v2.3.0 (RP2350)
Access to functions and data in the bootrom. More...
Data Structures | |
| struct | rom_helper_flash_op_params_t |
| Parameters for the flash operation helper used with flash_safe_execute. More... | |
| struct | rom_helper_explicit_buy_params_t |
| Parameters for the explicit buy helper used with flash_safe_execute. More... | |
| struct | boot_info_t |
| Boot information returned by the bootrom SYS_INFO_BOOT_INFO query. More... | |
Macros | |
| #define | ROM_TABLE_CODE(c1, c2) ((c1) | ((c2) << 8)) |
| Return a bootrom lookup code based on two ASCII characters. | |
Functions | |
| static uint32_t | rom_table_code (uint8_t c1, uint8_t c2) |
| Return a bootrom lookup code based on two ASCII characters. | |
| void * | rom_func_lookup (uint32_t code) |
| Lookup a bootrom function by its code. | |
| void * | rom_data_lookup (uint32_t code) |
| Lookup a bootrom data address by its code. | |
| bool | rom_funcs_lookup (uint32_t *table, unsigned int count) |
| Helper function to lookup the addresses of multiple bootrom functions. | |
| static __force_inline void * | rom_func_lookup_inline (uint32_t code) |
| Lookup a bootrom function by code. This method is forcibly inlined into the caller for FLASH/RAM sensitive code usage. | |
| static __force_inline void * | rom_data_lookup_inline (uint32_t code) |
| Lookup a bootrom data address by its code. This method is forcibly inlined into the caller for FLASH/RAM sensitive code usage. | |
| void | rom_reset_usb_boot (uint32_t usb_activity_gpio_pin_mask, uint32_t disable_interface_mask) |
| Reboot the device into BOOTSEL mode. | |
| void | rom_reset_usb_boot_extra (int usb_activity_gpio_pin, uint32_t disable_interface_mask, bool usb_activity_gpio_pin_active_low) |
| Reboot the device into BOOTSEL mode. | |
| static void | rom_connect_internal_flash (void) |
| Connect the SSI/QMI to the QSPI pads. | |
| static void | rom_flash_exit_xip (void) |
| Return the QSPI device from its XIP state to a serial command state. | |
| static void | rom_flash_range_erase (uint32_t addr, size_t count, uint32_t block_size, uint8_t block_cmd) |
| Erase bytes in flash. | |
| static void | rom_flash_range_program (uint32_t addr, const uint8_t *data, size_t count) |
| Program bytes in flash. | |
| static void | rom_flash_flush_cache (void) |
| Flush the XIP cache. | |
| static void | rom_flash_enter_cmd_xip (void) |
| Configure the SSI/QMI with a standard command. | |
| static int | rom_reboot (uint32_t flags, uint32_t delay_ms, uint32_t p0, uint32_t p1) |
| Reboot using the watchdog. | |
| static void | rom_bootrom_state_reset (uint32_t flags) |
| Reset bootrom state. | |
| static void | rom_flash_reset_address_trans (void) |
| Reset address translation. | |
| static void | rom_flash_select_xip_read_mode (bootrom_xip_mode_t mode, uint8_t clkdiv) |
| Configure QMI in a XIP read mode. | |
| static int | rom_flash_op (cflash_flags_t flags, uintptr_t addr, uint32_t size_bytes, uint8_t *buf) |
| Perform a flash read, erase, or program operation. | |
| static int | rom_func_otp_access (uint8_t *buf, uint32_t buf_len, otp_cmd_t cmd) |
| Writes data from a buffer into OTP, or reads data from OTP into a buffer. | |
| static int | rom_get_partition_table_info (uint32_t *out_buffer, uint32_t out_buffer_word_size, uint32_t partition_and_flags) |
| Fills a buffer with information from the partition table. | |
| static int | rom_load_partition_table (uint8_t *workarea_base, uint32_t workarea_size, bool force_reload) |
| Loads the current partition table from flash, if present. | |
| static int | rom_pick_ab_partition (uint8_t *workarea_base, uint32_t workarea_size, uint partition_a_num, uint32_t flash_update_boot_window_base) |
| Pick a partition from an A/B pair. | |
| int | rom_pick_ab_partition_during_update (uint32_t *workarea_base, uint32_t workarea_size, uint partition_a_num) |
| Pick A/B partition without disturbing any in progress Flash Update boot or TBYB boot. | |
