Software:kpatch

From HandWiki

kpatch
Developer(s)Red Hat
Initial releaseFebruary 26, 2014 (2014-02-26)[1]
Operating systemLinux
TypeKernel extension
LicenseGNU GPL version 2
Websitegithub.com/dynup/kpatch

kpatch is a feature of the Linux kernel that implements live patching of a running kernel, which allows kernel patches to be applied while the kernel is still running. By avoiding the need for rebooting the system with a new kernel that contains the desired patches, kpatch aims to maximize the system uptime and availability. At the same time, kpatch allows kernel-related security updates to be applied without deferring them to scheduled downtimes.[1][2] Internally, kpatch allows entire functions in a running kernel to be replaced with their patched versions, doing that safely by stopping all running processes while the live patching is performed.[3]

kpatch is developed by Red Hat, with its source code licensed under the terms of the GNU General Public License version 2 (GPLv2).[1] In May 2014, kpatch was submitted for inclusion into the Linux kernel mainline,[4] and the minimalistic foundations for live patching were merged into the Linux kernel mainline in kernel version 4.0, which was released on April 12, 2015.[5]

Internals

With live patching in place, calls to patched kernel functions invoke their replacement counterparts.[6]:2:07

Internally, kpatch consists of two parts – the core kernel module executes the live patching mechanism by altering kernel's inner workings, while a set of userspace utilities prepares individual hot patch kernel modules from source diffs and manages their application. Live kernel patching is performed at the function level, meaning that kpatch can replace entire functions in the running kernel with their patched versions by using facilities provided by ftrace to "route around" old versions of functions; that way, hot patches can also easily be undone. No changes to the kernel's internal data structures are possible; however, security patches, which are one of the natural candidates to be used with kpatch, rarely contain changes to the kernel's data structures.[3][4][6]

kpatch ensures that hot patches are applied atomically and safely by stopping all running processes while the hot patch is applied, and by ensuring that none of the stopped processes is running inside the functions that are to be patched. Such an approach simplifies the whole live patching mechanism and prevents certain issues associated with the way data structures are used by original and patched versions of functions. As the downside, this approach also leaves the possibility for a hot patch to fail, and introduces a small amount of latency required for stopping all running processes.[3][4][6]

History

Red Hat announced and publicly released kpatch in February 2014 under the terms of the GNU General Public License version 2 (GPLv2),[1] shortly before SUSE released its own live kernel patching implementation called kGraft.[7] kpatch was merged into the Linux kernel mainline, and it was submitted for the inclusion in May 2014.[4][8]

kpatch has been included in Red Hat Enterprise Linux 7.0, released on June 10, 2014, as a technology preview.[9][10]

Minimalistic foundations for live kernel patching were merged into the Linux kernel mainline in kernel version 4.0, which was released on April 12, 2015. Those foundations, based primarily on the kernel's ftrace functionality, form a common core capable of supporting hot patching by both kpatch and kGraft, by providing an application programming interface (API) for kernel modules that contain hot patches and an application binary interface (ABI) for the userspace management utilities. However, the common core included into Linux kernel 4.0 supports only the x86 architecture and does not provide any mechanisms for ensuring function-level consistency while the hot patches are applied.[5][11][12]

Since April 2015, there is ongoing work on porting kpatch to the common live patching core provided by the Linux kernel mainline.[12] However, implementation of the required function-level consistency mechanisms has been delayed because the call stacks provided by the Linux kernel may be unreliable in situations that involve assembly code without proper stack frames; as a result, the porting work remains in progress (As of September 2015). In an attempt to improve the reliability of kernel's call stacks, a specialized sanity-check stacktool userspace utility has also been developed.[13][14]

See also

  • Dynamic software updating, a field of research focusing on upgrading programs while they are running
  • kexec, a method for loading a whole new Linux kernel from a running system
  • Ksplice and KernelCare, other Linux kernel live patching technologies developed by Ksplice, Inc. (later acquired by Oracle) and CloudLinux, respectively

References

  1. ↑ 1.0 1.1 1.2 1.3 "Introducing kpatch: Dynamic Kernel Patching". February 26, 2014. http://rhelblog.redhat.com/2014/02/26/kpatch/. 
  2. ↑ Sean Michael Kerner (June 6, 2014). "Linux Kernel Patching Gets Dynamic". ServerWatch. http://www.serverwatch.com/server-news/linux-kernel-patching-get-dynamic.html. 
  3. ↑ 3.0 3.1 3.2 Jonathan Corbet (May 7, 2014). "The first kpatch submission". LWN.net. https://lwn.net/Articles/597407. 
  4. ↑ 4.0 4.1 4.2 4.3 Josh Poimboeuf (May 1, 2014). "kpatch: dynamic kernel patching". LWN.net. https://lwn.net/Articles/597123/. 
  5. ↑ 5.0 5.1 "Linux kernel 4.0, Section 1.2. Live patching". April 26, 2015. http://kernelnewbies.org/Linux_4.0#head-9aa7c8499b42911a48c02b24f367bf2bc6db8606. 
  6. ↑ 6.0 6.1 6.2 "Dynamic Kernel Patching". Red Hat. June 10, 2014. https://www.youtube.com/watch?v=HAJUQ_KJF_Y. 
  7. ↑ "SUSE Releases kGraft for Live Patching of Linux Kernel". SUSE. March 27, 2014. https://www.suse.com/company/press/2014/3/suse-releases-kgraft-for-live-patching-of-linux-kernel.html. 
  8. ↑ Michael Larabel (May 1, 2014). "SUSE Posts kGraft, Red Hat Posts Kpatch Patches". Phoronix. https://www.phoronix.com/scan.php?page=news_item&px=MTY3ODA. 
  9. ↑ "Red Hat Enterprise Linux 7.0 Release Notes, Chapter 5. Kernel". Red Hat. July 15, 2014. https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/7.0_Release_Notes/chap-Red_Hat_Enterprise_Linux-7.0_Release_Notes-Kernel.html. 
  10. ↑ Carlos Sanchez (June 26, 2014). "Red Hat Releases Red Hat Enterprise Linux 7 with Increased Linux Containers Support". http://www.infoq.com/news/2014/06/red-hat-enterprise-linux-7. 
  11. ↑ Jonathan Corbet (February 25, 2015). "A rough patch for live patching". LWN.net. https://lwn.net/Articles/634649/. 
  12. ↑ 12.0 12.1 "Linux kernel source tree: kernel/git/torvalds/linux.git: Pull live patching infrastructure from Jiri Kosina". kernel.org. February 11, 2015. https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=1d9c5d79e6e4385aea6f69c23ba543717434ed70. 
  13. ↑ Jonathan Corbet (September 30, 2015). "Compile-time stack validation". LWN.net. https://lwn.net/Articles/658333/. 
  14. ↑ Josh Poimboeuf (September 24, 2015). "Linux kernel documentation: Documentation/stack-validation.txt (from the v13 patch)". LWN.net. https://lwn.net/Articles/658347/. 

External links




Retrieved from "https://handwiki.org/wiki/index.php?title=Software:Kpatch&oldid=3043138"