[PATCH v3 00/13] livepatch-klp-build: small fixups and enhancements

[PATCH v3 00/13] livepatch-klp-build: small fixups and enhancements

[Joe Lawrence]

Here is v3, addressing review feedback from the v2 thread as well as
finding a few more things along the way.

I'll reply to specific patches with more details on new bugs/behavior.
I've ordered the patchset IMHO order of importance, fixing bugs then
moving on to enhancements.

v3:

- Added a patch to objtool ELF code to fix packed string section alignment
- Simplified the mkstemp() patch and surrounding code [Josh]
- Added patches to catch grep use, add Makefile shellcheck, and fix
  current shellcheck warnings [Josh]
- Simplified the short-circuit validation patch [Josh]
- Added a patch to fix short-circuit version mismatch
- Pretty-print output in color [Josh]
- Reduce 'patch' chatter to fuzz/offset warning during patch validation
- Prune tools/ from paths that find_objects() looks for changed objects

v2: https://lore.kernel.org/live-patching/20260204025140.2023382-1-joe.lawrence@redhat.com/

- Update patch subject prefixes accordingly [Josh]
- Added a small objtool/klp patch.  Test systems setup crazy long
  pathnames :D
- Removed patch ("limit parent .git directory search") as this version
  replaces the use of git apply --recount with patch and recountdiff.
  A side effect of this simplification was no longer needing this weird
  hack. [Josh]
- Updated the patch that handles input patches that add files to also
  support removing files, implement this by directly inspecting the
  .patch  +++ and --- header lines via two file lists [Josh]
- Implement two short-circuiting updates: validate patches for steps 1
  and 2, and allow the user to omit patches for steps 3 and 4.  This
  combines the original 'fail-fast' patch and some related notes on the
  v1 thread. [Josh]
- Since v2 replaces git apply with patch and recountdiff, there is no
  need for a -z/--fuzz argument, it comes with GNU patch for free.

v1: https://lore.kernel.org/live-patching/CAPhsuW5qrueccM123YbTo2ZvP-Rf+0UT-goG6c5A8gXw7BsF3w@mail.gmail.com/T/#t

Joe Lawrence (13):
  objtool/klp: honor SHF_MERGE entry alignment in elf_add_data()
  objtool/klp: fix mkstemp() failure with long paths
  livepatch/klp-build: support patches that add/remove files
  livepatch/klp-build: switch to GNU patch and recountdiff
  livepatch/klp-build: add grep-override function
  livepatch/klp-build: add Makefile with check target
  livepatch/klp-build: fix shellcheck complaints
  livepatch/klp-build: improve short-circuit validation
  livepatch/klp-build: fix version mismatch when short-circuiting
  livepatch/klp-build: provide friendlier error messages
  livepatch/klp-build: add terminal color output
  livepatch/klp-build: report patch validation drift
  livepatch/klp-build: don't look for changed objects in tools/

 scripts/livepatch/Makefile  |  20 +++++
 scripts/livepatch/klp-build | 142 ++++++++++++++++++++++--------------
 tools/objtool/elf.c         |  25 +------
 3 files changed, 110 insertions(+), 77 deletions(-)
 create mode 100644 scripts/livepatch/Makefile

-- Joe

-- 
2.53.0

[PATCH v3 01/13] objtool/klp: honor SHF_MERGE entry alignment in elf_add_data()

[Joe Lawrence]

When adding data to an SHF_MERGE section, set the Elf_Data d_align to
the section's sh_addralign so libelf aligns entries within the section.
This ensures that entry offsets are consistent with previously calculated
relocation addends.

Fixes: 431dbabf2d9d ("objtool: Add elf_create_data()")
Signed-off-by: Joe Lawrence <joe.lawrence@redhat.com>
---
 tools/objtool/elf.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tools/objtool/elf.c b/tools/objtool/elf.c
index 2c02c7b49265..bd6502e7bdc0 100644
--- a/tools/objtool/elf.c
+++ b/tools/objtool/elf.c
@@ -1375,7 +1375,7 @@ void *elf_add_data(struct elf *elf, struct section *sec, const void *data, size_
 		memcpy(sec->data->d_buf, data, size);
 
 	sec->data->d_size = size;
-	sec->data->d_align = 1;
+	sec->data->d_align = (sec->sh.sh_flags & SHF_MERGE) ? sec->sh.sh_addralign : 1;
 
 	offset = ALIGN(sec->sh.sh_size, sec->sh.sh_addralign);
 	sec->sh.sh_size = offset + size;
-- 
2.53.0

[PATCH v3 02/13] objtool/klp: fix mkstemp() failure with long paths

[Joe Lawrence]

The elf_create_file() function fails with EINVAL when the build directory
path is long enough to truncate the "XXXXXX" suffix in the 256-byte
tmp_name buffer.

Simplify the code to remove the unnecessary dirname()/basename() split
and concatenation.  Instead, allocate the exact number of bytes needed for
the path.

Signed-off-by: Joe Lawrence <joe.lawrence@redhat.com>
---
 tools/objtool/elf.c | 23 +++--------------------
 1 file changed, 3 insertions(+), 20 deletions(-)

diff --git a/tools/objtool/elf.c b/tools/objtool/elf.c
index bd6502e7bdc0..6f6d1c4cb6af 100644
--- a/tools/objtool/elf.c
+++ b/tools/objtool/elf.c
@@ -16,7 +16,6 @@
 #include <string.h>
 #include <unistd.h>
 #include <errno.h>
-#include <libgen.h>
 #include <ctype.h>
 #include <linux/align.h>
 #include <linux/kernel.h>
@@ -1189,7 +1188,7 @@ struct elf *elf_open_read(const char *name, int flags)
 struct elf *elf_create_file(GElf_Ehdr *ehdr, const char *name)
 {
 	struct section *null, *symtab, *strtab, *shstrtab;
-	char *dir, *base, *tmp_name;
+	char *tmp_name;
 	struct symbol *sym;
 	struct elf *elf;
 
@@ -1203,29 +1202,13 @@ struct elf *elf_create_file(GElf_Ehdr *ehdr, const char *name)
 
 	INIT_LIST_HEAD(&elf->sections);
 
-	dir = strdup(name);
-	if (!dir) {
-		ERROR_GLIBC("strdup");
-		return NULL;
-	}
-
-	dir = dirname(dir);
-
-	base = strdup(name);
-	if (!base) {
-		ERROR_GLIBC("strdup");
-		return NULL;
-	}
-
-	base = basename(base);
-
-	tmp_name = malloc(256);
+	tmp_name = malloc(strlen(name) + 8);
 	if (!tmp_name) {
 		ERROR_GLIBC("malloc");
 		return NULL;
 	}
 
-	snprintf(tmp_name, 256, "%s/%s.XXXXXX", dir, base);
+	sprintf(tmp_name, "%s.XXXXXX", name);
 
 	elf->fd = mkstemp(tmp_name);
 	if (elf->fd == -1) {
-- 
2.53.0

[PATCH v3 03/13] livepatch/klp-build: support patches that add/remove files

[Joe Lawrence]

The klp-build script prepares a clean patch by populating two temporary
directories ('a' and 'b') with source files and diffing the result.
However, this process fails when a patch introduces a new source file,
as the script attempts to copy files that do not yet exist in the
original source tree.  Likewise, it fails when a patch removes a source
file and the script attempts to copy a file that no longer exists.

Refactor the file-gathering logic to distinguish between original input
files and patched output files:

- Split get_patch_files() into get_patch_input_files() and
  get_patch_output_files() to identify which files exist before and
  after patch application.
- Filter out "/dev/null" from both to handle file creation/deletion.
- Update refresh_patch() to only copy existing input files to the 'a'
  directory and the resulting output files to the 'b' directory.

Signed-off-by: Joe Lawrence <joe.lawrence@redhat.com>
---
 scripts/livepatch/klp-build | 34 +++++++++++++++++++++++++++-------
 1 file changed, 27 insertions(+), 7 deletions(-)

diff --git a/scripts/livepatch/klp-build b/scripts/livepatch/klp-build
index 809e198a561d..94ed3b4a91d8 100755
--- a/scripts/livepatch/klp-build
+++ b/scripts/livepatch/klp-build
@@ -296,15 +296,33 @@ set_kernelversion() {
 	sed -i "2i echo $localversion; exit 0" scripts/setlocalversion
 }
 
-get_patch_files() {
+get_patch_input_files() {
+	local patch="$1"
+
+	grep0 -E '^--- ' "$patch"				\
+		| gawk '{print $2}'				\
+		| grep0 -v '^/dev/null$'			\
+		| sed 's|^[^/]*/||'				\
+		| sort -u
+}
+
+get_patch_output_files() {
 	local patch="$1"
 
-	grep0 -E '^(--- |\+\+\+ )' "$patch"			\
+	grep0 -E '^\+\+\+ ' "$patch"				\
 		| gawk '{print $2}'				\
+		| grep0 -v '^/dev/null$'			\
 		| sed 's|^[^/]*/||'				\
 		| sort -u
 }
 
+get_patch_files() {
+	local patch="$1"
+
+	{ get_patch_input_files "$patch"; get_patch_output_files "$patch"; } \
+		| sort -u
+}
+
 # Make sure git re-stats the changed files
 git_refresh() {
 	local patch="$1"
@@ -312,7 +330,7 @@ git_refresh() {
 
 	[[ ! -e "$SRC/.git" ]] && return
 
-	get_patch_files "$patch" | mapfile -t files
+	get_patch_input_files "$patch" | mapfile -t files
 
 	(
 		cd "$SRC"
@@ -426,21 +444,23 @@ do_init() {
 refresh_patch() {
 	local patch="$1"
 	local tmpdir="$PATCH_TMP_DIR"
-	local files=()
+	local input_files=()
+	local output_files=()
 
 	rm -rf "$tmpdir"
 	mkdir -p "$tmpdir/a"
 	mkdir -p "$tmpdir/b"
 
 	# Get all source files affected by the patch
-	get_patch_files "$patch" | mapfile -t files
+	get_patch_input_files "$patch" | mapfile -t input_files
+	get_patch_output_files "$patch" | mapfile -t output_files
 
 	# Copy orig source files to 'a'
-	( cd "$SRC" && echo "${files[@]}" | xargs cp --parents --target-directory="$tmpdir/a" )
+	( cd "$SRC" && echo "${input_files[@]}" | xargs cp --parents --target-directory="$tmpdir/a" )
 
 	# Copy patched source files to 'b'
 	apply_patch "$patch" --recount
-	( cd "$SRC" && echo "${files[@]}" | xargs cp --parents --target-directory="$tmpdir/b" )
+	( cd "$SRC" && echo "${output_files[@]}" | xargs cp --parents --target-directory="$tmpdir/b" )
 	revert_patch "$patch" --recount
 
 	# Diff 'a' and 'b' to make a clean patch
-- 
2.53.0

[PATCH v3 04/13] livepatch/klp-build: switch to GNU patch and recountdiff

[Joe Lawrence]

The klp-build script is currently very strict with input patches,
requiring them to apply cleanly via `git apply --recount`.  This
prevents the use of patches with minor contextual fuzz relative to the
target kernel sources.

To allow users to reuse a patch across similar kernel streams, switch to
using GNU patch and patchutils for intermediate patch manipulation.
Update the logic for applying, reverting, and regenerating patches:

- Use 'patch -p1' for better handling of context fuzz.
- Use 'recountdiff' to update line counts after FIX_PATCH_LINES.
- Drop git_refresh() and related git-specific logic.

Signed-off-by: Joe Lawrence <joe.lawrence@redhat.com>
---
 scripts/livepatch/klp-build | 59 ++++++++-----------------------------
 1 file changed, 13 insertions(+), 46 deletions(-)

diff --git a/scripts/livepatch/klp-build b/scripts/livepatch/klp-build
index 94ed3b4a91d8..564985a1588a 100755
--- a/scripts/livepatch/klp-build
+++ b/scripts/livepatch/klp-build
@@ -95,7 +95,7 @@ restore_files() {
 
 cleanup() {
 	set +o nounset
-	revert_patches "--recount"
+	revert_patches
 	restore_files
 	[[ "$KEEP_TMP" -eq 0 ]] && rm -rf "$TMP_DIR"
 	return 0
@@ -282,7 +282,7 @@ set_module_name() {
 }
 
 # Hardcode the value printed by the localversion script to prevent patch
-# application from appending it with '+' due to a dirty git working tree.
+# application from appending it with '+' due to a dirty working tree.
 set_kernelversion() {
 	local file="$SRC/scripts/setlocalversion"
 	local localversion
@@ -300,8 +300,8 @@ get_patch_input_files() {
 	local patch="$1"
 
 	grep0 -E '^--- ' "$patch"				\
+		| grep0 -v -e '/dev/null' -e '1969-12-31' -e '1970-01-01' \
 		| gawk '{print $2}'				\
-		| grep0 -v '^/dev/null$'			\
 		| sed 's|^[^/]*/||'				\
 		| sort -u
 }
@@ -310,8 +310,8 @@ get_patch_output_files() {
 	local patch="$1"
 
 	grep0 -E '^\+\+\+ ' "$patch"				\
+		| grep0 -v -e '/dev/null' -e '1969-12-31' -e '1970-01-01' \
 		| gawk '{print $2}'				\
-		| grep0 -v '^/dev/null$'			\
 		| sed 's|^[^/]*/||'				\
 		| sort -u
 }
@@ -323,21 +323,6 @@ get_patch_files() {
 		| sort -u
 }
 
-# Make sure git re-stats the changed files
-git_refresh() {
-	local patch="$1"
-	local files=()
-
-	[[ ! -e "$SRC/.git" ]] && return
-
-	get_patch_input_files "$patch" | mapfile -t files
-
-	(
-		cd "$SRC"
-		git update-index -q --refresh -- "${files[@]}"
-	)
-}
-
 check_unsupported_patches() {
 	local patch
 
@@ -358,36 +343,19 @@ check_unsupported_patches() {
 
 apply_patch() {
 	local patch="$1"
-	shift
-	local extra_args=("$@")
 
 	[[ ! -f "$patch" ]] && die "$patch doesn't exist"
-
-	(
-		cd "$SRC"
-
-		# The sed strips the version signature from 'git format-patch',
-		# otherwise 'git apply --recount' warns.
-		sed -n '/^-- /q;p' "$patch" |
-			git apply "${extra_args[@]}"
-	)
+	patch -d "$SRC" -p1 --dry-run --silent --no-backup-if-mismatch -r /dev/null < "$patch"
+	patch -d "$SRC" -p1 --silent --no-backup-if-mismatch -r /dev/null < "$patch"
 
 	APPLIED_PATCHES+=("$patch")
 }
 
 revert_patch() {
 	local patch="$1"
-	shift
-	local extra_args=("$@")
 	local tmp=()
 
-	(
-		cd "$SRC"
-
-		sed -n '/^-- /q;p' "$patch" |
-			git apply --reverse "${extra_args[@]}"
-	)
-	git_refresh "$patch"
+	patch -d "$SRC" -p1 -R --silent --no-backup-if-mismatch -r /dev/null < "$patch"
 
 	for p in "${APPLIED_PATCHES[@]}"; do
 		[[ "$p" == "$patch" ]] && continue
@@ -406,11 +374,10 @@ apply_patches() {
 }
 
 revert_patches() {
-	local extra_args=("$@")
 	local patches=("${APPLIED_PATCHES[@]}")
 
 	for (( i=${#patches[@]}-1 ; i>=0 ; i-- )) ; do
-		revert_patch "${patches[$i]}" "${extra_args[@]}"
+		revert_patch "${patches[$i]}"
 	done
 
 	APPLIED_PATCHES=()
@@ -434,6 +401,7 @@ do_init() {
 	APPLIED_PATCHES=()
 
 	[[ -x "$FIX_PATCH_LINES" ]] || die "can't find fix-patch-lines"
+	command -v recountdiff &>/dev/null || die "recountdiff not found (install patchutils)"
 
 	validate_config
 	set_module_name
@@ -459,12 +427,12 @@ refresh_patch() {
 	( cd "$SRC" && echo "${input_files[@]}" | xargs cp --parents --target-directory="$tmpdir/a" )
 
 	# Copy patched source files to 'b'
-	apply_patch "$patch" --recount
+	apply_patch "$patch"
 	( cd "$SRC" && echo "${output_files[@]}" | xargs cp --parents --target-directory="$tmpdir/b" )
-	revert_patch "$patch" --recount
+	revert_patch "$patch"
 
 	# Diff 'a' and 'b' to make a clean patch
-	( cd "$tmpdir" && git diff --no-index --no-prefix a b > "$patch" ) || true
+	( cd "$tmpdir" && diff -Nupr a b > "$patch" ) || true
 }
 
 # Copy the patches to a temporary directory, fix their lines so as not to
@@ -487,8 +455,7 @@ fix_patches() {
 
 		cp -f "$old_patch" "$tmp_patch"
 		refresh_patch "$tmp_patch"
-		"$FIX_PATCH_LINES" "$tmp_patch" > "$new_patch"
-		refresh_patch "$new_patch"
+		"$FIX_PATCH_LINES" "$tmp_patch" | recountdiff > "$new_patch"
 
 		PATCHES[i]="$new_patch"
 
-- 
2.53.0

[PATCH v3 05/13] livepatch/klp-build: add grep-override function

[Joe Lawrence]

Provide a custom grep() function to catch direct usage of the command.
Bare grep calls are generally incompatible with pipefail and
errexit behavior (where a failed match causes the script to exit).

