When libbpf attaches kprobe.session programs with exact function names
(the common case: SEC("kprobe.session/vfs_read")), the current code path
has two independent performance bottlenecks:1. Userspace (libbpf): attach_kprobe_session() always parses /proc/kallsyms to resolve function names, even when the name is exact (no wildcards). This takes ~150ms per function. 2. Kernel (ftrace): ftrace_lookup_symbols() does a full O(N) linear scan over ~200K kernel symbols via kallsyms_on_each_symbol(), decompressing every symbol name, even when resolving a single symbol (cnt == 1). This series optimizes both layers: - Patch 1: libbpf detects exact function names (no wildcards) in bpf_program__attach_kprobe_multi_opts() and bypasses kallsyms parsing, passing the symbol directly to the kernel via syms[] array. ESRCH is normalized to ENOENT for API consistency. - Patch 2: ftrace_lookup_symbols() uses kallsyms_lookup_name() for O(log N) binary search when cnt == 1, with fallback to linear scan for duplicate symbols. Included here for context; this patch is destined for the tracing tree via linux-trace-kernel (Steven Rostedt). - Patch 3: Selftests validating exact-name attachment via kprobe_multi_session.c and error consistency between wildcard and exact paths in test_attach_api_fails. Changes since v3 [3]: - Skip fast path when unique_match is set (Jiri Olsa, CI bot) Changes since v2 [2]: - Use if/else-if instead of goto (Jiri Olsa) - Use syms = &pattern directly (Jiri Olsa) - Drop unneeded pattern = NULL (Jiri Olsa) - Revert cosmetic rename in attach_kprobe_session (Jiri Olsa) - Remove "module symbols" from ftrace comment (CI bot) Changes since v1 [1]: - Move optimization into attach_kprobe_multi_opts (Jiri Olsa) - Use ftrace_location as boolean check only (Jiri Olsa) - Remove verbose perf rationale from comment (Steven Rostedt) - Consolidate tests into existing subtests (Jiri Olsa) - Delete standalone _syms.c and _errors.c files [1] https://lore.kernel.org/bpf/[email protected]/ [2] https://lore.kernel.org/bpf/[email protected]/ [3] https://lore.kernel.org/bpf/[email protected]/ Andrey Grodzovsky (3): libbpf: Optimize kprobe.session attachment for exact function names ftrace: Use kallsyms binary search for single-symbol lookup selftests/bpf: add tests for kprobe.session optimization kernel/trace/ftrace.c | 22 +++++++++++++ tools/lib/bpf/libbpf.c | 19 ++++++++++- .../bpf/prog_tests/kprobe_multi_test.c | 33 +++++++++++++++++-- .../bpf/progs/kprobe_multi_session.c | 10 ++++++ 4 files changed, 81 insertions(+), 3 deletions(-) -- 2.34.1
