3.2. 845719: A Load May Read Incorrect Data
When executing in the AArch32 state at EL0, the Cortex-A53 MPCore* processor may read incorrect data if a load is performed to the same offset within a different 4 GB region as a recent previous load in the AArch64 state.
- At EL0 or EL1, in the AArch32 or AArch64 state, the CPU executes a load, store, preload or data- or instruction-cache maintenance by MVA instruction.
- At EL0 or EL1 in the AArch64 state, the CPU executes a load with:
VA[63:32] != 32'h00000000
- At EL0 in AArch32 state, the CPU executes a load to the same 4 KB region as the instruction in step 1, with VA[31:6] matching the VA from the instruction in step 2.
The erratum does not apply if any of the following occurs between step 1 and step 3 in the sequence:
- A write to any of the following registers:
- Any SCTLR
- Any TTBR
- Any TCR
- Any MAIR
- A TLB maintenance instruction is executed, followed by a DSB.
This erratum also does not apply if an address translation instruction executes between steps 2 and 3 in the sequence.
If the above conditions are met, data corruption can occur. The load at EL0 can access data written at EL1 for which it does not have read permissions; however, a load in non-secure state cannot access secure data.
If one of the exception conditions listed after the sequence above is applied between steps 2 and 3, this erratum does not occur. Because there must be an exception return from AArch64 to AArch32 between positions 2 and 3 in the above sequence, the recommended workaround is to insert a write of the CONTEXTIDR_EL1 register into operating system exception return sequences.