1#!/bin/bash 2# SPDX-License-Identifier: GPL-2.0 3# 4# Build a livepatch module 5 6# shellcheck disable=SC1090,SC2155,SC2164 7 8if (( BASH_VERSINFO[0] < 4 || \ 9 (BASH_VERSINFO[0] == 4 && BASH_VERSINFO[1] < 4) )); then 10 echo "error: this script requires bash 4.4+" >&2 11 exit 1 12fi 13 14set -o errtrace 15set -o pipefail 16set -o nounset 17 18# Allow doing 'cmd | mapfile -t array' instead of 'mapfile -t array < <(cmd)'. 19# This helps keep execution in pipes so pipefail+ERR trap can catch errors. 20shopt -s lastpipe 21 22unset DEBUG_CLONE DIFF_CHECKSUM SKIP_CLEANUP VERBOSE XTRACE 23 24REPLACE=1 25SHORT_CIRCUIT=0 26JOBS="$(getconf _NPROCESSORS_ONLN)" 27shopt -o xtrace | grep -q 'on' && XTRACE=1 28 29# Avoid removing the previous $TMP_DIR until args have been fully processed. 30KEEP_TMP=1 31 32SCRIPT="$(basename "$0")" 33SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" 34FIX_PATCH_LINES="$SCRIPT_DIR/fix-patch-lines" 35 36OBJTOOL="$PWD/tools/objtool/objtool" 37CONFIG="$PWD/.config" 38TMP_DIR="$PWD/klp-tmp" 39 40ORIG_DIR="$TMP_DIR/1-orig" 41PATCHED_DIR="$TMP_DIR/2-patched" 42ORIG_CSUM_DIR="$TMP_DIR/3-checksum-orig" 43PATCHED_CSUM_DIR="$TMP_DIR/3-checksum-patched" 44DIFF_DIR="$TMP_DIR/4-diff" 45KMOD_DIR="$TMP_DIR/5-kmod" 46 47STASH_DIR="$TMP_DIR/stash" 48TIMESTAMP="$TMP_DIR/timestamp" 49PATCH_TMP_DIR="$TMP_DIR/tmp" 50 51KLP_DIFF_LOG="$DIFF_DIR/diff.log" 52 53# Terminal output colors 54read -r COLOR_RESET COLOR_BOLD COLOR_ERROR COLOR_WARN <<< "" 55if [[ -t 1 && -t 2 ]]; then 56 COLOR_RESET="\033[0m" 57 COLOR_BOLD="\033[1m" 58 COLOR_ERROR="\033[0;31m" 59 COLOR_WARN="\033[0;33m" 60fi 61 62grep0() { 63 # shellcheck disable=SC2317 64 command grep "$@" || true 65} 66 67# Because pipefail is enabled, the grep0 helper should be used instead of 68# grep, otherwise a failed match can propagate to an error. 69grep() { 70 echo "error: $SCRIPT: use grep0 or 'command grep' instead of bare grep" >&2 71 exit 1 72} 73 74status() { 75 echo -e "${COLOR_BOLD}$*${COLOR_RESET}" 76} 77 78warn() { 79 echo -e "${COLOR_WARN}warning${COLOR_RESET}: $SCRIPT: $*" >&2 80} 81 82die() { 83 echo -e "${COLOR_ERROR}error${COLOR_RESET}: $SCRIPT: $*" >&2 84 exit 1 85} 86 87declare -a STASHED_FILES 88 89stash_file() { 90 local file="$1" 91 local rel_file="${file#"$PWD"/}" 92 93 [[ ! -e "$file" ]] && die "no file to stash: $file" 94 95 mkdir -p "$STASH_DIR/$(dirname "$rel_file")" 96 cp -f "$file" "$STASH_DIR/$rel_file" 97 98 STASHED_FILES+=("$rel_file") 99} 100 101restore_files() { 102 local file 103 104 for file in "${STASHED_FILES[@]}"; do 105 mv -f "$STASH_DIR/$file" "$PWD/$file" || warn "can't restore file: $file" 106 done 107 108 STASHED_FILES=() 109} 110 111cleanup() { 112 set +o nounset 113 revert_patches 114 restore_files 115 [[ "$KEEP_TMP" -eq 0 ]] && rm -rf "$TMP_DIR" 116 return 0 117} 118 119trap_err() { 120 die "line ${BASH_LINENO[0]}: '$BASH_COMMAND'" 121} 122 123trap cleanup EXIT INT TERM HUP 124trap trap_err ERR 125 126__usage() { 127 cat <<EOF 128Usage: $SCRIPT [OPTIONS] PATCH_FILE(s) 129Generate a livepatch module. 