Method and device for patching

Abstract

A patching method comprising: in response to a need to patch initial content and the initial content being in memory, distinguishing between new content and old content, wherein the new content is the patched initial content and the old content is the initial content that was in memory; and in response to the new content being loaded into memory, allocating a new process that needs to apply the initial content to the new content, wherein the new process includes a process that is started after the new content has been loaded into memory;In response to the fact that the number of virtual machines that need to patch an initial content is greater than 1, schedule the patching so that n of the virtual machines initially perform the operation of patching the initial content, wherein the virtual machines that need to patch the initial content reside in the same physical machine and the number of virtual machines that need to patch the initial content is n + m, where both n and m are natural numbers; receive a notification reporting that at least one of the n virtual machines is already in an initial state, wherein the initial state includes all states from loading the patched initial content into memory to completing the patching operation;In response to receiving the notification, schedule at least one of m virtual machines, which is different from the n virtual machines, to perform the patching of the first content, such that the at least one of the m virtual machines performs the patching operation using the patched first content that has been loaded into memory.

Description

TECHNICAL FIELDThe present invention relates to the field of computers and, more particularly, to a method and apparatus for patching.BACKGROUNDWith the continued growth of software applications, there is an increasing need to patch software applications. Since it is unavoidable that security deficiencies or missing functions occur in software applications, software applications must be patched for improvement.Not only software applications but also operating systems must be continuously patched in order to remedy security bugs or improve functions. Furthermore, viruses generally propagate very quickly and widely. In order to avoid viral infections, operating systems or software applications must be patched in good time.However, current patching approaches require running applications to be suspended, which entails limitations in usage. If running applications are not suspended, then patching cannot be timely performed.US 2012 / 0 198 431 A1 describes a method for the efficient updating of a hypervisor component, in which changes in the address space and at the destination function are carried out in a targeted manner with the aid of a hypercall interface in order to reduce resource consumption and to minimize the effects on ongoing services.US 2012 / 0 110 237 A1 describes a method, an apparatus and a system for online migration from a physical machine to a virtual machine, in which memory pages are incrementally synchronized until a threshold value is reached, and the target machine is subsequently placed into the operating state in order to ensure a smooth service change.US 2008 / 0 022 376 A1 XXX describes a system and a method for hardware access control in which an access control module in the virtual machine monitor intercepts access requests of the client operating system, sends an authorization request to an authorization server and decides on the basis of its feedback whether access is permitted in order to ensure legal data copies and prevent illegal data copies.US 2008 / 0 083 030 A1 describes methods and devices for the in-memory patching of a program loaded in volatile memory, in which a service processor loads the patch, carries out adaptations and redirects the program to the patch, so that the latter is implemented without interrupting the program execution.SUMMARYThe invention is described by the features of the independent claims. Embodiments are set out in the dependent claims.It is an object of the invention to provide an improved method for patching, an improved apparatus for patching and an improved computer program for patching.For patching without halting ongoing applications, methods and apparatus for patching are provided by embodiments of the present invention.According to one aspect of the present invention, there is provided a method of patching, comprising: in response to a need to patch a first content and the first content being in memory, distinguishing between a new content and an old content, wherein the new content is the patched first content and the old content is the first content located in the memory; and in response to the new content being loaded into the memory, associating a new process to apply the first content with the new content, wherein the new process comprises a process to be started after loading the new content into the memory.According to another aspect of the present invention, there is provided a method of patching, comprising: in response to the number of virtual machines to patch a first content being greater than 1, scheduling the patching so that n of the virtual machines first perform the operation of patching the first content, wherein the virtual machines to patch the first content are in the same physical machine and the number of virtual machines to patch the first content is n+m, wherein both n and m are natural numbers; receiving a notification notifying that at least one of the n virtual machines is already in a first state, wherein the first state includes all states from loading the patched first content into the memory until completion of the operation of patching; and in response to receiving the notification, planning at least one of the m virtual machines other than the n virtual machines to perform the operation of patching the first content, such that the at least one of the m virtual machines performs the operation of patching using the patched first content loaded in the memory.According to another aspect of the present invention, there is provided a method of patching comprising: receiving an indication indicating that a current virtual machine is to be patched; obtaining a new storage location for storing a patched first content, the new storage location having a storage location that does not overlap with a storage location for storing an unpatched first content; sending a first notification comprising at least one address of the new storage location; sending a second notification notifying that the current virtual machine is already in a first state, the first state comprising all states from loading the patched first content to the storage location until completion of the patching operation; and executing the operation of patching in the current virtual machine according to the patched first content in the new storage space.According to another aspect of the present invention, there is provided a method of patching, comprising: receiving an indication indicating that a current virtual machine needs to be patched; detecting a storage space for storing a patched first content, the detected storage space being a storage space allocated to a virtual machine located in the same physical machine other than the current virtual machine; and executing the operation of patching in the current virtual machine according to the patched first content in the detected storage space.According to another aspect of the present invention, there is provided an apparatus for patching, comprising: a distinguishing module configured to, in response to a first content being to be patched and the first content being in the memory, distinguish between a new content and an old content, the new content being the patched first content, the old content being the first content being in the memory; and a mapping module configured to, in response to the new content being loaded into the memory, map the new content to a new process that needs to apply the first content, the new process comprising a process that is started after loading the new content into the memory.According to another aspect of the present invention, there is provided an apparatus for patching, comprising: a first planning module configured to, in response to the number of virtual machines to patch a first content being greater than 1, plan patching such that n virtual machines first perform the operation of patching the first content, wherein the virtual machines to patch the first content are arranged in the same physical machine, and the number of virtual machines to patch the first content is n+m, wherein both n and m are natural numbers; a receiving module configured to receive a notification notifying that at least one of the n virtual machines is already in a first state, the first state including all states of loading the patched first content into the memory until completion of the patching operation; and a second scheduling module configured to, in response to receiving the notification, schedule at least one of m virtual machines other than the n