The boot ROM and the SRAM stage

Learning goals

By the end of the week a student can:

• Say what the boot ROM is, where it runs, and why it cannot be changed.
• Explain the boot-media order, the boot select switch and USB boot mode.
• Explain why the first stage runs from on-chip SRAM, and what it has to do before anything larger can load.
• Pick out the boot ROM's and the first stage's lines in their own boot log.

Lecture 1, block 1: the first instruction

• When reset is released, the CPU starts at a fixed address inside the system-on-chip.
• The code there, the boot ROM or mask ROM, is part of the silicon, written at the factory.
• It cannot be changed or erased, which is why a board with broken firmware or boot media can always be brought back.
• Its whole job: find the first stage of the bootloader and start it.

Lecture 1, block 2: where it looks

• Boot sources in a fixed order, such as SPI flash, eMMC and the SD card.
• Both course boards have a boot select switch that changes which source is tried first; the schematic's boot page shows how.
• From the first source with a valid image, it reads a small first stage and checks its header; on a secured device, its signature too, against keys held in fuses.
• It copies the first stage into on-chip SRAM and jumps to it.

Lecture 1, block 3: USB boot mode

• No valid image anywhere, or the USB boot button held at power-on: the boot ROM waits for a computer to send the first stage over USB.
• The Libre Computer app and the recovery tools use this; from a PC, the Amlogic USB boot tool does the same.
• This is the recovery path for the rest of the course.

Lecture 2, block 1: why the first stage is small

• On-chip SRAM works from power-on with no setup, but holds only tens to hundreds of kilobytes.
• DRAM is thousands of times larger but does nothing until it is configured.
• So the boot is split: a small first stage in SRAM sets up clocks and the serial console, brings up DRAM and loads the larger stages into it.

Lecture 2, block 2: an open first stage

• Names differ by project: U-Boot calls it the SPL, Arm's Trusted Firmware calls it BL2.
• Both course boards boot Libre Computer's open boot chain, built from source by libretech-builder-simple.
• Students read the stage that runs in SRAM, change it, rebuild it and boot their own build over USB.
• Their build is loaded into SRAM and writes nothing to the board's storage.

Lecture 2, block 3: reading the log

• Mark the lines printed before any code from SPI flash or the boot media ran: the boot ROM's.
• Find where the boot ROM stops printing and the first stage starts.
• Use the boot chain diagram to place each stage and the memory it runs from.

Board demo

1. Power on with the console open and point out the boot ROM's lines as they scroll.
2. Power the board off (shut it down with sudo poweroff if Linux is running, wait for the halt, then unplug it), flip the boot select switch, power on again, and compare what the boot ROM prints. Put the switch back.
3. Hold the USB boot button at power-on, connect the phone running the app or the bench PC running the Amlogic USB boot tool to the USB Type-C port, and let it send the open first stage; the board starts without its own firmware.
4. Start the board over USB with a first stage built on the bench PC, with one added console line, and find the line on the console.