A kernel hot patching method, device, storage medium, and product

Abstract

The present invention provides a kernel hot patching method, device, storage medium, and product, relating to the technical field of kernel hot patching, including: obtaining the offset address of a function to be patched relative to the configuration item of its parent function; the function to be patched being a static function or an inline function of an operating system kernel; calculating the position to be patched of the function to be patched in memory according to the memory address of the parent function configuration item and the offset address; adding a first jump instruction for jumping to the patched instruction corresponding to the function to be patched at the position to be patched, and adding a second jump instruction for jumping to the function to be patched at the end position of the patched instruction, so as to complete the hot patching operation of the function to be patched. Thereby, the present application can identify the start and end of static functions and inline functions, overcome the problem that static function or inline function symbols are not visible in the global scope, can obtain accurate offset addresses, and can implement the hot patching operation of static functions and inline functions in combination with jump instructions.

Description

Technical Field

[0001] The present invention relates to the technical field of kernel hot patching, and particularly to a kernel hot patching method, device, storage medium, and product. Background Art

[0002] During the operation of the Linux (an operating system) system, errors that need to be repaired or performance optimization requirements may occur. The traditional approach is to recompile the kernel and restart the system to apply updates after an error is found. The hot patching technology based on kprobes (a lightweight kernel debugging technology) can modify the kernel code at runtime without affecting the normal operation of the system. This method not only reduces the risk of service interruption caused by restarting but also improves the availability and maintainability of the system. However, there are some inevitable problems with using kprobe. First, developing a kernel module is required for using kprobe, and the instrumentation points generally used for fault debugging are very unstable. For inline functions and static functions in the kernel, due to their invisibility in the global scope and being expanded into multiple copies during compilation and scattered throughout the code, etc., they cannot be patched through the kprobe method. Due to the above reasons, the kprobe technology cannot be directly used, and most developers can only choose to recompile the kernel or kernel module and use the replacement method for debugging or making patches.

[0003] It can be seen that how to implement hot patching for inline functions and static functions of the system kernel is a problem that needs to be solved by those skilled in the art. Summary of the Invention

[0004] The purpose of the embodiments of the present invention is to provide a kernel hot patching method, device, storage medium, and product, which can solve the problem of being unable to perform hot patching on kernel static functions and inline functions.

[0005] To solve the above technical problems, in a first aspect, the embodiments of the present invention provide a kernel hot patching method, including:

[0006] Obtain the offset address of the function to be patched relative to the parent function configuration item; the function to be patched is a static function or an inline function of the operating system kernel;

[0007] Calculate the location to be patched in memory of the function to be patched according to the memory address of the parent function configuration item and the offset address;

[0008] Add a first jump instruction for jumping to the patching instruction corresponding to the function to be patched at the location to be patched, and add a second jump instruction for jumping to the function to be patched at the end position of the patching instruction to complete the hot patching operation of the function to be patched.

[0009] Optionally, obtain the offset address of the function to be patched relative to the parent function configuration item, including:

[0010] Obtain the parent function configuration item corresponding to the function to be patched;

[0011] Based on the detection method for the function to be patched in the parent function configuration item, and determine the offset address of the function to be patched relative to the parent function configuration item by means of code scanning detection.

[0012] Optionally, based on the detection method for the function to be patched in the parent function configuration item, and determine the offset address of the function to be patched relative to the parent function configuration item by means of code scanning detection, including:

[0013] If the detection method for the function to be patched in the parent function configuration item indicates tracking the static function to be patched, then determine the first assembly code of the static function to be patched by means of code scanning detection;

[0014] Calculate the difference between the actual address of the function start instruction represented by the first assembly code and the entry address of the static function to be patched, and obtain the offset address of the static function to be patched relative to the parent function configuration item.

[0015] Optionally, based on the detection method for the function to be patched in the parent function configuration item, and determine the offset address of the function to be patched relative to the parent function configuration item by means of code scanning detection, including:

[0016] If the detection method for the function to be patched in the parent function configuration item indicates tracking the inlined function to be patched, then determine the second assembly code of the inlined function to be patched by means of code scanning detection;

[0017] Determine the function start instructions of each module file corresponding to the second assembly code, and calculate the difference between the actual address of the function start instruction corresponding to each module file and the start position of the inlined function to be patched respectively, and obtain the offset address of the inlined function to be patched relative to the parent function configuration item.

