Operating system hot patch implementation method, electronic device and storage medium

Abstract

The present invention discloses a method for implementing a hot patch for an operating system, an electronic device, and a storage medium. The method replaces the first instruction of the kernel executing the original function with a trampoline instruction redirected to the patch function; creates a first GPT table GPT1, modifies the GPT table entry corresponding to the entire memory page where the trampoline instruction is located, so that the memory page is in the root world permission; when the patch is loaded into the memory, modifies the first GPT table GPT1, and sets the page where the patch is located to the root world permission; accesses the trampoline instruction to trigger the patch. The present invention utilizes the GPC mechanism of the ARM confidential computing architecture to protect the entire process of triggering and applying the hot patch. Even if the operating system has been maliciously hijacked by an attacker, the patch content will not be tampered with.

Description

Technical Field

[0001] The present invention relates to operating system technology, in particular to an operating system hot patch implementation method, electronic equipment and storage medium. Background Art

[0002] As software complexity and heterogeneity continue to grow, the pressure to patch and update software, including operating system patches, to address security vulnerabilities in a timely manner is increasing. However, when applying patches requires a system restart, users experience downtime and loss of status (such as network connectivity). Even when the computer is idle, a restart can cause brief interruptions or unexpected errors, inevitably impacting businesses and end users. Existing systems require continuous high-precision calculations and critical financial transactions, making system restarts impractical. Beyond the most immediate cost of downtime, other costs, such as depleted inventory, can be difficult to quantify, but they can negatively impact a company's performance. Furthermore, security vulnerabilities in vehicle control devices, engine control units, or robotic systems can have catastrophic consequences. Consequently, businesses and users often delay applying operating system patches, increasing the risk to computing resources and potentially leading to even more severe losses for users.

[0003] The importance of patches in fixing vulnerabilities and adding software functionality is undeniable. Consequently, several real-time patching mechanisms have been proposed to reduce or avoid reboots of target systems, thereby eliminating the risks and costs associated with downtime. Among these mechanisms is dynamic hot patching, which applies patches to running software without restarting it. The hot patching process ensures high availability and maintains the current state of the program, so it has been widely studied in environments such as traditional software and server applications.

[0004] Prior to this, mainstream hot patching technologies in the industry included kpatch, kGraft, and Ksplice. Developed by Red Hat, kpatch uses the ftrace mechanism to trigger kernel replacements. During runtime, it does not redirect kernel calls to the old version. Instead, it waits until all function calls have stopped before switching to the new kernel. Developed by SUSE, kGraft uses a set of diff files to calculate the kernel sections that need to be modified. Kgraft does not require a complete kernel shutdown when performing replacements. During patching, running functions can initially use the corresponding sections from either the old or new kernel versions. Once the patch is applied, they can fully switch to the new version. Ksplice, developed by Ksplice, Inc. and later acquired by Oracle, utilizes the Linux kernel's stop_machine mechanism: it halts execution on all CPUs, leaving only the primary CPU to perform binary instruction replacement. All three of these technologies are real-time patching mechanisms for the running Linux kernel.

[0005] In addition, academic hot patching technologies mainly include KShot, HERA, and RapidPatch. KShot is an x86 kernel hot patching mechanism that patches Linux kernel security vulnerabilities based on the existing Intel SGX and x86 SMM technologies. The patching process is protected by a hardware-assisted trusted execution environment. HERA is a hot patching mechanism for embedded real-time applications that uses the built-in hardware features of commercial Cortex-M microcontrollers to perform hot patches on embedded systems. RapidPatch is a hot patching framework that uses the eBPF virtual machine to execute patches on resource-constrained embedded devices. It promotes patch propagation by installing universal patches without interrupting other tasks running on heterogeneous embedded devices.

[0006] There are several problems with existing kernel hot patching research:

[0007] First, there's the reliability issue. Existing methods like kpatch, kGraft, and Ksplice all require modifying existing kernel code and trusting the operating system, but operating systems aren't completely trustworthy. An attacker could hijack the operating system, interrupting the patch installation process. Even if the patch is successfully installed, the attacker's malicious program could roll back the system state to the pre-patch state or even directly modify the patch content, defeating the original purpose of installing the patch to fix a vulnerability or add functionality.

