A kernel hot patching method based on MIPS architecture

Abstract

This invention relates to the field of hot patching technology, specifically a kernel hot patching method based on the MIPS architecture. The method replaces a patch function in the code segment of the function being patched, and includes the following steps: Step S1: Create a hot-fix environment for the function being patched; Step S2: Based on the hot-fix environment, construct a replacement jump instruction for the function being patched under the MIPS architecture based on the patch function; Step S3: Modify the permissions of the function being patched to write permissions, so that the replacement jump instruction can be written into the function being patched; Step S4: Write the replacement jump instruction into the function being patched. This invention enables the MIPS architecture to fulfill kernel hot patching functionality even when GCC dependencies or architecture dependencies are missing, while also possessing advantages such as high reliability, fast repair speed, and traceability.

Description

Technical Field

[0001] This invention relates to the field of hot patching technology, and more specifically, to a kernel hot patching method based on the MIPS architecture. Background Technology

[0002] With the development of cloud computing, servers are becoming larger and larger, and more and more services are running. The growth in the scale of hardware and software will lead to an increasing probability of operating system problems. How to repair online kernel failures without system restart and without the business being aware of them is a common and important problem. The industry has done a lot of work on this and implemented key kernel hot patch repair technology. This technology is also constantly iterating and developing over time. However, this technology cannot support the MIPS architecture. Summary of the Invention

[0003] The main objective of this invention is to provide a kernel hot patching method based on the MIPS architecture, enabling the operating system to use kernel hot patching technology in the MIPS architecture environment, thus solving the problem that hot patching cannot be used due to the lack of some basic components of GCC and kernel on the MIPS architecture.

[0004] This invention discloses a kernel hot patching method based on the MIPS architecture. The method is used to replace the patch function with the code segment of the function being patched. The method includes the following steps: Step S1: Create a hotfix environment for the patched function; Step S2: Based on the hotfix environment, construct the replacement jump instruction for the patched function under the MIPS architecture based on the patch function; Step S3: Modify the permissions of the patched function to write permissions, so that the replacement jump instruction can be written into the patched function; Step S4: Write the replacement jump instruction into the patched function.

[0005] Furthermore, step S1 includes the following steps: Step S11: The user uses the insmod command to load the hot patch module into the kernel; the hot patch module includes patch functions; Step S12: The hot patch execution process corresponding to the insmod command is scheduled by the kernel scheduler to run on a CPU in the kernel, and the scheduled CPU is marked as the hot patch execution core; Step S13: The hot patch execution process sequentially performs halt scheduling on all CPUs in the kernel except for the hot patch execution core; Step S14: The hot patch execution process traverses all process linked lists, obtains stack frames at each level of the call stack, and retrieves the program counter from the stack frames; Step S15: Determine whether the value of the program counter is within the code segment range of the patched function; if the value of the program counter is within the code segment range of the patched function, exit the shutdown scheduling in step S13, and re-execute step S13 after a preset interval; otherwise, the hot-fix environment for the patched function is created.

[0006] Furthermore, the replacement jump instruction is replaced with a register jump instruction; the replacement jump instruction writes the virtual address of the patch function into register t8, and when the replacement jump instruction is triggered, it jumps to the patch function stored in register t8.

[0007] Furthermore, in step S3, the permissions of the function to be patched are set to write permissions in the following way: Obtain the base address of the page table in the kernel; Based on the virtual address of the patched function and the base address of the page table, each level of the page table is queried step by step, and the corresponding page table entry (PTE) for the patched function is found. Modify the read / write bit in the permission bitmap of the page table entry (PTE) corresponding to the patched function to writable.

[0008] Furthermore, in step S3, the permission of the patched function is set to writable in the following way: the physical address corresponding to the patched function is found based on the virtual address of the patched function, and then the physical address is remapped to the fixmap area of ​​the kernel with writable permission.

[0009] Furthermore, if the function to be patched is located in the kernel's modules area, the physical address corresponding to the function to be patched is found using a non-linear mapping method based on the virtual address of the function to be patched.

[0010] Furthermore, in step S4, the replacement jump instruction is written to the starting address of the patched function by copying memory.

[0011] Furthermore, before step S4, there is a backtrackable step: a global linked list structure is established in the hot patch module, and a new instruction buffer is created in its linked list node to back up the code segment of the patched function replaced by the jump instruction.

[0012] Furthermore, the instruction buffer is called instruction_buffer, which occupies 3 instruction bytes; the kernel is the Linux kernel.

