P54C Erratum 33
PROBLEM: The WRMSR and RDMSR instructions
allow writing and reading of special MSRs (Model Specific
Registers) based on the index number placed in ECX. The
architecture was specified to reject accesses to illegal
MSRs by generating the fault GP(0) if WRMSR or RDMSR is
executed with an illegal index. However, negative
indices, all of which are illegal, do not trigger GP(0).
IMPLICATIONS: If RDMSR is used with
negative indices, undefined values will be read into EAX.
If WRMSR is used with negative indices, undefined
processor behavior may result.
WORKAROUND: Do not use illegal indices
with WRMSR and RDMSR.
The above information is a direct quote from the Pentium
Processor Specification Update (errata). There's just
one problem with it...it's not true. While some of the
information is true, other parts of it are patently
false.
It's true that reading and writing illegal MSRs is
supposed to generate a GP fault. But Intel left a back-door
in the architecture to read and write MSRs that they
didn't think anybody would discover. It wasn't long
before the hacker community discovered this back door,
and began publishing the secrets of these hidden MSRs.
One such article appears at this web site, entitled
"Pentium
Model-Specific Registers and What They Reveal"
by Ralf Brown.
As Ralf was researching these hidden MSRs, he
contacted Christian
Ludloff and myself for more information. Ralf had
already discovered that MSRs with negative indices were
mirror images of their non-negative counterparts. There
was just one problem: the non-negative counterparts
weren't contiguous (some MSR indices that were undefined
and generated the expected GP(0)), but the negative
indices were all contiguous and all produced return
values. Ralf expected that these undefined MSR indices
were a back-door into MSRs that Intel wanted to use for
their own purposes. Ralf was correct.
Within a short period of time, I discovered that MSR
8000001D was an undocumented MSR that mapped to the Probe
Mode Control Register. Ralf discovered a few others
relating to the Floating Point Unit. He wrote up a paper,
and published it to the World Wide Web.
Now, the ball was in Intel's court. They had just
published Erratum 33 which described these illegal MSRs
as having an undefined effect on the Pentium processor's
behavior. Clearly, the thought this issue was important
enough to document it as Erratum 33. But unfortunately,
they didn't think it was important enough to tell the
truth.
|
