Problem

Branch Trace Store (BTS) and Branch Trace Message (BTM) send branch records to the Debug Store management area and system bus respectively. The Branch Predicted bit (bit 4 of eighth byte in BTS/BTM records) should report whether the most recent branch was predicted correctly. Due to this erratum, the Branch Predicted bit may be incorrect.

Implication

BTS and BTM cannot be used to determine the accuracy of branch prediction.

Workaround

None identified.

Status

For the steppings affected, refer to the Summary Table of Changes.

Problem

When a Precise-Event-Based-Sampling (PEBS) record is logged immediately after a not-taken conditional branch (Jcc instruction), the Eventing IP field should contain the address of the first byte of the Jcc instruction. Due to this erratum, it may instead contain the address of the instruction preceding the Jcc instruction.

Implication

Performance monitoring software using PEBS may incorrectly attribute PEBS events that occur on a Jcc to the preceding instruction.

Workaround

None identified.

Status

For the steppings affected, refer to the Summary Table of Changes.

Problem

When Intel^® Processor Trace (Intel^® PT) is enabled and a direct unconditional branch clears IA32_​RTIT_​STATUS.FilterEn (MSR 571H, bit 0), due to this erratum, the resulting Target IP Packet, Packet Generation Disable (TIP.PGD) may not have an IP payload with the target IP.

Implication

It may not be possible to tell which instruction in the flow caused the TIP.PGD using only the information in trace packets when this erratum occurs.

Workaround

The Intel^® Processor Trace decoder can compare direct unconditional branch targets in the source with the FilterEn address range(s) to determine which branch cleared FilterEn.

Status

For the steppings affected, refer to the Summary Table of Changes.

Problem

If BIOS uses the RSM instruction to load the SMBASE register with a value that would cause any part of the SMRAM state-save area to have an address above 4-GBytes, subsequent transitions into and out of SMM (System-Management Mode) might save and restore processor state from incorrect addresses.

Implication

This erratum may cause unpredictable system behavior. Intel has not observed this erratum with any commercially available system.

Workaround

Ensure that the SMRAM state-save area is located entirely below the 4GB address boundary.

Status

For the steppings affected, refer to the Summary Table of Changes.

Problem

x87 instructions that trigger #MF normally service interrupts before the #MF. Due to this erratum, if an instruction that triggers #MF is executing when an Enhanced Intel SpeedStep^® Technology transitions, an Intel^® Turbo Boost Technology transitions, or a Thermal Monitor event occurs, the #MF may be taken before pending interrupts are serviced.

Implication

Software may observe #MF being signaled before pending interrupts are serviced.

Workaround

None identified.

Status

For the steppings affected, refer to the Summary Table of Changes.

Problem

Some Intel^® Processor Trace packets should be issued only between Target IP Packet.Packet Generation Enable (TIP.PGE) and Target IP Packet. Generation Disable (TIP.PGD) packets. Due to this erratum, when a TIP.PGE packet is generated, it may be preceded by a Packet Stream Boundary (PSB) that incorrectly includes Flow Update Packet (FUP) and MODE.Exec packets.

Implication

Due to this erratum, FUP and MODE.Exec may be generated unexpectedly.

Workaround

Decoders should ignore FUP and MODE.Exec packets that are not between TIP.PGE and TIP.PGD packets.

Status

For the steppings affected, refer to the Summary Table of Changes.

Problem

Performance Monitoring counters configured to count only OS or only USR events by setting exactly one of bits 16 or 17 in IA32_​PERFEVTSELx MSRs (186H-18DH) may not count for a brief period during the transition to a new CPL.

Implication

A measurement of ring transitions (using the edge-detect bit 18 in IA32_​PERFEVTSELx) may undercount, such as CPL_​CYCLES.RING0_​TRANS (Event 5CH, Umask 01H). Additionally, the sum of an OS-only event and a USR-only event may not exactly equal an event counting both OS and USR. Intel has not observed any other software-visible impact

Workaround

None identified.

Status

For the steppings affected, refer to the Summary Table of Changes.

Problem

Vector masked store instructions to WB (write-back) memory-type that cross cache lines may lead to CPU writing back cached data even for cache lines where all of the bytes are masked.

This can affect MMIO (Memory Mapped IO) or non-coherent agents in the following ways:

• For MMIO range that is mapped as WB memory type, this erratum may lead to Machine Check Exception (MCE) due to writing back data into the MMIO space. This applies only to cross page vector masked stores where one of the pages is in MMIO range.
• If the CPU cached data is stale, for example in the case of memory written directly by a non-coherent agent (agent that uses non-coherent writes), this erratum may lead to writing back stale cached data even if these bytes are masked.

Implication

CPU may generate writes into MMIO space which lead to MCE or may write stale data into memory also written by non-coherent agents.

Workaround

It is recommended not to map MMIO range as WB. If WB is used for MMIO range, OS or VMM should not map such MMIO page adjacent to a regular WB page (adjacent on the linear address space, before or after the IO page). Memory that may be written by non-coherent agents should be separated by at least 64 bytes from regular memory used for other purposes (on the linear address space).

Status

For the steppings affected, refer to the Summary Table of Changes.

Problem

During Restricted Transactional Memory (RTM) operation when branch tracing is enabled using Branch Trace Message (BTM) or Branch Trace Store (BTS), the incorrect EIP value (From_​IP pointer) may be observed for an RTM abort.

Implication

Due to this erratum, the From_​IP pointer may be the same as that of the immediately preceding taken branch.

Workaround

None identified.

Status

For the steppings affected, refer to the Summary Table of Changes.

Problem

During a # General Protection Exception (GPE), the processor pushes an error code on to the exception handler’s stack. If the segment selector descriptor straddles the canonical boundary, the error code pushed onto the stack may be incorrect.

Implication

An incorrect error code may be pushed onto the stack. Intel has not observed this erratum with any commercially available software.

Workaround

None identified.

Status

For the steppings affected, refer to the Summary Table of Changes.

