Problem

Execution of the FSAVE, FNSAVE, FSTENV, or FNSTENV instructions in real-address mode or virtual-8086 mode may save an incorrect value for the x87 FDP (FPU data pointer). This erratum does not apply if the last non-control x87 instruction had an unmasked exception.

Implication

Software operating in real-address mode or virtual-8086 mode that depends on the FDP value for non-control x87 instructions without unmasked exceptions may not operate properly. Intel^® has not observed this erratum in any commercially available software.

Workaround

None identified. Software should use the FDP value saved by the listed instructions only when the most recent non-control x87 instruction incurred an unmasked exception.

Status

For the steppings affected, refer to the Summary Table of Changes.

Problem

If a MOV SS or POP SS instruction generated a debug exception, and is not followed by an explicit write to the Stack Pointer (SP), the processor may fail to deliver the debug exception or, if it does, the DR6 register contents may not correctly reflect the causes of the debug exception.

Implication

Debugging software may fail to operate properly if a debug exception is lost or does not report complete information. Intel^® has not observed this erratum with any commercially available software.

Workaround

Software should explicitly write to the stack pointer immediately after executing MOV SS or POP SS.

Status

For the steppings affected, refer to the Summary Table of Changes.

Problem

CPUID extended function 80000006H (EAX=80000006H) inaccurately reports information about the L2 cache in ECX. The function reports that the L2 cache size is 256K divided into 8 ways, while the actual L2 size and structure should be inferred from reading CPUID leaf 04H sub-leaf 02H.

Implication

Software that uses CPUID extended leaf 80000006H L2 cache information may operate incorrectly. Intel^® has not observed this erratum to impact the operation of any commercially available software.

Workaround

None identified. Software should ignore the L2 cache size information reported by CPUID extended leaf 80000006H for the affected processors.

Status

For the steppings affected, refer to the Summary Table of Changes.

Problem

Posted-interrupt processing is a virtualization feature for interrupts which requires configuring addresses in the posted-interrupt descriptor fields in the Virtual Machine Control Structure (VMCS). Configuring posted-interrupt descriptors addresses that are within the PRMRR (Processor Reserved Memory Range Register, defined by MSR 1F4H and MSR 1F5H) may result in a logical processor hang.

Implication

This erratum may result in a processor hang. Intel^® has not observed this erratum with any commercially available software.

Workaround

Virtual Machine Monitor (VMM) software should not use addresses within the PRMRR for posted-interrupt descriptors.

Status

For the steppings affected, refer to the Summary Table of Changes.

Problem

Due to a complex set of microarchitectural conditions, the Intel^® Processor Trace (Intel^® PT) CBR (Core:Bus Ratio) packet generated on a frequency change may be dropped, without an OVF (Overflow) packet, or may be inserted into the trace late, after other packets (including possibly another CBR) that were generated after the frequency change completed.

Implication

An Intel^® PT decoder may report an incorrect core; bus ratio to a portion of the trace, which may result in an incorrect wall clock time calculation.

Workaround

None identified.

Status

For the steppings affected, refer to the Summary Table of Changes.

Problem

The Intel^® Processor Trace (Intel^® PT) OVF (Overflow) packet may not be generated when only TIPs (Target IP Packets) and/or FUPs (Flow Update Packets) are lost due to internal buffer overflow.

Implication

A decoder error may result from the missing FUP and/or TIP packets.

Workaround

None identified. An Intel^® PT decoder may be able to resume proper decode from the next FUP, TIP, or PSB (Packet Stream Boundary) packet. The incidence of error may be mitigated by setting IA32_​RTIT_​CTL. CYCEn[bit 1] (MSR 0570H) to 1, as an internal buffer overflow that loses a CYC packet may generate an OVF.

Status

For the steppings affected, refer to the Summary Table of Changes.

Problem

Under complex microarchitectural conditions, a single internal parity error seen in IA32_​MC0_​STATUS MSR (401h) with MCACOD (bits 15:0) value of 5h and MSCOD (bits 31:16) value of 7h, may set the overflow flag (bit 62) in the same MSR.

Implication

Due to this erratum, the IA32_​MC0_​STATUS overflow flag may be set after a single parity error. Intel^® has not observed this erratum with any commercially available software.

Workaround

None identified.

Status

For the steppings affected, refer to the Summary Table of Changes.

Problem

Under complex microarchitectural conditions, in 32Bit mode, the processor may reset the busy (B) flag in the Task State Segment (TSS) descriptor when handling a general protection exception (#GP), a control protection exception (#CP), or a page fault exception (#PF) that happens during a task switch when Control-flow Enforcement Technology (CET) is enabled, indicated by CR4. CET (bit 23).

