Intel® Celeron® M Processor Specification Update July 2008 Revision 040 Document Number: 300303-040
INFORMATION IN THIS DOCUMENT IS PROVIDED IN CONNECTION WITH INTEL® PRODUCTS. NO LICENSE, EXPRESS OR IMPLIED, BY ESTOPPEL OR OTHERWISE, TO ANY INTELLECTUAL PROPERTY RIGHTS IS GRANTED BY THIS DOCUMENT.
Contents Revision History ...................................................................................................................4 Preface ...............................................................................................................................8 Summary Tables of Changes ................................................................................................10 Identification Information ................................................................................
Revision History Revision History Document Number Revision Number Description 300303 -001 Initial Release 300303 -002 Revisions include: Date January 2004 April 2004 • Added errata WW22- W23 • Added Specification Clarification W1 • Updated Processor Identification table 300303 -003 Revisions include: May 2004 • Added errata WW24- W25 300303 -004 Revisions include: June 2004 • Updated Processor Identification table 300303 -005 Revisions include: July 2004 • Change to Title to reflect p
Revision History Document Number Revision Number 300303 -011 Description • Updated Summary Tables of Changes Date May 2005 • Updated Processor Identification Table: ⎯ Added Celeron M processor ULV 383 ⎯ Updated Celeron M processor 360J & 350J • Added Errata W39 • Added Specification Clarification W1 • Added Specification Clarification W2 300303 -012 • Updated Summary Tables of Changes June 2005 • Removed Erratum W28 – W30 (which were duplicates of W3 – W5) • Added Erratum W40 – W42 300303 -013
Revision History Document Number Revision Number 300303 -021 Description • Added Errata W83-W87 Date September 2006 • Updated Errata W3, W6, W23, W40, W52 • Removed Errata W21, W55, W70, W71, W72, W77 and W81 • Updated Processor Identification (Table 1) • Updated Description for Code “A” and added codes” AA – AE” in Summary Tables of Changes 300303 -022 • Added Errata W88-90 September 2006 • Updated Errata W18, W56, W57, W73 and W80 • Removed erratum W76 • Updated Related Documents Table 300303
Revision History Document Number Revision Number 300303 -036 Description • Updated Stepping Codes Used in Summary Table Date November 2007 • Added Errata W153 and W154 • Updated Erratum W46 300303 -037 • Revised Summary Table of Changes (W75) 300303 -038 • Added Erratum W155 December 2007 January 2008 • Updated Stepping Codes Used in Summary Table 300303 -039 • Updated W11 February 2008 • Updated W49 300303 -040 • Updated Stepping Codes Used in Summary Table July 2008 § Specification
Preface Preface This document is an update to the specifications contained in the documents listed in the following Affected Documents table. It is a compilation of device and document errata and specification clarifications and changes, and is intended for hardware system manufacturers and for software developers of applications, operating system, and tools.
Preface Nomenclature S-Spec Number is a five-digit code used to identify products. Products are differentiated by their unique characteristics, e.g., core speed, L2 cache size, package type, etc. as described in the processor identification information table. Care should be taken to read all notes associated with each S-Spec number. Errata are design defects or errors. Errata may cause the Intel® Celeron® M processor’s behavior to deviate from published specifications.
Summary Tables of Changes Summary Tables of Changes The following table indicates the errata, documentation changes, specification clarifications, or specification changes that apply to the Celeron M processor. Intel intends to fix some of the errata in a future stepping of the component and to account for the other outstanding issues through documentation or specification changes as noted.
Summary Tables of Changes Note: Each Specification Update item is prefixed with a capital letter to distinguish the product. The key below details the letters that are used in Intel’s microprocessor Specification Updates: A = Dual-Core Intel® Xeon® processor 7000Δ sequence C = Intel® Celeron® processor D = Dual-Core Intel® Xeon® processor 2.
Summary Tables of Changes AK = Intel® Core™2 Extreme quad-core processor QX6000Δ sequence and Intel® Core™2 Quad processor Q6000Δ sequence AL = Dual-Core Intel® Xeon® processor 7100 Δ series AM = Intel® Celeron® processor 400 sequence AN = Intel® Pentium® dual-core processor AO = Quad-Core Intel® Xeon® processor 3200Δ series AP = Dual-Core Intel® Xeon® processor 3000Δ series AQ = Intel® Pentium® dual-core desktop processor E2000 sequence AR = Intel® Celeron® Processor 500Δ series AS = Intel® Xeon® processo
Summary Tables of Changes W4 W5 W6 B-1 CPU Signature = 0695h C-0 CPU Signature = 06E8h D-0 CPU Signature = 06ECh B-2 CPU Signature = 06F6h A-1 CPU Signature = 10661h W3 C-0 CPU Signature = 06D8h NO.