Problem

Execution of the FSAVE, FNSAVE, FSTENV, or FNSTENV instructions in real-address mode or virtual-8086 mode may save an incorrect value for the x87 FPU data pointer (FDP). This erratum does not apply if the last non-control x87 instruction had an unmasked exception.

Implication

Software operating in real-address mode or virtual-8086 mode that depends on the FDP value for non-control x87 instructions without unmasked exceptions may not operate properly.

Workaround

None identified. Software should use the FDP value saved by the listed instructions only when the most recent non-control x87 instruction incurred an unmasked exception.

Status

For the steppings affected, refer to the Summary Table of Changes.

Problem

The VAESIMC and VAESKEYGENASSIST instructions should produce a #UD (Invalid-Opcode) exception if the value of the vvvv field in the VEX prefix is not 1111b. Due to this erratum, if CR0.TS is “1”, the processor may instead produce a #NM (Device-Not-Available) exception.

Implication

Due to this erratum, some undefined instruction encodings may produce a #NM instead of a #UD exception.

Workaround

Software should always set the vvvv field of the VEX prefix to 1111b for instances of the VAESIMC and VAESKEYGENASSIST instructions.

Status

For the steppings affected, refer to the Summary Table of Changes.

Problem

Attempt to use FXSAVE or FXRSTOR with a VEX prefix should produce a #UD (Invalid-Opcode) exception. If either the TS or EM flag bits in CR0 are set, a #NM (device-not-available) exception may be raised instead of #UD exception.

Implication

Due to this erratum a #NM exception may be signaled instead of a #UD exception on an FXSAVE or an FXRSTOR with a VEX prefix.

Workaround

Software should not use FXSAVE or FXRSTOR with the VEX prefix.

Status

For the steppings affected, refer to the Summary Table of Changes.

Problem

IA32_​THERM_​STATUS MSR (19CH) includes read-only (RO) fields as well as writable fields. Writing a non-zero value to any of the read-only fields may cause a #GP.

Implication

Due to this erratum, software that reads the IA32_​THERM_​STATUS MSR, modifies some of the writable fields, and attempts to write the MSR back may #GP.

Workaround

Software should clear all read-only fields before writing to this MSR.

Status

For the steppings affected, refer to the Summary Table of Changes.

Problem

If a MOV SS or POP SS instruction generated a debug exception and is not followed by an explicit write to the stack pointer (SP), the processor may fail to deliver the debug exception or, if it does, the DR6 register contents may not correctly reflect the causes of the debug exception.

Implication

Debugging software may fail to operate properly if a debug exception is lost or does not report complete information. Intel has not observed this erratum with any commercially available software.

Workaround

Software should explicitly write to the stack pointer immediately after executing MOV SS or POP SS.

Status

For the steppings affected, refer to the Summary Table of Changes.

Problem

An Intel^® Processor Trace PIP (Paging Information Packet), which includes indication of entry into non-root operation, may be generated on VMentry as long as the “Conceal VMX in Intel^® PT” field (bit 19) in Secondary Execution Control register (IA32_​VMX_​PROCBASED_​CTLS2, MSR 048BH) is clear. This diverges from expected behavior, since this PIP should instead be generated only with a zero value of the “Conceal VMX entries from Intel^® PT” field (Bit 17) in the Entry Control register (IA32_​VMX_​ENTRY_​CTLS MSR 0484H).

Implication

An Intel^® PT trace may incorrectly expose entry to non-root operation.

Workaround

A VMM (Virtual Machine Monitor) should always set both the “Conceal VMX entries from Intel^® PT” field in the Entry Control register and the “Conceal VMX in Intel^® PT” in the Secondary Execution Control register to the same value.

Status

For the steppings affected, refer to the Summary Table of Changes.

Problem

Execution of VAESENCLAST with VEX.L= 1 should signal a #UD (Invalid Opcode) exception, however, due to the erratum, a #NM (Device Not Available) exception may be signaled.

Implication

As a result of this erratum, an operating system may restore AVX and other state unnecessarily.

Workaround

None identified.

Status

For the steppings affected, refer to the Summary Table of Changes.

Problem

The Anti Side-Channel Interference (ASCI) field in IA32_​PERF_​GLOBAL_​STATUS (MSR 38EH, bit 60) should be set when the count in any of the configured performance counters (Example: IA32_​PMCx or IA32_​FIXED_​CTRx) was altered due to direct or indirect operation of Intel^® SGX. Due to this erratum, the ASCI bit may not be set properly when IA32_​FIXED_​CTR0 is used.

Implication

Software that relies on the value of the ASCI bit in IA32_​PERF_​GLOBAL_​STATUS for its operation may not operate correctly when IA32_​FIXED_​CTR0 is used.

Workaround

None identified.

Status

For the steppings affected, refer to the Summary Table of Changes.

Problem

Bit 63 of IA32_​PERF_​GLOBAL_​STATUS_​SET MSR (391H) is reserved. Due to this erratum, setting the bit may not result in General Protection Fault (#GP).

Implication

Software that attempts to set bit 63 of IA32_​PERF_​GLOBAL_​STATUS_​SET MSR does not generate #GP.  There are no other system implications to this behavior.

Workaround

None identified.

Status

For the steppings affected, refer to the Summary Table of Changes.

Problem

WRMSR to PRMRR_​MASK (MSR 1F5H) may result in a #GP (General Protection Fault) when the resulting PRMRR (Processor Reserved Memory Range Register) base (as defined by MSR 1F4H) bitwise-and with its mask (as defined by MSR 1F5) equals zero, the range is configured (bit 3 of MSR 1F4H), and the processor is running with Intel Hyper Threading (HT) technology disabled.

Implication

WRMSR to PRMRR_​MASK may result in a #GP. Intel has not observed this erratum with any commercially available software.

Workaround

Software should not configure an empty PRMRR range.

Status

For the steppings affected, refer to the Summary Table of Changes.

