Intel® Celeron® Processor 500 Series Specification Update For Platforms Based on Mobile Intel® 965 Express Chipset March 2008 Revision 006 Document Number: 317667-006
INFORMATION IN THIS DOCUMENT IS PROVIDED IN CONNECTION WITH INTEL® PRODUCTS. NO LICENSE, EXPRESS OR IMPLIED, BY ESTOPPEL OR OTHERWISE, TO ANY INTELLECTUAL PROPERTY RIGHTS IS GRANTED BY THIS DOCUMENT.
Contents Preface ...............................................................................................................................5 Identification Information ......................................................................................................7 Summary Tables of Changes ..................................................................................................9 Errata ......................................................................................................
Revision History Revision Description Date -001 Initial release June 2007 -002 Added Note in Component Marking section to distinguish between code named Napa and Santa Rosa platforms.
Preface Preface This document is an update to the specifications contained in the documents listed in the following Affected Documents table. It is a compilation of device and document errata and specification clarifications and changes, and is intended for hardware system manufacturers and for software developers of applications, operating system, and tools.
Preface Nomenclature S-Spec Number is a five-digit code used to identify products. Products are differentiated by their unique characteristics (for example, core speed, L2 cache size, package type, etc.) as described in the processor identification information table. Care should be taken to read all notes associated with each S-Spec number. Errata are design defects or errors. Errata may cause the processor’s behavior to deviate from published specifications.
Identification Information Identification Information Component Identification via Programming Interface The Intel® Celeron® processor 500 series can be identified by the following register contents: NOTES: 1. 2.
Identification Information Component Marking Information Figure 1. Intel® Celeron® Processor 500 Series (Micro-FCPGA) Markings SAMPLE MARK EXAMPLE: Group 1 Line 1: Unit Identifier --Group 1 Line 2: FPO S-Spec# Group 2 Line 1: INTEL (m) © ’05 Group 2 Line 2: ATPO Serial Number For Pb-Free: Group 2 Line 1: INTEL (m) © ’05 (e1) Table 1.
Summary Tables of Changes Summary Tables of Changes The following table indicates the Specification Changes, Errata, Specification Clarifications or Documentation Changes, which apply to the listed CPU steppings. Intel intends to fix some of the errata in a future stepping of the component, and to account for the other outstanding issues through documentation or Specification Changes as noted.
Summary Tables of Changes Note: Each Specification Update item is prefixed with a capital letter to distinguish the product. The key below details the letters that are used in Intel’s microprocessor Specification Updates: A = Dual-Core Intel® Xeon® processor 7000Δ sequence C = Intel® Celeron® processor D = Dual-Core Intel® Xeon® processor 2.
Summary Tables of Changes AK = Intel® Core™2 Extreme quad-core processor QX6000 sequence and Intel® Core™2 Quad processor Q6000 sequence AL = Dual-Core Intel® Xeon® processor 7100 Δ series AM = Intel® Celeron® processor 400 sequence AN = Intel® Pentium® Dual-Core processor AO = Quad-Core Intel® Xeon® processor 3200Δ series AP = Dual-Core Intel® Xeon® processor 3000Δ series AQ = Intel® Pentium® Dual-Core Desktop processor E2000Δ sequence AR = Intel® Celeron® Processor 500Δ series AS = Intel® Xeon® processor
Summary Tables of Changes Stepping Stepping Number AR1 AR2 AR3 AR4 Plans A1 E1 X X X X X X X X X X AR5 AR6 AR7 AR8 AR9 AR10 AR11 AR12 AR13 AR14 X X X X X X X X X X X X X X X X X X X AR15 AR16 AR17 X X X AR18 X X AR19 X AR20 X 12 ERRATA No Fix Writing the Local Vector Table (LVT) When an Interrupt Is Pending May Cause an Unexpected Interrupt No Fix LOCK# Asserted during a Special Cycle Shutdown Transaction May Unexpectedly Deassert No Fix Address Reported b
Summary Tables of Changes Stepping Stepping Number Plans A1 AR21 X AR22 AR23 AR24 AR25 AR26 AR27 AR28 AR29 AR30 AR31 X X X X X X X X X X X X X X X X X AR32 AR33 AR34 AR35 X X X X X X X AR36 Fixed Sequential Code Fetch to Non-canonical Address May have Nondeterministic Results No Fix REP MOVS/STOS Executing with Fast Strings Enabled and Crossing Page Boundaries with Inconsistent Memory Types May Use an Incorrect Data Size or Lead to Memory-Ordering Violations.
