This errata sheet was cleared for release a while back.  I sent it to
Mark on 16 Jan 1997 (at about the same time that I sent him five rev S
StrongARMs to replace his rev K parts).  At the time, I talked to Rich
Witek and he said that the only real fix was a soldering iron.
(Replace Rev K and earlier parts with Rev S parts.)  I also talked to
the guy at Apple who had worked around the bug in the Newton.  Their
workaround wasn't really appropriate to NetBSD/arm32.

dc

=======================================================================
DIGITAL
November 14, 1996
SA-110
ERRATA SHEET

User Register Store Multiple
----------------------------
The SA-110 chips with ID register (CP15 Register 0) revision equal to 2
have a bug in User Register Store Multiple instruction (STM^). This
is the PRIVILEGED MODE STM which is used to store user mode registers
while in a privileged mode. If the STM^ is executed while a data cache
fill is completing, the store address for all but the first register
may be wrong. This has been corrected in the SA-110 revision 3.  

The following software work around can be used on revision 2 parts if
interrupts are disabled: 

Precede the STM^ with any of the following: a store that is not a
STM^, a MCR, or an MRC. Note a "MCR P15, 0, r0, c0, c0, 0", which is a
write to the ID register, is a NOP on the SA-110. This will fix the
problem, uses no registers and does no writes to memory.  

If interrupts are enabled, then break the STM^ into a STM for the non
banked registers, R0-R7 in FIQ mode, R0-12 in all other modes, and
store the banked registers one at a time in a STM^.

For example, the following shows the old and new code for saving all
the registers if you are not in FIQ mode.

Old code: stm r0, {r0-R14}^ ; store R0..R12 and User mode R13..R14

New code: stm r0!, {r0-12} ; store r0..r12 and update r0
          stm r0, {r13}^ ; store user mode R13
          add r0, r0, #4 ; inc store pointer
          stm r0, {r14}^ ; store user mode R14
          sub r0, r0, #4*14 ; fixup R0 to what it would be

Istream Aborts
--------------
The SA-110 chips with ID register (CP15 Register 0) revision less than
3 have a bug in Istream Aborts. The conditions needed to cause the bug
are :

1. A LD or LDM to the PC that is the last instruction in a protection
   region, (last instruction of a page or subpage).

2. The next location after the LD/LDM to PC is not readable because
   of permission or domain violation but is a valid section, large page
   or small page.

3. The translation  buffer entry for  the location after the LD/LDM to
   PC, is in the instruction translation buffer.

4. The data being loaded to the PC is in the data cache.

5. The data translation buffer entry for the data being loaded into
   the PC is in the data translation buffer.  

If these conditions are all met, and the LD/LDM is executed, an
Istream Abort will be taken. The reported PC for the Istream Abort
will be the value loaded into the PC by the load instruction minus 4.

This is fixed in the SA-110 revision 3, i.e.  SA-110 with ID register
(CP15 Register 0) revision greater than 2. The only work around is to
not generate the conditions that cause the bug. One way for an
operating system to do this would be to do the following:

1. Not use sub-pages to set up a page where for any mode, part was
   readable and part not readable.

2. For any page that is readable for a given mode the next page must
   be readable or invalid (the bottom two bits of the first or second
   level descriptor being 0 or 2).