From 672ef700b08dba21d3ccdaa2683aee012133a405 Mon Sep 17 00:00:00 2001 From: Arun Singh Date: Sat, 6 Jun 2026 11:26:51 +0000 Subject: [PATCH] link: expose syscall wrapper symbol helper Signed-off-by: Arun Singh --- link/kprobe.go | 10 ++++++++++ link/kprobe_multi_test.go | 4 +--- link/kprobe_test.go | 12 ++++++++++++ 3 files changed, 23 insertions(+), 3 deletions(-) diff --git a/link/kprobe.go b/link/kprobe.go index 8b27677f9..68cab96af 100644 --- a/link/kprobe.go +++ b/link/kprobe.go @@ -50,6 +50,16 @@ func (ko *KprobeOptions) cookie() uint64 { return ko.Cookie } +// SyscallWrapper returns the platform-specific kernel wrapper symbol for syscall. +func SyscallWrapper(syscall string) string { + prefix := linux.PlatformPrefix() + if prefix == "" || strings.HasPrefix(syscall, prefix) { + return syscall + } + + return prefix + syscall +} + // Kprobe attaches the given eBPF program to a perf event that fires when the // given kernel symbol starts executing. See /proc/kallsyms for available // symbols. For example, printk(): diff --git a/link/kprobe_multi_test.go b/link/kprobe_multi_test.go index 2942b46d7..7cf615d33 100644 --- a/link/kprobe_multi_test.go +++ b/link/kprobe_multi_test.go @@ -11,7 +11,6 @@ import ( "github.com/cilium/ebpf" "github.com/cilium/ebpf/features" - "github.com/cilium/ebpf/internal/linux" "github.com/cilium/ebpf/internal/testutils" "github.com/cilium/ebpf/internal/unix" ) @@ -127,9 +126,8 @@ func TestKprobeMultiProgramCall(t *testing.T) { // Use actual syscall names with platform prefix. // For simplicity, just assert the increment happens with any symbol in the array. - prefix := linux.PlatformPrefix() opts := KprobeMultiOptions{ - Symbols: []string{prefix + "sys_getpid", prefix + "sys_gettid"}, + Symbols: []string{SyscallWrapper("sys_getpid"), SyscallWrapper("sys_gettid")}, } km, err := KprobeMulti(p, opts) if err != nil { diff --git a/link/kprobe_test.go b/link/kprobe_test.go index 9da09a76e..8c2d87149 100644 --- a/link/kprobe_test.go +++ b/link/kprobe_test.go @@ -11,6 +11,7 @@ import ( "github.com/cilium/ebpf" "github.com/cilium/ebpf/asm" + "github.com/cilium/ebpf/internal/linux" "github.com/cilium/ebpf/internal/testutils" "github.com/cilium/ebpf/internal/tracefs" "github.com/cilium/ebpf/internal/unix" @@ -27,6 +28,17 @@ var symTests = []string{ "unregister_kprobes.part.0", // function body that was split and partially inlined } +func TestSyscallWrapper(t *testing.T) { + prefix := linux.PlatformPrefix() + + qt.Assert(t, qt.Equals(SyscallWrapper("sys_getpid"), prefix+"sys_getpid")) + + if prefix != "" { + wrapped := prefix + "sys_getpid" + qt.Assert(t, qt.Equals(SyscallWrapper(wrapped), wrapped)) + } +} + func TestKprobe(t *testing.T) { prog := mustLoadProgram(t, ebpf.Kprobe, 0, "")