klp-build(1)

📦 version 0~20250108.8e6c7f6, in opensuse-leap 16.0

🌸 NAME

okay so klp-build — the kernel livepatching creation tool. That’s literally the whole NAME section, bestie: it’s the klp-build(1) tool for making kernel livepatches, and it’s here to help 💅

✨ SYNOPSIS

klp-build <command> [-h] [-n NAME] [--filter FILTER]

🦋 DESCRIPTION

klp-build is a tool meant for automating the whole process of creating and testing livepatches for the Linux kernel (SLE edition). To reduce the burden of livepatch development, it’s also capable of checking which codestreams are vulnerable, batching multiple codestreams in parallel, and remotely building and running tests. whole workflow, no cap ✨

🎀 OPTIONS

Generic options available for all commands:

  • -h, --help — show command’s help message and exit. polite icon behavior 🫶
  • -n, --name NAME — the livepatch name. This will be the directory name of the resulting livepatches. name your child wisely 💅
  • --filter FILTER — list of accepted codestreams. Must be specified in regex format. Example: "15.3u[0-9]+|15.6u0". regex girlies rise

👑 COMMANDS

🔍 scan

In the scan, klp-build does a shallow analysis of the given CVE, searching for already patched codestreams and reporting those that most likely are still affected by the bug. This subcommand does not store any data, because it’s mainly targeted for automation and not for livepatch development. For the latter, see the setup subcommand. iykyk

  • --cve CVE — the CVE to be analyzed. give it the tea

🛠️ setup

During the setup, klp-build analyzes each codestream in order to identify those affected by the indicated CVE. Note that in this phase a lot of per-codestream data is generated and stored for future use. homework era 📚

  • --cve CVE — the CVE assigned to this livepatch.
  • --conf CONF — the kernel CONFIG used to build the object to be livepatched.
  • --no-check — do not check for already patched codestreams; do the setup for all non filtered codestreams.
  • --codestreams CODESTREAMS — codestreams affected by the CVE. Can be used as a regex, like "15.u[34]". regex again, slay
  • --file-funcs [FILE_FUNCS ...] — file and functions to be livepatched. Can be set multiple times. The format is: --file-funcs file/path.c func1 func2... --file-funcs file/patch2.c func1 func2...
  • --mod-file-funcs [MOD_FILE_FUNCS ...] — module, file and functions to be livepatched. Can be set multiple times. The format is: --mod-file-funcs module1 file/path.c func1 func2... --mod-file-funcs module2 file/patch2.c func1 func2...
  • --conf-mod-file-funcs [CONF_MOD_FILE_FUNCS ...] — conf, module, file and functions to be livepatched. Can be set multiple times. The format is: --conf-mod-file-funcs conf1 module1 file/path.c func1 func2... --conf-mod-file-funcs conf2 module2 file/patch2.c func1 func2...
  • --module MODULE — the module that will be livepatched for all files. If empty, vmlinux will be livepatched instead.
  • --archs {ppc64le,s390x,x86_64} [{ppc64le,s390x,x86_64} ...] — supported architectures for this livepatch. arch buffet
  • --skips SKIPS — list of excluded codestreams. Must be specified in regex format. Example: "15.3u[0-9]+|15.6u0".

🕵️ check-inline

check-inline is in the building, bestie — its options are:

  • --codestreams CODESTREAMS — codestream to check the inlined symbol.
  • --file FILE — file to be checked.
  • --symbol SYMBOL — symbol to be found. found it, periodt

✂️ extract

In this phase, klp-build creates the livepatch for each affected codestream based on the data generated during the setup. Results may differ greatly depending on the back-end tool selected for the livepatch creation. backend roulette, but make it kernel 🎲

  • --avoid-ext AVOID_EXT [AVOID_EXT ...] — functions to be copied into the livepatch instead of externalizing them. Useful to make sure to include symbols that are optimized in different architectures.
  • --apply-patches — apply patches found by get-patches command, if they exist.
  • --codestreams CODESTREAMS CODESTREAMS — apply diff on two different codestreams. two codestreams, one diff

🧁 format-patches

Extract patches from kgraft-patches (see the SEE ALSO section).

  • -v , --version VERSION — version to be added, like vX. yes, the comma spacing is exactly like that 💅

🔎 get-patches

Find and list the kernel versions with a backported fix to the indicated CVE.

  • --cve CVE — CVE number to search for related backported patches.

🧹 cleanup

Remove livepatch packages from SUSE's Build Service. delete, but make it corporate 🫶

🧪 prepare-tests

Generates a tar archive per supported architecture containing scripts and files that can later be used to run tests in the desired test benches. test era loading…

🚀 push

Push the generated livepatch packages to SUSE's Build Service. By doing so, klp-build can automate the building phase for each codestream and architecture. CI but make it livepatch 🔥

  • --wait — wait until all codestreams builds are finished.

📊 status

Check the status of the livepatch building phase initiated by the push command. are we there yet

  • --wait — wait until all codestreams builds are finished.

📜 log

Get build logs from SUSE'S Build Service. receipts, bestie

  • --cs CS — the codestream to get the log from.
  • --arch {ppc64le,s390x,x86_64} — build architecture.

📁 FILES

  • ~/.config/klp-build/config — personal configuration file. your own little settings corner
  • ~/klp/livepatches — default directory where the livepatch data will be placed, including the data generated by the different stages of the livepatch creation. main storage vibes
  • ~/klp/data — default directory where the downloaded source code will be placed. source code goes here, bestie

🌈 EXAMPLES

Check if the codestreams for SLE 15.5 x86_64 and ppc64le are affected by CVE-2022-1048. This CVE affects snd_pcm_attach_substream() and snd_pcm_detach_substream() functions, located in the kernel module snd-pcm.

$ klp-build setup --name bsc1197597 --cve 2022-1048 --mod snd-pcm
--conf CONFIG_SND_PCM --file-funcs sound/core/pcm.c
snd_pcm_attach_substream snd_pcm_detach_substream --codestreams
'15.5' --archs x86_64 ppc64le

🔗 SEE ALSO

💜 AUTHOR

Contributors to the klp-build project. See the project’s GIT history for the complete list. the group chat, but historical

🚀 DISTRIBUTION

The latest version of klp-build may be downloaded from https://github.com/SUSE/klp-build go get the latest, bestie

okay bye bestie 💖 — this was klp-build(1) from the General Commands Manual. Latest version lives at https://github.com/SUSE/klp-build, and there’s no date on the footer so I’m not inventing one 💅

📦 where this page comes from