From: Xiaofeng Yuan <yuanxiaofeng@eswincomputing.com>
To: Paul Walmsley <pjw@kernel.org>,
Palmer Dabbelt <palmer@dabbelt.com>,
Albert Ou <aou@eecs.berkeley.edu>
Cc: Alexandre Ghiti <alex@ghiti.fr>, Nam Cao <namcao@linutronix.de>,
Naveen N Rao <naveen@kernel.org>,
"David S . Miller" <davem@davemloft.net>,
Masami Hiramatsu <mhiramat@kernel.org>,
linux-riscv@lists.infradead.org, linux-kernel@vger.kernel.org,
linux-trace-kernel@vger.kernel.org,
Xiaofeng Yuan <yuanxiaofeng@eswincomputing.com>
Subject: [PATCH v5 0/2] riscv: kprobes: reject probes inside LR/SC sequences
Date: Wed, 14 Oct 2026 17:44:13 +0800 [thread overview]
Message-ID: <20261014094415.374-1-yuanxiaofeng@eswincomputing.com> (raw)
In-Reply-To: <20260828091202.1124-1-yuanxiaofeng@eswincomputing.com>
A breakpoint trap taken in the middle of an LR/SC sequence clears the
load reservation, so an SC following the probed instruction always fails
and the enclosing retry loop re-enters the breakpoint, livelocking the
CPU. This series makes the RISC-V kprobes implementation reject probes
placed on an LR/SC instruction or between them, following arm64's
approach for its equivalent exclusive load/store instructions.
Changes since v4:
- Reject the LR and SC instructions themselves in the decode stage
(riscv_probe_decode_insn()), so a probe placed directly on them is
caught independently of the kallsyms offset (fixes the case where the
probe address is exactly the enclosing symbol's start).
- Bound the sequence scan by instruction count (MAX_LRSC_GAP = 16)
instead of bytes, matching the Zalrsc "at most 16 instructions"
constraint and avoiding ambiguity with compressed instructions.
- Fold the LR/SC scan into arch_check_kprobe() so the function is walked
only once; arch_check_kprobe() now returns an error code.
- Use the existing GET_INSN_LENGTH() macro and a single unaligned 32-bit
load instead of two separate loads.
- Extend the KUnit test to check a probe right before, on the LR, inside,
on the SC, and right after the sequence, storing absolute probe
addresses instead of offsets.
Verified by cross-compiling for RISC-V and running the kprobes KUnit
test in QEMU (ok 2 kprobes_riscv).
Xiaofeng Yuan (2):
riscv: kprobes: reject probes inside LR/SC sequences
riscv: kprobes: add KUnit test for LR/SC sequence rejection
arch/riscv/include/asm/insn.h | 33 ++++++++++
arch/riscv/kernel/probes/decode-insn.c | 2 +
arch/riscv/kernel/probes/kprobes.c | 63 +++++++++++++++----
.../kernel/tests/kprobes/test-kprobes-asm.S | 24 +++++++
.../riscv/kernel/tests/kprobes/test-kprobes.c | 26 ++++++++
.../riscv/kernel/tests/kprobes/test-kprobes.h | 3 +
6 files changed, 139 insertions(+), 12 deletions(-)
--
2.34.1
WARNING: multiple messages have this Message-ID (diff)
From: Xiaofeng Yuan <yuanxiaofeng@eswincomputing.com>
To: Paul Walmsley <pjw@kernel.org>,
Palmer Dabbelt <palmer@dabbelt.com>,
Albert Ou <aou@eecs.berkeley.edu>
Cc: Alexandre Ghiti <alex@ghiti.fr>, Nam Cao <namcao@linutronix.de>,
Naveen N Rao <naveen@kernel.org>,
"David S . Miller" <davem@davemloft.net>,
Masami Hiramatsu <mhiramat@kernel.org>,
linux-riscv@lists.infradead.org, linux-kernel@vger.kernel.org,
linux-trace-kernel@vger.kernel.org,
Xiaofeng Yuan <yuanxiaofeng@eswincomputing.com>
Subject: [PATCH v5 0/2] riscv: kprobes: reject probes inside LR/SC sequences
Date: Wed, 14 Oct 2026 17:44:13 +0800 [thread overview]
Message-ID: <20261014094415.374-1-yuanxiaofeng@eswincomputing.com> (raw)
In-Reply-To: <20260828091202.1124-1-yuanxiaofeng@eswincomputing.com>
A breakpoint trap taken in the middle of an LR/SC sequence clears the
load reservation, so an SC following the probed instruction always fails
and the enclosing retry loop re-enters the breakpoint, livelocking the
CPU. This series makes the RISC-V kprobes implementation reject probes
placed on an LR/SC instruction or between them, following arm64's
approach for its equivalent exclusive load/store instructions.
