yashsingh1/xdaforums huggingface dataset:
[Xperia Z1 Original Android Development] delewer:
A few informations about kexec-tools debug

in kexec.c

Fonction :

if (file_type.load(argc, argv, kernel_buf,

kernel_size, &info) < 0) {

fprintf(stderr, "Cannot load %s\n", kernel);

return -1;

}

With a forced execution of kexec (bypass error to see...)

--mem-min=0x90000000

kernel: 0xb6b9d008 kernel_size: 3e9340

debug: 1 - after get memory range

debug: 2 - after type test

debug: 3 - after type test

debug: 4 - after info.kexec

debug: Focus 1 - argc '5' ; argv 'be856774' ; kernel_buf 'b6b9d008' ; kernel_size '3e9340' ; info 'be856548' ; i '1' ; file_type.name 'zImage'

Could not find a free area of memory of 3f1340 bytes...

Cannot load zImage

debug: 10 - before trampoline

debug: 11 - after trampoline

debug: 12 - before segment load

debug: 13 - after segment load

debug: 8 - before sort_segment

debug: 9 - after sort_segment

debug: 6 - before purgatory

debug: 7 - after purgatory

kexec_load: entry = (nil) flags = 280004

nr_segments = 0

kexec_load failed: Function not implemented

entry = (nil) flags = 280004

nr_segments = 0

debug: 5 - return result : ffffffff

With a forced bypass on file_type.load , we have this :

--mem-min=0x20000000

debug: Focus 1 - argc '5' ; argv 'bef18774' ; kernel_buf 'b6bc7008' ; kernel_size '3e9340' ; info 'bef18548' ; i '1' ; file_type.name 'zImage'

Segmentation fault
[Xperia Z1 Original Android Development] Shaky156:
Did you compile this kexec yourself? Or did you get this from krapabbel? I issued krapabbel to compile a new debug version have gave him the code but never heard back from him :/

Anywayz so cannot find free memory is the issue
[Xperia Z1 Original Android Development] aweosomeabhijeet:
deleted
[Xperia Z1 Original Android Development] Knucklessg1:
Is development dead?
[Xperia Z1 Original Android Development] olokos:
It seems like yeah.

Wysłane z mojego C6903 przy użyciu Tapatalka
[Xperia Z1 Original Android Development] delewer:
No, but i search how to declare in mmu (with "mcr p15" instruction) memory in write mode

And not working yet

When found, everythings will work.
[Xperia Z1 Original Android Development] Knucklessg1:
This might have information to help write to the memory.
[Xperia Z1 Original Android Development] vkass:
RIP :'(
[Xperia Z1 Original Android Development] munjeni:
Here is an working example how to write to the kernel memory :

#include <linux/init.h>
#include <linux/module.h>
#include <linux/kernel.h>
#include <linux/version.h>
#include <linux/kallsyms.h>
#include <asm/mmu_writeable.h>

#define DRIVER_AUTHOR "flar2 / MohammadAG"
#define DRIVER_DESCRIPTION "Defeat system write protect"
#define DRIVER_VERSION "0.1"

#define HIJACK_SIZE 12

static int sony_ric_enabled(void)
{
return 0;
}

inline void arm_write_hook ( void *target, char *code )
{
unsigned long *target_arm = (unsigned long *)target;
unsigned long *code_arm = (unsigned long *)code;

mem_text_write_kernel_word(target_arm, *code_arm);
mem_text_write_kernel_word(target_arm + 1, *(code_arm + 1));
mem_text_write_kernel_word(target_arm + 2, *(code_arm + 2));
}

void hijack_start ( void *target, void *new )
{
unsigned char n_code[HIJACK_SIZE];