[0018] Optionally, calculate the difference between the actual address of the function start instruction corresponding to each module file and the start position of the inlined function to be patched respectively, and obtain the offset address of the inlined function to be patched relative to the parent function configuration item, including:

[0019] Use a decompilation tool to process the kernel image or each module file of the inlined function to be patched, and based on the corresponding decompilation result, obtain the difference between the actual address of the function start instruction corresponding to each module file and the start position of the inlined function to be patched, and obtain the offset address of the inlined function to be patched relative to the parent function configuration item.

[0020] Optionally, after obtaining the offset address of the function to be patched relative to the parent function configuration item, it further includes:

[0021] Fill the offset address into a pre-set offset address list, and generate an information mapping table of the function name, memory address, and function length of the function to be patched for relevant personnel to query.

[0022] Optionally, calculate the position to be patched in memory of the function to be patched according to the memory address and offset address of the parent function configuration item, including:

[0023] Add the offset address to the memory address of the parent function configuration item to obtain the position to be patched in memory of the assembly code of the function to be patched.

[0024] Optionally, add a first jump instruction for jumping to the patch instruction corresponding to the function to be patched at the position to be patched, including:

[0025] Calculate the distance between the position to be patched and the patch instruction corresponding to the function to be patched to obtain the jump distance;

[0026] Generate a target jump type based on the size relationship between the jump distance and a preset distance threshold, and generate a first jump instruction for jumping to the patch instruction based on the target jump type; the target jump type is a long jump type or a near jump type;

[0027] Add the first jump instruction to the position to be patched.

[0028] Optionally, generate a target jump type based on the size relationship between the jump distance and a preset distance threshold, including:

[0029] If the jump distance is less than the preset distance threshold, determine the near jump type as the target jump type corresponding to the jump distance, otherwise determine the long jump type as the target jump type corresponding to the jump distance.

[0030] Optionally, generate a first jump instruction for jumping to the patch instruction based on the target jump type, including:

[0031] Generate a first jump instruction for jumping to the patch instruction using the jump parameter corresponding to the target jump type; the jump parameter includes a 32-bit offset corresponding to the near jump type, or a 16-bit segment selector and a 32-bit offset corresponding to the long jump type.

[0032] Optionally, add a second jump instruction for jumping to the function to be patched at the end position of the patch instruction, including:

[0033] Use a decompilation tool to view the assembly code of the function to be patched to determine the code end instruction of the assembly code corresponding to the position to be patched;

[0034] Add a second jump instruction at the end position of the patching instruction to jump to the next function instruction after the code end instruction in the function to be patched.

[0035] Optionally, adding a second jump instruction at the end position of the patching instruction to jump to the next function instruction after the code end instruction in the function to be patched includes:

[0036] Calculate the code end position of the position to be patched according to the first start position and instruction length of the code end instruction, and determine the code end position as the second start position of the next function instruction after the code end instruction;

[0037] Generate a second jump instruction for jumping to the second start position based on the distance between the end position of the patching instruction and the second start position;

[0038] Add the second jump instruction at the end position of the patching instruction.

[0039] In a second aspect, an embodiment of the present invention provides an electronic device, including:

[0040] A memory for storing a computer program;

[0041] A processor for executing the computer program to implement the steps of the kernel hot patching method as described above.

[0042] In a third aspect, an embodiment of the present invention provides a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, the steps of the kernel hot patching method as described above are implemented.

[0043] In a fourth aspect, an embodiment of the present invention provides a computer program product, including a computer program / instructions, and when the computer program / instructions are executed by a processor, the steps of the kernel hot patching method as described above are implemented.

[0044] As can be seen from the above technical solution, when performing kernel hot patching operations in this application, the offset address of the function to be patched relative to the parent function configuration item is first obtained; the function to be patched is a static function or an inline function of the operating system kernel; the location to be patched of the function to be patched in memory is calculated based on the memory address of the parent function configuration item and the offset address; then a first jump instruction for jumping to the patched instruction corresponding to the function to be patched is added at the location to be patched, and a second jump instruction for jumping to the function to be patched is added at the end position of the patched instruction to complete the hot patching operation of the function to be patched. In this way, for static functions and inline functions of the operating system kernel, this application can identify the location of the function, can correctly identify the start and end of the static function instructions, overcomes the problem that static function or inline function symbols are not visible globally, can obtain accurate offset addresses, and can implement hot patching operations for static functions and inline functions in combination with jump instructions. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] To more clearly illustrate the embodiments of the present invention, the drawings required for use in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those of ordinary skill in the art, without creative efforts, other drawings can be obtained based on these drawings.

