x-boot (external boot code) is a serves as the first-stage boot-loader placed in , residing in storage devices such as eMMC, NAND flash, or SD cards, . It is loaded into the system SRAM by i-boot, as DRAM is not yet ready during this phase. As it runs on operates in SRAM, its overall size (, including code, data, and stack) , must not exceed the capacity of the system SRAM's capacity. The primary task objective of x-boot is to initialize the DRAM DDR SDRAM controller and PHY, perform conduct calibration on DRAM the PHY and signals, and once calibrated, make the DRAM is ready for use.
Subsequently, x-boot then switches the CPU loads the images of TF-A (BL31), OP-TEE (BL32), and U-Boot (BL33) from a storage device into DRAM. The CPU (core 0) then switches itself from 32-bit mode to 64-bit by triggering a software reset. It proceeds to awaken other cores (core 1, 2, 3) and transitions them to 64-bit mode and loads TF-A . Finally, all cores execute TF-A.
Table of Contents
| Table of Contents |
|---|
Features
Output log at UART0 (set at 115,200 bps by i-boot).
Support loading firmware of DDR3, DDR4, or LPDDR4 from boot devices.
Support initialization of DDR controller and PHY.
Support 1D and 2D training of PHY and signals for DDR3, DDR4, and LPDDR4 SDRAM.
Support loading images of TF-A (BL31), OP-TEE (BL32), and U-Boot
...
(BL33) from boot devices.
Support secure boot:
Verify digital signature of fip (including TF-A and OP-TEE) and U-Boot images.
Decrypt fip image.
Support warm-boot:
Switch CA55 to 64-bit mode and jump to run TF-A.
Support reading and writing OTP bits using Sunplus OTPTool through UART0.
Flow
The x-boot (external boot code) is the first-stage boot loader. It is loaded into internal SRAM and run by internal ROM code of SP7350. Note that before X-Boot initializes and trains DRAM controller, DRAM is not available.x-boot initializes and trains the SDRAM controller, preparing the DRAM for useinitiation begins with the "_start" subroutine, written in assembly code, responsible for initializing the C execution environment. The process then proceeds to execute the "xboot_main" subroutine, which serves as the main C function within x-boot.
...
The "xboot_main()" subroutine begins with the "init_cdata" subroutine for initializing C global data. It is followed by the "init_uart()" subroutine to initialize all UARTs and the "init_hw()" subroutine for hardware initialization. Finally, the sequence progresses to run the "boot_flow()" subroutine.
...
The "boot_flow()" subroutine starts by initializing the DDR SDRAM controller and PHY, followed by PHY training. It then initializes the controller of the boot device, which is recorded in the C structure g_bootinfo. Subsequently, it loads the TF-A (Trusted Firmware-A) and OP-TEE (Open Portable Trusted Execution Environment) images from the fip (firmware image package) partition within ISPBOOOT.BINfip (firmware image package) image and U-Boot image from the respective partitions within the boot device, storing them in DRAM. Additionally, the U-Boot image is extracted from offset 0x30000 of ISPBOOOT.BIN and stored in DRAM. Upon successful checksum verification for all images, the system proceeds to execute TF-A, followed by OP-TEE, and finally U-Boot.
| Table of Contents |
|---|
x-boot is loaded and run at SRAM before DRAM is available.
x-boot is responsible for doing DDR SDRAM training.
x-boot is responsible for loading U-Boot image.
x-boot is responsible for loading and running TF-A and OP-TEE OS.
General features
Output log at UART0 (at 115,200 bps).
Support accessing OTP using Sunplus OTPTool via UART0.
Support loading firmware of LPDDR4/DDR4/DDR3 from boot devices.
Support 1D and 2D training of LPDDR4, DDR4 and DDR3 SDRAM.
Support loading image of TF-A (BL31), OP-TEE (BL32) and U-Boot (BL33) from boot devices.
Support secure-boot:
Verify digital signature of fip (TF-A and OP-TEE) and U-Boot images.
Decrypt fip image.
Support warm-boot.
Switch CA55 to 64-bit mode and jump to run TF-A.
Drivers locations and features
...
Drivers
...
Folders
...
Features
...
8-bit NAND
...
nand/
...
Finally, the process advances to execute the "boot_uboot()" subroutine.
...
The "boot_uboot()" subroutine begins by verifying the images of fip and U-Boot. Upon successful verification, it moves the TF-A and OP-TEE images from the load position to the dedicated location in DRAM. Subsequently, it executes the “go_a32_to_a64()” subroutine.
In the “go_a32_to_a64()” subroutine, it configures the CPU reset vector to the entry-point of the a64up module for all cores and triggers a warm-reset to switch itself (core 0) to 64-bit (aarch64) mode.