Problem

An access to a GPA (guest-physical address) may cause an EPT-violation VM exit. When the “EPT-violation #VE” VM-execution control is 1, an EPT violation may cause a #VE (virtualization exception) instead of a VM exit. Due to this erratum, an EPT violation may erroneously cause a #VE when the “suppress #VE” bit is set in the EPT paging-structure entry used to map the GPA being accessed. This erratum does not apply when the “EPT-violation #VE” VM-execution control is 0 or when delivering an event through the IDT. This erratum applies only when the GPA in CR3 is used to access the root of the guest paging-structure hierarchy (or, with PAE paging, when the GPA in a PDPTE is used to access a page directory).

Implication

When using PAE paging mode, an EPT violation that should cause an VMexit in the VMM may instead cause a VE# in the guest. In other paging modes, in addition to delivery of the erroneous #VE, the #VE may itself cause an EPT violation, but this EPT violation may be correctly delivered to the VMM.

Workaround

A VMM may support an interface that guest software can invoke with the VMCALL instruction when it detects an erroneous #VE.

Status

For the steppings affected, refer to the Summary Table of Changes.

Problem

CPUID leaf 16 (EAX=16H) subleaf 1 (ECX=01H) TLB information inaccurately reports that the instructions’ 1st-level TLB is 8-way and supports both 4K and 2M/4M pages, although it is split into 16 sets of 8 ways for 4K pages and 2 sets of 8 ways for 2M/4M pages.

Implication

Software that uses CPUID instructions 1st-level TLB information may operate incorrectly. Intel has not observed this erratum to impact the operation of any commercially available software.

Workaround

None identified. Software should ignore instructions’ 1^st-level TLB information reported by CPUID for the affected processors.

Status

For the steppings affected, refer to the Summary Table of Changes.

Problem

The performance monitoring events MEM_​TRANS_​RETIRED.LOAD_​LATENCY_​* (Event CDH; UMask 01H; any latency) count load instructions whose latency exceed a predefined threshold, where the loads are randomly selected using the load latency facility (an extension of PEBS). However due to this erratum, these events may count incorrectly for VGATHER*/VPGATHER* instructions.

Implication

The Load Latency Performance Monitoring events may be Inaccurate for Gather instructions.

Workaround

None identified

Status

For the steppings affected, refer to the Summary Table of Changes.

Problem

CPUID extended function 80000006H (EAX=80000006H) inaccurately reports information about the L2 cache in ECX. The function reports that the L2 cache size is 256K divided into 8 ways, while the actual L2 size and structure should be inferred from reading CPUID leaf 04H sub-leaf 02H.

Implication

Software that uses CPUID extended leaf 80000006H L2 cache information may operate incorrectly. Intel has not observed this erratum to impact the operation of any commercially available software.

Workaround

None identified. Software should ignore the L2 cache size information reported by CPUID extended leaf 80000006H for the affected processors.

Status

For the steppings affected, refer to the Summary Table of Changes.

Problem

In VMX non-root operation, Intel^® Software Guard Extensions (Intel^® SGX) enclave accesses to the APIC-access page may cause APIC-access VM exits instead of page faults.

Implication

A virtual-machine monitor (VMM) may receive a VM exit due to an access that should have caused a page fault, which would be handled by the guest operating system (OS).

Workaround

A VMM avoids this erratum if it does not map any part of the Enclave Page Cache (EPC) to the guest’s APIC-access address; an operating system avoids this erratum if it does not attempt indirect enclave accesses to the APIC.

Status

For the steppings affected, refer to the Summary Table of Changes.

Problem

Intel^® PT (Intel^® Processor Trace) generates a PSB+ (Packet Stream Boundary+) set of packets periodically, based on the number of trace bytes written out. If the threshold for a PSB+ is reached while Intel^® PT is being disabled by clearing IA32_​RTIT_​CTL.TraceEn[0] (MSR 0570H) either during a VM-exit or after generating fewer than 8 bytes of trace since TraceEn was last set, that PSB+ may be lost.

Implication

An Intel^® PT decoder that is scanning for a PSB+ at which to begin decoding may have to skip over more trace output bytes before finding one.

Workaround

Software processing the trace at runtime can detect that a PSB+ was dropped by checking that IA32_​RTIT_​STATUS.PacketByteCnt[48:32] (MSR 0571H) has recently crossed the PSB threshold, while scanning the trace to check that the expected PSB+ was not inserted. When a dropped PSB+ is detected, software can force a PSB+ to be inserted the next time Intel^® PT is enabled by clearing PacketByteCnt.

Status

For the steppings affected, refer to the Summary Table of Changes.

Problem

Due to a complex set of microarchitectural conditions, the Intel^® PT (Intel^® Processor Trace) CBR (Core:Bus Ratio) packet generated on a frequency change may be dropped, without an OVF (Overflow) packet, or may be inserted into the trace late, after other packets (including possibly another CBR) that were generated after the frequency change completed.

Implication

An Intel^® PT decoder may report an incorrect core: bus ratio to a portion of the trace, which may result in an incorrect wall clock time calculation.

Workaround

None identified.

Status

For the steppings affected, refer to the Summary Table of Changes.

Problem

The Intel^® PT (Intel^® Processor Trace) OVF (Overflow) packet may not be generated when only TIPs (Target IP Packets) and/or FUPs (Flow Update Packets) are lost due to internal buffer overflow.

Implication

A decoder error may result from the missing FUP and/or TIP packets.

Workaround

None identified. An Intel^® PT decoder may be able to resume proper decode from the next FUP, TIP, or PSB (Packet Stream Boundary) packet. The incidence of error may be mitigated by setting IA32_​RTIT_​CTL.CYCEn[bit 1] (MSR 0570H) to 1, as an internal buffer overflow that loses a CYC packet may generate an OVF.

Status

For the steppings affected, refer to the Summary Table of Changes.

Problem

Due to a rare microarchitectural condition, the second byte of a 2-byte CYC (Cycle Count) packet may be dropped without an OVF (Overflow) packet.

