If you like BoxMatrix then please contribute Supportdata, Supportdata2, Firmware and/or Hardware (get in touch).
My metamonk@yahoo.com is not reachable by me since years. Please use hippie2000@webnmail.de instead.
Property:SBL1
| BoxMatrix >> System >> SBL1 | @ BoxMatrix - IRC-Chat - Translate: de es fr it nl pl |
| News | Selectors | Models | Accessories | Components | Environment | Config | Commands | System | Webif | Software | Develop | Lexicon | Community | Project | Media |
| Devices | Filesystems | Partitions | Sockets | Netlink | Pipes | Interfaces | Bridges | Ports | Events | Sources | Sinks | AVMIPC | Processes | Watchdogs | Memory | Slab | Vmalloc | ProcFS | SysFS | Research |
Linux-Partition
| Partition: | SBL1 - type Part | Wiki | Freetz | IPPF | whmf | AVM | Web |
| Location: | System >> Linux-Partitions - Origin: AVM | ||||||
| Device: | mmcblk0p2 | ||||||
| Properties: | Firmware: 7.27 - 7.81 | ||||||
| Function: | ARM Secondary Boot Loader (SBL) Stage 1 #0 (Hawkeye, Miami). | ||||||
Goto: Dakota - Dependencies - Model-Matrix - Missing Supportdata - SMW-Browser
Details
SBL1 contains the first (and only) stage of the Secondary Boot Loader SBL and is explained there.
On other (non AVM) platforms like Android there may also be a SBL2 and SBL3.
The Miami introduces a second instance of SBL1 named SBL1_1.
The label of this partition is originally named 0:SBL1, which is an invalid article name in Mediawiki.
Multi-EVA boot on Qualcomm-ARM:
- SoCs: Hawkeye, Alder, Miami, Dakota, Maple
- Lexicon: PBL, SBL, TrustZone, EVA
- Procfs: sbl_version, sbl_reboot, struct_version
- Procfs: sbl_fault_register, sbl_reset_debug, sbl_wdog_status, sbl_wonce
- Procfs: tz0_verified, tz0_version, tz1_verified, tz1_version
- Procfs: tz_boot_ack, tz_boot_index, tz_version
- Procfs: eva0_verified, eva0_version, eva1_verified, eva1_version
- Procfs: eva_boot_ack, eva_boot_index
- Firmware: sblupdate, tzupdate, urladerupdate
- Commands: tz_update
- Startup: E02-tz_update, cortexa9, cortexa9.service
- Partitions: GPT, alignto512, align_config_to_4mb, SBL1, SBL1_1, MIBIB
- Partitions: BOOTCONFIG, BOOTCONFIG1, QSEE, QSEE_1, DEVCFG, DEVCFG_1, RPM, RPM_1
- Partitions: CDT, CDT_1, APPSBL, APPSBL_1, CONFIG, CONFIG_1, TME, TME_1
- Kconfig: CONFIG_AVM_FASTIRQ, CONFIG_AVM_TZ_EXTENSIONS, CONFIG_QSEECOM
- Kernel: avm_sbl.ko, avm_tz.ko, qseecom.ko, ipq40xx_qseecom.ko
Dakota
There's an ELF executable at offset 0x2800, prepended by 4 SBL1 image magics.
me@home:~/bin$ binwalk 7520_sbl.bin DECIMAL HEXADECIMAL DESCRIPTION
0 0x0 Qualcomm SBL1, image addr: ffffffff, image size: 4294967295, code size: 4294967295, sig size: 4294967295, cert chain size: 4294967295, oem_root_cert_sel: 4294967295, oem_num_root_certs: 4294967295 2048 0x800 Qualcomm SBL1, image addr: ffffffff, image size: 4294967295, code size: 4294967295, sig size: 4294967295, cert chain size: 4294967295, oem_root_cert_sel: 4294967295, oem_num_root_certs: 4294967295 4096 0x1000 Qualcomm SBL1, image addr: ffffffff, image size: 4294967295, code size: 4294967295, sig size: 4294967295, cert chain size: 4294967295, oem_root_cert_sel: 4294967295, oem_num_root_certs: 4294967295 6144 0x1800 Qualcomm SBL1, image addr: ffffffff, image size: 4294967295, code size: 4294967295, sig size: 4294967295, cert chain size: 4294967295, oem_root_cert_sel: 4294967295, oem_num_root_certs: 4294967295 10240 0x2800 ELF, 32-bit LSB executable, ARM, version 1 (SYSV) 131072 0x20000 Qualcomm SBL1, image addr: 6830ffa7, image size: 2970839043, code size: 1176526877, sig size: 537067429, cert chain size: 1174713656, oem_root_cert_sel: 1746429955, oem_num_root_certs: 620802368 212920 0x33FB8 Unix path: /dev/icbcfg/boot
The values of the 4 magic headers above are all wrong since they are 0xffffffff.
me@home:~/bin$ hexdump -C 7520_sbl.bin | head -n 15 00000000 d1 dc 4b 84 34 10 d7 73 5a 43 0b 7d ff ff ff ff !..K.4..sZC.}....! 00000010 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff !................! * 00000800 d1 dc 4b 84 34 10 d7 73 5a 43 0b 7d ff ff ff ff !..K.4..sZC.}....! 00000810 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff !................! * 00001000 d1 dc 4b 84 34 10 d7 73 5a 43 0b 7d ff ff ff ff !..K.4..sZC.}....! 00001010 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff !................! * 00001800 d1 dc 4b 84 34 10 d7 73 5a 43 0b 7d ff ff ff ff !..K.4..sZC.}....! 00001810 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff !................! * 00002800 7f 45 4c 46 01 01 01 00 00 00 00 00 00 00 00 00 !.ELF............! 00002810 02 00 28 00 01 00 00 00 e0 28 8c 0a 34 00 00 00 !..(......(..4...! 00002820 00 00 00 00 00 02 00 05 34 00 20 00 09 00 28 00 !........4. ...(.!
