stapstd elf note flags

[Jiri Olsa]

On Mon, Jan 12, 2026 at 07:23:48PM -0500, Frank Ch. Eigler wrote:
> Hi -
> 
> > Ok, I see what you are asking. For nop1, there is indeed one int3,
> > then kernel analyzes the instruction interrupted and sees that it's
> > one of the instructions that can be emulated without going back to
> > user space for single stepping. E.g., stack pushes are simulated like
> > that, for instance; and a bunch of other instructions as well. And for
> > such emulated instructions, we don't need single-stepping, so we avoid
> > another context switch and interrupt.
> 
> Oh, right.  I've been out of kprobes/uprobes land too long to recall
> this part.

Andrii, thanks for all the exaplanations!

> 
> 
> > [...]
> > But in this case, if we knew the size (1+5=6) we could safely assume
> > that nop5 was emitted through USDT macros. But oh well, we have to
> > find another way.
> 
> OK just spitballing here, but what if we emitted two adjacent notes,
> one for the nop1 and one for the nop5.  But mess with the
> name/provider strings of the second one a bit, so an old-school
> systemtap or stapbpf or whatever program would fail to match the
> second one. 

hum, I wonder we could do something like that without the tools
hitting error and bailing out during the parsing?

I guess we'd need to add new note type for that, in which case it'd
be probably better just add new version of stapstd note

thanks,
jirka


> Newer tools could identify the adjacency and relationship
> of the pair, and merge their semantics (place the probe on top of the
> nop5 only).