Boot chain

STM32MP parts are Cortex-A microprocessors running Linux, not Cortex-M microcontrollers. "MPU" here means microprocessor unit; the memory protection unit on the MCU side is a different thing that shares the abbreviation.

Where an MCU jumps straight from the reset vector into your main(), an MPU hands control through several stages, each initialising enough hardware for the next one to run in a larger memory.

Overview

ROM code
  → First stage boot loader (FSBL)
  → Second stage boot loader (SSBL)
  → Linux kernel
  → Linux user space

ROM code

• Executes from mask ROM inside the chip; cannot be modified.
• Selects the boot device from the boot pins — a serial link (USB/UART, for flashing) or flash (SD, eMMC, NAND, NOR).
• The first link in the chain of trust: on a secured part it authenticates and decrypts the FSBL before running it.

First stage boot loader (FSBL)

• Runs from internal SRAM, because the external RAM controller is not up yet. SRAM is small, which is why this stage is minimal.
• Initialises part of the clock tree and the DDR controller.
• Loads the SSBL into external RAM and jumps to it.
• Implemented by Trusted Firmware-A (TF-A BL2).

Second stage boot loader (SSBL)

• Runs from external RAM, so it has room for complex features: USB, Ethernet, display, file systems.
• Loads the kernel, device tree and initramfs, then boots them.
• Implemented by U-Boot.

Linux kernel

• Executes from external memory.
• Initialises all the peripheral drivers.

Linux user space

• Runs the initialisation described in the root file system (rootfs).
• Brings up services and the user interface.

Other services

Service	Started at	Applies to
Secure monitor (Cortex-A)	FSBL	MP13x, MP15x
Coprocessor firmware (Cortex-M)	SSBL, or the Linux kernel by default	MP15x

STM32MP13

Single Cortex-A7, no Cortex-M coprocessor.

ROM code

• Starts the processor in secure mode.
• Authenticates and decrypts the FSBL.

FSBL

• Executed from SYSRAM.
• Initialises part of the clock tree and the DDR controller.
• Loads the SSBL into external RAM and jumps to it.

SSBL

• U-Boot.

Linux

• Loaded into DDR by U-Boot.
• Executed in the non-secure context.

Secure OS and secure monitor

The Cortex-A7 secure world supports the OP-TEE secure OS. Secure and non-secure worlds run on the same core, switched through the secure monitor, which is why Linux never sees the secure peripherals directly.

STM32MP15

Adds a Cortex-M4 coprocessor alongside the Cortex-A7 cores.

The coprocessor's STM32Cube firmware can be started either by U-Boot at SSBL level using the remoteproc feature (rproc command), or later by the Linux remoteproc framework, which is the default. The choice is driven by the application's start-up time target: starting from U-Boot gets the real-time firmware running much earlier, at the cost of complicating the boot flow.

The Cortex-M4 side is programmed with the same HAL and CMSIS as a standalone STM32 — see STM32 MCU — with the addition of the inter-processor communication (IPCC) and shared-memory conventions that remoteproc and RPMsg define.