Intel ATOM PROCESSOR N 500 - UPDATE REVISION 001 User manual

Document Number: 324341-001
Intel® Atom™ Processor N500
Series
Specification Update
September 2010
Revision 001

2Specification Update
INFORMATION IN THIS DOCUMENT IS PROVIDED IN CONNECTION WITH INTEL® PRODUCTS. NO LICENSE, EXPRESS OR
IMPLIED, BY ESTOPPEL OR OTHERWISE, TO ANY INTELLECTUAL PROPERTY RIGHTS IS GRANTED BY THIS DOCUMENT. EXCEPT
AS PROVIDED IN INTEL’S TERMS AND CONDITIONS OF SALE FOR SUCH PRODUCTS, INTEL ASSUMES NO LIABILITY
WHATSOEVER, AND INTEL DISCLAIMS ANY EXPRESS OR IMPLIED WARRANTY, RELATING TO SALE AND/OR USE OF INTEL
PRODUCTS INCLUDING LIABILITY OR WARRANTIES RELATING TO FITNESS FOR A PARTICULAR PURPOSE, MERCHANTABILITY,
OR INFRINGEMENT OF ANY PATENT, COPYRIGHT OR OTHER INTELLECTUAL PROPERTY RIGHT.
UNLESS OTHERWISE AGREED IN WRITING BY INTEL, THE INTEL PRODUCTS ARE NOT DESIGNED NOR INTENDED FOR ANY
APPLICATION IN WHICH THE FAILURE OF THE INTEL PRODUCT COULD CREATE A SITUATION WHERE PERSONAL INJURY OR
DEATH MAY OCCUR.
Intel may make changes to specifications and product descriptions at any time, without notice. Designers must not rely on the
absence or characteristics of any features or instructions marked “reserved” or “undefined.” Intel reserves these for future
definition and shall have no responsibility whatsoever for conflicts or incompatibilities arising from future changes to them. The
information here is subject to change without notice. Do not finalize a design with this information.
Intel® Atom™ Processor N500 series may contain design defects or errors known as errata which may cause the product to
deviate from published specifications. Current characterized errata are available on request.
Intel processor numbers are not a measure of performance. Processor numbers differentiate features within each processor
family, not across different processor families. Over time processor numbers will increment based on changes in clock, speed,
cache, FSB, or other features, and increments are not intended to represent proportional or quantitative increases in any
particular feature. Current roadmap processor number progression is not necessarily representative of future roadmaps.
See www.intel.com/products/processor_number for details.
Contact your local Intel sales office or your distributor to obtain the latest specifications and before placing your product order.
Enhanced Intel SpeedStep® Technology for specified units of this processor available Q2/06. See the Processor Spec Finder
at http://processorfinder.intel.com or contact your Intel representative for more information.
Intel, Intel Atom and Intel logo are trademarks of Intel Corporation in the U.S. and other countries.
*Other names and brands may be claimed as the property of others.
Copyright © 2010, Intel Corporation. All rights reserved.

Specification Update 3
Contents
Preface ...............................................................................................................................5
Identification Information ......................................................................................................8
Summary Tables of Changes ................................................................................................10
Errata...............................................................................................................................14
Specification Changes .........................................................................................................31
Specification Clarifications ...................................................................................................32
Documentation Changes......................................................................................................33

4Specification Update
Revision History
Document
Number Revision Description Date
324341 001 •Initial Release September 2010
§

Preface
Specification Update 5
Preface
This document contains information specific to the Intel® Atom™ Processor N500
series. It is a Compilation of:
•Device sightings
•Document sightings
•Specification clarifications
•Specification changes
It is intended for hardware system manufacturers and software developers.
Information types defined in the Nomenclature section of this document are
consolidated into this document and are no longer published in other documents. This
Affected Documents
Document Title Document
Number/
Location1
Intel® Atom™ Processor N400 series and N500 series External Design
Specifications (EDS) – Volume 1 403526
Intel® Atom™ Processor N400 series and N500 series External Design
Specifications (EDS) – Volume 2 403528
RS – Pineview Processor BIOS Writer’s Guide (BWG), Volume 1 Contact your Intel
representative for
the latest revision.
RS – Pineview Processor BIOS Writer’s Guide (BWG), Volume 2 Contact your Intel
representative for
the latest revision.
NOTES:
1. Contact your Intel representative to receive the latest revisions of these documents.