[0008] The second issue is the limited number of patches. Existing hot patching technology is constrained by factors such as the number of FPB unit breakpoints, which limits the number of patches that can be applied, affecting the flexibility of the patching process.

[0009] Finally, there's the issue of overhead. Since the target system is already running, if the hot patching process incurs excessive performance overhead, it can cause system task execution delays. For systems with hard real-time constraints, uninterrupted execution delays are unacceptable, and the patching process may be forced to pause, significantly increasing the risk of system attacks.

[0010] CN112988182A discloses a LINUX kernel hot patching implementation method, electronic device and computer-readable medium. The solution modifies the header instruction code of the patched function through atomic operations to maintain the atomicity of the modification process. However, if there is a malicious attacker who has hijacked the operating system, the attacker can tamper with the instruction content after modifying the instruction code.

[0011] CN105630557B provides a hot patching method and device. This solution is for hot patching applications. Its patching process is completely dependent on the operating system, which requires the use of a dynamic symbol table to search for the address of external symbols, resulting in high search overhead. Summary of the Invention

[0012] The technical problem to be solved by the present invention is to provide a method for implementing hot patching of an operating system, an electronic device and a storage medium to prevent the patch content from being tampered with, in view of the shortcomings of the existing technology.

[0013] To solve the above technical problems, the present invention adopts a technical solution: a method for implementing a hot patch for an operating system, comprising the following steps:

[0014] Replace the first instruction of the original function executed by the kernel with a trampoline instruction that redirects to the patched function;

[0015] Create the first GPT table GPT1 and modify the GPT entry corresponding to the entire memory page where the trampoline instruction is located so that the memory page is in the root world permission;

[0016] After the patch is loaded into memory, the first GPT table GPT1 is modified, and the page where the patch is located is set to the rootworld permission;

[0017] The trampoline instruction is accessed to trigger the patch.

[0018] The hot patching process of the present invention does not require modifying existing kernel code or trusting the operating system to implement hot patching, thus maintaining intact system functionality. Even if the operating system has been maliciously hijacked by an attacker, the patch content cannot be tampered with, ensuring that the system patch installation process is not interrupted. This prevents the attacker's malicious program from reverting the system state after patch installation to the state before the patch was installed, and prevents the attacker from directly modifying the patch content, significantly improving the reliability of the hot patching process. The GPC mechanism of the ARM confidential computing architecture (creating a GPT table) modifies the memory access permissions that store instruction content, thereby protecting the instructions of the patched function and effectively preventing tampering by attackers. The present invention's solution targets kernel hot patching, enabling a single kernel patch to be applied to all applications. The addresses of external symbols are known, eliminating the need for dynamic symbol table lookups, reducing overhead.

[0019] Before replacing the first instruction of the original function executed by the kernel with a trampoline instruction redirecting to the patch function, a hot patch preparation operation is also included. The specific implementation process of the hot patch preparation operation includes:

[0020] Compile the original kernel code to obtain the first image file; compile the patch code to obtain the second image file;

[0021] Disassembling the first image file and the second image file to obtain a first disassembled file and a second disassembled file respectively;

[0022] Comparing the first disassembly file and the second disassembly file to obtain an instruction-level kernel code comparison report;

[0023] All the information in the comparison report is used to compile a hot patch source code, and the hot patch source code is compiled to generate a hot patch in a dynamic link library format.

[0024] In this invention, the comparison report includes the assembly instruction content before and after the kernel patch, the assembly instruction address of the matching function, and the machine code of the matching function. The machine code of some jump instructions is recalculated and replaced, mainly including modifying the bl jump instruction to a blr instruction and using the mov instruction before the blr instruction to save the jump address in a register. The advantage of this hot patch preparation process is that it can be standardized and automated when conducting batch experiments.

[0025] In the present invention, before replacing the first instruction of the original function executed by the kernel with a trampoline instruction redirecting to the patch function, it also includes: loading the hot patch installation into the target machine, and when the kernel version of the target machine is consistent with the machine version of the patch creation, loading the hot patch into the address space of the target system process.

