kpatch-build: add support for openEuler #1263

anatasluo · 2022-04-24T12:44:11Z

As I noticed, commit eaaced1 has added
partial support for openEuler.

This patch enables usage in openEuler like:
kaptch-build xxxx.patch

I test it in openEuler 21.09, for people who
want to use kpatch in openEuler, two more steps
are needed.

add repo source
source rpm package of openEuler kernel are put in
two places. One is
https://repo.openeuler.org/openEuler-21.09/source/
Another one is
https://repo.openeuler.org/openEuler-21.09/update/source/
The latter one is not included in rpm repo lists by default.
compile kernel with CONFIG_LIVEPATCH_PER_TASK_CONSISTENCY enabled
openEuler has its own strategy when trying to apply patches.
We can only use klp_enable_patch function when
CONFIG_LIVEPATCH_PER_TASK_CONSISTENCY enabled.

Signed-off-by: anatasluo luolongjuna@gmail.com

anatasluo · 2022-04-24T13:03:26Z

Test log in openEuler 21.09 (x86_64):

[anatasluo@localhost ~]$ ./kpatch/kpatch-build/kpatch-build 1.patch
Fedora/Red Hat/OpenEuler distribution detected
Downloading kernel source for 5.10.0-5.10.0.24.oe1.x86_64
Unpacking kernel source
Testing patch file(s)
Reading special section data
Building original source
Building patched source
Extracting new and modified ELF sections
version.o: changed function: version_proc_show
Patched objects: vmlinux
Building patch module: livepatch-1.ko
SUCCESS
[anatasluo@localhost ~]$ cat 1.patch
From cff0bb0b98b156b2fd27f45af292e3f9649cac23 Mon Sep 17 00:00:00 2001
From: anatasluo anatasluo@localhost.localdomain
Date: Sun, 24 Apr 2022 10:30:49 +0800
Subject: [PATCH] kpatch test

fs/proc/version.c | 1 +
1 file changed, 1 insertion(+)

diff --git a/fs/proc/version.c b/fs/proc/version.c
index b449f18..ad10ef7 100644
--- a/fs/proc/version.c
+++ b/fs/proc/version.c
@@ -8,6 +8,7 @@

static int version_proc_show(struct seq_file *m, void *v)
{

seq_printf(m, "It is version secret %d", 88);
seq_printf(m, linux_proc_banner,
utsname()->sysname,
utsname()->release,
--
2.30.0

[anatasluo@localhost ~]$ sudo insmod livepatch-1.ko
[sudo] password for anatasluo:
Sorry, try again.
[sudo] password for anatasluo:
[anatasluo@localhost ~]$ cat /proc/version
It is version secret 88Linux version 5.10.0-5.10.0.24.oe1.x86_64 (abuild@ecs-obsworker-201) (gcc_old (GCC) 10.3.1, GNU ld (GNU Binutils) 2.36.1) #1 SMP Wed Sep 29 19:53:50 UTC 2021

jpoimboe · 2022-04-25T23:08:22Z

kpatch-build/kpatch-build


-		echo "Fedora/Red Hat distribution detected"
+		echo "Fedora/Red Hat/OpenEuler distribution detected"


Since this now covers so many distros, how about we make the message more custom:

[[ "$DISTRO" = fedora ]] && echo "Fedora distribution detected" [[ "$DISTRO" = rhel ]] && echo "RHEL distribution detected" etc ...

It looks better now.

jpoimboe · 2022-04-25T23:08:24Z

kpatch-build/kpatch-build

@@ -773,7 +773,13 @@ else
 		rpmbuild -D "_topdir $RPMTOPDIR" -bp --nodeps "--target=$(uname -m)" "$RPMTOPDIR"/SPECS/kernel$ALT.spec 2>&1 | logger ||
 			die "rpmbuild -bp failed.  you may need to run 'yum-builddep kernel' first."

