aboutsummaryrefslogtreecommitdiffstats
path: root/scripts
diff options
context:
space:
mode:
Diffstat (limited to 'scripts')
-rw-r--r--scripts/Makefile.build5
-rw-r--r--scripts/Makefile.host2
-rw-r--r--scripts/Makefile.lib2
-rw-r--r--scripts/Makefile.modbuiltin2
-rw-r--r--scripts/Makefile.modpost2
-rw-r--r--scripts/Makefile.ubsan1
-rwxr-xr-xscripts/bpf_helpers_doc.py8
-rwxr-xr-xscripts/checkpatch.pl18
-rwxr-xr-xscripts/documentation-file-ref-check32
-rw-r--r--scripts/gcc-plugins/Kconfig126
-rw-r--r--scripts/gcc-plugins/arm_ssp_per_task_plugin.c2
-rw-r--r--scripts/gdb/linux/Makefile2
-rwxr-xr-xscripts/link-vmlinux.sh28
-rwxr-xr-xscripts/mkmakefile26
-rwxr-xr-xscripts/recordmcount.pl5
-rwxr-xr-xscripts/selinux/install_policy.sh92
-rw-r--r--scripts/selinux/mdp/Makefile2
-rw-r--r--scripts/selinux/mdp/mdp.c165
-rwxr-xr-xscripts/sphinx-pre-install1
-rwxr-xr-xscripts/tags.sh2
20 files changed, 300 insertions, 223 deletions
diff --git a/scripts/Makefile.build b/scripts/Makefile.build
index 76ca30cc4791..ae9cf740633e 100644
--- a/scripts/Makefile.build
+++ b/scripts/Makefile.build
@@ -222,6 +222,9 @@ endif
222ifdef CONFIG_RETPOLINE 222ifdef CONFIG_RETPOLINE
223 objtool_args += --retpoline 223 objtool_args += --retpoline
224endif 224endif
225ifdef CONFIG_X86_SMAP
226 objtool_args += --uaccess
227endif
225 228
226# 'OBJECT_FILES_NON_STANDARD := y': skip objtool checking for a directory 229# 'OBJECT_FILES_NON_STANDARD := y': skip objtool checking for a directory
227# 'OBJECT_FILES_NON_STANDARD_foo.o := 'y': skip objtool checking for a file 230# 'OBJECT_FILES_NON_STANDARD_foo.o := 'y': skip objtool checking for a file
@@ -501,7 +504,7 @@ existing-targets := $(wildcard $(sort $(targets)))
501 504
502-include $(foreach f,$(existing-targets),$(dir $(f)).$(notdir $(f)).cmd) 505-include $(foreach f,$(existing-targets),$(dir $(f)).$(notdir $(f)).cmd)
503 506
504ifneq ($(KBUILD_SRC),) 507ifneq ($(srctree),.)
505# Create directories for object files if they do not exist 508# Create directories for object files if they do not exist
506obj-dirs := $(sort $(obj) $(patsubst %/,%, $(dir $(targets)))) 509obj-dirs := $(sort $(obj) $(patsubst %/,%, $(dir $(targets))))
507# If targets exist, their directories apparently exist. Skip mkdir. 510# If targets exist, their directories apparently exist. Skip mkdir.
diff --git a/scripts/Makefile.host b/scripts/Makefile.host
index a115259b57e7..73b804197fca 100644
--- a/scripts/Makefile.host
+++ b/scripts/Makefile.host
@@ -71,7 +71,7 @@ __hostc_flags = $(_hostc_flags)
71__hostcxx_flags = $(_hostcxx_flags) 71__hostcxx_flags = $(_hostcxx_flags)
72 72
73ifeq ($(KBUILD_EXTMOD),) 73ifeq ($(KBUILD_EXTMOD),)
74ifneq ($(KBUILD_SRC),) 74ifneq ($(srctree),.)
75__hostc_flags = -I$(obj) $(call flags,_hostc_flags) 75__hostc_flags = -I$(obj) $(call flags,_hostc_flags)
76__hostcxx_flags = -I$(obj) $(call flags,_hostcxx_flags) 76__hostcxx_flags = -I$(obj) $(call flags,_hostcxx_flags)
77endif 77endif
diff --git a/scripts/Makefile.lib b/scripts/Makefile.lib
index 8a1f64f17740..41e98fa66b91 100644
--- a/scripts/Makefile.lib
+++ b/scripts/Makefile.lib
@@ -144,7 +144,7 @@ __cpp_flags = $(_cpp_flags)
144# If building the kernel in a separate objtree expand all occurrences 144# If building the kernel in a separate objtree expand all occurrences
145# of -Idir to -I$(srctree)/dir except for absolute paths (starting with '/'). 145# of -Idir to -I$(srctree)/dir except for absolute paths (starting with '/').
146ifeq ($(KBUILD_EXTMOD),) 146ifeq ($(KBUILD_EXTMOD),)
147ifneq ($(KBUILD_SRC),) 147ifneq ($(srctree),.)
148 148
149# -I$(obj) locates generated .h files 149# -I$(obj) locates generated .h files
150# $(call addtree,-I$(obj)) locates .h files in srctree, from generated .c files 150# $(call addtree,-I$(obj)) locates .h files in srctree, from generated .c files
diff --git a/scripts/Makefile.modbuiltin b/scripts/Makefile.modbuiltin
index a072a4267746..ea90a90b41a0 100644
--- a/scripts/Makefile.modbuiltin
+++ b/scripts/Makefile.modbuiltin
@@ -15,7 +15,7 @@ include include/config/tristate.conf
15 15
16include scripts/Kbuild.include 16include scripts/Kbuild.include
17 17
18ifneq ($(KBUILD_SRC),) 18ifneq ($(srctree),.)
