From nobody Mon Dec 1 22:05:37 2025 Received: from angie.orcam.me.uk (angie.orcam.me.uk [78.133.224.34]) by smtp.subspace.kernel.org (Postfix) with ESMTP id 1AF8E23EA94; Thu, 27 Nov 2025 04:54:13 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=78.133.224.34 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1764219258; cv=none; b=ZJc/4D3tgue6+hdRrWqKVLvGDKplk1HnBesWGwDow1gmfYu8gpyNBkfaOP/EDTL+skjLuHLhR0N5V+yoxWbuq20AFlI2FZpn0G5o2XIBK0n9LkalOASW44oZFYzr4AYLinSco6mqIlSju4kHpRa29a1+jP9smqNTrpeiwkixt+g= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1764219258; c=relaxed/simple; bh=J8IKZV7LQQSu/SQ9N6nxGmTKp9Zl9MYHNhaRvZoBHeQ=; h=Date:From:To:cc:Subject:Message-ID:MIME-Version:Content-Type; b=PHl+8Kh5WHSXr5m90Chl5EfWfVBYGkQ17p5olFGdzxpQgIHJdDigwKTrrDhC63lR5B5juJx43FxD2R/Z0hMJPabSM7D6+DFqymovv3FrnfzumGqZbFq0+LCLuftuZljvtuDq1ovL53o5oAjJoTZqPAjZjiJZOSzZYfk4aFDMr/Q= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=orcam.me.uk; spf=none smtp.mailfrom=orcam.me.uk; arc=none smtp.client-ip=78.133.224.34 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=orcam.me.uk Authentication-Results: smtp.subspace.kernel.org; spf=none smtp.mailfrom=orcam.me.uk Received: by angie.orcam.me.uk (Postfix, from userid 500) id 5495192009C; Thu, 27 Nov 2025 05:54:10 +0100 (CET) Received: from localhost (localhost [127.0.0.1]) by angie.orcam.me.uk (Postfix) with ESMTP id 4E8F992009B; Thu, 27 Nov 2025 04:54:10 +0000 (GMT) Date: Thu, 27 Nov 2025 04:54:10 +0000 (GMT) From: "Maciej W. Rozycki" To: Thomas Bogendoerfer cc: Jiaxun Yang , Gregory CLEMENT , linux-mips@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH v3] MIPS: mm: kmalloc tlb_vpn array to avoid stack overflow Message-ID: User-Agent: Alpine 2.21 (DEB 202 2017-01-01) Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Thomas Bogendoerfer Owing to Config4.MMUSizeExt and VTLB/FTLB MMU features later MIPSr2+=20 cores can have more than 64 TLB entries. Therefore allocate an array=20 for uniquification instead of placing too small an array on the stack. Signed-off-by: Thomas Bogendoerfer Signed-off-by: Maciej W. Rozycki Fixes: 9f048fa48740 ("MIPS: mm: Prevent a TLB shutdown on initial uniquific= ation") Cc: stable@vger.kernel.org --- Verified with Malta/74Kf and Malta/interAptiv for initial and secondary=20 CPU bootstrap. The PM path hasn't been covered, but is expected to be=20 the same as secondary CPU bootstrap. NB Malta/interAptiv has issues later on in SMP boot (boots fine UP) and=20 hangs with repeated: irq 23: nobody cared (try booting with the "irqpoll" option) CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Not tainted 6.18.0-rc1-dirty #2 NONE messages (for the CP0 timer interrupt AFAICT; GIC timer is supposed to=20 be used instead). This will have to be bisected. Changes from v2: - Use the bootmem allocator for early calls (CPU #0 bootstrap). - Update the change description; mark for stable backporting. --- arch/mips/mm/tlb-r4k.c | 16 +++++++++++++++- 1 file changed, 15 insertions(+), 1 deletion(-) linux-mips-tlb-r4k-uniquify-tlbsize.diff Index: linux-macro/arch/mips/mm/tlb-r4k.c =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D --- linux-macro.orig/arch/mips/mm/tlb-r4k.c +++ linux-macro/arch/mips/mm/tlb-r4k.c @@ -12,6 +12,7 @@ #include #include #include +#include #include #include #include @@ -524,15 +525,24 @@ static int r4k_vpn_cmp(const void *a, co */ static void r4k_tlb_uniquify(void) { - unsigned long tlb_vpns[1 << MIPS_CONF1_TLBS_SIZE]; int tlbsize =3D current_cpu_data.tlbsize; + bool use_slab =3D slab_is_available(); int start =3D num_wired_entries(); + phys_addr_t tlb_vpn_size; + unsigned long *tlb_vpns; unsigned long vpn_mask; int cnt, ent, idx, i; =20 vpn_mask =3D GENMASK(cpu_vmbits - 1, 13); vpn_mask |=3D IS_ENABLED(CONFIG_64BIT) ? 3ULL << 62 : 1 << 31; =20 + tlb_vpn_size =3D tlbsize * sizeof(*tlb_vpns); + tlb_vpns =3D (use_slab ? + kmalloc(tlb_vpn_size, GFP_KERNEL) : + memblock_alloc_raw(tlb_vpn_size, sizeof(*tlb_vpns))); + if (WARN_ON(!tlb_vpns)) + return; /* Pray local_flush_tlb_all() is good enough. */ + htw_stop(); =20 for (i =3D start, cnt =3D 0; i < tlbsize; i++, cnt++) { @@ -585,6 +595,10 @@ static void r4k_tlb_uniquify(void) tlbw_use_hazard(); htw_start(); flush_micro_tlb(); + if (use_slab) + kfree(tlb_vpns); + else + memblock_free(tlb_vpns, tlb_vpn_size); } =20 /*