Virtex-II Pro PowerPC 405 - Errata for all Virtex-II Pro Devices
Description
Keywords: PPC405, PPC405D5X1, PPC405D5X2
Urgency: Hot
General Description:
Complete errata information is available on the FTP site as follows:
The PPC405D5X1 Errata is for the older 2VP4 and 2VP7 devices:
http://www.xilinx.com/txpatches/pub/documentation/misc/ppc405f6v5_2_0.pdf
The PPC405D5X2 Errata is for all other 2VP devices:
http://www.xilinx.com/txpatches/pub/documentation/misc/ppc405f6v5_2_0.pdf
This Answer Record provides an overview of these errata, which are classified according to system impact and work-around availability.
Category 1:
Major impact, no work-around is available. A problem has a major impact if it results in a system crash, a hard failure, an unrecoverable soft failure, significant performance degradation, or the storage of incorrect data.
Category 2:
Major impact, a work-around is impractical to implement, or a substantial risk of encountering the same or additional problems (including performance issues) exists after the work-around is implemented.
Category 3:
Major impact, a work-around is available. Application of the work-around either eliminates the problem or reduces it to a minor impact issue.
Category 4:
Minor impact, no work-around is available. Minor impact problems result in slight to moderate performance degradation, or are a functional variance from the specification.
Category 5:
Minor impact, a work-around is available. Minor impact problems result in slight to moderate performance degradation, or are a functional variance from the specification.
Category 6:
Design enhancement.
Solution
1
CPU_121: The ICCCI instruction may errantly cause a Data TLB exception.Category: 3
OVERVIEW:
When data-side relocation (data address translation) is enabled (MSR[DR]=1), an ICCCI instruction errantly attempts an access check for the associated page. The ICCCI invalidates the entire I-Cache, and the effective address it generates is unnecessary.
2
CPU_147: Virtual memory that is marked as non-executable storage (storage attribute EX=0) can be loaded into the instruction cache using the ICBT instruction.Category: 3
OVERVIEW:
An ICBT instruction whose effective address maps to a region of storage has the three characteristics listed below. These characteristics cause a cache-line fill to occur within the instruction cache (I-cache):
- Memory is marked as non-executable storage (storage attribute EX = 0)
- Memory is marked as cacheable (storage attribute I = 0)
- Access is not prohibited by a zone fault (The access control field ZSEL references a ZPR field that does not prohibit access.)
The ICBT instruction should perform "no operation" (no-op) if the effective address belongs to a memory page that is marked as non-executable storage.
3
CPU_153: Floating-point enabled exceptions do not update the CR1 field of the CR.Category: 5
OVERVIEW:
The correct functioning is that floating-point enabled exceptions (excluding Enabled Invalid Operation and Enabled Zero Divide Exceptions) that occur on floating-point instructions with the RC bit set architecturally should update the CR1 field of the CR.
4
CPU_162: When in Real Mode, the 405 core may errantly make speculative instruction fetches from guarded storage.Category: 3
OVERVIEW:
In Real Mode, if instructions (Guarded Storage or not) and memory-mapped I/O (Guarded Storage) are within 1 KB of each other, the I/O may be speculative-accessed when the instructions are executed.
NOTES:
1. When instruction translation is disabled (MSR[IR]=0), the 405 core accesses instructions in Real Mode.
2. Settings in the Storage Guarded Register (SGR) define Real Mode Guarded storage on 128 MB boundaries.
5
CPU_163: Floating-point enabled exception handlers cannot reliably determine if the SRR0 points to the excepting instruction.Category: 3
OVERVIEW:
When a floating-point enabled exception exists while the MSR[FE0] and MSR[FE1] bits are Off, and either or both of the MSR[FE] bits are re-enabled via a MTMSR, RFI, or RFCI instruction, the floating-point enabled exception handler cannot determine if the exception was caused by the instruction pointed to by SRR0 or by an earlier instruction.
6
CPU_187:Access to guard storage via APU load/store double-word or APU load/store quad-word instructions is not architecturally compliant.Category: 5
OVERVIEW:
Architecturally, a data-aligned load or store (not including multiples or strings) to storage marked as "guarded" should not be accessed speculatively. The 405 core breaks double- and quad-word operations into 2- and 4-word transfers, respectively.
