[HTC Wildfire S] no.human.being:
Right. You too. Let me try answering most of them, since I've had a thorough look at the MSM7227 chip (and the ARM1136 on which it is based and the architecture of its firmware) for some time now.

Munjenji has found it on Aria and Wildfire S. It's the least significant bit of the byte at 0x00480828 physical ("actual physical" though, not what aARM sees as "physical"). It's one when the device is stock. Turn it to zero and the device becomes "true Radio S-OFF". When you try accessing that address from software (would be in the "unmapped area" / "radio partition" so not on a partition that's normally visible) you get different data than when accessing it via JTAG though and the page that you see via JTAG isn't anywhere in the "physical address space" that software sees. My claim that "mARM" and "aARM" are not physical but virtual processors running on a "class one hypervisor" implemented in the ARM's microcode still stands. It just makes so much sense. The Radio doesn't do anything computationally intensive so dedicated hardware for it seems overkill. Just "steal" 10 % of the main processor's processing power when transmitting/receiving data should be more than sufficient. Class one hypervisor seems to be the perfect solution for this.

But "chainloading HBOOT" would still work, unless other firmware is periodically calculating and checking signature of first physical page in RAM (or getting an interrupt fired when first physical page in RAM is written). You just couldn't make the S-OFF "persistent", but you could make it "volatile" and use it to e. g. flash the Radio. You'll probably have to flash an original Qualcomm Radio, since that one is in fact signature-verified by SBL, but at least you could up- and downgrade between official Qualcomm Radio builds.

But Qualcomm is doing this for a purpose. The purpose is that THEIR firmware isn't modified without Qualcomm's permission. Why should they care if OEM firmware is modified? It's not theirs anyways and it's certainly not a selling point. TI OMAP is one of the best-selling system-on-chips and it's much more open than, say, Qualcomm MSM.

The Radio for Qualcomm chips is an operating system called REX (Realtime Executive). Qualcomm licensed REX to build the "low level firmware" for their Snapdragon system-on-chips. REX is a proprietary port of Iguana to the ARM architecture that's owned by Qualcomm. Iguana (or IGUANA, since some claim that it's an acronym for "Independant Group of Unix-Alike Network Activists") in turn is an operating system developed by an Australian research-corporation called NICTA. Iguana was designed for x86. REX is Iguana ported to ARM. Apart from architectural differences they should be pretty much identical, so with a lot of porting effort, one could probably build an "clean room" implementation of a "REX-replacement" from the Iguana sources. Iguana is open source software under a weird license called the OZPBL license. I don't know about the exact license terms, but the source is available as a free download from NICTA without registration. It's an operating system based on a microkernel called L4/Pistachio that was developed by the University Karlsruhe, Germany. Inside the Iguana sources you'll find a folder called "wombats" (or "wombat" - not sure anymore) with a source tree inside that will STRONGLY remind you of the Linux kernel source tree, so I think that Iguana shares a lot of kernel code with Linux. REX is used as the "low level firmware" on which the MSM processor is running. When aARM wants to do something (say, access GPIO) it calls REX and REX knows how to access GPIO. It serves as an "abstraction layer" that hides the architectural details of the processor from the software running on top, probably so that Qualcomm can perform slight modifications to the hardware without requiring all system-level software to be rebuilt.