projects/linux·blob assoc-array-fixes · refs

943 lines · 22.1 KiB

1#!/bin/bash
2# SPDX-License-Identifier: GPL-2.0
3#
4# Build a livepatch module
5
6# shellcheck disable=SC1090,SC2155,SC2164
7
8if (( BASH_VERSINFO[0] < 4 || \
9 (BASH_VERSINFO[0] == 4 && BASH_VERSINFO[1] < 4) )); then
10 echo "error: this script requires bash 4.4+" >&2
11 exit 1
12fi
13
14set -o errtrace
15set -o pipefail
16set -o nounset
17
18# Allow doing 'cmd | mapfile -t array' instead of 'mapfile -t array < <(cmd)'.
19# This helps keep execution in pipes so pipefail+ERR trap can catch errors.
20shopt -s lastpipe
21
22unset DEBUG_CLONE DIFF_CHECKSUM SKIP_CLEANUP VERBOSE XTRACE
23
24REPLACE=1
25SHORT_CIRCUIT=0
26JOBS="$(getconf _NPROCESSORS_ONLN)"
27shopt -o xtrace | grep -q 'on' && XTRACE=1
28
29# Avoid removing the previous $TMP_DIR until args have been fully processed.
30KEEP_TMP=1
31
32SCRIPT="$(basename "$0")"
33SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
34FIX_PATCH_LINES="$SCRIPT_DIR/fix-patch-lines"
35
36OBJTOOL="$PWD/tools/objtool/objtool"
37CONFIG="$PWD/.config"
38TMP_DIR="$PWD/klp-tmp"
39
40ORIG_DIR="$TMP_DIR/1-orig"
41PATCHED_DIR="$TMP_DIR/2-patched"
42ORIG_CSUM_DIR="$TMP_DIR/3-checksum-orig"
43PATCHED_CSUM_DIR="$TMP_DIR/3-checksum-patched"
44DIFF_DIR="$TMP_DIR/4-diff"
45KMOD_DIR="$TMP_DIR/5-kmod"
46
47STASH_DIR="$TMP_DIR/stash"
48TIMESTAMP="$TMP_DIR/timestamp"
49PATCH_TMP_DIR="$TMP_DIR/tmp"
50
51KLP_DIFF_LOG="$DIFF_DIR/diff.log"
52
53# Terminal output colors
54read -r COLOR_RESET COLOR_BOLD COLOR_ERROR COLOR_WARN <<< ""
55if [[ -t 1 && -t 2 ]]; then
56 COLOR_RESET="\033[0m"
57 COLOR_BOLD="\033[1m"
58 COLOR_ERROR="\033[0;31m"
59 COLOR_WARN="\033[0;33m"
60fi
61
62grep0() {
63 # shellcheck disable=SC2317
64 command grep "$@" || true
65}
66
67# Because pipefail is enabled, the grep0 helper should be used instead of
68# grep, otherwise a failed match can propagate to an error.
69grep() {
70 echo "error: $SCRIPT: use grep0 or 'command grep' instead of bare grep" >&2
71 exit 1
72}
73
74status() {
75 echo -e "${COLOR_BOLD}$*${COLOR_RESET}"
76}
77
78warn() {
79 echo -e "${COLOR_WARN}warning${COLOR_RESET}: $SCRIPT: $*" >&2
80}
81
82die() {
83 echo -e "${COLOR_ERROR}error${COLOR_RESET}: $SCRIPT: $*" >&2
84 exit 1
85}
86
87declare -a STASHED_FILES
88
89stash_file() {
90 local file="$1"
91 local rel_file="${file#"$PWD"/}"
92
93 [[ ! -e "$file" ]] && die "no file to stash: $file"
94
95 mkdir -p "$STASH_DIR/$(dirname "$rel_file")"
96 cp -f "$file" "$STASH_DIR/$rel_file"
97
98 STASHED_FILES+=("$rel_file")
99}
100
101restore_files() {
102 local file
103
104 for file in "${STASHED_FILES[@]}"; do
105 mv -f "$STASH_DIR/$file" "$PWD/$file" || warn "can't restore file: $file"
106 done
107
108 STASHED_FILES=()
109}
110
111cleanup() {
112 set +o nounset
113 revert_patches
114 restore_files
115 [[ "$KEEP_TMP" -eq 0 ]] && rm -rf "$TMP_DIR"
116 return 0
117}
118
119trap_err() {
120 die "line ${BASH_LINENO[0]}: '$BASH_COMMAND'"
121}
122
123trap cleanup EXIT INT TERM HUP
124trap trap_err ERR
125
126__usage() {
127 cat <<EOF
128Usage: $SCRIPT [OPTIONS] PATCH_FILE(s)
129Generate a livepatch module.