| static int | rom_get_b_partition (uint pi_a) |
| Get B partition. | |
| static int | rom_get_uf2_target_partition (uint8_t *workarea_base, uint32_t workarea_size, uint32_t family_id, resident_partition_t *partition_out) |
| Get UF2 Target Partition. | |
| static intptr_t | rom_flash_runtime_to_storage_addr (uintptr_t flash_runtime_addr) |
| Translate runtime to storage address. | |
| static int | rom_chain_image (uint8_t *workarea_base, uint32_t workarea_size, uint32_t region_base, uint32_t region_size) |
| Chain into a launchable image. | |
| static int | rom_explicit_buy (uint8_t *buffer, uint32_t buffer_size) |
| Buy an image. | |
| static int | rom_set_ns_api_permission (uint ns_api_num, bool allowed) |
| Set NS API Permission. | |
| static void * | rom_validate_ns_buffer (const void *addr, uint32_t size, uint32_t write, uint32_t *ok) |
| Validate NS Buffer. | |
| static intptr_t | rom_set_rom_callback (uint callback_num, bootrom_api_callback_generic_t funcptr) |
| Set ROM callback function. | |
| static int | rom_get_sys_info (uint32_t *out_buffer, uint32_t out_buffer_word_size, uint32_t flags) |
| Get system information. | |
| int | rom_add_flash_runtime_partition (uint32_t start_offset, uint32_t size, uint32_t permissions) |
| Add a runtime partition to the partition table to specify flash permissions. | |
Access to functions and data in the bootrom.
This header may be included by assembly code
| #define ROM_TABLE_CODE | ( | c1, | |
| c2 | |||
| ) | ((c1) | ((c2) << 8)) |
Return a bootrom lookup code based on two ASCII characters.
These codes are uses to lookup data or function addresses in the bootrom
| c1 | the first character |
| c2 | the second character |
| int rom_add_flash_runtime_partition | ( | uint32_t | start_offset, |
| uint32_t | size, | ||
| uint32_t | permissions | ||
| ) |
Add a runtime partition to the partition table to specify flash permissions.
Note that a partition is added to the runtime view of the partition table maintained by the bootrom if there is space to do so
Note that these permissions cannot override the permissions for any pre-existing partitions, as permission matches are made on a first partition found basis.
| start_offset | the start_offset into flash in bytes (must be a multiple of 4K) |
| size | the size in byte (must be a multiple of 4K) |
| permissions | the bitwise OR of permissions from PICOBIN_PARTITION_PERMISSION_ constants, e.g. PICOBIN_PARTITION_PERMISSION_S_R_BITS from boot/picobin.h |
|
inlinestatic |
Reset bootrom state.
Resets internal bootrom state, based on the following flags:
STATE_RESET_CURRENT_CORE - Resets any internal bootrom state for the current core into a clean state. This method should be called prior to calling any other bootrom APIs on the current core, and is called automatically by the bootrom during normal boot of core 0 and launch of code on core 1.
STATE_RESET_OTHER_CORE - Resets any internal bootrom state for the other core into a clean state. This is generally called by a debugger when resetting the state of one core via code running on the other.
STATE_RESET_GLOBAL_STATE - Resets all non core-specific state, including: Disables access to bootrom APIs from ARM-NS Unlocks all BOOT spinlocks Clears any secure code callbacks
Note: the sdk calls this method on runtime initialisation to put the bootrom into a known state. This allows the program to function correctly if it is entered (e.g. from a debugger) without taking the usual boot path (which resets the state appropriately itself).
| flags | flags, as detailed above |
|
inlinestatic |
Chain into a launchable image.
Searches a memory region for a launchable image, and executes it if possible.
The region_base and region_size specify a word-aligned, word-multiple-sized area of RAM, XIP RAM or flash to search. The first 4 kiB of the region must contain the start of a Block Loop with an IMAGE_DEF. If the new image is launched, the call does not return otherwise an error is returned.