Summary Tables of Changes W12 A-1 CPU Signature = 10661h B-2 CPU Signature = 06F6h D-0 CPU Signature = 06ECh C-0 CPU Signature = 06E8h B-1 CPU Signature = 0695h C-0 CPU Signature = 06D8h NO.
Summary Tables of Changes W23 X X X X X X A-1 CPU Signature = 10661h B-2 CPU Signature = 06F6h D-0 CPU Signature = 06ECh C-0 CPU Signature = 06E8h B-1 CPU Signature = 0695h C-0 CPU Signature = 06D8h NO.
Summary Tables of Changes W33 X X X W34 X X X W35 X W36 X X X X X X X X X W40 X X X X X 16 A-1 CPU Signature = 10661h X W39 W41 B-2 CPU Signature = 06F6h D-0 CPU Signature = 06ECh X X W37 W38 X C-0 CPU Signature = 06E8h B-1 CPU Signature = 0695h C-0 CPU Signature = 06D8h NO.
Summary Tables of Changes W42 X X X W43 X X X W44 X X X W45 W46 W47 W48 W49 X X X X X Specification Update X X X X X X X X X X A-1 CPU Signature = 10661h B-2 CPU Signature = 06F6h D-0 CPU Signature = 06ECh C-0 CPU Signature = 06E8h B-1 CPU Signature = 0695h C-0 CPU Signature = 06D8h NO.
Summary Tables of Changes A-1 CPU Signature = 10661h B-2 CPU Signature = 06F6h D-0 CPU Signature = 06ECh C-0 CPU Signature = 06E8h B-1 CPU Signature = 0695h C-0 CPU Signature = 06D8h NO.
Summary Tables of Changes W62 X W63 X X W64 X W65 W66 X X W67 W68 W69 X X X X X X X X X X X X X A-1 CPU Signature = 10661h X X X B-2 CPU Signature = 06F6h D-0 CPU Signature = 06ECh C-0 CPU Signature = 06E8h B-1 CPU Signature = 0695h C-0 CPU Signature = 06D8h NO.
Summary Tables of Changes W73 W74 X X X X W75 X X X X X X A-1 CPU Signature = 10661h B-2 CPU Signature = 06F6h D-0 CPU Signature = 06ECh C-0 CPU Signature = 06E8h B-1 CPU Signature = 0695h C-0 CPU Signature = 06D8h NO.
Summary Tables of Changes W84 X X X A-1 CPU Signature = 10661h B-2 CPU Signature = 06F6h D-0 CPU Signature = 06ECh C-0 CPU Signature = 06E8h B-1 CPU Signature = 0695h C-0 CPU Signature = 06D8h NO.
Summary Tables of Changes W95 x W96 W97 W98 W99 W100 W101 W102 x X X X X X x X X A-1 CPU Signature = 10661h B-2 CPU Signature = 06F6h D-0 CPU Signature = 06ECh C-0 CPU Signature = 06E8h B-1 CPU Signature = 0695h C-0 CPU Signature = 06D8h NO.
Summary Tables of Changes W105 W106 W107 X X X A-1 CPU Signature = 10661h B-2 CPU Signature = 06F6h D-0 CPU Signature = 06ECh C-0 CPU Signature = 06E8h B-1 CPU Signature = 0695h C-0 CPU Signature = 06D8h NO.
Summary Tables of Changes W114 X A-1 CPU Signature = 10661h B-2 CPU Signature = 06F6h D-0 CPU Signature = 06ECh C-0 CPU Signature = 06E8h B-1 CPU Signature = 0695h C-0 CPU Signature = 06D8h NO.
Summary Tables of Changes Steppings A-1 CPU Signature = 10661h W126 X X No Fix PMI May Be Delayed to Next PEBS Event D-0 CPU Signature = 06ECh PEBS Does Not Always Differentiate Between CPL-Qualified Events C-0 CPU Signature = 06E8h No Fix B-1 CPU Signature = 0695h X C-0 CPU Signature = 06D8h X B-1 CPU Signature = 06D6h B-2 CPU Signature = 06F6h ERRATA W125 NO.
Summary Tables of Changes A-1 CPU Signature = 10661h B-2 CPU Signature = 06F6h D-0 CPU Signature = 06ECh C-0 CPU Signature = 06E8h B-1 CPU Signature = 0695h C-0 CPU Signature = 06D8h NO.
