Home » Intel Manuals » Processors » Intel SL3VS » Manual Viewer

Intel SL3VS Specification Update - Page 74

C83., Under Some Complex Conditions - drivers

Add to My Manuals
Save this manual to your list of manuals

Page 74 highlights

INTEL® CELERON® PROCESSOR SPECIFICATION UPDATE C83. Under Some Complex Conditions, the Instructions in the shadow of a JMP FAR may be Unintentionally Executed and Retired Problem: If all of the following events happen in sequence it is possible for the system or application to hang or to execute with incorrect data. 1. The execution of an instruction, with an OPCODE that requires the processor to stall the issue of microinstructions in the flow from the microcode sequence logic block to the instruction decode block (a StallMS condition). 2. Less than 63 (39 for Pre-CPUID 0x6BX) micro-instructions later, the execution of a mispredictable branch instruction (Jcc, LOOPcc, RET Near, CALL Near Indirect, JMP ECX=0, or JMP Near Indirect). 3. The conditional branch in event (2) is mispredicted, and furthermore the mispredicted path of execution must result in either an ITLB miss, or an Instruction Cache miss. This needs to briefly stall the issue of microinstructions again immediately after the conditional branch until that branch prediction is corrected by the jump execution block (a 2nd StallMS condition). 4. Along the correct path of execution, the next instruction must contain a 3rd StallMS condition at a precisely aligned point in the execution of the instruction (CLTS, POPSS, LSS, or MOV to SS). 5. A JMP FAR instruction must execute within the next 63 micro-instructions (39 Pre-CPUID 0x6BX). The intervening micro-instructions must not have any events or faults. When the instruction from event (2) retires, the StallMS condition within the event (5) instruction fails to operate correctly, and instructions in the shadow of the JMP FAR instruction could be unintentionally executed. Implication: Occurrence of this erratum could lead to erroneous software behavior. Intel has not identified any commercial software which may encounter this condition; this erratum was discovered in a focused test environment. One of the four instructions that are required to trigger this erratum, CLTS, is a privileged instruction that is only executed by an operating system or driver code.The remaining three instructions, POPSS, LSS, and MOV to SS, are executed infrequently in modern 32-bit application code. Workaround: None identified at this time. Status: For the stepping affected see the Summary of Changes at the beginning of this section. C84. Processor Does not Flag #GP on Non-zero Write to Certain MSRs Problem: When a non-zero write occurs to the upper 32 bits of SYSENTER_EIP_MSR or SYSENTER_ESP_MSR, the processor should indicate a general protection fault by flagging #GP. Due to this erratum, the processor does not flag #GP. . Implication: The processor unexpectedly does not flag #GP on a non-zero write to the upper 32 bits of SYSENTER_EIP_MSR or SYSENTER_ESP_MSR. No known commercially available operating system has been identified to be affected by this erratum. . Workaround: None identified. Status: For the steppings affected see the Summary of Changes at the beginning of this section. 66

