APPSBL on Qualcomm IPQ: is it U-Boot?

APPSBL stands for Application Secondary Boot Loader: the non-secure bootloader that Qualcomm's SBL1 hands off to after it has loaded and authenticated QSEE (the TEE), RPM (the power-management firmware), and DEVCFG (the device-config table).

What APPSBL *is* depends on the product line:

• On Qualcomm IPQ (networking) platforms: like the IPQ8074 in an Arcadyan AW1000: APPSBL is Qualcomm's fork of U-Boot, typically shipped as part of QSDK (the Qualcomm networking SDK). Base version is usually U-Boot 2016.01 heavily patched. This is what you find on retail routers.
• On Snapdragon mobile platforms: like a phone or tablet chipset: APPSBL is usually LK (Little Kernel) instead. Different codebase, same role in the chain.

APPSBL is loaded and authenticated by SBL1 exactly like every other post-SBL1 image. In the timing log, look for:

B -    707569 - Image Load, Start
D -     89914 - APPSBL Image Loaded, Delta - (572642 Bytes)

572 KB is a typical U-Boot-fork size for IPQ. The APPSBL image itself is signed and its signature is verified by SBL1 against the same certificate chain that verified SBL1 back at PBL.

Once loaded, APPSBL is invoked at EL2 / non-secure world on the primary Cortex-A53. On IPQ it enumerates NAND, loads a FIT image out of UBI, and jumps to the Linux kernel: usually at EL1 rather than EL2 because there's no EL2 hypervisor stub in the QSDK image set.