#!/bin/bash# SPDX-License-Identifier: GPL-2.0## Build a livepatch module # shellcheck disable=SC1090,SC2155 if (( BASH_VERSINFO[0] < 4 || \ (BASH_VERSINFO[0] == 4 && BASH_VERSINFO[1] < 4) )); then echo "error: this script requires bash 4.4+" >&2 exit 1fi set -o errexitset -o errtraceset -o pipefailset -o nounset # Allow doing 'cmd | mapfile -t array' instead of 'mapfile -t array < <(cmd)'.# This helps keep execution in pipes so pipefail+errexit can catch errors.shopt -s lastpipe unset DEBUG_CLONE DIFF_CHECKSUM SKIP_CLEANUP XTRACE REPLACE=1SHORT_CIRCUIT=0JOBS="$(getconf _NPROCESSORS_ONLN)"VERBOSE="-s"shopt -o xtrace | grep -q 'on' && XTRACE=1 # Avoid removing the previous $TMP_DIR until args have been fully processed.KEEP_TMP=1 SCRIPT="$(basename "$0")"SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"FIX_PATCH_LINES="$SCRIPT_DIR/fix-patch-lines" SRC="$(pwd)"OBJ="$(pwd)" CONFIG="$OBJ/.config"TMP_DIR="$OBJ/klp-tmp" ORIG_DIR="$TMP_DIR/orig"PATCHED_DIR="$TMP_DIR/patched"DIFF_DIR="$TMP_DIR/diff"KMOD_DIR="$TMP_DIR/kmod" STASH_DIR="$TMP_DIR/stash"TIMESTAMP="$TMP_DIR/timestamp"PATCH_TMP_DIR="$TMP_DIR/tmp" KLP_DIFF_LOG="$DIFF_DIR/diff.log" grep0() { command grep "$@" || true} status() { echo "$*"} warn() { echo "error: $SCRIPT: $*" >&2} die() { warn "$@" exit 1} declare -a STASHED_FILES stash_file() { local file="$1" local rel_file="${file#"$SRC"/}" [[ ! -e "$file" ]] && die "no file to stash: $file" mkdir -p "$STASH_DIR/$(dirname "$rel_file")" cp -f "$file" "$STASH_DIR/$rel_file" STASHED_FILES+=("$rel_file")} restore_files() { local file for file in "${STASHED_FILES[@]}"; do mv -f "$STASH_DIR/$file" "$SRC/$file" || warn "can't restore file: $file" done STASHED_FILES=()} cleanup() { set +o nounset revert_patches "--recount" restore_files [[ "$KEEP_TMP" -eq 0 ]] && rm -rf "$TMP_DIR" return 0} trap_err() { warn "line ${BASH_LINENO[0]}: '$BASH_COMMAND'"} trap cleanup EXIT INT TERM HUPtrap trap_err ERR __usage() { cat <<EOFUsage: $SCRIPT [OPTIONS] PATCH_FILE(s)Generate a livepatch module. Options: -f, --show-first-changed Show address of first changed instruction -j, --jobs=<jobs> Build jobs to run simultaneously [default: $JOBS] -o, --output=<file.ko> Output file [default: livepatch-<patch-name>.ko] --no-replace Disable livepatch atomic replace -v, --verbose Pass V=1 to kernel/module builds Advanced Options: -d, --debug Show symbol/reloc cloning decisions -S, --short-circuit=STEP Start at build step (requires prior --keep-tmp) 1|orig Build original kernel (default) 2|patched Build patched kernel 3|diff Diff objects 4|kmod Build patch module -T, --keep-tmp Preserve tmp dir on exit EOF} usage() { __usage >&2} process_args() { local keep_tmp=0 local short local long local args short="hfj:o:vdS:T" long="help,show-first-changed,jobs:,output:,no-replace,verbose,debug,short-circuit:,keep-tmp" args=$(getopt --options "$short" --longoptions "$long" -- "$@") || { echo; usage; exit } eval set -- "$args" while true; do case "$1" in -h | --help) usage exit 0 ;; -f | --show-first-changed) DIFF_CHECKSUM=1 shift ;; -j | --jobs) JOBS="$2" shift 2 ;; -o | --output) [[ "$2" != *.ko ]] && die "output filename should end with .ko" OUTFILE="$2" NAME="$(basename "$OUTFILE")" NAME="${NAME%.ko}" NAME="$(module_name_string "$NAME")" shift 2 ;; --no-replace) REPLACE=0 shift ;; -v | --verbose) VERBOSE="V=1" shift ;; -d | --debug) DEBUG_CLONE=1 keep_tmp=1 shift ;; -S | --short-circuit) [[ ! -d "$TMP_DIR" ]] && die "--short-circuit requires preserved klp-tmp dir" keep_tmp=1 case "$2" in 1 | orig) SHORT_CIRCUIT=1; ;; 2 | patched) SHORT_CIRCUIT=2; ;; 3 | diff) SHORT_CIRCUIT=3; ;; 4 | mod) SHORT_CIRCUIT=4; ;; *) die "invalid short-circuit step '$2'" ;; esac shift 2 ;; -T | --keep-tmp) keep_tmp=1 shift ;; --) shift break ;; *) usage exit 1 ;; esac done if [[ $# -eq 0 ]]; then usage exit 1 fi KEEP_TMP="$keep_tmp" PATCHES=("$@")} # temporarily disable xtrace for especially verbose codextrace_save() { [[ -v XTRACE ]] && set +x return 0} xtrace_restore() { [[ -v XTRACE ]] && set -x return 0} validate_config() { xtrace_save "reading .config" source "$CONFIG" || die "no .config file in $(dirname "$CONFIG")" xtrace_restore [[ -v CONFIG_LIVEPATCH ]] || \ die "CONFIG_LIVEPATCH not enabled" [[ -v CONFIG_KLP_BUILD ]] || \ die "CONFIG_KLP_BUILD not enabled" [[ -v CONFIG_GCC_PLUGIN_LATENT_ENTROPY ]] && \ die "kernel option 'CONFIG_GCC_PLUGIN_LATENT_ENTROPY' not supported" [[ -v CONFIG_GCC_PLUGIN_RANDSTRUCT ]] && \ die "kernel option 'CONFIG_GCC_PLUGIN_RANDSTRUCT' not supported" [[ -v CONFIG_AS_IS_LLVM ]] && \ [[ "$CONFIG_AS_VERSION" -lt 200000 ]] && \ die "Clang assembler version < 20 not supported" return 0} # Only allow alphanumerics and '_' and '-' in the module name. Everything else# is replaced with '-'. Also truncate to 55 chars so the full name + NUL# terminator fits in the kernel's 56-byte module name array.module_name_string() { echo "${1//[^a-zA-Z0-9_-]/-}" | cut -c 1-55} # If the module name wasn't specified on the cmdline with --output, give it a# name based on the patch name.set_module_name() { [[ -v NAME ]] && return 0 if [[ "${#PATCHES[@]}" -eq 1 ]]; then NAME="$(basename "${PATCHES[0]}")" NAME="${NAME%.*}" else NAME="patch" fi NAME="livepatch-$NAME" NAME="$(module_name_string "$NAME")" OUTFILE="$NAME.ko"} # Hardcode the value printed by the localversion script to prevent patch# application from appending it with '+' due to a dirty git working tree.set_kernelversion() { local file="$SRC/scripts/setlocalversion" local kernelrelease stash_file "$file" kernelrelease="$(cd "$SRC" && make syncconfig &>/dev/null && make -s kernelrelease)" [[ -z "$kernelrelease" ]] && die "failed to get kernel version" sed -i "2i echo $kernelrelease; exit 0" scripts/setlocalversion} get_patch_files() { local patch="$1" grep0 -E '^(--- |\+\+\+ )' "$patch" \ | gawk '{print $2}' \ | sed 's|^[^/]*/||' \ | sort -u} # Make sure git re-stats the changed filesgit_refresh() { local patch="$1" local files=() [[ ! -e "$SRC/.git" ]] && return get_patch_files "$patch" | mapfile -t files ( cd "$SRC" git update-index -q --refresh -- "${files[@]}" )} check_unsupported_patches() { local patch for patch in "${PATCHES[@]}"; do local files=() get_patch_files "$patch" | mapfile -t files for file in "${files[@]}"; do case "$file" in lib/*|*.S) die "unsupported patch to $file" ;; esac done done} apply_patch() { local