19# Create output directory if not already present 19# Create output directory if not already present
20_dummy := $(shell [ -d $(obj) ] || mkdir -p $(obj)) 20_dummy := $(shell [ -d $(obj) ] || mkdir -p $(obj))
21endif 21endif
diff --git a/scripts/Makefile.modpost b/scripts/Makefile.modpost
index 6b7f354f189a..fec6ec2ffa47 100644
--- a/scripts/Makefile.modpost
+++ b/scripts/Makefile.modpost
@@ -78,7 +78,7 @@ modpost = scripts/mod/modpost \
78 $(if $(KBUILD_EXTRA_SYMBOLS), $(patsubst %, -e %,$(KBUILD_EXTRA_SYMBOLS))) \ 78 $(if $(KBUILD_EXTRA_SYMBOLS), $(patsubst %, -e %,$(KBUILD_EXTRA_SYMBOLS))) \
79 $(if $(KBUILD_EXTMOD),-o $(modulesymfile)) \ 79 $(if $(KBUILD_EXTMOD),-o $(modulesymfile)) \
80 $(if $(CONFIG_SECTION_MISMATCH_WARN_ONLY),,-E) \ 80 $(if $(CONFIG_SECTION_MISMATCH_WARN_ONLY),,-E) \
81 $(if $(KBUILD_EXTMOD)$(KBUILD_MODPOST_WARN),-w) 81 $(if $(KBUILD_MODPOST_WARN),-w)
82 82
83MODPOST_OPT=$(subst -i,-n,$(filter -i,$(MAKEFLAGS))) 83MODPOST_OPT=$(subst -i,-n,$(filter -i,$(MAKEFLAGS)))
84 84
diff --git a/scripts/Makefile.ubsan b/scripts/Makefile.ubsan
index 38b2b4818e8e..019771b845c5 100644
--- a/scripts/Makefile.ubsan
+++ b/scripts/Makefile.ubsan
@@ -3,7 +3,6 @@ ifdef CONFIG_UBSAN
3 CFLAGS_UBSAN += $(call cc-option, -fsanitize=shift) 3 CFLAGS_UBSAN += $(call cc-option, -fsanitize=shift)
4 CFLAGS_UBSAN += $(call cc-option, -fsanitize=integer-divide-by-zero) 4 CFLAGS_UBSAN += $(call cc-option, -fsanitize=integer-divide-by-zero)
5 CFLAGS_UBSAN += $(call cc-option, -fsanitize=unreachable) 5 CFLAGS_UBSAN += $(call cc-option, -fsanitize=unreachable)
6 CFLAGS_UBSAN += $(call cc-option, -fsanitize=vla-bound)
7 CFLAGS_UBSAN += $(call cc-option, -fsanitize=signed-integer-overflow) 6 CFLAGS_UBSAN += $(call cc-option, -fsanitize=signed-integer-overflow)
8 CFLAGS_UBSAN += $(call cc-option, -fsanitize=bounds) 7 CFLAGS_UBSAN += $(call cc-option, -fsanitize=bounds)
9 CFLAGS_UBSAN += $(call cc-option, -fsanitize=object-size) 8 CFLAGS_UBSAN += $(call cc-option, -fsanitize=object-size)
diff --git a/scripts/bpf_helpers_doc.py b/scripts/bpf_helpers_doc.py
index 5010a4d5bfba..894cc58c1a03 100755
--- a/scripts/bpf_helpers_doc.py
+++ b/scripts/bpf_helpers_doc.py
@@ -1,7 +1,7 @@
1#!/usr/bin/python3 1#!/usr/bin/python3
2# SPDX-License-Identifier: GPL-2.0-only 2# SPDX-License-Identifier: GPL-2.0-only
3# 3#
4# Copyright (C) 2018 Netronome Systems, Inc. 4# Copyright (C) 2018-2019 Netronome Systems, Inc.
5 5
6# In case user attempts to run with Python 2. 6# In case user attempts to run with Python 2.
7from __future__ import print_function 7from __future__ import print_function
@@ -39,7 +39,7 @@ class Helper(object):
39 Break down helper function protocol into smaller chunks: return type, 39 Break down helper function protocol into smaller chunks: return type,
40 name, distincts arguments. 40 name, distincts arguments.
41 """ 41 """
42 arg_re = re.compile('((const )?(struct )?(\w+|...))( (\**)(\w+))?$') 42 arg_re = re.compile('((\w+ )*?(\w+|...))( (\**)(\w+))?$')
43 res = {} 43 res = {}
44 proto_re = re.compile('(.+) (\**)(\w+)\(((([^,]+)(, )?){1,5})\)$') 44 proto_re = re.compile('(.+) (\**)(\w+)\(((([^,]+)(, )?){1,5})\)$')
45 45
@@ -54,8 +54,8 @@ class Helper(object):
54 capture = arg_re.match(a) 54 capture = arg_re.match(a)
55 res['args'].append({ 55 res['args'].append({
56 'type' : capture.group(1), 56 'type' : capture.group(1),
57 'star' : capture.group(6), 57 'star' : capture.group(5),
58 'name' : capture.group(7) 58 'name' : capture.group(6)
59 }) 59 })
60 60
61 return res 61 return res
diff --git a/scripts/checkpatch.pl b/scripts/checkpatch.pl
index a09333fd7cef..bb28b178d929 100755
--- a/scripts/checkpatch.pl
+++ b/scripts/checkpatch.pl
@@ -2687,6 +2687,24 @@ sub process {
2687 } else { 2687 } else {
2688 $signatures{$sig_nospace} = 1; 2688 $signatures{$sig_nospace} = 1;
2689 } 2689 }
2690
2691# Check Co-developed-by: immediately followed by Signed-off-by: with same name and email
2692 if ($sign_off =~ /^co-developed-by:$/i) {
2693 if ($email eq $author) {
2694 WARN("BAD_SIGN_OFF",
2695 "Co-developed-by: should not be used to attribute nominal patch author '$author'\n" . "$here\n" . $rawline);
2696 }
2697 if (!defined $lines[$linenr]) {
2698 WARN("BAD_SIGN_OFF",
2699 "Co-developed-by: must be immediately followed by Signed-off-by:\n" . "$here\n" . $rawline);
2700 } elsif ($rawlines[$linenr] !~ /^\s*signed-off-by:\s*(.*)/i) {
2701 WARN("BAD_SIGN_OFF",
2702 "Co-developed-by: must be immediately followed by Signed-off-by:\n" . "$here\n" . $rawline . "\n" .$rawlines[$linenr]);
2703 } elsif ($1 ne $email) {
2704 WARN("BAD_SIGN_OFF",
2705 "Co-developed-by and Signed-off-by: name/email do not match \n" . "$here\n" . $rawline . "\n" .$rawlines[$linenr]);
2706 }
2707 }
2690 } 2708 }
2691 2709
2692# Check email subject for common tools that don't need to be mentioned 2710# Check email subject for common tools that don't need to be mentioned
diff --git a/scripts/documentation-file-ref-check b/scripts/documentation-file-ref-check
index ad9db6821824..63e9542656f1 100755
