stapstd elf note flags

[Andrii Nakryiko]

On Mon, Jan 12, 2026 at 1:58 PM Frank Ch. Eigler <fche@redhat.com> wrote:
>
> Hi, Andrii -
>
>
> > > > That works well for apps running on new kernel that allows to optimize
> > > > nop5, but it will regress on old kernel, which needs to do single
> > > > stepping of the nop5 instruction when the USDT probe is hit.
> > >
> > > Can you explain the regression exactly?  Would and old kernel tripping
> > > across a nop5 cause more single-stepping ops than if it had come
> > > across a nop1?  Is that a big problem?
> >
> > Yes, it takes one extra userspace->kernel->userspace trip (through
> > interrupt), which basically slows USDTs 2x, so that's not good
> > (especially that one of the main concern with uprobes and USDTs are
> > that they are relatively slow compared to kernel-side tracepoints).
>
> Just one more bit of detail please: what NOP5 instruction is it that
> would require two interrupts through an older kernel?  There doesn't
> exist another 5-byte nop that (how much?) older kernels recognize as
> one instruction?

Jiri is currently using:

0f 1f 44 00 00          nop    DWORD PTR [rax+rax*1+0x0]

I don't think there is any 5-byte nop that would be handled by (older)
kernels without single-stepping. This whole logic was recently
improved to handle all the different nop-like instructions, so going
forward this won't be a problem, but we are stuck with a lot of
released kernels that matter.

But please double check, I believe that logic is in
arch_uprobe_analyze_insn in arch/x86/kernel/uprobes.c

>
> (What kind/size of nop a NT_STAPSDT refers to is not actually limited
> by the spec.)

but unfortunately the size of nop instruction(s) is also not recorded
anywhere, which is why we are in this predicament

>
> - FChE
>