Implication

Due to this erratum, the TSS descriptor busy flag might be incorrectly written as "not busy" in the TSS descriptor. Intel^® has not observed this erratum with any commercially available software.

Workaround

Software should restore the busy flag in the TSS descriptor when handling #GP, #CP, or #PF exceptions, when CET is enabled.

Status

For the steppings affected, refer to the Summary Table of Changes.

Problem

On EPT violations, bit 4 of the Exit Qualification indicates whether the guest-physical address was writeable. When EPT is configured as supervisory shadow-stack (both bit 60 in EPT paging-structure leaf entry and bit 0 in EPT paging-structure entries are set), non-executable (bit 2 in EPT paging-structure entries is cleared), and non-writeable (bit 1 in EPT paging-structure entries is cleared) a VMExit due to a guest instruction fetch to a supervisory page may incorrectly set bit 4 of the Exit Qualification. Bits 3, 5, and 6 of the Exit Qualification is not impacted by this erratum.

Implication

Due to this erratum, bit 4 of the Exit Qualification may be incorrectly set. Intel^® has not observed this erratum on any commercially available software.

Workaround

EPT handlers processing an EPT violation due to an instruction fetch access on a present page should ignore the value of bit 4 of the Exit Qualification.

Status

For the steppings affected, refer to the Summary Table of Changes.

Problem

When operating in a virtualized environment, if shadow stack pages are mapped over an APIC page, the processor may generate spurious page faults on that shadow stack page whenever its linear to physical address translation is cached in the Translation Look-aside Buffer.

Implication

When this erratum occurs, the processor may generate a spurious page fault. Intel^® is not aware of any software that maps shadow stack pages over an APIC page.

Workaround

Software should avoid mapping shadow stack pages over the APIC page.

Status

For the steppings affected, refer to the Summary Table of Changes.

Problem

Type-C Port (TCP) PHY may fail the HDMI 1. 4 ID7-6 Inter-pair Skew Test for specific thermal corner cases.

Implication

Due to this erratum, the HDMI 1. 4 Inter-pair Skew Test may fail. Intel^® has only observed this erratum in a synthetic test environment.

Workaround

None Identified.

Status

For the steppings affected, refer to the Summary Table of Changes.

Problem

If an Intel^® Processor Trace (Intel^® PT) ToPA (Table of Physical Addresses) table is placed in UC (Uncacheable) or USWC (Uncacheable Speculative Write Combining) memory, and a ToPA output region is filled during an Intel^® TSX (Intel^® Transaction Synchronization Extensions) transaction, the resulting ToPA table read may cause a processor hang.

Implication

Placing Intel^® PT ToPA tables in non-cacheable memory when Intel^® TSX is in use may lead to a processor hang.

Workaround

None identified. Intel^® PT ToPA tables should be located in WB memory if Intel^® TSX is in use.

Status

For the steppings affected, refer to the Summary Table of Changes.

Problem

If an XACQUIRE lock is performed to the address of an Intel^® Processor Trace (Intel^® PT) Table of Physical Addresses (ToPA) table, and that table is later read by the CPU during the HLE (Hardware Lock Elision) transaction, the processor may hang.

Implication

Accessing ToPA tables with XACQUIRE may result in a processor hang.

Workaround

None identified. Software should not access ToPA tables using XACQUIRE. An OS or hypervisor may wish to ensure all application or guest writes to ToPA tables to take page faults or EPT violations.

Status

For the steppings affected, refer to the Summary Table of Changes.

Problem

The PECI (Platform Environmental Control Interface) 3.1 specification’s operating frequency range is 2 Kbps to 2 Mbps. Due to this erratum, PECI may be unreliable when operated out of 3.2Kbps-1Mbps range.

Implication

Platforms attempting to run PECI out of 3.2Kbps-1Mbps range may not behave as expected.

Workaround

None identified. Platforms should limit PECI operating frequency to 3.2Kbps-1Mbps range.

Status

For the steppings affected, refer to the Summary Table of Changes.

Problem

The processor may not meet the PCI Express M. 2 Specification Revision 4. 0, Version 0. 9 receiver Jitter Tolerance (JTol) Minimum Receiver Path Sensitivity requirements when operating at 16.0 GT/s under high temperature conditions.

Implication

Due to this erratum, the processor may exceed receiver jitter tolerance limits when tested at high temperature conditions. Intel^® has not observed any impact to functional behavior or nominal PCIe* compliance testing.

Workaround

None identified.

Status

For the steppings affected, refer to the Summary Table of Changes.

