Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
1#!/bin/bash
2# SPDX-License-Identifier: GPL-2.0
3#
4# Build a livepatch module
5
6# shellcheck disable=SC1090,SC2155
7
8if (( BASH_VERSINFO[0] < 4 || \
9 (BASH_VERSINFO[0] == 4 && BASH_VERSINFO[1] < 4) )); then
10 echo "error: this script requires bash 4.4+" >&2
11 exit 1
12fi
13
14set -o errexit
15set -o errtrace
16set -o pipefail
17set -o nounset
18
19# Allow doing 'cmd | mapfile -t array' instead of 'mapfile -t array < <(cmd)'.
20# This helps keep execution in pipes so pipefail+errexit can catch errors.
21shopt -s lastpipe
22
23unset DEBUG_CLONE DIFF_CHECKSUM SKIP_CLEANUP XTRACE
24
25REPLACE=1
26SHORT_CIRCUIT=0
27JOBS="$(getconf _NPROCESSORS_ONLN)"
28VERBOSE="-s"
29shopt -o xtrace | grep -q 'on' && XTRACE=1
30
31# Avoid removing the previous $TMP_DIR until args have been fully processed.
32KEEP_TMP=1
33
34SCRIPT="$(basename "$0")"
35SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
36FIX_PATCH_LINES="$SCRIPT_DIR/fix-patch-lines"
37
38SRC="$(pwd)"
39OBJ="$(pwd)"
40
41CONFIG="$OBJ/.config"
42TMP_DIR="$OBJ/klp-tmp"
43
44ORIG_DIR="$TMP_DIR/orig"
45PATCHED_DIR="$TMP_DIR/patched"
46DIFF_DIR="$TMP_DIR/diff"
47KMOD_DIR="$TMP_DIR/kmod"
48
49STASH_DIR="$TMP_DIR/stash"
50TIMESTAMP="$TMP_DIR/timestamp"
51PATCH_TMP_DIR="$TMP_DIR/tmp"
52
53KLP_DIFF_LOG="$DIFF_DIR/diff.log"
54
55# Terminal output colors
56read -r COLOR_RESET COLOR_BOLD COLOR_ERROR COLOR_WARN <<< ""
57if [[ -t 1 && -t 2 ]]; then
58 COLOR_RESET="\033[0m"
59 COLOR_BOLD="\033[1m"
60 COLOR_ERROR="\033[0;31m"
61 COLOR_WARN="\033[0;33m"
62fi
63
64grep0() {
65 # shellcheck disable=SC2317
66 command grep "$@" || true
67}
68
69# Because pipefail is enabled, the grep0 helper should be used instead of
70# grep, otherwise a failed match can propagate to an error.
71grep() {
72 echo "error: $SCRIPT: use grep0 or 'command grep' instead of bare grep" >&2
73 exit 1
74}
75
76status() {
77 echo -e "${COLOR_BOLD}$*${COLOR_RESET}"
78}
79
80warn() {
81 echo -e "${COLOR_WARN}warning${COLOR_RESET}: $SCRIPT: $*" >&2
82}
83
84die() {
85 echo -e "${COLOR_ERROR}error${COLOR_RESET}: $SCRIPT: $*" >&2
86 exit 1
87}
88
89declare -a STASHED_FILES
90
91stash_file() {
92 local file="$1"
93 local rel_file="${file#"$SRC"/}"
94
95 [[ ! -e "$file" ]] && die "no file to stash: $file"
96
97 mkdir -p "$STASH_DIR/$(dirname "$rel_file")"
98 cp -f "$file" "$STASH_DIR/$rel_file"
99
100 STASHED_FILES+=("$rel_file")
101}
102
103restore_files() {
104 local file
105
106 for file in "${STASHED_FILES[@]}"; do
107 mv -f "$STASH_DIR/$file" "$SRC/$file" || warn "can't restore file: $file"
108 done
109
110 STASHED_FILES=()
111}
112
113cleanup() {
114 set +o nounset
115 revert_patches
116 restore_files
117 [[ "$KEEP_TMP" -eq 0 ]] && rm -rf "$TMP_DIR"
118 return 0
119}
120
121trap_err() {
122 die "line ${BASH_LINENO[0]}: '$BASH_COMMAND'"
123}
124
125trap cleanup EXIT INT TERM HUP
126trap trap_err ERR
127
128__usage() {
129 cat <<EOF
130Usage: $SCRIPT [OPTIONS] PATCH_FILE(s)
131Generate a livepatch module.