[0046] Figure 1 It is a flowchart of a kernel hot patching method disclosed in this application;

[0047] Figure 2 It is a flowchart of a specific kernel hot patching method disclosed in this application;

[0048] Figure 3 It is a flowchart of another specific kernel hot patching method disclosed in this application;

[0049] Figure 4 It is a structural diagram of an electronic device disclosed in this application. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0050] The technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the drawings in the embodiments of the present invention. Obviously, the described embodiments are only some of the embodiments of the present invention, rather than all the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative efforts fall within the protection scope of the present invention.

[0051] As used in the specification of the present invention and the above-mentioned drawings, the terms "comprising" and "having", as well as any variations related to "comprising" and "having", are intended to cover non-exclusive inclusion. For example, a process, method, system, product or device that includes a series of steps or units is not limited to the listed steps or units, but may include steps or units that are not listed.

[0052] To enable those skilled in the art to better understand the solution of the present invention, the present invention will be further described in detail below with reference to the drawings and specific embodiments.

[0053] As Figure 1 shown, an embodiment of the present application discloses a kernel hot patching method, including:

[0054] Step S11, obtaining the offset address of the function to be patched relative to the parent function configuration item; the function to be patched is a static function or an inline function of the operating system kernel.

[0055] In the embodiment of the present application, the function to be patched in the operating system kernel can be a static function or an inline function; first, the actual address of the function to be patched is required, that is, the actual address of the static function or the actual address of the inline function (module file); then, according to the parent function configuration item that calls the function to be patched, the offset address of the static function or the inline function relative to the parent function configuration item can be determined.

[0056] In a specific embodiment, according to the offset address of the function to be patched relative to the parent function configuration item, it may include: obtaining the parent function configuration item corresponding to the function to be patched; based on the detection method for the function to be patched in the parent function configuration item, and determining the offset address of the function to be patched relative to the parent function configuration item by means of code scanning detection. Specifically, in the process of determining the offset address of the function to be patched relative to the parent function configuration item, first, the parent function configuration item corresponding to the function to be patched can be read, and there is a detection method for the function to be patched (static function or inline function) in the parent function configuration item; based on the detection method corresponding to the function to be patched, the offset address of the static function or the inline function relative to the parent function configuration item can be determined by means of code scanning detection.

[0057] In another specific embodiment, based on the detection method for the function to be patched in the parent function configuration item, and determining the offset address of the function to be patched relative to the parent function configuration item through code scanning detection, it may include: If the detection method for the function to be patched in the parent function configuration item indicates tracking the static function to be patched, then determine the first assembly code of the static function to be patched through code scanning detection; calculate the difference between the actual address of the function start instruction represented by the first assembly code and the entry address of the static function to be patched, to obtain the offset address of the static function to be patched relative to the parent function configuration item. Specifically, when the detection method for the function to be patched in the parent function configuration item indicates tracking the static function to be patched, if the detection method is to track the entry address of the static function, then the first assembly code of the static function to be patched can be determined through code scanning detection, and calculate the difference between the address of each code instruction represented by the first assembly code and the entry address of the static function to be patched, that is, the offset address of the static function to be patched relative to the parent function configuration item can be obtained. Correspondingly, based on the detection method for the function to be patched in the parent function configuration item, and determining the offset address of the function to be patched relative to the parent function configuration item through code scanning detection, it may include: If the detection method for the function to be patched in the parent function configuration item indicates tracking the inlined function to be patched, then determine the second assembly code of the inlined function to be patched through code scanning detection; determine the function start instructions of each module file corresponding to the second assembly code, and calculate the difference between the actual address of the function start instruction corresponding to each module file and the start position of the inlined function to be patched respectively, to obtain the offset address of the inlined function to be patched relative to the parent function configuration item. Specifically, if the detection method for the function to be patched in the parent function configuration item indicates tracking the inlined function to be patched, then the second assembly code of the inlined function to be patched can be determined through code scanning detection; it should be noted that the inlined function will be expanded into multiple module files during compilation, that is, the second assembly code here corresponds to each module file after the inlined function is expanded; further, in this way, the start position of the inlined function and the function start instructions corresponding to each module file can be obtained, and then calculate the difference between the address of the function start instruction corresponding to each module file and the start position of the inlined function respectively, that is, the offset address of the inlined function to be patched relative to the parent function configuration item can be obtained.

