kpatch-cc: exclude arch/x86/platform/pvh/* from diffing - #1515
Open
benjamindonnachie wants to merge 1 commit into
Open
kpatch-cc: exclude arch/x86/platform/pvh/* from diffing#1515benjamindonnachie wants to merge 1 commit into
benjamindonnachie wants to merge 1 commit into
Conversation
arch/x86/platform/pvh/head.o is Xen PVH boot entry code: it runs exactly once, very early at boot, before the kernel proper (and therefore before livepatch infrastructure) is even up. It can never legitimately be part of any livepatch. kpatch-cc already excludes the same category of early-boot-only, never-livepatchable code (arch/x86/boot/*, arch/x86/entry/vdso/*, arch/x86/purgatory/*, arch/x86/realmode/*, the EFI stub, etc.) from being copied into the orig/patched diffing pipeline at all. arch/x86/platform/pvh/* was simply missing from that list. Without this, a patch series that happens to touch a widely-included header (kpatch-build recompiles any file Kbuild considers stale, not just the files a patch series actually changes) can drag pvh/head.o into diffing, where its unusual 32-bit relocations and low-level address arithmetic can trip create-diff-object in ways unrelated to any real patch content. Reproduced building a real cumulative EL9 5.14 kernel livepatch. Co-authored-by: Claude <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Part of #1514.
arch/x86/platform/pvh/head.ois Xen PVH boot entry code: it runsexactly once, very early at boot, before the kernel proper (and
therefore before livepatch infrastructure) is even up. It can never
legitimately be part of any livepatch.
kpatch-ccalready excludes the same category of early-boot-only,never-livepatchable code (
arch/x86/boot/*,arch/x86/entry/vdso/*,arch/x86/purgatory/*,arch/x86/realmode/*, the EFI stub, etc.)from being copied into the orig/patched diffing pipeline at all.
arch/x86/platform/pvh/*was simply missing from that list.Without this, a patch series that happens to touch a widely-included
header (kpatch-build recompiles any file Kbuild considers stale, not
just the files a patch series actually changes) can drag
pvh/head.ointo diffing, where its unusual 32-bit relocations andlow-level address arithmetic can trip
create-diff-objectin waysunrelated to any real patch content.
Testing
Reproduced and fixed while building a real cumulative EL9 5.14
kernel livepatch (11 CVEs, base 5.14.0-687.25.1.el9_8 → target
5.14.0-687.38.1.el9_8). See #1514 for the full context, including
the other three fixes needed to get that build all the way through.
Co-authored-by: Claude noreply@anthropic.com