130
131Options:
132 -f, --show-first-changed Show address of first changed instruction
133 -j, --jobs=<jobs> Build jobs to run simultaneously [default: $JOBS]
134 -o, --output=<file.ko> Output file [default: livepatch-<patch-name>.ko]
135 --no-replace Disable livepatch atomic replace
136 -v, --verbose Pass V=1 to kernel/module builds
137
138Advanced Options:
139 -d, --debug Show symbol/reloc cloning decisions
140 -S, --short-circuit=STEP Start at build step (requires prior --keep-tmp)
141 1|orig Build original kernel (default)
142 2|patched Build patched kernel
143 3|checksum Generate checksums
144 4|diff Diff objects
145 5|kmod Build patch module
146 -T, --keep-tmp Preserve tmp dir on exit
147
148EOF
149}
150
151usage() {
152 __usage >&2
153}
154
155process_args() {
156 local keep_tmp=0
157 local short
158 local long
159 local args
160 local patch
161
162 short="hfj:o:vdS:T"
163 long="help,show-first-changed,jobs:,output:,no-replace,verbose,debug,short-circuit:,keep-tmp"
164
165 args=$(getopt --options "$short" --longoptions "$long" -- "$@") || {
166 echo; usage; exit
167 }
168 eval set -- "$args"
169
170 while true; do
171 case "$1" in
172 -h | --help)
173 usage
174 exit 0
175 ;;
176 -f | --show-first-changed)
177 DIFF_CHECKSUM=1
178 shift
179 ;;
180 -j | --jobs)
181 JOBS="$2"
182 shift 2
183 ;;
184 -o | --output)
185 [[ "$2" != *.ko ]] && die "output filename should end with .ko"
186 OUTFILE="$2"
187 NAME="$(basename "$OUTFILE")"
188 NAME="${NAME%.ko}"
189 NAME="$(module_name_string "$NAME")"
190 shift 2
191 ;;
192 --no-replace)
193 REPLACE=0
194 shift
195 ;;
196 -v | --verbose)
197 VERBOSE=1
198 shift
199 ;;
200 -d | --debug)
201 DEBUG_CLONE=1
202 keep_tmp=1
203 shift
204 ;;
205 -S | --short-circuit)
206 [[ ! -d "$TMP_DIR" ]] && die "--short-circuit requires preserved klp-tmp dir"
207 keep_tmp=1
208 case "$2" in
209 1 | orig) SHORT_CIRCUIT=1; ;;
210 2 | patched) SHORT_CIRCUIT=2; ;;
211 3 | checksum) SHORT_CIRCUIT=3; ;;
212 4 | diff) SHORT_CIRCUIT=4; ;;
213 5 | kmod) SHORT_CIRCUIT=5; ;;
214 *) die "invalid short-circuit step '$2'" ;;
215 esac
216 shift 2
217 ;;
218 -T | --keep-tmp)
219 keep_tmp=1
220 shift
221 ;;
222 --)
223 shift
224 break
225 ;;
226 *)
227 usage
228 exit 1
229 ;;
230 esac
231 done
232
233 if [[ $# -eq 0 ]] && (( SHORT_CIRCUIT <= 2 )); then
234 usage
235 exit 1
236 fi
237
238 KEEP_TMP="$keep_tmp"
239 PATCHES=("$@")
240
241 for patch in "${PATCHES[@]}"; do
242 [[ -f "$patch" ]] || die "$patch doesn't exist"
243 done
244}
245
246# temporarily disable xtrace for especially verbose code
247xtrace_save() {
248 [[ -v XTRACE ]] && set +x
249 return 0
250}
251
252xtrace_restore() {
253 [[ -v XTRACE ]] && set -x
254 return 0
255}
256
257validate_config() {
258 xtrace_save "reading .config"
259 source "$CONFIG" || die "no .config file in $(dirname "$CONFIG")"
260 xtrace_restore
261
262 [[ -v CONFIG_LIVEPATCH ]] || \
263 die "CONFIG_LIVEPATCH not enabled"
264
265 [[ -v CONFIG_KLP_BUILD ]] || \
266 die "CONFIG_KLP_BUILD not enabled"
267
268 [[ -v CONFIG_GCC_PLUGIN_LATENT_ENTROPY ]] && \
269 die "kernel option 'CONFIG_GCC_PLUGIN_LATENT_ENTROPY' not supported"
270
271 [[ -v CONFIG_GCC_PLUGIN_RANDSTRUCT ]] && \
272 die "kernel option 'CONFIG_GCC_PLUGIN_RANDSTRUCT' not supported"
