[PATCH] MIPS: mm: Fix the cache error vector jump for XKPHYS kernels

[PATCH] MIPS: mm: Fix the cache error vector jump for XKPHYS kernels

[Imre Kaloz]

except_vec2_generic jumps to cache_parity_error with a j, which cannot
leave the vector's 256MB region. An XKPHYS kernel such as IP30's, linked
at 512MB, is outside it, so the j targets an unbacked address and its
speculative fetch raises bus errors on unrelated fetches. Jump to the
handler's uncached XKPHYS address instead.

Fixes: 7505576d1c1a ("MIPS: add support for SGI Octane (IP30)")
Cc: stable@vger.kernel.org
Signed-off-by: Imre Kaloz <kaloz@kernel.org>
---
 arch/mips/mm/cex-gen.S | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/arch/mips/mm/cex-gen.S b/arch/mips/mm/cex-gen.S
index e528583d1331..6989fe274aab 100644
--- a/arch/mips/mm/cex-gen.S
+++ b/arch/mips/mm/cex-gen.S
@@ -8,6 +8,7 @@
  *
  * Cache error handler
  */
+#include <asm/addrspace.h>
 #include <asm/asm.h>
 #include <asm/regdef.h>
 #include <asm/mipsregs.h>
@@ -37,6 +38,21 @@
 	nop
 	nop
 
+#if defined(CONFIG_64BIT) && VMLINUX_LOAD_ADDRESS >= XKPHYS && \
+    VMLINUX_LOAD_ADDRESS < XKSEG
+	/*
+	 * An XKPHYS kernel may lie outside the 256MB region a j from the
+	 * vector reaches, so jump to the handler's uncached XKPHYS address.
+	 */
+	PTR_LA	k0, cache_parity_error
+	PTR_LI	k1, TO_PHYS_MASK
+	and	k0, k0, k1
+	PTR_LI	k1, UNCAC_BASE
+	or	k0, k0, k1
+	jr	k0
+	nop
+#else
 	j	cache_parity_error
 	nop
+#endif
 	END(except_vec2_generic)

base-commit: 24a19b953e2a3d0ea5a8c4951a0ab8f32720c907

Re: [PATCH] MIPS: mm: Fix the cache error vector jump for XKPHYS kernels

[Thomas Bogendoerfer]

On Wed, Oct 21, 2026 at 08:57:09PM +0200, Imre Kaloz wrote:
> except_vec2_generic jumps to cache_parity_error with a j, which cannot
> leave the vector's 256MB region. An XKPHYS kernel such as IP30's, linked
> at 512MB, is outside it, so the j targets an unbacked address and its
> speculative fetch raises bus errors on unrelated fetches. Jump to the
> handler's uncached XKPHYS address instead.
> 
> Fixes: 7505576d1c1a ("MIPS: add support for SGI Octane (IP30)")
> Cc: stable@vger.kernel.org
> Signed-off-by: Imre Kaloz <kaloz@kernel.org>
> ---
>  arch/mips/mm/cex-gen.S | 16 ++++++++++++++++
>  1 file changed, 16 insertions(+)

applied to mips-fixes

Thomas.

-- 
Crap can work. Given enough thrust pigs will fly, but it's not necessarily a
good idea.                                                [ RFC1925, 2.3 ]

Re: [PATCH] MIPS: mm: Fix the cache error vector jump for XKPHYS kernels

[Maciej W. Rozycki]

On Wed, 21 Oct 2026, Imre Kaloz wrote:

> diff --git a/arch/mips/mm/cex-gen.S b/arch/mips/mm/cex-gen.S
> index e528583d1331..6989fe274aab 100644
> --- a/arch/mips/mm/cex-gen.S
> +++ b/arch/mips/mm/cex-gen.S
> @@ -37,6 +38,21 @@
>  	nop
>  	nop
>  
> +#if defined(CONFIG_64BIT) && VMLINUX_LOAD_ADDRESS >= XKPHYS && \
> +    VMLINUX_LOAD_ADDRESS < XKSEG

 Not VMLINUX_LOAD_ADDRESS < CKSEG0 to take care of CONFIG_MAPPED_KERNEL?
Of course we'd have to switch caching in the wired TLB entry then too, but 
at least we won't crash outright...

> +	/*
> +	 * An XKPHYS kernel may lie outside the 256MB region a j from the
> +	 * vector reaches, so jump to the handler's uncached XKPHYS address.
> +	 */
> +	PTR_LA	k0, cache_parity_error
> +	PTR_LI	k1, TO_PHYS_MASK
> +	and	k0, k0, k1
> +	PTR_LI	k1, UNCAC_BASE
> +	or	k0, k0, k1
> +	jr	k0
> +	nop

 Given that this runs at ERL, a much shorter sequence could look like:

	LEAF(except_vec2_generic)
0:
	[...]
	PTR_L	k0, %lo(0x100 + (1f - 0b))(zero)
	jr	k0
	 nop
1:
	.quad	cache_parity_error
	[...]
	END(except_vec2_generic)

but I guess it doesn't matter that much as long as we don't overrun the 
exception handler slot, since this is obviously not a hot path.  Still it 
could be considered neater, couldn't it?

  Maciej