yashsingh1/xdaforums huggingface dataset:
[Xperia Z1 Original Android Development] munjeni:
I not understand why soft_restart fail, seems these kernel function is bad?

Edit:

This function is tested by me by separate kernel module and I confirm it is working (I have sucesfully rebooted into few modes which mean func is ok):

I do not know why reboot call complain in my kexec module because soft_restart func call is til after kexec_hardboot_hook in machine_kexec function! Maybe kexec binary have his own reboot function? On separate module harboot_hook reboot is working so probably reboot comming from kexec binary, or I am wrong :)
[Xperia Z1 Original Android Development] munjeni:
Maybe we can try to write to 0xBxxxxxxx with __raw_writel just for testing if problem is mmu or we have paging problem!
[Xperia Z1 Original Android Development] neXus PRIME:
Off topic:

If this thing works, Can it be implemented on Other locked Xperia devices? eg.huashan with MSM8960 S4 pro.
[Xperia Z1 Original Android Development] munjeni:
Probably yes!
[Xperia Z1 Original Android Development] mirhl:
Anything interesting/useful in here?
[Xperia Z1 Original Android Development] Aphole:
what are the the commands to disable: kernel level write protection, ssm, and change sony bootloader to a brown device?

i am on an xperia c6606 it has a snapdragon i believe,... so these would be similar methods right??????????
[Xperia Z1 Original Android Development] [NUT]:
It would be great if we can finally get this thing to work properly, that way we can finally bring locked bootloader root to the devices from the Z3+ upwards, getting root is not hard (any more) but it's impossible to have it stick. Because if you modify system on those devices they end up in a bootloop due to dm-verity...

If we could load the kexec module to the running kernel to eventually make that boot an alternate system partition instead (stored in a disk image) that would be the safest way to have root and complete control over the device/rom, without ending up in a bootloop...

[MENTION=4225567]delewer[/MENTION] [MENTION=4939386]Surge1223[/MENTION] [MENTION=4120742]munjeni[/MENTION] [MENTION=5065662]smgdev[/MENTION]

I'm not a C/C++ programmer myself, I'd love to take on this task if I could... but all I can do is help to structure the search for a solution and do a project lead... but I just hope to jolt your memory on this project and focus you back on this project... it would be the best news ever for Z3+/Z4/Z5 owners around the world.
[Xperia Z1 Original Android Development] Surge1223:
Agreed. After bypassing module loading restrictions and loading kexec and machine_kexec modules + atags/device tree info/modules it should be possible to kexec to another kernel, I have successfully got the kexec kernel to load into cache but usually that's where progress gets difficult. Normal kexec always gets corrupted in purgatory/cache but this might be a issue with cpu reset and shutdown implementations.

I had more successful using kexec-hardboot as a module, as that actually got me past the issues with cache I was having with normal kexec, I stopped messing with that module a while back when I got frustrated with memory remapping. But defs id like to see more projects like this.
[Xperia Z1 Original Android Development] smgdev:
I am not a z device owner, I actually joined this thread for another device but I had some experience with kexec and would love to help you guys.
[Xperia Z1 Original Android Development] threader:
Interesting, i was working with kexecboot some years ago, https://www.youtube.com/watch?v=1zQrY0NDsTg . applied the kexec harboot patches to out 4.4.4 kernel, but didnt get around to testing it much. Still needed that hardboot patch?
[Xperia Z1 Original Android Development] capt_planit:
I'm using V10 from page one. For some reason I just get couldn't find free memory when I run from internal storage. When I run from sdcard I get this:

dmesg | grep kexec

<4>[ 7242.237476] c0 Kexec: - Starting kexec_load...

<4>[ 7296.988567] c1 Kexec: - Starting kexec_load...