273
274 [[ -v CONFIG_LD_DEAD_CODE_DATA_ELIMINATION ]] && \
275 die "kernel option 'CONFIG_LD_DEAD_CODE_DATA_ELIMINATION' not supported"
276
277 [[ -v CONFIG_AS_IS_LLVM ]] && \
278 [[ "$CONFIG_AS_VERSION" -lt 200000 ]] && \
279 die "Clang assembler version < 20 not supported"
280
281 [[ -x "$OBJTOOL" ]] && "$OBJTOOL" klp 2>&1 | command grep -q "not implemented" && \
282 die "objtool not built with KLP support; install xxhash-devel/libxxhash-dev (version >= 0.8) and recompile"
283
284 return 0
285}
286
287# Only allow alphanumerics and '_' and '-' in the module name. Everything else
288# is replaced with '-'. Also truncate to 55 chars so the full name + NUL
289# terminator fits in the kernel's 56-byte module name array.
290module_name_string() {
291 echo "${1//[^a-zA-Z0-9_-]/-}" | cut -c 1-55
292}
293
294# If the module name wasn't specified on the cmdline with --output, give it a
295# name based on the patch name.
296set_module_name() {
297 [[ -v NAME ]] && return 0
298
299 if [[ "${#PATCHES[@]}" -eq 1 ]]; then
300 NAME="$(basename "${PATCHES[0]}")"
301 NAME="${NAME%.*}"
302 else
303 NAME="patch"
304 fi
305
306 NAME="livepatch-$NAME"
307 NAME="$(module_name_string "$NAME")"
308
309 OUTFILE="$NAME.ko"
310}
311
312# Hardcode the value printed by the localversion script to prevent patch
313# application from appending it with '+' due to a dirty working tree.
314set_kernelversion() {
315 local file="$PWD/scripts/setlocalversion"
316 local kernelrelease
317
318 stash_file "$file"
319
320 if [[ -n "$(make -s listnewconfig 2>/dev/null)" ]]; then
321 die ".config mismatch, check your .config or run 'make olddefconfig'"
322 fi
323 make syncconfig &>/dev/null || die "make syncconfig failed"
324
325 kernelrelease="$(make -s kernelrelease)"
326 [[ -z "$kernelrelease" ]] && die "failed to get kernel version"
327
328 sed -i "2i echo $kernelrelease; exit 0" scripts/setlocalversion
329}
330
331get_patch_input_files() {
332 local patch="$1"
333
334 grep0 -E '^--- ' "$patch" \
335 | grep0 -v -e '/dev/null' -e '1969-12-31' -e '1970-01-01' \
336 | gawk '{print $2}' \
337 | sed 's|^[^/]*/||' \
338 | sort -u
339}
340
341get_patch_output_files() {
342 local patch="$1"
343
344 grep0 -E '^\+\+\+ ' "$patch" \
345 | grep0 -v -e '/dev/null' -e '1969-12-31' -e '1970-01-01' \
346 | gawk '{print $2}' \
347 | sed 's|^[^/]*/||' \
348 | sort -u
349}
350
351get_patch_files() {
352 local patch="$1"
353
354 { get_patch_input_files "$patch"; get_patch_output_files "$patch"; } \
355 | sort -u
356}
357
358check_unsupported_patches() {
359 local patch
360
361 for patch in "${PATCHES[@]}"; do
362 local files=()
363
364 get_patch_files "$patch" | mapfile -t files
365
366 for file in "${files[@]}"; do
367 case "$file" in
368 lib/*|*/vdso/*|*/realmode/rm/*|*.S)
369 die "${patch}: unsupported patch to $file"
370 ;;
371 esac
372 done
373 done
374}
375
376apply_patch() {
377 local patch="$1"
378 shift
379 local extra_args=("$@")
380 local drift_regex="with fuzz|offset [0-9]+ line"
381 local output
382 local status
383
384 [[ ! -f "$patch" ]] && die "$patch doesn't exist"
385 status=0
386 output=$(patch -p1 --dry-run --no-backup-if-mismatch -r /dev/null "${extra_args[@]}" < "$patch" 2>&1) || status=$?