Summary Tables of Changes Stepping Stepping Number Plans A1 AR41 AR42 AR43 AR44 AR45 AR46 AR47 X X X X X X X X Fixed Concurrent Multi-processor Writes to Non-dirty Page May Result in Unpredictable Behavior Fixed Performance Monitor IDLE_DURING_DIV (18h) Count May Not Be Accurate No Fix Values for LBR/BTS/BTM Will Be Incorrect after an Exit from SMM Fixed SYSCALL Immediately after Changing EFLAGS.TF May Not Behave According to the New EFLAGS.
Summary Tables of Changes Stepping Stepping Number AR64 AR65 Plans A1 E1 X X X ERRATA No Fix PMI May Be Delayed to Next PEBS Event Fixed PEBS Buffer Overflow Status Will Not Be Indicated Unless IA32_DEBUGCTL[12] Is Set AR66 X X No Fix The BS Flag in DR6 May Be Set for Non-Single-Step #DB Exception AR67 X X No Fix An Asynchronous MCE during a Far Transfer May Corrupt ESP AR68 X X No Fix B0-B3 Bits in DR6 May Not Be Properly Cleared after Code Breakpoint X X No Fix BTM/BTS Branc
Summary Tables of Changes Stepping Stepping Number AR86 AR87 AR88 AR89 AR90 AR91 AR92 AR93 Plans ERRATA A1 E1 X X No Fix Performance Monitoring Event SIMD_UOP_TYPE_EXEC.
Summary Tables of Changes Number SPECIFICATION CHANGES There are no Specification Changes in this Specification Update revision. Number AR1 SPECIFICATION CLARIFICATIONS Clarification of Translation Lookaside Buffers (TLBS) Invalidation Number DOCUMENTATION CHANGES There are no Documentation Changes in this Specification Update revision.
Errata Errata AR1. Writing the Local Vector Table (LVT) When an Interrupt Is Pending May Cause an Unexpected Interrupt Problem: If a local interrupt is pending when the LVT entry is written, an interrupt may be taken on the new interrupt vector even if the mask bit is set. Implication: An interrupt may immediately be generated with the new vector when a LVT entry is written, even if the new LVT entry has the mask bit set.
Errata AR4. VERW/VERR/LSL/LAR Instructions May Unexpectedly Update the Last Exception Record (LER) MSR Problem: The LER MSR may be unexpectedly updated, if the resultant value of the Zero Flag (ZF) is zero after executing the following instructions. 1. VERR (ZF=0 indicates unsuccessful segment read verification) 2. VERW (ZF=0 indicates unsuccessful segment write verification) 3. LAR (ZF=0 indicates unsuccessful access rights load) 4.
Errata AR7. General Protection Fault (#GP) for Instructions Greater Than 15 Bytes May Be Preempted Problem: When the processor encounters an instruction that is greater than 15 bytes in length, a #GP is signaled when the instruction is decoded. Under some circumstances, the #GP fault may be preempted by another lower priority fault (for example, Page Fault (#PF)). However, if the preempting lower priority faults are resolved by the operating system and the instruction retried, a #GP fault will occur.
Errata AR10. A Write to an APIC Register Sometimes May Appear to Have Not Occurred Problem: With respect to the retirement of instructions, stores to the uncacheable memorybased APIC register space are handled in a non-synchronized way. For example if an instruction that masks the interrupt flag, for example.
Errata AR13. LER MSRs May Be Incorrectly Updated Problem: The LER (Last Exception Record) MSRs, MSR_LER_FROM_LIP (1DDH) and MSR_LER_TO_LIP (1DEH) may contain incorrect values after any of the following: • Either STPCLK#, NMI (Non-Maskable Interrupt) or external interrupts • CMP or TEST instructions with an uncacheable memory operand followed by a conditional jump • STI/POP SS/MOV SS instructions followed by CMP or TEST instructions and then by a conditional jump.
