Problem

Execution of the FSAVE, FNSAVE, FSTENV, or FNSTENV instructions in real-address mode or virtual-8086 mode may save an incorrect value for the x87 FDP (FPU data pointer). This erratum does not apply if the last non-control x87 instruction had an unmasked exception.

Implication

Software operating in real-address mode or virtual-8086 mode that depends on the FDP value for non-control x87 instructions without unmasked exceptions may not operate properly. Intel has not observed this erratum in any commercially available software.

Workaround

None identified. Software should use the FDP value saved by the listed instructions only when the most recent non-control x87 instruction incurred an unmasked exception.

Status

For the steppings affected, refer to the Summary Table of Changes.

Problem

If a MOV SS or POP SS instruction generated a debug exception, and is not followed by an explicit write to the Stack Pointer (SP), the processor may fail to deliver the debug exception or, if it does, the DR6 register contents may not correctly reflect the causes of the debug exception.

Implication

Debugging software may fail to operate properly if a debug exception is lost or does not report complete information. Intel has not observed this erratum with any commercially available software.

Workaround

Software should explicitly write to the stack pointer immediately after executing MOV SS or POP SS.

Status

For the steppings affected, refer to the Summary Table of Changes.

Problem

The execution of VMREAD or VMWRITE instructions should fail if the value of the instruction’s register source operand corresponds to an unsupported field in the VMCS (Virtual Machine Control Structure). The correct operation is that the logical processor will set the ZF (Zero Flag), write 0CH into the VM-instruction error field and for VMREAD leave the instruction’s destination unmodified. Due to this erratum, the instruction may instead clear the ZF, leave the VM-instruction error field unmodified and for VMREAD modify the contents of its destination.

Implication

Accessing an unsupported field in VMCS may fail to properly report an error. In addition, a VMREAD from an unsupported VMCS field may unexpectedly change its destination. Intel has not observed this erratum with any commercially available software.

Workaround

Software should avoid accessing unsupported fields in a VMCS.

Status

For the steppings affected, refer to the Summary Table of Changes.

Problem

BMI1, BMI2, LZCNT, ADXC, and ADOX instructions will not generate an #UD fault, even though the respective CPUID feature flags do not enumerate them as supported instructions.

Implication

Software that relies on BMI1, BMI2, LZCNT, ADXC, and ADOX instructions to generate an #UD fault, may not work correctly.

Workaround

None identified. Software should check CPUID reported instructions availability and not rely on the #UD fault behavior.

Status

For the steppings affected, refer to the Summary Table of Changes.

Problem

On EPT violations, bit 4 of the Exit Qualification indicates whether the guest-physical address was writeable. When EPT is configured as supervisory shadow-stack (both bit 60 in EPT paging-structure leaf entry and bit 0 in EPT paging-structure entries are set), non-executable (bit 2 in EPT paging-structure entries is cleared), and non-writeable (bit 1 in EPT paging-structure entries is cleared) a VMExit due to a guest instruction fetch to a supervisory page will incorrectly set bit 4 of the Exit Qualification. Bits 3, 5, and 6 of the Exit Qualification are not impacted by this erratum.

Implication

Due to this erratum, bit 4 of the Exit Qualification may be incorrectly set. Intel has not observed this erratum on any commercially available software.

Workaround

EPT handlers processing an EPT violation due to an instruction fetch access on a present page should ignore the value of bit 4 of the Exit Qualification.

Status

For the steppings affected, refer to the Summary Table of Changes.

Problem

When operating in a virtualized environment, if shadow stack pages are mapped over an APIC page, the processor will generate spurious page faults on that shadow stack page whenever its linear to physical address translation is cached in the Translation Look-aside Buffer.

Implication

When this erratum occurs, the processor will generate a spurious page fault. Intel is not aware of any software that maps shadow stack pages over an APIC page.

Workaround

Software should avoid mapping shadow stack pages over the APIC page.

Status

For the steppings affected, refer to the Summary Table of Changes.

Problem

Under complex micro-architectural conditions, when the processor receives a warm reset during BIOS initialization, the processor may hang with a machine check error reported in IA32_​MCi_​STATUS, with MCACOD (bits [15:0]) value of 0400H, and MSCOD (bits [31:16]) value of 0080H.

Implication

Due to this erratum, the processor may hang. Intel has only observed this erratum in a synthetic test environment.

Workaround

None Identified.

Status

For the steppings affected, refer to the Summary Table of Changes.

