[PATCH bpf-next v6 0/3] libbpf: clarify raw-address single kprobe attach behavior

[PATCH bpf-next v6 0/3] libbpf: clarify raw-address single kprobe attach behavior

[Hoyeon Lee]

Today libbpf documents single-kprobe attach through func_name, with an
optional offset. For the PMU-based path, func_name = NULL with an
absolute address in offset already works as well, but that is not
described in the API.

This patchset clarifies this behavior. First commit fixes kprobe
and uprobe attach error handling to use direct error codes. Next adds
kprobe API comments for the raw-address form and rejects it explicitly
for legacy tracefs/debugfs kprobes. Last adds PERF and LINK selftests
for the raw-address form, and checks that LEGACY rejects it.

---
Changes in v6:
- Split the kprobe/uprobe direct error-code fix into a separate patch

Changes in v5:
- Add kprobe API docs, use -EOPNOTSUPP, and switch selftests to LIBBPF_OPTS

Changes in v4:
- Inline raw-address error formatting and remove the probe_target buffer

Changes in v3:
- Drop bpf_kprobe_opts.addr and reuse offset when func_name is NULL
- Make legacy tracefs/debugfs kprobes reject the raw-address form
- Update selftests to cover PERF/LINK raw-address attach and LEGACY reject

Changes in v2:
- Fix line wrapping and indentation

Hoyeon Lee (3):
  libbpf: use direct error codes for kprobe/uprobe attach
  libbpf: clarify raw-address single kprobe attach behavior
  selftests/bpf: add test for raw-address single kprobe attach

 tools/lib/bpf/libbpf.c                        | 18 ++--
 tools/lib/bpf/libbpf.h                        | 27 +++++-
 .../selftests/bpf/prog_tests/attach_probe.c   | 82 +++++++++++++++++++
 3 files changed, 118 insertions(+), 9 deletions(-)

-- 
2.52.0

[PATCH bpf-next v6 1/3] libbpf: use direct error codes for kprobe/uprobe attach

[Hoyeon Lee]

perf_event_open_probe() and perf_event_{k,u}probe_open_legacy() helpers
are returning negative error codes directly on failure. This commit
changes bpf_program__attach_{k,u}probe_opts() to use those return
values directly instead of reading -errno again.

Signed-off-by: Hoyeon Lee <hoyeon.lee@suse.com>
---
 tools/lib/bpf/libbpf.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c
index 9ea41f40dc82..536c19c14d21 100644
--- a/tools/lib/bpf/libbpf.c
+++ b/tools/lib/bpf/libbpf.c
@@ -11835,7 +11835,7 @@ bpf_program__attach_kprobe_opts(const struct bpf_program *prog,
 						    offset, -1 /* pid */);
 	}
 	if (pfd < 0) {
-		err = -errno;
+		err = pfd;
 		pr_warn("prog '%s': failed to create %s '%s+0x%zx' perf event: %s\n",
 			prog->name, retprobe ? "kretprobe" : "kprobe",
 			func_name, offset,
@@ -12825,7 +12825,7 @@ bpf_program__attach_uprobe_opts(const struct bpf_program *prog, pid_t pid,
 						    binary_path, func_offset, pid);
 	}
 	if (pfd < 0) {
-		err = -errno;
+		err = pfd;
 		pr_warn("prog '%s': failed to create %s '%s:0x%zx' perf event: %s\n",
 			prog->name, retprobe ? "uretprobe" : "uprobe",
 			binary_path, func_offset,
-- 
2.52.0

Re: [PATCH bpf-next v6 1/3] libbpf: use direct error codes for kprobe/uprobe attach

[Jiri Olsa]

On Wed, Apr 01, 2026 at 04:05:02PM +0900, Hoyeon Lee wrote:
> perf_event_open_probe() and perf_event_{k,u}probe_open_legacy() helpers
> are returning negative error codes directly on failure. This commit
> changes bpf_program__attach_{k,u}probe_opts() to use those return
> values directly instead of reading -errno again.

because the errno might be changed by the error path cleanup code, right?