//ldr pc, [pc, #0]; .long addr; .long addr
memcpy(n_code, "\x00\xf0\x9f\xe5\x00\x00\x00\x00\x00\x00\x00\x00", HIJACK_SIZE);
*(unsigned long *)&n_code[4] = (unsigned long)new;
*(unsigned long *)&n_code[8] = (unsigned long)new;

pr_info("Hooking function 0x%p with 0x%p\n", target, new);

arm_write_hook(target, n_code);
}

static int __init wp_mod_init(void)
{
pr_info("wp_xperia_mod: %s version %s\n", DRIVER_DESCRIPTION,
DRIVER_VERSION);
pr_info("wp_xperia_mod: by %s\n", DRIVER_AUTHOR);

hijack_start((void *)kallsyms_lookup_name("sony_ric_enabled"), &sony_ric_enabled);

return 0;
}

module_init(wp_mod_init)

MODULE_AUTHOR(DRIVER_AUTHOR);
MODULE_DESCRIPTION(DRIVER_DESCRIPTION);
MODULE_VERSION(DRIVER_VERSION);
MODULE_LICENSE("GPL");
[Xperia Z1 Original Android Development] delewer:
Well...

"mem_text_write_kernel_word" work perfectly thx a lot munjeni ;)

I have change this :

#include <linux/module.h>
#include <linux/kallsyms.h>
#include <asm/mmu_writeable.h>
void **my_syscall_table;
my_syscall_table = (void **)kallsyms_lookup_name("sys_call_table");
(...)
mem_text_write_kernel_word(&my_syscall_table[__NR_kexec_load], my_kexec_load);
mem_text_write_kernel_word(&my_syscall_table[__NR_reboot], reboot);
(...)

And no more oops kernel error

We must change this too :

(...)
mem_text_write_kernel_word(&kexec_start_address, image->start);
mem_text_write_kernel_word(&kexec_indirection_page, page_list);
mem_text_write_kernel_word(&kexec_mach_type, machine_arch_type);
mem_text_write_kernel_word(&kexec_boot_atags, image->start - KEXEC_ARM_ZIMAGE_OFFSET + KEXEC_ARM_ATAGS_OFFSET);
mem_text_write_kernel_word(&kexec_hardboot, image->hardboot);
(...)

My sources are completly breaked... I need few time to clean all my sources and test with DoomLord kernel

ps :I have test with .757 kernel ;)
[Xperia Z1 Original Android Development] delewer:
After some tests with cleaned sources i have gray results...

I have no more need to install "driver" to have a communication with kexec_module.

Old and solid "kallsys replacement" method work for "kexec_load" and "reboot" :good:

So this part is OK

(...)
#include <linux/kallsyms.h>
#include <asm/mmu_writeable.h>
(...)
my_syscall_table = (void **)kallsyms_lookup_name("sys_call_table");
/*debug*/printk("Kexec_load: Replacement... : \n");
/*debug*/printk("kexec_load : my_syscall_table : %p\n", my_syscall_table);

/* Set kexec_load() syscall. */
/*debug*/printk("kexec_load : kexec_load before replacement : %p\n", my_syscall_table[__NR_kexec_load]);
mem_text_write_kernel_word((long unsigned int *)&my_syscall_table[__NR_kexec_load], (long unsigned int)my_kexec_load);
/*debug*/printk("kexec_load : kexec_load after replacement : %p\n", my_syscall_table[__NR_kexec_load]);

/* Swap reboot() syscall and store original */
/*debug*/printk("kexec_load : reboot before replacement : %p\n", my_syscall_table[__NR_reboot]);
original_reboot=my_syscall_table[__NR_reboot];
mem_text_write_kernel_word((long unsigned int *)&my_syscall_table[__NR_reboot], (long unsigned int)reboot);
/*debug*/printk("kexec_load : reboot after replacement : %p\n", my_syscall_table[__NR_reboot]);
/*debug*/printk("Kexec_load: End replacement... : \n");

Now, in "machine_kexec"

This, don't work...

mem_text_write_kernel_word((long unsigned int *)&kexec_start_address, (long unsigned int)image->start);
mem_text_write_kernel_word((long unsigned int *)&kexec_indirection_page, (long unsigned int)page_list);
mem_text_write_kernel_word((long unsigned int *)&kexec_mach_type, (long unsigned int)machine_arch_type);
mem_text_write_kernel_word((long unsigned int *)&kexec_boot_atags, (long unsigned int)image->start - KEXEC_ARM_ZIMAGE_OFFSET + KEXEC_ARM_ATAGS_OFFSET);

