yashsingh1/xdaforums huggingface dataset:
[Xperia Z1 Original Android Development] krabappel2548:
It's weekend, but the TWRP is fully functional yet and multirom also, only issue is that the Xperia M multirom is modified and uses another method to load the other roms then the original so now I have to:

- modify twrp to install roms another way

Or

- Modify multirom to fir original rom loading method again

But in the weekends I don't have time since I have a student jib and a gf :D
[Xperia Z1 Original Android Development] munjeni:
I have opened kexec kernel git and some things is based on your source, here is my git -> https://github.com/munjeni/stock_jb_kexec_kernel_for_locked_bootloader/commits/master

I have noticed old kexec binary which I used on custom Xperia kernel (kexec things worked like a charm) fail to see kexec_load (terminal say: function not implemented :(), but your kexec binary working but I have a lot of kernel panic things probably error come from kernel)... Using old binary I have noticed missing kexec sysfs (have implemented them into kernel, see on my git, but all time I have missing kexec_load)... please help me there, thanks! Are you implemented something into kexec binary related to the kernel kexec_load ??

Last_kmsg -> http://pastebin.com/SmxFtFB9

What might be a problem with line 27 ?
[Xperia Z1 Original Android Development] delewer:
I read in this moment your git.

I have notice your mod with included driver.

I try another way to add "from module or from native kernel kexec" a kexec call function with syms call from kernel.

take a look with this ex :

When you add a module into a Z1 kernel by "insmod", all entries are added into kallsyms automatically.

So, you can see :

grep kexec_load /proc/kallsyms
(...)
00000000 t kernel_kexec	[kexec_load]
00000000 t kexec_boot_atags	[kexec_load]
00000000 t machine_kexec_prepare	[kexec_load]
00000000 b kexec_reinit	[kexec_load]
00000000 b original_reboot	[kexec_load]
(...)

Give a try :

In kexec user program, you can found and add any kexec_load entry without "kptr_restrict" :

#include <linux/module.h>
#include <linux/kallsyms.h>
void (*my_kexec_load_module)(char *); // No return value, and 1 "char *" argument
static unsigned long *my_syscall_table;
static unsigned long *my_own_kexec_load;

into the "main" function :
my_syscall_table = (unsigned long *)kallsyms_lookup_name("sys_call_table");
my_own_kexec_load = (unsigned long *)my_syscall_table[__NR_kexec_load]; // or any syms you want from syscall table
my_kexec_load_module = (void *)kallsyms_lookup_name("printk");
my_kexec_load_module("passed argument"); // call kexec_load function, like "reboot" or "kexec_load", or call directly the function
// here, you print into dmesg your message
(you can use a lot of method to call module function from kernel, or module kernel)

I think, all this can reduce drastically kernel panic because you haven't no more the need to have a driver loaded.

I see your "sysfs_rw", and i gve a try with my locked bootloader.

Locked bootloader is not the real problem for kexec... pb is, we have a read only memory wich forbid to use any extern values needed for "sys call table" (bypassed by the adds i give here), or any "relocate_kernel" (i thinking a solution based on asm...)

So, your "sysfs_rw" is really interresting...

Thx for that...;)
[Xperia Z1 Original Android Development] munjeni:
Thanks for sugestions. I have solved a lot of kernel panic but remain is panic from (probably) from your syscal replacement, please see -> http://pastebin.com/RQKDZBNr If you have ida please let me know! Allso please open your git if you have a plan to continue your work on kexec (we can better view than).
[Xperia Z1 Original Android Development] munjeni:
So you think for example kexec_start_address...blabla failed? Ok I will try something. Do you have any better solution instead of using device driver, why - because I can see nothing using "grep kexec_driver /dev/devices", I think major problem is there (probably I have missing something, or at least something in my stock kernel defconfig is not enabled)

And another thing (I have not analysed in detail, but what is usage of the procfs_rw, is that realy needed? And allso (have not analysed, but will check soon) I think there is missing config_atags .
[Xperia Z1 Original Android Development] delewer:
No, i don't know.