387 if [[ "$status" -ne 0 ]]; then
388 echo "$output" >&2
389 die "$patch did not apply"
390 elif [[ "$output" =~ $drift_regex ]]; then
391 [[ -v VERBOSE ]] && echo "$output" >&2
392 warn "${patch} applied with fuzz"
393 fi
394
395 APPLIED_PATCHES+=("$patch")
396 patch -p1 --no-backup-if-mismatch -r /dev/null "${extra_args[@]}" --silent < "$patch"
397}
398
399revert_patch() {
400 local patch="$1"
401 local tmp=()
402
403 patch -p1 -R --force --no-backup-if-mismatch -r /dev/null &> /dev/null < "$patch" || true
404
405 for p in "${APPLIED_PATCHES[@]}"; do
406 [[ "$p" == "$patch" ]] && continue
407 tmp+=("$p")
408 done
409
410 APPLIED_PATCHES=("${tmp[@]}")
411}
412
413apply_patches() {
414 local extra_args=("$@")
415 local patch
416
417 for patch in "${PATCHES[@]}"; do
418 apply_patch "$patch" "${extra_args[@]}"
419 done
420}
421
422revert_patches() {
423 local patches=("${APPLIED_PATCHES[@]}")
424
425 for (( i=${#patches[@]}-1 ; i>=0 ; i-- )) ; do
426 revert_patch "${patches[$i]}"
427 done
428
429 APPLIED_PATCHES=()
430}
431
432validate_patches() {
433 check_unsupported_patches
434 apply_patches
435 revert_patches
436}
437
438do_init() {
439 # We're not yet smart enough to handle anything other than in-tree
440 # builds in pwd.
441 [[ ! "$PWD" -ef "$SCRIPT_DIR/../.." ]] && die "please run from the kernel root directory"
442
443 if (( SHORT_CIRCUIT >= 2 )); then
444 [[ -f "$ORIG_DIR/.complete" ]] || die "-S $SHORT_CIRCUIT requires completed $ORIG_DIR"
445 fi
446 if (( SHORT_CIRCUIT >= 3 )); then
447 [[ -f "$PATCHED_DIR/.complete" ]] || die "-S $SHORT_CIRCUIT requires completed $PATCHED_DIR"
448 fi
449 if (( SHORT_CIRCUIT >= 4 )); then
450 [[ -f "$ORIG_CSUM_DIR/.complete" ]] || die "-S $SHORT_CIRCUIT requires completed $ORIG_CSUM_DIR"
451 [[ -f "$PATCHED_CSUM_DIR/.complete" ]] || die "-S $SHORT_CIRCUIT requires completed $PATCHED_CSUM_DIR"
452 fi
453 if (( SHORT_CIRCUIT >= 5 )); then
454 [[ -f "$DIFF_DIR/.complete" ]] || die "-S $SHORT_CIRCUIT requires completed $DIFF_DIR"
455 fi
456
457 (( SHORT_CIRCUIT <= 1 )) && rm -rf "$TMP_DIR"
458 mkdir -p "$TMP_DIR"
459
460 APPLIED_PATCHES=()
461
462 [[ -x "$FIX_PATCH_LINES" ]] || die "can't find fix-patch-lines"
463 command -v recountdiff &>/dev/null || die "recountdiff not found (install patchutils)"
464
465 validate_config
466 set_module_name
467 set_kernelversion
468}
469
470# Refresh the patch hunk headers, specifically the line numbers and counts.
