[PATCH 0/2] tracing/wprobe: Fix to avoid inifinite watchpoint exception on arm64

Hi,

Here are patches which fixes a wprobe bug reported by Mark Brown on
arm64[1]. The root cause was that the infinite watchpoint exception on
the same instruction, because arm64 watchpoint exception happens before
the memory access has done, it needs to configure a single-step after
calling overflow handler. It does that only for the default overflow
handlers, and not for custom overflow handler registered via
hw_breakpoint interface.

[1] https://lore.kernel.org/all/aPvwGhMBJqMKcC9D@finisterre.sirena.org.uk/

To fix this issue, this series introduces default_overflow_compatible
flag in the perf_event and use it for identifying default overflow
handlers instead of checking handler functions everytime[1/2], and
set it in wprobe[2/2].

Thank you,

---

Masami Hiramatsu (Google) (2):
      perf: Introduce default_overflow_compatible flag
      tracing: wprobe: Make wprobe_handler default overflow_handler compatible


 include/linux/perf_event.h  |    9 ++-------
 kernel/events/core.c        |    2 ++
 kernel/trace/trace_wprobe.c |    7 +++++++
 3 files changed, 11 insertions(+), 7 deletions(-)

--
Masami Hiramatsu (Google) [off-list ref]

From: Masami Hiramatsu (Google) <mhiramat@kernel.org>

Instead of checking whether event->overflow_handler everytime in
is_default_overflow_handler(), just use a flag to check it once when
registering the handler.

Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
---
 include/linux/perf_event.h |    9 ++-------
 kernel/events/core.c       |    2 ++
 2 files changed, 4 insertions(+), 7 deletions(-)

diff --git a/include/linux/perf_event.h b/include/linux/perf_event.h
index fd1d91017b99..40dd897e26b0 100644
--- a/include/linux/perf_event.h
+++ b/include/linux/perf_event.h

@@ -902,6 +902,7 @@ struct perf_event {
 	u64				(*clock)(void);
 	perf_overflow_handler_t		overflow_handler;
 	void				*overflow_handler_context;
+	bool				default_overflow_compatible;
 	struct bpf_prog			*prog;
 	u64				bpf_cookie;
 

@@ -1505,13 +1506,7 @@ extern int perf_event_output(struct perf_event *event,
 static inline bool
 is_default_overflow_handler(struct perf_event *event)
 {
-	perf_overflow_handler_t overflow_handler = event->overflow_handler;
-
-	if (likely(overflow_handler == perf_event_output_forward))
-		return true;
-	if (unlikely(overflow_handler == perf_event_output_backward))
-		return true;
-	return false;
+	return event->default_overflow_compatible;
 }
 
 extern void

diff --git a/kernel/events/core.c b/kernel/events/core.c
index 177e57c1a362..6bbbde82cb21 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c

@@ -12946,9 +12946,11 @@ perf_event_alloc(struct perf_event_attr *attr, int cpu,
 	} else if (is_write_backward(event)){
 		event->overflow_handler = perf_event_output_backward;
 		event->overflow_handler_context = NULL;
+		event->default_overflow_compatible = true;
 	} else {
 		event->overflow_handler = perf_event_output_forward;
 		event->overflow_handler_context = NULL;
+		event->default_overflow_compatible = true;
 	}
 
 	perf_event__state_init(event);

From: Masami Hiramatsu (Google) <mhiramat@kernel.org>

To fix arm64 repeating watchpoint exception on the same instruction
bug, markthe wprobe handler as compatible with the default overflow
handler.

Since do_watchpoint() on arm64 does not configure the single step
execution correctly if the overflow_handler is not compatible with
default perf overflow handlers, custom handler will loop on the
same instruction by repeating watchpoint exception. But if the
overflow handler is compatible with the default handlers, it
configures the single step. So set the compatible flag since
wprobe_handler will not care arch-dependent case.

Reported-by: Mark Brown <broonie@kernel.org>
Closes: https://lore.kernel.org/all/aPvwGhMBJqMKcC9D@finisterre.sirena.org.uk/
Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
---
 kernel/trace/trace_wprobe.c |    7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/kernel/trace/trace_wprobe.c b/kernel/trace/trace_wprobe.c
index 98605b207f43..f2c2f26fd668 100644
--- a/kernel/trace/trace_wprobe.c
+++ b/kernel/trace/trace_wprobe.c

@@ -163,6 +163,8 @@ static void wprobe_perf_handler(struct perf_event *bp,
 static int __register_trace_wprobe(struct trace_wprobe *tw)
 {
 	struct perf_event_attr attr;
+	struct perf_event *bp;
+	int cpu;
 
 	if (tw->bp_event)
 		return -EINVAL;

@@ -179,6 +181,11 @@ static int __register_trace_wprobe(struct trace_wprobe *tw)
 		tw->bp_event = NULL;
 		return ret;
 	}
+	/* Mark wprobe_perf_handler is compatible with default one. */
+	for_each_online_cpu(cpu) {
+		bp = per_cpu(*tw->bp_event, cpu);
+		bp->default_overflow_compatible = true;
+	}
 
 	return 0;
 }

Gently ping.