The region_base is signed, as a negative value can be passed, which indicates that the (negated back to positive value) is both the region_base and the base of the "flash update" region.
This method potentially requires similar complexity to the boot path in terms of picking amongst versions, checking signatures etc. As a result it requires a user provided memory buffer as a work area. The work area should be word aligned, and of sufficient size or BOOTROM_ERROR_INSUFFICIENT_RESOURCES will be returned. The work area size currently required is 3264, so 3.25K is a good choice.
NOTE: This method is primarily expected to be used when implementing bootloaders.
NOTE: When chaining into an image, the OTP_DATA_BOOT_FLAGS0_ROLLBACK_REQUIRED flag will not be set, to prevent invalidating a bootloader without a rollback version by booting a binary which has one.
| workarea_base | base address of work area |
| workarea_size | size of work area |
| region_base | base address of image |
| region_size | size of window containing image |
|
inlinestatic |
Connect the SSI/QMI to the QSPI pads.
Restore all QSPI pad controls to their default state, and connect the SSI/QMI peripheral to the QSPI pads.
On RP2350 if a secondary flash chip select GPIO has been configured via OTP OTP_DATA_FLASH_DEVINFO, or by writing to the runtime copy of FLASH_DEVINFO in bootram, then this bank 0 GPIO is also initialised and the QMI peripheral is connected. Otherwise, bank 0 IOs are untouched.
| void * rom_data_lookup | ( | uint32_t | code | ) |
Lookup a bootrom data address by its code.
| code | the code |
|
static |
Lookup a bootrom data address by its code. This method is forcibly inlined into the caller for FLASH/RAM sensitive code usage.
| code | the code |
|
inlinestatic |
Buy an image.
Perform an "explicit" buy of an executable launched via an IMAGE_DEF which was "explicit buy" flagged. A "flash update" boot of such an image is a way to have the image execute once, but only become the "current" image if it calls back into the bootrom via this call.
This call may perform the following:
NOTE: The device may reboot while updating the rollback version, if multiple rollback rows need to be written - this occurs when the version crosses a multiple of 24 (for example upgrading from version 23 to 25 requires a reboot, but 23 to 24 or 24 to 25 doesn't). The application should therefore be prepared to reboot when calling this function, if rollback versions are in use.
Note that the first of the above requires 4 kiB of scratch space, so you should pass a word aligned buffer of at least 4 kiB to this method, or it will return BOOTROM_ERROR_INSUFFICIENT_RESOURCES if the "explicit buy" flag needs to be cleared.
| buffer | base address of scratch space |
| buffer_size | size of scratch space |
|
inlinestatic |
Configure the SSI/QMI with a standard command.
Configure the SSI/QMI to generate a standard 03h serial read command, with 24 address bits, upon each XIP access. This is a slow XIP configuration, but is widely supported. CLKDIV is set to 12 on RP2350. The debugger may call this function to ensure that flash is readable following a program/erase operation.
Note that the same setup is performed by flash_exit_xip(), and the RP2350 flash program/erase functions do not leave XIP in an inaccessible state, so calls to this function are largely redundant on RP2350. It is provided on RP2350 for compatibility with RP2040.
|
inlinestatic |
Return the QSPI device from its XIP state to a serial command state.
On RP2350, Initialise the QMI for serial operations (direct mode), and also initialise a basic XIP mode, where the QMI will perform 03h serial read commands at low speed (CLKDIV=12) in response to XIP reads.
Then, issue a sequence to the QSPI device on chip select 0, designed to return it from continuous read mode ("XIP mode") and/or QPI mode to a state where it will accept serial commands. This is necessary after system reset to restore the QSPI device to a known state, because resetting RP2350 does not reset attached QSPI devices. It is also necessary when user code, having already performed some continuous-read-mode or QPI-mode accesses, wishes to return the QSPI device to a state where it will accept the serial erase and programming commands issued by the bootrom's flash access functions.
If a GPIO for the secondary chip select is configured via FLASH_DEVINFO, then the XIP exit sequence is also issued to chip select 1.
The QSPI device should be accessible for XIP reads after calling this function; the name flash_exit_xip refers to returning the QSPI device from its XIP state to a serial command state.
|
inlinestatic |
Flush the XIP cache.
