If you like BoxMatrix then please contribute Supportdata, Supportdata2, Firmware and/or Hardware (get in touch).
My metamonk@yahoo.com is not reachable by me since years. Please use hippie2000@webnmail.de instead.

0
U

Property:SBL

From BoxMatrix

BoxMatrix >> Lexicon >> Computer-Terms >> SBL @ BoxMatrix   -   IRC-Chat   -   Translate: de es fr it nl pl
News Selectors Models Accessories Components Environment Config Commands System Webif Software Develop Lexicon Community Project Media
Computer FRITZ I18N Telephony Smarthome Internet Protocols Multimedia Formats Hardware Software Research

Term

Term: SBL Wiki Freetz IPPF whmf AVM Web
Short for: Secondary BootLoader
Location: Lexicon >> Computer-Terms
Weblinks: Wikipedia.int
Description: Second stage of the boot process on ARM based systems

Goto:   FRITZ!OS   -   Hawkeye  -  Alder  -  Miami  -  Dakota  -  Maple  -  SMW-Browser

Details

The SBL is the Secondary Bootloader executed by the Primary Bootloader (PBL).

It is part of the SecureBoot concept as used for Android and other modern ARM based systems.

The PBL is typically located on chip in the Boot-ROM (aka SecureCore) and is placed there by the chip manufacturer.
The SBL is a signed executable located on external storage and is customized by the device vendor.

The PBL searches for bootable media (flash), locates the SBL in it, validates its signature and executes it.

FRITZ!OS

In FRITZ!OS the SBL and all configuration and code chunks it requires are stored platform dependend.

SBL1 is *the* SBL here. On other platforms there may also be a SBL2 and SBL3.
CDT stores platform information and memory parameters[1].
QSEE is the TrustZone OS, on the 7520v1 it is loaded in 3 instances, likely into 3 cores.
APPSBL is the AVM bootloader EVA. See also the Multi-EVA article.

Multi-EVA boot on Qualcomm-ARM:

Hawkeye

On Hawkeye these chunks are stored on separate eMMC partitions.
Most original partition names are prepended by a 0:, which was removed for Mediawiki conventions:

Besides SBL1, tffs and data everything is stored twice. If one instance fails the other is used instead.

Alder

The Alder uses eMMC partitions similar to the Hawkeye, but adds a second SBL1 partition.
Besides this it adds 2 RPM partitions and 2 APDP partitions.
Most original partition names are prepended by a 0:, which was removed for Mediawiki conventions:

Besides tffs and data everything is stored twice. If one instance fails the other is used instead.

Miami

The Miami uses eMMC partitions similar to the Hawkeye, but adds a second SBL1 partition.
Besides this the 2 RPM partitions were replaced by 2 TME partitions.
Most original partition names are prepended by a 0:, which was removed for Mediawiki conventions:

Besides tffs and data everything is stored twice. If one instance fails the other is used instead.

Dakota

On Dakota all chunks are merged together into the mtd2 partition, and are not mounted separately.
On a 7520v1 the mtd2 partition spans 2.75 MB (0x2C0000 bytes) with this internal partition layout:

  • 0x000000 - 0x080000   -   SBL1 - Secondary Bootloader Stage 1 (512k)
  • 0x080000 - 0x100000   -   MIBIB - Multi-Image Boot Information Block #0 / #1 (512k)
  • 0x100000 - 0x180000   -   QSEE - Qualcomm Secure Execution Environment - TrustZone #0 (512k)
  • 0x180000 - 0x1C0000   -   CDT - Qualcomm platform Configure Data Table (256k)
  • 0x1C0000 - 0x240000   -   QSEE_B - Qualcomm Secure Execution Environment - TrustZone #1 (512k)
  • 0x240000 - 0x280000   -   APPSBL_B - Application Secondary Bootloader - EVA #1 (256k)
  • 0x280000 - 0x2C0000   -   APPSBL - Application Secondary Bootloader - EVA #0 (256k)

Only the TrustZone and EVA are stored in 2 instances here. The MIBIB partition contains 2 enumerated instances of itself

Excerpt from the failing 7520v1 PBL / SBL Serial-Console log[2] (Dakota): 

Format: Log Type - Time(microsec) - Message - Optional Info
Log Type: B - Since Boot(Power On Reset),  D - Delta,  S - Statistic

S - QC_IMAGE_VERSION_STRING=AVM_BOOT.BF.3.1.1
S - IMAGE_VARIANT_STRING=DAABANAZA
S - OEM_IMAGE_VERSION_STRING=1204
S - Boot Config, 0x00000025
S - Reset status Config, 0x00000000
S - Core 0 Frequency, 0 MHz