I have search for function in mmu.c

void mem_text_address_writeable(unsigned long addr)
{
struct task_struct *tsk = current;
struct mm_struct *mm = tsk->active_mm;
pgd_t *pgd = pgd_offset(mm, addr);
pud_t *pud = pud_offset(pgd, addr);

mem_unprotect.made_writeable = 0;

if ((addr < (unsigned long)RX_AREA_START) ||
(addr >= (unsigned long)RX_AREA_END))
return;

mem_unprotect.pmd = pmd_offset(pud, addr);
mem_unprotect.pmd_to_flush = mem_unprotect.pmd;
mem_unprotect.addr = addr & PAGE_MASK;

I thinks "relocate_kernel" of my module is out of "RX_AREA_START" and "RX_AREA_END"

So, address can't be write.

If someone have a idea ? :confused:

---------------

EDIT POST 1 :

I have create my own "mem_text_address_writeable" without area limitation..

Same result "Unable to handle kernel paging request at virtual adress"

Address is "&kexec_start_address" ...
[Xperia Z1 Original Android Development] munjeni:
Try to reserve and free memory like I done for kexec hard boot (iomem), you can see commit on my git in kernel for locked bootloader!
[Xperia Z1 Original Android Development] delewer:
I have successfully reserved memory in /proc/iomem

eg :

bf36d304-bf36d38c : kexec_relocate_kernel

But, memory is alway "ro"... i have a "oops" again... I thing it's because it's not located in "System RAM".

I'm going to rewrite code to directly write in "reboot_code_buffer" to change values...

When host kernel reboot to guest kernel... i don't know how "ro memory" can be redefined by guest kernel without a complete free of memory :confused:
[Xperia Z1 Original Android Development] munjeni:
Did you tried to use hijack_start function?
[Xperia Z1 Original Android Development] delewer:
Don't work.

The major part of the "hijack_start" is "mem_text_write_kernel_word" function to avoid protection faults (writes to read-only kernel memory) when CONFIG_STRICT_MEMORY_RWX is enabled (Read and Execute in system RAM only)

The rest of hijack can't help to write in Read-Only part of system.

I have include in my kexec the hijack... but without success..

To be continue...
[Xperia Z1 Original Android Development] munjeni:
Hmm, relocate_kernel.S seems need some hacking, did you tried to replace relocate_new_kernel function?
[Xperia Z1 Original Android Development] delewer:
:D success !!

I have hack "relocate_kernel" in user space and all is ok ^^

I continue ^^
[Xperia Z1 Original Android Development] munjeni:
What is remaining? :)
[Xperia Z1 Original Android Development] delewer:
I have modify my 1rst post

Sources and binaries.

I have nothing to test here... only an old jb kernel ^^... so with a KK doom kernel (not patched) and no ramdisk, i am blocked by fatality ^^
[Xperia Z1 Original Android Development] munjeni:
So not working? :eek:
[Xperia Z1 Original Android Development] Okluzhion:
Does that mean kexec is working for JB kernels on LB now?

Sent from my eXposed C6603
[Xperia Z1 Original Android Development] Knucklessg1:
So is this working? It's possible to load a KitKat AOSP kernel with kexec now?
[Xperia Z1 Original Android Development] delewer:
I m working on patch for stock kernel with "dtb append" (custom kernel)

It's for locked bootloader.

After this, i test aosp patch.

for now i have black screen with guest kernel.
[Xperia Z1 Original Android Development] munjeni:
Probably you have used an old kexec tool which use dtb appended to the kernel? I had the same black screen since dtb can not be used in "whole form", you must cut last part of the dt.img and append them to the zImage and it will be working! Appending whole dtb is not working! But in my latest bootmenu I have compiled new kexec tool which use dt.img instead of needs for appending part of the dtb anymore. You can try this one from attachments:

- Here is kexec which no need "append", just use dt.img by defining --dt parameter + path to the dt.img

- Kernel patch

I have used them with my botmenu project with success! Hope you find something usefull from these...
[Xperia Z1 Original Android Development] munjeni:
But if you no need new kexec tool, here is my tool which I have created for making zImage-dtb (appended)
[Xperia Z1 Original Android Development] delewer:
Cut dtb ?