[0058] In a specific embodiment, calculating the difference between the actual address of the function start instruction corresponding to each module file and the start position of the inline function to be patched, so as to obtain the offset address of the inline function to be patched relative to the parent function configuration item may include: processing the kernel image or each module file of the inline function to be patched by using a decompilation tool, and obtaining the difference between the actual address of the function start instruction corresponding to each module file and the start position of the inline function to be patched based on the corresponding decompilation result, so as to obtain the offset address of the inline function to be patched relative to the parent function configuration item. Specifically, during the compilation process, the inline function is split into several module files. Here, a decompilation tool can be used to decompile each module file of the inline function to be patched or the operating system kernel image, and the internal structure and content of the file can be viewed; further, according to the obtained decompilation result, the difference between the actual address of the function start instruction corresponding to each module file and the start position of the inline function to be patched can be identified and extracted, that is, the offset address of the inline function to be patched relative to the parent function configuration item is obtained.

[0059] In another specific embodiment, after obtaining the offset address of the function to be patched relative to the parent function configuration item, it may further include: filling the offset address into a pre-set offset address list, and generating an information mapping table of the function name, memory address, and function length of the function to be patched for relevant personnel to query. Specifically, after obtaining the offset address of the function to be patched relative to the parent function configuration item in this solution, the offset address can be filled into a pre-set offset address list for subsequent use; and at the same time, an information mapping table of the function name, memory address, and function length of the function to be patched can be saved; among them, for a static function, an information mapping table of the function name, memory address, and function length of the static function is saved, and for an inline function, an information mapping table of the function name, inline function offset, memory address, and function length of the inline function can be generated.

[0060] Step S12: Calculate the position to be patched of the function to be patched in memory by using the memory address and offset address of the parent function configuration item.

[0061] In the embodiment of the present application, the offset address of the function to be patched relative to the parent function configuration item can be obtained through the above steps. Then, it is necessary to accurately determine the code position to be modified in the function to be patched. Specifically, it is necessary to calculate the position to be patched in memory where the code to be modified in the function to be patched is located by using the memory address of the parent function configuration item and the obtained offset address of the function to be patched.

[0062] In a specific embodiment, calculating the position to be patched of the function to be patched in memory according to the memory address and offset address of the parent function configuration item may include: adding the offset address to the memory address of the parent function configuration item to obtain the position to be patched of the assembly code of the function to be patched in memory. Specifically, in the process of determining the position of the code to be modified of the function to be patched, it is necessary to know the starting address of the function to be patched in memory, that is, to obtain the memory address of the parent function by reading the kernel symbol table of the parent function configuration item; then, adding the offset address of the function to be patched relative to the parent function configuration item to this memory address can calculate the address of the function to be patched in memory, and further the position to be patched of the assembly code to be modified of the function to be patched in memory can be determined.

[0063] Step S13: Add a first jump instruction for jumping to the patch instruction corresponding to the function to be patched at the position to be patched, and add a second jump instruction for jumping to the function to be patched at the end position of the patch instruction to complete the hot patching operation of the function to be patched.

[0064] In this embodiment, after obtaining the position to be patched of the assembly code to be modified of the function to be patched in memory through the above steps, jump instructions can be added at this position to be patched, and the patching operation of the position to be patched of the function to be patched by using the patch instruction can be directly implemented through these jump instructions; through the first jump instruction added at the position to be patched, the corresponding patch instruction can be jumped to and executed, avoiding the relevant code to be modified in the function to be patched, and the patching operation of the function to be patched is realized. Moreover, at the end position of the patch instruction, it is necessary to jump back to the function to be patched. Through the added second jump instruction, after the patch instruction is executed, the function instruction represented by the relevant code after the position to be patched in the function to be patched can be jumped to and executed. In this way, the patching operation of the function to be patched can be completed through two jump instructions.

[0065] In a specific embodiment, such as Figure 2As shown, during the process of hot patching a static function or an inline function that exports a symbol in the operating system kernel (a macro in the Linux kernel), first obtain the parent function configuration item that calls the target function to be patched; then determine the offset address of the target function to be patched relative to the parent function according to the probing method in the configuration item. Combining the offset address of the target function, the position (code address) of the code that needs to be repaired in the target function can be calculated; further, through the above steps, the specific position of the code that needs to be modified in the target function has been determined. Combining the offset position of the position of the code to be modified and the position of the patching instruction, the length of the jump instruction can be calculated to generate the corresponding jump instruction for jumping from the position of the code that needs to be modified to the position of the patching instruction; and save the length of the jump instruction added to the target function, as well as the length of the assembly code and related function instructions corresponding to the target function, to the backup area of the configuration item for subsequent use; then insert a jump instruction at the position of the code that needs to be modified to jump to the start of the patching instruction. Correspondingly, at the end position of the code of the patching instruction, a jump instruction needs to be appended to jump to the position of the next instruction corresponding to the end instruction of the code that needs to be modified in the target function; use the patching instruction to implement the hot patching operation of the target function.