471refresh_patch() {
472 local patch="$1"
473 local tmpdir="$PATCH_TMP_DIR"
474 local input_files=()
475 local output_files=()
476
477 rm -rf "$tmpdir"
478 mkdir -p "$tmpdir/a"
479 mkdir -p "$tmpdir/b"
480
481 # Get all source files affected by the patch
482 get_patch_input_files "$patch" | mapfile -t input_files
483 get_patch_output_files "$patch" | mapfile -t output_files
484
485 # Copy orig source files to 'a'
486 echo "${input_files[@]}" | xargs cp --parents --target-directory="$tmpdir/a"
487
488 # Copy patched source files to 'b'
489 apply_patch "$patch" "--silent"
490 echo "${output_files[@]}" | xargs cp --parents --target-directory="$tmpdir/b"
491 revert_patch "$patch"
492
493 # Diff 'a' and 'b' to make a clean patch
494 ( cd "$tmpdir" && diff -Nupr a b > "$patch" ) || true
495}
496
497# Copy the patches to a temporary directory, fix their lines so as not to
498# affect the __LINE__ macro for otherwise unchanged functions further down the
499# file, and update $PATCHES to point to the fixed patches.
500fix_patches() {
501 local idx
502 local i
503
504 rm -f "$TMP_DIR"/*.patch
505
506 idx=0001
507 for i in "${!PATCHES[@]}"; do
508 local old_patch="${PATCHES[$i]}"
509 local tmp_patch="$TMP_DIR/tmp.patch"
510 local patch="${PATCHES[$i]}"
511 local new_patch
512
513 new_patch="$TMP_DIR/$idx-fixed-$(basename "$patch")"
514
515 cp -f "$old_patch" "$tmp_patch"
516 refresh_patch "$tmp_patch"
517 "$FIX_PATCH_LINES" "$tmp_patch" | recountdiff > "$new_patch"
518
519 PATCHES[i]="$new_patch"
520
521 rm -f "$tmp_patch"
522 idx=$(printf "%04d" $(( 10#$idx + 1 )))
523 done
524}
525
526clean_kernel() {
527 local cmd=()
528
529 cmd=("make")
530 cmd+=("--silent")
531 cmd+=("-j$JOBS")
532 cmd+=("clean")
533
534 "${cmd[@]}"
535}
536
537build_kernel() {
538 local build="$1"
539 local log="$TMP_DIR/build.log"
540 local cmd=()
541
542 cmd=("make")
543
544 # When a patch to a kernel module references a newly created unexported
545 # symbol which lives in vmlinux or another kernel module, the patched
546 # kernel build fails with the following error:
547 #
548 # ERROR: modpost: "klp_string" [fs/xfs/xfs.ko] undefined!
549 #
550 # The undefined symbols are working as designed in that case. They get
551 # resolved later when the livepatch module build link pulls all the
552 # disparate objects together into the same kernel module.
553 #
554 # It would be good to have a way to tell modpost to skip checking for
555 # undefined symbols altogether. For now, just convert the error to a
556 # warning with KBUILD_MODPOST_WARN, and grep out the warning to avoid
557 # confusing the user.
558 #
559 cmd+=("KBUILD_MODPOST_WARN=1")
560
561 cmd+=("KLP_SYMIDS=1")
562
563 if [[ -v VERBOSE ]]; then
564 cmd+=("V=1")
565 else
566 cmd+=("-s")
567 fi
568 cmd+=("-j$JOBS")
569 cmd+=("KCFLAGS=-ffunction-sections -fdata-sections")
570 cmd+=("vmlinux")
571 cmd+=("modules")
572
573 "${cmd[@]}" \
574 1> >(tee -a "$log") \
575 2> >(tee -a "$log" | grep0 -v "modpost.*undefined!" >&2) \
576 || die "$build kernel build failed"
577}
578
579find_objects() {
580 local opts=("$@")
581
582 # Find root-level vmlinux.o and non-root-level .ko files,
583 # excluding klp-tmp/ and hidden directories.