Preface
6Specification Update
Related Documents
Document Title Document
Number/
Location1
Intel®64 and IA-32 Architectures Software Developer’s Manual
Documentation Changes 252046
Intel®64 and IA-32 Architectures Software Developer’s Manual, Volume
1: Basic Architecture 253665
Intel®64 and IA-32 Architectures Software Developer’s Manual, Volume
2A: Instruction Set Reference, A-M 253666
Intel®64 and IA-32 Architectures Software Developer’s Manual, Volume
2B: Instruction Set Reference, N-Z 253667
Intel®64 and IA-32 Architectures Software Developer’s Manual, Volume
3A: System Programming Guide 253668
Intel®64 and IA-32 Architectures Software Developer’s Manual, Volume
3B: System Programming Guide 253669
IA-32 Intel®Architectures Optimization Reference Manual 248966
Intel®Processor Identification and the CPUID Instruction Application Note
(AP-485) 241618
Intel®64 and IA-32 Architectures Application Note TLBs, Paging-Structure
Caches, and Their Invalidation 317080
Nomenclature
Errata are design defects or errors. These may cause the processor behavior to
deviate from published specifications. Hardware and software designed to be used
with any given stepping must assume that all errata documented for that stepping are
present on all devices.
S-Spec Number is a five-digit code used to identify products. Products are
differentiated by their unique characteristics, for example, core speed, L2 cache size,
package type, etc. as described in the processor identification information table. Read
all notes associated with each S-Spec number.
QDF Number is a four digit code used to distinguish between engineering samples.
These samples are used for qualification and early design validation. The functionality
of these parts can range from mechanical only to fully functional. This document has a
processor identification information table that lists these QDF numbers and the
corresponding product details.
Specification Changes are modifications to the current published specifications.
These changes will be incorporated in any new release of the specification.
Specification Clarifications describe a specification in greater detail or further
highlight a specification’s impact to a complex design situation. These clarifications
will be incorporated in any new release of the specification.

Preface
Specification Update 7
Documentation Changes include typos, errors, or omissions from the current
published specifications. These will be incorporated in any new release of the
specification.
Note: Errata remain in the specification update throughout the product’s lifecycle, or until a
particular stepping is no longer commercially available. Under these circumstances,
errata removed from the specification update are archived and available upon request.
Specification changes, specification clarifications and documentation changes are
removed from the specification update when the appropriate changes are made to the
appropriate product specification or user documentation (datasheets, manuals, etc.).
§

Identification Information
8Specification Update
Identification Information
Intel® Atom™ Processor N500 series processor on 45-nm process stepping can be
identified by the following register contents:
Table 1. Component Identification via Programming Interface
Reserved Extended
Family1Extended Model2Reserved Processor Type3Family Code4Model Number5Stepping ID6
31:28 27:20 19:16 15:13 12 11:8 7:4 3:0
0000000b 0001b 0b 0110b 1100b XXXXb
NOTES:
1. The Extended Family, bits [27:20] are used in conjunction with the Family Code,
specified in bits [11:8], to indicate whether the processor belongs to the Intel386®,
Intel486®, Pentium®, Pentium Pro, Pentium 4, Atom or Intel Core processor family.
2. The Extended Model, bits [19:16] in conjunction with the Model Number, specified in
bits [7:4], are used to identify the model of the processor within the processor’s family.
3. The Processor Type, specified in bits [13:12] indicates whether the processor is an
original OEM processor, an OverDrive processor, or a dual processor (capable of being
used in a dual processor system).
4. The Family Code corresponds to bits [11:8] of the EDX register after RESET, bits [11:8]
of the EAX register after the CPUID instruction is executed with a 1 in the EAX register,
and the generation field of the Device ID register accessible through Boundary Scan.
5. The Model Number corresponds to bits [7:4] of the EDX register after RESET, bits [7:4]
of the EAX register after the CPUID instruction is executed with a 1 in the EAX register,
and the model field of the Device ID register accessible through Boundary Scan.
6. The Stepping ID in bits [3:0] indicates the revision number of that model. See Table 2
for the processor stepping ID number in the CPUID information.
When EAX is initialized to a value of 1, the CPUID instruction returns the Extended
Family, Extended Model, Type, Family, Model and Stepping value in the EAX register.
Note that the EDX processor signature value after reset is equivalent to the processor
signature output value in the EAX register.

