[Xperia Z1 Original Android Development] delewer:
I don't have git (i dont like git)

I work directly with sources, and publish here when i have somethinks new to show.

I don't see kernel panic on the pastbin...

You test with locked bootloader ?

If yes, panic is surely provoc by the read only memory....

If you try to write any extern variables, this cause a tainted panic by kernel MMU

For ex :

extern unsigned long kexec_start_address;

extern unsigned long kexec_indirection_page;

extern unsigned long kexec_mach_type;

extern unsigned long kexec_boot_atags;

These extern data from "machine_kexec" are used by "relocate_kernel"

You can read these data without any pb, but, if you try to modify one of them, you have a kernel panic.

For ex :

printk ("Kexec: Debug kexec_start_address %p", kexec_start_address);

run without any pb.

kexec_start_address = image->start;

provoque a kernel panic.

I search the solution to bypass this mmu protection.

I have try to use "set_memory_rw", but, for any obscur reason, don't work...

I thinks it's a HW protection, or a sony toolchain protection (include into stock kernel)

So, i try to found how to call "relocate_kernel" without any use of "extern" data.

Another pb exist here too :

//soft_restart(reboot_code_buffer_phys);

my_soft_restart = (void *)kallsyms_lookup_name("soft_restart");

my_soft_restart(reboot_code_buffer_phys);

I must use kernel "soft_restart" but, because it is called by a module, it cause a kernel panic... I don't know why... It's the real challenge !!

May be it is the "reboot_code_buffer_phys". Into the stock kernel, this address is passed and rewrite or logged... and provoc the panic.

So, i must extract this function (soft_restart) and rewrite the part wich provoc the panic...

To bypass any toolchain protection, i think write directly in "asm"... but only if it's really needed...

If we have a hw protection, i must find a RW area let free by S800 CPU, and use it... or must difficult... found the flag to switch (if it's not a fuse)

Another challenge for me, it to found "time"... (real life is here)

EDIT 1 :

I am completly blind....

Now, i see this in your pastbin :

Modules linked in: kexec_load procfs_rw cw1200_wlan cw1200_core

Try this before your kexec call :

rmmod cw1200_wlan

rmmod cw1200_core

May be better without any unused module wich can "ù$£*^¨f" your memory on kernel reboot... ;)

EDIT 2 :

If "fs_write" function can let memory in rw mode and unlocked mm protection, have you try to test with "fastboot boot new_kernel.img" ??

May it work ??

And,

If "fs_write" function can let memory in rw mode and unlocked mm protection, have you try to use a kernel guest compilled with the "CONFIG_ARM_APPENDED_DTB=y" option in defconfig, and ("cat zImage <filename>.dtb > zImage_w_dtb") ??

EDIT 3 :

I see this in your "machine_kexec"

local_irq_disable();
local_fiq_disable();
setup_mm_for_reboot(0); /* mode is not used, so just pass 0*/
flush_cache_all();
outer_flush_all();
outer_disable();
cpu_proc_fin();

Can you try with ?

soft_restart(reboot_code_buffer_phys);

I think it's better because S800 use a special protocol to shut off all boot cpu (x4 cpu) a let reboot initialize CPU

"setup_mm_for_reboot" can let 2 cpu on line...