Thank you for help me!
How to ascertain the address of RCW in the NOR Flash if I rewrite the flash content. I know the 32M NOR flash starts at address 0xFE000000, the location for U-Boot is fixed(0xfe00_000--0xfe09_ffff)。
the 32M NOR flash contents:
0xfe00_0000 - 0xfe09_ffff U-Boot
0xfe0e_0000 - 0xfe0f_ffff DTB
0xfe10_0000 - 0xfe3f_ffff Kernel
0xfe7e_0000 - 0xfe7e_ffff QE ucode
0xfe80_0000 - 0xfeff_ffff Ramdisk file system
where does the device loads a reset configuration word from NOR Flash?