[0066] In another specific embodiment, such as Figure 3As shown, the offset address of the static function or inline function to be patched can be determined through the parent function configuration item; the detection method indicates tracking the entry address of the static function, then set the corresponding offset address to the actual start position of the static function and store it in the pre-set offset address list; since the address of this static function is not a globally visible symbol table, the actual address of the static function can be found by means of code scanning detection. If the detection method is to track the inline function or any one of the function jump point, function return point, and source code position running point, then decompile the kernel image or the module file of the target function and extract the corresponding offset address, and store the extracted offset address in the offset address list. In other words, if the detection method is to track the static function, analyze the assembly code and find the start instruction of the static function, calculate the difference between each instruction address and the function entry address and fill it into the offset address list, and at the same time save the information mapping table of the static function name, address, and function length; if the detection method is to track the inline function, analyze the assembly code and find the start instruction of the inline function, calculate the difference between each instruction point address and the start position of the inline function and fill it into the offset address list, and at the same time generate the information mapping table of the inline function offset, address, and function length. Further, through the jump instruction, it is possible to jump from the start position of the static function or inline function to the patch instruction, and it is possible to jump from the end position of the patch instruction to the next function instruction (parent function body) at the end position of the static function or inline function. It should be noted that for the convenience of subsequent query and use, the jump instruction length can be copied and saved to the backup area, and, according to the jump instruction length, the instruction to be patched can be read using memcpy (a standard library function for copying the content of one piece of memory to another piece of memory) and saved to the backup_instructions array. In this way, by jumping to the patch instruction, the patching operation of the function body from the start position to the end position of the static function or inline function is realized.

[0067] In a specific embodiment, adding a first jump instruction for jumping to the patch instruction corresponding to the function to be patched at the position to be patched may include: calculating the distance between the position to be patched and the patch instruction corresponding to the function to be patched to obtain a jump distance; generating a target jump type based on the magnitude relationship between the jump distance and a preset distance threshold, and generating a first jump instruction for jumping to the patch instruction based on the target jump type; the target jump type is a long jump type or a near jump type; adding the first jump instruction to the position to be patched. Specifically, during the process of adding the first jump instruction at the position to be patched, it is necessary to consider the positions of the position to be patched and the patch instruction, and generate corresponding jump instructions according to the relationship between the positions; first, calculate the distance between the position to be patched and the patch instruction corresponding to the function to be patched to obtain a jump distance, and then a corresponding target jump type can be generated based on the magnitude relationship between the jump distance and the preset distance threshold. This jump type can be a long jump or a near jump, corresponding to jump instructions of different lengths; then, based on the target jump type and the positions of the position to be patched and the patch instruction, a corresponding first jump instruction for jumping from the position to be patched to the position of the patch instruction can be generated.

[0068] In a specific embodiment, generating a target jump type based on the magnitude relationship between the jump distance and a preset distance threshold may include: if the jump distance is less than the preset distance threshold, determining the near jump type as the target jump type corresponding to the jump distance; otherwise, determining the long jump type as the target jump type corresponding to the jump distance. Specifically, if the jump distance between the position to be patched and the position of the patch instruction is less than the preset distance threshold, the near jump type is determined as the target jump type for this jump distance; it can be understood that if the jump distance is not less than the preset distance threshold, the long jump type can be determined as the target jump type corresponding to this jump distance. Further, generating a first jump instruction for jumping to the patch instruction based on the target jump type may include: generating a first jump instruction for jumping to the patch instruction using the jump parameter corresponding to the target jump type; the jump parameter includes a 32-bit offset corresponding to the near jump type, or a 16-bit segment selector and a 32-bit offset corresponding to the long jump type. Specifically, corresponding types of jump instructions can be generated according to different jump types. The near jump type is applicable to a 32-bit offset, with a range of -2 31 to +2 31 -1 bytes, and the long jump type is applicable to a 16-bit segment selector and a 32-bit offset, and is usually used for cross-segment jumps. In a specific embodiment, the opcode of the near jump instruction may be 0xE9, followed by a 32-bit relative offset; the opcode of the long jump instruction may be 0xEA, followed by a 16-bit segment selector and a 32-bit offset.