Flush the entire XIP cache, by issuing an invalidate by set/way maintenance operation to every cache line. This ensures that flash program/erase operations are visible to subsequent cached XIP reads.
Note that this unpins pinned cache lines, which may interfere with cache-as-SRAM use of the XIP cache.
No other operations are performed.
|
inlinestatic |
Perform a flash read, erase, or program operation.
The flash operation is bounds-checked against the known flash devices specified by the runtime value of FLASH_DEVINFO, stored in bootram. This is initialised by the bootrom to the OTP value OTP_DATA_FLASH_DEVINFO, if OTP_DATA_BOOT_FLAGS0_FLASH_DEVINFO_ENABLE is set; otherwise it is initialised to 16 MiB for chip select 0 and 0 bytes for chip select 1. FLASH_DEVINFO can be updated at runtime by writing to its location in bootram, the pointer to which can be looked up in the ROM table.
If a resident partition table is in effect, then the flash operation is also checked against the partition permissions. The Secure version of this function can specify the caller's effective security level (Secure, Non-secure, bootloader) using the CFLASH_SECLEVEL_BITS bitfield of the flags argument, whereas the Non-secure function is always checked against the Non-secure permissions for the partition. Flash operations which span two partitions are not allowed, and will fail address validation.
If OTP_DATA_FLASH_DEVINFO_D8H_ERASE_SUPPORTED is set, erase operations will use a D8h 64 kiB block erase command where possible (without erasing outside the specified region), for faster erase time. Otherwise, only 20h 4 kiB sector erase commands are used.
Optionally, this API can translate addr from flash runtime addresses to flash storage addresses, according to the translation currently configured by QMI address translation registers, QMI_ATRANS0 through QMI_ATRANS7. For example, an image stored at a +2 MiB offset in flash (but mapped at XIP address 0 at runtime), writing to an offset of +1 MiB into the image, will write to a physical flash storage address of 3 MiB. Translation is enabled by setting the CFLASH_ASPACE_BITS bitfield in the flags argument.
When translation is enabled, flash operations which cross address holes in the XIP runtime address space (created by non-maximum ATRANSx_SIZE) will return an error response. This check may tear: the transfer may be partially performed before encountering an address hole and ultimately returning failure.
When translation is enabled, flash operations are permitted to cross chip select boundaries, provided this does not span an ATRANS address hole. When translation is disabled, the entire operation must target a single flash chip select (as determined by bits 24 and upward of the address), else address validation will fail.
| flags | controls the security level, address space, and flash operation |
| addr | the address of the first flash byte to be accessed, ranging from XIP_BASE to XIP_BASE + 0x1ffffff |
| size_bytes | size of buf, in bytes |
| buf | contains data to be written to flash, for program operations, and data read back from flash, for read operations |
|
inlinestatic |
Erase bytes in flash.
Erase count bytes, starting at addr (offset from start of flash). Optionally, pass a block erase command e.g. D8h block erase, and the size of the block erased by this command - this function will use the larger block erase where possible, for much higher erase speed. addr must be aligned to a 4096-byte sector, and count must be a multiple of 4096 bytes.
This is a low-level flash API, and no validation of the arguments is performed.
See rom_flash_op on RP2350 for a higher-level API which checks alignment, flash bounds and partition permissions, and can transparently apply a runtime-to-storage address translation.
The QSPI device must be in a serial command state before calling this API, which can be achieved by calling rom_connect_internal_flash() followed by rom_flash_exit_xip(). After the erase, the flash cache should be flushed via rom_flash_flush_cache() to ensure the modified flash data is visible to cached XIP accesses.
Finally, the original XIP mode should be restored by copying the saved XIP setup function from bootram into SRAM, and executing it: the bootrom provides a default function which restores the flash mode/clkdiv discovered during flash scanning, and user programs can override this with their own XIP setup function.
For the duration of the erase operation, QMI is in direct mode and attempting to access XIP from DMA, the debugger or the other core will return a bus fault. XIP becomes accessible again once the function returns.
| addr | the offset from start of flash to be erased |
| count | number of bytes to erase |
| block_size | optional size of block erased by block_cmd |
| block_cmd | optional block erase command e.g. D8h block erase |
|
inlinestatic |
Program bytes in flash.