Section	Page
CONTENTS	3
REVISION HISTORY	7
Date of Revision	7
Version	7
Description	7
PREFACE	8
Nomenclature	8
Specification Update for the Intel® Celeron® Processor	9
GENERAL INFORMATION	9
Intel® Celeron® Processor and Boxed Intel® Celeron® Processor Markings (S.E.P. Package)	9
Intel® Celeron® Processor and Boxed Intel® Celeron® Processor Markings (PPGA Package)	10
Intel® Celeron® Processor and Boxed Intel® Celeron® Processor Markings (FC-PGA/FC-PGA2 Package)	11
IDENTIFICATION INFORMATION	12
SUMMARY OF CHANGES	19
Summary of Errata	28
Summary of Documentation Changes	30
Summary of Specification Clarifications	31
Summary of Specification Changes	32
ERRATA	33
C1.	33
FP Data Operand Pointer May Be Incorrectly Calculated After FP Access Which Wraps 64Kbyte Boundary in 16Bit Code	33
Status: For the steppings affected see the Summary of Changes at the beginning of this section.	33
C2.	33
Differences Exist in Debug Exception Reporting	33
C3.	34
Code Fetch Matching Disabled Debug Register May Cause Debug Exception	34
Status: For the steppings affected see the Summary of Changes at the beginning of this section.	34
C4.	35
FP Inexact-Result Exception Flag May Not Be Set	35
C5.	35
BTM for SMI Will Contain Incorrect FROM EIP	35
C6.	36
I/O Restart in SMM May Fail After Simultaneous MCE	36
C7.	36
Branch Traps Do Not Function If BTMs Are Also Enabled	36
C8.	36
Machine Check Exception Handler May Not Always Execute Successfully	36
C9.	37
LBER May Be Corrupted After Some Events	37
C10.	37
BTMs May Be Corrupted During Simultaneous L1 Cache Line Replacement	37
C11.	38
Potential Early Deassertion of LOCK# During Split-Lock Cycles	38
C12.	38
A20M# May Be Inverted After Returning From SMM and Reset	38
C13.	39
Reporting of Floating-Point Exception May Be Delayed	39
C14.	39
Near CALL to ESP Creates Unexpected EIP Address	39
C15.	40
Built-in Self Test Always Gives Nonzero Result	40
C16.	40
THERMTRIP# May Not Be Asserted as Specified	40
C17.	40
Cache State Corruption in the Presence of Page A/D-bit Setting and Snoop Traffic	40
C18.	41
Snoop Cycle Generates Spurious Machine Check Exception	41
C19.	41
MOVD/MOVQ Instruction Writes to Memory Prematurely	41
C20.	42
Memory Type Undefined for Nonmemory Operations	42
C21.	42
Bus Protocol Conflict With Optimized Chipsets	42
C22.	43
FP Data Operand Pointer May Not Be Zero After Power On or Reset	43
C23.	44
MOVD Following Zeroing Instruction Can Cause Incorrect Result	44
C24.	45
Premature Execution of a Load Operation Prior to Exception Handler Invocation	45
C25.	46
Read Portion of RMW Instruction May Execute Twice	46
C26.	46
Test Pin Must Be High During Power Up	46
C27.	46
Intervening Writeback May Occur During Locked Transaction	46
C28.	47
MC2_STATUS MSR Has Model-Specific Error Code and Machine Check Architecture Error Code Reversed	47
C29.	47
MOV With Debug Register Causes Debug Exception	47
C30.	48
Upper Four PAT Entries Not Usable With Mode B or Mode C Paging	48
C31.	48
Incorrect Memory Type May Be Used When MTRRs Are Disabled	48
C32.	49
Misprediction in Program Flow May Cause Unexpected Instruction Execution	49
C33.	49
Data Breakpoint Exception in a Displacement Relative Near Call May Corrupt EIP	49
C34.	49
System Bus ECC Not Functional With 2:1 Ratio	49
C35.	50
Fault on REP CMPS/SCAS Operation May Cause Incorrect EIP	50
C36.	50
RDMSR or WRMSR To Invalid MSR Address May Not Cause GP Fault	50
C37.	51
SYSENTER/SYSEXIT Instructions Can Implicitly Load “Null Segment Selector” to SS and CS Registers	51
C38.	51
PRELOAD Followed by EXTEST Does Not Load Boundary Scan Data	51
C39.	52
Far Jump to New TSS With D-bit Cleared May Cause System Hang	52
C40.	52
Incorrect Chunk Ordering May Prevent Execution of the Machine Check Exception Handler After BINIT#	52
C41.	53
UC Write May Be Reordered Around a Cacheable Write	53
C42.	53
Resume Flag May Not Be Cleared After Debug Exception	53
C43.	54
Internal Cache Protocol Violation May Cause System Hang	54
C44.	54
GP# Fault on WRMSR to ROB_CR_BKUPTMPDR6	54
C45.	55
Machine Check Exception May Occur Due to Improper Line Eviction in the IFU	55
C46.	55
Lower Bits of SMRAM SMBASE Register Cannot Be Written With an ITP	55
C47.	56
Task Switch May Cause Wrong PTE and PDE Access Bit to be Set	56
C48.	56