After the warm-reset, CPU core 0 operates in the a64up module at 64-bit mode. It then wakes up cores 1, 2, and 3, switching them to 64-bit (aarch64) mode by triggering a warm-reset (in i-boot). Following the warm-reset, cores 1, 2, and 3 operate in the a64up mode at 64-bit mode. Subsequently, all cores make a jump to TF-A (BL31).
...
The flow chart below illustrates the process from i-boot's reset vector to the jump to TF-A for all cores
...
Source Files
The source files for x-boot are located in the "boot/xobot/" directory under the project's top folder. The entry point for x-boot is the label "_start" in the assembly file "arch/arm/sp7350/start.S". Notably, "_start" is situated at an offset of 32 bytes within the x-boot module, with the initial 32-byte space reserved for a header. The "_start" subroutine initializes the C execution environment and subsequently jumps to the C main function, the "xboot_main()" subroutine in the "xboot.c" file. The "xboot.c" file serves as the top-level control file for x-boot, governing the entire flow of operations.
The table below lists and explains the main files and folders in x-boot:
Files or folders | Descriptions |
adc/ | Contains subroutines for ADC. |
arch/arm/sp7350/ | Houses CPU-relevant codes, including:
|
bin/ | Output folder |
common/ | Contains common code, such as verifying images. |
configs/ | Contains defconfig files for boards. |
cpio/ | Contains CPIO codes. |
draminit/ | Contains DRAM-related codes. |
fat/ | Contains codes for FAT file-system operations. |
i2c/ | Contains subroutines for I2C interface. |
include/ | Contains many constant definitions used in x-boot. |
lib/ | Contains images CRC verification codes. |
nand/ | Contains SPI-NAND and 8-bit NAND drivers. |
otp/ | Contains subroutines for accessing OTP. |
romshare/ | Contains the entry table for accessing secure functions in i-boot. |
sdmmc/ | Contains SD card and eMMC drivers. |
tools/ | Contains some utilities used by x-boot. |
usb/ | Contains USB2.0 and USB3.0 drivers. |
warmboot/ | Contains a concise version of x-boot for running during warm-boot. |
Kconfig | Menu config file of x-boot. |
Makefile | Make file of x-boot |
xboot.c | Main C file of x-boot. |
Driver Specifications and Features
x-boot incorporates a range of device drivers, each offering specific features to facilitate various operations. The following table outlines the detailed specifications and features of these drivers.
Drivers | Specification and features | ||
8-bit NAND |
| ||
adc/ | eMMC | sdmmc/ |
|
I2C driver | i2c/ |
| |
NVMEN (OTP) | otp/ |
| |
SD card | sdmmc/ |
| |
SPI-NAND | nand/ |
| |
USB2.0 Host | usb/ |
| |
USB3.0 Host | usb/ |
|
Other files
...
Type
...
Folders
...
Files
...
machine
...
arch/arm/sp7350/
...
a64up/
...
aboot.S
...
boot.ld
...
cache.c
...
cpu/
...
include/
...
page_table/
...
start.S
...
default config files
...
configs/
...
sp7350_emmc_ev_defconfig
...
sp7350_sdcard_ev_defconfig
...
SRAM Space Allocation
To facilitate program maintenance and data sharing, x-boot and i-boot utilize the same SRAM segment division and structure. The figure below illustrates the segmentation of SRAM into 9 segments, ordered from low to high addresses: xboot_buf, bootinfo, boothead, a64up, cdata, storage_buf, stack, bootcompat, and spacc_ram.
...
Let's delve into the purpose of each segment:
xboot_buf: This segment houses the x-boot program, where it is loaded and executed.
bootinfo: Contains the bootinfo segment with the g_bootinfo structure, recording essential boot-related information.
boothead: The boothead segment stores the g_boothead array, used for GPT data in eMMC or header data in NAND flashes.
a64up: Dedicated to the a64up module, responsible for transitioning the CPU from 32-bit mode to 64-bit mode.
cdata: This is the C data segment, hosting global and static variables in C.
storage_buf: Reserved for device driver data related to boot devices like eMMC and NAND flash. Multiple boot device drivers share this space during a single boot, with only one boot device driver utilized per boot.
mmu_pgtbl: The page table of MMU.
stack: The stack segment where the stack for C is located.
bootcomp: CPU run control fields.
reserved: This segment is designated for warm-boot retention data.
During system boot, i-boot reads boot-related information from the boot switch and the OTP (One-Time Programmable) memory within the chip. This information is then stored in the C structure g_bootinfo. x-boot directly utilizes the data in the g_bootinfo structure to determine the boot mode and process.
x-boot Log and Explanation
Line 1: Banner (version) of x-boot
Line 5: PLLC (CPU frequency) is set to 1.5GHz.
Line 6: PLLL3 (L3 cache frequency) is configured to 1.2GHz.
Line 7: PLLD (DRAM clock) is set to 800MHz, with a data-rate of DDR SDRAM is 3200 Mbps.
