tree 3ecdbefe6c3caa462863a371bc7ad0725eccfb22
parent a07394dc003f7aae87beb8d1e983b5ec087e5266
author Sam Elliott <selliott@lowrisc.org> 1595503652 +0100
committer Sam Elliott <sam@lenary.co.uk> 1595973649 +0100

[mask rom] More Detailed Boot Pseudo-code

This is based off discussions we had in the meeting, and comments on the
previous PR (lowrisc/opentitan#2937), and a few private discussions.

The main change to the pseudo-code is the explicit handling of multiple
rom_ext manifests in a priority order (and the possibility of the boot
policy aborting boot of the primary rom_ext, but continuing with
subsequent rom_exts).

Another big change here is to document which parts of mask rom execution
can only happen after a ROM_EXT has been verified. Verifying this
signature is not the final thing the mask rom does.

Explicit stages have been added to cover:
- Enabling any software-enabled memory protection, which covers SRAM
  scrambling and if the software has to set up PMP regions (both of
  which are still open questions).
- Manufacturing boot-strapping process.

I have also tried to clarify how I see the split between the assembly
that cleans the device state and the C code which cleans the remaining
device state.

I have also done some markdown cleanups.

Signed-off-by: Sam Elliott <selliott@lowrisc.org>