From nobody Sat Jul 25 03:08:33 2026 Received: from cstnet.cn (smtp21.cstnet.cn [159.226.251.21]) (using TLSv1.2 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id F3B91277818 for ; Mon, 20 Jul 2026 08:00:53 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=159.226.251.21 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784534458; cv=none; b=SXTo9CbDIU/8MY2ZnO1Z0b/NXmFUYcmhQX+SENonlupmBYmYyLC91LV1jPEeKrj6lDyYIASWxd31DU3hGiM1pNyfDLLRd65LJ//FQhHwbM3UGG0yJufsB/A4R8VmHTGE5I5kmlIwNlbIVH464WBslJJqdcYCV5rQHku70x9eKMI= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784534458; c=relaxed/simple; bh=lWCd2mfyKMaJaQY4tz/pjJ7oajbRl2QqaA5vk9BBZYw=; h=From:To:Cc:Subject:Date:Message-Id:MIME-Version; b=ND16td3T/sJacNJIgvb4z8ICwkaR5ExSKHxnGjLmHPTOydN3/9pFkiwDeFRak05FEg5NTr8K5094kDaiqap6nDaGQXOtu/vBVw7IpjWIuwUbNQT2hEUr7cbRQtIUz47KDTrM93k/FJOkyVcyrXAkd6W1MDd6yG4GaM+gWD8YoeM= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=iscas.ac.cn; spf=pass smtp.mailfrom=iscas.ac.cn; arc=none smtp.client-ip=159.226.251.21 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=iscas.ac.cn Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=iscas.ac.cn Received: from smtp.gmail.com (unknown [180.111.28.80]) by APP-01 (Coremail) with SMTP id qwCowABXLfGo1V1qO7CtAA--.8116S2; Mon, 20 Jul 2026 16:00:40 +0800 (CST) From: daichengrong To: Paul Walmsley , Palmer Dabbelt , Albert Ou Cc: linux-riscv@lists.infradead.org, linux-kernel@vger.kernel.org, daichengrong Subject: [RFC PATCH] riscv: uprobe: Relax SYSTEM instruction validation Date: Mon, 20 Jul 2026 16:00:16 +0800 Message-Id: <20260720080016.49842-1-daichengrong@iscas.ac.cn> X-Mailer: git-send-email 2.34.1 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-CM-TRANSID: qwCowABXLfGo1V1qO7CtAA--.8116S2 X-Coremail-Antispam: 1UD129KBjvJXoWxJF43GF43ZF4rZFy3CFW5trb_yoW5Xry7pF s8Cw1fCFZ5Wrs3CryfAr4kur4Yga1rGw43KryDZw4aqayxJry5tF95tw45tr1ktFWjqr10 qF4Y9r9Y9345AaDanT9S1TB71UUUUU7qnTZGkaVYY2UrUUUUjbIjqfuFe4nvWSU5nxnvy2 9KBjDU0xBIdaVrnRJUUUkl14x267AKxVWUJVW8JwAFc2x0x2IEx4CE42xK8VAvwI8IcIk0 rVWrJVCq3wAFIxvE14AKwVWUJVWUGwA2ocxC64kIII0Yj41l84x0c7CEw4AK67xGY2AK02 1l84ACjcxK6xIIjxv20xvE14v26r4j6ryUM28EF7xvwVC0I7IYx2IY6xkF7I0E14v26r4j 6F4UM28EF7xvwVC2z280aVAFwI0_Cr1j6rxdM28EF7xvwVC2z280aVCY1x0267AKxVW0oV Cq3wAS0I0E0xvYzxvE52x082IY62kv0487Mc02F40EFcxC0VAKzVAqx4xG6I80ewAv7VC0 I7IYx2IY67AKxVWUJVWUGwAv7VC2z280aVAFwI0_Jr0_Gr1lOx8S6xCaFVCjc4AY6r1j6r 4UM4x0Y48IcxkI7VAKI48JM4x0x7Aq67IIx4CEVc8vx2IErcIFxwCY1x0262kKe7AKxVWU AVWUtwCF04k20xvY0x0EwIxGrwCFx2IqxVCFs4IE7xkEbVWUJVW8JwC20s026c02F40E14 v26r1j6r18MI8I3I0E7480Y4vE14v26r106r1rMI8E67AF67kF1VAFwI0_JF0_Jw1lIxkG c2Ij64vIr41lIxAIcVC0I7IYx2IY67AKxVWUJVWUCwCI42IY6xIIjxv20xvEc7CjxVAFwI 