Confidential and Proprietary - NXP Semiconductors€¦ · TM Freescale, the Freescale logo,...

TM

Freescale, the Freescale logo, AltiVec, C-5, CodeTEST, CodeWarrior, ColdFire, C-Ware, t

he Energy Efficient Solutions logo, mobileGT, PowerQUICC, QorIQ, StarCore and Symphony

are trademarks of Freescale Semiconductor, Inc., Reg. U.S. Pat. & Tm. Off. BeeKit, BeeStack,

ColdFire+, CoreNet, Flexis, Kinetis, MXC, Platform in a Package, Processor Expert, QorIQ

Qonverge, Qorivva, QUICC Engine, SMARTMOS, TurboLink, VortiQa and Xtrinsic are trademarks

of Freescale Semiconductor, Inc. All other product or service names are the property

of their respective owners. © 2011 Freescale Semiconductor, Inc.

Confidential and Proprietary

TM

Freescale, the Freescale logo, AltiVec, C-5, CodeTEST, CodeWarrior, ColdFire, C-Ware, the Energy Efficient Solutions logo, mobileGT, PowerQUICC, QorIQ, StarCore

and Symphony are trademarks of Freescale Semiconductor, Inc., Reg. U.S. Pat. & Tm. Off. BeeKit, BeeStack, ColdFire+, CoreNet, Flexis, Kinetis, MXC, Platform in a

Package, Processor Expert, QorIQ Qonverge, Qorivva, QUICC Engine, SMARTMOS, TurboLink, VortiQa and Xtrinsic are trademarks of Freescale Semiconductor, Inc.

All other product or service names are the property of their respective owners. © 2011 Freescale Semiconductor, Inc.

2


Title:

Simultaneous Instruction L1 MMU (I-L1VSP) miss (due to eviction) and

interrupt servicing can cause a core hang.

Description:

A system hang is possible when an exception occurs at the same time

as several other internal core conditions occur. For the hang to happen,

the L2 MMU TLB1 entry which maps the translation for the first

instruction in the exception handler must not be in the I-L1VSP.

Impact:

No further forward progress will be made until a higher priority

exception is received for which interrupts are enabled.

TM





3


TM





4


Fetch sequence Internal occurrences

1 Instruction at 1000 = Branch to 2000 is

mispredicted

mispredicts so prefetches 1020

If misses in I-Cache goes to ilfb but is removed when loaded

into I-Cache

1020 fetch to mispredict (prefetched or

not)

miss in I-Cache so creates ilfb

Since 1020 never is used, it is never written to the I-Cache

and stays in the ilfb

3 2000 = Branch to 3000 hits in I-Cache, and new 2000 I-L1VSP entry is made



6 5000 = Branch to 5040 - mispredicted A new 5000 I-L1VSP entry is made, evicting the entry for

1020; mispredicts to 1020

7 1020 Fetched Hits in ilfb, – misses in the I-L1VSP

I-L1VSP miss causes L2mmu lookup

8 Interrupt Ibflush, Fetch redirects to interrupt handler

Interrupt handler not in I-L1VSP

I-L1VSP miss causes L2mmu lookup (L2MMU still busy)

9 L2mmu finishes 1020 lookup L2mmu never starts 2nd lookup – because fetch never told it

to again

10 HANG - fetch is waiting on L2mmu lookup of exception handler, L2mmu is idle.

TM





5


L2MMU

I-L1VSP (L1MMU)

Instruction Line

Fill Buffer

1000

2000

3000

4000

5000

Exception Space

1. Translation for 1000 loaded into I-L1VSP;

Branch to 2000 is mispredicted to 1020

2. 1020 misses in the I-Cache and the 1020

cache line is loaded into the ilfb


2000 hits in the I-Cache; Branch to 3000 is

correctly predicted



correctly predicted



correctly predicted

6. Translation for 5000 loaded into I-L1VSP,

evicting 1000; 5000 hits in the I-Cache;

Branch to 5040 is mispredicted to 1020

7. 1020 misses in the I-L1VSP, causing an

L2MMU lookup

8. An interrupt is received, but misses in the I-

L1VSP causing an L2MMU lookup but is

ignored by L2MMU as it is working on

lookup for 1020.

Erratum: No new look up request should be sent

to L2MMU if it is working on one. But due to hit in

ilfb the request is not stalled.