132
133Options:
134 -f, --show-first-changed Show address of first changed instruction
135 -j, --jobs=<jobs> Build jobs to run simultaneously [default: $JOBS]
136 -o, --output=<file.ko> Output file [default: livepatch-<patch-name>.ko]
137 --no-replace Disable livepatch atomic replace
138 -v, --verbose Pass V=1 to kernel/module builds
139
140Advanced Options:
141 -d, --debug Show symbol/reloc cloning decisions
142 -S, --short-circuit=STEP Start at build step (requires prior --keep-tmp)
143 1|orig Build original kernel (default)
144 2|patched Build patched kernel
145 3|diff Diff objects
146 4|kmod Build patch module
147 -T, --keep-tmp Preserve tmp dir on exit
148
149EOF
150}
151
152usage() {
153 __usage >&2
154}
155
156process_args() {
157 local keep_tmp=0
158 local short
159 local long
160 local args
161
162 short="hfj:o:vdS:T"
163 long="help,show-first-changed,jobs:,output:,no-replace,verbose,debug,short-circuit:,keep-tmp"
164
165 args=$(getopt --options "$short" --longoptions "$long" -- "$@") || {
166 echo; usage; exit
167 }
168 eval set -- "$args"
169
170 while true; do
171 case "$1" in
172 -h | --help)
173 usage
174 exit 0
175 ;;
176 -f | --show-first-changed)
177 DIFF_CHECKSUM=1
178 shift
179 ;;
180 -j | --jobs)
181 JOBS="$2"
182 shift 2
183 ;;
184 -o | --output)
185 [[ "$2" != *.ko ]] && die "output filename should end with .ko"
186 OUTFILE="$2"
187 NAME="$(basename "$OUTFILE")"
188 NAME="${NAME%.ko}"
189 NAME="$(module_name_string "$NAME")"
190 shift 2
191 ;;
192 --no-replace)
193 REPLACE=0
194 shift
195 ;;
196 -v | --verbose)
197 VERBOSE="V=1"
198 shift
199 ;;
200 -d | --debug)
201 DEBUG_CLONE=1
202 keep_tmp=1
203 shift
204 ;;
205 -S | --short-circuit)
206 [[ ! -d "$TMP_DIR" ]] && die "--short-circuit requires preserved klp-tmp dir"
207 keep_tmp=1
208 case "$2" in
209 1 | orig) SHORT_CIRCUIT=1; ;;
210 2 | patched) SHORT_CIRCUIT=2; ;;
211 3 | diff) SHORT_CIRCUIT=3; ;;
212 4 | mod) SHORT_CIRCUIT=4; ;;
213 *) die "invalid short-circuit step '$2'" ;;
214 esac
215 shift 2
216 ;;
217 -T | --keep-tmp)
218 keep_tmp=1
219 shift
220 ;;
221 --)
222 shift
223 break
224 ;;
225 *)
226 usage
227 exit 1
228 ;;
229 esac
230 done
231
232 if [[ $# -eq 0 ]] && (( SHORT_CIRCUIT <= 2 )); then
233 usage
234 exit 1
235 fi
236
237 KEEP_TMP="$keep_tmp"
238 PATCHES=("$@")
239}
240
241# temporarily disable xtrace for especially verbose code
242xtrace_save() {
243 [[ -v XTRACE ]] && set +x
244 return 0
245}
246
247xtrace_restore() {
248 [[ -v XTRACE ]] && set -x
249 return 0
250}
251
252validate_config() {
253 xtrace_save "reading .config"
254 source "$CONFIG" || die "no .config file in $(dirname "$CONFIG")"
255 xtrace_restore
256
257 [[ -v CONFIG_LIVEPATCH ]] || \
258 die "CONFIG_LIVEPATCH not enabled"
259
260 [[ -v CONFIG_KLP_BUILD ]] || \
261 die "CONFIG_KLP_BUILD not enabled"
262
263 [[ -v CONFIG_GCC_PLUGIN_LATENT_ENTROPY ]] && \
264 die "kernel option 'CONFIG_GCC_PLUGIN_LATENT_ENTROPY' not supported"
265
266 [[ -v CONFIG_GCC_PLUGIN_RANDSTRUCT ]] && \
267 die "kernel option 'CONFIG_GCC_PLUGIN_RANDSTRUCT' not supported"
268
269 [[ -v CONFIG_AS_IS_LLVM ]] && \
270 [[ "$CONFIG_AS_VERSION" -lt 200000 ]] && \
271 die "Clang assembler version < 20 not supported"
272
273 return 0
274}
275
276# Only allow alphanumerics and '_' and '-' in the module name. Everything else
277# is replaced with '-'. Also truncate to 55 chars so the full name + NUL
278# terminator fits in the kernel's 56-byte module name array.
