1.2.5. Companion image — xbl_config

xbl_config_a.bin (LUN1, 0x20000 bytes) is a separate signed image, not part of xbl_a’s ELF: an ELF with entry 0x148F0000 carrying the same Qualcomm test-key certificate chain as XBL/ABL/TZ (Generated Test Root CA / General Use Test Key (for testing only) / SecTools Test User — see Secure boot and image signing). It holds board/PMIC/PON register settings applied by XBL early in boot; the PON reset-timer register table it carries is analysed in Physical keys: power, volume, and the boot-mode dispatcher.

1.2.5.1. Container format (CFGL)

The five loadable ELF segments (mapped to IMEM 0x148f0000–0x149044f0) are a ``CFGL`` archive: segment PH2 is the header (magic CFGL, version 01 01 04 00) plus an entry table, and each entry is [data-offset][data-size][name-len][name] pointing at one of the following segments. On this unit it bundles four named config blobs:

Bundled file

Size

Contents

/pmic_settings.bin

0xdc44 (~56 KB)

the PMIC register init table (PSI2 / RSBP records) applied early by XBL — the source the register values in PMIC reset timers, charging and reachability are read from

/6012_0100_0_1_dcb.bin

0x3404 (~13 KB)

a DDR Config Blob (DCB) — DDR parameter set, variant 0_1

/6012_0100_1_1_dcb.bin

0x3404

the second DCB, variant 1_1 — inferred, from the 0_1/ 1_1 naming, to cover different DDR rank/frequency plans, not confirmed by parsing the blob contents. The two DCBs feed DDR bring-up, complementing the training cache in Platform state partitions: cdt, ddr, uefivarstore and the runtime DDR manager in AOP — the Always-On Processor (RPMh / power back-end)

/devcfg.bin

0x5d8 (~1.5 KB)

a small device-config blob referenced alongside the TZ devcfg (Secure world and coprocessors (TZ, HYP, trustlets))

So xbl_config is not one flat blob but a signed mini-archive of the PMIC register table and the DDR config blobs XBL needs before DDR and the PMIC rails are up — which is why it is a separate image from xbl_a (it is consumed by the SBL/loader core, before the UEFI FV).

Source:

_READONLY/lun1/xbl_config_a.bin.

Cross-refs:

XBL, Platform state partitions: cdt, ddr, uefivarstore (cdt/ddr/uefivarstore), PMIC reset timers, charging and reachability, AOP — the Always-On Processor (RPMh / power back-end), Secure world and coprocessors (TZ, HYP, trustlets), Secure boot and image signing.