Specification Update

Errata
Specification Update 63
W73. SYSENTER/SYSEXIT Instructions Can Implicitly Load
“Null Segment Selector” to SS and CS Registers
Problem: According to the processor specification, attempting to load a null segment
selector into the CS and SS segment registers should generate a
General Protection Fault (#GP). Although loading a null segment
selector to the other segment registers is allowed, the processor will
generate an exception when the segment register holding a null
selector is used to access memory. However, the SYSENTER instruction
can implicitly load a null value to the SS segment selector. This can
occur if the value in SYSENTER_CS_MSR is between FFF8h and FFFBh
when the SYSENTER instruction is executed. This behavior is part of the
SYSENTER/SYSEXIT instruction definition; the content of the
SYSTEM_CS_MSR is always incremented by 8 before it is loaded into
the SS. This operation will set the null bit in the segment selector if a
null result is generated, but it does not generate a #GP on the
SYSENTER instruction itself. An exception will be generated as expected
when the SS register is used to access memory, however. The SYSEXIT
instruction will also exhibit this behavior for both CS and SS when
executed with the value in SYSENTER_CS_MSR between FFF0h and
FFF3h, or between FFE8h and FFEBh, inclusive.
Implication: These instructions are intended for operating system use. If this
erratum occurs (and the OS does not ensure that the processor never
has a null segment selector in the SS or CS segment registers), the
processor’s behavior may become unpredictable, possibly resulting in
system failure.
Workaround: Do not initialize the SYSTEM_CS_MSR with the values between FFF8h and FFFBh,
FFF0h and FFF3h, or FFE8h and FFEBh before executing SYSENTER or SYSEXIT.
Status: For the steppings affected, see the Summary Tables of Changes.
W74. Using 2-M/4-M Pages When A20M# Is Asserted May
Result in Incorrect Address Translations
Problem: An external A20M# pin if enabled forces address bit 20 to be masked
(forced to zero) to emulates real-address mode address wraparound at
1 megabyte. However, if all of the following conditions are met, address
bit 20 may not be masked.
• paging is enabled
• a linear address has bit 20 set
• the address references a large page
• A20M# is enabled
Implication: When A20M# is enabled and an address references a large page the
resulting translated physical address may be incorrect. This erratum
has not been observed with any commercially-available operating
system.