Linux Kernel Live Patching

on YouTube ↗33m

" summary

Describes a live kernel patching method that replaces whole functions at runtime to avoid reboots, using ftrace fentry for redirection and stop_machine plus stack walking to guarantee no patched function is on any task stack, with generated patch modules and kpatch packaging. Notes a measured overhead up to 30% when using heavy tracing, recommends switching tracing modes, and shows a real fix that restores creation of >65,000 cgroups/containers without reboot. Limitations include no structural feature adds and manual handling for complex data-structure changes via shadow variables.

AI-written summary · about

" chapters (14)

1. 0:00Intro
2. 0:15What is live patching
3. 2:15Why live patching
4. 5:50FTrace
5. 7:57Scheduling
6. 9:10Schedule Function
7. 10:58Stop Machine
8. 13:48Before Patching
9. 14:42Security Check
10. 15:44Verify Backtrace
11. 18:29Generating Live Patching
12. 19:38Review
13. 21:01Demo
14. 26:40QA

" related talks

• 28mHyperscale Kernel Live Patching at MetaSong Liu, David Carl Vernet · LinuxCon @ OSS Japan 2022
• 33mHow We Learned to Fix Planes MidflightEvgeniy Kolomeets · HighLoad++ 2017
• 24mKLP for Clang LTO KernelYonghong Song · Linux Plumbers Conference 2023
• 34mLivepatch Visibility at ScaleBreno Leitao · Linux Plumbers Conference 2023
• 33mPreserving IOMMU States During Kexec RebootFam Zheng · KVM Forum 2022
• 30mYou Might Still Need Patches for DenimDan Lorenc, Maya Kaczorowski · BSidesSF 2019
• 15mKVM Live Upgrade with Properly Handling of Passthrough DevicesZhiming Feng · KVM Forum 2020
• 16mXkernel: Principled Performance Tunability of Operating System KernelsWentao Zhang, Tianyin Xu, Fengyuan Ren, Ran Shu, Zhongjie Chen, Yulong Tang, Jing Liu · 20th USENIX Symposium on Operating Systems Design and Implementation (OSDI '26)