130 131Options: 132 -f, --show-first-changed Show address of first changed instruction 133 -j, --jobs=<jobs> Build jobs to run simultaneously [default: $JOBS] 134 -o, --output=<file.ko> Output file [default: livepatch-<patch-name>.ko] 135 --no-replace Disable livepatch atomic replace 136 -v, --verbose Pass V=1 to kernel/module builds 137 138Advanced Options: 139 -d, --debug Show symbol/reloc cloning decisions 140 -S, --short-circuit=STEP Start at build step (requires prior --keep-tmp) 141 1|orig Build original kernel (default) 142 2|patched Build patched kernel 143 3|checksum Generate checksums 144 4|diff Diff objects 145 5|kmod Build patch module 146 -T, --keep-tmp Preserve tmp dir on exit 147 148EOF 149} 150 151usage() { 152 __usage >&2 153} 154 155process_args() { 156 local keep_tmp=0 157 local short 158 local long 159 local args 160 local patch 161 162 short="hfj:o:vdS:T" 163 long="help,show-first-changed,jobs:,output:,no-replace,verbose,debug,short-circuit:,keep-tmp" 164 165 args=$(getopt --options "$short" --longoptions "$long" -- "$@") || { 166 echo; usage; exit 167 } 168 eval set -- "$args" 169 170 while true; do 171 case "$1" in 172 -h | --help) 173 usage 174 exit 0 175 ;; 176 -f | --show-first-changed) 177 DIFF_CHECKSUM=1 178 shift 179 ;; 180 -j | --jobs) 181 JOBS="$2" 182 shift 2 183 ;; 184 -o | --output) 185 [[ "$2" != *.ko ]] && die "output filename should end with .ko" 186 OUTFILE="$2" 187 NAME="$(basename "$OUTFILE")" 188 NAME="${NAME%.ko}" 189 NAME="$(module_name_string "$NAME")" 190 shift 2 191 ;; 192 --no-replace) 193 REPLACE=0 194 shift 195 ;; 196 -v | --verbose) 197 VERBOSE=1 198 shift 199 ;; 200 -d | --debug) 201 DEBUG_CLONE=1 202 keep_tmp=1 203 shift 204 ;; 205 -S | --short-circuit) 206 [[ ! -d "$TMP_DIR" ]] && die "--short-circuit requires preserved klp-tmp dir" 207 keep_tmp=1 208 case "$2" in 209 1 | orig) SHORT_CIRCUIT=1; ;; 210 2 | patched) SHORT_CIRCUIT=2; ;; 211 3 | checksum) SHORT_CIRCUIT=3; ;; 212 4 | diff) SHORT_CIRCUIT=4; ;; 213 5 | kmod) SHORT_CIRCUIT=5; ;; 214 *) die "invalid short-circuit step '$2'" ;; 215 esac 216 shift 2 217 ;; 218 -T | --keep-tmp) 219 keep_tmp=1 220 shift 221 ;; 222 --) 223 shift 224 break 225 ;; 226 *) 227 usage 228 exit 1 229 ;; 230 esac 231 done 232 233 if [[ $# -eq 0 ]] && (( SHORT_CIRCUIT <= 2 )); then 234 usage 235 exit 1 236 fi 237 238 KEEP_TMP="$keep_tmp" 239 PATCHES=("$@") 240 241 for patch in "${PATCHES[@]}"; do 242 [[ -f "$patch" ]] || die "$patch doesn't exist" 243 done 244} 245 246# temporarily disable xtrace for especially verbose code 247xtrace_save() { 248 [[ -v XTRACE ]] && set +x 249 return 0 250} 251 252xtrace_restore() { 253 [[ -v XTRACE ]] && set -x 254 return 0 255} 256 257validate_config() { 258 xtrace_save "reading .config" 259 source "$CONFIG" || die "no .config file in $(dirname "$CONFIG")" 260 xtrace_restore 261 262 [[ -v CONFIG_LIVEPATCH ]] || \ 263 die "CONFIG_LIVEPATCH not enabled" 264 265 [[ -v CONFIG_KLP_BUILD ]] || \ 266 die "CONFIG_KLP_BUILD not enabled" 267 268 [[ -v CONFIG_GCC_PLUGIN_LATENT_ENTROPY ]] && \ 269 die "kernel option 'CONFIG_GCC_PLUGIN_LATENT_ENTROPY' not supported" 270 271 [[ -v