[PATCH] microblaze: restore the page alignment of swapper_pg_dir

[PATCH] microblaze: restore the page alignment of swapper_pg_dir

[Ramin Moussavi]

microblaze handles TLB misses in software, and the handler builds the
address of the L1 entry by ORing the index into the page directory base
instead of adding it (hw_exception_handler.S):

		bsrli	r5, r3, PGDIR_SHIFT - 2
		andi	r5, r5, PAGE_SIZE - 4
	/* Assume pgdir aligned on 4K boundary, no need for
	   "andi r4,r4,0xfffff003" */
		or	r4, r4, r5
		lwi	r4, r4, 0		/* Get L1 entry */

The index is masked to the low 12 bits, so the OR only works if those bits
of the base are zero -- which is exactly the assumption the comment states
and the reason the masking of the base can be skipped.

swapper_pg_dir had no alignment directive of its own.  It was aligned
because it followed empty_zero_page in head.S, and that one carried the
.align 12:

	.section .data
	.global empty_zero_page
	.align 12
	empty_zero_page:
		.space	PAGE_SIZE
	.global swapper_pg_dir
	swapper_pg_dir:
		.space	PAGE_SIZE

Commit 6215d9f4470f ("arch, mm: consolidate empty_zero_page") removed
empty_zero_page from head.S, and with it the .align 12 that -- despite
sitting next to empty_zero_page -- was what page aligned swapper_pg_dir.
Since then swapper_pg_dir lands wherever .data happens to put it, its low
bits are no longer zero, and every kernel TLB miss ORs the index into a
base with a nonzero offset.  The resulting L1 lookups read the wrong
words, no valid translation is ever installed, and the kernel spins in
exceptions long before it can print anything.  On qemu-system-microblazeel
(petalogix-s3adsp1800) the console stays completely silent at 100% CPU;
there is no oops and no guest error reported by qemu, which makes this
awkward to diagnose.

Give swapper_pg_dir the alignment it requires, rather than relying on a
neighbour to provide it.

microblaze has no noMMU variant left in mainline -- CONFIG_MMU is
def_bool y and mmu_defconfig is the only defconfig -- so this is not a
corner case: every mainline microblaze kernel since v7.1-rc1 fails to
boot, including the v7.1 release.

	v7.0:                    swapper_pg_dir = 0xc05fd000  (aligned)
	v7.1-rc1:                swapper_pg_dir = 0xc0603140  (offset 320)
	v7.1-rc1 + this fix:     swapper_pg_dir = 0xc0604000  (aligned)
	next-20260726:           swapper_pg_dir = 0xc0615140  (offset 320)
	next-20260726 + this fix: swapper_pg_dir = 0xc0616000  (aligned)

Verified on qemu-system-microblazeel (petalogix-s3adsp1800) with
mmu_defconfig and microblazeel gcc 12.5.0: v7.1-rc1 and next-20260726
both print nothing at all without the fix, and both boot to userspace
with it.

Fixes: 6215d9f4470f ("arch, mm: consolidate empty_zero_page")
Cc: stable@vger.kernel.org
Signed-off-by: Ramin Moussavi <ramin.moussavi@yacoub.de>
---
 arch/microblaze/kernel/head.S | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/arch/microblaze/kernel/head.S b/arch/microblaze/kernel/head.S
index 808019c3b7ac..9bd3e513c89b 100644
--- a/arch/microblaze/kernel/head.S
+++ b/arch/microblaze/kernel/head.S
@@ -39,6 +39,8 @@
 #include <asm/processor.h>
 
 .section .data
+/* The MMU requires a page aligned page directory. */
+.align 12
 .global swapper_pg_dir
 swapper_pg_dir:
 	.space	PAGE_SIZE
-- 
2.53.0

Re: [PATCH] microblaze: restore the page alignment of swapper_pg_dir

[Andrew Morton]

On Mon, 27 Jul 2026 23:58:23 +0200 Ramin Moussavi <ramin.moussavi@yacoub.de> wrote:

> microblaze handles TLB misses in software, and the handler builds the
> address of the L1 entry by ORing the index into the page directory base
> instead of adding it (hw_exception_handler.S):
> 

Well that was a convincing changelog.