Acked-by: Jiri Olsa <jolsa@kernel.org>

jirka

> 
> Signed-off-by: Hoyeon Lee <hoyeon.lee@suse.com>
> ---
>  tools/lib/bpf/libbpf.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c
> index 9ea41f40dc82..536c19c14d21 100644
> --- a/tools/lib/bpf/libbpf.c
> +++ b/tools/lib/bpf/libbpf.c
> @@ -11835,7 +11835,7 @@ bpf_program__attach_kprobe_opts(const struct bpf_program *prog,
>  						    offset, -1 /* pid */);
>  	}
>  	if (pfd < 0) {
> -		err = -errno;
> +		err = pfd;
>  		pr_warn("prog '%s': failed to create %s '%s+0x%zx' perf event: %s\n",
>  			prog->name, retprobe ? "kretprobe" : "kprobe",
>  			func_name, offset,
> @@ -12825,7 +12825,7 @@ bpf_program__attach_uprobe_opts(const struct bpf_program *prog, pid_t pid,
>  						    binary_path, func_offset, pid);
>  	}
>  	if (pfd < 0) {
> -		err = -errno;
> +		err = pfd;
>  		pr_warn("prog '%s': failed to create %s '%s:0x%zx' perf event: %s\n",
>  			prog->name, retprobe ? "uretprobe" : "uprobe",
>  			binary_path, func_offset,
> -- 
> 2.52.0
> 

[PATCH bpf-next v6 2/3] libbpf: clarify raw-address single kprobe attach behavior

[Hoyeon Lee]

bpf_program__attach_kprobe_opts() documents single-kprobe attach
through func_name, with an optional offset. For the PMU-based path,
func_name = NULL with an absolute address in offset already works as
well, but that is not described in the API.

This commit clarifies this existing non-legacy behavior. For PMU-based
attach, callers can use func_name = NULL with an absolute address in
offset as the raw-address form. For legacy tracefs/debugfs kprobes,
reject this form explicitly.

Signed-off-by: Hoyeon Lee <hoyeon.lee@suse.com>
---
 tools/lib/bpf/libbpf.c | 14 ++++++++------
 tools/lib/bpf/libbpf.h | 27 ++++++++++++++++++++++++++-
 2 files changed, 34 insertions(+), 7 deletions(-)

diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c
index 536c19c14d21..ebb965230bb4 100644
--- a/tools/lib/bpf/libbpf.c
+++ b/tools/lib/bpf/libbpf.c
@@ -11816,6 +11816,8 @@ bpf_program__attach_kprobe_opts(const struct bpf_program *prog,
 	default:
 		return libbpf_err_ptr(-EINVAL);
 	}
+	if (!func_name && legacy)
+		return libbpf_err_ptr(-EOPNOTSUPP);
 
 	if (!legacy) {
 		pfd = perf_event_open_probe(false /* uprobe */, retprobe,
@@ -11836,20 +11838,20 @@ bpf_program__attach_kprobe_opts(const struct bpf_program *prog,
 	}
 	if (pfd < 0) {
 		err = pfd;
-		pr_warn("prog '%s': failed to create %s '%s+0x%zx' perf event: %s\n",
+		pr_warn("prog '%s': failed to create %s '%s%s0x%zx' perf event: %s\n",
 			prog->name, retprobe ? "kretprobe" : "kprobe",
-			func_name, offset,
-			errstr(err));
+			func_name ?: "", func_name ? "+" : "",
+			offset, errstr(err));
 		goto err_out;
 	}
 	link = bpf_program__attach_perf_event_opts(prog, pfd, &pe_opts);
 	err = libbpf_get_error(link);
 	if (err) {
 		close(pfd);
-		pr_warn("prog '%s': failed to attach to %s '%s+0x%zx': %s\n",
+		pr_warn("prog '%s': failed to attach to %s '%s%s0x%zx': %s\n",
 			prog->name, retprobe ? "kretprobe" : "kprobe",
-			func_name, offset,
-			errstr(err));
+			func_name ?: "", func_name ? "+" : "",
+			offset, errstr(err));
 		goto err_clean_legacy;
 	}
 	if (legacy) {
diff --git a/tools/lib/bpf/libbpf.h b/tools/lib/bpf/libbpf.h
index 0be34852350f..bba4e8464396 100644
--- a/tools/lib/bpf/libbpf.h
+++ b/tools/lib/bpf/libbpf.h
@@ -557,7 +557,7 @@ struct bpf_kprobe_opts {
 	size_t sz;
 	/* custom user-provided value fetchable through bpf_get_attach_cookie() */
 	__u64 bpf_cookie;
-	/* function's offset to install kprobe to */
+	/* function offset, or raw address if func_name == NULL */
 	size_t offset;
 	/* kprobe is return probe */
 	bool retprobe;
@@ -565,11 +565,36 @@ struct bpf_kprobe_opts {
 	enum probe_attach_mode attach_mode;
 	size_t :0;
 };
+
 #define bpf_kprobe_opts__last_field attach_mode
 