Program data to a range of flash addresses starting at addr (offset from the start of flash) and count bytes in size. addr must be aligned to a 256-byte boundary, and count must be a multiple of 256.
This is a low-level flash API, and no validation of the arguments is performed.
See rom_flash_op on RP2350 for a higher-level API which checks alignment, flash bounds and partition permissions, and can transparently apply a runtime-to-storage address translation.
The QSPI device must be in a serial command state before calling this API - see notes on rom_flash_range_erase
| addr | the offset from start of flash to be erased |
| data | buffer containing the data to be written |
| count | number of bytes to erase |
|
inlinestatic |
Reset address translation.
Restore the QMI address translation registers, QMI_ATRANS0 through QMI_ATRANS7, to their reset state. This makes the runtime-to-storage address map an identity map, i.e. the mapped and unmapped address are equal, and the entire space is fully mapped.
|
inlinestatic |
Translate runtime to storage address.
Applies the address translation currently configured by QMI address translation registers.
Translating an address outside of the XIP runtime address window, or beyond the bounds of an ATRANSx_SIZE field, returns BOOTROM_ERROR_INVALID_ADDRESS, which is not a valid flash storage address. Otherwise, return the storage address which QMI would access when presented with the runtime address addr. This is effectively a virtual-to-physical address translation for QMI.
| flash_runtime_addr | the address to translate |
|
inlinestatic |
Configure QMI in a XIP read mode.
Configure QMI for one of a small menu of XIP read modes supported by the bootrom. This mode is configured for both memory windows (both chip selects), and the clock divisor is also applied to direct mode.
| mode | bootrom_xip_mode_t mode to use |
| clkdiv | clock divider |
| void * rom_func_lookup | ( | uint32_t | code | ) |
Lookup a bootrom function by its code.
| code | the code |
|
static |
Lookup a bootrom function by code. This method is forcibly inlined into the caller for FLASH/RAM sensitive code usage.
| code | the code |
|
inlinestatic |
Writes data from a buffer into OTP, or reads data from OTP into a buffer.
The buffer must be aligned to 2 bytes or 4 bytes according to the IS_ECC flag.
This method will read and write rows until the first row it encounters that fails a key or permission check at which it will return BOOTROM_ERROR_NOT_PERMITTED.
Writing will also stop at the first row where an attempt is made to set an OTP bit from a 1 to a 0, and BOOTROM_ERROR_UNSUPPORTED_MODIFICATION will be returned.
If all rows are read/written successfully, then BOOTROM_OK will be returned.
| buf | buffer to read to/write from |
| buf_len | size of buf |
| cmd | OTP command to execute
|
| bool rom_funcs_lookup | ( | uint32_t * | table, |
| unsigned int | count | ||
| ) |
Helper function to lookup the addresses of multiple bootrom functions.
This method looks up the 'codes' in the table, and convert each table entry to the looked up function pointer, if there is a function for that code in the bootrom.
| table | an IN/OUT array, elements are codes on input, function pointers on success. |
| count | the number of elements in the table |
|
inlinestatic |
Get B partition.
Returns the index of the B partition of partition A if a partition table is present and loaded, and there is a partition A with a B partition; otherwise returns BOOTROM_ERROR_NOT_FOUND.
| pi_a | the A partition number |
|
inlinestatic |
Fills a buffer with information from the partition table.
Fills a buffer with information from the partition table. Note that this API is also used to return information over the picoboot interface.
On success, the buffer is filled, and the number of words filled in the buffer is returned. If the partition table has not been loaded (e.g. from a watchdog or RAM boot), then this method will return BOOTROM_ERROR_NO_DATA, and you should load the partition table via load_partition_table() first.
Note that not all data from the partition table is kept resident in memory by the bootrom due to size constraints. To protect against changes being made in flash after the bootrom has loaded the resident portion, the bootrom keeps a hash of the partition table as of the time it loaded it. If the hash has changed by the time this method is called, then it will return BOOTROM_ERROR_INVALID_STATE.
The information returned is chosen by the partition_and_flags parameter; the first word in the returned buffer, is the (sub)set of those flags that the API supports. You should always check this value before interpreting the buffer.