--- a/scripts/documentation-file-ref-check
+++ b/scripts/documentation-file-ref-check
@@ -30,6 +30,34 @@ print "Finding broken references. This may take a while... " if ($fix);
30 30
31my %broken_ref; 31my %broken_ref;
32 32
33my $doc_fix = 0;
34
35open IN, "git grep ':doc:\`' Documentation/|"
36 or die "Failed to run git grep";
37while (<IN>) {
38 next if (!m,^([^:]+):.*\:doc\:\`([^\`]+)\`,);
39
40 my $d = $1;
41 my $doc_ref = $2;
42
43 my $f = $doc_ref;
44
45 $d =~ s,(.*/).*,$1,;
46 $f =~ s,.*\<([^\>]+)\>,$1,;
47
48 $f ="$d$f.rst";
49
50 next if (grep -e, glob("$f"));
51
52 if ($fix && !$doc_fix) {
53 print STDERR "\nWARNING: Currently, can't fix broken :doc:`` fields\n";
54 }
55 $doc_fix++;
56
57 print STDERR "$f: :doc:`$doc_ref`\n";
58}
59close IN;
60
33open IN, "git grep 'Documentation/'|" 61open IN, "git grep 'Documentation/'|"
34 or die "Failed to run git grep"; 62 or die "Failed to run git grep";
35while (<IN>) { 63while (<IN>) {
@@ -38,6 +66,9 @@ while (<IN>) {
38 my $f = $1; 66 my $f = $1;
39 my $ln = $2; 67 my $ln = $2;
40 68
69 # On linux-next, discard the Next/ directory
70 next if ($f =~ m,^Next/,);
71
41 # Makefiles and scripts contain nasty expressions to parse docs 72 # Makefiles and scripts contain nasty expressions to parse docs
42 next if ($f =~ m/Makefile/ || $f =~ m/\.sh$/); 73 next if ($f =~ m/Makefile/ || $f =~ m/\.sh$/);
43 74
@@ -100,6 +131,7 @@ while (<IN>) {
100 } 131 }
101 } 132 }
102} 133}
134close IN;
103 135
104exit 0 if (!$fix); 136exit 0 if (!$fix);
105 137
diff --git a/scripts/gcc-plugins/Kconfig b/scripts/gcc-plugins/Kconfig
index 74271dba4f94..80220ed26a35 100644
--- a/scripts/gcc-plugins/Kconfig
+++ b/scripts/gcc-plugins/Kconfig
@@ -13,17 +13,19 @@ config HAVE_GCC_PLUGINS
13 An arch should select this symbol if it supports building with 13 An arch should select this symbol if it supports building with
14 GCC plugins. 14 GCC plugins.
15 15
16menuconfig GCC_PLUGINS 16config GCC_PLUGINS
17 bool "GCC plugins" 17 bool
18 depends on HAVE_GCC_PLUGINS 18 depends on HAVE_GCC_PLUGINS
19 depends on PLUGIN_HOSTCC != "" 19 depends on PLUGIN_HOSTCC != ""
20 default y
20 help 21 help
21 GCC plugins are loadable modules that provide extra features to the 22 GCC plugins are loadable modules that provide extra features to the
22 compiler. They are useful for runtime instrumentation and static analysis. 23 compiler. They are useful for runtime instrumentation and static analysis.
23 24
24 See Documentation/gcc-plugins.txt for details. 25 See Documentation/gcc-plugins.txt for details.
25 26
26if GCC_PLUGINS 27menu "GCC plugins"
28 depends on GCC_PLUGINS
27 29
28config GCC_PLUGIN_CYC_COMPLEXITY 30config GCC_PLUGIN_CYC_COMPLEXITY
29 bool "Compute the cyclomatic complexity of a function" if EXPERT 31 bool "Compute the cyclomatic complexity of a function" if EXPERT
@@ -66,71 +68,6 @@ config GCC_PLUGIN_LATENT_ENTROPY
66 * https://grsecurity.net/ 68 * https://grsecurity.net/
67 * https://pax.grsecurity.net/ 69 * https://pax.grsecurity.net/
68 70
69config GCC_PLUGIN_STRUCTLEAK
70 bool "Zero initialize stack variables"
71 help
72 While the kernel is built with warnings enabled for any missed
73 stack variable initializations, this warning is silenced for
74 anything passed by reference to another function, under the
75 occasionally misguided assumption that the function will do
76 the initialization. As this regularly leads to exploitable
77 flaws, this plugin is available to identify and zero-initialize
78 such variables, depending on the chosen level of coverage.
79
80 This plugin was originally ported from grsecurity/PaX. More
81 information at:
82 * https://grsecurity.net/
83 * https://pax.grsecurity.net/
84
85choice
86 prompt "Coverage"
87 depends on GCC_PLUGIN_STRUCTLEAK
88 default GCC_PLUGIN_STRUCTLEAK_BYREF_ALL
89 help
90 This chooses the level of coverage over classes of potentially
91 uninitialized variables. The selected class will be
92 zero-initialized before use.
93
94 config GCC_PLUGIN_STRUCTLEAK_USER
95 bool "structs marked for userspace"
96 help
97 Zero-initialize any structures on the stack containing
98 a __user attribute. This can prevent some classes of
99 uninitialized stack variable exploits and information
100 exposures, like CVE-2013-2141:
101 https://git.kernel.org/linus/b9e146d8eb3b9eca
102
103 config GCC_PLUGIN_STRUCTLEAK_BYREF
104 bool "structs passed by reference"
105 help
106 Zero-initialize any structures on the stack that may
107 be passed by reference and had not already been
108 explicitly initialized. This can prevent most classes
109 of uninitialized stack variable exploits and information
110 exposures, like CVE-2017-1000410:
111 https://git.kernel.org/linus/06e7e776ca4d3654
112
113 config GCC_PLUGIN_STRUCTLEAK_BYREF_ALL
114 bool "anything passed by reference"
115 help
116 Zero-initialize any stack variables that may be passed
117 by reference and had not already been explicitly
118 initialized. This is intended to eliminate all classes
119 of uninitialized stack variable exploits and information
120 exposures.