I-Cache

1000 cache line

2000 cache line

3000 cache line

4000 cache line

5000 cache line

1000

1020 cache line

2000

3000

4000

5000

TM





6


~L2_Done

Fetch State

Machine (FSM)

L2MMU State

Machine (L2SM)

Fetch

Idle

~TLB_MISS

TLB_Stall

~L2_Done

TLB_MISS

Idle

L1MMU_MISS

L2

Lookup

TLB_MISS

L2_Done

~L1MMU_MISS

L2_Done 1- TLB_MISS is defined by the equation (L1MMU_MISS & ~ILFB_HIT).

2- Upon the second misprediction to address 1020, the translation for 1020 misses in the I-L1VSP (L1MMU_MISS = 1), moving the L2SM from state Idle to

L2 Lookup.

3- At the same time, because the 1020 cacheline hits in the ILFB, TLB_MISS = 0, and the FSM stays in the Fetch Idle state.

4-As the lookup for 1020 completes, L2_Done is pulsed. Simultaneously, an interrupt is received which misses in the I-L1VSP (L1MMU_MISS = TLB_MISS =

1).

5- The valid TLB_MISS moves the FSM from Fetch Idle to TLB_Stall. The L1MMU_MISS and TLB_MISS are ignored by the L2SM as it moves back to Idle.

6-The FSM waits for the L2_Done signal for the Exception translation lookup (which pulsed when the 1020 lookup completed), and the L2SM thinks it has

nothing to do.

TM





7


Option 1 (All of the following steps must be performed):

a) Do not use more than 4 (8*) TLB1 entries, and ensure all interrupt handlers are mapped to one of the 4 (8*) TLB1 entries with a TID=0 and IPROT=1.

b) Prevent explicit invalidation of the TLB1 entry that contains the interrupt handler page by not overwriting or invalidating it (never clear the valid bit).

c) Prevent non-explicit invalidations of the TLB1 entry that contains the interrupt handler page by never

i. Setting MMUCSR0[L2TLB1_FI]

ii. Executing a tlbivax with RA[60:61] set to 0b11 (invalidate all). This should not be executed from any core in the integrated device as tlbivax is broadcast to all cores.

iii. * Executing tlbilx with T=0 or T=1

iv. * Executing mtspr LPIDR

Software may do non-explicit invalidations if

1. the instructions for invalidation are mapped by the same TLB1 entry which maps the interrupt handlers. (This will normally be the case if the operating system maps all its static executable code with a single TLB1 entry); AND

2. all interrupts should be blocked while performing the actions (set MSR[EE], MSR[CE], MSR[ME] & MSR[DE] = 0))

*These are with respect to the e500mc or e5500 based devices

TM





8


Option 2 (All of the following steps must be performed):

a) In order to restart a core that has hung due to this erratum, set the

watchdog timer to take an interrupt at some period greater than the

decrementer interrupt interval, but smaller than an unacceptable hang

time.

b) Have software reset the watchdog timer trigger during the decrementer

interrupt, ensuring the core only takes the watchdog interrupt if it is hung.

Notes:

• This will still allow for hangs, but will put a limit on the degradation in performance.

• If the software already performs critical interrupts, the core may still hang. If the customer wants to

set the “watchdog timer reset” field (TCR[WRC], (actual value will be SOC dependent), then a core

reboot will exit the hang condition.

TM





9


• All versions of the following products are effected:

− e500 Version 1 based devices

8540, 8541, 8555, 8560

− e500 Version 2 based devices

8533, 8535, 8536, 8543, 8544, 8545, 8547, 8548, 8567, 8568, 8569, 8572

P1010, P1011, P1012, P1013, P1014, P1015, P1016, P1017

P1020, P1021, P1022, P1023, P1024, P1025

P2010

P2020

9131 (rev 1.0)

− e500MC based devices

P2040, P2041, P3041, P4040, P4080

− e5500 based devices

P5010, P5020

− Will be fixed on:

9131 rev.1.1

TM





10


• All non-e500v1/e500v2/e500mc/e5500 cores are not affected.

− All legacy PowerPC devices (6xx/7xx/7xxx), PowerQUICC (8xx),

PowerQUICCII (82xx)

− e6500

− e300 (83xx)

• Freescale has shipped millions of e500 core family based

devices since 2003. To date one customer project has observed

the erratum.

• Freescale-provided Linux BSPs/SDKs use only three TLB1

entries and are unaffected. If features like huge tlbfs or USDPAA

are used, more TLB1 entries may be required.

TM

Date post:	08-Jul-2020
Category:	Documents
Upload:	others
View:	7 times
Download:	0 times

Confidential and Proprietary - NXP Semiconductors€¦ · TM Freescale, the Freescale logo,...

Documents