@@ -181,7 +181,7 @@ karlsen_lpf!(pac::KARLSEN_LPF2);
 karlsen_lpf!(pac::KARLSEN_LPF3);
 
 litex_hal::uart! {
-    UartMidi: litex_pac::UART,
+    UartMidi: litex_pac::UART_MIDI,
 }
 
 litex_hal::timer! {
diff --git a/firmware/polyvec-hal/src/log.rs b/firmware/polyvec-hal/src/log.rs
index fffdf04..32785a7 100644
--- a/firmware/polyvec-hal/src/log.rs
+++ b/firmware/polyvec-hal/src/log.rs
@@ -9,7 +9,7 @@ use litex_hal::uart::UartError;
 use crate::info;
 
 litex_hal::uart! {
-    Uart: pac::UART_MIDI,
+    Uart: pac::UART,
 }
 
 static mut UART_WRITER: Option<Uart> = None;
@@ -75,7 +75,7 @@ pub fn _logger_write(bytes: &[u8]) {
     }
 }
 
-pub fn init(uart: pac::UART_MIDI) {
+pub fn init(uart: pac::UART) {
     unsafe {
         UART_WRITER = Some(Uart::new(uart));
         if let Some(_) = &mut UART_WRITER {
diff --git a/firmware/polyvec/src/main.rs b/firmware/polyvec/src/main.rs
index b36cef6..db71d31 100644
--- a/firmware/polyvec/src/main.rs
+++ b/firmware/polyvec/src/main.rs
@@ -377,7 +377,7 @@ unsafe fn usb_device_controller_reset_write(value: u32) {
 fn main() -> ! {
     let peripherals = unsafe { pac::Peripherals::steal() };
 
-    log::init(peripherals.UART_MIDI);
+    log::init(peripherals.UART);
     info!("hello from litex-fw!");
 
 
@@ -403,7 +403,7 @@ fn main() -> ! {
         DmaRouter::new(peripherals.DMA_ROUTER0,
                        unsafe { BUF_IN.as_mut_ptr() as u32 },
                        BUF_SZ_WORDS as u32));
-    let uart_midi = UartMidi::new(peripherals.UART);
+    let uart_midi = UartMidi::new(peripherals.UART_MIDI);
     let midi_in =  MidiIn::new(uart_midi);
     let encoder = Encoder::new(peripherals.ROTARY_ENCODER, peripherals.ENCODER_BUTTON);