Visible to Intel only — GUID: nrg1685986469611
Ixiasoft
Visible to Intel only — GUID: nrg1685986469611
Ixiasoft
3.5.2. 1365437: ATS requests can return global mappings
Description
When the TCU returns an ATS Translation Completion for a request, the Global bit of the Translation Completion Data Entry must be returned zero in certain conditions, but instead is returned as 1.
Conditions
- The ATS Translation request has the SubstreamID Valid bit set. DTI_TBU_TRANS_REQ.SSV = 1.
- The Stream that is pointed to by the translation request requires Stage 1 translation. STE.Config is 3'b101 or STE.Config is 3'b111.
- The leaf entry for the Stage 1 page table has the nG (non-Global) bit set to 0, indicating a global page table entry.
- The page table walk results in a successful ATS Translation response.
When the above conditions occur, the ATS Translation response has the Global bit incorrectly set to 1.
Impact
The above listed erratum has a functional implication if all of the following conditions are met:
- ATS Translation requester uses the ATS Translation response with global bit set, for a different transaction with a different SubstreamID, but with the same Virtual Address.
- The context descriptor pointed to by that different SubstreamID has a different ASET value from the one that generated the translation response.
When the above conditions occur, then an incorrect translation response can be used by the ATS Translation requester, that could lead to a virtualization hole and data corruption.
Because ATS Translation requests are always Non-secure, there is no security violation because of this erratum.
Workaround
You can apply the following workarounds:
Hardware workaround
- The ATS Translation requester can ignore the Global bit returned in the ATS Translation response without any functional or performance implications and can always be considered to be 0.
Software workarounds
You can use one of the following software workarounds:
- All the context descriptors for a given ATS StreamID must have a consistent ASET value.
- All stage 1 page tables that ATS requests point to have no global mappings.
Category
Category B (rare)