Re: [RFC PATCH bpf-next v1 0/3] bpf: Add BPF program type for overriding tracepoint probes

[Fuyu Zhao]

On 9/18/2025 4:02 AM, Song Liu wrote:
> On Wed, Sep 17, 2025 at 12:23 AM Fuyu Zhao <zhaofuyu@xxxxxxxx> wrote:
>>
>> Hi everyone,
>>
>> This patchset introduces a new BPF program type that allows overriding
>> a tracepoint probe function registered via register_trace_*.
>>
>> Motivation
>> ----------
>> Tracepoint probe functions registered via register_trace_* in the kernel
>> cannot be dynamically modified, changing a probe function requires recompiling
>> the kernel and rebooting. Nor can BPF programs change an existing
>> probe function.
>>
>> Overiding tracepoint supports a way to apply patches into kernel quickly
>> (such as applying security ones), through predefined static tracepoints,
>> without waiting for upstream integration.
> 
> IIUC, this work solves the same problem as raw tracepoint (raw_tp) or raw
> tracepoint with btf (tp_btf).
> 
> Did I miss something?
> 
> Thanks,
> Song

As I understand it, raw tracepoints (raw_tp) and raw tracepoint (raw_tp)
are designed mainly for tracing the kernel. The goal of this work is to
provide a way to override the tracepoint callback, so that kernel behavior
can be adjusted dynamically.

Thanks,
Fuyu