MSM8937系统启动流程
1 Boot Address for Processors使用的处理器
chipsets里有不同的处理器，下图显示了处理器的类型以及启动地址
| Subsystem | Processor | Boot address |
| APPS | Cortex-A53 | 0x00100000* |
| RPM | Cortex-M3 | 0x00200000 | (Subsystem view) | 0x0(System view) |
| Modem | MSS_QDSP6 | Configurable* |
| WCNSS (Pronto) | ARM9 | 0x0 or 0xFFFF0000 or hardware remap* |
| LPASS | LPASS_QDSP6 | Configurable* | LPASS |
| *No change in the boot address in system and subsystem views |
RPM：resource and power management 用来进行电源管理
Modem：打电话2G 3G 4G的相关功能 （由dsp实现）
WCNSS：wireless connectivity network subsystem，wifi上网
LPASS：low power audio subsystem，低功耗音频子系统（sensorhub也在这里实现）（由dsp实现）
2 Boot Call Stack
PS：debug policy是针对fuse过的机器，让fuse过的机器也可以调试
| Component 组件 |
Based on processor 哪个处理器执行 |
Loaded from 从哪加载 |
Executes in 再哪里执行 |
Function 功能 |
||||||
| Application Processor Primary Boot Loader (APPS PBL) AP的第一个Bootloader |
Cortex-A53 (AArch32) |
NA | APPS ROM | Boot device and interface detection, Emergency Download mode support, loads and authenticates SBL1 ELF segments across L2TCM, and RPM code RAM |
||||||
| Secondary Boot Loader stage 1 (SBL1) 第二个bootloader的 第一阶段 |
Cortex-A53 (AArch32) |
eMMC |
|
Initial memory subsystem (buses, DDR, clocks, and CDT), loads/ authorizes TrustZone, DEVCFG, RPM_FW, APPS BL images, memory dump via USB 2.0 and Sahara, Watchdog debug retention, e.gfor example, L2 flush, RAM dump to eMMC/SD support, USB driver support, USB charging, thermal check, PMIC driver support, configures DDR, and flushes L1/L2/ETB to crash debug support-related configuration |
||||||
| QSEE/TrustZone | Cortex-A53 (AArch64) |
eMMC | LPDDR3 | Equivalent to TZBSP; sets up secure runtime environment, configures xPU, supports fuse driver, authenticates any subsystem images; abnormal RESET debug functionality is added |
||||||
| DEVCFG | Cortex-A53 (AArch64) |
eMMC | LPDDR3 | OEM configurable data, for example, xPU configuration, PIL loading image regions |
| Component | Based on processor |
Loaded from | Executes in | Function |
| Debug policy1 （fuse的机器可以调试， 是可选的） |
Cortex-A53 (Aarch 32) |
eMMC | LPDDR3 | Enables debugging on commercial secure devices |
| Resource Power Manager Firmware (RPM_FW) |
Cortex-M3 | eMMC | RPM code RAM | Resource power management |
| APPSBL/boot manager and OS loader （就是lk） |
Cortex-A532 (AArch32/ AArch64) |
eMMC | LPDDR3 | Splash screen, loads and authenticates the kernel, and provides HLOS-specific boot loader features using UEFI |
| High-Level Operating System (HLOS) （就是android） |
Cortex-A53 (AArch32/ AArch64) |
eMMC | LPDDR3 | Boots HLOS images, for example, A53 HLOS kernel image, WCNSS (Pronto) image, and so on. |
| Modem Primary Boot Loader (Modem PBL) （modem的bootloader） |
MSS_QDSP6 | NA | Modem ROM Qualcomm® Hexagon™ TCM (data and stack) |
Sets up Hexagon TCM, copies MBA from LPDDR3 into Hexagon TCM, and authenticates MBA in Hexagon TCM |
| Modem Boot Authenticator (MBA) （modem验证） |
MSS_QDSP6 | eMMC | Hexagon TCM | Authenticates the modem image, xPU protects the DDR regions for modem, and memory dump |
| 1Debug policy image is an optional image loaded by the SBL. See Debug Policy User Guide for MSM8996, MSM8976, MSM8956 (80-NV396-72). 2LK boot loader will start in 32-bit |
3 Boot Code Flow启动流程
Boot Flowchart
按下power键后，MSM8937/MSM8953/MSM8940的apps处理器开始执行，APPS PBL在ROM里执行
2. In Cortex-A53, APPS PBL loads and authenticates the following:
a. SBL1 segment 1 from the boot device to L2 (as TCM)
2. In Cortex-A53, APPS PBL loads and authenticates the following:
a. SBL1 segment 1 from the boot device to L2 (as TCM)
将sbl1加载到l2中
b.
