With Intel, Hackers Check In When Bugs Check Out By Alexander Wolfe SANTA CLARA, Calif. -- Intel's BIOS Update technology to quickly fix bugs that crop up in its microprocessors without having to recall the chips may contain a Trojan horse -- a hole that could potentially enable hackers to wreak havoc on the company's CPUs -- said a BIOS expert familiar with the technology.However, other industry experts said they believe Intel is staking out a pace-setting position with its bug-busting technology. They give the semiconductor giant kudos for using BIOS Update to reduce the impact of bugs in the face of a verification crisis that makes it increasingly difficult to ensure that microprocessors with tens of millions of transistors are validated and free of flaws. BIOS Update is a hidden feature that can fix bugs in Pentium Pro and Pentium II CPUs by patching the microcode inside the microprocessor. When the processor boots up, the BIOS loads the patches, which are contained in a 2,048-byte-long BIOS Update data block that is supplied by Intel. "The problem is, the BIOS cannot verify whether the BIOS Update data block contains real microcode or not," claimed one BIOS expert, who requested anonymity. "As long as the header and the checksum are okay, the BIOS will load that microcode into the microprocessor. Some hacker could actually wipe out microcode in the CPU. There is nothing that can prevent this." Intel doesn't see such a scenario as a realistic threat, pointing to the fact that the BIOS Update data block is encrypted. "We've spent quite a lot of time thinking about such scenarios to make sure we had sufficient mechanisms in place so you couldn't introduce your own flavor of BIOS Update into the processor," said Ajay Malhortra, a technical marketing manager based here at Intel's microprocessor group. "Not only is the data block containing the microcode patch encrypted, but once the processor examines the header of the BIOS update, there are two levels of encryption in the processor that must occur before it will successfully load the update." But Intel's biggest security feature may lie in keeping the technical details behind its BIOS Update technology a closely guarded secret. "There is no documentation," said Frank Binns, an architect in Intel's microprocessor group. "It's not as if you can get an Intel 'Red Book' with this stuff written down. It's actually in the heads of less than 10 people in the whole of Intel." However, some experts remain unconvinced. "This is just like any other technology -- if you want to reverse-engineer it, you can," said Ed Curry, president of Lone Star Evaluation Laboratories, a Georgetown, Texas microprocessor benchmarking and testing company. "You can do it by brute force, or a hacker could obtain information from someone inside the company or someone who had access to the documentation." Indeed, Curry, who said he's made presentations on computer-security issues to the U.S. Defense Department, said he believes microprocessor hardware in general is much more vulnerable to hacking than is commonly believed. "This is the big hole in our government security programs," he said. "They don't look at hardware as well as they should; they only look at software. This goes beyond desktop computers. You have to remember that microprocessors are now embedded in our weapons systems." Nevertheless, it's widely believed that it would be tough for a hacker to fake a complete microcode patch, in no small measure because it's also very difficult to obtain documentation that details the internal representation -- word widths and usage of all the bits -- of Pentium Pro microcode. In the era of the 8086 and 8088, microcode documentation was readily available. But such information is provided to selected developers only under tight nondisclosure restrictions. "It's a tightly held secret," Intel's Binns said. New-Tech Jitters However, it is seen as more feasible for a hacker to successfully fake the header and checksum portion of the BIOS Update data block -- something that could still cause the microprocessor to crash or lock up. According to another BIOS expert, talk of potential Trojan horses might be nothing more than jitters about new technology. "This is a new thing in the market," said the expert, who likened it to the early days of flash BIOS. "There was a great fear factor when the industry started using flash BIOSes," he said, "where concerns were raised that somebody could go in and destroy a system by flashing in a new BIOS containing an errant piece of code. I think today there's a fear that someone will play around with this BIOS Update feature and try to cause havoc with Intel's CPUs." As an added security precaution, some BIOS manufacturers limit access to their software. "As a matter of policy, we don't make our BIOS code available to anyone other than a system vendor or motherboard manufacturer," said Thomas Benoit, corporate marketing manager at BIOS vendor Phoenix Technologies, Natick, Mass. "We don't believe anyone should be twiddling the bits in our BIOS code." Irrespective of Trojan horse scenarios, many experts see Intel's bug-busting technology as a boon. "This feature benefits everyone -- it shouldn't be viewed as a liability, but as an asset," said Mark Huffman, marketing manager at American Megatrends, in Norcross, Ga. "It allows you to be able to update your processor without pulling it out of the system. Obviously, you can