Problem

The processor may fail to access system memory if memory frequency changes between entry and exit of warm reset or S3.

Implication

When this erratum occurs the system may hang.

Workaround

It is possible for the BIOS to contain a workaround for this erratum.

Status

For the steppings affected, refer to the Summary Table of Changes.

Problem

The processor's PCIe* port (Bus 0, Device 6, Function 0) does not transmit the Modified Compliance Test Pattern when in either 2. 5 GT/S or 5. 0 GT/s link speeds.

Implication

Due to this erratum, PCIe* compliance testing may fail at 2. 5 GT/S or 5. 0 GT/s link speeds when enabling Modified Compliance Test Pattern.

Workaround

None Identified.

Status

For the steppings affected, refer to the Summary Table of Changes.

Problem

During a thermal event, MSR IA32_​THERM_​STATUS (19Ch) CURRENT_​LIMIT_​STATUS bit 12 may not reflect the proper value.

Implication

Due to this erratum, software may not be able to determine the cause of the frequency limitation.

Workaround

None Identified.

Status

For the steppings affected, refer to the Summary Table of Changes.

Problem

When exiting Package C10 the system may draw excessive current.

Implication

Due to this erratum, the system may hang.

Workaround

It is possible for the BIOS to contain a workaround for this erratum.

Status

For the steppings affected, refer to the Summary Table of Changes.

Problem

When PROCHOT# is activated during BIOS initialization, the processor may hang with a machine check error reported in IA32_​MCi_​STATUS, with MCACOD (bits [15:0]) value of 0402H, and MSCOD (bits [31:16]) value of 0409H.

Implication

Due to this erratum, the processor may hang.

Workaround

It is possible for the BIOS to contain a workaround for this erratum.

Status

For the steppings affected, refer to the Summary Table of Changes.

Problem

Under complex microarchitectural conditions, when the processor receives a warm reset during BIOS initialization, the processor may hang with a machine check error reported in IA32_​MCi_​STATUS, with MCACOD (bits [15:0]) value of 0400H, and MSCOD (bits [31:16]) value of 0080H.

Implication

Due to this erratum, the processor may hang. Intel^® has only observed this erratum in a synthetic test environment.

Workaround

None identified.

Status

For the steppings affected, refer to the Summary Table of Changes.

Problem

After a Package C10 Exit event, the processor's PCIe* link may fail to retrain.

Implication

When, this erratum occurs, the PCIe* link enters the Link Down state, which may lead to a system failure.

Workaround

It is possible for BIOS to include a workaround for this errata.

Status

For the steppings affected, refer to the Summary Table of Changes.

Problem

MSR_​PKG_​ENERGY_​STATUS (611H) bits[31:0] may not accurately reflect package power.

Implication

Due to this erratum, a higher than expected variation in the reported package power may be observed.

Workaround

It is possible for the BIOS to contain a workaround for this erratum.

Status

For the steppings affected, refer to the Summary Table of Changes.

Problem

The USB3 TD6.5 Compliance Polling LFPS Duration Test fails, because of Electrical Low Frequency Periodic Signalling (LFPS) common mode adjustment.

Implication

Due to this erratum, this compliance test may fail. Intel^® has not observed a compliance test failure on ports with a platform-level retimer. Intel^® has not observed any functional failures due to this erratum.

Workaround

None identified.

Status

For the steppings affected, refer to the Summary Table of Changes.

Problem

The processor may fail to properly initialize internal cache configuration registers during boot.

Implication

Due to this erratum, the system may intermittently hang or exhibit unpredictable system behavior.

Workaround

It is possible for the BIOS to contain a workaround for this erratum.

Status

For the steppings affected, refer to the Summary Table of Changes.

Problem

Processor PCIe* Reference Clock may be unavailable for up to Tpoweron after CLKREQ# is asserted by an end point device while root port is in L1.2.Entry.

Implication

End point devices that rely upon PCIe* Refclk within Tpoweron may lead to PCIe* Link instabilities; including link speed reduction and/or link drop.

Workaround

A BIOS code change has been identified and may be implemented as a mitigation for this erratum.

Status

For the steppings affected, refer to the Summary Table of Changes.

Problem

The DEKEL PHY may fail to resume following PKG-C10.

Implication

Due to this erratum, the CPU PCIe* Link may hang resulting in an inaccessible PCIe* device or a system hang.

Workaround

It is possible for the BIOS to contain a workaround for this erratum.

Status

For the steppings affected, refer to the Summary Table of Changes.

