本文轉載自：https://blog.csdn.net/chenzhen1080/article/details/54945992?utm_source=blogxgwz8

1 Boot Address for Processors使用的處理器
chipsets裡有不同的處理器，下圖顯示了處理器的型別以及啟動地址
Subsystem     Processor     Boot address
APPS     Cortex-A53     0x00100000*
RPM     Cortex-M3     0x00200000           |
(Subsystem view)   |   0x0(System view)
Modem     MSS_QDSP6     Configurable*
WCNSS (Pronto)      ARM9     0x0 or 0xFFFF0000 or hardware remap*
LPASS     LPASS_QDSP6      Configurable*         |        LPASS
*No change in the boot address in system and subsystem views
APPS：應用處理器
RPM：resource and power management 用來進行電源管理
Modem：打電話2G 3G 4G的相關功能 （由dsp實現）
WCNSS：wireless connectivity network subsystem，wifi上網
LPASS：low power audio subsystem，低功耗音訊子系統（sensorhub也在這裡實現）（由dsp實現）

2 Boot Call Stack  
Component
元件     Based on
processor
哪個處理器執行     Loaded from
從哪載入       Executes in
再哪裡執行     Function
功能
Application Processor
Primary Boot Loader
(APPS PBL)
AP的第一個Bootloader     Cortex-A53
(AArch32)     NA     APPS ROM     Boot device and interface detection,
Emergency Download mode support,
loads and authenticates SBL1 ELF
segments across L2TCM, and RPM
code RAM
Secondary Boot
Loader stage 1 (SBL1)
第二個bootloader的
第一階段     Cortex-A53
(AArch32)     eMMC     
L2 TCM
(segment1)     L2 TCM
OCIMEM     —
RPM code RAM
(segment2)     RPM code
RAM
    Initial memory subsystem (buses,
DDR, clocks, and CDT), loads/
authorizes TrustZone, DEVCFG,
RPM_FW, APPS BL images, memory
dump via USB 2.0 and Sahara,
Watchdog debug retention, e.gfor
example, L2 flush, RAM dump to
eMMC/SD support, USB driver
support, USB charging, thermal
check, PMIC driver support,
configures DDR, and flushes
L1/L2/ETB to crash debug
support-related configuration
QSEE/TrustZone     Cortex-A53
(AArch64)     eMMC     LPDDR3     Equivalent to TZBSP; sets up secure
runtime environment, configures xPU,
supports fuse driver, authenticates
any subsystem images; abnormal
RESET debug functionality is added
DEVCFG     Cortex-A53
(AArch64)     eMMC     LPDDR3     OEM configurable data, for example,
xPU configuration, PIL loading image
regions

Component     Based on
processor     Loaded from      Executes in     Function
Debug policy1
（fuse的機器可以除錯，
是可選的）     Cortex-A53
(Aarch 32)     eMMC     LPDDR3     Enables debugging on commercial
secure devices
Resource Power
Manager Firmware
(RPM_FW)     Cortex-M3     eMMC     RPM code RAM     Resource power management
APPSBL/boot
manager and
OS loader
（就是lk）     Cortex-A532
(AArch32/
AArch64)     eMMC     LPDDR3     Splash screen, loads and
authenticates the kernel, and
provides HLOS-specific boot loader
features using UEFI
High-Level Operating
System (HLOS)
（就是android）     Cortex-A53
(AArch32/
AArch64)     eMMC     LPDDR3     Boots HLOS images, for example,
A53 HLOS kernel image, WCNSS
(Pronto) image, and so on.
Modem Primary Boot
Loader (Modem PBL)
（modem的bootloader）     MSS_QDSP6      NA     Modem ROM
Qualcomm® Hexagon™ TCM
(data and stack)     Sets up Hexagon TCM, copies MBA
from LPDDR3 into Hexagon TCM,
and authenticates MBA in Hexagon
TCM
Modem Boot
Authenticator (MBA)
（modem驗證）     MSS_QDSP6      eMMC     Hexagon TCM     Authenticates the modem image, xPU
protects the DDR regions for modem,
and memory dump
1Debug policy image is an optional image loaded by the SBL. See Debug Policy User Guide for MSM8996, MSM8976, MSM8956
(80-NV396-72).
2LK boot loader will start in 32-bit
PS：debug policy是針對fuse過的機器，讓fuse過的機器也可以除錯