[0026] The present invention replaces the first instruction of an original function executed by the kernel with a trampoline instruction that redirects the kernel to the patched function. The specific implementation process includes locating the location where the kernel executes the first instruction of the original function, replacing the first instruction with a trampoline instruction, and redirecting the control flow to a special function that serves as the patched entry point. The present invention requires minimal modifications and does not affect the original kernel's functionality.

[0027] The specific implementation process of accessing the trampoline instruction and triggering the patch includes:

[0028] Accessing the trampoline instruction triggers a GPF exception;

[0029] A second GPT table, GPT2, is created. If access to the trampoline instruction is legitimate, the first GPT table, GPT1, is switched to the second GPT table, GPT2. In the second GPT table, GPT2, the trampoline instruction and the patch portion are set with normal world permissions, while all other portions are set with root world permissions. This method protects the original kernel content from modification while ensuring that legitimate access operations proceed normally.

[0030] After the patch is triggered, the method further includes redirecting the original execution flow to the patch function to complete the application of the hot patch.

[0031] After the hotfix is applied, the second GPT table GPT2 is switched back to the first GPT table GPT1, and the kernel is returned to the code where the kernel is normally executed, and the kernel is continued to run according to the original process. In the present invention, only the GPT table switching operation can restore the kernel to a normal execution state.

[0032] As an inventive concept, the present invention further provides an electronic device comprising:

[0033] one or more processors;

[0034] A memory having one or more programs stored thereon, which, when executed by the one or more processors, enables the one or more processors to implement the steps of the above method of the present invention.

[0035] As an inventive concept, the present invention further provides a computer-readable storage medium storing a computer program, which implements the steps of the above method of the present invention when executed by a processor.

[0036] Compared with the prior art, the present invention has the following beneficial effects: in response to the reliability issue of hot patches, the present invention implements a safe and reliable operating system hot patching method that does not affect the original system functions, and uses the GPC mechanism of the ARM confidential computing architecture to protect the entire process of triggering and applying hot patches. Even if the operating system has been maliciously hijacked by an attacker, the patch content will not be tampered with; the present invention is universal and applicable to all bug types; while providing safe and reliable operating system hot patches to mitigate known kernel vulnerabilities, the present invention has almost no impact on system performance. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] Figure 1 This is a flowchart of preparing a hot patch according to an embodiment of the present invention;

[0038] Figure 2 This is a flowchart of patch transmission and application according to an embodiment of the present invention;

[0039] Figure 3 This is a flow chart of memory access triggering GPF according to an embodiment of the present invention;

[0040] Figure 4 This is a flowchart of the GPF handler table switching process according to an embodiment of the present invention. DETAILED DESCRIPTION

[0041] To make the objectives, technical solutions, and advantages of the embodiments of the present invention more clear, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts shall fall within the scope of protection of the present invention.

[0042] Example 1

[0043] The secure and tamper-resistant operating system hot patching method according to the embodiment of the present invention is mainly divided into the following parts:

[0044] 1. Analyze the code instruction level differences and use them to prepare the hot patch. The preparation process is as follows: Figure 1 shown.

[0045] (1) Compile the kernel code to obtain the uncompressed kernel image. Compile the original kernel code to obtain the image file vmlinux1, and compile the patched kernel code to obtain vmlinux2.

[0046] (2) Disassemble the kernel image to obtain the assembly file. Use the disassembly command objdump -d to disassemble the compiled image files vmlinux1 and vmlinux2 to obtain vmlinux1.out and vmlinux2.out.

[0047] (3) Analyze instruction-level differences using assembly files. Use binary comparison tools to analyze the differences between vmlinux1.out and vmlinux2.out, and generate an instruction-level kernel code comparison report. The report includes information such as the assembly instruction content before and after the kernel patch, the assembly instruction address of the matching function, and the machine code of the matching function. The machine code of some jump instructions is recalculated and replaced, mainly including modifying the bl jump instruction to the blr instruction and using the mov instruction before the blr instruction to save the jump address in a register.

[0048] (4) Generate a loadable hot patch. Use all the information obtained above to write the hot patch source code. The patch information includes the patch size and patch insertion point. Finally, compile and generate the hot patch in the format of a dynamic link library.

