[PATCH] riscv: errata: select RISCV_ALTERNATIVE_EARLY for THEAD GHOSTWRITE

[PATCH] riscv: errata: select RISCV_ALTERNATIVE_EARLY for THEAD GHOSTWRITE

[Zongmin Zhou]

From: Zongmin Zhou <zhouzongmin@kylinos.cn>

errata_probe_ghostwrite() only marks the CPU as vulnerable when it is
called at the RISCV_ALTERNATIVES_EARLY_BOOT stage, and the mitigation
in ghostwrite_enable_mitigation() only takes effect if the vulnerable
state was recorded before the boot alternatives are patched.

The early boot stage is only executed when CONFIG_RISCV_ALTERNATIVE_EARLY
is enabled, which currently is only selected by ERRATA_THEAD_MAE. In a
kernel built with ERRATA_THEAD_GHOSTWRITE=y but ERRATA_THEAD_MAE=n, the
early alternatives never run, so ghostwrite_state is never set to
VULNERABLE: ghostwrite_enable_mitigation() returns false, xtheadvector
remains enabled, and sysfs reports "Not affected" on a vulnerable
T-Head C9xx CPU.

Select RISCV_ALTERNATIVE_EARLY from ERRATA_THEAD_GHOSTWRITE so that the
vulnerability is detected in the early boot stage and the default
mitigation is applied.

Fixes: 4bf97069239b ("riscv: Add ghostwrite vulnerability")
Signed-off-by: Zongmin Zhou <zhouzongmin@kylinos.cn>
---
 arch/riscv/Kconfig.errata | 1 +
 1 file changed, 1 insertion(+)

diff --git a/arch/riscv/Kconfig.errata b/arch/riscv/Kconfig.errata
index 3c945d086c7d..6121ba83cfa6 100644
--- a/arch/riscv/Kconfig.errata
+++ b/arch/riscv/Kconfig.errata
@@ -146,6 +146,7 @@ config ERRATA_THEAD_PMU
 config ERRATA_THEAD_GHOSTWRITE
 	bool "Apply T-Head Ghostwrite errata"
 	depends on ERRATA_THEAD && RISCV_ISA_XTHEADVECTOR
+	select RISCV_ALTERNATIVE_EARLY
 	default y
 	help
 	  The T-Head C9xx cores have a vulnerability in the xtheadvector
-- 
2.34.1


No virus found
		Checked by Hillstone Network AntiVirus

Re: [PATCH] riscv: errata: select RISCV_ALTERNATIVE_EARLY for THEAD GHOSTWRITE

[Paul Walmsley]

On Thu, 17 Sep 2026, Zongmin Zhou wrote:

> From: Zongmin Zhou <zhouzongmin@kylinos.cn>
> 
> errata_probe_ghostwrite() only marks the CPU as vulnerable when it is
> called at the RISCV_ALTERNATIVES_EARLY_BOOT stage, and the mitigation
> in ghostwrite_enable_mitigation() only takes effect if the vulnerable
> state was recorded before the boot alternatives are patched.
> 
> The early boot stage is only executed when CONFIG_RISCV_ALTERNATIVE_EARLY
> is enabled, which currently is only selected by ERRATA_THEAD_MAE. In a
> kernel built with ERRATA_THEAD_GHOSTWRITE=y but ERRATA_THEAD_MAE=n, the
> early alternatives never run, so ghostwrite_state is never set to
> VULNERABLE: ghostwrite_enable_mitigation() returns false, xtheadvector
> remains enabled, and sysfs reports "Not affected" on a vulnerable
> T-Head C9xx CPU.
> 
> Select RISCV_ALTERNATIVE_EARLY from ERRATA_THEAD_GHOSTWRITE so that the
> vulnerability is detected in the early boot stage and the default
> mitigation is applied.
> 
> Fixes: 4bf97069239b ("riscv: Add ghostwrite vulnerability")
> Signed-off-by: Zongmin Zhou <zhouzongmin@kylinos.cn>

Thanks, queued for v7.3-rc.


- Paul