World Library  
Flag as Inappropriate
Email this Article


Article Id: WHEBN0041947332
Reproduction Date:

Title: KGraft  
Author: World Heritage Encyclopedia
Language: English
Subject: Kpatch, Linux kernel, Evdev, Kernel same-page merging, Debugfs
Publisher: World Heritage Encyclopedia


kGraft is a feature of the Linux kernel that implements live patching of a running kernel, which allows kernel patches to be applied while the kernel is still running. By avoiding the need for rebooting the system with a new kernel that contains the desired patches, kGraft aims to maximize the system uptime and availability. At the same time, kGraft allows kernel-related security updates to be applied without deferring them to scheduled downtimes.[1][2] Internally, kGraft allows entire functions in a running kernel to be replaced with their patched versions, doing that safely by selectively using original versions of functions to ensure per-process consistency while the live patching is performed.[3]

kGraft is developed by SUSE, and the source code is licensed under versions two and three of the GNU General Public License (GPL).[2][4] In April 2014, kGraft was submitted for inclusion into the Linux kernel mainline,[3] and the minimalistic foundations for live patching were merged into the Linux kernel mainline in kernel version 4.0, which was released on April 12, 2015.[5]


Internally, kGraft consists of two parts – the core kernel module executes the live patching mechanism by altering kernel's inner workings, while userspace utilities prepare individual hot patch kernel modules from source diffs. Live kernel patching is performed at the function level, meaning that kGraft can replace entire functions in the running kernel with their patched versions, while relying on the mechanisms and infrastructure established by ftrace to "route around" old versions of functions. No changes to the kernel's internal data structures are possible; however, security patches, which are one of the natural candidates to be used with kGraft, rarely contain changes to the kernel's data structures.[2][3][6]

While applying hot patches, kGraft does not require a running kernel to be stopped for patched versions of functions to be introduced into it. Instead of replacing functions atomically, kGraft provides consistent "world views" (or "universes") to userspace processes, kernel threads and interrupt handlers, which are monitored during their execution so the original versions of patched kernel functions can continue to be used. To accomplish that, kGraft maintains original versions of patched functions in a read-copy-update (RCU) fashion, and dynamically selects between the original and patched versions depending on which process, kernel thread or interrupt handler executes them. More specifically, original versions of functions continue to be used—​at the time when a hot patch is applied—​for processes currently executing within the kernel space, for kernel threads until they reach their completion points, and for currently executing interrupt handlers.[2][3][7][8]

Due to its design, kGraft does not introduce additional latency while applying hot patches. As the downside, original versions of patched kernel functions may be required to be maintained for extended periods of time in case there are processes that remain for too long within the kernel space; for example, a process may wait for I/O on a network socket. Also, as both original and patched versions of functions are allowed to be executed in parallel, troubles may arise if they use kernel's internal data structures in different ways.[3][8]

"World views" or "universes", maintained by kGraft in a RCU fashion[2]:14,15,17
Each process is monitored so it executes a patched function consistently within a single system call.
After everything migrates to a new "universe", trampoline-style checks are no longer needed.


SUSE announced kGraft in January 2014[9] and released it publicly in March 2014 under the GNU General Public License version 2 (GPLv2) for the kernel part, and under the version 3 (GPLv3) for the userspace part.[1][4] It was released shortly after Red Hat released its own live kernel patching implementation called kpatch.[10] kGraft aims to become merged into the Linux kernel mainline, and it was submitted for the inclusion in April 2014.[3][8]

kGraft was made available for SUSE Linux Enterprise Server 12 on November 18, 2014, as an additional feature called SUSE Linux Enterprise Live Patching.[11][12]

Minimalistic foundations for live kernel patching were merged into the Linux kernel mainline in kernel version 4.0, which was released on April 12, 2015. Those foundations, based primarily on the kernel's ftrace functionality, form a common core capable of supporting hot patching by both kGraft and kpatch, by providing an application programming interface (API) for kernel modules that contain hot patches and an application binary interface (ABI) for the userspace management utilities. However, the common core included into Linux kernel 4.0 supports only the x86 architecture and does not provide any mechanisms for ensuring function-level consistency while the hot patches are applied.[5][13][14]

Since April 2015, there is ongoing work on porting kGraft to the common live patching core provided by the Linux kernel mainline.[14] However, implementation of the required function-level consistency mechanisms has been delayed because the call stacks provided by the Linux kernel may be unreliable in situations that involve assembly code without proper stack frames; as a result, the porting work remains in progress as of September 2015. In an attempt to improve the reliability of kernel's call stacks, a specialized sanity-check stacktool userspace utility has also been developed.[15][16]

See also

  • Dynamic software updating – a field of research focusing on upgrading programs while they are running
  • kexec – a method for loading a whole new Linux kernel from a running system
  • Ksplice and KernelCare – other Linux kernel live patching technologies developed by Ksplice, Inc. (later acquired by Oracle) and CloudLinux, respectively


  1. ^ a b
  2. ^ a b c d e
  3. ^ a b c d e f
  4. ^ a b
  5. ^ a b
  6. ^
  7. ^
  8. ^ a b c
  9. ^
  10. ^
  11. ^
  12. ^
  13. ^
  14. ^ a b
  15. ^
  16. ^

External links

  • Official website
  • New Kernel Live Patching Combines kGraft & Kpatch, Phoronix, November 7, 2014, by Michael Larabel
  • Live Kernel Patching Support Called For Linux 3.20 Kernel, Phoronix, February 9, 2015, by Michael Larabel
  • Linux kernel set to get live patching in release 3.20, The Register, February 11, 2015, by Richard Chirgwin
  • No reboot patching comes to Linux 4.0, ZDNet, March 3, 2015, by Steven J. Vaughan-Nichols
This article was sourced from Creative Commons Attribution-ShareAlike License; additional terms may apply. World Heritage Encyclopedia content is assembled from numerous content providers, Open Access Publishing, and in compliance with The Fair Access to Science and Technology Research Act (FASTR), Wikimedia Foundation, Inc., Public Library of Science, The Encyclopedia of Life, Open Book Publishers (OBP), PubMed, U.S. National Library of Medicine, National Center for Biotechnology Information, U.S. National Library of Medicine, National Institutes of Health (NIH), U.S. Department of Health & Human Services, and, which sources content from all federal, state, local, tribal, and territorial government publication portals (.gov, .mil, .edu). Funding for and content contributors is made possible from the U.S. Congress, E-Government Act of 2002.
Crowd sourced content that is contributed to World Heritage Encyclopedia is peer reviewed and edited by our editorial staff to ensure quality scholarly research articles.
By using this site, you agree to the Terms of Use and Privacy Policy. World Heritage Encyclopedia™ is a registered trademark of the World Public Library Association, a non-profit organization.

Copyright © World Library Foundation. All rights reserved. eBooks from Project Gutenberg are sponsored by the World Library Foundation,
a 501c(4) Member's Support Non-Profit Organization, and is NOT affiliated with any governmental agency or department.