# Cold boot flow
Source: [https://docs.qualcomm.com/doc/80-88500-4/topic/9_Cold_boot_flow.html](https://docs.qualcomm.com/doc/80-88500-4/topic/9_Cold_boot_flow.html)
Cold boot is a process of starting the system from a power-off state. Cold boot begins with the execution of the primary boot loader (PBL).
The following figure shows the cold boot flow. The PBL initializes the hardware and acts as an interface between the hardware and system software.
The following sequence corresponds to the cold boot flow shown in the figure:
1. After reset, the Qualcomm^®^ Kryo™ CPU Silver core 0 comes out of reset and executes the PBL.
On the Kryo Silver core 0, the applications PBL initializes the hardware (clocks, and so on), CPU caches, and memory management unit (MMU), and then detects the boot device as per the boot option configuration:
Default boot option: Overridden by the Emergency Download (EDL) cookie or force USB general-purpose input/output (GPIO)
2. The application processor PBL loads and authenticates the following:
1. XBL\_SEC (region #0) from the boot device to boot on-chip internal memory (OCIMEM)
2. XBL\_Loader (region #1) from the boot device to boot internal memory (IMEM)
3. XBL\_Debug (region #2) from the boot device to OCIMEM (jumps to XBL\_SEC)
3. XBL\_SEC runs the security configuration in Exception Level (EL) 3 mode and executes the XBL\_Loader in EL1 mode.
4. XBL\_Loader performs the following:
1. Initializes hardware and firmware images, CPU caches, MMU, boot
device, XBLConfig, PMIC driver, DDR, system hardware resource manager (SHRM), and shared
memory (SMEM), fills the platform ID and RAM partition table, and performs DDR training,
if applicable
2. Executes a secure call manager (SCM) call to XBL\_SEC to initialize the pseudo IMEM (pIMEM), initializes the clocks, and configures the clock frequencies as per the clock plan
3. Loads and authenticates the application processor debug policy (APDP) image from the boot device. If the DLOAD cookie is set, it loads and authenticates the XBL RAM dump and jumps to XBL RAM dump to collect the crash dump
4. Loads and authenticates the multi-image signing and integrity check (MISC) image from the boot device
5. Loads and authenticates the always-on processor (AOP) image from the boot device
6. XBL\_SEC brings the AOP out of reset
7. Loads and authenticates the TrustZone (TZ) device configuration (DEVCFG) image from the boot device; loads and authenticates the Qualcomm® Trusted Execution Environment (Qualcomm TEE) image from the boot device; loads the SEC.dat (fuse blowing data) image from the boot storage if the image exists
8. Loads and authenticates the Qualcomm hypervisor execution environment (QHEE) image from the boot device
9. Loads and authenticates the eXtensible boot loader (XBL) core image from the boot device
10. Executes an SCM call to XBL\_SEC to jump to the Qualcomm TEE cold boot
5. The Qualcomm TEE sets up the secure environment and executes the QHEE image.
6. The QHEE executes the XBL\_CORE (or XBL region #3), and then XBL\_CORE mounts and runs the unified extensible firmware interface (UEFI) application processor (ABL firmware volume (FV)).
7. The Linux loader application (part of ABL FV) loads and authenticates the HLOS kernel with Verified Boot. After it is in the HLOS, the peripheral image loader (PIL) driver executes SCM calls to request secure PIL driver, authenticates the images, and brings each subsystem out of reset.
8. The PIL driver in HLOS loads the secure processor (SP), executes an SCM call to request secure PIL driver, and authenticates the firmware.
9. The PIL brings the SP out of reset, and the SP PBL decrypts the image and loads it into SP SRAM.
10. The PIL driver in the HLOS loads the video processing unit (VPU) to DDR and configures the clocks and power rails, if necessary. The PIL driver in HLOS executes an SCM call to request a secure PIL driver, authenticates the VPU, and brings it out of reset.
11. The PIL driver in HLOS loads the camera image, executes an SCM call to request secure PIL driver, authenticates the firmware, and brings it out of reset.
12. The PIL driver in HLOS loads the LPASS, executes an SCM call to request secure PIL driver, authenticates the firmware, and brings it out of reset.
13. The PIL driver in HLOS loads the sensor core firmware, executes an SCM call to request secure PIL driver, authenticates the firmware, and brings it out of reset.
14. The PIL driver in HLOS loads the Compute image, executes an SCM call to request secure PIL driver, authenticates the firmware, and brings it out of reset.
15. The PIL driver in HLOS loads the NPU image, executes an SCM call to request secure PIL driver, authenticates the firmware, and brings it out of reset.
