| Subsystem | Processor | Boot address |
| APPS | Cortex-A53 | 0x00100000* |
| RPM | Cortex-M3 | 0x00200000 |(Subsystem view) | 0x0(System view) |
| Modem | MSS_QDSP6 | Configurable* |
| WCNSS (Pronto) | ARM9 | 0x0 or 0xFFFF0000 or hardware remap* |
| LPASS | LPASS_QDSP6 | Configurable* | LPASS |
| *No change in the boot address in system and subsystem views |
| Component 組件 | Based onprocessor哪個處理器執行 | Loaded from從哪加載 | Executes in 再哪里執行 | Function功能 | ||||||
| application ProcessorPrimary Boot Loader(APPS PBL)AP的第一個Bootloader | Cortex-A53(AArch32) | NA | APPS ROM | Boot device and interface detection,Emergency Download mode support,loads and authenticates SBL1 ELFsegments across L2TCM, and RPMcode RAM | ||||||
| Secondary BootLoader stage 1 (SBL1)第二個bootloader的第一階段 | Cortex-A53(AArch32) | eMMC |
| Initial memory subsystem (buses,DDR, clocks, and CDT), loads/authorizes TrustZone, DEVCFG,RPM_FW, APPS BL images, memorydump via USB 2.0 and Sahara,Watchdog debug retention, e.gforexample, L2 flush, RAM dump toeMMC/SD support, USB driversupport, USB charging, thermalcheck, PMIC driver support,configures DDR, and flushesL1/L2/ETB to crash debugsupport-related configuration | ||||||
| QSEE/TrustZone | Cortex-A53(AArch64) | eMMC | LPDDR3 | Equivalent to TZBSP; sets up secureruntime environment, configures xPU,supports fuse driver, authenticatesany subsystem images; abnormalRESET debug functionality is added | ||||||
| DEVCFG | Cortex-A53(AArch64) | eMMC | LPDDR3 | OEM configurable data, for example,xPU configuration, PIL loading imageregions |
| Component | Based onprocessor | Loaded from | Executes in | Function |
| Debug policy1 （fuse的機器可以調試，是可選的） | Cortex-A53(Aarch 32) | eMMC | LPDDR3 | Enables debugging on commercialsecure devices |
| Resource PowerManager Firmware(RPM_FW) | Cortex-M3 | eMMC | RPM code RAM | Resource power management |
| APPSBL/bootmanager andOS loader（就是lk） | Cortex-A532(AArch32/AArch64) | eMMC | LPDDR3 | Splash screen, loads andauthenticates the kernel, andprovides HLOS-specific boot loaderfeatures using UEFI |
| High-Level OperatingSystem (HLOS)（就是android） | Cortex-A53(AArch32/AArch64) | eMMC | LPDDR3 | Boots HLOS images, for example,A53 HLOS kernel image, WCNSS(Pronto) image, and so on. |
| Modem Primary BootLoader (Modem PBL)（modem的bootloader） | MSS_QDSP6 | NA | Modem ROMQualcomm? Hexagon? TCM(data and stack) | Sets up Hexagon TCM, copies MBAfrom LPDDR3 into Hexagon TCM,and authenticates MBA in HexagonTCM |
| Modem BootAuthenticator (MBA)（modem驗證） | MSS_QDSP6 | eMMC | Hexagon TCM | Authenticates the modem image, xPUprotects the DDR regions for modem,and memory dump |
| 1Debug policy image is an optional image loaded by the SBL. See Debug Policy User Guide for MSM8996, MSM8976, MSM8956(80-NV396-72).2LK boot loader will start in 32-bit |
Boot Flowchart1. The system powers on and takes the MSM8937/MSM8953/MSM8940 apps processor CPU out of reset.按下power鍵后，MSM8937/MSM8953/MSM8940的apps處理器開始執行，APPS PBL在ROM里執行2. In Cortex-A53, APPS PBL loads and authenticates the following: a. SBL1 segment 1 from the boot device to L2 (as TCM) 將sbl1加載到l2中 b. SBL1 segment 2 (SDI equivalent) to RPM code RAM, then jumps to SBL1 將RPM的代碼加載到RPM的code RAM中，跳轉執行SBL13. SBL1 segment 1 initializes DDR and loads and authenticates the following: a. QSEE/TrustZone image from the boot device to DDR 將QSEE/TrustZone加載到DDR b. DEVCFG image from the boot device to DDR 將DEVCFG 加載到DDR c. Debug Policy image from the boot device to DDR 將Debug Policy加載到DDR d. HLOS APPSBL image from the boot device to DDR 將APPSBL（即lk）加載到DDR e. RPM firmware image from the boot device to RPM code RAM 將RPM firmware image加載到DDR4. SBL1 transfers the execution to QSEE/TrustZone. QSEE/TrustZone sets up a secure environment, configures xPU, and supports the fuse driver. sbl1執行完后，執行QSEE，QSEE設置安全環境，配置xPU， a. SBL1 runs in AArch32 mode. QSEE/TrustZone runs in AArc64 mode. For AArch64 mode switch, SBL1 sets boot remapper for QSEE entry and writes to RMR register, and then triggers warm-reset. QSEE now starts in AArch64 mode. SBL1運行在AArch32 模式，QSEE/TrustZone運行在AArc64 模式，SBL1將QSEE 的入口remap，寫RMR寄存器，warm-reset，這樣QSEE就在AArch64 模式5. QSEE notifies RPM to start the RPM firmware execution. QSEE通知RPM執行RPM的固件6. QSEE transfers execution to the HLOS APPSBL to initialize the system. HLOS APPSBL （即lk）初始化系統 a. The linux APPS boot loader (HLOS APPSBL) starts the execution in AArch32 mode only. HLOS APPSBL運行在AArch32 模式 b. This is done by EL3/Monitor mode by looking at the ELF header for HLOS APPSBL, which indicates that it uses 32-bit instruction set architecture. EL3/Monitor mode changes to 32-bit mode and starts Linux APPS boot loader (HLOS APPSBL) execution in 32-bit mode. 通過查看 HLOS APPSBL的ELF的文件頭，需要使用32位的指令集，系統切換到32位的模式7. The HLOS APPSBL loads and authenticates the HLOS kernel. The Linux APPS boot loader (HLOS APPSBL) will indicate about the HLOS kernel AArch64 mode by making an SCM call to secure the monitor before exiting. LK does not jump into the kernel directly as it did previously. HLOS APPSBL（即lk）加載內核，通過SCM調用切換到AArch64 模式8. The HLOS kernel loads the MBA to DDR via PIL.HLOS kernel 通過pil加載MBA到DDR9. The HLOS kernel brings the Hexagon modem DSP out of reset.HLOS kernel復位modem的DSP10. The Modem PBL then continues its boot process.Modem的PBL執行11. The HLOS kernel loads the AMSS modem image to DDR via PIL.HLOS kernel 通過pil加載AMSS modem image 到DDR12. The Modem PBL authenticates MBA and then jumps to it.modem的PBL驗證MBA，然后跳進執行13. HLOS loads the WCNSS (Pronto) image to DDR via PIL.HLOS kernel 通過pil加載WCNSS 到DDR14. HLOS brings the WCNSS (Pronto) image out of reset so that the Pronto image starts executing.HLOS復位wifi的處理器，wifi的固件開始執行15. HLOS loads the LPASS image to DDR via PIL.HLOS kernel 通過pil加載LPASS（音頻子系統）到DDR16. HLOS brings the LPASS image out of reset so that the LPASS image starts executing.HLOS kernel 復位處理音頻的dsp，音頻子系統開始運行新聞熱點
疑難解答