<6>[ 7296.988604] c1 Kexec: machine_kexec_prepare

<4>[ 7296.988642] c1 Kexec: kexec_info - Information

<4>[ 7296.988671] c1 Kexec: kexec_info - segment[0]: 0x40001000 - 0x40002000 (0x00001000) => zImage

<4>[ 7296.988718] c1 Kexec: kexec_info - segment[1]: 0x40008000 - 0x404ac000 (0x004a4000) => initrd

<4>[ 7296.988763] c1 Kexec: kexec_info - start : 0x40008000

<6>[ 7296.988805] c1 Kexec: machine_kexec_prepare - kexec_boot_atags : '0x4'

<6>[ 7296.988841] c1 Kexec: machine_kexec_prepare - image->start : '0x40008000'

<6>[ 7296.988880] c1 Kexec: machine_kexec_prepare - page_list : '0x0'

<6>[ 7296.988915] c1 Kexec: machine_kexec_prepare - machine_arch_type : '0xeb5'

<6>[ 7296.988952] c1 Kexec: machine_kexec_prepare - kexec_start_address ==> '0x40008000'

<6>[ 7296.988994] c1 Kexec: machine_kexec_prepare - kexec_indirection_page ==> '0x0'

<6>[ 7296.989032] c1 Kexec: machine_kexec_prepare - kexec_mach_type ==> '0xeb5'

<6>[ 7296.989072] c1 Kexec: machine_kexec_prepare - kexec_boot_atags ==> '0x40001000'

<6>[ 7296.989113] c1 Kexec: machine_kexec_prepare - reboot_code_buffer ==> '0xebdbf000'

<6>[ 7296.989155] c1 Kexec: machine_kexec_prepare - reboot_code_buffer_phys ==> '0x6bdbf000'

<6>[ 7296.989197] c1 Kexec: machine_kexec_prepare - my_reloc_kernel ==> '0xbf021bc0'

<6>[ 7296.989238] c1 Kexec: machine_kexec_prepare - relocate_new_kernel_size ==> '0x88'

<6>[ 7296.989330] c1 Kexec: C(")(") - kexec by delewer...

<6>[ 7296.989359] c1 Kexec: machine_kexec_prepare - End

<4>[ 7297.004716] c1 Kexec: - ---- kexec_load - result : '0'

The sad thing is, of the 3 different modules I've got currently compiled, this seems to be the closest to success. How do I debug this further? Am I right in assuming that this is caused by my lack of the system call in the running kernel?
[Xperia Z1 Original Android Development] :
Sorry wrong forum
[Xperia Z1 Original Android Development] capt_planit:
Well, here I am, one year later--still can't get it to work. If cpu_proc_fin won't return thanks to above issue you can try to use a proc-v7.S from a previous implementation. I used that available from the kexec_emulation module. Hope this helps someone. c_p
[Xperia Z1 Original Android Development] capt_planit:
Capt Necropost here. I have confusing behavior exhibited between v10 and v11. When trying to load the same kernel v10 says: kexec-zImage-arm : ----------------------------

INFO : Segment[0] - Start : 0x40001000 - length : 0x1000 - end : 0x40002000

INFO : Segment[1] - Start : 0x40008000 - length : 0x4a7000 - end : 0x404af000

Then accepts kexec -e and shuts down. While v11 says: INFO : Segment[0] - BUF - Start : 0x400ce008 - length : 0x4a6774

INFO : Segment[0] - MEM - Start : 0x40000000 - length : 0x4a7000 - end : 0x404a7000

Overlapping memory segments at 0x404a7000

And buggers off. The code responsible looks virtually identical to me. Any ghostly advice (just in time for Halloween). tyia c_p
[Xperia Z1 Original Android Development] chuckbtotheo:
I've been looking at this thread a lot over the years. And wish I could do something, but I've never coded.. Where should I start and what should I learn to help? I'd like to dedicate a lot of time on this.
[Xperia Z1 Original Android Development] capt_planit:
[MENTION=6076192]chuckbtotheo[/MENTION] 1) linux (there is cygwin too) 2) gcc that matches the version used to compile your kernel *Note* you must set your project environment or you will probably use the wrong gcc 3) kexec-tools source 4) kexec_load module source. Mostly you build these yourself but there are precompiled versions floating around on xda. If you look through all the threads dealing with kexec on xda you will find out pretty much all you need to get going. Good luck. c_p
[Xperia Z1 Original Android Development] delewer:
Yep i have compil kexec-tool myself (and kexeced kernel too)...

