iovisor / gobpf

Go bindings for creating BPF programs.
Apache License 2.0
2.15k stars 314 forks source link

Can't attach two functions to the same kprobe event #251

Open yanivagman opened 4 years ago

yanivagman commented 4 years ago

We have a use case where we need to attach two different functions to the same kprobe event (mmap syscall in one case). The use case is legitimate, as the user can choose to have one of these events or both. For some reason, this is not allowed as the function "attachProbe" (bcc/module.go) has the following check:

func (bpf *Module) attachProbe(evName string, attachType uint32, fnName string, fd int, maxActive int) error { if _, ok := bpf.kprobes[evName]; ok { return nil } ... ... bpf.kprobes[evName] = int(res) return nil }

With python bcc bindings there is no such issue, and I can attach two functions to a single kprobe event at once.

Any good reason for this check?

itaysk commented 4 years ago

any thoughts on this from the maintainers? I can fix this if someone green-lights it