Understanding the Layout of the ISP and Boot Image File: ISPBOOOT.BIN

This article provides an in-depth look at the partition layout of the ISP and boot image file, ISPBOOOT.BIN, specifically for the SP7350. As the name suggests, ISPBOOOT.BIN serves dual purposes: ISP (In-System Programming) and booting. The extra "O" in the name ensures compatibility with the legacy DOS 8.3 file name format while also creating a unique identifier.

In the ISP context, ISPBOOOT.BIN contains several crucial components: the first-stage boot loader (X-Boot), the second-stage boot loader (U-Boot), and multiple images intended for flashing onto various flash devices. X-Boot's primary role is to initialize the DRAM controller and train the DRAM PHY and signals. Once the DRAM is ready for use, X-Boot loads U-Boot, which then writes the necessary images to different flash devices, including eMMC, SPI-NAND, 8-bit NAND, and SPI-NOR.

For booting, ISPBOOOT.BIN contains only the first-stage boot loader, X-Boot.

Table of Contents

1 1. ISP
- 1.1 1.1. ISP Process
- 1.2 1.2 Layout of ISPBOOOT.BIN
2 2. Boot
- 2.1 2.1. Boot Process
- 2.2 2.2. Layout of ISPBOOOT.BIN

1. ISP

1.1. ISP Process

When the SP7350 powers on, its internal ROM code searches for the ISPBOOOT.BIN file in the root directory of the first or only partition on the selected boot device (SD card or USB flash drive). Once located, the file is loaded, extracting the first-stage boot loader, X-Boot, which is then stored in the internal SRAM.

X-Boot: The X-Boot image resides at offset 0 within ISPBOOOT.BIN and has a maximum size of 192 KiB, with the actual size specified in the X-Boot image header. After a successful checksum verification, the system executes X-Boot.
DRAM Initialization: X-Boot initializes and trains the DRAM controller, preparing the DRAM for subsequent operations.
Loading TF-A, OP-TEE and U-Boot: Once the DRAM is ready, X-Boot loads the TF-A (Trusted Firmware-A) and OP-TEE (Open Portable Trusted Execution Environment) images from the fip (firmware image package) partition within ISPBOOOT.BIN, storing them in DRAM. The U-Boot image is also extracted from offset 0x30000 of ISPBOOOT.BIN and stored in DRAM.
Executing TF-A, OP-TEE and U-Boot: After verifying the checksums for all images, the system proceeds to execute TF-A, followed by OP-TEE, and finally U-Boot.
Executing U-Boot ISP script: U-Boot automatically runs scripts located at the end of the ISPBOOOT.BIN file to program the flash devices.

1.2 Layout of ISPBOOOT.BIN

The partition layout of ISPBOOOT.BIN is as follows, beginning with the X-Boot image (partition name: xboot0), followed by the U-Boot image (partition name: uboot0), and a header that details the subsequent partitions.

Note actual size is the file size aligned to 1k boundary.

The following table explains details of each partition.

Partitions	Offset	Size	Descriptions

Partitions	Offset	Size	Descriptions
xboot0	0	192 kB	Image of X-Boot, including training firmware of DDR
uboot0	0x30000	1344 kB	Image of U-Boot
file_header	0x180000	16 kB	Header for the following partitions
xboot	0x184000	actual size	Image of X-boot, including training firmware of DDR
uboot1	-	actual size	Image of U-Boot (the factory default)
uboot2	-	actual size	Image of U-Boot (the latest update)
fip	-	actual size	Image of fip, including TF-A and OP-TEE
env	-	actual size	Image of environment variables of U-Boot
env_redund	-	actual size	Image of environment variables of U-Boot (redundant)
dtb	-	actual size	Image of device-tree blob (not used)
kernel	-	actual size	Image of Linux kernel with U-Boot header
rootfs	-	actual size	Image of root file-system
isp_script_nand	-	actual size	Script of U-Boot for NAND flash in-system program
isp_script_emmc	-	actual size	Script of U-Boot for eMMC in-system program

If ISPBOOOT.BIN is for programming SPI-NOR flash, isp_script_nand partition will be replaced with isp_script_nor partition, no isp_script_emmc partition.

Below are the code definitions for partition_info in the file_header:

#define SIZE_FILE_NAME      (32)
struct partition_info_s {
	u08 file_name[SIZE_FILE_NAME];  // file name of source (basename only)
	u08 md5sum[36];
	u32 file_offset;                // offset in output file
	u64 file_size;                  // file size of the partition
	u32 partition_start_addr;       // partition's start address in NAND, there will be an offset added in U-Boot script ($isp_nand_addr_1st_part), less than 4GB is expected.
	u64 partition_size;             // reserved size for this partition, less than 4GB is expected.
	u32 flags;
	u32 emmc_partition_start;       // Unit: block
	u32 reserved[7];                // let size of this structure == SIZE_PARTITION_INFO_S
} __attribute__((packed));

Refer to the code below for the definition of file_header.

#define SIZE_PARTITION_INFO_S           (128)
#define SIZE_INIT_SCRIPT                (2048)
#define NUM_OF_PARTITION                (111)
struct file_header_s {
	u08 signature[32];
	u08 init_script[SIZE_INIT_SCRIPT];
	u32 flags;
	u08 reserved[SIZE_PARTITION_INFO_S - 36];
	struct partition_info_s partition_info[NUM_OF_PARTITION];
} __attribute__((packed));          // sizeof(this structure) == 16384

The signature string is “Pentagram_ISP_image".

2. Boot

2.1. Boot Process

For booting, the ISPBOOOT.BIN file contains only the first-stage boot loader, X-Boot.

Similar to the ISP process, when the SP7350 powers on, its internal ROM code searches for the ISPBOOOT.BIN file in the root directory of the first or only partition on the selected boot device, such as an SD card or USB flash drive. Once located, the file is loaded, and the first-stage boot loader, X-Boot, is extracted and stored in the internal SRAM.

X-Boot: The X-Boot image resides at offset 0 within ISPBOOOT.BIN and has a maximum size of 192 KiB, with its actual size specified in the X-Boot image header. After a successful checksum verification, the system executes X-Boot.
DRAM Initialization: X-Boot initializes and trains the SDRAM controller, preparing the DRAM for subsequent operations.
Loading TF-A, OP-TEE and U-Boot: Once the DRAM is ready, X-Boot loads the TF-A (Trusted Firmware-A) and OP-TEE (Open Portable Trusted Execution Environment) images from the fip (firmware image package) image file, fip.img, on the boot device, storing them in DRAM. The U-Boot image is then loaded from the u-boot.img file on the boot device and stored in DRAM.
Executing TF-A, OP-TEE and U-Boot: After verifying the checksums for all images, the system proceeds to execute TF-A, followed by OP-TEE, and finally U-Boot.
U-Boot Execution of the Linux kernel: U-Boot automatically runs scripts to load the Linux kernel image (uImage) from the boot device, decompress and verify it, and then execute the Linux kernel.

2.2. Layout of ISPBOOOT.BIN

The partition layout of ISPBOOOT.BIN for boot purposes is straightforward, containing only the X-Boot image. This partition is named xboot0 and is located at the beginning of the file.

The following table explains details of xboot0 image.

Partition	Offset	Size	Description

Partition	Offset	Size	Description
xboot0	0	192 kB	Image of X-Boot, including DDR training firmware

This simple layout ensures that the essential components for booting are quickly accessible, allowing the SP7350 to initialize the system efficiently.