Summary Tables of Changes W145 X W146 X W147 A-1 CPU Signature = 10661h B-2 CPU Signature = 06F6h D-0 CPU Signature = 06ECh C-0 CPU Signature = 06E8h B-1 CPU Signature = 0695h C-0 CPU Signature = 06D8h NO. B-1 CPU Signature = 06D6h Steppings Plans ERRATA Plan Fix Performance Monitoring Event CPU_CLK_UNHALTED.
Summary Tables of Changes W154 W155 Number X X X X X X A-1 CPU Signature = 10661h B-2 CPU Signature = 06F6h D-0 CPU Signature = 06ECh C-0 CPU Signature = 06E8h B-1 CPU Signature = 0695h C-0 CPU Signature = 06D8h NO.
Identification Information Identification Information The Celeron M processor can be identified by the following values: Family1 Model2 Model2 (Celeron® M on 90-nm process) 0110 1001 1101 Brand ID 3 00010010 NOTES: 1. The Family corresponds to bits [11:8] of the EDX register after Reset, bits [11:8] of the EAX register after the CPUID instruction is executed with a 1 in the EAX register. 2.
S-Spec Processor number Product Stepping L2 Cache Size (bytes) CPU Signature Core Frequency Bus Frequency Voltage Identification Information Package MicroFCBGA-Pb= MicroFCBGA Lead Free SL8LW 373 C-0 512 K 06D8h 1.00 GHz 400 MHz 0.876 V – 0.956 V1 Micro-FCBGA-Pb SL8A4 373 C-0 512 K 06D8h 1.00 GHz 400 MHz 0.940 V Micro-FCBGA SL89S 373 C-0 512 K 06D8h 1.00 GHz 400 MHz 0.940 V Micro-FCBGA-Pb SL8MN 380 C-0 1M 06D8h 1.60 GHz 400 MHz 1.004 V – 1.
S-Spec Processor number Product Stepping L2 Cache Size (bytes) CPU Signature Core Frequency Bus Frequency Voltage Identification Information Package MicroFCBGA-Pb= MicroFCBGA Lead Free SL7DB n/a B-1 512 K 0695h 800 MHz 400 MHz 1.004 V Micro-FCBGA SL7DH n/a B-1 512 K 0695h 900 MHz 400 MHz 1.004 V Micro-FCBGA SL7F7 353 B-1 512 K 06D6h 900 MHz 400 MHz 0.940 V Micro-FCBGA SL7QX 353 B-1 512 K 06D6h 900 MHz 400 MHz 0.940 V Micro-FCBGA-Pb NOTES: 1.
Identification Information Figure 2. Intel Celeron Processor ULV on 90-nm Process (Micro-FCBGA) S-Spec Markings FPO# S-Spec# FFFFFFFF SXXX RJXXXXX XXXX/XX Product code (RJ-BGA), speed/ cache INTEL M C ‘04 2D Matrix (supplier lot ID+sequence #) Figure 3. Intel Celeron M Processor on 90-nm Process (Micro-FCPGA/FCBGA) S-Spec Markings FPO# /S-Spec# Product code (RJ-BGA, RH- PGA)/ Processor # RHXXXXX ### FFFFFFFF SXXX Frequency/ Cache/FSB X.
Identification Information Figure 4.
Errata Errata W1. Performance Monitoring Event That Counts the Number of Instructions Decoded (D0h) Is Not Accurate Problem: The performance-monitoring event that counts the number of instructions decoded may have inaccurate results. Implication: There is no functional impact of this erratum. However, the results/counts from this performance monitoring event should not be considered as being accurate Workaround: None identified. Status: For the steppings affected, see the Summary Tables of Changes.
Errata W4. FST Instruction with Numeric and Null Segment Exceptions May Take Numeric Exception with Incorrect FPU Operand Pointer Problem: If execution of an FST (Store Floating Point Value) instruction would generate both numeric and null segment exceptions, the numeric exception may be taken first and with the Null x87 FPU Instruction Operand (Data) Pointer.
Errata W7. Processor Can Enter a Livelock Condition under Certain Conditions When FP Exception Is Pending Problem: Processor clock modulation may be controlled via a processor register (IA32_THERM_CONTROL) or via the STPCLK# signal. While the processor clock is constantly being actively modulated at 12.
Errata W10. Inconsistent Reporting of Data Breakpoints on FP (MMX Technology) Loads Problem: The reporting of data breakpoints on either FP or MMX technology loads is dependent upon the code faulting behavior prior to the execution of the load. If there is a fault pending prior to the execution of the load and FP exceptions are enabled there is a chance that data breakpoint on successive FP/MMX technology Loads may be reported twice. Implication: Software debuggers should be aware of this possibility.