584 find "$PWD" -mindepth 1 \
585 \( -path "$TMP_DIR" -o -name ".*" -o -regex "$PWD/[^/][^/]*\.ko" \) -prune -o \
586 -type f "${opts[@]}" \
587 \( -name "*.ko" -o -path "$PWD/vmlinux.o" \) \
588 -printf '%P\n'
589}
590
591# Copy all .o archives to $ORIG_DIR
592copy_orig_objects() {
593 local files=()
594
595 rm -rf "$ORIG_DIR"
596 mkdir -p "$ORIG_DIR"
597
598 find_objects | mapfile -t files
599
600 xtrace_save "copying original objects"
601 for _file in "${files[@]}"; do
602 local rel_file="${_file/.ko/.o}"
603 local file="$PWD/$rel_file"
604 local orig_file="$ORIG_DIR/$rel_file"
605 local orig_dir="$(dirname "$orig_file")"
606
607 [[ ! -f "$file" ]] && die "missing $(basename "$file") for $_file"
608
609 mkdir -p "$orig_dir"
610 cp -f "$file" "$orig_dir"
611 done
612 xtrace_restore
613
614 cp -f "$PWD/vmlinux" "$ORIG_DIR" || die "missing vmlinux"
615
616 mv -f "$TMP_DIR/build.log" "$ORIG_DIR"
617 touch "$TIMESTAMP"
618 touch "$ORIG_DIR/.complete"
619}
620
621# Copy all changed objects to $PATCHED_DIR
622copy_patched_objects() {
623 local files=()
624 local opts=()
625 local found=0
626
627 rm -rf "$PATCHED_DIR"
628 mkdir -p "$PATCHED_DIR"
629
630 # Note this doesn't work with some configs, thus the 'cmp' below.
631 opts=("-newer")
632 opts+=("$TIMESTAMP")
633
634 find_objects "${opts[@]}" | mapfile -t files
635
636 xtrace_save "copying changed objects"
637 for _file in "${files[@]}"; do
638 local rel_file="${_file/.ko/.o}"
639 local file="$PWD/$rel_file"
640 local orig_file="$ORIG_DIR/$rel_file"
641 local patched_file="$PATCHED_DIR/$rel_file"
642 local patched_dir="$(dirname "$patched_file")"
643
644 [[ ! -f "$file" ]] && die "missing $(basename "$file") for $_file"
645
646 cmp -s "$orig_file" "$file" && continue
647
648 mkdir -p "$patched_dir"
649 cp -f "$file" "$patched_dir"
650 found=1
651 done
652 xtrace_restore
653
654 (( found == 0 )) && die "no changes detected"
655
656 mv -f "$TMP_DIR/build.log" "$PATCHED_DIR"
657 touch "$PATCHED_DIR/.complete"
658}
659
660# Copy .o files to a separate directory and run "objtool klp checksum" on each
661# copy. The checksums are written to a .discard.sym_checksum section.
662#
663# If match_dir is given, only process files which also exist there.
664generate_checksums() {
665 local src_dir="$1"
666 local dest_dir="$2"
667 local match_dir="${3:-}"
668 local files=()
669 local file
670
671 rm -rf "$dest_dir"
672 mkdir -p "$dest_dir"
673
674 find "$src_dir" -type f -name "*.o" | mapfile -t files
675 for file in "${files[@]}"; do
676 local rel="${file#"$src_dir"/}"
677 local dest="$dest_dir/$rel"
678
679 [[ -n "$match_dir" && ! -f "$match_dir/$rel" ]] && continue
680
681 mkdir -p "$(dirname "$dest")"
682 cp -f "$file" "$dest"
683 "$OBJTOOL" klp checksum "$dest"
684 done
685
686 [[ -f "$src_dir/vmlinux" ]] && cp -f "$src_dir/vmlinux" "$dest_dir"
687
688 touch "$dest_dir/.complete"
689}
690
691# Diff changed objects, writing output object to $DIFF_DIR
692diff_objects() {
693 local log="$KLP_DIFF_LOG"
694 local files=()
695 local opts=()
696
697 rm -rf "$DIFF_DIR"
698 mkdir -p "$DIFF_DIR"
699
700 find "$PATCHED_CSUM_DIR" -type f -name "*.o" | mapfile -t files
701 [[ ${#files[@]} -eq 0 ]] && die "no changes detected"
