On Mon, Feb 23, 2026 at 04:51:13PM -0500, Andrey Grodzovsky wrote:
> Add two new subtests to kprobe_multi_test to validate the
> kprobe.session exact function name optimization:
SNIP
> +static void test_session_errors(void)
> +{
> + struct kprobe_multi_session_errors *skel = NULL;
> + struct bpf_link *link_wildcard = NULL;
> + struct bpf_link *link_exact = NULL;
> + int err_wildcard, err_exact;
> +
> + skel = kprobe_multi_session_errors__open_and_load();
> + if (!ASSERT_OK_PTR(skel, "kprobe_multi_session_errors__open_and_load"))
> + return;
> +
> + /*
> + * Test error code consistency: both wildcard (slow path) and exact name
> + * (fast path) should return the same error code (ENOENT) for
> non-existent
> + * functions. This protects against future kernel changes that might
> alter
> + * error return values.
> + */
> +
> + /* Try to attach with non-existent wildcard pattern (slow path) */
> + link_wildcard =
> bpf_program__attach(skel->progs.test_nonexistent_wildcard);
> + err_wildcard = -errno;
> + ASSERT_ERR_PTR(link_wildcard, "attach_nonexistent_wildcard");
> + ASSERT_EQ(err_wildcard, -ENOENT, "wildcard_error_enoent");
> +
> + /* Try to attach with non-existent exact name (fast path) */
> + link_exact = bpf_program__attach(skel->progs.test_nonexistent_exact);
> + err_exact = -errno;
> + ASSERT_ERR_PTR(link_exact, "attach_nonexistent_exact");
> + ASSERT_EQ(err_exact, -ENOENT, "exact_error_enoent");
> +
> + /*
> + * Verify both paths return identical error codes - this is critical for
> + * API consistency and prevents user code from breaking when switching
> + * between wildcard patterns and exact function names.
> + */
> + ASSERT_EQ(err_wildcard, err_exact, "error_consistency");
> +
> + kprobe_multi_session_errors__destroy(skel);
there's already subtest for attach failures (test_attach_api_fails),
so maybe let's put this over there?
SNIP
> diff --git a/tools/testing/selftests/bpf/progs/kprobe_multi_session_syms.c
> b/tools/testing/selftests/bpf/progs/kprobe_multi_session_syms.c
> new file mode 100644
> index 000000000000..6a4bd57af1fc
> --- /dev/null
> +++ b/tools/testing/selftests/bpf/progs/kprobe_multi_session_syms.c
> @@ -0,0 +1,45 @@
> +// SPDX-License-Identifier: GPL-2.0
> +/* Test kprobe.session with exact function names to verify syms[]
> optimization */
> +#include <vmlinux.h>
> +#include <bpf/bpf_helpers.h>
> +#include <bpf/bpf_tracing.h>
> +#include <stdbool.h>
> +
> +char _license[] SEC("license") = "GPL";
> +
> +int pid = 0;
> +
> +/* Results for each function: incremented on entry and return */
> +__u64 test1_count = 0;
> +
> +/* Track entry vs return */
> +bool test1_return = false;
> +
> +/*
> + * No tests in here, just to trigger 'bpf_fentry_test*'
> + * through tracing test_run
> + */
> +SEC("fentry/bpf_modify_return_test")
> +int BPF_PROG(trigger)
> +{
> + return 0;
> +}
> +
> +/*
> + * Test 1: Exact function name (no wildcards) - uses fast syms[] path
> + * This should attach via opts.syms array, bypassing kallsyms parsing
> + */
> +SEC("kprobe.session/bpf_fentry_test1")
> +int test_kprobe_syms_1(struct pt_regs *ctx)
perhaps we could execute this as part of test_session_skel_api test?
seems like we could put this directly to progs/kprobe_multi_session.c and
call session_check(ctx) and change test_results validation accordingly
thanks,
jirka
> +{
> + if (bpf_get_current_pid_tgid() >> 32 != pid)
> + return 0;
> +
> + test1_count++;
> +
> + /* Check if this is return probe */
> + if (bpf_session_is_return(ctx))
> + test1_return = true;
> +
> + return 0; /* Always execute return probe */
> +}
> --
> 2.34.1
>