flash in a new BIOS a lot quicker than you can pop the case, pop the CPU and wait for a replacement." Indeed, BIOS Update has already been successfully used in the field to fix glitches in Pentium Pro-class CPUs, according to an Intel spokesman and to sources at several major BIOS vendors. "Yes, it is used," said an engineer at one vendor. "I personally know of five different things in the Pentium Pro related to multiprocessing, system management interrupt and other areas." "I think it'll be very useful," Phoenix Technology's Benoit said. "It's really to Intel's benefit that BIOS vendors are implementing this feature." "It's a very good feature," said Laurent Gharda, vice president of marketing at BIOS vendor Award Software International, in Mountain View, Calif. "The downside is going to be lower performance, perhaps. But the upside is avoiding a chip recall, as took place a few years ago." Intel's Pentium was recalled in January 1995 following the revelation of a bug in the processor's floating-point divide operations. Moreover, some say BIOS Update may signal the start of an industrywide trend. "These new Pentium-class clone CPUs that have recently been announced -- like the Centaur microprocessor -- they're going to do the same type of process," said Huffman at American Megatrends. Centaur -- officially the IDT-C6 -- is made by Centaur Technology, an Austin, Texas-based subsidiary of Integrated Device Technology. It was introduced in May and delivered to beta customers in Taiwan last month. At Centaur, a spokesman said, "The current silicon we are sampling has that capability, but in the production version of the chip we are dropping the feature, because it necessitates an increased die size." As a result, any bugs that crop up will have to be fixed via a mask revision -- a path the spokesman described as preferable. "Ideally, you want to do fixes by mask changes," he said. "That way, you'll have clean silicon moving forward. Otherwise, you have lots of different versions of BIOS floating around." But Centaur can easily add the feature back into future versions, if it wishes. For its part, Advanced Micro Devices of Sunnyvale, Calif., does not have the feature in its K5 and K6 microprocessors, according to a company spokesman. "There are some errata that can't be fixed by a BIOS update -- specifically, a hardwired instruction can't be changed." He added that AMD has the ability to add the feature into future designs, if it deems it necessary. Still, Huffman of American Megatrends thinks the BIOS Update feature has legs. "I think you'll see a trend toward CPU manufacturers incorporating this capability so they can perform microcode updates in the field," he said. "It gives them more flexibility in their manufacturing process -- they can keep their fab lines running and don't have to stop them to make a mask change and switch to a new stepping every time there's an erratum. More important, they don't have to recall the stepping that has the bug. They can just issue a BIOS update." Intel doesn't tell the BIOS vendors what bugs are being fixed in any given BIOS Update. However, there appears to be a way to figure that out. "It's true you can't see what's happening from a binary standpoint," the BIOS expert who requested anonymity said. "But Intel does release errata along with the update, which gives an explanation of what the update is for. To that extent, you know what they're fixing, though you don't know the exact binary details of what's occurring." Although the BIOS Update feature is firmly in place in the Pentium Pro and Pentium II families, Intel declined to comment on whether it is being used in Pentiums with the MMX multimedia extensions. Looking ahead, deciding whether to implement the technology in future CPU families will involve architectural considerations that extend far beyond a desire to bust bugs. "We're just learning the power this technology really has," Intel's Malhortra said. "In concert with that, we're also becoming more aware of some of its limitations. For example, the trade-off between die size that's used for microcode-patchable space [i.e., for the BIOS Update feature] vs. die size that can be devoted to performance enhancements or to additional micro-architectural features is a tough one." Validation Boost "One could make the argument that, with improved validation processes, you won't need to expand silicon real estate devoted to the microcode-patch feature, because early validation would catch the bulk of problems," Malhortra added. Nevertheless, there's a growing concern that microprocessor bugs could become a bigger problem as 64-bit CPU architectures -- which will be orders of magnitude more difficult to validate than current designs -- are introduced toward the end of the decade. "It's becoming abundantly clear that the ability to manufacture in high volume and to provide a reliable product through validation are somewhat mutually exclusive," Intel's Binns said. "It takes a fairly large amount of time to wring all the errata out of a processor. Fixing errata by making changes to silicon is OK, if you can make those changes quickly. Unfortunately, with the complexity of the processors we've got today, that's not acceptable. The smarter we can get with features like this, the less errata we bring to market. And if we do see errata after we ship, we can correct them in situ." ----- End of forwarded message from Richard Crisp -----