CONFIG_GCC_PLUGIN_RANDSTRUCT ]] && \ 272 die "kernel option 'CONFIG_GCC_PLUGIN_RANDSTRUCT' not supported" 273 274 [[ -v CONFIG_LD_DEAD_CODE_DATA_ELIMINATION ]] && \ 275 die "kernel option 'CONFIG_LD_DEAD_CODE_DATA_ELIMINATION' not supported" 276 277 [[ -v CONFIG_AS_IS_LLVM ]] && \ 278 [[ "$CONFIG_AS_VERSION" -lt 200000 ]] && \ 279 die "Clang assembler version < 20 not supported" 280 281 [[ -x "$OBJTOOL" ]] && "$OBJTOOL" klp 2>&1 | command grep -q "not implemented" && \ 282 die "objtool not built with KLP support; install xxhash-devel/libxxhash-dev (version >= 0.8) and recompile" 283 284 return 0 285} 286 287# Only allow alphanumerics and '_' and '-' in the module name. Everything else 288# is replaced with '-'. Also truncate to 55 chars so the full name + NUL 289# terminator fits in the kernel's 56-byte module name array. 290module_name_string() { 291 echo "${1//[^a-zA-Z0-9_-]/-}" | cut -c 1-55 292} 293 294# If the module name wasn't specified on the cmdline with --output, give it a 295# name based on the patch name. 296set_module_name() { 297 [[ -v NAME ]] && return 0 298 299 if [[ "${#PATCHES[@]}" -eq 1 ]]; then 300 NAME="$(basename "${PATCHES[0]}")" 301 NAME="${NAME%.*}" 302 else 303 NAME="patch" 304 fi 305 306 NAME="livepatch-$NAME" 307 NAME="$(module_name_string "$NAME")" 308 309 OUTFILE="$NAME.ko" 310} 311 312# Hardcode the value printed by the localversion script to prevent patch 313# application from appending it with '+' due to a dirty working tree. 314set_kernelversion() { 315 local file="$PWD/scripts/setlocalversion" 316 local kernelrelease 317 318 stash_file "$file" 319 320 if [[ -n "$(make -s listnewconfig 2>/dev/null)" ]]; then 321 die ".config mismatch, check your .config or run 'make olddefconfig'" 322 fi 323 make syncconfig &>/dev/null || die "make syncconfig failed" 324 325 kernelrelease="$(make -s kernelrelease)" 326 [[ -z "$kernelrelease" ]] && die "failed to get kernel version" 327 328 sed -i "2i echo $kernelrelease; exit 0" scripts/setlocalversion 329} 330 331get_patch_input_files() { 332 local patch="$1" 333 334 grep0 -E '^--- ' "$patch" \ 335 | grep0 -v -e '/dev/null' -e '1969-12-31' -e '1970-01-01' \ 336 | gawk '{print $2}' \ 337 | sed 's|^[^/]*/||' \ 338 | sort -u 339} 340 341get_patch_output_files() { 342 local patch="$1" 343 344 grep0 -E '^\+\+\+ ' "$patch" \ 345 | grep0 -v -e '/dev/null' -e '1969-12-31' -e '1970-01-01' \ 346 | gawk '{print $2}' \ 347 | sed 's|^[^/]*/||' \ 348 | sort -u 349} 350 351get_patch_files() { 352 local patch="$1" 353 354 { get_patch_input_files "$patch"; get_patch_output_files "$patch"; } \ 355 | sort -u 356} 357 358check_unsupported_patches() { 359 local patch 360 361 for patch in "${PATCHES[@]}"; do 362 local files=() 363 364 get_patch_files "$patch" | mapfile -t files 365 366 for file in "${files[@]}"; do 367 case "$file" in 368 lib/*|*/vdso/*|*/realmode/rm/*|*.S) 369 die "${patch}: unsupported patch to $file" 370 ;; 371 esac 372 done 373 done 374} 375 376apply_patch() { 377 local patch="$1" 378 shift 379 local extra_args=("$@") 380 local drift_regex="with fuzz|offset [0-9]+ line" 381 local output 382 local status 383 384 [[ ! -f "$patch" ]] && die "$patch doesn't exist" 385 status=0 386 output=$(patch -p1 --dry-run --no-backup-if-mismatch -r /dev/null "${extra_args[@]}" < "$patch" 2>&1) || status=$? 