Developers can still call grep via command grep if that behavior is
explicitly desired.

Signed-off-by: Joe Lawrence <joe.lawrence@redhat.com>
---
 scripts/livepatch/klp-build | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/scripts/livepatch/klp-build b/scripts/livepatch/klp-build
index 564985a1588a..cf6c2bf694aa 100755
--- a/scripts/livepatch/klp-build
+++ b/scripts/livepatch/klp-build
@@ -56,6 +56,13 @@ grep0() {
 	command grep "$@" || true
 }
 
+# Because pipefail is enabled, the grep0 helper should be used instead of
+# grep, otherwise a failed match can propagate to an error.
+grep() {
+	echo "error: $SCRIPT: use grep0 or 'command grep' instead of bare grep" >&2
+	exit 1
+}
+
 status() {
 	echo "$*"
 }
-- 
2.53.0

[PATCH v3 06/13] livepatch/klp-build: add Makefile with check target

[Joe Lawrence]

Add a standalone Makefile with a 'check' target that runs static code
analysis (shellcheck) on the klp-build script(s).  This is intended
strictly as a development aid.

Signed-off-by: Joe Lawrence <joe.lawrence@redhat.com>
---
 scripts/livepatch/Makefile | 20 ++++++++++++++++++++
 1 file changed, 20 insertions(+)
 create mode 100644 scripts/livepatch/Makefile

diff --git a/scripts/livepatch/Makefile b/scripts/livepatch/Makefile
new file mode 100644
index 000000000000..17b590213740
--- /dev/null
+++ b/scripts/livepatch/Makefile
@@ -0,0 +1,20 @@
+# SPDX-License-Identifier: GPL-2.0
+# Standalone Makefile for developer tooling (not part of kbuild).
+
+SHELLCHECK := $(shell which shellcheck 2> /dev/null)
+
+SRCS := \
+  klp-build
+
+.DEFAULT_GOAL := help
+.PHONY: help
+help:
+	@echo "  check      - Run shellcheck on $(SRCS)"
+	@echo "  help       - Show this help message"
+
+.PHONY: check
+check:
+ifndef SHELLCHECK
+	$(error shellcheck is not installed. Please install it to run checks)
+endif
+	@$(SHELLCHECK) $(SHELLCHECK_OPTIONS) $(SRCS)
-- 
2.53.0

[PATCH v3 07/13] livepatch/klp-build: fix shellcheck complaints

[Joe Lawrence]

Fix or suppress the following shellcheck warnings:

  In klp-build line 57:
  	command grep "$@" || true
                               ^--^ SC2317 (info): Command appears to be unreachable. Check usage (or ignore if invoked indirectly).

Fix the following warning:

  In klp-build line 565:
  		local file_dir="$(dirname "$file")"
                        ^------^ SC2034 (warning): file_dir appears unused. Verify use (or export if used externally).

Signed-off-by: Joe Lawrence <joe.lawrence@redhat.com>
---
 scripts/livepatch/klp-build | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/scripts/livepatch/klp-build b/scripts/livepatch/klp-build
index cf6c2bf694aa..374e1261fd7a 100755
--- a/scripts/livepatch/klp-build
+++ b/scripts/livepatch/klp-build
@@ -53,6 +53,7 @@ PATCH_TMP_DIR="$TMP_DIR/tmp"
 KLP_DIFF_LOG="$DIFF_DIR/diff.log"
 
 grep0() {
+	# shellcheck disable=SC2317
 	command grep "$@" || true
 }
 
@@ -550,7 +551,6 @@ copy_orig_objects() {
 	for _file in "${files[@]}"; do
 		local rel_file="${_file/.ko/.o}"
 		local file="$OBJ/$rel_file"
-		local file_dir="$(dirname "$file")"
 		local orig_file="$ORIG_DIR/$rel_file"
 		local orig_dir="$(dirname "$orig_file")"
 
-- 
2.53.0

[PATCH v3 08/13] livepatch/klp-build: improve short-circuit validation

[Joe Lawrence]

Update SHORT_CIRCUIT behavior to better handle patch validation and
argument processing in later klp-build steps.

Perform patch validation for both step 1 (building original kernel) and
step 2 (building patched kernel) to ensure patches are verified before
any compilation occurs.

Additionally, allow the user to omit input patches when skipping past
step 2.

Signed-off-by: Joe Lawrence <joe.lawrence@redhat.com>
---
 scripts/livepatch/klp-build | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/scripts/livepatch/klp-build b/scripts/livepatch/klp-build
index 374e1261fd7a..60c7635e65c1 100755
--- a/scripts/livepatch/klp-build
+++ b/scripts/livepatch/klp-build
@@ -220,7 +220,7 @@ process_args() {
 		esac
 	done
 
-	if [[ $# -eq 0 ]]; then
+	if [[ $# -eq 0 ]] && (( SHORT_CIRCUIT <= 2 )); then
 		usage
 		exit 1
 	fi
@@ -791,9 +791,12 @@ build_patch_module() {
 process_args "$@"
 do_init
 
-if (( SHORT_CIRCUIT <= 1 )); then
+if (( SHORT_CIRCUIT <= 2 )); then
 	status "Validating patch(es)"
 	validate_patches
+fi
+
+if (( SHORT_CIRCUIT <= 1 )); then
 	status "Building original kernel"
 	clean_kernel
 	build_kernel
-- 
2.53.0

[PATCH v3 09/13] livepatch/klp-build: fix version mismatch when short-circuiting

[Joe Lawrence]

The klp-build script overrides the kernel's setlocalversion script to
freeze the version string.  This prevents the build system from appending
"+" or "-dirty" suffixes between original and patched kernel builds.

However, a version mismatch may still occur when running successive
klp-build commands using the short-circuit option (-S 2):

- Initial Run (-T): The real setlocalversion runs once.  It is then
  replaced by a fixed-string copy.  On exit, the original script is
  restored.
- Subsequent Runs (-S 2): The tree contains the original setlocalversion
  script again.  When set_kernelversion() is called, it may generate a
  different version string because the tree state has changed (e.g.,
  include/config/auto.conf now exists).  This causes patched kernel
  builds to use a version string that differs from the original.

Fix this by restoring the saved override when SHORT_CIRCUIT >= 2.  This
ensures that subsequent patched builds reuse the localversion from the
initial klp-build run.

Signed-off-by: Joe Lawrence <joe.lawrence@redhat.com>
---
 scripts/livepatch/klp-build | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/scripts/livepatch/klp-build b/scripts/livepatch/klp-build
index 60c7635e65c1..6d3adadfc394 100755
--- a/scripts/livepatch/klp-build
+++ b/scripts/livepatch/klp-build
@@ -291,17 +291,26 @@ set_module_name() {
 
 # Hardcode the value printed by the localversion script to prevent patch
 # application from appending it with '+' due to a dirty working tree.
+# When short-circuiting at step 2 or later, restore the saved override from
+# a prior run instead of recomputing (avoids version mismatch with orig objects).
 set_kernelversion() {
 	local file="$SRC/scripts/setlocalversion"
 	local localversion
 
 	stash_file "$file"
+	if (( SHORT_CIRCUIT >= 2 )); then
+		[[ ! -f "$TMP_DIR/setlocalversion.override" ]] && \
+			die "previous setlocalversion.override not found"
+		cp -f "$TMP_DIR/setlocalversion.override" "$SRC/scripts/setlocalversion"
+		return 0
+	fi
 
 	localversion="$(cd "$SRC" && make --no-print-directory kernelversion)"
 	localversion="$(cd "$SRC" && KERNELVERSION="$localversion" ./scripts/setlocalversion)"
 	[[ -z "$localversion" ]] && die "setlocalversion failed"
 
 	sed -i "2i echo $localversion; exit 0" scripts/setlocalversion
+	cp -f "$SRC/scripts/setlocalversion" "$TMP_DIR/setlocalversion.override"
 }
 
 get_patch_input_files() {
-- 
2.53.0

[PATCH v3 10/13] livepatch/klp-build: provide friendlier error messages

[Joe Lawrence]

Provide more context for common klp-build failure modes.  Clarify which
user-provided patch is unsupported or failed to apply, and explicitly
identify which kernel build (original or patched) failed.

Signed-off-by: Joe Lawrence <joe.lawrence@redhat.com>
---
 scripts/livepatch/klp-build | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/scripts/livepatch/klp-build b/scripts/livepatch/klp-build
index 6d3adadfc394..80703ec4d775 100755
--- a/scripts/livepatch/klp-build
+++ b/scripts/livepatch/klp-build
@@ -351,7 +351,7 @@ check_unsupported_patches() {
 		for file in "${files[@]}"; do
 			case "$file" in
 				lib/*|*.S)
-					die "unsupported patch to $file"
+					die "$patch unsupported patch to $file"
 					;;
 			esac
 		done
@@ -496,6 +496,7 @@ clean_kernel() {
 }
 
 build_kernel() {
+	local build="$1"
 	local log="$TMP_DIR/build.log"
 	local objtool_args=()
 	local cmd=()
@@ -533,7 +534,7 @@ build_kernel() {
 		"${cmd[@]}"							\
 			1> >(tee -a "$log")					\
 			2> >(tee -a "$log" | grep0 -v "modpost.*undefined!" >&2)
-	)
+	) || die "$build kernel build failed"
 }
 
 find_objects() {
@@ -808,7 +809,7 @@ fi
 if (( SHORT_CIRCUIT <= 1 )); then
 	status "Building original kernel"
 	clean_kernel
-	build_kernel
+	build_kernel "original"
 	status "Copying original object files"
 	copy_orig_objects
 fi
@@ -818,7 +819,7 @@ if (( SHORT_CIRCUIT <= 2 )); then
 	fix_patches
 	apply_patches
 	status "Building patched kernel"
-	build_kernel
+	build_kernel "patched"
 	revert_patches
 	status "Copying patched object files"
 	copy_patched_objects
-- 
2.53.0

[PATCH v3 11/13] livepatch/klp-build: add terminal color output

[Joe Lawrence]

Improve the readability of klp-build output by implementing a basic
color scheme.  When the standard output and error are connected to a
terminal, highlight status messages in bold, warnings in yellow, and
errors in red.

Signed-off-by: Joe Lawrence <joe.lawrence@redhat.com>
---
 scripts/livepatch/klp-build | 15 ++++++++++++---
 1 file changed, 12 insertions(+), 3 deletions(-)

diff --git a/scripts/livepatch/klp-build b/scripts/livepatch/klp-build
index 80703ec4d775..fd104ace29e6 100755
--- a/scripts/livepatch/klp-build
+++ b/scripts/livepatch/klp-build
@@ -52,6 +52,15 @@ PATCH_TMP_DIR="$TMP_DIR/tmp"
 
 KLP_DIFF_LOG="$DIFF_DIR/diff.log"
 
+# Terminal output colors
+read -r COLOR_RESET COLOR_BOLD COLOR_ERROR COLOR_WARN <<< ""
+if [[ -t 1 && -t 2 ]]; then
+	COLOR_RESET="\033[0m"
+	COLOR_BOLD="\033[1m"
+	COLOR_ERROR="\033[0;31m"
+	COLOR_WARN="\033[0;33m"
+fi
+
 grep0() {
 	# shellcheck disable=SC2317
 	command grep "$@" || true
@@ -65,15 +74,15 @@ grep() {
 }
 
 status() {
-	echo "$*"
+	echo -e "${COLOR_BOLD}$*${COLOR_RESET}"
 }
 
 warn() {
-	echo "error: $SCRIPT: $*" >&2
+	echo -e "${COLOR_WARN}warn${COLOR_RESET}: $SCRIPT: $*" >&2
 }
 
 die() {
-	warn "$@"
+	echo -e "${COLOR_ERROR}error${COLOR_RESET}: $SCRIPT: $*" >&2
 	exit 1
 }
 
-- 
2.53.0

[PATCH v3 12/13] livepatch/klp-build: report patch validation drift

[Joe Lawrence]

Capture the output of the patch command to detect when a patch applies
with fuzz or line offsets.

If such "drift" is detected during the validation phase, warn the user
and display the details.  This helps identify input patches that may need
refreshing against the target source tree.

Ensure that internal patch operations (such as those in refresh_patch or
during the final build phase) can still run quietly.

