● SoC-specific stuff in mediatek/platform/${platform}/preloader, this contains the core, drivers, initalizing and security code.
● Device-specific stuff in mediatek/custom/${device}/preloader, this contains the Device-specific code.1. Clear all registers.
2. Switch the CPU to SVC32 mode.3. Disable interrupts.
4. Setup the caches and stack.
5. Duplicate the CTP code to the Slave CPU and start it.
6. Creates a VMA-to-LMA mapping for the Slave CPU.
7. Jump to the main code in the C code.typedef enum {
BR_POWER_KEY = 0,
BR_USB,
BR_RTC,
BR_WDT,
BR_WDT_BY_PASS_PWK,
BR_TOOL_BY_PASS_PWK,
#ifdef RTC_2SEC_REBOOT_ENABLE
BR_2SEC_REBOOT,
#endif
BR_UNKNOWN
} boot_reason_t;
static part_t platform_parts[PART_MAX_COUNT] = {
{PART_PRELOADER, 0, PART_SIZE_PRELOADER, 0,PART_FLAG_NONE},
{PART_MBR, 0, PART_SIZE_MBR, 0,PART_FLAG_NONE},
{PART_EBR1, 0, PART_SIZE_EBR1, 0,PART_FLAG_NONE},
{PART_PRO_INFO, 0, PART_SIZE_PRO_INFO, 0,PART_FLAG_NONE},
{PART_NVRAM, 0, PART_SIZE_NVRAM, 0,PART_FLAG_NONE},
{PART_PROTECT_F, 0, PART_SIZE_PROTECT_F, 0,PART_FLAG_NONE},
{PART_PROTECT_S, 0, PART_SIZE_PROTECT_S, 0,PART_FLAG_NONE},
{PART_SECURE, 0, PART_SIZE_SECCFG, 0,PART_FLAG_NONE},
{PART_UBOOT, 0, PART_SIZE_UBOOT, 0,PART_FLAG_NONE},
{PART_BOOTIMG, 0, PART_SIZE_BOOTIMG, 0,PART_FLAG_NONE},
{PART_RECOVERY, 0, PART_SIZE_RECOVERY, 0,PART_FLAG_NONE},
{PART_SECSTATIC, 0, PART_SIZE_SEC_RO, 0,PART_FLAG_NONE},
{PART_MISC, 0, PART_SIZE_MISC, 0,PART_FLAG_NONE},
{PART_LOGO, 0, PART_SIZE_LOGO, 0,PART_FLAG_NONE},
{PART_EXPDB, 0, PART_SIZE_EXPDB, 0,PART_FLAG_NONE},
{PART_ANDSYSIMG, 0, PART_SIZE_ANDROID, 0,PART_FLAG_NONE},
{PART_CACHE, 0, PART_SIZE_CACHE, 0,PART_FLAG_NONE},
{PART_USER, 0, PART_SIZE_USRDATA, 0,PART_FLAG_NONE},
{PART_FAT, 0, PART_SIZE_FAT, 0,PART_FLAG_NONE},
{NULL,0,0,0,PART_FLAG_END},
};typedef enum
{
NORMAL_BOOT = 0,
META_BOOT = 1,
RECOVERY_BOOT = 2,
SW_REBOOT = 3,
FACTORY_BOOT = 4,
ADVMETA_BOOT = 5,
ATE_FACTORY_BOOT = 6,
ALARM_BOOT = 7,
#if defined (MTK_KERNEL_POWER_OFF_CHARGING)
KERNEL_POWER_OFF_CHARGING_BOOT = 8,
LOW_POWER_OFF_CHARGING_BOOT = 9,
#endif
FASTBOOT = 99,
DOWNLOAD_BOOT = 100,
UNKNOWN_BOOT
} BOOTMODE;| Command | Byte | Function |
|---|---|---|
| CMD_GET_HW_SW_VER | 0xfc | Return hardware subcode, hardware/software version |
| CMD_GET_HW_CODE | 0xfd | Return hardware code/status |
| CMD_GET_BL_VER | 0xfe | Gets the Preloader version |
| CMD_LEGACY_WRITE | 0xa1 | Write data to the SoC memory (legacy) |
| CMD_LEGACY_READ | 0xa2 | Read data from the SoC memory (legacy) |
| CMD_I2C_INIT | 0xb0 | Initializes the I2C |
| CMD_I2C_DEINIT | 0xb1 | Shuts down the I2C |
| CMD_I2C_WRITE8 | 0xb2 | Write data to the I2C (8 bit length) |
| CMD_I2C_READ8 | 0xb3 | Read data from the I2C (8 bit length) |
| CMD_I2C_SET_SPEED | 0xb4 | Sets the I2C speed |
| CMD_PWR_INIT | 0xc4 | Initializes the PMC |
| CMD_PWR_DEINIT | 0xc5 | Shuts down the PMC |
