Experiences using livepatch?

["Joseph Reynolds" <jrey@linux.ibm.com>]

I am re-asking a question from the OpenBMC community.

Does anyone have experience using Linux kernel livepatch with embedded 
systems and is willing to share experiences or best practices?

Members of the OpenBMC community discussed a use case that involves many 
thousands of systems that all need to be updated as quickly as 
possible.  Specifically, downloading a new firmware image, performing 
firmware update, and rebooting the BMC would be too disruptive and take 
too long.  The idea is to livepatch the systems as quickly as possible.  
The livepatch would be in-memory only and would be followed up with a 
normal firmware code update.  Details are in the OpenBMC security 
working group minutes, referenced below.

We are less interested in the mechanics of building kpatch into the 
kernel or in building patches, and more interested in the overall 
experience, including how well deploying and applying patches works in 
practice.

- Joseph

_________

References:

OpenBMC email: 
https://lists.ozlabs.org/pipermail/openbmc/2020-October/023723.html

Discussed in OpenBMC security working group dated 2020-10-28 agenda item 5
https://docs.google.com/document/d/1b7x9BaxsfcukQDqbvZsU2ehMq4xoJRQvLxxsDUWmAOI

BMC firmware code update: 
https://github.com/openbmc/docs/blob/master/architecture/code-update/code-update.md

Ubuntu livepatch wiki: https://wiki.ubuntu.com/Kernel/Livepatch.kpatch

Bitbake recipe for livepatch in meta-oe/recipes-kernel/kpatch.

Questions about how to create and apply patches.  For example asked 
here: 
https://stackoverflow.com/questions/34175786/how-to-install-kernel-patch-locally-in-yocto