[RFC v3 0/2] rm64: kprobes: Fix single-step fault and reentry handling

[Pu Hu <hupu@transsion.com>]

From: Pu Hu <hupu@transsion.com>

This series fixes two arm64 kprobes issues observed when running
simpleperf with preemptirq tracepoints and dwarf callchains while a
kprobe is active on a frequently executed kernel function.

The crash happens in the kprobe debug exception path. While a kprobe is
preparing or executing its XOL single-step instruction, perf/trace code
can run in the same window. That code may either take a fault of its own
or hit another kprobe.

Patch 1 fixes kprobe_fault_handler() so that it only handles a fault
taken in KPROBE_HIT_SS or KPROBE_REENTER state when the faulting PC
points at the current kprobe's XOL instruction. Simulated kprobes,
which have no XOL slot at all, are filtered out at function entry so
that the normal page fault handler (including fixup_exception) can
process any fault without interference.


Patch 2 allows a kprobe hit in KPROBE_HIT_SS to be handled as a
recoverable one-level reentry, instead of treating it as unrecoverable.
This is safe because the reentry save area has not yet been consumed at
that point. Only a hit while already in KPROBE_REENTER remains
unrecoverable. The same patch also extends struct prev_kprobe with a
saved_irqflag field so that the outer kprobe's original DAIF state is
preserved across reentry. Without this, the nested kprobe would
overwrite kcb->saved_irqflag, and the outer kprobe would restore the
wrong DAIF mask on completion, potentially leaving interrupts
permanently disabled.

This follows the same logic as the existing x86 fixes:

  6381c24cd6d5 ("kprobes/x86: Fix page-fault handling logic")
  6a5022a56ac3 ("kprobes/x86: Allow to handle reentered kprobe on single-stepping")

v2 -> v3:
  - Patch 1: unchanged.
  - Folded Patch 3 into Patch 2 so the saved_irqflag fix lands in the
    same commit as the reentry change, keeping the series bisectable.

v1 -> v2:
  - Patch 1: moved simulated kprobe check to function entry (per
    maintainer review); removed redundant xol_insn NULL check from
    the inner branch.
  - Patch 2: unchanged.
  - Patch 3: new in v2; fixes the IRQ flag save/restore gap that
    Patch 2 exposes.
  - Removed the selftest patch (old Patch 3) from this series.
  - Fixed Signed-off-by to use full name (Pu Hu) instead of username
    (hupu).
  - Updated comments and commit messages across all patches.

Reproducer:
  simpleperf record -p <pid> -f 10000 \
    -e preemptirq:preempt_disable \
    -e preemptirq:preempt_enable \
    --duration 9 --call-graph dwarf \
    -o /data/local/tmp/perf.data

Before this series, the crash reproduced frequently. With both patches
applied, it was no longer reproduced in our testing.

Pu Hu (2):
  arm64: kprobes: Only handle faults originating from XOL slot
  arm64: kprobes: Allow reentering kprobes while single-stepping

 arch/arm64/include/asm/kprobes.h   |  6 ++++
 arch/arm64/kernel/probes/kprobes.c | 45 +++++++++++++++++++++++++++++-
 2 files changed, 50 insertions(+), 1 deletion(-)

-- 
2.43.0