[PATCH 02/11] klp-build: Add --patch-only option

From: Song Liu

Date: Fri Oct 16 2026 - 20:25:43 EST


klp-build fixes the input patches before building the patched kernel:
it combines them into a single patch against the original source and
adds #line directives, so that unchanged functions further down a
patched file keep their __LINE__ values. This only happens after the
original kernel has been built, so seeing the result, or testing this
step, takes a full kernel build and --keep-tmp.

Add a --patch-only option which validates and fixes the patches, prints
the fixed patch to stdout, and exits without building. It skips the
.config checks and the kernel version setup, which only matter for
building, so the tree it runs in doesn't need to be configured. It
uses a private tmp dir rather than klp-tmp, which may hold a previous
build that a later --short-circuit run wants to reuse.

Assisted-by: Claude:claude-opus-5
Signed-off-by: Song Liu <song@xxxxxxxxxx>
---
scripts/livepatch/klp-build | 28 ++++++++++++++++++++++++++--
1 file changed, 26 insertions(+), 2 deletions(-)

diff --git a/scripts/livepatch/klp-build b/scripts/livepatch/klp-build
index 6cdc36e97c21..295fad62d7b8 100755
--- a/scripts/livepatch/klp-build
+++ b/scripts/livepatch/klp-build
@@ -19,7 +19,7 @@ set -o nounset
# This helps keep execution in pipes so pipefail+ERR trap can catch errors.
shopt -s lastpipe

-unset DEBUG_CLONE DIFF_CHECKSUM SKIP_CLEANUP VERBOSE XTRACE
+unset DEBUG_CLONE DIFF_CHECKSUM PATCH_ONLY SKIP_CLEANUP VERBOSE XTRACE

REPLACE=1
SHORT_CIRCUIT=0
@@ -137,6 +137,7 @@ Options:

Advanced Options:
-d, --debug Show symbol/reloc cloning decisions
+ --patch-only Print the fixed patch(es) and exit without building
-S, --short-circuit=STEP Start at build step (requires prior --keep-tmp)
1|orig Build original kernel (default)
2|patched Build patched kernel
@@ -160,7 +161,7 @@ process_args() {
local patch

short="hfj:o:vdS:T"
- long="help,show-first-changed,jobs:,output:,no-replace,verbose,debug,short-circuit:,keep-tmp"
+ long="help,show-first-changed,jobs:,output:,no-replace,verbose,debug,patch-only,short-circuit:,keep-tmp"

args=$(getopt --options "$short" --longoptions "$long" -- "$@") || {
echo; usage; exit
@@ -202,6 +203,10 @@ process_args() {
keep_tmp=1
shift
;;
+ --patch-only)
+ PATCH_ONLY=1
+ shift
+ ;;
-S | --short-circuit)
[[ ! -d "$TMP_DIR" ]] && die "--short-circuit requires preserved klp-tmp dir"
keep_tmp=1
@@ -238,6 +243,15 @@ process_args() {
KEEP_TMP="$keep_tmp"
PATCHES=("$@")

+ if [[ -v PATCH_ONLY ]]; then
+ (( SHORT_CIRCUIT > 0 )) && die "--patch-only can't be used with --short-circuit"
+
+ # Leave klp-tmp alone, it may hold a previous build
+ TMP_DIR="$(mktemp -d)"
+ PATCH_TMP_DIR="$TMP_DIR/tmp"
+ KEEP_TMP=0
+ fi
+
for patch in "${PATCHES[@]}"; do
[[ -f "$patch" ]] || die "$patch doesn't exist"
done
@@ -462,6 +476,9 @@ do_init() {
[[ -x "$FIX_PATCH_LINES" ]] || die "can't find fix-patch-lines"
command -v recountdiff &>/dev/null || die "recountdiff not found (install patchutils)"

+ # The rest is only needed for building
+ [[ -v PATCH_ONLY ]] && return 0
+
validate_config
set_module_name
set_kernelversion
@@ -910,6 +927,13 @@ build_patch_module() {
process_args "$@"
do_init

+if [[ -v PATCH_ONLY ]]; then
+ validate_patches
+ fix_patches
+ cat "${PATCHES[@]}"
+ exit 0
+fi
+
if (( SHORT_CIRCUIT <= 2 )); then
status "Validating patch(es)"
validate_patches
--
2.53.0-Meta