virtual machines to perform the patching operation of the first content such that the at least one of the m virtual machines performs the patching operation using the patched first content loaded into the memory.According to another aspect of the present invention, there is provided an apparatus for patching, comprising: a receiving module configured to receive an indication indicating that a current virtual machine is to be patched; a receiving module configured to receive a new storage location for storing a patched first content, the new storage location being storage location that does not overlap with storage location for storing an unpatched first content; a sending module configured to send a first notification having at least one address of the new storage location and send a second notification to notify that the current virtual machine is already in a first state, the first state including all states from loading the patched first content to the storage location to ending the patching operation; and a patching module configured to perform the patching operation on the current virtual machine according to the patched first content on the new storage location.According to another aspect of the present invention, there is provided an apparatus for patching, comprising: a receiving module configured to receive an indication indicating that a current virtual machine is to be patched; a detecting module configured to detect a storage location for storing a patched first content, wherein the detected storage location is a storage location allocated to another virtual machine arranged in the same physical machine as the current virtual machine; and a patching module configured to perform the operation for patching in the current virtual machine according to the patched first content in the detected storage location.With the technical solution provided by the present invention, dynamic patching can be performed without stopping running applications.BRIEF DESCRIPTION OF THE SEVERAL DRAWING VIEWSBy describing some embodiments of the present disclosure in more detail in the accompanying drawings, the above and other objects, features, and advantages of the present disclosure will become more apparent, and like reference numerals generally designate the same components in the embodiments of the present disclosure. FIG. 1 illustrates an example computer system / server 12 that may be used to implement embodiments of the present invention; FIG. 2 shows a schematic flow diagram of a method for patching according to embodiments of the present invention; FIG. 3 ashows a schematic flow diagram of a method for patching performed by a library file manager according to embodiments of the present invention; FIG. 3 b shows a schematic flow diagram of another method for patching performed by a library file manager according to embodiments of the present invention; FIG. 3 c shows a schematic flow diagram of a method for patching applied in the environment of a virtual machine according to embodiments of the present invention; FIG. 4 shows a schematic flow diagram of a method for patching applied to virtual machines according to embodiments of the present invention; FIG. 5 shows a schematic flow diagram of another method for patching applied to virtual machines according to embodiments of the present invention; FIG. 6 is a schematic flow diagram of another method for patching applied to virtual machines according to embodiments of the present invention; FIG. 7 is a schematic flow chart of yet another method of patching applied to virtual machines according to embodiments of the present invention; FIG. 8 is a schematic illustration of an apparatus for patching according to an embodiment of the present invention; FIG. 9 is a schematic illustration of another patching apparatus in accordance with embodiments of the present invention; FIG. 10 shows a schematic representation of a further apparatus for patching according to embodiments of the present invention; FIG. 11 is a schematic illustration of yet another patching apparatus according to embodiments of the present invention; and FIG. 12 shows a schematic representation of yet another apparatus for patching according to embodiments of the present invention.DETAILED DESCRIPTIONSome preferred embodiments will be described in more detail with reference to the accompanying drawings, in which the preferred embodiments of the present disclosure have been illustrated. However, the present disclosure may be practiced in various ways and, therefore, should not be construed as being limited to the embodiments disclosed herein. On the other hand, these embodiments are provided for the thorough and complete understanding of the present disclosure and to fully convey the scope of the present disclosure to a person skilled in the art.It will be apparent to one skilled in the art that aspects of the present invention may be embodied as a system, method, or computer program product. Accordingly, aspects of the present invention may take the form of a hardware-only embodiment, a software-only embodiment (including firmware, resident software, microcode, etc.), or an embodiment combining software and hardware aspects, all of which may be referred to herein as a "circuit," "module," or "system.". Furthermore, aspects of the present invention may take the form of a computer program product embodied in one or more computer readable media having computer readable program code embodied therein.Any combination of one or more computer readable media may be utilized. The computer readable medium may be a computer readable signal medium or a computer readable storage medium. A computer readable storage medium may be, for example, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any suitable combination of the foregoing. More specific examples (a non-exhaustive list) of the computer readable storage medium would include the following: an electrical connection having one or more wires, a portable computer diskette, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or Flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage unit, a magnetic storage unit, or any suitable combination of the foregoing. In the context of this document, a computer readable storage medium may be any tangible medium that can contain or store the program for use by or in connection with a system, apparatus, or device for instruction execution.A computer readable signal medium may include a propagating data signal having computer readable program code embodied therein, e.g., in baseband or as part of a carrier wave. Such a propagating signal may take any of a variety of forms, including, but not limited to, electromagnetic, optical, or any suitable combination thereof. A computer readable signal medium may be any computer readable medium that is not a computer readable storage medium and that can transmit, propagate, or transport a program for use by or in connection with a system, apparatus, or device for instruction execution.Program code embodied on a computer readable medium may be transmitted using any suitable medium, including, but not limited to, wireless, wired, fiber optic cable, radio frequency (RF) media, etc., or any suitable combination of the foregoing.Computer program code for carrying out operations for aspects of the present invention may be written in any combination of one or more programming languages, including an object oriented programming language such as Java, Smalltalk, C++ or the like and conventional procedural programming languages, such as the "C" programming language or similar programming languages. The program code may execute on only a user's computer, partially on a user's computer, as a stand-alone software package, partially on a user's computer and partially on a remote computer, or only on the remote computer or server. In the latter scenario, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or the connection may be made to an external computer (e.g., via the Internet using an Internet Service Provider).Aspects of the present invention are described herein with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems) and computer program products according to embodiments of the invention. It will be appreciated that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, may be implemented by computer program instructions. These computer program instructions may be provided to a processor of a general purpose computer, special purpose computer, or other programmable data processing apparatus to form a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate means for implementing the functions / acts specified in the flowchart and / or block diagram block or blocks.These computer program instructions may also be stored in a computer readable medium that can direct a computer, other programmable data processing apparatus, or other devices to function in a particular manner, such that the instructions stored in the computer readable medium produce an article of manufacture including instructions that implement the function / effect specified in the flowchart and / or