We have a use case where we need to attach two different functions to the same kprobe event (mmap syscall in one case).
The use case is legitimate, as the user can choose to have one of these events or both.
For some reason, this is not allowed as the function "attachProbe" (bcc/module.go) has the following check:
We have a use case where we need to attach two different functions to the same kprobe event (mmap syscall in one case). The use case is legitimate, as the user can choose to have one of these events or both. For some reason, this is not allowed as the function "attachProbe" (bcc/module.go) has the following check:
func (bpf *Module) attachProbe(evName string, attachType uint32, fnName string, fd int, maxActive int) error { if _, ok := bpf.kprobes[evName]; ok { return nil } ... ... bpf.kprobes[evName] = int(res) return nil }
With python bcc bindings there is no such issue, and I can attach two functions to a single kprobe event at once.
Any good reason for this check?