702
703 [[ -v DEBUG_CLONE ]] && opts=("--debug")
704
705 # Diff all changed objects
706 for file in "${files[@]}"; do
707 local rel_file="${file#"$PATCHED_CSUM_DIR"/}"
708 local orig_file="$rel_file"
709 local patched_file="$PATCHED_CSUM_DIR/$rel_file"
710 local out_file="$DIFF_DIR/$rel_file"
711 local filter=()
712 local cmd=()
713
714 mkdir -p "$(dirname "$out_file")"
715
716 cmd=("$OBJTOOL")
717 cmd+=("klp")
718 cmd+=("diff")
719 (( ${#opts[@]} > 0 )) && cmd+=("${opts[@]}")
720 cmd+=("$orig_file")
721 cmd+=("$patched_file")
722 cmd+=("$out_file")
723
724 if [[ -v DIFF_CHECKSUM ]]; then
725 filter=("grep0")
726 filter+=("-Ev")
727 filter+=("DEBUG: .*checksum: ")
728 else
729 filter=("cat")
730 fi
731
732 (
733 cd "$ORIG_CSUM_DIR"
734 [[ -v VERBOSE ]] && echo "cd $ORIG_CSUM_DIR && ${cmd[*]}"
735 "${cmd[@]}" \
736 1> >(tee -a "$log") \
737 2> >(tee -a "$log" | "${filter[@]}" >&2) || \
738 die "objtool klp diff failed"
739 )
740 done
741
742 touch "$DIFF_DIR/.complete"
743}
744
745# For each changed object, run "objtool klp checksum" with --debug-checksum to
746# get the per-instruction checksums, and then diff those to find the first
747# changed instruction for each function.
748diff_checksums() {
749 local orig_log="$ORIG_DIR/checksum.log"
750 local patched_log="$PATCHED_DIR/checksum.log"
751 local -A funcs
752 local cmd=()
753 local line
754 local file
755 local func
756
757 gawk '/\.o: changed function: / {
758 sub(/:$/, "", $1)
759 print $1, $NF
760 }' "$KLP_DIFF_LOG" | mapfile -t lines
761
762 for line in "${lines[@]}"; do
763 read -r file func <<< "$line"
764 if [[ ! -v funcs["$file"] ]]; then
765 funcs["$file"]="$func"
766 else
767 funcs["$file"]+=" $func"
768 fi
769 done
770
771 cmd=("$OBJTOOL")
772 cmd+=("klp" "checksum")
773 cmd+=("--dry-run")
774
775 for file in "${!funcs[@]}"; do
776 local opt="--debug-checksum=${funcs[$file]// /,}"
777
778 (
779 cd "$ORIG_DIR"
780 "${cmd[@]}" "$opt" "$file" &> "$orig_log" || \
781 ( cat "$orig_log" >&2; die "objtool klp checksum failed" )
782
783 cd "$PATCHED_DIR"
784 "${cmd[@]}" "$opt" "$file" &> "$patched_log" || \
785 ( cat "$patched_log" >&2; die "objtool klp checksum failed" )
786 )
787
788 for func in ${funcs[$file]}; do
789 local -a orig patched
790 paste <(grep0 -E "^DEBUG: .*checksum: $func " "$orig_log") \
791 <(grep0 -E "^DEBUG: .*checksum: $func " "$patched_log") |
792 while IFS= read -r line; do
793 read -ra orig <<< "${line%%$'\t'*}"
794 read -ra patched <<< "${line#*$'\t'}"
795
796 if [[ ${#patched[@]} -eq 0 ]]; then
797 printf "%s: %s: %s (removed)\n" "${orig[1]%:}" "${orig[3]}" "${orig[-2]}"
798 break
799 elif [[ ${#orig[@]} -eq 0 ]]; then
800 printf "%s: %s: %s (added)\n" "${patched[1]%:}" "${patched[3]}" "${patched[-2]}"
801 break
802 fi
803
804 [[ "${orig[-1]}" == "${patched[-1]}" ]] && continue
805
806 printf "%s: %s: %s" "${orig[1]%:}" "${orig[3]}" "${orig[-2]}"
807 [[ "${orig[-2]}" != "${patched[-2]}" ]] && \
808 printf " (patched: %s)" "${patched[-2]}"
809 printf "\n"
810 break
811 done || true
812 done
813 done
814}
815
816# Build and post-process livepatch module in $KMOD_DIR
817build_patch_module() {
818 local makefile="$KMOD_DIR/Kbuild"
819 local log="$KMOD_DIR/build.log"