[0069] In a specific embodiment, adding a second jump instruction for jumping to the function to be patched at the end position of the patching instruction may include: using a decompilation tool to view the assembly code of the function to be patched to determine the code end instruction of the assembly code corresponding to the position to be patched; adding a second jump instruction for jumping to the next function instruction of the code end instruction in the function to be patched at the end position of the patching instruction. Specifically, when it is necessary to jump back from the patching instruction to the function to be patched, a jump instruction is added at the end position of the patching instruction to jump to the position after the code to be modified in the function to be patched after the patching instruction is executed, so as to continue executing the next function instruction in the function to be patched; here, a decompilation tool can be used to view the code end instruction of the assembly code corresponding to the position to be patched in the function to be patched; it can be understood that the next function instruction of the code end instruction at the position to be patched is the function instruction of the original function to be patched that does not need to be modified and can be directly executed; then a second jump instruction can be added at the end position of the patching instruction to jump to the end position of the code end instruction in the function to be patched through the second jump instruction after the patching instruction is executed, so as to continue executing the next function instruction of the code end instruction.

[0070] In another specific embodiment, adding a second jump instruction for jumping to the next function instruction of the code end instruction in the to-be-patched function at the end position of the patching instruction may include: calculating the code end position of the to-be-patched position according to the first start position and instruction length of the code end instruction, and determining the code end position as the second start position of the next function instruction of the code end instruction; generating a second jump instruction for jumping to the second start position based on the distance between the end position of the patching instruction and the second start position; adding the second jump instruction at the end position of the patching instruction. Specifically, in the process of adding the second jump instruction at the end position of the patching instruction, it is necessary to consider the end position of the to-be-patched position, that is, the code end position of the code end instruction corresponding to the to-be-patched position can be calculated according to the first start position of the code end instruction corresponding to the to-be-patched position and the instruction length of this code end instruction, and this code end position is the second start position of the next function instruction of this code end instruction; the second jump instruction needs to jump from the end position of the patching instruction to this second start position; it is necessary to generate a second jump instruction according to the distance relationship between the end position of the patching instruction and this second start position, and then add the second jump instruction to the end position of the patching instruction, so that it can jump to the second start position of the to-be-patched function after the patching instruction is executed, and continue to execute the corresponding function instruction. In this way, the patching operation of the assembly code at the to-be-patched position is realized through the patching instruction. In a specific embodiment, after the patching instruction is executed, it can jump to the next function instruction of the code end instruction corresponding to the code to be modified in the to-be-patched function through the second jump instruction, and the next function instruction can be copied and saved to the backup area for subsequent query and use.

[0071] It can be understood that the above-mentioned process of calculating the length of the function instruction in the embodiment can also consider the characteristics of the variable-length instruction set, so as to more accurately calculate the position of the offset address of the function and the length of the code to be patched.

[0072] As can be seen, for the static functions and inline functions of the operating system kernel in this application, the positions of the functions can be identified through code scanning detection, and the start and end of the static function instructions can be correctly identified, so as to calculate the length of the function instructions, overcoming the problem that the static function symbols are not visible in the global scope; and the parent function configuration item is called to implement the instruction identification and length calculation of the inline function, so as to detect the accurate function body of the inline function and obtain the accurate offset address; through the above steps, the hot patching operation of the static function and the inline function can be realized, and the defects of the static function or the inline function in the kernel can be corrected without restarting the system, maintaining service continuity and avoiding risks such as data loss caused by downtime; moreover, realizing the hot patching of the static function or the inline function can reduce the restart operation and maintenance cost. The partial replacement of the kernel function can be realized through two jump instructions, which can identify and solve problems faster and improve the efficiency of fault diagnosis and exclusion.

[0073] Furthermore, the embodiment of the present application also discloses an electronic device. Figure 4 It is a structural diagram of an electronic device shown according to an exemplary embodiment, and the content in the figure should not be regarded as any limitation on the scope of use of the present application. The electronic device may specifically include: at least one processor 21, at least one memory 22, a power supply 23, a communication interface 24, an input / output interface 25, and a communication bus 26. Among them, the memory 22 is used to store a computer program, and the computer program is loaded and executed by the processor 21 to implement the relevant steps in the kernel hot patching method disclosed in any of the foregoing embodiments. In addition, the electronic device in this embodiment may specifically be an electronic computer.

