2

Is there a reliable way to explicitly specify BPF kprobe programs execution order (without kretprobes).

For example, when I name programs like kprobe__<func>_1 and kprobe__<func>_2 I get an execution order like kprobe__<func>_2 -> kprobe__<func>_1, that is in backward order. Does the order of programs loading or it's name makes sense? I can't find any documentation about that and don't know how to make sure that my programs will be executed in order I really need on whole kernels.

I was just trying to rename my functions with suffixes _[n], where n is strighly positive number (including zero), and it works, but doesn't gives sure that it will work on whole kernels same.

pchaigno
  • 11,313
  • 2
  • 29
  • 54
Tim
  • 25
  • 2

1 Answers1

1

It is not possible to guarantee a particular execution order of kprobe programs since the ordering can vary across different kernel versions. Even relying on naming conventions or the order in which the programs were loaded does not guarantee a specific execution order.

Therefore, it is advisable to design kprobe programs that are independent of each other's order of execution or combine them into one.

Hedam
  • 2,209
  • 27
  • 53
  • Unfortunately there's a necessary because of old kernel with back port of bpf (e.g. centos 3.10) has a limitations of prog size and have no support of `bpf_tail_call` – Tim Apr 19 '23 at 10:09
  • 1
    I don't think you can do much about that other than not supporting versions that backported BPF. Since there exist no guarantees, for ordering you are out of luck. – Hedam Apr 19 '23 at 11:24