Problem

When a PCIe* endpoint attempts to increase the PCIe* link width after a previous link speed change, the upper lanes of the PCIe* link may fail to train.

Implication

Due to this erratum, a PCIe* link width change may fail and continue to operate at the previously configured link width.

Workaround

Endpoint devices need to perform link width change to maximum supported link width before performing any link speed change.

Status

For the steppings affected, refer to the Summary Table of Changes.

Problem

DDR4 1Rx16 DIMMs cannot achieve optimal memory configuration, which may result in display artifacts.

Implication

Due to this erratum, visible display artifacts such as flickering or glitches may occur.

Workaround

It is possible for a BIOS code change to contain a workaround for this erratum.

Status

For the steppings affected, refer to the Summary Table of Changes.

Problem

Under complex microarchitectural conditions, it is possible for the processor to select an incorrect core operating voltage, which may lead to unpredictable system behavior.

Implication

Due to this erratum, the system may exhibit unpredictable system behavior.

Workaround

It is possible for BIOS to contain a workaround for this erratum.

Status

For the steppings affected, refer to the Summary Table of Changes.

Problem

The processor may hang when exiting a Package (PKG) C9 or deeper state with a machine check exception (MCACOD=0402H, MSCOD=0471H).

Implication

Due to this erratum, the system may hang.

Workaround

It is possible for the BIOS to contain a workaround for this erratum.

Status

For the steppings affected, refer to the Summary Table of Changes.

Problem

If the processor's Type C subsystem enters a TC7 state when the processor enters Package C10, the processor may hang upon Pkg C10 exit without reporting a machine check exception.

Implication

Due to this erratum, the system may hang.

Workaround

It is possible for the BIOS to contain a workaround for this erratum.

Status

For the steppings affected, refer to the Summary Table of Changes.

Problem

Under complex microarchitectural conditions, executing any of the XSAVE, XSAVEOPT, XSAVEC, XSAVES, or VZEROALL instructions shortly after the execution of SYSENTER may result in unexpected SSE/AVX register values.

Implication

Due to this erratum, software may observe unexpected values in the SSE/AVX registers. Intel^® has only observed this erratum in a synthetic test environment.

Workaround

None identified. An operating system’s SYSENTER handler should avoid using executing an XSAVE or VZEROALL instruction in its first ten instructions.

Status

For the steppings affected, refer to the Summary Table of Changes.

Problem

The processor may fail to resume from Package C10 and report an unexpected machine check exception.

Implication

Due to this erratum, the system may report a machine check exception (MSCOD 0403h, MCACOD 0402h, IP_​READY_​WAIT_​TIMEOUT).

Workaround

It is possible for the BIOS to contain a workaround for this erratum.

Status

For the steppings affected, refer to the Summary Table of Changes.

Problem

During Pkg C7 or deeper exit transitions, the processor may cause a display flicker.

Implication

Due to this erratum, a sporadic display flickering may be observed.

Workaround

It may be possible for BIOS to workaround this erratum.

Status

For the steppings affected, refer to the Summary Table of Changes.

Problem

Execution of the VCVTPS2PH instruction with a memory destination may update the MXCSR exceptions flags (bits [5:0]) if the store to memory causes a fault (Example: #PF) or VM exit. The value written to the MXCSR exceptions flags is what would have been written if there were no fault.

Implication

Software may see exceptions flags set in MXCSR, although the instruction has not successfully completed due to a fault on the memory operation. Intel^® has not observed this erratum to affect any commercially available software.

Workaround

None identified.

Status

For the steppings affected, refer to the Summary Table of Changes.

Problem

For platforms that have Intel^® Trusted Execution Technology (Intel^® TXT) (MSR IA32_​FEATURE_​CONTROL (3Ah)[2:1] = ‘11b’) and Total Memory Encryption (TME) enabled (IA32_​TME_​ACTIVATE MSR (0982H), Bit 1 set to 1), software that performs a TXT launch (TXT.STS offset 000h bit 0 (SENTER.DONE.STS) = 1), intends to preserve memory across a warm reset, and performs a warm reset without first tearing down TXT ((TXT.STS offset 000h bit 1 (SEXIT.DONE.STS) = 1), may lead to the memory contents not being preserved.

Implication

Due to this erratum, software that relies on memory content but does not tear down TXT prior to a warm reset may not operate as expected. Intel^® has observed BIOS Update Utilities to be susceptible to this erratum.

Workaround

It may be possible for BIOS to contain a workaround for this erratum.

Status

For the steppings affected, refer to the Summary Table of Changes.