121
122endchoice
123
124config GCC_PLUGIN_STRUCTLEAK_VERBOSE
125 bool "Report forcefully initialized variables"
126 depends on GCC_PLUGIN_STRUCTLEAK
127 depends on !COMPILE_TEST # too noisy
128 help
129 This option will cause a warning to be printed each time the
130 structleak plugin finds a variable it thinks needs to be
131 initialized. Since not all existing initializers are detected
132 by the plugin, this can produce false positive warnings.
133
134config GCC_PLUGIN_RANDSTRUCT 71config GCC_PLUGIN_RANDSTRUCT
135 bool "Randomize layout of sensitive kernel structures" 72 bool "Randomize layout of sensitive kernel structures"
136 select MODVERSIONS if MODULES 73 select MODVERSIONS if MODULES
@@ -171,59 +108,8 @@ config GCC_PLUGIN_RANDSTRUCT_PERFORMANCE
171 in structures. This reduces the performance hit of RANDSTRUCT 108 in structures. This reduces the performance hit of RANDSTRUCT
172 at the cost of weakened randomization. 109 at the cost of weakened randomization.
173 110
174config GCC_PLUGIN_STACKLEAK
175 bool "Erase the kernel stack before returning from syscalls"
176 depends on GCC_PLUGINS
177 depends on HAVE_ARCH_STACKLEAK
178 help
179 This option makes the kernel erase the kernel stack before
180 returning from system calls. That reduces the information which
181 kernel stack leak bugs can reveal and blocks some uninitialized
182 stack variable attacks.
183
184 The tradeoff is the performance impact: on a single CPU system kernel
185 compilation sees a 1% slowdown, other systems and workloads may vary
186 and you are advised to test this feature on your expected workload
187 before deploying it.
188
189 This plugin was ported from grsecurity/PaX. More information at:
190 * https://grsecurity.net/
191 * https://pax.grsecurity.net/
192
193config STACKLEAK_TRACK_MIN_SIZE
194 int "Minimum stack frame size of functions tracked by STACKLEAK"
195 default 100
196 range 0 4096
197 depends on GCC_PLUGIN_STACKLEAK
198 help
199 The STACKLEAK gcc plugin instruments the kernel code for tracking
200 the lowest border of the kernel stack (and for some other purposes).
201 It inserts the stackleak_track_stack() call for the functions with
202 a stack frame size greater than or equal to this parameter.
203 If unsure, leave the default value 100.
204
205config STACKLEAK_METRICS
206 bool "Show STACKLEAK metrics in the /proc file system"
207 depends on GCC_PLUGIN_STACKLEAK
208 depends on PROC_FS
209 help
210 If this is set, STACKLEAK metrics for every task are available in
211 the /proc file system. In particular, /proc/<pid>/stack_depth
212 shows the maximum kernel stack consumption for the current and
213 previous syscalls. Although this information is not precise, it
214 can be useful for estimating the STACKLEAK performance impact for
215 your workloads.
216
217config STACKLEAK_RUNTIME_DISABLE
218 bool "Allow runtime disabling of kernel stack erasing"
219 depends on GCC_PLUGIN_STACKLEAK
220 help
221 This option provides 'stack_erasing' sysctl, which can be used in
222 runtime to control kernel stack erasing for kernels built with
223 CONFIG_GCC_PLUGIN_STACKLEAK.
224
225config GCC_PLUGIN_ARM_SSP_PER_TASK 111config GCC_PLUGIN_ARM_SSP_PER_TASK
226 bool 112 bool
227 depends on GCC_PLUGINS && ARM 113 depends on GCC_PLUGINS && ARM
228 114
229endif 115endmenu
diff --git a/scripts/gcc-plugins/arm_ssp_per_task_plugin.c b/scripts/gcc-plugins/arm_ssp_per_task_plugin.c
index 89c47f57d1ce..8c1af9bdcb1b 100644
--- a/scripts/gcc-plugins/arm_ssp_per_task_plugin.c
+++ b/scripts/gcc-plugins/arm_ssp_per_task_plugin.c
@@ -36,7 +36,7 @@ static unsigned int arm_pertask_ssp_rtl_execute(void)
36 mask = GEN_INT(sext_hwi(sp_mask, GET_MODE_PRECISION(Pmode))); 36 mask = GEN_INT(sext_hwi(sp_mask, GET_MODE_PRECISION(Pmode)));
37 masked_sp = gen_reg_rtx(Pmode); 37 masked_sp = gen_reg_rtx(Pmode);
38 38
39 emit_insn_before(gen_rtx_SET(masked_sp, 39 emit_insn_before(gen_rtx_set(masked_sp,
40 gen_rtx_AND(Pmode, 40 gen_rtx_AND(Pmode,
41 stack_pointer_rtx, 41 stack_pointer_rtx,
42 mask)), 42 mask)),
diff --git a/scripts/gdb/linux/Makefile b/scripts/gdb/linux/Makefile
index 3df395a9c2ce..9fd3d8ed731a 100644
--- a/scripts/gdb/linux/Makefile
+++ b/scripts/gdb/linux/Makefile
@@ -1,6 +1,6 @@
1# SPDX-License-Identifier: GPL-2.0 1# SPDX-License-Identifier: GPL-2.0
2 2
3ifneq ($(KBUILD_SRC),) 3ifneq ($(srctree),.)
