Hi, On 9/22/2021 5:42 AM, Andrii Nakryiko wrote: > On Fri, Sep 17, 2021 at 6:56 PM Hou Tao <houtao1@xxxxxxxxxx> wrote: >> Program on writable tracepoint is BPF_PROG_TYPE_RAW_TRACEPOINT_WRITABLE, >> but its attachment is the same as BPF_PROG_TYPE_RAW_TRACEPOINT. >> >> Signed-off-by: Hou Tao <houtao1@xxxxxxxxxx> >> --- >> tools/lib/bpf/libbpf.c | 4 ++++ >> 1 file changed, 4 insertions(+) >> >> diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c >> index da65a1666a5e..981fcdd95bdc 100644 >> --- a/tools/lib/bpf/libbpf.c >> +++ b/tools/lib/bpf/libbpf.c >> @@ -7976,6 +7976,10 @@ static const struct bpf_sec_def section_defs[] = { >> .attach_fn = attach_raw_tp), >> SEC_DEF("raw_tp/", RAW_TRACEPOINT, >> .attach_fn = attach_raw_tp), >> + SEC_DEF("raw_tracepoint_writable/", RAW_TRACEPOINT_WRITABLE, >> + .attach_fn = attach_raw_tp), >> + SEC_DEF("raw_tp_writable/", RAW_TRACEPOINT_WRITABLE, >> + .attach_fn = attach_raw_tp), > _writable is a bit mouthful, maybe we should do the same we did for > "sleepable", just add ".w" suffix? So it will be "raw_tp.w/..."? Or > does anyone feel it's too subtle? raw_tp.w is fine to me. Will update it in v3. > >> SEC_DEF("tp_btf/", TRACING, >> .expected_attach_type = BPF_TRACE_RAW_TP, >> .is_attach_btf = true, >> -- >> 2.29.2 >> > .