[0074] In this embodiment, the power supply 23 is used to provide working voltage for each hardware device on the electronic device; the communication interface 24 can create a data transmission channel between the electronic device and external devices, and the communication protocol it follows is any communication protocol applicable to the technical solution of the present application, and no specific limitation is imposed on it here; the input / output interface 25 is used to obtain external input data or output data to the outside, and its specific interface type can be selected according to specific application needs, and no specific limitation is made here.

[0075] In addition, as a carrier for resource storage, the memory 22 may be a read-only memory, a random access memory, a disk, or an optical disc, etc., and the resources stored thereon may include an operating system 221, a computer program 222, etc., and the storage method may be short-term storage or permanent storage.

[0076] Among them, the operating system 221 is used to manage and control each hardware device and computer program 222 on the electronic device, and it can be Windows Server, Netware, Unix, Linux, etc. In addition to the computer program that can be used to complete the kernel hot patching method executed by the electronic device disclosed in any of the foregoing embodiments, the computer program 222 can further include computer programs that can be used to complete other specific tasks.

[0077] Furthermore, the present application also discloses a computer-readable storage medium for storing a computer program; wherein, when the computer program is executed by a processor, the foregoing disclosed kernel hot patching method is implemented. For the specific steps of this method, reference can be made to the corresponding content disclosed in the foregoing embodiments, and details will not be elaborated herein.

[0078] Furthermore, the present application also discloses a computer program product, including a computer program / instructions, and when the computer program / instructions are executed by a processor, the steps of the kernel hot patching method disclosed in the foregoing embodiments are implemented.

[0079] In this specification, each embodiment is described in a progressive manner. The key point of each embodiment is to illustrate the differences from other embodiments. For the same or similar parts among the embodiments, reference can be made to each other. For the device disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and reference can be made to the description of the method part for the relevant parts.

[0080] Those skilled in the art can further realize that the units and algorithm steps of each example described in combination with the embodiments disclosed in this article can be implemented by electronic hardware, computer software, or a combination of the two. To clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described according to functions in the above description. Whether these functions are executed in a hardware or software manner depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered to exceed the scope of this application.

[0081] The steps of the method or algorithm described in combination with the embodiments disclosed in this article can be directly implemented by hardware, a software module executed by a processor, or a combination of the two. The software module can be placed in a random access memory (RAM), internal memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, register, hard disk, removable disk, CD-ROM, or any other form of storage medium well-known in the technical field.

[0082] Finally, it should also be noted that in this text, relational terms such as first and second are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any actual relationship or order between these entities or operations. Moreover, the term "comprising", "including" or any other variant thereof is intended to cover non-exclusive inclusion, such that a process, method, article or device comprising a series of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article or device. Without further limitation, an element defined by the statement "comprising an..." does not exclude the presence of additional identical elements in the process, method, article or device comprising the element.

[0083] The technical solutions provided in this application have been introduced in detail above. Specific examples are used in this text to elaborate on the principles and implementation manners of this application. The descriptions of the above embodiments are only used to help understand the method and its core idea of this application; at the same time, for those of ordinary skill in the art, according to the idea of this application, there will be changes in the specific implementation manners and application scopes. In summary, the content of this specification should not be construed as a limitation to this application.

Claims

1. A kernel hot patching method, characterized in that, Including: Obtain the parent function configuration item corresponding to the function to be patched; the function to be patched is a static function or an inline function of the operating system kernel; Based on the detection method for the function to be patched in the parent function configuration item, and by means of code scanning detection, determine the offset address of the function to be patched relative to the parent function configuration item; Calculate the position to be patched of the function to be patched in memory according to the memory address of the parent function configuration item and the offset address; Add a first jump instruction for jumping to the patch instruction corresponding to the function to be patched at the position to be patched, and add a second jump instruction for jumping to the function to be patched at the end position of the patch instruction, so as to complete the hot patching operation of the function to be patched.

2. The kernel hot patching method according to claim 1, characterized in that The determining the offset address of the function to be patched relative to the parent function configuration item based on the detection method for the function to be patched in the parent function configuration item and by means of code scanning detection includes: If the detection method for the function to be patched in the parent function configuration item indicates tracking the static function to be patched, determine the first assembly code of the static function to be patched by means of code scanning detection; Calculate the difference between the actual address of the function start instruction represented by the first assembly code and the entry address of the static function to be patched, so as to obtain the offset address of the static function to be patched relative to the parent function configuration item.

