[v3] libbpf: Make optimized uprobes backward compatible

[PATCHv3 bpf-next 2/5] libbpf: Add uprobe syscall feature detection

Posted by Jiri Olsa 2 days, 8 hours ago

Adding uprobe syscall feature detection that will be used
in following changes.

Signed-off-by: Jiri Olsa <jolsa@kernel.org>
---
 tools/lib/bpf/features.c        | 24 ++++++++++++++++++++++++
 tools/lib/bpf/libbpf_internal.h |  2 ++
 2 files changed, 26 insertions(+)

diff --git a/tools/lib/bpf/features.c b/tools/lib/bpf/features.c
index b842b83e2480..04a225c7f2c0 100644
--- a/tools/lib/bpf/features.c
+++ b/tools/lib/bpf/features.c
@@ -506,6 +506,27 @@ static int probe_kern_arg_ctx_tag(int token_fd)
 	return probe_fd(prog_fd);
 }
 
+#ifdef __x86_64__
+
+#ifndef __NR_uprobe
+#define __NR_uprobe 336
+#endif
+
+static int probe_uprobe_syscall(int token_fd)
+{
+	/*
+	 * If kernel supports uprobe() syscall, it will return -ENXIO when called
+	 * from the outside of a kernel-generated uprobe trampoline.
+	 */
+	return syscall(__NR_uprobe) < 0 && errno == ENXIO;
+}
+#else
+static int probe_uprobe_syscall(int token_fd)
+{
+	return 0;
+}
+#endif
+
 typedef int (*feature_probe_fn)(int /* token_fd */);
 
 static struct kern_feature_cache feature_cache;
@@ -581,6 +602,9 @@ static struct kern_feature_desc {
 	[FEAT_BTF_QMARK_DATASEC] = {
 		"BTF DATASEC names starting from '?'", probe_kern_btf_qmark_datasec,
 	},
+	[FEAT_UPROBE_SYSCALL] = {
+		"Kernel supports uprobe syscall", probe_uprobe_syscall,
+	},
 };
 
 bool feat_supported(struct kern_feature_cache *cache, enum kern_feature_id feat_id)
diff --git a/tools/lib/bpf/libbpf_internal.h b/tools/lib/bpf/libbpf_internal.h
index fc59b21b51b5..69aa61c038a9 100644
--- a/tools/lib/bpf/libbpf_internal.h
+++ b/tools/lib/bpf/libbpf_internal.h
@@ -392,6 +392,8 @@ enum kern_feature_id {
 	FEAT_ARG_CTX_TAG,
 	/* Kernel supports '?' at the front of datasec names */
 	FEAT_BTF_QMARK_DATASEC,
+	/* Kernel supports uprobe syscall */
+	FEAT_UPROBE_SYSCALL,
 	__FEAT_CNT,
 };
 
-- 
2.53.0

Re: [PATCHv3 bpf-next 2/5] libbpf: Add uprobe syscall feature detection

Posted by Andrii Nakryiko 1 day, 19 hours ago

On Wed, Feb 11, 2026 at 12:49 AM Jiri Olsa <jolsa@kernel.org> wrote:
>
> Adding uprobe syscall feature detection that will be used
> in following changes.
>
> Signed-off-by: Jiri Olsa <jolsa@kernel.org>
> ---
>  tools/lib/bpf/features.c        | 24 ++++++++++++++++++++++++
>  tools/lib/bpf/libbpf_internal.h |  2 ++
>  2 files changed, 26 insertions(+)
>
> diff --git a/tools/lib/bpf/features.c b/tools/lib/bpf/features.c
> index b842b83e2480..04a225c7f2c0 100644
> --- a/tools/lib/bpf/features.c
> +++ b/tools/lib/bpf/features.c
> @@ -506,6 +506,27 @@ static int probe_kern_arg_ctx_tag(int token_fd)
>         return probe_fd(prog_fd);
>  }
>
> +#ifdef __x86_64__
> +
> +#ifndef __NR_uprobe
> +#define __NR_uprobe 336
> +#endif
> +
> +static int probe_uprobe_syscall(int token_fd)
> +{
> +       /*
> +        * If kernel supports uprobe() syscall, it will return -ENXIO when called
> +        * from the outside of a kernel-generated uprobe trampoline.
> +        */
> +       return syscall(__NR_uprobe) < 0 && errno == ENXIO;
> +}
> +#else
> +static int probe_uprobe_syscall(int token_fd)
> +{
> +       return 0;
> +}
> +#endif
> +
>  typedef int (*feature_probe_fn)(int /* token_fd */);
>
>  static struct kern_feature_cache feature_cache;
> @@ -581,6 +602,9 @@ static struct kern_feature_desc {
>         [FEAT_BTF_QMARK_DATASEC] = {
>                 "BTF DATASEC names starting from '?'", probe_kern_btf_qmark_datasec,
>         },
> +       [FEAT_UPROBE_SYSCALL] = {
> +               "Kernel supports uprobe syscall", probe_uprobe_syscall,

this will conflict with libbpf arena relocation fix landed into bpf,
so let's wait until trees merge.