Errata Problem: SysEnter and SysExit instructions may write incorrect RPL in the FP Code Segment selector (FCS). As a result of this, the RPL field in FCS may be corrupted. Implication: This is a rare condition that may result in a system hang. Intel has not observed this erratum with any commercially-available software, or system. Workaround: It is possible for BIOS to contain a workaround for this erratum. Status: 38 For the steppings affected, see the Summary Tables of Changes.
Errata W13. Memory Aliasing with Inconsistent A and D Bits May Cause Processor Deadlock Problem: In the event that software implements memory aliasing by having twopage directory entries (PDEs) point to a common page table entry (PTE) and the Accessed and Dirty bits for the two PDEs are allowed to become inconsistent, the processor may become deadlocked. Implication: This erratum has not been observed with commercially-available software.
Errata W16. Unable to Disable Reads/Writes to Performance Monitoring Related MSRs Problem: The Performance Monitoring Available bit in the miscellaneous processor features MSR (IA32_MISC_ENABLES.7) was defined so that when it is cleared to a 0, RDMSR/WRMSR/RDPMC instructions would return all zeros for reads of and prevent any writes to performance monitoring related MSRs.
Errata W18. REP MOVS/STOS Executing with Fast Strings Enabled and Crossing Page Boundaries with Inconsistent Memory Types May Use an Incorrect Data Size or Lead to MemoryOrdering Violations Problem: Under certain conditions as described in the Intel® 64 and IA-32 Architecture Software Developer’s Manual section, Out-of-Order Stores For String Operations in Pentium 4, Intel Xeon, and P6 Family Processors, the processor performs REP MOVS or REP STOS as fast strings.
Errata W20. Machine Check Exception May Occur Due to Improper Line Eviction in the IFU Problem: The processor is designed to signal an unrecoverable machine check exception (MCE) as a consistency checking mechanism. Under a complex set of circumstances involving multiple speculative branches and memory accesses there exists a one cycle long window in which the processor may signal a MCE in the instruction fetch unit (IFU) because instructions previously decoded have been evicted from the IFU.
Errata W21. POPF and POPFD Instructions That Set the Trap Flag Bit May Cause Unpredictable Processor Behavior Problem: In some rare cases, POPF and POPFD instructions that set the Trap Flag (TF) bit in the EFLAGS register (causing the processor to enter SingleStep mode) may cause unpredictable processor behavior. Implication: Single step operation is typically enabled during software debug activities, not during normal system operation.
Errata W24. Code Fetch Matching Disabled Debug Register May Cause Debug Exception Problem: The bits L0-3 and G0-3 enable breakpoints local to a task and global to all tasks, respectively. If one of these bits is set, a breakpoint is enabled, corresponding to the addresses in the debug registers DR0DR3. If at least one of these breakpoints is enabled, any of these registers are disabled (i.e.
Errata W26. SSE/SSE2 Streaming Store Resulting in a Self-Modifying Code (SMC) Event May Cause Unexpected Behavior Problem: An SSE or SSE2 streaming store that results in a self-modifying code (SMC) event may cause unexpected behavior. The SMC event occurs on a full address match of code contained in L1 cache. Implication: Due to this erratum, any of the following events may occur: 1.
Errata W31. Page with PAT (Page Attribute Table) Set to USWC (Uncacheable Speculative Write Combine) While Associated MTRR (Memory Type Range Register) Is UC (Uncacheable) May Consolidate to UC Problem: A page whose PAT memory type is USWC while the relevant MTRR memory type is UC, the consolidated memory type may be treated as UC (rather than WC, as specified in the Intel® 64 and IA-32 Architecture Software Developer’s Manual).
Errata W34. FPU Operand Pointer May Not Be Cleared following FINIT/FNINIT Problem: Initializing the floating point state with either FINIT or FNINT, may not clear the x87 FPU Operand (Data) Pointer Offset and the x87 FPU Operand (Data) Pointer Selector (both fields form the FPUDataPointer). Saving the floating point environment with FSTENV, FNSTENV, or floating point state with FSAVE, FNSAVE or FXSAVE before an intervening FP instruction may save uninitialized values for the FPUDataPointer.
Errata W37. CPUID Leaf 0x80000006 May Provide the Incorrect Value for an 8-Way Associative Cache Problem: CPUID leaf 0x80000006 may return 0x8 in ECX [15:12] to indicate 8way associative cache, but the correct encoding for an 8-way associative cache is 0x6. Implication: Software that depends on the associativity of the cache may not function correctly. Workaround: It is possible for the BIOS to contain a workaround for this erratum.
