=================================
Companion image — ``xbl_config``
=================================

``xbl_config_a.bin`` (LUN1, ``0x20000`` bytes) is a **separate signed
image**, not part of ``xbl_a``'s ELF: an ELF with entry ``0x148F0000``
carrying the same Qualcomm **test-key** certificate chain as XBL/ABL/TZ
(``Generated Test Root CA`` / ``General Use Test Key (for testing only)`` /
``SecTools Test User`` — see :doc:`/boot/secure-boot`). It holds
board/PMIC/PON register settings applied by XBL early in boot; the PON
reset-timer register table it carries is analysed in :doc:`/boot/keys`.

Container format (``CFGL``)
==============================

The five loadable ELF segments (mapped to IMEM
``0x148f0000``–``0x149044f0``) are a **``CFGL``** archive: segment PH2 is
the header (magic ``CFGL``, version ``01 01 04 00``) plus an entry table,
and each entry is ``[data-offset][data-size][name-len][name]`` pointing at
one of the following segments. On this unit it bundles **four** named
config blobs:

.. list-table::
   :header-rows: 1
   :widths: 30 14 56

   * - Bundled file
     - Size
     - Contents
   * - ``/pmic_settings.bin``
     - ``0xdc44`` (~56 KB)
     - the PMIC register init table (``PSI2`` / ``RSBP`` records) applied
       early by XBL — the source the register values in :doc:`/soc/pmic`
       are read from
   * - ``/6012_0100_0_1_dcb.bin``
     - ``0x3404`` (~13 KB)
     - a **DDR Config Blob (DCB)** — DDR parameter set, variant ``0_1``
   * - ``/6012_0100_1_1_dcb.bin``
     - ``0x3404``
     - the second **DCB**, variant ``1_1`` — inferred, from the ``0_1``/
       ``1_1`` naming, to cover different DDR rank/frequency plans, not
       confirmed by parsing the blob contents. The two DCBs feed DDR
       bring-up, complementing the training cache in :doc:`platform-state`
       and the runtime DDR manager in :doc:`/soc/aop`
   * - ``/devcfg.bin``
     - ``0x5d8`` (~1.5 KB)
     - a small device-config blob referenced alongside the TZ ``devcfg``
       (:doc:`/trustzone/secure-world`)

So ``xbl_config`` is not one flat blob but a signed mini-archive of the
PMIC register table and the DDR config blobs XBL needs before DDR and the
PMIC rails are up — which is why it is a *separate* image from ``xbl_a``
(it is consumed by the SBL/loader core, before the UEFI FV).

:Source: ``_READONLY/lun1/xbl_config_a.bin``.
:Cross-refs: :doc:`/xbl/index`, :doc:`platform-state` (cdt/ddr/uefivarstore),
   :doc:`/soc/pmic`, :doc:`/soc/aop`, :doc:`/trustzone/secure-world`,
   :doc:`/boot/secure-boot`.