How to disable a program before spec.LoadAndAssign? #39629

[Robin3Chan]

I want to disable a kprobe program before LoadAndAssign, because some Linux kernel does not support the target kernel functions. Using libbpf, I can set autoload to "false". How could I disable the program with cilium?

bpf_program__set_autoload(obj->progs.my_test, false);

[Ghostbaby]

Hi @Robin3Chan ,You can achieve similar functionality to libbpf's bpf_program__set_autoload(obj->progs.my_test, false) in cilium/ebpf through several approaches:

Method 1: Remove Program from Spec

// Completely remove unsupported programs from spec
delete(spec.Programs, "my_test")

coll, err := ebpf.NewCollectionWithOptions(spec, ebpf.CollectionOptions{})

Method 2: Conditional Compilation + Runtime Checks

Your use case is perfect for combining compile-time conditionals with runtime checks. Here's an example inspired by kernel compatibility patterns:

In your eBPF C code:

#if LINUX_KERNEL_VERSION >= KERNEL_VERSION(5, 10, 0)
SEC("kprobe/target_function")
int my_test(struct pt_regs *ctx) {
    // Implementation for newer kernels
    return 0;
}
#else
// Alternative implementation or no-op for older kernels
#endif

In your Go code:

func loadProgramsConditionally() error {
    spec, err := loadMyEBPFSpec()
    if err != nil {
        return err
    }
    
    // Runtime kernel compatibility check
    if !kernelSupportsKprobe("target_function") {
        // Method 1: Disable by setting type
        if progSpec, exists := spec.Programs["my_test"]; exists {
            progSpec.Type = ebpf.UnspecifiedProgram
        }
        
        // OR Method 2: Remove entirely
        // delete(spec.Programs, "my_test")
    }
    
    coll, err := ebpf.NewCollectionWithOptions(spec, ebpf.CollectionOptions{})
    if err != nil {
        return err
    }
    defer coll.Close()
    
    // Only attach programs that exist and are valid
    if prog := coll.Programs["my_test"]; prog != nil && prog.Type() != ebpf.UnspecifiedProgram {
        l, err := link.Kprobe(link.KprobeOptions{
            Symbol: "target_function", 
            Program: prog,
        })
        if err != nil {
            return err
        }
        defer l.Close()
    }
    
    return nil
}

func kernelSupportsKprobe(symbol string) bool {
    // Check if the kernel symbol exists
    if _, err := os.Stat("/proc/kallsyms"); err != nil {
        return false
    }
    
    // You could also check kernel version, probe for features, etc.
    return checkSymbolExists(symbol)
}

Method 3: Using CollectionOptions.Programs

spec, err := loadMyEBPFSpec()
if err != nil {
    return err
}

// Create a map of programs to load, excluding unsupported ones
programsToLoad := make(map[string]*ebpf.Program)
for name, progSpec := range spec.Programs {
    if name == "my_test" && !kernelSupportsTargetFunction() {
        continue // Skip loading this program
    }
    programsToLoad[name] = progSpec
}

coll, err := ebpf.NewCollectionWithOptions(spec, ebpf.CollectionOptions{
    Programs: programsToLoad,
})