Identification Information
Specification Update 9
Component Marking Information
Intel® Atom™ Processor N500 series is identified by the following component
markings.
Figure 1. Intel® Atom™ Processor N500 Series (Micro-FCBGA8) Markings
SAMPLE MARK EXAMPLE:
GRP1LINE1 : INTEL{M}{C}’YY {e1}
GRP2LINE1 : {FPO} S-Spec Processor#
Table 2. Identification Table for Intel® Atom™ Processor N500 Series
QDF /
S-Spec MM# Product Stepping
Processor
# CPUID
Core Speed
Package Cache Size
(KB)
Highest
Freq. Mode
(HFM)
Lowest
Freq.
Mode (LFM)
Q4MF 908135 B0 N550 QS 000106CAh 1.50 GHz 1.00 GHz Micro-
FCBGA8 2 x 512
SLBXF 908140 B0 N550 Pro. 000106CAh 1.50 GHz 1.00 GHz Micro-
FCBGA8 2 x 512
§

Summary Tables of Changes
10 Specification Update
Summary Tables of Changes
The table included in this section indicated the sightings that apply to the Intel Atom
Processor N500 series. If a sighting becomes an Erratum, Intel may fix some of the
errata in a future stepping of the component, and account for the other outstanding
issues through documentation or specification changes as noted. This table uses the
following notations:
Codes Used in Summary Table
Stepping
X: This sighting applies to this stepping.
Blank (No mark): This sighting is fixed, or does not exist, in the listed stepping.
Status
Plan Fix: Root caused to a silicon issue and will be fixed in a future stepping.
Fixed: Root caused to a silicon issue and has been fixed in a subsequent stepping.
No Fix:Root caused to a silicon issue that will not be fixed.
Spec Change: Root caused to a specification error that will be updated.
Open, Under Investigation: A root cause has not been determined.
Not Reproducible: The sighting could not be reproduced after it was reported.
Third Party: Root caused to a board, software, driver, BIOS, or third party silicon
issue.
Row
Shaded: This item is either new or modified from the previous version of
the document.

Summary Tables of Changes
Specification Update 11
Number Stepping Status Description
B0
BH1 X No Fix An xTPR Update Transaction Cycle, if Enabled, May be Issued to the FSB after
the Processor has Issued a Stop-Grant Special Cycle
BH2 X No Fix The Processor May Report a #TS Instead of a #GP Fault
BH3 X No Fix Writing the Local Vector Table (LVT) when an Interrupt is Pending May Cause
an Unexpected Interrupt
BH4 X No Fix MOV To/From Debug Registers Causes Debug Exception
BH5 X No Fix A Write to an APIC Register Sometimes May Appear to Have Not Occurred
BH6 X No Fix Using 2M/4M Pages When A20M# Is Asserted May Result in Incorrect Address
Translations
BH7 X No Fix Value for LBR/BTS/BTM will be Incorrect after an Exit from SMM
BH8 X No Fix Incorrect Address Computed For Last Byte of FXSAVE/FXRSTOR Image Leads to
Partial Memory Update
BH9 X No Fix A Thermal Interrupt is Not Generated when the Current Temperature is Invalid
BH10 X No Fix Programming the Digital Thermal Sensor (DTS) Threshold May Cause
Unexpected Thermal Interrupts
BH11 X No Fix Returning to Real Mode from SMM with EFLAGS.VM Set May Result in
Unpredictable System Behavior
BH12 X No Fix Fault on ENTER Instruction May Result in Unexpected Value on Stack Frame
BH13 X No Fix With TF (Trap Flag) Asserted, FP Instruction That Triggers an Unmasked FP
Exception May Take Single Step Trap before Retirement of Instruction
BH14 X No Fix An Enabled Debug Breakpoint or Single Step Trap May Be Taken after MOV
SS/POP SS Instruction if it is Followed by an Instruction That Signals a Floating
Point Exception
BH15 X No Fix Code Segment Limit/Canonical Faults on RSM May be Serviced before Higher
Priority Interrupts/Exceptions and May Push the Wrong Address Onto the Stack
BH16 X No Fix BTS(Branch Trace Store) and PEBS(Precise Event Based Sampling) May Update
Memory outside the BTS/PEBS Buffer
BH17 X No Fix Single Step Interrupts with Floating Point Exception Pending May Be Mishandled
BH18 X No Fix Unsynchronized Cross-Modifying Code Operations Can Cause Unexpected
Instruction Execution Results
BH19 X No Fix A Page Fault May Not be Generated When the PS bit is set to “1” in a PML4E or
PDPTE
BH20 X No Fix IO_SMI Indication in SMRAM State Save Area May be Set Incorrectly