Changes since v4:
- Reject the LR and SC instructions themselves in the decode stage
(riscv_probe_decode_insn()), so a probe placed directly on them is
caught independently of the kallsyms offset (fixes the case where the
probe address is exactly the enclosing symbol's start).
- Bound the sequence scan by instruction count (MAX_LRSC_GAP = 16)
instead of bytes, matching the Zalrsc "at most 16 instructions"
constraint and avoiding ambiguity with compressed instructions.
- Fold the LR/SC scan into arch_check_kprobe() so the function is walked
only once; arch_check_kprobe() now returns an error code.
- Use the existing GET_INSN_LENGTH() macro and a single unaligned 32-bit
load instead of two separate loads.
- Extend the KUnit test to check a probe right before, on the LR, inside,
on the SC, and right after the sequence, storing absolute probe
addresses instead of offsets.
Verified by cross-compiling for RISC-V and running the kprobes KUnit
test in QEMU (ok 2 kprobes_riscv).
Xiaofeng Yuan (2):
riscv: kprobes: reject probes inside LR/SC sequences
riscv: kprobes: add KUnit test for LR/SC sequence rejection
arch/riscv/include/asm/insn.h | 33 ++++++++++
arch/riscv/kernel/probes/decode-insn.c | 2 +
arch/riscv/kernel/probes/kprobes.c | 63 +++++++++++++++----
.../kernel/tests/kprobes/test-kprobes-asm.S | 24 +++++++
.../riscv/kernel/tests/kprobes/test-kprobes.c | 26 ++++++++
.../riscv/kernel/tests/kprobes/test-kprobes.h | 3 +
6 files changed, 139 insertions(+), 12 deletions(-)
--
2.34.1
_______________________________________________
linux-riscv mailing list
linux-riscv@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-riscv
next prev parent reply other threads:[~2026-10-14 9:44 UTC|newest]
Thread overview: 15+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-08-28 9:12 [PATCH v4 0/2] riscv: kprobes: reject probes inside LR/SC sequences Xiaofeng Yuan
2026-08-28 9:12 ` [PATCH v4 1/2] riscv: probes: reject kprobes " Xiaofeng Yuan
2026-09-22 13:37 ` Nam Cao
2026-08-28 9:12 ` [PATCH v4 2/2] riscv: kprobes: add KUnit test for LR/SC sequence rejection Xiaofeng Yuan
2026-09-22 13:46 ` Nam Cao
2026-09-20 8:02 ` [PATCH v4 0/2] riscv: kprobes: reject probes inside LR/SC sequences Xiaofeng Yuan
2026-09-22 15:40 ` Nam Cao
2026-09-22 15:40 ` Nam Cao
2026-10-14 9:44 ` Xiaofeng Yuan [this message]
2026-10-14 9:44 ` [PATCH v5 " Xiaofeng Yuan
2026-10-14 9:44 ` [PATCH v5 1/2] " Xiaofeng Yuan
2026-10-14 9:44 ` Xiaofeng Yuan
2026-10-14 9:44 ` [PATCH v5 2/2] riscv: kprobes: add KUnit test for LR/SC sequence rejection Xiaofeng Yuan
2026-10-14 9:44 ` Xiaofeng Yuan
2026-10-14 9:54 ` sashiko-bot
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20261014094415.374-1-yuanxiaofeng@eswincomputing.com \
--to=yuanxiaofeng@eswincomputing.com \
--cc=alex@ghiti.fr \
--cc=aou@eecs.berkeley.edu \
--cc=davem@davemloft.net \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-riscv@lists.infradead.org \
--cc=linux-trace-kernel@vger.kernel.org \
--cc=mhiramat@kernel.org \
--cc=namcao@linutronix.de \
--cc=naveen@kernel.org \
--cc=palmer@dabbelt.com \
--cc=pjw@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.