Problem

On processors that support bus-lock detection (CPUID.(EAX=7, ECX=0).ECX[24]) and have it enabled (bit 2 in the IA32_​DEBUGCTL MSR (1D9h)), and employ an Extended Page Table (EPT) that is mapped to an uncacheable area (UC), and the EPT_​AD is enabled (bit 6 of the EPT Pointer is set), if the VMM performs an EPT modification on a predefined valid page while a virtual machine is running, the processor may hang.

Implication

Due to this erratum, the system may hang when bus-lock detection is enabled. Intel has not observed this erratum in any commercially available software.

Workaround

VMM should not map EPT tables to Uncacheable memory while using EPT_​AD.

Status

For the steppings affected, refer to the Summary Table of Changes.

Problem

If the processor root port receives an FetchAdd, Swap, or CAS TLP (an atomic operation) that is erroneous, it should generate a UR completion to the downstream requestor. If the TLP has an operand size greater than 4 bytes, the generated UR completion will report an operand size of 4 bytes, which will be interpreted as a malformed transaction.

Implication

When this erratum occurs, the processor may respond with a malformed transaction.

Workaround

None Identified.

Status

For the steppings affected, refer to the Summary Table of Changes.

Problem

If the MSR_​MISC_​PWR_​MGMT.LOCK (MSR 1AAh, bit13 ) is set, a General Protection Exception (#GP) will not be signaled when MSR_​MISC_​PWR_​MGMT.ENABLE_​SDC (MSR 1AAh, bit 10) is cleared while IA32_​XSS.HDC (MSR DA0h, bit 13) is set and if IA32_​PKG_​HDC_​CTL.HDC_​PKG_​Enable (MSR DB0h, bit 0) was set at least once before.

Implication

Due to this erratum, MSR_​MISC_​PWR_​MGMT.ENABLE_​SDC will be cleared even though a #GP was not signaled.

Workaround

None identified. Software should not attempt to clear MSR_​MISC_​PWR_​MGMT.ENABLE_​SDC if the above #GP conditions are met.

Status

For the steppings affected, refer to the Summary Table of Changes.

Problem

Last Branch Records (LBRs) are expected to survive warm reset according to Intel® architectures (SDM Vol3 Table 9-2). LBRs may be incorrectly cleared following warm reset if a valid machine check error was logged in one of the IA32_​MCi_​STATUS MSRs (401h, 405h, 409h, 40Dh).

Implication

Reading LBRs following warm reset may show zero value even though LBRs were enabled (IA32_​LBR_​CTL.LBREn[0]=1) before the warm reset.

Workaround

None Identified.

Status

For the steppings affected, refer to the Summary Table of Changes.

Problem

When the PCIe Link exits the L1.2 low-power link state, the link may fail to correctly train to L0.

Implication

Due to this erratum, a PCIe link may incur unexpected link recovery events or it may enter a Link_​Down state.

Workaround

It may be possible for a BIOS code change to workaround this erratum.

Status

For the steppings affected, refer to the Summary Table of Changes.

Problem

Under complex microarchitectural conditions, the PCIe controller may transmit an incorrectly formed Transaction Layer Packet (TLP), which will fail CRC checks.

Implication

When this erratum occurs, the PCIe end point may record correctable errors resulting in either a NAK or link recovery. Intel has not observed any functional impact due to this erratum.

Workaround

None Identified.

Status

For the steppings affected, refer to the Summary Table of Changes.

Problem

An invalid instruction opcode that runs into another exception before fetching all instruction bytes (e.g. A #GP due to the instruction being longer than 15 bytes or a CS limit violation) may signal a #UD despite not fetching all instruction bytes under some microarchitectural conditions.

Implication

Due to this erratum, a #UD exception may be serviced before other exceptions. This does not occur for valid instructions. Intel has only observed this erratum in a synthetic test environment.

Workaround

None Identified.

Status

For the steppings affected, refer to the Summary Table of Changes.

Problem

The Type-C controller does not properly support Qword accesses to its MSI-X interrupt table which may lead to unexpected behavior.

Implication

When this erratum occurs, Qword reads do not return Unsupported Request and may not return correct data and Qword writes may lead to unexpected behavior. Intel has not observed this erratum to affect any commercially available software.

Workaround

Software should not utilize Qword access for the Type-C MSI-X table.

Status

For the steppings affected, refer to the Summary Table of Changes.

Problem

An instruction breakpoint should have the highest priority and needs to be serviced before any other exception. In case an instruction breakpoint is marked on an illegal instruction longer than 15 bytes that starts in bytes 0-16 of a 32B-aligned chunk, and that instruction does not complete within the same 32B-aligned chunk, a General Protection Exception (#GP) on the same instruction will be serviced before the breakpoint exception.

Implication

Due to this erratum, an illegal instruction #GP exception may be serviced before an instruction breakpoint.

