Skip to content

kpatch-build: add support for openEuler #1263

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
joe-lawrence merged 2 commits into from
May 13, 2022
Merged

kpatch-build: add support for openEuler #1263

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
2784f50
kpatch-build: add support for openEuler
anatasluo Apr 24, 2022
e680087
doc/install.md: add instructions for openEuler
anatasluo May 2, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
110 changes: 110 additions & 0 deletions doc/INSTALL.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,6 +12,7 @@ Table of contents
- [Debian 8 (Jessie)](#debian-8-jessie)
- [Debian 7 (Lenny)](#debian-7-lenny)
- [Gentoo](#gentoo)
- [OpenEuler](#openeuler)
- [Build](#build)
- [Install](#install)

Expand Down Expand Up @@ -187,6 +188,115 @@ Configure ccache:
ccache --max-size=5G
```

### OpenEuler
Copy link
Contributor

@joe-lawrence joe-lawrence May 2, 2022

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think the whole "OpenEuler" section needs to go a bit further up in the file, before the "Build" and "Install" sections (they are general sections and not specific to Gentoo).

Copy link
Contributor Author

@anatasluo anatasluo May 4, 2022

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Already fix it.


*ATTENTION: openEuler maintains its own version of kpatch which work with its
own kernel. You can check this [link](https://gitee.com/src-openeuler/kpatch)
to see its documents. This document describes how to run mainline kpatch in openEuler.*

*NOTE: You'll need about 15GB of free disk space for the kpatch-build cache in
`~/.kpatch` and for ccache.*

Install the dependencies for compiling kpatch and running kpatch-build:

```bash
source test/integration/lib.sh
# Will request root privileges
kpatch_dependencies
```

Before running kpatch-build, two more things need to be checked:
-------
1. Ensure current kernel compiled with *CONFIG_LIVEPATCH_PER_TASK_CONSISTENCY* set

openEuler has two strategies to apply kernel live patches and it is decided at compile time.

When CONFIG_LIVEPATCH_STOP_MACHINE_CONSISTENCY set, openEuler uses its own strategy.

When CONFIG_LIVEPATCH_PER_TASK_CONSISTENCY set, openEuler uses the conventional strategy.

Only one config option can take effect at the same time.
A [chinese blog](https://www.modb.pro/db/232858) written by the openEuler official describes
their modifications for kernel livepatch. The main difference is CONFIG_LIVEPATCH_STOP_MACHINE_CONSISTENCY
will disable the usage of ftrace handler in livepatch, they believe it will be faster.

Check whether your current kernel compiled with *CONFIG_LIVEPATCH_PER_TASK_CONSISTENCY*
```bash
grep "CONFIG_LIVEPATCH_PER_TASK_CONSISTENCY" /boot/config-$(uname -r)
```

If you see any output, it means your kernel satisfies, you can go directly to check step 2.

If not, then you need to recompile your current kernel with CONFIG_LIVEPATCH_PER_TASK_CONSISTENCY set.
Copy link
Contributor

@joe-lawrence joe-lawrence May 2, 2022 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Not knowing much about OpenEuler, I read this as implying that CONFIG_LIVEPATCH_PER_TASK_CONSISTENCY is required. Just curious if that is true and how/when are CONFIG_LIVEPATCH_STOP_MACHINE_CONSISTENCY livepatches built?

Copy link
Contributor Author

@anatasluo anatasluo May 4, 2022

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

openEuler maintains their own version of kpatch, already add its link to the document.


You can reference the following steps to recompile the kernel if needed
1. download source code of the current kernel
```bash
# set working directories
TEMPDIR=~/.tmp
mkdir -p $TEMPDIR
mkdir -p $TEMPDIR/buildroot

# download kernel source rpm package
yumdownloader --source --destdir "$TEMPDIR" kernel-$(uname -r)

# obtain source code from package
rpm -D "_topdir $TEMPDIR/buildroot" -ivh $TEMPDIR/kernel-*.src.rpm
rpmbuild -D "_topdir $TEMPDIR/buildroot" -bp --nodeps --target=$(uname -m) $TEMPDIR/buildroot/SPECS/kernel.spec

# check source code and copy config file
cd $TEMPDIR/buildroot/BUILD/kernel-*/linux-*[sS]ource
cp /boot/config-$(uname -r) .config
```

2. set CONFIG_LIVEPATCH_PER_TASK_CONSISTENCY
```bash
make menuconfig
```
select order

-> Processor type and features
-> Enable Livepatch
-> Kernel Live Patching
-> live patching method

choose
> based on ftrace

After this step, you shoud see CONFIG_LIVEPATCH_PER_TASK_CONSISTENCY in .config file

3. recompile kernel and install it to your running environment.

Just to remind, after installing the recompiled kernel, the config file should also be updated.

Copy link
Contributor

@joe-lawrence joe-lawrence May 2, 2022

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Kernel build instructions look fine, though if OpenEuler provides their own wiki or howto (even if not in English), we could alternately link there in case any details change.

Copy link
Contributor Author

@anatasluo anatasluo May 4, 2022

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Sorry, I can not find any official blog from the openEuler about how to recompile the kernel. Actually, I get most of these information from reading source code. Their official documents are very insufficient.


2. Ensure */update/source* is in the rpm repo lists

openEuler releases its source rpm package of the kernel in two places.

One is /source and it is included in rpm repo lists by default.

One is /update/source and it may not be included it in some release versions.

