Alternate Instruction Set
The Alternate Instruction Set (AIS) is a second 32-bit instruction set architecture found in some x86 CPUs made by VIA Technologies. On these VIA C3 processors, the second hidden processor mode is accessed by executing the x86 instruction
0F 3F). If AIS mode has been enabled, the processor will perform a JMP EAX and begin executing AIS instructions at the address of the EAX register. Using AIS allows native access to the Centaur Technology-designed RISC core inside the processor.
|AIS number||x86 name|
The manufacter describes the Alternate Instruction Set as "an extended set of integer, MMX, floating-point, and 3DNow! instructions along with additional registers and some more powerful instruction forms".
Every AIS instruction is prefixed with the 3-byte sequence
0x8D8400 followed by the 32-bit instruction; this prefix form for the AIS instructions makes them appear to be x86 Load Effective Address (
In 2018 researcher Christoper Domas reported that the prefix
BOUND) also worked.
In 2007 a patent named some microcode instructions as
store to/from main RAM, and
storePRAM to/from private-RAM inside the processor.
The Centaur Technologies verification team, in a 2014 paper about the VIA Nano, included some short lists of micro-instructions including
STORE_PRAM, plus micro-operations
XSUB. Micro-operations were shown to have a format that includes the fields
write flags? and
From x86 mode, the availability of the Alternate Instruction Set can be detected by executing a CPUID with the EAX register set to
0xc0000001 and then examining the EDX register. If EDX bit 0 is set to 1, then AIS is supported. If EDX bit 1 is also set to 1, then AIS is enabled. If AIS is supported by the CPU, then its status can be checked and altered through the Model-specific registers, by checking and setting the Feature Control Register (FCR, register 0x1107). If bit 0 ("
ALTINST") is set to 1, then AIS is enabled.
The Microsoft Windows NT kernel
KiGetFeatureBits() initialisation function proactively disables Alternate Instruction mode on boot up.
If the x86
ALTINST jump instruction is executed when AIS mode is disabled, then the processor will generate an Invalid Instruction exeception.
Setting the AIS-enabled bit requires privileged access, and should be set using a read-modify-write sequence.
In 2018 Christopher Domas discovered that some Samuel 2 processors came with the Alternate Instruction Set enabled by default and that by executing AIS instructions from user space, it was possible to gain privilege escalation from Ring 3 to Ring 0. Domas had partially reverse engineered the AIS instruction set using automated fuzzing against a cluster of seven thin clients. Domas used the terms "deeply embedded core" (DEC) plus "deeply embedded instruction set" (DEIS) for the RISC instruction set, "launch instruction" for
ALTINST, "bridge instruction" for the x86 prefix wrapper, "global configuration register" for the Feature Control Register (FCR), and documented the privilege escalation with the name "Rosenbridge".
- Alternate Instruction Set (PDF). VIA Eden (Report). Embedded System Platform Processor Datasheet. November 2002. p. 70‒71. Retrieved 10 August 2018.
- Stiller, Andreas (22 January 2003). "VIAs Prozessor der siebten Generation" [VIA's seventh-generation processor]. Heise Online (in German). Heinz Heise. Retrieved 12 August 2018.
Als … kann man Nehemiahs RISC-artigen Core auch native programmieren (AIS: Alternate Instruction Set). Auch hier wird sich zeigen, ob findige Programmierer das für den einen oder anderen Treiber nutzen können, um hier mehr Performance herauszukitzeln.
- "#21 add support for Centaur's AIS". The Netwide Assembler. 18 December 2002. Retrieved 12 August 2018 – via Sourceforge.
- US patent 20080256336A1, Henry, G. Glenn; Colin Eddy & Rodney E. Hooker et al., "Microprocessor with private microcode ram", published 2008-10-16, issued 2010-11-02
- Davis, Jared; Slobodova, Anna; Swords, Sol (20 April 2016). "Microcode Verification – Another Piece of the Microprocessor Verification Puzzle" (PDF). Retrieved 14 August 2018. Cite journal requires
- Centaur Extended CPUID Instruction Functions (PDF). VIA Eden-N Embedded System Platform Processor Datasheet (Report). 22 October 2004. p. 20, 74. Retrieved 10 August 2018.
- Microsoft. "kernlini.c". Microsoft Windows NT kernel source. Retrieved 14 August 2018.
KiGetFeatureBits() … // Disable bit 0 which controls the Cyrix ALTINST feature.
- Alternative Instruction Execution (PDF). VIA C3 Samuel 2 Processor Datasheet (Report). October 2004. p. 60.
- Domas, Christopher. "Rosenbridge: Hardware backdoors in x86 CPUs". Retrieved 10 August 2018.
- Wagenseil, Paul (9 August 2018). "Hacker Finds Hidden 'God Mode' on Old x86 CPUs". Tom's Hardware. Retrieved 10 August 2018.
- US patent 20030154359, Henry, Glenn; Rodney Hooker & Terry Parks, "Apparatus and method for extending a microprocessor instruction set", published 2003-08-14, issued 2007-02-20, assigned to Centaur Technology
- US patent 20030188130A1, Henry, Glenn; Rodney Hooker & Terry Parks, "Mechanism for extending the number of registers in a microprocessor", published 2003-10-02, issued 2008-05-13, assigned to Centaur Technology
- Domas, Christopher (10 August 2018). God Mode unlocked: Hardware backdoors in x86 CPUs (PDF). DEF CON 26. Las Vegas.