Under construction…
A built-in ROM code.
Load x-boot image from a boot storage device into SRAM and run it.
Support 6 boot storage devices:
i-boot, stored in the chip's internal mask ROM, plays a crucial role in the system's initialization process. During power-on reset, the program counters of all four ARM Cortex A55 CPUs are configured to point to the entry point address of i-boot. Upon the completion of power-on reset, the CPUs commence execution from this entry point. i-boot undertakes a series of essential tasks, including CPU initialization, setting up interrupt vectors, stack initialization, cache setup, serial port configuration, timer configuration, and more.
Following this initialization phase, i-boot loads x-boot from external storage devices into SRAM and performs a checksum verification. If the verification passes, i-boot proceeds to execute x-boot.
Table of Contents
| Table of Contents |
|---|
Key Features
Output log at UART0 with a baud rate of 115,200 bps.
UART0 pins can be turned off through an OTP bit.
Read bootstrap pins IV_MX[6..3] to decide boot-device.
Support for five boot devices: SPI-NOR flash, SPI-NAND flash, 8-bit NAND flash, eMMC, SD card
...
, and USB flash drive (on either USB2.0
...
or USB3.0
...
Support secure-boot.
Support encrypted x-boot.
CPU core 0 is the boot-core and is responsible for booting.
CPU core 1, 2 and 3 spin at i-boot until being waked up.
Support warm-boot (wake up from deep-sleep mode).
CPU core 0 is the boot core.
...
port).
Implementation of secure-boot with the ability to verify the digital signature of the x-boot image and decrypt it.
Secure-boot activation controlled by an OTP bit.
Support for warm-boot, enabling wake-up from deep-sleep mode.
Support for the peripheral-reset signal (output from G_MX2).
Main Flow
The i-boot flow initiates with the reset vector, followed by the execution of the "cpu_init" subroutine responsible for initializing the CPU. Next in the sequence is the "start_boot" subroutine, which sets up the C execution environment. The flow then advances to execute the "iboot_main" subroutine, serving as the C main function within i-boot.
...
The "iboot_main" subroutine commences by invoking the "init_cdata" subroutine to initialize global C data. It then proceeds to read boot-strap pins from a dedicated hardware register, storing the information in the C structure g_bootinfo. In the event of a warm-boot scenario, it checks the readiness of DRAM (where CM4 handles the restoration of DDR IO retention data and specific hardware registers or settings). If DRAM is confirmed ready, the subroutine redirects to the start address of the warm-boot module to continue the warm-boot processes.
In cases where a warm-boot is not applicable (in cold-start scenario), the process continues to execute the "AV1_STC_init()", "init_uart()", and "init_hw()" subroutines to initialize hardware components. Finally, it advances to run the "boot_flow()" subroutine.
...
The "boot_flow()" subroutine begins by examining the C structure g_bootinfo to determine the preferred boot device: eMMC, SPI-NAND flash, 8-bit NAND flash, SD card, or USB flash drive. It then initializes the controller of the selected boot device and loads the x-boot image into SRAM from the chosen source. After loading, the subroutine checks the image checksum. If the checksum passes verification, it proceeds to execute x-boot.
In the case of secure-boot activation through OTP bits, the subroutine additionally checks the digital signature and decrypts the image after the checksum validation.
It's essential to note that i-boot does not initialize DDR DRAM, rendering it temporarily unavailable. Hence, x-boot must be loaded into SRAM for execution.
...
Boot Devices
i-Boot supports five boot devices, each with specific specifications and requirements. Below is a detailed table outlining the specifications for each boot device:
Boot devices | Specifications |
8-bit NAND flash |
|
eMMC device |
|
SPI-NAND flash |
|
SPI-NOR flash |
|
SD card |
|
USB flash drive |
|
CPU Boot Core and Other Cores
CPU core 0 serves as the boot core, responsible for all boot processes from i-boot to Linux. Meanwhile, CPU core 1, 2, and 3 enter a spin state (enter wfe mode) after initialize itself at within i-boot .
...
Run Control of CPU Pen (at bootcompat session) :
after self-initialization, awaiting activation by core 0. The subsequent assembly code illustrates these processes.
Line 75~78: Read MPIDR to retrieve the CPU core id.
