sunfish-admin
deaaf42caa
Release-keys/AVB, CVE clean+hi batches, Yama/slabrand, Pro branding, bundled apps, and AXP-class product surface docs/scripts.
114 lines
4.8 KiB
Bash
Executable File
114 lines
4.8 KiB
Bash
Executable File
#!/bin/bash
|
|
# Usage: 009-bisect-ksync-one.sh <name> [CONFIG_FOO] ...
|
|
# Rebuilds kernel with optional CONFIG_=y extras, injects into GOODMAKE.
|
|
set -eo pipefail
|
|
NAME=${1:?name}; shift
|
|
cd /srv/rom/src/lineage
|
|
export HOME=/home/android-build CCACHE_DIR=/srv/rom/ccache USE_CCACHE=1
|
|
export PATH=/home/android-build/bin:/usr/local/bin:/usr/bin:/bin:$PATH
|
|
export ANDROID_BUILD_TOP=/srv/rom/src/lineage
|
|
unset OUT_DIR || true
|
|
LIVE=kernel/google/msm-4.14
|
|
DEF=$LIVE/arch/arm64/configs/sunfish_defconfig
|
|
GOOD=/srv/rom/artifacts/009-axp-los23-port/20260918T143547Z-axp-full/boot-make.img
|
|
MB=$(find /srv/rom/prebuilts/magisk -name magiskboot | head -1)
|
|
|
|
echo "=== ksync-$NAME START $(date -Is) configs=[$*] ==="
|
|
git -C "$LIVE" reset --hard 28f9290ae067
|
|
git -C "$LIVE" clean -fd
|
|
sed -i '/CONFIG_KSU/d' "$DEF"
|
|
echo '# CONFIG_KSU is not set' >> "$DEF"
|
|
for k in FORTIFY_SOURCE INIT_ON_ALLOC_DEFAULT_ON INIT_ON_FREE_DEFAULT_ON SECURITY_DMESG_RESTRICT SLAB_FREELIST_HARDENED SLAB_HARDENED; do
|
|
sed -i "/CONFIG_${k}/d" "$DEF"
|
|
done
|
|
for cfg in "$@"; do
|
|
echo "${cfg}=y" >> "$DEF"
|
|
echo "enable $cfg"
|
|
done
|
|
|
|
# Clang FORTIFY port (no BUG stubs). See docs/009-fortify-clang-port.md
|
|
case " $* " in
|
|
*" CONFIG_FORTIFY_SOURCE "*)
|
|
python3 /srv/rom/artifacts/009-axp-los23-port/scripts/apply_fortify_clang.py "$LIVE"
|
|
# Driver bounds for Clang/LTO fortify false-path link (docs/009-fortify-pos0-link-failure-20260927.md)
|
|
patch -p1 --forward --batch -d "$LIVE" < /srv/rom/artifacts/009-axp-los23-port/scripts/0001-driver-bounds-rtac-fils.patch
|
|
if [ "${FORTIFY_DIAG:-0}" = 1 ]; then
|
|
python3 /srv/rom/artifacts/009-axp-los23-port/scripts/apply_fortify_diag.py "$LIVE"
|
|
fi
|
|
;;
|
|
esac
|
|
|
|
# Plaintext panic mirror into alt ramoops (no FORTIFY). See docs/009-fortify-diag-capture-plan.md
|
|
# Also applied via FORTIFY_DIAG above when building fortify-diag.
|
|
if [ "${PSTORE_ALT_PLAIN:-0}" = 1 ]; then
|
|
python3 /srv/rom/artifacts/009-axp-los23-port/scripts/apply_fortify_diag.py "$LIVE"