block diagram block / s.The computer program instructions may also be loaded into a computer, other programmable data processing apparatus, or other devices to effect a series of operational steps to be performed on the computer, other programmable data processing apparatus, or other devices to produce a computer implemented process such that the instructions performed on the computer or other programmable apparatus provide processes for implementing the functions / acts specified in the flowchart and / or block diagram block or blocks.Reference is now made to FIG. 1, which shows an example computer system / server 12 that may be used to implement embodiments of the present invention. The computer system / server 12 is merely illustrative and is not intended to suggest a limitation as to the scope or functionality of embodiments of the invention described herein.Referring now to Figure 1, computer system / server 12 is shown in the form of a general purpose computing device. Components of computer system / server 12 may include, but are not limited to, one or more processors or processing units 16, a system memory 28, and a bus 18 that couples various system components, including system memory 28, to processor 16.Bus 18 represents one or more of various types of bus structures, including a memory bus or memory controller, a peripheral bus, an accelerated graphics port, and a processor or local bus using any of a variety of bus architectures. By way of example and not limitation, such architectures include industry standard architecture (ISA) bus, micro channel architecture (MCA) bus, enhanced ISA (EISA) bus, video electronics standards association (VESA) local bus, and peripheral component interconnect (PCI) busComputer system / server 12 typically includes a variety of computer system readable media. Such media may be any available medium that can be accessed by computer system / server 12 and includes both volatile and non-volatile media, as well as removable and non-removable media.System memory 28 may include computer system readable media in the form of volatile memory, such as random access memory (RAM) 30 and / or cache memory 32. Computer system / server 12 may further include other volatile / non-volatile removable / non-removable storage media of the computer system. For example only, the storage system 34 may be provided for reading from and writing to non-removable, non-volatile magnetic media (not shown and commonly referred to as a "hard disk drive"). Although not shown, a magnetic disk drive for reading from and writing to a non-volatile magnetic removable disk (e.g., a "floppy disk"), and an optical disk drive for reading from and writing to a non-volatile optical removable disk such as a CD-ROM, DVD-ROM, or other optical medium may be provided. In such cases, each medium may be connected to bus 18 by one or more data medium interfaces. As further illustrated and described below, the memory 28 may include at least one program product having a group of program modules (e.g., at least one program module) configured to perform the functions of embodiments of the invention.The program / utility 40 having a group of program modules 42 (at least one program module) may be stored in a memory 28 by way of example and not limitation, as may an operating system, one or more application programs, and program data. For the operating system, one or more application programs, other program modules and program data or specific combinations thereof, a realization of a networking environment is conceivable in each case. Program modules 42 generally perform the functions and / or procedures of embodiments of the invention described herein.The computer system / server 12 may also include one or more external devices 14 such as a keyboard, a pointing device, a display 24, etc.; one or more devices that enable a user to interact with the computer system / server 12; and / or all devices (e.g., network card, modem, etc.) This allows computer system / server 12 to communicate with one or more other computing devices. Such data exchange may be performed via input / output (I / O) interfaces 22. Further, the computer system / server 12 may communicate with one or more networks, such as a local area network (LAN), a general wide area network (WAN), and / or a public network (e.g., the Internet), via a network adapter 20. As shown, network adapter 20 exchanges data with the other components of computer system / server 12 via bus 18. Although not shown, it should be appreciated that other hardware and / or software components could be used in conjunction with computer system / server 12. Examples include, but are not limited to: microcode, device drivers, redundant processing devices, external disk drive arrays, RAID systems, tape drives, and data archive storage systems, etc.FIG. 2 shows a method of patching provided by an embodiment of the present invention. The method comprises: a step 210 of differentiating between a new content and an old content in response to a need to patch a first content and the first content being in the memory, the new content being the patched first content, the old content being the first content being in the memory; a step 220 of assigning a new process to the new content in response to the new content being loaded into the memory, the new process having to apply the new content, the new process comprising a process that is started after the new content has been loaded into the memory.When a content to be patched has been loaded into the memory according to the prior art, all processes associated with the content are terminated because directly modifying a content in the memory causes an abnormality in a process associated with the content. After a patched content is loaded into memory, a process associated with the content may be restarted to be associated with the patched memory. The solution provided by the prior art must obviously end up processes for performing patch operations that could place restrictions on usage for users. If a process cannot be temporarily terminated, no patching operations can be performed, i.e., if a new process is started, old content is still used, resulting in it being impossible to add a function or close a safety gap by patching. In the technical solution provided by this embodiment, when a content to be patched has been loaded into the memory, by distinguishing between a new content and an old content, the patched content is also loaded into the memory, a new process is assigned to the new content, and an old process still uses the old content. In this way, when a process is restarted, the patched content can be used without necessarily ending a running process, so that the operation for patching the first content is ended.In one embodiment of the present invention, the first content may include a library file. The library file can be, for example, a file of a dynamic link library (DLL) and / or a static link library. In another embodiment of the present invention, the first content may include other program files such as a class file, etc. For convenience, the description in the following embodiments will be presented so that the first content is, for example, a library file.In one embodiment of the present invention, the memory is physical memory. However, it is clear to a person skilled in the art that the memory may possibly have several meanings during technological development. In embodiments of the present invention, content loaded into memory mainly denotes content that affects the running of a process when patched. Whether, in one embodiment of the present invention, content to be patched is in memory may be judged by determining whether an application to be associated with the content to be patched is currently running.In one embodiment of the present invention, the method shown in FIG. 2 may be applied to a physical machine. In another embodiment of the present invention, the method shown in FIG. 2 may be applied to a virtual machine.In an embodiment of the present invention, the method shown in FIG. 2 may further include: detecting that there is a need to patch the first content; and determining that the first content is in the memory. There may be several approaches to detecting that there is a need to patch the first content, for example receiving a notification or directly receiving a kick with respect to patches or directly receiving a control command. In addition, in the prior art, there are various methods for determining that the first content is in the memory. Embodiments shown in FIGS. 3 aand 3 b provide corresponding examples, which will not be explained in more detail at this point.In one embodiment of the present invention, the first content comprises a library file. Accordingly, distinguishing between a new content and an old content in step 210 comprises: distinguishing between the new content and the old content by modifying a library file list. There are various implementations; for example, an element related to an old content may be modified in the library file list or an element related to a new content