UPGRADE YOUR BROWSER

We have detected your current browser version is not the latest one. Xilinx.com uses the latest web technologies to bring you the best online experience possible. Please upgrade to a Xilinx.com supported browser:Chrome, Firefox, Internet Explorer 11, Safari. Thank you!

AR# 55572

Zynq-7000 AP SoC - Boot Times using NAND / QSPI

Description

This answer record contains information relevant to Zynq-7000 AP SoC boot with NAND or QSPI memory devices.

The document particularly highlights settings and considerations to achieve better timing and bandwidth results during different boot stages.

In order to obtain an estimate of the boot times for your configuration, use the attached spreadsheet.

Solution

Boot Times

The bandwidth of flash memories varies for the following configurations from different vendors; this affects boot times. 

For details about the size and type of devices supported by Xilinx tools, please refer to (Xilinx Answer 50991). The following figure shows the main components that constitute the boot time for Zynq-7000 devices.

PS and PL Image loaded serially


  1. Power ramp time (dependent on power supply)
  2. PLL Lock time
  3. BootROM time
  4. Loading Images


This answer record does not cover power ramp time and PLL lock time. Power-up ramp time is dependent on the type of power supply being used. PLL lock time can be up to thousands of cycles, but is still in micro-seconds and does not impact the overall boot times significantly.

Non-Secure Boot

Details about non-secure boot can be found in the chapter 6 of the Zynq-7000 AP SoC Technical Reference Manual. In non-secure boot, the PL can be powered off if a separate power supply is used. If the power supply between PL and PS is shared, then PL will also be powered on. In both these cases, BootROM does not wait for PL to be ready. For TPoR numbers, refer to the TPoR table in the BootROM Timing section. Once FSBL is copied to the OCM, which is user code, it takes over. The BootROM has the ability to authenticate non-secure FSBL prior to execution using RSA public key authentication.

Secure Boot

In secure boot either all the images partitions or some of the image partitions are encrypted. In order for boot to be secure FSBL has to be encrypted. For details, refer to chapter 6 and chapter 32 of Zynq-7000 AP SoC Technical Reference Manual. Since FSBL is secure so the AES/SHA engine in the Programmable Logic is used to decrypt and authenticate the image. For this to happen, the BootROM has to wait for PL to be ready, which can include PL TPoR and/or house cleaning. The BootROM is also able to authenticate the secure FSBL prior to execution using RSA public key authentication.

BootROM Timings

Please contact a Xilinx FAE to obtain BootROM timings for the interface you plan to use.

The BootROM starts executing code after the PLL lock, which happens after the de-assertion of the PoR (Power On Reset). It includes everything until the control is given to the FSBL. BootROM code can be broken down into the following:

  1. Boot code execution
  2. Copying FSBL form flash device to the OCM
  3. CRC Check of BootROM code (if enabled)
  4. TPoR of Programmable Logic (Secure boot)
  5. AES/SHA decryption and authentication (secure boot)
  6. RSA authentication (if enabled)

Other than Boot code execution and copying FSBL into the OCM, the rest are optional and add to the BootROM time if enabled.

CRC Check for BootROM Code

After the power-on and reset sequences have completed, the on-chip BootROM begins to execute. An optional eFuse setting can be used to perform a full 128 KB CRC on the BootROM. Details about enabling the 128KB CRC check on Boot ROM can be found in chapter 32 of the Zynq-7000 AP SoC Technical reference Manual. After the integrity check, the BootROM reads the boot mode setting specified by the bootstrap pins.

TPOR of the Programmable Logic

TPoR of PL is the voltage ramp time when the device is first powered on. This only comes into play when the board/device is first powered on. If the Board is already powered on and the Zynq-7000 device is reset, then since PL was already powered on, the TPoR does come into play. The following table indicates PL TPOR values to be considered for BootROM timing.

PS PoweredPL Powered SecureTPoR (ms)
YesNoNo0
YesYesNo0
YesYesYes35/50*

* For details on TPoR see Zynq-7000 All Programmable SoC Data Sheet: DC and AC Switching Characteristics (DS187 or DS191) at www.xilinx.com

The following cases are covered in the table above:

  • In non-secure boot, when both PS and PL are powered on, the BootROM does not wait for TPoR. The BootROM loads the FSBL into the OCM. Then, the FSBL can also start configuring the PS. If all these tasks take less than the TPoR and the user intends to load the PL bitstream, then the user needs to wait until the PL is ready, which will be after 35/50 ms from the point PL was powered on. In order to check if the PL is ready, user code needs to check for the PCFG_INIT bit in the DevC Status register before programming the bitstream. Details can be found in the PL Configuration section in the Zynq-7000 AP SoC Technical Reference Manual.
  • In secure boot mode, since the PL has to be powered on and the AES/SHA engine in the PL is used for decryption and authentication of the FSBL, the BootROM waits for the PL to be ready, which includes the TPoR for PL if the board is being powered up for the first time. If the board was already powered up and only the Zynq-7000 device is being reset, then since PL was already powered on, the TPoR does not come into the picture.