If the modified extern value fails, you have a panic immediatly and don't go to "bye !" Kmessage...

But we see in pastbin, you go to.

Yep. It's the purpose of "kallsyms_lookup_name" in user program (not module)

You see module from user kexec pgm, and "trap" address to call without device_driver.

If device_driver is causing panic, we don't have another solution to call module kexec_load (because we can't change sys_call_table on locked bootloader)

I don't know...

This part of code (not mine) is for write on system FS (root of device).

But, this part of device is not a physical file on device.

I think it's not needed.

On Z1 we don't use atag, nein, non, jamais, nether !!

We use "device_tree". And this device_tree can be include into kernel.img (or in a separate file)

So we don't need to have a RW sysfs to write atag file.
[Xperia Z1 Original Android Development] munjeni:
Last 3 commits -> https://github.com/munjeni/stock_jb_kexec_kernel_for_locked_bootloader/commits/master

no errors (probably memory is reserved sucesfull?) , but why its not on /proc/iomem (probably reservation failed | need to reload iomem table?) ?

See log:

And another strange thing is: why --load-hardboot call from prg kexec fail to see kexec_load but not fail if I use standard --load ?

Edit:

solved with call sys table. Now remain only reservation in memory for kexec atags.
[Xperia Z1 Original Android Development] krabappel2548:
[MENTION=4225567]delewer[/MENTION], which command are you using and which ZImage? Because you need a zImage-dtb and this command:

/kexec --load-hardboot /cache/zImage-dtb --initrd=/cache/initrd.img --mem-min=0x20000000 --command-line="$(cat /proc/cmdline)" --dtb

Regular zImage won't work with our S800 I think, also don't forget to add dtb to the command to load device tree stuff.

Also note the min-mem value, it's working on unlocked bootloader so should also work on locked bootloader. Anyway if you can't get it to work I'll take a look at your files etc and lock my bootloader to see what I can do.

I'm not sure what you have done already with your kexec sources etc, github would be very handy to follow progress and changes tbh.

Anyway if you can't get it to work I'll take a look at your files etc and lock my bootloader to see what I can do.
[Xperia Z1 Original Android Development] delewer:
You are far far away from my work.

And very close to have a working module.

But... are you sure you have a locked bootloader ?

I can't see in your kexec_module any reason why you have no panic when you change the sys_call_table, and why i have panics (of course it's because i have a read only kernel memory, i repeat myself, because of my locked bootloader).

Your toolchain ? something else ?

From the beginning i search the solution to use the sys_call_table and the relocate_kernel.

If i use this code, it's for sure a panic :

/* Set kexec_load() syscall. */
sys_call_table[__NR_kexec_load]=kexec_load;
/* Swap reboot() syscall and store original */
sys_call_table[__NR_reboot]=kexec_call_reboot;

So i can't help... your sources can't be use for my device (but i try... just to be sure)

;)

Yep with your kexec, i can't use --dtb (because you search the folder "/device_tree")

I can use a kernel with dtb include into, with a custom kexec (or regular, with empty atags, because r2 register is bypass during boot process. It because the append_dtb option is used at compil... r2 is found by the research of dtb magic value and is unused for atags).

The sony kernel include the possibility to search at boot the DTB by itself with the append_dtb option in defconfig.

I have, of course, compiled with, and without the defconfig, the sony kernel and the Doom kernel

But, it's experimental and not pertinent for the moment... i don't have a kexec module working yet...

My priority is to found how use relocate kernel thru "soft_restart(reboot_code_buffer_phys)" without panic.

If i can use your kexec with a custom kexec_module for stock kernel, i do. No regret to delete my kexec and use your.

