For raw tracepoint program types libbpf will try to find btf_id of raw tracepoint in vmlinux's BTF. It's a responsiblity of bpf program author to annotate the program with SEC("raw_tracepoint/name") where "name" is a valid raw tracepoint. If "name" is indeed a valid raw tracepoint then in-kernel BTF will have "btf_trace_##name" typedef that points to function prototype of that raw tracepoint. BTF description captures exact argument the kernel C code is passing into raw tracepoint. The kernel verifier will check the types while loading bpf program. Signed-off-by: Alexei Starovoitov <ast@xxxxxxxxxx> --- tools/lib/bpf/libbpf.c | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c index e0276520171b..0e6f7b41c521 100644 --- a/tools/lib/bpf/libbpf.c +++ b/tools/lib/bpf/libbpf.c @@ -4591,6 +4591,22 @@ int libbpf_prog_type_by_name(const char *name, enum bpf_prog_type *prog_type, continue; *prog_type = section_names[i].prog_type; *expected_attach_type = section_names[i].expected_attach_type; + if (*prog_type == BPF_PROG_TYPE_RAW_TRACEPOINT) { + struct btf *btf = bpf_core_find_kernel_btf(); + char raw_tp_btf_name[128] = "btf_trace_"; + int ret; + + if (IS_ERR(btf)) + /* lack of kernel BTF is not a failure */ + return 0; + /* append "btf_trace_" prefix per kernel convention */ + strcpy(raw_tp_btf_name + sizeof("btf_trace_") - 1, + name + section_names[i].len); + ret = btf__find_by_name(btf, raw_tp_btf_name); + if (ret > 0) + *expected_attach_type = ret; + btf__free(btf); + } return 0; } pr_warning("failed to guess program type based on ELF section name '%s'\n", name); -- 2.20.0