Following the first word, returns words of data for each present flag in order. With the exception of PT_INFO, all the flags select "per partition" information, so each field is returned in flag order for one partition after the next. The special SINGLE_PARTITION flag indicates that data for only a single partition is required.
| out_buffer | buffer to write data to |
| out_buffer_word_size | size of out_buffer, in words |
| partition_and_flags | partition number and flags |
|
inlinestatic |
Get system information.
Fills a buffer with various system information. Note that this API is also used to return information over the picoboot interface.
On success, the buffer is filled, and the number of words filled in the buffer is returned.
The information returned is chosen by the flags parameter; the first word in the returned buffer, is the (sub)set of those flags that the API supports. You should always check this value before interpreting the buffer.
"Boot Diagnostic" information is intended to help identify the cause of a failed boot, or booting into an unexpected binary. This information can be retrieved via picoboot after a watchdog reboot, however it will not survive a reset via the RUN pin or POWMAN reset.
There is only one word of diagnostic information. What it records is based on the pp selection above, which is itself set as a parameter when rebooting programmatically into a normal boot.
To get diagnostic info, pp must refer to a slot or an "A" partition; image diagnostics are automatically selected on boot from OTP or RAM image, or when chain_image() is called.)
The diagnostic word thus contains data for either slot 0 and slot 1, or the "A" partition (and its "B" partition if it has one). The low half word of the diagnostic word contains information from slot 0 or partition A; the high half word contains information from slot 1 or partition B.
To get a full picture of a failed boot involving slots and multiple partitions, the device can be rebooted multiple times to gather the information.
| out_buffer | buffer to write data to |
| out_buffer_word_size | size of out_buffer, in words |
| flags | flags |
|
inlinestatic |
Get UF2 Target Partition.
This method performs the same operation to decide on a target partition for a UF2 family ID as when a UF2 is dragged onto the USB drive in BOOTSEL mode.
This method potentially requires similar complexity to the boot path in terms of picking amongst versions, checking signatures etc. As a result it requires a user provided memory buffer as a work area. The work area should byte word-aligned and of sufficient size or BOOTROM_ERROR_INSUFFICIENT_RESOURCES will be returned. The work area size currently required is 3264, so 3.25K is a good choice.
If the partition table has not been loaded (e.g. from a watchdog or RAM boot), then this method will return BOOTROM_ERROR_PRECONDITION_NOT_MET, and you should load the partition table via <<api-load_partition_table, load_partition_table()>> first.
| workarea_base | base address of work area |
| workarea_size | size of work area |
| family_id | the family ID to place |
| partition_out | pointer to the resident_partition_t to fill with the partition data |
|
inlinestatic |
Loads the current partition table from flash, if present.
This method potentially requires similar complexity to the boot path in terms of picking amongst versions, checking signatures etc. As a result it requires a user provided memory buffer as a work area. The work area should byte word-aligned and of sufficient size or BOOTROM_ERROR_INSUFFICIENT_RESOURCES will be returned. The work area size currently required is 3264, so 3.25K is a good choice.
If force_reload is false, then this method will return BOOTROM_OK immediately if the bootrom is loaded, otherwise it will reload the partition table if it has been loaded already, allowing for the partition table to be updated in a running program.
| workarea_base | base address of work area |
| workarea_size | size of work area |
| force_reload | force reloading of the partition table |
|
inlinestatic |
Pick a partition from an A/B pair.
Determines which of the partitions has the "better" IMAGE_DEF. In the case of executable images, this is the one that would be booted
This method potentially requires similar complexity to the boot path in terms of picking amongst versions, checking signatures etc. As a result it requires a user provided memory buffer as a work area. The work area should bye word aligned, and of sufficient size or BOOTROM_ERROR_INSUFFICIENT_RESOURCES will be returned. The work area size currently required is 3264, so 3.25K is a good choice.
The passed partition number can be any valid partition number other than the "B" partition of an A/B pair.
This method returns a negative error code, or the partition number of the picked partition if (i.e. partition_a_num or the number of its "B" partition if any).
NOTE: This method does not look at owner partitions, only the A partition passed and it's corresponding B partition.
