On Thu, 31 Mar 2022 21:48:36 -0400 Steven Rostedt <rostedt@xxxxxxxxxxx> wrote: > > Does this make sense to you? Did I miss something? > > I thought the BPF trampoline does: > > call bpf_trace_before_function > call original_function + X86_PATCH_SIZE > call bpf_trace_after_function > > Thus, the bpf direct trampoline calls the unpatched version of the > function call making the live patch useless. Or is this not what it > does? Or perhaps you are only talking about the part of bpf that does not trace the end of a function? -- Steve