[0013] The beneficial effects of this invention are as follows: This invention enables the MIPS architecture to meet the kernel hot patching function in the absence of GCC dependencies and architecture dependencies, while also having the advantages of excellent reliability, fast repair speed and traceability.

[0014] This invention creates a reliable hot-patching environment, ensuring that there are no race conditions in the modified code segment and that the patched function does not exist in the process call stack. This invention constructs MIPS long jump instructions, ensuring that the patched function can be accessed via jump instructions regardless of whether it is located in the Modules area or the vmlinux area.

[0015] This invention addresses the issue of replacement instructions failing to be written due to modifying the read-only permissions of the patched function code segment. After the instructions are written, this invention ensures that each CPU can cache the original patched function instructions, preventing cache coherency issues.

[0016] This invention features a rollback mechanism for patches, ensuring that historical function versions of every patch prior to the current one can be accessed. This invention does not rely on FTRACE and does not add instrumentation instructions that would impact performance. This invention does not require MIPS support for gcc's fentre compilation parameters, nor does it require kernel support for the MIPS version FTRACE_WITH_REGS. Attached Figure Description

[0017] To more clearly illustrate the technical solutions in the embodiments of this application, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0018] Figure 1 This is a flowchart of the method of the present invention; Figure 2 This is a format comparison table of the R-type MIPS instructions of the present invention; Figure 3 This is a format comparison table of the Type I MIPS instructions of the present invention. Detailed Implementation

[0019] The technical solutions of the present invention will be clearly and completely described below with reference to the embodiments of the present invention. Many specific details are set forth in the following description to provide a thorough understanding of the present invention; however, the present invention may also be implemented in other ways different from those described herein. Those skilled in the art can make similar extensions without departing from the spirit of the present invention. Therefore, the present invention is not limited to the specific embodiments disclosed below.

[0020] The main objective of this invention is to provide a kernel hot patching method based on the MIPS architecture, enabling the operating system to use kernel hot patching technology in the MIPS architecture environment, thus solving the problem that hot patching cannot be used due to the lack of some basic components of GCC and kernel on the MIPS architecture.

[0021] The method of this invention centers on replacing code segments with jump instructions. After the compiled hot-patching module is loaded into the kernel space, it first halts and schedules CPUs other than the CPU where the repair process is located, placing them in a non-scheduled state to prevent race conditions between other tasks and the repair task on this CPU (note that locking cannot be performed on the code segment of the patched function, because in addition to the complexity of the added lock construction instructions, it may also cause the lock instructions to be too long, exceeding the length of the original function's code segment and overwriting other code segments). After achieving this reliable environment through halting and scheduling, it is also necessary to traverse the task call stack on each CPU to check if the patched function exists. If it does, it will cause stack recovery exceptions and other disordered behaviors during recovery because the original code has already been patched. Only after ensuring that there are no patched functions on the call stack can code segment modification operations be safely performed.

[0022] Then, a jump instruction is constructed to modify the permissions of the function being patched. Finally, the jump instruction is written to the address of the function being patched, and the repair process exits. Afterward, when a task accesses the original function address, it will no longer execute the original function's instructions, but instead execute the jump instruction, which will then jump to the patched function. This is the overall repair process. Specific Implementation Example 1:

[0024] This embodiment describes a kernel hot patching method based on the MIPS architecture. The method uses the Linux kernel, and the verification platform is the MIPS architecture. Figure 1 As shown, it includes the following steps: Step S1: Create a reliable hotfix environment for the patched functions (corresponding to...) Figure 1 (The "thermal remediation environment site" in the text).

[0025] Step S1 includes the following steps: Step S11: The user (user space) uses the insmod command to load the hot patch module into the kernel (kernel space); the hot patch module includes patch functions; Step S12: The hot patch execution process corresponding to the insmod command is scheduled by the kernel scheduler to run on a CPU in the kernel, and the scheduled CPU is marked as the hot patch execution core; Step S13: The hot patch execution process sequentially performs halt scheduling on all CPUs in the kernel except the hot patch execution core. This causes the CPU to execute the highest-priority pre-set halt task in the next scheduling cycle. The halt task performs a disable preemption operation and further executes low-power, non-voluntary-scheduled `relex` instructions in a loop. After halt scheduling is completed, the only schedulable process in the scheduler is the hot patch execution process.