-		mv "$RPMTOPDIR"/BUILD/kernel-*/linux-* "$KERNEL_SRCDIR" 2>&1 | logger || die
+		if [[ "$DISTRO" = openEuler ]]; then
+			# openEuler has two dirctories with the same content after 'rpm -D'


"directories"

Already fix it

jpoimboe

Other than the minor "CentOS" issue, looks good to me

jpoimboe · 2022-04-26T16:51:18Z

kpatch-build/kpatch-build

+		[[ "$DISTRO" = fedora ]] && echo "Fedora distribution detected"
+		[[ "$DISTRO" = rhel ]] && echo "RHEL distribution detected"
+		[[ "$DISTRO" = ol ]] && echo "Oracle Linux distribution detected"
+		[[ "$DISTRO" = centos ]] && echo "Centos distribution detected"


sorry for this mistake, already fix it now.

joe-lawrence · 2022-04-27T13:23:47Z

kpatch-build/kpatch-build

@@ -841,6 +855,9 @@ fi
 # shellcheck disable=SC1090
 source "$CONFIGFILE"

+[[ "$DISTRO" = openEuler ]] && [[ -z "$CONFIG_LIVEPATCH_PER_TASK_CONSISTENCY" ]] && \
+	die "openEuler kernel doesn't have 'CONFIG_LIVEPATCH_PER_TASK_CONSISTENCY' enabled"


I'm guessing OpenEuler sets CONFIG_LIVEPATCH_PER_TASK_CONSISTENCY by default, but is it absolutely necessary that it be turned on for this distro? IOW, could one build conventional livepatches on this kernel? Thanks.

Q: Could one build conventional livepatches on this kernel?
A: yes, but absolutely necessary to need CONFIG_LIVEPATCH_PER_TASK_CONSISTENCY set.

As we can see from the source code of the openEuler, without CONFIG_LIVEPATCH_PER_TASK_CONSISTENCY, there is even no klp_enable_patch function.

Q: Is CONFIG_LIVEPATCH_PER_TASK_CONSISTENCY set by default?
A: It depends on the version of the kernel. From this openEuler commit, I think they prefer to use their own strategy.

joe-lawrence

Do you want to add OpenEuler setup instructions to the install.md file? (Recently updated, so you may need to rebase.)

anatasluo · 2022-04-27T17:47:01Z

@joe-lawrence I have added some instructions in the commit log. It is a good idea to add complete instructions to the install.md file. I will do it later this week.

anatasluo · 2022-05-02T08:52:44Z

@joe-lawrence I have added some instructions in INSTALL.md. I am not sure it is organized very well.

joe-lawrence

Thanks for adding INSTALL.md notes, I think that will definitely help future OpenEuler kpatch adventurer. See review comments on a few minor things.

joe-lawrence · 2022-05-02T14:25:44Z

doc/INSTALL.md

@@ -206,3 +207,123 @@ Alternatively, the kpatch and kpatch-build scripts can be run directly from the
 git tree.


+### OpenEuler


I think the whole "OpenEuler" section needs to go a bit further up in the file, before the "Build" and "Install" sections (they are general sections and not specific to Gentoo).

Already fix it.

joe-lawrence · 2022-05-02T14:26:45Z

doc/INSTALL.md

+    When CONFIG_LIVEPATCH_PER_TASK_CONSISTENCY set, openEuler uses the conventional strategy.
+
+    Only one config option can take effect at the same time.
+    Differences between two strategies will not be discussed here, but you can easily guess them from config names.


Does (Open)Euler document the differences anywhere? If so, it would be nice if we could provide the user a link.

