Re: [RFC PATCH 8/9] arm64/kprobes: Drop the XOL single-step fault PC check

[Mark Rutland <mark.rutland@arm.com>]

On Mon, Jul 27, 2026 at 12:25:46PM +0000, Hongyan Xia wrote:
> From: Hongyan Xia <hongyan.xia@transsion.com>
> 
> With the armed single-step window closed (the whole path noinstr, and
> every piece of instrumentable code confined to instrumentation windows
> that run in KPROBE_HIT_ACTIVE/HIT_SSDONE state), no code other than the
> XOL instruction itself can execute while the state is KPROBE_HIT_SS or
> KPROBE_REENTER. A page fault taken in those states therefore necessarily
> originates from the XOL instruction, and the faulting-PC comparison is
> redundant; revert to handling all such faults as single-step faults (as
> before commit 879a6754d3d1).
> 
> The simulated-kprobe early bail is kept: simulated probes have no XOL
> slot and execute (inside an instrumentation window) in debug trap
> context, so a fault there can still come from the simulation handlers
> and must not be treated as a single-step fault.

As commented on an earlier patch, to fix this properly I think we have
to make the simulation noinstr-safe.

Mark.

> 
> Signed-off-by: Hongyan Xia <hongyan.xia@transsion.com>
> ---
>  arch/arm64/kernel/probes/kprobes.c | 12 ------------
>  1 file changed, 12 deletions(-)
> 
> diff --git a/arch/arm64/kernel/probes/kprobes.c b/arch/arm64/kernel/probes/kprobes.c
> index 1658b6acd803..73bbbcdbbfe5 100644
> --- a/arch/arm64/kernel/probes/kprobes.c
> +++ b/arch/arm64/kernel/probes/kprobes.c
> @@ -309,18 +309,6 @@ int noinstr kprobe_fault_handler(struct pt_regs *regs, unsigned int fsr)
>  	switch (kcb->kprobe_status) {
>  	case KPROBE_HIT_SS:
>  	case KPROBE_REENTER:
> -		/*
> -		 * A page fault taken while in KPROBE_HIT_SS or
> -		 * KPROBE_REENTER state is only attributable to kprobe
> -		 * single-stepping if the faulting PC points to the
> -		 * current kprobe's XOL instruction. If the fault occurred
> -		 * elsewhere (e.g. in perf or tracing code invoked from the
> -		 * debug exception path), leave it for the normal page fault
> -		 * handler to process.
> -		 */
> -		if (instruction_pointer(regs) != (unsigned long)cur->ainsn.xol_insn)
> -			break;
> -
>  		/*
>  		 * We are here because the instruction being single
>  		 * stepped caused a page fault. We reset the current
> -- 
> 2.47.3
>