Problem

If the processor root port receives an FetchAdd, Swap, or CAS TLP (an atomic operation) that is erroneous, it should generate a UR completion to the downstream requestor. If the TLP has an operand size greater than 4 bytes, the generated UR completion may report an operand size of 4 bytes, which may be interpreted as a malformed transaction.

Implication

When this erratum occurs, the processor may respond with a malformed transaction.

Workaround

None identified.

Status

For the steppings affected, refer to the Summary Table of Changes.

Problem

A processor hang may result if Intel^® Processor Trace (Intel^®PT) is enabled with Mini Time Counter (MTC) packets and single range output mode (TraceEn[0]=1, MTCEn[9]=1 and ToPA[8]=0 in IA32_​RTIT_​CTL MSR (0570h)), while the output buffer is less than 1 KB in size (IA32_​RTIT_​OUTPUT_​MASK_​PTRS[31:0] MSR (0561h) < 0400h) and it is mapped as uncacheable (UC) or write protect (WP) memory type in the Memory Type Range Registers (MTRRs).

Implication

Due to this erratum, the system may experience an Internal Timer Error Machine Check (IA32_​MCi_​STATUS.MCACOD=400H; bits 15:0). Intel^® has only observed this erratum in a synthetic test environment.

Workaround

Avoid directing Intel^® PT output to an uncacheable buffer less than 1KB in size.

Status

For the steppings affected, refer to the Summary Table of Changes.

Problem

During system boot, a spurious Fully Integrated Voltage Regulator (FIVR) Over-Current Protection (OCP) machine check (IA32_​MC6_​STATUS MSR (419h) with MSCOD (bits[31:16]) value of 0810h and MCACOD (bits[15:0]) value of 0402h) may occur.

Implication

When this erratum occurs, the system may fail to boot.

Workaround

It is possible for the BIOS to contain a workaround for this erratum.

Status

For the steppings affected, refer to the Summary Table of Changes.

Problem

During idle scenarios, the processor may cause the embedded display to flicker.

Implication

Due to this erratum, a sporadic display flickering may be observed.

Workaround

It may be possible to workaround this erratum with a combination of a graphics driver and a BIOS code change.

Status

For the steppings affected, refer to the Summary Table of Changes.

Problem

After an internal timer error has been reported in MC3_​STATUS MSR (0x40d) with MCACOD (bits [15:0]) value of 0400H, and MSCOD (bits [31:16]) value of 0080H, under complex micro-architectural conditions, a false error may be reported in MC1_​STATUS MSR (0x405) with MCACOD 0x174 or MCACOD 0x124.

Implication

Due to this erratum, a false MCE may be reported in MC1_​STATUS MSR. Intel^® has only observed this erratum in a synthetic test environment.

Workaround

Software should ignore the MC1_​STATUS error when it appears with an internal timer error.

Status

For the steppings affected, refer to the Summary Table of Changes.

Problem

When the PCIe* Link exits the L1.2 low-power link state, the link may fail to correctly train to L0.

Implication

Due to this erratum, a PCIe* link may incur unexpected link recovery events or it may enter a Link_​Down state.

Workaround

It may be possible for a BIOS code change to workaround this erratum.

Status

For the steppings affected, refer to the Summary Table of Changes.

Problem

During S3/S4/S5 and/or S0ix cycles, DMI may fail to exit L1 in the time required.

Implication

The system may hang with a machine check exception (MCACOD=2AH).

Workaround

It is possible for a BIOS code change to workaround this erratum.

Status

For the steppings affected, refer to the Summary Table of Changes.

Problem

Setting MISC_​FEATURE_​CONTROL.DISABLE_​THREE_​STRIKE_​CNT (bit 11 in MSR 1A4h) does not prevent the three-strike counter from incrementing as documented; instead, it only prevents the signaling of the three-strike event once the counter has expired.

Implication

Due to this erratum, software may be able to see the three-strike logged in the MC3_​STATUS (MSR 40Dh, MCACOD = 400h [bits 15:0]) even when MISC_​FEATURE_​CONTROL.DISABLE_​THREE_​STRIKE_​CNT is set.

Workaround

None Identified.

Status

For the steppings affected, refer to the Summary Table of Changes.

Problem

When Intel^® PT (Intel^® Processor Trace) is enabled and a direct unconditional branch clears IA32_​RTIT_​STATUS.FilterEn (MSR 571H, bit 0), due to this erratum, the resulting TIP.PGD (Target IP Packet, Packet Generation Disable) may not have an IP payload with the target IP.

Implication

It may not be possible to tell which instruction in the flow caused the TIP.PGD using only the information in trace packets when this erratum occurs.

