Re: [RFC PATCH bpf-next v1 0/3] bpf: Add BPF program type for overriding tracepoint probes

[Song Liu]

On Wed, Sep 17, 2025 at 12:23 AM Fuyu Zhao <zhaofuyu@xxxxxxxx> wrote:
>
> Hi everyone,
>
> This patchset introduces a new BPF program type that allows overriding
> a tracepoint probe function registered via register_trace_*.
>
> Motivation
> ----------
> Tracepoint probe functions registered via register_trace_* in the kernel
> cannot be dynamically modified, changing a probe function requires recompiling
> the kernel and rebooting. Nor can BPF programs change an existing
> probe function.
>
> Overiding tracepoint supports a way to apply patches into kernel quickly
> (such as applying security ones), through predefined static tracepoints,
> without waiting for upstream integration.

IIUC, this work solves the same problem as raw tracepoint (raw_tp) or raw
tracepoint with btf (tp_btf).

Did I miss something?

Thanks,
Song