#!/bin/bash
# Usage: 009-bisect-ksync-one.sh <name> [CONFIG_FOO] ...
# Rebuilds kernel with optional CONFIG_=y extras, injects into GOODMAKE.
set -eo pipefail
NAME=${1:?name}; shift
cd /srv/rom/src/lineage
export HOME=/home/android-build CCACHE_DIR=/srv/rom/ccache USE_CCACHE=1
export PATH=/home/android-build/bin:/usr/local/bin:/usr/bin:/bin:$PATH
export ANDROID_BUILD_TOP=/srv/rom/src/lineage
unset OUT_DIR || true
LIVE=kernel/google/msm-4.14
DEF=$LIVE/arch/arm64/configs/sunfish_defconfig
GOOD=/srv/rom/artifacts/009-axp-los23-port/20260918T143547Z-axp-full/boot-make.img
MB=$(find /srv/rom/prebuilts/magisk -name magiskboot | head -1)

echo "=== ksync-$NAME START $(date -Is) configs=[$*] ==="
git -C "$LIVE" reset --hard 28f9290ae067
git -C "$LIVE" clean -fd
sed -i '/CONFIG_KSU/d' "$DEF"
echo '# CONFIG_KSU is not set' >> "$DEF"
for k in FORTIFY_SOURCE INIT_ON_ALLOC_DEFAULT_ON INIT_ON_FREE_DEFAULT_ON SECURITY_DMESG_RESTRICT SLAB_FREELIST_HARDENED SLAB_HARDENED; do
  sed -i "/CONFIG_${k}/d" "$DEF"
done
for cfg in "$@"; do
  echo "${cfg}=y" >> "$DEF"
  echo "enable $cfg"
done

# Clang FORTIFY port (no BUG stubs). See docs/009-fortify-clang-port.md
case " $* " in
  *" CONFIG_FORTIFY_SOURCE "*)
    python3 /srv/rom/artifacts/009-axp-los23-port/scripts/apply_fortify_clang.py "$LIVE"
    # Driver bounds for Clang/LTO fortify false-path link (docs/009-fortify-pos0-link-failure-20260927.md)
    patch -p1 --forward --batch -d "$LIVE"       < /srv/rom/artifacts/009-axp-los23-port/scripts/0001-driver-bounds-rtac-fils.patch
    if [ "${FORTIFY_DIAG:-0}" = 1 ]; then
      python3 /srv/rom/artifacts/009-axp-los23-port/scripts/apply_fortify_diag.py "$LIVE"
    fi
    ;;
esac

# Plaintext panic mirror into alt ramoops (no FORTIFY). See docs/009-fortify-diag-capture-plan.md
# Also applied via FORTIFY_DIAG above when building fortify-diag.
if [ "${PSTORE_ALT_PLAIN:-0}" = 1 ]; then
  python3 /srv/rom/artifacts/009-axp-los23-port/scripts/apply_fortify_diag.py "$LIVE"
fi

# FORTIFY stubs DISABLED by default (see docs/009-fortify-clang-port.md).
# Set ALLOW_FORTIFY_BUG_STUBS=1 only for archaeology — not a valid port.
if [ "${ALLOW_FORTIFY_BUG_STUBS:-0}" = 1 ]; then
  case " $* " in *" CONFIG_FORTIFY_SOURCE "*)
    echo 'WARN: injecting BUG() fortify stubs (ALLOW_FORTIFY_BUG_STUBS=1)'
    python3 - <<'PY2'
from pathlib import Path
import re
p = Path("kernel/google/msm-4.14/lib/string.c")
t = p.read_text()
if "EXPORT_SYMBOL(__read_overflow)" not in t:
    m = re.search(r"void fortify_panic\(const char \*name\).*?EXPORT_SYMBOL\(fortify_panic\);", t, re.S)
    assert m, 'fortify_panic marker missing'
    stub = m.group(0) + """

void __read_overflow(void) { BUG(); }
EXPORT_SYMBOL(__read_overflow);
void __read_overflow2(void) { BUG(); }
EXPORT_SYMBOL(__read_overflow2);
void __read_overflow3(void) { BUG(); }
EXPORT_SYMBOL(__read_overflow3);
void __write_overflow(void) { BUG(); }
EXPORT_SYMBOL(__write_overflow);
"""
    p.write_text(t[:m.start()] + stub + t[m.end():])
PY2
  ;; esac
fi

set +u; source build/envsetup.sh; set -e
breakfast sunfish userdebug
echo "TARGET_RELEASE=${TARGET_RELEASE:-unset}"
test "${TARGET_RELEASE:-}" = "bp4a"

rm -f out/target/product/sunfish/obj/KERNEL_OBJ/arch/arm64/boot/Image.lz4
rm -f out/target/product/sunfish/boot.img
mka bootimage -j8

PROD=/srv/rom/src/lineage/out/target/product/sunfish
BID=$(date -u +%Y%m%dT%H%M%SZ)
DEST=/srv/rom/artifacts/009-axp-los23-port/${BID}-bisect-ksync-${NAME}
mkdir -p "$DEST"
cp -v "$PROD/boot.img" "$DEST/boot-make-native.img"

WORK=$DEST/work
rm -rf "$WORK"; mkdir -p "$WORK/good" "$WORK/new" "$WORK/check"
(cd "$WORK/good" && "$MB" unpack "$GOOD")
(cd "$WORK/new" && "$MB" unpack "$PROD/boot.img")
cp -f "$WORK/new/kernel" "$WORK/good/kernel"
(cd "$WORK/good" && "$MB" repack "$GOOD" "$DEST/boot-make.img")
(cd "$WORK/check" && "$MB" unpack "$DEST/boot-make.img" >/dev/null && "$MB" cpio ramdisk.cpio extract)
echo "=== VERIFY $NAME ==="
grep -E 'security_patch|sdk_full' "$WORK/check/prop.default" | sort -u
# Prefer header from first successful unpack (WORK/check); do not ||true a SIGILL unpack.
if [[ -f "$WORK/check/kernel" ]]; then
  "$MB" unpack "$DEST/boot-make.img" >"$DEST/unpack-hdr.txt" 2>&1 || \
    echo "WARN: magiskboot header unpack failed (host SIGILL?); kernel already verified via WORK/check" | tee -a "$DEST/unpack-hdr.txt"
else
  "$MB" unpack "$DEST/boot-make.img" >"$DEST/unpack-hdr.txt" 2>&1
fi
grep -E 'OS_PATCH|KERNEL_SZ|KERNEL_FMT' "$DEST/unpack-hdr.txt" || true
# ikconfig spot-check
/srv/rom/src/lineage/kernel/google/msm-4.14/scripts/extract-ikconfig "$WORK/check/kernel" 2>/dev/null \
  | grep -E 'CONFIG_(SECURITY_DMESG_RESTRICT|SLAB_FREELIST_HARDENED|FORTIFY_SOURCE|INIT_ON_ALLOC)=' || true
sha256sum "$DEST/boot-make.img" "$DEST/boot-make-native.img" | tee "$DEST/SHA256SUMS"
printf '%s\n' "ksync bisect: $NAME" "configs: $*" "Flash boot-make.img only (GOODMAKE ramdisk)." > "$DEST/README.txt"
echo "=== DONE $DEST $(date -Is) ==="