struct kpatch_func {
  /* public */
  unsigned long new_addr;
  unsigned long new_size;
  unsigned long old_addr;
  unsigned long old_size;
  
  const char *name;
  struct list_head list;  // double linked list
  
  /* private */
  struct hlist_node node; // hashmap
  enum kpatch_op op;      // function status
  struct kobject kobj;    // sysfs
};

struct kpatch_object {
  struct list_head list;
  const char *name;
  // entries for functions to be patched in the object
  struct list_head funcs; 
  struct list_head dynrelas;

  // struct klp_callbacks 
  // functions to be executed pre/post (un)patching
  int (*pre_patch_callback)(...);
  void (*post_patch_callback)(...);
  void (*pre_unpatch_callback)(...);
  void (*post_unpatch_callback)(...);

  /* private */
  struct module *mod;  // kernel module
  struct kobject kobj; // sysfs
};

struct kpatch_module {
  /* public */
  struct module *mod;
  struct list_head objects; // entries for objects

  /* public read-only */
  bool enabled;

  /* private */
  struct list_head list;
  struct kobject kobj;
};

int kpatch_register(struct kpatch_module *kpmod, ...)
{
  // pre-condition
  down(&kpatch_mutex);
  try_module_get(kpmod->mod);

  // iterate patch modules
  list_for_each_entry(object, &kpmod->objects, list) {
    // Prepare patch module to be patched
    kpatch_link_object(kpmod, object);
    
    // set function state
    list_for_each_entry(func, &object->funcs, list)
      func->op = KPATCH_OP_PATCH;
  }
 
// continue...

  // memory barrier between func hash and state write
  smp_wmb();

  kpatch_state_updating();

  // verify activeness safety, and atomically make the new
  // functions visible to the ftrace handler.
  stop_machine(kpatch_apply_patch, kpmod, NULL);
  
  kpatch_state_idle();

  up(&kpatch_mutex);
  return 0;
}

static int kpatch_link_object(struct kpatch_module *kpmod,
                              struct kpatch_object *object)
{
  mutex_lock(&module_mutex);
  // find the object module
  find_module(object->name);
  try_module_get(mod);
  mutex_unlock(&module_mutex)
  
  list_for_each_entry(func, &object->funcs, list) {
    // lookup the old address by kallsyms_on_each_symbol 
    kpatch_find_object_symbol(...&func->old_addr);
    
    // add to ftrace filter and register handler if needed
    kpatch_ftrace_add_func(func->old_addr);
  }
}

static struct ftrace_ops kpatch_ftrace_ops __read_mostly = {
  .func = kpatch_ftrace_handler,
  .flags = FTRACE_OPS_FL_SAVE_REGS | FTRACE_OPS_FL_IPMODIFY,
}

int kpatch_ftrace_add_func(unsigned long ip)
{
  ftrace_set_filter_ip(&kpatch_ftrace_ops, ip, 0, 0);
}

void kpatch_ftrace_handler(unsigned long ip ...,
                           struct pt_regs *regs)
{
  preempt_disable_notrace();
  
  // find func from hash (hash_for_each_possible_rcu)
  func = kpatch_get_func(ip);
  regs->ip = func->new_addr + MCOUNT_INSN_SIZE;
  
  preempt_enable_notrace();
}

static int kpatch_apply_patch(void *data)
{
  kpatch_verify_activeness_safety(kpmod);
  
  // run any user-defined pre-patch callbacks
  list_for_each_entry(object, &kpmod->objects, list)
    pre_patch_callback();
  
  do_for_each_linked_func(kpmod, func)
    hash_add_rcu(khash, &func->node, func->old_addr);
  
  // memory barrier between func hash add and state change
  smp_wmb();
  kpatch_state_finish(KPATCH_STATE_SUCCESS);
  
  // run any user-defined post-patch callbacks
  list_for_each_entry(object, &kpmod->objects, list)
    post_patch_callback(object);
}

int kpatch_verify_activeness_safety(... *kpmod)
{
  struct task_struct *g, *t;
  
  // check the stacks of all tasks
  do_each_thread(g, t) {
    save_stack_trace_tsk(t, &trace);
    for (i = 0; i < trace.nr_entries; i++)
      // iterate kpatch functions compare to second argument
      kpatch_backtrace_address_verify(kpmod,
                                      trace.entries[i]);
  } while_each_thread(g, t);
}