SBL1 segment 2 (SDI equivalent) to RPM code RAM, then jumps to SBL1
将RPM的代码加载到RPM的code RAM中，跳转执行SBL1
3. SBL1 segment 1 initializes DDR and loads and authenticates the following:
a. QSEE/TrustZone image from the boot device to DDR
3. SBL1 segment 1 initializes DDR and loads and authenticates the following:
a. QSEE/TrustZone image from the boot device to DDR
将QSEE/TrustZone加载到DDR
b. DEVCFG image from the boot device to DDR
b. DEVCFG image from the boot device to DDR
将DEVCFG 加载到DDR
c. Debug Policy image from the boot device to DDR
c. Debug Policy image from the boot device to DDR
将Debug Policy加载到DDR
d. HLOS APPSBL image from the boot device to DDR
d. HLOS APPSBL image from the boot device to DDR
将APPSBL（即lk）加载到DDR
e. RPM firmware image from the boot device to RPM code RAM
e. RPM firmware image from the boot device to RPM code RAM
将RPM firmware image加载到DDR
4. SBL1 transfers the execution to QSEE/TrustZone. QSEE/TrustZone sets up a secure environment, configures xPU, and supports the fuse driver.
4. SBL1 transfers the execution to QSEE/TrustZone. QSEE/TrustZone sets up a secure environment, configures xPU, and supports the fuse driver.
sbl1执行完后，执行QSEE，QSEE设置安全环境，配置xPU，
a. SBL1 runs in AArch32 mode. QSEE/TrustZone runs in AArc64 mode. For AArch64 mode switch, SBL1 sets boot remapper for QSEE entry and writes to RMR register, and then triggers warm-reset. QSEE now starts in AArch64 mode.
a. SBL1 runs in AArch32 mode. QSEE/TrustZone runs in AArc64 mode. For AArch64 mode switch, SBL1 sets boot remapper for QSEE entry and writes to RMR register, and then triggers warm-reset. QSEE now starts in AArch64 mode.
SBL1运行在AArch32 模式，QSEE/TrustZone运行在AArc64 模式，SBL1将QSEE 的入口remap，写RMR寄存器，warm-reset，这样QSEE就在AArch64 模式
5. QSEE notifies RPM to start the RPM firmware execution.
5. QSEE notifies RPM to start the RPM firmware execution.
QSEE通知RPM执行RPM的固件
6.
QSEE transfers execution to the HLOS APPSBL to initialize the system.
HLOS APPSBL （即lk）初始化系统
a. The Linux APPS boot loader (HLOS APPSBL) starts the execution in AArch32 mode only.
a. The Linux APPS boot loader (HLOS APPSBL) starts the execution in AArch32 mode only.
HLOS APPSBL运行在AArch32 模式
b. This is done by EL3/Monitor mode by looking at the ELF header for HLOS APPSBL, which indicates that it uses 32-bit instruction set architecture. EL3/Monitor mode changes to 32-bit mode and starts Linux APPS boot loader (HLOS APPSBL) execution in 32-bit mode.
b. This is done by EL3/Monitor mode by looking at the ELF header for HLOS APPSBL, which indicates that it uses 32-bit instruction set architecture. EL3/Monitor mode changes to 32-bit mode and starts Linux APPS boot loader (HLOS APPSBL) execution in 32-bit mode.
通过查看 HLOS APPSBL的ELF的文件头，需要使用32位的指令集，系统切换到32位的模式
7. The HLOS APPSBL loads and authenticates the HLOS kernel. The Linux APPS boot loader (HLOS APPSBL) will indicate about the HLOS kernel AArch64 mode by making an SCM call to secure the monitor before exiting. LK does not jump into the kernel directly as it did previously.
7. The HLOS APPSBL loads and authenticates the HLOS kernel. The Linux APPS boot loader (HLOS APPSBL) will indicate about the HLOS kernel AArch64 mode by making an SCM call to secure the monitor before exiting. LK does not jump into the kernel directly as it did previously.
HLOS APPSBL（即lk）加载内核，通过SCM调用切换到AArch64 模式
8. The HLOS kernel loads the MBA to DDR via PIL.
8. The HLOS kernel loads the MBA to DDR via PIL.
HLOS kernel 通过pil加载MBA到DDR
9. The HLOS kernel brings the Hexagon modem DSP out of reset.
9. The HLOS kernel brings the Hexagon modem DSP out of reset.
HLOS kernel复位modem的DSP
10. The Modem PBL then continues its boot process.
10. The Modem PBL then continues its boot process.
Modem的PBL执行
11. The HLOS kernel loads the AMSS modem image to DDR via PIL.
11. The HLOS kernel loads the AMSS modem image to DDR via PIL.
HLOS kernel 通过pil加载AMSS modem image 到DDR
12. The Modem PBL authenticates MBA and then jumps to it.
12. The Modem PBL authenticates MBA and then jumps to it.
modem的PBL验证MBA，然后跳进执行
13. HLOS loads the WCNSS (Pronto) image to DDR via PIL.
13. HLOS loads the WCNSS (Pronto) image to DDR via PIL.
HLOS kernel 通过pil加载WCNSS 到DDR
14. HLOS brings the WCNSS (Pronto) image out of reset so that the Pronto image starts executing.
14. HLOS brings the WCNSS (Pronto) image out of reset so that the Pronto image starts executing.
HLOS复位wifi的处理器，wifi的固件开始执行
15. HLOS loads the LPASS image to DDR via PIL.
15. HLOS loads the LPASS image to DDR via PIL.
HLOS kernel 通过pil加载LPASS（音频子系统）到DDR
16. HLOS brings the LPASS image out of reset so that the LPASS image starts executing.
16. HLOS brings the LPASS image out of reset so that the LPASS image starts executing.
HLOS kernel 复位处理音频的dsp，音频子系统开始运行