may be modified in the library file list.In an embodiment of the present invention, the method shown in FIG. 2 may further include: after all old processes are completed, removing an element related to the old content, the old processes including a process associated with the old content before the new content is loaded into the memory. Specifically, an element related to the old content in the library file list may be deleted, of the contents, the old content may be released, or both an element related to the old content in the library file list is deleted and the old content is released from the contents.In one embodiment of the present invention, the method shown in FIG. 2 may be implemented by a library file manager. As shown in FIG. 3 a, in step 310, the library file manager receives a notification that is for notifying the library file manager that a patch for a first library file is present. The notification is sent, for example, by a patch switch. In step 320, the library file manager decides whether the first library file is already in memory. If so, the process proceeds to step 330; if not, the process proceeds to step 340. In step 330, the library file manager distinguishes between the patched first library file and the unpatched first library file. For simplicity of the following description, the patched first library file is referred to as a new library file and the unpatched first library file is referred to as an old library file. If a new process is started in step 350, the new process is mapped to the new library file. The new process is a process started after the new library file is loaded into the memory, and the old process is a process assigned to the old library file before the new library file is loaded into the memory. If, in step 360, all processes associated with the old library file have been completed, an element relating to the old library file is deleted. In step 340, the method may end directly or otherwise it is reported that the first library file is not in memory. In this embodiment, loading the new library file into memory may be implemented by the operating system or other means before, simultaneously with, or after step 330 as long as it occurs after step 320 and before step 350.In another embodiment of the present invention, as shown in Figure 3b, the notification received at step 310 may be a notification that notifies the library file manager of information about a new library file, including, for example, a memory address, a designation of the new library file, etc. The notification may be sent by the operating system or other means, for example. In this embodiment, a determination as to whether the library file is already in memory is performed, prior to step 310, by the library file manager or operating system, or other means in particular. In step 330, the library file manager may distinguish between the new library file and the old library file by modifying the library file list. In this embodiment, the library file manager retains the library file list, the list including information concerning library files and correspondence relationships between library files and processes, the information concerning library files including, for example, library file designations, memory addresses, etc. Alternatively, the library file manager may distinguish between new and old library files by modifying a label of the new library file in the library file list. For the old process, the library file manager still makes an assignment to the old library file in step 370 to ensure normal running of the process. In step 360, deleting an element relating to the old library file may include deleting all or at least a portion of elements of the old library file in the library file list. Alternatively, the old library file may be released in the memory. As can be seen from the embodiments shown in FIGS. 3 aand 3 b, the technical solution provided by the embodiments of the present invention may perform operations for patching while ensuring that running of the old process is not affected, so that the new process may use the patched content, i.e., dynamic patching is achieved. This technical solution may improve user experience and ensure proper patching. Moreover, the embodiment shown in FIG. 3b may prevent the old process from affecting the new library file upon termination. Furthermore, this embodiment and the embodiment shown in FIG. 3 acan refer to one another, for example the embodiment shown in FIG. 3 acan likewise have step 370.When implemented in a virtual machine environment as shown in FIG. 3 c, the above-mentioned embodiment may further include: in step 301, the virtual machine receives a notification of patching a first content; in step 302, the virtual machine determines that the first content is already in memory in response to receiving the notification; in step 303, the virtual machine distinguishes between an old content and a new content in response to determining that the new content has been loaded into the new memory location; in step 305, the virtual machine assigns a new process that needs to apply the first content to the new content; in step 306, a first notification is sent, the first notification including at least one address of the new memory location; In step 307, a second notification is sent, the second notification being for notifying that this virtual machine is already in a first state, the first state including all states from loading the first patched content to the new storage location until ending the patch operation. One skilled in the art will appreciate that there is no particular order of execution between step 303 and step 304; there is also no particular order of execution between step 305, step 306, and step 307 as long as step 305 and step 307 are executed after the patched first content is loaded into the memory space. A specific technical solution of the virtual machine in which memory is shared may refer to details described with reference to the following embodiments, which will not be discussed in detail herein. In the solution provided by this embodiment, a plurality of virtual machines can achieve shared memory usage when patching, thereby saving memory space and avoiding double downloading of patches; moreover, dynamic patching is enabled without stopping running processes.As shown in FIG. 4, the embodiment of the present invention provides a method for patching. The method is suitable for performing the virtual machine patch operation. The method includes: step 410 to, in response to the number of virtual machines to patch a first content being greater than 1, schedule patching such that n virtual machines from the virtual machines first perform the operation for patching the first content, wherein the virtual machines to patch the first content are arranged in the same physical machine and the number of virtual machines to patch the first content is n+m, wherein both n and m are natural numbers; A step 420 of receiving a notification, the notification for notifying that at least one of the n virtual machines is already in a first state, the first state including all states from loading the patched first content to a storage location until ending the patching operation; step 430 responsive to receiving the notification, scheduling at least one of the m virtual machines different from the n virtual machines to perform the patching operation of the first content such that at least one of the virtual machines can use the patched first content loaded into the storage for the patching operation.In the related art, when a plurality of virtual machines perform patching, each virtual machine performs the patching operation independently without any cooperation with other virtual machines because these virtual machines are separated from each other. As a result, patches are repeatedly downloaded, thereby increasing the network transmission load and degrading the network transmission conditions or increasing the response time of the I / O interface. Moreover, since a plurality of virtual machines independently perform the patching operation, they could occupy multiple memory locations for storing the same patched contents, thereby wasting memory location. The method provided by this embodiment may plan a plurality of virtual machines that require patching to effect cooperation between virtual machines, thereby reducing the possibility that virtual machines download patches repeatedly and reducing network transmission burden. In addition, by causing n virtual machines to perform patching first and subsequently causing at least one of m virtual machines to perform patching using the patched content in the memory, a virtual machine performing patching later may use memory space occupied by a virtual machine performing patching before, thereby avoiding waste of memory space; i.e., multiple virtual machines may share the memory occupied by patched content. The method provided by this embodiment can be applied to dynamic patching or static patching.In one embodiment of the present invention, the value of n is alternatively 