====================
README for kpatch
====================

OVERVIEW

kpatch is a tool for the generation and application of kernel
modules that patch a running Linux kernel while in operation,
without requiring a reboot.  This is very valuable in cases
where critical workloads, which do not have high availability via
scale-out, run on a single machine and are very downtime
sensitive or require a heavyweight approval process and
notification of workload users in the event of downtime.

QUICK START

NOTE: While kpatch is designed to work with any recent Linux
kernel on any distribution, these quick start instructions
currently only work on Fedora.

First make a patch against the kernel tree, e.g. foo.patch.
Then:

    sudo kpatch-build/kpatch-build ~/foo.patch
    insmod kpatch.ko kpatch-foo.ko

Voila, your kernel is patched.

LICENSE

kpatch is under the GPLv2 license.

This program is free software; you can redistribute it and/or
modify it under the terms of the GNU General Public License
as published by the Free Software Foundation; either version 2
of the License, or (at your option) any later version.

This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
GNU General Public License for more details.

You should have received a copy of the GNU General Public License
along with this program; if not, write to the Free Software
Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.

STATUS

kpatch is currently is early development.  For now, it should _not_ be used
in production environments until significantly more testing on various
patches and environments is conducted.

DEPENDENCIES

kpatch-build tools require libelf library and development headers to be installed.
See GOTCHAS below.

GOTCHAS

The version of elfutils (namely libelf) that ship with most distros as of
the time of this writing, have a bug in libelf that is exposed by kpatch.

elfutils-0.158 or higher contains the fix.

The specific commit is 88ad5ddb71bd1fa8ed043a840157ebf23c0057b3.

git://git.fedorahosted.org/git/elfutils.git

HOWTO

An example script for automating the hotfix module generation is
kpatch-build/kpatch-build.  The script is written for Fedora but should
be adaptable to other distributions with limited changes.

The primary steps in the hotfix module generation process are:
- Building the unstripped vmlinux for the kernel
- Patching the source tree
- Rebuilding vmlinux and monitoring which objects are building rebuilt.
  These are the "changed objects".
- Recompile each changed object with -ffunction-sections -fdata-sections
  resulting in the changed patched objects
- Unpatch the source tree
- Recompile each changed object with -ffunction-sections -fdata-sections
  resulting in the changed original objects
- Use create-diff-object to analyze each original/patched object pair
  for patchability and generate an output object containing modified
  sections
- Link all the output objects in a into a cumulative object
- Use add-patches-section to add the .patches section that the
  core kpatch module uses to determine the list of functions that need
  to be redirected using ftrace
- Generate the hotfix kernel module
- Use link-vmlinux-syms to hardcode non-exported kernel symbols
  into the symbol table of the hotfix kernel module

DEMONSTRATION

A demonstration of kpatch is available on Youtube:

http://www.youtube.com/watch?v=WeSmG-XirC4

This demonstration completes each step in the HOWTO section in a manual
fashion.  However, from a end-user perspective, most of these steps will
be hidden away in scripts (eventually).