I try to find another way to load kernel in memory, bc i think the kernel is'nt too large for memory ... lol

may be can we use another load function ?
[Xperia Z1 Original Android Development] Shaky156:
Kexec cannot load if no zImage is being loaded to due not finding free memory, loading isnt the isssue, finding free memory is the issue, as a test to prove this, take off the hardboot option, load the kernel in RAM where there is free space and execute it that way, youll know that kernel load isnt the problem just finding free memory is
[Xperia Z1 Original Android Development] Shaky156:
There may be a miscalculation somewhere regarding where to put the kernel in memort hence why we cannot load the kernel, 4.1mb is needed, why dont we compile kernel with lzma if its not already done, thatll help alittle :)
[Xperia Z1 Original Android Development] delewer:
I compil kernel with :

CONFIG_HAVE_KERNEL_LZMA=y

and see if kexeked kabapel kernel with this option is ok....
[Xperia Z1 Original Android Development] Shaky156:
Errrr I compile lorddooms kernel, his compiles on XZ compression, which i dont think kexec supports, only gzip and lzma? If anyone can double check and confirm, confighavekernellzma, & configkernellzma should = y
[Xperia Z1 Original Android Development] delewer:
just for information...

compressed kernel with lzma his bigger than no lzma lol

4,1 Vs 4,15

so, i thave try :

kexec --load zImage.lzma --mem-min=0x0f00000000 --command-line="$(cat /proc/cmdline)"

debug: Focus 1 - argc '5' ; argv 'bea96754' ; kernel_buf 'b6bdf008' ; kernel_size '3f5414' ; info 'bea96528' ; i '1' ; file_type.name 'zImage'

debug: malloc - xmalloc mem_range '4511824'

Could not find a free area of memory of 3fd414 bytes...

lol ... if you could find a way to reduced size ?? :p
[Xperia Z1 Original Android Development] Shaky156:
I understand but that is minor as they have compressed with xz, compressing with lzma is the way to go as kexec can read lzma
[Xperia Z1 Original Android Development] Rekoil:
The whole point of this is to bypass the chain of trust. Basically, the bootloader will load a signed kernel, and then that kernel will in turn load a CyanogenMod kernel for example. But it is a difficult process.
[Xperia Z1 Original Android Development] DooMLoRD:
those working on this contact me via p.m with ur gtalk/hangout ids... it will be faster to discuss...
[Xperia Z1 Original Android Development] delewer:
I have debug Kexec-tool :

I have found the exact instruction witch cause the segfault

In "kexec-zImage-arm.c" :

(...)

switch (saved_tags->hdr.tag) {

case ATAG_INITRD:

case ATAG_INITRD2:

case ATAG_CMDLINE:

case ATAG_NONE:

(...)

When "saved_tags->hdr.tag" is read => segfault !!

I let you see how to solv this...

good night !
[Xperia Z1 Original Android Development] Shaky156:
Delete
[Xperia Z1 Original Android Development] delewer:
Work much more with

"const char fn[]= "/proc/rdtags";"

not "const char fn[]= "/proc/rdtag";"

No more segfault

but :

kexec_load failed: Function not implemented

still here...

Kexec Kernel implementation...