Summary Tables of Changes
12 Specification Update
Number Stepping Status Description
B0
BH21 X No Fix Writes to IA32_DEBUGCTL MSR May Fail when FREEZE_LBRS_ON_PMI is Set
BH22 X No Fix Address Reported by Machine-Check Architecture (MCA) on L2 Cache Errors
May be Incorrect
BH23 X No Fix Performance Monitoring Event for Outstanding Bus Requests Ignores
AnyThread Bit
BH24 X No Fix Corruption of CS Segment Register During RSM While Transitioning From Real
Mode to Protected Mode
BH25 X No Fix GP and Fixed Performance Monitoring Counters With AnyThread Bit Set May
Not Accurately Count Only OS or Only USR Events
BH26 X No Fix PMI Request is Not Generated on a Counter Overflow if Its OVF Bit is Already
Set in IA32_PERF_GLOBAL_STATUS
BH27 X No Fix Processor May Use an Incorrect Translation if the TLBs Contain Two Different
Translations For a Linear Address
BH28 X No Fix PEBS Record not Updated when in Probe Mode
BH29 X No Fix LBR/BTM/BTS Information Immediately After a Transition From
Legacy/Compatibility Mode to 64-bit Mode May be Incorrect
BH30 X No Fix During a C-State Exit due to a Pending External Interrupt the System May Hang
BH31 X No Fix Pending x87 FPU Exceptions (#MF) Following STI May Be Serviced Before
Higher Priority Interrupts
BH32 X No Fix Benign Exception after a Double Fault May Not Cause a Triple Fault Shutdown
BH33 X No Fix IA32_MC1_STATUS MSR Bit[60] Does Not Reflect Machine Check Error
Reporting Enable Correctly
BH34 X No Fix LINT0 Assertion and Deassertion During an Inactive State May Cause
Unexpected Operation When APIC is Disabled
BH35 X No Fix IRET under Certain Conditions May Cause an Unexpected Alignment Check
Exception
BH36 X No Fix HSYNC and VSYNC Buffers Do Not Meet VESA Rise and Undershoot
Specification
BH37 X No Fix Glitch on LVDS Display Interface Clocks and Data Lines May be Observed
During Power Up Sequence
BH38 X No Fix Synchronous Reset of IA32_MPERF on IA32_APERF Overflow May Not Work
BH39 X No Fix Writes to Set IA32_MCG_STATUS.MCIP Will Fail
BH40 X No Fix IA32_MC2_STATUS [OVERFLOW] Bit is Not Set When Single-Bit Correctable
ECC Error Occurs
BH41 X No Fix FP Data Operand Pointer May Be Incorrectly Calculated After an FP Access
Which Wraps a 64-Kbyte Boundary in 16-Bit Code
BH42 X No Fix High Temperature Circuit Marginality Issue May Cause the System to Hang or
Auto Reboot

Summary Tables of Changes
Specification Update 13
Number SPECIFICATION CHANGES
There are no Specification Changes in this revision of the specification Update
Number SPECIFICATION CLARIFICATIONS
There are no Specification Clarifications in this revision of the specification Update
Number DOCUMENTATION CHANGES
There are no Document Changes in this revision of the specification Update
§

Errata
14 Specification Update
Errata
BH1 An xTPR Update Transaction Cycle, if Enabled, May be Issued to the
FSB after the Processor has Issued a Stop-Grant Special Cycle
Problem: According to the FSB (Front Side Bus) protocol specification, no FSB cycles should be
issued by the processor once a Stop-Grant special cycle has been issued to the bus. If
xTPR update transactions are enabled by clearing the IA32_MISC_ENABLES[bit-23] at
the time of Stop-Clock assertion, an xTPR update transaction cycle may be issued to
the FSB after the processor has issued a Stop Grant Acknowledge transaction.
Implication: When this erratum occurs in systems using C-states C2 (Stop-Grant State) and higher
the result could be a system hang.
Workaround: BIOS must leave the xTPR update transactions disabled (default).
Status: For the steppings affected, see the Summary Tables of Changes.
BH2 Processor May Report a #TS Instead of a #GP Fault
Problem: During system reset, there is insufficient time for handshake between ICH and GMCH
LVDS logic. As a result, timing from panel backlight enable going low to LVDS data
going low (TX) and timing from LVDS data going low to panel VCC enable going low
(T3) do not match the programmed values. Panel backlight enable (LBKLT_EN), panel
Vcc enable (LVDD_EN) and LVDS data lines go low at the same time.
Implication: A jump to a busy TSS (Task-State Segment) may cause a #TS (invalid TSS exception)
instead of a #GP fault (general protection exception).
Workaround: None.
Status: For the steppings affected, see the Summary Tables of Changes.

