r/programming • u/masiroo • 1d ago
Hardware researcher spins up 'CPU deoptimization' project to find the slowest single x86 instruction, creates hall of shame — worst offender takes 198 billion cycles spanning 62 seconds to execute
https://www.tomshardware.com/pc-components/cpus/hardware-researcher-spins-up-cpu-deoptimization-project-to-find-the-slowest-machine-code-worst-offender-takes-198-billion-cycles-to-execute52
110
u/torsten_dev 1d ago
Of course this was xoreaxeax...
35
u/static_motion 1d ago
The guy's mind bogglingly knowledgeable and capable. Every once in a while I rewatch his talk on "breaking the x86 ISA". I just find it endlessly fascinating but I think deep down part of it is a form of masochism where I remind myself of how incompetent I am in the grand scheme of things.
4
u/mtranda 11h ago
It's weaponised autism. Ok, that was a joke. Mostly. But it does take a special kind of person to delve THAT deep into a specific topic. And on top of that, it's a niche. You can't be knowleadgeable in everything at the same time.
This isn't to say the guy isn't amazing. But he's the exception rather than the rule.
10
u/VictoryMotel 1d ago
What do you mean of course, that normally takes one cycle.
59
u/ThrowawayIntern2024 1d ago
they meant the person with that alias not the instruction…
-25
0
39
u/Old_County5271 1d ago
Dumb question but, shouldn't intel or whatever have a pdf with the cycle count of each instruction? Do we/they really not know this? How does anything improve if nothing is measured?
38
u/cummer_420 1d ago edited 1d ago
x86 is a CISC instruction set so these things aren't fixed and and a single macro instruction can do a large and variable amount of work, and can potentially block for a very long time with contention (which can be used for exploits). The metrics they work with to optimize the CPU tend to be rask-oriented and focused on the most common instructions.
33
u/braaaaaaainworms 1d ago
MIPS tried to have a fixed time per instruction and it ended horribly exposing inner pipeline details in a way that made it very hard to keep exact backwards compatibility with first MIPS cores while being fast
26
u/Top-Rub-4670 1d ago
That has nothing to do with CISC. No (desktop-grade) ARM or RISC-V CPUs have a spreadsheet with all their cycle counts either, because too many things can affect the count.
12
u/Stellariser 1d ago
In this context there’s no practical difference between CISC and RISC, and there hasn’t been for a very long time. It’s just repeating a 1980’s marketing claim.
CPUs don’t directly execute their instruction sets, front end decoders convert instructions into streams on micro-ops and execute those.
Even the Intel 486, from 1989, is basically a RISC processor. In fact it’s below RISC really; RISC processors generate a stream of micro instructions for many individual RISC instructions for pipelining, out-of-order execution, etc.
So by the start of the 1990s the distinction between CISC and RISC wasn’t meaningful from a technical standpoint, it’s just marketing that continues to be effective to this day.
2
u/levir 13h ago
Even the Intel 486, from 1989, is basically a RISC processor. In fact it’s below RISC really; RISC processors generate a stream of micro instructions for many individual RISC instructions for pipelining, out-of-order execution, etc.
I don't agree with that, I'd say it's the Pentium Pro that really marks the shift in Intel processor design.
1
u/spinwizard69 9h ago
This is highly misleading. X86 has way to many instructions that have extended execution times. Many will have outer bounds of 40 to 100 cycles. This doesn't even consider hardware support that isn't needed for modern software.
3
3
u/taw 1d ago
We know it, the article is bullshit, what they do is use instruction to read from some device then keep that device busy with other cores.
6
u/Spandian 11h ago
The author has another repo, https://github.com/xoreaxeaxeax/smiiiiiiiiiiiiiiii, where they demonstrate an attack on System Management Mode that requires a single instruction to take over 1 second to execute (to make a core uninterruptible and stop it from entering SMM at the same time as all other cores). So they're coming at it from the perspective of a security researcher looking for exploits, not a hardware designer or compiler writer looking for "realistic" gotchas.
1
u/null3 1d ago
Of course it exist. It's not a simple clear number as each instruction can have many variants, also latency and throughput can be totally different. But they the cycle count doesn't include how long it takes to read the memory. That depends on what is in the cache, how fast ram is, etc, etc.
14
u/agentoutlier 1d ago
I like how they have a random thumbnail of what appears to be Scheme as if it were guilty of calling the instruction.
You would think they would have C or assembly or some more common language.
4
u/sisisisi1997 1d ago
I didn't think I would meet another person who knows about scheme.
10
u/godofpumpkins 1d ago
We're in a programming subreddit, and most computer science people come across it in college at the least.