387 if [[ "$status" -ne 0 ]]; then 388 echo "$output" >&2 389 die "$patch did not apply" 390 elif [[ "$output" =~ $drift_regex ]]; then 391 [[ -v VERBOSE ]] && echo "$output" >&2 392 warn "${patch} applied with fuzz" 393 fi 394 395 APPLIED_PATCHES+=("$patch") 396 patch -p1 --no-backup-if-mismatch -r /dev/null "${extra_args[@]}" --silent < "$patch" 397} 398 399revert_patch() { 400 local patch="$1" 401 local tmp=() 402 403 patch -p1 -R --force --no-backup-if-mismatch -r /dev/null &> /dev/null < "$patch" || true 404 405 for p in "${APPLIED_PATCHES[@]}"; do 406 [[ "$p" == "$patch" ]] && continue 407 tmp+=("$p") 408 done 409 410 APPLIED_PATCHES=("${tmp[@]}") 411} 412 413apply_patches() { 414 local extra_args=("$@") 415 local patch 416 417 for patch in "${PATCHES[@]}"; do 418 apply_patch "$patch" "${extra_args[@]}" 419 done 420} 421 422revert_patches() { 423 local patches=("${APPLIED_PATCHES[@]}") 424 425 for (( i=${#patches[@]}-1 ; i>=0 ; i-- )) ; do 426 revert_patch "${patches[$i]}" 427 done 428 429 APPLIED_PATCHES=() 430} 431 432validate_patches() { 433 check_unsupported_patches 434 apply_patches 435 revert_patches 436} 437 438do_init() { 439 # We're not yet smart enough to handle anything other than in-tree 440 # builds in pwd. 441 [[ ! "$PWD" -ef "$SCRIPT_DIR/../.." ]] && die "please run from the kernel root directory" 442 443 if (( SHORT_CIRCUIT >= 2 )); then 444 [[ -f "$ORIG_DIR/.complete" ]] || die "-S $SHORT_CIRCUIT requires completed $ORIG_DIR" 445 fi 446 if (( SHORT_CIRCUIT >= 3 )); then 447 [[ -f "$PATCHED_DIR/.complete" ]] || die "-S $SHORT_CIRCUIT requires completed $PATCHED_DIR" 448 fi 449 if (( SHORT_CIRCUIT >= 4 )); then 450 [[ -f "$ORIG_CSUM_DIR/.complete" ]] || die "-S $SHORT_CIRCUIT requires completed $ORIG_CSUM_DIR" 451 [[ -f "$PATCHED_CSUM_DIR/.complete" ]] || die "-S $SHORT_CIRCUIT requires completed $PATCHED_CSUM_DIR" 452 fi 453 if (( SHORT_CIRCUIT >= 5 )); then 454 [[ -f "$DIFF_DIR/.complete" ]] || die "-S $SHORT_CIRCUIT requires completed $DIFF_DIR" 455 fi 456 457 (( SHORT_CIRCUIT <= 1 )) && rm -rf "$TMP_DIR" 458 mkdir -p "$TMP_DIR" 459 460 APPLIED_PATCHES=() 461 462 [[ -x "$FIX_PATCH_LINES" ]] || die "can't find fix-patch-lines" 463 command -v recountdiff &>/dev/null || die "recountdiff not found (install patchutils)" 464 465 validate_config 466 set_module_name 467 set_kernelversion 468} 469 470# Refresh the patch hunk headers, specifically the line numbers and counts. 