dynup/kpatch

Purpose and entry points

kpatch is a Linux live-kernel-patching toolchain: it turns a kernel source diff into a loadable livepatch module, then manages that module without rebooting. The user-facing entry points are kpatch-build/kpatch-build for building and kpatch/kpatch for loading, unloading, and managing generated modules. Top-level build orchestration is in Makefile and Makefile.inc.

Build pipeline orchestration

kpatch-build/kpatch-build drives the stateful build workflow against a prepared kernel source/build tree: build the original kernel, apply the source patch, rebuild to identify changed objects, rebuild affected objects with function/data sections, then restore and compare original versus patched artifacts. kpatch-build/kpatch-cc acts as the compiler wrapper used during those rebuild stages. This boundary depends on the target kernel’s build system, GCC, kernel configuration, and matching build artifacts.

ELF comparison and patch-object generation

The native build tools transform paired original/patched ELF objects into a patchable representation:

• kpatch-build/create-diff-object.c analyzes changed functions/sections and emits kpatch metadata plus replacement code.

• kpatch-build/kpatch-elf.c and kpatch-build/kpatch-elf.h provide ELF parsing, rewriting, symbol, section, and relocation handling.

• kpatch-build/lookup.c resolves relevant symbol information.

The key output is an object containing replacement sections plus function-redirection and dynamic-relocation metadata, later linked into a .ko module.

Module assembly and ABI variants

Module generators package transformed objects and metadata for the target livepatch mechanism:

• kpatch-build/create-kpatch-module.c

• kpatch-build/create-klp-module.c

• kpatch-build/kpatch-intermediate.h

This is an important compatibility boundary: generated modules must match the running kernel’s ABI, symbols, architecture, and CONFIG_LIVEPATCH behavior. The repository supports x86-64, ppc64le, arm64, s390, and loongarch64; GCC plugin support includes kpatch-build/gcc-plugins/ppc64le-plugin.c.

Runtime patch module framework

Generated modules include common patch-side headers, linker layout, hooks, and macros from kmod/patch/, notably kmod/patch/kpatch-patch.h, kmod/patch/kpatch-macros.h, and kmod/patch/kpatch.lds.S. The patch module registers replacement functions with the kernel livepatch subsystem, which redirects execution at function granularity, generally via ftrace. Patch modules can also contain callbacks, syscall-specific support, and relocation metadata.

Kernel-resident kpatch core

The optional/core runtime module resolves patch-local references and supports advanced patch behavior not handled solely by upstream livepatch:

• kmod/core/core.c

• kmod/core/shadow.c

• kmod/core/kpatch.h

Its core responsibilities include processing generated function and dynamic-relocation metadata and providing shadow-variable support for associating replacement state with existing kernel objects. This code runs in kernel context and interacts directly with kernel module, symbol, livepatch, and ftrace facilities.

Operations, persistence, and validation

kpatch/kpatch is the privileged operational CLI; loading modules requires kernel module privileges (CAP_SYS_MODULE) and state is observable through /sys/kernel/livepatch. Packaging includes a systemd unit at contrib/kpatch.service and RPM-oriented files such as contrib/kpatch.spec. Integration coverage is organized by target kernel/distribution under test/integration/ (for example test/integration/rhel-9.7), reflecting the central risk: compiler and kernel-version-specific patchability and runtime correctness.