Live-patching for the FreeBSD kernel
This project aims to add a livepatch subsystem to dynamically update kernel code. Having a way to patch bugs or security vulnerabilities without restarting the whole machine would be very useful, especially on servers, which make up the majority of FreeBSD usage. Patches will be delivered via kernel modules, utilizing ELF headers and CTF/DWARF metadata to accurately resolve internal symbols. The patching mechanism will redirect control flow by inserting trampolines at the prologue of target functions. To ensure system stability, patches will be safely applied using a stop-the-world consistency model via smp_rendezvous, with safeguards to prevent the modification of critical routines like the SYSINIT routines. Stack trace analysis will also be explored to more accurately detect function quiescence.
Project details
Technologies
Not listed in the archive