Changed '<filename>.o: changed function: <function>' to
'<path>/<filename>.o: changed function: <function>'
This enhances log clarity by providing the full path to the object file.
Signed-off-by: George Guo <guodongtai@kylinos.cn>
Typically, symbols within the same object file can be referenced
directly for better performance. However, when the patched code stores a
function pointer (R_390_GOTENT and rela symbol type is STT_FUNC), using
a dynrela is a safer approach. This ensures that if the function is used
as a asynchronous callback, the kernel does not attempt to execute an
invalid pointer after the module is unloaded. Instead, with a dynrela,
the kernel will invoke the original function, preventing potential
crashes.
Test program: Test if the original function ptr address is printed
during patch load / unload.
0f400db024
Patched code (function ptr rela):
void *patchme(void) { printk(KERN_NOTICE "patched\n"); return patchme; }
0: c0 04 00 00 00 00 jgnop 0 <patchme>
6: eb ef f0 88 00 24 stmg %r14,%r15,136(%r15)
c: c4 28 00 00 00 00 lgrl %r2,c <patchme+0xc>
e: R_390_GOTENT .LC0+0x2
12: b9 04 00 ef lgr %r14,%r15
16: e3 f0 ff e8 ff 71 lay %r15,-24(%r15)
1c: e3 e0 f0 98 00 24 stg %r14,152(%r15)
22: c0 e5 00 00 00 00 brasl %r14,22 <patchme+0x22>
24: R_390_PLT32DBL _printk+0x2
28: c4 28 00 00 00 00 lgrl %r2,28 <patchme+0x28>
2a: R_390_GOTENT patchme+0x2 <- func ptr
2e: eb ef f0 a0 00 04 lmg %r14,%r15,160(%r15)
34: c0 f4 00 00 00 00 jg 34 <patchme+0x34>
36: R_390_PC32DBL __s390_indirect_jump_r14+0x2
3a: 07 07 nopr %r7
3c: 07 07 nopr %r7
3e: 07 07 nopr %r7
Reference:
1. https://github.com/dynup/kpatch/issues/1437
2. https://github.com/dynup/kpatch/pull/755
Signed-off-by: Sumanth Korikkar <sumanthk@linux.ibm.com>
When building a livepatch, we assume symbols from "readelf -s" is the
same as the order observed in kallsyms. We calculate sympos of a symbol
based on this order (readelf -s). However, with gcc-14, "readelf -s"
may present the symbols in a different order. For example:
With gcc 13:
32951: ffff8000802edf20 172 FUNC LOCAL DEFAULT 2 zero_user_segments.constprop.0
33497: ffff8000802fb798 236 FUNC LOCAL DEFAULT 2 zero_user_segments.constprop.0
47034: ffff80008044b250 172 FUNC LOCAL DEFAULT 2 zero_user_segments.constprop.0
51466: ffff8000804be260 236 FUNC LOCAL DEFAULT 2 zero_user_segments.constprop.0
51483: ffff8000804bf6a8 172 FUNC LOCAL DEFAULT 2 zero_user_segments.constprop.0
52287: ffff8000804cb098 172 FUNC LOCAL DEFAULT 2 zero_user_segments.constprop.0
54066: ffff800080518e38 172 FUNC LOCAL DEFAULT 2 zero_user_segments.constprop.0
58217: ffff800080575bb0 172 FUNC LOCAL DEFAULT 2 zero_user_segments.constprop.0
72912: ffff8000806c5dc0 172 FUNC LOCAL DEFAULT 2 zero_user_segments.constprop.0
73719: ffff8000806eccd0 172 FUNC LOCAL DEFAULT 2 zero_user_segments.constprop.0
With gcc 14:
9557: ffff800080312f28 236 FUNC LOCAL DEFAULT 2 zero_user_segments.constprop.0
16599: ffff8000806eb060 172 FUNC LOCAL DEFAULT 2 zero_user_segments.constprop.0
17305: ffff800080711d30 172 FUNC LOCAL DEFAULT 2 zero_user_segments.constprop.0
63960: ffff800080305540 172 FUNC LOCAL DEFAULT 2 zero_user_segments.constprop.0
74577: ffff800080466030 172 FUNC LOCAL DEFAULT 2 zero_user_segments.constprop.0
78568: ffff8000804dc3e0 172 FUNC LOCAL DEFAULT 2 zero_user_segments.constprop.0
79372: ffff8000804e81c0 172 FUNC LOCAL DEFAULT 2 zero_user_segments.constprop.0
81016: ffff800080537380 172 FUNC LOCAL DEFAULT 2 zero_user_segments.constprop.0
84685: ffff800080595428 172 FUNC LOCAL DEFAULT 2 zero_user_segments.constprop.0
Fix this by calculating sympos in another for_each_obj_symbol loop.
