#!/bin/bash
# Apply the LAB-verified combo4 + Clang FORTIFY pack onto a clean msm-4.14 tree.
#
# Boot-OK on sunfish LAB 2026-09-28 (ksync combo4-fortify-fix). This is NOT
# the full Graphene Stage1 pack (Stage1 alone historically hung at Google logo).
#
# Usage: apply_combo4_fortify.sh <kernel-tree>
# Expects a virgin / reset tree (apply_fortify_clang.py is not idempotent).
set -e

K=${1:?kernel tree}
HERE=$(cd "$(dirname "$0")" && pwd)
FC="$HERE/fortify-clang"

test -d "$K/include/linux"
test -f "$FC/apply_fortify_clang.py"
test -f "$FC/0001-driver-bounds-rtac-fils.patch"

python3 "$FC/apply_fortify_clang.py" "$K"
patch -p1 --forward --batch -d "$K" < "$FC/0001-driver-bounds-rtac-fils.patch"

DEF="$K/arch/arm64/configs/sunfish_defconfig"
test -f "$DEF"

# Drop any prior toggles we manage, then enable the boot-OK set.
for k in \
  FORTIFY_SOURCE \
  INIT_ON_ALLOC_DEFAULT_ON \
  INIT_ON_FREE_DEFAULT_ON \
  SECURITY_DMESG_RESTRICT \
  SLAB_FREELIST_HARDENED \
  SLAB_HARDENED
do
  sed -i "/CONFIG_${k}/d" "$DEF"
done

# Keep KernelSU off on this Magisk track.
sed -i '/CONFIG_KSU/d' "$DEF"
echo '# CONFIG_KSU is not set' >> "$DEF"

for k in \
  CONFIG_FORTIFY_SOURCE \
  CONFIG_INIT_ON_ALLOC_DEFAULT_ON \
  CONFIG_INIT_ON_FREE_DEFAULT_ON \
  CONFIG_SECURITY_DMESG_RESTRICT \
  CONFIG_SLAB_FREELIST_HARDENED
do
  echo "${k}=y" >> "$DEF"
done

echo "OK: combo4+FORTIFY applied on $K"