Cross Modifying Code Operations on a Jump Instruction May Cause a General Protection Fault	56
C49.	57
Deadlock May Occur Due To Illegal-Instruction/Page-Miss Combination	57
C50.	57
FLUSH# Assertion Following STPCLK# May Prevent CPU Clocks From Stopping	57
C51.	58
Floating-Point Exception Condition May be Deferred	58
C52.	58
Cache Line Reads May Result in Eviction of Invalid Data	58
C53.	59
FLUSH# Servicing Delayed While Waiting for STARTUP_IPI in 2way MP Systems	59
C54.	59
Double ECC Error on Read May Result in BINIT#	59
C55.	60
MCE Due to L2 Parity Error Gives L1 MCACOD.LL	60
C56.	60
EFLAGS Discrepancy on a Page Fault After a Multiprocessor TLB Shootdown	60
C57.	61
Mixed Cacheability of Lock Variables Is Problematic in MP Systems	61
C58.	61
INT 1 with DR7.GD set does not clear DR7.GD	61
C59.	62
Potential Loss of Data Coherency During MP Data Ownership Transfer	62
C60.	62
Misaligned Locked Access to APIC Space Results In a Hang	62
C61.	63
Memory Ordering Based Synchronization May Cause a Livelock Condition in MP Systems	63
C62.	64
Processor May Assert DRDY# on a Write With No Data	64
C63.	64
Machine Check Exception May Occur Due to Improper Line Eviction in the IFU	64
C65.	64
Snoop Request May Cause DBSY# Hang	64
C66.	65
MASKMOVQ Instruction Interaction with String Operation May Cause Deadlock	65
C67.	65
MOVD, CVTSI2SS, or PINSRW Following Zeroing Instruction Can Cause Incorrect Result	65
C68.	67
Snoop Probe During FLUSH# Could Cause L2 to be Left in Shared State.	67
C69.	67
Livelock May Occur Due to IFU Line Eviction	67
C70.	68
Selector for the LTR/LLDT Register May Get Corrupted	68
C71.	68
INIT Does Not Clear Global Entries in the TLB	68
C72.	68
VM Bit Will be Cleared on a Double Fault Handler	68
C73.	69
Memory Aliasing with Inconsistent A and D bits May Cause Processor Deadlock	69
C74.	69
Processor may Report Invalid TSS Fault Instead of Double Fault During Mode C Paging	69
C75.	69
APIC Failure at CPU Core/System Bus Frequency of 766/66 MHz	69
C76.	70
Machine Check Exception may Occur When Interleaving Code Between Different Memory Types	70
C77.	70
Wrong ESP Register Values During a Fault in VM86 Mode	70
C78.	70
APIC ICR Write May Cause Interrupt Not to be Sent When ICR Delivery Bit Pending	70
C79.	71
The instruction Fetch Unit (IFU) May Fetch Instructions Based Upon Stale CR3 Data After a Write to CR3 Register	71
C80.	71
The Processor Might not Exit Sleep State Properly Upon De-assertion of CPUSLP# Signal	71
C81.	71
During Boundary Scan, BCLK not Sampled High When SLP# is Asserted Low	71
C82.	72
Incorrect Assertion of THERMTRIP# Signal	72
C83.	74
Under Some Complex Conditions, the Instructions in the shadow of a JMP FAR may be Unintentionally Executed and Retired	74
C84.	74
Processor Does not Flag #GP on Non-zero Write to Certain MSRs	74
C111	86
Performance Monitoring Event FP_MMX_TRANS_TO_MMX May Not Count Some Transitions	86
DOCUMENTATION CHANGES	87
C1.	87
SSE and SSE2 Instructions Opcodes	87
C3.	88
Direction Flag (DF) Mistakenly Denoted as a System Flag	88
C4.	88
Fopcode Compatibility Mode	88
C5.	89
FCOS, FPTAN, FSIN, and FSINCOS Trigonometric Domain	89
NOT correct.	89
C6.	89
Incorrect Description of stack	89
C7.	90
EFLAGS Register Correction	90
C8.	90
PSE-36 Paging Mechanism	90
C9.	91
0x33 Opcode	91
Opcode Instruction Description	91
C10.	91
Incorrect Information for SLDT	91
C11.	91
LGDT/LIDT Instruction Information Correction	91
C12.	92
Errors in Instruction Set Reference	92
C13.	95
RSM Instruction Set Summary	95
C14.	95
Correct MOVAPS and MOVAPD Operand Section	95
C15.	96
DAA—Decimal Adjust AL after Addition	96
Operation	96
C16.	97
DAS—Decimal Adjust AL after Subtraction	97
Operation	97
C17.	98
Omission of Dependency Between BTM and LBR	98
C18.	99
I/O Permissions Bitmap Base Addy > 0xDFFF Does not	99
Cause #GP(0) Fault	99
C19.	99
C20.	100
C21.	100
C22.	101
Cache Description	101
C23.	101
Instruction Formats and Encoding	101
C24.	101
Machine-Check Initialization	101
C1.	105
PWRGOOD Inactive Pulse Width	105
C2.	105
Floating-Point Opcode Clarification	105
C3.	106
MTRR Initialization Clarification	106
C4.	106
Non-AGTL+ Output Low Current Clarification	106
SPECIFICATION CHANGES	107
C1.	107
RESET# Pin Definition	107
C2.	107
Tco max revision for 533A, 566 & 600 MHz	107
C3.	108