4 4
5symlinks := $(patsubst $(srctree)/$(src)/%,%,$(wildcard $(srctree)/$(src)/*.py)) 5symlinks := $(patsubst $(srctree)/$(src)/%,%,$(wildcard $(srctree)/$(src)/*.py))
6 6
diff --git a/scripts/link-vmlinux.sh b/scripts/link-vmlinux.sh
index dc0e8c5a1402..a7124f895b24 100755
--- a/scripts/link-vmlinux.sh
+++ b/scripts/link-vmlinux.sh
@@ -35,7 +35,7 @@ set -e
35info() 35info()
36{ 36{
37 if [ "${quiet}" != "silent_" ]; then 37 if [ "${quiet}" != "silent_" ]; then
38 printf " %-7s %s\n" ${1} ${2} 38 printf " %-7s %s\n" "${1}" "${2}"
39 fi 39 fi
40} 40}
41 41
@@ -91,6 +91,25 @@ vmlinux_link()
91 fi 91 fi
92} 92}
93 93
94# generate .BTF typeinfo from DWARF debuginfo
95gen_btf()
96{
97 local pahole_ver;
98
99 if ! [ -x "$(command -v ${PAHOLE})" ]; then
100 info "BTF" "${1}: pahole (${PAHOLE}) is not available"
101 return 0
102 fi
103
104 pahole_ver=$(${PAHOLE} --version | sed -E 's/v([0-9]+)\.([0-9]+)/\1\2/')
105 if [ "${pahole_ver}" -lt "113" ]; then
106 info "BTF" "${1}: pahole version $(${PAHOLE} --version) is too old, need at least v1.13"
107 return 0
108 fi
109
110 info "BTF" ${1}
111 LLVM_OBJCOPY=${OBJCOPY} ${PAHOLE} -J ${1}
112}
94 113
95# Create ${2} .o file with all symbols from the ${1} object file 114# Create ${2} .o file with all symbols from the ${1} object file
96kallsyms() 115kallsyms()
@@ -193,6 +212,9 @@ modpost_link vmlinux.o
193# modpost vmlinux.o to check for section mismatches 212# modpost vmlinux.o to check for section mismatches
194${MAKE} -f "${srctree}/scripts/Makefile.modpost" vmlinux.o 213${MAKE} -f "${srctree}/scripts/Makefile.modpost" vmlinux.o
195 214
215info MODINFO modules.builtin.modinfo
216${OBJCOPY} -j .modinfo -O binary vmlinux.o modules.builtin.modinfo
217
196kallsymso="" 218kallsymso=""
197kallsyms_vmlinux="" 219kallsyms_vmlinux=""
198if [ -n "${CONFIG_KALLSYMS}" ]; then 220if [ -n "${CONFIG_KALLSYMS}" ]; then
@@ -248,6 +270,10 @@ fi
248info LD vmlinux 270info LD vmlinux
249vmlinux_link "${kallsymso}" vmlinux 271vmlinux_link "${kallsymso}" vmlinux
250 272
273if [ -n "${CONFIG_DEBUG_INFO_BTF}" ]; then
274 gen_btf vmlinux
275fi
276
251if [ -n "${CONFIG_BUILDTIME_EXTABLE_SORT}" ]; then 277if [ -n "${CONFIG_BUILDTIME_EXTABLE_SORT}" ]; then
252 info SORTEX vmlinux 278 info SORTEX vmlinux
253 sortextable vmlinux 279 sortextable vmlinux
diff --git a/scripts/mkmakefile b/scripts/mkmakefile
index 412f13fdff52..4d0faebb1719 100755
--- a/scripts/mkmakefile
+++ b/scripts/mkmakefile
@@ -7,33 +7,11 @@
7# Usage 7# Usage
8# $1 - Kernel src directory 8# $1 - Kernel src directory
9 9
10# Only overwrite automatically generated Makefiles
11# (so we do not overwrite kernel Makefile)
12if test -e Makefile && ! grep -q Automatically Makefile
13then
14 exit 0
15fi
16if [ "${quiet}" != "silent_" ]; then 10if [ "${quiet}" != "silent_" ]; then
17 echo " GEN Makefile" 11 echo " GEN Makefile"
18fi 12fi
19 13
20cat << EOF > Makefile 14cat << EOF > Makefile
21# Automatically generated by $0: don't edit 15# Automatically generated by $(realpath $0): don't edit
22 16include $(realpath $1/Makefile)
23ifeq ("\$(origin V)", "command line")
24VERBOSE := \$(V)
25endif
26ifneq (\$(VERBOSE),1)
27Q := @
28endif
29
30MAKEFLAGS += --no-print-directory
31
32.PHONY: __sub-make \$(MAKECMDGOALS)
33
34__sub-make:
35 \$(Q)\$(MAKE) -C $1 O=\$(CURDIR) \$(MAKECMDGOALS)
36
37\$(filter-out __sub-make, \$(MAKECMDGOALS)): __sub-make
38 @:
39EOF 17EOF
diff --git a/scripts/recordmcount.pl b/scripts/recordmcount.pl
index 68841d01162c..d24759214efd 100755
--- a/scripts/recordmcount.pl
+++ b/scripts/recordmcount.pl
@@ -397,6 +397,9 @@ if ($arch eq "x86_64") {
397} elsif ($arch eq "nds32") { 397} elsif ($arch eq "nds32") {
398 $mcount_regex = "^\\s*([0-9a-fA-F]+):\\s*R_NDS32_HI20_RELA\\s+_mcount\$"; 398 $mcount_regex = "^\\s*([0-9a-fA-F]+):\\s*R_NDS32_HI20_RELA\\s+_mcount\$";
399 $alignment = 2; 399 $alignment = 2;
400} elsif ($arch eq "csky") {
401 $mcount_regex = "^\\s*([0-9a-fA-F]+):\\s*R_CKCORE_PCREL_JSR_IMM26BY2\\s+_mcount\$";
402 $alignment = 2;
400} else { 403} else {
401 die "Arch $arch is not supported with CONFIG_FTRACE_MCOUNT_RECORD"; 404 die "Arch $arch is not supported with CONFIG_FTRACE_MCOUNT_RECORD";
402} 405}
@@ -493,7 +496,7 @@ sub update_funcs
493# 496#
494# Step 2: find the sections and mcount call sites 497# Step 2: find the sections and mcount call sites
495# 498#
496open(IN, "$objdump -hdr $inputfile|") || die "error running $objdump"; 499open(IN, "LANG=C $objdump -hdr $inputfile|") || die "error running $objdump";
497 500
498my $text; 501my $text;
499 502
diff --git a/scripts/selinux/install_policy.sh b/scripts/selinux/install_policy.sh
index 0b86c47baf7d..2dccf141241d 100755
--- a/scripts/selinux/install_policy.sh
+++ b/scripts/selinux/install_policy.sh
@@ -1,30 +1,61 @@
1#!/bin/sh 1#!/bin/sh
2# SPDX-License-Identifier: GPL-2.0 2# SPDX-License-Identifier: GPL-2.0
3set -e
3if [ `id -u` -ne 0 ]; then 4if [ `id -u` -ne 0 ]; then
4 echo "$0: must be root to install the selinux policy" 5 echo "$0: must be root to install the selinux policy"
5 exit 1 6 exit 1
6fi 7fi
8
7SF=`which setfiles` 9SF=`which setfiles`
8if [ $? -eq 1 ]; then 10if [ $? -eq 1 ]; then
9 if [ -f /sbin/setfiles ]; then 11 echo "Could not find setfiles"