471refresh_patch() { 472 local patch="$1" 473 local tmpdir="$PATCH_TMP_DIR" 474 local input_files=() 475 local output_files=() 476 477 rm -rf "$tmpdir" 478 mkdir -p "$tmpdir/a" 479 mkdir -p "$tmpdir/b" 480 481 # Get all source files affected by the patch 482 get_patch_input_files "$patch" | mapfile -t input_files 483 get_patch_output_files "$patch" | mapfile -t output_files 484 485 # Copy orig source files to 'a' 486 echo "${input_files[@]}" | xargs cp --parents --target-directory="$tmpdir/a" 487 488 # Copy patched source files to 'b' 489 apply_patch "$patch" "--silent" 490 echo "${output_files[@]}" | xargs cp --parents --target-directory="$tmpdir/b" 491 revert_patch "$patch" 492 493 # Diff 'a' and 'b' to make a clean patch 494 ( cd "$tmpdir" && diff -Nupr a b > "$patch" ) || true 495} 496 497# Copy the patches to a temporary directory, fix their lines so as not to 498# affect the __LINE__ macro for otherwise unchanged functions further down the 499# file, and update $PATCHES to point to the fixed patches. 500fix_patches() { 501 local idx 502 local i 503 504 rm -f "$TMP_DIR"/*.patch 505 506 idx=0001 507 for i in "${!PATCHES[@]}"; do 508 local old_patch="${PATCHES[$i]}" 509 local tmp_patch="$TMP_DIR/tmp.patch" 510 local patch="${PATCHES[$i]}" 511 local new_patch 512 513 new_patch="$TMP_DIR/$idx-fixed-$(basename "$patch")" 514 515 cp -f "$old_patch" "$tmp_patch" 516 refresh_patch "$tmp_patch" 517 "$FIX_PATCH_LINES" "$tmp_patch" | recountdiff > "$new_patch" 518 519 PATCHES[i]="$new_patch" 520 521 rm -f "$tmp_patch" 522 idx=$(printf "%04d" $(( 10#$idx + 1 ))) 523 done 524} 525 526clean_kernel() { 527 local cmd=() 528 529 cmd=("make") 530 cmd+=("--silent") 531 cmd+=("-j$JOBS") 532 cmd+=("clean") 533 534 "${cmd[@]}" 535} 536 537build_kernel() { 538 local build="$1" 539 local log="$TMP_DIR/build.log" 540 local cmd=() 541 542 cmd=("make") 543 544 # When a patch to a kernel module references a newly created unexported 545 # symbol which lives in vmlinux or another kernel module, the patched 546 # kernel build fails with the following error: 547 # 548 # ERROR: modpost: "klp_string" [fs/xfs/xfs.ko] undefined! 549 # 550 # The undefined symbols are working as designed in that case. They get 551 # resolved later when the livepatch module build link pulls all the 552 # disparate objects together into the same kernel module. 553 # 554 # It would be good to have a way to tell modpost to skip checking for 555 # undefined symbols altogether. For now, just convert the error to a 556 # warning with KBUILD_MODPOST_WARN, and grep out the warning to avoid 557 # confusing the user. 558 # 559 cmd+=("KBUILD_MODPOST_WARN=1") 560 561 cmd+=("KLP_SYMIDS=1") 562 563 if [[ -v VERBOSE ]]; then 564 cmd+=("V=1") 565 else 566 cmd+=("-s") 567 fi 568 cmd+=("-j$JOBS") 569 cmd+=("KCFLAGS=-ffunction-sections -fdata-sections") 570 cmd+=("vmlinux") 571 cmd+=("modules") 572 573 "${cmd[@]}" \ 574 1> >(tee -a "$log") \ 575 2> >(tee -a "$log" | grep0 -v "modpost.*undefined!" >&2) \ 576 || die "$build kernel build failed" 577} 578 579find_objects() { 580 local opts=("$@") 581 582 # Find root-level vmlinux.o and non-root-level .ko files, 583 # excluding klp-tmp/ and hidden directories. 584 find "$PWD" -mindepth 1 \ 585 \( -path "$TMP_DIR" -o -name ".