uprobe optimization and override
summary
Kernel now implements an x86-only uprobe optimization that replaces a five‑byte NOP probe with a user‑space trampoline and uprobe syscall, avoiding exception single‑stepping and making common cases about 3x faster. Libbpf and USDT macros can emit NOP/combined probes and detect kernel support for backward compatibility. An RFC explores extending this to multi‑instruction prologs but faces non‑atomic patching and jump‑into‑middle risks. A new probe override allows eBPF to write user registers (since 6.18) to skip or redirect user functions.
AI-written summary · about
chapters (9)
- 0:00Introduction to uprobe updates
- 1:03Probe optimization on x86_64
- 3:56Optimizing USDT probes
- 6:24Generic instruction emulation
- 10:18Introducing probe override
- 13:29Q&A on probe override
- 17:25Technical Q&A session
- 23:09Security and limitations
- 24:13Closing remarks
related talks
15mvBOIDs: Taming Chaos via Coarse-Grained Scheduling Abstraction for Containers
42mInter Process Confusion - Navigating Zephyr's IPC APIs
47mLinkage in the Third Millenium. Ideas, Innovations, Experiments and Prototypes for Fl...
52mA deep dive into dispatching techniques
52m[normalized Sound] A deep dive into dispatching techniques
27mInsights on the Re-Architecting to a Single Codebase, Running on Different Hardware...
41mFuture of Zephyr Device Model
40mThreads in Embedded Linux- 6 Easy Pieces