In BPF Types
it explains to developers about how to understand type/extras
in libbpf API. As examples, there are such types as fentry and uprobe, types of which are however described to be:
uprobe.s+/...
fentry.s+/...
In [Footnotes], it uses a uprobe[.s]
denotation without explain. Is it an part of regular expression or immediate literals to append when I declare using SEC() macro?
TL;DR. The .s
part is interpreted literally and means the program is sleepable.
These section formats are defined in array section_defs
in libbpf: https://elixir.bootlin.com/linux/v6.7.1/source/tools/lib/bpf/libbpf.c#L8894. We can see the two formats for uprobes side-by-side:
SEC_DEF("uprobe+", KPROBE, 0, SEC_NONE, attach_uprobe),
SEC_DEF("uprobe.s+", KPROBE, 0, SEC_SLEEPABLE, attach_uprobe),
The only difference is thus that the .s format is sleepable. We can find the same pattern for sleepable uretprobes, multi-uprobes, USDT, LSM, etc.
An example of such program can be found in the BPF selftests: https://elixir.bootlin.com/linux/v6.7.1/source/tools/testing/selftests/bpf/progs/test_attach_probe.c#L90.