Kernel hot repair method and device, storage medium and product

Abstract

The invention provides a kernel hot repair method and device, a storage medium and a product, and relates to the technical field of kernel hot repair, and the method comprises the following steps: obtaining an offset address of a to-be-repaired function relative to a parent function configuration item; the function to be repaired is a static function or an inline function of an operating system kernel; calculating a to-be-repaired position of the to-be-repaired function in a memory according to the memory address and the offset address of the parent function configuration item; and adding a first jump instruction used for jumping to a repair instruction corresponding to the to-be-repaired function at the to-be-repaired position, and adding a second jump instruction used for jumping to the to-be-repaired function at the end position of the repair instruction to complete hot repair operation on the to-be-repaired function. Therefore, the start and end of the static function and the inline function can be recognized, the problem that the symbol of the static function or the inline function is invisible in the global range is solved, an accurate offset address can be obtained, and hot repair operation on the static function and the inline function can be achieved in combination with the jump instruction.

Description

Technical Field

[0001] The present invention relates to the technical field of kernel hot patching, and in particular to a kernel hot patching method, device, storage medium and product. Background Art

[0002] During the operation of Linux (an operating system), the system may encounter errors that need to be fixed or performance optimization needs. The traditional approach is to recompile the kernel and restart the system to apply the update after discovering the error. The hot patching technology based on kprobes (a lightweight kernel debugging technology) can implement the function of modifying the kernel code at runtime without affecting the normal operation of the system. This method not only reduces the risk of service interruption caused by restart, but also improves the availability and maintainability of the system. However, there are some unavoidable problems in using kprobe. First of all, using kprobe requires the development of kernel modules, and the plug-in points generally used for fault debugging are very unstable. For inline functions and static functions in the kernel, they are not visible in the global scope and are expanded into multiple copies during compilation and scattered throughout the code. For the above reasons, kprobe technology cannot be used directly. Most developers can only choose to recompile the kernel or kernel module and use replacement to debug or make patches.

[0003] It can be seen that how to implement hot patching of inline functions and static functions of the system kernel is a problem that needs to be solved by those skilled in the art. Summary of the invention

[0004] The purpose of the embodiments of the present invention is to provide a kernel hot patching method, device, storage medium and product, which can solve the problem that kernel static functions and inline functions cannot be hot patched.

[0005] To solve the above technical problems, in a first aspect, an embodiment of the present invention provides a kernel hot patching method, comprising:

[0006] Obtaining the offset address of the function to be patched relative to the parent function configuration item; the function to be patched is a static function or an inline function of the operating system kernel;

[0007] Calculate the location of the function to be patched in memory according to the memory address and offset address of the parent function configuration item;

[0008] A first jump instruction for jumping to a patch instruction corresponding to the function to be patched is added at the position to be patched, and a second jump instruction for jumping to the function to be patched is added at the end position of the patch instruction to complete the hot patch operation on the function to be patched.

[0009] Optionally, get the offset address of the function to be patched relative to the parent function configuration item, including:

[0010] Get the parent function configuration item corresponding to the function to be patched;

[0011] Based on the detection method for the function to be patched in the parent function configuration item, the offset address of the function to be patched relative to the parent function configuration item is determined by code scanning detection.

[0012] Optionally, based on the detection method for the function to be patched in the parent function configuration item, the offset address of the function to be patched relative to the parent function configuration item is determined by code scanning detection, including:

[0013] If the detection method for the function to be patched in the parent function configuration item indicates tracking of the static function to be patched, then determining the first assembly code of the static function to be patched by means of code scanning detection;

[0014] The difference between the actual address of the function start instruction represented by the first assembly code and the entry address of the static function to be patched is calculated to obtain the offset address of the static function to be patched relative to the parent function configuration item.

[0015] Optionally, based on the detection method for the function to be patched in the parent function configuration item, the offset address of the function to be patched relative to the parent function configuration item is determined by code scanning detection, including:

[0016] If the detection method for the function to be patched in the parent function configuration item indicates tracking of the inline function to be patched, then determining the second assembly code of the inline function to be patched by means of code scanning detection;

[0017] Determine the function start instruction of each module file corresponding to the second assembly code, and calculate the difference between the actual address of the function start instruction corresponding to each module file and the starting position of the inline function to be patched, so as to obtain the offset address of the inline function to be patched relative to the parent function configuration item.