Workaround

The Intel^® PT trace decoder can compare direct unconditional branch targets in the source with the FilterEn address range(s) to determine which branch cleared FilterEn.

Status

For the steppings affected, refer to the Summary Table of Changes.

Problem

Some Intel^® Processor Trace packets should be issued only between TIP.PGE (Target IP Packet.Packet Generation Enable) and TIP.PGD (Target IP Packet.Packet Generation Disable) packets. Due to this erratum, when a TIP.PGE packet is generated it may be preceded by a PSB+ (Packet Stream Boundary) that incorrectly includes FUP (Flow Update Packet) and MODE.Exec packets.

Implication

Due to this erratum, FUP and MODE.Exec may be generated unexpectedly.

Workaround

Decoders should ignore FUP and MODE.Exec packets that are not between TIP.PGE and TIP.PGD packets.

Status

For the steppings affected, refer to the Summary Table of Changes.

Problem

Due to a rare microarchitectural condition, the second byte of a 2-byte CYC (Cycle Count) packet may be dropped without an OVF (Overflow) packet.

Implication

A trace decoder may signal a decode error due to the lost trace byte.

Workaround

None identified. A mitigation is available for this erratum. If a decoder encounters a multi-byte CYC packet where the second byte has bit 0 (Ext) set to 1, it should assume that 4095 cycles have passed since the prior CYC packet, and it should ignore the first byte of the CYC and treat the second byte as the start of a new packet.

Status

For the steppings affected, refer to the Summary Table of Changes.

Problem

If VM entry clears Intel^® PT (Intel^® Processor Trace) IA32_​RTIT_​CTL.TraceEn (MSR 570H, bit 0) while PacketEn is 1 then a FUP (Flow Update Packet) may precede the TIP.PGD (Target IP Packet, Packet Generation Disable). VM entry can clear TraceEn if the VM-entry MSR-load area includes an entry for the IA32_​RTIT_​CTL MSR.

Implication

When this erratum occurs, an unexpected FUP may be generated that creates the appearance of an asynchronous event taking place immediately before or during the VM entry.

Workaround

The Intel^® PT trace decoder may opt to ignore any FUP whose IP matches that of a VM entry instruction.

Status

For the steppings affected, refer to the Summary Table of Changes.

Problem

Under complex micro-architectural conditions, when using Intel^® Processor Trace (Intel^® PT) with single range output larger than 4KB, disabling PT and then enabling PT using the TraceEn bit in IA32_​RTIT_​CTL MSR (MSR 570h, bit 0) may cause incorrect output values to be recorded.

Implication

Due to this erratum, a PT trace may contain incorrect values.

Workaround

None identified. Software should avoid using PT with single range output larger than 4KB.

Status

For the steppings affected, refer to the Summary Table of Changes.

Problem

A #GP (global protection exception) that results from an instruction being longer than 15 bytes is prioritized and served before a #CP (Controlflow Protection exception) that was created due to a missing ENDBRx instruction at the target of an indirect branch.

Implication

Due to this erratum, during an indirect jump with ENDBRANCH tracking, if the processor lands on an illegal instruction with length longer than 15 bytes or that decodes to a CS limit, the processor may prioritize and deliver a #GP exception over the #CP exception.

Workaround

None Identified.

Status

For the steppings affected, refer to the Summary Table of Changes.

Problem

Under complex microarchitectural conditions, on systems with Control-flow Enforcement Technology (CET) enabled, hitting a predefined data breakpoint may not be reported in B0-B3 (bits 3:0) in the DR6 register if that breakpoint was set on the legacy code page bitmap.

Implication

Due to this erratum, software may not know which breakpoint triggered when setting breakpoints on the legacy code page bitmap.

Workaround

None Identified.

Status

For the steppings affected, refer to the Summary Table of Changes.

Problem

On systems that enable Control-flow Enforcement Technology shadow-stack (CET-SS) in supervisor mode, an inter-privilege level far CALL or event delivery switches the shadow stack to a supervisor shadow stack. During this switch, the processor fails to signal a #GP exception if the 32-byte region comprised of 8 bytes containing the supervisor shadow stack token and the following 24-byte stack frame are not 32-byte aligned on the shadow stack.

Implication

Due to this erratum, on systems that enable CET-SS in supervisor mode, system software that fails to properly 32-byte align the supervisor shadow stack token may incorrectly mark the supervisor shadow stack token as busy, preventing re-entry into the supervisor thread by generating an unexpected #GP exception unrelated to stack token alignment.

Workaround

It may be possible for BIOS to contain a workaround for this erratum.

Status

For the steppings affected, refer to the Summary Table of Changes.