[0026] Step S14: The hot patch execution process traverses all process lists. During the traversal, it backtracks the function call stack of each process in the scheduler. When backtracking, it can obtain stack frames at each level of the call stack. The stack frame format meets the MIPS procedure call specification. The required program counter, i.e., PC, can be retrieved from the stack frame.

[0027] Step S15: Determine if the program counter value (64-bit address) is within the code segment range of the patched function. If the program counter value is within the code segment range of the patched function, then there is a task executing the patched function in the system, but it has been interrupted by the halting schedule in this method. Therefore, the halting schedule in step S13 needs to be exited so that other tasks can complete. After a preset interval, step S13 is re-executed. This continues until no other tasks are within the code segment range of the patched function. At this point, the check passes, the hotfix environment is created, and subsequent steps are executed.

[0028] It is important to note that if the program counter value is found to be within the code segment of the patched function, and no additional intervention is taken, after continuing to modify the code segment of the patched function through subsequent processes and exiting the repair process, the interrupted task executing the patched function may become erratic or generate a stack exception when it resumes because the next instruction to be executed has been modified.

[0029] Step S2: Based on the hotfix environment, in the MIPS architecture, construct the replacement jump instruction (corresponding to...) Figure 1 The "replacement instruction" in the text refers to a jump instruction that replaces a register jump instruction. A replacement jump instruction can consist of the following three parts: Plain Text lui t7, hi ori t7, t8, lo jr t8 Where hi represents the high 16 bits of the virtual address of the patch function, lo represents the low 16 bits of the virtual address of the patch function, t7 and t8 are temporary registers during the MIPS function call process, and lui and ori are MIPS type I instructions. The instruction format double reference table is as follows: Figure 3 As shown, the three statements that replace the jump instruction mean that the virtual address of the patch function is written to register t8, and then when the register jump instruction is executed, the jump is made to the address of the patch function stored in register t8, thus realizing the hot patching function. In the actual writing of the instructions, the instruction code must correspond to the binary representation.

[0030] Step S3, modify the permissions of the code segment of the function to be patched: make the permissions of the function to be patched writable, so that the replacement jump instruction can be written into the function to be patched.

[0031] After the replacement jump instruction is constructed, the code segment of the function being patched needs to be modified to writable permissions before the replacement instruction can be written. The text.section in the Modules and vmlinux areas of the kernel has read-only permissions. There are two methods to modify the code segment permissions: the direct method and the indirect method.

[0032] The direct method involves obtaining the base address of the page table in the kernel, querying each level of the page table based on the virtual address of the function being patched, and finally finding the page table entry (PTE) corresponding to the function being patched at the last level. The read / write bits in the permission bitmap of the PTE are then directly modified to be writable.

[0033] The indirect method refers to finding the corresponding physical address based on the virtual address of the function being patched, and then remapping it to the kernel's fixmap area with write permissions. It's important to note that the function being patched may reside in the kernel's Modules or vmlinux area, where memory mapping methods differ between non-linear and linear mappings, respectively, leading to different methods for finding the physical address from the virtual address.

[0034] Step S4: Write the replacement jump instruction into the patched function.

[0035] Specifically, after modifying the code segment of the function to be patched to writable permissions, the replacement jump instruction can be directly written to the starting address of the patched function by copying memory. The parameter passing rules in the calling process of the patched function remain unchanged. Afterwards, to prevent the CPU's instruction cache from prefetching the instructions of the patched function, all CPU instruction caches need to be invalidated. Specific Implementation Example 2:

[0037] This embodiment also includes a backtrackable step. To satisfy the backtrackable characteristic of continuous patches, the following operation can be added before writing the replacement jump instruction (step S4): First, a global linked list data structure is established in the hot patch module, and a new member `instruction_buffer` is created in its linked list node. This member occupies 3 instruction bytes and can be used to back up the code segment space of the patched function to be replaced by the replacement jump instruction (3 instructions). If a new hot patch module is loaded subsequently, the node can be created and the replaced space backed up in the same way, so that when backtracking to a certain version, the linked list can be directly traversed to retrieve the replacement space node unit corresponding to the target version, and the cached data in the unit can be restored to the starting address of the code segment. Specific Implementation Example 3:

[0039] This example explains why register jumps are used in the MIPS architecture.

[0040] a. Obtain the address of the function name to be patched and the address of the function name to be patched from the kernel space, and calculate the difference between the two addresses. Note that this difference is not an absolute address, but a signed address, which can be used to represent the offset for forward or backward jumps.

