Runtime patching of an operating system (OS) without stopping execution

摘要

Techniques for runtime patching of an OS without stopping execution of the OS are presented. When a patch function is needed, it is loaded into the OS code. Threads of the OS that are in kernel mode have a flag set and a jump is inserted at a location of an old function. When the old function is accessed, the jump uses a trampoline to check the flag, if the flag is set, processing returns to the old function; otherwise processing jumps to a given location of the patch. Flags are unset when exiting or entering the kernel mode.

主权项

1. A method, comprising:
loading, via the device, a patch function for an existing function within a kernel of an Operating System (OS); setting, via the device, a flag for each kernel thread active within the Operating System (OS); unsetting, via the device, each flag when any OS thread enters the kernel or when any OS thread exits the kernel; and inspecting, via the device, each flag for each kernel thread that attempts to execute the existing function and when that flag is set pass that kernel thread to the existing function for execution but when that flag is unset pass that kernel thread to the patch function without halting the OS.