To: D.J.Smyth who wrote (8888 ) 11/10/1997 8:14:00 PM From: Mason Barge Respond to of 25960
Here's the news from EE (CMP), for those interested: Intel Confirms Latest Pentium Glitch (11/10/97; 5:00 p.m. EST) By Alexander Wolfe, EE Times In the latest round of cyberspace bug hunting, an anonymous report of a glitch that can crash Intel's Pentium and Pentium/MMX processors has surfaced on the comp.sys.intel newsgroup. An Intel spokesman Monday confirmed the existence of the bug, adding that the Santa Clara, Calif., company hopes to post information on possible workarounds by the end of the week. "This won't affect any commercial software," the Intel spokesman said. "Somebody would have to maliciously put it out there, and you'd have to download a piece of code." The bug involves a sequence of illegal opcodes -- instructions not normally intended for use with the Intel chips. "These opcodes are supposed to cause an exception, where the processor raises a flag telling the program that something's wrong," explained Richard Smith, a software expert and president of Phar Lap Software, in Cambridge, Mass. "This particular sequence, instead, causes a loop and locks up the processor." The glitch -- dubbed the "F0 bug" because of the opcode involved -- is the latest to haunt Intel. A Pentium floating-point-division bug, uncovered in November 1994, by University of Kentucky math professor Thomas Nicely, was a public relations disaster for Intel that resulted in its first-ever chip recall and an eventual $475 million charge against company earnings. Early this year, a less serious floating-point "flag erratum," involving the Pentium II and Pentium Pro CPUs, became national news after it was posted on the renegade "Intel Secrets" Website run by Robert Collins. The provenance of this latest bug is the most mysterious to date. The first report was contained in an anonymous posting last Thursday (Nov. 6) in a message signed by "noname@noname.com" and sent from an e-mail account at the University of Texas in Austin. The message read: "If you execute F0 0F C7 C8 on a P5, it will lock the machine up. This is true for any operating system including usermode Linux. It's pretty cool. Basically, the opcodes are an invalid form of cmpxchg8b eax with a lock prefix. Has anyone seen this before? The problem doesn't show itself for the Pentium Pro or Pentium 2." "They were obviously trying to keep themselves anonymous. Given the nature of the bug, I think it was an Intel competitor that found it," said software expert Smith. Smith said he believes it would be very difficult to accidentally run across the opcode sequence that causes the glitch. "Let's say you are a microprocessor-clone designer and you want to emulate Intel's instruction set," he said. "One thing you're concerned about is whether Intel included any undocumented instructions. So, you might write a test program to check out all possible instruction combinations. I think that's what happened -- somebody was looking for undocumented instructions." Intel said users are unlikely to run into the problematic sequence by accident. In addition, Smith said he believes it will be of little significance in the Windows 95 world. "You can crash Windows 95 in a lot of other ways," he said. "What it affects more is Windows NT and Unix -- both claim you can't crash them at the user level. This bug will enable the bad guys to come in and crash these supposedly uncrashable operating systems." More significant is the question of whether there are other illegal opcode sequences that can cause problems on processors made by Intel and its competitors. Smith said there are millions of unused opcode combinations that are illegal and raise exception flags, causing no damage. However, it's possible that some sequences may have slipped through the hands of chip designers. Indeed, the report of the Intel erratum appears to have kicked off a frenzied round of bug hunting among denizens of the Intel newsgroup, including an early, unsubstantiated report of an illegal sequence that brings down at least one clone processor.