I use this command :

kexec --load-hardboot zImage --mem-min=0x20000000 --initrd=ramdiskCWM.img --dtb=dt.img --command-line="androidboot.hardware=qcom user_debug=31 maxcpus=2 msm_rtb.filter=0x3F ehci-hcd.park=3 msm_rtb.enable=0 lpj=192598 dwc3.maximum_speed=high dwc3_msm.prop_chg_detect=Y" -f

The "--command" is the Sony default command.

I think it's deprecated to use the /proc/cmdline because you have some bad options like this : "warmboot=0x000052d1"

The warmboot change at each step of boot process... It is the reason of boot...

Try your kexec with the default Sony value... to see...

If it's ok keep the Sony value... You can add a terminal command for when we can found the method to trace by serial the boot process

For ex with : --append="console=ttySAC2,115200 loglevel=4"

This append can be add into the commandline...

I haven't found how to listen this serials comm (by jack ? by usb with resistor ?)
[Xperia Z1 Original Android Development] krabappel2548:
Ok, I'm not really an expert at this, but I'll try to take a look at all of your sources as soon as I finish multirom (I think I have it working :p)

Also using cmdline worked perfectly on unlocked bootloader so not sure if that part would really matter to be honest.

Does the kexec-tools also has the code for the modules you build and use?
[Xperia Z1 Original Android Development] delewer:
Yep, first post, module sources included.

If you try, this module don't work because of relocate_kernel wich use adresses to zero (static vs extern)... a bug of course

My actual sources are breaked and unused

i must clean a lot of stuff i experiment.

I read a lot of sony source ("mm" part of sources) to find the "way of freedom"... so, i test a lot ; And, i don't use '#if'...
[Xperia Z1 Original Android Development] munjeni:
Yes I have locked (relocked) bootloader! I had panic when I used some parts of your kexec (for example reboot function) but I replaced these function with new function aka kexec_call_reboot, so maybe panic happen if some one trying to replace function which allready exist on stock kernel (probably allowed is only a new func names | new functions)!!! Try to rename function, allso extract offsets for all needed functions from your stock kernel by cat /proc/kallsyms, etc. About my version of the kexec, I have no idea how to put hardboot atags to the offset 0x1FFE0000 after kexec load happen, do you have idea? Thats remaining thing (I think) for my kexec module! Now when I load kexec, device reboot in the way the same like I had year ago when problem was reboot_function in ASM, but probably now problem is not reboot, probably (for sure) problem now is "reserved" memory for kexec atags.

And one more question, what is dtb kernel??
[Xperia Z1 Original Android Development] delewer:
Thx a lot !!

Atags ??

Z1 don't use atag, but dtb.

Dtb is "device_tree" acronyme

You must Reserve memory for dtb, not atags

it's a real good news you give here.

I dowload git tonight to test another kexec and change names like you say

Thx again

A last question, what is your toolchain ?

mine is 4.7.7 ; the last cross toolchain in date
[Xperia Z1 Original Android Development] munjeni:
I'm using standard toolchain (4.4.3) which come with Android source. Have some good progress with latest git commit (no more errors):

1. dmesg:

2. kexec load:

3. sync

4. ./kexec -e

5. last_kmsg:

6. final result: not working :( So definitelly it failed because resrved hardboot memory not exist? I thinking kexec_hardboot fail since I can not see them in /proc/iomem :(. Mybe we can use ram_console "iomem" reserved space to store hardboot atags (if that working than we can modify guest kernel for: new hardboot offset + move ram_console to position up, just for idea)?
[Xperia Z1 Original Android Development] delewer:
1-

thx.

2-

well... you can not use atag... z1 use dtb.img file in place of atag... or a zImage concatenate with dtb.img, and compil for. :rolleyes:

For the rest, it's like expected.. panic because something is missing... device_tree ?

See here what it is : http://en.m.wikipedia.org/wiki/Device_tree

but please continue, all help is really appreciate.