Errata AR15. Performance Monitoring Event for Number of Reference Cycles When the Processor Is Not Halted (3CH) Does Not Count According to the Specification Problem: The CPU_CLK_UNHALTED performance monitor with mask 1 counts bus clock cycles instead of counting the core clock cycles at the maximum possible ratio. The maximum possible ratio is computed by dividing the maximum possible core frequency by the bus frequency.
Errata AR17. Writing Shared Unaligned Data that Crosses a Cache Line without Proper Semaphores or Barriers May Expose a Memory Ordering Issue Problem: Software which is written so that multiple agents can modify the same shared unaligned memory location at the same time may experience a memory ordering issue if multiple loads access this shared data shortly thereafter. Exposure to this problem requires the use of a data write which spans a cache line boundary.
Errata AR19. FP Inexact-Result Exception Flag May Not Be Set Problem: When the result of a floating-point operation is not exactly representable in the destination format (1/3 in binary form, for example), an inexact-result (precision) exception occurs. When this occurs, the PE bit (bit 5 of the FPU status word) is normally set by the processor. Under certain rare conditions, this bit may not be set when this rounding occurs.
Errata AR20 Global Pages in the Data Translation Look-Aside Buffer (DTLB) May Not Be Flushed by RSM instruction before Restoring the Architectural State from SMRAM Problem: The Resume from System Management Mode (RSM) instruction does not flush global pages from the Data Translation Look-Aside Buffer (DTLB) prior to reloading the saved architectural state.
Errata AR22. REP MOVS/STOS Executing with Fast Strings Enabled and Crossing Page Boundaries with Inconsistent Memory Types May Use an Incorrect Data Size or Lead to Memory-Ordering Violations. Problem: Under certain conditions as described in the Software Developers Manual section “Outof-Order Stores For string operations in Pentium 4, Intel Xeon, and P6 Family Processors” the processor performs REP MOVS or REP STOS as fast strings.
Errata AR24. Premature Execution of a Load Operation Prior to Exception Handler Invocation Problem: If any of the below circumstances occur it is possible that the load portion of the instruction is executed before the exception handler is entered. 1. If an instruction that performs a memory load causes a code segment limit violation. 2. If a waiting X87 floating-point (FP) instruction or MMX™ technology instruction that performs a memory load has a floating-point exception pending. 3.
Errata AR26. EIP May Be Incorrect after Shutdown in IA-32e Mode Problem: When the processor is going into shutdown state the upper 32 bits of the instruction pointer may be incorrect. This may be observed if the processor is taken out of shutdown state by NMI#. Implication: A processor that has been taken out of the shutdown state may have an incorrect EIP. The only software which would be affected is diagnostic software that relies on a valid EIP. Workaround: None identified.
Errata AR29. Performance Monitoring Events for Retired Loads (CBH) and Instructions Retired (C0H) May Not Be Accurate Problem: The following events may be counted as instructions that contain a load by the MEM_LOAD_RETIRED performance monitor events and may be counted as loads by the INST_RETIRED (mask 01H) performance monitor event: • Prefetch instructions. • x87 exceptions on FST* and FBSTP instructions. • Breakpoint matches on loads, stores, and I/O instructions.
Errata AR31. Unsynchronized Cross-Modifying Code Operations Can Cause Unexpected Instruction Execution Results Problem: The act of one processor, or system bus master, writing data into a currently executing code segment of a second processor with the intent of having the second processor execute that data as code is called cross-modifying code (XMC). XMC that does not force the second processor to execute a synchronizing instruction, prior to execution of the new code, is called unsynchronized XMC.
Errata AR33. Incorrect Address Computed for Last Byte of FXSAVE/FXRSTOR Image Leads to Partial Memory Update Problem: A partial memory state save of the 512-byte FXSAVE image or a partial memory state restore of the FXRSTOR image may occur if a memory address exceeds the 64KB limit while the processor is operating in 16-bit mode or if a memory address exceeds the 4GB limit while the processor is operating in 32-bit mode.
