Agilex™ 5 ES Device Errata and User Guidelines

ID 825514
Date 12/09/2024
Public
Document Table of Contents

3.1.1. 1024718: Update of DBM or AP bits without break-before-make might result in incorrect

Description

If the hardware dirty bit update is enabled, and the DBM or AP bits in the translation table descriptor are updated by software without using break-before-make, then it is possible for hardware to incorrectly update the AP bits based on the old value of those bits.

Conditions

  1. The hardware dirty bit update is enabled for stage1 (TCR_ELx.HA and TCR_ELx.HD are both set) or stage2 (VTCR_EL2.HA and VTCR_EL2.HD are both set).
  2. A store instruction is executed, which causes a hardware dirty bit update for the translation table descriptor which has DBM=1 and no write permission because of either AP[2]=1 or S2AP[1]=0.
  3. At the same time as the store, the OS or hypervisor writes to the same translation table descriptor to update the AP, S2AP, or DBM bits, without using a break-before-make procedure.
  4. The new translation table descriptor is a valid translation, but does not require the dirty bit update for the store because either the DBM bit is now clear, or the AP/S2AP bits would still cause a permission fault to occur even after a dirty bit update.

Impact

The permission checking of the store is performed on the old version of the translation table descriptor, while the AP/S2AP bit is updated in the new version of the translation table descriptor. This could lead to an inconsistent situation where the store is executed but the OS or hypervisor is not expecting the store to have permission to execute.

Workaround

The OS or hypervisor can use a break-before-make procedure if it needs to update the DBM or AP/S2AP bits. Alternatively, it can use software management of the dirty bit update.

Category

Category B