Re: [PATCHv3 bpf-next 3/5] libbpf: Add support to detect nop,nop5 instructions combo for usdt probe

[Jiri Olsa]

On Wed, Feb 11, 2026 at 01:45:12PM -0800, Andrii Nakryiko wrote:
> On Wed, Feb 11, 2026 at 12:49 AM Jiri Olsa <jolsa@xxxxxxxxxx> wrote:
> >
> > Adding support to detect nop,nop5 instructions combo for usdt probe
> > by checking on probe's following nop5 instruction.
> >
> > When the nop,nop5 combo is detected together with uprobe syscall,
> > we can place the probe on top of nop5 and get it optimized.
> >
> > [1] https://github.com/libbpf/usdt
> > Signed-off-by: Jiri Olsa <jolsa@xxxxxxxxxx>
> > ---
> >  tools/lib/bpf/usdt.c | 55 ++++++++++++++++++++++++++++++++++++++++----
> >  1 file changed, 51 insertions(+), 4 deletions(-)
> >
> > diff --git a/tools/lib/bpf/usdt.c b/tools/lib/bpf/usdt.c
> > index d1524f6f54ae..4e5f70bb4c31 100644
> > --- a/tools/lib/bpf/usdt.c
> > +++ b/tools/lib/bpf/usdt.c
> > @@ -262,6 +262,7 @@ struct usdt_manager {
> >         bool has_bpf_cookie;
> >         bool has_sema_refcnt;
> >         bool has_uprobe_multi;
> > +       bool has_uprobe_syscall;
> >  };
> >
> >  struct usdt_manager *usdt_manager_new(struct bpf_object *obj)
> > @@ -301,6 +302,13 @@ struct usdt_manager *usdt_manager_new(struct bpf_object *obj)
> >          * usdt probes.
> >          */
> >         man->has_uprobe_multi = kernel_supports(obj, FEAT_UPROBE_MULTI_LINK);
> > +
> > +       /*
> > +        * Detect kernel support for uprobe() syscall, it's presence means we can
> > +        * take advantage of faster nop5 uprobe handling.
> > +        * Added in: 56101b69c919 ("uprobes/x86: Add uprobe syscall to speed up uprobe")
> > +        */
> > +       man->has_uprobe_syscall = kernel_supports(obj, FEAT_UPROBE_SYSCALL);
> >         return man;
> >  }
> >
> > @@ -585,13 +593,42 @@ static int parse_usdt_note(GElf_Nhdr *nhdr, const char *data, size_t name_off,
> >
> >  static int parse_usdt_spec(struct usdt_spec *spec, const struct usdt_note *note, __u64 usdt_cookie);
> >
> > -static int collect_usdt_targets(struct usdt_manager *man, Elf *elf, const char *path, pid_t pid,
> > -                               const char *usdt_provider, const char *usdt_name, __u64 usdt_cookie,
> > -                               struct usdt_target **out_targets, size_t *out_target_cnt)
> > +#if defined(__x86_64__)
> > +static bool has_nop_combo(int fd, long off)
> > +{
> > +       static unsigned char nop_combo[6] = {
> > +               0x90, 0x0f, 0x1f, 0x44, 0x00, 0x00 /* nop,nop5 */
> > +       };
> > +       unsigned char buf[6] = {};
> > +
> > +       /*
> > +        * We are using file descriptor that backs Elf object,
> > +        * let's dup it to be on the safe side.
> > +        */
> > +       fd = dup(fd);
> > +       if (fd < 0)
> > +               return false;
> > +       if (lseek(fd, off, SEEK_SET) == off)
> > +               read(fd, buf, 6);
> > +       close(fd);
> 
> ugh, use pread() instead of all this ? I wouldn't bother with short
> read handling, if we didn't get 6 bytes, so be it, no nop5.

ok, that's simpler, will change

thanks,
jirka

> 
> > +       return memcmp(buf, nop_combo, 6) == 0;
> > +}
> > +#else
> > +static bool has_nop_combo(int fd, long off)
> > +{
> > +       return false;
> > +}
> > +#endif
> > +
> 
> [...]