Intel CORE 2 DUO E4000 - SPECIFICATION UPDATE 3-2008 Specification page 45

Errata
In IA-32e mode, if a MOVSS or POPSS instruction with a debug breakpoint is
Problem:
followed by the SYSRET instruction; incorrect information may exist in the
Debug Status Register (DR6).
Implication: When debugging or when developing debuggers, this behavior should be
noted. This erratum will not occur under normal usage of the MOVSS or
POPSS instructions (i.e., following them with a MOV ESP instruction).
Workaround: Do not attempt to put a breakpoint on MOVSS and POPSS instructions that
are followed by a SYSRET.
For the steppings affected, see the Summary Tables of Changes.
Status:
AI62. EFLAGS Discrepancy on a Page Fault After a Multiprocessor TLB
Shootdown
This erratum may occur when the processor executes one of the following
Problem:
read-modify-write arithmetic instructions and a page fault occurs during the
store of the memory operand: ADD, AND, BTC, BTR, BTS, CMPXCHG, DEC,
INC, NEG, NOT, OR, ROL/ROR, SAL/SAR/SHL/SHR, SHLD, SHRD, SUB, XOR,
and XADD. In this case, the EFLAGS value pushed onto the stack of the page
fault handler may reflect the status of the register after the instruction would
have completed execution rather than before it. The following conditions are
required for the store to generate a page fault and call the operating system
page fault handler:
• The store address entry must be evicted from the DTLB by speculative loads from
other instructions that hit the same way of the DTLB before the store has
completed. DTLB eviction requires at least three-load operations that have linear
address bits 15:12 equal to each other and address bits 31:16 different from each
other in close physical proximity to the arithmetic operation.
• The page table entry for the store address must have its permissions tightened
during the very small window of time between the DTLB eviction and execution of
the store. Examples of page permission tightening include from Present to Not
Present or from Read/Write to Read Only, etc.
• Another processor, without corresponding synchronization and TLB flush, must
cause the permission change.
Implication: This scenario may only occur on a multiprocessor platform running an
operating system that performs "lazy" TLB shootdowns. The memory image
of the EFLAGS register on the page fault handler's stack prematurely contains
the final arithmetic flag values although the instruction has not yet
completed. Intel has not identified any operating systems that inspect the
arithmetic portion of the EFLAGS register during a page fault nor observed
this erratum in laboratory testing of software applications.
Workaround: No workaround is needed upon normal restart of the instruction, since this
erratum is transparent to the faulting code and results in correct instruction
behavior. Operating systems may ensure that no processor is currently
®
Intel Core™2 Extreme Processor X6800 and
®
Intel Core™2 Duo Desktop Processor E6000 and E4000 Sequence
Specification Update
45