When libbpf attaches kprobe.session programs with exact function names
(the common case: SEC("kprobe.session/vfs_read")), the current code path
has two independent performance bottlenecks:1. Userspace (libbpf): attach_kprobe_session() always parses /proc/kallsyms to resolve function names, even when the name is exact (no wildcards). This takes ~150ms per function. 2. Kernel (ftrace): ftrace_lookup_symbols() does a full O(N) linear scan over ~200K kernel symbols via kallsyms_on_each_symbol(), decompressing every symbol name, even when resolving a single symbol (cnt == 1). This series optimizes both layers: - Patch 1: libbpf detects exact function names (no wildcards) in bpf_program__attach_kprobe_multi_opts() and bypasses kallsyms parsing, passing the symbol directly to the kernel via syms[] array. ESRCH is normalized to ENOENT for API consistency. - Patch 2: ftrace_lookup_symbols() uses kallsyms_lookup_name() for O(log N) binary search when cnt == 1, with fallback to linear scan for duplicate symbols or module symbols. Included here for context; this patch is destined for the tracing tree via linux-trace-kernel (Steven Rostedt). - Patch 3: Selftests validating exact-name attachment via kprobe_multi_session.c and error consistency between wildcard and exact paths in test_attach_api_fails. Changes since v1: https://lore.kernel.org/bpf/[email protected]/ - Moved exact-name detection from attach_kprobe_session() into bpf_program__attach_kprobe_multi_opts() so all callers benefit, not just session (Jiri Olsa) - Changed ftrace_location() to boolean check only, keeping original kallsyms address in addrs[] consistent with kallsyms_callback behavior (Jiri Olsa) - Removed verbose performance rationale from ftrace code comment, kept in changelog (Steven Rostedt) - Consolidated session syms test into kprobe_multi_session.c using session_check(), validating via kprobe_session_result[0] == 4 (Jiri Olsa) - Folded error tests into existing test_attach_api_fails() instead of separate subtest (Jiri Olsa) - Deleted standalone kprobe_multi_session_syms.c and kprobe_multi_session_errors.c Andrey Grodzovsky (3): libbpf: Optimize kprobe.session attachment for exact function names ftrace: Use kallsyms binary search for single-symbol lookup selftests/bpf: add tests for kprobe.session optimization kernel/trace/ftrace.c | 22 ++++++++++++ tools/lib/bpf/libbpf.c | 34 +++++++++++++++---- .../bpf/prog_tests/kprobe_multi_test.c | 33 ++++++++++++++++-- .../bpf/progs/kprobe_multi_session.c | 10 ++++++ 4 files changed, 91 insertions(+), 8 deletions(-) -- 2.34.1
