linux-stable.git/arch/riscv/kvm/vcpu_vector.c, branch linux-rolling-stable

riscv: kvm: fix vector context allocation leak

2026-05-14T13:31:14+00:00

commit b7c958d7c1eb1cb9b2be7b5ee4129fcd66cec978 upstream.

When the second kzalloc (host_context.vector.datap) fails in
kvm_riscv_vcpu_alloc_vector_context, the first allocation
(guest_context.vector.datap) is leaked. Free it before returning.

Fixes: 0f4b82579716 ("riscv: KVM: Add vector lazy save/restore support")
Cc: stable@vger.kernel.org
Signed-off-by: Osama Abdelkader 
Reviewed-by: Andy Chiu 
Link: https://lore.kernel.org/r/20260316151612.13305-1-osama.abdelkader@gmail.com
Signed-off-by: Anup Patel 
Signed-off-by: Greg Kroah-Hartman

RISC-V: KVM: fix stack overrun when loading vlenb

2025-08-25T04:56:20+00:00

The userspace load can put up to 2048 bits into an xlen bit stack
buffer.  We want only xlen bits, so check the size beforehand.

Fixes: 2fa290372dfe ("RISC-V: KVM: add 'vlenb' Vector CSR")
Cc: stable@vger.kernel.org
Signed-off-by: Radim Krčmář 
Reviewed-by: Nutty Liu 
Reviewed-by: Daniel Henrique Barboza 
Link: https://lore.kernel.org/r/20250805104418.196023-4-rkrcmar@ventanamicro.com
Signed-off-by: Anup Patel

KVM: RISC-V: refactor vector state reset

2025-05-21T04:04:46+00:00

Do not depend on the reset structures.

vector.datap is a kernel memory pointer that needs to be preserved as it
is not a part of the guest vector data.

Reviewed-by: Andrew Jones 
Signed-off-by: Radim Krčmář 
Link: https://lore.kernel.org/r/20250403112522.1566629-4-rkrcmar@ventanamicro.com
Signed-off-by: Anup Patel

RISC-V: KVM: add 'vlenb' Vector CSR

2023-12-29T07:01:54+00:00

Userspace requires 'vlenb' to be able to encode it in reg ID. Otherwise
it is not possible to retrieve any vector reg since we're returning
EINVAL if reg_size isn't vlenb (see kvm_riscv_vcpu_vreg_addr()).

Signed-off-by: Daniel Henrique Barboza 
Reviewed-by: Anup Patel 
Signed-off-by: Anup Patel

RISC-V: KVM: set 'vlenb' in kvm_riscv_vcpu_alloc_vector_context()

2023-12-29T07:01:53+00:00

'vlenb', added to riscv_v_ext_state by commit c35f3aa34509 ("RISC-V:
vector: export VLENB csr in __sc_riscv_v_state"), isn't being
initialized in guest_context. If we export 'vlenb' as a KVM CSR,
something we want to do in the next patch, it'll always return 0.

Set 'vlenb' to riscv_v_size/32.

Signed-off-by: Daniel Henrique Barboza 
Reviewed-by: Anup Patel 
Signed-off-by: Anup Patel

riscv: Rearrange hwcap.h and cpufeature.h

2023-11-09T18:15:51+00:00

Now hwcap.h and cpufeature.h are mutually including each other, and most of
the variable/API declarations in hwcap.h are implemented in cpufeature.c,
so, it's better to move them into cpufeature.h and leave only macros for
ISA extension logical IDs in hwcap.h.

BTW, the riscv_isa_extension_mask macro is not used now, so this patch
removes it.

Suggested-by: Andrew Jones 
Signed-off-by: Xiao Wang 
Reviewed-by: Andrew Jones 
Link: https://lore.kernel.org/r/20231031064553.2319688-2-xiao.w.wang@intel.com
Signed-off-by: Palmer Dabbelt

RISC-V: KVM: Improve vector save/restore functions

2023-08-08T11:56:05+00:00

Make two nonfunctional changes to the vector get/set vector reg
functions and their supporting function for simplification and
readability. The first is to not pass KVM_REG_RISCV_VECTOR, but
rather integrate it directly into the masking. The second is to
rename reg_val to reg_addr where and address is used instead of
a value.

Also opportunistically touch up some of the code formatting for
a third nonfunctional change.

Signed-off-by: Andrew Jones 
Reviewed-by: Daniel Henrique Barboza 
Signed-off-by: Anup Patel

RISC-V: KVM: Improve vector save/restore errors

2023-08-08T11:56:00+00:00

kvm_riscv_vcpu_(get/set)_reg_vector() now returns ENOENT if V is not
available, EINVAL if reg type is not of VECTOR type, and any error that
might be thrown by kvm_riscv_vcpu_vreg_addr().

Signed-off-by: Andrew Jones 
Signed-off-by: Anup Patel

riscv: KVM: Add vector lazy save/restore support

2023-06-08T14:16:51+00:00

This patch adds vector context save/restore for guest VCPUs. To reduce the
impact on KVM performance, the implementation imitates the FP context
switch mechanism to lazily store and restore the vector context only when
the kernel enters/exits the in-kernel run loop and not during the KVM
world switch.

Signed-off-by: Vincent Chen 
Signed-off-by: Greentime Hu 
Signed-off-by: Andy Chiu 
Reviewed-by: Anup Patel 
Acked-by: Anup Patel 
Link: https://lore.kernel.org/r/20230605110724.21391-20-andy.chiu@sifive.com
Signed-off-by: Palmer Dabbelt