selftests/bpf: Add tests for kprobe.session optimization

Extend existing kprobe_multi_test subtests to validate the
kprobe.session exact function name optimization:

In kprobe_multi_session.c, add test_kprobe_syms which attaches a
kprobe.session program to an exact function name (bpf_fentry_test1)
exercising the fast syms[] path that bypasses kallsyms parsing.  It
calls session_check() so bpf_fentry_test1 is hit by both the wildcard
and exact probes, and test_session_skel_api validates
kprobe_session_result[0] == 4 (entry + return from each probe).

In test_attach_api_fails, add fail_7 and fail_8 verifying error code
consistency between the wildcard pattern path (slow, parses kallsyms)
and the exact function name path (fast, uses syms[] array).  Both
paths must return -ENOENT for non-existent functions.

Signed-off-by: Andrey Grodzovsky <andrey.grodzovsky@crowdstrike.com>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Link: https://lore.kernel.org/bpf/20260302200837.317907-4-andrey.grodzovsky@crowdstrike.com
This commit is contained in:
Andrey Grodzovsky 2026-03-02 15:08:37 -05:00 committed by Andrii Nakryiko
parent 6afc431db1
commit a28441dd29
2 changed files with 41 additions and 2 deletions

View File

@ -327,6 +327,30 @@ static void test_attach_api_fails(void)
if (!ASSERT_EQ(saved_error, -E2BIG, "fail_6_error"))
goto cleanup;
/* fail_7 - non-existent wildcard pattern (slow path) */
LIBBPF_OPTS_RESET(opts);
link = bpf_program__attach_kprobe_multi_opts(skel->progs.test_kprobe_manual,
"__nonexistent_func_xyz_*",
&opts);
saved_error = -errno;
if (!ASSERT_ERR_PTR(link, "fail_7"))
goto cleanup;
if (!ASSERT_EQ(saved_error, -ENOENT, "fail_7_error"))
goto cleanup;
/* fail_8 - non-existent exact name (fast path), same error as wildcard */
link = bpf_program__attach_kprobe_multi_opts(skel->progs.test_kprobe_manual,
"__nonexistent_func_xyz_123",
&opts);
saved_error = -errno;
if (!ASSERT_ERR_PTR(link, "fail_8"))
goto cleanup;
if (!ASSERT_EQ(saved_error, -ENOENT, "fail_8_error"))
goto cleanup;
cleanup:
bpf_link__destroy(link);
kprobe_multi__destroy(skel);
@ -355,8 +379,13 @@ static void test_session_skel_api(void)
ASSERT_OK(err, "test_run");
ASSERT_EQ(topts.retval, 0, "test_run");
/* bpf_fentry_test1-4 trigger return probe, result is 2 */
for (i = 0; i < 4; i++)
/*
* bpf_fentry_test1 is hit by both the wildcard probe and the exact
* name probe (test_kprobe_syms), so entry + return fires twice: 4.
* bpf_fentry_test2-4 are hit only by the wildcard probe: 2.
*/
ASSERT_EQ(skel->bss->kprobe_session_result[0], 4, "kprobe_session_result");
for (i = 1; i < 4; i++)
ASSERT_EQ(skel->bss->kprobe_session_result[i], 2, "kprobe_session_result");
/* bpf_fentry_test5-8 trigger only entry probe, result is 1 */

View File

@ -76,3 +76,13 @@ int test_kprobe(struct pt_regs *ctx)
{
return session_check(ctx);
}
/*
* Exact function name (no wildcards) - exercises the fast syms[] path
* in bpf_program__attach_kprobe_multi_opts() which bypasses kallsyms parsing.
*/
SEC("kprobe.session/bpf_fentry_test1")
int test_kprobe_syms(struct pt_regs *ctx)
{
return session_check(ctx);
}