> 
> Fixes: 6215d9f4470f ("arch, mm: consolidate empty_zero_page")

I'll queue for 7.2-rcX.

> Cc: stable@vger.kernel.org

With this.

> --- a/arch/microblaze/kernel/head.S
> +++ b/arch/microblaze/kernel/head.S
> @@ -39,6 +39,8 @@
>  #include <asm/processor.h>
>  
>  .section .data
> +/* The MMU requires a page aligned page directory. */
> +.align 12
>  .global swapper_pg_dir
>  swapper_pg_dir:
>  	.space	PAGE_SIZE

Thanks.

Hard-coding "12" is a bit sad.  Can we do ".align PAGE_SHIFT" or
similar?

Re: [PATCH] microblaze: restore the page alignment of swapper_pg_dir

[Michal Simek]

On 7/27/26 23:58, Ramin Moussavi wrote:
> microblaze handles TLB misses in software, and the handler builds the
> address of the L1 entry by ORing the index into the page directory base
> instead of adding it (hw_exception_handler.S):
> 
> 		bsrli	r5, r3, PGDIR_SHIFT - 2
> 		andi	r5, r5, PAGE_SIZE - 4
> 	/* Assume pgdir aligned on 4K boundary, no need for
> 	   "andi r4,r4,0xfffff003" */
> 		or	r4, r4, r5
> 		lwi	r4, r4, 0		/* Get L1 entry */
> 
> The index is masked to the low 12 bits, so the OR only works if those bits
> of the base are zero -- which is exactly the assumption the comment states
> and the reason the masking of the base can be skipped.
> 
> swapper_pg_dir had no alignment directive of its own.  It was aligned
> because it followed empty_zero_page in head.S, and that one carried the
> .align 12:
> 
> 	.section .data
> 	.global empty_zero_page
> 	.align 12
> 	empty_zero_page:
> 		.space	PAGE_SIZE
> 	.global swapper_pg_dir
> 	swapper_pg_dir:
> 		.space	PAGE_SIZE
> 
> Commit 6215d9f4470f ("arch, mm: consolidate empty_zero_page") removed
> empty_zero_page from head.S, and with it the .align 12 that -- despite
> sitting next to empty_zero_page -- was what page aligned swapper_pg_dir.
> Since then swapper_pg_dir lands wherever .data happens to put it, its low
> bits are no longer zero, and every kernel TLB miss ORs the index into a
> base with a nonzero offset.  The resulting L1 lookups read the wrong
> words, no valid translation is ever installed, and the kernel spins in
> exceptions long before it can print anything.  On qemu-system-microblazeel
> (petalogix-s3adsp1800) the console stays completely silent at 100% CPU;
> there is no oops and no guest error reported by qemu, which makes this
> awkward to diagnose.
> 
> Give swapper_pg_dir the alignment it requires, rather than relying on a
> neighbour to provide it.
> 
> microblaze has no noMMU variant left in mainline -- CONFIG_MMU is
> def_bool y and mmu_defconfig is the only defconfig -- so this is not a
> corner case: every mainline microblaze kernel since v7.1-rc1 fails to
> boot, including the v7.1 release.
> 
> 	v7.0:                    swapper_pg_dir = 0xc05fd000  (aligned)
> 	v7.1-rc1:                swapper_pg_dir = 0xc0603140  (offset 320)
> 	v7.1-rc1 + this fix:     swapper_pg_dir = 0xc0604000  (aligned)
> 	next-20260726:           swapper_pg_dir = 0xc0615140  (offset 320)
> 	next-20260726 + this fix: swapper_pg_dir = 0xc0616000  (aligned)

hm. This is the first time I get information about this regression.

Guenter: I know you had Microblaze in your testing. Is it still running?

