i-boot (ROM code)

i-boot, stored in the chip's internal mask ROM, plays a crucial role in the system's initialization process. During power-on reset, the program counters of all four ARM Cortex A55 CPUs are configured to point to the entry point address of i-boot. Upon the completion of power-on reset, the CPUs commence execution from this entry point. i-boot undertakes a series of essential tasks, including CPU initialization, setting up interrupt vectors, stack initialization, cache setup, serial port configuration, timer configuration, and more.

Following this initialization phase, i-boot loads x-boot from external storage devices into SRAM and performs a checksum verification. If the verification passes, i-boot proceeds to execute x-boot.

Table of Contents

Key Features

1. Output log at UART0 with a baud rate of 115,200 bps.

2. UART0 pins can be turned off through an OTP bit.

3. Read bootstrap pins IV_MX[6..3] to decide boot-device.

4. Support for five boot devices: SPI-NOR flash, SPI-NAND flash, 8-bit NAND flash, eMMC, SD card, and USB flash drive (on either USB2.0 or USB3.0 port).

5. Implementation of secure-boot with the ability to verify the digital signature of the x-boot image and decrypt it.

6. Secure-boot activation controlled by an OTP bit.

7. Support for warm-boot, enabling wake-up from deep-sleep mode.

8. Support for the peripheral-reset signal (output from G_MX2).

Main Flow

The i-boot flow initiates with the reset vector, followed by the execution of the "cpu_init" subroutine responsible for initializing the CPU. Next in the sequence is the "start_boot" subroutine, which sets up the C execution environment. The flow then advances to execute the "iboot_main" subroutine, serving as the C main function within i-boot.

Open

The "iboot_main" subroutine commences by invoking the "init_cdata" subroutine to initialize global C data. It then proceeds to read boot-strap pins from a dedicated hardware register, storing the information in the C structure g_bootinfo. In the event of a warm-boot scenario, it checks the readiness of DRAM (where CM4 handles the restoration of DDR IO retention data and specific hardware registers or settings). If DRAM is confirmed ready, the subroutine redirects to the start address of the warm-boot module to continue the warm-boot processes.

In cases where a warm-boot is not applicable (in cold-start scenario), the process continues to execute the "AV1_STC_init()", "init_uart()", and "init_hw()" subroutines to initialize hardware components. Finally, it advances to run the "boot_flow()" subroutine.

Open

The "boot_flow()" subroutine begins by examining the C structure g_bootinfo to determine the preferred boot device: eMMC, SPI-NAND flash, 8-bit NAND flash, SD card, or USB flash drive. It then initializes the controller of the selected boot device and loads the x-boot image into SRAM from the chosen source. After loading, the subroutine checks the image checksum. If the checksum passes verification, it proceeds to execute x-boot.

In the case of secure-boot activation through OTP bits, the subroutine additionally checks the digital signature and decrypts the image after the checksum validation.

It's essential to note that i-boot does not initialize DDR DRAM, rendering it temporarily unavailable. Hence, x-boot must be loaded into SRAM for execution.

Open

Boot Devices

i-Boot supports five boot devices, each with specific specifications and requirements. Below is a detailed table outlining the specifications for each boot device:

CPU Boot Core and Other Cores

CPU core 0 serves as the boot core, responsible for all boot processes from i-boot to Linux. Meanwhile, CPU core 1, 2, and 3 enter a spin state (wfe mode) within i-boot after self-initialization, awaiting activation by core 0. The subsequent assembly code illustrates these processes.

Line 75~78: Read MPIDR to retrieve the CPU core id.

Line 79 ~ 80: Verify whether the core id is equal to 0 (indicating core 0). If ture, execute the jump to start_boot; otherwise (for core 1, 2, 3), proceed to A_cpu_wait.

Line 84 ~ 99: Retrieve the CPU Run Control field. If the field is equivalent to CPU_WAIT_INIT_VAL, continue a loop (spin) between line 91 ~ 96 (depicted by the red rectangle). If the field is equal to CPU_WAIT_A64_VAL, initiate a jump to A_go_AA_64 (line105). For any other field values, perform a jump to the specified address.

Open

Each CPU core possesses its own CPU Run Control field, with each field being 32 bits wide and situated in SRAM.

Open

The values of the CPU Run Control field are defined in the table below:

CPU core 0 fills the specified value into the CPU Run Control field of the target core to wake it up.

Bootstrap Pins of SP7350

The state of bootstrap pins of SP7350 is read into bootstrap register (G0.31) upon releasing power-on reset. Refer to definition of boot-strap pins in i-boot below:

Note:

1. If MX1 = 0, the JTAG interface of CA55 of SP7350 will be enabled.

2. If MX2 = 0, SP7350 will enter test mode. Always set to 1 for normal operation.

i-boot Log and Explanation

Line 1: The banner (version) of i-boot

Line 4: Boot-mode is 0x1F (MX[6..2]), indicating eMMC boot.

Line 6: “[emmc_boot]” signifies that i-boot is executing the 'emmc boot' flow.

Line 11: The bus clock of eMMC is configured to 200kHz (divisor = 1789) for the IdentifyStorage command.

Line 15: The bus clock of eMMC is adjusted to 25MHz (divisor = 14) for subsequent Read and other commands.

Line 24: The magic number (signature of the x-boot image) is 0x54554258 ('XBUT').

Line 25: The length of the x-boot image is 0xAEA0 (44,704 bytes), excluding DDR training firmware.

Line 26: The checksum of the x-boot image is 0x2866.

Line 27: The secure flag is 0, indicating non-secure boot.

Line 29: The image checksum is successfully verified.

Line 31: Proceeding to execute x-boot.