Re: Pentium DEATH in user-mode [FIX???]

Kevin Buhr (
11 Nov 1997 13:46:23 -0600

Louis Mandelstam <> writes:
> >
> > I saw a message somewhere today [bugtraq perhaps?] where someone
> > claimed to have found a workaround for the 0xf0 pentium bug.
> >
> > If I understood it correctly, they locked the illegal instruction trap
> > into cpu cache....
> ..and lost the performance advantage of having an internal cache, no?

Actually, Miguel Angel Rodriguez Jodar <rodriguj@DRAGO.FIE.US.ES>
forwarded a message (originally from Jim Brooks <>)
to BUGTRAQ about this possible solution.

What Jim Brooks had discovered was that, if the IDT gate descriptor
for the invalid opcode exception had been cached (by first executing a
"legitimate" invalid opcode), then the F0 0F C7 C8 would not cause a

Miguel pointed out that, because the internal cache could be locked,
this cached gate descriptor could be made permanent, at a horrible
performance penalty.

HOWEVER, if Jim Brooks is right in his explanation, then we're talking
about a cached gate descriptor, which has nothing to do with the
"internal cache" we normally talk about; the descriptor is cached

If, as I assume (and I am clueless), the Pentium has a dedicated cache
for a single IDT gate descriptor, then it might be possible to work
around the bug by executing an invalid opcode (to recache the invalid
opcode descriptor) whenever the "last used IDT descriptor" might have

That is, it might be possible to finish off every interrupt handler by
executing (and handling) an illegal opcode. Presumably this would have
to be done back out in user space, to prevent a double fault. We
would suffer a performance penalty, but it might be worth it.

Any comments on workability from folks with a clue?

Kevin <>