Errata W40. INIT Does Not Clear Global Entries in the TLB Problem: INIT may not flush a TLB entry when: 1. The processor is in protected mode with paging enabled and the page global enable flag is set (PGE bit of CR4 register) 2. G bit for the page table entry is set 3. TLB entry is present in TLB when INIT occurs Implication: Software may encounter unexpected page fault or incorrect address translation due to a TLB entry erroneously left in TLB after INIT.
Errata W42. Machine Check Exception May Occur When Interleaving Code between Different Memory Types Problem: A small window of opportunity exists where code fetches interleaved between different memory types may cause a machine check exception. A complex set of micro-architectural boundary conditions is required to expose this window. Implication: Interleaved instruction fetches between different memory types may result in a machine check exception.
Errata Workaround: Software should ensure that memory accesses do not occur above the 4-G limit (0ffffffffh). Status: For the steppings affected, see the Summary Tables of Changes. W45. DR3 Address Match on MOVD/MOVQ/MOVNTQ Memory Store Instruction May Incorrectly Increment Performance Monitoring Count for Saturating SIMD Instructions Retired (Event 0CFh) Problem: Performance monitoring for Event CFH normally increments on saturating SIMD instruction retired.
Errata Status: 52 For the steppings affected, see the Summary Tables of Changes.
Errata W48. Certain Performance Monitoring Counters Related to Bus, L2 Cache and Power Management Are Inaccurate Problem: All Performance Monitoring Counters in the ranges 21H-3DH and 60H7FH may have inaccurate results up to ±7. Implication: There may be a small error in the affected counts. Workaround: None identified. Status: For the steppings affected, see the Summary Tables of Changes. W49.
Errata Workaround: This non-synchronization can be avoided by issuing an APIC register read after the APIC register write. This will force the store to the APIC register before any subsequent instructions are executed. No commercial operating system is known to be impacted by this erratum. Status: 54 For the steppings affected, see the Summary Tables of Changes.
Errata W51. The Processor May Report a #TS Instead of a #GP Fault Problem: A jump to a busy TSS (Task-State Segment) may cause a #TS (invalid TSS exception) instead of a #GP fault (general protection exception). Implication: Operation systems that access a busy TSS may get invalid TSS fault instead of a #GP fault. Intel has not observed this erratum with any commercially-available software. Workaround: None identified. Status: For the steppings affected, see the Summary Tables of Changes. W52.
Errata W54. Writing the Local Vector Table (LVT) When an Interrupt Is Pending May Cause an Unexpected Interrupt Problem: If a local interrupt is pending when the LVT entry is written, an interrupt may be taken on the new interrupt vector even if the mask bit is set. Implication: An interrupt may immediately be generated with the new vector when an LVT entry is written, even if the new LVT entry has the mask bit set.
Errata Note that even if this combination of instructions is encountered, there is also a dependency on the internal pipelining and execution state of both instructions in the processor. Implication: Inexact-result exceptions are commonly masked or ignored by applications, as it happens frequently, and produces a rounded result acceptable to most applications. The PE bit of the FPU status word may not always be set upon receiving an inexact-result exception.
Errata W59. LOCK# Asserted during a Special Cycle Shutdown Transaction May Unexpectedly Deassert Problem: During a processor shutdown transaction, when LOCK# is asserted and if a DEFER# is received during a snoop phase and the Locked transaction is pipelined on the front side bus (FSB), LOCK# may unexpectedly deassert. Implication: When this erratum occurs, the system may hang during shutdown. Intel has not observed this erratum with any commercially-available systems or software.
Errata W62. Disabling of Single-step On Branch Operation May Be Delayed following a POPFD Instruction Problem: Disabling of Single-step On Branch Operation may be delayed, if the following conditions are met: 1. “Single Step On Branch Mode” is enabled (DebugCtlMSR.BTF and EFLAGS.TF are set) 2. POPFD used to clear EFLAGS.TF 3. A jump instruction (JMP, Jcc, etc.) is executed immediately after POPFD0.
Errata Workaround: Software exception handlers that rely on the LER MSR value should read the LER MSR before executing VERW/VERR/LSL/LAR instructions. Status: For the steppings affected, see the Summary Tables of Changes. W65. Performance Monitoring Events for Retired Floating Point Operations (C1h) May Not Be Accurate Problem: Performance monitoring events that count retired floating point operations may be too high. Implication: The Performance Monitoring Event may have an inaccurate count.