1. that is, first, it is scheduled that one virtual machine is patching and then other virtual machines are patching using patched content loaded into memory. In this way, the benefit of sharing patched content between virtual machines can be reflected to a greater extent.In an embodiment of the present invention, the method shown in FIG. 4 further includes: determining that the number of virtual machines to patch the first content is greater than 1, wherein the virtual machines to patch the first content include a first virtual machine running a process associated with the unpatched first content. In the method provided by this embodiment, virtual machines can achieve dynamic patching. Details of the specific implementation may refer to the embodiments shown in FIGS. 2, 3 a, and 3 b. It should be appreciated that in a virtual machine environment, a determination as to whether content to be patched is in memory or a virtual machine runs a process associated with content to be patched by the patch manager or patch switch in the virtual machine.In one embodiment of the present invention, in steps 410 and 430, by different indications, n and m virtual machines may be scheduled to perform patching, respectively, such that n virtual machines are given a new storage space while m virtual machines are using the existing storage space. Alternatively, the scheduling approaches in steps 410 and 430 are the same, i.e., the virtual machine decides whether to get a new storage space or to use the existing storage space.In an embodiment of the present invention, the first state comprises: loading the patched content into the storage space; or obtaining a new client storage page; or allocating the new client storage page to the new storage space; or allocating the new process to the patched content.In one embodiment of the present invention, referring to the embodiment shown in FIG. 2, scheduling may be implemented in step 430 by sending a notification of patching, by directly propagating a patch, or by directly sending a control command, which is not discussed in detail herein.In one embodiment of the present invention, the method shown in FIG. 4 may be performed by a patch manager. The patch manager is to plan corresponding virtual machines to perform patches. Alternatively, the patch manager may send a message about patching to the patch switch in the virtual machine. Alternatively, the patch manager may move a patch address directly to the patch switch in the virtual machine. Accordingly, the patch manager may directly receive a notification about patching and download a patch itself or directly obtain an address at which a patch is stored. In this embodiment, the patch address may be an address on the disk or an address in the memory. In virtual machine applications, the memory may be physical memory in a physical machine or may be embodied as physical memory of the virtual machine hypervisor. The patch manager may alternatively be located in the physical machine operating system or in the virtual machine hypervisor operating in a physical machine. It is clear to a person skilled in the art that the patch manager can be arranged at other locations during the course of the technological development as long as it is able to plan corresponding virtual machines for carrying out the patching.As shown in FIG. 5, an embodiment of the present invention provides a method of patching. The method is adapted to perform the virtual machine patch operation. The method includes: at step 510, receiving an indication to indicate that a current virtual machine is to be patched; at step 520, obtaining a new storage location for storing a patched first content, the new storage location having a storage location that does not overlap a storage location at which the unpatched first content is stored; at step 530, sending a first notification including at least one address of the new storage location; at step 540, sending a second notification notifying that the current virtual machine is in a first state, the first state including all states from loading the patched first content to the storage location until completion of the patching operation; and in step 550, performing the patch operation for the current virtual machine according to the patched first content in the new storage space.According to the method provided by the embodiment of the present invention, the virtual machine notifies the patch manager so that the patch manager can plan other virtual machines to perform patching after the virtual machine loads the patched content into the memory. This helps achieve interworking in patching between a plurality of virtual machines, thereby achieving shared memory usage, avoiding multiple download of patches, and also avoiding occupying too large a space of memory.In one embodiment of the present invention, according to the embodiment shown in FIG. 4, the indication received in step 510 may indicate that the current virtual machine needs to obtain a new storage space, or simply indicate that the current virtual machine needs to patch the first content, such that the virtual machine itself decides whether to obtain a new storage space.In one embodiment of the present invention, the indication received in step 510 is an indication transmitted by first means. The first indication transmitted in step 530 is transmitted by second means. The second indication transmitted in step 540 is transmitted by third means. Both the first means and the third means are patch managers for planning virtual machines for performing patches; and the second means is a patch controller for managing the new storage space. The patch controller may alternatively be used to store an address of the new memory location. Such a virtual machine, in particular the patch switch in the virtual machine, can obtain an address of the new memory location by accessing the patch controller. The patch controller may alternatively be used for exchanging data with the virtual machine and for managing the address of the new storage space. In this manner, the patch controller can manage addresses from a plurality of new memory locations and respond to a variety of requests. One skilled in the art will appreciate that the patch manager and patch controller may be located in the same device or may be two separate means. Alternatively, the patch controller may be located in the hypervisor, facilitating management of memory locations.For example, in one embodiment of the present invention, step 520 may include: in response to the first content being in the memory location, obtaining a new memory location for storing the patched first content. In this embodiment, a new storage space can be obtained when the first content is already in the memory. In another embodiment, determining whether the first content is in the storage location is performed prior to downloading a patch, therefore, the patch may be directly downloaded to the disk in response to the first content not being in the storage location. In another embodiment of the present invention, determining whether the first content is in the storage location is performed after downloading a patch to the disk, therefore, in response to the first content not being in the storage location, no operation is temporarily performed until a process needs to be associated with the content, and storage location for storing the patched content is obtained, i.e., the patched content is directly loaded from the disk to the memory. Step 550 may include: obtaining a new client memory page; mapping the new client memory page to the new memory location; and mapping the new process that needs to apply the first content to the patched first content, the new process including a process that is started after mapping the new client memory page to the new memory location. Obtaining a new client memory page may consist of allocating a new memory location or detecting a new memory location allocated to the current virtual machine. In this embodiment, the client storage page may be implemented in the form of a table in which mapping relationships between virtual machine memories and physical addresses managed by the virtual machine hypervisor are maintained. In the method provided by this embodiment, when a process associated with patched content runs in the virtual machine, the content may nevertheless be patched and the patched content is loaded into memory so that a new process can use the patched content and an old process still uses old content. In this way, dynamic patching is achieved without interfering with the running of an old process.In an embodiment of the present invention, the method shown in FIG. 5 further includes: after all old processes are completed, removing an element related to the first content, the old processes including a process that has been mapped to the unpatched first content before mapping the new client memory page to the new memory location. In the method provided by this embodiment, after an old process is completed, an element related to an old content can be released in time without affecting a new