--- a/bootrom.notes	Tue Apr 16 06:59:35 2013 +0000
+++ b/bootrom.notes	Tue Apr 16 20:56:31 2013 +0000
@@ -1,3 +1,33 @@
+Application images in flash:
+
+In order for the nCS0 flash content to be considered a valid bootable image
+(i.e., for the boot ROM to transfer control to it, rather than wait forever
+for a UART download), the 32-bit word at address 0x2000 (the first word
+after the ROM-overlaid portion) must contain either 0 or 1, corresponding
+to two supported environment options:
+
+* If the word at 0x2000 equals 0, it signifies an application image that is
+  designed to run with the boot ROM still mapped at 0, with ARM exceptions
+  vectoring through the 7 magic RAM locations at 0x80001C, and possibly
+  through the 2nd level ("user-friendly") vector table at 0x800000 as well.
+
+  If the word at 0x2000 equals 0, the following word at 0x2004 must contain
+  the absolute address of the boot entry point; the boot ROM will transfer
+  control to that address with the FFFF:FB10 register set to explicitly map
+  the internal boot ROM at 0.  It is a BX-style address: setting the least
+  significant bit will result in control being transferred in the Thumb state.
+
+* If the word at 0x2000 equals 1, it signifies an application image that is
+  at least conceptually independent of the Calypso boot ROM - one that would,
+  at least in theory, function correctly with nIBOOT tied/pulled/driven HIGH,
+  or even on an older DBB chip with no internal boot ROM.
+
+  When the boot ROM code sees a 1 in the 0x2000 word, it copies a little piece
+  of code into the internal ROM and runs it there; this code sets the FFFF:FB10
+  register to disable the internal boot ROM (map the external nCS0 memory at 0,
+  as if nIBOOT were high) and causes the watchdog timer to go off, resetting
+  the ARM core and causing it to execute the external nCS0 reset vector.
+
 RAM layout:
 
 800000 7 words: