Function TestKprobeMultiProgramCall

link/kprobe_multi_test.go:123–164

(t *testing.T)

}

func TestKprobeMultiProgramCall(t *testing.T) {
	testutils.SkipIfNotSupported(t, features.HaveBPFLinkKprobeMulti())

	m, p := newUpdaterMapProg(t, ebpf.Kprobe, ebpf.AttachTraceKprobeMulti)

	// Use actual syscall names with platform prefix.
	// For simplicity, just assert the increment happens with any symbol in the array.
	prefix := linux.PlatformPrefix()
	opts := KprobeMultiOptions{
		Symbols: []string{prefix + "sys_getpid", prefix + "sys_gettid"},
	}
	km, err := KprobeMulti(p, opts)
	if err != nil {
		t.Fatal(err)
	}

	// Trigger ebpf program call.
	unix.Getpid()
	unix.Gettid()

	// Assert that the value got incremented to at least 2, while allowing
	// for bigger values, because we could race with other getpid/gettid
	// callers.
	assertMapValueGE(t, m, 0, 2)

	// Close the link.
	if err := km.Close(); err != nil {
		t.Fatal(err)
	}

	// Reset map value to 0 at index 0.
	if err := m.Update(uint32(0), uint32(0), ebpf.UpdateExist); err != nil {
		t.Fatal(err)
	}

	// Retrigger the ebpf program call.
	unix.Getpid()
	unix.Gettid()

	// Assert that this time the value has not been updated.
	assertMapValue(t, m, 0, 0)
}

func TestKprobeSession(t *testing.T) {
	testutils.SkipIfNotSupported(t, features.HaveBPFLinkKprobeSession())