10 SF="/usr/setfiles" 12 echo "Do you have policycoreutils installed?"
11 else 13 exit 1
12 echo "no selinux tools installed: setfiles"
13 exit 1
14 fi
15fi 14fi
16 15
17cd mdp
18
19CP=`which checkpolicy` 16CP=`which checkpolicy`
17if [ $? -eq 1 ]; then
18 echo "Could not find checkpolicy"
19 echo "Do you have checkpolicy installed?"
20 exit 1
21fi
20VERS=`$CP -V | awk '{print $1}'` 22VERS=`$CP -V | awk '{print $1}'`
21 23
22./mdp policy.conf file_contexts 24ENABLED=`which selinuxenabled`
23$CP -o policy.$VERS policy.conf 25if [ $? -eq 1 ]; then
26 echo "Could not find selinuxenabled"
27 echo "Do you have libselinux-utils installed?"
28 exit 1
29fi
30
31if selinuxenabled; then
32 echo "SELinux is already enabled"
33 echo "This prevents safely relabeling all files."
34 echo "Boot with selinux=0 on the kernel command-line or"
35 echo "SELINUX=disabled in /etc/selinux/config."
36 exit 1
37fi
38
39cd mdp
40./mdp -m policy.conf file_contexts
41$CP -U allow -M -o policy.$VERS policy.conf
24 42
25mkdir -p /etc/selinux/dummy/policy 43mkdir -p /etc/selinux/dummy/policy
26mkdir -p /etc/selinux/dummy/contexts/files 44mkdir -p /etc/selinux/dummy/contexts/files
27 45
46echo "__default__:user_u:s0" > /etc/selinux/dummy/seusers
47echo "base_r:base_t:s0" > /etc/selinux/dummy/contexts/failsafe_context
48echo "base_r:base_t:s0 base_r:base_t:s0" > /etc/selinux/dummy/default_contexts
49cat > /etc/selinux/dummy/contexts/x_contexts <<EOF
50client * user_u:base_r:base_t:s0
51property * user_u:object_r:base_t:s0
52extension * user_u:object_r:base_t:s0
53selection * user_u:object_r:base_t:s0
54event * user_u:object_r:base_t:s0
55EOF
56touch /etc/selinux/dummy/contexts/virtual_domain_context
57touch /etc/selinux/dummy/contexts/virtual_image_context
58
28cp file_contexts /etc/selinux/dummy/contexts/files 59cp file_contexts /etc/selinux/dummy/contexts/files
29cp dbus_contexts /etc/selinux/dummy/contexts 60cp dbus_contexts /etc/selinux/dummy/contexts
30cp policy.$VERS /etc/selinux/dummy/policy 61cp policy.$VERS /etc/selinux/dummy/policy
@@ -33,37 +64,22 @@ FC_FILE=/etc/selinux/dummy/contexts/files/file_contexts
33if [ ! -d /etc/selinux ]; then 64if [ ! -d /etc/selinux ]; then
34 mkdir -p /etc/selinux 65 mkdir -p /etc/selinux
35fi 66fi
36if [ ! -f /etc/selinux/config ]; then 67if [ -f /etc/selinux/config ]; then
37 cat > /etc/selinux/config << EOF 68 echo "/etc/selinux/config exists, moving to /etc/selinux/config.bak."
38SELINUX=enforcing 69 mv /etc/selinux/config /etc/selinux/config.bak
70fi
71echo "Creating new /etc/selinux/config for dummy policy."
72cat > /etc/selinux/config << EOF
73SELINUX=permissive
39SELINUXTYPE=dummy 74SELINUXTYPE=dummy
40EOF 75EOF
41else
42 TYPE=`cat /etc/selinux/config | grep "^SELINUXTYPE" | tail -1 | awk -F= '{ print $2 '}`
43 if [ "eq$TYPE" != "eqdummy" ]; then
44 selinuxenabled
45 if [ $? -eq 0 ]; then
46 echo "SELinux already enabled with a non-dummy policy."
47 echo "Exiting. Please install policy by hand if that"
48 echo "is what you REALLY want."
