[Xperia Arc General] scholbert:
some comments on the 1st log and a new one...

Hi there,

there's some news and i'd like to give some comments as well...

VBus is high, SoftService is not asserted...

No this message is not related to the testpoint.

With the testpoint shorted to GND external NAND gets blocked and we talk to OTP PBL via USB only.

In this mode there are no messages at all.

It seems this message is printed out from QCSBL or OEMSBL.

As we know QCSBL/OEMBL is executed by the ARM9 baseband processor and my guess is:

...wether it checks another GPIO (yet not located) to enter SoftService,

or SoftService get's activated by some code/key transfered via USB.

SEMCSEC Secure Bootstrap "1241-3656 S1Boot MSM7230 CRH1099189_R9B031" (2011-11-30 14:34)

It is not all clear here, but it seems that S1boot (EROM) is already APPS bootloader.

So this is the Scorpion core talking to us.

At least these messages exist in a higher level code which could be dumped from RAM.

QCSBL/OEMSBL have finished their work here already, i guess.

TCB_VerifyASAHISignature hashLength=[0x14] ASAHILength=[0x23f]
TCB_VerifyASAHISignature: S1_VerifySignature OK

To be honest... i don't know.

Maybe this is part of the signature checks for next stage...

BTW, i'm still on locked bootloader :o

Partition table contents:
PartID Descr Attribs StartBlock NumBlocks UsedAs
0x00000001 S1Boot 0x00000022 0x00000000 0x00000001
0x00000002 TA 0x00000001 0x00000008 0x00000008
0x00000008 AppDSP 0x40000022 0x0000015c 0x0000006c aDSP image
0x00000006 ModemFS 0x40000001 0x000000f4 0x00000068 mARM-FS image
0x00000005 ModemSW 0x40000022 0x00000010 0x000000e4 mARM image
0x00000003 Linux 0x80000022 0x00000280 0x00000064 aARM image
0x00000004 AppsFS1 0x80000001 0x000002f4 0x00000c80 system image
0x00000010 AppLog 0x80000001 0x00000f74 0x00000030 appslog image
0x0000000f AppsFS3 0xc0000001 0x00000fa4 0x0000032c cache image
0x0000000b FOTA0 0x40000022 0x000001c8 0x0000005c
0x0000000c FOTA1 0x40000022 0x00000224 0x0000005c
0x00000009 AppsFS2 0x80000001 0x000012d0 0x00000d20 userdata image

Yupp... no need to calculate any values from cryptic code snippets.

Would be really nice to tweak the kernel command line to include the "hidden" partitions.

Boot parameters found in config data
Commandline:totalmem=0x200 startup=0x00000001 serialno=xxxxxxxxxx bt0.ieee_addr=xx:xx:xx:xx:xx:xx wifi0.eth_addr=xx:xx:xx:xx:xx:xx.

Yeah obviously... and config data section holds these values.

Would be nice to know if it could be tweaked...

Epic Qualcomm failure workaround activated
(that means firewalling SMEM)

Really a funny statement in a bootloader here.

This is clearly a hint that an essential bug gets fixed at a later point.

Is this related to PBL bug???

Is my device old security (did not check that thought)?

Jumping to code @ 0x04700000, goodbye and thanks for all the fish...

Maybe the quote is even GPL'ed... could we force Sony to open up their bootcode ;) ??

Nothing to add here... apart from the fact that i'm still on locked bootloader.

Anyway, i like to gather all infos and logs before i unlock it. This way we may see the differences even better.

BTW, as stated above, by pulling the testpoint to GND NAND flash gets blocked and only OTP PBL is started.

There are no messages in this mode.

We could only talk to the bare metal using some binary mode over USB lines.

Next i entered SEMC flash mode (QHUSB_LOAD) by pressing the back key.

Here's the log:

VBus is high, SoftService is not asserted...
HW_REVISION_NUMBER = 0x205720e1
SEMCSEC Secure Bootstrap "1241-3656 S1Boot MSM7230 CRH1099189_R9B031" (2011-11-3
0 14:34)
Platform startup reason: USB
BQ charger detected
Detected memories on MSM8255-0 rev 2 ASIC:
EBI0 CS0: Elpida 256MB LPDDR2 (SR 0x5103), IO Calibration Done
EBI1 CS0: Elpida 256MB LPDDR2 (SR 0x5103), IO Calibration Done
EBI2 CS0: UNKNOWN 1024MB NAND (0x98 0xb3 0x55)
OTP User segment locked
OTP User segment locked
TA @ 0x08100000 (8*128kB)
Hardware Config: verification OK
OTP User segment locked
MSN=xxxxxxxxxx IMEI=xxxxxxxxxxxxxx Model=MK16i SW=1243-7775_4.1.B.0.587
Service Mode Config From TA (ver 1.0): KEYS:1 USB:eek:N SERVICEMODE:USB SERVICE_PIN
:ENABLED
Service key was pressed
Modem cold start
S1 BOOT waiting for USB connection
Will set FlaFla
OTP User segment locked
TCB_VerifyASAHISignature hashLength=[0x14] ASAHILength=[0x23f]
TCB_VerifyASAHISignature: S1_VerifySignature OK

Compare this to my 1st one... things get clearer step by step.

Uuuuh long posting...

In the meantime i reassembled my phone again, because i need it as a phone (very funny indeed) :o.

Anyway fastboot mode had not been logged yet, and i'm sure there's some technique to get into bootloader command line mode as well.

Research will go on...

Have fun!!!

scholbert