3 Boot Code Flow啟動流程


Boot Flowchart
1. The system powers on and takes the MSM8937/MSM8953/MSM8940 apps  processor CPU out of reset.
按下power鍵後，MSM8937/MSM8953/MSM8940的apps處理器開始執行，APPS PBL在ROM裡執行
2. In Cortex-A53, APPS PBL loads and authenticates the following:
  a. SBL1 segment 1 from the boot device to L2 (as TCM)
  將sbl1載入到l2中
  b. SBL1 segment 2 (SDI equivalent) to RPM code RAM, then jumps to SBL1
  將RPM的程式碼載入到RPM的code RAM中，跳轉執行SBL1
3. SBL1 segment 1 initializes DDR and loads and authenticates the following:
  a. QSEE/TrustZone image from the boot device to DDR
  將QSEE/TrustZone載入到DDR
  b. DEVCFG image from the boot device to DDR
  將DEVCFG 載入到DDR
  c. Debug Policy image from the boot device to DDR
  將Debug Policy載入到DDR
  d. HLOS APPSBL image from the boot device to DDR
  將APPSBL（即lk）載入到DDR
  e. RPM firmware image from the boot device to RPM code RAM
  將RPM firmware image載入到DDR
4. SBL1 transfers the execution to QSEE/TrustZone. QSEE/TrustZone sets up a  secure environment, configures xPU, and supports the fuse driver.
  sbl1執行完後，執行QSEE，QSEE設定安全環境，配置xPU，
  a. SBL1 runs in AArch32 mode. QSEE/TrustZone runs in AArc64 mode. For AArch64 mode switch, SBL1 sets boot remapper for QSEE entry and writes to RMR register, and then triggers warm-reset. QSEE now starts in AArch64 mode.
  SBL1執行在AArch32 模式，QSEE/TrustZone執行在AArc64 模式，SBL1將QSEE 的入口remap，寫RMR暫存器，warm-reset，這樣QSEE就在AArch64 模式
5. QSEE notifies RPM to start the RPM firmware execution.
  QSEE通知RPM執行RPM的韌體

6. QSEE transfers execution to the HLOS APPSBL to initialize the system.
   HLOS APPSBL （即lk）初始化系統
  a. The Linux APPS boot loader (HLOS APPSBL) starts the execution in AArch32 mode only.
  HLOS APPSBL執行在AArch32 模式
  b. This is done by EL3/Monitor mode by looking at the ELF header for HLOS APPSBL, which indicates that it uses 32-bit instruction set architecture. EL3/Monitor mode changes to 32-bit mode and starts Linux APPS boot loader (HLOS APPSBL) execution in 32-bit mode.
  通過檢視 HLOS APPSBL的ELF的檔案頭，需要使用32位的指令集，系統切換到32位的模式
7. The HLOS APPSBL loads and authenticates the HLOS kernel. The Linux APPS boot loader (HLOS APPSBL) will indicate about the HLOS kernel AArch64 mode by making an SCM call to secure the monitor before exiting. LK does not jump into the kernel directly as it did previously.
 HLOS APPSBL（即lk）載入核心，通過SCM呼叫切換到AArch64 模式
8. The HLOS kernel loads the MBA to DDR via PIL.
HLOS kernel 通過pil載入MBA到DDR
9. The HLOS kernel brings the Hexagon modem DSP out of reset.
HLOS kernel復位modem的DSP
10. The Modem PBL then continues its boot process.
Modem的PBL執行
11. The HLOS kernel loads the AMSS modem image to DDR via PIL.
HLOS kernel 通過pil載入AMSS modem image 到DDR
12. The Modem PBL authenticates MBA and then jumps to it.
modem的PBL驗證MBA，然後跳進執行
13. HLOS loads the WCNSS (Pronto) image to DDR via PIL.
HLOS kernel 通過pil載入WCNSS 到DDR
14. HLOS brings the WCNSS (Pronto) image out of reset so that the Pronto image starts executing.
HLOS復位wifi的處理器，wifi的韌體開始執行
15. HLOS loads the LPASS image to DDR via PIL.
HLOS kernel 通過pil載入LPASS（音訊子系統）到DDR
16. HLOS brings the LPASS image out of reset so that the LPASS image starts executing.
HLOS kernel 復位處理音訊的dsp，音訊子系統開始執行
---------------------
作者：茫茫大士
來源：CSDN
原文：https://blog.csdn.net/chenzhen1080/article/details/54945992
版權宣告：本文為博主原創文章，轉載請附上博文連結！