Updates of interest:
v0.9.10:
- Support for Amazon Linux, Anolis OS, and OpenCloudOS distros
- Fix cleanup when kpatch is installed in read-only location
- Added RHEL-8.9, 9.3, 8.10, 9.4, and 9.5 integration tests
- Added AL2023 integration tests
- Support for __patchable_function_entries sections
Signed-off-by: Joe Lawrence <joe.lawrence@redhat.com>
Starting from linux commit 13b25489b6f8 ("kbuild: change working
directory to external module directory with M="), the kpatch-build
fails:
make -C /root/linux M=/root/.kpatch/tmp/patch CFLAGS_MODULE=''
make[1]: Entering directory '/root/linux'
make[2]: Entering directory '/root/.kpatch/tmp/patch'
LDS kpatch.lds
make -C /root/linux M=/root/.kpatch/tmp/patch CFLAGS_MODULE='' patch-hook.o
***
*** The external module source tree is not clean.
*** Please run 'make -C /root/linux M=/root/linux clean'
***
The easiest and quickest way to fix the build is to remove the
$(KPATCH_MAKE) patch-hook.o in Makefile. Unfortunately this would mean
make `patch-hook.o` cannot be performed directly. However the Makefile
still lists patch-hook.o's source dependencies, so if any are updated,
the kpatch module would be rebuilt anyway.
Thanks for Sumanth Korikkar for reporting, debugging, and suggesting
this workaround.
Closes: #1430 ("kpatch-build fails: unable to locate patch-hook.o since linux commit 13b25489b6f8")
Reported-by: Sumanth Korikkar <sumanthk@linux.ibm.com>
Signed-off-by: Joe Lawrence <joe.lawrence@redhat.com>
When CONFIG_COMPAT is disabled (No 31 bit emulation support), macro
__S390_SYS_STUBx() is nop.
(See arch/s390/include/asm/syscall_wrapper.h).
Also, __SC_COMPAT_CAST definition is not available, which leads to build
error.
Hence, __KPATCH_S390_SYS_STUBx() inherited from __S390_SYS_STUBx() macro,
should point also point to nop when CONFIG_COMPAT is disabled.
Signed-off-by: Sumanth Korikkar <sumanthk@linux.ibm.com>
In commit [1], kpatch added support for function padding,
and CONFIG_CFI_CLANG, which hardcoded a value of 16 for
the prefix size.
In some cases, the padding around __cfi prefixed functions can
vary. For example, in Photon OS 5.0, the __cfi prefix
size is modified in a patch for the gcc RAP plugin [2].
Since we have read the prefix size anyways, we can use it
instead of hardcoding.
Ref:
1. 3e54c63b17
2. https://github.com/vmware/photon/blob/5.0/SPECS/linux/secure/gcc-rap-plugin-with-kcfi.patch
Signed-off-by: Brennan Lamoreaux <brennan.lamoreaux@broadcom.com>
RHEL-9.6 backported the upstream v6.3 s390x syscall updates, so add a
distro-specific kernel version check around the correct definitions.
Signed-off-by: Joe Lawrence <joe.lawrence@redhat.com>
The __mcount_loc section contains the addresses of patchable ftrace
sites which is used by the ftrace infrastructure in the kernel to create
a list of tracable functions and to know where to patch to enable
tracing of them. On some kernel configurations, section is called
__patchable_function_entries and is generated by the compiler. Either of
__mcount_loc or __patchable_function_entries is recognised by the kernel
but for these configurations, use __patchable_function_entries as it is
what is expected.
The x86_64 arch is special (of course). Unlike other arches (ppc64le
and aarch64) a x86_64 kernel built with -fpatchable-function-entry will
generate nops AND create rela__patchable_function_entries for functions even
marked as notrace. For this arch, always create __mount_loc sections and
rely on __fentry__ relocations to indicate ftrace call sites.
Note: this patch is a refactoring of original code by Pete Swain
<swine@google.com> for aarch64. At the same time, this version squashes
several follow up commits from him and zimao <zimao@microsoft.com>. The
intent is minimize the eventual changeset for aarch64 support now that
other arches are making use of __patchable_function_entries sections.
Signed-off-by: Joe Lawrence <joe.lawrence@redhat.com>
Add -std=gnu11 to CFLAGS for kpatch-build tooling. This aligns with the
kernel build and avoids confusion when older tooling may default to
earlier versions.
