Multi kprobe ftrace_lookup_symbols question

Multi kprobe ftrace_lookup_symbols question

[Vincent Li]

Hi,

I have sample code like below to give duplicate "vprintk" symbols to
multi kprobe attachment, it results in ESRCH return from
ftrace_lookup_symbols, I assume it should be user space code
responsibility not to feed kernel with duplicate symbols, correct? the
sort_r() in  bpf_kprobe_multi_link_attach() seems not to remove
duplicate symbols.

import (

        "fmt"


        "github.com/cilium/ebpf"

        "github.com/cilium/ebpf/asm"

        "github.com/cilium/ebpf/link"

)


func detectKprobeMulti() bool {

        prog, err := ebpf.NewProgram(&ebpf.ProgramSpec{

                Name: "probe_bpf_kprobe_multi_link",

                Type: ebpf.Kprobe,

                Instructions: asm.Instructions{

                        asm.Mov.Imm(asm.R0, 0),

                        asm.Return(),

                },

                AttachType: ebpf.AttachTraceKprobeMulti,

                License:    "MIT",

        })

        if err != nil {

                return false

        }

        defer prog.Close()


        syms := []string{"vprintk", "vprintk"}

        opts := link.KprobeMultiOptions{Symbols: syms}


        _, err = link.KprobeMulti(prog, opts)

        return err == nil

}


func main() {

        if detectKprobeMulti() {

                fmt.Println(" it works\n")

        }

}

Re: Multi kprobe ftrace_lookup_symbols question

[Jiri Olsa]

On Tue, Sep 27, 2022 at 07:58:23AM -0700, Vincent Li wrote:
> Hi,
> 
> I have sample code like below to give duplicate "vprintk" symbols to
> multi kprobe attachment, it results in ESRCH return from
> ftrace_lookup_symbols, I assume it should be user space code
> responsibility not to feed kernel with duplicate symbols, correct? the
> sort_r() in  bpf_kprobe_multi_link_attach() seems not to remove
> duplicate symbols.

hi,
correct, symbols must be unique, ftrace_lookup_symbols (kernel/trace/ftrace.c)
will fail if there are duplicate symbols on input

> 
> import (
> 
>         "fmt"
> 
> 
>         "github.com/cilium/ebpf"
> 
>         "github.com/cilium/ebpf/asm"
> 
>         "github.com/cilium/ebpf/link"
> 
> )
> 
> 
> func detectKprobeMulti() bool {
> 
>         prog, err := ebpf.NewProgram(&ebpf.ProgramSpec{
> 
>                 Name: "probe_bpf_kprobe_multi_link",
> 
>                 Type: ebpf.Kprobe,
> 
>                 Instructions: asm.Instructions{
> 
>                         asm.Mov.Imm(asm.R0, 0),
> 
>                         asm.Return(),
> 
>                 },
> 
>                 AttachType: ebpf.AttachTraceKprobeMulti,
> 
>                 License:    "MIT",
> 
>         })
> 
>         if err != nil {
> 
>                 return false
> 
>         }
> 
>         defer prog.Close()
> 
> 
>         syms := []string{"vprintk", "vprintk"}
> 
>         opts := link.KprobeMultiOptions{Symbols: syms}

you can resolve all 'vprintk' functions yourself and attach it through
KprobeMultiOptions::Addresses array

jirka

> 
> 
>         _, err = link.KprobeMulti(prog, opts)
> 
>         return err == nil
> 
> }
> 
> 
> func main() {
> 
>         if detectKprobeMulti() {
> 
>                 fmt.Println(" it works\n")
> 
>         }
> 
> }

Re: Multi kprobe ftrace_lookup_symbols question

[Vincent Li]

On Tue, Sep 27, 2022 at 8:49 AM Jiri Olsa <olsajiri@gmail.com> wrote:
>
> On Tue, Sep 27, 2022 at 07:58:23AM -0700, Vincent Li wrote:
> > Hi,
> >
> > I have sample code like below to give duplicate "vprintk" symbols to
> > multi kprobe attachment, it results in ESRCH return from
> > ftrace_lookup_symbols, I assume it should be user space code
> > responsibility not to feed kernel with duplicate symbols, correct? the
> > sort_r() in  bpf_kprobe_multi_link_attach() seems not to remove
> > duplicate symbols.
>
> hi,
> correct, symbols must be unique, ftrace_lookup_symbols (kernel/trace/ftrace.c)
> will fail if there are duplicate symbols on input
>
> >
> > import (
> >
> >         "fmt"
> >
> >
> >         "github.com/cilium/ebpf"
> >
> >         "github.com/cilium/ebpf/asm"
> >
> >         "github.com/cilium/ebpf/link"
> >
> > )
> >
> >
> > func detectKprobeMulti() bool {
> >
> >         prog, err := ebpf.NewProgram(&ebpf.ProgramSpec{
> >
> >                 Name: "probe_bpf_kprobe_multi_link",
> >
> >                 Type: ebpf.Kprobe,
> >
> >                 Instructions: asm.Instructions{
> >
> >                         asm.Mov.Imm(asm.R0, 0),
> >
> >                         asm.Return(),
> >
> >                 },
> >
> >                 AttachType: ebpf.AttachTraceKprobeMulti,
> >
> >                 License:    "MIT",
> >
> >         })
> >
> >         if err != nil {
> >
> >                 return false
> >
> >         }
> >
> >         defer prog.Close()
> >
> >
> >         syms := []string{"vprintk", "vprintk"}
> >
> >         opts := link.KprobeMultiOptions{Symbols: syms}
>
> you can resolve all 'vprintk' functions yourself and attach it through
> KprobeMultiOptions::Addresses array

Thank you for all your clarification!
>
> jirka
>
> >
> >
> >         _, err = link.KprobeMulti(prog, opts)
> >
> >         return err == nil
> >
> > }
> >
> >
> > func main() {
> >
> >         if detectKprobeMulti() {
> >
> >                 fmt.Println(" it works\n")
> >
> >         }
> >
> > }