Match case Limit results 1 per page

INTEL

CELERON® PROCESSOR SPECIFICATION UPDATE

C83.

Under Some Complex Conditions, the Instructions in the

shadow of a JMP FAR may be Unintentionally Executed and

Retired

Problem:

If all

of the following events happen in sequence it is possible for the system or application to hang

or to execute with incorrect data.

1. The execution of an instruction, with an OPCODE that requires the processor to stall the issue of micro-

instructions in the flow from the microcode sequence logic block to the instruction decode block (a StallMS

condition).

2. Less than 63 (39 for Pre-CPUID 0x6BX) micro-instructions later, the execution of a mispredictable branch

instruction (Jcc, LOOPcc, RET Near, CALL Near Indirect,

JMP ECX=0, or JMP Near Indirect).

3. The conditional branch in event (2) is mispredicted, and furthermore the mispredicted path of execution

must result in either an ITLB miss, or an Instruction Cache miss. This needs to briefly stall the issue of micro-

instructions again immediately after the conditional branch until that branch prediction is corrected by the jump

execution block (a 2nd StallMS condition).

4. Along the correct path of execution, the next instruction must contain a 3rd StallMS condition at a precisely

aligned point in the execution of the instruction (CLTS, POPSS, LSS, or MOV to SS).

5. A JMP FAR instruction must execute within the next 63 micro-instructions (39 Pre-CPUID 0x6BX). The

intervening micro-instructions must not have any events or faults.

When the instruction from event (2) retires, the StallMS condition within the event (5) instruction fails to

operate correctly, and instructions in the shadow of the JMP FAR instruction could be unintentionally

executed.

Implication:

Occurrence of this erratum could lead to erroneous software behavior. Intel has not identified

any commercial software which may encounter this condition; this erratum was discovered in a focused test

environment.

One of the four instructions that are required to trigger this erratum, CLTS, is a privileged

instruction that is only executed by an operating system or driver code.The remaining three instructions,

POPSS, LSS, and MOV to SS, are executed infrequently in modern 32-bit application code.

Workaround:

None identified at this time.

Status:

For the stepping affected see the

Summary of Changes

at the beginning of this section.

C84.

Processor Does not Flag #GP on Non-zero Write to Certain

MSRs

Problem:

When a non-zero write occurs to the upper 32 bits of SYSENTER_EIP_MSR or

SYSENTER_ESP_MSR, the processor should indicate a general protection fault by flagging #GP. Due to this

erratum, the processor does not flag #GP.

Implication:

The processor unexpectedly does not flag #GP on a non-zero write to the upper 32 bits of

SYSENTER_EIP_MSR or SYSENTER_ESP_MSR. No known commercially available operating system has

been identified to be affected by this erratum.

Workaround:

None identified.

Status:

For the steppings affected see the

Summary of Changes

at the beginning of this section.