[0018] Optionally, the difference between the actual address of the function start instruction corresponding to each module file and the start position of the inline function to be patched is calculated respectively to obtain the offset address of the inline function to be patched relative to the parent function configuration item, including:

[0019] A decompilation tool is used to process the kernel image or each module file of the inline function to be patched, and based on the corresponding decompilation result, the difference between the actual address of the function start instruction corresponding to each module file and the start position of the inline function to be patched is obtained to obtain the offset address of the inline function to be patched relative to the parent function configuration item.

[0020] Optionally, after obtaining the offset address of the function to be patched relative to the parent function configuration item, it also includes:

[0021] The offset address is filled into a preset offset address list, and an information mapping table of the function name, memory address, and function length of the function to be patched is generated for query by relevant personnel.

[0022] Optionally, the location of the function to be patched in memory is calculated according to the memory address and offset address of the parent function configuration item, including:

[0023] The memory address of the parent function configuration item plus the offset address is used to obtain the assembly code position of the function to be patched in the memory.

[0024] Optionally, adding a first jump instruction for jumping to a patch instruction corresponding to the function to be patched at the position to be patched includes:

[0025] The distance between the patch position to be patched and the patch instruction corresponding to the function to be patched is calculated to obtain the jump distance;

[0026] Generate a target jump type based on a size relationship between the jump distance and a preset distance threshold, and generate a first jump instruction for jumping to the patch instruction based on the target jump type; the target jump type is a long jump type or a short jump type;

[0027] Add the first jump instruction to the location to be patched.

[0028] Optionally, generating a target jump type based on a magnitude relationship between the jump distance and a preset distance threshold includes:

[0029] If the jump distance is less than the preset distance threshold, the short jump type is determined as the target jump type corresponding to the jump distance; otherwise, the long jump type is determined as the target jump type corresponding to the jump distance.

[0030] Optionally, generating a first jump instruction for jumping to the patch instruction based on the target jump type includes:

[0031] A first jump instruction for jumping to the patch instruction is generated using a jump parameter corresponding to the target jump type; the jump parameter includes a 32-bit offset corresponding to the near jump type, or a 16-bit segment selector and a 32-bit offset corresponding to the long jump type.

[0032] Optionally, a second jump instruction for jumping to the function to be patched is added at the end position of the patch instruction, including:

[0033] Use a decompilation tool to view the assembly code of the function to be patched to determine the code end instruction of the assembly code corresponding to the position to be patched;

[0034] A second jump instruction for jumping to the next function instruction of the code end instruction in the to-be-patched function is added at the end position of the patch instruction.

[0035] Optionally, adding a second jump instruction for jumping to the next function instruction of the code end instruction in the to-be-patched function at the end position of the patch instruction includes:

[0036] Calculate the code end position of the position to be patched according to the first start position of the code end instruction and the instruction length, and determine the code end position as the second start position of the next function instruction of the code end instruction;

[0037] generating a second jump instruction for jumping to the second starting position based on the distance between the end position of the patch instruction and the second starting position;

[0038] A second jump instruction is added at the end of the patch instruction.

[0039] In a second aspect, an embodiment of the present invention provides an electronic device, including:

[0040] Memory for storing computer programs;

[0041] The processor is used to execute a computer program to implement the steps of the above kernel hot patching method.

[0042] In a third aspect, an embodiment of the present invention provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the steps of the above kernel hot patching method are implemented.

[0043] In a fourth aspect, an embodiment of the present invention provides a computer program product, including a computer program / instruction, which implements the steps of the above kernel hot patching method when executed by a processor.

[0044] It can be seen from the above technical scheme that when performing kernel hot patching, the present application first obtains the offset address of the function to be patched relative to the parent function configuration item; the function to be patched is a static function or an inline function of the operating system kernel; the position of the function to be patched in the memory is calculated according to the memory address and the offset address of the parent function configuration item; then, a first jump instruction for jumping to the patch instruction corresponding to the function to be patched is added at the position to be patched, and a second jump instruction for jumping to the function to be patched is added at the end position of the patch instruction to complete the hot patching operation on the function to be patched. In this way, the present application can identify the position of the function for the static function and inline function of the operating system kernel, can correctly identify the start and end of the static function instruction, overcome the problem that the static function or inline function symbol is not visible in the global scope, can obtain an accurate offset address, and can realize the hot patching operation on the static function and inline function in combination with the jump instruction. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] In order to more clearly illustrate the embodiments of the present invention, the following briefly introduces the drawings required for use in the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0046] Figure 1 A flow chart of a kernel hot patching method disclosed in this application;

