Martin Bligh <mbligh@xxxxxxxxxx> writes:
[...] "compiled anew from original sources after deployment" seems
the most practical to do to me. From second hand info on using
systemtap, you seem to need the same compiler and source tree to
work from anyway [...]
Not quite. Systemtap does not look at sources, only object code and
its embedded debugging information. (How many distributions keep
around compilable source trees?)
[...] It seems like all we'd need to do is "list all references to
function, freeze kernel, update all references, continue", [...]
One additional problem are external references made *by* the function.
Those too would all have to be relocated to the live data.
Live code patching is theoretically useful for all kinds of things,
but I've never heard it described as relatively simple before! :-)