A breakpoint trap taken in the middle of an LR/SC sequence clears the load reservation, so an SC following the probed instruction always fails and the enclosing retry loop re-enters the breakpoint, livelocking the CPU. This series makes the RISC-V kprobes implementation reject probes placed on an LR/SC instruction or between them, following arm64's approach for its equivalent exclusive load/store instructions.
Changes since v4: - Reject the LR and SC instructions themselves in the decode stage (riscv_probe_decode_insn()), so a probe placed directly on them is caught independently of the kallsyms offset (fixes the case where the probe address is exactly the enclosing symbol's start). - Bound the sequence scan by instruction count (MAX_LRSC_GAP = 16) instead of bytes, matching the Zalrsc "at most 16 instructions" constraint and avoiding ambiguity with compressed instructions. - Fold the LR/SC scan into arch_check_kprobe() so the function is walked only once; arch_check_kprobe() now returns an error code. - Use the existing GET_INSN_LENGTH() macro and a single unaligned 32-bit load instead of two separate loads. - Extend the KUnit test to check a probe right before, on the LR, inside, on the SC, and right after the sequence, storing absolute probe addresses instead of offsets. Verified by cross-compiling for RISC-V and running the kprobes KUnit test in QEMU (ok 2 kprobes_riscv). Xiaofeng Yuan (2): riscv: kprobes: reject probes inside LR/SC sequences riscv: kprobes: add KUnit test for LR/SC sequence rejection arch/riscv/include/asm/insn.h | 33 ++++++++++ arch/riscv/kernel/probes/decode-insn.c | 2 + arch/riscv/kernel/probes/kprobes.c | 63 +++++++++++++++---- .../kernel/tests/kprobes/test-kprobes-asm.S | 24 +++++++ .../riscv/kernel/tests/kprobes/test-kprobes.c | 26 ++++++++ .../riscv/kernel/tests/kprobes/test-kprobes.h | 3 + 6 files changed, 139 insertions(+), 12 deletions(-) -- 2.34.1