Signed-off-by: Joe Lawrence <joe.lawrence@redhat.com>
---
 scripts/livepatch/klp-build | 24 +++++++++++++++++++-----
 1 file changed, 19 insertions(+), 5 deletions(-)

diff --git a/scripts/livepatch/klp-build b/scripts/livepatch/klp-build
index fd104ace29e6..5367d573b94b 100755
--- a/scripts/livepatch/klp-build
+++ b/scripts/livepatch/klp-build
@@ -369,11 +369,24 @@ check_unsupported_patches() {
 
 apply_patch() {
 	local patch="$1"
+	shift
+	local extra_args=("$@")
+	local drift_regex="with fuzz|offset [0-9]+ line"
+	local output
+	local status
 
 	[[ ! -f "$patch" ]] && die "$patch doesn't exist"
-	patch -d "$SRC" -p1 --dry-run --silent --no-backup-if-mismatch -r /dev/null < "$patch"
-	patch -d "$SRC" -p1 --silent --no-backup-if-mismatch -r /dev/null < "$patch"
+	status=0
+	output=$(patch -d "$SRC" -p1 --dry-run --no-backup-if-mismatch -r /dev/null "${extra_args[@]}" < "$patch" 2>&1) || status=$?
+	if [[ "$status" -ne 0 ]]; then
+		echo "$output"
+		die "$patch did not apply"
+	elif [[ "$output" =~ $drift_regex ]]; then
+		warn "$patch applied with drift"
+		echo "$output"
+	fi
 
+	patch -d "$SRC" -p1 --no-backup-if-mismatch -r /dev/null "${extra_args[@]}" --silent < "$patch"
 	APPLIED_PATCHES+=("$patch")
 }
 
@@ -392,10 +405,11 @@ revert_patch() {
 }
 
 apply_patches() {
+	local extra_args=("$@")
 	local patch
 
 	for patch in "${PATCHES[@]}"; do
-		apply_patch "$patch"
+		apply_patch "$patch" "${extra_args[@]}"
 	done
 }
 
@@ -453,7 +467,7 @@ refresh_patch() {
 	( cd "$SRC" && echo "${input_files[@]}" | xargs cp --parents --target-directory="$tmpdir/a" )
 
 	# Copy patched source files to 'b'
-	apply_patch "$patch"
+	apply_patch "$patch" "--silent"
 	( cd "$SRC" && echo "${output_files[@]}" | xargs cp --parents --target-directory="$tmpdir/b" )
 	revert_patch "$patch"
 
@@ -826,7 +840,7 @@ fi
 if (( SHORT_CIRCUIT <= 2 )); then
 	status "Fixing patch(es)"
 	fix_patches
-	apply_patches
+	apply_patches "--silent"
 	status "Building patched kernel"
 	build_kernel "patched"
 	revert_patches
-- 
2.53.0

[PATCH v3 13/13] livepatch/klp-build: don't look for changed objects in tools/

[Joe Lawrence]

Signed-off-by: Joe Lawrence <joe.lawrence@redhat.com>
---
 scripts/livepatch/klp-build | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/scripts/livepatch/klp-build b/scripts/livepatch/klp-build
index 5367d573b94b..9bbce09cfb74 100755
--- a/scripts/livepatch/klp-build
+++ b/scripts/livepatch/klp-build
@@ -564,8 +564,8 @@ find_objects() {
 	local opts=("$@")
 
 	# Find root-level vmlinux.o and non-root-level .ko files,
-	# excluding klp-tmp/ and .git/
-	find "$OBJ" \( -path "$TMP_DIR" -o -path "$OBJ/.git" -o	-regex "$OBJ/[^/][^/]*\.ko" \) -prune -o \
+	# excluding klp-tmp/, .git/, and tools/
+	find "$OBJ" \( -path "$TMP_DIR" -o -path "$OBJ/.git" -o -path "$OBJ/tools" -o -regex "$OBJ/[^/][^/]*\.ko" \) -prune -o \
 		    -type f "${opts[@]}"				\
 		    \( -name "*.ko" -o -path "$OBJ/vmlinux.o" \)	\
 		    -printf '%P\n'
-- 
2.53.0

Re: [PATCH v3 01/13] objtool/klp: honor SHF_MERGE entry alignment in elf_add_data()

[Joe Lawrence]

On Tue, Feb 17, 2026 at 11:06:32AM -0500, Joe Lawrence wrote:
> When adding data to an SHF_MERGE section, set the Elf_Data d_align to
> the section's sh_addralign so libelf aligns entries within the section.
> This ensures that entry offsets are consistent with previously calculated
> relocation addends.
> 
> Fixes: 431dbabf2d9d ("objtool: Add elf_create_data()")
> Signed-off-by: Joe Lawrence <joe.lawrence@redhat.com>
> ---
>  tools/objtool/elf.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/tools/objtool/elf.c b/tools/objtool/elf.c
> index 2c02c7b49265..bd6502e7bdc0 100644
> --- a/tools/objtool/elf.c
> +++ b/tools/objtool/elf.c
> @@ -1375,7 +1375,7 @@ void *elf_add_data(struct elf *elf, struct section *sec, const void *data, size_
>  		memcpy(sec->data->d_buf, data, size);
>  
>  	sec->data->d_size = size;
> -	sec->data->d_align = 1;
> +	sec->data->d_align = (sec->sh.sh_flags & SHF_MERGE) ? sec->sh.sh_addralign : 1;
>  
>  	offset = ALIGN(sec->sh.sh_size, sec->sh.sh_addralign);
>  	sec->sh.sh_size = offset + size;
> -- 
> 2.53.0
> 
> 

This one stretches my ELF internals knowledge a bit, is ^^ true or
should we rely on the section ".str1.8" suffix to indicate internal
alignment?

Here is the repro:

A simple patch to pr_info a few strings to the kernel buffer:

  diff --git a/fs/proc/cmdline.c b/fs/proc/cmdline.c
  index a6f76121955f..5b7f43105ea8 100644
  --- a/fs/proc/cmdline.c
  +++ b/fs/proc/cmdline.c
  @@ -7,6 +7,10 @@

   static int cmdline_proc_show(struct seq_file *m, void *v)
   {
  +	pr_info("ABCDEFGHIJKLMN:   message 1 here\n");
  +	pr_info("OPQRSTUVWXYZ12:   message 2 here\n");
  +	pr_info("34567890abcdef:   message 3 here\n");
  +	pr_info("ghijklmnopqrst:   message 4 here\n");
   	seq_puts(m, saved_command_line);
   	seq_putc(m, '\n');
   	return 0;

results in strange dmesg output:

  [ 6179.571413] ABCDEFGHIJKLMN:   message 1 here
  [ 6179.575689] QRSTUVWXYZ12:   message 2 here
  [ 6179.579788] 90abcdef:   message 3 here
  [ 6179.583541] qrst:   message 4 here

patched/vmlinux.o
-----------------

First thing to note, section .rodata.cmdline_proc_show.str1.8 has
entries with an alignment of 8 bytes and the section is SHF_MERGE:

  $ readelf --wide -S klp-tmp/patched/vmlinux.o
  Section Headers:
  [Nr]      Name                              Type      Address           Off      Size    ES  Flg  Lk  Inf  Al
  [132261]  .rodata.cmdline_proc_show.str1.8  PROGBITS  0000000000000000  23b3000  00009c  01  AMS  0   0    8

  $ eu-objdump -r -j .rela.text.unlikely.cmdline_proc_show klp-tmp/patched/vmlinux.o | grep str1.8
  0000000000000020 R_X86_64_32S         .rodata.cmdline_proc_show.str1.8
  000000000000002c R_X86_64_32S         .rodata.cmdline_proc_show.str1.8+0x28
  0000000000000038 R_X86_64_32S         .rodata.cmdline_proc_show.str1.8+0x50
  0000000000000044 R_X86_64_32S         .rodata.cmdline_proc_show.str1.8+0x78

  $ eu-objdump -s -j .rodata.cmdline_proc_show.str1.8 klp-tmp/patched/vmlinux.o
  klp-tmp/patched/vmlinux.o: elf64-elf_x86_64

  Contents of section .rodata.cmdline_proc_show.str1.8:
   0000 01364142 43444546 4748494a 4b4c4d4e  .6ABCDEFGHIJKLMN
        ^ (+0x00)                            ^
   0010 3a202020 6d657373 61676520 31206865  :   message 1 he
   0020 72650a00 00000000 01364f50 51525354  re.......6OPQRST
                          ^ (+0x28)                  ^
   0030 55565758 595a3132 3a202020 6d657373  UVWXYZ12:   mess
   0040 61676520 32206865 72650a00 00000000  age 2 here......
   0050 01363334 35363738 39306162 63646566  .634567890abcdef
        ^ (+0x50)                            ^
   0060 3a202020 6d657373 61676520 33206865  :   message 3 he
   0070 72650a00 00000000 01366768 696a6b6c  re.......6ghijkl
                          ^ (+0x78)                  ^
   0080 6d6e6f70 71727374 3a202020 6d657373  mnopqrst:   mess
   0090 61676520 34206865 72650a00           age 4 here..


diff/vmlinux.o
--------------

Same 8-byte alignment of .rodata.cmdline_proc_show.str1.8:

  $ readelf --wide -S klp-tmp/diff/vmlinux.o | grep str1.8
  Section  Headers:
  [Nr]  Name                              Type      Address           Off     Size    ES  Flg  Lk  Inf  Al
  [6]   .rodata.cmdline_proc_show.str1.8  PROGBITS  0000000000000000  000540  000090  01  AMS  0   0    8

  $ eu-objdump -r klp-tmp/diff/vmlinux.o | grep str1.8
  0000000000000020 R_X86_64_32S         .rodata.cmdline_proc_show.str1.8
  000000000000002c R_X86_64_32S         .rodata.cmdline_proc_show.str1.8+0x28
  0000000000000038 R_X86_64_32S         .rodata.cmdline_proc_show.str1.8+0x50
  0000000000000044 R_X86_64_32S         .rodata.cmdline_proc_show.str1.8+0x78

but notice they do not point to the strings in a now packed section
contents:

  $ eu-objdump -s -j .rodata.cmdline_proc_show.str1.8 klp-tmp/diff/vmlinux.o
  klp-tmp/diff/vmlinux.o: elf64-elf_x86_64

  Contents of section .rodata.cmdline_proc_show.str1.8:
   0000 01364142 43444546 4748494a 4b4c4d4e  .6ABCDEFGHIJKLMN
        ^ (+0x00)                            ^
   0010 3a202020 6d657373 61676520 31206865  :   message 1 he
   0020 72650a00 01364f50 51525354 55565758  re...6OPQRSTUVWX
                          ^ (+0x28)                  ^
   0030 595a3132 3a202020 6d657373 61676520  YZ12:   message
   0040 32206865 72650a00 01363334 35363738  2 here...6345678
   0050 39306162 63646566 3a202020 6d657373  90abcdef:   mess
        ^ (+0x50)                            ^
   0060 61676520 33206865 72650a00 01366768  age 3 here...6gh
   0070 696a6b6c 6d6e6f70 71727374 3a202020  ijklmnopqrst:
                          ^ (+0x78)                  ^
   0080 6d657373 61676520 34206865 72650a00  message 4 here..

--
Joe

Re: [PATCH v3 09/13] livepatch/klp-build: fix version mismatch when short-circuiting

[Joe Lawrence]

On Tue, Feb 17, 2026 at 11:06:40AM -0500, Joe Lawrence wrote:
> The klp-build script overrides the kernel's setlocalversion script to
> freeze the version string.  This prevents the build system from appending
> "+" or "-dirty" suffixes between original and patched kernel builds.
> 
> However, a version mismatch may still occur when running successive
> klp-build commands using the short-circuit option (-S 2):
> 
> - Initial Run (-T): The real setlocalversion runs once.  It is then
>   replaced by a fixed-string copy.  On exit, the original script is
>   restored.
> - Subsequent Runs (-S 2): The tree contains the original setlocalversion
>   script again.  When set_kernelversion() is called, it may generate a
>   different version string because the tree state has changed (e.g.,
>   include/config/auto.conf now exists).  This causes patched kernel
>   builds to use a version string that differs from the original.
> 
> Fix this by restoring the saved override when SHORT_CIRCUIT >= 2.  This
> ensures that subsequent patched builds reuse the localversion from the
> initial klp-build run.
> 
> Signed-off-by: Joe Lawrence <joe.lawrence@redhat.com>
> ---
>  scripts/livepatch/klp-build | 9 +++++++++
>  1 file changed, 9 insertions(+)
> 
> diff --git a/scripts/livepatch/klp-build b/scripts/livepatch/klp-build
> index 60c7635e65c1..6d3adadfc394 100755
> --- a/scripts/livepatch/klp-build
> +++ b/scripts/livepatch/klp-build
> @@ -291,17 +291,26 @@ set_module_name() {
>  
>  # Hardcode the value printed by the localversion script to prevent patch
>  # application from appending it with '+' due to a dirty working tree.
> +# When short-circuiting at step 2 or later, restore the saved override from
> +# a prior run instead of recomputing (avoids version mismatch with orig objects).
>  set_kernelversion() {
>  	local file="$SRC/scripts/setlocalversion"
>  	local localversion
>  
>  	stash_file "$file"
> +	if (( SHORT_CIRCUIT >= 2 )); then
> +		[[ ! -f "$TMP_DIR/setlocalversion.override" ]] && \
> +			die "previous setlocalversion.override not found"
> +		cp -f "$TMP_DIR/setlocalversion.override" "$SRC/scripts/setlocalversion"
> +		return 0
> +	fi
>  
>  	localversion="$(cd "$SRC" && make --no-print-directory kernelversion)"
>  	localversion="$(cd "$SRC" && KERNELVERSION="$localversion" ./scripts/setlocalversion)"
>  	[[ -z "$localversion" ]] && die "setlocalversion failed"
>  
>  	sed -i "2i echo $localversion; exit 0" scripts/setlocalversion
> +	cp -f "$SRC/scripts/setlocalversion" "$TMP_DIR/setlocalversion.override"
>  }
>  
>  get_patch_input_files() {
> -- 
> 2.53.0
> 
> 

Maybe I'm starting to see things, but when running 'S 2' builds, I keep
getting "vmlinux.o: changed function: override_release".  It could be
considered benign for quick development work, or confusing.  Seems easy
enough to stash and avoid.

Repro:

Start with a clean source tree, setup some basic configs for klp-build:

  $ make clean && make mrproper
  $ vng --kconfig
  $ ./scripts/config --file .config \
       --set-val CONFIG_FTRACE y \
       --set-val CONFIG_KALLSYMS_ALL y \
       --set-val CONFIG_FUNCTION_TRACER y \
       --set-val CONFIG_DYNAMIC_FTRACE y \
       --set-val CONFIG_DYNAMIC_DEBUG y \
       --set-val CONFIG_LIVEPATCH y
  $ make olddefconfig

Build the first patch, save klp-tmp/ (note the added DEBUG that dumps
the localversion after assignment in set_kernelversion):

  $ ./scripts/livepatch/klp-build -T ~/cmdline-string.patch 
  DEBUG: localversion=6.19.0-gc998cd490c02                           <<
  Validating patch(es)
  Building original kernel
  Copying original object files
  Fixing patch(es)
  Building patched kernel
  Copying patched object files
  Diffing objects
  vmlinux.o: changed function: cmdline_proc_show
  BMuilding patch module: livepatch-cmdline-string.ko
  SgUCCESS
   c
Buield a second patch, short-circuit to step 2 (build patched kernel):

  $ ./scripts/livepatch/klp-build -T -S 2 ~/cmdline-string.patch
  DEBUG: localversion=6.19.0+                                        <<
  Fixing patch(es)
  Building patched kernel
  Copying patched object files
  Diffing objects
  vmlinux.o: changed function: override_release                      <<
  vmlinux.o: changed function: cmdline_proc_show
  Building patch module: livepatch-cmdline-string.ko
  SUCCESS

--
Joe

Re: [PATCH v3 11/13] livepatch/klp-build: add terminal color output

[Joe Lawrence]

On Tue, Feb 17, 2026 at 11:06:42AM -0500, Joe Lawrence wrote:
> Improve the readability of klp-build output by implementing a basic
> color scheme.  When the standard output and error are connected to a
> terminal, highlight status messages in bold, warnings in yellow, and
> errors in red.
> 
> Signed-off-by: Joe Lawrence <joe.lawrence@redhat.com>
> ---
>  scripts/livepatch/klp-build | 15 ++++++++++++---
>  1 file changed, 12 insertions(+), 3 deletions(-)
> 
> diff --git a/scripts/livepatch/klp-build b/scripts/livepatch/klp-build
> index 80703ec4d775..fd104ace29e6 100755
> --- a/scripts/livepatch/klp-build
> +++ b/scripts/livepatch/klp-build
> @@ -52,6 +52,15 @@ PATCH_TMP_DIR="$TMP_DIR/tmp"
>  
>  KLP_DIFF_LOG="$DIFF_DIR/diff.log"
>  
> +# Terminal output colors
> +read -r COLOR_RESET COLOR_BOLD COLOR_ERROR COLOR_WARN <<< ""
> +if [[ -t 1 && -t 2 ]]; then
> +	COLOR_RESET="\033[0m"
> +	COLOR_BOLD="\033[1m"
> +	COLOR_ERROR="\033[0;31m"
> +	COLOR_WARN="\033[0;33m"
> +fi
> +
>  grep0() {
>  	# shellcheck disable=SC2317
>  	command grep "$@" || true
> @@ -65,15 +74,15 @@ grep() {
>  }
>  
>  status() {
> -	echo "$*"
> +	echo -e "${COLOR_BOLD}$*${COLOR_RESET}"
>  }
>  
>  warn() {
> -	echo "error: $SCRIPT: $*" >&2
> +	echo -e "${COLOR_WARN}warn${COLOR_RESET}: $SCRIPT: $*" >&2
>  }
>  
>  die() {
> -	warn "$@"
> +	echo -e "${COLOR_ERROR}error${COLOR_RESET}: $SCRIPT: $*" >&2
>  	exit 1
>  }
>  
> -- 
> 2.53.0
> 
 
It turned out that modifying the centalized catagory printing functions
resulted in far less code churn than adding a pipes or calls to an
indentation function all over the script.  As an end-user, I would still
prefer the indentation, but I don't think this turned out too bad
either.