Errata AR36. FXSAVE/FXRSTOR Instructions Which Store to the End of the Segment and Cause a Wrap to a Misaligned Base Address (Alignment <= 0x10h) May Cause FPU Instruction or Operand Pointer Corruption Problem: If a FXSAVE/FXRSTOR instruction stores to the end of the segment causing a wrap to a misaligned base address (alignment <= 0x10h), and one of the following conditions is satisfied: 1. 32-bit addressing, obtained by using address-size override, when in 64-bit mode. 2.
Errata AR38. PREFETCHh Instruction Execution under Some Conditions May Lead to Processor Livelock Problem: PREFETCHh instruction execution after a split load and dependent upon ongoing store operations may lead to processor livelock. Implication: Due to this erratum, the processor may livelock. Workaround: It is possible for the BIOS to contain a workaround for this erratum. Status: For the steppings affected, see the Summary Tables of Changes. AR39.
Errata AR41. Concurrent Multi-processor Writes to Non-dirty Page May Result in Unpredictable Behavior Problem: When a logical processor writes to a non-dirty page, and another logical-processor either writes to the same non-dirty page or explicitly sets the dirty bit in the corresponding page table entry, complex interaction with internal processor activity may cause unpredictable system behavior. Implication: This erratum may result in unpredictable system behavior and hang.
Errata AR44. SYSCALL Immediately after Changing EFLAGS.TF May Not Behave According to the New EFLAGS.TF Problem: If a SYSCALL instruction follows immediately after EFLAGS.TF was updated and IA32_FMASK.TF (bit 8) is cleared, then under certain circumstances SYSCALL may behave according to the previous EFLAGS.TF. Implication: When the problem occurs, SYSCALL may generate an unexpected debug exception, or may skip an expected debug exception. Workaround: Mask EFLAGS.TF by setting IA32_FMASK.TF (bit 8).
Errata AR47. Code Breakpoint May Be Taken after POP SS Instruction If It Is followed by an Instruction That Faults Problem: A POP SS instruction should inhibit all interrupts including Code Breakpoints until after execution of the following instruction. This allows sequential execution of POP SS and MOV eSP, eBP instructions without having an invalid stack during interrupt handling.
Errata AR49. IO_SMI Indication in SMRAM State Save Area May Be Set Incorrectly Problem: The IO_SMI bit in SMRAM's location 7FA4H is set to "1" by the CPU to indicate a System Management Interrupt (SMI) occurred as the result of executing an instruction that reads from an I/O port. Due to this erratum, the IO_SMI bit may be incorrectly set by: • A non-I/O instruction. • SMI is pending while a lower priority event interrupts. • A REP I/O read. • An I/O read that redirects to MWAIT.
Errata AR51. Using Memory Type Aliasing with Memory Types WB/WT May Lead to Unpredictable Behavior Problem: Memory type aliasing occurs when a single physical page is mapped to two or more different linear addresses, each with different memory type. Memory type aliasing with the memory types WB and WT may cause the processor to perform incorrect operations leading to unpredictable behavior. Implication: Software that uses aliasing of WB and WT memory types may observe unpredictable behavior.
Errata AR54. MOV To/From Debug Registers Causes Debug Exception Problem: When in V86 mode, if a MOV instruction is executed to/from a debug register, a general-protection exception (#GP) should be generated. However, in the case when the general detect enable flag (GD) bit is set, the observed behavior is that a debug exception (#DB) is generated instead.
Errata AR55. EFLAGS Discrepancy on a Page Fault after a Multiprocessor TLB Shootdown Problem: This erratum may occur when the processor executes one of the following readmodify-write arithmetic instructions and a page fault occurs during the store of the memory operand: ADD, AND, BTC, BTR, BTS, CMPXCHG, DEC, INC, NEG, NOT, OR, ROL/ROR, SAL/SAR/SHL/SHR, SHLD, SHRD, SUB, XOR, and XADD.
Errata AR56. LBR, BTS, BTM May Report a Wrong Address When an Exception/Interrupt Occurs in 64-bit Mode Problem: An exception/interrupt event should be transparent to the LBR (Last Branch Record), BTS (Branch Trace Store) and BTM (Branch Trace Message) mechanisms.