Line 79 ~ 80: Verify whether the core id is equal to 0 (indicating core 0). If ture, execute the jump to start_boot; otherwise (for core 1, 2, 3), proceed to A_cpu_wait.
Line 84 ~ 99: Retrieve the CPU Run Control field. If the field is equivalent to CPU_WAIT_INIT_VAL, continue a loop (spin) between line 91 ~ 96 (depicted by the red rectangle). If the field is equal to CPU_WAIT_A64_VAL, initiate a jump to A_go_AA_64 (line105). For any other field values, perform a jump to the specified address.
...
Each CPU core possesses its own CPU Run Control field, with each field being 32 bits wide and situated in SRAM.
...
The values of the CPU Run Control field are defined in the table below:
Values | Define | Descriptions | |
0xFFFFFFFF | CPU_WAIT_INIT_VAL | ||
...
CPU continues spining (waiting) | ||
0xFFFFFFFE | CPU_WAIT_A64_VAL | |
...
CPU goes | ||
...
x (address other than above) // CPU goes to x
Bootstrap pins of SP7350
...
to switch to 64-bit mode. | |||
X | CPU jumps to address X directly. | ||
CPU core 0 fills the specified value into the CPU Run Control field of the target core to wake it up.
Bootstrap Pins of SP7350
The state of bootstrap pins of SP7350 will be is read into bootstrap register (G0.31) at the moment that upon releasing power-on reset is released. Refer to definition of boot-strap pins of SP7350 in i-boot below:
Boot-strap pins of SP7350 | Boot devices | |||||||
MX6 | MX5 | MX4 | MX3 | MX2 | MX1 | MX0 | ||
1 | 1 | 1 | 1 | 1 | x | x | eMMC boot | |
1 | 1 | 1 | 0 | 1 | x | x | SPI-NAND boot | |
1 | 1 | 0 | 1 | 1 | x | x | USB boot | |
1 | 1 | 0 | 0 | 1 | x | x | SDC boot | |
1 | 0 | 1 | 1 | 1 | x | x | SPI-NOR boot | |
1 | 0 | 0 | 0 | 1 | x | x | 8-bit NAND boot | |
Note:
If MX1 = 0, the JTAG interface of CA55 of SP7350 will be enabled.
If MX2 = 0, SP7350 will enter test mode. Always set to 1 for normal operation.
i-boot Log and Explanation
Line 1: The banner (version) of i-boot
Line 4: Boot-mode is 0x1F (MX[6..2]), indicating eMMC boot.
Line 6: “[emmc_boot]” signifies that i-boot is executing the 'emmc boot' flow.
Line 11: The bus clock of eMMC is configured to 200kHz (divisor = 1789) for the IdentifyStorage command.
Line 15: The bus clock of eMMC is adjusted to 25MHz (divisor = 14) for subsequent Read and other commands.
Line 24: The magic number (signature of the x-boot image) is 0x54554258 ('XBUT').
Line 25: The length of the x-boot image is 0xAEA0 (44,704 bytes), excluding DDR training firmware.
Line 26: The checksum of the x-boot image is 0x2866.
Line 27: The secure flag is 0, indicating non-secure boot.
Line 29: The image checksum is successfully verified.
Line 31: Proceeding to execute x-boot.
...
Add label
| Code Block |
|---|
+++iBoot v1.0 Oct 18 2022 13:51:18
[d] iboot.c:134
[d] iboot.c:157
mode=0x0000001F
[emmc_boot]
dev=2 pin=1
.[d] bootmain.c:136
...[d] drv_sd_mmc.c:21
InitChipCtrl
busclk=200000 div=1789
[d] drv_sd_mmc.c:23
IdentifyStorage
[d] hal_sd_mmc.c:478
busclk=25000000 div=14
[d] hal_sd_mmc.c:1709
[d] drv_sd_mmc.c:33
[d] iboot.c:526
mg=0x54554258
len=0x0000AEA0
chk=0x0000F3D7
[d] iboot.c:557
[d] iboot.c:567
mg=0x54554258
len=0x0000AEA0
chk=0x0000F3D7
flg=0x00000000
[d] bootmain.c:559
img chksum correct
boot!
.15522 |