*" -o -regex "$PWD/[^/][^/]*\.ko" \) -prune -o \ 586 -type f "${opts[@]}" \ 587 \( -name "*.ko" -o -path "$PWD/vmlinux.o" \) \ 588 -printf '%P\n' 589} 590 591# Copy all .o archives to $ORIG_DIR 592copy_orig_objects() { 593 local files=() 594 595 rm -rf "$ORIG_DIR" 596 mkdir -p "$ORIG_DIR" 597 598 find_objects | mapfile -t files 599 600 xtrace_save "copying original objects" 601 for _file in "${files[@]}"; do 602 local rel_file="${_file/.ko/.o}" 603 local file="$PWD/$rel_file" 604 local orig_file="$ORIG_DIR/$rel_file" 605 local orig_dir="$(dirname "$orig_file")" 606 607 [[ ! -f "$file" ]] && die "missing $(basename "$file") for $_file" 608 609 mkdir -p "$orig_dir" 610 cp -f "$file" "$orig_dir" 611 done 612 xtrace_restore 613 614 cp -f "$PWD/vmlinux" "$ORIG_DIR" || die "missing vmlinux" 615 616 mv -f "$TMP_DIR/build.log" "$ORIG_DIR" 617 touch "$TIMESTAMP" 618 touch "$ORIG_DIR/.complete" 619} 620 621# Copy all changed objects to $PATCHED_DIR 622copy_patched_objects() { 623 local files=() 624 local opts=() 625 local found=0 626 627 rm -rf "$PATCHED_DIR" 628 mkdir -p "$PATCHED_DIR" 629 630 # Note this doesn't work with some configs, thus the 'cmp' below. 631 opts=("-newer") 632 opts+=("$TIMESTAMP") 633 634 find_objects "${opts[@]}" | mapfile -t files 635 636 xtrace_save "copying changed objects" 637 for _file in "${files[@]}"; do 638 local rel_file="${_file/.ko/.o}" 639 local file="$PWD/$rel_file" 640 local orig_file="$ORIG_DIR/$rel_file" 641 local patched_file="$PATCHED_DIR/$rel_file" 642 local patched_dir="$(dirname "$patched_file")" 643 644 [[ ! -f "$file" ]] && die "missing $(basename "$file") for $_file" 645 646 cmp -s "$orig_file" "$file" && continue 647 648 mkdir -p "$patched_dir" 649 cp -f "$file" "$patched_dir" 650 found=1 651 done 652 xtrace_restore 653 654 (( found == 0 )) && die "no changes detected" 655 656 mv -f "$TMP_DIR/build.log" "$PATCHED_DIR" 657 touch "$PATCHED_DIR/.complete" 658} 659 660# Copy .o files to a separate directory and run "objtool klp checksum" on each 661# copy. The checksums are written to a .discard.sym_checksum section. 662# 663# If match_dir is given, only process files which also exist there. 664generate_checksums() { 665 local src_dir="$1" 666 local dest_dir="$2" 667 local match_dir="${3:-}" 668 local files=() 669 local file 670 671 rm -rf "$dest_dir" 672 mkdir -p "$dest_dir" 673 674 find "$src_dir" -type f -name "*.o" | mapfile -t files 675 for file in "${files[@]}"; do 676 local rel="${file#"$src_dir"/}" 677 local dest="$dest_dir/$rel" 678 679 [[ -n "$match_dir" && ! -f "$match_dir/$rel" ]] && continue 680 681 mkdir -p "$(dirname "$dest")" 682 cp -f "$file" "$dest" 683 "$OBJTOOL" klp checksum "$dest" 684 done 685 686 [[ -f "$src_dir/vmlinux" ]] && cp -f "$src_dir/vmlinux" "$dest_dir" 687 688 touch "$dest_dir/.complete" 689} 690 691# Diff changed objects, writing output object to $DIFF_DIR 692diff_objects() { 693 local log="$KLP_DIFF_LOG" 694 local files=() 695 local opts=() 696 697 rm -rf "$DIFF_DIR" 698 mkdir -p "$DIFF_DIR" 699 700 find "$PATCHED_CSUM_DIR" -type f -name "*.o" | mapfile -t files 701 [[ ${#files[@]} -eq 0 ]] && die "no changes detected" 702 703 [[ -v DEBUG_CLONE ]] && opts=("--debug") 704 705 # Diff all changed objects 706 for file in "${files[@]}"; do 707 local rel_file="${file#"$PATCHED_CSUM_DIR"/}" 708 local orig_file="$rel_file" 709 local patched_file="$PATCHED_CSUM_DIR/$rel_file" 710 local out_file="$DIFF_DIR/$rel_file" 711 local filter=() 712 local cmd=() 713 714 mkdir -p "$(dirname "$out_file")" 715 716 cmd=("$OBJTOOL") 717 cmd+=("klp") 718 cmd+=("diff") 719 (( ${#opts[@]} > 0 )) && cmd+=("${opts[@]}") 720 cmd+=("$orig_file") 721 cmd+=("$patched_file") 722 cmd+=("$out_file") 723 724 if [[ -v DIFF_CHECKSUM ]]; then 725 filter=("grep0") 726 filter+=("-Ev") 727 filter+=("DEBUG: .