Errata AR59. Returning to Real Mode from SMM with EFLAGS.VM Set May Result in Unpredictable System Behavior Problem: Returning back from SMM mode into real mode while EFLAGS.VM is set in SMRAM may result in unpredictable system behavior. Implication: If SMM software changes the values of the EFLAGS.VM in SMRAM, it may result in unpredictable system behavior. Intel has not observed this behavior in commercially available software. Workaround: SMM software should not change the value of EFLAGS.
Errata AR62. CPL-Qualified BTS May Report Incorrect Branch-From Instruction Address Problem: CPL (Current Privilege Level)-qualified BTS (Branch Trace Store) may report incorrect branch-from instruction address under the following conditions: • Either BTS_OFF_OS [9] or BTS_OFF_USR [10] is selected in IA32_DEBUGCTLC MSR (1D9H). • Privilege-level transitions occur between CPL > 0 and CPL 0 or vice versa.
Errata AR65. PEBS Buffer Overflow Status Will Not Be Indicated Unless IA32_DEBUGCTL[12] is Set Problem: IA32_PERF_GLOBAL_STATUS MSR (38EH) bit [62] when set, indicates that a PEBS (Precise Event-Based Sampling) overflow has occurred and a PMI (Performance Monitor Interrupt) has been sent. Due to this erratum, this bit is not set unless IA32_DEBUGCTL MSR (1D9H) bit [12] (which stops all performance monitor counters upon a PMI) is also set.
Errata AR68. B0-B3 Bits in DR6 May Not Be Properly Cleared after Code Breakpoint Problem: B0-B3 bits (breakpoint conditions detect flags, bits [3:0]) in DR6 may not be properly cleared when the following sequence happens: 1. POP instruction to SS (Stack Segment) selector. 2. Next instruction is FP (Floating Point) that gets FP assist followed by code breakpoint. Implication: B0-B3 bits in DR6 may not be properly cleared. Workaround: None identified.
Errata AR71. Performance Monitor SSE Retired Instructions May Return Incorrect Values Problem: The SIMD_INST_RETIRED (Event: C7H) is used to track retired SSE instructions. Due to this erratum, the processor may also count other types of instructions resulting in values higher than the number of actual retired SSE instructions. Implication: The event monitor instruction SIMD_INST_RETIRED may report count higher than expected. Workaround: None identified.
Errata AR74. A MOV Instruction from CR8 Register with 16 Bit Operand Size Will Leave Bits 63:16 of the Destination Register Unmodified Problem: Moves to/from control registers are supposed to ignore REW.W and the 66H (operand size) prefix. In systems supporting Intel Virtualization Technology, when the processor is operating in VMX non-root operation and “use TPR shadow” VM-execution control is set to 1, a MOV instruction from CR8 with a 16 bit operand size (REX.
Errata AR77. Fault on ENTER Instruction May Result in Unexpected Values on Stack Frame Problem: The ENTER instruction is used to create a procedure stack frame. Due to this erratum, if execution of the ENTER instruction results in a fault, the dynamic storage area of the resultant stack frame may contain unexpected values (i.e., residual stack data as a result of processing the fault). Implication: Data in the created stack frame may be altered following a fault on the ENTER instruction.
Errata AR80. Page Access Bit May Be Set Prior to Signaling a Code Segment Limit Fault Problem: If code segment limit is set close to the end of a code page, then due to this erratum the memory page Access bit (A bit) may be set for the subsequent page prior to general protection fault on code segment limit.
Errata AR83. EFLAGS, CR0, CR4 and the EXF4 Signal May Be Incorrect after Shutdown Problem: When the processor is going into shutdown due to an RSM inconsistency failure, EFLAGS, CR0 and CR4 may be incorrect. In addition the EXF4 signal may still be asserted. This may be observed if the processor is taken out of shutdown by NMI#. Implication: A processor that has been taken out of shutdown may have an incorrect EFLAGS, CR0 and CR4. In addition the EXF4 signal may still be asserted.
Errata AR86. Performance Monitoring Event SIMD_UOP_TYPE_EXEC.MUL is Counted Incorrectly for PMULUDQ Instruction Problem: Performance Monitoring Event SIMD_UOP_TYPE_EXEC.MUL (Event select 0B3H, Umask 01H) counts the number of SIMD packed multiply micro-ops executed. The count for PMULUDQ micro-ops might be lower than expected. No other instruction is affected. Implication: The count value returned by the performance monitoring event SIMD_UOP_TYPE_EXEC.MUL may be lower than expected.
