WO2016101503A1

WO2016101503A1 - Hot patching realization method and apparatus

Info

Publication number: WO2016101503A1
Application number: PCT/CN2015/078896
Authority: WO
Inventors: 魏煜帆; 刘爱丽; 朱怀云; 于光波; 熊珍
Original assignee: 中兴通讯股份有限公司
Priority date: 2014-12-24
Filing date: 2015-05-13
Publication date: 2016-06-30
Also published as: CN105786537A

Abstract

Disclosed are a hot patching realization method and apparatus. The method comprises: acquiring file information of a substitute function from a target file, wherein the substitute function is used for substituting a function requiring patching on a target side; generating a new executable file for the function requiring patching according to the file information; determining corresponding address information of the new executable file when run on the target side; according to the address information, generating corresponding substitution command information for the new executable file when run on the target side; and notifying the target side to utilize the substitution command information to run the new executable file.

Description

Method and device for implementing hot patch

Technical field

The present invention relates to the field of communications, and in particular, to a method and an apparatus for implementing a hot patch.

Background technique

Hot patching is a quick, low-cost way to fix product software bugs. Compared with the upgraded software version, the main advantage of the hot patch is that it will not interrupt the current running of the device, that is, the defect of the current software version of the device can be repaired without restarting the device. Hot patch processing is basically based on functions, that is, by repairing a function that has a vulnerability or needs to be replaced, to fix the current software version. That is, the hot patch works by replacing the first instruction of the patched function with the instruction that jumps to the replacement function, causing the program to jump to the location where the new function (replacement function) is located, when replacing the patch in the function. After the code is executed, it returns to the code that calls the old function, thus completing the entire calling process.

The hot patch method disclosed in the related art is divided into two steps: 1) First, on the host, a patching tool is used to create a redirectable hot patch file according to the hot patch source. 2) Then download the hot patch file to the target machine, and the patch control module on the target machine loads the system file and the hot patch file of the target machine, and relocates according to the symbol table provided by the system file to generate a final target hot patch file, 3 Finally, the target hot patch file is activated, and the target system is started from the entry of the target system file.

The implementation of the hot patch will cause a waste of memory space, and also increase the complexity of the loading process. Even multiple copies of the same function or variable in memory may cause inconsistency in function calls or variable references, which may result in serious system breakdown.

Summary of the invention

The embodiment of the invention provides a method and a device for implementing a hot patch. The technical problem to be solved is how to reduce the complexity of reducing the patch loading.

In order to solve the above technical problem, the embodiment of the present invention provides the following technical solutions:

A method for implementing a hot patch includes: obtaining file information of a replacement function from a patch object file, where the replacement function is used to replace a function that needs to be patched on the target side; and according to the file information, the patch is required The function generates a new executable file; determines address information corresponding to the new executable file when the target side runs; generates, according to the address information, when the new executable file runs on the target side Corresponding replacement instruction information; notifying the target side to run the new executable file by using the replacement instruction information.

The file information of the replacement function includes file information obtained by performing an extraction operation of the .text.bss.rodata.data segment on the patch object file.

And generating, according to the file information, a new executable file for the function to be patched, comprising: generating a structure file of the new executable file by using the file information; and adjusting a function call in the structure file Relationship and a reference relationship of the variable; after completing the adjustment operation, generating a section header table of the executable file, and obtaining the new executable file according to the section header table of the executable file.

Determining address information corresponding to the new executable file when the target file is run, including: obtaining a symbol table and a corresponding symbol address table; and according to the symbol address table, weighting the symbol address in the executable file Positioned as a memory call address.

The generating, according to the address information, the corresponding replacement instruction information for the new executable file when the target file is run, including: jumping to the first instruction by replacing the first instruction of the function requiring the patch The starting position of the executable file is run, and after the replacement function is executed, it returns to the function that calls the function that needs to be replaced.

