Boot ROM and ELF loader

The boot ROM detects two block devices, mounts their file systems, associates ELF, YAML and data directories, loads valid ELF32 images into IMEM/DMEM and then transfers control to the application.

Boot sequence

Reset initializes IMEM, DMEM and devices. Hart 0 starts at 0x00000000.
Secure boot releases boot_ok and mpu_lock when metadata checks pass.
The boot ROM initializes the HPS block bridge at 0xffff00c0.
Program and data images are treated as block devices and mounted through FAT/exFAT helpers.
The program drive is detected through root-level *.elf files.
The data drive is detected through the /data directory.
The first valid app is matched as /name.elf, /config/name.yaml and /data/name.
YAML is parsed into an internal app configuration.
ELF headers and program headers are validated.
Executable segments are written through the IMEM loader; data segments and BSS go to DMEM.
Start parameters and optional bundles for services such as HarvTTP are placed in DMEM.
The IMEM loader is locked.
The boot ROM sets a0 = params_addr, initializes sp and jumps to the ELF entry.

USB image layout

Program image

/
  harvttp.elf
  harvsql.elf
  config/
    harvttp/harvttp.yaml
    harvsql/harvsql.yaml
    harvsql/runtime.yaml
  config/harvsql/seed/
  config/harvsql/migrations/

Data image

/
  data/
    harvttp/
      webroot/
    harvsql/
      db/
        catalog.hsq

ELF validation

Check	Rule
Magic	`0x7f 'E' 'L' 'F'`.
Class/data	`ELFCLASS32`, `ELFDATA2LSB`.
Type/machine	`ET_EXEC`, `EM_RISCV`.
Header sizes	`ehsize` and `phentsize` must match the boot-ROM structures.
Program headers	`phnum > 0` and no more than 16.
Segment bounds	`filesz <= memsz`, no overflow, file offsets inside the image.
Alignment	`vaddr` must be 4-byte aligned.
W^X	Segments with both `PF_W` and `PF_X` are rejected.
Entry	The entry point must lie inside an executable `PT_LOAD` segment.

Load behavior

for each PT_LOAD phdr:
  reject if phdr.flags has both PF_W and PF_X
  if phdr.flags has PF_X:
    write_exec_segment_via_imem_loader(phdr)
  else:
    copy_to_dmem(phdr.filesz)
    zero_bss(phdr.memsz - phdr.filesz)

Error behavior

Boot errors are exposed through a debug word at 0x00000420. Status values begin with 0xB001....; failures are encoded as 0xBAD00000 | status. The current boot ROM starts the first valid app. A production multi-app path should load a supervisor first and let it isolate and schedule service ELFs.