Kitsune: Efficient, General-purpose Dynamic Software Updating for CChristopher M. Hayden Edward K. Smith Michail DenchevMichael Hicks Jeffrey S. FosterUniversity of Maryland, College Park, USA{hayden,tedks,mdenchev,mwh,jfoster}@cs.umd.eduAbstractDynamic software updating (DSU) systems allow programsto be updated while running, thereby permitting developersto add features and fix bugs without downtime. This paperintroduces Kitsune, a new DSU system for C whose designhas three notable features. First, Kitsune’s updating mecha-nism updates the whole program, not individual functions.This mechanism is more flexible than most prior approachesand places no restrictions on data representations or allowedcompiler optimizations. Second, Kitsune makes the impor-tant aspects of updating explicit in the program text, makingthe program’s semantics easy to understand while minimiz-ing programmer effort. Finally, the programmer can writesimple specifications to direct Kitsune to generate code thattraverses and transforms old-version state for use by newcode; such state transformation is often necessary, and issignificantly more difficult in prior DSU systems. We haveused Kitsune to update five popular, open-source, single- andmulti-threaded programs, and find that few program changesare required to use Kitsune, and that it incurs essentially noperformance overhead.Categories and Subject Descriptors C.4 [Performance ofSystems]: Reliability, availability, and serviceabilityGeneral Terms Design, LanguagesKeywords dynamic software updating1. IntroductionRunning software systems without incurring downtime isvery important in today’s 24/7 world. Dynamic softwareupdating (DSU) services can update programs with newcode—to fix bugs or add features—without shutting themdown. The research community has shown that general-Permission to make digital or hard copies of all or part of this work for personal orclassroom use is granted without fee provided that copies are not made or distributedfor profit or commercial advantage and that copies bear this notice and the full citationon the first page. To copy otherwise, to republish, to post on servers or to redistributeto lists, requires prior specific permission and/or a fee.OOPSLA’12, October 19–26, 2012, Tucson, Arizona, USA.Copyrightc 2012 ACM 978-1-4503-1561-6/12/10. . . $10.00purpose DSU is feasible: systems that support dynamic up-grades to running C, C++, and Java programs have been ap-plied to dozens of realistic applications, tracking changes ac-cording to those applications’ release histories [1, 5, 9, 12–14, 16, 17, 19]. Concurrently, industry has begun to packageDSU support into commercial products [2, 20].The strength of DSU is its ability to preserve programstate during an update. For example, servers for databases,media, FTP, SSH, and routing can maintain client connec-tions for unbounded time periods. DSU can allow thoseactive connections to immediately benefit from importantprogram updates (e.g., security fixes), whereas traditionalupdating strategies like rolling upgrades cannot. Serversmay also maintain significant in-memory state; examples in-clude memcached (a caching server) and redis (a key-valueserver). DSU techniques can maintain this in-memory stateacross the update, whereas traditional upgrade techniqueswill lose it (memcached) or must rely on an expensive diskreload that degrades performance (redis).We are interested in supporting general-purpose DSU forsingle- and multi-threaded C applications. While progressmade by existing DSU systems is promising, a truly prac-tical system must be in harmony with the main reasons de-velopers use C: control over low-level data representations;explicit resource management; legacy code; and, perhapsabove all, performance. In this paper we present Kitsune, anew DSU system for C that is the first to satisfy these motiva-tions while supporting general-purpose dynamic updates in aprogrammer-friendly manner. (We compare in detail againstrelated systems in Section 5.)Kitsune operates in harmony with C thanks to three keydesign and implementation choices. First, Kitsune uses en-tirely standard compilation. After a translation pass to addsome boilerplate calls to the Kitsune runtime, a Kitsune pro-gram is compiled and linked to form a shared object file(via a simple Makefile change). When a Kitsune programis launched, the runtime starts a driver routine that loads thefirst version’s shared object file and transfers control to it.When a dynamic update becomes available (only at specificprogram points, as discussed shortly), the program longjmpsback to the driver routine, which loads the new applicationversion and calls the new version’s main function. Thus, ap-plication code is updated all at once, and as a consequence,Kitsune places no restrictions on coding idioms or data rep-resentations; it allows the application’s internal structure tobe changed arbitrarily from one version to another; and itdoes not inhibit any compiler optimizations.Second, Kitsune gives the programmer explicit controlover the updating process, which is reflected as three kindsof additions to the original program: (1) a handful of callsto kitsune update(...), placed at the start of one or more ofthe program’s long-running loops, to specify update pointsat which dynamic updates may take effect; (2) code to ini-tiate data migration, where old-version data is assigned tonew-version variables (possibly after transformation to re-flect program changes); and (3) code to perform control mi-gration, which redirects execution to the corresponding up-date point in the new version. In our experience, these codeadditions are small (see below) and fairly easy to write be-cause of Kitsune’s simple semantics. (Section 2 explains Kit-sune’s use in detail.)Finally, Kitsune includes a novel tool called xfgen thatassists the programmer in writing code to migrate and trans-form old program state to be compatible with a new pro-gram version. The input to xfgen is a series of programmer-provided transformation specifications (“transformers” forshort), one per changed type or variable, that describe in in-tuitive notation how to translate data from the old to newformat. The output of xfgen is C code that performs state mi-gration, executing transformation wherever it is needed. At ahigh level, the generated code operates analogously to a trac-ing garbage collector, traversing the heap starting at globalvariables and