Hardware or bootloader will initialize TLB entries to any value, which
may collide with kernel's UNIQUE_ENTRYHI value. On MIPS microAptiv/M5150
family of cores this will trigger machine check exception and cause boot
failure. On M5150 simulation this could happen 7 times out of 1000 boots.

Replace local_flush_tlb_all() with r4k_tlb_uniquify() which probes each
TLB ENTRIHI unique value for collisions before it's written, and in case
of collision try a different ASID.

Cc: stable@kernel.org
Signed-off-by: Jiaxun Yang <jiaxun.yang@flygoat.com>
---
Changes in v2:
- Cycle ASID instead of ENTRYHI index in case of collison.
- Avoid int over flow UB (Maciej)
- Link to v1: https://lore.kernel.org/r/20250605-tlb-fix-v1-1-4af496f17b2f@flygoat.com
---
 arch/mips/mm/tlb-r4k.c | 56 +++++++++++++++++++++++++++++++++++++++++++++++++-
 1 file changed, 55 insertions(+), 1 deletion(-)

diff --git a/arch/mips/mm/tlb-r4k.c b/arch/mips/mm/tlb-r4k.c
index 76f3b9c0a9f0ce60c42e4a9ea8025e1283678bd1..347126dc010dd59904820d9d9e34cdeeb011832f 100644
--- a/arch/mips/mm/tlb-r4k.c
+++ b/arch/mips/mm/tlb-r4k.c
@@ -508,6 +508,60 @@ static int __init set_ntlb(char *str)
 
 __setup("ntlb=", set_ntlb);
 
+/* Initialise all TLB entries with unique values */
+static void r4k_tlb_uniquify(void)
+{
+	int entry = num_wired_entries();
+
+	htw_stop();
+	write_c0_entrylo0(0);
+	write_c0_entrylo1(0);
+
+	while (entry < current_cpu_data.tlbsize) {
+		unsigned long asid_mask = cpu_asid_mask(&current_cpu_data);
+		unsigned long asid = 0;
+		int idx;
+
+		/* Skip wired MMID to make ginvt_mmid work */
+		if (cpu_has_mmid)
+			asid = MMID_KERNEL_WIRED + 1;
+
+		/* Check for match before using UNIQUE_ENTRYHI */
+		do {
+			if (cpu_has_mmid) {
+				write_c0_memorymapid(asid);
+				write_c0_entryhi(UNIQUE_ENTRYHI(entry));
+			} else {
+				write_c0_entryhi(UNIQUE_ENTRYHI(entry) | asid);
+			}
+			mtc0_tlbw_hazard();
+			tlb_probe();
+			tlb_probe_hazard();
+			idx = read_c0_index();
+			/* No match or match is on current entry */
+			if (idx < 0 || idx == entry)
+				break;
+			/*
+			 * If we hit a match, we need to try again with
+			 * a different ASID.
+			 */
+			asid++;
+		} while (asid < asid_mask);
+
+		if (idx >= 0 && idx != entry)
+			panic("Unable to uniquify TLB entry %d", idx);
+
+		write_c0_index(entry);
+		mtc0_tlbw_hazard();
+		tlb_write_indexed();
+		entry++;
+	}
+
+	tlbw_use_hazard();
+	htw_start();
+	flush_micro_tlb();
+}
+
 /*
  * Configure TLB (for init or after a CPU has been powered off).
  */
@@ -547,7 +601,7 @@ static void r4k_tlb_configure(void)
 	temp_tlb_entry = current_cpu_data.tlbsize - 1;
 
 	/* From this point on the ARC firmware is dead.	 */
-	local_flush_tlb_all();
+	r4k_tlb_uniquify();
 
 	/* Did I tell you that ARC SUCKS?  */
 }

---
base-commit: 911483b25612c8bc32a706ba940738cc43299496
change-id: 20250605-tlb-fix-578bac7be546

Best regards,
-- 
Jiaxun Yang <jiaxun.yang@flygoat.com>

On Sat, Jun 07, 2025 at 01:43:56PM +0100, Jiaxun Yang wrote:
> Hardware or bootloader will initialize TLB entries to any value, which
> may collide with kernel's UNIQUE_ENTRYHI value. On MIPS microAptiv/M5150
> family of cores this will trigger machine check exception and cause boot
> failure. On M5150 simulation this could happen 7 times out of 1000 boots.
> 
> Replace local_flush_tlb_all() with r4k_tlb_uniquify() which probes each
> TLB ENTRIHI unique value for collisions before it's written, and in case
> of collision try a different ASID.
> 
> Cc: stable@kernel.org
> Signed-off-by: Jiaxun Yang <jiaxun.yang@flygoat.com>
> ---
> Changes in v2:
> - Cycle ASID instead of ENTRYHI index in case of collison.
> - Avoid int over flow UB (Maciej)
> - Link to v1: https://lore.kernel.org/r/20250605-tlb-fix-v1-1-4af496f17b2f@flygoat.com
> ---
>  arch/mips/mm/tlb-r4k.c | 56 +++++++++++++++++++++++++++++++++++++++++++++++++-
>  1 file changed, 55 insertions(+), 1 deletion(-)

applied to mips-next.

