On Tue, Sep 27, 2022 at 8:49 AM Jiri Olsa <olsajiri@xxxxxxxxx> wrote:
>
> On Tue, Sep 27, 2022 at 07:58:23AM -0700, Vincent Li wrote:
> > Hi,
> >
> > I have sample code like below to give duplicate "vprintk" symbols to
> > multi kprobe attachment, it results in ESRCH return from
> > ftrace_lookup_symbols, I assume it should be user space code
> > responsibility not to feed kernel with duplicate symbols, correct? the
> > sort_r() in bpf_kprobe_multi_link_attach() seems not to remove
> > duplicate symbols.
>
> hi,
> correct, symbols must be unique, ftrace_lookup_symbols (kernel/trace/ftrace.c)
> will fail if there are duplicate symbols on input
>
> >
> > import (
> >
> > "fmt"
> >
> >
> > "github.com/cilium/ebpf"
> >
> > "github.com/cilium/ebpf/asm"
> >
> > "github.com/cilium/ebpf/link"
> >
> > )
> >
> >
> > func detectKprobeMulti() bool {
> >
> > prog, err := ebpf.NewProgram(&ebpf.ProgramSpec{
> >
> > Name: "probe_bpf_kprobe_multi_link",
> >
> > Type: ebpf.Kprobe,
> >
> > Instructions: asm.Instructions{
> >
> > asm.Mov.Imm(asm.R0, 0),
> >
> > asm.Return(),
> >
> > },
> >
> > AttachType: ebpf.AttachTraceKprobeMulti,
> >
> > License: "MIT",
> >
> > })
> >
> > if err != nil {
> >
> > return false
> >
> > }
> >
> > defer prog.Close()
> >
> >
> > syms := []string{"vprintk", "vprintk"}
> >
> > opts := link.KprobeMultiOptions{Symbols: syms}
>
> you can resolve all 'vprintk' functions yourself and attach it through
> KprobeMultiOptions::Addresses array
Thank you for all your clarification!
>
> jirka
>
> >
> >
> > _, err = link.KprobeMulti(prog, opts)
> >
> > return err == nil
> >
> > }
> >
> >
> > func main() {
> >
> > if detectKprobeMulti() {
> >
> > fmt.Println(" it works\n")
> >
> > }
> >
> > }