An apparatus for implementing a hot patch, comprising: an obtaining module, configured to obtain file information of a replacement function from a patch object file, wherein the replacement function is used to replace a function requiring a patch on a target side; the first generating module is set to And generating, according to the file information, a new executable file for the function that needs to be patched; the determining module is configured to determine address information corresponding to when the new executable file runs on the target side; and a second generating module, Is configured to generate corresponding replacement instruction information when the new executable file is run on the target side according to the address information; and the notification module is configured to notify the target side to run the new by using the replacement instruction information Executable file.

The first generation module includes: a first generation unit configured to generate a structure file of the new executable file by using the file information; and an adjustment unit configured to adjust a call relationship of a function in the structure file and a reference relationship of the variable; the second generating unit is configured to generate a section header table of the executable file after completing the adjusting operation, and obtain the new executable file according to the section header table of the executable file.

The determining module includes: an obtaining unit, configured to acquire a symbol table and a corresponding symbol address table; and a relocating unit configured to relocate the symbol address in the executable file to a memory calling address according to the symbol address table .

The second generation module is further configured to: jump to the start position of the executable file by replacing the first instruction of the function requiring the patch, and return to the call after the replacement function is executed. The function of the function that needs to be replaced.

Embodiments of the present invention also provide a computer program, including program instructions, that when executed by a computer, cause the computer to perform the above method.

Embodiments of the present invention also provide a computer readable storage medium carrying the above computer program.

The embodiment provided by the present invention extracts the code segment and the data segment of the entire object file from the related art, and then constructs the target hot patch file, and compares the implementation manner of writing all the memory space when the hot patch is loaded. The embodiment of the present invention only generates a patch file for a function that needs to be patched, which not only reduces the size of the patch, but also reduces the reserved memory space required for loading the patch, and is convenient for management, avoiding inconsistency of function calls, and reducing the patch. The purpose of loading complexity.

BRIEF abstract

FIG. 1 is a schematic flowchart diagram of a method for implementing a hot patch according to an embodiment of the present disclosure;

2 is a schematic diagram of a target side management patch according to an embodiment of the present invention;

FIG. 3 is a schematic flowchart diagram of an apparatus for implementing a hot patch according to an embodiment of the present invention.

Preferred embodiment of the invention

The embodiments of the present invention will be further described in detail below with reference to the accompanying drawings. It should be noted that, in the case of no conflict, the features in the embodiments and the embodiments in the present application may be arbitrarily combined with each other.

FIG. 1 is a schematic flowchart diagram of a method for implementing a hot patch according to an embodiment of the present invention. The method embodiment shown in Figure 1 includes:

Step 101: Obtain file information of a replacement function from a patch object file, where the replacement function is used to replace a function that needs to be patched on the target side;

Step 102: Generate a new executable file for the function that requires a patch according to the file information.

Step 103: Determine address information corresponding to the new executable file running on the target side;

Step 104: Generate corresponding replacement instruction information for the new executable file to run on the target side according to the address information.

Step 105: Notify the target side to run the new executable file by using the replacement instruction information.

In the embodiment of the present invention, in the related art, the code segment and the data segment of the entire object file are extracted, and then constructed into a target hot patch file, and compared to the implementation manner in which the hot patch is all written into the memory space, The embodiment of the invention only generates a patch file for the function that needs to be patched, which not only reduces the size of the patch, but also reduces the reserved memory space required for loading the patch, and is convenient for management, avoiding inconsistency of function calls, and reducing patch loading. The purpose of complexity.

The method provided by the embodiment of the present invention is further described below:

In step 101, when the software patch is created, the patch source file is first analyzed according to the source file to be patched (the patch source file is compiled as a patch target file), and the patch object file is made to .text.bss.rodata. The extraction operation of the .data segment obtains the file information.

