一句话：用多版本执行让动态软件更新先在副本中试运行，意外分歧即回滚，降低更新停顿与出错风险。
动态软件更新（DSU）能在不停止有状态软件的前提下打补丁，兼顾及时更新与不间断服务。但更新本身（无论是改动代码还是动态引入改动的方式）若存在缺陷，可能导致更新后的软件崩溃或行为异常；此外，动态应用更新所需时间若过长，也会造成不可接受的服务延迟。本文的核心观察是：这两个问题都可以借助多版本执行（MVE）来解决。更新在 fork 出的副本上应用，原系统继续对外服务，从而避免服务延迟；更新完成后，MVE 系统监控两个版本对同一输入的响应是否一致。程序员用 MVE 专用 DSL 描述预期内的分歧；意外分歧则视为潜在错误并回滚更新，即终止新版本、退回原版本，这一过程之所以安全，是因为 MVE 系统始终同步维护两个版本的状态。若新版本在预热期后未暴露问题，运维人员可将其转为永久版本并丢弃原版本。作者通过把 Varan（一个先进的 MVE 系统）集成进 Kitsune DSU 框架实现了 MVEDSUA，并在 Redis、Memcached 与 VSFTPD 等高性 能服务器上进行了更新实验。结果表明，MVEDSUA 显著缩短了更新时延，稳态开销很小，并且能轻松从错误中恢复。
Dynamic Software Updating (DSU) is a technique for patching stateful software without shutting it down, which enables both timely updates and non-stop service. Unfortunately, bugs in the update itself---whether in the changed code or in the way the change is introduced dynamically---may cause the updated software to crash or misbehave. Furthermore, the time taken to dynamically apply the update may be unacceptable if it introduces a long delay in service. This paper makes the key observation that both problems can be addressed by employing Multi-Version Execution (MVE). To avoid delay in service, the update is applied to a forked copy while the original system continues to operate. Once the update completes, the MVE system monitors that the responses of both versions agree for the same inputs. Expected divergences are specified by the programmer using an MVE-specific DSL. Unexpected divergences signal possible errors and roll back the update, which simply means terminating the updated version and reverting to the original version. This is safe because the MVE system keeps the state of both versions in sync. If the new version shows no problems after a warmup period, operators can make it permanent and discard the original version. We have implemented this approach, which we call MVEDSUa, by extending the Kitsune DSU framework with Varan, a state-of-the-art MVE system. We have used MVEDSUa to update several high-performance servers: Redis, Memcached, and VSFTPD. Our results show that MVEDSUa significantly reduces the update-time delay, imposes little overhead in steady state, and easily recovers from a
DOI 原文 ·
@inproceedings{paperbot4906,
title = {MVEDSUA},
author = {Luís Pina and Anastasios Andronidis and Michael Hicks and Cristian Cadar},
booktitle = {ASPLOS},
year = {2019},
doi = {10.1145/3297858.3304063}
}