Implication

A trace decoder may signal a decode error due to the lost trace byte.

Workaround

None Identified. A mitigation is available for this erratum. If a decoder encounters a multi-byte CYC packet where the second byte has bit 0 (Ext) set to 1, it should assume that 4095 cycles have passed since the prior CYC packet, and it should ignore the first byte of the CYC and treat the second byte as the start of a new packet.

Status

For the steppings affected, refer to the Summary Table of Changes.

Problem

If VM entry clears Intel^® Processor Trace (Intel^® PT) IA32_​RTIT_​CTL.TraceEn (MSR 570H, bit 0) while PacketEn is 1 then a Flow Update Packet (FUP) may precede the Target IP Packet, Packet Generation Disable (TIP.PGD). VM entry can clear TraceEn if the VM-entry MSR-load area includes an entry for the IA32_​RTIT_​CTL MSR.

Implication

When this erratum occurs, an unexpected FUP may be generated that creates the appearance of an asynchronous event take place immediately before or during the VM entry.

Workaround

The Intel^® PT trace decoder may opt to ignore any FUP whose IP matches that of a VM entry instruction.

Status

For the steppings affected, refer to the Summary Table of Changes.

Problem

Execution of the VCVTPS2PH instruction with a memory destination may update the MXCSR exceptions flags (bits [5:0]) if the store to memory causes a fault (Example: #PF) or VM exit. The value written to the MXCSR exceptions flags  is what would have been written if there were no fault.

Implication

Software may see exceptions flags set in MXCSR, although the instruction has not successfully completed due to a fault on the memory operation. Intel has not observed this erratum to affect any commercially available software.

Workaround

None identified.

Status

For the steppings affected, refer to the Summary Table of Changes.

Problem

The PECI (Platform Environmental Control Interface) 3.1 specification’s operating frequency range is 2Kbps to 2Mbps. Due to this erratum, PECI may be unreliable when operated out of 3.2Kbps-1Mbps range.

Implication

Platforms attempting to run PECI out of 3.2Kbps-1Mbps range may not behave as expected.

Workaround

None identified. Platforms should limit PECI operating frequency to 3.2Kbps-1Mbps range.

Status

For the steppings affected, refer to the Summary Table of Changes.

Problem

TCSS USB Host Controller (xHCI) may hang when a USB 3.x Device requests U2 exit and the xHCI controller is entering autonomous power gated state (d0i2) asynchronous occur at the same time.

Implication

Due to this erratum, the system may hang.

Workaround

A workaround has been implemented in IOM Firmware 04.00C.0.00 and later disabling d0i2. System power implications are USB3.x device and workload dependent.

Status

For the steppings affected, refer to the Summary Table of Changes.

Problem

Connecting a USB Device to Type-C Converter cable or a dongle to Type-B or Type-A Connector on an unpopulated Type-C port may align with Processor Power Management (PM) transition causing a momentary stall of the Processor PM Transition. This may result in the violation of a Device reported Latency Tolerance Reporting (LTR).

Implication

Isochronous traffic streams may exhibit temporary anomalies when this erratum occurs, such as audio clicks or display flickers.

Workaround

A Fix has been implemented in IOM Firmware 04.00F.0.00

Status

For the steppings affected, refer to the Summary Table of Changes.

Problem

If a USB 3.x device is established to operate in USB 2.0 and the platform enters an S3 state, if a different USB 3.x device is connected to the port, the speed may be limited to USB 2.0 speed operation.

Implication

Due to this erratum, the USB 3.x device may only operate at USB 2.0 speeds.

Workaround

None identified. USB 3.x capability can be recovered by unplugging and re-plugging the USB 3.x device after the system has resumed from S3.

Status

For the steppings affected, refer to the Summary Table of Changes.

Problem

While running USB 3.1 Gen2 Link Compliance Test TD7.39 (Port Match Retry Test), the speed negotiation may downgrade to USB 2.0 instead of USB 3.1 Gen1 when using an USB cable not capable of USB 3.1 Gen2 speeds.

Implication

USB 3.1 Gen2 link may downgrade to USB 2.0 when using an USB cable to capable of USB 3.1 Gen2 speeds and fail the certification test.

Workaround

None identified. Intel has obtained a waiver for this erratum.

Status

For the steppings affected, refer to the Summary Table of Changes.

Problem

The processor’s internal voltage regulation circuits optimize power consumption based on processor workload. Due to this erratum, these circuits may fail to completely optimize power under certain lightly loaded conditions when TCSS is in TC Cold state.

Implication

When this erratum occurs, power consumption under lightly loaded conditions may exceed expectations. Intel has not observed any functional failures associated with this erratum.

Workaround

It is possible for the BIOS to contain a workaround for this erratum.

Status

For the steppings affected, refer to the Summary Table of Changes.

Problem

Under complex micro-architectural conditions, both logical processors on the same physical core may hang, with an internal timeout error (MCACOD 0400H) logged into IA32_​MC3_​STATUS (MSR 40DH). This erratum can only happen when both logical processors on the same physical core are active.

Implication

Due to this erratum, the processor may hang. Intel has not observed this erratum with any commercially available software.

Workaround

It is possible for the BIOS to contain a workaround for this erratum.

Status

For the steppings affected, refer to the Summary Table of Changes.

Problem

Running high graphics throughput workloads with corresponding high ring frequencies may lead to system failure

Implication

Due to this erratum, the system may hang when running high-throughput graphics scenarios such as graphics stress testing.

Workaround

It is possible for the BIOS to contain a workaround for this erratum.

Status

For the steppings affected, refer to the Summary Table of Changes.

Problem

The processor may miscount consecutive PROCHOT assertions, which may lead to an extended duration for lowest P-state operation.

Implication

PROCHOT demotion algorithm may put the processor in LFM for longer than expected.

Workaround

It is possible for the BIOS to contain a workaround for this erratum.

Status

For the steppings affected, refer to the Summary Table of Changes.