```bash
grep "/update/source" /etc/yum.repos.d/openEuler.repo
```

If you can't see any output, add it to the end of /etc/yum.repos.d/openEuler.repo

For example, if you use openEuler 21.09, you will add something like:
```
[update-source]
name=update-source
baseurl=https://repo.openeuler.org/openEuler-21.09/update/source/
enabled=1
gpgcheck=0
```

*baseurl* is releated with your release version, be careful please!

Goto [openEuler repo](https://repo.openeuler.org/), find your own suitable baseurl.

Build
-----

Expand Down
25 changes: 21 additions & 4 deletions kpatch-build/kpatch-build
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -750,9 +750,13 @@ elif [[ -e "$KERNEL_SRCDIR"/.config ]] && [[ -e "$VERSIONFILE" ]] && [[ "$(cat "
echo "Using cache at $KERNEL_SRCDIR"

else
if [[ "$DISTRO" = fedora ]] || [[ "$DISTRO" = rhel ]] || [[ "$DISTRO" = ol ]] || [[ "$DISTRO" = centos ]]; then
if [[ "$DISTRO" = fedora ]] || [[ "$DISTRO" = rhel ]] || [[ "$DISTRO" = ol ]] || [[ "$DISTRO" = centos ]] || [[ "$DISTRO" = openEuler ]]; then

echo "Fedora/Red Hat distribution detected"
[[ "$DISTRO" = fedora ]] && echo "Fedora distribution detected"
[[ "$DISTRO" = rhel ]] && echo "RHEL distribution detected"
[[ "$DISTRO" = ol ]] && echo "Oracle Linux distribution detected"
[[ "$DISTRO" = centos ]] && echo "CentOS distribution detected"
[[ "$DISTRO" = openEuler ]] && echo "OpenEuler distribution detected"

clean_cache

Expand All @@ -773,7 +777,13 @@ else
rpmbuild -D "_topdir $RPMTOPDIR" -bp --nodeps "--target=$(uname -m)" "$RPMTOPDIR"/SPECS/kernel$ALT.spec 2>&1 | logger ||
die "rpmbuild -bp failed. you may need to run 'yum-builddep kernel' first."

mv "$RPMTOPDIR"/BUILD/kernel-*/linux-* "$KERNEL_SRCDIR" 2>&1 | logger || die
if [[ "$DISTRO" = openEuler ]]; then
# openEuler has two directories with the same content after 'rpm -D'
# openEuler 21.09 has linux-* and linux-*-source while openEuler 20.03 has linux-* and linux-*-Source
mv "$RPMTOPDIR"/BUILD/kernel-*/linux-*[sS]ource "$KERNEL_SRCDIR" 2>&1 | logger || die
else
mv "$RPMTOPDIR"/BUILD/kernel-*/linux-* "$KERNEL_SRCDIR" 2>&1 | logger || die
fi
rm -rf "$RPMTOPDIR"
rm -rf "$KERNEL_SRCDIR/.git"

Expand All @@ -783,7 +793,11 @@ else

echo "$ARCHVERSION" > "$VERSIONFILE" || die

[[ -z "$CONFIGFILE" ]] && CONFIGFILE="$KERNEL_SRCDIR/configs/kernel$ALT-$KVER-$ARCH.config"
if [[ "$DISTRO" = openEuler ]]; then
[[ -z "$CONFIGFILE" ]] && CONFIGFILE="/boot/config-${ARCHVERSION}"
else
[[ -z "$CONFIGFILE" ]] && CONFIGFILE="$KERNEL_SRCDIR/configs/kernel$ALT-$KVER-$ARCH.config"
fi

(cd "$KERNEL_SRCDIR" && make mrproper 2>&1 | logger) || die

Expand Down Expand Up @@ -841,6 +855,9 @@ fi
# shellcheck disable=SC1090
source "$CONFIGFILE"

[[ "$DISTRO" = openEuler ]] && [[ -z "$CONFIG_LIVEPATCH_PER_TASK_CONSISTENCY" ]] && \
die "openEuler kernel doesn't have 'CONFIG_LIVEPATCH_PER_TASK_CONSISTENCY' enabled"
Copy link
Contributor

@joe-lawrence joe-lawrence Apr 27, 2022

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm guessing OpenEuler sets CONFIG_LIVEPATCH_PER_TASK_CONSISTENCY by default, but is it absolutely necessary that it be turned on for this distro? IOW, could one build conventional livepatches on this kernel? Thanks.

Copy link
Contributor Author

@anatasluo anatasluo Apr 27, 2022

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Q: Could one build conventional livepatches on this kernel?
A: yes, but absolutely necessary to need CONFIG_LIVEPATCH_PER_TASK_CONSISTENCY set.

As we can see from the source code of the openEuler, without CONFIG_LIVEPATCH_PER_TASK_CONSISTENCY, there is even no klp_enable_patch function.
wechat_20220428012215

Q: Is CONFIG_LIVEPATCH_PER_TASK_CONSISTENCY set by default?
A: It depends on the version of the kernel. From this openEuler commit, I think they prefer to use their own strategy.


[[ -z "$CONFIG_DEBUG_INFO" ]] && die "kernel doesn't have 'CONFIG_DEBUG_INFO' enabled"

# Build variables - Set some defaults, then adjust features
Expand Down
13 changes: 13 additions & 0 deletions test/integration/lib.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -116,6 +116,19 @@ kpatch_centos_dependencies()
sudo yum remove -y epel-release
}

kpatch_openEuler_dependencies()
{
local kernel_version
local arch
kernel_version=$(uname -r)
arch=$(uname -m)

sudo yum install -y make gcc patch bison flex openssl-devel dwarves \
rpm-build dnf-plugins-core python3-devel openssl-devel ncurses-devel elfutils-libelf-devel
sudo yum install -y "kernel-source-${kernel_version%.*}" \
"kernel-debuginfo-${kernel_version%.*}" "kernel-devel-${kernel_version%.*}"
}

kpatch_dependencies()
{
# shellcheck disable=SC1091
Expand Down