[0047] Figure 2 A specific kernel hot patching method flow chart disclosed in this application;

[0048] Figure 3 Another specific kernel hot patching method flow chart disclosed in this application;

[0049] Figure 4 This is a structural diagram of an electronic device disclosed in this application. DETAILED DESCRIPTION

[0050] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0051] The terms "including" and "having" in the specification of the present invention and the above-mentioned drawings, as well as any variations thereof, are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device including a series of steps or units is not limited to the listed steps or units, but may include steps or units that are not listed.

[0052] In order to enable those skilled in the art to better understand the scheme of the present invention, the present invention is further described in detail below in conjunction with the accompanying drawings and specific implementation methods.

[0053] As Figure 1 As shown, the embodiment of the present application discloses a kernel hot patching method, including:

[0054] Step S11, obtaining the offset address of the function to be patched relative to the parent function configuration item; the function to be patched is a static function or an inline function of the operating system kernel.

[0055] In an embodiment of the present application, the function to be patched in the operating system kernel may be a static function or an inline function; first, the actual address of the function to be patched is required, that is, the actual address of the static function or the actual address of the inline function (module file); then, based on the parent function configuration item of the function to be patched, the offset address of the static function or the inline function relative to the parent function configuration item can be determined.

[0056] In a specific embodiment, according to the offset address of the function to be patched relative to the parent function configuration item, it can include: obtaining the parent function configuration item corresponding to the function to be patched; based on the detection method for the function to be patched in the parent function configuration item, and determining the offset address of the function to be patched relative to the parent function configuration item by code scanning detection. Specifically, in the process of determining the offset address of the function to be patched relative to the parent function configuration item, the parent function configuration item corresponding to the function to be patched can be read first, and the parent function configuration item has a detection method for the function to be patched (static function or inline function); based on the detection method corresponding to the function to be patched, the offset address of the static function or inline function relative to the parent function configuration item can be determined by code scanning detection.

[0057] In another specific embodiment, based on the detection method for the function to be patched in the parent function configuration item, and determining the offset address of the function to be patched relative to the parent function configuration item by means of code scanning detection, it may include: if the detection method for the function to be patched in the parent function configuration item represents tracking of the static function to be patched, then determining the first assembly code of the static function to be patched by means of code scanning detection; calculating the difference between the actual address of the function start instruction represented by the first assembly code and the entry address of the static function to be patched, and obtaining the offset address of the static function to be patched relative to the parent function configuration item. Specifically, when the detection method for the function to be patched in the parent function configuration item represents tracking of the static function to be patched, if the detection method is tracking the entry address of the static function, then the first assembly code of the static function to be patched can be determined by means of code scanning detection, and the difference between the address of each code instruction represented by the first assembly code and the entry address of the static function to be patched is calculated, that is, the offset address of the static function to be patched relative to the parent function configuration item can be obtained. Correspondingly, based on the detection method for the function to be patched in the parent function configuration item, and determining the offset address of the function to be patched relative to the parent function configuration item by means of code scanning detection, it can include: if the detection method for the function to be patched in the parent function configuration item represents tracking of the inline function to be patched, then determining the second assembly code of the inline function to be patched by means of code scanning detection; determining the function start instruction of each module file corresponding to the second assembly code, and respectively calculating the difference between the actual address of the function start instruction corresponding to each module file and the starting position of the inline function to be patched, to obtain the offset address of the inline function to be patched relative to the parent function configuration item. Specifically, if the detection method of the function to be patched in the parent function configuration item represents the tracking of the inline function to be patched, the second assembly code of the inline function to be patched can be determined by code scanning detection; it should be pointed out that the inline function will be expanded into multiple module files during compilation, that is, the second assembly code here corresponds to the module files after the inline function is expanded; further, in this way, the starting position of the inline function and the function start instruction corresponding to each module file can be obtained, and then the difference between the address of the function start instruction corresponding to each module file and the starting position of the inline function is calculated respectively, that is, the offset address of the inline function to be patched relative to the parent function configuration item can be obtained.