Signed-off-by: Song Liu <song@kernel.org>
Add function of 'kpatch list' to adjust kernel new attribute 'stack_order' of
livepatch of kernel v6.14 or later.
Now, using 'kpatch list' can output the enabling function
in the system and the relationship from the enabling function to its
object and its related module.
This feature only support the kernel with 'stack_order' attribute.
Suggested-by: Joe Lawrence <joe.lawrence@redhat.com>
Signed-off-by: Wardenjohn <zhangwarden@gmail.com>
Updates of interest:
v0.9.10:
- Support for Amazon Linux, Anolis OS, and OpenCloudOS distros
- Fix cleanup when kpatch is installed in read-only location
- Added RHEL-8.9, 9.3, 8.10, 9.4, and 9.5 integration tests
- Added AL2023 integration tests
- Support for __patchable_function_entries sections
Signed-off-by: Joe Lawrence <joe.lawrence@redhat.com>
Starting from linux commit 13b25489b6f8 ("kbuild: change working
directory to external module directory with M="), the kpatch-build
fails:
make -C /root/linux M=/root/.kpatch/tmp/patch CFLAGS_MODULE=''
make[1]: Entering directory '/root/linux'
make[2]: Entering directory '/root/.kpatch/tmp/patch'
LDS kpatch.lds
make -C /root/linux M=/root/.kpatch/tmp/patch CFLAGS_MODULE='' patch-hook.o
***
*** The external module source tree is not clean.
*** Please run 'make -C /root/linux M=/root/linux clean'
***
The easiest and quickest way to fix the build is to remove the
$(KPATCH_MAKE) patch-hook.o in Makefile. Unfortunately this would mean
make `patch-hook.o` cannot be performed directly. However the Makefile
still lists patch-hook.o's source dependencies, so if any are updated,
the kpatch module would be rebuilt anyway.
Thanks for Sumanth Korikkar for reporting, debugging, and suggesting
this workaround.
Closes: #1430 ("kpatch-build fails: unable to locate patch-hook.o since linux commit 13b25489b6f8")
Reported-by: Sumanth Korikkar <sumanthk@linux.ibm.com>
Signed-off-by: Joe Lawrence <joe.lawrence@redhat.com>
When CONFIG_COMPAT is disabled (No 31 bit emulation support), macro
__S390_SYS_STUBx() is nop.
(See arch/s390/include/asm/syscall_wrapper.h).
Also, __SC_COMPAT_CAST definition is not available, which leads to build
error.
Hence, __KPATCH_S390_SYS_STUBx() inherited from __S390_SYS_STUBx() macro,
should point also point to nop when CONFIG_COMPAT is disabled.
Signed-off-by: Sumanth Korikkar <sumanthk@linux.ibm.com>
In commit [1], kpatch added support for function padding,
and CONFIG_CFI_CLANG, which hardcoded a value of 16 for
the prefix size.
In some cases, the padding around __cfi prefixed functions can
vary. For example, in Photon OS 5.0, the __cfi prefix
size is modified in a patch for the gcc RAP plugin [2].