Problem

Some errors may be logged in IA32_​MC1_​STATUS MSR (405H) without generating #MC (machine check exception). The logged errors would have the VAL bit set to 1 (bit 63), UC bit set to 1 (bit 61), PCC bit set to 1 (bit 57) and EN bit set to 0 (bit 60). These errors may be:

Implication

Errors may be logged in IA32_​MC1_​STATUS MSR with EN bit set to 0. Software that incorrectly ignores the EN bit value may interpret these errors as fatal events. Software that properly interprets EN bit may fail to behave as expected.

Workaround

None identified.

Status

For the steppings affected, refer to the Summary Table of Changes.

Problem

When the processor exits a PKG-C9/C10 exit, it may incorrectly assert THRMTRIP# signal.

Implication

Due to this erratum, THRMTRIP# may be asserted and the system may hang.

Workaround

It is possible for the BIOS to contain a workaround for this erratum.

Status

For the steppings affected, refer to the Summary Table of Changes.

Problem

Guest-physical access using a guest-physical address that translates to an address on the APIC-access page (as identified by the APIC-access address field in the VMCS) should cause an APIC-access VM exit. This includes page table information accesses done as part of page translation (page walks). Due to this erratum placing page table information in the APIC-access page may result in a page fault instead of VM exit when the page translation is done as part of an enclave access.

Implication

Software that places page table information in the APIC access page may get page faults on executing enclave accesses, instead of exiting to the VMM (Virtual-Machine Monitor). Intel has not observed this erratum with any commercially available software.

Workaround

Software should not place page table information in the APIC access page.

Status

For the steppings affected, refer to the Summary Table of Changes.

Problem

This erratum may cause a machine-check error (IA32_​MCi_​STATUS.MCACOD=0150H) on the fetch of an instruction. It applies only if (1) instruction bytes are fetched from a linear address translated using a 4-Kbyte page and cached in the processor; (2) the paging structures are later modified so that these bytes are translated using a large page (2-Mbyte, 4-Mbyte or 1-GByte) with a different physical address or memory type; and (3) the same instruction is fetched after the paging structure modification but before software invalidates any TLB entries for the linear region.

Implication

Due to this erratum an unexpected machine check with error code 0150H with MSCOD 00FH may occur, possibly resulting in a shutdown. This erratum could also lead to unexpected correctable machine check (IA32_​MCi_​STATUS.UC=0) with error code 005H with MSCOD 00FH.

Workaround

Software should not write to a paging-structure entry in a way that would change the page size and either the physical address, memory type or User/Supervisor bit. It can instead use one of the following algorithms: first clear the P flag in the relevant paging-structure entry (example: PDE); then invalidate any translations for the affected linear addresses; and then modify the relevant paging-structure entry to set the P flag and establish the new page size. An alternative algorithm: first change the physical page attributes (combination of physical address, memory type and User/Supervisor bit) in all 4K pages in the affected linear addresses; then invalidate any translations for the affected linear addresses; and then modify the relevant paging-structure entry to establish the new page size.

Status

For the steppings affected, refer to the Summary Table of Changes.

Problem

When the Graphics core is running in low frequency, the system may hang, resulting in an Internal Timer Error machine check exception.

Implication

Due to this erratum, a system hang may occur resulting in an unexpected machine check with error code MCACOD=400h.

Workaround

It is possible for the BIOS to contain a workaround for this erratum.

Status

For the steppings affected, refer to the Summary Table of Changes.

Problem

LFPS (Low Frequency Periodic Signaling) sampling may fail when hot plugging on USB3.x ports without a retimer.

Implication

USB3.x device may not enumerate or may downgrade to USB2 speed.

Workaround

It is possible for the BIOS to contain a workaround for this erratum.

Status

For the steppings affected, refer to the Summary Table of Changes.

Problem

If accesses to certain Display Engine configuration registers occur while the Display Engine is in a low power state, these requests may take longer than expected.

Implication

When this erratum occurs, isochronous devices may experience deferred memory access, leading to, for example, audio artifacts such as popping, clicking, or hissing.

Workaround

It is possible for the BIOS to contain a workaround for this erratum.

Status

For the steppings affected, refer to the Summary Table of Changes.

Problem

FIVR PS5 (Power State 5) current may be insufficient during PKG-C6 resume.

Implication

System implication is design dependent which may lead to system instability or display flicker during PKG-C6 resume.

Workaround

It is possible for the BIOS to contain a workaround for this erratum.

Status

For the steppings affected, refer to the Summary Table of Changes.

Problem

During PKG-C7 entry an improper control logic power sequence may cause an incorrect pulse to occur on LPDDR4x CKE, due to incorrect DDR IO configurations.

Implication

Due to this erratum DRAM may incorrectly exit self-refresh, resulting in unpredictable system behavior.

Workaround

A fix for this erratum is available in BIOS. (BIOS version 3512 and SiC version 08.00.57.10)

Status

For the steppings affected, refer to the Summary Table of Changes.

Problem

When a high-performance Thunderbolt™ device is connected to Type-C port 3 or 4 the TCSS DTS may be incorrectly calculated.

Implication

Due to this erratum, TJMAX may be exceeded leading to unpredictable system behavior or a global reset.

Workaround

It is possible for the BIOS to contain a workaround for this erratum.

Status

For the steppings affected, refer to the Summary Table of Changes.

Problem

Under complex micro-architectural conditions, using a REP MOVSB instruction in which at least one of the operands (destination or source) of the instruction is in a non-flat segment mode, might cause unpredictable system behavior.

Implication

Due to this erratum, unpredictable system behavior may occur. Intel has not observed this erratum with any commercially available software.

Workaround

It is possible for the BIOS to contain a workaround for this erratum.

Status

For the steppings affected, refer to the Summary Table of Changes.