+/**
+ * @brief **bpf_program__attach_kprobe()** attaches a BPF program to a
+ * kernel function entry or return.
+ *
+ * @param prog BPF program to attach
+ * @param retprobe Attach to function return
+ * @param func_name Name of the kernel function to attach to
+ * @return Reference to the newly created BPF link; or NULL is returned on
+ * error, error code is stored in errno
+ */
 LIBBPF_API struct bpf_link *
 bpf_program__attach_kprobe(const struct bpf_program *prog, bool retprobe,
 			   const char *func_name);
+
+/**
+ * @brief **bpf_program__attach_kprobe_opts()** is just like
+ * bpf_program__attach_kprobe() except with an options struct
+ * for various configurations.
+ *
+ * @param prog BPF program to attach
+ * @param func_name Name of the kernel function to attach to. If NULL,
+ * opts->offset is treated as a raw kernel address. Raw-address attach
+ * is supported with PROBE_ATTACH_MODE_PERF and PROBE_ATTACH_MODE_LINK.
+ * @param opts Options for altering program attachment
+ * @return Reference to the newly created BPF link; or NULL is returned on
+ * error, error code is stored in errno
+ */
 LIBBPF_API struct bpf_link *
 bpf_program__attach_kprobe_opts(const struct bpf_program *prog,
                                 const char *func_name,
-- 
2.52.0

Re: [PATCH bpf-next v6 2/3] libbpf: clarify raw-address single kprobe attach behavior

[Jiri Olsa]

On Wed, Apr 01, 2026 at 04:05:03PM +0900, Hoyeon Lee wrote:
> bpf_program__attach_kprobe_opts() documents single-kprobe attach
> through func_name, with an optional offset. For the PMU-based path,
> func_name = NULL with an absolute address in offset already works as
> well, but that is not described in the API.
> 
> This commit clarifies this existing non-legacy behavior. For PMU-based
> attach, callers can use func_name = NULL with an absolute address in
> offset as the raw-address form. For legacy tracefs/debugfs kprobes,
> reject this form explicitly.
> 
> Signed-off-by: Hoyeon Lee <hoyeon.lee@suse.com>

