Re: [RFC PATCH bpf-next 1/3] libbpf: Optimize kprobe.session attachment for exact function names

[Jiri Olsa <olsajiri@gmail.com>]

On Mon, Feb 23, 2026 at 04:51:11PM -0500, Andrey Grodzovsky wrote:
> Implement dual-path optimization in attach_kprobe_session():
> - Fast path: Use syms[] array for exact function names
>   (no kallsyms parsing)
> - Slow path: Use pattern matching with kallsyms only for
>   wildcards
> 
> This avoids expensive kallsyms file parsing (~150ms) when function names
> are specified exactly, improving attachment time 50x (~3-5ms).
> 
> Error code normalization: The fast path returns ESRCH from kernel's
> ftrace_lookup_symbols(), while slow path returns ENOENT from userspace
> kallsyms parsing. Convert ESRCH to ENOENT in fast path to maintain API
> consistency - both paths now return identical error codes for "symbol
> not found".
> 
> Signed-off-by: Andrey Grodzovsky <andrey.grodzovsky@crowdstrike.com>
> ---
>  tools/lib/bpf/libbpf.c | 32 +++++++++++++++++++++++++++-----
>  1 file changed, 27 insertions(+), 5 deletions(-)
> 
> diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c
> index 0be7017800fe..87a71eab4308 100644
> --- a/tools/lib/bpf/libbpf.c
> +++ b/tools/lib/bpf/libbpf.c
> @@ -12192,7 +12192,7 @@ static int attach_kprobe_session(const struct bpf_program *prog, long cookie,
>  {
>  	LIBBPF_OPTS(bpf_kprobe_multi_opts, opts, .session = true);
>  	const char *spec;
> -	char *pattern;
> +	char *func_name;
>  	int n;
>  
>  	*link = NULL;
> @@ -12202,14 +12202,36 @@ static int attach_kprobe_session(const struct bpf_program *prog, long cookie,
>  		return 0;
>  
>  	spec = prog->sec_name + sizeof("kprobe.session/") - 1;
> -	n = sscanf(spec, "%m[a-zA-Z0-9_.*?]", &pattern);
> +	n = sscanf(spec, "%m[a-zA-Z0-9_.*?]", &func_name);
>  	if (n < 1) {
> -		pr_warn("kprobe session pattern is invalid: %s\n", spec);
> +		pr_warn("kprobe session function name is invalid: %s\n", spec);
>  		return -EINVAL;
>  	}
>  
> -	*link = bpf_program__attach_kprobe_multi_opts(prog, pattern, &opts);
> -	free(pattern);
> +	/* Check if pattern contains wildcards */
> +	if (strpbrk(func_name, "*?")) {
> +		/* Wildcard pattern - use pattern matching path with kallsyms parsing */
> +		*link = bpf_program__attach_kprobe_multi_opts(prog, func_name, &opts);
> +	} else {
> +		/* Exact function name - use syms array path (fast, no kallsyms parsing) */
> +		const char *syms[1];
> +
> +		syms[0] = func_name;
> +		opts.syms = syms;
> +		opts.cnt = 1;
> +		*link = bpf_program__attach_kprobe_multi_opts(prog, NULL, &opts);

hi,
good idea, could we do this directly in bpf_program__attach_kprobe_multi_opts ?
seems like it's not drectly related to session

jirka

> +		if (!*link && errno == ESRCH) {
> +			/*
> +			 * Normalize error code for API consistency: fast path returns ESRCH
> +			 * from kernel's ftrace_lookup_symbols(), while slow path returns ENOENT
> +			 * from userspace kallsyms parsing. Convert ESRCH to ENOENT so both paths
> +			 * return the same error for "symbol not found".
> +			 */
> +			errno = ENOENT;
> +		}
> +	}
> +
> +	free(func_name);
>  	return *link ? 0 : -errno;
>  }
>  
> -- 
> 2.34.1
>