Errata
Specification Update 15
BH3 Writing the Local Vector Table (LVT) when an Interrupt is Pending
May Cause an Unexpected Interrupt
Problem: If a local interrupt is pending when the LVT entry is written, an interrupt may be taken
on the new interrupt vector even if the mask bit is set.
Implication: An interrupt may immediately be generated with the new vector when a LVT entry is
written, even if the new LVT entry has the mask bit set. If there is no Interrupt
Service Routine (ISR) set up for that vector the system will GP fault. If the ISR does
not do an End of Interrupt (EOI) the bit for the vector is left set in the in-service
register and mask all interrupts at the same or lower priority.
Workaround: Any vector programmed into an LVT entry must have an ISR associated with it, even
if that vector was programmed as masked. This ISR routine must do an EOI to clear
any unexpected interrupts that may occur. The ISR associated with the spurious
vector does not generate an EOI; therefore the spurious vector should not be used
when writing the LVT.
Status: For the steppings affected, see the Summary Tables of Changes.
BH4 MOV To/From Debug Registers Causes Debug Exception
Problem: When in V86 mode, if a MOV instruction is executed to/from a debug registers, a
general-protection exception (#GP) should be generated. However, in the case when
the general detect enable flag (GD) bit is set, the observed behavior is that a debug
exception (#DB) is generated instead.
Implication: With debug-register protection enabled (i.e., the GD bit set), when attempting to
execute a MOV on debug registers in V86 mode, a debug exception is generated
instead of the expected general-protection fault.
Workaround: In general, operating systems do not set the GD bit when they are in V86 mode. The
GD bit is generally set and used by debuggers. The debug exception handler should
check that the exception did not occur in V86 mode before continuing. If the exception
did occur in V86 mode, the exception may be directed to the general-protection
exception handler.
Status: For the steppings affected, see the Summary Tables of Changes.

Errata
16 Specification Update
BH5 A Write to an APIC Register Sometimes May Appear to Have Not
Occurred
Problem: With respect to the retirement of instructions, stores to the uncacheable memory
based APIC register space are handled in a non-synchronized way. For example if an
instruction that masks the interrupt flag, for example CLI, is executed soon after an
uncacheable write to the Task Priority Register (TPR) that lowers the APIC priority, the
interrupt masking operation may take effect before the actual priority has been
lowered. This may cause interrupts whose priority is lower than the initial TPR, but
higher than the final TPR, to not be serviced until the interrupt enabled flag is finally
set, i.e. by STI instruction. Interrupts will remain pending and are not lost.
Implication: In this example the processor may allow interrupts to be accepted but may delay their
service.
Workaround: This non-synchronization can be avoided by issuing an APIC register read after the
APIC register write. This will force the store to the APIC register before any
subsequent instructions are executed. No commercial operating system is known to be
impacted by this erratum.
Status: For the steppings affected, see the Summary Tables of Changes.
BH6 Using 2M/4M Pages When A20M# Is Asserted May Result in Incorrect
Address Translations
Problem: An external A20M# pin if enabled forces address bit-20 to be masked (forced to zero)
to emulates real-address mode address wraparound at 1 megabyte. However, if all of
the following conditions are met, address bit-20 may not be masked.
•paging is enabled
•a linear address has bit-20 set
•the address references a large page
•A20M# is enabled
Implication: When A20M# is enabled and an address references a large page the resulting
translated physical address may be incorrect. This erratum has not been observed
with any commercially available operating system.
Workaround: Operating systems should not allow A20M# to be enabled if the masking of address
bit-20 could be applied to an address that references a large page. A20M# is normally
only used with the first megabyte of memory.
Status: For the steppings affected, see the Summary Tables of Changes.

