NAME fentry
PROG fentry:vfs_read { printf("SUCCESS %d\n", pid); exit(); }
EXPECT_REGEX SUCCESS [0-9][0-9]*
REQUIRES_FEATURE fentry
AFTER ./testprogs/syscall read

NAME fexit
PROG fexit:vfs_read { printf("SUCCESS %d\n", pid); exit(); }
EXPECT_REGEX SUCCESS [0-9][0-9]*
REQUIRES_FEATURE fentry
AFTER ./testprogs/syscall read

NAME fentry_wildcard
PROG fentry:vfs_re*ad { printf("SUCCESS %d\n", pid); exit(); }
EXPECT_REGEX SUCCESS [0-9][0-9]*
REQUIRES_FEATURE fentry
AFTER ./testprogs/syscall read

NAME fentry_module
PROG fentry:vmlinux:vfs_read { printf("SUCCESS %d\n", pid); exit(); }
EXPECT_REGEX SUCCESS [0-9][0-9]*
REQUIRES_FEATURE fentry
AFTER ./testprogs/syscall read

NAME fentry_module_wildcard
PROG fentry:vmlinu*:vfs_read { printf("SUCCESS %d\n", pid); exit(); }
EXPECT_REGEX SUCCESS [0-9][0-9]*
REQUIRES_FEATURE fentry
AFTER ./testprogs/syscall read

# https://github.com/bpftrace/bpftrace/issues/2447
NAME fentry_multiple_attach_point_multiple_functions
PROG BEGIN { @a = 2; @b = 1; @c = 1 } i:s:1 { exit() } fentry:vfs_read, fentry:vfs_open /@a != 0/ { @a -= 1 } fentry:vfs_read /@b == 1/ { @b = 0 } fentry:vfs_open /@c == 1/ { @c = 0 }
EXPECT @a: 0
       @b: 0
       @c: 0
REQUIRES_FEATURE fentry
# Note: this calls both vfs_read and vfs_open
AFTER ./testprogs/syscall read

NAME fentry args
PROG fentry:vfs_read { printf("%d\n", args.count); exit(); }
EXPECT_REGEX [0-9][0-9]*
REQUIRES_FEATURE fentry
REQUIRES_FEATURE btf
AFTER ./testprogs/syscall read

# Checking backwards compatibility
NAME fentry args as a pointer
PROG fentry:vfs_read { printf("%d\n", args->count); exit(); }
EXPECT_REGEX [0-9][0-9]*
REQUIRES_FEATURE fentry
REQUIRES_FEATURE btf
AFTER ./testprogs/syscall read

NAME fentry func builtin
PROG fentry:vfs_read { printf("func: %s\n", func); exit(); }
EXPECT func: vfs_read
REQUIRES_FEATURE fentry
REQUIRES_FEATURE btf
REQUIRES_FEATURE get_func_ip
AFTER ./testprogs/syscall read

NAME fexit large args
PROG fexit:__sys_bpf { if (args.cmd == 1111 && args.size == 2222 && (int64)retval == -7) { printf("SUCCESS %d\n", pid); exit(); }}
EXPECT_REGEX SUCCESS [0-9][0-9]*
REQUIRES_FEATURE fentry
REQUIRES_FEATURE btf
AFTER ./testprogs/fentry_args 1111 2222

NAME fentry_warn_missing_probes
PROG fentry:vfs_read,fentry:nonsense { exit(); }
EXPECT WARNING: No BTF found for nonsense, skipping.

NAME fentry_ignore_missing_probes
PROG config = { missing_probes = "ignore" } fentry:vfs_read,fentry:nonsense { exit(); }
EXPECT_NONE WARNING: No BTF found for nonsense, skipping.

NAME fentry_error_missing_probes
PROG config = { missing_probes = "error" } fentry:vfs_read,fentry:nonsense { exit(); }
EXPECT ERROR: No BTF found for nonsense
WILL_FAIL

# Sanity check for kfunc/kretfunc alias
NAME kfunc
PROG kfunc:vfs_read { printf("SUCCESS %d\n", pid); exit(); }
EXPECT_REGEX SUCCESS [0-9][0-9]*
REQUIRES_FEATURE fentry
AFTER ./testprogs/syscall read

NAME kretfunc
PROG kretfunc:vfs_read { printf("SUCCESS %d\n", pid); exit(); }
EXPECT_REGEX SUCCESS [0-9][0-9]*
REQUIRES_FEATURE fentry
AFTER ./testprogs/syscall read

NAME kprobe
PROG kprobe:vfs_read { printf("SUCCESS %d\n", pid); exit(); }
EXPECT_REGEX SUCCESS [0-9][0-9]*
AFTER ./testprogs/syscall read

NAME kprobe_short_name
PROG k:vfs_read { printf("SUCCESS %d\n", pid); exit(); }
EXPECT_REGEX SUCCESS [0-9][0-9]*
AFTER ./testprogs/syscall read

NAME kprobe_order
RUN {{BPFTRACE}} runtime/scripts/kprobe_order.bt
EXPECT first second
AFTER /bin/bash -c "./testprogs/syscall nanosleep 1000"; /bin/bash -c "./testprogs/syscall nanosleep 1000"

NAME kprobe_offset
PROG kprobe:vfs_read+0 { printf("SUCCESS %d\n", pid); exit(); }
EXPECT_REGEX SUCCESS [0-9][0-9]*
AFTER ./testprogs/syscall read

NAME kprobe_wildcard
PROG kprobe:vmlinux:vfs_rea* { printf("SUCCESS %d\n", pid); exit(); }
EXPECT_REGEX SUCCESS [0-9][0-9]*
AFTER ./testprogs/syscall read

NAME kprobe_wildcard_multi
RUN {{BPFTRACE}} --unsafe -e 'kprobe:ksys_* { printf("progs: "); system("/usr/sbin/bpftool prog | grep kprobe | grep ksys_ | wc -l"); exit(); }'
EXPECT progs: 1
REQUIRES /usr/sbin/bpftool
REQUIRES_FEATURE kprobe_multi

NAME kprobe_module
PROG kprobe:vmlinux:vfs_read { printf("SUCCESS %d\n", pid); exit(); }
EXPECT_REGEX SUCCESS [0-9][0-9]*
AFTER ./testprogs/syscall read

NAME kprobe_module_wildcard
PROG kprobe:vmlinu*:vfs_read { printf("SUCCESS %d\n", pid); exit(); }
EXPECT_REGEX SUCCESS [0-9][0-9]*
AFTER ./testprogs/syscall read

NAME kprobe_module_missing
PROG kprobe:nonsense:vfs_read { printf("SUCCESS %d\n", pid); exit(); }
EXPECT ERROR: Error attaching probe: kprobe:nonsense:vfs_read: specified module nonsense in probe kprobe:nonsense:vfs_read is not loaded.
WILL_FAIL

NAME kprobe_wildcard_all_leading_underscore
PROG kprobe:_* { } interval:s:1{ printf("SUCCESS"); exit(); }
EXPECT_REGEX SUCCESS
ENV BPFTRACE_MAX_PROBES=20000
REQUIRES_FEATURE kprobe_multi

NAME kprobe_disallow_rcu_functions
PROG kprobe:rcu_* { printf("SUCCESS %d\n", pid); exit(); }
EXPECT No probes to attach
WILL_FAIL

NAME kprobe_hide_ftrace_invalid_address
RUN {{BPFTRACE}} -l | grep -c __ftrace_invalid_address__ || true
EXPECT 0

NAME kprobe_func_missing
PROG kprobe:vmlinux:nonsense { printf("SUCCESS %d\n", pid); exit(); }
EXPECT ERROR: Error attaching probe: kprobe:vmlinux:nonsense
WILL_FAIL

NAME kprobe_multi_wildcard
RUN {{BPFTRACE}} --unsafe -e 'kprobe:ksys_* { printf("link: "); system("/usr/sbin/bpftool link | grep kprobe_multi | wc -l"); exit(); }'
EXPECT link: 1
REQUIRES /usr/sbin/bpftool
REQUIRES_FEATURE kprobe_multi

NAME uprobe_multi_wildcard
RUN {{BPFTRACE}} --unsafe -e 'uprobe:./testprogs/uprobe_test:uprobeFunction* { printf("link: "); system("/usr/sbin/bpftool link | grep -E \"uprobe_multi|type 12\" | wc -l"); exit(); }'
EXPECT link: 1
REQUIRES /usr/sbin/bpftool
REQUIRES_FEATURE uprobe_multi
AFTER ./testprogs/uprobe_test

NAME kprobe_wildcard probe builtin
RUN {{BPFTRACE}} --unsafe -e 'kprobe:ksys_* { @ = probe; printf("progs: "); system("/usr/sbin/bpftool prog | grep kprobe | grep ksys_ | wc -l"); exit(); }'
EXPECT_REGEX progs: [1-9][0-9]+
REQUIRES /usr/sbin/bpftool

# Note: this test may fail if you've installed a new kernel but not rebooted
# yet. Reason is b/c bpftrace will look for a vmlinux based on the running kernel's
# version.
NAME kprobe_offset_fail_size
PROG kprobe:vfs_read+1000000 { printf("SUCCESS %d\n", pid); exit(); }
EXPECT_REGEX Offset outside the function bounds \('vfs_read' size is*
WILL_FAIL
# See https://github.com/bpftrace/bpftrace/pull/956
SKIP_IF_ENV_HAS CI=true

NAME kprobe_multi_mixed_attachpoint
PROG kprobe:vfs_read,kprobe:nonsense* { printf("SUCCESS\n"); exit(); }
EXPECT SUCCESS
REQUIRES_FEATURE kprobe_multi
AFTER ./testprogs/syscall read

NAME kprobe_offset_module
RUN {{BPFTRACE}} -e 'kprobe:nft_trans_alloc_gfp+0x5 { printf("hit\n"); exit(); }'
AFTER /usr/sbin/nft add table bpftrace
EXPECT hit
ARCH x86_64
REQUIRES lsmod | grep '^nf_tables'
REQUIRES /usr/sbin/nft --help
CLEANUP /usr/sbin/nft delete table bpftrace

# Local entry point to nft_trans_alloc_gfp is located at offset of 8 bytes in ppc64 and aarch64.
NAME kprobe_offset_module
RUN {{BPFTRACE}} -e 'kprobe:nft_trans_alloc_gfp+0x8 { printf("hit\n"); exit(); }'
AFTER /usr/sbin/nft add table bpftrace
EXPECT hit
ARCH ppc64|ppc64le|aarch64
REQUIRES lsmod | grep '^nf_tables'
REQUIRES /usr/sbin/nft --help
CLEANUP /usr/sbin/nft delete table bpftrace

NAME kprobe_offset_module_error
RUN {{BPFTRACE}} -e 'kprobe:nft_trans_alloc_gfp+0x1 { printf("hit\n"); exit(); }'
EXPECT ERROR: Possible attachment attempt in the middle of an instruction, try a different offset.
ARCH x86_64
REQUIRES lsmod | grep '^nf_tables'
WILL_FAIL

NAME kprobe_offset_module_error
RUN {{BPFTRACE}} -e 'kprobe:nft_trans_alloc_gfp+0x1 { printf("hit\n"); exit(); }'
EXPECT cannot attach kprobe, Invalid argument
ARCH aarch64
REQUIRES lsmod | grep '^nf_tables'
WILL_FAIL

NAME kprobe_warn_missing_probes
PROG kprobe:vfs_read,kprobe:nonsense { exit(); }
EXPECT WARNING: could not attach probe kprobe:nonsense, skipping.

NAME kprobe_ignore_missing_probes
PROG config = { missing_probes = "ignore" } kprobe:vfs_read,kprobe:nonsense { exit(); }
EXPECT_NONE WARNING: could not attach probe kprobe:nonsense, skipping.

NAME kprobe_error_missing_probes
PROG config = { missing_probes = "error" } kprobe:vfs_read,kprobe:nonsense { exit(); }
EXPECT ERROR: Error attaching probe: kprobe:nonsense
WILL_FAIL

NAME kretprobe
PROG kretprobe:vfs_read { printf("SUCCESS %d\n", pid); exit(); }
EXPECT_REGEX SUCCESS [0-9][0-9]*
AFTER ./testprogs/syscall read

NAME kretprobe_short_name
PROG kr:vfs_read { printf("SUCCESS %d\n", pid); exit(); }
EXPECT_REGEX SUCCESS [0-9][0-9]*
AFTER ./testprogs/syscall read

NAME kretprobe_order
RUN {{BPFTRACE}} runtime/scripts/kretprobe_order.bt
EXPECT first second
AFTER /bin/bash -c "./testprogs/syscall nanosleep 1000"; /bin/bash -c "./testprogs/syscall nanosleep 1000"

NAME kretprobe_wildcard
PROG kretprobe:vmlinux:vfs_rea* { printf("SUCCESS %d\n", pid); exit(); }
EXPECT_REGEX SUCCESS [0-9][0-9]*
AFTER ./testprogs/syscall read

NAME kretprobe_wildcard_multi
RUN {{BPFTRACE}} --unsafe -e 'kretprobe:ksys_* { system("/usr/sbin/bpftool prog | grep kprobe | grep ksys_ | wc -l"); exit(); }'
EXPECT 1
REQUIRES /usr/sbin/bpftool
REQUIRES_FEATURE kprobe_multi

NAME kretprobe_wildcard_multi_link
RUN {{BPFTRACE}} --unsafe -e 'kretprobe:ksys_* { printf("link: "); system("/usr/sbin/bpftool link | grep kprobe_multi | wc -l"); exit(); }'
EXPECT link: 1
REQUIRES /usr/sbin/bpftool
REQUIRES_FEATURE kprobe_multi

NAME uretprobe_multi_wildcard
RUN {{BPFTRACE}} --unsafe -e 'uretprobe:./testprogs/uprobe_test:uprobeFunction* { printf("link: "); system("/usr/sbin/bpftool link | grep -E \"uprobe_multi|type 12\" | wc -l"); exit(); }'
EXPECT link: 1
REQUIRES /usr/sbin/bpftool
REQUIRES_FEATURE uprobe_multi
AFTER ./testprogs/uprobe_test

NAME uprobe_multi_wildcard_target_wildcard
RUN {{BPFTRACE}} --unsafe -e 'uretprobe:*:uprobeFunction* { printf("link: "); system("/usr/sbin/bpftool link | grep -E \"uprobe_multi|type 12\" | wc -l"); exit(); }' -p {{BEFORE_PID}}
EXPECT link: 1
REQUIRES /usr/sbin/bpftool
REQUIRES_FEATURE uprobe_multi
BEFORE ./testprogs/uprobe_test

NAME uprobe
PROG uprobe:/bin/bash:echo_builtin { printf("arg0: %d\n", arg0); exit();}
EXPECT_REGEX arg0: [0-9]*
AFTER /bin/bash -c "echo lala"

NAME uprobe_offset
PROG uprobe:/bin/bash:echo_builtin+0 { printf("arg0: %d\n", arg0); exit();}
EXPECT_REGEX arg0: [0-9]*
AFTER /bin/bash -c "echo lala"

NAME uprobe_offset
PROG uprobe:/bin/bash:"echo_builtin"+0 { printf("arg0: %d\n", arg0); exit();}
EXPECT_REGEX arg0: [0-9]*
AFTER /bin/bash -c "echo lala"

NAME uprobe_offset_fail_size
PROG uprobe:/bin/bash:echo_builtin+1000000 { printf("arg0: %d\n", arg0); exit();}
EXPECT_REGEX Offset outside the function bounds \('echo_builtin' size is*
WILL_FAIL

NAME uprobe_address_fail_resolve
PROG uprobe:/bin/bash:10 { printf("arg0: %d\n", arg0); exit();}
EXPECT ERROR: Could not resolve address: /bin/bash:0xa
WILL_FAIL

NAME uprobe_library
PROG uprobe:libc:fread { printf("size: %d\n", arg1); exit(); }
EXPECT_REGEX size: [0-9]+
AFTER ./testprogs/uprobe_library
REQUIRES_FEATURE libpath_resolv

NAME uprobe_order
RUN {{BPFTRACE}} runtime/scripts/uprobe_order.bt
EXPECT first second
AFTER /bin/bash -c "echo lala"; /bin/bash -c "echo lala"

NAME uprobe_zero_size
PROG uprobe:./testprogs/uprobe_test:_init { printf("arg0: %d\n", arg0); exit();}
EXPECT ERROR: Could not determine boundary for _init (symbol has size 0).
       Use --unsafe to force attachment. WARNING: This option could lead to data corruption in the target process.
WILL_FAIL

NAME uprobe_zero_size_unsafe
RUN {{BPFTRACE}} --unsafe -e 'uprobe:./testprogs/uprobe_test:_init { printf("arg0: %d\n", arg0); exit();}'
EXPECT_REGEX arg0: [0-9]*
AFTER ./testprogs/uprobe_test

NAME uprobe_warn_missing_probes
PROG uprobe:./testprogs/uprobe_test:uprobeFunction1,uprobe:./testprogs/uprobe_test:uprobeFunction3 { exit(); }
EXPECT WARNING: Could not resolve symbol: ./testprogs/uprobe_test:uprobeFunction3, skipping probe.
AFTER ./testprogs/uprobe_test

NAME uprobe_ignore_missing_probes
PROG config = { missing_probes = "ignore" } uprobe:./testprogs/uprobe_test:uprobeFunction1,uprobe:./testprogs/uprobe_test:uprobeFunction3 { exit(); }
EXPECT_NONE WARNING: Could not resolve symbol: ./testprogs/uprobe_test:uprobeFunction3, skipping probe.
AFTER ./testprogs/uprobe_test

NAME uprobe_error_missing_probes
PROG config = { missing_probes = "error" } uprobe:./testprogs/uprobe_test:uprobeFunction1,uprobe:./testprogs/uprobe_test:uprobeFunction3 { exit(); }
EXPECT ERROR: Could not resolve symbol: ./testprogs/uprobe_test:uprobeFunction3, cannot attach probe.
AFTER ./testprogs/uprobe_test
WILL_FAIL

NAME uretprobe
PROG uretprobe:/bin/bash:echo_builtin { printf("readline: %d\n", retval); exit();}
EXPECT_REGEX readline: [0-9]*
AFTER /bin/bash -c "echo lala"

NAME uretprobe_order
RUN {{BPFTRACE}} runtime/scripts/uretprobe_order.bt
EXPECT first second
AFTER /bin/bash -c "echo lala"; /bin/bash -c "echo lala"

NAME tracepoint
PROG tracepoint:syscalls:sys_exit_nanosleep { printf("SUCCESS %d\n", gid); exit(); }
EXPECT_REGEX SUCCESS [0-9][0-9]*
AFTER ./testprogs/syscall nanosleep 1e8

NAME tracepoint_short_name
PROG t:syscalls:sys_exit_nanosleep { printf("SUCCESS %d\n", gid); exit(); }
EXPECT_REGEX SUCCESS [0-9][0-9]*
AFTER ./testprogs/syscall nanosleep 1e8

NAME tracepoint_order
RUN {{BPFTRACE}} runtime/scripts/tracepoint_order.bt
EXPECT first second
AFTER ./testprogs/syscall nanosleep 1e8; ./testprogs/syscall nanosleep 1e8

NAME tracepoint_expansion
RUN {{BPFTRACE}} -e 'tracepoint:syscalls:sys_*_nanosleep { printf("hit\n"); }' -c "./testprogs/syscall nanosleep 1e8"
EXPECT hit

NAME tracepoint_missing
PROG t:syscalls:nonsense { printf("hit"); exit(); }
EXPECT stdin:1:1-20: ERROR: tracepoint not found: syscalls:nonsense
WILL_FAIL

NAME tracepoint_multiattach_missing
PROG t:syscalls:sys_exit_nanosleep,t:syscalls:nonsense { printf("hit"); exit(); }
EXPECT hit
AFTER ./testprogs/syscall nanosleep 1e8
WILL_FAIL

NAME tracepoint args
PROG tracepoint:syscalls:sys_enter_read { printf("%d\n", args.count); exit(); }
EXPECT_REGEX [0-9][0-9]*
AFTER ./testprogs/syscall read

# Checking backwards compatibility
NAME tracepoint args as pointer
PROG tracepoint:syscalls:sys_enter_read { printf("%d\n", args->count); exit(); }
EXPECT_REGEX [0-9][0-9]*
AFTER ./testprogs/syscall read

# Test that we get at least two characters out
NAME tracepoint_data_loc
PROG tracepoint:irq:irq_handler_entry { print(str(args.name)); exit(); }
EXPECT_REGEX ..+

NAME rawtracepoint
PROG rawtracepoint:sys_exit { printf("SUCCESS %d\n", gid); exit(); }
EXPECT_REGEX SUCCESS [0-9][0-9]*
AFTER ./testprogs/syscall nanosleep 1e8

NAME rawtracepoint_short_name
PROG rt:sys_exit { printf("SUCCESS %d\n", gid); exit(); }
EXPECT_REGEX SUCCESS [0-9][0-9]*
AFTER ./testprogs/syscall nanosleep 1e8

NAME rawtracepoint_missing
PROG rawtracepoint:nonsense { printf("hit"); exit(); }
EXPECT ERROR: Probe does not exist: rawtracepoint:nonsense
WILL_FAIL

NAME rawtracepoint_wildcard
PROG rawtracepoint:sys_* { printf("SUCCESS %d\n", gid); exit(); }
EXPECT_REGEX SUCCESS [0-9][0-9]*
AFTER ./testprogs/syscall nanosleep

NAME profile
PROG profile:hz:599 { print("hit"); exit(); }
EXPECT hit

NAME profile_short_name
PROG p:hz:599 { print("hit"); exit(); }
EXPECT hit

NAME profile_probe_builtin
PROG profile:hz:599 { print(probe); exit();}
EXPECT profile:hz:599

NAME interval
PROG interval:ms:1 { print("hit"); exit(); }
EXPECT hit

NAME interval_short_name
PROG i:ms:1{ print("hit"); exit();}
EXPECT hit

NAME interval_probe_builtin
PROG interval:ms:1 { print(probe); exit();}
EXPECT interval:ms:1

NAME software
PROG software:cpu-clock:1 { print("hit"); exit();}
EXPECT hit

NAME software_probe_builtin
PROG software:cpu-clock:1 { print(probe); exit();}
EXPECT software:cpu-clock:1

NAME software_alias_probe_builtin
PROG software:cpu:1 { print(probe); exit();}
EXPECT software:cpu:1

NAME hardware
REQUIRES ls /sys/devices/cpu/events/cache-misses
PROG hardware:cache-misses:10 { print("hit"); exit(); }
EXPECT hit

NAME hardware_probe_builtin
REQUIRES ls /sys/devices/cpu/events/cache-misses
PROG hardware:cache-misses:10 { print(probe); exit();}
EXPECT hardware:cache-misses:10

NAME BEGIN
PROG BEGIN { printf("Hello\n"); exit();}
EXPECT Hello
TIMEOUT 2

NAME END_processing_after_exit
PROG interval:s:1 { exit(); } END { printf("end"); }
EXPECT end
TIMEOUT 2

NAME BEGIN,END
PROG BEGIN,END { printf("Hello\n"); exit(); }
EXPECT Hello
       Hello
TIMEOUT 2

# The "probe" builtin forces bpftrace to generate one BPF function for each
# match and so we should fail on exceeding BPFTRACE_MAX_BPF_PROGS.
NAME bpf_programs_limit
PROG k:* { @[probe] = count(); }
EXPECT_REGEX ERROR: Failed to compile: Your program is trying to generate more than \d+ BPF programs, which exceeds the current limit of 512.\nYou can increase the limit through the BPFTRACE_MAX_BPF_PROGS environment variable.
WILL_FAIL
TIMEOUT 2

NAME sanitise probe name
PROG uprobe:./testprogs/uprobe_namesan:fn* { printf("ok\n"); exit(); }
EXPECT ok
AFTER ./testprogs/uprobe_namesan