Problem

When hot-plugging a USB 3.0 Device that is connected through a Type A to Type C cable, the device may not be detected or may down train to USB 2.0 speed when connected to a Type-C port.

Implication

Due to this erratum, a USB 3.0 Device may not be detected or may down train to USB 2.0 speed.

Workaround

It may be possible for BIOS code changes to workaround this erratum.

Status

For the steppings affected, refer to the Summary Table of Changes.

Problem

In 32-bit mode, a call instruction wrapping around the 32-bit address should save a return address near the bottom of the address space (low address) around address zero. Under complex micro-architectural conditions, a return instruction following such a call may return to the next sequential address instead (high address).

Implication

Due to this erratum, In 32-bit mode a return following a call instruction that wraps around the 32-bit address boundary may return to the next sequential IP without wrapping around the address, possibly resulting in a #PF. Intel^® has not observed this behavior on any commercially available software.

Workaround

Software should not place call instructions in addresses that wrap around the 32-bit address space in 32-bit mode.

Status

For the steppings affected, refer to the Summary Table of Changes.

Problem

On USB 3.2 Gen 1x1 only capable ports, including ports configured as USB 3.2 Gen 1x1 by soft strap, the xHCI controller may send only 15 LFPS signals instead of a burst of 16 LFPS signals as specified by the USB 3.2 specification.

Implication

There are no known functional implications due to this erratum. LFPS handshake requires the receiver link partner to only detect 2 LFPS signals. This issue may impact the SuperSpeed compliance test case which checks for the 16 LFPS burst requirements: TD6.4, TD6.5, and TD7.31.

Workaround

None identified.

Status

For the steppings affected, refer to the Summary Table of Changes.

Problem

Under complex micro-architectural conditions, an L2 prefetch MCE that should be reported with MCACOD 165h in IA32_​MC3_​STATUS MSR (MSR 40dh, bits [15:0]) may be reported with an MCACOD of 101h.

Implication

Due to this erratum, the reported MCACOD for this MCE may be incorrect.

Workaround

None identified.

Status

For the steppings affected, refer to the Summary Table of Changes.

Problem

The Crashlog and Telemetry PM_​BAR register (Bus 0, Device 10, Function 0, Offset 10h) does not correctly implement the BAR sizing function. It reports a 32K BAR, but the BAR requires 64K memory alignment.

Implication

Due to this erratum, if PM_​BAR is 32K aligned, but not 64K aligned, accesses to the BAR may fail.

Workaround

None identified. BIOS must ensure that this BAR is 64K aligned.

Status

For the steppings affected, refer to the Summary Table of Changes.

Problem

When the Fast Store Forwarding Predictor (FSFP) is enabled, the LFENCE instruction may allow older stores to be predictively forwarded to younger loads.

Implication

Due to this erratum, software that relies on the LFENCE instruction to prevent FSFP forwarding may not behave as expected.

Workaround

It may be possible for BIOS to contain a workaround for this Erratum.

Status

For the steppings affected, refer to the Summary Table of Changes.

Problem

GPU may hang when Async Compute is enabled

Implication

Due to this erratum, the GPU may hang when running high bandwidth GFx application such as benchmarks and/or games.

Workaround

None identified. The Async Compute feature may be disabled in a graphics driver update. See GFx Driver Revenue SV2 PR5 (101.3616 or later) and release notes.

Status

For the steppings affected, refer to the Summary Table of Changes.

Problem

Under complex microarchitectural conditions, the branch predictor may produce an incorrect instruction pointer leading to unpredictable system behavior.

Implication

Due to this erratum, the system may exhibit unpredictable behavior.

Workaround

It may be possible for BIOS to contain a workaround for this erratum.

Status

For the steppings affected, refer to the Summary Table of Changes.

Problem

The processor accesses to TME exclude range may be encrypted but not decrypted if mapped to remap range.

Implication

Due to this erratum, the processor exclude range it may be encrypted but may but not decrypted if mapped to remap range.

Workaround

It may be possible for BIOS to workaround this erratum.

Status

For the steppings affected, refer to the Summary Table of Changes.

Problem

The xHCI controller does not return the correct completion code for the Force Header Command as defined in the Section 4.6.16 of the eXtensible Host Controller Interface for Universal Serial Bus (xHCI) Requirements Specification Rev 1.2.

Implication

xHCI CV TD4.12 - Force Header Command Test may report an error. Intel^® has obtained a waiver for TD 4.12. The Force Header Command is only used by the USB-IF Command Verifier (xHCI CV) tool for device testing. There are no known functional failures due to this erratum.

Workaround

None identified.

