Dynamic software updating

Any running program can be thought of a tuple ${\displaystyle (\delta ,P)}$, where ${\displaystyle \delta }$ is the current program state and ${\displaystyle P}$ is the current program code. Dynamic software updating systems transform a running program ${\displaystyle (\delta ,P)}$ to a new version ${\displaystyle (\delta ',P')}$. In order to do this, the state must be transformed into the representation ${\displaystyle P'}$ expects. This requires a state transformer function. Thus, DSU transforms a program ${\displaystyle (\delta ,P)}$ to ${\displaystyle (S(\delta ),P')}$. An update is considered valid if and only if the running program ${\displaystyle (S(\delta ),P')}$ can be reduced to a point tuple ${\displaystyle (\delta ,P')}$ that is reachable from the starting point of the new version of the program, ${\displaystyle (\delta _{init},P')}$.[1]

The location in a program where a dynamic update occurs is referred to as an update point. Existing DSU implementations vary widely in their treatment of update points. In some systems, such as UpStare and PoLUS, an update can occur at any time during execution. Ginseng's compiler will attempt to infer good locations for update points, but can also use programmer-specified update points. Kitsune and Ekiden require developers to manually specify and name all update points.

Updating systems differ in the types of program changes that they support. For example, Ksplice only supports code changes in functions, and does not support changes to state representation. This is because Ksplice primarily targets security changes, rather than general updates. In contrast, Ekiden can update a program to any other program capable of being executed, even one written in a different programming language. Systems designers can extract valuable performance or safety assurances by limiting the scope of updates. For example, any update safety check limits the scope of updates to updates which pass that safety check. The mechanism used to transform code and state influences what kinds of updates a system will support.

DSU systems, as tools, can also be evaluated on their ease-of-use and clarity to developers. Many DSU systems, such as Ginseng, require programs to pass various static analyses. While these analyses prove properties of programs that are valuable for DSU, they are by nature sophisticated and difficult to understand. DSU systems that do not use a static analysis might require use of a specialized compiler. Some DSU systems require neither static analysis nor specialty compilers.

Programs that are updated by a DSU system are referred to as target programs. Academic publications of DSU systems commonly include several target programs as case studies. vsftpd, OpenSSH, PostgreSQL, Tor, Apache, GNU Zebra, memcached, and Redis are all dynamic updating targets for various systems. Since few programs are written with support for dynamic updating in mind, retrofitting existing programs is a valuable means of evaluating a DSU system for practical use.

The problem space addressed by dynamic updating can be thought of as an intersection of several others. Examples include checkpointing, dynamic linking, and persistence. As an example, a database that must be backward-compatible with previous versions of its on-disk file format, must accomplish the same type of state transformation expected of a dynamic updating system. Likewise, a program that has a plugin architecture, must be able to load and execute new code at runtime.

Similar techniques are sometimes also employed for the purpose of dynamic dead-code elimination to remove conditionally dead or unreachable code at load or runtime, and recombine the remaining code to minimize its memory footprint or improve speed.[2][3]

The earliest precursor to dynamic software updating is redundant systems. In a redundant environment, spare systems exist ready to take control of active computations in the event of a failure of the main system. These systems contain a main machine and a hot spare. The hot spare would be periodically seeded with a checkpoint of the primary system. In the event of a failure, the hot spare would take over, and the main machine would become the new hot spare. This pattern can be generalized to updating. In the event of an update, the hot spare would activate, the main system would update, and then the updated system would resume control.

The earliest true Dynamic Software Updating system is DYMOS (Dynamic Modification System).[4] Presented in 1983 in the PhD dissertation of Insup Lee, DYMOS was a fully integrated system that had access to an interactive user interface, a compiler and runtime for a Modula variant, and source code. This enabled DYMOS to type-check updates against the existing program.

DSU systems must load new code into a running program, and transform existing state into a format that is understood by the new code. Since many motivational use-cases of DSU are time-critical (for example, deploying a security fix on a live and vulnerable system), DSU systems must provide adequate update availability. Some DSU systems also attempt to ensure that updates are safe before applying them.

There is no one canonical solution to any of these problems. Typically, a DSU system that performs well in one problem area does so at a trade-off to others. For example, empirical testing of dynamic updates indicates that increasing the number of update points results in an increased number of unsafe updates.[5]

Most DSU systems use subroutines as the unit of code for updates; however, newer DSU systems implement whole-program updates.[6][7]

If the target program is implemented in a virtual machine language, the VM can use existing infrastructure to load new code, since modern virtual machines support runtime loading for other use cases besides DSU (mainly debugging). The HotSpot JVM supports runtime code loading, and DSU systems targeting Java (programming language) can utilize this feature.

In native languages such as C or C++, DSU systems can use specialized compilers that insert indirection into the program. At update time, this indirection is updated to point to the newest version. If a DSU system does not use a compiler to insert these indirections statically, it insert them at runtime with binary rewriting. Binary rewriting is the process of writing low-level code into the memory image of a running native program to re-direct functions. While this requires no static analysis of a program, it is highly platform-dependent.

Ekiden and Kitsune load new program code via starting an entirely new program, either through fork-exec or dynamic loading. The existing program state is then transferred to the new program space.[6][7]

During an update, program state must be transformed from the original representation to the new version's representation. This is referred to as state transformation. A function which transforms a state object or group of objects is referred to as a transformer function or state transformer.

DSU systems can either attempt to synthesize transformer functions, or require that the developer manually supply them. Some systems mix these approaches, inferring some elements of transformers while requiring developer input on others.

These transformer functions can either be applied to program state lazily, as each piece of old-version state is accessed, or eagerly, transforming all state at update time. Lazy transformation ensures that the update will complete in constant time, but also incurs steady-state overhead on object access. Eager transformation incurs more expense at the time of update, requiring the system to stop the world while all transformers run. However, eager transformation allows compilers to fully optimize state access, avoiding the steady-state overhead involved with lazy transformation.

Most DSU systems attempt to show some safety properties for updates. The most common variant of safety checking is type safety, where an update is considered safe if it does not result in any new code operating on an old state representation, or vice versa.

Type safety is typically checked by showing one of two properties, activeness safety or cons-freeness safety. A program is considered activeness-safe if no updated function exists on the call stack at update time. This proves safety because control can never return to old code that would access new representations of data.

Cons-Freeness is another way to prove type safety, where a section of code is considered safe if it does not access state of a given type in a way that requires knowledge of the type representation. This code can be said to not access the state concretely, while it may access the state abstractly. It is possible to prove or disprove cons-freeness for all types in any section of code, and the DSU system Ginseng uses this to prove type safety.[8][9] If a function is proven cons-free, it can be updated even if it is live on the stack, since it will not cause a type error by accessing state using the old representation.

Empirical analysis of cons-freeness and activeness safety by Hayden et al. show that both techniques permit most correct updates and deny most erroneous updates. However, manually selecting update points results in zero update errors, and still allows frequent update availability.[5]

• Hot swapping § Software
• Persistence (computer science)
• Runtime verification

• Ksplice homepage
• Ksplice source code
• Ginseng Project Page and Source Code/ UpStare Paper/ PoLUS paper
• Erlang homepage
• Katana homepage
• Whitepaper blog post on Visual C++ patching