[XPERIA X8 Original Android Development] der_mart:
Hey thnx for your answer, yea i suppose providing/developing a custom rom is very time consuming, very nice rom btw. using it too :)

For the insmod order, if you're interested, i attached the modified insmodnet script. No need to run this twice anymore ;)

I got a x8 and the offsets seem to be ok, kallsyms_lookup_name_dx is working, i'm seeing your debug output of the hijacked functions.

Did some more debugging, seems nf_nat.ko (or one of its dep. modules) is somehow not working correct?

Hijacked ip_route_output_flow and added some debug output showing the params.

after insmodding these modules:

insmod netfilter.ko
insmod x_tables.ko
insmod ipv4_netfilter.ko
insmod nf_defrag_ipv4.ko
insmod nf_conntrack.ko
insmod nf_conntrack_ftp.ko
insmod nf_conntrack_ipv4.ko
insmod nf_conntrack_irc.ko
insmod nf_conntrack_tftp.ko

running ping (to google) got this output of ip_route_flow:

[ 336.621074] enter ip_route_output_flow
[ 336.621181] net:c0610950
[ 336.621719] *rp:0
[ 336.623629] flp:c3505e70
[ 336.626164] sk:cc06a220
[ 336.628575] flags:1
[ 336.630730] trying to run __ip_route_output_key
[ 336.635189] finished __ip_route_output_key() ==0
[ 336.639775] *rp:c52da160

then i insmodded nf_nat.ko, running ping and got this:

[ 407.210505] x8netfilter: nf_nat initializing
[ 412.032199] ------------[ cut here ]------------
[ 412.032324] WARNING: at /home/hudsonslave/root/workspace/offbuild_edream2.1-germany_matrix/HUDSON_PRODUCT/shakira/HUDSON_VARIANT/user/jdk/Sun-Java-5_64-bit/label/CM_PC/kernel/net/core/dst.c:270 dst_release+0x44/0x50()
[ 412.050510] Modules linked in: nf_nat nf_conntrack_tftp nf_conntrack_irc nf_conntrack_ipv4 nf_conntrack_ftp nf_conntrack nf_defrag_ipv4 ipv4_netfilter x_tables netfilter tiwlan_drv x8uv x8mddi synaptics_i2c_rmi4 twofish twofish_common dm_crypt dm_mod sdio
[ 412.073031] [<c038bd3c>] (dump_stack+0x0/0x14) from [<c00865f4>] (warn_slowpath+0x70/0x8c)
[ 412.081291] [<c0086584>] (warn_slowpath+0x0/0x8c) from [<c02c7444>] (dst_release+0x44/0x50)
[ 412.089609] r3:becfc5c7 r2:00000000
[ 412.093173] r7:0101a8c0 r6:00000000 r5:c590bf00 r4:cc06a9a0
[ 412.098813] [<c02c7400>] (dst_release+0x0/0x50) from [<c02fb95c>] (ip4_datagram_connect+0x164/0x27c)
[ 412.107931] [<c02fb7f8>] (ip4_datagram_connect+0x0/0x27c) from [<c0305b34>] (inet_dgram_connect+0x78/0x80)
[ 412.117577] [<c0305abc>] (inet_dgram_connect+0x0/0x80) from [<c02b3afc>] (sys_connect+0x74/0x98)
[ 412.126336] r7:000220a4 r6:c590bf00 r5:00000010 r4:c0d408e0
[ 412.131976] [<c02b3a88>] (sys_connect+0x0/0x98) from [<c002be80>] (ret_fast_syscall+0x0/0x2c)
[ 412.140496] r7:0000011b r6:00000000 r5:afe41328 r4:00022094
[ 412.146128] ---[ end trace 2786fd1b0831bd89 ]---
[ 412.150740] enter ip_route_output_flow
[ 412.154468] net:c0610950
[ 412.156976] *rp:0
[ 412.158886] flp:c590be70
[ 412.161415] sk:cc06a9a0
[ 412.163835] flags:1
[ 412.165918] trying to run __ip_route_output_key
[ 412.170466] finished __ip_route_output_key() ==0
[ 412.175031] *rp:0
[ 412.176961] Unable to handle kernel NULL pointer dereference at virtual address 000000e0
[ 412.185039] pgd = c6564000
[ 412.187706] [000000e0] *pgd=05c1b031, *pte=00000000, *ppte=00000000
[ 412.193959] Internal error: Oops: 17 [#1] PREEMPT
[ 412.198642] Modules linked in: nf_nat nf_conntrack_tftp nf_conntrack_irc nf_conntrack_ipv4 nf_conntrack_ftp nf_conntrack nf_defrag_ipv4 ipv4_netfilter x_tables netfilter tiwlan_drv x8uv x8mddi synaptics_i2c_rmi4 twofish twofish_common dm_crypt dm_mod sdio
[ 412.221217] CPU: 0 Tainted: G W (2.6.29 #1)
[ 412.226476] PC is at ip_route_output_flow_dx+0xd0/0x2cc [netfilter]
[ 412.232684] LR is at release_console_sem+0x1b4/0x218
[ 412.237626] pc : [<bf12f218>] lr : [<c0086d14>] psr: 60000013
[ 412.237636] sp : c590be18 ip : c590bd48 fp : c590be54
[ 412.249077] r10: 00000000 r9 : 00000000 r8 : c0610950
[ 412.254289] r7 : 00000001 r6 : c590beac r5 : cc06a9a0 r4 : c590be70
[ 412.260799] r3 : 00000000 r2 : c590be70 r1 : c590beac r0 : c0610950
[ 412.267311] Flags: nZCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment user
[ 412.274427] Control: 00c5387d Table: 06764008 DAC: 00000015
...
[ 413.187096] Backtrace:
[ 413.189527] [<bf12f148>] (ip_route_output_flow_dx+0x0/0x2cc [netfilter]) from [<c02fb97c>] (ip4_datagram_connect+0x184/0x27c)
[ 413.200812] [<c02fb7f8>] (ip4_datagram_connect+0x0/0x27c) from [<c0305b34>] (inet_dgram_connect+0x78/0x80)
[ 413.210447] [<c0305abc>] (inet_dgram_connect+0x0/0x80) from [<c02b3afc>] (sys_connect+0x74/0x98)
[ 413.219216] r7:000220a4 r6:c590bf00 r5:00000010 r4:c0d408e0
[ 413.224857] [<c02b3a88>] (sys_connect+0x0/0x98) from [<c002be80>] (ret_fast_syscall+0x0/0x2c)
[ 413.233366] r7:0000011b r6:00000000 r5:afe41328 r4:00022094
[ 413.239006] Code: e3530000 e1a00008 05963000 e1a01006 (059330e0)
[ 413.246996] Kernel panic - not syncing: Fatal exception
[ 413.250359] Rebooting in 1 seconds..<6>smd_close(ccc87e00)

