pf-linux-port/docs/en/patches.md

Linux core patch set

Português: docs/pt-BR/patches.md.

Current status: EMPTY

The port requires zero modifications to the Linux 7.3.4 core. The design (spec §5) anticipated one mandatory patch — P1: export symbols needed by the PF module — but the M1 compile-port proved it unnecessary: modpost reported no undefined symbols for pf.ko. The compat layer was written against APIs the stock kernel already exports (__inet_lookup_established, __inet_lookup_listener, __inet6_lookup_established, inet6_lookup_listener, __udp4_lib_lookup, __udp6_lib_lookup, ip_route_output_flow/ip6_route_output_flags via inline wrappers, icmp_send, …). The evidence and the exact list live in patches/kernel/p1-needs.txt, which also carries a watch list: e.g. tcp_v4_send_reset would need an export only if userland RST helpers are used.

patches/kernel/ therefore contains no 000N-*.patch today, and applying the (empty) set is a no-op.

Honest note: install.md and the design mention scripts/apply-patches.sh, scripts/unpatch.sh and patches/kernel/series. Those helpers are not in the tree yet; until they land, "apply the patch set" is by definition nothing to do. When a real patch is needed, the first commit that adds it MUST also add the two scripts and the series file (see rules below).

The mechanism (how the set is meant to work)

• Every kernel-core change is a standalone file patches/kernel/000N-short-description.patch, listed in order in patches/kernel/series, applied to the pristine kernel tree with git apply-style tooling and reverted the same way (unpatch.sh reverse-applies).
• The tree must never be left dirty silently: builds that must be reproducible apply, build, and record the state (out/.config, out/kernelversion).
• Hard rules for any future patch:
  1. Additive, zero behavior change (e.g. EXPORT_SYMBOL_GPL() lines adjacent to existing export clusters). Anything that alters logic needs a design-spec amendment first.
  2. One concern per patch, numbered sequentially — never edit a landed patch; supersede with a new number.
  3. A section in this file (both languages) before the patch lands: what/why/impact/revert + the VM evidence.
  4. The patch must survive make -C <kerneldir> bzImage modules from a clean tree (CI-of-the-lab: vm-run-tests.sh after a fresh boot).

Template for a future 000N entry

Copy this block into both docs/en/patches.md and docs/pt-BR/patches.md (EN above the pt-BR file's same anchor) when adding 000N-*.patch:

### 000N — <one-line title>

- File: `patches/kernel/000N-<slug>.patch`
- Status: landed (kernel 7.3.4) / superseded by 000M
- Touches: <file(s) in the kernel tree>, <n> added lines, 0 removed
- What: <exact symbols / hooks / Kconfig knobs added>
- Why: <which PF-on-Linux code needs it; why no exported API suffices>
- Impact: <runtime/ABI/memory impact on plain Linux; expected: none>
- Revert: `./scripts/unpatch.sh <kerneldir>` (reverse-apply); module
  then fails to link with the missing symbol named in modpost output.
- Evidence: <VM run id / date / relevant gate output>

Change log of this directory

Date	Change
2026-11-11	P1 evaluated after M1 compile-port → not needed; p1-needs.txt records the evidence and the watch list. Set remains empty.