[0041] b. The Linux kernel allocates a 128MB address space for the entire Modules section. The patch function within the patch module is located within the Modules section. If the function being patched is located within the Modules section, and the absolute value of the offset difference is less than or equal to 128MB, a short jump instruction can be used on ARM64 or x86 architectures. If the function being patched is located within the `text.section` section of `vmlinux`, and the offset is greater than 128MB, a long jump (register jump instruction) can be used on ARM64 or x86 architectures. However, the short jump instruction range for relative jumps in the MIPS architecture is less than 128MB. Therefore, in the MIPS architecture, both short and long jumps use long jump instructions (register jump instructions).

[0042] The format of register jump instructions in MIPS follows the MIPS architecture specification, and its R-type MIPS instruction format is as follows: Figure 2 As shown.

[0043] Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without inventive effort are within the scope of protection of the present invention.

Claims

1. A kernel hot patching method based on the MIPS architecture, characterized in that, This method is used to replace the patch function in the code segment of the function being patched. The method includes the following steps: Step S1: Create a hotfix environment for the patched function; Step S2: Construct replacement jump instructions under the MIPS architecture based on the hotfix environment and patch functions; Step S3: Modify the permissions of the patched function to write permissions, so that the replacement jump instruction can be written into the patched function; Step S4: Write the replacement jump instruction into the patched function; Step S1 includes the following steps: Step S11: The user uses the insmod command to load the hot patch module into the kernel; the hot patch module includes patch functions; Step S12: The hot patch execution process corresponding to the insmod command is scheduled by the kernel scheduler to run on a CPU in the kernel, and the scheduled CPU is marked as the hot patch execution core; Step S13: The hot patch execution process sequentially performs halt scheduling on all CPUs in the kernel except for the hot patch execution core; Step S14: The hot patch execution process traverses all process linked lists, obtains stack frames at each level of the call stack, and retrieves the program counter from the stack frames; Step S15: Determine whether the value of the program counter is within the code segment range of the patched function; if the value of the program counter is within the code segment range of the patched function, exit the shutdown scheduling in step S13, and re-execute step S13 after a preset interval; otherwise, the hot-fix environment for the patched function is created.

2. The kernel hot patching method based on MIPS architecture according to claim 1, characterized in that, The kernel is the Linux kernel.

3. The kernel hot patching method based on MIPS architecture according to claim 1, characterized in that, The replacement jump instruction is a register jump instruction; the replacement jump instruction writes the virtual address of the patch function to register t8. When the replacement jump instruction is triggered, the jump is made to the patch function stored in register t8.

4. The kernel hot patching method based on MIPS architecture according to claim 1, characterized in that, In step S3, the permissions of the function to be patched are changed to write permissions in the following way: Obtain the base address of the page table in the kernel; Based on the virtual address of the patched function and the base address of the page table, each level of the page table is queried step by step, and the corresponding page table entry (PTE) for the patched function is found. Modify the read / write bit in the permission bitmap of the page table entry (PTE) corresponding to the patched function to writable.

5. The kernel hot patching method based on MIPS architecture according to claim 1, characterized in that, In step S3, the permissions of the patched function are modified to be writable in the following way: the physical address corresponding to the patched function is found based on the virtual address of the patched function, and then the physical address is remapped to the fixmap area of ​​the kernel with writable permissions.

6. The kernel hot patching method based on MIPS architecture according to claim 5, characterized in that, If the function to be patched is located in the kernel's modules area, the physical address corresponding to the function to be patched is found using a non-linear mapping method based on the virtual address of the function to be patched.

7. A kernel hot patching method based on MIPS architecture according to claim 5, characterized in that, If the function to be patched is located in the kernel's vmlinux area, the physical address corresponding to the function to be patched is found by using a linear mapping method based on the virtual address of the function to be patched.

8. A kernel hot patching method based on MIPS architecture according to claim 1, characterized in that, In step S4, the replacement jump instruction is written to the starting address of the function being patched by copying memory.

9. A kernel hot patching method based on MIPS architecture according to claim 1, characterized in that, Before step S4, there is also a backtrackable step: a global linked list structure is established in the hot patch module, and an instruction buffer is created in its linked list node to back up the code segment of the patched function replaced by the jump instruction.

10. A kernel hot patching method based on MIPS architecture according to claim 9, characterized in that, The instruction buffer is called instruction_buffer, which occupies 3 instruction bytes.

Images