For example, consider aligned double-word transfers to guarded storage. Once the first word of a double-word transfer has reached load write-back (LWB), it is uninterruptible. If the second piece is still in the execute (EXE) or in the write-back (WB) pipeline stage, it may be interrupted because of an asynchronous interrupt.
When the interrupt handler returns to the interrupted load double-word, the instruction is restarted from the beginning. As a result, the guarded storage location accessed by the first piece of the load double-word is accessed a second time. Similarly, for double-word store instructions that are interrupted immediately after the first piece of data has left the write-back stage, returning from the interrupt handler restarts the instruction, causing the first piece to be accessed from the guarded location twice.
If the APU load/store double-word or APU load/store quad-word involves 32-bit or smaller RT or RS registers such that the double or quad-word transfer resembles a load/store multiple, the guarded requirement does not apply. If the APU load/store double-word or APU load/store quad-word involves 64 or 128-bit registers, respectively, then the guarded requirement does apply and accessing the guarded location twice is not architecturally compliant.
This is currently a problem for floating-point load/store double-word operations to guarded storage.
7
CPU_197: Incorrect Real Mode attributes may be used when the last instruction is accessed in a 128 MB region.Category: 3
OVERVIEW:
When instructions are executed in Real Mode (MSR[IR]=0), an access to the last instruction in a 128 MB region uses the Real Mode attributes of the next consecutive 128 MB region under any of the following conditions:
1. The last instruction in a 128 MB region contains a branch target that is non-cacheable or causes a cache miss.
2. The address restored by an RFI or RFCI is the last instruction in a 128 MB region, and this address is non-cacheable or causes a cache miss.
3. The next-to-last instruction in a non-cacheable 128 MB region contains a branch that is predicted taken but is not taken.
4. The next-to-last instruction in a non-cacheable 128 MB region contains an ISYNC instruction.
NOTES:
1. Real Mode attributes are specified by the ICCR, SU0R, and SLER registers.
2. All 128 MB regions have the same storage attributes after reset. Therefore, a branch instruction at the reset vector 0xFFFFFFFC is not affected by this erratum after a core, chip, or system reset.
3. In Real Mode, the storage regions wrap, making the last storage region (0xF8000000 - 0xFFFFFFFF) and the first storage region (0x00000000 - 0x07FFFFFF) consecutive.
8
CPU_208: ICBT instructions executed with data relocation enabled might cause incorrect instruction execution if the ICBT misses in the UTLB or does not have permission to access the page.Category: 3
OVERVIEW:
ICBT instructions executed with data relocation enabled (MSR[DR]=1) might cause incorrect instruction execution if the ICBT misses in the UTLB or does not have permission to access the page. For the ICBT to cause the instruction cache to deliver incorrect instructions to the fetcher, a number of conditions must be present:
1. Data relocation is enabled.
2. Either condition 2a or 2b is true:
a. The page referenced by the ICBT instruction is not found in the UTLB.
b. The TLB page referenced by the ICBT instruction is marked protected by its ZPR settings.
3. A cache line fill completes while the execute logic is requesting the ICU to perform an ICBT.
4. The fetcher must be requesting an address for a new cache line followed by a request for the previous cache line. This condition occurs when the fetcher re-request data is thrown away because there is inadequate room in the fetch queue.
5. In the same cycle as Conditions 3 and 4, the ICBT must be presented to the instruction cache. The instruction cache must not accept the fetch request this cycle, but does accept the ICBT.
9
This is a 2VP4 and 2VP7 Errata ONLY!CPU_210: Interrupted "stwcx." instructions may errantly write data to memory under certain DCU conditions.
Category: 2
OVERVIEW:
An aligned "stwcx." instruction with write permission can alter the following three resources:
1. The storage location at the data-side effective address if the reservation bit is set.
2. The CR field 0 (CR0) to indicate the success or failure of the store to the data-side effective address.
3. The reservation bit is cleared.
The PPC405 core breaks the stwcx. into two pieces in the EXE stage. The first piece moves to WB stage and performs the access check and the store operation if the reservation bit is set. If the first piece does not cause a storage exception, the second piece in EXE updates the CR0 as it moves to the WB stage and clears the reservation bit when it is in the WB stage.