[0058] In a specific embodiment, respectively calculating the difference between the actual address of the function start instruction corresponding to each module file and the starting position of the inline function to be patched, and obtaining the offset address of the inline function to be patched relative to the parent function configuration item, can include: using a decompilation tool to process the kernel image or each module file of the inline function to be patched, and based on the corresponding decompilation result, obtaining the difference between the actual address of the function start instruction corresponding to each module file and the starting position of the inline function to be patched, and obtaining the offset address of the inline function to be patched relative to the parent function configuration item. Specifically, the inline function is split into several module files during the compilation process, and here the decompilation tool can be used to perform decompilation processing on each module file of the inline function to be patched, or the kernel image of the operating system, and the internal structure and content of the file can be viewed; further, according to the decompilation result obtained by processing, the difference between the actual address of the function start instruction corresponding to each module file and the starting position of the inline function to be patched can be identified and extracted, that is, the offset address of the inline function to be patched relative to the parent function configuration item is obtained.

[0059] In another specific embodiment, after obtaining the offset address of the function to be patched relative to the parent function configuration item, it can also include: filling the offset address into a pre-set offset address list, and generating an information mapping table of the function name, memory address, and function length of the function to be patched, so that relevant personnel can query. Specifically, after obtaining the offset address of the function to be patched relative to the parent function configuration item, this scheme can fill the offset address into a pre-set offset address list for subsequent use; and, at the same time, can save the information mapping table of the function name, memory address, and function length of the function to be patched; wherein, for a static function, the information mapping table of the function name, memory address, and function length of the static function is saved, and for an inline function, an information mapping table of the function name, inline function offset, memory address, and function length of the inline function can be generated.

[0060] Step S12: Calculate the to-be-patched position of the to-be-patched function in the memory using the memory address and offset address of the parent function configuration item.

[0061] In an embodiment of the present application, the above steps can be used to obtain the offset address of the function to be patched relative to the parent function configuration item, and then the location of the code that needs to be modified in the function to be patched needs to be accurately determined. Specifically, the memory address of the parent function configuration item and the obtained offset address of the function to be patched need to be used to calculate the location of the code that needs to be modified in the memory of the function to be patched.

[0062] In a specific embodiment, the position of the function to be patched in the memory is calculated based on the memory address and offset address of the parent function configuration item, which may include: using the memory address of the parent function configuration item plus the offset address to obtain the position of the assembly code of the function to be patched in the memory to be patched. Specifically, in the process of determining the position of the code that needs to be modified in the function to be patched, it is necessary to know the starting address of the function to be patched in the memory, that is, to obtain the memory address of the parent function by reading the kernel symbol table of the parent function configuration item; then, the address of the function to be patched in the memory can be calculated by using the memory address plus the offset address of the function to be patched relative to the parent function configuration item, and further the position of the assembly code of the function to be patched that needs to be modified in the memory to be patched can be determined.

[0063] Step S13, adding a first jump instruction for jumping to the patch instruction corresponding to the function to be patched at the position to be patched, and adding a second jump instruction for jumping to the function to be patched at the end position of the patch instruction to complete the hot patch operation on the function to be patched.

[0064] In this embodiment, after obtaining the assembly code of the function to be patched that needs to be modified at the position to be patched in the memory through the above steps, a jump instruction can be added to the position to be patched, and the patching operation of the position to be patched of the function to be patched using the patch instruction can be directly implemented through the jump instruction; through the first jump instruction added at the position to be patched, the corresponding patch instruction can be jumped to execute, avoiding the relevant code that needs to be modified in the function to be patched, and the patching operation of the function to be patched can be implemented. In addition, at the end position of the patch instruction, it is necessary to jump to the function to be patched again. Through the added second jump instruction, after the patch instruction is executed, the function instruction represented by the relevant code after the position to be patched in the function to be patched can be jumped to execute. In this way, the patching operation of the function to be patched can be completed through two jump instructions.