Acked-by: Jiri Olsa <jolsa@kernel.org>

jirka


> ---
>  tools/lib/bpf/libbpf.c | 14 ++++++++------
>  tools/lib/bpf/libbpf.h | 27 ++++++++++++++++++++++++++-
>  2 files changed, 34 insertions(+), 7 deletions(-)
> 
> diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c
> index 536c19c14d21..ebb965230bb4 100644
> --- a/tools/lib/bpf/libbpf.c
> +++ b/tools/lib/bpf/libbpf.c
> @@ -11816,6 +11816,8 @@ bpf_program__attach_kprobe_opts(const struct bpf_program *prog,
>  	default:
>  		return libbpf_err_ptr(-EINVAL);
>  	}
> +	if (!func_name && legacy)
> +		return libbpf_err_ptr(-EOPNOTSUPP);
>  
>  	if (!legacy) {
>  		pfd = perf_event_open_probe(false /* uprobe */, retprobe,
> @@ -11836,20 +11838,20 @@ bpf_program__attach_kprobe_opts(const struct bpf_program *prog,
>  	}
>  	if (pfd < 0) {
>  		err = pfd;
> -		pr_warn("prog '%s': failed to create %s '%s+0x%zx' perf event: %s\n",
> +		pr_warn("prog '%s': failed to create %s '%s%s0x%zx' perf event: %s\n",
>  			prog->name, retprobe ? "kretprobe" : "kprobe",
> -			func_name, offset,
> -			errstr(err));
> +			func_name ?: "", func_name ? "+" : "",
> +			offset, errstr(err));
>  		goto err_out;
>  	}
>  	link = bpf_program__attach_perf_event_opts(prog, pfd, &pe_opts);
>  	err = libbpf_get_error(link);
>  	if (err) {
>  		close(pfd);
> -		pr_warn("prog '%s': failed to attach to %s '%s+0x%zx': %s\n",
> +		pr_warn("prog '%s': failed to attach to %s '%s%s0x%zx': %s\n",
>  			prog->name, retprobe ? "kretprobe" : "kprobe",
> -			func_name, offset,
> -			errstr(err));
> +			func_name ?: "", func_name ? "+" : "",
> +			offset, errstr(err));
>  		goto err_clean_legacy;
>  	}
>  	if (legacy) {
> diff --git a/tools/lib/bpf/libbpf.h b/tools/lib/bpf/libbpf.h
> index 0be34852350f..bba4e8464396 100644
> --- a/tools/lib/bpf/libbpf.h
> +++ b/tools/lib/bpf/libbpf.h
> @@ -557,7 +557,7 @@ struct bpf_kprobe_opts {
>  	size_t sz;
>  	/* custom user-provided value fetchable through bpf_get_attach_cookie() */
>  	__u64 bpf_cookie;
> -	/* function's offset to install kprobe to */
> +	/* function offset, or raw address if func_name == NULL */
>  	size_t offset;
>  	/* kprobe is return probe */
>  	bool retprobe;
> @@ -565,11 +565,36 @@ struct bpf_kprobe_opts {
>  	enum probe_attach_mode attach_mode;
>  	size_t :0;
>  };
> +
>  #define bpf_kprobe_opts__last_field attach_mode
>  
> +/**
> + * @brief **bpf_program__attach_kprobe()** attaches a BPF program to a
> + * kernel function entry or return.
> + *
> + * @param prog BPF program to attach
> + * @param retprobe Attach to function return
> + * @param func_name Name of the kernel function to attach to
> + * @return Reference to the newly created BPF link; or NULL is returned on
> + * error, error code is stored in errno
> + */
>  LIBBPF_API struct bpf_link *
>  bpf_program__attach_kprobe(const struct bpf_program *prog, bool retprobe,
>  			   const char *func_name);
> +
> +/**
> + * @brief **bpf_program__attach_kprobe_opts()** is just like
> + * bpf_program__attach_kprobe() except with an options struct
> + * for various configurations.
> + *
> + * @param prog BPF program to attach
> + * @param func_name Name of the kernel function to attach to. If NULL,
> + * opts->offset is treated as a raw kernel address. Raw-address attach
> + * is supported with PROBE_ATTACH_MODE_PERF and PROBE_ATTACH_MODE_LINK.
> + * @param opts Options for altering program attachment
> + * @return Reference to the newly created BPF link; or NULL is returned on
> + * error, error code is stored in errno
> + */
>  LIBBPF_API struct bpf_link *
>  bpf_program__attach_kprobe_opts(const struct bpf_program *prog,
>                                  const char *func_name,
> -- 
> 2.52.0
> 

[PATCH bpf-next v6 3/3] selftests/bpf: add test for raw-address single kprobe attach

[Hoyeon Lee]

Currently, attach_probe covers manual single-kprobe attaches by
func_name, but not the raw-address form that the PMU-based
single-kprobe path can accept.

This commit adds PERF and LINK raw-address coverage. It resolves
SYS_NANOSLEEP_KPROBE_NAME through kallsyms, passes the absolute address
in bpf_kprobe_opts.offset with func_name = NULL, and verifies that
kprobe and kretprobe are still triggered. It also verifies that LEGACY
rejects the same form.

