linux-kernel - Re: [PATCH bpf-next 2/4] libbpf: Add uprobe syscall feature detection

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <aSa6gA2o-2-0YMQW@krava>
Date: Wed, 26 Nov 2025 09:29:52 +0100
From: Jiri Olsa <olsajiri@...il.com>
To: Andrii Nakryiko <andrii.nakryiko@...il.com>
Cc: Andrii Nakryiko <andrii@...nel.org>, bpf@...r.kernel.org,
	linux-kernel@...r.kernel.org, Song Liu <songliubraving@...com>,
	Yonghong Song <yhs@...com>,
	John Fastabend <john.fastabend@...il.com>
Subject: Re: [PATCH bpf-next 2/4] libbpf: Add uprobe syscall feature detection

On Mon, Nov 24, 2025 at 09:29:05AM -0800, Andrii Nakryiko wrote:
> On Mon, Nov 17, 2025 at 12:36 AM Jiri Olsa <jolsa@...nel.org> wrote:
> >
> > Adding uprobe syscall feature detection that will be used
> > in following changes.
> >
> > Signed-off-by: Jiri Olsa <jolsa@...nel.org>
> > ---
> >  tools/lib/bpf/features.c        | 22 ++++++++++++++++++++++
> >  tools/lib/bpf/libbpf_internal.h |  2 ++
> >  2 files changed, 24 insertions(+)
> >
> > diff --git a/tools/lib/bpf/features.c b/tools/lib/bpf/features.c
> > index b842b83e2480..587571c21d2d 100644
> > --- a/tools/lib/bpf/features.c
> > +++ b/tools/lib/bpf/features.c
> > @@ -506,6 +506,25 @@ static int probe_kern_arg_ctx_tag(int token_fd)
> >         return probe_fd(prog_fd);
> >  }
> >
> > +#ifdef __x86_64__
> 
> nit: <empty line here>, give the code a bit of breathing room :)

ok :)

> > +#ifndef __NR_uprobe
> > +#define __NR_uprobe 336
> > +#endif
> 
> <empty line>
> 
> > +static int probe_uprobe_syscall(int token_fd)
> > +{
> > +       /*
> > +        * When not executed from executed kernel provided trampoline,
> 
> "executed from executed kernel"? Maybe: "If kernel supports uprobe()
> syscall, it will return -ENXIO when called from the outside of a
> kernel-generated uprobe trampoline."? Otherwise it will be -ENOSYS or
> something like this, right?

ugh, yep

> 
> > +        * the uprobe syscall returns ENXIO error.
> > +        */
> > +       return syscall(__NR_uprobe) == -1 && errno == ENXIO;
> 
> nit: please use < 0 check for consistency with other error checking
> logic everywhere else

ok

thanks,
jirka


> 
> 
> > +}
> > +#else
> > +static int probe_uprobe_syscall(int token_fd)
> > +{
> > +       return 0;
> > +}
> > +#endif
> > +
> >  typedef int (*feature_probe_fn)(int /* token_fd */);
> >
> >  static struct kern_feature_cache feature_cache;
> > @@ -581,6 +600,9 @@ static struct kern_feature_desc {
> >         [FEAT_BTF_QMARK_DATASEC] = {
> >                 "BTF DATASEC names starting from '?'", probe_kern_btf_qmark_datasec,
> >         },
> > +       [FEAT_UPROBE_SYSCALL] = {
> > +               "Kernel supports uprobe syscall", probe_uprobe_syscall,
> > +       },
> >  };
> >
> >  bool feat_supported(struct kern_feature_cache *cache, enum kern_feature_id feat_id)
> > diff --git a/tools/lib/bpf/libbpf_internal.h b/tools/lib/bpf/libbpf_internal.h
> > index fc59b21b51b5..69aa61c038a9 100644
> > --- a/tools/lib/bpf/libbpf_internal.h
> > +++ b/tools/lib/bpf/libbpf_internal.h
> > @@ -392,6 +392,8 @@ enum kern_feature_id {
> >         FEAT_ARG_CTX_TAG,
> >         /* Kernel supports '?' at the front of datasec names */
> >         FEAT_BTF_QMARK_DATASEC,
> > +       /* Kernel supports uprobe syscall */
> > +       FEAT_UPROBE_SYSCALL,
> >         __FEAT_CNT,
> >  };
> >
> > --
> > 2.51.1
> >