On Tue, Sep 27, 2022 at 07:58:23AM -0700, Vincent Li wrote:
> Hi,
>
> I have sample code like below to give duplicate "vprintk" symbols to
> multi kprobe attachment, it results in ESRCH return from
> ftrace_lookup_symbols, I assume it should be user space code
> responsibility not to feed kernel with duplicate symbols, correct? the
> sort_r() in bpf_kprobe_multi_link_attach() seems not to remove
> duplicate symbols.
hi,
correct, symbols must be unique, ftrace_lookup_symbols (kernel/trace/ftrace.c)
will fail if there are duplicate symbols on input
>
> import (
>
> "fmt"
>
>
> "github.com/cilium/ebpf"
>
> "github.com/cilium/ebpf/asm"
>
> "github.com/cilium/ebpf/link"
>
> )
>
>
> func detectKprobeMulti() bool {
>
> prog, err := ebpf.NewProgram(&ebpf.ProgramSpec{
>
> Name: "probe_bpf_kprobe_multi_link",
>
> Type: ebpf.Kprobe,
>
> Instructions: asm.Instructions{
>
> asm.Mov.Imm(asm.R0, 0),
>
> asm.Return(),
>
> },
>
> AttachType: ebpf.AttachTraceKprobeMulti,
>
> License: "MIT",
>
> })
>
> if err != nil {
>
> return false
>
> }
>
> defer prog.Close()
>
>
> syms := []string{"vprintk", "vprintk"}
>
> opts := link.KprobeMultiOptions{Symbols: syms}
you can resolve all 'vprintk' functions yourself and attach it through
KprobeMultiOptions::Addresses array
jirka
>
>
> _, err = link.KprobeMulti(prog, opts)
>
> return err == nil
>
> }
>
>
> func main() {
>
> if detectKprobeMulti() {
>
> fmt.Println(" it works\n")
>
> }
>
> }
