Safe and timely updates to multi-threaded programs

Abstract

Many dynamic updating systems have been developed that enable a program to be patched while it runs, to fix bugs or add new features. This paper explores techniques for supporting dynamic updates to multi-threaded programs, focusing on the problem of applying an update in a timely fashion while still producing correct behavior. Past work has shown that this tension of safety versus timeliness can be balanced for single-threaded programs. For multi-threaded programs, the task is more difficult because myriad thread interactions complicate understanding the possible program states to which a patch could be applied. Our approach allows the programmer to specify a few program points (e.g., one per thread) at which a patch may be applied, which simplifies reasoning about safety. To improve timeliness, a combination of static analysis and run-time support automatically expands these few points to many more that produce behavior equivalent to the originals. Experiments with thirteen realistic updates to three multi-threaded servers show that we can safely perform a dynamic update within milliseconds when more straightforward alternatives would delay some updates indefinitely.

Dynamic software updates

“…Boyapati et al [11] implement this model, as described in Section 5. Our experience and that of others [5,32,30,24] indicate that our model expresses many updates well. We leave to future work a detailed investigation of the semantics and expressiveness of both models.…”

“…JVOLVE takes the opposite tack of forcing old object fields to point to up-to-date objects, and thus requires no special language support. Moreover, JVOLVE's model follows that of earlier work [5,32,30,24] which has proven its effectiveness on a half-dozen realistic applications across several years' worth of releases. However, further research to understand the costs and benefits of the two updating models would be useful.…”

“…JVOLVE installs a return barrier on this method, but with many active sessions, this method is essentially always on stack, preventing the update. Future work could address this problem using scheduler support for coordinating updates among active threads [30].…”

“…This approach does not guarantee JVOLVE will reach a DSU safe point, but in our multithreaded benchmarks it does in nearly all cases. More sophisticated thread scheduling support could attain greater flexibility [30].…”

Incremental Dynamic Updates with First-class Contexts.

“…Such updates are inherently unsafe if performed at an arbitrary point in time: running threads might run both old and new code in an incoherent manner while old methods on the stack might presume type signatures that are no longer valid, possibly leading to run-time type errors. Quiescent global update points must be selected to ensure safe updates, but such points may be difficult to reach for multi-threaded systems [NH09,SHM09]. More generally, a global update might not be possible due to the nature of the change, for example it would fail to update anonymous connections to an FTP server that mandates authentication after the update: the missing information cannot be provided a posteriori [NHSO06].…”