content.In one embodiment of the present invention, the method shown in Figure 5 is performed by the patch switch employed in the virtual machine. It will be apparent to one skilled in the art that a portion of the functions, e.g., the patch manager, may be implemented by other means.As shown in FIG. 6, embodiments of the present invention provide a method of patching. The method is suitable for performing a patching for a virtual machine. The method includes: in step 610, receiving an indication to notify that a current virtual machine is to patch; in step 620, detecting a storage location for storing patched first content, the detected storage location being a storage location allocated to another virtual machine in the same physical machine as the current virtual machine; and in step 630, performing patches for the current virtual machine according to the patched first content stored in the detected storage location.In the method provided by this embodiment, the virtual machine applying the method may share with a patched virtual machine a storage space where the patch is located, thereby avoiding double downloading of the patch and also avoiding occupying too large a storage space.In one embodiment of the present invention, according to the embodiment shown in FIG. 4, the indication received in step 610 may indicate that the current virtual machine needs to use the present storage space or simply indicate that the current virtual machine needs to patch the first content, the virtual machine itself deciding whether to use the present storage space.In one embodiment of the present invention, the indication received in step 610 is transmitted by first means. The memory location detected in step 620 is a memory location detected by a second means for storing the patched first content. Both the first means and the second means can be patch managers. In a further embodiment of the present invention, the first means is a patch manager and the second means is a patch controller.For example, in one embodiment of the present invention, step 630 may include: obtaining a new client memory page; mapping the new client memory page to the detected memory location; and mapping a new process to the patched first content, the new process to be applied to the first content, the new process including a process that begins after mapping the new client memory page to the detected memory location.The above embodiments of the method may refer to each other and be linked together to obtain further embodiments. For example, the embodiments shown in FIGS. 4 and 2 may be linked to obtain a dynamic patching method for virtual machines performed by a patch manager when shared memory. Furthermore, for example, linking of the embodiments shown in FIGS. 6 and 2 is conceivable in order to obtain a method for dynamic patching for virtual machines carried out by a patch switching center when shared memory.In FIG. 7, detailed explanation is given in the embodiments of the present invention. In the physical machine A, a virtual machine 1, a virtual machine 2, a virtual machine 3, and a virtual machine 4 are operated. A patch manager, which is arranged in the operating system of the physical machine A, recognizes that a file dll1 to which an application "a" is assigned must be patched. In step 710, the patch manager downloads a patch for a file dll1 to the disk. In step 720, the patch manager determines that application "a" is currently running on virtual machines 1, 2, and 3, but not on virtual machine 4. The application "a" is an application associated with a file dll1. In step 730, the patch manager sends a patching notification to the patch switch 1 located in the virtual machine 1. In step 740, the patch switch 1 obtains a new physical storage space in response to receiving the notification of the patching. In step 750, patch switch 1 receives a new client memory page and allocates it to the new physical memory space. In step 760, in response to the patched file dll1 having been loaded into the new physical storage space, the patch switch 1 sends a notification to the patch manager. In step 770, in response to the patched file dll1being loaded into the new physical storage space, a new process is mapped to the new client storage page and then to the patched file dll1. In step 780, patch switch 1 reports to a patch controller an address of the new physical memory location, i.e., an address of patched file dll1in the physical memory. In step 790 in response to receiving the notification from the patch switch 1, the patch manager sends a notification of patching to the patch switch 2 located in the virtual machine 2 and the patch switch 3 located in the virtual machine 3, respectively. In step 7010, the patch switches 2 and 3 each receive the new client memory page in response to receiving the patch notification sent from the patch manager. In step 7011, in response to receiving the notification of patching sent from the patch manager from the patch controller, the patch switches 2 and 3 each obtain the address of the patched file dll1 in the physical memory. In step 7012, patch switches 2 and 3, respectively, allocate the new client memory page to a physical memory space occupied by patched file dll1. In step 7013, patch switches 2 and 3 assign the new process to their corresponding new client memory pages and then to the patched file dll1.In this embodiment, loading the patched content into the new physical storage space may be translated after, before, or while the patch switch 1 receives the new physical storage space, as long as translation occurs after the assignment of the new physical storage space and before step 770. In this embodiment, there is no particular order of execution between step 760 and step 770. Step 780 is performed after step 740 and before step 7011. There is also no special execution order between step 7010 and step 7011. In this embodiment, the patch manager and the patch controller may be arranged together or at different positions. In this embodiment, step 720 may be specified by the patch manager itself or reported by a virtual machine. When the reporting is performed by a virtual machine, the virtual machine itself decides whether a file dll1is in the physical memory and can be executed by a library file manager. Further, step 770 may be performed, for example, by the library file manager and prior to performing step 770, wherein the library file manager may distinguish between an old file dll1and a new file dll1. The specific implementation may refer to the embodiment shown in FIG. 2. For simplicity of Figure 7, the library file manager is not shown separately, but the library file manager and patch switch are shown as a whole. In this embodiment, when an application "a" runs, it necessarily means that content 1 to be patched is in the physical memory. Therefore, it can be determined whether content to be patched is in the physical memory by judging whether an application "a" is currently running. One skilled in the art will appreciate that other approaches may be used to determine whether content to be patched is in physical memory. Further implementation details of this embodiment may also relate to the above-mentioned embodiments. In the technical solution provided by this embodiment, virtual machines in the same physical machine can cooperate in the operation of patching the same content, content to which a running application is assigned can be patched without affecting an old process, and the patched content can be applied in a new process, thereby improving user experience and enhancing security. In addition, since virtual machines can share physical memory, they do not repeatedly download the same patch or do not occupy too large physical memory.As shown in FIG. 8, embodiments of the present invention provide an apparatus 800 for patching. The device 800 may be disposed in a physical machine environment or a virtual machine environment. The apparatus 800 includes: a distinguishing module 810 configured to, in response to a need to patch a first content and the first content already being in the memory, distinguish between a new content and an old content, the new content being the patched first content and the old content being the first content that was in the memory; and a mapping module 820 configured to, in response to the first content being loaded into the memory, map the new content to a new process that needs to apply the first content, the new process including a process that is started after the new content is loaded into the memory. The technical solution provided by this embodiment can achieve dynamic patching. Details of the specific implementation of this embodiment can relate to an embodiment of the corresponding method, which is not explained in detail in this context. The device 800 may alternatively be implemented as, for example, a library file manager.In an embodiment of the present invention, the apparatus 800 may further include: a detection module 830 configured to detect that there is a need for patching the first content; and a determination module 840 