3. The kernel hot patching method according to claim 1, wherein The determining the offset address of the function to be patched relative to the parent function configuration item based on the detection method for the function to be patched in the parent function configuration item and by means of code scanning detection includes: If the detection method for the function to be patched in the parent function configuration item indicates tracking the inline function to be patched, determine the second assembly code of the inline function to be patched by means of code scanning detection; Determine the function start instructions of each module file corresponding to the second assembly code, and calculate the difference between the actual address of the function start instruction corresponding to each module file and the start position of the inline function to be patched respectively, so as to obtain the offset address of the inline function to be patched relative to the parent function configuration item.

4. The kernel hot patching method according to claim 3, wherein The calculating the difference between the actual address of the function start instruction corresponding to each module file and the start position of the inline function to be patched respectively, so as to obtain the offset address of the inline function to be patched relative to the parent function configuration item includes: Use a decompilation tool to process the kernel image of the inline function to be patched or each module file, and based on the corresponding decompilation result, obtain the difference between the actual address of the function start instruction corresponding to each module file and the start position of the inline function to be patched, so as to obtain the offset address of the inline function to be patched relative to the parent function configuration item.

5. The kernel hot patching method according to claim 1, characterized in that After obtaining the offset address of the function to be patched relative to the parent function configuration item, further include: Fill the offset address into a pre-set offset address list, and generate an information mapping table of the function name, memory address and function length of the function to be patched for relevant personnel to query.

6. The kernel hot patching method according to claim 1, characterized in that, Calculating the position to be patched of the function to be patched in memory according to the memory address of the parent function configuration item and the offset address includes: Adding the offset address to the memory address of the parent function configuration item to obtain the position to be patched of the assembly code of the function to be patched in memory.

7. The kernel hot patching method according to claim 1, wherein, Adding a first jump instruction for jumping to the patch instruction corresponding to the function to be patched at the position to be patched includes: Calculating the distance between the position to be patched and the patch instruction corresponding to the function to be patched to obtain a jump distance; Generating a target jump type based on the size relationship between the jump distance and a preset distance threshold, and generating a first jump instruction for jumping to the patch instruction based on the target jump type; the target jump type is a long jump type or a near jump type; Adding the first jump instruction to the position to be patched.

8. The kernel hot patching method according to claim 7, wherein Generating a target jump type based on the size relationship between the jump distance and a preset distance threshold includes: If the jump distance is less than the preset distance threshold, determining the near jump type as the target jump type corresponding to the jump distance, otherwise determining the long jump type as the target jump type corresponding to the jump distance.

9. The kernel hot patching method according to claim 7, wherein Generating a first jump instruction for jumping to the patch instruction based on the target jump type includes: Generating a first jump instruction for jumping to the patch instruction using the jump parameter corresponding to the target jump type; the jump parameter includes a 32-bit offset corresponding to the near jump type, or a 16-bit segment selector and a 32-bit offset corresponding to the long jump type.

10. The kernel hot patching method according to any one of claims 1 to 9, characterized in that, Adding a second jump instruction for jumping to the function to be patched at the end position of the patch instruction includes: Using a decompilation tool to view the assembly code of the function to be patched to determine the code end instruction of the assembly code corresponding to the position to be patched; Adding a second jump instruction for jumping to the next function instruction of the code end instruction in the function to be patched at the end position of the patch instruction.

11. The kernel hot patching method according to claim 10, wherein Adding a second jump instruction for jumping to the next function instruction of the code end instruction in the function to be patched at the end position of the patch instruction includes: Calculating the code end position of the position to be patched according to the first start position and the instruction length of the code end instruction, and determining the code end position as the second start position of the next function instruction of the code end instruction; Generating a second jump instruction for jumping to the second start position based on the distance between the end position of the patch instruction and the second start position; Adding the second jump instruction at the end position of the patch instruction.

12. An electronic device, characterized in that, Includes: A memory for storing a computer program; A processor for executing the computer program to implement the steps of the kernel hot patching method according to any one of claims 1 to 11.

13. A computer-readable storage medium, characterized in that, A computer program is stored on the computer-readable storage medium, and when the computer program is executed by a processor, the steps of the kernel hot patching method according to any one of claims 1 to 11 are implemented.

14. A computer program product comprising a computer program / instructions, characterized in that, When the computer program / instructions are executed by a processor, the steps of the kernel hot patching method according to any one of claims 1 to 11 are implemented.

Images