49 exit 1
50 fi
51 mv /etc/selinux/config /etc/selinux/config.mdpbak
52 grep -v "^SELINUXTYPE" /etc/selinux/config.mdpbak >> /etc/selinux/config
53 echo "SELINUXTYPE=dummy" >> /etc/selinux/config
54 fi
55fi
56 76
57cd /etc/selinux/dummy/contexts/files 77cd /etc/selinux/dummy/contexts/files
58$SF file_contexts / 78$SF -F file_contexts /
59 79
60mounts=`cat /proc/$$/mounts | egrep "ext2|ext3|xfs|jfs|ext4|ext4dev|gfs2" | awk '{ print $2 '}` 80mounts=`cat /proc/$$/mounts | \
61$SF file_contexts $mounts 81 egrep "ext[234]|jfs|xfs|reiserfs|jffs2|gfs2|btrfs|f2fs|ocfs2" | \
82 awk '{ print $2 '}`
83$SF -F file_contexts $mounts
62 84
63 85echo "-F" > /.autorelabel
64dodev=`cat /proc/$$/mounts | grep "/dev "`
65if [ "eq$dodev" != "eq" ]; then
66 mount --move /dev /mnt
67 $SF file_contexts /dev
68 mount --move /mnt /dev
69fi
diff --git a/scripts/selinux/mdp/Makefile b/scripts/selinux/mdp/Makefile
index e9c92db7e2a3..8a1269a9d0ba 100644
--- a/scripts/selinux/mdp/Makefile
+++ b/scripts/selinux/mdp/Makefile
@@ -2,7 +2,7 @@
2hostprogs-y := mdp 2hostprogs-y := mdp
3HOST_EXTRACFLAGS += \ 3HOST_EXTRACFLAGS += \
4 -I$(srctree)/include/uapi -I$(srctree)/include \ 4 -I$(srctree)/include/uapi -I$(srctree)/include \
5 -I$(srctree)/security/selinux/include 5 -I$(srctree)/security/selinux/include -I$(objtree)/include
6 6
7always := $(hostprogs-y) 7always := $(hostprogs-y)
8clean-files := policy.* file_contexts 8clean-files := policy.* file_contexts
diff --git a/scripts/selinux/mdp/mdp.c b/scripts/selinux/mdp/mdp.c
index 6d51b74bc679..18fd6143888b 100644
--- a/scripts/selinux/mdp/mdp.c
+++ b/scripts/selinux/mdp/mdp.c
@@ -32,6 +32,7 @@
32#include <stdlib.h> 32#include <stdlib.h>
33#include <unistd.h> 33#include <unistd.h>
34#include <string.h> 34#include <string.h>
35#include <linux/kconfig.h>
35 36
36static void usage(char *name) 37static void usage(char *name)
37{ 38{
@@ -94,10 +95,31 @@ int main(int argc, char *argv[])
94 } 95 }
95 fprintf(fout, "\n"); 96 fprintf(fout, "\n");
96 97
97 /* NOW PRINT OUT MLS STUFF */ 98 /* print out mls declarations and constraints */
98 if (mls) { 99 if (mls) {
99 printf("MLS not yet implemented\n"); 100 fprintf(fout, "sensitivity s0;\n");
100 exit(1); 101 fprintf(fout, "sensitivity s1;\n");
102 fprintf(fout, "dominance { s0 s1 }\n");
103 fprintf(fout, "category c0;\n");
104 fprintf(fout, "category c1;\n");
105 fprintf(fout, "level s0:c0.c1;\n");
106 fprintf(fout, "level s1:c0.c1;\n");
107#define SYSTEMLOW "s0"
108#define SYSTEMHIGH "s1:c0.c1"
109 for (i = 0; secclass_map[i].name; i++) {
110 struct security_class_mapping *map = &secclass_map[i];
111
112 fprintf(fout, "mlsconstrain %s {\n", map->name);
113 for (j = 0; map->perms[j]; j++)
114 fprintf(fout, "\t%s\n", map->perms[j]);
115 /*
116 * This requires all subjects and objects to be
117 * single-level (l2 eq h2), and that the subject
118 * level dominate the object level (h1 dom h2)
119 * in order to have any permissions to it.
120 */
121 fprintf(fout, "} (l2 eq h2 and h1 dom h2);\n\n");
122 }
101 } 123 }
102 124
103 /* types, roles, and allows */ 125 /* types, roles, and allows */
@@ -107,34 +129,127 @@ int main(int argc, char *argv[])
107 for (i = 0; secclass_map[i].name; i++) 129 for (i = 0; secclass_map[i].name; i++)
108 fprintf(fout, "allow base_t base_t:%s *;\n", 130 fprintf(fout, "allow base_t base_t:%s *;\n",
109 secclass_map[i].name); 131 secclass_map[i].name);
110 fprintf(fout, "user user_u roles { base_r };\n"); 132 fprintf(fout, "user user_u roles { base_r }");
111 fprintf(fout, "\n"); 133 if (mls)
134 fprintf(fout, " level %s range %s - %s", SYSTEMLOW,
135 SYSTEMLOW, SYSTEMHIGH);
136 fprintf(fout, ";\n");
137
138#define SUBJUSERROLETYPE "user_u:base_r:base_t"
139#define OBJUSERROLETYPE "user_u:object_r:base_t"
112 140
113 /* default sids */ 141 /* default sids */
114 for (i = 1; i < initial_sid_to_string_len; i++) 142 for (i = 1; i < initial_sid_to_string_len; i++)
115 fprintf(fout, "sid %s user_u:base_r:base_t\n", initial_sid_to_string[i]); 143 fprintf(fout, "sid %s " SUBJUSERROLETYPE "%s\n",
144 initial_sid_to_string[i], mls ? ":" SYSTEMLOW : "");
116 fprintf(fout, "\n"); 145 fprintf(fout, "\n");
117 146
118 fprintf(fout, "fs_use_xattr ext2 user_u:base_r:base_t;\n"); 147#define FS_USE(behavior, fstype) \
119 fprintf(fout, "fs_use_xattr ext3 user_u:base_r:base_t;\n"); 148 fprintf(fout, "fs_use_%s %s " OBJUSERROLETYPE "%s;\n", \
120 fprintf(fout, "fs_use_xattr ext4 user_u:base_r:base_t;\n"); 149 behavior, fstype, mls ? ":" SYSTEMLOW : "")
121 fprintf(fout, "fs_use_xattr jfs user_u:base_r:base_t;\n"); 150
122 fprintf(fout, "fs_use_xattr xfs user_u:base_r:base_t;\n"); 151 /*
123 fprintf(fout, "fs_use_xattr reiserfs user_u:base_r:base_t;\n"); 152 * Filesystems whose inode labels can be fetched via getxattr.
124 fprintf(fout, "fs_use_xattr jffs2 user_u:base_r:base_t;\n"); 153 */
125 fprintf(fout, "fs_use_xattr gfs2 user_u:base_r:base_t;\n"); 154#ifdef CONFIG_EXT2_FS_SECURITY
155 FS_USE("xattr", "ext2");
156#endif
157#ifdef CONFIG_EXT4_FS_SECURITY
158#ifdef CONFIG_EXT4_USE_FOR_EXT2
159 FS_USE("xattr", "ext2");
160#endif
161 FS_USE("xattr", "ext3");
162 FS_USE("xattr", "ext4");
163#endif
164#ifdef CONFIG_JFS_SECURITY
165 FS_USE("xattr", "jfs");
166#endif
167#ifdef CONFIG_REISERFS_FS_SECURITY
168 FS_USE("xattr", "reiserfs");
169#endif
170#ifdef CONFIG_JFFS2_FS_SECURITY
171 FS_USE("xattr", "jffs2");
172#endif
173#ifdef CONFIG_XFS_FS
174 FS_USE("xattr", "xfs");
175#endif
176#ifdef CONFIG_GFS2_FS
177 FS_USE("xattr", "gfs2");
178#endif
179#ifdef CONFIG_BTRFS_FS
180 FS_USE("xattr", "btrfs");
181#endif
182#ifdef CONFIG_F2FS_FS_SECURITY
183 FS_USE("xattr", "f2fs");
184#endif
185#ifdef CONFIG_OCFS2_FS
186 FS_USE("xattr", "ocsfs2");
187#endif
188#ifdef CONFIG_OVERLAY_FS
189 FS_USE("xattr", "overlay");
190#endif
191#ifdef CONFIG_SQUASHFS_XATTR
192 FS_USE("xattr", "squashfs");
193#endif
194
195 /*
196 * Filesystems whose inodes are labeled from allocating task.
