From 17dcebf077d694d594ad073828687c2ef7b4c08e Mon Sep 17 00:00:00 2001
From: Song Liu <song@kernel.org>
Date: Fri, 14 May 2021 17:32:41 -0700
Subject: [PATCH 1/4] kpatch-build: enable klp with replace option by default
Since 5.1 kernel, klp_patch supports a "replace" option, which does atomic
replace of cumulative patches. Enable building such patch by default. If
replace behavior is not desired, the user can use -R|--non-replace option
to disable it.
Signed-off-by: Song Liu <song@kernel.org>
---
kmod/patch/livepatch-patch-hook.c | 15 +++++++++++++++
kpatch-build/kpatch-build | 25 ++++++++++++++++++++++++-
2 files changed, 39 insertions(+), 1 deletion(-)
diff --git a/kmod/patch/livepatch-patch-hook.c b/kmod/patch/livepatch-patch-hook.c
index e12fd505..120c637a 100644
--- a/kmod/patch/livepatch-patch-hook.c
+++ b/kmod/patch/livepatch-patch-hook.c
@@ -74,6 +74,18 @@
# define HAVE_SIMPLE_ENABLE
#endif
+#ifdef RHEL_RELEASE_CODE
+# if RHEL_RELEASE_CODE >= RHEL_RELEASE_VERSION(8, 2)
+# define HAVE_KLP_REPLACE
+# endif
+#elif LINUX_VERSION_CODE >= KERNEL_VERSION(5, 1, 0)
+# define HAVE_KLP_REPLACE
+#endif
+
+#ifndef KLP_REPLACE_ENABLE
+#define KLP_REPLACE_ENABLE true
+#endif
+
/*
* There are quite a few similar structures at play in this file:
* - livepatch.h structs prefixed with klp_*
@@ -385,6 +397,9 @@ static int __init patch_init(void)
goto out;
lpatch->mod = THIS_MODULE;
lpatch->objs = lobjects;
+#ifdef HAVE_KLP_REPLACE
+ lpatch->replace = KLP_REPLACE_ENABLE;
+#endif
#if defined(__powerpc64__) && defined(HAVE_IMMEDIATE)
lpatch->immediate = true;
#endif
diff --git a/kpatch-build/kpatch-build b/kpatch-build/kpatch-build
index 617f8578..e40f79b2 100755
--- a/kpatch-build/kpatch-build
+++ b/kpatch-build/kpatch-build
@@ -55,6 +55,7 @@ DEBUG_KCFLAGS=""
declare -a PATCH_LIST
APPLIED_PATCHES=0
OOT_MODULE=
+KLP_REPLACE=1
warn() {
echo "ERROR: $1" >&2
@@ -218,6 +219,15 @@ use_klp_arch()
fi
}
+support_klp_replace()
+{
+ if kernel_is_rhel; then
+ rhel_kernel_version_gte 4.18.0-193.el8
+ else
+ kernel_version_gte 5.1.0
+ fi
+}
+
find_dirs() {
if [[ -e "$SCRIPTDIR/create-diff-object" ]]; then
# git repo
@@ -514,12 +524,13 @@ usage() {
echo " (can be specified multiple times)" >&2
echo " -e, --oot-module Enable patching out-of-tree module," >&2
echo " specify current version of module" >&2
+ echo " -R, --non-replace Disable replace patch (replace is on by default)" >&2
echo " --skip-cleanup Skip post-build cleanup" >&2
echo " --skip-compiler-check Skip compiler version matching check" >&2
echo " (not recommended)" >&2
}
-options="$(getopt -o ha:r:s:c:v:j:t:n:o:de: -l "help,archversion:,sourcerpm:,sourcedir:,config:,vmlinux:,jobs:,target:,name:,output:,oot-module:,debug,skip-gcc-check,skip-compiler-check,skip-cleanup" -- "$@")" || die "getopt failed"
+options="$(getopt -o ha:r:s:c:v:j:t:n:o:de:R -l "help,archversion:,sourcerpm:,sourcedir:,config:,vmlinux:,jobs:,target:,name:,output:,oot-module:,debug,skip-gcc-check,skip-compiler-check,skip-cleanup,non-replace" -- "$@")" || die "getopt failed"
eval set -- "$options"
@@ -582,6 +593,9 @@ while [[ $# -gt 0 ]]; do
OOT_MODULE="$(readlink -f "$2")"
shift
;;
+ -R|--non-replace)
+ KLP_REPLACE=0
+ ;;
--skip-cleanup)
echo "Skipping cleanup"
SKIPCLEANUP=1
@@ -821,6 +835,12 @@ if grep -q "CONFIG_LIVEPATCH=y" "$CONFIGFILE" && (kernel_is_rhel || kernel_versi
KPATCH_LDFLAGS="--unique=.parainstructions --unique=.altinstructions"
CDO_FLAGS="--klp-arch"
fi
+
+ if [[ "$KLP_REPLACE" -eq 1 ]] ; then
+ support_klp_replace || die "The kernel doesn't support klp replace"
+ else
+ export KBUILD_CFLAGS_MODULE="$KBUILD_CFLAGS_MODULE -DKLP_REPLACE_ENABLE=false"