NOTE: You should not call this method directly when performing a Flash Update Boot before calling explicit_buy, as it may prevent any version downgrade from occuring - instead see rom_pick_ab_partition_during_update() which wraps this function.
| workarea_base | base address of work area |
| workarea_size | size of work area |
| partition_a_num | the A partition of the pair |
| flash_update_boot_window_base | the flash update base, to pick that partition instead of the normally "better" partition |
| int rom_pick_ab_partition_during_update | ( | uint32_t * | workarea_base, |
| uint32_t | workarea_size, | ||
| uint | partition_a_num | ||
| ) |
Pick A/B partition without disturbing any in progress Flash Update boot or TBYB boot.
This will perform the same function as rom_pick_ab_partition(), using the flash_update_boot_window_base from the current boot, while performing extra checks to prevent disrupting a main image TBYB boot. It requires the same minimum workarea size as rom_pick_ab_partition().
This should be used instead of rom_pick_ab_partition() when performing a Flash Update Boot before calling rom_explicit_buy(), and can still be used without issue when a Flash Update Boot is not in progress.
This function is necessary because if an explicit_buy is pending then calling pick_ab_partition would clear the saved flash erase address for the version downgrade, so the required erase of the other partition would not occur when explicit_buy is called. This function saves and restores that address to prevent this issue, and returns BOOTROM_ERROR_NOT_PERMITTED if the partition chosen by pick_ab_partition also requires a flash erase version downgrade (as you can't erase two partitions with one explicit_buy call).
This function also checks that the chosen partition contained a valid image (e.g. a signed image when using secure boot), and returns BOOTROM_ERROR_NOT_FOUND if it does not.
| workarea_base | base address of work area |
| workarea_size | size of work area |
| partition_a_num | the A partition of the pair |
|
inlinestatic |
Reboot using the watchdog.
Resets the chip and uses the watchdog facility to restart.
The delay_ms is the millisecond delay before the reboot occurs. Note: by default this method is asynchronous (unless NO_RETURN_ON_SUCCESS is set - see below), so the method will return and the reboot will happen this many milliseconds later.
The flags field contains one of the following values:
REBOOT2_FLAG_REBOOT_TYPE_NORMAL - reboot into the normal boot path.
REBOOT2_FLAG_REBOOT_TYPE_BOOTSEL - reboot into BOOTSEL mode. p0 - a set of flags: 0x01 : DISABLE_MSD_INTERFACE - Disable the BOOTSEL USB drive (see <<section_bootrom_mass_storage>>) 0x02 : DISABLE_PICOBOOT_INTERFACE - Disable the {picoboot} interface (see <<section_bootrom_picoboot>>). 0x10 : GPIO_PIN_ACTIVE_LOW - The GPIO specified in p1 is active low (GPIO_PIN_SPECIFIED must also be set). 0x20 : GPIO_PIN_SPECIFIED - Enable the activity indicator on the GPIO specified in p1. p1 - the GPIO number to use as an activity indicator (enabled by GPIO_PIN_SPECIFIED flag in p0).
REBOOT2_FLAG_REBOOT_TYPE_RAM_IMAGE - reboot into an image in RAM. The region of RAM or XIP RAM is searched for an image to run. This is the type of reboot used when a RAM UF2 is dragged onto the BOOTSEL USB drive. p0 - the region start address (word-aligned). p1 - the region size (word-aligned).
REBOOT2_FLAG_REBOOT_TYPE_FLASH_UPDATE - variant of REBOOT2_FLAG_REBOOT_TYPE_NORMAL to use when flash has been updated. This is the type of reboot used after dragging a flash UF2 onto the BOOTSEL USB drive. p0 - the address of the start of the region of flash that was updated. If this address matches the start address of a partition or slot, then that partition or slot is treated preferentially during boot (when there is a choice). This type of boot facilitates TBYB and version downgrades.
REBOOT2_FLAG_REBOOT_TYPE_PC_SP - reboot to a specific PC and SP. Note: this is not allowed in the ARM-NS variant. p0 - the initial program counter (PC) to start executing at. This must have the lowest bit set for Arm and clear for RISC-V p1 - the initial stack pointer (SP).