[0049] 2. Utilize secure and confidential channels for patch delivery and transmission. To install a hot patch on a target machine, the patch handler first selects a secure and confidential communication channel with the remote patch generator. The patch handler retrieves the patch generated by the generator through this communication channel. After ensuring that the kernel version of the target machine matches that of the machine that created the patch, the patch handler extracts metadata from the patch and then uses the loader to load the patch into the address space of the target system process.

[0050] 3. Modify the GPT entries for critical memory pages. Set the memory pages related to protected content to higher access permissions.

[0051] (1) Insert a trampoline instruction into the original function. Replace the first instruction of the original function executed by the kernel with a trampoline instruction jmp that redirects the control flow to the patch function. Locate the location where the kernel executes the first instruction of the original function and replace it with a trampoline instruction, redirecting the control flow to a special function that serves as the patch entry point.

[0052] (2) Modify the access rights of the trampoline instruction. Create the first GPT table GPT1. Since the minimum granularity of the GPT table is 4K, directly modify the GPT table entry corresponding to the entire 4K memory page where the trampoline instruction is located, so that the page is under rootworld permissions. After that, users with lower permissions will not be able to perform any modification operations on the content where the trampoline instruction is located.

[0053] (3) Modify the access rights of the patch. After confirming that the patch has been loaded into memory, modify GPT1 and set the page where the patch is located to the root world.

[0054] 4. Access the trampoline command to trigger the patch.

[0055] (1) Accessing the trampoline instruction triggers GPF. When the normal process of the original system runs to the predefined trampoline instruction point, a GPF exception will be triggered. Since the security status of the memory page where the trampoline instruction is located is root world, when the program executes to the trampoline instruction, it will try to access the memory page where the instruction is located, but due to insufficient access permissions, a GPF exception is triggered. The process of the program accessing memory to trigger GPF is as follows: Figure 3 shown.

[0056] (2) The GPF handler switches the GPT table. Create a second GPT table GPT2. If the access is legal, in order to ensure the normal operation of the patch process, the GPF handler will perform the table switching operation. In the exception handling, the GPF handler switches the current GPT1 to GPT2. In GPT2, the trampoline instruction and the patch part are set in the normal world, and the other parts are set in the root world. This ensures that the other normal parts of the original execution process that do not need to be modified will not be maliciously tampered with by the attacker. The GPF handler table switching process is as follows: Figure 4 shown.

[0057] 5. The original execution flow is redirected to the patch function, completing the patch application. Due to runtime code remapping, the execution flow is redirected to the entry point of the patch. At this point, the original execution flow switches to the patch execution flow and continues to run, completing the patch application process.

[0058] 6. Use the GPT table for patch protection. After completing the above process, the GPF handler performs another table switch operation. At this point, after running the patch application process, the original system execution flow returns to the original system function execution address. Due to insufficient access rights, another GPF exception is triggered. In this exception, GPT2 is switched back to GPT1. Finally, the execution flow returns to the normal kernel execution code, and the kernel continues to run according to the original process.

[0059] Example 2

[0060] Embodiment 2 of the present invention provides an electronic device corresponding to the above-mentioned embodiment 1. The electronic device may be a processing device for a client, such as a mobile phone, a laptop computer, a tablet computer, a desktop computer, etc., to execute the method of the above-mentioned embodiment.

[0061] The electronic device of this embodiment includes a memory, a processor, and a computer program stored in the memory; the processor executes the computer program in the memory to implement the steps of the method in the above-mentioned embodiment 1.

[0062] In some implementations, the memory may be a high-speed random access memory (RAM), and may also include a non-volatile memory, such as at least one disk storage.

[0063] In other implementations, the processor may be a central processing unit (CPU), a digital signal processor (DSP), or other general-purpose processors, which are not limited herein.

[0064] Example 3

[0065] Embodiment 3 of the present invention provides a computer-readable storage medium corresponding to the above-mentioned embodiment 1, on which a computer program / instruction is stored. When the computer program / instruction is executed by a processor, the steps of the method of the above-mentioned embodiment 1 are implemented.

