[AT&T Samsung Galaxy S 4 Android Development] E:V:A:
NO. What Adam calls the "Monotonic counter", is known in Qualcomm lingo as the OEM ANTI_REPLAY Qfuse region in QFPROM. You can get an idea about the layout of this region from my post in the MSM8960 thread HERE.

However, the chip combo we're talking about here is quite different from the 8960 chip as it consists of two chips (AP + BP) and PoP memory. These each have their own Qfuses and in addition they use their own Sahara protocol to download FW from AP to BP.

The MDM9215M (modem) and the APQ8064T (Snapdragon 600) is the latest Qualcomm

chip combo that we will likely see more of in the future. From a developer and

HW-hacker point of view, what is new about this is that it makes some changes

to the common MSM8960 system model that we are now getting used to.

Some of the new modem features are:

- The Sahara protocol for HSIC download

- Flashless Boot (PBL) over HSIC (the Sahara boot-option)

This is best explained in the document: [80-N5576-45 Rev.A]

As for the Qfuse region in the APQ8064T, we expect it to be the same (or at least very similar) to that of the MSM8960. The Qfuse memory region is actually mapped to some pseudo-register, so we have at least two copies of the qfuse settings floating around.

The first address space region is known as the RAW region, and is used for blowing in the fuse values and for checking that the fuses have been blown with the correct data and FEC values. (I.e. FEC is not applied.)

The second address space region is known as the CORRECTED region, and is used for software and JTAG accesses read-only. Reading this region require read-permission and include FEC.

The address mappings are as follows:

[SIZE=2]QFPROM raw address space

This set of addresses accesses the QFPROM directly. These are not true
registers, but instead QFPROM regions. Each address definition below
corresponds to half of one of the QFPROM rows. The register definitions give
the exact physical location of each of the fuses in the QFPROM. Note that this
is the Raw QFPROM address space. Reads from this space do not apply any error
correction to the values read from the QFPROM. They are read out in the exact
format of the data. This address space should be used for blowing in the fuse
values and for checking that the fuses have been blown with the correct data
and FEC values. Any software usage of the fuses should be done through the
QFPROM corrected address space. Accesses to this address space require the
system FPB clock be on otherwise they hang.

[B]0x00A8 [/B]QFPROM_RAW_READ_PERM_LSB
[13:12] ANTI_REPLAY These two bits are ORed together to create the read permission
setting for the ANTI_REPLAY region.
00: Allow Read
01,10,11: Disable Read

[B]0x00B0 [/B]QFPROM_RAW_WRITE_PERM_LSB
[13:12] ANTI_REPLAY These two bits are ORed together to create the write permission
setting for the ANTI_REPLAY region.
00: Allow Write
01,10,11: Disable Write

[B]0x01E8 [/B]QFPROM_RAW_ANTI_REPLAY_LSB

This register maps to the LSB of the OEM Anti-Replay region of the QFPROM. It
is used by the OEM to store the current version of the software that is
expected to be running on the device. This prevents end users from rolling
back software updates. The OEM should blow one fuse each time it makes a major
software update. This fuse region does not incorporate a FEC scheme. Accesses
to the RAW region are intended for fuse blowing and checking only.

-----------------------------------------------------------------------
Bits Name Description
-----------------------------------------------------------------------
31:2 SW_VERSION_LSB These are the least significant bits of
the expected software version of the
OEM code.

1:0 SBL_SOFTWARE_VERSION This field determines the secondary
boot loader software version.
-----------------------------------------------------------------------

[B]0x01EC [/B]QFPROM_RAW_ANTI_REPLAY_MSB

This register maps to the MSB of the OEM Anti-Replay region of the QFPROM. It
is used by the OEM to store the current version of the software that is
expected to be running on the device. This prevents end users from rolling
back software updates. The OEM should blow one fuse each time it makes a major
software update. This fuse region does not incorporate a FEC scheme. Accesses
to the RAW region are intended for fuse blowing and checking only.

-----------------------------------------------------------------------
Bits Name Description
-----------------------------------------------------------------------
31:0 SW_VERSION_MSB These are the most significant bits of
the expected software version of the
OEM code.
-----------------------------------------------------------------------

[B]0x40A8 [/B]QFPROM_CORR_READ_PERM_LSB

This is the lower half of the QFPROM row for the Read Permissions. The read
permissions apply to Software and JTAG accesses only. This fuse region uses a
1-to-1 redundancy scheme. Each pair of bits controls the read permissions for
1 of the regions in the QFPROM. Accesses to the CORRECTED address space are
intended for use by software. This is a read only address space.

[B]0x40AC [/B]QFPROM_CORR_READ_PERM_MSB

This is the upper half of the QFPROM row for the Read Permissions. The read
permissions apply to Software and JTAG accesses only. This fuse region uses a
1-to-1 redundancy scheme. Each pair of bits controls the read permissions for
1 of the regions in the QFPROM. Accesses to the CORRECTED address space are
intended for use by software. This is a read only address space.

[B]0x41E8 [/B]QFPROM_CORR_ANTI_REPLAY_LSB

This register maps to the LSB of the OEM Anti-Replay region of the QFPROM. It
is used by the OEM to store the current version of the software that is
expected to be running on the device. This prevents end users from rolling
back software updates. The OEM should blow one fuse each time it makes a major
software update. This fuse region does not incorporate a FEC scheme. Accesses
to the CORRECTED address space are intended for use by software. This is a
read only address space.

[B]0x41EC [/B]QFPROM_CORR_ANTI_REPLAY_MSB

This register maps to the MSB of the OEM Anti-Replay region of the QFPROM. It
is used by the OEM to store the current version of the software that is
expected to be running on the device. This prevents end users from rolling
back software updates. The OEM should blow one fuse each time it makes a major
software update. This fuse region does not incorporate a FEC scheme. Accesses
to the CORRECTED address space are intended for use by software. This is a
read only address space.

[The same tables apply as for "QFPROM_RAW_ANTI_REPLAY_*" above.]
[/SIZE]

(This was taken from a text-only excerpt of the document [80-N5576-41 Rev.C ] that was relayed to me. So don't bother to ask me for the rest, because I don't have it. But you can surely find it if you search. I haven't bothered.)

Again, all this show us why it is extremely important why you should NEVER UPDATE YOUR NEW DEVICE, EVER! Instead wait until the developer community have managed to make and distribute our own roms, without the dangerous bootloader "updates". (You never need to update you bootloaders, unless we tell you so and supply you with it.)