===
XBL
===

The second-stage bootloader (XBL, loaded and authenticated by PBL):
structural reverse engineering of ``xbl_a.bin`` (LUN1) and its companion
images, and the bounded hand-off contract XBL presents to ABL. The
boot-chain and exception-level narrative is in :doc:`/boot/boot-chain`; the
signing chain is in :doc:`/boot/secure-boot`.

Container and segment layout
================================

``xbl_a.bin`` is an AArch64 ELF ``EXEC``, **entry ``0x14817908``**, **16
program headers**, ``0x380000`` bytes on disk. It executes largely from
IMEM/SRAM (``0x146xxxxx``–``0x1497xxxx``) plus DDR working windows
(``0x807xxxxx``), and carries the UEFI firmware volume to be placed at
``0x9FC00000``.

.. list-table::
   :header-rows: 1
   :widths: 6 16 14 12 34

   * - PH
     - vaddr
     - file size
     - flags
     - role
   * - 0
     - — (``0x0``)
     - ``0x3c0``
     - ``0x07000000``
     - MBN header + per-segment SHA-384 hash table
   * - 1
     - ``0x9FE40000``
     - ``0x1c10``
     - ``0x02200000``
     - boot metadata (UEFI region)
   * - 2
     - ``0x14817000``
     - ``0x4b6d0``
     - ``R E``
     - **XBLCore / SBL loader code** (entry ``0x14817908``) — :doc:`el3-monitor`
   * - 3–8, 10
     - ``0x14868000`` …
     - (bss/data)
     - ``RW``
     - XBLCore data / heap / stacks (IMEM + ``0x80700000``)
   * - 7
     - ``0x14699000``
     - ``0x1230``
     - ``R E``
     - EL1→EL3 SMC gateway — :doc:`el3-monitor`
   * - 9
     - ``0x148B9000``
     - ``0x23c60``
     - ``RWX``
     - runtime GOT / cross-module PLT region — :doc:`charger-detection`
   * - 11
     - ``0x9FC00000``
     - ``0x240000``
     - ``RWX``
     - **embedded UEFI firmware volume** — :doc:`dxe`, :doc:`platform-config`
   * - 12
     - ``0x14950000``
     - ``0x26000``
     - ``0x05000005``
     - **XBL "Sec" — EL3 secure monitor** (entry ``0x14953000``) —
       :doc:`el3-monitor`
   * - 13
     - ``0x80735000``
     - ``0x4eeef``
     - ``R E``
     - SBL1/charger/``fedl`` code in DDR — :doc:`charger-detection`
       (:doc:`/edl/entry`)
   * - 14–15
     - ``0x807A7000``
     - (bss/data)
     - ``RW``
     - DDR working data

Two companion partitions carry XBL-adjacent state, documented on their own
pages: the signed ``xbl_config`` mini-archive (:doc:`xbl-config`) and the
mutable ``cdt``/``ddr``/``uefivarstore`` partitions (:doc:`platform-state`).

Signing envelope
===================

The image is authenticated by its MBN **hash segment** (PH0: header +
per-segment SHA-384 table) plus a signature over that segment. On this unit
the chain is the public Qualcomm **test** key and ``SEC_BOOT`` is not
fused, so the ``xbl_a`` envelope is re-computable — **except**, by inference,
the EL3 "Sec" segment (PH12): its structural match to the Firehose
programmer's nested EL3 monitor, which :doc:`/edl/firehose` *proves* is
signature-enforced unconditionally, suggests the same independent
enforcement here, though this has not been directly tested against XBL Sec
itself (:doc:`/boot/boot-chain`). Cert
subjects, fingerprints and the ECDSA-P384/SHA-384 algorithm are in
:doc:`/boot/secure-boot`.

.. toctree::
   :maxdepth: 1

   handoff
   el3-monitor
   dxe
   platform-config
   xbl-config
   platform-state
   charger-detection