Problem

Under complex microarchitectural conditions, executing a MASKMOVQ or MASKMOVDQU instruction to a physical memory location mapped by two linear addresses of different page sizes pages may result in unpredictable system behavior if either accessed flag (A flag) or the dirty flag (D flag) of one of those pages are cleared or the transaction is to a uncacheable memory.

Implication

When this erratum occurs, the system may behave unpredictably. Intel has not observed this erratum with any commercially available software.

Workaround

Software that uses MASKMOVQ or MASKMOVDQU instructions should invalidate the TLB entries (using an INVLPG instruction) containing an address that could be accessed as part of two different page sizes after each paging-structure change that affects those pages

Status

For the steppings affected, refer to the Summary Table of Changes.

Problem

USB 3.x link training may fail in systems with a retimer due to incorrect Rcomp value.

Implication

Due to this erratum, some USB3.x devices may not be functional until unplugged and reconnected and/or requiring a system reset.

Workaround

It is possible for the BIOS to contain a workaround for this erratum.

Status

For the steppings affected, refer to the Summary Table of Changes.

Problem

If system software enables VTd translations for the Gfx IOMMU (TE=1) and then switches the Gfx IOMMU to disable translations (TE=0) while the display is enabled, display memory underrun condition can occur.

Implication

Due to this erratum, momentary display corruption may occur. Intel has only observed this issue when BIOS pre-boot DMA protection was enabled for Gfx IOMMU.

Workaround

It is possible for the BIOS to contain a workaround for this erratum.

Status

For the steppings affected, refer to the Summary Table of Changes.

Problem

MDS_​NO bit (bit 5) in IA32_​ARCH_​CAPABILITIES MSR (10Ah) is set, incorrectly indicating full activation of all MDS (micro-architectural data sampling) mitigations.

Implication

Due to this erratum, the IA32_​ARCH_​CAPABILITIES MDS_​NO bit incorrectly reports the activation of all MDS mitigations actions.

Workaround

It is possible for the BIOS to contain a workaround for this erratum.

Status

For the steppings affected, refer to the Summary Table of Changes.

Problem

Under complex micro-architectural conditions, a single internal parity error seen in IA32_​MC0_​STATUS MSR (401h) with MCACOD (bits 15:0) value of 5h and MSCOD (bits 31:16) value of 7h, may set the overflow flag (bit 62) in the same MSR.

Implication

Due to this erratum, the IA32_​MC0_​STATUS overflow flag may be set after a single parity error. Intel has not observed this erratum with any commercially available software.

Workaround

None identified.

Status

For the steppings affected, refer to the Summary Table of Changes.

Problem

Non-contiguous capacity masks set in the IA32_​L3_​QOS_​Mask_​N MSRs (address c90h through c9fh) may not cause #GP (general protection) as expected.

Implication

Due to this erratum, the processor may not report a #GP when non-contiguous capacity masks are set in the IA32_​L3_​QOS_​Mask_​N MSRs.

Workaround

Software should not expect a #GP after setting non-contiguous capacity masks in IA32_​L3_​QOS_​Mask_​N MSRs.

Status

For the steppings affected, refer to the Summary Table of Changes.

Problem

Under complex micro-architectural conditions, when either CR0.TS (bit 3) or CR0.EM (bit 2) are set, both logical processors on the same physical core may hang, with an internal timeout error (MCACOD 0400H) logged into IA32_​MC3_​STATUS (MSR 40DH). This can only happen when both logical processors on the same physical core are active.

Implication

Due to this erratum, system may hang.

Workaround

None identified.

Status

For the steppings affected, refer to the Summary Table of Changes.

Problem

Under complex microarchitectural conditions, when either CR0.TS (bit 3) or CR0.EM (bit 2) are set, unexpected system behavior may occur.

Implication

Due to this erratum, the processor may experience unexpected system behavior.

Workaround

It is possible for the BIOS to contain a workaround for this erratum.

Status

For the steppings affected, refer to the Summary Table of Changes.

Problem

When Intel^® SGX extends an Enclave Page Cache (EPC) via the page permissions instruction (ENCLU[EMODPE]) and generates a Page Fault (#PF), even though the page permissions instruction access is a read access to the target page, the Page Fault Error Code (#PF's PFEC) may indicate that the fault occurred on a write (PFEC.W bit may be set) instead.

Implication

This erratum may impact debugging Intel^® SGX enclaves software. Intel has not observed this erratum with any commercially available software.

Workaround

None identified.

Status

For the steppings affected, refer to the Summary Table of Changes.

Problem

When using the APIC timer in Time Stamp Counter Deadline (TSC-deadline) mode, if the most significant set bit in the written value to the TSC-Deadline MSR is bit 55, the processor may generate a spurious timer interrupt.

Implication

When this erratum occurs, a spurious timer interrupt may occur causing unpredictable system behavior. Intel has not observed this erratum with any commercially available software.

Workaround

It is possible for the BIOS to contain a workaround for this erratum.

Status

For the steppings affected, refer to the Summary Table of Changes.

Problem

Under complex micro-architectural conditions, the processor's RDTSC and RDTSCP instructions may report a shifted value. In these cases, the shift value may be larger than a minute.

Implication

Software may experience a non-monotonic time stamp counter, misalignment across threads, or a spurious timer interrupt.

Workaround

It is possible for the BIOS to contain a workaround for this erratum.

Status

For the steppings affected, refer to the Summary Table of Changes.

Problem

Under complex micro-architectural conditions, when Move Elimination is performed, unpredictable system behavior may occur.

Implication

Due to this erratum, unpredictable system behavior may occur.

Workaround

It is possible for the BIOS to contain a workaround for this erratum.

Status

For the steppings affected, refer to the Summary Table of Changes.

Problem

Under complex micro-architectural conditions, using the REP MOVSB instruction may lead to an incorrect value in the Extended Stack Pointer (ESP) register. This can only happen when both logical processors on the same physical core are active.

Implication

Due to this erratum, the Extended Stack Pointer register may be incorrect, leading to unpredictable system behavior.

Workaround

It is possible for the BIOS to contain a workaround for this erratum.