^^

My 6 month sources cut dtb directly when loaded into kexec. I have include into dtb loading by kexec, research of magic, lengh and cut. I keep only the first occurs. So my sources theoricaly work... but i have black screen :(

so, i test appended and not appended dtb guest kernel to see differences

I have test last night, and don't see your posts... silly me !!

i test your sources when i can (i m in my job)

I see another method to call relocate (from tassadar sources), because on v7, cpu freeze sometime when memory is flush.

i post when i have something new

Thx a lot !
[Xperia Z1 Original Android Development] munjeni:
I cut last ocours since first one not worked!
[Xperia Z1 Original Android Development] delewer:
Arf !!!! :banghead:
[Xperia Z1 Original Android Development] Galcactus:
People, this thread claims to have Kexec:

http://xdaforums.com/showthread.php?t=2747215

Anyone want to check the work? It's for the TX...
[Xperia Z1 Original Android Development] Knucklessg1:
Is this working currently?
[Xperia Z1 Original Android Development] Galcactus:
Allegedly so. I don't know how to test it though...
[Xperia Z1 Original Android Development] joecool666:
hi, how do i use this tool and patch any tut, i have a C6903 L.B, might be willing to try, any help would be graetful, regards joe.
[Xperia Z1 Original Android Development] mchlbenner:
I have z1s I would like to get this working
[Xperia Z1 Original Android Development] smgdev:
Compiling

Hello [MENTION=4225567]delewer[/MENTION], Its an awesome work. However, I could not get it to compile. The arch/arm/include/asm/mmu_writable.h is missing on my kernel sources. Its a 2.6.39 kernel. Is there anything I can do about it? Is there any device or kernel specific code in v10 zip? Cause I could compile the older zip source which called kexec-tools-delewer-V1.zip.

Edit:

When I try to load a v1 or v1.1 source compiled module, it shows some memory map or something like that and says kexec_load: function not implemented. I run it with --atags argument cause I don't know how to create a dtb. But when I lsmod, I can see both kexec_load module and procfs_rw module. Also I can interact with the driver.

[IMG="The command I am using is kexec --load zImage --atags. It doesnt make a difference if I am using the hardboot argument or defining a mem-min value."]http://i.imgur.com/zyxR5F9.png[/IMG]

The command I am using is kexec --load zImage --atags. It doesnt make a difference if I am using the hardboot argument or defining a mem-min value.

Thank you for this great work.

I am trying to port it to Sony Tablet S btw.

Sorry if I am disturbing you.
[Xperia Z1 Original Android Development] delewer:
Hi,

Thx, but it's not a awesome work yet because my new kernel won't boot on the older ;)

I can't help if your kernel sources does not have "mmu_writable.h" file

When i have this kind of missing source, i temporary suppress ".h" #include, and see what function is missing.

After what, i grep -ri on source to find in /arch/arm the good file.

also, for the module, i add missing function by direct call with "kallsyms_lookup_name" declaration.

My older sources with (V1) need to have driver to work.

With the last sources, you don't need to have drivers, and can't have "function not implemented"

See in the first post, i have post my last V11 kexec with a lot of fixes.

If you have something missing (function not found at kexec_load loading), please share, i try to help for that.

Good luck to you.
[Xperia Z1 Original Android Development] smgdev:
Hello [MENTION=4225567]delewer[/MENTION] , thanks for the (quick) answer.

I suppressed the mmu_writable.h as you said and tried to find that function but no luck,no function like that(neither on V11).

Anyway, I found the problem with kexec_load not implemented error, I were using thw v10 binary against the v1.1 sourced module, tried with home-built binaries and it worked, it loads kernel without problem (with 0 exit code.). But when I try to execute it with kexec -e -x command,It says

"kexec failed: No such file or directory".