+ fi
else
# No support for livepatch in the kernel. Kpatch core module is needed.
@@ -828,6 +848,9 @@ else
# sections. Use with caution!
echo "WARNING: Use of kpatch core module (kpatch.ko) is deprecated! There may be bugs!" >&2
+ if [[ "$KLP_REPLACE" -eq 1 ]] ; then
+ die "kpatch core module (kpatch.ko) does not support replace, please add -R|--non-replace"
+ fi
find_core_symvers || die "unable to find Module.symvers for kpatch core module"
KBUILD_EXTRA_SYMBOLS="$SYMVERSFILE"
fi
From 69e69d59e83a98ca3272c5028fa89f7e9196770d Mon Sep 17 00:00:00 2001
From: Song Liu <song@kernel.org>
Date: Wed, 19 May 2021 15:18:27 -0700
Subject: [PATCH 2/4] doc: kpatch-build uses "replace" flag by default
Add documentation about kpatch-build enables livepatch "replace" flag by
default, and provides -R|--non-replace option to disable the flag.
Signed-off-by: Song Liu <song@kernel.org>
---
doc/patch-author-guide.md | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/doc/patch-author-guide.md b/doc/patch-author-guide.md
index 33c1b277..f3dcf736 100644
--- a/doc/patch-author-guide.md
+++ b/doc/patch-author-guide.md
@@ -39,6 +39,13 @@ recommended that when patching a system which has already been patched, the
second patch should be a cumulative upgrade which is a superset of the first
patch.
+Since upstream kernel 5.1, livepatch supports a "replace" flag to help the
+management of cumulative patches. With the flag set, the kernel will load
+the cumulative patch and unload all existing patches in one transition.
+kpatch-build enables the replace flag by default. If replace behavior is
+not desired, the user can disable it with -R|--non-replace.
+
+
Data structure changes
----------------------
From 8487a0ca0a5201ca53b33b3a2de5b65320b947c9 Mon Sep 17 00:00:00 2001
From: Song Liu <song@kernel.org>
Date: Tue, 25 May 2021 15:20:59 -0700
Subject: [PATCH 3/4] manpages: update kpatch-build with -R | --non-replace
option
Signed-off-by: Song Liu <song@kernel.org>
---
man/kpatch-build.1 | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/man/kpatch-build.1 b/man/kpatch-build.1
index dfd61acf..4483a4a3 100644
--- a/man/kpatch-build.1
+++ b/man/kpatch-build.1
@@ -51,6 +51,10 @@ effect.
Enable patching out-of-tree module,
specify current version of module
+-R|--non-replace
+ Disable replace flag of KLP
+ (replace is on by default)
+
--skip-cleanup
Skip post-build cleanup
From 4b68be868f40244ff9850bf35f8d273afa12cf12 Mon Sep 17 00:00:00 2001
From: Song Liu <song@kernel.org>
Date: Mon, 24 May 2021 17:34:24 -0700
Subject: [PATCH 4/4] kpatch-test: disable replace flag when the kernel doesn't
support it
For redhat kernel < 4.18.0-193.el8 or non-redhat kernel version < 5.1,
add -R to $KPATCHBUILD_OPTS.
Signed-off-by: Song Liu <song@kernel.org>
---
test/integration/kpatch-test | 27 +++++++++++++++++++++++++++
1 file changed, 27 insertions(+)
diff --git a/test/integration/kpatch-test b/test/integration/kpatch-test
index 4359b463..ca5e7835 100755
--- a/test/integration/kpatch-test
+++ b/test/integration/kpatch-test
@@ -50,6 +50,7 @@ ERROR=0
LOG=test.log
DYNDEBUG_CONTROL=/sys/kernel/debug/dynamic_debug/control
DYNDEBUG_ENABLED=1
+ARCHVERSION="$(uname -r)"
rm -f ./*.log
PATCHDIR="${PATCHDIR:-$PWD}"
@@ -308,6 +309,27 @@ new_dmesg() {
fi
}
+kernel_version_gte() {
+ [ "${ARCHVERSION//-*/}" = "$(echo -e "${ARCHVERSION//-*}\\n$1" | sort -rV | head -n1)" ]
+}
+
+support_klp_replace()
+{
+ if kernel_is_rhel; then
+ rhel_kernel_version_gte 4.18.0-193.el8
+ else
+ kernel_version_gte 5.1.0
+ fi
+}
+
+kernel_is_rhel() {
+ [[ "$ARCHVERSION" =~ \.el[789] ]]
+}
+
+rhel_kernel_version_gte() {
+ [ "${ARCHVERSION}" = "$(echo -e "${ARCHVERSION}\\n$1" | sort -rV | head -n1)" ]
+}
+
# shellcheck disable=SC1091
source /etc/os-release
if [[ "${ID}" == "rhel" && "${VERSION_ID%%.*}" == "7" && "${VERSION_ID##*.}" -le "6" ]]; then
@@ -315,6 +337,11 @@ if [[ "${ID}" == "rhel" && "${VERSION_ID%%.*}" == "7" && "${VERSION_ID##*.}" -le
echo "Dynamic debug is not supported on '${PRETTY_NAME}', disabling."
fi
+if ! support_klp_replace ; then
+ KPATCHBUILD_OPTS="$KPATCHBUILD_OPTS -R"
+ echo "KLP replace is not supported on '${PRETTY_NAME}', disabling."
+fi
+
for file in "${PATCH_LIST[@]}"; do
if [[ $QUICK != 1 || "$file" =~ -FAIL ]]; then
build_module "$file"