Step 102, generating, according to the file information, a new function for the function that requires a patch. Executable files, including:

Generating a structure file of the new executable file by using the file information; adjusting a calling relationship of a function in the structure file and a reference relationship of a variable; and after completing the adjusting operation, generating a section header table of the executable file, The new executable file is obtained according to the section header table of the executable file.

Optionally, a new executable file is obtained according to the section header table of the executable file, including:

Read the header of the structure file of the Executable and Linking Format (ELF), and read each section header record according to the section header address addr and the section header size provided by the header information of the ELF structure file. Information and information stored in the memory address;

Analyze the .text section and extract the code segment of the replacement function in the .text section;

Analyze the .rodata section, extract the read-only data referenced by the replacement function in the .rodata section, and merge them into a new .rodata section;

Construct an ELF structure object file containing only the code segment of the replacement function, the rodata section, and the symbol section, and use .text.bss.rodata.data as the base address, addend as the offset to reset the relocation information;

Reset the addr and size of each section header to build a new ELF file.

Step 103: The determining the address information corresponding to the new executable file when the target file is run includes:

Obtaining a symbol table and a corresponding symbol address table; relocating the symbol address in the executable file to a memory call address according to the symbol address table, including:

The address of the relocation symbol is completed on the host side, and the symbol information of the target version is first analyzed, and the symbol information is generated into an index table, where the index table includes a symbol address, the symbol includes: a global variable, a global function, a static variable, a static function, and Static local variables, and then find the symbol to be relocated in the index table to obtain the actual real address. Analyze the new ELF file, find the relocation symbol address in the ELF object file by looking up the real address of the symbol in the image file, complete the relocation work, and determine the function call and the variable address.

The process of relocation is as follows:

Read the reserved patch area, symbol table and corresponding symbol address in the original file of the kernel image table;

According to the symbol address table, the symbol address referenced in the input object file is relocated to the real memory address of the symbol.

Optionally, in step 104, the generating, according to the address information, the corresponding replacement instruction information for the new executable file when the target file is run, including: replacing the first instruction of the function that requires the patch by replacing To jump to the starting position of the executable file run, and after the replacement function is executed, return to the function that calls the function that needs to be replaced.

A replacement function table is generated according to the source address and the target address of the replacement function, and the target machine side performs an instruction jump operation. The source address is the symbol address before the patch is modified, and the target address is the modified symbol address of the patch, which is located in the patch area. The instruction list is replaced by the host side constructor according to the reserved patch area address. The jump instruction is constructed according to different CPU architectures. The main working principle is that by replacing the first instruction of the original old function, the instruction jumps to the new function, so that the program jumps to the position where the new function is located, and when the patch code in the new function is executed, Go to the code that calls the old function and complete the entire call process.

It can be seen from the above that the above patch making process is completed on the host side, and the extracting operation of the .text.bss.rodata.data segment is performed on the target file, and the required ELF segment is extracted for patching, thereby effectively reducing the patch size. Reduced memory consumption on the target side;

In addition, the relocation symbol is relocated on the host side, the symbol table in the original image file is analyzed, a corresponding address correspondence table is generated for different types of symbols, and then the relocation symbol address of the target file is searched.

For example, the normal non-static function func_name:

{func_name, address}

Global variable global_var_name:

{global_var_name, address}

For static symbols, use the prefix method to identify, where file represents the file in which the symbol is located, and function represents the function in which the symbol is located.

Static local variable static_localvar_name:

{file_function_static_localvar_name, address}

Static variable static_var_name:

{file_static_var_name, address}

Static function static_func_name:

{file_static_func_name, address}

Then, according to the address correspondence table, relocation of symbols such as ordinary functions, global variables, static local variables, static variables, and static functions is implemented, and the above operations are all performed on the host side without modifying the code on the target side, thereby greatly Increased flexibility and portability of patch production.