seems __ip_route_output_key() no longer produces a valid rtable struct:

[ 412.170466] finished __ip_route_output_key() ==0
[ 412.175031] *rp:0

Very interesting is also the waning at kernel/net/core/dst.c:270 dst_release+0x44/0x50()

Its only occuring with nf_nat.ko loaded

Can you reproduce this?

EDIT: is it possible this has sth. todo with ip route cache, since __ip_route_output_key checks that cache and it maybe isn't valid anymore after nf_nat is loaded? Is there a way to flush this cache?

I also added insmodnet script at the end of hw_config.sh so it gets loaded before any network traffic occurs (at least i hope so).

Now i get kernel panic at ip_rcv when tiwlan driver initializes. Attached dmesg.

I also found an interesting article describing the walkthrough of the linux network stack here. Actually its for 2.4 kernel but alot also seems to apply to 2.6. Not sure if this maybe helpful...

EDIT2: forget about ip route cache, theres some trouble even before, when i load all modules and ping 192.168.1.1 (my router) i got following:

<4>[ 780.463705] enter ip_route_output_flow
<4>[ 780.463918] net:c0610950
<4>[ 780.464415] *rp:0
<4>[ 780.467155] flp:c549be70
<4>[ 780.468850] flp->fl4_src:e
<4>[ 780.473243] flp->fl4_dst:0
<4>[ 780.474233] sk:cc167220
<4>[ 780.476656] flags:1
<4>[ 780.478771] trying to run __ip_route_output_key
<4>[ 780.484740] finished __ip_route_output_key() ==-22

look at the flp adresses, they are completely screwed up

so far my progress ;)