Visible to Intel only — GUID: kxu1487886134811
Ixiasoft
3.1. 843819: Memory Locations May be Accessed Speculatively Due to Instruction Fetches When HCR.VM is Set
3.2. 845719: A Load May Read Incorrect Data
3.3. 855871: ETM Does Not Report IDLE State When Disabled Using OSLOCK
3.4. 855872: A Store-Exclusive Instruction May Pass When it Should Fail
3.5. 711668: Configuration Extension Register Has Wrong Value Status
3.6. 720107: Periodic Synchronization Can Be Delayed and Cause Overflow
3.7. 855873: An Eviction Might Overtake a Cache Clean Operation
3.8. 853172: ETM May Assert AFREADY Before All Data Has Been Output
3.9. 836870: Non-Allocating Reads May Prevent a Store Exclusive From Passing
3.10. 836919: Write of the JMCR in EL0 Does Not Generate an UNDEFINED Exception
3.11. 845819: Instruction Sequences Containing AES Instructions May Produce Incorrect Results
3.12. 851672: ETM May Trace an Incorrect Exception Address
3.13. 851871: ETM May Lose Counter Events While Entering WFx Mode
3.14. 852071: Direct Branch Instructions Executed Before a Trace Flush May be Output in an Atom Packet After Flush Acknowledgment
3.15. 852521: A64 Unconditional Branch May Jump to Incorrect Address
3.16. 855827: PMU Counter Values May Be Inaccurate When Monitoring Certain Events
3.17. 855829: Reads of PMEVCNTR<n> are not Masked by HDCR.HPMN
3.18. 855830: Loads of Mismatched Size May not be Single-Copy Atomic
Visible to Intel only — GUID: kxu1487886134811
Ixiasoft
3.2. 845719: A Load May Read Incorrect Data
Description
When executing in the AArch32 state at EL0, the Cortex-A53 MPCore* processor may read incorrect data if a load is performed to the same offset within a different 4 GB region as a recent previous load in the AArch64 state.
The following sequence must occur for this erratum to be triggered:
Note: This sequence requires execution in both AArch32 and AArch64, therefore at least one exception level change is required.
- At EL0 or EL1, in the AArch32 or AArch64 state, the CPU executes a load, store, preload or data- or instruction-cache maintenance by MVA instruction.
- At EL0 or EL1 in the AArch64 state, the CPU executes a load with:
VA[63:32] != 32'h00000000
- At EL0 in AArch32 state, the CPU executes a load to the same 4 KB region as the instruction in step 1, with VA[31:6] matching the VA from the instruction in step 2.
The erratum does not apply if any of the following occurs between step 1 and step 3 in the sequence:
- A write to any of the following registers:
- Any SCTLR
- Any TTBR
- Any TCR
- Any MAIR
- CONTEXTIDR
- A TLB maintenance instruction is executed, followed by a DSB.
This erratum also does not apply if an address translation instruction executes between steps 2 and 3 in the sequence.
Impact
If the above conditions are met, data corruption can occur. The load at EL0 can access data written at EL1 for which it does not have read permissions; however, a load in non-secure state cannot access secure data.
Workaround
If one of the exception conditions listed after the sequence above is applied between steps 2 and 3, this erratum does not occur. Because there must be an exception return from AArch64 to AArch32 between positions 2 and 3 in the above sequence, the recommended workaround is to insert a write of the CONTEXTIDR_EL1 register into operating system exception return sequences.