[0065] In a specific embodiment, Figure 2As shown, in the process of hot patching the static function or inline function of the operating system kernel export symbol (a macro in the Linux kernel), first obtain the parent function configuration item that calls the target function to be patched; then determine the offset address of the target function to be patched relative to the parent function according to the detection method in the configuration item, and calculate the position (code address) of the code to be repaired in the target function in combination with the offset address of the target function; further, the specific position of the code to be modified in the target function has been determined through the above steps, and then combined with the offset position of the code position to be modified and the position of the patch instruction, the length of the jump instruction can be calculated to generate a corresponding jump instruction for jumping from the code position to be modified to the position of the patch instruction; and save the jump instruction length added in the target function, as well as the length of the assembly code and related function instructions corresponding to the target function to the backup area of ​​the configuration item for subsequent use; then insert a jump instruction at the code position to be modified to jump to the beginning of the patch instruction. Correspondingly, a jump instruction needs to be added at the code end position of the patch instruction to jump to the position of the next instruction corresponding to the end instruction of the code to be modified in the target function; and use the patch instruction to implement the hot patching operation on the target function.

[0066] In another specific embodiment, Figure 3As shown, the offset address of the static function or inline function to be patched can be determined through the parent function configuration item; the detection method is characterized by tracking the static function entry address, and the corresponding offset address is set to the actual start position of the static function and stored in the preset offset address list; since the address of this static function is not a globally visible symbol table, the actual address of the static function can be found by code scanning detection. If the detection method is to track inline functions or any one of function jump points, function return points, and source code location running points, the module file of the kernel image or target function is decompiled and the corresponding offset address is extracted, and the extracted offset address is stored in the offset address list. In other words, if the detection method is to track static functions, analyze the assembly code and find the static function start instruction, calculate the difference between each instruction address and the function entry address, and fill it into the offset address list, and save the static function name and address, function length information mapping table; if the detection method is to track inline functions, analyze the assembly code and find the inline function start instruction, calculate the difference between each instruction point address and the inline start position, and fill it into the offset address list, and generate the return inline function offset and address, function length information mapping table. Furthermore, the jump instruction can be used to jump from the start position of the static function or inline function to the patch instruction, and the patch instruction can be used to jump from the end position of the static function or inline function to the next function instruction (parent function body) at the end position of the static function or inline function. It should be pointed out that in order to facilitate subsequent query use, the jump instruction length can be copied and saved to the backup area, and memcpy (a standard library function used to copy the contents of a block of memory to another block of memory) can be used according to the jump instruction length to read the instruction to be patched and save it to the backup_instructions array. In this way, by jumping to the patch instruction, the patch operation of the function body from the start position to the end position of the static function or inline function is realized.

[0067] In a specific embodiment, adding a first jump instruction for jumping to a patch instruction corresponding to a function to be patched at a position to be patched may include: calculating the distance between the position to be patched and the patch instruction corresponding to the function to be patched to obtain a jump distance; generating a target jump type based on the size relationship between the jump distance and a preset distance threshold, and generating a first jump instruction for jumping to the patch instruction based on the target jump type; the target jump type is a long jump type or a near jump type; adding the first jump instruction to the position to be patched. Specifically, in the process of adding the first jump instruction to the position to be patched, the positions of the position to be patched and the patch instruction need to be considered, and a corresponding jump instruction is generated according to the relationship between the positions; first, the distance between the position to be patched and the patch instruction corresponding to the function to be patched is calculated to obtain a jump distance, and then a corresponding target jump type may be generated based on the size relationship between the jump distance and the preset distance threshold, and the jump type may be a long jump or a near jump, corresponding to jump instructions of different lengths respectively; then, based on the target jump type and the positions of the position to be patched and the patch instruction, a corresponding first jump instruction for jumping from the position to be patched to the position of the patch instruction may be generated.

[0068] In a specific embodiment, generating a target jump type based on the size relationship between the jump distance and a preset distance threshold may include: if the jump distance is less than the preset distance threshold, determining the near jump type as the target jump type corresponding to the jump distance, otherwise determining the long jump type as the target jump type corresponding to the jump distance. Specifically, if the jump distance between the position to be patched and the position of the patch instruction is less than the preset distance threshold, the near jump type is determined as the target jump type of the jump distance; it is understandable that if the jump distance is not less than the preset distance threshold, the long jump type may be determined as the target jump type corresponding to the jump distance. Further, generating a first jump instruction for jumping to the patch instruction based on the target jump type may include: generating a first jump instruction for jumping to the patch instruction using a jump parameter corresponding to the target jump type; the jump parameter includes a 32-bit offset corresponding to the near jump type, or a 16-bit segment selector and a 32-bit offset corresponding to the long jump type. Specifically, jump instructions of corresponding types may be generated according to different jump types, and the near jump type is applicable to a 32-bit offset in the range of -2 31 To +2 31 -1 byte, the long jump type is applicable to 16-bit segment selector and 32-bit offset, and is usually used for cross-segment jump. In a specific embodiment, the opcode of the near jump instruction can be 0xE9, followed by a 32-bit relative offset; the opcode of the long jump instruction can be 0xEA, followed by a 16-bit segment selector and a 32-bit offset.