But also, this description is going into the middle of a sentence,
start it with lower case

pw-bot: cr



> +       },
>  };
>
>  bool feat_supported(struct kern_feature_cache *cache, enum kern_feature_id feat_id)
> diff --git a/tools/lib/bpf/libbpf_internal.h b/tools/lib/bpf/libbpf_internal.h
> index fc59b21b51b5..69aa61c038a9 100644
> --- a/tools/lib/bpf/libbpf_internal.h
> +++ b/tools/lib/bpf/libbpf_internal.h
> @@ -392,6 +392,8 @@ enum kern_feature_id {
>         FEAT_ARG_CTX_TAG,
>         /* Kernel supports '?' at the front of datasec names */
>         FEAT_BTF_QMARK_DATASEC,
> +       /* Kernel supports uprobe syscall */
> +       FEAT_UPROBE_SYSCALL,
>         __FEAT_CNT,
>  };
>
> --
> 2.53.0
>

Re: [PATCHv3 bpf-next 2/5] libbpf: Add uprobe syscall feature detection

Posted by Jiri Olsa 1 day, 3 hours ago

On Wed, Feb 11, 2026 at 01:45:08PM -0800, Andrii Nakryiko wrote:
> On Wed, Feb 11, 2026 at 12:49 AM Jiri Olsa <jolsa@kernel.org> wrote:
> >
> > Adding uprobe syscall feature detection that will be used
> > in following changes.
> >
> > Signed-off-by: Jiri Olsa <jolsa@kernel.org>
> > ---
> >  tools/lib/bpf/features.c        | 24 ++++++++++++++++++++++++
> >  tools/lib/bpf/libbpf_internal.h |  2 ++
> >  2 files changed, 26 insertions(+)
> >
> > diff --git a/tools/lib/bpf/features.c b/tools/lib/bpf/features.c
> > index b842b83e2480..04a225c7f2c0 100644
> > --- a/tools/lib/bpf/features.c
> > +++ b/tools/lib/bpf/features.c
> > @@ -506,6 +506,27 @@ static int probe_kern_arg_ctx_tag(int token_fd)
> >         return probe_fd(prog_fd);
> >  }
> >
> > +#ifdef __x86_64__
> > +
> > +#ifndef __NR_uprobe
> > +#define __NR_uprobe 336
> > +#endif
> > +
> > +static int probe_uprobe_syscall(int token_fd)
> > +{
> > +       /*
> > +        * If kernel supports uprobe() syscall, it will return -ENXIO when called
> > +        * from the outside of a kernel-generated uprobe trampoline.
> > +        */
> > +       return syscall(__NR_uprobe) < 0 && errno == ENXIO;
> > +}
> > +#else
> > +static int probe_uprobe_syscall(int token_fd)
> > +{
> > +       return 0;
> > +}
> > +#endif
> > +
> >  typedef int (*feature_probe_fn)(int /* token_fd */);
> >
> >  static struct kern_feature_cache feature_cache;
> > @@ -581,6 +602,9 @@ static struct kern_feature_desc {
> >         [FEAT_BTF_QMARK_DATASEC] = {
> >                 "BTF DATASEC names starting from '?'", probe_kern_btf_qmark_datasec,
> >         },
> > +       [FEAT_UPROBE_SYSCALL] = {
> > +               "Kernel supports uprobe syscall", probe_uprobe_syscall,
> 
> this will conflict with libbpf arena relocation fix landed into bpf,
> so let's wait until trees merge.
> 
> But also, this description is going into the middle of a sentence,
> start it with lower case

ok, will change

jirka

[PATCHv3 bpf-next 1/5] selftests/bpf: Emit nop,nop5 instructions combo for x86_64 arch
[PATCHv3 bpf-next 2/5] libbpf: Add uprobe syscall feature detection
[PATCHv3 bpf-next 3/5] libbpf: Add support to detect nop,nop5 instructions combo for usdt probe
[PATCHv3 bpf-next 4/5] selftests/bpf: Add test for checking correct nop of optimized usdt
[PATCHv3 bpf-next 5/5] selftests/bpf: Add usdt trigger bench