[PATCH v5 1/2] riscv: kprobes: reject probes inside LR/SC sequences

[Masami Hiramatsu (Google)]

On Wed, 14 Oct 2026 17:44:14 +0800, Xiaofeng Yuan <yuanxiaofeng at eswincomputing.com> wrote:
> A trap taken in the middle of an LR/SC sequence clears the load
> reservation, so an SC following the probed instruction always fails and
> the enclosing retry loop re-enters the breakpoint, livelocking the CPU.
> Reject probes of the LR/SC instructions themselves and of any address
> between them.
>
> arm64's kprobes rejects its equivalent exclusive load/store instructions
> and, in arm_kprobe_decode_insn(), walks backward from the probe address
> (bounded by the enclosing symbol) to reject any address inside an
> exclusive sequence.  RISC-V cannot walk backward because
> variable-length instructions make instruction boundaries ambiguous, so
> walk forward from the enclosing symbol, a known instruction boundary, up
> to the probe address and track whether an LR is still outstanding.
>
> A Zalrsc-constrained LR/SC retry loop holds at most 16 instructions, so
> an LR more than MAX_LRSC_GAP instructions ahead of the probe cannot
> start a sequence containing it.  Count instructions, not bytes:
> compressed instructions would make a byte window ambiguous.
>
> The LR/SC instructions themselves are rejected in
> riscv_probe_decode_insn(), and an address inside a sequence is rejected
> in arch_check_kprobe().
>

Looks good to me from kprobes maintainer's viewpoint.

Acked-by: Masami Hiramatsu (Google) <mhiramat at kernel.org>

Thanks!

> Signed-off-by: Xiaofeng Yuan <yuanxiaofeng at eswincomputing.com>
> ---
>  arch/riscv/include/asm/insn.h          | 33 ++++++++++++++
>  arch/riscv/kernel/probes/decode-insn.c |  2 +
>  arch/riscv/kernel/probes/kprobes.c     | 63 +++++++++++++++++++++-----
>  3 files changed, 86 insertions(+), 12 deletions(-)
>

-- 
Masami Hiramatsu (Google) <mhiramat at kernel.org>