patch="$1" shift local extra_args=("$@") [[ ! -f "$patch" ]] && die "$patch doesn't exist" ( cd "$SRC" # The sed strips the version signature from 'git format-patch', # otherwise 'git apply --recount' warns. sed -n '/^-- /q;p' "$patch" | git apply "${extra_args[@]}" ) APPLIED_PATCHES+=("$patch")} revert_patch() { local patch="$1" shift local extra_args=("$@") local tmp=() ( cd "$SRC" sed -n '/^-- /q;p' "$patch" | git apply --reverse "${extra_args[@]}" ) git_refresh "$patch" for p in "${APPLIED_PATCHES[@]}"; do [[ "$p" == "$patch" ]] && continue tmp+=("$p") done APPLIED_PATCHES=("${tmp[@]}")} apply_patches() { local patch for patch in "${PATCHES[@]}"; do apply_patch "$patch" done} revert_patches() { local extra_args=("$@") local patches=("${APPLIED_PATCHES[@]}") for (( i=${#patches[@]}-1 ; i>=0 ; i-- )) ; do revert_patch "${patches[$i]}" "${extra_args[@]}" done APPLIED_PATCHES=()} validate_patches() { check_unsupported_patches apply_patches revert_patches} do_init() { # We're not yet smart enough to handle anything other than in-tree # builds in pwd. [[ ! "$SRC" -ef "$SCRIPT_DIR/../.." ]] && die "please run from the kernel root directory" [[ ! "$OBJ" -ef "$SCRIPT_DIR/../.." ]] && die "please run from the kernel root directory" (( SHORT_CIRCUIT <= 1 )) && rm -rf "$TMP_DIR" mkdir -p "$TMP_DIR" APPLIED_PATCHES=() [[ -x "$FIX_PATCH_LINES" ]] || die "can't find fix-patch-lines" validate_config set_module_name set_kernelversion} # Refresh the patch hunk headers, specifically the line numbers and counts.refresh_patch() { local patch="$1" local tmpdir="$PATCH_TMP_DIR" local files=() rm -rf "$tmpdir" mkdir -p "$tmpdir/a" mkdir -p "$tmpdir/b" # Get all source files affected by the patch get_patch_files "$patch" | mapfile -t files # Copy orig source files to 'a' ( cd "$SRC" && echo "${files[@]}" | xargs cp --parents --target-directory="$tmpdir/a" ) # Copy patched source files to 'b' apply_patch "$patch" --recount ( cd "$SRC" && echo "${files[@]}" | xargs cp --parents --target-directory="$tmpdir/b" ) revert_patch "$patch" --recount # Diff 'a' and 'b' to make a clean patch ( cd "$tmpdir" && git diff --no-index --no-prefix a b > "$patch" ) || true} # Copy the patches to a temporary directory, fix their lines so as not to# affect the __LINE__ macro for otherwise unchanged functions further down the# file, and update $PATCHES to point to the fixed patches.fix_patches() { local idx local i rm -f "$TMP_DIR"/*.patch idx=0001 for i in "${!PATCHES[@]}"; do local old_patch="${PATCHES[$i]}" local tmp_patch="$TMP_DIR/tmp.patch" local patch="${PATCHES[$i]}" local new_patch new_patch="$TMP_DIR/$idx-fixed-$(basename "$patch")" cp -f "$old_patch" "$tmp_patch" refresh_patch "$tmp_patch" "$FIX_PATCH_LINES" "$tmp_patch" > "$new_patch" refresh_patch "$new_patch" PATCHES[i]="$new_patch" rm -f "$tmp_patch" idx=$(printf "%04d" $(( 10#$idx + 1 ))) done} clean_kernel() { local cmd=() cmd=("make") cmd+=("--silent") cmd+=("-j$JOBS") cmd+=("clean") ( cd "$SRC" "${cmd[@]}" )} build_kernel() { local log="$TMP_DIR/build.log" local objtool_args=() local cmd=() objtool_args=("--checksum") cmd=("make")Lines 1–500 of 834. Load more