B -       261 - PBL, Start
B -      1339 - bootable_media_detect_entry, Start
B -      2612 - bootable_media_detect_success, Start
B -      2626 - elf_loader_entry, Start
B -      4044 - auth_hash_seg_entry, Start
B -      5975 - auth_hash_seg_exit, Start
B -    110185 - elf_segs_hash_verify_entry, Start
B -    301613 - PBL, End

B -         0 - SBL1, Start
B -    401997 - pm_device_init, Start
D -         9 - pm_device_init, Delta
B -    403122 - boot_flash_init, Start
D -     80146 - boot_flash_init, Delta
B -    487612 - boot_config_data_table_init, Start
D -     13964 - boot_config_data_table_init, Delta - (419 Bytes)
B -    504033 - clock_init, Start
D -      7430 - clock_init, Delta
B -    514437 - CDT version:2,Platform ID:8,Major
B -    515742 - sbl1_ddr_set_params, Start
B -    520450 - cpr_init, Start
D -         4 - cpr_init, Delta
B -    525528 - Pre_DDR_clock_init, Start
D -         5 - Pre_DDR_clock_init, Delta
D -     13021 - sbl1_ddr_set_params, Delta
B -    538923 - pm_driver_init, Start
D -         4 - pm_driver_init, Delta
B -    574161 - sbl1_wait_for_ddr_training, Start
D -        30 - sbl1_wait_for_ddr_training, Delta
B -    590282 - Image Verify, Start 0:QSEE
D -    283753 - QSEE Image Loaded, Delta - (293144 Bytes)
B -    874350 - Image Verify, Start 0:QSEE_B
D -    286531 - QSEE Image Loaded, Delta - (293144 Bytes)
B -   1161237 - Selected TZ0: 10228 (0:QSEE)
B -   1164298 - Image Load, Start
D -    286442 - QSEE Image Loaded, Delta - (293144 Bytes)
B -   1451053 - Image Load, Start
D -      2029 - SEC Image Loaded, Delta - (2048 Bytes)
B -   1464613 - Image Verify, Start 0:APPSBL
B -   1589146 - Image Verification failed (689)
D -    124890 - APPSBL Image Loaded, Delta - (118924 Bytes)
B -   1593278 - Image Verify, Start 0:APPSBL_B
B -   1721701 - Image Verification failed (689)
D -    128781 - APPSBL Image Loaded, Delta - (118924 Bytes)
B -   1725781 - No verified EVA in flash!!! Booting not possible!!!

Fixing this would have required a RAM-Boot running urladerupdate.
But that's not possible without a working EVA, so there's only EJTAG left.

Maple

On Maple all chunks are also merged together into the mtd2 partition, and are not mounted separately.
On a fsgw the mtd2 partition spans 5.25 MB (0x540000 bytes) with this internal partition layout:

  • 0x000000 - 0x080000   -   SBL1 - Secondary Bootloader Stage 1 (512k)
  • 0x080000 - 0x100000   -   MIBIB - Multi-Image Boot Information Block #0 / #1 (512k)
  • 0x100000 - 0x140000   -   DEVCFG - Device Configuration (256k)
  • 0x140000 - 0x180000   -   CDT - Qualcomm platform Configure Data Table (256k)
  • 0x180000 - 0x280000   -   QSEE - Qualcomm Secure Execution Environment - TrustZone #0 (1M)
  • 0x280000 - 0x380000   -   QSEE_1 - Qualcomm Secure Execution Environment - TrustZone #1 (1M)
  • 0x380000 - 0x400000   -   APPSBL - Application Secondary Bootloader - EVA #0 (512k)
  • 0x400000 - 0x480000   -   APPSBL_1 - Application Secondary Bootloader - EVA #1 (512k)
  • 0x480000 - 0x4C0000   -   CONFIG_0 - AVM factory data #0 (256k)
  • 0x4C0000 - 0x500000   -   CONFIG_1 - AVM factory data #1 (256k)
  • 0x500000 - 0x540000   -   unused (256k)

Only the TrustZone and EVA are stored in 2 instances here. The MIBIB partition contains 2 enumerated instances of itself

References
  1. ↑ Qualcomm platform CDT analysis and production method
  2. ↑ 7520 boot log captured by Insti

SMW-Browser

Property:SBL
Information is currently being retrieved from the backend.
 

Synonyms

Showing 1 related property.

S

Retrieved from "https://boxmatrix.info/w/index.php?title=Property:SBL&oldid=174256"