• State Resolved
  • Replies 2 replies
  • Subscribers 98 subscribers
  • Views 43 views
  • Users 0 members are here
Support feedback
Options
Options
Related

Original question:

[FAQ] Redundant boot from eMMC boot partitions on AM62x

AM625: Redundant boot from eMMC

Alexander Sverdlin
Prodigy 70 points

Part Number: AM625

Dear TI engineers!

Similar question was asked in the past regarding eMMC redundant boot from separate boot partitions, and if I understand the reply (FAQ) correctly, separate SPI-connected Flash has been proposed by TI engineer. However, TRM mentiones fallback offset in eMMC raw UDA mode:
"in RAW mode only, the ROM supports a redundant image at offset 0x400000 in case the initial image fails to be recognized".
 
Does it mean that it's possible to have redundant boot with eMMC only, if we configure the boot mode into eMMC UDA raw mode (B6:B3 1 0 0 0 "MMCSD Boot (SD Card Boot or eMMC Boot using UDA", as it's named in TRM)?
 
What are the conditions the BootROM alternate between offset 0x0 and 0x400000 in UDA?
 
Thanks for your support!

  • +1
    TI__Expert 4240 points

    Hello Alexander,

    Yes, redundant boot with eMMC-only is possible in UDA RAW mode. The AM625 BootROM does support a redundant image at offset 0x400000 in the eMMC UDA, but only in RAW mode, not in filesystem mode. This is directly confirmed by the AM62x TRM in section 5.4.3.1 SD Card Bootloader Operation:

    "In RAW mode only, the ROM supports a redundant image at offset 0x400000 in case the initial image fails to be recognized."

    Additionally, Table 5-54 MMCSD/eMMC Boot Parameter Table in the AM62x TRM explicitly lists:

    • Raw Offset 0- default value 0x000000- Raw read offset (primary)
    • Raw Offset 1- default value 0x400000- Backup raw read offset

    The BootROM switches to the redundant offset (0x400000) when the primary image at 0x0 fails to be recognized. "fails to be recognized" means the image at offset 0x0:

    • Has a missing/invalid boot header.
    • Fails integrity check (bad magic, corrupt header).
    • Fails authentication (on HS-SE devices, if the certificate/signature check fails).

    The BootROM does not fall back due to runtime errors, it's purely a boot-time image validity check. The boot sequence is:

    • ROM attempts to read and validate the image at offset 0x0 of UDA.
    • If validation fails, ROM tries the redundant image at offset 0x400000.
    • If that also fails, ROM moves to the configured backup boot mode (e.g., UART, USB DFU, etc.).

    In the case of eMMC primary boot, the ROM only supports redundant boot from offset 0x400000 for UDA RAW bootmode. The ROM also does not support booting from the Boot1 partition if booting from the Boot0 partition fails. Now, if booting Linux OS, the UDA RAW bootmode and therefore redundant boot capability can't be leveraged because the partition table would need to be at offset 0x0 of UDA. In short, if booting Linux OS, leveraging redundant boot for eMMC is really not possible. However, you can still leverage the Backup Bootmedia.

    So the redundant boot in UDA RAW is feasible only if:
    • You are not using an OS partition table starting at 0x0 of UDA (i.e., no MBR/GPT).
    • You reserve and manage the UDA manually, e.g., use a raw partition covering 0x400000 exclusively for the redundant SBL/SPL image.

    Please be aware of silicon errata i2415 Boot: UART Backup Boot Authentication Failure w/ xSPI Primary Boot Mode. Ensure the redundant image at 0x400000 is a complete boot certificate (not just a TIFS certificate), otherwise the ROM state machine may not reset correctly before attempting a backup boot mode.

    Here are some related threads to yours:

    Best Regards,

    Borislav Lazarkov

  • 0 in reply to Borislav Lazarkov
    Prodigy 70 points

    Thanks a lot for the quick and verbose reply, Borislav!