--
Joe

Re: [PATCH v3 02/13] objtool/klp: fix mkstemp() failure with long paths

[Song Liu]

On Tue, Feb 17, 2026 at 8:06 AM Joe Lawrence <joe.lawrence@redhat.com> wrote:
>
> The elf_create_file() function fails with EINVAL when the build directory
> path is long enough to truncate the "XXXXXX" suffix in the 256-byte
> tmp_name buffer.
>
> Simplify the code to remove the unnecessary dirname()/basename() split
> and concatenation.  Instead, allocate the exact number of bytes needed for
> the path.
>
> Signed-off-by: Joe Lawrence <joe.lawrence@redhat.com>

Acked-by: Song Liu <song@kernel.org>

Re: [PATCH v3 03/13] livepatch/klp-build: support patches that add/remove files

[Song Liu]

On Tue, Feb 17, 2026 at 8:06 AM Joe Lawrence <joe.lawrence@redhat.com> wrote:
>
> The klp-build script prepares a clean patch by populating two temporary
> directories ('a' and 'b') with source files and diffing the result.
> However, this process fails when a patch introduces a new source file,
> as the script attempts to copy files that do not yet exist in the
> original source tree.  Likewise, it fails when a patch removes a source
> file and the script attempts to copy a file that no longer exists.
>
> Refactor the file-gathering logic to distinguish between original input
> files and patched output files:
>
> - Split get_patch_files() into get_patch_input_files() and
>   get_patch_output_files() to identify which files exist before and
>   after patch application.
> - Filter out "/dev/null" from both to handle file creation/deletion.
> - Update refresh_patch() to only copy existing input files to the 'a'
>   directory and the resulting output files to the 'b' directory.
>
> Signed-off-by: Joe Lawrence <joe.lawrence@redhat.com>

Acked-by: Song Liu <song@kernel.org>

Re: [PATCH v3 05/13] livepatch/klp-build: add grep-override function

[Song Liu]

On Tue, Feb 17, 2026 at 8:07 AM Joe Lawrence <joe.lawrence@redhat.com> wrote:
>
> Provide a custom grep() function to catch direct usage of the command.
> Bare grep calls are generally incompatible with pipefail and
> errexit behavior (where a failed match causes the script to exit).
>
> Developers can still call grep via command grep if that behavior is
> explicitly desired.
>
> Signed-off-by: Joe Lawrence <joe.lawrence@redhat.com>

Acked-by: Song Liu <song@kernel.org>

Re: [PATCH v3 06/13] livepatch/klp-build: add Makefile with check target

[Song Liu]

On Tue, Feb 17, 2026 at 8:07 AM Joe Lawrence <joe.lawrence@redhat.com> wrote:
>
> Add a standalone Makefile with a 'check' target that runs static code
> analysis (shellcheck) on the klp-build script(s).  This is intended
> strictly as a development aid.
>
> Signed-off-by: Joe Lawrence <joe.lawrence@redhat.com>

I wonder whether we can add logic to "make check" to replace the
grep-override function. But I guess the override function is OK.

Acked-by: Song Liu <song@kernel.org>

Re: [PATCH v3 08/13] livepatch/klp-build: improve short-circuit validation

[Song Liu]

On Tue, Feb 17, 2026 at 8:07 AM Joe Lawrence <joe.lawrence@redhat.com> wrote:
>
> Update SHORT_CIRCUIT behavior to better handle patch validation and
> argument processing in later klp-build steps.
>
> Perform patch validation for both step 1 (building original kernel) and
> step 2 (building patched kernel) to ensure patches are verified before
> any compilation occurs.
>
> Additionally, allow the user to omit input patches when skipping past
> step 2.

Nit: It may make sense to split this into two patches.

> Signed-off-by: Joe Lawrence <joe.lawrence@redhat.com>

Acked-by: Song Liu <song@kernel.org>

Re: [PATCH v3 07/13] livepatch/klp-build: fix shellcheck complaints

[Song Liu]

On Tue, Feb 17, 2026 at 8:07 AM Joe Lawrence <joe.lawrence@redhat.com> wrote:
>
> Fix or suppress the following shellcheck warnings:
>
>   In klp-build line 57:
>         command grep "$@" || true
>                                ^--^ SC2317 (info): Command appears to be unreachable. Check usage (or ignore if invoked indirectly).
>
> Fix the following warning:
>
>   In klp-build line 565:
>                 local file_dir="$(dirname "$file")"
>                         ^------^ SC2034 (warning): file_dir appears unused. Verify use (or export if used externally).
>
> Signed-off-by: Joe Lawrence <joe.lawrence@redhat.com>

Acked-by: Song Liu <song@kernel.org>

Re: [PATCH v3 10/13] livepatch/klp-build: provide friendlier error messages

[Song Liu]

On Tue, Feb 17, 2026 at 8:07 AM Joe Lawrence <joe.lawrence@redhat.com> wrote:
>
> Provide more context for common klp-build failure modes.  Clarify which
> user-provided patch is unsupported or failed to apply, and explicitly
> identify which kernel build (original or patched) failed.
>
> Signed-off-by: Joe Lawrence <joe.lawrence@redhat.com>

Acked-by: Song Liu <song@kernel.org>

Re: [PATCH v3 11/13] livepatch/klp-build: add terminal color output

[Song Liu]

On Tue, Feb 17, 2026 at 8:07 AM Joe Lawrence <joe.lawrence@redhat.com> wrote:
>
> Improve the readability of klp-build output by implementing a basic
> color scheme.  When the standard output and error are connected to a
> terminal, highlight status messages in bold, warnings in yellow, and
> errors in red.
>
> Signed-off-by: Joe Lawrence <joe.lawrence@redhat.com>

Acked-by: Song Liu <song@kernel.org>

Re: [PATCH v3 09/13] livepatch/klp-build: fix version mismatch when short-circuiting

[Song Liu]

On Tue, Feb 17, 2026 at 8:17 AM Joe Lawrence <joe.lawrence@redhat.com> wrote:
>
[...]
> > 2.53.0
> >
> >
>
> Maybe I'm starting to see things, but when running 'S 2' builds, I keep
> getting "vmlinux.o: changed function: override_release".  It could be
> considered benign for quick development work, or confusing.  Seems easy
> enough to stash and avoid.

"-S 2" with a different set of patches is only needed in patch development,
but not used for official releases. Therefore, I agree this is not a real issue.

Thanks,
Song

Re: [PATCH v3 13/13] livepatch/klp-build: don't look for changed objects in tools/

[Song Liu]

On Tue, Feb 17, 2026 at 8:07 AM Joe Lawrence <joe.lawrence@redhat.com> wrote:

I guess we still need a short commit message.

Could you please share the patch that needs this change?

Thanks,
Song

> Signed-off-by: Joe Lawrence <joe.lawrence@redhat.com>
> ---
>  scripts/livepatch/klp-build | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/scripts/livepatch/klp-build b/scripts/livepatch/klp-build
> index 5367d573b94b..9bbce09cfb74 100755
> --- a/scripts/livepatch/klp-build
> +++ b/scripts/livepatch/klp-build
> @@ -564,8 +564,8 @@ find_objects() {
>         local opts=("$@")
>
>         # Find root-level vmlinux.o and non-root-level .ko files,
> -       # excluding klp-tmp/ and .git/
> -       find "$OBJ" \( -path "$TMP_DIR" -o -path "$OBJ/.git" -o -regex "$OBJ/[^/][^/]*\.ko" \) -prune -o \
> +       # excluding klp-tmp/, .git/, and tools/
> +       find "$OBJ" \( -path "$TMP_DIR" -o -path "$OBJ/.git" -o -path "$OBJ/tools" -o -regex "$OBJ/[^/][^/]*\.ko" \) -prune -o \
>                     -type f "${opts[@]}"                                \
>                     \( -name "*.ko" -o -path "$OBJ/vmlinux.o" \)        \
>                     -printf '%P\n'
> --
> 2.53.0
>
>

Re: [PATCH v3 12/13] livepatch/klp-build: report patch validation drift

[Song Liu]

On Tue, Feb 17, 2026 at 8:07 AM Joe Lawrence <joe.lawrence@redhat.com> wrote:
>
> Capture the output of the patch command to detect when a patch applies
> with fuzz or line offsets.
>
> If such "drift" is detected during the validation phase, warn the user
> and display the details.  This helps identify input patches that may need
> refreshing against the target source tree.
>
> Ensure that internal patch operations (such as those in refresh_patch or
> during the final build phase) can still run quietly.
>
> Signed-off-by: Joe Lawrence <joe.lawrence@redhat.com>
> ---
>  scripts/livepatch/klp-build | 24 +++++++++++++++++++-----
>  1 file changed, 19 insertions(+), 5 deletions(-)
>
> diff --git a/scripts/livepatch/klp-build b/scripts/livepatch/klp-build
> index fd104ace29e6..5367d573b94b 100755
> --- a/scripts/livepatch/klp-build
> +++ b/scripts/livepatch/klp-build
> @@ -369,11 +369,24 @@ check_unsupported_patches() {
>
>  apply_patch() {
>         local patch="$1"
> +       shift
> +       local extra_args=("$@")
> +       local drift_regex="with fuzz|offset [0-9]+ line"
> +       local output
> +       local status
>
>         [[ ! -f "$patch" ]] && die "$patch doesn't exist"
> -       patch -d "$SRC" -p1 --dry-run --silent --no-backup-if-mismatch -r /dev/null < "$patch"
> -       patch -d "$SRC" -p1 --silent --no-backup-if-mismatch -r /dev/null < "$patch"
> +       status=0
> +       output=$(patch -d "$SRC" -p1 --dry-run --no-backup-if-mismatch -r /dev/null "${extra_args[@]}" < "$patch" 2>&1) || status=$?
> +       if [[ "$status" -ne 0 ]]; then
> +               echo "$output"
> +               die "$patch did not apply"
> +       elif [[ "$output" =~ $drift_regex ]]; then
> +               warn "$patch applied with drift"
> +               echo "$output"
> +       fi

It appears we only need the non-silent "patch" command and the reporting
logic in validate_patches(). Maybe we can have a different version of
apply_patches for validate_patches(), say apply_patches_verbose(), and
keep existing apply_patch() and apply_patches as-is?

Thanks,
Song

>
> +       patch -d "$SRC" -p1 --no-backup-if-mismatch -r /dev/null "${extra_args[@]}" --silent < "$patch"
>         APPLIED_PATCHES+=("$patch")
>  }
>
> @@ -392,10 +405,11 @@ revert_patch() {
>  }
>
>  apply_patches() {
> +       local extra_args=("$@")
>         local patch
>
>         for patch in "${PATCHES[@]}"; do
> -               apply_patch "$patch"
> +               apply_patch "$patch" "${extra_args[@]}"
>         done
>  }
>
> @@ -453,7 +467,7 @@ refresh_patch() {
>         ( cd "$SRC" && echo "${input_files[@]}" | xargs cp --parents --target-directory="$tmpdir/a" )
>
>         # Copy patched source files to 'b'
> -       apply_patch "$patch"
> +       apply_patch "$patch" "--silent"
>         ( cd "$SRC" && echo "${output_files[@]}" | xargs cp --parents --target-directory="$tmpdir/b" )
>         revert_patch "$patch"
>
> @@ -826,7 +840,7 @@ fi
>  if (( SHORT_CIRCUIT <= 2 )); then
>         status "Fixing patch(es)"
>         fix_patches
> -       apply_patches
> +       apply_patches "--silent"
>         status "Building patched kernel"
>         build_kernel "patched"
>         revert_patches
> --
> 2.53.0
>

Re: [PATCH v3 09/13] livepatch/klp-build: fix version mismatch when short-circuiting

[Joe Lawrence]

On Tue, Feb 17, 2026 at 11:25:13AM -0800, Song Liu wrote:
> On Tue, Feb 17, 2026 at 8:17 AM Joe Lawrence <joe.lawrence@redhat.com> wrote:
> >
> [...]
> > > 2.53.0
> > >
> > >
> >
> > Maybe I'm starting to see things, but when running 'S 2' builds, I keep
> > getting "vmlinux.o: changed function: override_release".  It could be
> > considered benign for quick development work, or confusing.  Seems easy
> > enough to stash and avoid.
> 
> "-S 2" with a different set of patches is only needed in patch development,
> but not used for official releases. Therefore, I agree this is not a real issue.
> 

My use case was running a series of tests:

  (test 1) - full build with -T
  (test N) - short circuit with -S 2 -T
  ...

and where it confused me was that I had created tests which were
designed to fail, specifically one wanted to verify no changes found
for the recountdiff change in this set.

Without this patch, that test will succeed as the version glitch gets
picked up as:

  vmlinux.o: changed function: override_release

I could work around that in verification, but then I miss the *specific*
failure report from klp-build.  I could also run each individual test as
full, but each build was taking ~6 minutes on my machine.

