3 ms·

Xen's hypervisor would seem to be a great place to implement live patching like KSplice/kGraft/Kpatch does for the Linux kernel. Presumably that stuff still wor

Xen's hypervisor would seem to be a great place to implement live patching like KSplice/kGraft/Kpatch does for the Linux kernel. Presumably that stuff still works on KVM host machines with live guests.

__bjoernd 12y ago
There was this talk at last Linux Plumbers Conference, fyi: http://www.linuxplumbersconf.org/2014/ocw/sessions/2421 http://www.linuxplumbersconf.org/2014/ocw/sessions/2421
resc1440 12y ago
Amazon's security advisory seems to indicate that they have this capability for 90% of EC2 instances (leaving 10% that must be rebooted). https://aws.amazon.com/premiumsupport/maintenance-2015-03/ https://aws.amazon.com/premiumsupport/maintenance-2015-03/
- cesarb 12y ago
  It could be either that (live patching) or live migration: do a live migration of all instances on this host to an already patched host, reboot the host, repeat for the next host.
- lscotte 12y ago
  Not really - to me, it implies that 90% of EC2 instances are not running on a vulnerable version of Xen...
  - nmjohn 12y ago
    FTA: > While all instance types need to be updated, we have developed the capability to live-update instances running on newer hardware. The vast majority of the EC2 fleet will be live-updated, but a portion of instances (less than 10% of customer EC2 instances) running on older hardware will require a reboot to complete the update process.