linuxlinux-kernelebpfbpfkprobe

Kprobe BPF programs execution order


Is there a reliable way to explicitly specify BPF kprobe programs execution order (without kretprobes).

For example, when I name programs like kprobe__<func>_1 and kprobe__<func>_2 I get an execution order like kprobe__<func>_2 -> kprobe__<func>_1, that is in backward order. Does the order of programs loading or it's name makes sense? I can't find any documentation about that and don't know how to make sure that my programs will be executed in order I really need on whole kernels.

I was just trying to rename my functions with suffixes _[n], where n is strighly positive number (including zero), and it works, but doesn't gives sure that it will work on whole kernels same.


Solution

  • It is not possible to guarantee a particular execution order of kprobe programs since the ordering can vary across different kernel versions. Even relying on naming conventions or the order in which the programs were loaded does not guarantee a specific execution order.

    Therefore, it is advisable to design kprobe programs that are independent of each other's order of execution or combine them into one.