I got deep into the source to find the cause. I found the following function:

static int my_shutdown(void){
char *args[] = {
"shutdown",
"-r",
"now",
NULL
};

execv("/sbin/shutdown", args);
execv("/etc/shutdown", args);
execv("/bin/shutdown", args);

perror("shutdown");
return -1;
}

I guessed that was the problem cause my device have the reboot binary instead of shutdown and the folder structure was wrong. So I changed that to:

static int my_shutdown(void)
{
char *args[] = {
NULL
};

execv("/system/bin/reboot",args);
execv("/system/xbin/reboot",args);

perror("reboot");
return -1;
}

I thought that were going to fix everything but I was wrong. The problem were the following function.(Again, I guess. :eek: )

static int my_exec(void)
{
int result;

//////////////////////////////////////////////
// Remplacement de "syscall" - Par Delewer //
// Novembre 2013 //
//////////////////////////////////////////////
//
//	result = kexec_reboot();

const char fn[]= "/dev/kexec_driver";
FILE *fp;
fp = fopen(fn, "w");
if (!fp)
{
fprintf(stderr, "Kexec_driver non implemented\n");
fprintf(stderr, "Please, prepare by typing the following commands :\n");
fprintf(stderr, " => mknod /dev/kexec_driver c <major number> 0\n");
fprintf(stderr, " => cat /dev/kexec_driver\n");
return -1;
}
fwrite("boot", 1, 4, fp);
fclose(fp);
//////////////////////////////////////////////

/* I have failed if I make it here */
fprintf(stderr, "kexec failed: %s\n",
strerror(errno));
return -1;
}

I think the fwrite line doesn't make its job, but anyway I tried echo boot > /dev/kexec_driver but the device did not reboot. So I checked the dmesg. The only thing I could find about this process or module or driver was that line:

"<6>[83652.446275] procfs_rw: procfile_read (/proc/atags) called"

I think the comment line at the end tells truth. /* I have failed if I make it here */

Any thoughts about this situation? And can you explain the last block after the comment line? I mean how this program can make it to there?

I am so sorry about this long post and the questions. :angel: Have a good day. Thanks.

And I am also sorry about my English grammar knowledge.

Tevfik
[Xperia Z1 Original Android Development] delewer:
Well..

In 1rst, please don't try with V1.1 ;)

For a lot of reason, you failed to success to boot with.

For eg : - not aligned memory, no "reloc_kernel" addresses attribute are definitively good reasons

Other pb is with driver.. It's work, but you need to mount a lot of files system at early boot, and cause random pb

If you have atags with a stock phone with locked kernel, you need to use "procfs_rw" to create you own "atags" file, and only if atags is missing... but, if you use "Device Tree Blob" (called "DTB") like our Z1 have, you don't need any "atags"... It's atags or Dtb, but not both.

Our kexec is coded for dtb file, and feed the same register at boot to replace atags address by dtb address.

If you don't know, if you need a Dtb file on your phone, you have a problem ;) Dtb is like atags... It's directly used by kernel to link hardware to kernel software, and is generated at guest kernel compil (vs host kernel we don't have sources).

Please try with V11 sources and see if you have a freeze in the "machine_kexec" addresses alloc for "relocate_kernel"... it's the key to have a kexec module working for a locked bootloader.

We have a static ro memory for loaded module on Z1 (by smp mmu protection on stock kernel), and i have create a dynamic relocate_kernel function in user space to bypass this protection.

It's not the best solution, but it work...

I m block at "soft_restart" function because of "cpu_proc_fin" freeze ("mcr p15" mmu roolback can't be exec)

So, i search...
[Xperia Z1 Original Android Development] mirhl:
I hope these presentations may help
[Xperia Z1 Original Android Development] LaosPerson:
We are third wheels, we are most of the time completely ignored when it comes down to stuff like this lol
[Xperia Z1 Original Android Development] smgdev:
Before I can start to patch the memory adresses and atags stuff, I have to get it compiled. I can't compile the v10 and v11. My kernel is missing the mmu_writable.h header file unfortunately. I suppressed it and tried to find some similiar functions but it didn't work. Do you have any ideas for that? kernel version is 2.6.39.
[Xperia Z1 Original Android Development] smgdev:
Nevermind, I found some code to hook system call table without using mmu_writable header file. I am making my own module built on top of yours.

