mirror of https://lore.kernel.org/lkml/
 help / color / mirror / Atom feed
From: Xiaofeng Yuan <yuanxiaofeng@eswincomputing.com>
To: Paul Walmsley <pjw@kernel.org>,
	Palmer Dabbelt <palmer@dabbelt.com>,
	Albert Ou <aou@eecs.berkeley.edu>
Cc: Alexandre Ghiti <alex@ghiti.fr>, Nam Cao <namcao@linutronix.de>,
	Naveen N Rao <naveen@kernel.org>,
	"David S . Miller" <davem@davemloft.net>,
	Masami Hiramatsu <mhiramat@kernel.org>,
	linux-riscv@lists.infradead.org, linux-kernel@vger.kernel.org,
	linux-trace-kernel@vger.kernel.org,
	Xiaofeng Yuan <yuanxiaofeng@eswincomputing.com>
Subject: [PATCH v7 0/2] riscv: kprobes: reject probes inside LR/SC sequences
Date: Mon, 19 Oct 2026 21:41:19 +0800	[thread overview]
Message-ID: <20261019134121.1763-1-yuanxiaofeng@eswincomputing.com> (raw)

A breakpoint trap taken in the middle of an LR/SC sequence clears the
load reservation, so an SC following the probed instruction always fails
and the enclosing retry loop re-enters the breakpoint, livelocking the
CPU.  This series makes the RISC-V kprobes implementation reject probes
placed on an LR/SC instruction or between them, following arm64's
approach for its equivalent exclusive load/store instructions.

Changes since v6:
- Fix an off-by-one in the LR/SC tracking window: a constrained loop
  holds at most 16 instructions (the LR, the SC, and up to 14 between
  them), and the walk now stops tracking after 14 intermediate
  instructions, as the spec requires.
- Use the existing RV_EXTRACT_FUNCT3()/RV_EXTRACT_RS2_REG() helpers and
  add RV_EXTRACT_FUNCT5() in riscv_insn_is_lr()/riscv_insn_is_sc() to
  avoid code duplication.
- Rename test_kprobes_lrsc_offsets[] and split it into separate
  test_kprobes_lrsc_allowed_addresses[]/test_kprobes_lrsc_rejected_
  addresses[] so that adding an entry does not force a change in a
  parallel reject[] table.
- Add a KUnit boundary case pinning the 16-instruction tracking window:
  the 15th instruction after an LR must be rejected and the 16th must be
  accepted (this fails without the off-by-one fix).

Verified by cross-compiling for RISC-V and running the kprobes KUnit
test in QEMU (ok 2 kprobes_riscv).

Xiaofeng Yuan (2):
  riscv: kprobes: reject probes inside LR/SC sequences
  riscv: kprobes: add KUnit test for LR/SC sequence rejection

 arch/riscv/include/asm/insn.h                 | 63 ++++++++++++++----
 arch/riscv/kernel/probes/decode-insn.c        |  2 +
 arch/riscv/kernel/probes/kprobes.c            | 65 +++++++++++++++----
 .../kernel/tests/kprobes/test-kprobes-asm.S   | 60 +++++++++++++++++
 .../riscv/kernel/tests/kprobes/test-kprobes.c | 34 ++++++++++
 .../riscv/kernel/tests/kprobes/test-kprobes.h |  6 ++
 6 files changed, 207 insertions(+), 23 deletions(-)

-- 
2.34.1


             reply	other threads:[~2026-10-19 13:41 UTC|newest]

Thread overview: 3+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2026-10-19 13:41 Xiaofeng Yuan [this message]
2026-10-19 13:41 ` [PATCH v7 1/2] " Xiaofeng Yuan
2026-10-19 13:41 ` [PATCH v7 2/2] riscv: kprobes: add KUnit test for LR/SC sequence rejection Xiaofeng Yuan

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20261019134121.1763-1-yuanxiaofeng@eswincomputing.com \
    --to=yuanxiaofeng@eswincomputing.com \
    --cc=alex@ghiti.fr \
    --cc=aou@eecs.berkeley.edu \
    --cc=davem@davemloft.net \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-riscv@lists.infradead.org \
    --cc=linux-trace-kernel@vger.kernel.org \
    --cc=mhiramat@kernel.org \
    --cc=namcao@linutronix.de \
    --cc=naveen@kernel.org \
    --cc=palmer@dabbelt.com \
    --cc=pjw@kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox

all inboxes | Powered by JetHome®