On 9/18/2025 4:02 AM, Song Liu wrote:
> On Wed, Sep 17, 2025 at 12:23 AM Fuyu Zhao <[email protected]> wrote:
>>
>> Hi everyone,
>>
>> This patchset introduces a new BPF program type that allows overriding
>> a tracepoint probe function registered via register_trace_*.
>>
>> Motivation
>> ----------
>> Tracepoint probe functions registered via register_trace_* in the kernel
>> cannot be dynamically modified, changing a probe function requires
>> recompiling
>> the kernel and rebooting. Nor can BPF programs change an existing
>> probe function.
>>
>> Overiding tracepoint supports a way to apply patches into kernel quickly
>> (such as applying security ones), through predefined static tracepoints,
>> without waiting for upstream integration.
>
> IIUC, this work solves the same problem as raw tracepoint (raw_tp) or raw
> tracepoint with btf (tp_btf).
>
> Did I miss something?
>
> Thanks,
> Song
As I understand it, raw tracepoints (raw_tp) and raw tracepoint (raw_tp)
are designed mainly for tracing the kernel. The goal of this work is to
provide a way to override the tracepoint callback, so that kernel behavior
can be adjusted dynamically.
Thanks,
Fuyu