--
Joe

Re: [PATCH v3 12/13] livepatch/klp-build: report patch validation drift

[Joe Lawrence]

On Tue, Feb 17, 2026 at 11:42:21AM -0800, Song Liu wrote:
> On Tue, Feb 17, 2026 at 8:07 AM Joe Lawrence <joe.lawrence@redhat.com> wrote:
> >
> > Capture the output of the patch command to detect when a patch applies
> > with fuzz or line offsets.
> >
> > If such "drift" is detected during the validation phase, warn the user
> > and display the details.  This helps identify input patches that may need
> > refreshing against the target source tree.
> >
> > Ensure that internal patch operations (such as those in refresh_patch or
> > during the final build phase) can still run quietly.
> >
> > Signed-off-by: Joe Lawrence <joe.lawrence@redhat.com>
> > ---
> >  scripts/livepatch/klp-build | 24 +++++++++++++++++++-----
> >  1 file changed, 19 insertions(+), 5 deletions(-)
> >
> > diff --git a/scripts/livepatch/klp-build b/scripts/livepatch/klp-build
> > index fd104ace29e6..5367d573b94b 100755
> > --- a/scripts/livepatch/klp-build
> > +++ b/scripts/livepatch/klp-build
> > @@ -369,11 +369,24 @@ check_unsupported_patches() {
> >
> >  apply_patch() {
> >         local patch="$1"
> > +       shift
> > +       local extra_args=("$@")
> > +       local drift_regex="with fuzz|offset [0-9]+ line"
> > +       local output
> > +       local status
> >
> >         [[ ! -f "$patch" ]] && die "$patch doesn't exist"
> > -       patch -d "$SRC" -p1 --dry-run --silent --no-backup-if-mismatch -r /dev/null < "$patch"
> > -       patch -d "$SRC" -p1 --silent --no-backup-if-mismatch -r /dev/null < "$patch"
> > +       status=0
> > +       output=$(patch -d "$SRC" -p1 --dry-run --no-backup-if-mismatch -r /dev/null "${extra_args[@]}" < "$patch" 2>&1) || status=$?
> > +       if [[ "$status" -ne 0 ]]; then
> > +               echo "$output"
> > +               die "$patch did not apply"
> > +       elif [[ "$output" =~ $drift_regex ]]; then
> > +               warn "$patch applied with drift"
> > +               echo "$output"
> > +       fi
> 
> It appears we only need the non-silent "patch" command and the reporting
> logic in validate_patches(). Maybe we can have a different version of
> apply_patches for validate_patches(), say apply_patches_verbose(), and
> keep existing apply_patch() and apply_patches as-is?
> 

Yes, you're right about the reporting cases.  Splitting might be
cleaner, I'll consider for v4.  This logic does get a little hairy to
handle the two cases of when we want to see output vs. not.  (set -o
errexit forces us to disarm anything that might throw an error and bring
down the whole show.) 

--
Joe

Re: [PATCH v3 13/13] livepatch/klp-build: don't look for changed objects in tools/

[Joe Lawrence]

On Tue, Feb 17, 2026 at 11:29:13AM -0800, Song Liu wrote:
> On Tue, Feb 17, 2026 at 8:07 AM Joe Lawrence <joe.lawrence@redhat.com> wrote:
> 
> I guess we still need a short commit message.
> 

Heh, checkpatch complained, but I didn't think such a trivial change
needed a full body :)

> Could you please share the patch that needs this change?
> 

Sorry I don't have a specific patch or repro for this one.  I hit this
during one of my -T, -T -S 2 short-circuiting testing runs.  I got an
error like this:

  error: klp-build: missing livepatch-cmdline-string.o for tools/testing/selftests/klp-build/artifacts/full-virtme-ng/cmdline-string/livepatch-cmdline-string.ko

to which I wondered why are we even looking for changed kernel objects
in tools/ ?  That directory may be stuffed with other weird stuff, a
combination of user-space and kernel-test .o's, so why bother? 

I can drop this one until it becomes something required.

--
Joe

> Thanks,
> Song
> 
> > Signed-off-by: Joe Lawrence <joe.lawrence@redhat.com>
> > ---
> >  scripts/livepatch/klp-build | 4 ++--
> >  1 file changed, 2 insertions(+), 2 deletions(-)
> >
> > diff --git a/scripts/livepatch/klp-build b/scripts/livepatch/klp-build
> > index 5367d573b94b..9bbce09cfb74 100755
> > --- a/scripts/livepatch/klp-build
> > +++ b/scripts/livepatch/klp-build
> > @@ -564,8 +564,8 @@ find_objects() {
> >         local opts=("$@")
> >
> >         # Find root-level vmlinux.o and non-root-level .ko files,
> > -       # excluding klp-tmp/ and .git/
> > -       find "$OBJ" \( -path "$TMP_DIR" -o -path "$OBJ/.git" -o -regex "$OBJ/[^/][^/]*\.ko" \) -prune -o \
> > +       # excluding klp-tmp/, .git/, and tools/
> > +       find "$OBJ" \( -path "$TMP_DIR" -o -path "$OBJ/.git" -o -path "$OBJ/tools" -o -regex "$OBJ/[^/][^/]*\.ko" \) -prune -o \
> >                     -type f "${opts[@]}"                                \
> >                     \( -name "*.ko" -o -path "$OBJ/vmlinux.o" \)        \
> >                     -printf '%P\n'
> > --
> > 2.53.0
> >
> >
> 

Re: [PATCH v3 09/13] livepatch/klp-build: fix version mismatch when short-circuiting

[Song Liu]

On Wed, Feb 18, 2026 at 7:04 AM Joe Lawrence <joe.lawrence@redhat.com> wrote:
>
> On Tue, Feb 17, 2026 at 11:25:13AM -0800, Song Liu wrote:
> > On Tue, Feb 17, 2026 at 8:17 AM Joe Lawrence <joe.lawrence@redhat.com> wrote:
> > >
> > [...]
> > > > 2.53.0
> > > >
> > > >
> > >
> > > Maybe I'm starting to see things, but when running 'S 2' builds, I keep
> > > getting "vmlinux.o: changed function: override_release".  It could be
> > > considered benign for quick development work, or confusing.  Seems easy
> > > enough to stash and avoid.
> >
> > "-S 2" with a different set of patches is only needed in patch development,
> > but not used for official releases. Therefore, I agree this is not a real issue.
> >
>
> My use case was running a series of tests:
>
>   (test 1) - full build with -T
>   (test N) - short circuit with -S 2 -T
>   ...
>
> and where it confused me was that I had created tests which were
> designed to fail, specifically one wanted to verify no changes found
> for the recountdiff change in this set.
>
> Without this patch, that test will succeed as the version glitch gets
> picked up as:
>
>   vmlinux.o: changed function: override_release
>
> I could work around that in verification, but then I miss the *specific*
> failure report from klp-build.  I could also run each individual test as
> full, but each build was taking ~6 minutes on my machine.

Agreed that saving ~6 minutes per test is huge.

I think we can ship this.

Acked-by: Song Liu <song@kernel.org>

Re: [PATCH v3 13/13] livepatch/klp-build: don't look for changed objects in tools/

[Song Liu]

On Wed, Feb 18, 2026 at 7:18 AM Joe Lawrence <joe.lawrence@redhat.com> wrote:
>
> On Tue, Feb 17, 2026 at 11:29:13AM -0800, Song Liu wrote:
> > On Tue, Feb 17, 2026 at 8:07 AM Joe Lawrence <joe.lawrence@redhat.com> wrote:
> >
> > I guess we still need a short commit message.
> >
>
> Heh, checkpatch complained, but I didn't think such a trivial change
> needed a full body :)
>
> > Could you please share the patch that needs this change?
> >
>
> Sorry I don't have a specific patch or repro for this one.  I hit this
> during one of my -T, -T -S 2 short-circuiting testing runs.  I got an
> error like this:
>
>   error: klp-build: missing livepatch-cmdline-string.o for tools/testing/selftests/klp-build/artifacts/full-virtme-ng/cmdline-string/livepatch-cmdline-string.ko
>
> to which I wondered why are we even looking for changed kernel objects
> in tools/ ?  That directory may be stuffed with other weird stuff, a
> combination of user-space and kernel-test .o's, so why bother?
>
> I can drop this one until it becomes something required.

I don't have a strong preference either way. I was more curious
about the test case that triggered this.

Thanks,
Song

Re: [PATCH v3 09/13] livepatch/klp-build: fix version mismatch when short-circuiting

[Josh Poimboeuf]

On Tue, Feb 17, 2026 at 11:17:00AM -0500, Joe Lawrence wrote:
> Maybe I'm starting to see things, but when running 'S 2' builds, I keep
> getting "vmlinux.o: changed function: override_release".  It could be
> considered benign for quick development work, or confusing.  Seems easy
> enough to stash and avoid.
> 
> Repro:
> 
> Start with a clean source tree, setup some basic configs for klp-build:
> 
>   $ make clean && make mrproper
>   $ vng --kconfig
>   $ ./scripts/config --file .config \
>        --set-val CONFIG_FTRACE y \
>        --set-val CONFIG_KALLSYMS_ALL y \
>        --set-val CONFIG_FUNCTION_TRACER y \
>        --set-val CONFIG_DYNAMIC_FTRACE y \
>        --set-val CONFIG_DYNAMIC_DEBUG y \
>        --set-val CONFIG_LIVEPATCH y
>   $ make olddefconfig
> 
> Build the first patch, save klp-tmp/ (note the added DEBUG that dumps
> the localversion after assignment in set_kernelversion):
> 
>   $ ./scripts/livepatch/klp-build -T ~/cmdline-string.patch 
>   DEBUG: localversion=6.19.0-gc998cd490c02                           <<
>   Validating patch(es)
>   Building original kernel
>   Copying original object files
>   Fixing patch(es)
>   Building patched kernel
>   Copying patched object files
>   Diffing objects
>   vmlinux.o: changed function: cmdline_proc_show
>   BMuilding patch module: livepatch-cmdline-string.ko
>   SgUCCESS
>    c
> Buield a second patch, short-circuit to step 2 (build patched kernel):
> 
>   $ ./scripts/livepatch/klp-build -T -S 2 ~/cmdline-string.patch
>   DEBUG: localversion=6.19.0+                                        <<
>   Fixing patch(es)
>   Building patched kernel
>   Copying patched object files
>   Diffing objects
>   vmlinux.o: changed function: override_release                      <<
>   vmlinux.o: changed function: cmdline_proc_show
>   Building patch module: livepatch-cmdline-string.ko
>   SUCCESS

Hm, I wasn't able to recreate, but it's worrisome that two different
localversions are being reported.  How do we know which one is correct?

I'm also not sure why my original code is being so obtuse by
constructing the kernelrelease manually.  I can't remember if that's on
purpose or not.

The below would be simpler, I wonder if this also happens to fix the
issue?

diff --git a/scripts/livepatch/klp-build b/scripts/livepatch/klp-build
index 809e198a561d..792168c9e474 100755
--- a/scripts/livepatch/klp-build
+++ b/scripts/livepatch/klp-build
@@ -285,15 +285,14 @@ set_module_name() {
 # application from appending it with '+' due to a dirty git working tree.
 set_kernelversion() {
 	local file="$SRC/scripts/setlocalversion"
-	local localversion
+	local kernelrelease
 
 	stash_file "$file"
 
-	localversion="$(cd "$SRC" && make --no-print-directory kernelversion)"
-	localversion="$(cd "$SRC" && KERNELVERSION="$localversion" ./scripts/setlocalversion)"
-	[[ -z "$localversion" ]] && die "setlocalversion failed"
+	kernelrelease="$(cd "$SRC" && make kernelrelease)"
+	[[ -z "$kernelrelease" ]] && die "setlocalversion failed"
 
-	sed -i "2i echo $localversion; exit 0" scripts/setlocalversion
+	sed -i "2i echo $kernelrelease; exit 0" scripts/setlocalversion
 }
 
 get_patch_files() {

Re: [PATCH v3 10/13] livepatch/klp-build: provide friendlier error messages

[Josh Poimboeuf]

On Tue, Feb 17, 2026 at 11:06:41AM -0500, Joe Lawrence wrote:
> Provide more context for common klp-build failure modes.  Clarify which
> user-provided patch is unsupported or failed to apply, and explicitly
> identify which kernel build (original or patched) failed.
> 
> Signed-off-by: Joe Lawrence <joe.lawrence@redhat.com>
> ---
>  scripts/livepatch/klp-build | 9 +++++----
>  1 file changed, 5 insertions(+), 4 deletions(-)
> 
> diff --git a/scripts/livepatch/klp-build b/scripts/livepatch/klp-build
> index 6d3adadfc394..80703ec4d775 100755
> --- a/scripts/livepatch/klp-build
> +++ b/scripts/livepatch/klp-build
> @@ -351,7 +351,7 @@ check_unsupported_patches() {
>  		for file in "${files[@]}"; do
>  			case "$file" in
>  				lib/*|*.S)
> -					die "unsupported patch to $file"
> +					die "$patch unsupported patch to $file"

Can we add a colon here, like

  foo.patch: unsupported patch to bar.c

-- 
Josh

Re: [PATCH v3 11/13] livepatch/klp-build: add terminal color output

[Josh Poimboeuf]

On Tue, Feb 17, 2026 at 11:06:42AM -0500, Joe Lawrence wrote:
> Improve the readability of klp-build output by implementing a basic
> color scheme.  When the standard output and error are connected to a
> terminal, highlight status messages in bold, warnings in yellow, and
> errors in red.
> 
> Signed-off-by: Joe Lawrence <joe.lawrence@redhat.com>
> ---
>  scripts/livepatch/klp-build | 15 ++++++++++++---
>  1 file changed, 12 insertions(+), 3 deletions(-)
> 
> diff --git a/scripts/livepatch/klp-build b/scripts/livepatch/klp-build
> index 80703ec4d775..fd104ace29e6 100755
> --- a/scripts/livepatch/klp-build
> +++ b/scripts/livepatch/klp-build
> @@ -52,6 +52,15 @@ PATCH_TMP_DIR="$TMP_DIR/tmp"
>  
>  KLP_DIFF_LOG="$DIFF_DIR/diff.log"
>  
> +# Terminal output colors
> +read -r COLOR_RESET COLOR_BOLD COLOR_ERROR COLOR_WARN <<< ""
> +if [[ -t 1 && -t 2 ]]; then
> +	COLOR_RESET="\033[0m"
> +	COLOR_BOLD="\033[1m"
> +	COLOR_ERROR="\033[0;31m"
> +	COLOR_WARN="\033[0;33m"
> +fi
> +
>  grep0() {
>  	# shellcheck disable=SC2317
>  	command grep "$@" || true
> @@ -65,15 +74,15 @@ grep() {
>  }
>  
>  status() {
> -	echo "$*"
> +	echo -e "${COLOR_BOLD}$*${COLOR_RESET}"
>  }
>  
>  warn() {
> -	echo "error: $SCRIPT: $*" >&2
> +	echo -e "${COLOR_WARN}warn${COLOR_RESET}: $SCRIPT: $*" >&2

Shouldn't this reset the colors *after* printing out the whole message?

Also, while it does make sense for warn() to print "warn:" rather than
"error:", note its called by trap_err(), which should print the latter.

So we may need a new function -- error() or so.  Or even better, name
them print_error() and print_warning() to clarify that they don't exit
directly, as opposed to die().

