On Wed, 14 Oct 2026 17:44:14 +0800, Xiaofeng Yuan <[email protected]> wrote: > A trap taken in the middle of an LR/SC sequence clears the load > reservation, so an SC following the probed instruction always fails and > the enclosing retry loop re-enters the breakpoint, livelocking the CPU. > Reject probes of the LR/SC instructions themselves and of any address > between them. > > arm64's kprobes rejects its equivalent exclusive load/store instructions > and, in arm_kprobe_decode_insn(), walks backward from the probe address > (bounded by the enclosing symbol) to reject any address inside an > exclusive sequence. RISC-V cannot walk backward because > variable-length instructions make instruction boundaries ambiguous, so > walk forward from the enclosing symbol, a known instruction boundary, up > to the probe address and track whether an LR is still outstanding. > > A Zalrsc-constrained LR/SC retry loop holds at most 16 instructions, so > an LR more than MAX_LRSC_GAP instructions ahead of the probe cannot > start a sequence containing it. Count instructions, not bytes: > compressed instructions would make a byte window ambiguous. > > The LR/SC instructions themselves are rejected in > riscv_probe_decode_insn(), and an address inside a sequence is rejected > in arch_check_kprobe(). >
Looks good to me from kprobes maintainer's viewpoint. Acked-by: Masami Hiramatsu (Google) <[email protected]> Thanks! > Signed-off-by: Xiaofeng Yuan <[email protected]> > --- > arch/riscv/include/asm/insn.h | 33 ++++++++++++++ > arch/riscv/kernel/probes/decode-insn.c | 2 + > arch/riscv/kernel/probes/kprobes.c | 63 +++++++++++++++++++++----- > 3 files changed, 86 insertions(+), 12 deletions(-) > -- Masami Hiramatsu (Google) <[email protected]>