FIG. 2 is a schematic diagram of a target side management patch according to an embodiment of the present invention. In the schematic diagram shown in FIG. 2, the target side implements loading, activation, patch automatic activation, deactivation, and uninstallation of the patch. The state transition control is operated in a command-driven manner and controlled by the state machine to ensure the correct state transition. described as follows:

Patch loading process: First, determine whether the patch and the version number of the system software are consistent. If they are inconsistent, directly exit. If they are consistent, load the patch file into the flash, and then read the function replacement table in the file and load the patch as needed. The address of the reserved area, the code segment of the replacement function, the read-only data segment is written into the memory. After the patch is loaded, the status of the patch is inactive and the status of the patch is written to the corresponding configuration file.

Patch activation: Replace the table according to the instruction, change the instruction at the patch function address to the instruction to jump to the replacement function, and write the status of the patch to the configuration file.

The patch is automatically activated: the patch status is changed to the automatic activation state and saved in the patch configuration file. The patch will continue to take effect the next time it is restarted, and the status of the patch is written to the configuration file.

Patch deactivation: Replace the table with the instruction, and replace the jump instruction at the patch function address with the original instruction. After successful, the patch status is changed to inactive and the status of the patch is written to the configuration file.

Patch unloading: release the flash space occupied by the patch file, and the memory space, and replace the jump instruction at the patch function address with the original instruction, and write the status of the patch to the configuration file.

Patch status query: By reading the configuration file, you can view the status of the current patch.

It can be seen that the hot patching method provided by the embodiment of the present invention can still modify the related process according to the patching manner of the related art. Therefore, the solution provided by the embodiment of the present invention has strong applicability.

FIG. 3 is a schematic structural diagram of an apparatus for implementing a hot patch according to an embodiment of the present invention. With reference to the method embodiment shown in FIG. 1, the apparatus shown in FIG. 3 includes:

The obtaining module 301 is configured to obtain file information of the replacement function from the patch object file, where the replacement function is used to replace the function that needs to be patched on the target side;

The first generating module 302 is configured to generate a new executable file for the function requiring the patch according to the file information;

a determining module 303, configured to determine address information corresponding to when the new executable file runs on the target side;

The second generation module 304 is configured to generate corresponding replacement instruction information when the new executable file is run on the target side according to the address information;

The notification module 305 is configured to notify the target side to run the new executable file by using the replacement instruction information.

The file information of the replacement function includes an extraction operation of the .text.bss.rodata.data segment of the target file, and the file information is obtained.

The first generation module 302 includes:

a first generating unit, configured to generate a structural file of the new executable file by using the file information;

An adjusting unit, connected to the first generating unit, configured to adjust a calling relationship of a function in the structure file and a reference relationship of the variable;

The second generating unit is connected to the adjusting unit, and is configured to generate a section header table of the executable file after completing the adjusting operation, and obtain the new executable file according to the section header table of the executable file.

The determining module 303 includes:

Obtaining a unit, configured to obtain a symbol table and a corresponding symbol address table;

The relocation unit is configured to relocate the symbol address in the executable file to a memory call address according to the symbol address table.

The second generation module 304 is configured to:

The first instruction that replaces the function requiring the patch is to jump to the start position of the executable file, and after the replacement function is executed, returns to the function that calls the function that needs to be replaced.

One of ordinary skill in the art will appreciate that all or a portion of the steps of the above-described embodiments can be implemented using a computer program flow, which can be stored in a computer readable storage medium, such as on a corresponding hardware platform (eg, The system, device, device, device, etc. are executed, and when executed, include one or a combination of the steps of the method embodiments.

Alternatively, all or part of the steps of the above embodiments may also be implemented by using an integrated circuit. These steps may be separately fabricated into individual integrated circuit modules, or multiple modules or steps may be fabricated into a single integrated circuit module. achieve. Thus, the invention is not limited to any specific combination of hardware and software.

The devices/function modules/functional units in the above embodiments may be implemented by a general-purpose computing device, which may be centralized on a single computing device or distributed over a network of multiple computing devices.