820 local kmod_file
821 local cflags=()
822 local files=()
823 local cmd=()
824
825 rm -rf "$KMOD_DIR"
826 mkdir -p "$KMOD_DIR"
827
828 cp -f "$SCRIPT_DIR/init.c" "$KMOD_DIR"
829
830 echo "obj-m := $NAME.o" > "$makefile"
831 echo -n "$NAME-y := init.o" >> "$makefile"
832
833 find "$DIFF_DIR" -type f -name "*.o" | mapfile -t files
834 [[ ${#files[@]} -eq 0 ]] && die "no changes detected"
835
836 for file in "${files[@]}"; do
837 local rel_file="${file#"$DIFF_DIR"/}"
838 local orig_file="$ORIG_DIR/$rel_file"
839 local orig_dir="$(dirname "$orig_file")"
840 local kmod_file="$KMOD_DIR/$rel_file"
841 local kmod_dir="$(dirname "$kmod_file")"
842 local cmd_file="$kmod_dir/.$(basename "$file").cmd"
843
844 mkdir -p "$kmod_dir"
845 cp -f "$file" "$kmod_dir"
846
847 # Tell kbuild this is a prebuilt object
848 cp -f "$file" "${kmod_file}_shipped"
849
850 # Make modpost happy
851 touch "$cmd_file"
852
853 echo -n " $rel_file" >> "$makefile"
854 done
855
856 echo >> "$makefile"
857
858 cflags=("-ffunction-sections")
859 cflags+=("-fdata-sections")
860 [[ $REPLACE -eq 0 ]] && cflags+=("-DKLP_NO_REPLACE")
861
862 cmd=("make")
863 if [[ -v VERBOSE ]]; then
864 cmd+=("V=1")
865 else
866 cmd+=("-s")
867 fi
868 cmd+=("-j$JOBS")
869 cmd+=("--directory=.")
870 cmd+=("M=$KMOD_DIR")
871 cmd+=("KCFLAGS=${cflags[*]}")
872
873 # Build a "normal" kernel module with init.c and the diffed objects
874 "${cmd[@]}" \
875 1> >(tee -a "$log") \
876 2> >(tee -a "$log" >&2)
877
878 kmod_file="$KMOD_DIR/$NAME.ko"
879
880 # Save off the intermediate binary for debugging
881 cp -f "$kmod_file" "$kmod_file.orig"
882
883 # Work around issue where slight .config change makes corrupt BTF
884 objcopy --remove-section=.BTF "$kmod_file"
885
886 # Fix (and work around) linker wreckage for klp syms / relocs
887 "$OBJTOOL" klp post-link "$kmod_file" || die "objtool klp post-link failed"
888
889 cp -f "$kmod_file" "$OUTFILE"
890}
891
892
893################################################################################
894
895process_args "$@"
896do_init
897
898if (( SHORT_CIRCUIT <= 2 )); then
899 status "Validating patch(es)"
900 validate_patches
901fi
902
903if (( SHORT_CIRCUIT <= 1 )); then
904 status "Building original kernel"
905 clean_kernel
906 build_kernel "original"
907 status "Copying original object files"
908 copy_orig_objects
909fi
910
911if (( SHORT_CIRCUIT <= 2 )); then
912 status "Fixing patch(es)"
913 fix_patches
914 apply_patches "--silent"
915 status "Building patched kernel"
916 build_kernel "patched"
917 revert_patches
918 status "Copying patched object files"
919 copy_patched_objects
920fi
921
922if (( SHORT_CIRCUIT <= 3 )); then
923 status "Generating original checksums"
924 generate_checksums "$ORIG_DIR" "$ORIG_CSUM_DIR" "$PATCHED_DIR"
925 status "Generating patched checksums"
926 generate_checksums "$PATCHED_DIR" "$PATCHED_CSUM_DIR"
927fi
928
929if (( SHORT_CIRCUIT <= 4 )); then
930 status "Diffing objects"
931 diff_objects
932 if [[ -v DIFF_CHECKSUM ]]; then
933 status "Finding first changed instructions"
934 diff_checksums
935 fi
936fi
937
938if (( SHORT_CIRCUIT <= 5 )); then
939 status "Building patch module: $OUTFILE"
940 build_patch_module
941fi
942
943status "SUCCESS"