Live data from Hacker News

Destroying x86_64 instruction decoders with differential fuzzing

blog.trailofbits.com

81–90 of 113 posts

Re: Destroying x86_64 instruction decoders with differential fuzzing

#81
post #29

Earlier quoted context omitted.

> I really wish Itanium had taken off. IMO it is a superior architecture that was simply ahead of it's time. Itanium was an architecture that was designed for "big iron", i.e. fast, powerful computers. It is thus, in my opinion, much harder to "scale down" to, say, mobile devices than x86.

x86 hasn't really proven that it scales down well for mobile devices either.

Interestingly enough, the baseband for iPhone XS runs x86.

Re: Destroying x86_64 instruction decoders with differential fuzzing

#82
post #9
post #3

“For reverse engineers and program analysts: x86_64 instruction decoding is hard.” An idea that hit me while reading this: Using a tool like this should (help to) make it easy to determine if a commercial app is using GPL libraries illicitly by assembling a syntax tree of method signatures as a first line indicator that the executable contains code matching a GPL library. If first pass indicates a match a deeper anal…

For simple code match, you can just compared bytes without decoding instructions. If you want to try and identify functionally similar but not more or less identical code from binaries, good luck; it's a very hard problem. Antivirus companies and reverse engineers would love to know how to do that efficiently.

Of course, for stupid and/or lazy GPL infringers strings is often a good first check.

Re: Destroying x86_64 instruction decoders with differential fuzzing

#83
post #2

From the great article: "x86_64 is the 64-bit extension of a 32-bit extension of a 40-year-old 16-bit ISA designed to be source-compatible with a 50-year-old 8-bit ISA. In short, it’s a mess, with each generation adding and removing functionality, ..." Nice way of wording that! :) It also explains the complexity of the following 10 pages of text.

Every mobile app: "Sorry your version is incompatible with the service as it existed three months ago, you have to update."

Re: Destroying x86_64 instruction decoders with differential fuzzing

#84
post #52

Earlier quoted context omitted.

One major issue was that the segments overlapped, so two different pointers could actually point to the same address. > Half the issue with Spectre is that there isn't a clean way to describe to the processor different memory security contexts except with a page table pointer swap. You don't need segments for that. A flat address space where the 2 MSBs (or however many you need) of a pointer encode the context would…

I mean, that's just a reimplementation of segments.

You were talking about x86 segments. x86 segments overlapped. Therefore, this is not a reimplementation of the kind of segments you were talking about.

Re: Destroying x86_64 instruction decoders with differential fuzzing

#85
post #84

Earlier quoted context omitted.

I mean, that's just a reimplementation of segments.

You were talking about x86 segments. x86 segments overlapped. Therefore, this is not a reimplementation of the kind of segments you were talking about.

Protected mode segments are very different than real mode segments. I was talking about those.

Re: Destroying x86_64 instruction decoders with differential fuzzing

#86
post #51
post #47

Earlier quoted context omitted.

VLIW has ultimately failed several times outside of IA-64. It was briefly tried for GPUs too.

It's alive and kicking on the Texas Instruments DSP chips. You can get incredible performance out of them, but you pay with horrible compile times. To give you a taste what these chips do: - 64 registers, 8 execution units, so 8 instruction can execute per cycle. Each instruction executes in a single cycle but may writes back the result later (multiplications do this for example). It's your responsibility to make sur…

I'm feeling extremely masochistic. What's the model number of one of these chips and/or a pointer to its instruction set reference?

Re: Destroying x86_64 instruction decoders with differential fuzzing

#87
post #29

Earlier quoted context omitted.

I really wish Itanium had taken off. IMO it is a superior architecture that was simply ahead of it's time. Wouldn't it be great if software instead of hardware, had complete control of instruction ordering? Wouldn't it be great to not be limited by the current SIMD restrictions? Wouldn't it be nice if you could choose to spend more compile time to get even faster programs (vs relying on the hardware to do it JIT)? I…

> I really wish Itanium had taken off. IMO it is a superior architecture that was simply ahead of it's time. Itanium was an architecture that was designed for "big iron", i.e. fast, powerful computers. It is thus, in my opinion, much harder to "scale down" to, say, mobile devices than x86.

I'd say the opposite is true. There isn't anything about Itanium that makes it worse for mobile. In fact, the opposite is true, it would be better for mobile because it was designed to push more of the optimizations into the compiler vs the hardware. That means less power required to do optimizations against running software.

Because Itanium fits with mobile just as well as ARM does for much of the same reasons. After all, Itanium is essentially a RISC architecture.

It never touched mobile because it was dead before mobile computing was really taking off. Heck, it was dead before ARM got a stranglehold on the market.

Re: Destroying x86_64 instruction decoders with differential fuzzing

#88

Earlier quoted context omitted.

I really wish Itanium had taken off. IMO it is a superior architecture that was simply ahead of it's time. Wouldn't it be great if software instead of hardware, had complete control of instruction ordering? Wouldn't it be great to not be limited by the current SIMD restrictions? Wouldn't it be nice if you could choose to spend more compile time to get even faster programs (vs relying on the hardware to do it JIT)? I…

The stupid quip about sufficiently advanced compilers has actually been true until relatively recently, and shipping shared libraries has also been a thing for a while until recently (we basically ship shared libraries as statically linked these days, aka containers)

I'd say roughly around 2010 maybe 2015, compilers got to the point where they didn't totally suck at vectorization.

Before that point, yeah, they were just too dumb to be able to make Itanium fast.

Re: Destroying x86_64 instruction decoders with differential fuzzing

#89
post #38

Earlier quoted context omitted.

I really wish Itanium had taken off. IMO it is a superior architecture that was simply ahead of it's time. Wouldn't it be great if software instead of hardware, had complete control of instruction ordering? Wouldn't it be great to not be limited by the current SIMD restrictions? Wouldn't it be nice if you could choose to spend more compile time to get even faster programs (vs relying on the hardware to do it JIT)? I…

Itanium was one of those scenarios where theory blew up in practice. In theory it’s great for software to have complete control of instruction ordering. In practice, software simply doesn’t have enough information at compile time to do that. As proven by the fact that even Itanium moved to an OOO architecture in Paulson. It comes down to memory latency. Even an L3 cache hit these days is 30-40 cycles. It’s hard to pr…

I'm not too far in the know for how the OOO stuff works/worked within Paulson. Did OOO migrate instruction execution between batches? Did it simply ignore them all together?

I'd still imagine you'd see benefits for the same reason you see SIMD benefits (assuming you aren't doing a whole bunch of pointer chasing).

Re: Destroying x86_64 instruction decoders with differential fuzzing

#90
post #76

Earlier quoted context omitted.

Interesting, I wasn't aware that you could use them in protected mode and they were 32-bits wide from the 386 on-wards. It also reminded me of something else: I think Tanenbaum discussed the advantages of the segmented memory model in his operating systems book, but I never paid attention because coming from the 16-bit word I immediately dismissed that idea. I might have to reread that chapter...

It's worse than that, you can set up 32-bit segments in 32-bit mode, then switch back to 16-bit mode and have them do vaguely sensible things .... This wasn't defined by Intel, but Windows went on to depend on this feature in order to boot (to access PCI) (I was once involved in an x86 clone project)

For anybody who is curious, this is colloquially referred-to as "unreal mode": https://en.m.wikipedia.org/wiki/Unreal_mode
Post reply on HN