SpacemiT K1 (Ky X1) get TLB entries

Hello.
I’m trying to run proprietary Operating System on OrangePi RV2. I flash all TLB entries via sfence.vma x0, x0. After that I allocate some numbers of virtual address (VA) range without TLB flush, because these VA is not used before, I catched exception that allocated VAs not allocated, but it is not true. If I set TLB flush before the access the allocated VA, all works fine. Why? How can I read TLB entries on SpacemiT K1 (Ky X1) for ensures that TLB contain correct mapping?

For reproduce the trouble use this scenario:

  1. Create (Map) two 4Kb page (modifying the page tables)
  2. Write some unique data to these pages via mapped virtual address.
  3. Unmap these pages
  4. Flush TLB for these pages
  5. Remap first page (with same VA, PPN and attributes)
  6. Read data from first page (expected get unique data from step 2 for first page)
  7. Remap second page (with same VA, PPN and attributes)
  8. Read data from second page (expected get unique data from step 2 for second page)

But on 8 step exception occur, maybe because TLB set speculatively invalid entry for second page, I don’t know.
Maybe SpacemiT K1 have some errata with TLB?

RISC-V specification confirmed, that CPU can fill TLB speculatively. So, after update PTE sfence.vma always should be executed

https://docs.riscv.org/reference/isa/priv/supervisor.html#:~:text=Speculative%20executions%20of,the%20algorithm%20began.

so after executing sfence.vma, did it work?