On Wed, 23 Apr 2025 14:21:24 -0700 Andrii Nakryiko <andrii.nakry...@gmail.com> wrote:
> BPF by itself doesn't have any API to list tracepoints, so in that > sense, no, BPF doesn't expose *the list* of those tracepoints. But the > same can be said about kprobes or normal tracepoints. But it is > allowed to attempt to attach to those tracepoints by just specifying > their name as a string. > > I guess I'm confused about what "accessing only from code within the > kernel" means. In my mind BPF isn't really "code within the kernel", > but we are getting into the philosophical area now :) I just wanted to > point out that this is consumable/attachable with BPF just like any > other tracepoint, so it's not just kernel/module code that can attach > to them. To continue the philosophical debate ;-) I'll argue that a BPF program runs inside the kernel just like a module would. Hence, a BPF program is in kernel space. In fact, from what I understand, that's the entire point of BPF. To run in kernel space! -- Steve