[0069] In a specific embodiment, adding a second jump instruction for jumping to the function to be patched at the end position of the patch instruction may include: using a decompilation tool to view the assembly code of the function to be patched to determine the code end instruction of the assembly code corresponding to the position to be patched; adding a second jump instruction for jumping to the next function instruction of the code end instruction in the function to be patched at the end position of the patch instruction. Specifically, when it is necessary to jump back to the function to be patched from the patch instruction, add a jump instruction at the end position of the patch instruction to jump to the position after the code to be modified in the function to be patched after the patch instruction is executed, so as to continue to execute the next function instruction in the function to be patched; here, the decompilation tool may be used to view the code end instruction of the assembly code corresponding to the position to be patched in the function to be patched; it can be understood that the next function instruction of the code end instruction of the position to be patched is a function instruction of the original function to be patched that does not need to be modified and can be directly executed; then, a second jump instruction may be added at the end position of the patch instruction to jump to the end position of the code end instruction in the function to be patched after the patch instruction is executed through the second jump instruction, so as to continue to execute the next function instruction of the code end instruction.

[0070] In another specific embodiment, adding a second jump instruction for jumping to the next function instruction of the code end instruction in the function to be patched at the end position of the patch instruction may include: calculating the code end position of the position to be patched based on the first starting position of the code end instruction and the instruction length, and determining the code end position as the second starting position of the next function instruction of the code end instruction; generating a second jump instruction for jumping to the second starting position based on the distance between the end position and the second starting position of the patch instruction; and adding the second jump instruction at the end position of the patch instruction. Specifically, in the process of adding the second jump instruction at the end position of the patch instruction, the end position of the position to be patched needs to be considered, that is, the code end position of the code end instruction corresponding to the position to be patched can be calculated according to the first starting position of the code end instruction corresponding to the position to be patched and the instruction length of the code end instruction, and the code end position is the second starting position of the next function instruction of the code end instruction; through the second jump instruction, it is necessary to jump from the end position of the patch instruction to the second starting position; it is necessary to generate the second jump instruction according to the distance relationship between the end position of the patch instruction and the second starting position, and then add the second jump instruction to the end position of the patch instruction, and it can jump to the second starting position of the function to be patched after the patch instruction is executed, and continue to execute the corresponding function instruction. In this way, the patching operation of the assembly code of the position to be patched is realized through the patch instruction. In a specific embodiment, after the execution of the patch instruction is completed, the second jump instruction can be used to jump to the next function instruction of the code end instruction corresponding to the code to be modified of the function to be patched, and the next function instruction can be copied and saved to the backup area for subsequent query use.

[0071] It is understandable that the process of calculating the length of the function instruction in the above embodiment may also take into account the characteristics of the variable-length instruction set, so as to more accurately calculate the position of the offset address of the function and the length of the code to be patched.

[0072] It can be seen that the present application targets static functions and inline functions of the operating system kernel, can identify the location of the function by means of code scanning detection, can correctly identify the start and end of the static function instructions, thereby calculating the length of the function instructions, and overcoming the problem that the static function symbols are invisible in the global scope; and calls the parent function configuration item to realize the instruction recognition and length calculation of the inline function, so as to detect the accurate function body of the inline function and obtain the accurate offset address; the above steps can be used to implement hot patching operations on static functions and inline functions, and the defects of static functions or inline functions in the kernel can be corrected without restarting the system, maintaining service continuity, and avoiding risks such as data loss due to downtime; and hot patching of static functions or inline functions can reduce restart operations and maintenance costs. Partial replacement of kernel functions can be realized through two jump instructions, which can identify and solve problems more quickly and improve fault diagnosis and elimination efficiency.