I suppr my debug and post the tool

:)

Edit 1 :

with "-mem-min=0x8000"

kernel: 0xb6b67008 kernel_size: 3e9340

kexec_load: entry = 0x10000 flags = 280004

nr_segments = 3

segment[0].buf = 0x18f4850

segment[0].bufsz = 208

segment[0].mem = 0x9000

segment[0].memsz = 1000

segment[1].buf = 0xb6b67008

segment[1].bufsz = 3e9340

segment[1].mem = 0x10000

segment[1].memsz = 3ea000

segment[2].buf = 0xb64bf008

segment[2].bufsz = 6a7500

segment[2].mem = 0xfad000

segment[2].memsz = 6a8000

kexec_load failed: Function not implemented

entry = 0x10000 flags = 280004

nr_segments = 3

segment[0].buf = 0x18f4850

segment[0].bufsz = 208

segment[0].mem = 0x9000

segment[0].memsz = 1000

segment[1].buf = 0xb6b67008

segment[1].bufsz = 3e9340

segment[1].mem = 0x10000

segment[1].memsz = 3ea000

segment[2].buf = 0xb64bf008

segment[2].bufsz = 6a7500

segment[2].mem = 0xfad000

segment[2].memsz = 6a8000

=> # lsmod

wlan 2758343 0 - Live 0x00000000 (O)

texfat 129349 1 - Live 0x00000000 (PO)

adsprpc 16639 0 - Live 0x00000000

adsp_loader 12473 0 - Live 0x00000000

cfg80211 160899 1 wlan, Live 0x00000000

hid_sony 12525 0 - Live 0x00000000 (O)

(kernel not loaded)

Here, the tool : http://xdaforums.com/attachment.php?attachmentid=2353177&stc=1&d=1382877631
[Xperia Z1 Original Android Development] Shaky156:
Woops nice find, btw is that with hardboot option enabled? Attempt to load without hardboot option enabled
[Xperia Z1 Original Android Development] delewer:
hey guy, test yourself ! lol

:)

Yes, i have test with all combinations possibles

...without succes

May be a missing Tag in rdtags ?

May be a bad "struct tag" ?

struct tag {
struct tag_header hdr;
union {
struct tag_core	core;
struct tag_mem32	mem;
struct tag_initrd initrd;
struct tag_cmdline cmdline;
} u;

May be a bad things in kexec Doom kenel ?

I don't know...

If somebody have a idea ? Please tell us

DoomLord, you're welcomes !

Edit :

Shaky156 please, change then Ramdisk link in the first post, it is the same than kexec-tool

And please, replace link with the new kexec-tool.. Thx.
[Xperia Z1 Original Android Development] delewer:
If you want to compil yourself the kexec-tools, do this :

Download the toolchain (if you don't have it)

sudo apt-get install gcc-arm-linux-gnueabi

Download the "kexec-tools" linked in first post of thread.

Download my configurator : http://xdaforums.com/attachment.php?attachmentid=2353367&stc=1&d=1382883687

and run with

. ./setup-cross

Yes, the first dot is needed.

Compils will be "Static" with this conf.

Go in "kexec-tools" folder, and :

./configure --target=arm-linux-gnueabi --host=arm-linux-gnueabi

In "purgatory/Makefile" file, delete

--no-undefined

Save Makefile

make clean
make

Result in "build/sbin" folder

kexec and kdump file to install in device Z1 (or ZU)

Enjoy.:D
[Xperia Z1 Original Android Development] Shaky156:
Dude youre a legend haha, ill update OP as soon as my computers fixed, got a important report to do so will try n be active on her too, was doing some research heres what i found out.

