Andrey Grodzovsky says:
====================
Optimize kprobe.session attachment for exact function names
When libbpf attaches kprobe.session programs with exact function names
(the common case: SEC("kprobe.session/vfs_read")), the current code path
has two independent performance bottlenecks:
1. Userspace (libbpf): attach_kprobe_session() always parses
/proc/kallsyms to resolve function names, even when the name is exact
(no wildcards). This takes ~150ms per function.
2. Kernel (ftrace): ftrace_lookup_symbols() does a full O(N) linear scan
over ~200K kernel symbols via kallsyms_on_each_symbol(), decompressing
every symbol name, even when resolving a single symbol (cnt == 1).
This series optimizes libbpf side: libbpf detects exact function names
(no wildcards) in bpf_program__attach_kprobe_multi_opts() and bypasses
kallsyms parsing, passing the symbol directly to the kernel via syms[]
array. ESRCH is normalized to ENOENT for API consistency.
Selftests validates exact-name attachment via kprobe_multi_session.c
and error consistency between wildcard and exact paths
in test_attach_api_fails.
Changes since v3 [3]:
- Skip fast path when unique_match is set (Jiri Olsa, CI bot)
Changes since v2 [2]:
- Use if/else-if instead of goto (Jiri Olsa)
- Use syms = &pattern directly (Jiri Olsa)
- Drop unneeded pattern = NULL (Jiri Olsa)
- Revert cosmetic rename in attach_kprobe_session (Jiri Olsa)
- Remove "module symbols" from ftrace comment (CI bot)
Changes since v1 [1]:
- Move optimization into attach_kprobe_multi_opts (Jiri Olsa)
- Use ftrace_location as boolean check only (Jiri Olsa)
- Remove verbose perf rationale from comment (Steven Rostedt)
- Consolidate tests into existing subtests (Jiri Olsa)
- Delete standalone _syms.c and _errors.c files
[1] https://lore.kernel.org/bpf/
20260223215113.924599-1-andrey.grodzovsky@crowdstrike.com/
[2] https://lore.kernel.org/bpf/
20260226173342.
3565919-1-andrey.grodzovsky@crowdstrike.com/
[3] https://lore.kernel.org/bpf/
20260227204052.725813-1-andrey.grodzovsky@crowdstrike.com/
====================
Link: https://patch.msgid.link/20260302200837.317907-1-andrey.grodzovsky@crowdstrike.com
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>