Errata Status: For the steppings affected, see the Summary Tables of Changes.
Errata W68. Hardware Prefetch Performance Monitoring Events May Be Counted Inaccurately Problem: Hardware prefetch activity is not accurately reflected in the hardware prefetch performance monitoring. Implication: This erratum may cause inaccurate counting for all hardware prefetch performance monitoring events. Workaround: None identified. Status: For the steppings affected, see the Summary Tables of Changes. W69.
Errata W73. SYSENTER/SYSEXIT Instructions Can Implicitly Load “Null Segment Selector” to SS and CS Registers Problem: According to the processor specification, attempting to load a null segment selector into the CS and SS segment registers should generate a General Protection Fault (#GP). Although loading a null segment selector to the other segment registers is allowed, the processor will generate an exception when the segment register holding a null selector is used to access memory.
Errata Workaround: Operating systems should not allow A20M# to be enabled if the masking of address bit 20 could be applied to an address that references a large page. A20M# is normally only used with the first megabyte of memory. Status: For the steppings affected, see the Summary Tables of Changes. W75.
Errata accessing side-effect memory and by ensuring that all code is written such that a code segment limit violation cannot occur as a part of reading from side-effect memory. Status: For the steppings affected, see the Summary Tables of Changes.
Errata W79. Performance Monitoring Events for Retired Instructions (C0H) May Not Be Accurate Problem: The INST_RETIRED performance monitor may miscount retired instructions as follows: • Repeat string and repeat I/O operations are not counted when a hardware interrupt is received during or after the last iteration of the repeat flow. • VMLAUNCH and VMRESUME instructions are not counted. • HLT and MWAIT instructions are not counted.
Errata W83. Writing Shared Unaligned Data That Crosses a Cache Line without Proper Semaphores or Barriers May Expose a Memory Ordering Issue Problem: Software which is written so that multiple agents can modify the same shared unaligned memory location at the same time may experience a memory ordering issue if multiple loads access this shared data shortly thereafter. Exposure to this problem requires the use of a data write which spans a cache line boundary.
Errata Implication: FXSAVE/FXRSTOR will incur a #GP fault due to the memory limit violation as expected but the memory state may be only partially saved or restored. Workaround: Software should avoid memory accesses that wrap around the respective 16-bit and 32-bit mode memory limits. Status: For affected steppings see the Summary Tables of Changes. W86.
Errata • FDIV instruction with zero operand value in memory In addition, an assist event may be counted when DAZ (Denormals-Are-Zeros) and FTZ (Flush-To-Zero) flags are turned on even though no actual assist occurs. Implication: The counter value for performance monitoring event FP_ASSIST (11H) may be larger than expected. The size of the error is dependent on the number of occurrences of the above condition while the event is active. Workaround: None identified.
Errata W89. The BS Flag in DR6 May Be Set for Non-Single-Step #DB Exception Problem: DR6 BS (Single Step, bit 14) flag may be incorrectly set when the TF (Trap Flag, bit 8) of the EFLAGS Register is set, and a #DB (Debug Exception) occurs due to one of the following: • DR7 GD (General Detect, bit 13) being bit set; • INT1 instruction; • Code breakpoint Implication: The BS flag may be incorrectly set for non-single-step #DB exception. Workaround: None identified.
Errata W93.
Errata W95. Microcode Updates Performed During VMX Non-root Operation Could Result in Unexpected Behavior Problem: When Intel® Virtualization Technology is enabled, microcode updates are allowed only during VMX root operations. Attempts to apply microcode updates while in VMX non-root operation should be silently ignored. Due to this erratum, the processor may allow microcode updates during VMX non-root operations if not explicitly prevented by the host software.
Errata W97. Fault on ENTER Instruction May Result in Unexpected Values on Stack Frame Problem: The ENTER instruction is used to create a procedure stack frame. Due to this erratum, if execution of the ENTER instruction results in a fault, the dynamic storage area of the resultant stack frame may contain unexpected values (i.e. residual stack data as a result of processing the fault). Implication: Data in the created stack frame may be altered following a fault on the ENTER instruction.
Errata Workaround: None identified. Status: For the steppings affected, see the Summary Tables of Changes. W100. CS Limit Violation on RSM May be Serviced before Higher Priority Interrupts/Exceptions Problem: When the processor encounters a CS (Code Segment) limit violation, a #GP (General Protection Exception) fault is generated after all higher priority Interrupts and exceptions are serviced.