[0066] Computer readable storage media can be tangible devices that hold and store instructions used by instruction execution devices. Computer readable storage media can be, for example, but not limited to, electronic storage devices, magnetic storage devices, optical storage devices, electromagnetic storage devices, semiconductor storage devices, or any combination thereof.

[0067] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may take the form of a fully hardware embodiment, a fully software embodiment, or an embodiment combining software and hardware. Furthermore, the present application may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code. The solutions in the embodiments of the present application may be implemented in various computer languages, such as the object-oriented programming language Java and the interpreted scripting language JavaScript.

[0068] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 a process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0069] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing the instructions executed on the computer or other programmable device for implementing the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0070] Although the preferred embodiments of the present application have been described, those skilled in the art may make additional changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the present application.

[0071] Obviously, those skilled in the art may make various changes and modifications to this application without departing from the spirit and scope of this application. Thus, if these modifications and variations of this application fall within the scope of the claims of this application and their equivalents, this application is intended to include these modifications and variations.

Claims

1. A method for implementing a hot patch for an operating system, characterized in that: The following steps are involved: Replace the first instruction of the original function executed by the kernel with a trampoline instruction that redirects to the patched function; Create the first GPT table GPT1 and modify the GPT entry corresponding to the entire memory page where the trampoline instruction is located so that the memory page is in the root world permission; After the patch is loaded into memory, the first GPT table GPT1 is modified to set the page where the patch is located to the root world permissions; Accessing the trampoline instruction to trigger the patch; The specific implementation process of replacing the first instruction of the original function executed by the kernel with a trampoline instruction redirecting to the patch function includes: locating the position where the first instruction of the original function is executed by the kernel, replacing the first instruction with a trampoline instruction, so that the control flow is redirected to a special function serving as the patch entry point; The specific implementation process of accessing the trampoline instruction and triggering the patch includes: Accessing the trampoline instruction triggers a GPF exception; Create a second GPT table GPT2. If the access to the trampoline instruction is legal, switch the first GPT table GPT1 to the second GPT table GPT2. In the second GPT table GPT2, the trampoline instruction and the patch part are set in the normal world permissions, and the other parts are set in the root world permissions.

2. The method for implementing a hot patch for an operating system according to claim 1, wherein: Before replacing the first instruction of the original function executed by the kernel with a trampoline instruction redirecting to the patch function, a hot patch preparation operation is also included. The specific implementation process of the hot patch preparation operation includes: Compile the original kernel code to obtain the first image file; compile the patch code to obtain the second image file; Disassembling the first image file and the second image file to obtain a first disassembled file and a second disassembled file respectively; Comparing the first disassembly file and the second disassembly file to obtain an instruction-level kernel code comparison report; All the information in the comparison report is used to compile a hot patch source code, and the hot patch source code is compiled to generate a hot patch in a dynamic link library format.

3. The method for implementing a hot patch for an operating system according to claim 2, wherein: The comparison report includes the assembly instruction content before and after the kernel patch, the assembly instruction address of the matching function, and the machine code of the matching function.

4. The method for implementing a hot patch for an operating system according to any one of claims 1 to 3, wherein: Before the kernel replaces the first instruction of the original function with a trampoline instruction that redirects to the patched function, it also includes: The hot patch is installed and loaded into the target machine. When the kernel version of the target machine is consistent with the version of the machine where the patch is created, the hot patch is loaded into the address space of the target system process.

5. The method for implementing a hot patch for an operating system according to claim 1, wherein: After the patch is triggered, the method further includes redirecting the original execution flow to the patch function to complete the application of the hot patch.

6. The method for implementing a hot patch for an operating system according to claim 5, wherein: After the hot patch is applied, the process also includes: switching the second GPT table GPT2 back to the first GPT table GPT1, returning to the code where the kernel is normally executed, and continuing to run the kernel according to the original process.

7. An electronic device, characterized in that: include: one or more processors; A memory having one or more programs stored thereon, which, when executed by the one or more processors, enables the one or more processors to implement the steps of the method according to any one of claims 1 to 6.

8. A computer-readable storage medium, characterized in that The device stores a computer program, which, when executed by a processor, implements the steps of the method according to any one of claims 1 to 6.

Images