The Replicant project wants to support devices with free software bootloaders, but most/all the smartphones and tablets supported by Replicant do check the signature of the first stage bootloader.
A presentation on the situation of some of the devices supported by Replicant was made at the Replicant contributors meeting in July 2019. The presentation slides and video are available.
xboot is an OS that is supposed to run as the BL1 on a board that has the the Exynos 4412.
There is an attempt to port it and run it on the Galaxy SIII but it didn't succeed yet.
If the xboot attempt doesn't work we could also try to understand with qemu2 or a developement board that has JTAG, if func_ptr_BaseAddr is somehow used by the bootrom when verifying the BL1.
Testing with qemu2 is probably way more easy than using the JTAG.
If it is we might be able to replace the bootrom check function.
1 https://fredericb.info/2018/03/emulating-exynos-4210-bootrom-in-qemu.html
2 https://github.com/frederic/qemu-exynos-bootrom
On several SOCs families you can override the boot pins through register writes.
For instance on the OMAP 3630 you have a register for that at 0x48002910 which is publicly documented in its technical reference manual.
Not all the system on a chip have something like that.
If registers to do that are found for the Exynos 4412, rebooting directly to u-boot from s-boot should be pretty easy to do.
The i9300_emmc_toolbox project can execute code in s-boot, and we can easily write C code to be executed in it.
Some examples are provided in the shellcode directory.
So it would be trivial to write to a register and use the already provided reboot function.
TODO:Note that this has not been seen in use yet, including in the Galaxy SIII repair manual , which shorts a resistor to change the boot modes. Though the Samsung branch that does the smartphones and tablets is separate from the branch doing the System on a chip. So for instance the System on a chip branch was providing SOCs to Apple for its Iphones while consumer electronics branch was at (legal) war against Apple.
When booting Parabola with a Replicant 9 kernel on a Galaxy SIII (i9300), it is possible to erase the bootloader to make the device boot from the microSD instead.
This could be used to do some testing, for instance to see if the BL1 signature can somehow be bypassed, however as no free software bootloaders do exist yet (u-boot relies on nonfree and non-redistributable software), this is not very useful yet.
If you really want to erase the bootloader (your device will be broken and will never boot anymore), you could run the following:
# echo 0 > /sys/class/block/mmcblk2boot0/force_ro
# ddrescue -f /dev/zero /dev/mmcblk2boot0
GNU ddrescue 1.24
Press Ctrl-C to interrupt
ipos: 4194 kB, non-trimmed: 0 B, current rate: 4194 kB/s
opos: 4194 kB, non-scraped: 0 B, average rate: 4194 kB/s
non-tried: 9223 PB, bad-sector: 0 B, error rate: 0 B/s
rescued: 4194 kB, bad areas: 0, run time: 0s
pct rescued: 0.00%, read errors: 0, remaining time: n/a
time since last successful read: n/a
Copying non-tried blocks... Pass 1 (forwards)
ddrescue: Write error: No space left on device
And then verify that it's erased:
# hexdump -C /dev/mmcblk2boot0 00000000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| * 00400000Also verify that the following partitions are also erased:
I'm not sure what BOTA0 and BOTA1 are but they were already blank in my case.
Note that I didn't manage yet to go from u-boot to s-boot.
Requirements:
$ on(){ sigrok-cli -d korad-kaxxxxp:conn=/dev/ttyACM0 --set --config enabled=on ;}
$ off(){ sigrok-cli -d korad-kaxxxxp:conn=/dev/ttyACM0 --set --config enabled=off ;}
$ off
$ sleep 10 ; on
You then should have u-boot running which can boot Parabola, so you can then easily recover.
Note that to run Parabola you need to make sure that you use an MBR and no gpt as u-boot is to be put at the second 512B block.