Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Live patching for Linux 3.20

lkml.iu.edu

Post reply on HN
Print view View original

21–30 of 32 posts

Re: Live patching for Linux 3.20

#21

Post by lemonade »

AlyssaRowan wrote: post #16
poims wrote: post #12

And it was officially merged into Linux this evening: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux....

I am very happy about this. It's been years in coming! We might finally get live updates on distros. (No thanks to Oracle, of course.) Wonder if we can also do it that well in userspace? (How does systemd behave with patching, actually?)

The original KSplice project was actually fully open source, funded by a Dutch charity called NLnet that funds lots of interesting projects like that. I've been running it ever since.

After this was all done the team got acquihired by Oracle. I was actually amazed that the team was allowed to keep the service up for some non-Oracle distro's.

But very happy to see a broader adoption of this kind of technology, it is essential for all these unmanned systems out there in the cloud that they can be patched whilst running.

Re: Live patching for Linux 3.20

#23

Post by donavanm »

DSMan195276 wrote: post #15
mkonecny wrote: post #10

Does anyone have a simple example of how this would work? I can't wrap my head around code evolving during runtime for any arbitrary binary change.

I took a quick look at the accepted patch. while I can't guarantee I know what's actually going on, my understanding is that patching individual functions works by sticking the replacement functions code somewhere new in memory, getting a pointer to it, and then over-writing the code in the old function to jump to the new one. (Kinda like short-circuiting the old function - all the old code still calls the old functi…

Basically yes. Check out the kprobes docs for a nice description of how these frameworks work ,https://www.kernel.org/doc/Documentation/kprobes.txt. Being able to intercept (and mangle) kernel function calls is awesome. With uprobes the same techniques work in userland as well.

Re: Live patching for Linux 3.20

#24

Post by desdiv »

lemonade wrote: post #21
AlyssaRowan wrote: post #16

Earlier quoted context omitted.

I am very happy about this. It's been years in coming! We might finally get live updates on distros. (No thanks to Oracle, of course.) Wonder if we can also do it that well in userspace? (How does systemd behave with patching, actually?)

The original KSplice project was actually fully open source, funded by a Dutch charity called NLnet that funds lots of interesting projects like that. I've been running it ever since. After this was all done the team got acquihired by Oracle. I was actually amazed that the team was allowed to keep the service up for some non-Oracle distro's. But very happy to see a broader adoption of this kind of technology, it is e…

Any reason why no one forked KSplice when the original team went to Oracle?

Re: Live patching for Linux 3.20

#25

Post by kasabali »

bjackman wrote: post #8

This is cool as fuck, I didn't know about kpatch or kGraft. Does anyone know if any other OSs have live kernel patching?

Windows Server 2003 had a live patching feature [1] and it was also applicable to kernel patching according to [2]. For some reason it was quickly abandoned, though.

[1] https://technet.microsoft.com/en-us/library/cc781109%28v=ws....

[2] http://jpassing.com/2011/05/01/windows-hotpatching/

Re: Live patching for Linux 3.20

#26

Post by AlyssaRowan »

desdiv wrote: post #24
lemonade wrote: post #21

Earlier quoted context omitted.

The original KSplice project was actually fully open source, funded by a Dutch charity called NLnet that funds lots of interesting projects like that. I've been running it ever since. After this was all done the team got acquihired by Oracle. I was actually amazed that the team was allowed to keep the service up for some non-Oracle distro's. But very happy to see a broader adoption of this kind of technology, it is e…

Any reason why no one forked KSplice when the original team went to Oracle?

Yes: KSplice had software patents - Oracle bought them. And everyone knows what Oracle is like with software patents: aggressive!

I'm not clear what they actually cover, and can't look them up right now, but I'd thought they were specific on how KSplice in particular operates, both applying hotpatches and analysing the source to create them. I don't know whether they'd apply to anything else, or whether there is prior art, but they're an obvious landmine to be aware of and to avoid. So a simple fork wouldn't do unless it'd change the way it actually worked. A fresh approach was needed, and we seem to have two fresh approaches here.

I'm trusting they've been avoided here. They probably have, as this is much more general? The concept of hot patches are of course fine, people have been doing that for decades, and you can't patent concepts.

The lesson here: please don't patent stuff jn your open-source software, in case you wake up one day and got acquihired by Evil™.

Re: Live patching for Linux 3.20

#27

Post by teddyh »

AlyssaRowan wrote: post #26
desdiv wrote: post #24

Earlier quoted context omitted.

Any reason why no one forked KSplice when the original team went to Oracle?

Yes: KSplice had software patents - Oracle bought them. And everyone knows what Oracle is like with software patents: aggressive! I'm not clear what they actually cover, and can't look them up right now, but I'd thought they were specific on how KSplice in particular operates, both applying hotpatches and analysing the source to create them. I don't know whether they'd apply to anything else, or whether there is prio…

> The lesson here: please don't patent stuff jn your open-source software, in case you wake up one day and got acquihired by Evil™.

Or use a a license with a patent grant, like Apache 2.0 or GPL 3.

Re: Live patching for Linux 3.20

#28

Post by feld »

SEJeff wrote: post #11
feld wrote: post #9

Earlier quoted context omitted.

FreeBSD has not gone quite that far, but there was a PoC for loading new kernels without rebooting. https://www.bsdcan.org/2012/schedule/events/325.en.html

Yup Linux has had a similar feature, kexec, for several years.

Everyone I talked to about it since has said "nobody seems to care enough to bother completing it"

It is kind of a niche feature, really.

Re: Live patching for Linux 3.20

#29

Post by rockdoe »

peterwwillis wrote: post #6

An interesting case of the Cathedral causing siloed duplication, and the Bazaar creating a better solution without duplication.

Ignoring the fact that both SuSE and Red Hat are paying the involved engineers their paychecks in order to get the feature in their silo first.

Re: Live patching for Linux 3.20

#30

Post by AlyssaRowan »

AlyssaRowan wrote: post #26
desdiv wrote: post #24

Earlier quoted context omitted.

Any reason why no one forked KSplice when the original team went to Oracle?

Yes: KSplice had software patents - Oracle bought them. And everyone knows what Oracle is like with software patents: aggressive! I'm not clear what they actually cover, and can't look them up right now, but I'd thought they were specific on how KSplice in particular operates, both applying hotpatches and analysing the source to create them. I don't know whether they'd apply to anything else, or whether there is prio…

OK, I've now looked up the Ksplice patents that I know of. (I may not have found them all, but I think I probably have?) Here be dragons! (Those who are ordered not to read patents: Don't click on the links in this post.)

Of course the time they were granted (to Oracle, after Ksplice were bought) the applications became nigh-impenetrable patentese that really need a US-qualified patent attorney to interpret, so I'm absolutely not going to try and I'm just going to post what I found here.

Application: https://www.google.co.uk/patents/US20100269105 became patent https://www.google.co.uk/patents/US8612951 (B2) "Method of determining which computer program functions are changed by an arbitrary source code modification". (They've also cited a patent for a… coffeepot. OK, I'm pretty sure that bit's a typo. )

Application: https://www.google.co.uk/patents/US20100083224 seems to have become patent https://www.google.co.uk/patents/US8261247 (B2) "Method of modifying code of a running computer program based on symbol values discovered from comparison of running code to corresponding object code".

Application: https://www.google.co.uk/patents/US20100269106 does not seem to have been granted directly, but then there's patent https://www.google.co.uk/patents/US8607208 "System and methods for object code hot updates" which I think is a continuation-in-part of it and oh I've gone cross-eyed, get a professional.

Post reply on HN