If you unlock your bootloader, it sets a tamper fuse in trustzone, ill be backing up tz partition if/when unlocking device.
[Xperia Z1 Original Android Development] Shaky156:
Could be missing tag in rdtag, I have a feeling something isnt right in kernel, ill have a look @ the kernel again to make sure/double check everything was implemented correctly
[Xperia Z1 Original Android Development] Shaky156:
EDIT: double checked the atag defines, they are perfectly fine so now kexec-tools is fine, need to double check kernel now, which can only be done once my computer boots up :/

EDIT2: I GOT IT!! :D We are missing atags!
[Xperia Z1 Original Android Development] Shaky156:
False alarm, btw watchdog is causing reboot on the dual recovery, from what i see, is dual recovery fixed?
[Xperia Z1 Original Android Development] delewer:
I look here for rdtag, in kernel :"board-rdtag.c"

struct rdtags_tag_const {
const char const key[16];
const char const value[32];
};

struct rdtags_build_tags {
const unsigned int magic;
const unsigned int size;
const struct rdtags_tag_const tag_array[NBR_OF_ELEMENTS];
};

And here, in kexec-tools : "kexec-zImage-arm.c"

(...)
struct tag *saved_tags = atag_read_tags();
(...)

I'll debug later zImage-arm (no computer here), to see what are results by procedure call in this module.

May be rdtag is complely false, and must be recodded
[Xperia Z1 Original Android Development] Desperanto86:
http://xdaforums.com/showthread.php?p=45149758#post45149758 partly fixed...fix of reboot broke timeservice
[Xperia Z1 Original Android Development] delewer:
I have create the "atags" file in "/data/atags" for now (by kexec-zImage-arm.c modification)

I create modules to load the custom kernel.

- "kexec_load"

And another to open rw the /proc folder

but, a can't load bc this :

insmod: init_module (...) failed (Exec format error)

i have a wrong signature :

dmesg | grep

(...) disagrees about version of symbol module_layout

Of course, i am on stock kernel (no choice)...

so, my uname -r give me :

3.4.0-perf-g66807d4-02450-g9a218f1

If someone give me the way to change the version in module ?

May be in .config

May be in Makefile

May be in symvers

May be in module.h => __attribute( (...) __version)

May be in other way ?

Thx to help me.

Edit 1 :

I have try with modprobe too, with same error

the "-f" to force don't exist

Edit 2 :

Ok, i have found

But the issu occurs.

If someone know how to edit the magicver of module to force module to load by insmod ?

Thx
[Xperia Z1 Original Android Development] delewer:
I don't anderstand

I have exactly the same vermagic

This module load correctly : /system/lib/module/mii.ko

This module don't : /system/lib/kexec_load.ko

strings mii.ko | grep vermagic

vermagic=3.4.0-perf-g66807d4-02450-g9a218f1 SMP preempt mod_unload modversions ARMv7

strings kexec_load.ko | grep vermagic

vermagic=3.4.0-perf-g66807d4-02450-g9a218f1 SMP preempt mod_unload modversions ARMv7

__mod_vermagic5

__mod_vermagic5

Any help please... Thx
[Xperia Z1 Original Android Development] bobthecooldad:
Would this help.

http://xdaforums.com/showthread.php?t=2399714&highlight=kexec&page=4

he made it fully working so you could use the files

https://github.com/munjeni/android_kernel_xperiago
[Xperia Z1 Original Android Development] delewer:
No, this don't help... it's kernel related thread, not module kexec issu thread.

Thx.
[Xperia Z1 Original Android Development] delewer:
I have succesfully load one of two needed modules by hacking modules loading process.

First module work :

# lsmod
procfs_rw 12455 0 - Live 0x00000000 (O)

It's not a vermagic issu, because vermagic is not a "key" to have a synchronisation between kernel and modules, but a signature to be sure the sources used are equals

The keys used are in module himself for each external modules include in kernel... it's "symbols" keys.

I have hack these keys to load module in closed stock kernel.

But i have this last issu to have a fully working kexec :

kexec_load: Unknown symbol init_mm (err 0)

This dmesg seem that i use a old kexec_load source for 2.6 kernel.

Yougest kernel have a lot of non exported vars, and non exported function.

init_mm is no longuer exported.

I must change the init_mm system.