197 */
198 FS_USE("task", "pipefs");
199 FS_USE("task", "sockfs");
126 200
127 fprintf(fout, "fs_use_task eventpollfs user_u:base_r:base_t;\n"); 201 /*
128 fprintf(fout, "fs_use_task pipefs user_u:base_r:base_t;\n"); 202 * Filesystems whose inode labels are computed from both
129 fprintf(fout, "fs_use_task sockfs user_u:base_r:base_t;\n"); 203 * the allocating task and the superblock label.
204 */
205#ifdef CONFIG_UNIX98_PTYS
206 FS_USE("trans", "devpts");
207#endif
208#ifdef CONFIG_HUGETLBFS
209 FS_USE("trans", "hugetlbfs");
210#endif
211#ifdef CONFIG_TMPFS
212 FS_USE("trans", "tmpfs");
213#endif
214#ifdef CONFIG_DEVTMPFS
215 FS_USE("trans", "devtmpfs");
216#endif
217#ifdef CONFIG_POSIX_MQUEUE
218 FS_USE("trans", "mqueue");
219#endif
130 220
131 fprintf(fout, "fs_use_trans mqueue user_u:base_r:base_t;\n"); 221#define GENFSCON(fstype, prefix) \
132 fprintf(fout, "fs_use_trans devpts user_u:base_r:base_t;\n"); 222 fprintf(fout, "genfscon %s %s " OBJUSERROLETYPE "%s\n", \
133 fprintf(fout, "fs_use_trans hugetlbfs user_u:base_r:base_t;\n"); 223 fstype, prefix, mls ? ":" SYSTEMLOW : "")
134 fprintf(fout, "fs_use_trans tmpfs user_u:base_r:base_t;\n");
135 fprintf(fout, "fs_use_trans shm user_u:base_r:base_t;\n");
136 224
137 fprintf(fout, "genfscon proc / user_u:base_r:base_t\n"); 225 /*
226 * Filesystems whose inodes are labeled from path prefix match
227 * relative to the filesystem root. Depending on the filesystem,
228 * only a single label for all inodes may be supported. Here
229 * we list the filesystem types for which per-file labeling is
230 * supported using genfscon; any other filesystem type can also
231 * be added by only with a single entry for all of its inodes.
232 */
233#ifdef CONFIG_PROC_FS
234 GENFSCON("proc", "/");
235#endif
236#ifdef CONFIG_SECURITY_SELINUX
237 GENFSCON("selinuxfs", "/");
238#endif
239#ifdef CONFIG_SYSFS
240 GENFSCON("sysfs", "/");
241#endif
242#ifdef CONFIG_DEBUG_FS
243 GENFSCON("debugfs", "/");
244#endif
245#ifdef CONFIG_TRACING
246 GENFSCON("tracefs", "/");
247#endif
248#ifdef CONFIG_PSTORE
249 GENFSCON("pstore", "/");
250#endif
251 GENFSCON("cgroup", "/");
252 GENFSCON("cgroup2", "/");
138 253
139 fclose(fout); 254 fclose(fout);
140 255
@@ -143,8 +258,8 @@ int main(int argc, char *argv[])
143 printf("Wrote policy, but cannot open %s for writing\n", ctxout); 258 printf("Wrote policy, but cannot open %s for writing\n", ctxout);
144 usage(argv[0]); 259 usage(argv[0]);
145 } 260 }
146 fprintf(fout, "/ user_u:base_r:base_t\n"); 261 fprintf(fout, "/ " OBJUSERROLETYPE "%s\n", mls ? ":" SYSTEMLOW : "");
147 fprintf(fout, "/.* user_u:base_r:base_t\n"); 262 fprintf(fout, "/.* " OBJUSERROLETYPE "%s\n", mls ? ":" SYSTEMLOW : "");
148 fclose(fout); 263 fclose(fout);
149 264
150 return 0; 265 return 0;
diff --git a/scripts/sphinx-pre-install b/scripts/sphinx-pre-install
index 067459760a7b..f6a5c0bae31e 100755
--- a/scripts/sphinx-pre-install
+++ b/scripts/sphinx-pre-install
@@ -532,6 +532,7 @@ sub check_needs()
532 check_program("dot", 1); 532 check_program("dot", 1);
533 check_program("convert", 1); 533 check_program("convert", 1);
534 check_program("rsvg-convert", 1) if ($pdf); 534 check_program("rsvg-convert", 1) if ($pdf);
535 check_program("latexmk", 1) if ($pdf);
535 536
536 check_distros(); 537 check_distros();
537 538
diff --git a/scripts/tags.sh b/scripts/tags.sh
index f470d9919ed7..70e14c67bde7 100755
--- a/scripts/tags.sh
+++ b/scripts/tags.sh
@@ -19,7 +19,7 @@ ignore="$ignore ( -name *.mod.c ) -prune -o"
19# Do not use full path if we do not use O=.. builds 19# Do not use full path if we do not use O=.. builds
20# Use make O=. {tags|cscope} 20# Use make O=. {tags|cscope}
21# to force full paths for a non-O= build 21# to force full paths for a non-O= build
22if [ "${KBUILD_SRC}" = "" ]; then 22if [ "${srctree}" = "." -o -z "${srctree}" ]; then
23 tree= 23 tree=
24else 24else
25 tree=${srctree}/ 25 tree=${srctree}/
generated by cgit v1.2.2 (git 2.25.0) at 2025-12-30 14:37:53 -0500