configured to determine that the first content is in the memory.In one embodiment of the present invention, the first content comprises, for example, a library file. Accordingly, the distinguishing module 810 is configured to distinguish between the new content and the old content by modifying a library file list.In an embodiment of the present invention, the apparatus 800 may further include: a removal module 850 configured to remove an element related to the old content after all old processes are completed, the old processes including a process associated with the old content before the new content is loaded into the memory.As shown in FIG. 9, embodiments of the present invention provide an apparatus for patching. The apparatus 900 may be disposed in a virtual machine environment. The apparatus 900 includes: a first scheduling module 910 configured to, in response to the number of virtual machines required to patch a first content being greater than 1, schedule patching such that n of the virtual machines first perform the operation to patch the first content, wherein the virtual machines to patch the first content are in the same physical machine, and the number of virtual machines to patch the first content is n+m, wherein both n and m are natural numbers; a receiving module 920 configured to receive a notification notifying that at least one of the n virtual machines is already in a first state, the first state including all states from loading the patched first content into the memory until ending the patching operation; and a second scheduling module 930 configured to, in response to receiving the notification, schedule at least one of m virtual machines different from the n virtual machines to execute the patching operation of the first content, so that the at least one of the m virtual machines can execute the patching operation by using the patched first content loaded into the memory. The device 900 may alternatively be implemented as a patch manager. The device 900 may alternatively be disposed in the virtual machine hypervisor or the physical machine operating system as long as the position of the device 900 may cause the device 900 to communicate with a plurality of virtual machines disposed in the same physical machine. It will be appreciated by one of ordinary skill in the art that device 900 may further include multiple modules for performing other functions, e.g., a download patch function, a move patch function, etc., which will not be discussed in greater detail herein. In the technical solution provided by this embodiment, a plurality of virtual machines to be patched may achieve a shared operation and share the memory to avoid repeated downloading of patches and not occupy too much memory space.In an embodiment of the present invention, a value of n is, for example, 1.In an embodiment of the present invention, the apparatus 900 further comprises: a module 940 for detecting. The determining module 940 is configured to determine that the number of virtual machines to patch the first content is greater than 1, wherein the virtual machines to patch the first content include a virtual machine that runs a process associated with the first content that has not been patched. In the technical solution provided by this embodiment, dynamic patching for virtual machines may be implemented, and details of the concrete implementation may refer to the embodiments shown in FIGS. 2, 3 a, and 3 b.As shown in FIG. 10, embodiments of the present invention provide an apparatus 1000 for patching. The apparatus 100 may be disposed in a virtual machine environment. The apparatus 1000 may include: a receiving module 1010 configured to receive an indication indicating that a current virtual machine needs to be patched; a receiving module 1020 configured to receive a new storage location for storing a patched first content, the new storage location having a storage location that does not overlap a storage location for storing a non-patched first content; a sending module 1030 configured to send a first notification comprising at least one address of the new storage location and a second notification to notify that the current virtual machine is already in a first state, the first state comprising all states from loading the unpatched first content to the storage location until ending the patching operation; and a patching module 1040 configured to perform the patching operation in the current virtual machine according to the patched first content in the new storage location. The apparatus 1000 can alternatively be implemented, for example, as a patch switch, wherein the patch switch can be arranged, for example, in a virtual machine. In the technical solution provided by this embodiment, a plurality of virtual machines to be patched can achieve a shared operation and share the memory to avoid repeatedly downloading patches and occupying too large a storage space.For example, in one embodiment of the present invention, the module 1010 for receiving may receive the indication from a first means, and the module 1030 for transmitting may be configured to transmit the first notification to a second means and transmit the second notification to a third means, for example. Both the first means and the third means are patch managers that plan virtual machines to perform the patching operation; and the second means is a patch controller for managing the new storage space. As can be seen from the description of the embodiment of the method, the patch managers and the patch control unit can be arranged jointly or at different positions, wherein the patch managers are arranged, for example, in the operating system of a physical machine, while the patch control unit is arranged in the hypervisor.In one embodiment of the present invention, the obtaining module 1020 is configured to obtain a new memory location for storing the patched first content in response to the first content being in the memory. The patching module 1040 includes: a client page submodule configured to obtain a new storage space; a first mapping submodule configured to map the new client page to the new storage space; a second mapping submodule configured to map the patched first content with a new process that needs to apply the first content, the new process including a process that begins after the new client page has been mapped to the new storage space. In the technical solution provided by this embodiment, dynamic patching can be achieved based on shared memory use between virtual machines. In conjunction with the embodiment shown in FIG. 9, it will be apparent to one skilled in the art that a process associated with unpatched content may be judged by the patch switch in the virtual machine or by the patch manager whether a process associated with unpatched content is running in a virtual machine.In an embodiment of the present invention, the apparatus 100 further comprises a removal module 1050 configured to remove an element relating to the first content after all old processes have been completed, the old processes comprising a process associated with the unpatched first content before the new client memory page has been associated with the new memory location.As shown in FIG. 11, embodiments of the present invention provide an apparatus 1100 for patching. The apparatus 1100 may be disposed in a virtual machine environment. The apparatus 1100 includes: a receiving module 1110 configured to receive an indication indicating that a virtual machine needs patching; a detecting module 1120 configured to detect a storage location to store patched first content, the detected storage location being a storage location allocated to another virtual machine located in the same physical machine as the current virtual machine; and a patching module 1130 configured to perform the patching operation on the current virtual machine according to the patched first content in the detected storage location. The apparatus 1100 can alternatively be implemented, for example, as a patch switch, wherein the patch switch can be arranged, for example, in a virtual machine. In the technical solution provided by this embodiment, a plurality of virtual machines to be patched can achieve a shared operation and share the memory to avoid repeated downloading of patches and not occupy too much memory.In one embodiment of the present invention, the patching module 1130 includes, for example: a client page submodule configured to obtain a new client page; a first mapping submodule configured to map the new client page to the detected memory location; and a second mapping submodule configured to map the patched first content to a new process to apply the first content, the new process including a process started after the new client page is mapped to the detected memory location.The above embodiments of the method may be related and linked together to obtain further reactions. The embodiments shown in FIGS. 10 and 11 may be linked, for example, in order to obtain a device 1200 for patching as shown in FIG. 12, wherein the device 1200 may be arranged, for example, in a