After some searching work, I find they have their own version of kpatch which is https://gitee.com/src-openeuler/kpatch. I also find a blog written by the openEuler official which describes the differences. The link is https://www.modb.pro/db/232858. Sadly, they are both written in chinese. I have added these information to the document.

joe-lawrence · 2022-05-02T14:28:08Z

doc/INSTALL.md

+
+    Check whether your current kernel compiled with *CONFIG_LIVEPATCH_PER_TASK_CONSISTENCY*
+    ```bash
+    grep -rn "CONFIG_LIVEPATCH_PER_TASK_CONSISTENCY" /boot/config-$(uname -r)


nit: maybe grep -rn is muscle memory :) but strictly speaking, I think recursive search and line numbers aren't needed for this check

yeah, it looks better now, already fix it.

joe-lawrence · 2022-05-02T14:29:33Z

doc/INSTALL.md

+
+    If you see any output, it means your kernel satisfies, you can go directly to check step 2.
+
+    If not, then you need to recompile your current kernel with CONFIG_LIVEPATCH_PER_TASK_CONSISTENCY set.


Not knowing much about OpenEuler, I read this as implying that CONFIG_LIVEPATCH_PER_TASK_CONSISTENCY is required. Just curious if that is true and how/when are CONFIG_LIVEPATCH_STOP_MACHINE_CONSISTENCY livepatches built?

openEuler maintains their own version of kpatch, already add its link to the document.

joe-lawrence · 2022-05-02T14:32:59Z

doc/INSTALL.md

+    3. recompile kernel and install it to your running environment.
+
+        Just to remind, after installing the recompiled kernel, the config file should also be updated.
+


Kernel build instructions look fine, though if OpenEuler provides their own wiki or howto (even if not in English), we could alternately link there in case any details change.

Sorry, I can not find any official blog from the openEuler about how to recompile the kernel. Actually, I get most of these information from reading source code. Their official documents are very insufficient.

As I noticed, commit eaaced1 has added partial support for openEuler. This patch enables usage in openEuler like: kpatch-build xxxx.patch I test it in openEuler 21.09, for people who want to use kpatch in openEuler, two more steps are needed. 1) add repo source source rpm package of openEuler kernel are put in two places. One is https://repo.openeuler.org/openEuler-21.09/source/ Another one is https://repo.openeuler.org/openEuler-21.09/update/source/ The latter one is not inclued in rpm repo lists by default. 2) compile kernel with CONFIG_LIVEPATCH_PER_TASK_CONSISTENCY enabled openEuler has its own strategy when trying to apply patches. We can use the klp_enable_patch function only when CONFIG_LIVEPATCH_PER_TASK_CONSISTENCY is enabled. Signed-off-by: anatasluo <luolongjuna@gmail.com>

anatasluo · 2022-05-06T03:34:30Z

@jpoimboe @joe-lawrence After some tests, I found there is no need to run
dnf install kpatch kpatch-runtime
in kpatch_openEuler_dependencies which is in test/integration/lib.sh.

Actually, these two packages are from kpatch maintained by openEuler, and it will probably make people confused.

So, I remove it from kpatch_openEuler_dependencies, and that is the content of my closest commit.

joe-lawrence · 2022-05-06T18:23:22Z

@anatasluo : thanks for updating, though it looks like the INSTALL.md updates were lost in the last force push? Those looked pretty good.

Signed-off-by: anatasluo <luolongjuna@gmail.com>

anatasluo · 2022-05-07T02:06:28Z

@anatasluo : thanks for updating, though it looks like the INSTALL.md updates were lost in the last force push? Those looked pretty good.

Sorry, I forgot to add it to the commit. Already add it now.

joe-lawrence

Thanks for adding more OpenEuler info to the docs!

joe-lawrence · 2022-05-10T22:31:15Z

@anatasluo : just wondering, what kind of kpatches have you been building on OpenEuler?

anatasluo · 2022-05-11T01:39:55Z

@jpoimboe My test log is here: #1263 (comment)

This log includes my test patch. Currently, I am trying to solve some CVE using kpatch on openEuler.

jpoimboe reviewed Apr 25, 2022

View reviewed changes