Errata W103. Sequential Code Fetch to Non-canonical Address May Have Nondeterministic Results Problem: If code sequentially executes off the end of the positive canonical address space (falling through from address 00007fffffffffff to non- canonical address 0000800000000000), under some circumstances the code fetch will be converted to a canonical fetch at address ffff800000000000. Implication: Due to this erratum, the processor may transfer control to an unintended address.
Errata Status: For the steppings affected, see the Summary Tables of Changes. W106. (E)CX May Get Incorrectly Updated When Performing Fast String REP MOVS or Fast String REP STOS with Large Data Structures Problem: When performing Fast String REP MOVS or REP STOS commands with data structures [(E)CX*Data Size] larger than the supported address size structure (64K for 16-bit address size and 4G for 32-bit address size) some addresses may be processed more than once.
Errata W108. Unsynchronized Cross-Modifying Code Operations Can Cause Unexpected Instruction Execution Results Problem: The act of one processor, or system bus master, writing data into a currently executing code segment of a second processor with the intent of having the second processor execute that data as code is called cross-modifying code (XMC). XMC that does not force the second processor to execute a synchronizing instruction, prior to execution of the new code, is called unsynchronized XMC.
Errata W110. REP CMPS/SCAS Operations May Terminate Early in 64-bit Mode when RCX >= 0X100000000 Problem: REP CMPS (Compare String) and SCAS (Scan String) instructions in 64-bit mode may terminate before the count in RCX reaches zero if the initial value of RCX is greater than or equal to 0X100000000. Implication: Early termination of REP CMPS/SCAS operation may be observed and RFLAGS may be incorrectly updated. Workaround: It is possible for the BIOS to contain a workaround for this erratum.
Errata W112. PREFETCHh Instruction Execution under Some Conditions May Lead to Processor Livelock Problem: PREFETCHh instruction execution after a split load and dependent upon ongoing store operations may lead to processor livelock. Implication: Due to this erratum, the processor may livelock. Workaround: It is possible for the BIOS to contain a workaround for this erratum. Status: For the steppings affected, see the Summary Tables of Changes. W113.
Errata W115. Performance Monitor IDLE_DURING_DIV (18h) Count May Not Be Accurate Problem: Performance monitoring events that count the number of cycles the divider is busy and no other execution unit operation or load operation is in progress may not be accurate. Implication: The counter may reflect a value higher or lower than the actual number of events. Workaround: None identified. Status: For the steppings affected, see the Summary Tables of Changes. W116.
Errata W118. IO_SMI Indication in SMRAM State Save Area May Be Set Incorrectly Problem: The IO_SMI bit in SMRAM's location 7FA4H is set to "1" by the CPU to indicate a System Management Interrupt (SMI) occurred as the result of executing an instruction that reads from an I/O port. Due to this erratum, the IO_SMI bit may be incorrectly set by: • A non-I/O instruction. • SMI is pending while a lower priority event interrupts. • A REP I/O read. • An I/O read that redirects to MWAIT.
Errata W120. A Thermal Interrupt Is Not Generated When the Current Temperature Is Invalid Problem: When the DTS (Digital Thermal Sensor) crosses one of its programmed thresholds it generates an interrupt and logs the event (IA32_THERM_STATUS MSR (019Ch) bits [9, 7]). Due to this erratum, if the DTS reaches an invalid temperature (as indicated IA32_THERM_STATUS MSR bit[31]) it does not generate an interrupt even if one of the programmed thresholds is crossed and the corresponding log bits become set.
Errata W123. IRET under Certain Conditions May Cause an Unexpected Alignment Check Exception Problem: In IA-32e mode, it is possible to get an Alignment Check Exception (#AC) on the IRET instruction even though alignment checks were disabled at the start of the IRET. This can only occur if the IRET instruction is returning from CPL3 code to CPL3 code. IRETs from CPL0/1/2 are not affected.
Errata W125. CPL-Qualified BTS May Report Incorrect Branch-From Instruction Address Problem: CPL (Current Privilege Level)-qualified BTS (Branch Trace Store) may report incorrect branch-from instruction address under the following conditions: • Either BTS_OFF_OS [9] or BTS_OFF_USR [10] is selected in IA32_DEBUGCTLC MSR (1D9H). • Privilege-level transitions occur between CPL > 0 and CPL 0 or vice versa.
Errata W128. An Asynchronous MCE during a Far Transfer May Corrupt ESP Problem: If an asynchronous machine check occurs during an interrupt, call through gate, FAR RET or IRET and in the presence of certain internal conditions, ESP may be corrupted. Implication: If the MCE (Machine Check Exception) handler is called without a stack switch, then a triple fault will occur due to the corrupted stack pointer, resulting in a processor shutdown.