[0073] Furthermore, the present application also discloses an electronic device. Figure 4 This is a structural diagram of an electronic device according to an exemplary embodiment, and the content in the diagram cannot be regarded as any limitation on the scope of use of this application. The electronic device may specifically include: at least one processor 21, at least one memory 22, a power supply 23, a communication interface 24, an input / output interface 25, and a communication bus 26. The memory 22 is used to store a computer program, which is loaded and executed by the processor 21 to implement the relevant steps in the kernel hot patching method disclosed in any of the aforementioned embodiments. In addition, the electronic device in this embodiment may specifically be an electronic computer.

[0074] In this embodiment, the power supply 23 is used to provide working voltage for each hardware device on the electronic device; the communication interface 24 can create a data transmission channel between the electronic device and the external device, and the communication protocol it follows is any communication protocol that can be applied to the technical solution of the present application, and is not specifically limited here; the input and output interface 25 is used to obtain external input data or output data to the outside world, and its specific interface type can be selected according to specific application needs and is not specifically limited here.

[0075] In addition, the memory 22, as a carrier for storing resources, can be a read-only memory, a random access memory, a disk or an optical disk, etc. The resources stored thereon can include an operating system 221, a computer program 222, etc., and the storage method can be temporary storage or permanent storage.

[0076] The operating system 221 is used to manage and control various hardware devices on the electronic device and the computer program 222, which can be Windows Server, Netware, Unix, Linux, etc. In addition to including a computer program that can be used to complete the kernel hot patching method performed by the electronic device disclosed in any of the aforementioned embodiments, the computer program 222 can further include a computer program that can be used to complete other specific tasks.

[0077] Furthermore, the present application also discloses a computer-readable storage medium for storing a computer program; wherein the computer program, when executed by a processor, implements the kernel hot patching method disclosed above. For the specific steps of the method, reference may be made to the corresponding contents disclosed in the above embodiments, and no further description will be given here.

[0078] Furthermore, the present application also discloses a computer program product, including a computer program / instruction, which, when executed by a processor, implements the steps of the kernel hot patching method disclosed in the aforementioned embodiment.

[0079] In this specification, each embodiment is described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the embodiments can be referred to each other. For the device disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part.

[0080] Professionals may further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in the above description according to function. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians may use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0081] The steps of the method or algorithm described in conjunction with the embodiments disclosed herein may be implemented directly using hardware, a software module executed by a processor, or a combination of the two. The software module may be placed in a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art.

[0082] Finally, it should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the presence of other identical elements in the process, method, article or device including the elements.

[0083] The technical solution provided by the present application is introduced in detail above. Specific examples are used in this article to illustrate the principles and implementation methods of the present application. The description of the above embodiments is only used to help understand the method of the present application and its core idea. At the same time, for general technicians in this field, according to the idea of ​​the present application, there will be changes in the specific implementation methods and application scope. In summary, the content of this specification should not be understood as a limitation on the present application.

Claims

1. A kernel hot patching method, characterized in that: include: Get the offset address of the function to be patched relative to the parent function configuration item; The function to be patched is a static function or an inline function of the operating system kernel; Calculate the to-be-patched position of the to-be-patched function in the memory according to the memory address of the parent function configuration item and the offset address; A first jump instruction for jumping to a patch instruction corresponding to the function to be patched is added at the position to be patched, and a second jump instruction for jumping to the function to be patched is added at the end position of the patch instruction to complete the hot patch operation on the function to be patched.

2. The kernel hot patching method according to claim 1, characterized in that: The obtaining of the offset address of the function to be patched relative to the parent function configuration item includes: Get the parent function configuration item corresponding to the function to be patched; Based on the detection method for the to-be-patched function in the parent function configuration item, the offset address of the to-be-patched function relative to the parent function configuration item is determined by code scanning detection.

3. The kernel hot patching method according to claim 2, characterized in that: The detecting method for the function to be patched in the parent function configuration item and determining the offset address of the function to be patched relative to the parent function configuration item by code scanning detection includes: If the detection method for the function to be patched in the parent function configuration item indicates tracking of the static function to be patched, determining the first assembly code of the static function to be patched by means of code scanning detection; The difference between the actual address of the function start instruction represented by the first assembly code and the entry address of the static function to be patched is calculated to obtain the offset address of the static function to be patched relative to the parent function configuration item.