Closes: #1416 ("C99 code vs. gcc defaults?")
Signed-off-by: Joe Lawrence <joe.lawrence@redhat.com>
Fix the following:
In kpatch/kpatch line 358:
break
^-- SC2317 (info): Command appears to be unreachable. Check usage (or ignore if invoked indirectly).
In kpatch-build/kpatch-build line 1424:
"$TOOLSDIR"/create-diff-object $CDO_FLAGS "orig/$i" "patched/$i" "$KOBJFILE_NAME" \
^--------^ SC2086 (info): Double quote to prevent globbing and word splitting.
In kpatch-build/kpatch-build line 1494:
MAKEVARS[$idx]=${MAKEVARS[$idx]/${KPATCH_CC_PREFIX}/}
^--^ SC2004 (style): $/${} is unnecessary on arithmetic variables.
In kpatch-build/kpatch-build line 1510:
"$TOOLSDIR"/create-klp-module $extra_flags "$TEMPDIR/patch/tmp.ko" "$TEMPDIR/patch/$MODNAME.ko" 2>&1 | logger 1
^----------^ SC2086 (info): Double quote to prevent globbing and word splitting.
In test/integration/lib.sh line 119:
tdnf install -y linux-$flavor-debuginfo
^-----^ SC2086 (info): Double quote to prevent globbing and word splitting.
Signed-off-by: Joe Lawrence <joe.lawrence@redhat.com>
squash
Man pages for kpatch are created via gzip which includes timestamp of original
file by default. This means the compressed file will change depending on the
time at which the repository was cloned / updated, leading to non-deterministic
builds. Pass option to disable this.
Signed-off-by: Oleksandr Hnatiuk <ohnatiuk@cisco.com>
On NixOS files are installed with mode 444 (read-only). This causes
directories in $TEMPDIR to be read-only as well, because they are
created by:
cp -LR "$DATADIR/patch" "$TEMPDIR" || die
which preserves the mode of the directory. We could do
--no-preserve=mode, but this will make people with non-coreutils cp
unhappy. Instead just chmod the files after copying.
If this patch is not applied, cleanup complains like this:
rm: cannot remove '/home/julian/.kpatch/tmp/patch/kpatch.h': Permission denied
rm: cannot remove '/home/julian/.kpatch/tmp/patch/Makefile': Permission denied
rm: cannot remove '/home/julian/.kpatch/tmp/patch/kpatch-macros.h': Permission denied
...
Signed-off-by: Julian Stecklina <julian.stecklina@cyberus-technology.de>
-mno-pic-data-is-text-relative compiler flag expects -fPIC/-fPIE flag
along with it. Since kernel commit 778666df60f0 ("s390: compile
relocatable kernel without -fPIE"), the -fPIC/-fPIE flag is missing when
creating kpatch module and this can lead to the following error:
cc1: error: ‘-mno-pic-data-is-text-relative’ cannot be used without
‘-fpic’/‘-fPIC’.
Previously kpatch-build didnt show up this issue, as the previous kernel
was built with -fPIE.
However, kpatch build could fail with kernel commit 778666df60f0 ("s390:
compile relocatable kernel without -fPIE"), where -fPIE is not included.
Hence, include it in kpatch-build for all kernels < 6.10.0
Note:
Latest s390 kernel is built with -fPIC flag.
i.e. kernel commit 00cda11d3b2e ("s390: Compile kernel with -fPIC and
link with -no-pie"). Hence, there is no need to explicitly add it again
in kpatch-build.
Signed-off-by: Sumanth Korikkar <sumanthk@linux.ibm.com>
When invoking kpatch-build through integration testing, like:
$ make PATCH_DIR="linux-6.9.0" \
KPATCH_BUILD_OPTS="--sourcedir /root/linux" \
integration-slow
results in an error as kpatch-build's `make kernelversion` adds
directory information to its output:
make[2]: Entering directory '/root/linux'
6.9.0
make[2]: Leaving directory '/root/linux'
This screws up kpatch-build's assignment of the make output to
LOCALVERSION, which was expecting only "6.9.0".
Add --no-print-directory to the make invocation to avoid the undesired
entering / leaving directory info.
