This document discusses Ksplice, a technology that allows patching of the Linux kernel without requiring a reboot. Ksplice works by comparing the old and new object code of the kernel, generating a delta patch, and using address redirection to load the new code without interrupting running processes. It was developed at MIT and later acquired by Oracle. While promising for high availability systems, questions remain around its licensing and whether it infringes any patents.

1. OpenSource Trends Days 2012
Ksplice
Linux kernel patching without a reboot
Udo Seidel

2. OpenSource Trends Days 2012
Agenda
● Who?
● Why?
● How?
● Show!
● And?

3. OpenSource Trends Days 2012
Me :-)
● Teacher of mathematics
and physics
● PhD in experimental physics
● Started with Linux in 1996
● Linux/UNIX trainer
● Solution engineer in HPC
and CAx environment
● Head of a international distributed sysadmin team

4. OpenSource Trends Days 2012
Why?

5. OpenSource Trends Days 2012
Why kernel updates?
● Business critical applications on Linux
● Bug fixing
● New functions or improvements
● External requirements
● Importance of security, e.g. PCI-DSS

6. OpenSource Trends Days 2012
What is 'wrong' with reboots?
● Missing HA
● Procedures, Operations, ...
● External requirements

7. OpenSource Trends Days 2012
Do we really need a reboot?
Question ....

8. OpenSource Trends Days 2012
Looking back and around
● Not new
● mainframes
● hot updates for Unix
● Early days of Linux
● Picked up 'recently'
● Rootkits

9. OpenSource Trends Days 2012
How?
Hotfix preparation

10. OpenSource Trends Days 2012
Source code comparison
● One approach for generation of hot updates
● Looks simple ... but
● High programming language skills needed
● Analysis complex
● Code replacement unclear

11. OpenSource Trends Days 2012
Object code comparison
● New approach for generation of hot updates
● Advantages
● Reduced need for developing skills
● Implicit patch analysis
● Can be automated
● Challenges
● Object code generation
● Code replacement

12. OpenSource Trends Days 2012
Ksplice arises ...
● 2008/2009
● 4 students @ MIT
– Thesis from Jeff Arnolds
● Ksplice Inc. founded
– GPLv2
– Supported: Debian, Ubuntu, Fedora, CentOS, RHEL
● July 2011
● Acquired by Oracle

13. OpenSource Trends Days 2012
Ksplice – high level
● Patching original source code
● Generation of new object code
● Comparison of 'old' and new object code
● Load of the delta code
● Address redirection to activate new object code

14. OpenSource Trends Days 2012
Ksplice – how it works part I

15. OpenSource Trends Days 2012
Ksplice – some first details
● Creation of dedicated sections for functions and
structures of source code
● Identical compiler recommended
● Unnecessary replacement code possible
● Memory addresses?

16. OpenSource Trends Days 2012
Address determination – first trial
● Symbol to address translation
● Known from core dump analysis
● /boot/System.map
● Does not work here :-(

17. OpenSource Trends Days 2012
Address determination by Ksplice
● Pair up object code on disk (PRE) with object
code in memory (RUN)
● Filter of 'wrong' symbols
● Analysis of unknown address in PRE objects
via RUN objects

18. OpenSource Trends Days 2012
Address determination by Ksplice

19. OpenSource Trends Days 2012
Ksplice - more details
● Cancel if unexpected event during PRE-RUN
comparison
● PRE-RUN comparison => kernel module

20. OpenSource Trends Days 2012
Ksplice – how it works part I

21. OpenSource Trends Days 2012
Ksplice – how it works part II

22. OpenSource Trends Days 2012
Last step
● Tell the kernel to use the new object code
● Kernel module ksplice.ko
● Load the new object code
● Kernel module ksplice­new.ko

23. OpenSource Trends Days 2012
What else
● Limitations
● Scalability
● Patch context
● Patch size
● Unclear
● Patent violation?
● license

24. OpenSource Trends Days 2012
How?
Hotfix application

25. OpenSource Trends Days 2012
Client side
● Download via Ksplice client
● Modification of depmod and modprobe
● Update of initial ram disk
● Automation via SysV init scripts

26. OpenSource Trends Days 2012
Client commands
Command description
uptrack­install Install available patch(es)
uptrack­remove Remove installed
patch(es)
uptrack­show Status of installed and/or
available patches
uptrack­uname Effective/patched kernel
version
uptrack­upgrade Install all availabe
patches

27. OpenSource Trends Days 2012
Show!

28. OpenSource Trends Days 2012
Example
● CVE-2012-0207
● Kernel 2.6.36
● Bug in IGMP code
● Simple source code fix
diff ­­git a/net/ipv4/igmp.c b/net/ipv4/igmp.c ...
@@ ­875,6 +875,8 @@ static void igmp_heard_query ...
...
max_delay = IGMPV3_MRC(ih3>code)*...
+ if (!max_delay)
+ max_delay = 1; /* can't mod w/ 0 */
} else { /* v3 */

29. OpenSource Trends Days 2012
And?

30. OpenSource Trends Days 2012
Summary
● Promising technology
● Available for selected Linux distributions only
● Open questions on license/patent

31. OpenSource Trends Days 2012
References
● http://www.ksplice.com
● http://kerneltrap.org/mail-archive/linux-
kernel/2008/4/23/1570474
● http://cve.mitre.org/cgi-bin/cvename.cgi?
name=CVE-2012-0207

32. OpenSource Trends Days 2012
Thank you!

33. OpenSource Trends Days 2012
Ksplice
Linux kernel patching without a reboot
Udo Seidel