Thanks, [MENTION=4225567]delewer[/MENTION] .
[Xperia Z1 Original Android Development] JustPlayingHard:
Excuse me. Is this project still active i am so waiting patiencely to try CM11 or Dirty Unicorns on my Z1 With Locked Bootloader curiosity of EE UK
[Xperia Z1 Original Android Development] munjeni:
Well, I had the same situation and problem was:

- stock kernels on locked bootloader have no enabled config ATAGS, so atags is all time empty, you can hack atags by making them available in proc directory but it will be all time empty. I have tried to port ATAGS part of kernel to module but I must say thats a hard job, good luck to you proting them! Atags is created on boot time so you need a very good idea to hack/port them trought an kernel module or whatever. I had no luck making kexec working on locked bootloader since I had no idea how to enable atags and make them no empty.
[Xperia Z1 Original Android Development] munjeni:
Hey [MENTION=4225567]delewer[/MENTION]! Need help! Status of my implementation:

1. implemented hardboot page reservation (success)

2. implemented kexec_load by hijacking sys_call_table (success)

3. implemented device tree (success)

4. implemented the rest (success but kernel panic in func machine_kexec_prepare)

log 1 (seems everything right kexec binary side):

Log 2 (last_kmsg):

- http://pastebin.com/1CMJxyTe

Makefile for module:

Here is my source code, please see if I have missing something!
[Xperia Z1 Original Android Development] :
I thank you so much for dev on kexec... I hope you can make it... if i can help with testing just say it...
[Xperia Z1 Original Android Development] delewer:
hi munjeni

Your kexec mod is not grant by MMU to write in memory. It's a S800 security implemented in kernel by sony

I haven't found yet how to, in the fly, unabled this.

Your panic is on the "mem_text_write_kernel_word" instructions

I see how to mod memory driver, but, it's not easy.
[Xperia Z1 Original Android Development] munjeni:
Yes it fail on mem_text_write_kernel_word but I realy not found why. These function working on other modules without any problem, but on this kexec it failed. I have searched a lot by grep KEXEC and have analysed every file which contain these word, but unable to get reason for that. From my thinking probably module can not write to these memory region, but builtin module can. MAybe only builtin modules have rights for that? What you think? Apsolutly I have no ideas why it happen :( Allso I found some complains in reboot function while I using strace for analysing kexec binary! I have tried your module, everything seems right but reboot function allso fail trought strace analyse!

Edit:

probably ssize_t sys_kexec_load (which live on 0xc01b4d38):

probably we can not hook sys_kexec_load function since after hooking these function mem addresse is changed to xbf36915c so it looks like this:

0xbf3680e4 is near hooked sys_kexec_load which looks like kexec fail since its not 0xcXXXXXXX, instead it is now 0xbXXXXXXX

next thing:

I have no idea how to solve this. Do you have info where is limit? For example 0xCfffffff is kernel space end & 0xB0000000 is userspace start (just example :)).

Edit:

Probably all external modules is limited since it lives in 0xBxxxxxxx memory so all calls from 0xBxxxxxxx is blocked by mmu, while builtin modules which live in 0xCxxxxxxx memory have rights for that :( Or at least maybe there is diferencies in page size between 0xbxxxxxxx and 0xcxxxxxxx ? Probably we will need to locate function which is used for limiting that and hook them?
[Xperia Z1 Original Android Development] delewer:
Thx a lot for this review !

I thinks it's not a pb from addresses, but TO addresses.

For ex, in kexec.c you have a mem_text_write_kernel_word, and work perfect

It's because the target addresses write are located in a rwx memory range.

I have solve this part of kexec by a user memory use, to code the reloc_kernel

My kexec panic at the "soft_restart" function, module coded or "in kernel" called.

MMU panic at every step ;)

I have thinking of a looot of solution.

One of them is to rewrite in the fly memory driver

Another, a custom "insmod" to load in a not protected memory range;

None of theses ideas are nice.

Welcome ! ;)

Edit 1:

Search a way to use another virtual memory in 0xB addreses is brillant, and stop to use 0xC !

I see to do that.