Thomas.

-- 
Crap can work. Given enough thrust pigs will fly, but it's not necessarily a
good idea.                                                [ RFC1925, 2.3 ]

在2025年6月7日周六 下午1:43，Jiaxun Yang写道：
> Hardware or bootloader will initialize TLB entries to any value, which
> may collide with kernel's UNIQUE_ENTRYHI value. On MIPS microAptiv/M5150
> family of cores this will trigger machine check exception and cause boot
> failure. On M5150 simulation this could happen 7 times out of 1000 boots.
>
> Replace local_flush_tlb_all() with r4k_tlb_uniquify() which probes each
> TLB ENTRIHI unique value for collisions before it's written, and in case
> of collision try a different ASID.

A gentle ping :-)

>
> Cc: stable@kernel.org
> Signed-off-by: Jiaxun Yang <jiaxun.yang@flygoat.com>
> ---
> Changes in v2:
> - Cycle ASID instead of ENTRYHI index in case of collison.
> - Avoid int over flow UB (Maciej)
> - Link to v1: 
> https://lore.kernel.org/r/20250605-tlb-fix-v1-1-4af496f17b2f@flygoat.com
> ---
>  arch/mips/mm/tlb-r4k.c | 56 
> +++++++++++++++++++++++++++++++++++++++++++++++++-
>  1 file changed, 55 insertions(+), 1 deletion(-)
>
> diff --git a/arch/mips/mm/tlb-r4k.c b/arch/mips/mm/tlb-r4k.c
> index 
> 76f3b9c0a9f0ce60c42e4a9ea8025e1283678bd1..347126dc010dd59904820d9d9e34cdeeb011832f 
> 100644
> --- a/arch/mips/mm/tlb-r4k.c
> +++ b/arch/mips/mm/tlb-r4k.c
> @@ -508,6 +508,60 @@ static int __init set_ntlb(char *str)
> 
>  __setup("ntlb=", set_ntlb);
> 
> +/* Initialise all TLB entries with unique values */
> +static void r4k_tlb_uniquify(void)
> +{
> +	int entry = num_wired_entries();
> +
> +	htw_stop();
> +	write_c0_entrylo0(0);
> +	write_c0_entrylo1(0);
> +
> +	while (entry < current_cpu_data.tlbsize) {
> +		unsigned long asid_mask = cpu_asid_mask(&current_cpu_data);
> +		unsigned long asid = 0;
> +		int idx;
> +
> +		/* Skip wired MMID to make ginvt_mmid work */
> +		if (cpu_has_mmid)
> +			asid = MMID_KERNEL_WIRED + 1;
> +
> +		/* Check for match before using UNIQUE_ENTRYHI */
> +		do {
> +			if (cpu_has_mmid) {
> +				write_c0_memorymapid(asid);
> +				write_c0_entryhi(UNIQUE_ENTRYHI(entry));
> +			} else {
> +				write_c0_entryhi(UNIQUE_ENTRYHI(entry) | asid);
> +			}
> +			mtc0_tlbw_hazard();
> +			tlb_probe();
> +			tlb_probe_hazard();
> +			idx = read_c0_index();
> +			/* No match or match is on current entry */
> +			if (idx < 0 || idx == entry)
> +				break;
> +			/*
> +			 * If we hit a match, we need to try again with
> +			 * a different ASID.
> +			 */
> +			asid++;
> +		} while (asid < asid_mask);
> +
> +		if (idx >= 0 && idx != entry)
> +			panic("Unable to uniquify TLB entry %d", idx);
> +
> +		write_c0_index(entry);
> +		mtc0_tlbw_hazard();
> +		tlb_write_indexed();
> +		entry++;
> +	}
> +
> +	tlbw_use_hazard();
> +	htw_start();
> +	flush_micro_tlb();
> +}
> +
>  /*
>   * Configure TLB (for init or after a CPU has been powered off).
>   */
> @@ -547,7 +601,7 @@ static void r4k_tlb_configure(void)
>  	temp_tlb_entry = current_cpu_data.tlbsize - 1;
> 
>  	/* From this point on the ARC firmware is dead.	 */
> -	local_flush_tlb_all();
> +	r4k_tlb_uniquify();
> 
>  	/* Did I tell you that ARC SUCKS?  */
>  }
>
> ---
> base-commit: 911483b25612c8bc32a706ba940738cc43299496
> change-id: 20250605-tlb-fix-578bac7be546
>
> Best regards,
> -- 
> Jiaxun Yang <jiaxun.yang@flygoat.com>

-- 
- Jiaxun