when are section names needed for ebpf programs

Question

When are section names needed with eBPF programs and when are they not necessary? This example does not specify a section for the kprobe while the example here does.

Answer 1

Section names are typically used to give the loader information about the BPF program, such as its type, its position in a tail call map, the type of attachment point, etc. Some loaders, such as bcc, support other ways of passing this information, either via the function name or explicitly in the loader's code.

---

Your first example shows a bcc program. In that example, the type of BPF program (kprobe) and the attachment point (kernel function oom_kill_process) are both given by the function name (kprobe__oom_kill_process), per the bcc convention. bcc also allows you to set the program type on the Python side, with:

b = BPF(src_file="example.c")
tail_fn = b.load_func(function_name, BPF.KPROBE)

Your second example seems to follow the libbpf convention. In that case, the section name is used to pass the type of BPF program, the type of attachment, whether it's a sleepable program, etc.