[PATCH] Linux Kernel Markers

[Frank Ch. Eigler]

Martin Bligh <mbligh@google.com> writes:

> [...]  "compiled anew from original sources after deployment" seems
> the most practical to do to me.  From second hand info on using
> systemtap, you seem to need the same compiler and source tree to
> work from anyway [...]

Not quite.  Systemtap does not look at sources, only object code and
its embedded debugging information.  (How many distributions keep
around compilable source trees?)

> [...] It seems like all we'd need to do is "list all references to
> function, freeze kernel, update all references, continue", [...]

One additional problem are external references made *by* the function.
Those too would all have to be relocated to the live data.

Live code patching is theoretically useful for all kinds of things,
but I've never heard it described as relatively simple before! :-)

- FChE