linux-kernel - Re: [PATCH v2] MIPS: mm: tlb-r4k: Uniquify TLB entries on init

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-Id: <7ebe1a12-5975-4ed1-8580-905662059a27@app.fastmail.com>
Date: Tue, 24 Jun 2025 09:42:14 +0100
From: "Jiaxun Yang" <jiaxun.yang@...goat.com>
To: "Thomas Bogendoerfer" <tsbogend@...ha.franken.de>
Cc: "Maciej W. Rozycki" <macro@...am.me.uk>,
 "linux-mips@...r.kernel.org" <linux-mips@...r.kernel.org>,
 linux-kernel@...r.kernel.org, stable@...nel.org
Subject: Re: [PATCH v2] MIPS: mm: tlb-r4k: Uniquify TLB entries on init



在2025年6月7日周六 下午1:43，Jiaxun Yang写道：
> Hardware or bootloader will initialize TLB entries to any value, which
> may collide with kernel's UNIQUE_ENTRYHI value. On MIPS microAptiv/M5150
> family of cores this will trigger machine check exception and cause boot
> failure. On M5150 simulation this could happen 7 times out of 1000 boots.
>
> Replace local_flush_tlb_all() with r4k_tlb_uniquify() which probes each
> TLB ENTRIHI unique value for collisions before it's written, and in case
> of collision try a different ASID.

A gentle ping :-)

>
> Cc: stable@...nel.org
> Signed-off-by: Jiaxun Yang <jiaxun.yang@...goat.com>
> ---
> Changes in v2:
> - Cycle ASID instead of ENTRYHI index in case of collison.
> - Avoid int over flow UB (Maciej)
> - Link to v1: 
> https://lore.kernel.org/r/20250605-tlb-fix-v1-1-4af496f17b2f@flygoat.com
> ---
>  arch/mips/mm/tlb-r4k.c | 56 
> +++++++++++++++++++++++++++++++++++++++++++++++++-
>  1 file changed, 55 insertions(+), 1 deletion(-)
>
> diff --git a/arch/mips/mm/tlb-r4k.c b/arch/mips/mm/tlb-r4k.c
> index 
> 76f3b9c0a9f0ce60c42e4a9ea8025e1283678bd1..347126dc010dd59904820d9d9e34cdeeb011832f 
> 100644
> --- a/arch/mips/mm/tlb-r4k.c
> +++ b/arch/mips/mm/tlb-r4k.c
> @@ -508,6 +508,60 @@ static int __init set_ntlb(char *str)
> 
>  __setup("ntlb=", set_ntlb);
> 
> +/* Initialise all TLB entries with unique values */
> +static void r4k_tlb_uniquify(void)
> +{
> +	int entry = num_wired_entries();
> +
> +	htw_stop();
> +	write_c0_entrylo0(0);
> +	write_c0_entrylo1(0);
> +
> +	while (entry < current_cpu_data.tlbsize) {
> +		unsigned long asid_mask = cpu_asid_mask(&current_cpu_data);
> +		unsigned long asid = 0;
> +		int idx;
> +
> +		/* Skip wired MMID to make ginvt_mmid work */
> +		if (cpu_has_mmid)
> +			asid = MMID_KERNEL_WIRED + 1;
> +
> +		/* Check for match before using UNIQUE_ENTRYHI */
> +		do {
> +			if (cpu_has_mmid) {
> +				write_c0_memorymapid(asid);
> +				write_c0_entryhi(UNIQUE_ENTRYHI(entry));
> +			} else {
> +				write_c0_entryhi(UNIQUE_ENTRYHI(entry) | asid);
> +			}
> +			mtc0_tlbw_hazard();
> +			tlb_probe();
> +			tlb_probe_hazard();
> +			idx = read_c0_index();
> +			/* No match or match is on current entry */
> +			if (idx < 0 || idx == entry)
> +				break;
> +			/*
> +			 * If we hit a match, we need to try again with
> +			 * a different ASID.
> +			 */
> +			asid++;
> +		} while (asid < asid_mask);
> +
> +		if (idx >= 0 && idx != entry)
> +			panic("Unable to uniquify TLB entry %d", idx);
> +
> +		write_c0_index(entry);
> +		mtc0_tlbw_hazard();
> +		tlb_write_indexed();
> +		entry++;
> +	}
> +
> +	tlbw_use_hazard();
> +	htw_start();
> +	flush_micro_tlb();
> +}
> +
>  /*
>   * Configure TLB (for init or after a CPU has been powered off).
>   */
> @@ -547,7 +601,7 @@ static void r4k_tlb_configure(void)
>  	temp_tlb_entry = current_cpu_data.tlbsize - 1;
> 
>  	/* From this point on the ARC firmware is dead.	 */
> -	local_flush_tlb_all();
> +	r4k_tlb_uniquify();
> 
>  	/* Did I tell you that ARC SUCKS?  */
>  }
>
> ---
> base-commit: 911483b25612c8bc32a706ba940738cc43299496
> change-id: 20250605-tlb-fix-578bac7be546
>
> Best regards,
> -- 
> Jiaxun Yang <jiaxun.yang@...goat.com>

-- 
- Jiaxun