279module_name_string() {
280 echo "${1//[^a-zA-Z0-9_-]/-}" | cut -c 1-55
281}
282
283# If the module name wasn't specified on the cmdline with --output, give it a
284# name based on the patch name.
285set_module_name() {
286 [[ -v NAME ]] && return 0
287
288 if [[ "${#PATCHES[@]}" -eq 1 ]]; then
289 NAME="$(basename "${PATCHES[0]}")"
290 NAME="${NAME%.*}"
291 else
292 NAME="patch"
293 fi
294
295 NAME="livepatch-$NAME"
296 NAME="$(module_name_string "$NAME")"
297
298 OUTFILE="$NAME.ko"
299}
300
301# Hardcode the value printed by the localversion script to prevent patch
302# application from appending it with '+' due to a dirty working tree.
303set_kernelversion() {
304 local file="$SRC/scripts/setlocalversion"
305 local kernelrelease
306
307 stash_file "$file"
308
309 kernelrelease="$(cd "$SRC" && make syncconfig &>/dev/null && make -s kernelrelease)"
310 [[ -z "$kernelrelease" ]] && die "failed to get kernel version"
311
312 sed -i "2i echo $kernelrelease; exit 0" scripts/setlocalversion
313}
314
315get_patch_input_files() {
316 local patch="$1"
317
318 grep0 -E '^--- ' "$patch" \
319 | grep0 -v -e '/dev/null' -e '1969-12-31' -e '1970-01-01' \
320 | gawk '{print $2}' \
321 | sed 's|^[^/]*/||' \
322 | sort -u
323}
324
325get_patch_output_files() {
326 local patch="$1"
327
328 grep0 -E '^\+\+\+ ' "$patch" \
329 | grep0 -v -e '/dev/null' -e '1969-12-31' -e '1970-01-01' \
330 | gawk '{print $2}' \
331 | sed 's|^[^/]*/||' \
332 | sort -u
333}
334
335get_patch_files() {
336 local patch="$1"
337
338 { get_patch_input_files "$patch"; get_patch_output_files "$patch"; } \
339 | sort -u
340}
341
342check_unsupported_patches() {
343 local patch
344
345 for patch in "${PATCHES[@]}"; do
346 local files=()
347
348 get_patch_files "$patch" | mapfile -t files
349
350 for file in "${files[@]}"; do
351 case "$file" in
352 lib/*|*.S)
353 die "${patch}: unsupported patch to $file"
354 ;;
355 esac
356 done
357 done
358}
359
360apply_patch() {
361 local patch="$1"
362 shift
363 local extra_args=("$@")
364 local drift_regex="with fuzz|offset [0-9]+ line"
365 local output
366 local status
367
368 [[ ! -f "$patch" ]] && die "$patch doesn't exist"
369 status=0
370 output=$(patch -d "$SRC" -p1 --dry-run --no-backup-if-mismatch -r /dev/null "${extra_args[@]}" < "$patch" 2>&1) || status=$?