Workaround

None Identified.

Status

For the steppings affected, refer to the Summary Table of Changes.

Problem

Instructions longer than 15 bytes should assert a General Protection Exception (#GP). For instructions longer than 15 bytes, a Page Fault Exception (#PF) from the subsequent page might be issued before the #GP exception in the following cases:

Implication

Due to this erratum, an unexpected #PF exception might be serviced before a #GP exception.

Workaround

None Identified.

Status

For the steppings affected, refer to the Summary Table of Changes.

Problem

A General Protection Exception (#GP) will not be signaled when writing non-zero values to the upper 32 bits of IA32_​L3_​QOS_​Mask_​15 MSR (Offset C9FH) even though they are defined as reserved bits.

Implication

Due to this erratum, a #GP will not be signaled when the upper bits of IA32_​L3_​QOS_​Mask_​15 are written with a non-zero value.

Workaround

None Identified.

Status

For the steppings affected, refer to the Summary Table of Changes.

Problem

Under complex micro-architectural conditions, the VMX-preemption timer may not generate a VM Exit if the VMX-preemption timer value is set to 1.

Implication

Due to this erratum, if the value configured to a value of 1, a VM exit may not occur.

Workaround

None identified. Software should avoid programming the VMX-preemption timer with a value of 1.

Status

For the steppings affected, refer to the Summary Table of Changes.

Problem

Setting MISC_​FEATURE_​CONTROL.DISABLE_​THREE_​STRIKE_​CNT (bit 11 in MSR 1A4h) does not prevent the three-strike counter from incrementing as documented; instead, it only prevents the signaling of the three-strike event once the counter has expired.

Implication

Due to this erratum, software may be able to see the three-strike logged in the MC3_​STATUS (MSR 40Dh, MCACOD = 400h [bits 15:0]) even when MISC_​FEATURE_​CONTROL.DISABLE_​THREE_​STRIKE_​CNT is set.

Workaround

None Identified.

Status

For the steppings affected, refer to the Summary Table of Changes.

Problem

The processor's PCIe port (Bus 0, Device 1, Function 0/1/2 or Bus 0, Device 6, Function 0) does not transmit the Modified Compliance Test Pattern when in either 2.5 GT/S or 5.0 GT/s link speeds.

Implication

Due to this erratum, PCIe compliance testing may fail at 2.5 GT/S or 5.0 GT/s link speeds when enabling the Modified Compliance Test Pattern.

Workaround

None Identified.

Status

For the steppings affected, refer to the Summary Table of Changes.

Problem

When booting in a single core configuration, the system may hang when resuming from a S3/S4 or a warm reset.

Implication

Due to this erratum, the system may hang.

Workaround

It is possible for BIOS to contain a workaround for this erratum.

Status

For the steppings affected, refer to the Summary Table of Changes.

Problem

Under complex micro-architectural conditions, single step on branches (IA32_​DEBUGCTLMSR (Offset 1D9h, bit [1]) and also TF flag in EFLAGS register is set) in guest might be missed when VMM enables notification on VM Exit (IA32_​VMX_​PROCBASED_​CTLS2 MSR, Offset 48Bh, bit [31]) while the dirty access bit is not set for the code page (bit [6] in paging-structure entry).

Implication

When single step is enabled under the above condition, some single step branches will be missed. Intel has only observed this erratum in a synthetic test environment.

Workaround

When enabling single step on branches for debugging, software should first set the dirty bit of the code page.

Status

For the steppings affected, refer to the Summary Table of Changes.

Problem

Under complex micro-architectural conditions, RDMSR instruction to Productive Performance (MSR_​PPERF) MSR (Offset 64eh) may not return correct values in the upper 32 bits (EDX register) if Core C6 is enabled.

Implication

Software may experience a non-monotonic value when reading the MSR_​PPERF multiple times.

Workaround

None identified. Software should not rely on the upper bits of the MSR_​PPERF when core C6 is enabled.

Status

For the steppings affected, refer to the Summary Table of Changes.

Problem

If a #CP exception is triggered during a UIRET instruction execution, the error code on the stack will report NEAR-RET instruction (code 1) instead of FAR-RET instruction (code 2).

Implication

Due to this erratum, an incorrect #CP error code is logged when #CP is triggered during UIRET instruction.

Workaround

None Identified.

Status

For the steppings affected, refer to the Summary Table of Changes.