Status

For the steppings affected, refer to the Summary Table of Changes.

Problem

Under a complex set of micro-architectural conditions, an incorrect sequence of operations during a ring interconnect performance state transition may result in unpredictable system behavior.

Implication

Due to this erratum, unpredictable system behavior may occur.

Workaround

It is possible for the BIOS to contain a workaround for this erratum.

Status

For the steppings affected, refer to the Summary Table of Changes.

Problem

MSR_​UNC_​PERF_​GLOBAL_​CTRL (E01H) (bit29) ‘Enable all uncore counters’ and (bit 31) ‘Freeze counters’ may not function. In addition, MSR_​UNC_​ARB_​PERFCTR0_​0 (3B0H) and MSR_​UNC_​ARB_​PERFEVTSEL0_​0 (3B2H) may not return correct values.

Implication

Due to this erratum, software cannot globally control uncore performance counters using MSR_​UNC_​PERF_​GLOBAL_​CTRL and cannot use MSR_​UNC_​ARB_​PERFCTR0_​0 or MSR_​UNC_​ARB_​PERFEVTSEL0_​0.

Workaround

None identified. Software may need to utilize each individual local enable (bit 22) in the specific uncore PMON Performance Event Select (PERFEVTSEL) registers.

Status

For the steppings affected, refer to the Summary Table of Changes.

Problem

Under a complex set of micro-architectural conditions, Memory Controller domain low power mode state transition may result in retrieval of incorrect data from memory.

Implication

Due to this erratum, unexpected system behavior may occur.

Workaround

It is possible for the BIOS to contain a workaround for this erratum.

Status

For the steppings affected, refer to the Summary Table of Changes.

Problem

The VT-d architecture allows software to issue Domain- or Device- specific Context Cache invalidation requests. In such cases, the VT-d engine is expected to invalidate all entries that belong to the Domain (or Device) from Context cache. Due to this errata, some Context Cache entries that were required to be invalidated are not invalidated. Global context cache invalidation may correctly invalidate all entries of the context cache.

Implication

Incomplete VT-d Domain-specific Content Cache Invalidation may lead to unpredictable system behavior.

Workaround

It is possible for BIOS to contain a workaround for this erratum.

Status

For the steppings affected, refer to the Summary Table of Changes.

Problem

When the processor attempts to enter a deep power state, on platforms with all enabled Type-C ports configured as DP-FIXD (HDMI/DP) with no devices attached on any port, the system may hang.

Implication

Due to this erratum, the system may hang.

Workaround

It is possible for a BIOS code change to contain a workaround for this erratum.

Status

For the steppings affected, refer to the Summary Table of Changes.

Problem

Under complex micro-architectural conditions, a VERR instruction that follows a VM-entry with a guest state indicating MOV SS blocking (bit 1 in the Interruptibility state) and at least one of B3-B0 bits set (bits 3:0 in the pending debug exception), may lead to incorrect values in DR6.

Implication

Due to this erratum, DR6 may contain incorrect values. Intel has not observed this erratum with any commercially available software.

Workaround

None identified.

Status

For the steppings affected, refer to the Summary Table of Changes.

Problem

Under complex micro-architectural conditions, when the processor receives a warm reset during BIOS initialization, the processor may hang with a machine check error reported in IA32_​MCi_​STATUS, with MCACOD (bits [15:0]) value of 0400H, and MSCOD (bits [31:16]) value of 0080H.

Implication

Due to this erratum, the processor may hang. Intel has only observed this erratum in a synthetic test environment.

Workaround

None identified.

Status

For the steppings affected, refer to the Summary Table of Changes.

Problem

Under complex micro-architectural conditions, reading the IA32_​RTIT_​STATUS.FilterEn bit (bit 0 in MSR 571h) after entering or exiting an RTIT region might reflect a previous value instead of the current one.

Implication

Due to this erratum, IA32_​RTIT_​STATUS.FilterEn bit might reflect a previous value. This erratum has not been seen in any commercially available software.

Workaround

Software should perform an LFENCE instruction prior to reading the IA32_​RTIT_​STATUS MSR to avoid this issue.

Status

For the steppings affected, refer to the Summary Table of Changes.

Problem

The Speculative Store Bypass Disable (SSBD) (IA32_​SPEC_​CTRL MSR 48h, bit [2]) capability should prevent loads from executing speculatively before the addresses of all older stores are known. SMM and SGX enclave always apply this policy. Under certain complex microarchitectural conditions, speculative loads may execute before all older stores are known when in SMM or SGX or when SSBD control bit is set.

Implication

Due to this erratum, the speculation properties implied by SSBD may not be fully met. Intel has not observed any functional implications due to this erratum.

Workaround

It is possible for BIOS to contain a workaround for this erratum.

Status

For the steppings affected, refer to the Summary Table of Changes.

Problem

Under complex microarchitectural conditions, executing any of the XSAVE, XSAVEOPT, XSAVEC, XSAVES, or VZEROALL instructions shortly after the execution of SYSENTER may result in unexpected SSE/AVX register values.

Implication

Due to this erratum, software may observe unexpected values in the SSE/AVX registers. Intel has only observed this erratum in a synthetic test environment.

Workaround

None identified. An operating system’s SYSENTER handler should avoid using executing an XSAVE or VZEROALL instruction in its first ten instructions.

Status

For the steppings affected, refer to the Summary Table of Changes.

Problem

After an internal timer error has been reported in MC3_​STATUS MSR (0x40d) with MCACOD (bits [15:0]) value of 0400H, and MSCOD (bits [31:16]) value of 0080H, under complex micro-architectural conditions, a false error may be reported in MC1_​STATUS MSR (0x405) with MCACOD 0x174 or MCACOD 0x124.

Implication

Due to this erratum, a false MCE may be reported in MC1_​STATUS MSR. Intel has only observed this erratum in a synthetic test environment.

Workaround

Software should ignore the MC1_​STATUS error when it appears with an internal timer error.