371 if [[ "$status" -ne 0 ]]; then
372 echo "$output" >&2
373 die "$patch did not apply"
374 elif [[ "$output" =~ $drift_regex ]]; then
375 echo "$output" >&2
376 warn "${patch} applied with fuzz"
377 fi
378
379 patch -d "$SRC" -p1 --no-backup-if-mismatch -r /dev/null "${extra_args[@]}" --silent < "$patch"
380 APPLIED_PATCHES+=("$patch")
381}
382
383revert_patch() {
384 local patch="$1"
385 local tmp=()
386
387 patch -d "$SRC" -p1 -R --silent --no-backup-if-mismatch -r /dev/null < "$patch"
388
389 for p in "${APPLIED_PATCHES[@]}"; do
390 [[ "$p" == "$patch" ]] && continue
391 tmp+=("$p")
392 done
393
394 APPLIED_PATCHES=("${tmp[@]}")
395}
396
397apply_patches() {
398 local extra_args=("$@")
399 local patch
400
401 for patch in "${PATCHES[@]}"; do
402 apply_patch "$patch" "${extra_args[@]}"
403 done
404}
405
406revert_patches() {
407 local patches=("${APPLIED_PATCHES[@]}")
408
409 for (( i=${#patches[@]}-1 ; i>=0 ; i-- )) ; do
410 revert_patch "${patches[$i]}"
411 done
412
413 APPLIED_PATCHES=()
414}
415
416validate_patches() {
417 check_unsupported_patches
418 apply_patches
419 revert_patches
420}
421
422do_init() {
423 # We're not yet smart enough to handle anything other than in-tree
424 # builds in pwd.
425 [[ ! "$SRC" -ef "$SCRIPT_DIR/../.." ]] && die "please run from the kernel root directory"
426 [[ ! "$OBJ" -ef "$SCRIPT_DIR/../.." ]] && die "please run from the kernel root directory"
427
428 (( SHORT_CIRCUIT <= 1 )) && rm -rf "$TMP_DIR"
429 mkdir -p "$TMP_DIR"
430
431 APPLIED_PATCHES=()
432
433 [[ -x "$FIX_PATCH_LINES" ]] || die "can't find fix-patch-lines"
434 command -v recountdiff &>/dev/null || die "recountdiff not found (install patchutils)"
435
436 validate_config
437 set_module_name
438 set_kernelversion
439}
440
441# Refresh the patch hunk headers, specifically the line numbers and counts.
442refresh_patch() {
443 local patch="$1"
444 local tmpdir="$PATCH_TMP_DIR"
445 local input_files=()
446 local output_files=()
447
448 rm -rf "$tmpdir"
449 mkdir -p "$tmpdir/a"
450 mkdir -p "$tmpdir/b"
451
452 # Get all source files affected by the patch
453 get_patch_input_files "$patch" | mapfile -t input_files
454 get_patch_output_files "$patch" | mapfile -t output_files
455
456 # Copy orig source files to 'a'
457 ( cd "$SRC" && echo "${input_files[@]}" | xargs cp --parents --target-directory="$tmpdir/a" )
458
459 # Copy patched source files to 'b'
460 apply_patch "$patch" "--silent"
461 ( cd "$SRC" && echo "${output_files[@]}" | xargs cp --parents --target-directory="$tmpdir/b" )
462 revert_patch "$patch"
463
464 # Diff 'a' and 'b' to make a clean patch
465 ( cd "$tmpdir" && diff -Nupr a b > "$patch" ) || true
466}
467
468# Copy the patches to a temporary directory, fix their lines so as not to
469# affect the __LINE__ macro for otherwise unchanged functions further down the
470# file, and update $PATCHES to point to the fixed patches.
471fix_patches() {
472 local idx
473 local i
474
475 rm -f "$TMP_DIR"/*.patch
476
477 idx=0001
478 for i in "${!PATCHES[@]}"; do
479 local old_patch="${PATCHES[$i]}"
480 local tmp_patch="$TMP_DIR/tmp.patch"
481 local patch="${PATCHES[$i]}"
482 local new_patch
483
484 new_patch="$TMP_DIR/$idx-fixed-$(basename "$patch")"
485
486 cp -f "$old_patch" "$tmp_patch"
487 refresh_patch "$tmp_patch"
488 "$FIX_PATCH_LINES" "$tmp_patch" | recountdiff > "$new_patch"
489
490 PATCHES[i]="$new_patch"
491
492 rm -f "$tmp_patch"
493 idx=$(printf "%04d" $(( 10#$idx + 1 )))
494 done
495}
496
497clean_kernel() {
498 local cmd=()
499
500 cmd=("make")
501 cmd+=("--silent")
502 cmd+=("-j$JOBS")
503 cmd+=("clean")
504
505 (
506 cd "$SRC"
507 "${cmd[@]}"
508 )
509}
510
511build_kernel() {
512 local build="$1"
513 local log="$TMP_DIR/build.log"
514 local objtool_args=()
515 local cmd=()
516
517 objtool_args=("--checksum")
518
519 cmd=("make")
520
521 # When a patch to a kernel module references a newly created unexported
522 # symbol which lives in vmlinux or another kernel module, the patched
523 # kernel build fails with the following error:
524 #
525 # ERROR: modpost: "klp_string" [fs/xfs/xfs.ko] undefined!