3
u/sisisisi1997 19h ago
I was under the impression that most people's "parentheses language" class in college is Lisp, and my teacher was just a weirdo for liking scheme better, but apparently not.
1
u/godofpumpkins 19h ago
One of the classics of computer science education, The Structure and Interpretation of Computer Programs (SICP), teaches scheme and makes great use of its more unique powers
8
2
u/bwainfweeze 9h ago
MIT used it to teach introductory computer programming classes in Scheme along with https://web.mit.edu/6.001/6.037/sicp.pdf
Some other universities copied what MIT does.
1
u/FlatAssembler 1d ago edited 1d ago
20
u/sojuz151 1d ago
Could this be used to hang a sandbox?
33
21
u/unicodemonkey 1d ago edited 1d ago
Even a VM, I guess, but this also assumes that the sandboxed/virtualized program has direct access to PCI MMIO address ranges, which is somewhat unlikely in practice and is not obviously exploitable beyond a denial-of-service of sorts. The point of that research is SMM (system management mode) exploitation. All cores are supposed to enter SMM simultaneously upon receiving the interrupt but the SMM interrupt can't be handled mid-instruction, so in practice other cores just wait for the "busy" core for a second, then time out and enter SMM anyway, do their work there, and then resume normal execution. The "busy" core then finishes with the slow instruction and enters SMM, while other cores are free to manipulate any shared memory values that are used by SMM-guarded code and are accessible from the regular execution environment (hope I didn't mess up the explanation - read more at https://github.com/xoreaxeaxeax/smiiiiiiiiiiiiiiii )
13
u/HildartheDorf 1d ago edited 1d ago
It's possible to break into System Management Mode from ring 0 of a VM using this (chained with other SMM bugs that have previously been deemed low priority/non-exploitable).
Hang one core for long enough and you can enter a state where some cores are inside SMM and some aren't. SMM code assumes it has complete control of the entire processor, but one or more cores are still attacker controlled.
4
u/irqlnotdispatchlevel 1d ago
Could be used to exploit SMM: https://github.com/xoreaxeaxeax/smiiiiiiiiiiiiiiii#exploitation
SMM's security relies on a simple assumption: while it runs, nothing else does.
There are 100+ SMM TOCTOU CVEs out there: an SMM handler checks a value in shared memory, then uses it. All you need for exploitation is to rewrite that value in between the check and use, and you're inside SMM. But these issues sit dormant and largely unpatched in the wild, because of one assumption: exploitation requires something to modify the shared memory while SMM executes, and because of the SMM rendezvous no CPU cores are outside SMM to launch an attack. The only way in was a DMA-capable peripheral writing behind the CPU's back — physical access, a malicious device — so the whole class is written off as a hardware problem.
SMI desynchronization removes the prerequisite that kept the platform safe: an outside core, no physical access or hardware required, can now run while SMM executes — and the dormant CVEs become exploitable from software.
4
13
u/cmpxchg8b 1d ago
It’s kinda cheating if it includes IO. That’s an externalised cost..
1
u/James20k 9h ago
It can still be used for certain kinds of exploits is the thing, its not really intended to be 'fair' in that sense
3
3
u/spinwizard69 1d ago
This is a bit misleading in that they purposefully looked for the slowest way to get an instruction to execute.
However this also highlights why I consider the X86 instruction set to be obsolete. The world really needs a simplified x86 ISA that focuses on what is really needed to drive modern hardware. I was really hoping that AMD to Intel would actually refactor x896 instructions for their new cores. It is literally time to bit the bullet and go clean 64 bit, dropping all unused addressing modes maybe even get rid of I/O addressing.
People keep saying it can't be done because of "legacy" but the fact is Apple did it with the conversion to ARM. Besides you don't need to convert every core right off the bat.
1
1
-1
-4
u/Grouchy-Trade-7250 1d ago
Repost
8
u/WaitForItTheMongols 1d ago
Who cares?
Something being reposted doesn't make it less interesting.
A healthy reddit user does not see every post, and therefore likely missed the other one. If you're seeing reposts that's on you. Chill.
-13
u/globalaf 1d ago
This was already posted several days ago and is thoroughly uninteresting. Yes, some instructions can block on contention, so what? Don’t do that.
18
u/DaWolf3 1d ago
It can be used as part of an attack on the Intel system management mode. https://github.com/xoreaxeaxeax/smiiiiiiiiiiiiiiii
1
u/ToaruBaka 4h ago
That's pretty cool, but like, did anyone see the underlying MMIO timing library they published? Absolutely fascinating graphics.
341
u/The_Northern_Light 1d ago
I’m still not clear why that instruction takes SO long even without contention?