linux-kernel - [RFC PATCH bpf-next v1 0/3] bpf: Add BPF program type for overriding tracepoint probes

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20250917072242.674528-1-zhaofuyu@vivo.com>
Date: Wed, 17 Sep 2025 15:22:39 +0800
From: Fuyu Zhao <zhaofuyu@...o.com>
To: ast@...nel.org,
	daniel@...earbox.net,
	andrii@...nel.org,
	martin.lau@...ux.dev,
	song@...nel.org,
	yonghong.song@...ux.dev,
	haoluo@...gle.com,
	jolsa@...nel.org,
	eddyz87@...il.com,
	kpsingh@...nel.org,
	sdf@...ichev.me,
	rostedt@...dmis.org,
	mhiramat@...nel.org,
	mathieu.desnoyers@...icios.com,
	shuah@...nel.org,
	willemb@...gle.com,
	kerneljasonxing@...il.com,
	paul.chaignon@...il.com,
	chen.dylane@...ux.dev,
	memxor@...il.com,
	martin.kelly@...wdstrike.com,
	zhaofuyu@...o.com,
	ameryhung@...il.com,
	linux-kernel@...r.kernel.org,
	bpf@...r.kernel.org,
	linux-trace-kernel@...r.kernel.org,
	linux-kselftest@...r.kernel.org
Cc: yikai.lin@...o.com
Subject: [RFC PATCH bpf-next v1 0/3] bpf: Add BPF program type for overriding tracepoint probes

Hi everyone,

This patchset introduces a new BPF program type that allows overriding
a tracepoint probe function registered via register_trace_*.

Motivation
----------
Tracepoint probe functions registered via register_trace_* in the kernel
cannot be dynamically modified, changing a probe function requires recompiling
the kernel and rebooting. Nor can BPF programs change an existing
probe function.

Overiding tracepoint supports a way to apply patches into kernel quickly
(such as applying security ones), through predefined static tracepoints,
without waiting for upstream integration.

This patchset demonstrates the way to override probe functions by BPF program.

Overview
--------
This patchset adds BPF_PROG_TYPE_RAW_TRACEPOINT_OVERRIDE program type.
When this type of BPF program attaches, it overrides the target tracepoint
probe function.

And it also extends a new struct type "tracepoint_func_snapshot", which extends
the tracepoint structure. It is used to record the original probe function
registered by kernel after BPF program being attached and restore from it
after detachment. 

Critical steps
--------------

1. Attach: Attach programs via the raw_tracepoint_open syscall.
2. Override: 
   (a) Locate the target probe by `probe_name`.
   (b) Override target probe with the BPF program.
   (c) Save the BPF program and target probe function into "tracepoint_func_snapshot".
3. Restore: When the BPF program is detached, automatically restore
   the original probe function from earlier saved snapshot.

Future work
-----------
This patchset is intended as a first step toward supporting BPF programs
that can override tracepoint probes. The current implementation may not yet
cover all use cases or handle every corner case.

I welcome feedback and suggestions from the community, and will continue to
refine and improve the design based on comments and real-world requirements.

Thanks!
Fuyu

Fuyu Zhao (3):
  bpf: Introduce BPF_PROG_TYPE_RAW_TRACEPOINT_OVERRIDE
  libbpf: Add support for BPF_PROG_TYPE_RAW_TRACEPOINT_OVERRIDE
  selftests/bpf: Add selftest for "raw_tp.o"

 include/linux/bpf_types.h                     |   2 +
 include/linux/trace_events.h                  |   9 +
 include/linux/tracepoint-defs.h               |   6 +
 include/linux/tracepoint.h                    |   3 +
 include/uapi/linux/bpf.h                      |   2 +
 kernel/bpf/syscall.c                          |  35 +++-
 kernel/trace/bpf_trace.c                      |  31 +++
 kernel/tracepoint.c                           | 190 +++++++++++++++++-
 tools/include/uapi/linux/bpf.h                |   2 +
 tools/lib/bpf/bpf.c                           |   1 +
 tools/lib/bpf/bpf.h                           |   3 +-
 tools/lib/bpf/libbpf.c                        |  27 ++-
 tools/lib/bpf/libbpf.h                        |   3 +-
 .../bpf/prog_tests/raw_tp_override_test_run.c |  23 +++
 .../bpf/progs/test_raw_tp_override_test_run.c |  20 ++
 .../selftests/bpf/test_kmods/bpf_testmod.c    |   7 +
 16 files changed, 352 insertions(+), 12 deletions(-)
 create mode 100644 tools/testing/selftests/bpf/prog_tests/raw_tp_override_test_run.c
 create mode 100644 tools/testing/selftests/bpf/progs/test_raw_tp_override_test_run.c

-- 
2.43.0