Errata
Specification Update 17
BH7 Value for LBR/BTS/BTM will be Incorrect after an Exit from SMM
Problem: After a return from SMM (System Management Mode), the CPU will incorrectly update
the LBR (Last Branch Record) and the BTS (Branch Trace Store), hence rendering
their data invalid. The corresponding data if sent out as a BTM on the system bus will
also be incorrect.
Note: This issue would only occur when one of the 3 above mentioned debug support
facilities are used.
Implication: The value of the LBR, BTS, and BTM immediately after an RSM operation should not
be used.
Workaround: None.
Status: For the steppings affected, see the Summary Tables of Changes.
BH8 Incorrect Address Computed For Last Byte of FXSAVE/FXRSTOR
Image Leads to Partial Memory Update
Problem: A partial memory state save of the 512-byte FXSAVE image or a partial memory state
restore of the FXRSTOR image may occur if a memory address exceeds the 64KB limit
while the processor is operating in 16-bit mode or if a memory address exceeds the
4GB limit while the processor is operating in 32-bit mode.
Implication: FXSAVE/FXRSTOR will incur a #GP fault due to the memory limit violation as expected
but the memory state may be only partially saved or restored.
Workaround: Software should avoid memory accesses that wrap around the respective 16-bit and
32-bit mode memory limits.
Status: For the steppings affected, see the Summary Tables of Changes.
BH9 A Thermal Interrupt is Not Generated when the Current Temperature
is Invalid
Problem: When the DTS (Digital Thermal Sensor) crosses one of its programmed thresholds it
generates an interrupt and logs the event (IA32_THERM_STATUS MSR (019Ch) bits
[9,7]). Due to this erratum, if the DTS reaches an invalid temperature (as indicated
IA32_THERM_STATUS MSR bit[31]) it does not generate an interrupt even if one of
the programmed thresholds is crossed and the corresponding log bits become set.
Implication: When the temperature reaches an invalid temperature the CPU does not generate a
Thermal interrupt even if a programmed threshold is crossed.
Workaround: None.
Status: For the steppings affected, see the Summary Tables of Changes.

Errata
18 Specification Update
BH10 Programming the Digital Thermal Sensor (DTS) Threshold May Cause
Unexpected Thermal Interrupts
Problem: Software can enable DTS thermal interrupts by programming the thermal threshold
and setting the respective thermal interrupt enable bit. When programming DTS
value, the previous DTS threshold may be crossed. This will generate an unexpected
thermal interrupt.
Implication: Software may observe an unexpected thermal interrupt occur after reprogramming
the thermal threshold.
Workaround: In the ACPI/OS implement a workaround by temporarily disabling the DTS threshold
interrupt before updating the DTS threshold value.
Status: For the steppings affected, see the Summary Tables of Changes.
BH11 Returning to Real Mode from SMM with EFLAGS.VM Set May Result in
Unpredictable System Behavior
Problem: Returning back from SMM mode into real mode while EFLAGS.VM is set in SMRAM may
result in unpredictable system behavior.
Implication: If SMM software changes the value of the EFLAGS.VM in SMRAM, it may result in
unpredictable system behavior. Intel has not observed this behavior in commercially
available software.
Workaround: SMM software should not change the value of EFLAGS.VM in SMRAM.
Status: For the steppings affected, see the Summary Tables of Changes.
BH12 Fault on ENTER Instruction May Result in Unexpected Value on Stack
Frame
Problem: The ENTER instruction is used to create a procedure stack frame. Due to this erratum,
if execution of the ENTER instruction results in a fault, the dynamic storage area of
the resultant stack frame may contain unexpected value (i.e. residual stack data as a
result of processing the fault).
Implication: Data in the created stack frame may be altered following a fault on the ENTER
instruction. Please refer to "Procedure Calls For Block-Structured Languages" in IA-32
Intel® Architecture Software Developer’s Manual, Vol. 1, Basic Architecture, for
information on the usage of the ENTER instructions. This erratum is not expected to
occur in ring 3. Faults are usually processed in ring 0 and stack switch occurs when
transferring to ring 0. Intel has not observed this erratum on any commercially
available software.
Workaround: None.
Status: For the steppings affected, see the Summary Tables of Changes.