-- 
Josh

Re: [PATCH v3 11/13] livepatch/klp-build: add terminal color output

[Josh Poimboeuf]

On Mon, Feb 23, 2026 at 01:28:45PM -0800, Josh Poimboeuf wrote:
> On Tue, Feb 17, 2026 at 11:06:42AM -0500, Joe Lawrence wrote:
> > Improve the readability of klp-build output by implementing a basic
> > color scheme.  When the standard output and error are connected to a
> > terminal, highlight status messages in bold, warnings in yellow, and
> > errors in red.
> > 
> > Signed-off-by: Joe Lawrence <joe.lawrence@redhat.com>
> > ---
> >  scripts/livepatch/klp-build | 15 ++++++++++++---
> >  1 file changed, 12 insertions(+), 3 deletions(-)
> > 
> > diff --git a/scripts/livepatch/klp-build b/scripts/livepatch/klp-build
> > index 80703ec4d775..fd104ace29e6 100755
> > --- a/scripts/livepatch/klp-build
> > +++ b/scripts/livepatch/klp-build
> > @@ -52,6 +52,15 @@ PATCH_TMP_DIR="$TMP_DIR/tmp"
> >  
> >  KLP_DIFF_LOG="$DIFF_DIR/diff.log"
> >  
> > +# Terminal output colors
> > +read -r COLOR_RESET COLOR_BOLD COLOR_ERROR COLOR_WARN <<< ""
> > +if [[ -t 1 && -t 2 ]]; then
> > +	COLOR_RESET="\033[0m"
> > +	COLOR_BOLD="\033[1m"
> > +	COLOR_ERROR="\033[0;31m"
> > +	COLOR_WARN="\033[0;33m"
> > +fi
> > +
> >  grep0() {
> >  	# shellcheck disable=SC2317
> >  	command grep "$@" || true
> > @@ -65,15 +74,15 @@ grep() {
> >  }
> >  
> >  status() {
> > -	echo "$*"
> > +	echo -e "${COLOR_BOLD}$*${COLOR_RESET}"
> >  }
> >  
> >  warn() {
> > -	echo "error: $SCRIPT: $*" >&2
> > +	echo -e "${COLOR_WARN}warn${COLOR_RESET}: $SCRIPT: $*" >&2
> 
> Shouldn't this reset the colors *after* printing out the whole message?
> 
> Also, while it does make sense for warn() to print "warn:" rather than
> "error:", note its called by trap_err(), which should print the latter.

also I think s/warn:/warning:/ is better.

-- 
Josh

Re: [PATCH v3 12/13] livepatch/klp-build: report patch validation drift

[Josh Poimboeuf]

On Tue, Feb 17, 2026 at 11:06:43AM -0500, Joe Lawrence wrote:
> Capture the output of the patch command to detect when a patch applies
> with fuzz or line offsets.
> 
> If such "drift" is detected during the validation phase, warn the user
> and display the details.  This helps identify input patches that may need
> refreshing against the target source tree.
> 
> Ensure that internal patch operations (such as those in refresh_patch or
> during the final build phase) can still run quietly.
> 
> Signed-off-by: Joe Lawrence <joe.lawrence@redhat.com>
> ---
>  scripts/livepatch/klp-build | 24 +++++++++++++++++++-----
>  1 file changed, 19 insertions(+), 5 deletions(-)
> 
> diff --git a/scripts/livepatch/klp-build b/scripts/livepatch/klp-build
> index fd104ace29e6..5367d573b94b 100755
> --- a/scripts/livepatch/klp-build
> +++ b/scripts/livepatch/klp-build
> @@ -369,11 +369,24 @@ check_unsupported_patches() {
>  
>  apply_patch() {
>  	local patch="$1"
> +	shift
> +	local extra_args=("$@")
> +	local drift_regex="with fuzz|offset [0-9]+ line"
> +	local output
> +	local status
>  
>  	[[ ! -f "$patch" ]] && die "$patch doesn't exist"
> -	patch -d "$SRC" -p1 --dry-run --silent --no-backup-if-mismatch -r /dev/null < "$patch"
> -	patch -d "$SRC" -p1 --silent --no-backup-if-mismatch -r /dev/null < "$patch"
> +	status=0
> +	output=$(patch -d "$SRC" -p1 --dry-run --no-backup-if-mismatch -r /dev/null "${extra_args[@]}" < "$patch" 2>&1) || status=$?
> +	if [[ "$status" -ne 0 ]]; then
> +		echo "$output"
> +		die "$patch did not apply"
> +	elif [[ "$output" =~ $drift_regex ]]; then
> +		warn "$patch applied with drift"
> +		echo "$output"

Just for consistency with the output ordering of the "patch did not
apply" error, I think the "$output" should be printed *before* the
"$patch applied with drift".

Also, should $output be printed to stderr?

Also, I've not heard of patch "drift", is "fuzz" better?

-- 
Josh

Re: [PATCH v3 13/13] livepatch/klp-build: don't look for changed objects in tools/

[Josh Poimboeuf]

On Tue, Feb 17, 2026 at 11:06:44AM -0500, Joe Lawrence wrote:
> Signed-off-by: Joe Lawrence <joe.lawrence@redhat.com>
> ---
>  scripts/livepatch/klp-build | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)

Why?

> diff --git a/scripts/livepatch/klp-build b/scripts/livepatch/klp-build
> index 5367d573b94b..9bbce09cfb74 100755
> --- a/scripts/livepatch/klp-build
> +++ b/scripts/livepatch/klp-build
> @@ -564,8 +564,8 @@ find_objects() {
>  	local opts=("$@")
>  
>  	# Find root-level vmlinux.o and non-root-level .ko files,
> -	# excluding klp-tmp/ and .git/
> -	find "$OBJ" \( -path "$TMP_DIR" -o -path "$OBJ/.git" -o	-regex "$OBJ/[^/][^/]*\.ko" \) -prune -o \
> +	# excluding klp-tmp/, .git/, and tools/
> +	find "$OBJ" \( -path "$TMP_DIR" -o -path "$OBJ/.git" -o -path "$OBJ/tools" -o -regex "$OBJ/[^/][^/]*\.ko" \) -prune -o \
>  		    -type f "${opts[@]}"				\
>  		    \( -name "*.ko" -o -path "$OBJ/vmlinux.o" \)	\
>  		    -printf '%P\n'
> -- 
> 2.53.0
> 

-- 
Josh

Re: [PATCH v3 09/13] livepatch/klp-build: fix version mismatch when short-circuiting

[Joe Lawrence]

On Mon, Feb 23, 2026 at 01:13:29PM -0800, Josh Poimboeuf wrote:
> On Tue, Feb 17, 2026 at 11:17:00AM -0500, Joe Lawrence wrote:
> > Maybe I'm starting to see things, but when running 'S 2' builds, I keep
> > getting "vmlinux.o: changed function: override_release".  It could be
> > considered benign for quick development work, or confusing.  Seems easy
> > enough to stash and avoid.
> > 
> > Repro:
> > 
> > Start with a clean source tree, setup some basic configs for klp-build:
> > 
> >   $ make clean && make mrproper
> >   $ vng --kconfig
> >   $ ./scripts/config --file .config \
> >        --set-val CONFIG_FTRACE y \
> >        --set-val CONFIG_KALLSYMS_ALL y \
> >        --set-val CONFIG_FUNCTION_TRACER y \
> >        --set-val CONFIG_DYNAMIC_FTRACE y \
> >        --set-val CONFIG_DYNAMIC_DEBUG y \
> >        --set-val CONFIG_LIVEPATCH y
> >   $ make olddefconfig
> > 
> > Build the first patch, save klp-tmp/ (note the added DEBUG that dumps
> > the localversion after assignment in set_kernelversion):
> > 
> >   $ ./scripts/livepatch/klp-build -T ~/cmdline-string.patch 
> >   DEBUG: localversion=6.19.0-gc998cd490c02                           <<
> >   Validating patch(es)
> >   Building original kernel
> >   Copying original object files
> >   Fixing patch(es)
> >   Building patched kernel
> >   Copying patched object files
> >   Diffing objects
> >   vmlinux.o: changed function: cmdline_proc_show
> >   BMuilding patch module: livepatch-cmdline-string.ko
> >   SgUCCESS
> >    c
> > Buield a second patch, short-circuit to step 2 (build patched kernel):
> > 
> >   $ ./scripts/livepatch/klp-build -T -S 2 ~/cmdline-string.patch
> >   DEBUG: localversion=6.19.0+                                        <<
> >   Fixing patch(es)
> >   Building patched kernel
> >   Copying patched object files
> >   Diffing objects
> >   vmlinux.o: changed function: override_release                      <<
> >   vmlinux.o: changed function: cmdline_proc_show
> >   Building patch module: livepatch-cmdline-string.ko
> >   SUCCESS
> 
> Hm, I wasn't able to recreate, but it's worrisome that two different
> localversions are being reported.  How do we know which one is correct?
> 
> I'm also not sure why my original code is being so obtuse by
> constructing the kernelrelease manually.  I can't remember if that's on
> purpose or not.
> 
> The below would be simpler, I wonder if this also happens to fix the
> issue?
> 

I finally figured out why you couldn't reproduce, in my tests, I never
built the original kernel, I jumped straight from a clean repo to
starting up klp-build.  If I perform an initial make before running
klp-build, then the sequence works as expected. 

- If skipping the initial vmlinux is an unsupported use-case, then we
  can ignore and drop this patch,
- or perhaps detect and warn/error out 
- If this is something we need to support, then your suggested version
  below didn't work out either...

The following change committed on top of v7.0-rc2:

diff --git a/scripts/livepatch/klp-build b/scripts/livepatch/klp-build
index 809e198a561d..f223395e630e 100755
--- a/scripts/livepatch/klp-build
+++ b/scripts/livepatch/klp-build
@@ -285,15 +285,16 @@ set_module_name() {
 # application from appending it with '+' due to a dirty git working tree.
 set_kernelversion() {
        local file="$SRC/scripts/setlocalversion"
-       local localversion
+       local kernelrelease
 
        stash_file "$file"
 
-       localversion="$(cd "$SRC" && make --no-print-directory kernelversion)"
-       localversion="$(cd "$SRC" && KERNELVERSION="$localversion" ./scripts/setlocalversion)"
-       [[ -z "$localversion" ]] && die "setlocalversion failed"
+       kernelrelease="$(cd "$SRC" && make kernelrelease)"
+       [[ -z "$kernelrelease" ]] && die "setlocalversion failed"
 
-       sed -i "2i echo $localversion; exit 0" scripts/setlocalversion
+       echo "DEBUG: kernelrelease=$kernelrelease"
+
+       sed -i "2i echo $kernelrelease; exit 0" scripts/setlocalversion
 }
 
 get_patch_files() {


$ git clone --branch v7.0-rc2 --depth=1 git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git

[ add the commit above ]

$ git status
On branch master
Your branch is ahead of 'origin/master' by 1 commit.
  (use "git push" to publish your local commits)

nothing to commit, working tree clean

$ vng --kconfig
$ ./scripts/config --file .config \
   --set-val CONFIG_FTRACE y \
   --set-val CONFIG_KALLSYMS_ALL y \
   --set-val CONFIG_FUNCTION_TRACER y \
   --set-val CONFIG_DYNAMIC_FTRACE y \
   --set-val CONFIG_DYNAMIC_DEBUG y \
   --set-val CONFIG_LIVEPATCH y
$ make olddefconfig

$ ./scripts/livepatch/klp-build -T ~/src/linux/cmdline-string.patch 
DEBUG: kernelrelease=7.0.0-rc2-00001-g624702e6338b
Validating patch(es)
Building original kernel
Copying original object files
Fixing patch(es)
Building patched kernel
Copying patched object files
Diffing objects
vmlinux.o: changed function: cmdline_proc_show
Building patch module: livepatch-cmdline-string.ko
SUCCESS

$ strings livepatch-cmdline-string.ko | grep vermagic
vermagic=7.0.0-rc2-00001-g624702e6338b SMP preempt mod_unload

$ ./scripts/livepatch/klp-build -T -S 2 ~/src/linux/cmdline-string.patch 
DEBUG: kernelrelease=7.0.0-rc2+
Fixing patch(es)
Building patched kernel
Copying patched object files
Diffing objects
vmlinux.o: changed function: override_release
vmlinux.o: changed function: cmdline_proc_show
Building patch module: livepatch-cmdline-string.ko
SUCCESS

$ strings livepatch-cmdline-string.ko | grep vermagic
vermagic=7.0.0-rc2+ SMP preempt mod_unload 

--
Joe

Re: [PATCH v3 10/13] livepatch/klp-build: provide friendlier error messages

[Joe Lawrence]

On Mon, Feb 23, 2026 at 01:15:55PM -0800, Josh Poimboeuf wrote:
> On Tue, Feb 17, 2026 at 11:06:41AM -0500, Joe Lawrence wrote:
> > Provide more context for common klp-build failure modes.  Clarify which
> > user-provided patch is unsupported or failed to apply, and explicitly
> > identify which kernel build (original or patched) failed.
> > 
> > Signed-off-by: Joe Lawrence <joe.lawrence@redhat.com>
> > ---
> >  scripts/livepatch/klp-build | 9 +++++----
> >  1 file changed, 5 insertions(+), 4 deletions(-)
> > 
> > diff --git a/scripts/livepatch/klp-build b/scripts/livepatch/klp-build
> > index 6d3adadfc394..80703ec4d775 100755
> > --- a/scripts/livepatch/klp-build
> > +++ b/scripts/livepatch/klp-build
> > @@ -351,7 +351,7 @@ check_unsupported_patches() {
> >  		for file in "${files[@]}"; do
> >  			case "$file" in
> >  				lib/*|*.S)
> > -					die "unsupported patch to $file"
> > +					die "$patch unsupported patch to $file"
> 
> Can we add a colon here, like
> 
>   foo.patch: unsupported patch to bar.c
> 

Good idea, will do in v4.

--
Joe

Re: [PATCH v3 11/13] livepatch/klp-build: add terminal color output

[Joe Lawrence]

On Mon, Feb 23, 2026 at 01:32:09PM -0800, Josh Poimboeuf wrote:
> On Mon, Feb 23, 2026 at 01:28:45PM -0800, Josh Poimboeuf wrote:
> > On Tue, Feb 17, 2026 at 11:06:42AM -0500, Joe Lawrence wrote:
> > > Improve the readability of klp-build output by implementing a basic
> > > color scheme.  When the standard output and error are connected to a
> > > terminal, highlight status messages in bold, warnings in yellow, and
> > > errors in red.
> > > 
> > > Signed-off-by: Joe Lawrence <joe.lawrence@redhat.com>
> > > ---
> > >  scripts/livepatch/klp-build | 15 ++++++++++++---
> > >  1 file changed, 12 insertions(+), 3 deletions(-)
> > > 
> > > diff --git a/scripts/livepatch/klp-build b/scripts/livepatch/klp-build
> > > index 80703ec4d775..fd104ace29e6 100755
> > > --- a/scripts/livepatch/klp-build
> > > +++ b/scripts/livepatch/klp-build
> > > @@ -52,6 +52,15 @@ PATCH_TMP_DIR="$TMP_DIR/tmp"
> > >  
> > >  KLP_DIFF_LOG="$DIFF_DIR/diff.log"
> > >  
> > > +# Terminal output colors
> > > +read -r COLOR_RESET COLOR_BOLD COLOR_ERROR COLOR_WARN <<< ""
> > > +if [[ -t 1 && -t 2 ]]; then
> > > +	COLOR_RESET="\033[0m"
> > > +	COLOR_BOLD="\033[1m"
> > > +	COLOR_ERROR="\033[0;31m"
> > > +	COLOR_WARN="\033[0;33m"
> > > +fi
> > > +
> > >  grep0() {
> > >  	# shellcheck disable=SC2317
> > >  	command grep "$@" || true
> > > @@ -65,15 +74,15 @@ grep() {
> > >  }
> > >  
> > >  status() {
> > > -	echo "$*"
> > > +	echo -e "${COLOR_BOLD}$*${COLOR_RESET}"
> > >  }
> > >  
> > >  warn() {
> > > -	echo "error: $SCRIPT: $*" >&2
> > > +	echo -e "${COLOR_WARN}warn${COLOR_RESET}: $SCRIPT: $*" >&2
> > 
> > Shouldn't this reset the colors *after* printing out the whole message?
> > 

Colorizing the "warn:" and "error:" was intended to look similar to gcc
color output.  I can easily highlight the entire message if you prefer.