Since we have read the prefix size anyways, we can use it
instead of hardcoding.
Ref:
1. 3e54c63b17
2. https://github.com/vmware/photon/blob/5.0/SPECS/linux/secure/gcc-rap-plugin-with-kcfi.patch
Signed-off-by: Brennan Lamoreaux <brennan.lamoreaux@broadcom.com>
RHEL-9.6 backported the upstream v6.3 s390x syscall updates, so add a
distro-specific kernel version check around the correct definitions.
Signed-off-by: Joe Lawrence <joe.lawrence@redhat.com>
The __mcount_loc section contains the addresses of patchable ftrace
sites which is used by the ftrace infrastructure in the kernel to create
a list of tracable functions and to know where to patch to enable
tracing of them. On some kernel configurations, section is called
__patchable_function_entries and is generated by the compiler. Either of
__mcount_loc or __patchable_function_entries is recognised by the kernel
but for these configurations, use __patchable_function_entries as it is
what is expected.
The x86_64 arch is special (of course). Unlike other arches (ppc64le
and aarch64) a x86_64 kernel built with -fpatchable-function-entry will
generate nops AND create rela__patchable_function_entries for functions even
marked as notrace. For this arch, always create __mount_loc sections and
rely on __fentry__ relocations to indicate ftrace call sites.
Note: this patch is a refactoring of original code by Pete Swain
<swine@google.com> for aarch64. At the same time, this version squashes
several follow up commits from him and zimao <zimao@microsoft.com>. The
intent is minimize the eventual changeset for aarch64 support now that
other arches are making use of __patchable_function_entries sections.
Signed-off-by: Joe Lawrence <joe.lawrence@redhat.com>
Add -std=gnu11 to CFLAGS for kpatch-build tooling. This aligns with the
kernel build and avoids confusion when older tooling may default to
earlier versions.
Closes: #1416 ("C99 code vs. gcc defaults?")
Signed-off-by: Joe Lawrence <joe.lawrence@redhat.com>
Fix the following:
In kpatch/kpatch line 358:
break
^-- SC2317 (info): Command appears to be unreachable. Check usage (or ignore if invoked indirectly).
In kpatch-build/kpatch-build line 1424:
"$TOOLSDIR"/create-diff-object $CDO_FLAGS "orig/$i" "patched/$i" "$KOBJFILE_NAME" \
^--------^ SC2086 (info): Double quote to prevent globbing and word splitting.
In kpatch-build/kpatch-build line 1494:
MAKEVARS[$idx]=${MAKEVARS[$idx]/${KPATCH_CC_PREFIX}/}
^--^ SC2004 (style): $/${} is unnecessary on arithmetic variables.
In kpatch-build/kpatch-build line 1510:
"$TOOLSDIR"/create-klp-module $extra_flags "$TEMPDIR/patch/tmp.ko" "$TEMPDIR/patch/$MODNAME.ko" 2>&1 | logger 1
^----------^ SC2086 (info): Double quote to prevent globbing and word splitting.
In test/integration/lib.sh line 119:
tdnf install -y linux-$flavor-debuginfo
^-----^ SC2086 (info): Double quote to prevent globbing and word splitting.
Signed-off-by: Joe Lawrence <joe.lawrence@redhat.com>
squash
Man pages for kpatch are created via gzip which includes timestamp of original
file by default. This means the compressed file will change depending on the
time at which the repository was cloned / updated, leading to non-deterministic
builds. Pass option to disable this.
Signed-off-by: Oleksandr Hnatiuk <ohnatiuk@cisco.com>
On NixOS files are installed with mode 444 (read-only). This causes
directories in $TEMPDIR to be read-only as well, because they are
created by:
cp -LR "$DATADIR/patch" "$TEMPDIR" || die
which preserves the mode of the directory. We could do
--no-preserve=mode, but this will make people with non-coreutils cp
unhappy. Instead just chmod the files after copying.