Thanks,
Michal

Re: [PATCH] microblaze: restore the page alignment of swapper_pg_dir

[Guenter Roeck]

On 7/27/26 22:28, Michal Simek wrote:
> 
> 
> On 7/27/26 23:58, Ramin Moussavi wrote:
>> microblaze handles TLB misses in software, and the handler builds the
>> address of the L1 entry by ORing the index into the page directory base
>> instead of adding it (hw_exception_handler.S):
>>
>>         bsrli    r5, r3, PGDIR_SHIFT - 2
>>         andi    r5, r5, PAGE_SIZE - 4
>>     /* Assume pgdir aligned on 4K boundary, no need for
>>        "andi r4,r4,0xfffff003" */
>>         or    r4, r4, r5
>>         lwi    r4, r4, 0        /* Get L1 entry */
>>
>> The index is masked to the low 12 bits, so the OR only works if those bits
>> of the base are zero -- which is exactly the assumption the comment states
>> and the reason the masking of the base can be skipped.
>>
>> swapper_pg_dir had no alignment directive of its own.  It was aligned
>> because it followed empty_zero_page in head.S, and that one carried the
>> .align 12:
>>
>>     .section .data
>>     .global empty_zero_page
>>     .align 12
>>     empty_zero_page:
>>         .space    PAGE_SIZE
>>     .global swapper_pg_dir
>>     swapper_pg_dir:
>>         .space    PAGE_SIZE
>>
>> Commit 6215d9f4470f ("arch, mm: consolidate empty_zero_page") removed
>> empty_zero_page from head.S, and with it the .align 12 that -- despite
>> sitting next to empty_zero_page -- was what page aligned swapper_pg_dir.
>> Since then swapper_pg_dir lands wherever .data happens to put it, its low
>> bits are no longer zero, and every kernel TLB miss ORs the index into a
>> base with a nonzero offset.  The resulting L1 lookups read the wrong
>> words, no valid translation is ever installed, and the kernel spins in
>> exceptions long before it can print anything.  On qemu-system-microblazeel
>> (petalogix-s3adsp1800) the console stays completely silent at 100% CPU;
>> there is no oops and no guest error reported by qemu, which makes this
>> awkward to diagnose.
>>
>> Give swapper_pg_dir the alignment it requires, rather than relying on a
>> neighbour to provide it.
>>
>> microblaze has no noMMU variant left in mainline -- CONFIG_MMU is
>> def_bool y and mmu_defconfig is the only defconfig -- so this is not a
>> corner case: every mainline microblaze kernel since v7.1-rc1 fails to
>> boot, including the v7.1 release.
>>
>>     v7.0:                    swapper_pg_dir = 0xc05fd000  (aligned)
>>     v7.1-rc1:                swapper_pg_dir = 0xc0603140  (offset 320)
>>     v7.1-rc1 + this fix:     swapper_pg_dir = 0xc0604000  (aligned)
>>     next-20260726:           swapper_pg_dir = 0xc0615140  (offset 320)
>>     next-20260726 + this fix: swapper_pg_dir = 0xc0616000  (aligned)
> 
> hm. This is the first time I get information about this regression.
> 
> Guenter: I know you had Microblaze in your testing. Is it still running?
> 

No, sorry. I gave up on it late last year. Too difficult to support - little
if any interest, big endian support was dropped from qemu after v10.0, and
too many "who cares" responses when bringing up issues. With marginal support
in both qemu and the Linux kernel I ended up spending way too much time trying
to figure out if a problem is a kernel problem or a qemu problem.

Guenter

Re: [PATCH] microblaze: restore the page alignment of swapper_pg_dir

[Michal Simek]