Line 14: “{{emmc_boot}}” indicates that x-boot is executing the 'emmc boot' flow.
Line 19: Boot-device is 0x1F (MX[6..2]), indicating eMMC boot.
Line 20: Banner (version) of DDR training firmware
Line 23: DDR SDRAM part number is MT53E1G32D2 version B, with FBGA code ‘D8CJG’.
LIne 24: DDR SDRAM clock is at 1600MHz.
Line 28: The length of the x-boot image is 0xAEA0 (44,704 bytes), excluding DDR training firmware.
Line 29-30: 1D training firmware has benn successfully loaded, with the checksum verified.
Line 42: 1D training has successfully completed.
Line 44-45: 2D training firmware has been successfully loaded, with the checksum verified.
Line 52: 2D training has successfully completed.
LIne 57: Testing DRAM (only 1kB range)
Line 61: The bus clock of eMMC is configured to 200kHz (divisor = 1789) for the IdentifyStorage command.
Line 69: The bus clock of eMMC is adjusted to 25MHz (divisor = 14) for subsequent Read and other commands.
Line 70: Read GPT of eMMC.
LIne 71-73: Loading header of uboot1 image (factory default)
Line 74-78: Loading uboot2 image (the latest update). Size of uboot2 image is 858,952 bytes. The checksum of uboot2 image is successfully verified.
Line 79-81: Loading fip image (including TF-A and OP-TEE images). Size of fip image is 408,462 bytes. The checksum of fip image is successfully verified.
Line 82: uboot image is loaded at 0x00500040.
Line 83: fip image is loaded at 0x01000000.
Line 84: Initializing Cortex M4 hardware. Reset of CM4 is asserted here.
Line 85-86: CPU core is preparing to switch to 64-bit mode, and a64up module is located at 0xFA218400.
Line 87: CPU core 0 is at secure EL3 mode and proceeds to execute TF-A (BL31), which is located at 0x00200000.
| Code Block |
|---|
+++xBoot Feb 14 2024 18:41:41
Remap DRAM for 4GB
ID1 of STI8070X = 0x88
ID2 of STI8070X = 0x01
Set PLLC to 1.5GHz
Set PLLL3 to 1.2GHz
PLLD: 800MHz, DATARATE:3200
0x00001008
0x0000C0BE
0x00000107
[d] xboot.c :397
..mode=0x0000001F
{{emmc_boot}}
[d] common/bootmain.c :76
dev=2
pin=1
.Run draiminit@0xFA208351
bootdevice=0x0000001F
Built at Feb 14 2024 18:41:37
dram_init
dwc_umctl2_lpddr4_1600_SP7350_for_realchip
MT53E1G32D2_B, 2rank, FBGA=D8CJG
SDRAM_SPEED_1600
dwc_ddrphy_phyinit_main 20231212
dwc_ddrphy_phyinit_out_lpddr4_train1d2d_3200_SP7350
bootdevice:0x0000001F
XBOOT_len=0x0000AEA0
1D IMEM checksum ok
1D DMEM checksum ok
Start to wait for the training firmware to complete v.00 !!!
End of CA training.
End of initialization.
End of read enable training.
End of fine write leveling.
End of read dq deskew training.
End of MPR read delay center optimization.
End of Wrtie leveling coarse delay.
End of write delay center optimization.
End of read delay center optimization.
End of max read latency training.
Training has run successfully.(firmware complete)
bootdevice:0x0000001F
2D IMEM checksum ok
2D DMEM checksum ok
Start to wait for the training firmware to complete v.00 !!!
End of initialization.
End of 2D write delay/voltage center optimization.
End of 2D write delay/voltage center optimization.
End of 2D read delay/voltage center optimization.
End of 2D read delay/voltage center optimization.
Training has run successfully.(firmware complete)
Register programming done!!!
Register programming done!!!
dram_init_end
Done draiminit
dram test 0x00800000 - 0x00800400
Set WL_REG_ON (GPIO56) to HI.
[d] sdmmc/drv_sd_mmc.c :21
InitChipCtrl
busclk=200000
div=1789
[d] sdmmc/drv_sd_mmc.c :23
IdentifyStorage
[d] sdmmc/hal_sd_mmc.c :507
busclk=25000000
div=14
[d] sdmmc/hal_sd_mmc.c :1729
[d] sdmmc/drv_sd_mmc.c :33
Read GPT
part1 LBA=0x00000022
emmc load uboot@blk=0x00000022
uboot1 hdr good
part2 LBA=0x00000822
emmc load uboot@blk=0x00000822
data size=858952
verify img...
uboot2 good
emmc load fip@blk=0x00001022
data size=408462
verify img...
uboot @0x00500040
fip @0x01000000
M4 init
32->64
a64up@0xFA218400
core0 S-EL3 @0x00200000 |