Listing of the compiled in secboot3 source code:
me@home:~/bin$ strings 7520_sbl.bin | grep '\.c$' boot_images/core/boot/secboot3/hw/ipq40xx/sbl1/sbl1_config.c boot_images/core/boot/secboot3/hw/ipq40xx/sbl1/sbl1_hw.c boot_images/core/boot/secboot3/hw/ipq40xx/sbl1/sbl1_mc.c boot_images/core/boot/secboot3/hw/ipq40xx/sbl1/sbl1_sahara.c boot_images/core/boot/secboot3/hw/ipq40xx/sbl1/sbl1_target.c boot_images/core/boot/secboot3/src/boot_a53.c boot_images/core/boot/secboot3/src/boot_authenticator.c boot_images/core/boot/secboot3/src/boot_clobber_prot.c boot_images/core/boot/secboot3/src/boot_clobber_prot_local.c boot_images/core/boot/secboot3/src/boot_config.c boot_images/core/boot/secboot3/src/boot_config_data.c boot_images/core/boot/secboot3/src/boot_config_emmc.c boot_images/core/boot/secboot3/src/boot_ddr_info.c boot_images/core/boot/secboot3/src/boot_dload_debug.c boot_images/core/boot/secboot3/src/boot_elf_loader.c boot_images/core/boot/secboot3/src/boot_error_handler.c boot_images/core/boot/secboot3/src/boot_extern_ddr_interface.c boot_images/core/boot/secboot3/src/boot_flash.c boot_images/core/boot/secboot3/src/boot_flash_dev_dal.c boot_images/core/boot/secboot3/src/boot_flash_dev_if.c boot_images/core/boot/secboot3/src/boot_flash_dev_nand.c boot_images/core/boot/secboot3/src/boot_flash_dev_nand_if.c boot_images/core/boot/secboot3/src/boot_flash_partition.c boot_images/core/boot/secboot3/src/boot_flash_target.c boot_images/core/boot/secboot3/src/boot_flash_trans_nand.c boot_images/core/boot/secboot3/src/boot_loader.c boot_images/core/boot/secboot3/src/boot_logger_ram.c boot_images/core/boot/secboot3/src/boot_mc.c boot_images/core/boot/secboot3/src/boot_pbl_v1.c boot_images/core/boot/secboot3/src/boot_ram_partition.c boot_images/core/boot/secboot3/src/boot_rollback_version.c boot_images/core/boot/secboot3/src/boot_secure_watchdog.c boot_images/core/boot/secboot3/src/boot_smem.c boot_images/core/dal/src/DALModEnv.c boot_images/core/mproc/smem/src/smem.c boot_images/core/services/utils/src/crc.c
Dependencies
Daily updated index of all dependencies of this partition. Last update: GMT.
A * in the Mod column marks info from Supportdata-Probes, which will always stay incomplete.
A ** in the Mod column marks info from Supportdata2 probes, which by their nature will stay way more incomplete.
A - in the Mod column marks manual research, the Firmware then shows where the item occurs, not the Relation.
| Relation | Typ | Object | Mod | Firmware | Info | Origin |
|---|---|---|---|---|---|---|
| 0 dependencies for this partition | ||||||
Model-Matrix
Daily updated index of the presence, path and size of this partition for each model. Last update: 2024-12-21 07:02 GMT.
Showing all models using this partition. Click any column header (click-wait-click) to sort the list by the respective data.
The (main/scrpn/boot/arm/prx/atom/rtl) label in the Model column shows which CPU is meant for Multi-Linux models.
Note that this list comes from Supportdata-Probes, which can have arbitrary settings and come from different firmware versions.
It doesn't say much if a model is not listed here. It may be a missing supportdata file or just a disabled feature.
| Model | Firmware | Device | Size |
|---|---|---|---|
| FRITZ!Box 4060 | 7.28 - 7.29 | mmcblk0p2 | 512k |
| FRITZ!Box 5590 Fiber (main) | 7.27 - 7.81 | mmcblk0p2 | 512k |
| FRITZ!Box 5690 Pro (main) | 7.61 | mmcblk0p2 | 1.1M |
| FRITZ!Box 7682 | 7.60 | mmcblk0p2 | 1.1M |
| FRITZ!Box 7690 | 7.60 - 7.61 | mmcblk0p2 | 1.1M |
| 5 models use this partition | |||
Missing Supportdata
The data in this article is incomplete due to missing Supportdata-Probes for the models listed below.
If you own any of these models and would like to help then please get in touch.
| Model | Method | Info |
|---|---|---|
| FRITZ!Box WLAN 3270 IT | lua | http://fritz.box/support.lua |
| FRITZ!Box Fon ata | html | http://fritz.box/html/support.html |
| FRITZ!Box Fon ata 1020 | html | http://fritz.box/html/support.html |
| FRITZ!Box Fon 5010 | html | http://fritz.box/html/support.html |
| FRITZ!Box Fon 5012 | html | http://fritz.box/html/support.html |
| FRITZ!Box Fon WLAN 7113 INT | html | http://fritz.box/html/support.html |
| Speedport W 501V | telnet | |
| Speedport W 722V | console | |
| Eumex 300 IP | telnet | |
| 9 models without supportdata probes | ||