526 #
527 # The undefined symbols are working as designed in that case. They get
528 # resolved later when the livepatch module build link pulls all the
529 # disparate objects together into the same kernel module.
530 #
531 # It would be good to have a way to tell modpost to skip checking for
532 # undefined symbols altogether. For now, just convert the error to a
533 # warning with KBUILD_MODPOST_WARN, and grep out the warning to avoid
534 # confusing the user.
535 #
536 cmd+=("KBUILD_MODPOST_WARN=1")
537
538 cmd+=("$VERBOSE")
539 cmd+=("-j$JOBS")
540 cmd+=("KCFLAGS=-ffunction-sections -fdata-sections")
541 cmd+=("OBJTOOL_ARGS=${objtool_args[*]}")
542 cmd+=("vmlinux")
543 cmd+=("modules")
544
545 (
546 cd "$SRC"
547 "${cmd[@]}" \
548 1> >(tee -a "$log") \
549 2> >(tee -a "$log" | grep0 -v "modpost.*undefined!" >&2)
550 ) || die "$build kernel build failed"
551}
552
553find_objects() {
554 local opts=("$@")
555
556 # Find root-level vmlinux.o and non-root-level .ko files,
557 # excluding klp-tmp/ and .git/
558 find "$OBJ" \( -path "$TMP_DIR" -o -path "$OBJ/.git" -o -regex "$OBJ/[^/][^/]*\.ko" \) -prune -o \
559 -type f "${opts[@]}" \
560 \( -name "*.ko" -o -path "$OBJ/vmlinux.o" \) \
561 -printf '%P\n'
562}
563
564# Copy all .o archives to $ORIG_DIR
565copy_orig_objects() {
566 local files=()
567
568 rm -rf "$ORIG_DIR"
569 mkdir -p "$ORIG_DIR"
570
571 find_objects | mapfile -t files
572
573 xtrace_save "copying orig objects"
574 for _file in "${files[@]}"; do
575 local rel_file="${_file/.ko/.o}"
576 local file="$OBJ/$rel_file"
577 local orig_file="$ORIG_DIR/$rel_file"
578 local orig_dir="$(dirname "$orig_file")"
579
580 [[ ! -f "$file" ]] && die "missing $(basename "$file") for $_file"
581
582 mkdir -p "$orig_dir"
583 cp -f "$file" "$orig_dir"
584 done
585 xtrace_restore
586
587 mv -f "$TMP_DIR/build.log" "$ORIG_DIR"
588 touch "$TIMESTAMP"
589}
590
591# Copy all changed objects to $PATCHED_DIR
592copy_patched_objects() {
593 local files=()
594 local opts=()
595 local found=0
596
597 rm -rf "$PATCHED_DIR"
598 mkdir -p "$PATCHED_DIR"
599
600 # Note this doesn't work with some configs, thus the 'cmp' below.
