|
| 1 | +/** |
| 2 | +* A Wrapper for Linux Kernel to by pass android dtb check |
| 3 | +* |
| 4 | +* Qualcomm application bootloader (ABL) will check msm-id/board-id |
| 5 | +* or apply overlay before booting kernel. By replacing android dtb with linux dtb, |
| 6 | +* abl will failed to check or apply dtbo and then refuse to boot. |
| 7 | +* This wrapper is used to bypass the check. |
| 8 | +* |
| 9 | +* Scheme: |
| 10 | +* Only replace kernel instead of replacing dtb. But inject the dtb in kernel |
| 11 | +* |
| 12 | +* Step: |
| 13 | +* Inject this wrapper into kernel header and make a payload with linux kernel + linux dtb. |
| 14 | +* Then, repack the android boot image with the payload, but not replace dtb. |
| 15 | +* Linux will boot successfully then. |
| 16 | +* |
| 17 | +* Note: |
| 18 | +* You need to add memory region for linux dtb in device tree manually |
| 19 | +* otherwise linux will NOT boot. |
| 20 | +* |
| 21 | +* Usage: |
| 22 | +* ./DualBootKernelPatcher OriginalKernel mainline_dtb output DualBoot.Sm8250DT.cfg ShellCode.KernelWrapper.bin |
| 23 | +* Then repack android image with the output file. |
| 24 | +* |
| 25 | +* Inspired by @bigfootACA |
| 26 | +* |
| 27 | +*/ |
| 28 | + |
| 29 | +/* Dummy Header for shellcode */ |
| 30 | +.include "DummyHead.S" |
| 31 | + |
| 32 | +_ShellCodeStart: |
| 33 | + // Calculate UEFI FD(dtb addr here) start address and store in X4 |
| 34 | + adr x4, _KernelHead // Store kernel head address in x4. |
| 35 | + ldr x5, _KernelSize // Store kernel size in x5. |
| 36 | + add x4, x4, x5 // Add kernel base + kernel size, store value in x4. |
| 37 | + |
| 38 | + // Copy dtb to safe place (StackRegion, you can configure it freely in DualBoot config file) |
| 39 | + ldr x5, _StackBase // Store FD Base in x5. |
| 40 | + ldr x6, _StackSize // Store FD Size in x6. |
| 41 | + bl _CopyLoop // Copy DTB to stack region. |
| 42 | + |
| 43 | + // Set X0 to StackBase, which is the new DTB address |
| 44 | + ldr x0, _StackBase // Store stack base address in x5. |
| 45 | + b _LinuxStart // Boot linux kernel. |
| 46 | + b _Dead // We should never get here. |
| 47 | + |
| 48 | +// Copy Sub program, X4 is src, X5 is dst, X6 is size |
| 49 | +_CopyLoop: |
| 50 | + ldp x2, x3, [x4], #0x10 // Save value at [x4](pointer) to x2 and x3, then x4 add 16. |
| 51 | + stp x2, x3, [x5], #0x10 // Save value in x2 and x3 to [x5](pointer), then x5 add 16 |
| 52 | + subs x6, x6, #0x10 // x6 - 16, if , set CPSR register to 0. |
| 53 | + b.ne _CopyLoop // Check CPSR, if CPSR != 0, jump back to _CopyLoop. |
| 54 | + ret // Return when finish. |
| 55 | + |
| 56 | +_Dead: |
| 57 | + b _Dead // We should never get here. |
| 58 | + |
| 59 | +.text |
| 60 | +.align 4 |
| 61 | + |
| 62 | +_ShellCodeEnd: |
| 63 | +/* Do not remove the last line */ |
0 commit comments