Problem

External interrupts should cause the processor to exit the implementation-dependent optimized state reached by the TPAUSE and UMWAIT instructions regardless of the value of RFLAGS.IF. Due to this erratum, an interrupt may not wake the processor from such a state when RFLAGS.IF is 0. Additionally, the processor may not exit from UMWAIT/TPAUSE sleep state if the virtualization execution control of Interrupt-Window Exiting is active (bit[2] of Primary Processor Based VM Execution Control is set to 1) or if Virtual-interrupt Delivery is active (bit[9] of Secondary Processor Based VM Execution Control is 1 & bit[31] of Primary Processor Based VM Execution Control is 1). Note that the only method to reach UMWAIT/TPAUSE sleep state with interrupt-window exiting pending is if the previous instruction is a STI, MOV SS, POP SS, or VM-entry which sets MOV/POP SS blocking or STI blocking.

Implication

If interrupts are masked because RFLAGS.IF = 0, arrival of an interrupt (or virtual interrupt) will not wake the processor from TPAUSE/UWMAIT. For operating systems that ensure that RFLAGS.IF = 1 whenever CPL > 0, this erratum applies only if TPAUSE or UMWAIT is used with interrupts disabled by RFLAGS.IF while CPL = 0. Intel is not aware of production software affected by this erratum.

Workaround

It may be possible for the BIOS to contain a workaround for this erratum.

Status

For the steppings affected, refer to the Summary Table of Changes.

Problem

Transient noise on the CPU crystal clock differential signals (CPU_​NSSC_​DP and CPU_​NSSC_​ DN) when resuming from G3/S3/S4/S5 may prevent the platform from booting.

Implication

Due to this erratum, the platform may fail boot when resuming from G3/S3/S4/S5.

Workaround

It may be possible for BIOS code changes to workaround this erratum.

Status

For the steppings affected, refer to the Summary Table of Changes.

Problem

Some Intel Processor Trace packets should be issued only between TIP.PGE (Target IP Packet.Packet Generation Enable) and TIP.PGD (Target IP Packet.Packet Generation Disable) packets. Due to this erratum, when a TIP.PGE packet is generated it may be preceded by a PSB+ (Packet Stream Boundary) that incorrectly includes FUP (Flow Update Packet) and MODE.Exec packets.

Implication

Due to this erratum, FUP and MODE.Exec may be generated unexpectedly.

Workaround

Decoders should ignore FUP and MODE.Exec packets that are not between TIP.PGE and TIP.PGD packets.

Status

For the steppings affected, refer to the Summary Table of Changes.

Problem

Due to a rare microarchitectural condition, the second byte of a 2-byte CYC (Cycle Count) packet may be dropped without an OVF (Overflow) packet.

Implication

A trace decoder may signal a decode error due to the lost trace byte.

Workaround

None identified. A mitigation is available for this erratum. If a decoder encounters a multi-byte CYC packet where the second byte has bit 0 (Ext) set to 1, it should assume that 4095 cycles have passed since the prior CYC packet, and it should ignore the first byte of the CYC and treat the second byte as the start of a new packet.

Status

For the steppings affected, refer to the Summary Table of Changes.

Problem

If VM entry clears Intel^® PT (Intel^® Processor Trace) IA32_​RTIT_​CTL.TraceEn (MSR 570H, bit 0) while PacketEn is 1 then a FUP (Flow Update Packet) will precede the TIP.PGD (Target IP Packet, Packet Generation Disable). VM entry can clear TraceEn if the VM-entry MSR-load area includes an entry for the IA32_​RTIT_​CTL MSR.

Implication

When this erratum occurs, an unexpected FUP may be generated that creates the appearance of an asynchronous event taking place immediately before or during the VM entry.

Workaround

The Intel^® PT trace decoder may opt to ignore any FUP whose IP matches that of a VM entry instruction.

Status

For the steppings affected, refer to the Summary Table of Changes.

Problem

The act of one processor or system bus master writing data into a currently executing code segment of a second processor with the intent of having the second processor execute that data as code is called cross-modifying code (XMC). XMC that does not force the second processor to execute a synchronizing instruction prior to execution of the new code is called unsynchronized XMC.Software using unsynchronized XMC to modify the instruction byte stream of a processor can see unexpected or unpredictable execution behavior from the processor that is executing the modified code.

Implication

In this case the phrase "unexpected or unpredictable execution behavior" encompasses the generation of most of the exceptions listed in the Intel Architecture Software Developer's Manual Volume 3: System Programming Guide including a General Protection Fault (GPF) or other unexpected behaviors. In the event that unpredictable execution causes a GPF the application executing the unsynchronized XMC operation would be terminated by the operating system.

Workaround

None Identified.

Status

For the steppings affected, refer to the Summary Table of Changes.

