How does the Linux kernel update itself?

Question

How does kernel updates itself while it's running without breaking anything in the process?

Answer 1

When you update the kernel, you actually update the kernel package. On most Linux distributions, what this really does is just register the package in your package manager, add the new modules under /lib/modules, add the initramfs and kernel under /boot, and maybe update the bootloader entries and some other miscellaneous activity. It doesn't generally actually replace the loaded kernel in memory.

At boot, the kernel itself is loaded into memory. That is, even if the file it was loaded from (eg. /boot/vmlinuz) goes away, it's not needed after initial loading of the kernel.

Even if it was needed for something (say, debugging information) and has been replaced, anyone already with an open file handle to it will still be able to use the file, since the backing data won't be deleted until the inode in question has a reference count of 0 (the kernel itself doesn't need such a reference though, since it's already loaded into memory, unlike running processes from userspace executables). Those blocks normally can be fully freed from disk unless you're in the middle of running some user-space program on that file. The Linux kernel doesn't page its own memory, and even decompresses itself on the fly at startup. There's no /proc/.../exe or /proc/.../fd way to access the booted /boot/vmlinuz — the kernel might not even mount the device it was booted from in a netboot or USB-boot situation.

So generally, the kernel doesn't update itself. That's typically done at reboot or kexec time. The kind of thing you're describing does exist for limited use cases as kpatch, kgraft, and ksplice, but generally these can only be used for small and targeted patches, not new upstream kernel releases.