[Verizon Samsung Galaxy S III] E:V:A:
The Secure Boot Loaders

The table below list the various boot loaders and their code execution address,

code location and the type of memory it is executed in. WARNING!

Do not take these values as a fact, until we can verify them. The documentation

this is based on is already quite old and OEMs (like Samsung) are always changing and

tweaking things, including publishing poorly quality controlled documentation.

[SIZE=2]Component Processor Loc ExecAddr ExecMemType
-------------------------------------------------------------------------------
PBL ARM7 *ROM 0x0 RPM ROM and RAM (stack)
SBL1 ARM7 eMMC 0x2A000000 System IMEM
SBL2 Krait eMMC 0x2E000000 GMEM
RPM FW ARM7 eMMC x20000 RPM code RAM
TZ image Krait eMMC [strike]0x2a020000[/strike] System IMEM
SBL3 Krait eMMC [strike]0x47f00000[/strike] LPDDR2
APPSBL Krait eMMC [strike]TBD[/strike] LPDDR2
HLOS Krait eMMC TBD LPDDR2
-------------------------------------------------------------------------------
*RPM Boot ROM
[/SIZE]

But Ralekdev, noticed that these deviates for our device. He'd like to see:

[SIZE=2]TZ 0x2A000000
SBL3 0x8FF00000
APPSBL/aboot 0x88E00000
[/SIZE]

Obviously the PBL is the mother of all boot loaders, and is the most important to everyone.

So we need to show and understand the memory map of that.

The PBL Memory Map

The PBL Error Handler

But what use is a memory map without an error handler? In fact the error handler explain how to reach

the HS-USB Emergency Download mode. Which is what we are discussing here, since it could

be disabled by blowing a Qfuse. The error log goes directly into memory (RPM RAM) as was also the case for the boot

log shown in a previous post.

Debugging can be done by inspecting the 1KB Error Log in the RAM at location 0x3FF18.

Log content is defined in the following format:

[SIZE=2]typedefstructboot_pbl_error_log_location_type {
uint32 line_num;
char *filename;
pbl_err_code_enum_typeerr_code;
} boot_pbl_error_log_location_type;

-------------------------------------------------------------------------------
PBL Error Code Definitions
-------------------------------------------------------------------------------
typedefenum {
PBL_NO_ERR= 0,
PBL_FLASH_DET_OR_RW_ERR,
PBL_FLASH_TIMEOUT_ERR,
PBL_ASSERT_ERR,
PBL_LOAD_RPM_SBL_ERR,
PBL_RPM_SBL_FORMAT_ERR,
PBL_FLASH_SPEC_VER_ERR,
PBL_CERT_CHAIN_VERIFY_ERR,
PBL_SIGNATURE_VERIFY_ERR,
PBL_MISC_OR_EXCEPTION_ABORT_ERR,
PBL_LOAD_DLOAD_ERR,
PBL_BOOT_SELECT_OPTION_ERR,
PBL_SDCC_SPEED_SELECT_ERR,
PBL_OUT_OF_BOUND_ERR,
PBL_NULL_PTR_ERR, /* null pointer error */
PBL_ROLLBACK_ERR, /* Denotes older secure image is being used */
PBL_OEM_NUM_ROOT_CERTS_ERR, /* Denotes the number of OEM root certswere invalid */
PBL_OEM_ROOT_CERT_SEL_ERR, /* Denotes the OEM root cert selected is invalid */
PBL_INVALID_IMAGE_TYPE_ERR, /* invalid image being authenticated */
PBL_INVALID_PMIC_ERR, /* no PMIC, or not an expected Qualcomm PMIC connected */
PBL_PMIC_FLCB_ERR, /* Error during fast low current boot sequence ==> PMIC power down MSM. */
PBL_USB_ENUM_ERR, /* USB enumeration failed */
MAX_ERR_CODE = 0x7FFFFFFF /* To ensure it's 32 bits wide */
} pbl_err_code_enum_type;

[/SIZE]

<< To Be Continued... >>