anatasluo force-pushed the master branch from 07832cc to 20c2a2c Compare April 26, 2022 02:41

anatasluo requested a review from jpoimboe April 26, 2022 03:56

jpoimboe reviewed Apr 26, 2022

View reviewed changes

anatasluo force-pushed the master branch from 20c2a2c to 955c3cd Compare April 27, 2022 01:47

anatasluo requested a review from jpoimboe April 27, 2022 01:50

jpoimboe approved these changes Apr 27, 2022

View reviewed changes

joe-lawrence reviewed Apr 27, 2022

View reviewed changes

anatasluo force-pushed the master branch 7 times, most recently from ef3dd60 to 910ac3d Compare May 2, 2022 08:49

anatasluo requested a review from joe-lawrence May 2, 2022 08:50

joe-lawrence reviewed May 2, 2022

View reviewed changes

anatasluo force-pushed the master branch from 910ac3d to 4de79d8 Compare May 4, 2022 09:23

anatasluo requested a review from joe-lawrence May 4, 2022 09:41

anatasluo force-pushed the master branch from 4de79d8 to 2784f50 Compare May 6, 2022 02:58

doc/install.md: add instructions for openEuler

e680087

Signed-off-by: anatasluo <luolongjuna@gmail.com>

joe-lawrence approved these changes May 10, 2022

View reviewed changes

joe-lawrence merged commit 6a0dcb0 into dynup:master May 13, 2022

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

kpatch-build: add support for openEuler #1263

kpatch-build: add support for openEuler #1263

anatasluo commented Apr 24, 2022

anatasluo commented Apr 24, 2022

jpoimboe Apr 25, 2022

anatasluo Apr 26, 2022

jpoimboe Apr 25, 2022

anatasluo Apr 26, 2022

jpoimboe left a comment

jpoimboe Apr 26, 2022

anatasluo Apr 27, 2022

joe-lawrence Apr 27, 2022

anatasluo Apr 27, 2022

joe-lawrence left a comment

anatasluo commented Apr 27, 2022

anatasluo commented May 2, 2022

joe-lawrence left a comment

joe-lawrence May 2, 2022

anatasluo May 4, 2022

joe-lawrence May 2, 2022

anatasluo May 4, 2022 •

edited

Loading

joe-lawrence May 2, 2022 •

edited

Loading

anatasluo May 4, 2022

joe-lawrence May 2, 2022 •

edited

Loading

anatasluo May 4, 2022

joe-lawrence May 2, 2022

anatasluo May 4, 2022

anatasluo commented May 6, 2022 •

edited

Loading

joe-lawrence commented May 6, 2022

anatasluo commented May 7, 2022

joe-lawrence left a comment

joe-lawrence commented May 10, 2022

anatasluo commented May 11, 2022


		echo "Fedora/Red Hat distribution detected"
		echo "Fedora/Red Hat/OpenEuler distribution detected"

		@@ -206,3 +207,123 @@ Alternatively, the kpatch and kpatch-build scripts can be run directly from the
		git tree.


		### OpenEuler


		If you see any output, it means your kernel satisfies, you can go directly to check step 2.

		If not, then you need to recompile your current kernel with CONFIG_LIVEPATCH_PER_TASK_CONSISTENCY set.

		3. recompile kernel and install it to your running environment.

		Just to remind, after installing the recompiled kernel, the config file should also be updated.

kpatch-build: add support for openEuler #1263

kpatch-build: add support for openEuler #1263

Conversation

anatasluo commented Apr 24, 2022

anatasluo commented Apr 24, 2022

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

jpoimboe left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

joe-lawrence left a comment

Choose a reason for hiding this comment

anatasluo commented Apr 27, 2022

anatasluo commented May 2, 2022

joe-lawrence left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

anatasluo May 4, 2022 • edited Loading

Choose a reason for hiding this comment

joe-lawrence May 2, 2022 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

joe-lawrence May 2, 2022 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

anatasluo commented May 6, 2022 • edited Loading

joe-lawrence commented May 6, 2022

anatasluo commented May 7, 2022

joe-lawrence left a comment

Choose a reason for hiding this comment

joe-lawrence commented May 10, 2022

anatasluo commented May 11, 2022

anatasluo May 4, 2022 •

edited

Loading

joe-lawrence May 2, 2022 •

edited

Loading

joe-lawrence May 2, 2022 •

edited

Loading

anatasluo commented May 6, 2022 •

edited

Loading