linux-kernel - Re: [PATCHv3 bpf-next 3/5] libbpf: Add support to detect nop,nop5 instructions combo for usdt probe

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAEf4BzbFjXDiQUcZbxpceVTGLa4UGvm76sAuGXEFVREj9FLoJw@mail.gmail.com>
Date: Wed, 11 Feb 2026 13:45:12 -0800
From: Andrii Nakryiko <andrii.nakryiko@...il.com>
To: Jiri Olsa <jolsa@...nel.org>
Cc: Andrii Nakryiko <andrii@...nel.org>, bpf@...r.kernel.org, linux-kernel@...r.kernel.org, 
	Song Liu <songliubraving@...com>, Yonghong Song <yhs@...com>, 
	John Fastabend <john.fastabend@...il.com>
Subject: Re: [PATCHv3 bpf-next 3/5] libbpf: Add support to detect nop,nop5
 instructions combo for usdt probe

On Wed, Feb 11, 2026 at 12:49 AM Jiri Olsa <jolsa@...nel.org> wrote:
>
> Adding support to detect nop,nop5 instructions combo for usdt probe
> by checking on probe's following nop5 instruction.
>
> When the nop,nop5 combo is detected together with uprobe syscall,
> we can place the probe on top of nop5 and get it optimized.
>
> [1] https://github.com/libbpf/usdt
> Signed-off-by: Jiri Olsa <jolsa@...nel.org>
> ---
>  tools/lib/bpf/usdt.c | 55 ++++++++++++++++++++++++++++++++++++++++----
>  1 file changed, 51 insertions(+), 4 deletions(-)
>
> diff --git a/tools/lib/bpf/usdt.c b/tools/lib/bpf/usdt.c
> index d1524f6f54ae..4e5f70bb4c31 100644
> --- a/tools/lib/bpf/usdt.c
> +++ b/tools/lib/bpf/usdt.c
> @@ -262,6 +262,7 @@ struct usdt_manager {
>         bool has_bpf_cookie;
>         bool has_sema_refcnt;
>         bool has_uprobe_multi;
> +       bool has_uprobe_syscall;
>  };
>
>  struct usdt_manager *usdt_manager_new(struct bpf_object *obj)
> @@ -301,6 +302,13 @@ struct usdt_manager *usdt_manager_new(struct bpf_object *obj)
>          * usdt probes.
>          */
>         man->has_uprobe_multi = kernel_supports(obj, FEAT_UPROBE_MULTI_LINK);
> +
> +       /*
> +        * Detect kernel support for uprobe() syscall, it's presence means we can
> +        * take advantage of faster nop5 uprobe handling.
> +        * Added in: 56101b69c919 ("uprobes/x86: Add uprobe syscall to speed up uprobe")
> +        */
> +       man->has_uprobe_syscall = kernel_supports(obj, FEAT_UPROBE_SYSCALL);
>         return man;
>  }
>
> @@ -585,13 +593,42 @@ static int parse_usdt_note(GElf_Nhdr *nhdr, const char *data, size_t name_off,
>
>  static int parse_usdt_spec(struct usdt_spec *spec, const struct usdt_note *note, __u64 usdt_cookie);
>
> -static int collect_usdt_targets(struct usdt_manager *man, Elf *elf, const char *path, pid_t pid,
> -                               const char *usdt_provider, const char *usdt_name, __u64 usdt_cookie,
> -                               struct usdt_target **out_targets, size_t *out_target_cnt)
> +#if defined(__x86_64__)
> +static bool has_nop_combo(int fd, long off)
> +{
> +       static unsigned char nop_combo[6] = {
> +               0x90, 0x0f, 0x1f, 0x44, 0x00, 0x00 /* nop,nop5 */
> +       };
> +       unsigned char buf[6] = {};
> +
> +       /*
> +        * We are using file descriptor that backs Elf object,
> +        * let's dup it to be on the safe side.
> +        */
> +       fd = dup(fd);
> +       if (fd < 0)
> +               return false;
> +       if (lseek(fd, off, SEEK_SET) == off)
> +               read(fd, buf, 6);
> +       close(fd);

ugh, use pread() instead of all this ? I wouldn't bother with short
read handling, if we didn't get 6 bytes, so be it, no nop5.

> +       return memcmp(buf, nop_combo, 6) == 0;
> +}
> +#else
> +static bool has_nop_combo(int fd, long off)
> +{
> +       return false;
> +}
> +#endif
> +

[...]