:)
[Xperia Z1 Original Android Development] munjeni:
I see no errors so I don't know if there is missing device_three, but on our Xperia device we using atags, kexec working on my kernel on unlocked bootloader, but not working in our kexec for locked bootloader, with this commit I have noticed empty atags :crying: but going to try to use ram_console as a hardboot container :), let see if it working.
[Xperia Z1 Original Android Development] munjeni:
On quest kernel I have moved ram_console into some space down, hardboot is now in previos ram_console space, quest kernel (working kexec) is here -> https://github.com/munjeni/android_kernel_xperiago/tree/cm-11 , modification now is -> http://pastebin.com/Txm5pbt5 , so lets see :) If not working than I realy have no idea how to get them. Seems missing "copy attags to kexec_hardboot" ?

Edit:

not working! There is definitelly missing something :(
[Xperia Z1 Original Android Development] munjeni:
1fe00000-1fefffff : kexec_hardboot

Want to see how looking these atags there, do you have any info which tool I can use to dump these iomem range?
[Xperia Z1 Original Android Development] munjeni:
What I thining by now, problem might be a file kexec_load_mod.c which is generated automaticaly by compilation, but if you open these file you will notice inside symbols and offsets, so probably we fail on these offsets since for sure these ofsets not match stock kernel! Do you hav idea how we can modify and compile these file (I don't have idea since these file I have edited but file is regenerated again and compiled)... ?
[Xperia Z1 Original Android Development] munjeni:
Solved problems related to the iomem, now I can see hardboot in iomem:

Probably I need to resize System RAM but that have no priority, I think I need to find a way for atags because atags is empty, thats priority by now. If you have idea how I can do it please let me know!
[Xperia Z1 Original Android Development] munjeni:
Dev, are you here?
[Xperia Z1 Original Android Development] king960:
Maybe ask "the leading developers" (not yo say that you are worse, I don't think that) like doomlord and the others?
[Xperia Z1 Original Android Development] delewer:
I can't help you...

I have say in 31 posts.. Z1 have no atags... Z1 kernel use device_tree blob...

If you post to say you work on atags.. i can't help... it's never work for Z1 kernel.

The only way, may be this can work, it's because guest kernel use accidently device_tree from host kernel... and this never work for CM or new kernel (3.8 for ex) because they needed new dvb to work.

If you use stock kernel you never, never found any atags.

You can try to reserve memory, but for dvb, not atags.

Edit : If you want to create a default atags (but you

must not

use it !!), use "procfs_rw" (see zip source in 1er post)
[Xperia Z1 Original Android Development] munjeni:
Ok mate thanks, seems you are right, I managed some atags (found them), but unable to get atags_core...etc... I bought z1c, stoped all activity on xperia 2012 line, starting now on kexec for z1c device, hope we get progress.
[Xperia Z1 Original Android Development] munjeni:
Do Z1 have last_kmsg ? On Z1C I can not found them :(
[Xperia Z1 Original Android Development] delewer:
Yep, only if we have crash or panic.
[Xperia Z1 Original Android Development] munjeni:
Ok, found last_kmsg after first panic :). I started kexec development on Z1C, everything is ok, iomem maped, /proc/atags created (no usage, I know), but sys_call_table giving me panic and reboot automatically :(, probably we can not use them. Found something interesting here -> http://lwn.net/Articles/557046/ I think this one will be usefull for future development on kexec? Why sys_call_table fail, do you have idea?

c01062c4 T sys_call_table

There is T flag so I have no idea why that fail. MAybe some table arrays is not exist, for example __NR_kexec_load and __NR_reboot??

Edit:

No, but I found something after dumping adress of the kexec_load:

printk("kexec_load_address=0x%.8X\n", (unsigned int)sys_call_table[__NR_kexec_load]);

Adress is: kexec_load_address=0xC01B2180

In kallsyms these adress is:

c01b2180 W sys_kexec_load

Seems its right adress but why it fail with error "<1>[ 1540.475283] Unable to handle kernel paging request at virtual address c0106830" I have no idea.

