[RFT PATCH] riscv: errata: mips: Skip vendor extension lookup during early alternatives

[RFT PATCH] riscv: errata: mips: Skip vendor extension lookup during early alternatives

[Karl Mehltretter]

When an enabled erratum selects RISCV_ALTERNATIVE_EARLY,
apply_early_boot_alternatives() calls the MIPS errata callback from
setup_vm() with the MMU disabled. Each enabled P8700 probe calls
riscv_isa_vendor_extension_available() before rejecting
RISCV_ALTERNATIVES_EARLY_BOOT, although neither workaround is applied in
that stage.

KASAN instrumentation in __riscv_isa_vendor_extension_available() reads
shadow memory with satp=0. On QEMU's mips-p8700 model this raises a load
access fault, and the temporary trap vector parks the boot hart. The guest
prints nothing after the OpenSBI handoff.

Move the existing early-stage rejection before the extension lookup in both
probes. All later stages retain their existing lookup and patch selection.

Fixes: 0b0ca959d206 ("riscv: errata: Fix the PAUSE Opcode for MIPS P8700")
Fixes: 2cf0b2992203 ("riscv: Add ERRATA_MIPS_P8700_WFI to replace WFI with mips.pause")
Assisted-by: LLM
Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com>
---
Based on RISC-V for-next commit a5ae1bf65cee.

Tested with QEMU 11.0.2, virt/mips-p8700, four harts, and generic KASAN:

- The parent reached the OpenSBI handoff but produced no Linux output in
  120 seconds.
- The patched kernel initialized KASAN, brought all four harts online, and
  powered off cleanly.
- With a DTB advertising xmipsexectl, all 414 PAUSE and 6 WFI sites in live
  kernel text contained mips.pause.

QEMU does not model the physical WFI translation erratum or P8700 PAUSE
behavior. This was not tested on P8700 hardware. Please test with KASAN and
both P8700 errata enabled.

 arch/riscv/errata/mips/errata.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/arch/riscv/errata/mips/errata.c b/arch/riscv/errata/mips/errata.c
index 6e71555274501..9bb1c3de9504e 100644
--- a/arch/riscv/errata/mips/errata.c
+++ b/arch/riscv/errata/mips/errata.c
@@ -18,10 +18,10 @@ static inline bool errata_probe_pause(unsigned int stage)
 	if (!IS_ENABLED(CONFIG_ERRATA_MIPS_P8700_PAUSE_OPCODE))
 		return false;
 
-	if (!riscv_isa_vendor_extension_available(MIPS_VENDOR_ID, XMIPSEXECTL))
+	if (stage == RISCV_ALTERNATIVES_EARLY_BOOT)
 		return false;
 
-	if (stage == RISCV_ALTERNATIVES_EARLY_BOOT)
+	if (!riscv_isa_vendor_extension_available(MIPS_VENDOR_ID, XMIPSEXECTL))
 		return false;
 
 	return true;
@@ -32,10 +32,10 @@ static inline bool errata_probe_wfi(unsigned int stage)
 	if (!IS_ENABLED(CONFIG_ERRATA_MIPS_P8700_WFI))
 		return false;
 
-	if (!riscv_isa_vendor_extension_available(MIPS_VENDOR_ID, XMIPSEXECTL))
+	if (stage == RISCV_ALTERNATIVES_EARLY_BOOT)
 		return false;
 
-	if (stage == RISCV_ALTERNATIVES_EARLY_BOOT)
+	if (!riscv_isa_vendor_extension_available(MIPS_VENDOR_ID, XMIPSEXECTL))
 		return false;
 
 	return true;
base-commit: a5ae1bf65cee84bcc121d659e7e22a767853f5f5
-- 
2.39.5 (Apple Git-154)

Re: [RFT PATCH] riscv: errata: mips: Skip vendor extension lookup during early alternatives

[Aleksa Paunovic]

Hi Karl,

Thanks for the fix!

On 10/16/26 22:30, Karl Mehltretter wrote:
> When an enabled erratum selects RISCV_ALTERNATIVE_EARLY,
> apply_early_boot_alternatives() calls the MIPS errata callback from
> setup_vm() with the MMU disabled. Each enabled P8700 probe calls
> riscv_isa_vendor_extension_available() before rejecting
> RISCV_ALTERNATIVES_EARLY_BOOT, although neither workaround is applied in
> that stage.
>
> KASAN instrumentation in __riscv_isa_vendor_extension_available() reads
> shadow memory with satp=0. On QEMU's mips-p8700 model this raises a load
> access fault, and the temporary trap vector parks the boot hart. The guest
> prints nothing after the OpenSBI handoff.
>
> Move the existing early-stage rejection before the extension lookup in both
> probes. All later stages retain their existing lookup and patch selection.
>
> Fixes: 0b0ca959d206 ("riscv: errata: Fix the PAUSE Opcode for MIPS P8700")
> Fixes: 2cf0b2992203 ("riscv: Add ERRATA_MIPS_P8700_WFI to replace WFI with mips.pause")
> Assisted-by: LLM
> Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com>
> ---
> Based on RISC-V for-next commit a5ae1bf65cee.
>
> Tested with QEMU 11.0.2, virt/mips-p8700, four harts, and generic KASAN:
>
> - The parent reached the OpenSBI handoff but produced no Linux output in
>   120 seconds.
> - The patched kernel initialized KASAN, brought all four harts online, and
>   powered off cleanly.
> - With a DTB advertising xmipsexectl, all 414 PAUSE and 6 WFI sites in live
>   kernel text contained mips.pause.
>
> QEMU does not model the physical WFI translation erratum or P8700 PAUSE
> behavior. This was not tested on P8700 hardware. Please test with KASAN and
> both P8700 errata enabled.
I tested this on a Boston board configured with a single-core MIPS P8700 CPU. 
The kernel was built with KASAN_INLINE enabled. Reproduced the bug and confirmed
that your fix works. FWIW, I was not able to reproduce it with KASAN_OUTLINE.

Tested-by: Aleksa Paunovic <aleksa.paunovic@htecgroup.com>

Best regards,
Aleksa