mirror of
https://github.com/torvalds/linux.git
synced 2026-05-30 00:29:35 +08:00
a28441dd29
Extend existing kprobe_multi_test subtests to validate the kprobe.session exact function name optimization: In kprobe_multi_session.c, add test_kprobe_syms which attaches a kprobe.session program to an exact function name (bpf_fentry_test1) exercising the fast syms[] path that bypasses kallsyms parsing. It calls session_check() so bpf_fentry_test1 is hit by both the wildcard and exact probes, and test_session_skel_api validates kprobe_session_result[0] == 4 (entry + return from each probe). In test_attach_api_fails, add fail_7 and fail_8 verifying error code consistency between the wildcard pattern path (slow, parses kallsyms) and the exact function name path (fast, uses syms[] array). Both paths must return -ENOENT for non-existent functions. Signed-off-by: Andrey Grodzovsky <andrey.grodzovsky@crowdstrike.com> Signed-off-by: Andrii Nakryiko <andrii@kernel.org> Link: https://lore.kernel.org/bpf/20260302200837.317907-4-andrey.grodzovsky@crowdstrike.com
89 lines
1.9 KiB
C
89 lines
1.9 KiB
C
// SPDX-License-Identifier: GPL-2.0
|
|
#include <linux/bpf.h>
|
|
#include <bpf/bpf_helpers.h>
|
|
#include <bpf/bpf_tracing.h>
|
|
#include <stdbool.h>
|
|
#include "bpf_kfuncs.h"
|
|
#include "bpf_misc.h"
|
|
|
|
char _license[] SEC("license") = "GPL";
|
|
|
|
extern const void bpf_fentry_test1 __ksym;
|
|
extern const void bpf_fentry_test2 __ksym;
|
|
extern const void bpf_fentry_test3 __ksym;
|
|
extern const void bpf_fentry_test4 __ksym;
|
|
extern const void bpf_fentry_test5 __ksym;
|
|
extern const void bpf_fentry_test6 __ksym;
|
|
extern const void bpf_fentry_test7 __ksym;
|
|
extern const void bpf_fentry_test8 __ksym;
|
|
|
|
int pid = 0;
|
|
|
|
__u64 kprobe_session_result[8];
|
|
|
|
static int session_check(void *ctx)
|
|
{
|
|
unsigned int i;
|
|
__u64 addr;
|
|
const void *kfuncs[] = {
|
|
&bpf_fentry_test1,
|
|
&bpf_fentry_test2,
|
|
&bpf_fentry_test3,
|
|
&bpf_fentry_test4,
|
|
&bpf_fentry_test5,
|
|
&bpf_fentry_test6,
|
|
&bpf_fentry_test7,
|
|
&bpf_fentry_test8,
|
|
};
|
|
|
|
if (bpf_get_current_pid_tgid() >> 32 != pid)
|
|
return 1;
|
|
|
|
addr = bpf_get_func_ip(ctx);
|
|
|
|
for (i = 0; i < ARRAY_SIZE(kfuncs); i++) {
|
|
if (kfuncs[i] == (void *) addr) {
|
|
kprobe_session_result[i]++;
|
|
break;
|
|
}
|
|
}
|
|
|
|
/*
|
|
* Force probes for function bpf_fentry_test[5-8] not to
|
|
* install and execute the return probe
|
|
*/
|
|
if (((const void *) addr == &bpf_fentry_test5) ||
|
|
((const void *) addr == &bpf_fentry_test6) ||
|
|
((const void *) addr == &bpf_fentry_test7) ||
|
|
((const void *) addr == &bpf_fentry_test8))
|
|
return 1;
|
|
|
|
return 0;
|
|
}
|
|
|
|
/*
|
|
* No tests in here, just to trigger 'bpf_fentry_test*'
|
|
* through tracing test_run
|
|
*/
|
|
SEC("fentry/bpf_modify_return_test")
|
|
int BPF_PROG(trigger)
|
|
{
|
|
return 0;
|
|
}
|
|
|
|
SEC("kprobe.session/bpf_fentry_test*")
|
|
int test_kprobe(struct pt_regs *ctx)
|
|
{
|
|
return session_check(ctx);
|
|
}
|
|
|
|
/*
|
|
* Exact function name (no wildcards) - exercises the fast syms[] path
|
|
* in bpf_program__attach_kprobe_multi_opts() which bypasses kallsyms parsing.
|
|
*/
|
|
SEC("kprobe.session/bpf_fentry_test1")
|
|
int test_kprobe_syms(struct pt_regs *ctx)
|
|
{
|
|
return session_check(ctx);
|
|
}
|