Specification Update

Errata

42 Specification Update

AH58. MOV To/From Debug Registers Causes Debug Exception

Problem: When in V86 mode, if a MOV instruction is executed to/from a debug register, a

general-protection exception (#GP) should be generated. However, in the case when

the general detect enable flag (GD) bit is set, the observed behavior is that a debug

exception (#DB) is generated instead.

Implication: With debug-register protection enabled (that is, the GD bit set), when attempting to

execute a MOV on debug registers in V86 mode, a debug exception will be generated

instead of the expected general-protection fault.

Workaround: In general, operating systems do not set the GD bit when they are in V86 mode. The

GD bit is generally set and used by debuggers. The debug exception handler should

check that the exception did not occur in V86 mode before continuing. If the exception

did occur in V86 mode, the exception may be directed to the general-protection

exception handler.

Status: For the steppings affected, see the Summary Tables of Changes.

AH59. EFLAGS Discrepancy on a Page Fault after a Multiprocessor TLB

Shootdown

Problem: This erratum may occur when the processor executes one of the following read-

modify-write arithmetic instructions and a page fault occurs during the store of the

memory operand: ADD, AND, BTC, BTR, BTS, CMPXCHG, DEC, INC, NEG, NOT, OR,

ROL/ROR, SAL/SAR/SHL/SHR, SHLD, SHRD, SUB, XOR, and XADD. In this case, the

EFLAGS value pushed onto the stack of the page fault handler may reflect the status

of the register after the instruction would have completed execution rather than

before it. The following conditions are required for the store to generate a page fault

and call the operating system page fault handler:

1. The store address entry must be evicted from the DTLB by speculative loads from

other instructions that hit the same way of the DTLB before the store has

completed. DTLB eviction requires at least three-load operations that have linear

address bits 15:12 equal to each other and address bits 31:16 different from each

other in close physical proximity to the arithmetic operation.

2. The page table entry for the store address must have its permissions tightened

during the very small window of time between the DTLB eviction and execution of

the store. Examples of page permission tightening include from Present to Not

Present or from Read/Write to Read Only, etc. 3. Another processor, without

corresponding synchronization and TLB flush, must cause the permission change.

Implication: This scenario may only occur on a multiprocessor platform running an operating

system that performs “lazy” TLB shootdowns. The memory image of the EFLAGS

values although the instruction has not yet completed. Intel has not identified any

operating systems that inspect the arithmetic portion of the EFLAGS register during a

page fault nor observed this erratum in laboratory testing of software applications.

Workaround: No workaround is needed upon normal restart of the instruction, since this erratum is

transparent to the faulting code and results in correct instruction behavior. Operating

systems may ensure that no processor is currently accessing a page that is scheduled

to have its page permissions tightened or have a page fault handler that ignores any

incorrect state.

Status: For the steppings affected, see the Summary Tables of Changes.