The previous ptwrite instrumentation only worked on 5 byte+ nops because
it needs to patch in a 5 byte branch.
However that is somewhat limiting because it means most code cannot
be probed. Use a simplified variant of the instruction
punning technique from Chamith et al. "Instruction Punning: Lightweight
instrumentation for x86-64". Patch only the one-byte branch opcode and
reuse the existing 4 following bytes in the code as the branch target.
If someone branches to the remaining bytes they are still executed
in the original way because they didn't change.
This requires placing a target trampoline page at the right address. If
the area is not available or points to kernel space it doesn't work.
[ ... ]
The punning technique could be also used with optimized
uprobes, but this patch only applies it to ptwrite probes.
Assisted-by: omp:gpt-5.6-luna
Signed-off-by: Andi Kleen <ak@kernel.org>
Sashiko has reviewed this patch and found no issues. It looks great!
--
Sashiko AI review · https://sashiko.dev/#/patchset/20260917230127.924985-2-ak@kernel.org?part=8