Status

For the steppings affected, refer to the Summary Table of Changes.

Problem

Platform designs with discrete graphics may hang upon removal of a USB Type-C monitor from the system.

Implication

Due to this erratum the system may hang.

Workaround

It is possible for BIOS to contain a workaround for this erratum.

Status

For the steppings affected, refer to the Summary Table of Changes.

Problem

The USB 3.2 Debug Class Device (DbC) reports an incorrect Sublink Speed Attribute ID (SSID) value in the SuperSpeedPlus USB Device Capability field.

Implication

Due to this erratum, the processor USB 3.2.DbC (Debug Capability) device may fail to enumerate when connected to a USB 3.2 Gen 2x1 port.

Workaround

None identified.

Status

For the steppings affected, refer to the Summary Table of Changes.

Problem

Under complex microarchitectural conditions, the processor may hang when executing a microcode update (MCU) by writing to IA32_​BIOS_​UPDT_​TRIG (MSR 79h).

Implication

Due to this erratum, processor may hang during a microcode update.

Workaround

It may be possible for BIOS to contain a workaround for this erratum.

Status

For the steppings affected, refer to the Summary Table of Changes.

Problem

A delay in the availability of LCRD1 (Link Credit 1) from a USB 3.2 hub, with two or more downstream USB 3.2 bulk endpoint devices engaged in SuperSpeedPlus concurrent transfers, may lead to the connected xHCI controller sending the ACK and Status of a transfer packet out of order.

Implication

Due to this erratum, a USB 3.2 bulk endpoint device may not respond to subsequent transfers. It may be possible for a device driver to recover the USB 3.2 device.

Workaround

None identified.

Status

For the steppings affected, refer to the Summary Table of Changes.

Problem

The xHCI controller may fail to handle a zero-length data packet when doing concurrent traffic with the following devices connected on three separate root ports:

• USB 3.2 Gen 2x1 (or 2x2) hub with at least two USB 3.2 bulk devices.
• USB 3.2 Gen 2x1 (or 2x2) hub with at least two USB 3.2 bulk devices.
• USB isochronous device that sends zero-length data packets.

Implication

Due to this erratum, the xHCI controller may hang. Intel has only observed this behavior with USB audio offload enabled and USB 2.0 audio devices that send zero-length data packets.

Workaround

None identified.

Status

For the steppings affected, refer to the Summary Table of Changes.

Problem

When the Intel® Processor Trace (Intel® PT) CR3-filtering mechanism is enabled using the CR3Filter bit in IA32_​RTIT_​CTL MSR (MSR 570h, bit 7), CR3 control register bits [63:52] are not compared with the IA32_​RTIT_​CR3_​MATCH MSR (MSR 572h) value.

Implication

Due to this erratum, software that relies upon the IA32_​RTIT_​CTL MSR (bit 7) may function incorrectly.

Workaround

None identified. Software may mitigate this erratum by copying the CR3 register value into IA32_​RTIT_​CR3_​MATCH MSR.

Status

For the steppings affected, refer to the Summary Table of Changes.

Problem

When branch tracing is enabled using branch trace store (BTS) during a task switch, the processor reports the linear address of the branch target in the branch record field "Last Branch from" instead of the linear address of the instruction from which branch was taken.

Implication

Due to this erratum, debug tools relying on BTS may misinterpret control flow.

Workaround

None identified. Software should avoid using BTS to determine the accuracy of branch prediction.

Status

For the steppings affected, refer to the Summary Table of Changes.

Problem

When the Intel® Processor Trace (Intel® PT) is enabled by setting VM-Entry control field "Load IA32_​RTIT_​CTL" (bit 18) and an event is injected during STM (SMM-transfer monitor) to VMX transition (root or non-root), the following VMCS fields may be incorrect: VM-entry interruption-information field (4016h) VM-entry exception error code (4018h) VM-entry instruction length (401Ah)

Implication

Due to this erratum, the processor may enter HLT state or report an incorrect value in the VMCS IDT-vectoring information field (4408h).

Workaround

A mitigation for this erratum is for software (VMM) to verify the VMCS fields on the next VM exit before executing vmresume.

Status

For the steppings affected, refer to the Summary Table of Changes.

Problem

Writes to the MPX_​FUSE_​OVERRIDE (MSR 0xA6h) register may enable the deprecated Intel® Memory Protection Extensions (Intel® MPX).

Implication

Due to this erratum, a General Protection (#GP) may occur.

Workaround

It may be possible for the BIOS to contain a workaround for this erratum.

Status

For the steppings affected, refer to the Summary Table of Changes.