Edit:

Found ansver. Syscalltable is read only.
[Xperia Z1 Original Android Development] munjeni:
There is a thing for disabling page protection -> http://www.vivekthachil.com/2013/12/patching-system-calls-in-linux.html but I am unable to compile them since I have error:
[Xperia Z1 Original Android Development] munjeni:
This one allso not working http://pastebin.com/c1RCjcsX ,seems:

c0113368 T set_memory_rw

c01133d4 T set_memory_ro

is bypased in kernel? :(
[Xperia Z1 Original Android Development] delewer:
All you have post is allready tested and i have post a loooot of things about.

You can't compil cr0 because is for intel unix, not arm

It's not arm asm.

Set_memory don't work, try to see "mm" part of kernel, i haven't find why don't work (2 week i search)

I have post, i think it's sony toolchain, or s800 hw protection
[Xperia Z1 Original Android Development] Konvict64:
Check this, hope that it will help :-/

http://xdaforums.com/showthread.php?t=2608408

It's on Xperia sp development!

Envoyé depuis mon Xperia Z1 C6903 utilisant XDA premium app
[Xperia Z1 Original Android Development] Olivier:
That won't help much... It's nothing new. I used a similar method for my Xperia S, some devs from Xperia U/sola/go forums too.

Gesendet von meinem LT26i mit Tapatalk
[Xperia Z1 Original Android Development] munjeni:
Thats not what we want, thats an ramdisk hack, but nothing related to the kernel, kernel remains stock!
[Xperia Z1 Original Android Development] munjeni:
solved.
[Xperia Z1 Original Android Development] Galcactus:
Would you please care to expand upon what has been solved?

I got rather excited when I first read that, I must admit...
[Xperia Z1 Original Android Development] Knucklessg1:
What's been solved?
[Xperia Z1 Original Android Development] dh.harald:
I try to use your work on Xperia SP, but i'm stuck on "no symbol version for module_layout"

Can you make a short howto, to fix symbols to my stock kernel (booloader unlock allowed: no)

(something similar like your seds)

Thanks!

NWM: successfully loaded kexec_mod:

root@android:/data/local/tmp # lsmod

kexec_load 25296 0 - Live 0xbf01f000 (O)
[Xperia Z1 Original Android Development] delewer:
with the right #define, use this :

//soft_restart(reboot_code_buffer_phys);

my_soft_restart = (void *)kallsyms_lookup_name("soft_restart" ) ;

my_soft_restart(reboot_code_buffer_phys ) ;
[Xperia Z1 Original Android Development] dh.harald:
OK, here's my try on Xperia SP

compiled modules (from v1.1)

compiled kexec tools (from v1.1)

compiled patched kernel (best try:)

# insmod /data/local/tmp/kexec_load.ko
# insmod /data/local/tmp/procfs_rw.ko
# rm /dev/kexec_driver
# mknod /dev/kexec_driver c 100 0
# cat /dev/kexec_driver
Kexec_load driver implemented !
Kexec_load module communication granted.
You can send kernel by this communication channel.
Type following commands for help
=> echo help >/dev/kexec_driver
=> dmesg | grep Kexec
# /data/local/tmp/kexec --load-hardboot /data/local/tmp/zImage --atags --mem-min=0x20000000 --command-line="$(cat /proc/cmdline)"
kernel: 0x40377008 kernel_size: 5fce58
kexec_driver_contener->KDS_entry : '8022c000'
kexec_driver_contener->KDS_nr_segments : '2'
kexec_driver_contener->KDS_segment : '10c0010'
kexec_driver_contener->KDS_kexec_flags : '280004'
Kexec : kexec_load result : 0
# sync
# /data/local/tmp/kexec -e

Phone freezes :)

And here's last_kmsg:

[ 205.592553] Kexec:-----------------------------------------------------
[ 205.592827] Kexec: REBOOT DEVICE !!!
[ 205.593071] Disabling non-boot CPUs ...
[ 205.593346] Starting new kernel
[ 205.593560] KEXEC: MSM Watchdog Exit - Deactivated
[ 205.593987] Bye!
[ 205.594262] Unable to handle kernel paging request at virtual address 7e961c10
[ 205.594658] Unable to handle kernel paging request at virtual address ff000024
[ 205.594903] Unable to handle kernel paging request at virtual address ff000024
[ 205.595299] Unable to handle kernel paging request at virtual address ff000024

What's now? What do am I wrong?
[Xperia Z1 Original Android Development] delewer:
Nice try..