AES/SHA Decryption and Authentication

AES/SHA decryption and authentication can only take place in secure boot mode. In order to perform AES/SHA decryption and authentication when QSPI is used, the DMA in the device configuration block copies the encrypted image from the flash to the device configuration engine. In case of NAND, the image is copied into DDR and then the DMA in the Device Configuration copies it from DDR to the device configuration engine for decryption and authentication. The biggest impact on BootROM time is the waiting of the PL to be ready, as discussed above.

RSA Authentication

The BootROM also has the ability to authenticate a non-secure FSBL prior to execution using RSA public key authentication. This feature is enabled by blowing the RSA Authentication Enable fuse in the PS eFuse array. When RSA authentication is enabled, the BootROM starts by loading the FSBL into the OCM and then begins the authentication process. If the authentication passes, a non-secure FSBL will start execution. Failure to authenticate the FSBL triggers a fallback mode by the boot ROM. If a new FSBL is not found, the device enters a secure lockdown. In case RSA authentication is enabled, the BootROM initiates the authentication process, after the FSBL is loaded into the OCM. If the authentication passes, a secure FSBL is then decrypted using the AES. Failure to authenticate the FSBL triggers a fallback mode by the BootROM. If a new FSBL is not found, the device enters a secure lockdown.

BootROM Optimization

The default setting of BootROM for the boot interfaces is very slow. The boot interfaces can be made to run faster by setting registers. These settings are dependent on the devices being used and board layout parameters. Optimized values for the registers shown in the following examples should be obtained by vendor data sheets for the devices being used. Examples below show these settings for NAND and QSPI interfaces for specific devices on a board, so these settings may not be the optimized settings for your devices and board. Please use them as reference to what register settings can be modified.

These registers, which represent MIO multiplexer and flash clocks, are part of BootROM header. For more details, please refer to the BootROM Header section in chapter 6 of the Zynq-7000 AP SoC Technical Reference Manual.

NAND Examples

NANDx8 Non-Secure Register Initialization

/******* Register Inits *******/
.set. 0xF8000120 = 0x1F000200; // ARM_CLK_CTRL - divisor = 2 (433 MHz)
.set. 0xF8000148 = 0x00000921; // SMC_CLK_CTRL - divisor = 9 (96 MHz, 10.4ns)
.set. 0xE000E014 = 0x00225133; // SMC set_cycles - 2,1,1,2,1,3,3 see below*
.set. 0xE000E018 = 0x00000000; // SMC set_opmode - 8 bit
.set. 0xE000E010 = 0x02400000; // SMC direct_cmd - write set regs to NAND

*Bits for set_cycles:

     t6 - t_rr

     t5 - t_ar

     t4 - t_clr

     t3 - t_wp

     t2 - t_rea

     t1 - t_wc

     t0 - t_rc

For details, see Bit field definition in SMC register SET_CYCLES (0xE000E014) in Zynq-7000 AP SoC Technical Reference Manual.

NANDx8 Secure Register Initialization

/******* Register Inits *******/
.set. 0xF8000120 = 0x1F000200; // ARM_CLK_CTRL - divisor = 2 (433 MHz)
.set. 0xF8000148 = 0x00000921; // SMC_CLK_CTRL - divisor = 9 (96 MHz, 10.4ns)

NANDx16 Non-Secure Register Initialization

/******* Register Inits *******/
.set. 0xF8000120 = 0x1F000200; // ARM_CLK_CTRL - divisor = 2 (433 MHz)
.set. 0xF8000148 = 0x00000921; // SMC_CLK_CTRL - divisor = 9 (96 MHz, 10.4ns)
.set. 0xE000E014 = 0x00225133; // SMC set_cycles - 2,1,1,2,1,3,3 see below*
.set. 0xE000E018 = 0x00000001; // SMC set_opmode - 16 bit
.set. 0xE000E010 = 0x02400000; // SMC direct_cmd - write set regs to NAND

*Bits for set_cycles:

     t6 - t_rr

     t5 - t_ar

     t4 - t_clr

     t3 - t_wp

     t2 - t_rea

     t1 - t_wc

     t0 - t_rc

For details, see Bit field definition in SMC register SET_CYCLES (0xE000E014) in Zynq-7000 AP SoC Technical Reference Manual.