Errata AR88. Updating Code Page Directory Attributes without TLB Invalidation May Result in Improper Handling of Code #PF Problem: Code #PF (Page Fault exception) is normally handled in lower priority order relative to both code #DB (Debug Exception) and code Segment Limit Violation #GP (General Protection Fault).
Errata AR90. Store Ordering May Be Incorrect between WC and WP Memory Types Problem: According to Intel® 64 and IA-32 Architecture Software Developer’s Manual, Volume 3A: System Programming Guide, WP (Write Protected) stores should drain the WC (Write Combining) buffers in the same way as UC (Uncacheable) memory type stores do. Due to this erratum, WP stores may not drain the WC buffers. Implication: Memory ordering may be violated between WC and WP stores.
Errata AR93. A REP STOS/MOVS to a MONITOR/MWAIT Address Range May Prevent Triggering of the Monitoring Hardware Problem: The MONITOR instruction is used to arm the address monitoring hardware for the subsequent MWAIT instruction. The hardware is triggered on subsequent memory store operations to the monitored address range. Due to this erratum, REP STOS/MOVS fast string operations to the monitored address range may prevent the actual triggering store to be propagated to the monitoring hardware.
Errata AR96. PMI While LBR Freeze Enabled May Result in Old/Out-of-Date LBR Information Problem: When Precise Event-Based Sampling (PEBS) is configured with Performance Monitoring Interrupt (PMI) on PEBS buffer overflow enabled and Last Branch Record (LBR) Freeze on PMI enabled by setting FREEZE_LBRS_ON_PMI flag (bit 11) to 1 in IA32_DEBUGCTL (MSR 1D9H), the LBR stack is frozen upon the occurrence of a hardware PMI request. Due to this erratum, the LBR freeze may occur too soon (i.e.
Errata AR99. Instruction Fetch May Cause a Livelock during Snoops of the L1 Data Cache Problem: A livelock may be observed in rare conditions when instruction fetch causes multiple level one data cache snoops. Implication: Due to this erratum, a livelock may occur. Intel has not observed this erratum with any commercially available software. Workaround: It is possible for BIOS to contain a workaround for this erratum] Status: For the steppings affected, see the Summary Tables of Changes. AR100.
Errata AR101. A WB Store Following a REP STOS/MOVS or FXSAVE May Lead to Memory-Ordering Violations Problem: Under certain conditions, as described in the Intel® 64 and IA-32 Architecture Software Developer’s Manual, section "Out-of-Order Stores For String Operations in Pentium 4, Intel Xeon, and P6 Family Processors", the processor may perform REP MOVS or REP STOS as write combining stores (referred to as “fast strings”) for optimal performance.
Errata AR103 RSM Instruction Execution under Certain Conditions May Cause Processor Hang or Unexpected Instruction Execution Results Problem: RSM instruction execution, under certain conditions triggered by a complex sequence of internal processor micro-architectural events, may lead to processor hang, or unexpected instruction execution results.
Errata AR105 Benign Exception after a Double Fault May Not Cause a Triple Fault Shutdown Problem: According to the Intel® 64 and IA-32 Architecture Software Developer’s Manual, Volume 3A: System Programming Guide, if another exception occurs while attempting to call the double-fault handler, the processor enters shutdown mode. However due to this erratum, only Contributory Exceptions and Page Faults will cause a triple fault shutdown, whereas a benign exception may not.
Specification Changes Specification Changes There are no specification changes for this specification update revision.
Specification Clarifications Specification Clarifications AR1 Clarification of Translation Lookaside Buffers (TLBS) Invalidation Section 10.9 INVALIDATING THE TRANSLATION LOOKASIDE BUFFERS (TLBS) of the Intel® 64 and IA-32 Architecture Software Developer’s Manual, Volume 3A: System Programming Guide will be modified to include the presence of page table structure caches, such as the page directory cache, which Intel processors implement.
Documentation Changes Documentation Changes There are no documentation changes for this specification update revision.