0_Jr0_Gr1lIxAIcVCF04k26cxKx2IYs7xG6r1j6r1xMIIF0xvEx4A2jsIE14v26r1j6r4U MIIF0xvEx4A2jsIEc7CjxVAFwI0_Jr0_GrUvcSsGvfC2KfnxnUUI43ZEXa7VUjuHq7UUUU U== X-CM-SenderInfo: pgdluxxhqj201qj6x2xfdvhtffof0/ Content-Type: text/plain; charset="utf-8" RISC-V uprobe currently rejects all SYSTEM instructions during instruction validation. This policy is conservative, but it also rejects CSR instructions that only read architectural state, preventing uprobe from instrumenting user applications containing such instructions. This RFC proposes refining the SYSTEM instruction validation by distinguishing read-only CSR instructions from CSR operations that may modify processor state. Read-only CSR instructions are allowed, while CSR write operations and other SYSTEM instructions continue to be rejected. The RISC-V ISA permits implementation-defined side effects on some CSR reads. Feedback is welcome on whether instruction-level validation is sufficient, or whether additional validation based on CSR properties would be more appropriate. Signed-off-by: daichengrong --- arch/riscv/include/asm/insn.h | 15 +++++++++++++++ arch/riscv/kernel/probes/decode-insn.c | 2 +- 2 files changed, 16 insertions(+), 1 deletion(-) diff --git a/arch/riscv/include/asm/insn.h b/arch/riscv/include/asm/insn.h index c3005573e8c9..08c6be4609ea 100644 --- a/arch/riscv/include/asm/insn.h +++ b/arch/riscv/include/asm/insn.h @@ -600,4 +600,19 @@ static inline void riscv_insn_insert_utype_itype_imm(u= 32 *utype_insn, u32 *itype *utype_insn |=3D (imm & RV_U_IMM_31_12_MASK) + ((imm & BIT(11)) << 1); *itype_insn |=3D ((imm & RV_I_IMM_11_0_MASK) << RV_I_IMM_11_0_OPOFF); } + +static __always_inline bool riscv_insn_is_csr_read(u32 code) +{ + return (code & RV_INSN_OPCODE_MASK) =3D=3D RVG_OPCODE_SYSTEM && + (GET_FUNCT3(code) =3D=3D GET_FUNCT3(INSN_MATCH_CSRRS) + || GET_FUNCT3(code) =3D=3D GET_FUNCT3(INSN_MATCH_CSRRC) + || GET_FUNCT3(code) =3D=3D GET_FUNCT3(INSN_MATCH_CSRRSI) + || GET_FUNCT3(code) =3D=3D GET_FUNCT3(INSN_MATCH_CSRRCI)) && + RV_EXTRACT_RS1_REG(code) =3D=3D 0; +} + +static __always_inline bool riscv_insn_is_system_except_csr_read(u32 code) +{ + return riscv_insn_is_system(code) && !riscv_insn_is_csr_read(code); +} #endif /* _ASM_RISCV_INSN_H */ diff --git a/arch/riscv/kernel/probes/decode-insn.c b/arch/riscv/kernel/pro= bes/decode-insn.c index 65d9590bfb9f..4a6a33b95159 100644 --- a/arch/riscv/kernel/probes/decode-insn.c +++ b/arch/riscv/kernel/probes/decode-insn.c @@ -21,7 +21,7 @@ riscv_probe_decode_insn(probe_opcode_t *addr, struct arch= _probe_insn *api) /* * Reject instructions list: */ - RISCV_INSN_REJECTED(system, insn); + RISCV_INSN_REJECTED(system_except_csr_read, insn); RISCV_INSN_REJECTED(fence, insn); =20 /* --=20 2.25.1