Search code examples
kernelebpflibbpf

What does "[.s]" mean as in "probe[.s]" type of BPF progs?


In BPF Types it explains to developers about how to understand type/extras in libbpf API. As examples, there are such types as fentry and uprobe, types of which are however described to be:

uprobe.s+/...
fentry.s+/...

In [Footnotes], it uses a uprobe[.s] denotation without explain. Is it an part of regular expression or immediate literals to append when I declare using SEC() macro?


Solution

  • TL;DR. The .s part is interpreted literally and means the program is sleepable.


    These section formats are defined in array section_defs in libbpf: https://elixir.bootlin.com/linux/v6.7.1/source/tools/lib/bpf/libbpf.c#L8894. We can see the two formats for uprobes side-by-side:

    SEC_DEF("uprobe+",      KPROBE, 0, SEC_NONE, attach_uprobe),
    SEC_DEF("uprobe.s+",    KPROBE, 0, SEC_SLEEPABLE, attach_uprobe),
    

    The only difference is thus that the .s format is sleepable. We can find the same pattern for sleepable uretprobes, multi-uprobes, USDT, LSM, etc.

    An example of such program can be found in the BPF selftests: https://elixir.bootlin.com/linux/v6.7.1/source/tools/testing/selftests/bpf/progs/test_attach_probe.c#L90.