On 7/28/26 08:24, Guenter Roeck wrote:
> On 7/27/26 22:28, Michal Simek wrote:
>>
>>
>> On 7/27/26 23:58, Ramin Moussavi wrote:
>>> microblaze handles TLB misses in software, and the handler builds the
>>> address of the L1 entry by ORing the index into the page directory base
>>> instead of adding it (hw_exception_handler.S):
>>>
>>>         bsrli    r5, r3, PGDIR_SHIFT - 2
>>>         andi    r5, r5, PAGE_SIZE - 4
>>>     /* Assume pgdir aligned on 4K boundary, no need for
>>>        "andi r4,r4,0xfffff003" */
>>>         or    r4, r4, r5
>>>         lwi    r4, r4, 0        /* Get L1 entry */
>>>
>>> The index is masked to the low 12 bits, so the OR only works if those bits
>>> of the base are zero -- which is exactly the assumption the comment states
>>> and the reason the masking of the base can be skipped.
>>>
>>> swapper_pg_dir had no alignment directive of its own.  It was aligned
>>> because it followed empty_zero_page in head.S, and that one carried the
>>> .align 12:
>>>
>>>     .section .data
>>>     .global empty_zero_page
>>>     .align 12
>>>     empty_zero_page:
>>>         .space    PAGE_SIZE
>>>     .global swapper_pg_dir
>>>     swapper_pg_dir:
>>>         .space    PAGE_SIZE
>>>
>>> Commit 6215d9f4470f ("arch, mm: consolidate empty_zero_page") removed
>>> empty_zero_page from head.S, and with it the .align 12 that -- despite
>>> sitting next to empty_zero_page -- was what page aligned swapper_pg_dir.
>>> Since then swapper_pg_dir lands wherever .data happens to put it, its low
>>> bits are no longer zero, and every kernel TLB miss ORs the index into a
>>> base with a nonzero offset.  The resulting L1 lookups read the wrong
>>> words, no valid translation is ever installed, and the kernel spins in
>>> exceptions long before it can print anything.  On qemu-system-microblazeel
>>> (petalogix-s3adsp1800) the console stays completely silent at 100% CPU;
>>> there is no oops and no guest error reported by qemu, which makes this
>>> awkward to diagnose.
>>>
>>> Give swapper_pg_dir the alignment it requires, rather than relying on a
>>> neighbour to provide it.
>>>
>>> microblaze has no noMMU variant left in mainline -- CONFIG_MMU is
>>> def_bool y and mmu_defconfig is the only defconfig -- so this is not a
>>> corner case: every mainline microblaze kernel since v7.1-rc1 fails to
>>> boot, including the v7.1 release.
>>>
>>>     v7.0:                    swapper_pg_dir = 0xc05fd000  (aligned)
>>>     v7.1-rc1:                swapper_pg_dir = 0xc0603140  (offset 320)
>>>     v7.1-rc1 + this fix:     swapper_pg_dir = 0xc0604000  (aligned)
>>>     next-20260726:           swapper_pg_dir = 0xc0615140  (offset 320)
>>>     next-20260726 + this fix: swapper_pg_dir = 0xc0616000  (aligned)
>>
>> hm. This is the first time I get information about this regression.
>>
>> Guenter: I know you had Microblaze in your testing. Is it still running?
>>
> 
> No, sorry. I gave up on it late last year. Too difficult to support - little
> if any interest, big endian support was dropped from qemu after v10.0, and
> too many "who cares" responses when bringing up issues. With marginal support
> in both qemu and the Linux kernel I ended up spending way too much time trying
> to figure out if a problem is a kernel problem or a qemu problem.

ok. I see. Thanks.
I will check with our testing team why they are not testing it.

It is clear that Microblaze is declining and is going to be replaced by Risc-V 
based core called Microblaze V. There is any plan when core disappear from 
design tools but still it is around. But it is question of time when it is going 
to be removed from the kernel. We have been talking about it with Arnd in past.

Thanks,
Michal


-- 
Michal Simek, Ing. (M.Eng), OpenPGP -> KeyID: FE3D1F91
w: www.monstr.eu p: +42-0-721842854
Maintainer of Linux kernel - Xilinx Microblaze
Maintainer of Linux kernel - Xilinx Zynq ARM and ZynqMP/Versal ARM64 SoCs
U-Boot custodian - Xilinx Microblaze/Zynq/ZynqMP/Versal/Versal NET SoCs
TF-A maintainer - Xilinx ZynqMP/Versal/Versal NET SoCs