Status

For the steppings affected, refer to the Summary Table of Changes.

Problem

Posted-interrupt processing is a virtualization feature for interrupts which requires configuring addresses in the posted-interrupt descriptor fields in the VMCS (Virtual Machine Control Structure). Configuring posted-interrupt descriptors addresses that are within the PRMRR (Processor Reserved Memory Range Register, defined by MSR 1F4H and MSR 1F5H) may result in a logical processor hang.

Implication

This erratum may result in a processor hang. Intel has not observed this erratum with any commercially available software.

Workaround

VMM (Virtual Machine Monitor) software should not use addresses within the PRMRR for posted-interrupt descriptors.

Status

For the steppings affected, refer to the Summary Table of Changes.

Problem

A processor hang may result if Intel^® Processor Trace (Intel^® PT) is enabled with Mini Time Counter (MTC) packets and single range output mode (TraceEn[0]=1, MTCEn[9]=1 and ToPA[8]=0 in IA32_​RTIT_​CTL MSR (0570h)), while the output buffer is less than 1 KB in size (IA32_​RTIT_​OUTPUT_​MASK_​PTRS[31:0] MSR (0561h) < 0400h) and it is mapped as uncacheable (UC) or write protect (WP) memory type in the Memory Type Range Registers (MTRRs).

Implication

Due to this erratum, the system may experience an Internal Timer Error Machine Check (IA32_​MCi_​STATUS.MCACOD=400H; bits 15:0). Intel has only observed this erratum in a synthetic test environment.

Workaround

Avoid directing Intel PT output to an uncacheable buffer less than 1KB in size.

Status

For the steppings affected, refer to the Summary Table of Changes.

Problem

Setting MISC_​FEATURE_​CONTROL.DISABLE_​THREE_​STRIKE_​CNT (bit 11 in MSR 1A4h) does not prevent the three-strike counter from incrementing as documented; instead, it only prevents the signaling of the three-strike event once the counter has expired.

Implication

Due to this erratum, software may be able to see the three-strike logged in the MC3_​STATUS (MSR 40Dh, MCACOD = 400h [bits 15:0]) even when MISC_​FEATURE_​CONTROL.DISABLE_​THREE_​STRIKE_​CNT is set.

Workaround

None identified.

Status

For the steppings affected, refer to the Summary Table of Changes.

Problem

Under complex micro-architectural conditions, when using Intel^® Processor Trace (Intel^® PT) with single range output larger than 4KB, disabling PT and then enabling PT using the TraceEn bit in IA32_​RTIT_​CTL MSR (MSR 570h, bit 0) may cause incorrect output values to be recorded.

Implication

Due to this erratum, a PT trace may contain incorrect values.

Workaround

None identified. Software should avoid using PT with single range output larger than 4KB.

Status

For the steppings affected, refer to the Summary Table of Changes.

Problem

Under complex micro-architectural conditions, an L2 prefetch MCE that should be reported with MCACOD 165h in IA32_​MC3_​STATUS MSR (MSR 40dh, bits [15:0]) may be reported with an MCACOD of 101h.

Implication

Due to this erratum, the reported MCACOD for this MCE may be incorrect.

Workaround

None identified.

Status

For the steppings affected, refer to the Summary Table of Changes.

Problem

In 32-bit mode, a call instruction wrapping around the 32-bit address should save a return address near the bottom of the address space (low address) around address zero. Under complex micro-architectural conditions, a return instruction following such a call may return to the next sequential address instead (high address).

Implication

Due to this erratum, In 32-bit mode a return following a call instruction that wraps around the 32-bit address boundary may return to the next sequential IP without wrapping around the address, possibly resulting in a #PF. Intel has not observed this behavior on any commercially available software.

Workaround

Software should not place call instructions in addresses that wrap around the 32-bit address space in 32-bit mode.

Status

For the steppings affected, refer to the Summary Table of Changes.

Problem

Under complex microarchitectural conditions, the branch predictor may produce an incorrect instruction pointer leading to unpredictable system behavior.

Implication

Due to this erratum, the system may exhibit unpredictable behavior.

Workaround

It may be possible for BIOS to contain a workaround for this erratum.

Status

For the steppings affected, refer to the Summary Table of Changes.

Problem

The USB 3.2 Debug Class Device (DbC) reports an incorrect Sublink Speed Attribute ID (SSID) value in the SuperSpeedPlus USB Device Capability field.

Implication

Due to this erratum, the processor USB 3.2.DbC (Debug Capability) device may fail to enumerate when connected to a USB 3.2 Gen 2x1 port.

Workaround

None identified.

Status

For the steppings affected, refer to the Summary Table of Changes.

Problem

Under complex micro-architectural conditions, writing a non-zero value to the Time-Stamp Counter (TSC) Deadline counter, IA32-TSC_​DEADLINE MSR (6E0h), may cause timer interrupt following the write.

Implication

Due to this erratum, an unexpected timer interrupt may be signaled.

Workaround

None identified.

Status

For the steppings affected, refer to the Summary Table of Changes.

Problem

Under complex microarchitectural conditions, the processor may hang when executing a microcode update (MCU) by writing to IA32_​BIOS_​UPDT_​TRIG (MSR 79h).

Implication

Due to this erratum, processor may hang during a microcode update.

Workaround

It may be possible for BIOS to contain a workaround for this erratum.

Status

For the steppings affected, refer to the Summary Table of Changes.

Problem

A delay in the availability of LCRD1 (Link Credit 1) from a USB 3.2 hub, with two or more downstream USB 3.2 bulk endpoint devices engaged in SuperSpeedPlus concurrent transfers, may lead to the connected xHCI controller sending the ACK and Status of a transfer packet out of order.

Implication

Due to this erratum, a USB 3.2 bulk endpoint device may not respond to subsequent transfers. It may be possible for a device driver to recover the USB 3.2 device.

Workaround

None identified.

Status

For the steppings affected, refer to the Summary Table of Changes.