4. The kernel hot patching method according to claim 2, characterized in that: The detecting method for the function to be patched in the parent function configuration item and determining the offset address of the function to be patched relative to the parent function configuration item by code scanning detection includes: If the detection method for the function to be patched in the parent function configuration item indicates tracking of the inline function to be patched, determining the second assembly code of the inline function to be patched by means of code scanning detection; Determine the function start instruction of each module file corresponding to the second assembly code, and calculate the difference between the actual address of the function start instruction corresponding to each module file and the starting position of the inline function to be patched, so as to obtain the offset address of the inline function to be patched relative to the parent function configuration item.

5. The kernel hot patching method according to claim 4, characterized in that: The step of respectively calculating the difference between the actual address of the function start instruction corresponding to each of the module files and the start position of the inline function to be patched, and obtaining the offset address of the inline function to be patched relative to the parent function configuration item, comprises: A decompilation tool is used to process the kernel image of the inline function to be patched or each of the module files, and based on the corresponding decompilation results, the difference between the actual address of the function start instruction corresponding to each of the module files and the starting position of the inline function to be patched is obtained to obtain the offset address of the inline function to be patched relative to the parent function configuration item.

6. The kernel hot patching method according to claim 1, characterized in that: After obtaining the offset address of the function to be patched relative to the parent function configuration item, the method further includes: The offset address is filled into a preset offset address list, and an information mapping table of the function name, memory address, and function length of the function to be patched is generated to facilitate query by relevant personnel.

7. The kernel hot patching method according to claim 1, characterized in that: The calculating the to-be-patched position of the to-be-patched function in the memory according to the memory address of the parent function configuration item and the offset address includes: The memory address of the parent function configuration item is added to the offset address to obtain the to-be-patched position of the assembly code of the to-be-patched function in the memory.

8. The kernel hot patching method according to claim 1, characterized in that: The adding, at the to-be-patched position, a first jump instruction for jumping to a patch instruction corresponding to the to-be-patched function comprises: Calculating the distance between the to-be-patched position and the patch instruction corresponding to the to-be-patched function to obtain a jump distance; Generate a target jump type based on the size relationship between the jump distance and a preset distance threshold, and generate a first jump instruction for jumping to the patch instruction based on the target jump type; the target jump type is a long jump type or a short jump type; Adding the first jump instruction to the location to be patched.

9. The kernel hot patching method according to claim 8, characterized in that: The generating a target jump type based on the magnitude relationship between the jump distance and a preset distance threshold comprises: If the jump distance is less than a preset distance threshold, a short jump type is determined as a target jump type corresponding to the jump distance; otherwise, a long jump type is determined as a target jump type corresponding to the jump distance.

10. The kernel hot patching method according to claim 8, characterized in that: The generating a first jump instruction for jumping to the patch instruction based on the target jump type comprises: A first jump instruction for jumping to the patch instruction is generated using a jump parameter corresponding to the target jump type; the jump parameter includes a 32-bit offset corresponding to the near jump type, or a 16-bit segment selector and a 32-bit offset corresponding to the long jump type.

11. The kernel hot patching method according to any one of claims 1 to 10, characterized in that: The adding a second jump instruction for jumping to the to-be-patched function at the end position of the patch instruction comprises: Using a decompilation tool to view the assembly code of the function to be patched, so as to determine the code end instruction of the assembly code corresponding to the position to be patched; A second jump instruction for jumping to the next function instruction of the code end instruction in the to-be-patched function is added at the end position of the patch instruction.

12. The kernel hot patching method according to claim 11, characterized in that: The adding of a second jump instruction for jumping to the next function instruction of the code end instruction in the to-be-patched function at the end position of the patch instruction comprises: Calculating the code end position of the to-be-patched position according to the first start position of the code end instruction and the instruction length, and determining the code end position as the second start position of the next function instruction of the code end instruction; generating a second jump instruction for jumping to the second starting position based on the distance between the end position of the patch instruction and the second starting position; The second jump instruction is added at the end position of the patch instruction.

13. An electronic device, characterized in that: include: Memory for storing computer programs; A processor is used to execute the computer program to implement the steps of the kernel hot patching method according to any one of claims 1 to 12.

14. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the kernel hot patching method according to any one of claims 1 to 12 are implemented.

15. A computer program product comprising a computer program / instructions, characterized in that When the computer program / instruction is executed by a processor, the steps of the kernel hot patching method according to any one of claims 1 to 12 are implemented.

Images