See if you have a panic at relocate_kernel call

May be if you use another relocate_kernel adress to see in kmsg if it work (fake relocate_kernel function with kprintf to trace accesses)
[Xperia Z1 Original Android Development] dh.harald:
I've started my development from scratch, and i've working kernel module and kexec binary (without hardcode loading atm)

I'm using mainly original kernel without patches

I can upload kernel image, but when i start kexec-e it loads the original kernel without any error:

[ 182.296078] Kexec: - Starting kexec_load...
[ 182.313627] Kexec: - ---- kexec_load - result : '0'
[ 190.619075] Disabling non-boot CPUs ...
[ 190.619533] Starting new kernel
[ 190.619777] Bye!

No errors detected

No errors, but it's soft reset, because i don't need to enter pin code...

Can somebody help me?
[Xperia Z1 Original Android Development] munjeni:
The same as I had on my Xperia Go ! Main problem in your and mine kexec is missing atags! Without working atags there is no way to boot new kernel! You need at least to copy atags to the right place (I never solved that) before kernel boot. I leaved whole project after ten unsucesfull attemts.

On Xperia Z1C there is a way but only if we found a way for unlocking memory since kernel memory is read only so we can not modify sys call table without unlocking mem. I allso had some atempts but alvays had a kernel panic since memory was not unlocked :( There is some functions in kernel for unlocking but functions is fake (something like void unlock_mem(void) { }) :(

I will be happy if some one found vulneability in kernel, here is the best example how is working an kernel exploit -> http://ugcs.net/~keegan/talks/kernel-exploit/talk.pdf very detiled explained.
[Xperia Z1 Original Android Development] delewer:
This exploit can only work with :

echo 0>/proc/sys/vm/mmap_min_addr

To try...
[Xperia Z1 Original Android Development] Galcactus:
Is this for all Xperia lines, or just the latest Z/1/2/C/Ultra range?

Would this work for the Xperia T? Or is kernel memory r-o in all Xperia, or even all Android devices?
[Xperia Z1 Original Android Development] delewer:
I don't know for these devices...

On Z1 memory lock, it is caused by locked bootloader.

On unlocked bootloader, you don't have memory restrict, and kexek work fine.

We don't know if it's a Sony toolchain lock or a new snapdragon HW lock

If we find the way to unlock memory for locked Z1, i thinks it will be ok for other Sony device, because all kernel have common sources.
[Xperia Z1 Original Android Development] vkass:
http://xdaforums.com/showthread.php?t=2676492

Maybe theres no need for kexec?
[Xperia Z1 Original Android Development] king960:
It's hijacking the ramdisk, kernel remains the same. Read before posting. It was discussed already...
[Xperia Z1 Original Android Development] vkass:
I dont really understand the technical stuff, isnt one of the points of kexec to run aosp based roms?

Sure a custom kernel is much better, but aosp with a stock kernel is better than nothing.
[Xperia Z1 Original Android Development] olokos:
You can't use AOSP rom on stock kernel. Try to flash PA on stock kernel. You'll end up in a bootloop.

Wysłane z mojego C6903 przy użyciu Tapatalka
[Xperia Z1 Original Android Development] vkass:
The point is he managed to make cm run on locked BL.

If he cant change the kernel, its still stock.

from http://www.xda-developers.com/andro...er-receives-unofficial-cyanogenmod-10-2-port/