#BL602 "Boot2" ... The Boot Code that starts every BL602 Firmware ... Shall I unravel and document the code? 🤔
https://github.com/bouffalolab/bl_iot_sdk/tree/master/customer_app/bl602_boot2/bl602_boot2
My hunch: #BL602 Boot2 and ESP32 Secure Boot V2 have similar bootloader features 🤔
https://docs.espressif.com/projects/esp-idf/en/latest/esp32/security/secure-boot-v2.html
#BL602 Linker Map shows Boot2 Code is always loaded at 0x2300 0300 ... Let's find out what's inside
https://github.com/lupyuen/bl_iot_sdk/releases/download/v8.0.1/sdk_app_blinky.map
When #BL602 boots, it runs the Boot2 Bootloader Firmware at 0x2300 0000 ... Which loads the Application Firmware into (yikes!) 0x2300 0000 ... Let's investigate how the Bootloader makes this self-overlay possible
Quick check of #BL602 Boot2 Disassembly ... To be sure that it matches the Boot2 Bootloader that we have been flashing to BL602. Great exercise for learning #RISCV Assembly! 👍
https://github.com/lupyuen/bl_iot_sdk/releases/download/v8.0.2/bl602_boot2.S
#BL602 Bootloader installs the Application Firmware ... With eFuse Protection (optional)
How #BL602 Bootloader starts the Application Firmware
#BL602 Bootloader installs the Application Firmware
#BL602 Bootloader writes Application Firmware to XIP Flash Memory
Where does #BL602 Bootloader get the AES Encryption Key? From the eFuse Hardware!
#BL602 Application Firmware also has a Table of ROM API Functions ... But it's located at 0x4200 C000 (DTCM) 🤔
https://github.com/lupyuen/bl_iot_sdk/releases/download/v8.0.1/sdk_app_blinky.map
Linker Script for #BL602 Bootloader says that some System Functions will be placed in ITCM (0x2201 0000) ... Like Global Register (GLB), Power (PDS), XIP Flash and eFuse 🤔
Some parts of #BL602 Bootloader are located in ITCM Cache Memory (instead of XIP Flash) ... Maybe that's why the Bootloader is able to overwrite itself in XIP Flash Memory 🤔
https://github.com/lupyuen/bl_iot_sdk/releases/download/v8.0.2/bl602_boot2.map
Remember the Table of #BL602 ROM API Functions? Here's an interesting project that wraps the BL602 ROM API with #RustLang
https://github.com/9names/bl602-rom-wrapper/blob/main/src/rom_lookup.rs
#BL602 IoT SDK defines the ROM Driver API Functions at 0x2101 0800 ... Located in the BL602 Boot ROM
Now writing about the #BL602 Bootloader ... Then heading back to Rust Wrappers for BL602 IoT SDK
What is the #BL602 Boot2 Bootloader? How is it used for Secure Firmware Updates?
#BL602 Bootloader loads our Application Firmware into XIP Flash Memory ... And starts the firmware
https://lupyuen.github.io/articles/boot?7#inside-the-bootloader
#BL602 Bootloader will rollback the Application Firmware in XIP Flash Memory when there's a problem
https://lupyuen.github.io/articles/boot?8#inside-the-bootloader
#BL602 Bootloader uses XZ Compression when installing Application Firmware
https://lupyuen.github.io/articles/boot?9#install-application-firmware
How #BL602 Bootloader copies our Application Firmware to XIP Flash Memory
https://lupyuen.github.io/articles/boot?10#write-firmware-to-xip-flash
What's inside the #BL602 Partition Table? How does it control the Bootloader?
https://lupyuen.github.io/articles/boot?12#bl602-partition-table
#BL602 Boot ROM ... What's Inside?
https://lupyuen.github.io/articles/boot?14#bl602-rom-driver-api
Here's how we discovered the #BL602 ROM Driver Functions in Boot ROM
https://lupyuen.github.io/articles/boot?15#locating-the-rom-driver-api
How #BL602 Bootloader starts our Application Firmware
https://lupyuen.github.io/articles/boot?23#start-the-firmware
Does #BL602 Bootloader overwrite itself with our Application Firmware? Nope ... It switches the XIP Cache!
Comparing #BL602 Bootloader with #PineTime, ESP32 and RP2040
https://lupyuen.github.io/articles/boot?25#other-bootloaders
#BL602 Bootloader has a Table of ROM API Functions at 0x2201 0000 (ITCM) ... How is this table used? 🤔
https://github.com/lupyuen/bl_iot_sdk/releases/download/v8.0.2/bl602_boot2.map