Errata W131. Performance Monitor SSE Retired Instructions May Return Incorrect Values Problem: The SIMD_INST_RETIRED (Event: C7H) is used to track retired SSE instructions. Due to this erratum, the processor may inaccurately count certain types of instructions resulting in values higher than the number of actual retired SSE instructions. Implication: The event monitor instruction SIMD_INST_RETIRED may report count higher than expected. Workaround: None identified.
Errata W134. Debug Register May Contain Incorrect Information on a MOVSS or POPSS Instruction followed by SYSRET Problem: In IA-32e mode, if a MOVSS or POPSS instruction with a debug breakpoint is followed by the SYSRET instruction; incorrect information may exist in the Debug Status Register (DR6). Implication: When debugging or when developing debuggers, this behavior should be noted.
Errata Workaround: None identified. Status: 88 For the steppings affected, see the Summary Tables of Changes.
Errata W137. Invalid Instructions May Lead to Unexpected Behavior Problem: Invalid instructions due to undefined opcodes or instructions exceeding the maximum instruction length (due to redundant prefixes placed before the instruction) may lead, under complex circumstances, to unexpected behavior. Implication: The processor may behave unexpectedly due to invalid instructions. Intel has not observed this erratum with any commercially available software. Workaround: None identified.
Errata W140. The Stack May be Incorrect as a Result of VIP/VIF Check on SYSEXIT and SYSRET Problem: The stack size may be incorrect under the following scenario: 1. The stack size was changed due to a SYSEXIT or SYSRET 2. PVI (Protected Mode Virtual Interrupts) mode was enabled (CR4.PVI == 1) 3. Both the VIF (Virtual Interrupt Flag) and VIP (Virtual Interrupt Pending) flags of the EFLAGS register are set.
Errata Status: For the steppings affected, see the Summary Tables of Changes.
Errata W143. Store Ordering May be Incorrect between WC and WP Memory Types Problem: According to Intel® 64 and IA-32 Architecture Software Developer’s Manual, Volume 3A, Methods of Caching Available, WP (Write Protected) stores should drain the WC (Write Combining) buffers in the same way as UC (Uncacheable) memory type stores do. Due to this erratum, WP stores may not drain the WC buffers. Implication: Memory ordering may be violated between WC and WP stores. Workaround: None identified.
Errata W145. Performance Monitoring Event CPU_CLK_UNHALTED.REF May Not Count Clock Cycles According to the Processors Operating Frequency Problem: Performance Counter MSR_PERF_FIXED_CTR2 (MSR 30BH) that counts CPU_CLK_UNHALTED.REF clocks, should count these clock cycles at a constant rate that is determined by the maximum resolved boot frequency, as programmed by BIOS. Due to this erratum, the rate is instead, set by the maximum core-clock to bus-clock ratio of the processor, as indicated by hardware.
Errata W147. Performance Monitoring Event MISALIGN_MEM_REF May Over Count Problem: Performance monitoring event MISALIGN_MEM_REF (05H) is used to count the number of memory accesses that cross an 8-byte boundary and are blocked until retirement. Due to this erratum, the performance monitoring event MISALIGN_MEM_REF also counts other memory accesses. Implication: The performance monitoring event MISALIGN_MEM_REF may over count.
Errata W150. A Memory Access May Get a Wrong Memory Type following a #GP due to WRMSR to an MTRR Mask Problem: The TLB (Translation Lookaside Buffer) may indicate a wrong memory type on a memory access to a large page (2-M/4-M Byte) following the recovery from a #GP (General Protection Fault) due to a WRMSR to one of the IA32_MTRR_PHYSMASKn MSRs with reserved bits set. Implication: When this erratum occurs, a memory access may get an incorrect memory type leading to unexpected system operation.
Errata Workaround: None Identified. Status: For the steppings affected, see the Summary Tables of Changes. W153.
Errata Implication: If a benign exception occurs while attempting to call the double-fault handler, the processor may hang or may handle the benign exception. Intel has not observed this erratum with any commercially available software. Workaround: Status: None identified. For the steppings affected, see the Summary Tables of Changes.
Specification Changes Specification Changes There are no Specification Changes in this Specification Update revision.
Specification Clarifications Specification Clarifications W1. Removed See the Revision History for details. W2. Removed See the Revision History for details. W3. Clarification of TRANSLATION LOOKASIDE BUFFERS (TLBS) Invalidation Section 10.
Documentation Changes Documentation Changes There are no Documentation Changes in this Specification Update revision.