Signed-off-by: Hoyeon Lee <hoyeon.lee@suse.com>
---
 .../selftests/bpf/prog_tests/attach_probe.c   | 82 +++++++++++++++++++
 1 file changed, 82 insertions(+)

diff --git a/tools/testing/selftests/bpf/prog_tests/attach_probe.c b/tools/testing/selftests/bpf/prog_tests/attach_probe.c
index 9e77e5da7097..a41542f4b35d 100644
--- a/tools/testing/selftests/bpf/prog_tests/attach_probe.c
+++ b/tools/testing/selftests/bpf/prog_tests/attach_probe.c
@@ -123,6 +123,82 @@ static void test_attach_probe_manual(enum probe_attach_mode attach_mode)
 	test_attach_probe_manual__destroy(skel);
 }
 
+/* manual attach address-based kprobe/kretprobe testings */
+static void test_attach_kprobe_by_addr(enum probe_attach_mode attach_mode)
+{
+	LIBBPF_OPTS(bpf_kprobe_opts, kprobe_opts);
+	struct test_attach_probe_manual *skel;
+	unsigned long func_addr;
+
+	if (!ASSERT_OK(load_kallsyms(), "load_kallsyms"))
+		return;
+
+	func_addr = ksym_get_addr(SYS_NANOSLEEP_KPROBE_NAME);
+	if (!ASSERT_NEQ(func_addr, 0UL, "func_addr"))
+		return;
+
+	skel = test_attach_probe_manual__open_and_load();
+	if (!ASSERT_OK_PTR(skel, "skel_kprobe_manual_open_and_load"))
+		return;
+
+	kprobe_opts.attach_mode = attach_mode;
+	kprobe_opts.retprobe = false;
+	kprobe_opts.offset = func_addr;
+	skel->links.handle_kprobe =
+		bpf_program__attach_kprobe_opts(skel->progs.handle_kprobe,
+						NULL, &kprobe_opts);
+	if (!ASSERT_OK_PTR(skel->links.handle_kprobe, "attach_kprobe_by_addr"))
+		goto cleanup;
+
+	kprobe_opts.retprobe = true;
+	skel->links.handle_kretprobe =
+		bpf_program__attach_kprobe_opts(skel->progs.handle_kretprobe,
+						NULL, &kprobe_opts);
+	if (!ASSERT_OK_PTR(skel->links.handle_kretprobe,
+			   "attach_kretprobe_by_addr"))
+		goto cleanup;
+
+	/* trigger & validate kprobe && kretprobe */
+	usleep(1);
+
+	ASSERT_EQ(skel->bss->kprobe_res, 1, "check_kprobe_res");
+	ASSERT_EQ(skel->bss->kretprobe_res, 2, "check_kretprobe_res");
+
+cleanup:
+	test_attach_probe_manual__destroy(skel);
+}
+
+/* reject legacy address-based kprobe attach */
+static void test_attach_kprobe_legacy_by_addr_reject(void)
+{
+	LIBBPF_OPTS(bpf_kprobe_opts, kprobe_opts);
+	struct test_attach_probe_manual *skel;
+	unsigned long func_addr;
+
+	if (!ASSERT_OK(load_kallsyms(), "load_kallsyms"))
+		return;
+
+	func_addr = ksym_get_addr(SYS_NANOSLEEP_KPROBE_NAME);
+	if (!ASSERT_NEQ(func_addr, 0UL, "func_addr"))
+		return;
+
+	skel = test_attach_probe_manual__open_and_load();
+	if (!ASSERT_OK_PTR(skel, "skel_kprobe_manual_open_and_load"))
+		return;
+
+	kprobe_opts.attach_mode = PROBE_ATTACH_MODE_LEGACY;
+	kprobe_opts.offset = func_addr;
+	skel->links.handle_kprobe =
+		bpf_program__attach_kprobe_opts(skel->progs.handle_kprobe,
+						NULL, &kprobe_opts);
+	if (ASSERT_ERR_PTR(skel->links.handle_kprobe,
+			   "attach_kprobe_legacy_by_addr"))
+		ASSERT_EQ(libbpf_get_error(skel->links.handle_kprobe),
+			  -EOPNOTSUPP, "attach_kprobe_legacy_by_addr_err");
+
+	test_attach_probe_manual__destroy(skel);
+}
+
 /* attach uprobe/uretprobe long event name testings */
 static void test_attach_uprobe_long_event_name(void)
 {
@@ -416,6 +492,12 @@ void test_attach_probe(void)
 		test_attach_probe_manual(PROBE_ATTACH_MODE_PERF);
 	if (test__start_subtest("manual-link"))
 		test_attach_probe_manual(PROBE_ATTACH_MODE_LINK);
+	if (test__start_subtest("kprobe-perf-by-addr"))
+		test_attach_kprobe_by_addr(PROBE_ATTACH_MODE_PERF);
+	if (test__start_subtest("kprobe-link-by-addr"))
+		test_attach_kprobe_by_addr(PROBE_ATTACH_MODE_LINK);
+	if (test__start_subtest("kprobe-legacy-by-addr-reject"))
+		test_attach_kprobe_legacy_by_addr_reject();
 