Here the source :

void setup_mm_for_reboot(char mode)
{
unsigned long base_pmdval;
pgd_t *pgd;
int i;

if (current->mm && current->mm->pgd)
pgd = current->mm->pgd;
else
pgd = init_mm.pgd;

base_pmdval = PMD_SECT_AP_WRITE | PMD_SECT_AP_READ | PMD_TYPE_SECT;

for (i = 0; i < FIRST_USER_PGD_NR + USER_PTRS_PER_PGD; i++, pgd++) {
unsigned long pmdval = (i << PGDIR_SHIFT) | base_pmdval;
pmd_t *pmd;

pmd = pmd_off(pgd, i << PGDIR_SHIFT);
pmd[0] = __pmd(pmdval);
pmd[1] = __pmd(pmdval + (1 << (PGDIR_SHIFT - 1)));
flush_pmd_entry(pmd);
}
}

Please, help me to replace "init_mm", or include declaration for this function

My compil speak a lot :

make
(...)
WARNING: "init_mm" [/home/kernel/kexec-module/kexec_load.ko] undefined!
(...)

I have found how declare struct in DooMLoRD Kernel, but i don't know how use it in a module.

Thx for help. :good:
[Xperia Z1 Original Android Development] onlyolli:
Hey guys,

i havent done any kernel compiling for android, but i did enough c development and kernel-module compiling on linux to know a bit about it. so i'd like to know, why isn't it just possible to use the original kernel-source provided by sony to compile the required modules and tools against those sources+headers? there shouldn't really be any hacking required, should it?

have a nice weekend, olli
[Xperia Z1 Original Android Development] delewer:
i answer only :

"unlocked bootloader alow :

no

"
[Xperia Z1 Original Android Development] king960:
Or Bootloader unlock allowed: no. :p
[Xperia Z1 Original Android Development] onlyolli:
No I didn't meant to compile and replace the kernel, that wouldn't work,obviously.. I meant, why isn't it possible to use the environment provided by those kernels headers and config to compile the required modules and tools? Or would any other problems arise from doing so?

Modifying source and header files sounds like compiling modules and tools against the wrong kernel version and ssources.
[Xperia Z1 Original Android Development] delewer:
Because this change anything for modules.

The new compil will have news kallsyms adresses, and modules won't load in memory.

So, Sony kernel or DooMLoRD kernel is the same way for me, except this, i only one kernel to maintain for now. It's a easy way.

The only way to have a loading module in a kernel, is the kernel is compil with option witch grant external module.

It's the same issu that stock kernel won't grant, and won't kexec, because stock kernel don't have any option to be open to community (on locked bootloader of course)

Sony gives sources for unlocked only...

Nota :

"kexec_load.ko" is loaded in memory now. Now i try to converse with.

Edit : "procfs_rw.ko" work

I have a "/proc/atags" now
[Xperia Z1 Original Android Development] king960:
Attempts on Xperia P (sorry IF i noob-ed with this post)

http://xdaforums.com/showthread.php?t=2053466
[Xperia Z1 Original Android Development] delewer:
It's a dead thread.

Because, it's a epic failed (for now).

********

Status of my attempts :

Modules loads : OK for two modules (kexec_load and procfs_rw)

- procfs_rw.ko => create "/proc/atags" => ok, but bad buf... it must be fix (easy part)

- kexec_load.ko => Loaded => ok but, the way to use is "syscall" add for kexec_load function => failed

why ? Because after 2.6 kernel (Z1 have 3.4.0 kernel), syscall_table is read only and had fixed size. So if i attempt to add value (kexec_load in our case), we have kernel panic.

But i have a solution to add function in LKM, is to add a "real" module call.

I have add a "kexec_driver" in "/dev" structure by :

insmod kexec_load.ko
mknod /dev/kexec_driver c 254 0
(...)
crw-rw-rw- root root 254, 0 2013-11-11 15:26 kexec_driver

Driver is in alpha stage and highty experimental

To be continue...
[Xperia Z1 Original Android Development] king960:
It would be great, IF this kexec method would be successful :D