ROM Initialization Sequence

The ROM is split into two main parts:

  1. The low level initialization and setup, which is written in assembler: this part is responsible for ensuring that the power supplies are set up, and that memory instances are enabled for default power-up conditions.
  2. The higher level functionality implemented in C dealing with the various peripherals, life cycle states and security features: these are defined in more detail in Security Subsystem.

The ROM initialization sequence is shown graphically in the "ROM Initialization Sequence Flowchart" figure. The flowchart describes the various paths through the boot sequence, taking into account the possible life cycle states and power modes.

Figure: ROM Initialization Sequence Flowchart

The "Boot Options" table shows the available boot options.

Table: Boot Options

ACS_BOOT_CFG

CC312AO

Results

BOOT_ROT_BYPASS_ENABLE

Enable

Pass but with cold boot

BOOT_ROT_BYPASS_DISABLE

Enable

Pass but with cold boot

BOOT_ROT_BYPASS_DISABLE

Disable

Fail with CCAO_REBOOT_RESET_FLAG_SET in ACS_RESET_STATUS

BOOT_ROT_BYPASS_ENABLE

Disable

Fail with watchdog reset in boot ROM

ROM Basic Initialization

The basic system initialization function is called once the power supplies and memories have been set to known default states. At this stage the RAM is enabled and the C stack is available for use.

The primary sequence of this initialization is as follows:

  • Set up the NVIC to allow only NMI and Hard Fault exceptions.
  • Disable the MPU, bus, and usage faults, forcing them to be always promoted to hard faults.
  • Disable all of the external interrupts and clear all pending status indicators.
  • Assign the NMI to a constant low source.
  • Stop any running flash or flash copier operations.
  • Reset the GPIOs.
  • Enable all JTAG pins.
  • Disable Pad Retention Mode.
  • Configure the watchdog timer for a maximum timeout, and refresh.
  • Disable DMA.
  • Configure Non Secure code zone.
  • Disable the SAU and set the ALLNS to zero so that everything is secure.
  • Configure the non-secure accesses to RAM and peripherals as disabled.
  • Make sure that the flash is not busy before setting up the RC.
  • Configure the RC for 12 MHz.
  • Select the RC oscillator as the system clock.
  • Set up the various clock pre-scalars.
  • Disable RF access.
  • Disable the baseband interface.
  • Enable all memories.
  • Ensure that the Arm CryptoCell-312 (CC312) is enabled and ready to run.
  • Set the system core clock variable and flash delays, indicating that the device is configured to use the 12 MHz RC oscillator.

ROM Status Variables & Status Codes

As part of its execution, the ROM sets several status variables indicating its execution status. These variables are stored near the base of RAM, starting at 0x20000004:

ROM Status

Variable indicating the status of the ROM execution, residing at 0x20000004.

ROM Context

Variable indicating the state of the device in which the ROM is executing. For example, this state could be energy harvesting mode or one of the secure life cycle modes. Resides at 0x20000008.

Application Status

Variable that is free to be used by the application. Resides at 0x2000000C.

Application Context

Variable that is free to be used by the application. Resides at 0x20000010.

The two tables below contain the possible values of ROM status ("ROM Status Values" table) and ROM context (the "ROM Context Values" table.

Table: ROM Status Values

Status or Context Name

Description

Value

RS_PRODUCTION_BOOT Indicates that the ROM is in production boot mode 0xBB000001
RS_FATAL_ERROR Indicates a fatal boot error 0x0000FE00
RS_SE_BOOT Indicates secure boot status values 0x5EC00000
RS_SE_BOOT_BAD_CONFIG Indicates a bad configuration has been detected during a secure boot 0x5EC0FE01 (RS_SE_BOOT | RS_FATAL_ERROR | 0x00000001)
RS_COLD_BOOT Indicates a cold boot state 0xCB000000
RS_COLD_BOOT_FAILED Indicates a cold boot failure. 0xCB00FE00 (RS_COLD_BOOT | RS_FATAL_ERROR)
Table: ROM Context Values

Status or Context name

Description

Value

RS_EH_BOOT Energy harvesting mode boot 0xEE000000
RS_EH_NO_KEY Energy harvesting mode, no key provided 0xEE000001 (RS_EH_BOOT + 1)
RS_EH_INV_KEY Energy harvesting mode, the key provided is invalid 0xEE000002 (RS_EH_BOOT + 2)
RS_EH_HAS_KEY_NO_CERT Energy harvesting mode, the key is provided but there is no valid certificate. 0xEE000003 (RS_EH_BOOT + 3)
RS_EH_HAS_KEY_HAS_CERT Energy harvesting mode, the key is provided and there is a valid certificate. 0xEE000004 (RS_EH_BOOT + 4)
RS_EH_NO_DCU Energy harvesting mode, the DCU setting is missing. 0xEE000005 (RS_EH_BOOT + 5)
RS_EH_INV_DCU Energy harvesting mode, the DCU setting is invalid. 0xEE000006 (RS_EH_BOOT + 6)
RS_EH_HAS_DCU Energy harvesting mode, the DCU setting is valid 0xEE000007 (RS_EH_BOOT + 7)
RS_CONTEXT Indicates a context variable. 0x00008000
RS_CONTEXT_RMA_FAIL Indicates a RMA state failure 0x00008100 (RS_CONTEXT + 0x100)
RS_CONTEXT_ROT_FAIL Indicates a Root-Of-Trust failure 0x00008200 (RS_CONTEXT + 0x200)
RS_CONTEXT_ALL_BITS Masking allowing modification of all context bits. 0xFFFFFFFF
RS_CONTEXT_LCS_BITS Mask allowing modification of Life-cycle state bits. 0x000000FF
RS_CONTEXT_CTX_BITS Mask allowing modification of Life-cycle state bits. 0x0000FF00