 	if (test__start_subtest("auto"))
 		test_attach_probe_auto(skel);
-- 
2.52.0

Re: [PATCH bpf-next v6 3/3] selftests/bpf: add test for raw-address single kprobe attach

[Jiri Olsa]

On Wed, Apr 01, 2026 at 04:05:04PM +0900, Hoyeon Lee wrote:
> Currently, attach_probe covers manual single-kprobe attaches by
> func_name, but not the raw-address form that the PMU-based
> single-kprobe path can accept.
> 
> This commit adds PERF and LINK raw-address coverage. It resolves
> SYS_NANOSLEEP_KPROBE_NAME through kallsyms, passes the absolute address
> in bpf_kprobe_opts.offset with func_name = NULL, and verifies that
> kprobe and kretprobe are still triggered. It also verifies that LEGACY
> rejects the same form.

left 2 nits below

Acked-by: Jiri Olsa <jolsa@kernel.org>

jirka

> 
> Signed-off-by: Hoyeon Lee <hoyeon.lee@suse.com>
> ---
>  .../selftests/bpf/prog_tests/attach_probe.c   | 82 +++++++++++++++++++
>  1 file changed, 82 insertions(+)
> 
> diff --git a/tools/testing/selftests/bpf/prog_tests/attach_probe.c b/tools/testing/selftests/bpf/prog_tests/attach_probe.c
> index 9e77e5da7097..a41542f4b35d 100644
> --- a/tools/testing/selftests/bpf/prog_tests/attach_probe.c
> +++ b/tools/testing/selftests/bpf/prog_tests/attach_probe.c
> @@ -123,6 +123,82 @@ static void test_attach_probe_manual(enum probe_attach_mode attach_mode)
>  	test_attach_probe_manual__destroy(skel);
>  }
>  
> +/* manual attach address-based kprobe/kretprobe testings */
> +static void test_attach_kprobe_by_addr(enum probe_attach_mode attach_mode)
> +{
> +	LIBBPF_OPTS(bpf_kprobe_opts, kprobe_opts);
> +	struct test_attach_probe_manual *skel;
> +	unsigned long func_addr;
> +
> +	if (!ASSERT_OK(load_kallsyms(), "load_kallsyms"))
> +		return;
> +
> +	func_addr = ksym_get_addr(SYS_NANOSLEEP_KPROBE_NAME);
> +	if (!ASSERT_NEQ(func_addr, 0UL, "func_addr"))
> +		return;
> +
> +	skel = test_attach_probe_manual__open_and_load();
> +	if (!ASSERT_OK_PTR(skel, "skel_kprobe_manual_open_and_load"))
> +		return;
> +
> +	kprobe_opts.attach_mode = attach_mode;
> +	kprobe_opts.retprobe = false;
> +	kprobe_opts.offset = func_addr;
> +	skel->links.handle_kprobe =
> +		bpf_program__attach_kprobe_opts(skel->progs.handle_kprobe,
> +						NULL, &kprobe_opts);
> +	if (!ASSERT_OK_PTR(skel->links.handle_kprobe, "attach_kprobe_by_addr"))
> +		goto cleanup;
> +
> +	kprobe_opts.retprobe = true;
> +	skel->links.handle_kretprobe =
> +		bpf_program__attach_kprobe_opts(skel->progs.handle_kretprobe,
> +						NULL, &kprobe_opts);
> +	if (!ASSERT_OK_PTR(skel->links.handle_kretprobe,
> +			   "attach_kretprobe_by_addr"))

nit, no need to split the line

> +		goto cleanup;
> +
> +	/* trigger & validate kprobe && kretprobe */
> +	usleep(1);
> +
> +	ASSERT_EQ(skel->bss->kprobe_res, 1, "check_kprobe_res");
> +	ASSERT_EQ(skel->bss->kretprobe_res, 2, "check_kretprobe_res");
> +
> +cleanup:
> +	test_attach_probe_manual__destroy(skel);
> +}
> +
> +/* reject legacy address-based kprobe attach */
> +static void test_attach_kprobe_legacy_by_addr_reject(void)
> +{
> +	LIBBPF_OPTS(bpf_kprobe_opts, kprobe_opts);
> +	struct test_attach_probe_manual *skel;
> +	unsigned long func_addr;
> +
> +	if (!ASSERT_OK(load_kallsyms(), "load_kallsyms"))
> +		return;
> +
> +	func_addr = ksym_get_addr(SYS_NANOSLEEP_KPROBE_NAME);
> +	if (!ASSERT_NEQ(func_addr, 0UL, "func_addr"))
> +		return;
> +
> +	skel = test_attach_probe_manual__open_and_load();
> +	if (!ASSERT_OK_PTR(skel, "skel_kprobe_manual_open_and_load"))
> +		return;
> +
> +	kprobe_opts.attach_mode = PROBE_ATTACH_MODE_LEGACY;
> +	kprobe_opts.offset = func_addr;
> +	skel->links.handle_kprobe =
> +		bpf_program__attach_kprobe_opts(skel->progs.handle_kprobe,
> +						NULL, &kprobe_opts);
> +	if (ASSERT_ERR_PTR(skel->links.handle_kprobe,
> +			   "attach_kprobe_legacy_by_addr"))
> +		ASSERT_EQ(libbpf_get_error(skel->links.handle_kprobe),
> +			  -EOPNOTSUPP, "attach_kprobe_legacy_by_addr_err");

nit, maybe we could do just:

       ASSERT_ERR_PTR(skel->links.handle_kprobe, "attach_kprobe_legacy_by_addr");
       ASSERT_EQ(libbpf_get_error(skel->links.handle_kprobe),
                 -EOPNOTSUPP, "attach_kprobe_legacy_by_addr_err");

> +
> +	test_attach_probe_manual__destroy(skel);
> +}
> +
>  /* attach uprobe/uretprobe long event name testings */
>  static void test_attach_uprobe_long_event_name(void)
>  {
> @@ -416,6 +492,12 @@ void test_attach_probe(void)
>  		test_attach_probe_manual(PROBE_ATTACH_MODE_PERF);
>  	if (test__start_subtest("manual-link"))
>  		test_attach_probe_manual(PROBE_ATTACH_MODE_LINK);
> +	if (test__start_subtest("kprobe-perf-by-addr"))
> +		test_attach_kprobe_by_addr(PROBE_ATTACH_MODE_PERF);
> +	if (test__start_subtest("kprobe-link-by-addr"))
> +		test_attach_kprobe_by_addr(PROBE_ATTACH_MODE_LINK);
> +	if (test__start_subtest("kprobe-legacy-by-addr-reject"))
> +		test_attach_kprobe_legacy_by_addr_reject();
>  
>  	if (test__start_subtest("auto"))
>  		test_attach_probe_auto(skel);
> -- 
> 2.52.0
>