F00f

f00f (pronEng|ˈfuːf), an abbreviation of f0 0f c7 c8, is the hexadecimal encoding of an instruction that exhibits a design flaw in the majority of Intel Pentium, Pentium MMX, and Pentium OverDrive processors.

Intel calls this issue the "invalid operand with locked CMPXCHG8B instruction."cite book
title = Pentium Processor Specification Update
publisher = Intel Corporation
date = 1999-01
pages = 51–52
url = http://www.biblio.deis.unibo.it/Testi_Liberi/Pentium/24248041.PDF
format = PDF
accessdate = 2006-11-02
id = order number 242480-041]

Description

The instruction represents:

lock cmpxchg8b eax

The operand could be a register other than eax. The "cmpxchg8b" instruction is used to compare the value in the "edx" and "eax" registers with an 8-byte value at some memory location. In this example a 4-byte register is used as the destination operand, which is not big enough to store the 8-byte result.

Under normal circumstances, this instruction would simply result in an exception; however, when used with the "lock" prefix (normally used to prevent two processors from interfering with the same memory location), the exception handler is never called, the processor stops servicing interrupts and the CPU must be reset to recover.

The instruction does not require any special privileges and, due to the proliferation of Intel microprocessors, was considered a serious issue at the time. Operating system vendors responded by implementing workarounds that detected the condition and prevented the crash.

Although technically not an example of either, the f00f instruction is often considered an HCF instruction or a killer poke. Since the f00f bug has become common knowledge, the term is sometimes used to describe similar hardware design flaws such as the Cyrix coma bug.

No permanent hardware damage would result from executing the f00f instruction on a vulnerable system. Depending on the file system, operating system, and other circumstances, it is possible for data loss to occur if the disk buffers have not been flushed, if drives were interrupted during a write operation, or if some other non-atomic operation was interrupted.

No Intel processors since the introduction of the Pentium Pro have been affected by the bug. The myB2 stepping fixed this issue.

Information about this bug started spreading over the Internet on or about 7 November,1997. [ cite web
url = http://groups.google.com/group/nl.comp.hardware/msg/8e8aa53186685ed5
title = Nieuwe Intel Pentium BUG
accessdate = 2008-07-07 ]

ee also

*Killer poke
*Halt and Catch Fire
*Intel
*Hacker jargon
*Pentium FDIV bug
*Cyrix coma bug
*Hexspeak

External links

* [http://support.intel.com/support/processors/pentium/ppiie/index.htm Intel erratum]
* [http://support.microsoft.com/kb/q163852/ Microsoft knowledge base article]
* [http://news.com.com/2100-1033-205157.html?legacy=cnet CNET Article]
* [http://www.x86.org/errata/dec97/f00fbug.htm The Intel Pentium F00F Bug: Description and Workarounds] is a detailed description of the bug and its workarounds.

References