> > Also, while it does make sense for warn() to print "warn:" rather than
> > "error:", note its called by trap_err(), which should print the latter.
> 
> also I think s/warn:/warning:/ is better.
> 

Ack to both for v4.

--
Joe

Re: [PATCH v3 12/13] livepatch/klp-build: report patch validation drift

[Joe Lawrence]

On Mon, Feb 23, 2026 at 01:40:14PM -0800, Josh Poimboeuf wrote:
> On Tue, Feb 17, 2026 at 11:06:43AM -0500, Joe Lawrence wrote:
> > Capture the output of the patch command to detect when a patch applies
> > with fuzz or line offsets.
> > 
> > If such "drift" is detected during the validation phase, warn the user
> > and display the details.  This helps identify input patches that may need
> > refreshing against the target source tree.
> > 
> > Ensure that internal patch operations (such as those in refresh_patch or
> > during the final build phase) can still run quietly.
> > 
> > Signed-off-by: Joe Lawrence <joe.lawrence@redhat.com>
> > ---
> >  scripts/livepatch/klp-build | 24 +++++++++++++++++++-----
> >  1 file changed, 19 insertions(+), 5 deletions(-)
> > 
> > diff --git a/scripts/livepatch/klp-build b/scripts/livepatch/klp-build
> > index fd104ace29e6..5367d573b94b 100755
> > --- a/scripts/livepatch/klp-build
> > +++ b/scripts/livepatch/klp-build
> > @@ -369,11 +369,24 @@ check_unsupported_patches() {
> >  
> >  apply_patch() {
> >  	local patch="$1"
> > +	shift
> > +	local extra_args=("$@")
> > +	local drift_regex="with fuzz|offset [0-9]+ line"
> > +	local output
> > +	local status
> >  
> >  	[[ ! -f "$patch" ]] && die "$patch doesn't exist"
> > -	patch -d "$SRC" -p1 --dry-run --silent --no-backup-if-mismatch -r /dev/null < "$patch"
> > -	patch -d "$SRC" -p1 --silent --no-backup-if-mismatch -r /dev/null < "$patch"
> > +	status=0
> > +	output=$(patch -d "$SRC" -p1 --dry-run --no-backup-if-mismatch -r /dev/null "${extra_args[@]}" < "$patch" 2>&1) || status=$?
> > +	if [[ "$status" -ne 0 ]]; then
> > +		echo "$output"
> > +		die "$patch did not apply"
> > +	elif [[ "$output" =~ $drift_regex ]]; then
> > +		warn "$patch applied with drift"
> > +		echo "$output"
> 
> Just for consistency with the output ordering of the "patch did not
> apply" error, I think the "$output" should be printed *before* the
> "$patch applied with drift".
> 
> Also, should $output be printed to stderr?
> 

Will adjust both ^^ for v4.

> Also, I've not heard of patch "drift", is "fuzz" better?
> 

Ah, I was trying to figure what word would include both offset and fuzz.
I /think/ "fuzz" may be used for both, so I can just use that for v4.

--
Joe

Re: [PATCH v3 13/13] livepatch/klp-build: don't look for changed objects in tools/

[Joe Lawrence]

On Mon, Feb 23, 2026 at 01:41:58PM -0800, Josh Poimboeuf wrote:
> On Tue, Feb 17, 2026 at 11:06:44AM -0500, Joe Lawrence wrote:
> > Signed-off-by: Joe Lawrence <joe.lawrence@redhat.com>
> > ---
> >  scripts/livepatch/klp-build | 4 ++--
> >  1 file changed, 2 insertions(+), 2 deletions(-)
> 
> Why?
> 

I don't have a pithy repro captured here, so I can just drop this for
now.  I was playing with building klp-build selftest modules and
stashing the resulting .ko's under tools/testing/selftests.
Occasionally subsequent klp-builds would get confused when seeing only a
.ko and complaint about missing ancestor object files.  Which led me to
ask, why does it look in directories that don't even include kernel
build artifacts.

--
Joe

Re: [PATCH v3 01/13] objtool/klp: honor SHF_MERGE entry alignment in elf_add_data()

[Josh Poimboeuf]

On Tue, Feb 17, 2026 at 11:14:17AM -0500, Joe Lawrence wrote:
> On Tue, Feb 17, 2026 at 11:06:32AM -0500, Joe Lawrence wrote:
> > When adding data to an SHF_MERGE section, set the Elf_Data d_align to
> > the section's sh_addralign so libelf aligns entries within the section.
> > This ensures that entry offsets are consistent with previously calculated
> > relocation addends.
> > 
> > Fixes: 431dbabf2d9d ("objtool: Add elf_create_data()")
> > Signed-off-by: Joe Lawrence <joe.lawrence@redhat.com>
> > ---
> >  tools/objtool/elf.c | 2 +-
> >  1 file changed, 1 insertion(+), 1 deletion(-)
> > 
> > diff --git a/tools/objtool/elf.c b/tools/objtool/elf.c
> > index 2c02c7b49265..bd6502e7bdc0 100644
> > --- a/tools/objtool/elf.c
> > +++ b/tools/objtool/elf.c
> > @@ -1375,7 +1375,7 @@ void *elf_add_data(struct elf *elf, struct section *sec, const void *data, size_
> >  		memcpy(sec->data->d_buf, data, size);
> >  
> >  	sec->data->d_size = size;
> > -	sec->data->d_align = 1;
> > +	sec->data->d_align = (sec->sh.sh_flags & SHF_MERGE) ? sec->sh.sh_addralign : 1;
> >  
> >  	offset = ALIGN(sec->sh.sh_size, sec->sh.sh_addralign);
> >  	sec->sh.sh_size = offset + size;
> > -- 
> > 2.53.0
> > 
> > 
> 
> This one stretches my ELF internals knowledge a bit, is ^^ true or
> should we rely on the section ".str1.8" suffix to indicate internal
> alignment?

I hit the same issue in my testing for the klp-build arm64 port, I think
it can be simplified to the below?

diff --git a/tools/objtool/elf.c b/tools/objtool/elf.c
@@ -1375,7 +1382,7 @@ void *elf_add_data(struct elf *elf, struct section *sec, const void *data, size_
 		memcpy(sec->data->d_buf, data, size);
 
 	sec->data->d_size = size;
-	sec->data->d_align = 1;
+	sec->data->d_align = sec->sh.sh_addralign;
 
 	offset = ALIGN(sec->sh.sh_size, sec->sh.sh_addralign);
 	sec->sh.sh_size = offset + size;

Re: [PATCH v3 11/13] livepatch/klp-build: add terminal color output

[Josh Poimboeuf]

On Mon, Mar 02, 2026 at 09:24:28PM -0500, Joe Lawrence wrote:
> On Mon, Feb 23, 2026 at 01:32:09PM -0800, Josh Poimboeuf wrote:
> > On Mon, Feb 23, 2026 at 01:28:45PM -0800, Josh Poimboeuf wrote:
> > > On Tue, Feb 17, 2026 at 11:06:42AM -0500, Joe Lawrence wrote:
> > > > Improve the readability of klp-build output by implementing a basic
> > > > color scheme.  When the standard output and error are connected to a
> > > > terminal, highlight status messages in bold, warnings in yellow, and
> > > > errors in red.
> > > > 
> > > > Signed-off-by: Joe Lawrence <joe.lawrence@redhat.com>
> > > > ---
> > > >  scripts/livepatch/klp-build | 15 ++++++++++++---
> > > >  1 file changed, 12 insertions(+), 3 deletions(-)
> > > > 
> > > > diff --git a/scripts/livepatch/klp-build b/scripts/livepatch/klp-build
> > > > index 80703ec4d775..fd104ace29e6 100755
> > > > --- a/scripts/livepatch/klp-build
> > > > +++ b/scripts/livepatch/klp-build
> > > > @@ -52,6 +52,15 @@ PATCH_TMP_DIR="$TMP_DIR/tmp"
> > > >  
> > > >  KLP_DIFF_LOG="$DIFF_DIR/diff.log"
> > > >  
> > > > +# Terminal output colors
> > > > +read -r COLOR_RESET COLOR_BOLD COLOR_ERROR COLOR_WARN <<< ""
> > > > +if [[ -t 1 && -t 2 ]]; then
> > > > +	COLOR_RESET="\033[0m"
> > > > +	COLOR_BOLD="\033[1m"
> > > > +	COLOR_ERROR="\033[0;31m"
> > > > +	COLOR_WARN="\033[0;33m"
> > > > +fi
> > > > +
> > > >  grep0() {
> > > >  	# shellcheck disable=SC2317
> > > >  	command grep "$@" || true
> > > > @@ -65,15 +74,15 @@ grep() {
> > > >  }
> > > >  
> > > >  status() {
> > > > -	echo "$*"
> > > > +	echo -e "${COLOR_BOLD}$*${COLOR_RESET}"
> > > >  }
> > > >  
> > > >  warn() {
> > > > -	echo "error: $SCRIPT: $*" >&2
> > > > +	echo -e "${COLOR_WARN}warn${COLOR_RESET}: $SCRIPT: $*" >&2
> > > 
> > > Shouldn't this reset the colors *after* printing out the whole message?
> > > 
> 
> Colorizing the "warn:" and "error:" was intended to look similar to gcc
> color output.  I can easily highlight the entire message if you prefer.

I guess I was confused because a) the commit log made it sound like the
entire warning is in color and b) the status messages are also for the
entire message.

I don't know if I have a preference either way, but at least the commit
log should make the intended behavior more clear.

-- 
Josh

Re: [PATCH v3 13/13] livepatch/klp-build: don't look for changed objects in tools/

[Josh Poimboeuf]

On Mon, Mar 02, 2026 at 09:30:23PM -0500, Joe Lawrence wrote:
> On Mon, Feb 23, 2026 at 01:41:58PM -0800, Josh Poimboeuf wrote:
> > On Tue, Feb 17, 2026 at 11:06:44AM -0500, Joe Lawrence wrote:
> > > Signed-off-by: Joe Lawrence <joe.lawrence@redhat.com>
> > > ---
> > >  scripts/livepatch/klp-build | 4 ++--
> > >  1 file changed, 2 insertions(+), 2 deletions(-)
> > 
> > Why?
> > 
> 
> I don't have a pithy repro captured here, so I can just drop this for
> now.  I was playing with building klp-build selftest modules and
> stashing the resulting .ko's under tools/testing/selftests.
> Occasionally subsequent klp-builds would get confused when seeing only a
> .ko and complaint about missing ancestor object files.  Which led me to
> ask, why does it look in directories that don't even include kernel
> build artifacts.

Yeah, I don't necessarily object to the change, but it would be nice to
have some kind of justification in the commit log.

-- 
Josh

Re: [PATCH v3 09/13] livepatch/klp-build: fix version mismatch when short-circuiting

[Josh Poimboeuf]

On Mon, Mar 02, 2026 at 09:20:00PM -0500, Joe Lawrence wrote:
> I finally figured out why you couldn't reproduce, in my tests, I never
> built the original kernel, I jumped straight from a clean repo to
> starting up klp-build.  If I perform an initial make before running
> klp-build, then the sequence works as expected. 
> 
> - If skipping the initial vmlinux is an unsupported use-case, then we
>   can ignore and drop this patch,
> - or perhaps detect and warn/error out 
> - If this is something we need to support, then your suggested version
>   below didn't work out either...
> 
> The following change committed on top of v7.0-rc2:

Thanks, I was able to reproduce this and figure it out.  The problem is
that "make oldconfig" doesn't sync auto.conf, whereas a full make does.

So if you do "make kernelrelease" before the first build, it may be
wrong.

And apparently that's intentional:

  commit a29d4d8c5669a658b5a091b38205c13084967ce7
  Author: Masahiro Yamada <yamada.masahiro@socionext.com>
  Date:   Fri Jul 20 16:46:35 2018 +0900
  
      kbuild: do not update config for 'make kernelrelease'
      
      'make kernelrelease' depends on CONFIG_LOCALVERSION(_AUTO), but
      for the same reason as install targets, we do not want to update
      the configuration just for printing the kernelrelease string.
      
      This is likely to happen when you compiled the kernel with
      CROSS_COMPILE, but forget to pass it to 'make kernelrelease'.
      
      Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>
  
  diff --git a/Makefile b/Makefile
  index 8ca9e0b114f1..060874d85e0d 100644
  --- a/Makefile
  +++ b/Makefile
  @@ -225,7 +225,8 @@ no-dot-config-targets := $(clean-targets) \
   			 cscope gtags TAGS tags help% %docs check% coccicheck \
   			 $(version_h) headers_% archheaders archscripts \
   			 kernelversion %src-pkg
  -no-sync-config-targets := $(no-dot-config-targets) install %install
  +no-sync-config-targets := $(no-dot-config-targets) install %install \
  +			   kernelrelease
   
   config-targets  := 0
   mixed-targets   := 0



So the fix is just to do "make syncconfig" before the "make
kernelrelease".  Let me write up a proper patch.

-- 
Josh

[PATCH] klp-build: Fix inconsistent kernel version

[Josh Poimboeuf]

If .config hasn't been synced with auto.conf, any recent changes to
CONFIG_LOCALVERSION* may not get reflected in the kernel version name.

Use "make syncconfig" to force them to sync, and "make kernelrelease" to
get the version instead of having to construct it manually.

