11–20 of 32 posts
This is cool as fuck, I didn't know about kpatch or kGraft. Does anyone know if any other OSs have live kernel patching?
FreeBSD has not gone quite that far, but there was a PoC for loading new kernels without rebooting. https://www.bsdcan.org/2012/schedule/events/325.en.html
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux....
Does anyone have a simple example of how this would work? I can't wrap my head around code evolving during runtime for any arbitrary binary change.
I don't think it can do arbitrary changes, it "only" applies specially prepared changes to the running system by replacing function call targets while tasks are sleeping. The biggest limitation to changes probably is that old and new code runs in parallel, so you can only do changes to data structures that won't confuse the old code. "Simplest" use case might be adding guards against exploits to syscalls.
I can't tell how viable it would be for the new code to build an entire parallel structure and to only switch to this after everything is migrated, or how deep into the kernel these changes could go. Could one fix a file system driver while using the file system?
Does anyone have a simple example of how this would work? I can't wrap my head around code evolving during runtime for any arbitrary binary change.
It looks like, however, because kernel modules seem to be in elf format (Don't quote me on that, just going from the code), elf format includes a 'relocation table', which is basically a table that says "this function is located here, and this next function is located here, and ..." for every function in the module. Ignoring why that is actually there, they can take advantage of the relocation table and replace a functions location with the location of the replacement function, effectively overwriting the old one. Even if it's still in memory (I can't tell if it gets removed or not) the code will never be called again.
From there, the discussion mostly seems to be around how to 'stop' the kernel enough to be able to replace the function without resulting in a mess because something was trying to use that function at the same time that you replaced it.
And it was officially merged into Linux this evening: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux....
We might finally get live updates on distros. (No thanks to Oracle, of course.)
Wonder if we can also do it that well in userspace? (How does systemd behave with patching, actually?)
Does anyone have a simple example of how this would work? I can't wrap my head around code evolving during runtime for any arbitrary binary change.
(just what I gathered from a bit of mailing-list reading, if any of this is wrong please correct me) I don't think it can do arbitrary changes, it "only" applies specially prepared changes to the running system by replacing function call targets while tasks are sleeping. The biggest limitation to changes probably is that old and new code runs in parallel, so you can only do changes to data structures that won't confu…
This is cool as fuck, I didn't know about kpatch or kGraft. Does anyone know if any other OSs have live kernel patching?
Earlier quoted context omitted.
lkml.org explicitly states that they are unofficial. From https://lkml.org , "In case you haven't read the titlebar of your web browser's window: this site is the (unofficial) Linux Kernel Mailing List archive."
Firefox Nightly doesn't display that neither in the tab name nor the Xwindow title. I'd never have seen this ...
Maybe they forgot to keep the "unofficial" in the title?
This is cool as fuck, I didn't know about kpatch or kGraft. Does anyone know if any other OSs have live kernel patching?