This paper presents Rubah, a new dynamic software updating (DSU) system for Java programs that works on stock JVMs. Rubah supports a large range of program changes (e.g., changes to the class hierarchy and updates to running methods), does not restrict important programming idioms (e.g., reflection), and, as shown by performance experiments using an updatable version of the H2 database management system, imposes low overhead on normal execution.
Security patches protect an application from discovered vulnerabilities and should be applied as fast as possible. On the other hand, patching the application reduces the availability of the service due to the necessary restart. System administrators need to balance system availability with a potential compromise of system integrity. A dynamic software update mechanism applies security updates on the fly but does not protect from unknown vulnerabilities. Software-based fault isolation on the other hand uses a sandbox to protect the integrity of a system by detecting unpatched vulnerabilities but provides no mechanism to repair any vulnerabilities. This paper presents DynSec, a mechanism for on-thefly code rewriting and repair that dynamically applies security patches for unmodified binary applications. A sandbox protects the integrity of the system while the dynamic update mechanism increases the availability of the application. A prototype implementation that needs no a-priori cooperation from the application incurs a combined overhead of 11% on the SPEC CPU2006 benchmarks for the sandbox and the dynamic update mechanism.
Software updates in embedded systems are typically performed by bringing the system to stop, replacing the software and restarting the system. This process can in certain cases be very time consuming and costly, which leads to less frequent software updates. In order to establish both long uptime and up-to-date software, the software must be updated during runtime. This paper presents a runtime updating framework for embedded systems capable of replacing parts of software without stopping the system. The framework is based on FreeRTOS and mechanisms have been added to dynamically link and re-link FreeRTOS tasks to the system during runtime. Our framework enables the programmer to easily create updatable software with simple annotations to the program. Experiments demonstrate the benefits of updating software during runtime with an acceptable overhead when transferring the application state.
We present a novel methodology for deriving fine-grained patches of Java software. We consider an abstract-syntax tree (AST) representation of Java classes compiled to the Java Virtual Machine (JVM) format, and a difference analysis over the AST representation to derive patches. The AST representation defines an appropriate abstraction level for analyzing differences, yielding compact patches that correlate modularly to actual source code changes. The approach contrasts to other common, coarse-grained approaches, like plain binary differences, which may easily lead to disproportionately large patches. We present the main traits of the methodology, a prototype tool called aspa that implements it, and a case-study analysis on the use of aspa to derive patches for the Java 2 SE API. The case-study results illustrate that aspa patches have a significantly smaller size than patches derived by binary differencing tools.
This paper presents PyMoult, a Python library implementing various dynamic software update (DSU) mechanisms. This library aims to provide a prototyping platform for experimenting with DSU and to implement a vast choice of update mechanisms while allowing their combination and customization. We selected different update mechanisms from the literature and implemented them in PyMoult.This paper focuses on how we implemented these mechanisms and discusses the cost of implementing DSU in Python.
We describe an algorithm for efficient formal verification of changes in software built on top of a model-checking procedure that traverses the control flow graph explicitly while representing the data symbolically. The main idea of our algorithm is to guide the control flow graph exploration first to the paths that traverse through the changed nodes in the graph. We implemented this idea on top of the concolic model checker ExpliSAT and the experimental results on real programs show a significant improvement in performance compared to re-verification of the whole program, when the change involves a small fraction of paths on the control flow graph.
Deploying and upgrading software systems is typically a labourious, error prone and tedious task. To deal with the complexity of a software deployment process and to make this process more reliable, we have developed Nix, a purely functional package manager as well as an extension called Disnix, capable of deploying service-oriented systems in a network of machines. Nix and its applications only support deployment of immutable components, which never change after they have been built. However, not all components of a software system are immutable, such as databases. These components must be deployed by other means, which makes deployment and upgrades of such systems difficult, especially in large networks. In this paper, we analyse the properties of mutable components and we propose Dysnomia, a deployment extension for mutable components.
Dynamic software updating (DSU) techniques show great promise in allowing vital software services to be upgraded without downtime, avoiding dropped connections and the loss of critical program state. For multithreaded programs, DSU systems must balance correctness and timeliness. To simplify reasoning that an update is correct, we could limit updates to take place only when all threads have blocked at well-defined update points. However, several researchers have pointed out that this approach poses the risk of delaying an update for too long, even indefinitely, and therefore have developed fairly complicated mechanisms to mitigate the risk. This paper argues that such mechanisms are unnecessary by demonstrating empirically that many multithreaded programs can be updated with minimal delay using only a small number of manually annotated update points. Our study of the time taken for all of the threads in six real-world, event-driven programs to reach their update points ranged from 0.155 to 107.558 ms, and most were below 1 ms.
In this paper, we propose the use of a Software Transactional Memory to implement a Dynamic Software Upgrade system that combines two desirable properties. First, it provides a simple semantics to the developer, while allowing upgrades to occur atomically, concurrently with the execution of the program. Second, it converts the program's data lazily, as data is progressively accessed by the execution of the upgraded program. We present also experimental results that show that our lazy approach to software upgrades is able to upgrade a system without affecting significantly the maximum response time of the system's operations, whereas an immediate approach shows values of maximum response time up to three orders of magnitude higher.