601 opts=("-newer")
602 opts+=("$TIMESTAMP")
603
604 find_objects "${opts[@]}" | mapfile -t files
605
606 xtrace_save "copying changed objects"
607 for _file in "${files[@]}"; do
608 local rel_file="${_file/.ko/.o}"
609 local file="$OBJ/$rel_file"
610 local orig_file="$ORIG_DIR/$rel_file"
611 local patched_file="$PATCHED_DIR/$rel_file"
612 local patched_dir="$(dirname "$patched_file")"
613
614 [[ ! -f "$file" ]] && die "missing $(basename "$file") for $_file"
615
616 cmp -s "$orig_file" "$file" && continue
617
618 mkdir -p "$patched_dir"
619 cp -f "$file" "$patched_dir"
620 found=1
621 done
622 xtrace_restore
623
624 (( found == 0 )) && die "no changes detected"
625
626 mv -f "$TMP_DIR/build.log" "$PATCHED_DIR"
627}
628
629# Diff changed objects, writing output object to $DIFF_DIR
630diff_objects() {
631 local log="$KLP_DIFF_LOG"
632 local files=()
633 local opts=()
634
635 rm -rf "$DIFF_DIR"
636 mkdir -p "$DIFF_DIR"
637
638 find "$PATCHED_DIR" -type f -name "*.o" | mapfile -t files
639 [[ ${#files[@]} -eq 0 ]] && die "no changes detected"
640
641 [[ -v DEBUG_CLONE ]] && opts=("--debug")
642
643 # Diff all changed objects
644 for file in "${files[@]}"; do
645 local rel_file="${file#"$PATCHED_DIR"/}"
646 local orig_file="$rel_file"
647 local patched_file="$PATCHED_DIR/$rel_file"
648 local out_file="$DIFF_DIR/$rel_file"
649 local filter=()
650 local cmd=()
651
652 mkdir -p "$(dirname "$out_file")"
653
654 cmd=("$SRC/tools/objtool/objtool")
655 cmd+=("klp")
656 cmd+=("diff")
657 (( ${#opts[@]} > 0 )) && cmd+=("${opts[@]}")
658 cmd+=("$orig_file")
659 cmd+=("$patched_file")
660 cmd+=("$out_file")
661
662 if [[ -v DIFF_CHECKSUM ]]; then
663 filter=("grep0")
664 filter+=("-Ev")
665 filter+=("DEBUG: .*checksum: ")
666 else
667 filter=("cat")
668 fi
669
670 (
671 cd "$ORIG_DIR"
672 "${cmd[@]}" \
673 1> >(tee -a "$log") \
674 2> >(tee -a "$log" | "${filter[@]}" >&2) || \
675 die "objtool klp diff failed"
676 )
677 done
678}
679
680# For each changed object, run objtool with --debug-checksum to get the
681# per-instruction checksums, and then diff those to find the first changed
682# instruction for each function.
683diff_checksums() {
684 local orig_log="$ORIG_DIR/checksum.log"
685 local patched_log="$PATCHED_DIR/checksum.log"
686 local -A funcs
687 local cmd=()
688 local line
689 local file
690 local func
691
692 gawk '/\.o: changed function: / {
693 sub(/:$/, "", $1)
694 print $1, $NF
695 }' "$KLP_DIFF_LOG" | mapfile -t lines
696
697 for line in "${lines[@]}"; do
698 read -r file func <<< "$line"
699 if [[ ! -v funcs["$file"] ]]; then
700 funcs["$file"]="$func"
701 else
702 funcs["$file"]+=" $func"
703 fi
704 done
705
706 cmd=("$SRC/tools/objtool/objtool")
707 cmd+=("--checksum")
708 cmd+=("--link")
709 cmd+=("--dry-run")
710
711 for file in "${!funcs[@]}"; do
712 local opt="--debug-checksum=${funcs[$file]// /,}"
713
714 (
715 cd "$ORIG_DIR"
716 "${cmd[@]}" "$opt" "$file" &> "$orig_log" || \
717 ( cat "$orig_log" >&2; die "objtool --debug-checksum failed" )
718
719 cd "$PATCHED_DIR"
720 "${cmd[@]}" "$opt" "$file" &> "$patched_log" || \
721 ( cat "$patched_log" >&2; die "objtool --debug-checksum failed" )
722 )
723
724 for func in ${funcs[$file]}; do
725 diff <( grep0 -E "^DEBUG: .*checksum: $func " "$orig_log" | sed "s|$ORIG_DIR/||") \