*checksum: ") 728 else 729 filter=("cat") 730 fi 731 732 ( 733 cd "$ORIG_CSUM_DIR" 734 [[ -v VERBOSE ]] && echo "cd $ORIG_CSUM_DIR && ${cmd[*]}" 735 "${cmd[@]}" \ 736 1> >(tee -a "$log") \ 737 2> >(tee -a "$log" | "${filter[@]}" >&2) || \ 738 die "objtool klp diff failed" 739 ) 740 done 741 742 touch "$DIFF_DIR/.complete" 743} 744 745# For each changed object, run "objtool klp checksum" with --debug-checksum to 746# get the per-instruction checksums, and then diff those to find the first 747# changed instruction for each function. 748diff_checksums() { 749 local orig_log="$ORIG_DIR/checksum.log" 750 local patched_log="$PATCHED_DIR/checksum.log" 751 local -A funcs 752 local cmd=() 753 local line 754 local file 755 local func 756 757 gawk '/\.o: changed function: / { 758 sub(/:$/, "", $1) 759 print $1, $NF 760 }' "$KLP_DIFF_LOG" | mapfile -t lines 761 762 for line in "${lines[@]}"; do 763 read -r file func <<< "$line" 764 if [[ ! -v funcs["$file"] ]]; then 765 funcs["$file"]="$func" 766 else 767 funcs["$file"]+=" $func" 768 fi 769 done 770 771 cmd=("$OBJTOOL") 772 cmd+=("klp" "checksum") 773 cmd+=("--dry-run") 774 775 for file in "${!funcs[@]}"; do 776 local opt="--debug-checksum=${funcs[$file]// /,}" 777 778 ( 779 cd "$ORIG_DIR" 780 "${cmd[@]}" "$opt" "$file" &> "$orig_log" || \ 781 ( cat "$orig_log" >&2; die "objtool klp checksum failed" ) 782 783 cd "$PATCHED_DIR" 784 "${cmd[@]}" "$opt" "$file" &> "$patched_log" || \ 785 ( cat "$patched_log" >&2; die "objtool klp checksum failed" ) 786 ) 787 788 for func in ${funcs[$file]}; do 789 local -a orig patched 790 paste <(grep0 -E "^DEBUG: .*checksum: $func " "$orig_log") \ 791 <(grep0 -E "^DEBUG: .*checksum: $func " "$patched_log") | 792 while IFS= read -r line; do 793 read -ra orig <<< "${line%%$'\t'*}" 794 read -ra patched <<< "${line#*$'\t'}" 795 796 if [[ ${#patched[@]} -eq 0 ]]; then 797 printf "%s: %s: %s (removed)\n" "${orig[1]%:}" "${orig[3]}" "${orig[-2]}" 798 break 799 elif [[ ${#orig[@]} -eq 0 ]]; then 800 printf "%s: %s: %s (added)\n" "${patched[1]%:}" "${patched[3]}" "${patched[-2]}" 801 break 802 fi 803 804 [[ "${orig[-1]}" == "${patched[-1]}" ]] && continue 805 806 printf "%s: %s: %s" "${orig[1]%:}" "${orig[3]}" "${orig[-2]}" 807 [[ "${orig[-2]}" != "${patched[-2]}" ]] && \ 808 printf " (patched: %s)" "${patched[-2]}" 809 printf "\n" 810 break 811 done || true 812 done 813 done 814} 815 816# Build and post-process livepatch module in $KMOD_DIR 817build_patch_module() { 818 local makefile="$KMOD_DIR/Kbuild" 819 local log="$KMOD_DIR/build.log" 820 local kmod_file 821 local cflags=() 822 local files=() 823 local cmd=() 824 825 rm -rf "$KMOD_DIR" 826 mkdir -p "$KMOD_DIR" 827 828 cp -f "$SCRIPT_DIR/init.c" "$KMOD_DIR" 829 830 echo "obj-m := $NAME.o" > "$makefile" 831 echo -n "$NAME-y := init.o" >> "$makefile" 832 833 find "$DIFF_DIR" -type f -name "*.o" | mapfile -t files 834 [[ ${#files[@]} -eq 0 ]] && die "no changes detected" 835 836 for file in "${files[@]}"; do 837 local rel_file="${file#"$DIFF_DIR"/}" 838 local orig_file="$ORIG_DIR/$rel_file" 839 local orig_dir="$(dirname "$orig_file")" 840 local kmod_file="$KMOD_DIR/$rel_file" 841 local kmod_dir="$(dirname "$kmod_file")" 842 local cmd_file="$kmod_dir/.$(basename "$file").cmd" 843 844 mkdir -p "$kmod_dir" 845 cp -f "$file" "$kmod_dir" 846 847 # Tell kbuild this is a prebuilt object 848 cp -f "$file" "${kmod_file}_shipped" 849 850 # Make modpost happy 851 touch "$cmd_file" 852 853 echo -n " $rel_file" >> "$makefile" 854 done 855 856 echo >> "$makefile" 857 858 cflags=("-ffunction-sections") 859 cflags+=("-fdata-sections") 860 [[ $REPLACE -eq 0 ]] && cflags+=("-DKLP_NO_REPLACE") 861 862 cmd=("make") 863 if [[ -v VERBOSE ]]; then 864 cmd+=("V=1") 865 else 866 cmd+=("-s") 867 fi 868 cmd+=("-j$JOBS") 869 cmd+=("--directory=.") 870 cmd+=("M=$KMOD_DIR") 871 cmd+=("KCFLAGS=${cflags[*]}") 872 873 # Build a "normal" kernel module with init.c and the diffed objects 874 "${cmd[@]}" \ 875 1> >(tee -a "$log") \ 876 2> >(tee -a "$log" >&2) 877 878 kmod_file="$KMOD_DIR/$NAME.ko" 879 880 # Save off the intermediate binary for debugging 881 cp -f "$kmod_file" "$kmod_file.orig" 882 883 # Work around issue where slight .config change makes corrupt BTF 884 objcopy --remove-section=.BTF "$kmod_file" 885 886 # Fix (and work around) linker wreckage for klp syms / relocs 887 "$OBJTOOL" klp post-link "$kmod_file" || die "objtool klp post-link failed" 888 889 cp -f "$kmod_file" "$OUTFILE" 890} 891 892 893################################################################################ 894 895process_args "$@" 896do_init 897 898if (( SHORT_CIRCUIT <= 2 )); then 899 status "Validating patch(es)" 900 validate_patches 901fi 902 903if (( SHORT_CIRCUIT <= 1 )); then 904 status "Building original kernel" 905 clean_kernel 906 build_kernel "original" 907 status "Copying original object files" 908 copy_orig_objects 909fi 910 911if (( SHORT_CIRCUIT <= 2 )); then 912 status "Fixing patch(es)" 913 fix_patches 914 apply_patches "--silent" 915 status "Building patched kernel" 916 build_kernel "patched" 917 revert_patches 918 status "Copying patched object files" 919 copy_patched_objects 920fi 921 922if (( SHORT_CIRCUIT <= 3 )); then 923 status "Generating original checksums" 924 generate_checksums "$ORIG_DIR" "$ORIG_CSUM_DIR" "$PATCHED_DIR" 925 status "Generating patched checksums" 926 generate_checksums "$PATCHED_DIR" "$PATCHED_CSUM_DIR" 927fi 928 929if (( SHORT_CIRCUIT <= 4 )); then 930 status "Diffing objects" 931 diff_objects 932 if [[ -v DIFF_CHECKSUM ]]; then 933 status "Finding first changed instructions" 934 diff_checksums 935 fi 936fi 937 938if (( SHORT_CIRCUIT <= 5 )); then 939 status "Building patch module: $OUTFILE" 940 build_patch_module 941fi 942 943status "SUCCESS" 944