All of the above, can have optional flags ORed in:
REBOOT2_FLAG_REBOOT_TO_ARM - switch both cores to the Arm architecture (rather than leaving them as is). The call will fail with BOOTROM_ERROR_INVALID_STATE if the Arm architecture is not supported. REBOOT2_FLAG_REBOOT_TO_RISCV - switch both cores to the RISC-V architecture (rather than leaving them as is). The call will fail with BOOTROM_ERROR_INVALID_STATE if the RISC-V architecture is not supported. REBOOT2_FLAG_NO_RETURN_ON_SUCCESS - the watchdog h/w is asynchronous. Setting this bit forces this method not to return if the reboot is successfully initiated.
| flags | the reboot flags, as detailed above |
| delay_ms | millisecond delay before the reboot occurs |
| p0 | parameter 0, depends on flags |
| p1 | parameter 1, depends on flags |
| void rom_reset_usb_boot | ( | uint32_t | usb_activity_gpio_pin_mask, |
| uint32_t | disable_interface_mask | ||
| ) |
Reboot the device into BOOTSEL mode.
This function reboots the device into the BOOTSEL mode ('usb boot"). Facilities are provided to enable an "activity light" via GPIO attached LED for the USB Mass Storage Device, and to limit the USB interfaces exposed.
| usb_activity_gpio_pin_mask | 0 No pins are used as per a cold boot. Otherwise, a single bit set indicating which GPIO pin should be set to output and raised whenever there is mass storage activity from the host. |
| disable_interface_mask | value to control exposed interfaces
|
| void rom_reset_usb_boot_extra | ( | int | usb_activity_gpio_pin, |
| uint32_t | disable_interface_mask, | ||
| bool | usb_activity_gpio_pin_active_low | ||
| ) |
Reboot the device into BOOTSEL mode.
This function reboots the device into the BOOTSEL mode ('usb boot"). Facilities are provided to enable an "activity light" via GPIO attached LED for the USB Mass Storage Device, and to limit the USB interfaces exposed.
| usb_activity_gpio_pin | GPIO pin to be used as an activitiy pin, or -1 for none |
| disable_interface_mask | value to control exposed interfaces
|
| usb_activity_gpio_pin_active_low | Activity GPIO is active low (ignored on RP2040). A bug in the bootrom of RP2350 A4 chips means this parameter has no effect on that version of the RP2350. |
|
inlinestatic |
Set NS API Permission.
Allow or disallow the specific NS API (note all NS APIs default to disabled).
ns_api_num configures ARM-NS access to the given API. When an NS API is disabled, calling it will return BOOTROM_ERROR_NOT_PERMITTED.
NOTE: All permissions default to disallowed after a reset.
| ns_api_num | ns api number |
| allowed | permission |
|
inlinestatic |
Set ROM callback function.
The only currently supported callback_number is 0 which sets the callback used for the secure_call API.
A callback pointer of 0 deletes the callback function, a positive callback pointer (all valid function pointers are on RP2350) sets the callback function, but a negative callback pointer can be passed to get the old value without setting a new value.
If successful, returns >=0 (the existing value of the function pointer on entry to the function).
| callback_num | the callback number to set - only 0 is supported on RP2350 |
| funcptr | pointer to the callback function |
|
inlinestatic |
Return a bootrom lookup code based on two ASCII characters.
These codes are uses to lookup data or function addresses in the bootrom
| c1 | the first character |
| c2 | the second character |
|
inlinestatic |
Validate NS Buffer.
Utility method that can be used by secure ARM code to validate a buffer passed to it from Non-secure code.
Both the write parameter and the (out) result parameter ok are RCP booleans, so 0xa500a500 for true, and 0x00c300c3 for false. This enables hardening of this function, and indeed the write parameter must be one of these values or the RCP will hang the system.
For success, the entire buffer must fit in range XIP_BASE -> SRAM_END, and must be accessible by the Non-secure caller according to SAU + NS MPU (privileged or not based on current processor IPSR and NS CONTROL flag). Buffers in USB RAM are also allowed if access is granted to NS via ACCESSCTRL.
| addr | buffer address |
| size | buffer size |
| write | rcp boolean, true if writeable |
| ok | rcp boolean result |