On Mon, 18 May 2026 08:23:14 -0700
Mykyta Yatsenko <[email protected]> wrote:
> BPF and other consumers that want to attach to or decode a generic
> tracepoint need three pieces of BTF information for it:
>
> - the BTF of the object that owns the tracepoint's types
> - the FUNC_PROTO describing the tracepoint arguments (with names),
> consumed by raw_tp / tp_btf BPF programs
> - the STRUCT id of trace_event_raw_<call>, the ring-buffer record
> consumed by classic BPF_PROG_TYPE_TRACEPOINT programs
>
> Today none of this is easily discoverable from userspace. The kernel
> knows the ids - resolve_btfids fills them in at link time - but
> consumers have to search them by the naming convention
> ("__bpf_trace_<name>", "trace_event_raw_<name>"), walking BTF for
> every tracepoint.
I'll pull this in even though it adds 100K to the kernel:
text data bss dec hex filename
40506047 15709518 16661184 72876749 45802cd
/tmp/vmlinux.new
40499064 15615294 16661184 72775542 4567776
/tmp/vmlinux.old
-- Steve