When each device/function module/functional unit in the above embodiment is implemented in the form of a software function module and sold or used as a stand-alone product, it can be stored in a computer readable storage medium. The above mentioned computer readable storage medium may be a read only memory, a magnetic disk or an optical disk or the like.

The above description is only a specific embodiment of the present invention, but the scope of protection of the present invention is not limited. In this regard, any person skilled in the art can easily conceive changes or substitutions within the scope of the present invention. Therefore, the scope of the invention should be determined by the scope of the claims.

Industrial applicability

The above embodiment only generates a patch file for the function that needs to be patched, which not only reduces the size of the patch, but also reduces the reserved memory space required for loading the patch, and is convenient for management, avoiding inconsistency of function calls, and reducing patch loading. The purpose of complexity.

Claims

A method for implementing a hot patch, comprising:

Obtaining file information of the replacement function from the patch object file, wherein the replacement function is used to replace the function that needs to be patched on the target side;

Generating a new executable file for the function requiring the patch according to the file information;

Determining address information corresponding to the new executable file running on the target side;

Generating corresponding replacement instruction information when the new executable file is run on the target side according to the address information;

Notifying the target side to run the new executable file using the replacement instruction information.
The method according to claim 1, wherein the file information of the replacement function includes file information obtained by performing an extraction operation of a .text.bss.rodata.data segment on the patch object file.
The method of claim 2, wherein generating a new executable file for the function to be patched according to the file information comprises:

Generating a structure file of the new executable file by using the file information;

Adjusting the calling relationship of the function in the structure file and the reference relationship of the variable;

After the adjustment operation is completed, a section header table of the executable file is generated, and the new executable file is obtained according to the section header table of the executable file.
The method of claim 1, wherein determining the address information corresponding to the new executable file when the target file is run comprises:

Obtaining a symbol table and a corresponding symbol address table;

The symbol address in the executable file is relocated to a memory call address according to the symbol address table.
The method according to claim 1, wherein the generating, according to the address information, the corresponding replacement instruction information when the target file is run for the new executable file comprises:

The first instruction that replaces the function requiring the patch jumps to the start position of the execution of the executable file, and after the replacement function is executed, returns to the function that calls the function that needs to be replaced.
A device for implementing a hot patch, comprising:

Obtaining a module, configured to obtain file information of the replacement function from the patch object file, wherein the replacement function is used to replace the function that needs to be patched on the target side;

a first generating module, configured to generate a new executable file for the function requiring the patch according to the file information;

a determining module, configured to determine address information corresponding to when the new executable file runs on the target side;

a second generation module, configured to generate corresponding replacement instruction information when the new executable file is run on the target side according to the address information;

The notification module is configured to notify the target side to run the new executable file by using the replacement instruction information.
The apparatus according to claim 6, wherein the file information of the replacement function includes file information obtained by performing an extraction operation of a .text.bss.rodata.data section on the patch object file.
The apparatus of claim 7, wherein the first generation module comprises:

a first generating unit, configured to generate a structural file of the new executable file by using the file information;

The adjusting unit is configured to adjust a calling relationship of the function in the structure file and a reference relationship of the variable;

The second generating unit is configured to generate a section header table of the executable file after completing the adjusting operation, and obtain the new executable file according to the section header table of the executable file.
The apparatus of claim 6 wherein said determining module comprises:

Obtaining a unit, configured to obtain a symbol table and a corresponding symbol address table;

The relocation unit is configured to relocate the symbol address in the executable file to a memory call address according to the symbol address table.
The apparatus of claim 6, wherein the second generation module is further configured to:

The first instruction that replaces the function requiring the patch jumps to the start position of the execution of the executable file, and after the replacement function is executed, returns to the function that calls the function that needs to be replaced.
A computer program comprising program instructions which, when executed by a computer, cause the computer to perform the method of any one of claims 1 to 5.
A computer readable storage medium carrying the computer program of claim 11.