Errata
Specification Update 19
BH13 With TF (Trap Flag) Asserted, FP Instruction That Triggers an
Unmasked FP Exception May Take Single Step Trap before Retirement
of Instruction
Problem: If an FP instruction generates an unmasked exception with the EFLAGS.TF=1, it is
possible for external events to occur, including a transition to a lower power state.
When resuming from the lower power state, it may be possible to take the single step
trap before the execution of the original FP instruction completes.
Implication: A Single Step trap is taken when not expected.
Workaround: None.
Status: For the steppings affected, see the Summary Tables of Changes.
BH14 An Enabled Debug Breakpoint or Single Step Trap May Be Taken after
MOV SS/POP SS Instruction if it is Followed by an Instruction That
Signals a Floating Point Exception
Problem: A MOV SS/POP SS instruction should inhibit all interrupts including debug breakpoints
until after execution of the following instruction. This is intended to allow the
sequential execution of MOV SS/POP SS and MOV [r/e]SP, [r/e]BP instructions without
having an invalid stack during interrupt handling. However, an enabled debug
breakpoint or single step trap may be taken after MOV SS/POP SS if this instruction is
followed by an instruction that signals a floating point exception rather than a MOV
[r/e]SP, [r/e]BP instruction. This results in a debug exception being signaled on an
unexpected instruction boundary since the MOV SS/POP SS and the following
instruction should be executed atomically.
Implication: This can result in incorrect signaling of a debug exception and possibly a mismatched
Stack Segment and Stack Pointer. If MOV SS/POP SS is not followed by a MOV
[r/e]SP, [r/e]BP, there may be a mismatched Stack Segment and Stack Pointer on
any exception. Intel has not observed this erratum with any commercially available
software, or system.
Workaround: As recommended in the IA32 Intel® Architecture Software Developer’s Manual, the
use of MOV SS/POP SS in conjunction with MOV [r/e]SP, [r/e]BP will avoid the failure
since the MOV [r/e]SP, [r/e]BP will not generate a floating point exception. Developers
of debug tools should be aware of the potential incorrect debug event signaling
created by this erratum.
Status: For the steppings affected, see the Summary Tables of Changes.

Errata
20 Specification Update
BH15 Code Segment Limit/Canonical Faults on RSM May be Serviced before
Higher Priority Interrupts/Exceptions and May Push the Wrong
Address Onto the Stack
Problem: Normally, when the processor encounters a Segment Limit or Canonical Fault due to
code execution, a #GP (General Protection Exception) fault is generated after all
higher priority Interrupts and exceptions are serviced. Due to this erratum, if RSM
(Resume from System Management Mode) returns to execution flow that results in a
Code Segment Limit or Canonical Fault, the #GP fault may be serviced before a higher
priority Interrupt or Exception (for example NMI (Non-Maskable Interrupt), Debug
break(#DB), Machine Check (#MC), etc.). If the RSM attempts to return to a non-
canonical address, the address pushed onto the stack for this #GP fault may not
match the non-canonical address that caused the fault.
Implication: Operating systems may observe a #GP fault being serviced before higher priority
Interrupts and Exceptions. Intel has not observed this erratum on any commercially
available software.
Workaround: None.
Status: For the steppings affected, see the Summary Tables of Changes.
BH16 BTS(Branch Trace Store) and PEBS(Precise Event Based Sampling)
May Update Memory outside the BTS/PEBS Buffer
Problem: If the BTS/PEBS buffer is defined such that:
•The difference between BTS/PEBS buffer base and BTS/PEBS absolute maximum
is not an integer multiple of the corresponding record sizes
•BTS/PEBS absolute maximum is less than a record size from the end of the virtual
address space
•The record that would cross BTS/PEBS absolute maximum will also continue past
the end of the virtual address space
A BTS/PEBS record can be written that will wrap at the 4G boundary (IA32) or 264
boundary (EM64T mode), and write memory outside of the BTS/PEBS buffer.
Implication: Software that uses BTS/PEBS near the 4G boundary (IA32) or 264 boundary (EM64T
mode), and defines the buffer such that it does not hold an integer multiple of records
can update memory outside the BTS/PEBS buffer.
Workaround: Define BTS/PEBS buffer such that BTS/PEBS absolute maximum minus BTS/PEBS
buffer base is integer multiple of the corresponding record sizes as recommended in
the IA-32 Intel® Architecture Software Developer’s Manual, Volume 3.
Status: For the steppings affected, see the Summary Tables of Changes.