Fixes: 24ebfcd65a87 ("livepatch/klp-build: Introduce klp-build script for generating livepatch modules")
Closes: https://lore.kernel.org/20260217160645.3434685-10-joe.lawrence@redhat.com
Reported-by: Joe Lawrence <joe.lawrence@redhat.com>
Signed-off-by: Josh Poimboeuf <jpoimboe@kernel.org>
---
 scripts/livepatch/klp-build | 9 ++++-----
 1 file changed, 4 insertions(+), 5 deletions(-)

diff --git a/scripts/livepatch/klp-build b/scripts/livepatch/klp-build
index 809e198a561d..72f05c40b9f8 100755
--- a/scripts/livepatch/klp-build
+++ b/scripts/livepatch/klp-build
@@ -285,15 +285,14 @@ set_module_name() {
 # application from appending it with '+' due to a dirty git working tree.
 set_kernelversion() {
 	local file="$SRC/scripts/setlocalversion"
-	local localversion
+	local kernelrelease
 
 	stash_file "$file"
 
-	localversion="$(cd "$SRC" && make --no-print-directory kernelversion)"
-	localversion="$(cd "$SRC" && KERNELVERSION="$localversion" ./scripts/setlocalversion)"
-	[[ -z "$localversion" ]] && die "setlocalversion failed"
+	kernelrelease="$(cd "$SRC" && make syncconfig &>/dev/null && make kernelrelease)"
+	[[ -z "$kernelrelease" ]] && die "failed to get kernel version"
 
-	sed -i "2i echo $localversion; exit 0" scripts/setlocalversion
+	sed -i "2i echo $kernelrelease; exit 0" scripts/setlocalversion
 }
 
 get_patch_files() {
-- 
2.53.0

Re: [PATCH] klp-build: Fix inconsistent kernel version

[Joe Lawrence]

On Thu, Mar 05, 2026 at 02:52:46PM -0800, Josh Poimboeuf wrote:
> If .config hasn't been synced with auto.conf, any recent changes to
> CONFIG_LOCALVERSION* may not get reflected in the kernel version name.
> 
> Use "make syncconfig" to force them to sync, and "make kernelrelease" to
> get the version instead of having to construct it manually.
> 
> Fixes: 24ebfcd65a87 ("livepatch/klp-build: Introduce klp-build script for generating livepatch modules")
> Closes: https://lore.kernel.org/20260217160645.3434685-10-joe.lawrence@redhat.com
> Reported-by: Joe Lawrence <joe.lawrence@redhat.com>
> Signed-off-by: Josh Poimboeuf <jpoimboe@kernel.org>
> ---
>  scripts/livepatch/klp-build | 9 ++++-----
>  1 file changed, 4 insertions(+), 5 deletions(-)
> 
> diff --git a/scripts/livepatch/klp-build b/scripts/livepatch/klp-build
> index 809e198a561d..72f05c40b9f8 100755
> --- a/scripts/livepatch/klp-build
> +++ b/scripts/livepatch/klp-build
> @@ -285,15 +285,14 @@ set_module_name() {
>  # application from appending it with '+' due to a dirty git working tree.
>  set_kernelversion() {
>  	local file="$SRC/scripts/setlocalversion"
> -	local localversion
> +	local kernelrelease
>  
>  	stash_file "$file"
>  
> -	localversion="$(cd "$SRC" && make --no-print-directory kernelversion)"
> -	localversion="$(cd "$SRC" && KERNELVERSION="$localversion" ./scripts/setlocalversion)"
> -	[[ -z "$localversion" ]] && die "setlocalversion failed"
> +	kernelrelease="$(cd "$SRC" && make syncconfig &>/dev/null && make kernelrelease)"

Almost, I needed to add '-s' to the kernelversion target to silence the
make "entering / leaving directory" msgs and then this worked for me.

There's some makefile voodoo going on here where when I manually run
`make kernelrelease` I don't see the verbose msgs, but I printed
"$kernelrelease" here in klp-build and on my machine (make v4.4.1), that
extra output derailed the script.

Anyway, `make help` says:

  kernelrelease   - Output the release version string (use with make -s)

so we should probably use '-s' regardless.

With that, shall I drop my ("livepatch/klp-build: fix version mismatch
when short-circuiting") and carry yours in its place?

--
Joe

Re: [PATCH v3 01/13] objtool/klp: honor SHF_MERGE entry alignment in elf_add_data()

[Joe Lawrence]

On Wed, Mar 04, 2026 at 06:33:47PM -0800, Josh Poimboeuf wrote:
> On Tue, Feb 17, 2026 at 11:14:17AM -0500, Joe Lawrence wrote:
> > On Tue, Feb 17, 2026 at 11:06:32AM -0500, Joe Lawrence wrote:
> > > When adding data to an SHF_MERGE section, set the Elf_Data d_align to
> > > the section's sh_addralign so libelf aligns entries within the section.
> > > This ensures that entry offsets are consistent with previously calculated
> > > relocation addends.
> > > 
> > > Fixes: 431dbabf2d9d ("objtool: Add elf_create_data()")
> > > Signed-off-by: Joe Lawrence <joe.lawrence@redhat.com>
> > > ---
> > >  tools/objtool/elf.c | 2 +-
> > >  1 file changed, 1 insertion(+), 1 deletion(-)
> > > 
> > > diff --git a/tools/objtool/elf.c b/tools/objtool/elf.c
> > > index 2c02c7b49265..bd6502e7bdc0 100644
> > > --- a/tools/objtool/elf.c
> > > +++ b/tools/objtool/elf.c
> > > @@ -1375,7 +1375,7 @@ void *elf_add_data(struct elf *elf, struct section *sec, const void *data, size_
> > >  		memcpy(sec->data->d_buf, data, size);
> > >  
> > >  	sec->data->d_size = size;
> > > -	sec->data->d_align = 1;
> > > +	sec->data->d_align = (sec->sh.sh_flags & SHF_MERGE) ? sec->sh.sh_addralign : 1;
> > >  
> > >  	offset = ALIGN(sec->sh.sh_size, sec->sh.sh_addralign);
> > >  	sec->sh.sh_size = offset + size;
> > > -- 
> > > 2.53.0
> > > 
> > > 
> > 
> > This one stretches my ELF internals knowledge a bit, is ^^ true or
> > should we rely on the section ".str1.8" suffix to indicate internal
> > alignment?
> 
> I hit the same issue in my testing for the klp-build arm64 port, I think
> it can be simplified to the below?
> 
> diff --git a/tools/objtool/elf.c b/tools/objtool/elf.c
> @@ -1375,7 +1382,7 @@ void *elf_add_data(struct elf *elf, struct section *sec, const void *data, size_
>  		memcpy(sec->data->d_buf, data, size);
>  
>  	sec->data->d_size = size;
> -	sec->data->d_align = 1;
> +	sec->data->d_align = sec->sh.sh_addralign;
>  
>  	offset = ALIGN(sec->sh.sh_size, sec->sh.sh_addralign);
>  	sec->sh.sh_size = offset + size;
> 

Yeah that make sense, but I think we both missed the second half of the
fix in the symbol table.  This patch fails with your version:

-->8-- -->8-- -->8-- -->8-- -->8-- -->8-- -->8-- -->8-- -->8-- -->8--

diff --git a/fs/proc/stat.c b/fs/proc/stat.c
--- a/fs/proc/stat.c
+++ b/fs/proc/stat.c
@@ -54,6 +54,13 @@ static u64 get_iowait_time(struct kernel_cpustat *kcs, int cpu)
 	return iowait;
 }
 
+static void klp_test_stat_accessed(void)
+{
+	static atomic_t call_count = ATOMIC_INIT(0);
+	atomic_inc(&call_count);
+	pr_info("klp-build-test: stat accessed %d times\n", atomic_read(&call_count));
+}
+
 static int show_stat(struct seq_file *p, void *v)
 {
 	int i, j;
@@ -92,6 +99,7 @@ static int show_stat(struct seq_file *p, void *v)
 	user = nice = system = idle = iowait =
 		irq = softirq = steal = 0;
 	guest = guest_nice = 0;
+	klp_test_stat_accessed();
 	getboottime64(&boottime);
 	/* shift boot timestamp according to the timens offset */
 	timens_sub_boottime(&boottime);

-->8-- -->8-- -->8-- -->8-- -->8-- -->8-- -->8-- -->8-- -->8-- -->8--

Confused on instruction decoding?

  livepatch-test.o: warning: objtool: show_stat+0x696: can't find jump dest instruction at .rodata.show_stat.str1.1+0x38
  make[3]: *** [/root/linux/scripts/Makefile.build:505: livepatch-test.o] Error 255
  make[3]: *** Deleting file 'livepatch-test.o'
  make[2]: *** [/root/linux/Makefile:2064: .] Error 2
  make[1]: *** [/root/linux/Makefile:248: __sub-make] Error 2
  make: *** [Makefile:248: __sub-make] Error 2
  error: klp-build: line 793: '"${cmd[@]}" > >(tee -a "$log") 2> >(tee -a "$log" 1>&2)'
  error: klp-build: line 795: '( cd "$SRC"; "${cmd[@]}" > >(tee -a "$log") 2> >(tee -a "$log" 1>&2) )'

Notice the 0x10 section offset value for show_stat in the generated
vmlinux.o diff object symbol table:

  $ readelf --wide --symbols klp-tmp/diff/vmlinux.o | grep -E 'Ndx|\.text\.show_stat$|show_stat$|pfx_show_stat$'
     Num:    Value          Size Type    Bind   Vis      Ndx Name
       1: 0000000000000000    16 FUNC    LOCAL  DEFAULT    4 __pfx_show_stat
       2: 0000000000000010  2126 FUNC    LOCAL  DEFAULT    4 show_stat
       5: 0000000000000000     0 SECTION LOCAL  DEFAULT    4 .text.show_stat

but then in the disassembly, show_stat() starts 0x20 bytes into the
section:

  $ objdump -d -j .text.show_stat --start-address=0x0 --stop-address=0x24 klp-tmp/diff/vmlinux.o
  
  klp-tmp/diff/vmlinux.o:     file format elf64-x86-64
  
  
  Disassembly of section .text.show_stat:
  
  0000000000000000 <__pfx_show_stat>:
     0:   90                      nop
     1:   90                      nop
     2:   90                      nop
     3:   90                      nop
     4:   90                      nop
     5:   90                      nop
     6:   90                      nop
     7:   90                      nop
     8:   90                      nop
     9:   90                      nop
     a:   90                      nop
     b:   90                      nop
     c:   90                      nop
     d:   90                      nop
     e:   90                      nop
     f:   90                      nop
  
  0000000000000010 <show_stat>:
          ...
    20:   f3 0f 1e fa             endbr64


When cloning the symbol, if we ensure the symbol's offset aligns
with the sh_addralign (as elf_add_data() does now):

-->8-- -->8-- -->8-- -->8-- -->8-- -->8-- -->8-- -->8-- -->8-- -->8--

diff --git a/tools/objtool/klp-diff.c b/tools/objtool/klp-diff.c
index a3198a63c2..c2c4e4968b 100644
--- a/tools/objtool/klp-diff.c
+++ b/tools/objtool/klp-diff.c
@@ -14,6 +14,7 @@
 #include <objtool/util.h>
 #include <arch/special.h>
 
+#include <linux/align.h>
 #include <linux/objtool_types.h>
 #include <linux/livepatch_external.h>
 #include <linux/stringify.h>
@@ -560,7 +561,7 @@ static struct symbol *__clone_symbol(struct elf *elf, struct symbol *patched_sym
 		}
 
 		if (!is_sec_sym(patched_sym))
-			offset = sec_size(out_sec);
+			offset = ALIGN(sec_size(out_sec), out_sec->sh.sh_addralign);
 
 		if (patched_sym->len || is_sec_sym(patched_sym)) {
 			void *data = NULL;

-->8-- -->8-- -->8-- -->8-- -->8-- -->8-- -->8-- -->8-- -->8-- -->8--

Results are as expected:

  $ readelf --wide --symbols klp-tmp/diff/vmlinux.o | grep -E 'Ndx|\.text\.show_stat$|show_stat$|pfx_show_stat$'
     Num:    Value          Size Type    Bind   Vis      Ndx Name
       1: 0000000000000000    16 FUNC    LOCAL  DEFAULT    4 __pfx_show_stat
       2: 0000000000000020  2126 FUNC    LOCAL  DEFAULT    4 show_stat
       5: 0000000000000000     0 SECTION LOCAL  DEFAULT    4 .text.show_stat

$ objdump -d -j .text.show_stat --start-address=0x0 --stop-address=0x24 klp-tmp/diff/vmlinux.o 

klp-tmp/diff/vmlinux.o:     file format elf64-x86-64


Disassembly of section .text.show_stat:

0000000000000000 <__pfx_show_stat>:
   0:   90                      nop
   1:   90                      nop
   2:   90                      nop
   3:   90                      nop
   4:   90                      nop
   5:   90                      nop
   6:   90                      nop
   7:   90                      nop
   8:   90                      nop
   9:   90                      nop
   a:   90                      nop
   b:   90                      nop
   c:   90                      nop
   d:   90                      nop
   e:   90                      nop
   f:   90                      nop
        ...

0000000000000020 <show_stat>:
  20:   f3 0f 1e fa             endbr64


LMK if you want me to update the patch in this set, or drop it here so
you can update in ("objtool/arm64: Port klp-build to arm64").

Thanks,

--
Joe

Re: [PATCH] klp-build: Fix inconsistent kernel version

[Josh Poimboeuf]

On Tue, Mar 10, 2026 at 09:45:42AM -0400, Joe Lawrence wrote:
> On Thu, Mar 05, 2026 at 02:52:46PM -0800, Josh Poimboeuf wrote:
> > If .config hasn't been synced with auto.conf, any recent changes to
> > CONFIG_LOCALVERSION* may not get reflected in the kernel version name.
> > 
> > Use "make syncconfig" to force them to sync, and "make kernelrelease" to
> > get the version instead of having to construct it manually.
> > 
> > Fixes: 24ebfcd65a87 ("livepatch/klp-build: Introduce klp-build script for generating livepatch modules")
> > Closes: https://lore.kernel.org/20260217160645.3434685-10-joe.lawrence@redhat.com
> > Reported-by: Joe Lawrence <joe.lawrence@redhat.com>
> > Signed-off-by: Josh Poimboeuf <jpoimboe@kernel.org>
> > ---
> >  scripts/livepatch/klp-build | 9 ++++-----
> >  1 file changed, 4 insertions(+), 5 deletions(-)
> > 
> > diff --git a/scripts/livepatch/klp-build b/scripts/livepatch/klp-build
> > index 809e198a561d..72f05c40b9f8 100755
> > --- a/scripts/livepatch/klp-build
> > +++ b/scripts/livepatch/klp-build
> > @@ -285,15 +285,14 @@ set_module_name() {
> >  # application from appending it with '+' due to a dirty git working tree.
> >  set_kernelversion() {
> >  	local file="$SRC/scripts/setlocalversion"
> > -	local localversion
> > +	local kernelrelease
> >  
> >  	stash_file "$file"
> >  
> > -	localversion="$(cd "$SRC" && make --no-print-directory kernelversion)"
> > -	localversion="$(cd "$SRC" && KERNELVERSION="$localversion" ./scripts/setlocalversion)"
> > -	[[ -z "$localversion" ]] && die "setlocalversion failed"
> > +	kernelrelease="$(cd "$SRC" && make syncconfig &>/dev/null && make kernelrelease)"
> 
> Almost, I needed to add '-s' to the kernelversion target to silence the
> make "entering / leaving directory" msgs and then this worked for me.
> 
> There's some makefile voodoo going on here where when I manually run
> `make kernelrelease` I don't see the verbose msgs, but I printed
> "$kernelrelease" here in klp-build and on my machine (make v4.4.1), that
> extra output derailed the script.
> 
> Anyway, `make help` says:
> 
>   kernelrelease   - Output the release version string (use with make -s)
> 
> so we should probably use '-s' regardless.
> 
> With that, shall I drop my ("livepatch/klp-build: fix version mismatch
> when short-circuiting") and carry yours in its place?

Yes, I think so.  Thanks!

-- 
Josh

Re: [PATCH v3 01/13] objtool/klp: honor SHF_MERGE entry alignment in elf_add_data()

[Josh Poimboeuf]

On Tue, Mar 10, 2026 at 10:02:58AM -0400, Joe Lawrence wrote:
> LMK if you want me to update the patch in this set, or drop it here so
> you can update in ("objtool/arm64: Port klp-build to arm64").

I actually already merged that one into tip/objtool/urgent (356e4b2f5b80
("objtool: Fix data alignment in elf_add_data()")), so please create a
separate fix based on tip/objtool/urgent, and make it the first patch of
your series so I can easily grab it.

Also, FYI, I'm starting PTO today, so I may be slow to respond the rest
of the week.

-- 
Josh