ITop4412 startup guide and iTop4412 startup Guide

ITop4412 startup guide and iTop4412 startup Guide

ITop4412 irom startup andExynos4212 iROMBooting GuideIs the same.

Tool for making itop4412 BL1: http://download.csdn.net/detail/cj675816156/9101607

 

IROM stage startup process

This article describes how to build BL1 and BL2 in Exynos4412 so that irom can successfully load BL1 and BL2 and finally execute the OS.

IROM stores programs used in the startup phase to load specific binary data from (NAND, emmc, SDcard, etc.) to RAM/SRAM. This program was burned out by Samsung when the chip was released, no code is provided, so we cannot see the source code. For the irom loading and starting process, see the figure below:

Register NameAddressSFR for Direct-Go flag0x0202_0020SFR for Direct-Go address0x0202_0024

 

If the Flag register (0x0202_0020) of Direct-Go isFc0xba_0d10

The value of the Direct-Go address register (0x0202_0024) is also provided, so the program flow will jump to the address given in the 0x02020024 register for execution.

The Code reads the registers corresponding to the OM pin to determine the device from which the device started the device. The corresponding devices with OM values are as follows:

OM [5:1]	1st Device	2nd Device
2 (B '00010)	SDMMC_CH2	USB
3 (B '00011)	EMMC43_CH0	USB
4 (B '00100)	Emmc44_methane	USB
8 (B '01000)	NAND_512_8ECC	USB
9 (B '01001)	NAND_2KB_OVER	USB
19 (B '10011)	EMMC43_CH0	SDMMC_CH2
20 (B '10100)	Emmc44_methane	SDMMC_CH2
24 (B '11000)	NAND_512_8ECC	SDMMC_CH2
25 (B '11001)	NAND_2KB_OVER	SDMMC_CH2

 

The following describes the BL1 process:

BL1 reads the Startup Mode register to determine the device from which the device was started, then reads BL2 from the device to the SRAM, and then checks the BL2 integrity in the SRAM. The BL1 code should not depend on the configuration of the external platform. In addition, the security context data should be in bl1,

BL1 also has BL2's security verification Public Key. BL2's public key is used to verify whether BL2 is the author's own unmodified program image. If not, it will fail to start.

 

About BL2 startup process:

BL2 copies the OS image (BL3) to the DDR and then checks the integrity of the OS image.

In BL2, the system clock is initialized and the DDR is initialized. If necessary, uart, net, emmc, and sdcard can also be initialized.

The Process Code in BL2 does not depend on BL1, that is, BL2 will no longer go back to call the BL1 process.

The starting process of each phase is basically like this. Next we will introduce how to divide each segment of the internal memory ing, that is, what are placed in each segment in the SRAM?

The size of BL1 is 8 KB, that is, 8192 bytes. The starting address of SRAM is 5 kb reserved for iROM. The BL1 code security context is stored at 0x0202_3000, the BL2 size can be changed to BL1. As long as BL1 has multiple copy points, BL2 can be enlarged.

In (S. LSI ‟ s reference code of BL1) the maximum value of BL2 specified by Samsung for BL1 is 14KB-4B, and 4B stores the BL2 verification code. If your BL2 is less than 14KB-4, then, enter 0 for those that are not satisfied. The BL2 signature is at 0x0202_6C00, And the checksum for BL2 is at 0x0202_6BFC in S. LSI ‟ s reference code.

If iROM needs to copy BL1 to SRAM, it must have some functional interfaces such as sdcard copy interface, emmc copy interface, and usb copy interface. Where are these interfaces?

The answer is that the address 0x0202_0030 to 0x0202_0070 is the entry to copy function functions one by one. You can use the function pointer to point to an address and then call the corresponding copy function.

 

These functions are described as follows:

Address	Name	Descripyion
Zero x 02020030	SDMMC_ReadBlocks	This interface is used to copy data from SD or MMC devices to the destination address; Returns 1 = True, 0 = False; parameter (u32 SrcBlock, u32 NumofSrcBlock, void * DstByte) SrcBlock: start block number. (0 ~ N) the number of the Start block to be copied starts from 0. NumofSrcBlock: Number of copy Blocks DstByte: Destination Address (System Memory)
0x0202003C	LoadBL2FromEmmc43Ch0	This interface copies BL2 startup zone data from emmc 4.3 to internal RAM; Returns 1 = True, 0 = False; parameter (u32 SrcBlock, u32 * DstByte)
Zero x 02020040	Emmc43_EndBootOp_eMMC	This interface ends emmc 4.3 startup mode; Returns and parameters are both void
Zero x 02020044	Msh_readfrom1_o_emmc	This interface copies data in the startup zone from emmc 4.4 to the destination address; Returns 1 = True, 0 = False; parameter (u32 uNumofBlocks, void * uDstAddr) UNumofBlocks: Total number of transmitted blocks, 1 = 512B UDstAddr: Destination Address (System Memory)
Zero x 02020048	MSH_EndBootOp_eMMC	This interface ends emmc 4.4 startup mode; The return value and parameter value are both void. This function will wait for the end of the READ function above.
Zero x 02020070	LoadImageFromUsb	This interface is used to copy data from USB. If the data is successfully enumerated in iROM, this function can be used; Returns 1 = True, 0 = False; void

Note:

1. The clock provided to SDMMC and eMMC at startup is 20 Mhz, and MPLL is the source of these clocks.

2. If SDMMC and eMMC are selected as startup devices, the SDMMC or eMMC copy functions in iROM can be used in BL1 and BL2 phases. If you want to use these two functions, do not modify the clock of SDMMC or eMMC before using them.

Do not modify the PLL clock configurations related to SDMMC or eMMC. If you have modified the clock configurations related to SDMMC or eMMC, we cannot guarantee correct copying.

The following is an example partition about sdcard startup by referring to SD: