Hi,
I have sample code like below to give duplicate "vprintk" symbols to
multi kprobe attachment, it results in ESRCH return from
ftrace_lookup_symbols, I assume it should be user space code
responsibility not to feed kernel with duplicate symbols, correct? the
sort_r() in bpf_kprobe_multi_link_attach() seems not to remove
duplicate symbols.
import (
"fmt"
"github.com/cilium/ebpf"
"github.com/cilium/ebpf/asm"
"github.com/cilium/ebpf/link"
)
func detectKprobeMulti() bool {
prog, err := ebpf.NewProgram(&ebpf.ProgramSpec{
Name: "probe_bpf_kprobe_multi_link",
Type: ebpf.Kprobe,
Instructions: asm.Instructions{
asm.Mov.Imm(asm.R0, 0),
asm.Return(),
},
AttachType: ebpf.AttachTraceKprobeMulti,
License: "MIT",
})
if err != nil {
return false
}
defer prog.Close()
syms := []string{"vprintk", "vprintk"}
opts := link.KprobeMultiOptions{Symbols: syms}
_, err = link.KprobeMulti(prog, opts)
return err == nil
}
func main() {
if detectKprobeMulti() {
fmt.Println(" it works\n")
}
}