If this patch is not applied, cleanup complains like this:
rm: cannot remove '/home/julian/.kpatch/tmp/patch/kpatch.h': Permission denied
rm: cannot remove '/home/julian/.kpatch/tmp/patch/Makefile': Permission denied
rm: cannot remove '/home/julian/.kpatch/tmp/patch/kpatch-macros.h': Permission denied
...
Signed-off-by: Julian Stecklina <julian.stecklina@cyberus-technology.de>
-mno-pic-data-is-text-relative compiler flag expects -fPIC/-fPIE flag
along with it. Since kernel commit 778666df60f0 ("s390: compile
relocatable kernel without -fPIE"), the -fPIC/-fPIE flag is missing when
creating kpatch module and this can lead to the following error:
cc1: error: ‘-mno-pic-data-is-text-relative’ cannot be used without
‘-fpic’/‘-fPIC’.
Previously kpatch-build didnt show up this issue, as the previous kernel
was built with -fPIE.
However, kpatch build could fail with kernel commit 778666df60f0 ("s390:
compile relocatable kernel without -fPIE"), where -fPIE is not included.
Hence, include it in kpatch-build for all kernels < 6.10.0
Note:
Latest s390 kernel is built with -fPIC flag.
i.e. kernel commit 00cda11d3b2e ("s390: Compile kernel with -fPIC and
link with -no-pie"). Hence, there is no need to explicitly add it again
in kpatch-build.
Signed-off-by: Sumanth Korikkar <sumanthk@linux.ibm.com>
When invoking kpatch-build through integration testing, like:
$ make PATCH_DIR="linux-6.9.0" \
KPATCH_BUILD_OPTS="--sourcedir /root/linux" \
integration-slow
results in an error as kpatch-build's `make kernelversion` adds
directory information to its output:
make[2]: Entering directory '/root/linux'
6.9.0
make[2]: Leaving directory '/root/linux'
This screws up kpatch-build's assignment of the make output to
LOCALVERSION, which was expecting only "6.9.0".
Add --no-print-directory to the make invocation to avoid the undesired
entering / leaving directory info.
Fixes: 629b5acf3d ("kpatch-build: Fix setlocalversion issue with 6.3 kernel")
Signed-off-by: Joe Lawrence <joe.lawrence@redhat.com>
Commit 629b5acf3d ("kpatch-build: Fix setlocalversion issue with 6.3
kernel") fixed VERMAGIC_STRING between kpatch original/patched kernel
builds by creating a temporary scripts/setlocalversion script. This was
accomplished by saving the output from `make kernelversion` into a
KERNELVERSION environment variable and running the (original)
scripts/setlocalversion to gather a "vX.Y" + "<src version>" pair of
strings.
Unfortunately pre-v6.3 scripts/setlocalversion does not use the
KERNELVERSION environment variable, so the same efforts results in an
unusable "<NULL>" + "<src version>" version string pair.
Restore the original `scripts/setlocalversion --save-scmversion`
invocation for source trees that (still) support the --save-scmversion
option.
Fixes: 629b5acf3d ("kpatch-build: Fix setlocalversion issue with 6.3 kernel")
Signed-off-by: Joe Lawrence <joe.lawrence@redhat.com>
Commit 69e71f8dcc ("kpatch-build: cleanup kernel file backup/restore")
consolidated a bunch of kernel-tree copy and restoring. As part of that
effort, when kpatch-build is invoked with a -s|--sourcedir USERSRCDIR
value the vmlinux file is now saved to "$TEMPDIR/kernel-backup/" and not
simply "$TEMPDIR/". This results in kpatch-build confusion like:
readelf: /home/jolawren/.kpatch/tmp/vmlinux: Error: No such file
Update the VMLINUX reassignment in this case to point to the new path.
Fixes: 69e71f8dcc ("kpatch-build: cleanup kernel file backup/restore")
Signed-off-by: Joe Lawrence <joe.lawrence@redhat.com>
