hi,
we recently had several requests for tetragon to be able to change
user application function return value or divert its execution through
instruction pointer change.

This patchset adds support for uprobe program to change app's registers
including instruction pointer.

v3 changes:
- deny attach of kprobe,multi with kprobe_write_ctx set [Alexei]
- added more tests for denied kprobe attachment

thanks,
jirka


---
Jiri Olsa (6):
      bpf: Allow uprobe program to change context registers
      uprobe: Do not emulate/sstep original instruction when ip is changed
      selftests/bpf: Add uprobe context registers changes test
      selftests/bpf: Add uprobe context ip register change test
      selftests/bpf: Add kprobe write ctx attach test
      selftests/bpf: Add kprobe multi write ctx attach test

 include/linux/bpf.h                                        |   1 +
 kernel/events/core.c                                       |   4 +++
 kernel/events/uprobes.c                                    |   7 +++++
 kernel/trace/bpf_trace.c                                   |   7 +++--
 tools/testing/selftests/bpf/prog_tests/attach_probe.c      |  28 +++++++++++++++++
 tools/testing/selftests/bpf/prog_tests/kprobe_multi_test.c |  27 ++++++++++++++++
 tools/testing/selftests/bpf/prog_tests/uprobe.c            | 156 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++-
 tools/testing/selftests/bpf/progs/kprobe_write_ctx.c       |  22 +++++++++++++
 tools/testing/selftests/bpf/progs/test_uprobe.c            |  38 +++++++++++++++++++++++
 9 files changed, 287 insertions(+), 3 deletions(-)
 create mode 100644 tools/testing/selftests/bpf/progs/kprobe_write_ctx.c

On Tue, Sep 9, 2025 at 8:39 AM Jiri Olsa <jolsa@kernel.org> wrote:
>
> hi,
> we recently had several requests for tetragon to be able to change
> user application function return value or divert its execution through
> instruction pointer change.
>
> This patchset adds support for uprobe program to change app's registers
> including instruction pointer.
>
> v3 changes:
> - deny attach of kprobe,multi with kprobe_write_ctx set [Alexei]
> - added more tests for denied kprobe attachment
>
> thanks,
> jirka
>
>
> ---
> Jiri Olsa (6):
>       bpf: Allow uprobe program to change context registers
>       uprobe: Do not emulate/sstep original instruction when ip is changed
>       selftests/bpf: Add uprobe context registers changes test
>       selftests/bpf: Add uprobe context ip register change test
>       selftests/bpf: Add kprobe write ctx attach test
>       selftests/bpf: Add kprobe multi write ctx attach test
>

For the series:

Acked-by: Andrii Nakryiko <andrii@kernel.org>

Question is which tree will this go through? Most changes are in BPF,
so probably bpf-next, right?

>  include/linux/bpf.h                                        |   1 +
>  kernel/events/core.c                                       |   4 +++
>  kernel/events/uprobes.c                                    |   7 +++++
>  kernel/trace/bpf_trace.c                                   |   7 +++--
>  tools/testing/selftests/bpf/prog_tests/attach_probe.c      |  28 +++++++++++++++++
>  tools/testing/selftests/bpf/prog_tests/kprobe_multi_test.c |  27 ++++++++++++++++
>  tools/testing/selftests/bpf/prog_tests/uprobe.c            | 156 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++-
>  tools/testing/selftests/bpf/progs/kprobe_write_ctx.c       |  22 +++++++++++++
>  tools/testing/selftests/bpf/progs/test_uprobe.c            |  38 +++++++++++++++++++++++
>  9 files changed, 287 insertions(+), 3 deletions(-)
>  create mode 100644 tools/testing/selftests/bpf/progs/kprobe_write_ctx.c