Just to elaborate, I found this code in arch/arm/cpu/armv7/mx6/soc.c:
void boot_mode_apply(unsigned cfg_val)
{
unsigned reg;
struct src *psrc = (struct src *)SRC_BASE_ADDR;
writel(cfg_val, &psrc->gpr9);
reg = readl(&psrc->gpr10);
if (cfg_val)
reg |= 1 << 28;
else
reg &= ~(1 << 28);
writel(reg, &psrc->gpr10);
}
/*
* cfg_val will be used for
* Boot_cfg4[7:0]:Boot_cfg3[7:0]:Boot_cfg2[7:0]:Boot_cfg1[7:0]
* After reset, if GPR10[28] is 1, ROM will copy GPR9[25:0]
* to SBMR1, which will determine the boot device.
*/
cfg_val is 0x01 in the case of "bmode usb". None of these bits are documented in the RM, BTW.