|
|
fi
|
|
|
|
# FORTIFY stubs DISABLED by default (see docs/009-fortify-clang-port.md).
|
|
# Set ALLOW_FORTIFY_BUG_STUBS=1 only for archaeology — not a valid port.
|
|
if [ "${ALLOW_FORTIFY_BUG_STUBS:-0}" = 1 ]; then
|
|
case " $* " in *" CONFIG_FORTIFY_SOURCE "*)
|
|
echo 'WARN: injecting BUG() fortify stubs (ALLOW_FORTIFY_BUG_STUBS=1)'
|
|
python3 - <<'PY2'
|
|
from pathlib import Path
|
|
import re
|
|
p = Path("kernel/google/msm-4.14/lib/string.c")
|
|
t = p.read_text()
|
|
if "EXPORT_SYMBOL(__read_overflow)" not in t:
|
|
m = re.search(r"void fortify_panic\(const char \*name\).*?EXPORT_SYMBOL\(fortify_panic\);", t, re.S)
|
|
assert m, 'fortify_panic marker missing'
|
|
stub = m.group(0) + """
|
|
|
|
void __read_overflow(void) { BUG(); }
|
|
EXPORT_SYMBOL(__read_overflow);
|
|
void __read_overflow2(void) { BUG(); }
|
|
EXPORT_SYMBOL(__read_overflow2);
|
|
void __read_overflow3(void) { BUG(); }
|
|
EXPORT_SYMBOL(__read_overflow3);
|
|
void __write_overflow(void) { BUG(); }
|
|
EXPORT_SYMBOL(__write_overflow);
|
|
"""
|
|
p.write_text(t[:m.start()] + stub + t[m.end():])
|
|
PY2
|
|
;; esac
|
|
fi
|
|
|
|
set +u; source build/envsetup.sh; set -e
|
|
breakfast sunfish userdebug
|
|
echo "TARGET_RELEASE=${TARGET_RELEASE:-unset}"
|
|
test "${TARGET_RELEASE:-}" = "bp4a"
|
|
|
|
rm -f out/target/product/sunfish/obj/KERNEL_OBJ/arch/arm64/boot/Image.lz4
|
|
rm -f out/target/product/sunfish/boot.img
|
|
mka bootimage -j8
|
|
|
|
PROD=/srv/rom/src/lineage/out/target/product/sunfish
|
|
BID=$(date -u +%Y%m%dT%H%M%SZ)
|
|
DEST=/srv/rom/artifacts/009-axp-los23-port/${BID}-bisect-ksync-${NAME}
|
|
mkdir -p "$DEST"
|
|
cp -v "$PROD/boot.img" "$DEST/boot-make-native.img"
|
|
|
|
WORK=$DEST/work
|
|
rm -rf "$WORK"; mkdir -p "$WORK/good" "$WORK/new" "$WORK/check"
|
|
(cd "$WORK/good" && "$MB" unpack "$GOOD")
|
|
(cd "$WORK/new" && "$MB" unpack "$PROD/boot.img")
|
|
cp -f "$WORK/new/kernel" "$WORK/good/kernel"
|
|
(cd "$WORK/good" && "$MB" repack "$GOOD" "$DEST/boot-make.img")
|
|
(cd "$WORK/check" && "$MB" unpack "$DEST/boot-make.img" >/dev/null && "$MB" cpio ramdisk.cpio extract)
|
|
echo "=== VERIFY $NAME ==="
|
|
grep -E 'security_patch|sdk_full' "$WORK/check/prop.default" | sort -u
|
|
# Prefer header from first successful unpack (WORK/check); do not ||true a SIGILL unpack.
|
|
if [[ -f "$WORK/check/kernel" ]]; then
|
|
"$MB" unpack "$DEST/boot-make.img" >"$DEST/unpack-hdr.txt" 2>&1 || \
|
|
echo "WARN: magiskboot header unpack failed (host SIGILL?); kernel already verified via WORK/check" | tee -a "$DEST/unpack-hdr.txt"
|
|
else
|
|
"$MB" unpack "$DEST/boot-make.img" >"$DEST/unpack-hdr.txt" 2>&1
|
|
fi
|
|
grep -E 'OS_PATCH|KERNEL_SZ|KERNEL_FMT' "$DEST/unpack-hdr.txt" || true
|
|
# ikconfig spot-check
|
|
/srv/rom/src/lineage/kernel/google/msm-4.14/scripts/extract-ikconfig "$WORK/check/kernel" 2>/dev/null \
|
|
| grep -E 'CONFIG_(SECURITY_DMESG_RESTRICT|SLAB_FREELIST_HARDENED|FORTIFY_SOURCE|INIT_ON_ALLOC)=' || true
|
|
sha256sum "$DEST/boot-make.img" "$DEST/boot-make-native.img" | tee "$DEST/SHA256SUMS"
|
|
printf '%s\n' "ksync bisect: $NAME" "configs: $*" "Flash boot-make.img only (GOODMAKE ramdisk)." > "$DEST/README.txt"
|
|
echo "=== DONE $DEST $(date -Is) ==="
|