When the SoC is powered on the Boot ROM starts and tries to load the IPL from somewhere and tries to jump into it. The Boot ROM outputs some limited messages at 38400 baud. All of the IPLs so far use 115200 baud so this results in the Boot ROM messages showing as junk before the IPL output.
There seem to be some strap pins to tell the boot rom which media to boot from. Booting from eMMC, SD card, NAND and SPI NOR are apparently supported.
At the end of the Boot ROM for infinity 3 forward there seems to be an ASCII tag that contains the git hash the ROM was built from.
BROM Tag/Signature can be viewed by using the u-boot command
md.b 0x3fe0 0x20 or
md.b 0x7fe0 0x20.
For SMP systems all cores boot the same boot ROM but all CPUs other than 0 stop in a loop that waits for an interrupt and checks if the boot address and magic number are valid. When an interrupt comes and the registers are valid the secondary CPU will jump to the address.
Enable capture in minicom and then at the u-boot prompt enter
md.b 0x0 0x8000
Then clean up the header and footer of the capture so there are no extra lines and use uboot-mdb-dump to turn the dump into a binary. Make sure the binary has a tag at the end. Some ROMs are 16KB and some are 32KB so check the 32KB dump to see if it repeats and turncate it with dd if needed like so:
dd if=bootrom.bin of=fixed_bootrom.bin bs=1024 count=16