There is a bugfix (or strange behavior) on arm64 hw breakpoint but
to fix it cleanly, it should change the perf itself (but I'm not
sure why arm64 changes the behavior only for the default overflow
handlers.) Anyone knows it?

Thank you,

On Thu, 30 Oct 2025 12:26:55 +0900
"Masami Hiramatsu (Google)" [off-list ref] wrote:

Hi,

Here are patches which fixes a wprobe bug reported by Mark Brown on
arm64[1]. The root cause was that the infinite watchpoint exception on
the same instruction, because arm64 watchpoint exception happens before
the memory access has done, it needs to configure a single-step after
calling overflow handler. It does that only for the default overflow
handlers, and not for custom overflow handler registered via
hw_breakpoint interface.

[1] https://lore.kernel.org/all/aPvwGhMBJqMKcC9D@finisterre.sirena.org.uk/

To fix this issue, this series introduces default_overflow_compatible
flag in the perf_event and use it for identifying default overflow
handlers instead of checking handler functions everytime[1/2], and
set it in wprobe[2/2].

Thank you,

---

Masami Hiramatsu (Google) (2):
      perf: Introduce default_overflow_compatible flag
      tracing: wprobe: Make wprobe_handler default overflow_handler compatible


 include/linux/perf_event.h  |    9 ++-------
 kernel/events/core.c        |    2 ++
 kernel/trace/trace_wprobe.c |    7 +++++++
 3 files changed, 11 insertions(+), 7 deletions(-)

--
Masami Hiramatsu (Google) [off-list ref]

-- 
Masami Hiramatsu (Google) [off-list ref]

Ingo, Will, Ping?

I also found that Kyle made a change on this area recently.

Thank you,

On Thu, 30 Oct 2025 12:26:55 +0900
"Masami Hiramatsu (Google)" [off-list ref] wrote:

Hi,

Here are patches which fixes a wprobe bug reported by Mark Brown on
arm64[1]. The root cause was that the infinite watchpoint exception on
the same instruction, because arm64 watchpoint exception happens before
the memory access has done, it needs to configure a single-step after
calling overflow handler. It does that only for the default overflow
handlers, and not for custom overflow handler registered via
hw_breakpoint interface.

[1] https://lore.kernel.org/all/aPvwGhMBJqMKcC9D@finisterre.sirena.org.uk/

To fix this issue, this series introduces default_overflow_compatible
flag in the perf_event and use it for identifying default overflow
handlers instead of checking handler functions everytime[1/2], and
set it in wprobe[2/2].

Thank you,

---

Masami Hiramatsu (Google) (2):
      perf: Introduce default_overflow_compatible flag
      tracing: wprobe: Make wprobe_handler default overflow_handler compatible


 include/linux/perf_event.h  |    9 ++-------
 kernel/events/core.c        |    2 ++
 kernel/trace/trace_wprobe.c |    7 +++++++
 3 files changed, 11 insertions(+), 7 deletions(-)

--
Masami Hiramatsu (Google) [off-list ref]

-- 
Masami Hiramatsu (Google) [off-list ref]

On Tue, Nov 04, 2025 at 10:37:35PM +0900, Masami Hiramatsu wrote:

Gently ping.

There is a bugfix (or strange behavior) on arm64 hw breakpoint but
to fix it cleanly, it should change the perf itself (but I'm not
sure why arm64 changes the behavior only for the default overflow
handlers.) Anyone knows it?

It's because GDB expects to handle the stepping itself when using the
ptrace interface (with a custom overflow handler to deliver SIGTRAP).

Will

On Fri, 14 Nov 2025 16:17:06 +0000
Will Deacon [off-list ref] wrote:

On Tue, Nov 04, 2025 at 10:37:35PM +0900, Masami Hiramatsu wrote:

quoted

Gently ping.

There is a bugfix (or strange behavior) on arm64 hw breakpoint but
to fix it cleanly, it should change the perf itself (but I'm not
sure why arm64 changes the behavior only for the default overflow
handlers.) Anyone knows it?

It's because GDB expects to handle the stepping itself when using the
ptrace interface (with a custom overflow handler to deliver SIGTRAP).

Hmm, would you mean GDB for user program?
If so, it expects hw breakpoint is used by:
 - user-space ptrace (for GDB)
 - kernel-space perf (must be default overflow handler)

And not expects to be used by 

 - kernel-space custom overflow handler

This series is to handle the third use case.

Thank you,

-- 
Masami Hiramatsu (Google) [off-list ref]