NANDx16 Secure Register Initialization

/******* Register Inits *******/
.set. 0xF8000120 = 0x1F000200; // ARM_CLK_CTRL - divisor = 2 (433 MHz)
.set. 0xF8000148 = 0x00000921; // SMC_CLK_CTRL - divisor = 9 (96 MHz, 10.4ns)

QSPI Example

QSPI Non-Secure Register Initialization

/******* Register Inits *******/
.set. 0xF8000120 = 0x1F000200; // ARM_CLK_CTRL - divisor = 2 (433 MHz)
.set. 0xF8000720 = 0x00000602; // MIO_PIN_08 - QSPI FB clock, 3.3 V
.set. 0xF800014C = 0x00000521; // LQSPI_CLK_CTRL - divisor = 5 (173 MHz)
.set. 0xE000D000 = 0x800238C1; // QSPI config - divide-by-2 (86 MHz)
.set. 0xE000D038 = 0x00000020; // QSPI loopback - internal, 0 delay.set. 0xE000D0A0 = 0x82FF04EB; // LQSPI_CFG - QIOREAD mode, Numonyx/Micron

QSPI Secure Register Initialization

/******* Register Inits *******/
.set. 0xF8000120 = 0x1F000200; // ARM_CLK_CTRL - divisor = 2 (433 MHz)
.set. 0xF800014C = 0x00000621; // LQSPI_CLK_CTRL - divisor = 6, (144 MHz)

Dual QSPI Non-Secure Register Initialization

/******* Register Inits *******/
.set. 0xF8000120 = 0x1F000200; // ARM_CLK_CTRL - divisor = 2 (433 MHz)
.set. 0xF8000720 = 0x00000602; // MIO_PIN_08 - QSPI FB clock, 3.3 V
.set. 0xF800014C = 0x00000521; // LQSPI_CLK_CTRL - divisor = 5 (173 MHz)
.set. 0xE000D000 = 0x800238C1; // QSPI config - divide-by-2 (86 MHz)
.set. 0xE000D038 = 0x00000020; // QSPI loopback - internal, 0 delay
//.set. 0xE000D0A0 = 0xE2FF06EB; // LQSPI_CFG - QIOREAD mode, Numonyx/Micron
.set. 0xE000D0A0 = 0xE2FF02EB; // LQSPI_CFG - QIOREAD mode, Winbond/Spansion


Dual QSPI Secure Register Initialization

/******* Register Inits *******/
.set. 0xF8000120 = 0x1F000200; // ARM_CLK_CTRL - divisor = 2 (433 MHz)
.set. 0xF800014C = 0x00000621; // LQSPI_CLK_CTRL - divisor = 6, (144 MHz)

Note: Size of the image loaded on the boot device is 128 KB. The Reference Clock Frequency used is 33.33 MHz

Loading Images

The time it takes to boot the rest of the images depends on the size of the images and the boot interface used. In order to get a rough estimate of boot time for your application, please provide the information in Design Details section to your FAE.

Design Details

Please collect the following details in order to obtain an estimated boot time for your design using the attached spreadsheet.

Mode Option Comments
Boot TypeSecure/Non-secure
Zynq DeviceZ-7010/Z-7015/Z-7020/Z-7030/Z-7045/Z-7100
OSBare Metal/Linux

If known, provide size of application code and/or Linux image, otherwise ask FAE for the default size that the boot time estimate is based on. If known, provide following information:

  • Size of application code
  • Size of Linux Kernel, RAM Disk, Device Tree and Uboot 
Vendor Micron/Spansion
Boot DeviceNAND/QSPI
Device Configuration

NAND: x8/x16
QSPI: Single/Dual Stacked/Dual Parallel

Voltage 1.8v/3.3v
AuthenticationNone/AES/RSA/AES+RSANon-Secure: None/RSA
Secure: AES/RSA/AES+RSA
QSPI Type>128Mb or <128Mb
BootROM CRCEnable 128Kb CRC check for BootROM

Attachments

Associated Attachments

Name File Size File Type
Zynq-7000_Boot_time_estimator_QSPI_NAND_rev2.7.xlsm 125 KB XLSM
AR# 55572
Date Created 04/16/2013
Last Updated 09/08/2016
Status Active
Type General Article
Devices
  • Zynq-7000