selftests/bpf: Add tests for kprobe.session optimization

Extend existing kprobe_multi_test subtests to validate the
kprobe.session exact function name optimization:

In kprobe_multi_session.c, add test_kprobe_syms which attaches a
kprobe.session program to an exact function name (bpf_fentry_test1)
exercising the fast syms[] path that bypasses kallsyms parsing.  It
calls session_check() so bpf_fentry_test1 is hit by both the wildcard
and exact probes, and test_session_skel_api validates
kprobe_session_result[0] == 4 (entry + return from each probe).

In test_attach_api_fails, add fail_7 and fail_8 verifying error code
consistency between the wildcard pattern path (slow, parses kallsyms)
and the exact function name path (fast, uses syms[] array).  Both
paths must return -ENOENT for non-existent functions.

Signed-off-by: Andrey Grodzovsky <andrey.grodzovsky@crowdstrike.com>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Link: https://lore.kernel.org/bpf/20260302200837.317907-4-andrey.grodzovsky@crowdstrike.com

diff --git a/tools/testing/selftests/bpf/prog_tests/kprobe_multi_test.c b/tools/testing/selftests/bpf/prog_tests/kprobe_multi_test.c
index f81dcd609ee928fbe3dd29e9dc3846ee96651af8..78c974d4ea33aaf640f7f6365729cd530f519e1d 100644 (file)
--- a/tools/testing/selftests/bpf/prog_tests/kprobe_multi_test.c
+++ b/tools/testing/selftests/bpf/prog_tests/kprobe_multi_test.c
@@ -327,6 +327,30 @@ static void test_attach_api_fails(void)
        if (!ASSERT_EQ(saved_error, -E2BIG, "fail_6_error"))
                goto cleanup;
 
+       /* fail_7 - non-existent wildcard pattern (slow path) */
+       LIBBPF_OPTS_RESET(opts);
+
+       link = bpf_program__attach_kprobe_multi_opts(skel->progs.test_kprobe_manual,
+                                                    "__nonexistent_func_xyz_*",
+                                                    &opts);
+       saved_error = -errno;
+       if (!ASSERT_ERR_PTR(link, "fail_7"))
+               goto cleanup;
+
+       if (!ASSERT_EQ(saved_error, -ENOENT, "fail_7_error"))
+               goto cleanup;
+
+       /* fail_8 - non-existent exact name (fast path), same error as wildcard */
+       link = bpf_program__attach_kprobe_multi_opts(skel->progs.test_kprobe_manual,
+                                                    "__nonexistent_func_xyz_123",
+                                                    &opts);
+       saved_error = -errno;
+       if (!ASSERT_ERR_PTR(link, "fail_8"))
+               goto cleanup;
+
+       if (!ASSERT_EQ(saved_error, -ENOENT, "fail_8_error"))
+               goto cleanup;
+
 cleanup:
        bpf_link__destroy(link);
        kprobe_multi__destroy(skel);
@@ -355,8 +379,13 @@ static void test_session_skel_api(void)
        ASSERT_OK(err, "test_run");
        ASSERT_EQ(topts.retval, 0, "test_run");
 
-       /* bpf_fentry_test1-4 trigger return probe, result is 2 */
-       for (i = 0; i < 4; i++)
+       /*
+        * bpf_fentry_test1 is hit by both the wildcard probe and the exact
+        * name probe (test_kprobe_syms), so entry + return fires twice: 4.
+        * bpf_fentry_test2-4 are hit only by the wildcard probe: 2.
+        */
+       ASSERT_EQ(skel->bss->kprobe_session_result[0], 4, "kprobe_session_result");
+       for (i = 1; i < 4; i++)
                ASSERT_EQ(skel->bss->kprobe_session_result[i], 2, "kprobe_session_result");
 
        /* bpf_fentry_test5-8 trigger only entry probe, result is 1 */

diff --git a/tools/testing/selftests/bpf/progs/kprobe_multi_session.c b/tools/testing/selftests/bpf/progs/kprobe_multi_session.c
index bd8b7fb7061edd5a6c961e0cbd371e148d6991c7..d52a65b40bbf0639b28d497743f8cf5135200723 100644 (file)
--- a/tools/testing/selftests/bpf/progs/kprobe_multi_session.c
+++ b/tools/testing/selftests/bpf/progs/kprobe_multi_session.c
@@ -76,3 +76,13 @@ int test_kprobe(struct pt_regs *ctx)
 {
        return session_check(ctx);
 }
+
+/*
+ * Exact function name (no wildcards) - exercises the fast syms[] path
+ * in bpf_program__attach_kprobe_multi_opts() which bypasses kallsyms parsing.
+ */
+SEC("kprobe.session/bpf_fentry_test1")
+int test_kprobe_syms(struct pt_regs *ctx)
+{
+       return session_check(ctx);
+}