Fixes: 629b5acf3d ("kpatch-build: Fix setlocalversion issue with 6.3 kernel")
Signed-off-by: Joe Lawrence <joe.lawrence@redhat.com>
Commit 629b5acf3d ("kpatch-build: Fix setlocalversion issue with 6.3
kernel") fixed VERMAGIC_STRING between kpatch original/patched kernel
builds by creating a temporary scripts/setlocalversion script. This was
accomplished by saving the output from `make kernelversion` into a
KERNELVERSION environment variable and running the (original)
scripts/setlocalversion to gather a "vX.Y" + "<src version>" pair of
strings.
Unfortunately pre-v6.3 scripts/setlocalversion does not use the
KERNELVERSION environment variable, so the same efforts results in an
unusable "<NULL>" + "<src version>" version string pair.
Restore the original `scripts/setlocalversion --save-scmversion`
invocation for source trees that (still) support the --save-scmversion
option.
Fixes: 629b5acf3d ("kpatch-build: Fix setlocalversion issue with 6.3 kernel")
Signed-off-by: Joe Lawrence <joe.lawrence@redhat.com>
Commit 69e71f8dcc ("kpatch-build: cleanup kernel file backup/restore")
consolidated a bunch of kernel-tree copy and restoring. As part of that
effort, when kpatch-build is invoked with a -s|--sourcedir USERSRCDIR
value the vmlinux file is now saved to "$TEMPDIR/kernel-backup/" and not
simply "$TEMPDIR/". This results in kpatch-build confusion like:
readelf: /home/jolawren/.kpatch/tmp/vmlinux: Error: No such file
Update the VMLINUX reassignment in this case to point to the new path.
Fixes: 69e71f8dcc ("kpatch-build: cleanup kernel file backup/restore")
Signed-off-by: Joe Lawrence <joe.lawrence@redhat.com>
When kpatch-build is invoked with a -s|--sourcedir USERSRCDIR value,
kpatch-build doesn't source the /etc/os-release file as it can't assume
that the user-specified kernel source config matches any particular
distribution. Subsequent is_supported_{rpm,deb}_distro() function calls
will result in ugly syntax errors like:
kpatch-build: line 697: SUPPORTED_RPM_DISTROS: bad array subscript
kpatch-build: line 692: SUPPORTED_DEB_DISTROS: bad array subscript
Enhance the is_supported_{rpm,deb}_distro() functions to check that a
non-NULL distribution string argument exists before indexing the
SUPPORTED_{RPM,DEB}_DISTROS associative arrays.
Signed-off-by: Joe Lawrence <joe.lawrence@redhat.com>
Make kpatch-build aware about the ID of Amazon Linux distributions. No
other special changes are needed.
Signed-off-by: Puranjay Mohan <pjy@amazon.com>
Temporarily editing kernel tree sources has become a recurring
requirement in kpatch-build. Pull the saving/restoring of these files
into a common function helpers to standardize the pattern.
Reported-and-tested-by: Zhijun Wang <zhijwang@redhat.com>
Signed-off-by: Joe Lawrence <joe.lawrence@redhat.com>
Upstream kernel v6.1+ commit linux@e1789d7c752e ("kbuild: upgrade the
orphan section warning to an error if CONFIG_WERROR is set") and
CONFIG_WERROR will result in failed kernel builds due to the linker
reporting tons of "unplaced orphan section `.text.<function>`
<object-file.o>" errors.
Workaround this by temporarily demoting such errors in the top-level
kernel Makefile.
Reported-and-tested-by: Zhijun Wang <zhijwang@redhat.com>
Closes: #1391 ("CONFIG_WERROR=y and CONFIG_LD_ORPHAN_WARN_LEVEL="error" break kpatch-build")
Signed-off-by: Joe Lawrence <joe.lawrence@redhat.com>
Upstream kernel commit f7af6977621a ("x86/paravirt: Remove no longer
needed paravirt patching code") v6.8+ removed the .parainstructions
section and its paravirt_patch_site struct. Therefore this checks the
kernel version and does not export the struct size if the kernel
version is >= v6.8.0, avoiding the code path for it in
create-diff-object.c entirely.
Fixes: https://github.com/dynup/kpatch/issues/1380
Signed-off-by: Ryan Sullivan <rysulliv@redhat.com>
