• State
  • Locked Locked
  • Replies 1 reply
  • Subscribers 97 subscribers
  • Views 230 views
  • Users 0 members are here
Support feedback
Options
Options
Related

This thread has been locked.

If you have a related question, please click the "Ask a related question" button in the top right corner. The newly created question will be automatically linked to this question.

TDA4AH-Q1: XSPI Boot sequence

Baptiste B.
Prodigy 10 points
Part Number: TDA4AH-Q1


Tool/software:

Hi TI,

We have a custom board with TDA4AH-Q1 HS SoC and we are trying to boot in XSPI (Mode OCTAL-DTR (8D-8D-8D) at 25 MHz, Pin Cmd 0x0B Read Command, SFDP Disabled).

 

I need to better understand the low level sequence of accesses over XSPI. From SPRUJ52D TRM and on board trials, I understand that:

Boot mode pins being well read and according to “Figure 4-5 Title TBD”:

J7 issues 1 low frequency ReadSFDP  (to provide get the reference value) Does ROM code make any verification on this return values against supported SFDP structures?

J7 issues 16 25MHz ReadSFDP (to internally set the best controller latencies comparing with the first low freq read)

 

Figure 4-5 Title TBD end to “Do next steps of boot” What are these next steps? I suppose next details are in 4.2.1 MCU ROM Code Architecture?

 

Back to 4.2.1 MCU ROM Code Architecture, provide Boot mode/Main module path (Image/Bloc/Filesystem) but XSPI is missing here. Am I right to consider XSPI similar to OSPI, so “Image Path” being used, or is it Block Path?  
I don’t understand the differences between Image Path and Block Path. For Image Path, what means “the image data can be directly read […] in place”? The boot buffer isn’t used at all? Implying that every checks (on X.509 header for example) are done by dedicated reads in the XSPI? Or is the X.509 header read once and for all (once length determined in a dedicated read maybe?) and every checks done internally?
If checks are done by several reads upon XSPI interface, can we have the accesses list? XSPI commands (if not only 0x0B) and addresses?

On board we can see that J7 after ReadSFDP performs several 0x0B reads at 0x00000000 address of the Flash. Why is it for? Are some specific checks done before reading the complete “X.509 certificate”?

Once integrity of the header checked, is the “Boot Image Blob” read performed in a continuous XSPI 0x0B read? Regardless of the Image Path or Bloc Path?

Do you have a more detailed document (than SPRUJ52D TRM) for HS Boot ROM Code behaviour? 


Thanks in advance for your time and answer.

 

Best regards

  • 0
    TI__Mastermind 48483 points

    Hi Baptiste,

    For XSPI boot details, refer to Chapter 4.3.8 xSPI Boot Device Configuration.

    Can you tell us the xSPI part is being used on your custom board? Have you checked with TI before selecting this part?

    All the details regarding the ROM code implementation needed for the user to know are already provided in this document.

    Baptiste B. said:
    Does ROM code make any verification on this return values against supported SFDP structures?

    Can you give us more details on the intention behind your query here? All values read are verified, and the appropriate step is taken based on the value.

    Baptiste B. said:
    Figure 4-5 Title TBD end to “Do next steps of boot” What are these next steps? I suppose next details are in 4.2.1 MCU ROM Code Architecture?

    Yes.

    Baptiste B. said:
    Back to 4.2.1 MCU ROM Code Architecture, provide Boot mode/Main module path (Image/Bloc/Filesystem) but XSPI is missing here. Am I right to consider XSPI similar to OSPI, so “Image Path” being used, or is it Block Path?  

    Yes. Same as OSPI. And it is Impage Path.

    Baptiste B. said:
    I don’t understand the differences between Image Path and Block Path. For Image Path, what means “the image data can be directly read […] in place”? The boot buffer isn’t used at all? Implying that every checks (on X.509 header for example) are done by dedicated reads in the XSPI? Or is the X.509 header read once and for all (once length determined in a dedicated read maybe?) and every checks done internally?

    In the Image Path, the complete "initial software" image is read "completely" into the internal memory buffer/boot buffer before passing it to the SMS core for certificate checks.

    Baptiste B. said:
    If checks are done by several reads upon XSPI interface, can we have the accesses list? XSPI commands (if not only 0x0B) and addresses?

    We use DAC mode, so we don't understand your question.

    Baptiste B. said:
    On board we can see that J7 after ReadSFDP performs several 0x0B reads at 0x00000000 address of the Flash. Why is it for? Are some specific checks done before reading the complete “X.509 certificate”?

    We are not sure why you are reverse engineering the BootROM code. Can you give us the reason? 

    Baptiste B. said:
    Do you have a more detailed document (than SPRUJ52D TRM) for HS Boot ROM Code behaviour? 

    Again, it is not clear why you need this detail. Please note the Boot ROM is a closed box for customers, and we don't share more information than what is already mentioned in the TRM.

    Thanks.