726 <( grep0 -E "^DEBUG: .*checksum: $func " "$patched_log" | sed "s|$PATCHED_DIR/||") \
727 | gawk '/^< DEBUG: / {
728 gsub(/:/, "")
729 printf "%s: %s: %s\n", $3, $5, $6
730 exit
731 }' || true
732 done
733 done
734}
735
736# Build and post-process livepatch module in $KMOD_DIR
737build_patch_module() {
738 local makefile="$KMOD_DIR/Kbuild"
739 local log="$KMOD_DIR/build.log"
740 local kmod_file
741 local cflags=()
742 local files=()
743 local cmd=()
744
745 rm -rf "$KMOD_DIR"
746 mkdir -p "$KMOD_DIR"
747
748 cp -f "$SRC/scripts/livepatch/init.c" "$KMOD_DIR"
749
750 echo "obj-m := $NAME.o" > "$makefile"
751 echo -n "$NAME-y := init.o" >> "$makefile"
752
753 find "$DIFF_DIR" -type f -name "*.o" | mapfile -t files
754 [[ ${#files[@]} -eq 0 ]] && die "no changes detected"
755
756 for file in "${files[@]}"; do
757 local rel_file="${file#"$DIFF_DIR"/}"
758 local orig_file="$ORIG_DIR/$rel_file"
759 local orig_dir="$(dirname "$orig_file")"
760 local kmod_file="$KMOD_DIR/$rel_file"
761 local kmod_dir="$(dirname "$kmod_file")"
762 local cmd_file="$kmod_dir/.$(basename "$file").cmd"
763
764 mkdir -p "$kmod_dir"
765 cp -f "$file" "$kmod_dir"
766
767 # Tell kbuild this is a prebuilt object
768 cp -f "$file" "${kmod_file}_shipped"
769
770 # Make modpost happy
771 touch "$cmd_file"
772
773 echo -n " $rel_file" >> "$makefile"
774 done
775
776 echo >> "$makefile"
777
778 cflags=("-ffunction-sections")
779 cflags+=("-fdata-sections")
780 [[ $REPLACE -eq 0 ]] && cflags+=("-DKLP_NO_REPLACE")
781
782 cmd=("make")
783 cmd+=("$VERBOSE")
784 cmd+=("-j$JOBS")
785 cmd+=("--directory=.")
786 cmd+=("M=$KMOD_DIR")
787 cmd+=("KCFLAGS=${cflags[*]}")
788
789 # Build a "normal" kernel module with init.c and the diffed objects
790 (
791 cd "$SRC"
792 "${cmd[@]}" \
793 1> >(tee -a "$log") \
794 2> >(tee -a "$log" >&2)
795 )
796
797 kmod_file="$KMOD_DIR/$NAME.ko"
798
799 # Save off the intermediate binary for debugging
800 cp -f "$kmod_file" "$kmod_file.orig"
801
802 # Work around issue where slight .config change makes corrupt BTF
803 objcopy --remove-section=.BTF "$kmod_file"
804
805 # Fix (and work around) linker wreckage for klp syms / relocs
806 "$SRC/tools/objtool/objtool" klp post-link "$kmod_file" || die "objtool klp post-link failed"
807
808 cp -f "$kmod_file" "$OUTFILE"
809}
810
811
812################################################################################
813
814process_args "$@"
815do_init
816
817if (( SHORT_CIRCUIT <= 2 )); then
818 status "Validating patch(es)"
819 validate_patches
820fi
821
822if (( SHORT_CIRCUIT <= 1 )); then
823 status "Building original kernel"
824 clean_kernel
825 build_kernel "original"
826 status "Copying original object files"
827 copy_orig_objects
828fi
829
830if (( SHORT_CIRCUIT <= 2 )); then
831 status "Fixing patch(es)"
832 fix_patches
833 apply_patches "--silent"
834 status "Building patched kernel"
835 build_kernel "patched"
836 revert_patches
837 status "Copying patched object files"
838 copy_patched_objects
839fi
840
841if (( SHORT_CIRCUIT <= 3 )); then
842 status "Diffing objects"
843 diff_objects
844 if [[ -v DIFF_CHECKSUM ]]; then
845 status "Finding first changed instructions"
846 diff_checksums
847 fi
848fi
849
850if (( SHORT_CIRCUIT <= 4 )); then
851 status "Building patch module: $OUTFILE"
852 build_patch_module
853fi
854
855status "SUCCESS"