We consider the overhead incurred by programs that can be updated dynamically and argue that, in general, and regardless of the mechanism used, the program must incur an overhead during normal execution. We argue that the overhead during normal execution of the updateable program need not be as high as the overhead for the updated program. In light of the fundamental limitations and the differences in the overhead that must be incurred by the updateable and updated programs, we propose a new mechanism for dynamic software update based on a new shifting gears approach. The mechanism attempts to incur just the required overhead depending on the stage of update the application is in. Before an update the execution incurs low overhead and when an update occurs the execution incurs higher overhead which reverts to low overhead as the execution progresses. We evaluate the mechanism by modifying an application by hand. Preliminary performance numbers show that the mechanism performs better than existing mechanisms for dynamic software update.
Software updates present a difficult challenge to the software maintenance process. Too often, updates result in failures, and users face the uncomfortable choice between using an old stable version which misses recent features and bug fixes, and using a new version which improves the software in certain ways, only to introduce other bugs and security vulnerabilities.In this position paper, we propose a radically new approach for performing software updates: whenever a new update becomes available, instead of upgrading the software to the new version, we instead run the new version in parallel with the old one. By carefully coordinating their executions and selecting the behavior of the more reliable version when they diverge, we can preserve the stability of the old version without giving up the features and bug fixes added to the new version.We are currently focusing on a prototype system targeting multicore CPUs, but we believe this approach could also be deployed on other parallel platforms, such as GPGPUs and cloud environments.
Traditional live update systems offer little or no automated support for state transfer between two different program versions with changes in the program state. In this paper, we report our efforts to build a safe and automated state transfer framework for C programs that requires a minimal number of program state annotations and handles common structural state changes with no programmer assistance. To handle more complex state transformations, the framework includes a number of extension mechanisms designed to minimize the overall programming effort. Our experience with real-world programs suggests that our framework can handle all the standard C idioms and support safe and automated state transfer for complex state changes. We believe our approach is effective in several update scenarios and significantly raises the bar on the security and reliability of live update.
Dynamic Software Updating (DSU) has been an active topic of research for at least the last 30 years. However, despite many recent advances, DSU has yet to see widespread adoption and deployment in practice. In this paper, we review a slice of the history of DSU research to study how DSU for C has evolved over the last two decades. We examine the ways DSU systems are evaluated in the research literature. We identify several shortcomings of the evaluation criteria that have been used, and propose key improvements. We believe that using better evaluation criteria can guide DSU research to produce systems that will be more practical, flexible, and usable.
We present a novel approach to update server applications in Java. In our approach, different versions of the code coexist in the system, but are isolated into distinct contexts. The server can switch from one context to another incrementally in order to process incoming requests. Our approach has the following characteristics: (1) updatability is defined and added to the application by developers, (2) no syntax is added to the language and the update is controlled via the manipulation of objects, (3) the whole system is migrated lazily and eventually replaces the old system, (4) it is safe to update global entities anytime and there is no need to reach update points. We demonstrate our approach by updating the Jetty web server.
This paper describes Edition-Based Redefinition (EBR) in the Oracle database --- a novel technology and methodology to build database application patches so that installation of these patches does not require application downtime. It discusses the challenge of zero-downtime application patch installation and shows how EBR can meet the challenge. Customer experience shows that EBR provides online application upgrade in several industries.
Year after year, the frequency of updated releases of software continues to increase. Without an automated install process, the result is either that a system installs software with known defects and/or vulnerabilities, or systems require increased manual labor to maintain up-to-date software installations. Linux packages, in conjunction with repositories, fill this need for automation to reduce both undesirable situations. This model can be modified to a generic operating system environment, such as Windows, which currently lacks the capability to update arbitrary software applications. Our application, Appupdater, demonstrates this concept of detecting, downloading, and installing upgrades automatically. This provides a completely automated upgrade cycle.
Many real-world systems require continuous operation. Downtime is ill-affordable and scheduling maintenance for regular software updates is a tremendous challenge for system administrators. For this reason, live update is a potential solution as it allows running software to be replaced by a newer version without stopping the system. The vast majority of live update approaches proposed as a solution to this problem aims to support existing software systems, while striving to maintain a good level of safety and flexibility. In this paper, we consider the opposite direction. Our work aims to build dependable and trustworthy live updatable systems that do not attempt to be backward compatible but look forward to solving the update problem in future systems. To this end, we highlight possible issues and limitations in existing approaches and propose a new cooperative model for live update to provide better safety and flexibility guarantees.
Seamlessly updating software in running systems has recently gained momentum. Dynamically updating the software of real-time embedded systems, however, still poses numerous challenges: such systems must meet hard deadlines, cope with limited resources, and adhere to high safety standards. This paper presents a solution for updating component-based cyclic embedded systems without violating real-time constraints. In particular, it investigates how to identify points in time at which updates can be performed and how to transfer the state of a component to a new version of the same component. We also present experimental results to validate the proposed solution.
Recent years have seen significant advances in dynamic software updating (DSU) systems, which allow programs to be patched on the fly. However, a significant challenge remains: How can we ensure the act of applying a patch does not itself introduce errors? In this paper, we address this problem by presenting a new systematic testing methodology for updatable programs. Our idea is to transform standard system tests into update tests that execute as before, but each transformed test applies a patch at a different update point during execution. To mitigate the increase in the number of tests, we developed an algorithm for test suite minimization that finds a subset of update points that, if fully tested, yields the equivalent to full update point coverage. We implemented our approach and evaluated it on OpenSSH and vsftpd, two widely used server applications. We found that minimization is highly effective, reducing the number of update tests required for full coverage by 93%.
