Errata28. Incorrect decode of Unindexed Mode, using Addressing Mode 5, cancorrupt protected registersProblem:Workaround:The instructi<strong>on</strong> decoder incorrectly decodes the valid combinati<strong>on</strong> of P=0, U=1 and W=0, whenusing unindexed mode in addressing mode 5 (load and store coprocessor). In this case, the LDC orSTC should produce c<strong>on</strong>secutive address loads or stores, with no base update until the coprocessorsignals that it has received enough data. Instead, the instructi<strong>on</strong> gets separated into an LDR/STRand a CP access.The LDR/STR gets decoded as a post-index address, updating the base register. Due to thedecoding as post-index, the ‘opti<strong>on</strong>’ bits, normally reserved for the coprocessor in unindexedmode, will become the 8 bit offset value used in the base register update calculati<strong>on</strong>.The implicati<strong>on</strong> is that protected registers can be corrupted. This errata can cause the corrupti<strong>on</strong> ofFIQ registers, R13-R14, in user and system modes when the LDC instructi<strong>on</strong> is executed usingunindexed addressing mode. It can also cause the corrupti<strong>on</strong> of FIQ registers, R8-R12, in any modewhen the LDC instructi<strong>on</strong> is executed using unindexed addressing. The R13 register in debugmode may also be corrupted during an LDC in any mode. In the case of STC, <strong>on</strong>ly Rn is corrupted.Unexpected memory accesses can also occur. In the case of an LDC, any memory locati<strong>on</strong> may beaccessed, since the FIQ registers may be improperly used as the base register. In the case of anSTC, the memory word located at Rn+4 will be corrupted. This is the memory locati<strong>on</strong>immediately following the locati<strong>on</strong>s which should be modified by STC unindexed.Do not use unindexed addressing in addressing mode 5 - Load and Store Coprocessor.Status: NoFix. Will not be fixed <strong>on</strong> D-step. See the Table “Summary Table of Changes” <strong>on</strong> page 7.29. Load immediately following a DMM flush entry is also flushedProblem:Workaround:A load that immediately follows a data memory management (DMM) flush entry command, thatalso hits the data TLB, is also flushed. Therefore, the instructi<strong>on</strong> immediately following the flush isalso flushed from the data TLB.All flush entry commands to the data TLB must be followed by 2 nops. The first ensures that theerrata is not encountered, and the sec<strong>on</strong>d ensures that the speed path is not hit.Status: NoFix. Will not be fixed <strong>on</strong> D-step. See the Table “Summary Table of Changes” <strong>on</strong> page 7.30. Trace Buffer does not operate below 1.3 VProblem:Workaround:The trace buffer within the debug unit is not guaranteed to operate, due to voltage sensitivity, whenthe Vcc voltage supply is below 1.3 V.Make sure the voltage is above 1.3 V during debug.Status: NoFix. Will not be fixed <strong>on</strong> D-step. See the Table “Summary Table of Changes” <strong>on</strong> page 7.22 <str<strong>on</strong>g>Intel</str<strong>on</strong>g> ® <str<strong>on</strong>g>80200</str<strong>on</strong>g> <str<strong>on</strong>g>Processor</str<strong>on</strong>g> <str<strong>on</strong>g>based</str<strong>on</strong>g> <strong>on</strong> <str<strong>on</strong>g>Intel</str<strong>on</strong>g> ® <strong>XScale</strong> <strong>Microarchitecture</strong> Specificati<strong>on</strong> Update
Errata31. Thumb branch with the Branch Target Buffer enabled, can go to the wr<strong>on</strong>gaddressProblem:Workaround:A mispredicted 'not taken' thumb branch, with the branch target buffer (BTB) enabled, can causeincorrect program flow.C<strong>on</strong>diti<strong>on</strong>s to cause the problem:1. BTB must be enabled2. Thumb mode3. C<strong>on</strong>diti<strong>on</strong>al branch at address XXXX X1FC4. The branch must be predicted as taken, but then is not taken.Branch flush occurs but executi<strong>on</strong> c<strong>on</strong>tinues from the wr<strong>on</strong>g address, rather than just 'fallingthrough'.D<strong>on</strong>'t run thumb code with the BTB enabled.Status: Fixed. Fixed <strong>on</strong> B-step. See the Table “Summary Table of Changes” <strong>on</strong> page 7.32. Back to back external aborts can cause a hangProblem:Workaround:The following causes a bus hang:1.