Under certain data cache unit (DCU) conditions, the first piece of the stwcx. can become immune to interrupts by leaving the WB stage while the second piece of the stwcx. remains susceptible to interrupts because it is stalled in the EXE stage. If the second piece is then interrupted by an asynchronous interrupt, the reservation bit and CR field 0 are not updated and the data is errantly written to memory (if the reservation bit was set).
10
CPU_211: When deterministic multiplication is enabled (Core Input TIEC405DETERMINISTICMULT = 1), the mulhw[.], mullw[o][.] and mulli instructions might generate an incorrect result.Category: 3
OVERVIEW:
When deterministic multiplication is enabled (Core Input TIEC405DETERMINISTICMULT = 1), the mulhw[.], mullw[o][.] and mulli instructions might generate an incorrect result.
11
CPU_212: While waiting for a Data Side PLB (DSPLB) load to complete, the PPC405 Core might ignore a valid store completion from Data Side OCM (DSOCM) when a particular sequence of operations occurs. This condition can occur in a system using both DSPLB and DSOCM interfaces. This condition can cause the PPC405 to hang or can result in incorrect values for registers in these operations.Category: 3
OVERVIEW:
In a normal operation, the PPC405 Core ensures that a load request to DSPLB memory space is completed before a second load request (to DSOCM or non-DSOCM memory space) is completed. A problem occurs when two store requests are made to DSOCM between these two load requests AND the first load to DSPLB is waiting to be completed (at the time when a second load request is initiated). In this case, if DSOCM issues a valid completion for the first and second store requests to PPC405 Core, then a second store completion is ignored (erroneously) by the PPC405 Core. This might cause the PPC405 to hang or to leave a second store operation in an incomplete state and eventually produces incorrect results.
To work around this issue for a system using DSPLB and DSOCM, set the reserved bit [1] of register CCR0 (described in the PPC405 Embedded Processor Core User Manual.) More information on how to work around this issue and any potential performance problems is available in the PPC405 Errata PDF files.
12
The uTLB may errantly return hits.Category: 3
OVERVIEW:
Programs using the Translation Look-aside Buffer (TLB) of the Memory Management Unit (MMU) for instruction and data address translation might errantly experience hits in the TLB.
IMPACT:
Data may be loaded from or stored to an incorrect address, or an instruction may be fetched from an incorrect address. Either of these may cause data loss, corruption or incorrect operation.
WORK-AROUND:
- If the MMU is not used (hardware pin TIEc405MMUEn is tied to 0), or instruction of data address relocation is disabled (IR and DR bits in MSR are 0) no work-around is necessary.
- If the processor version register (PVR) matches the following:
PPC405D5X2: PVR 32'h2001_08A0
The issue has been resolved and no work-around is required.
- If the processor version register matches the following values:
PPC405D5X1: PVR 32'h20010820
PPC405D5X2: PVR 32'h20010860
The following work-around can be applied:
Limit TLB depth to 32 entries by using only even entries in the TLB. Odd entries should be invalidated and remain invalidated during operation. This can be achieved by inserting assembly code, corresponding to the following pseudo-code, into your application or operating system before turning on the MMU.
At system initialization:
/* invalidate all TLB entries */
tlbia
During instruction and data TLB exceptions:
/* chose TLB entry to replace from set {0, 2, 4, .., 62} */
i = select entry from {0, 2, 4, .., 62}
mttlbhi i, <tlbhhi value>
mttlblo i, <tlblo value>
- Embedded Linux
For embedded Linux a patch is available that works around the errata. The patch applies cleanly against the MontaVista Professional Linux 3.0
kernel for ML300. To apply the patch follow these steps:
1. Change into the root directory of your Linux kernel.
2. Dry-run to apply the patch by executing the command:
$ unzip -p tlb_errata.patch.zip | /usr/local/gnu/bin/patch --dry-run -p0 -F0
You will see the following output:
patching file arch/ppc/kernel/head_4xx.S
patching file arch/ppc/kernel/misc.S
3. If the dry-run was successful apply the patch:
$ unzip -p tlb_errata.patch.zip | /usr/local/gnu/bin/patch -p0 -F0
4. Recompile the Linux kernel.
The patch can be found here:
http://www.xilinx.com/txpatches/pub/applications/3rdparty/tlb_errata.patch.zip
13
CPU_213: Incorrect data may be flushed from the data cache.Category: 3
OVERVIEW:
The CPU 213 erratum does affect both Xilinx cores (PPC405D5X1 and PPC405D5X2).