Note: The mdm\_helper may start earlier depending on when the INIT daemon gets to run. The application runs asynchronously with the kernel.
Table : Cold boot components
| Component | Based on processor | Loaded from | ZI/RW allocated in | Executes in | Function |
| --- | --- | --- | --- | --- | --- |
| Applications PBL | Kryo CPU Silver core 0 | – | Boot IMEM | ROM |
- Establishes a secure root of trust (ROT) for secure boot
- Boots device, detects interface, and provides EDL mode support
- Loads the XBL segments (XBL-Loader and XBL-SEC) to boot IMEM and OCIMEM (system IMEM)
- Decrypts and authenticates the XBL segments
|
| XBL-SEC | Kryo Silver core 0 | UFS | OCIMEM | OCIMEM |
- Runs in secure EL3 and sets up external protection units (xPU)
- Provides critical functionalities such as authentication and pIMEM initialization to XBL-loader running in nonsecure EL1
- Debugs policy support
- Transfers execution to Qualcomm TEE image running in EL3 in runtime
|
| XBL loader | Kryo Silver core 0 | UFS | Boot IMEM, OCIMEM, LPDDR5/ LPDDR4X | Boot IMEM |
- Initializes the memory subsystem (buses, LPDDR, clocks, and configuration data table (CDT))
- Loads and authenticates the Qualcomm TEE, QHEE, AOP_Firmware, XBL-Core, and SHRM images through XBL_SEC
- Supports image rollback prevention
- Supports system drivers – PMIC, USB, charging, thermal check, and DDR training
- Resets debug support (on warm reset) – XBL-Loader to load XBL-RAM dump to LPDDR, XBL-RAM dump to support display with font support, crash dump through USB/Sahara protocol, and crash dump to storage (SD/UFS)
|
| MISC | Kryo Silver core 0 | UFS | N/A | Boot IMEM, LPDDR5/LPDDR4X | Collates post-XBL image hashes and optimizes total authentication time |
| SHRM | – | UFS | SHRM DataRAM, system cache | SHRM CodeRAM, system cache |
- Supports boot-time DDR frequency switch to initialize and train DDR
- Provides runtime DDR power management (Clock (XO) shutdown, power collapse, and DDR frequency switching) and system cache management
- Provides reset debug support (DDR out of self-refresh)
|
| AOP | Arm^®^ Cortex^™^-M3 processor | UFS | AOP DataRAM, LPDDR5/LPDDR4X | AOP CodeRAM |
- Initiates the AOP firmware
- Handles dependencies, complex aggregations, and corner cases that are not covered in the hardware accelerators
|
| Qualcomm TEE (TZ) | Kryo Silver cores and Gold cores | UFS | OCIMEM, pIMEM, LPDDR5/ LPDDR4X | OCIMEM, pIMEM
LPDDR5/LPDDR4X |
- Runs in secure EL3/EL1, equivalent to the TZ BSP environment
- Sets up the secure run-time execution environment (EE)
- Configures the xPU
- Supports the fuse driver
|
| QHEE (HYP) | Kryo Silver cores and Gold cores | UFS | LPDDR5/ LPDDR4X | LPDDR5/ LPDDR4X |
- Runs in nonsecure EL2
- Configures the CPU/SMMU Stage 2 memory mappings
- Secures the PIL support
|
| XBL-Core + application processor | Kryo Silver core 0 | UFS | LPDDR5/ LPDDR4X | LPDDR5/ LPDDR4X |
- Initiates the HLOS-specific and feature-rich boot loader
- Supports the UEFI features
|
| HLOS | Kryo Silver/Gold cores | UFS | LPDDR5/ LPDDR4X | LPDDR5/ LPDDR4X |
- Initiates the HLOS kernel and applications
- Runs in nonsecure EL1 and EL0
|
| SP PBL | SC-300 | – | SP SRAM | ROM |
- Establishes the SP ROT
- Loads the SP image to the SP SRAM
- Decrypts and authenticates the SP image
- Enables the SP SRAM obfuscation
|
| SP ROM | SC-300 | – | SP SRAM | ROM | Provides security post boot services for the SP image |
| SP main control program (MCP) image | SC-300 | UFS | SP SRAM | SP SRAM | Initiates the SP MCP image |
**Parent Topic:** [Boot](https://docs.qualcomm.com/doc/80-88500-4/topic/8_Boot_.html)
Last Published: Aug 18, 2023
[Previous Topic
Boot](https://docs.qualcomm.com/bundle/publicresource/80-88500-4/topics/8_Boot_.md) [Next Topic
Configuration data table for boot loader](https://docs.qualcomm.com/bundle/publicresource/80-88500-4/topics/10_Boot_loader_configuration.md)