# US 10,310,863 B1 · Patching functions in use on a running computer system > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,310,863 B1 - Document ID: US10310863B1 - Status: Granted - Kind: B1 - Application number: 13/955,937 - Filed: 2013-07-31 - Granted: 2019-06-04 - Earliest claimed: 2013-07-31 - Assignees: Red Hat, Inc. - Applicants: Red Hat, Inc. - Inventors: Joshua Nathan Poimboeuf; Steven David Rostedt - Web page: https://patentgrep.com/patent/US10310863B1 ## CPC - G06F 11/3636: {by tracing the execution of the program} - G06F 8/656: while running - G06F 11/3644: {by instrumenting at runtime} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A mechanism for patching functions in use on a running computer system. A method includes modifying an original function to call a hot patch function. The hot patch function transfers execution control from the original function to a replacement function. ## Claims ### Claim 1 A method comprising: receiving a call to an original function; modifying, by a processing device, the original function to call a hot patch function to transfer execution control from the original function to a replacement function by changing an initial instruction in the original function that specifies no operation to be executed to specifying that the call to the hot patch function is to be executed, wherein the hot patch function is conditionally applied to replace the original function in view of a number of calls to the original function that have been received by applying the hot patch function for a particular call for every defined number of calls that have been received and not applying the hot patch function for remaining calls for every defined number of calls that have been received; changing, by the processing device, a value of a pointer, in a data structure identifying a plurality of original functions used by an operating system, from an original memory location associated with the original function to a replacement memory location associated with the replacement function; executing, by the processing device, the replacement function using the pointer to the replacement memory location associated with the replacement function in the data structure identifying the plurality of original functions used by the operating system; and returning, by the processing device, to a caller of the original function in response to executing the replacement function. ### Claim 2 (depends on 1) The method of claim 1 wherein the hot patch function is associated with a security update for the original function. ### Claim 3 (depends on 1) The method of claim 1, further comprising: in response to executing the replacement function, changing a value of a register of the processing device to reflect another value of the original function, wherein the executing of the replacement function uses the another value of the original function. ### Claim 4 (depends on 3) The method of claim 3 further comprising calling the original function to execute the changed first instruction of the original function. ### Claim 5 (depends on 1) The method of claim 1, wherein the transferring execution control comprises returning from the hot patch function to the replacement function. ### Claim 6 (depends on 1) The method of claim 1 wherein the original function is modified during run time of the operating system. ### Claim 7 A system comprising: a memory; a processing device, operatively coupled with the memory, to: receive a call to an original function; modify the original function to call a hot patch function to transfer execution control from the original function to a replacement function by changing an initial instruction in the original function that specifies no operation to be executed to specifying that the call to the hot patch function is to be executed, wherein the hot patch function is conditionally applied to replace the original function in view of a number of calls to the original function that have been received by applying the hot patch function for a particular call for every defined number of calls that have been received and not applying the hot patch function for remaining calls for every defined number of calls that have been received; change a value of a pointer, in a data structure identifying a plurality of original functions used by an operating system, from an original memory location associated with the original function to a replacement memory location associated with the replacement function; execute the replacement function using the pointer to the replacement memory location associated with the replacement function in the data structure identifying the plurality of original functions used by the operating system; and return to a caller of the original function in response to executing the replacement function. ### Claim 8 (depends on 7) The system of claim 7, wherein the hot patch function is associated with a security update for the original function. ### Claim 9 (depends on 7) The system of claim 7, wherein the processing device is further to: in response to executing the replacement function, change a value of a register of the processing device to reflect another value of the original function, wherein the executing of the replacement function uses the another value of the original function. ### Claim 10 (depends on 9) The system of claim 9, the processing device to call the original function to execute the changed first instruction of the original function. ### Claim 11 (depends on 7) The system of claim 7, wherein to transfer execution control, the processing device is to return from the hot patch function to the replacement function. ### Claim 12 (depends on 7) The system of claim 7, wherein the original function is modified during run time of the operating system. ### Claim 13 A non-transitory machine-readable storage medium comprising data, when accessed by a processing device, cause the processing device to: receive a call to an original function; modify, by the processing device, the original function to call a hot patch function to transfer execution control from the original function to a replacement function by changing an initial instruction in the original function that specifies no operation to be executed to specifying that the call to the hot patch function is to be executed, wherein the hot patch function is conditionally applied to replace the original function in view of a number of calls to the original function that have been received by applying the hot patch function for a particular call for every defined number of calls that have been received and not applying the hot patch function for remaining calls for every defined number of calls that have been received; change, by the processing device, a value of a pointer, in a data structure identifying a plurality of original functions used by an operating system, from an original memory location associated with the original function to a replacement memory location associated with the replacement function; execute, by the processing device, the replacement function using the pointer to the replacement memory location associated with the replacement function in the data structure identifying the plurality of original functions used by the operating system; and return, by the processing device, to a caller of the original function in response to executing the replacement function. ### Claim 14 (depends on 13) The non-transitory machine-readable storage medium of claim 13, wherein the hot patch function is associated with a security update for the original function. ### Claim 15 (depends on 13) The non-transitory machine-readable storage medium of claim 13, wherein the processing device is further to: in response to executing the replacement function, change a value of a register of the processing device to reflect another value of the original function, wherein the executing of the replacement function uses the another value of the original function. ### Claim 16 (depends on 13) The non-transitory machine-readable storage medium of claim 13, wherein the processing device is to call the original function to execute the changed first instruction of the original function. ### Claim 17 (depends on 14) The non-transitory machine-readable storage medium of claim 14 wherein the first instruction is a no-op instruction.