| CMD_PWR_READ16 | 0xc6 | Read 16 bit data from the PMC interface memory (16 bit length) |
| CMD_PWR_WRITE16 | 0xc7 | Write 16 bit data to the PMC interface memory (16 bit length) |
| CMD_READ16 | 0xd0 | Read data from the SoC memory (16 bit length) |
| CMD_READ32 | 0xd1 | Read data from the SoC memory (32 bit length) |
| CMD_WRITE16 | 0xd2 | Write data to the SoC memory (16 bit length) |
| CMD_WRITE16_NO_ECHO | 0xd3 | Write data to the SoC memory without echoing (16 bit length) |
| CMD_WRITE32 | 0xd4 | Write data to the SoC memory (32 bit length) |
| CMD_JUMP_DA | 0xd5 | Sets boot mode to DOWNLOAD_BOOT and starts execution of the Download Agent sent to the SoC |
| CMD_JUMP_BL | 0xd6 | Starts execution of the Preloader on eMMC/NAND flash |
| CMD_SEND_DA | 0xd7 | Sends a "Download Agent" binary to the SoC signed with a key |
| CMD_GET_TARGET_CONFIG | 0xd8 | Gets supported Preloader config flags |
| CMD_UART1_LOG_EN | 0xdb | Not sure what this command does |
| Command | String | Function |
|---|---|---|
| HSNK_COM_READY | READY | If sent, will wait for a 8 byte token before switching to BROM |
| META_STR_REQ | METAMETA | Switches into META_BOOT mode |
| META_STR_ACK | ATEMATEM | Used for response from META_BOOT mode |
| META_LOCK | LOCK | Not sure what this command does |
| META_FORBIDDEN_ACK | METAFORB | Not sure what this command does |
| META_ADV_REQ | ADVEMETA | Switches into ADVMETA_BOOT mode |
| META_ADV_ACK | ATEMEVDA | Used for response from ADVMETA_BOOT mode |
| FACTORY_STR_REQ | FACTFACT | Switches into FACTORY_BOOT mode |
| FACTORY_STR_ACK | TCAFTCAF | Used for response from FACTORY_BOOT mode |
| ATE_STR_REQ | FACTORYM | Switches into ATE_FACTORY_BOOT mode |
| FACTORY_STR_ACK | MYROTCAF | Used for response from ATE_FACTORY_BOOT mode |
| SWITCH_MD_REQ | SWITCHMD | Switches the modem into firmware download mode |
| SWITCH_MD_ACK | DMHCTIWS | Used for response from modem in firmware download mode |
| ATCMD_NBOOT_REQ | AT+NBOOT | Switches into NORMAL_BOOT mode |
| ATCMD_OK | AT+OK | Not sure what this command does |
| ATCMD_UNKNOWN | AT+UNKNOWN | Not sure what this command does |
| FB_STR_REQ | FASTBOOT | Switches into FASTBOOT mode |
| FB_STR_ACK | TOOBTSAF | Used for response from FASTBOOT mode |
● Security data comes from the SECSTATIC partition
● Validation of cryptographic image signatures using RSA/SHA1
● (CONFIRMED AS SEEN HERE AS FLASHING LK IN MAVERICK GETS IT STUCK IN PRELOADER) The UBOOT, LOGO, BOOTIMG, RECOVERY and ANDROID partitions are checked at some point
● The "customer name" seems to be checked, strange but why?typedef struct {
u32 magic;
boot_mode_t mode;
u32 e_flag;
u32 log_port;
u32 log_baudrate;
u8 log_enable;
u8 reserved[3];
u32 dram_rank_num;
u32 dram_rank_size[4];
u32 boot_reason;
u32 meta_com_type;
u32 meta_com_id;
da_infp_t da_info;
SEC_LIMIT sec_limit;
} boot_arg_t;