Problem

When PROCHOT# is activated during BIOS initialization, the processor may hang with a machine check error reported in IA32_​MCi_​STATUS, with MCACOD (bits [15:0]) value of 0402H, and MSCOD (bits [31:16]) value of 0409H.

Implication

Due to this erratum, the processor may hang.

Workaround

None Identified.

Status

For the steppings affected, refer to the Summary Table of Changes.

Problem

CPUID leaf 18H sub-leaf 04H EBX [31:16] reports 4 ways instead of 6 ways for the Load DTLB.

Implication

Due to this erratum, software that relies upon the number of ways in the load DTLB may operate sub optimally.

Workaround

None Identified.

Status

For the steppings affected, refer to the Summary Table of Changes.

Problem

On systems that enable Control-flow Enforcement Technology shadow-stack (CET-SS) in supervisor mode, an inter-privilege level far CALL or event delivery switches the shadow stack to a supervisor shadow stack. During this switch, the processor fails to signal a #GP exception if the 32-byte region comprised of 8 bytes containing the supervisor shadow stack token and the following 24-byte stack frame are not 32-byte aligned on the shadow stack.

Implication

Due to this erratum, on systems that enable CET-SS in supervisor mode, system software that fails to properly 32-byte align the supervisor shadow stack token may incorrectly mark the supervisor shadow stack token as busy, preventing re-entry into the supervisor thread by generating an unexpected #GP exception unrelated to stack token alignment.

Workaround

It may be possible for BIOS to contain a workaround for this erratum.

Status

For the steppings affected, refer to the Summary Table of Changes.

Problem

Under complex micro-architectural conditions, when using Intel^® Processor Trace (Intel^® PT) with single range output larger than 4KB, disabling PT and then enabling PT using the TraceEn bit in IA32_​RTIT_​CTL MSR (MSR 570h, bit 0) may cause incorrect output values to be recorded.

Implication

Due to this erratum, a PT trace may contain incorrect values.

Workaround

None identified. Software should avoid using PT with single range output larger than 4KB.

Status

For the steppings affected, refer to the Summary Table of Changes.

Problem

The OFFCORE_​REQUESTS_​OUTSTANDING.*DATA_​RD performance monitoring event (Event 20h; UMask 08h) counts the number of off-core outstanding data read transactions each cycle. Due to this erratum, an inaccurate count may be observed when Intel^® HyperThreading Technology is enabled and hardware prefetchers are enabled.

Implication

OFFCORE_​REQUESTS_​OUTSTANDING Performance Monitoring Events may be Inaccurate.

Workaround

None Identified.

Status

For the steppings affected, refer to the Summary Table of Changes.

Problem

A #GP (global protection exception) that results from an instruction being longer than 15 bytes is prioritized and served before a #CP (Controlflow Protection exception) that was created due to a missing ENDBRx instruction at the target of an indirect branch.

Implication

Due to this erratum, during an indirect jump with ENDBRANCH tracking, if the processor lands on an illegal instruction with length longer than 15 bytes or that decodes to a CS limit, the processor will prioritize and deliver a #GP exception over the #CP exception.

Workaround

None Identified.

Status

For the steppings affected, refer to the Summary Table of Changes.

Problem

Under complex microarchitectural conditions, on systems with Control-flow Enforcement Technology (CET) enabled, hitting a predefined data breakpoint may not be reported in B0-B3 (bits 3:0) in the DR6 register if that breakpoint was set on the legacy code page bitmap.

Implication

Due to this erratum, software may not know which breakpoint triggered when setting breakpoints on the legacy code page bitmap.

Workaround

None Identified.

Status

For the steppings affected, refer to the Summary Table of Changes.

Problem

The processor will load the value of IA32_​PERF_​GLOBAL_​CTRL (MSR 038Fh) from the SMM-transfer VMCS upon SMI (System Management Interrupt) when STM (SMM-transfer monitor) is configured.

Implication

Due to this erratum, Processor may enter STM with non-zero PERF_​GLOBAL_​CTRL MSR which may result in unexpected performance monitoring behavior.

Workaround

Software should clear IA32_​PERF_​GLOBAL_​CTRL inside the SMM transfer VMCS before performing STM configuration.

Status

For the steppings affected, refer to the Summary Table of Changes.

Problem

When Intel^® Transactional Synchronization Extensions (TSX) is enabled, and there is an RTM (Restricted Transactional Memory))abort due to an INT1 or INT3 instruction, bit 5 of the RTM abort status (nested transaction execution) will not be set even if the RTM was nested.

Implication

Due to this erratum, software that manages RTM aborts cannot determine whether an abort is nested.

Workaround

None Identified.

Status

For the steppings affected, refer to the Summary Table of Changes.