Scribd
Upload
101 views

Kpatch: Dynamic Kernel Patching: Keltron Page - 1

kpatch is a Linux dynamic kernel patching system that allows patching a running kernel without rebooting. It uses four main components: kpatch-build converts source patches to patch modules; patch modules contain replacement functions; the kpatch core module hooks original functions to redirect to replacements; and a utility manages patch modules that can load at boot. kpatch-build compares original and patched objects, adds metadata, and links them into a patch module for dynamic application by the core module using function tracing. This allows critical security patches to be applied immediately without downtime.

Uploaded by

ratheeshbr
Copyright
© © All Rights Reserved
Available Formats
Download as DOCX, PDF, TXT or read online on Scribd
101 views

Kpatch: Dynamic Kernel Patching: Keltron Page - 1

kpatch is a Linux dynamic kernel patching system that allows patching a running kernel without rebooting. It uses four main components: kpatch-build converts source patches to patch modules; patch modules contain replacement functions; the kpatch core module hooks original functions to redirect to replacements; and a utility manages patch modules that can load at boot. kpatch-build compares original and patched objects, adds metadata, and links them into a patch module for dynamic application by the core module using function tracing. This allows critical security patches to be applied immediately without downtime.

Uploaded by

ratheeshbr
Copyright
© © All Rights Reserved
Available Formats
Download as DOCX, PDF, TXT or read online on Scribd
You are on page 1/ 2

kpatch: dynamic kernel patching

kpatch is a Linux dynamic kernel patching infrastructure which allows you to patch a running kernel
without rebooting or restarting any processes. It enables sysadmins to apply critical security patches to the
kernel immediately, without having to wait for long-running tasks to complete, for users to log off, or for
scheduled reboot windows. It gives more control over uptime without sacrificing security or stab
How it works
kpatch works at a function granularity: old functions are replaced with new ones. It has four main
components:
kpatch-build: a collection of tools which convert a source diff patch to a patch module. They work by
compiling the kernel both with and without the source patch, comparing the binaries, and generating a
patch module which includes new binary versions of the functions to be replaced.
patch module: a kernel module (.ko file) which includes the replacement functions and metadata about
the original functions.
kpatch core module: a kernel module (.ko file) which provides an interface for the patch modules to
register new functions for replacement. It uses the kernel ftrace subsystem to hook into the original
function's mcount call instruction, so that a call to the original function is redirected to the replacement
function.
kpatch utility: a command-line tool which allows a user to manage a collection of patch modules. One or
more patch modules may be configured to load at boot time, so that a system can remain patched even
after a reboot into the same version of the kernel.
kpatch-build
The "kpatch-build" command converts a source-level diff patch file to a kernel patch module. Most of its
work is performed by the kpatch-build script which uses a utility named create-diff-object to compare
changed objects.
The primary steps in kpatch-build are:
 Build the unstripped vmlinux for the kernel
 Patch the source tree
 Rebuild vmlinux and monitor which objects are being rebuilt. These are the "changed objects".
 Recompile each changed object with -ffunction-sections -fdata-sections, resulting in the changed
patched objects
 Unpatch the source tree

KELTRON Page | 1
 Recompile each changed object with -ffunction-sections -fdata-sections, resulting in the changed
original objects
 For every changed object, use create-diff-object to do the following:
o Analyze each original/patched object pair for patchability
o Add .kpatch.funcs and .rela.kpatch.funcs sections to the output object. The kpatch core
module uses this to determine the list of functions that need to be redirected using ftrace.
o Add .kpatch.dynrelas and .rela.kpatch.dynrelas sections to the output object. This will be
used to resolve references to non-included local and non-exported global symbols. These
relocations will be resolved by the kpatch core module.
o Generate the resulting output object containing the new and modified sections
o Link all the output objects into a cumulative object
 Generate the patch module
Patching
The patch modules register with the core module (kpatch.ko). They provide information about original
functions that need to be replaced, and corresponding function pointers to the replacement functions.
The core module registers a handler function with ftrace. The handler function is called by ftrace
immediately before the original function begins executing. This occurs with the help of the reserved
mcount call at the beginning of every function, created by the gcc -mfentry flag. The ftrace handler then
modifies the return instruction pointer (IP) address on the stack and returns to ftrace, which then restores
the original function's arguments and stack, and "returns" to the new function.
Limitations
Patches which modify init functions (annotated with __init) are not supported. kpatch-build will return an
error if the patch attempts to do so.
Patches which modify statically allocated data are not supported. kpatch-build will detect that and return
an error. (In the future we will add a facility to support it. It will probably require the user to write code
which runs at patch module loading time which manually updates the data.)
Patches which change the way a function interacts with dynamically allocated data might be safe, or
might not. It isn't possible for kpatch-build to verify the safety of this kind of patch. It's up to the user to
understand what the patch does, whether the new functions interact with dynamically allocated data in a
different way than the old functions did, and whether it would be safe to atomically apply such a patch to
a running kernel.
Patches which modify functions in vdso are not supported. These run in user-space and ftrace can't hook
them.

KELTRON Page | 2

You might also like