virtual machine. The apparatus 1200 includes: a receiving module 1210 configured to receive a first indication indicating that a current virtual machine needs to obtain a new storage location for patching a first content and a second notification notifying that the current virtual machine needs to use the present storage location for patching a second content; a obtaining module 1220 configured to obtain a new storage location for storing a patched first content in response to receiving the first indication, the new storage location including a storage location that does not overlap a storage location on which a non-patched first content is stored; a sending module 1230 configured to send a first notification comprising at least one address of the new memory location and a second notification indicating that the current virtual machine is already in a first state, the first state comprising all states from loading the patched first content to the memory location until ending the patching operation; a detecting module 1240 configured to detect a memory location for storing the patched first content in response to receiving the second indication, the detected memory location being a memory location allocated to another virtual machine located in the same physical machine as the current virtual machine; and a patching module 1250 configured to perform the patching operation in the current virtual machine according to the patched content in the storage location obtained by the obtaining module 1220 or in the storage location detected by the detecting module 1240.Details of the implementation of the above-mentioned embodiments of the device can refer to corresponding embodiments of the method.The flowchart and block diagrams in the figures illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of the present invention. In this regard, each block in the flowchart or block diagrams may represent a module, segment, or portion of code that includes one or more executable instructions for implementing the specified logical function(s). It should also be noted that, in some alternative implementations, the functions indicated in the block may occur in a different order than indicated in the figures. For example, two blocks shown in sequence may actually be executed substantially simultaneously, or the blocks may occasionally be executed in the reverse order depending on the functionality involved. It is also noted that each block of the block diagrams and / or flowchart illustration, and combinations of blocks in the block diagrams and / or flowchart illustration, may be implemented by special purpose hardware-based systems that perform the specified functions or acts, or combinations of special purpose hardware and computer instructions.The descriptions of the various embodiments of the present invention have been presented for purposes of illustration, but are not intended to be exhaustive or to limit the disclosed embodiments. Many modifications and variations will occur to those skilled in the art without departing from the scope and spirit of the described embodiments. The terminology used herein was chosen to best explain the principles of the invention, the practical application, or the technical improvement over technologies found in the market, or to enable those skilled in the art to understand the embodiments disclosed herein.

Claims

A method of patching, comprising: responsive to a need to patch a first content and the first content being in the memory, distinguishing between a new content and an old content, wherein the new content is the patched first content and the old content is the first content that was in the memory; and responsive to the new content being loaded into the memory, associating a new process that needs to apply the first content with the new content, wherein the new process comprises a process that is started after the new content is loaded into the memory; in response to the number of virtual machines that are to patch a first content being greater than 1, scheduling the patching such that n of the virtual machines first perform the operation of patching the first content, wherein the virtual machines that are to patch the first content are in the same physical machine and the number of virtual machines that are to patch the first content is n+m, wherein both n and m are natural numbers; receiving a notification notifying that at least one of the n virtual machines is already in a first state, wherein the first state includes all states from loading the patched first content into the memory until ending the operation for patching; and in response to receiving the notification, planning at least one of m virtual machines other than the n virtual machines to perform the patching of the first content, so that the at least one of the m virtual machines performs the patching operation using the patched first content loaded in the memory.The method of claim 1, wherein the method further comprises: detecting that there is a need to patch the first content; and determining that the first content has been in the memory.The method of claim 1 or claim 2, wherein the first content comprises a library file, the distinguishing between a new content and an old content comprises: distinguishing between the new content and the old content by modifying a library file list.The method of any preceding claim, wherein the method further comprises: removing an element relating to the old content after all processes have been completed, wherein the old processes comprise a process associated with the old content before the new content has been loaded into the memory.The method of any preceding claim, wherein n is 1.The method of any one of claims 1 to 4, wherein the method further comprises: determining that the number of virtual machines to patch the first content is greater than 1, wherein the virtual machines to patch the first content comprise a virtual machine running a process associated with the first content that is not patched.An apparatus for patching, comprising: a distinguishing module configured to, in response to a need to patch a first content and the first content being in the memory, distinguish between a new content and an old content, wherein the new content is the patched first content, the old content is the first content that was in the memory; and a mapping module configured to, in response to the new content being loaded into the memory, map a new process that needs to apply the first content to the new content, wherein the new process comprises a process that is started after the new content is loaded into the memory; a first scheduling module configured to schedule patching so that n of the virtual machines first perform the operation of patching the first content, wherein the virtual machines that are to patch the first content are in the same physical machine, and the number of virtual machines that are to patch the first content is n+m, wherein both n and m are natural numbers, in response to the number of virtual machines that are to patch the first content being greater than 1; a receiving module configured to receive a notification to notify that at least one of the virtual machines is already in a first state, the first state including all states from loading the patched first content into the memory until ending the patching operation; and a second scheduling module configured to, in response to receiving the notification, schedule at least one of m virtual machines different from the n virtual machines to execute the patching operation of the first content such that the at least one of the m virtual machines executes the patching operation using the patched first content loaded into the memory.The apparatus of claim 7, wherein the apparatus further comprises: a detecting module configured to detect that there is a need to patch the first content; and a determining module configured to determine that the first content is in the memory.The apparatus of claim 7 or 8, wherein the first content comprises a library file and the module for distinguishing is configured to distinguish between the new content and the old content by modifying a library file list.The apparatus of any of claims 7 to 9, wherein the apparatus further comprises: a removal module configured to remove an element related to the old content after all old processes are completed, the old processes comprising a process associated with the old content before the new content is loaded into the memory.The device according to any one of claims 7 to 10, wherein n is 1.The apparatus of any one of claims 7 to 10, wherein the apparatus further comprises: a determining module configured to determine that the number of virtual machines to patch the first content is greater than 1, wherein the virtual machines to patch the first content comprise a virtual machine running a process associated with the first content that has not been patched.Computer program comprising program code by means of which it is possible to carry out the method steps of claims 1 to 6 when the program runs in a computer.

Images