#!/bin/bash # SPDX-License-Identifier: GPL-2.0 # # Build a livepatch module # shellcheck disable=SC1090,SC2155 if (( BASH_VERSINFO[0] < 4 || \ (BASH_VERSINFO[0] == 4 && BASH_VERSINFO[1] < 4) )); then echo "error: this script requires bash 4.4+" >&2 exit 1 fi set -o errexit set -o errtrace set -o pipefail set -o nounset # Allow doing 'cmd | mapfile -t array' instead of 'mapfile -t array < <(cmd)'. # This helps keep execution in pipes so pipefail+errexit can catch errors. shopt -s lastpipe unset DEBUG_CLONE DIFF_CHECKSUM SKIP_CLEANUP XTRACE REPLACE=1 SHORT_CIRCUIT=0 JOBS="$(getconf _NPROCESSORS_ONLN)" VERBOSE="-s" shopt -o xtrace | grep -q 'on' && XTRACE=1 # Avoid removing the previous $TMP_DIR until args have been fully processed. KEEP_TMP=1 SCRIPT="$(basename "$0")" SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" FIX_PATCH_LINES="$SCRIPT_DIR/fix-patch-lines" SRC="$(pwd)" OBJ="$(pwd)" CONFIG="$OBJ/.config" TMP_DIR="$OBJ/klp-tmp" ORIG_DIR="$TMP_DIR/orig" PATCHED_DIR="$TMP_DIR/patched" DIFF_DIR="$TMP_DIR/diff" KMOD_DIR="$TMP_DIR/kmod" STASH_DIR="$TMP_DIR/stash" TIMESTAMP="$TMP_DIR/timestamp" PATCH_TMP_DIR="$TMP_DIR/tmp" KLP_DIFF_LOG="$DIFF_DIR/diff.log" grep0() { command grep "$@" || true } status() { echo "$*" } warn() { echo "error: $SCRIPT: $*" >&2 } die() { warn "$@" exit 1 } declare -a STASHED_FILES stash_file() { local file="$1" local rel_file="${file#"$SRC"/}" [[ ! -e "$file" ]] && die "no file to stash: $file" mkdir -p "$STASH_DIR/$(dirname "$rel_file")" cp -f "$file" "$STASH_DIR/$rel_file" STASHED_FILES+=("$rel_file") } restore_files() { local file for file in "${STASHED_FILES[@]}"; do mv -f "$STASH_DIR/$file" "$SRC/$file" || warn "can't restore file: $file" done STASHED_FILES=() } cleanup() { set +o nounset revert_patches "--recount" restore_files [[ "$KEEP_TMP" -eq 0 ]] && rm -rf "$TMP_DIR" return 0 } trap_err() { warn "line ${BASH_LINENO[0]}: '$BASH_COMMAND'" } trap cleanup EXIT INT TERM HUP trap trap_err ERR __usage() { cat <<EOF Usage: $SCRIPT [OPTIONS] PATCH_FILE(s) Generate a livepatch module. Options: -f, --show-first-changed Show address of first changed instruction -j, --jobs=<jobs> Build jobs to run simultaneously [default: $JOBS] -o, --output=<file.ko> Output file [default: livepatch-<patch-name>.ko] --no-replace Disable livepatch atomic replace -v, --verbose Pass V=1 to kernel/module builds Advanced Options: -d, --debug Show symbol/reloc cloning decisions -S, --short-circuit=STEP Start at build step (requires prior --keep-tmp) 1|orig Build original kernel (default) 2|patched Build patched kernel 3|diff Diff objects 4|kmod Build patch module -T, --keep-tmp Preserve tmp dir on exit EOF } usage() { __usage >&2 } process_args() { local keep_tmp=0 local short local long local args short="hfj:o:vdS:T" long="help,show-first-changed,jobs:,output:,no-replace,verbose,debug,short-circuit:,keep-tmp" args=$(getopt --options "$short" --longoptions "$long" -- "$@") || { echo; usage; exit } eval set -- "$args" while true; do case "$1" in -h | --help) usage exit 0 ;; -f | --show-first-changed) DIFF_CHECKSUM=1 shift ;; -j | --jobs) JOBS="$2" shift 2 ;; -o | --output) [[ "$2" != *.ko ]] && die "output filename should end with .ko" OUTFILE="$2" NAME="$(basename "$OUTFILE")" NAME="${NAME%.ko}" NAME="$(module_name_string "$NAME")" shift 2 ;; --no-replace) REPLACE=0 shift ;; -v | --verbose) VERBOSE="V=1" shift ;; -d | --debug) DEBUG_CLONE=1 keep_tmp=1 shift ;; -S | --short-circuit) [[ ! -d "$TMP_DIR" ]] && die "--short-circuit requires preserved klp-tmp dir" keep_tmp=1 case "$2" in 1 | orig) SHORT_CIRCUIT=1; ;; 2 | patched) SHORT_CIRCUIT=2; ;; 3 | diff) SHORT_CIRCUIT=3; ;; 4 | mod) SHORT_CIRCUIT=4; ;; *) die "invalid short-circuit step '$2'" ;; esac shift 2 ;; -T | --keep-tmp) keep_tmp=1 shift ;; --) shift break ;; *) usage exit 1 ;; esac done if [[ $# -eq 0 ]]; then usage exit 1 fi KEEP_TMP="$keep_tmp" PATCHES=("$@") } # temporarily disable xtrace for especially verbose code xtrace_save() { [[ -v XTRACE ]] && set +x return 0 } xtrace_restore() { [[ -v XTRACE ]] && set -x return 0 } validate_config() { xtrace_save "reading .config" source "$CONFIG" || die "no .config file in $(dirname "$CONFIG")" xtrace_restore [[ -v CONFIG_LIVEPATCH ]] || \ die "CONFIG_LIVEPATCH not enabled" [[ -v CONFIG_KLP_BUILD ]] || \ die "CONFIG_KLP_BUILD not enabled" [[ -v CONFIG_GCC_PLUGIN_LATENT_ENTROPY ]] && \ die "kernel option 'CONFIG_GCC_PLUGIN_LATENT_ENTROPY' not supported" [[ -v CONFIG_GCC_PLUGIN_RANDSTRUCT ]] && \ die "kernel option 'CONFIG_GCC_PLUGIN_RANDSTRUCT' not supported" [[ -v CONFIG_AS_IS_LLVM ]] && \ [[ "$CONFIG_AS_VERSION" -lt 200000 ]] && \ die "Clang assembler version < 20 not supported" return 0 } # Only allow alphanumerics and '_' and '-' in the module name. Everything else # is replaced with '-'. Also truncate to 55 chars so the full name + NUL # terminator fits in the kernel's 56-byte module name array. module_name_string() { echo "${1//[^a-zA-Z0-9_-]/-}" | cut -c 1-55 } # If the module name wasn't specified on the cmdline with --output, give it a # name based on the patch name. set_module_name() { [[ -v NAME ]] && return 0 if [[ "${#PATCHES[@]}" -eq 1 ]]; then NAME="$(basename "${PATCHES[0]}")" NAME="${NAME%.*}" else NAME="patch" fi NAME="livepatch-$NAME" NAME="$(module_name_string "$NAME")" OUTFILE="$NAME.ko" } # Hardcode the value printed by the localversion script to prevent patch # application from appending it with '+' due to a dirty git working tree. set_kernelversion() { local file="$SRC/scripts/setlocalversion" local kernelrelease stash_file "$file" kernelrelease="$(cd "$SRC" && make syncconfig &>/dev/null && make -s kernelrelease)" [[ -z "$kernelrelease" ]] && die "failed to get kernel version" sed -i "2i echo $kernelrelease; exit 0" scripts/setlocalversion } get_patch_files() { local patch="$1" grep0 -E '^(--- |\+\+\+ )' "$patch" \ | gawk '{print $2}' \ | sed 's|^[^/]*/||' \ | sort -u } # Make sure git re-stats the changed files git_refresh() { local patch="$1" local files=() [[ ! -e "$SRC/.git" ]] && return get_patch_files "$patch" | mapfile -t files ( cd "$SRC" git update-index -q --refresh -- "${files[@]}" ) } check_unsupported_patches() { local patch for patch in "${PATCHES[@]}"; do local files=() get_patch_files "$patch" | mapfile -t files for file in "${files[@]}"; do case "$file" in lib/*|*.S) die "unsupported patch to $file" ;; esac done done } apply_patch() { local patch="$1" shift local extra_args=("$@") [[ ! -f "$patch" ]] && die "$patch doesn't exist" ( cd "$SRC" # The sed strips the version signature from 'git format-patch', # otherwise 'git apply --recount' warns. sed -n '/^-- /q;p' "$patch" | git apply "${extra_args[@]}" ) APPLIED_PATCHES+=("$patch") } revert_patch() { local patch="$1" shift local extra_args=("$@") local tmp=() ( cd "$SRC" sed -n '/^-- /q;p' "$patch" | git apply --reverse "${extra_args[@]}" ) git_refresh "$patch" for p in "${APPLIED_PATCHES[@]}"; do [[ "$p" == "$patch" ]] && continue tmp+=("$p") done APPLIED_PATCHES=("${tmp[@]}") } apply_patches() { local patch for patch in "${PATCHES[@]}"; do apply_patch "$patch" done } revert_patches() { local extra_args=("$@") local patches=("${APPLIED_PATCHES[@]}") for (( i=${#patches[@]}-1 ; i>=0 ; i-- )) ; do revert_patch "${patches[$i]}" "${extra_args[@]}" done APPLIED_PATCHES=() } validate_patches() { check_unsupported_patches apply_patches revert_patches } do_init() { # We're not yet smart enough to handle anything other than in-tree # builds in pwd. [[ ! "$SRC" -ef "$SCRIPT_DIR/../.." ]] && die "please run from the kernel root directory" [[ ! "$OBJ" -ef "$SCRIPT_DIR/../.." ]] && die "please run from the kernel root directory" (( SHORT_CIRCUIT <= 1 )) && rm -rf "$TMP_DIR" mkdir -p "$TMP_DIR" APPLIED_PATCHES=() [[ -x "$FIX_PATCH_LINES" ]] || die "can't find fix-patch-lines" validate_config set_module_name set_kernelversion } # Refresh the patch hunk headers, specifically the line numbers and counts. refresh_patch() { local patch="$1" local tmpdir="$PATCH_TMP_DIR" local files=() rm -rf "$tmpdir" mkdir -p "$tmpdir/a" mkdir -p "$tmpdir/b" # Get all source files affected by the patch get_patch_files "$patch" | mapfile -t files # Copy orig source files to 'a' ( cd "$SRC" && echo "${files[@]}" | xargs cp --parents --target-directory="$tmpdir/a" ) # Copy patched source files to 'b' apply_patch "$patch" --recount ( cd "$SRC" && echo "${files[@]}" | xargs cp --parents --target-directory="$tmpdir/b" ) revert_patch "$patch" --recount # Diff 'a' and 'b' to make a clean patch ( cd "$tmpdir" && git diff --no-index --no-prefix a b > "$patch" ) || true } # Copy the patches to a temporary directory, fix their lines so as not to # affect the __LINE__ macro for otherwise unchanged functions further down the # file, and update $PATCHES to point to the fixed patches. fix_patches() { local idx local i rm -f "$TMP_DIR"/*.patch idx=0001 for i in "${!PATCHES[@]}"; do local old_patch="${PATCHES[$i]}" local tmp_patch="$TMP_DIR/tmp.patch" local patch="${PATCHES[$i]}" local new_patch new_patch="$TMP_DIR/$idx-fixed-$(basename "$patch")" cp -f "$old_patch" "$tmp_patch" refresh_patch "$tmp_patch" "$FIX_PATCH_LINES" "$tmp_patch" > "$new_patch" refresh_patch "$new_patch" PATCHES[i]="$new_patch" rm -f "$tmp_patch" idx=$(printf "%04d" $(( 10#$idx + 1 ))) done } clean_kernel() { local cmd=() cmd=("make") cmd+=("--silent") cmd+=("-j$JOBS") cmd+=("clean") ( cd "$SRC" "${cmd[@]}" ) } build_kernel() { local log="$TMP_DIR/build.log" local objtool_args=() local cmd=() objtool_args=("--checksum") cmd=("make")