Undocumented CPU behavior: analyzing undocumented opcodes on Intel x86-64 (2018) [pdf]
cattius.com
cattius.com
I know next to nothing about processors at this level, but I wonder if it would be possible for a skilled engineer to try to find these instructions by scrutinizing the actual physical instruction decoder on the chip and/or inspect the processor's microcode. Are these things possible to do? If they are, is it feasible to reverse engineer them?
For two reasons: the equipment needed (extremely expensive) and the complexity of the task (transistors are placed by software, not humans anymore).
At least with software you can go step by step and inspect the memory at the very least.
With hardware you would have to take into account the entire chip state and routing.
So the level of complexity is pretty daunting. IMHO if you want to find out undocumented behaviour that was deliberately introduced, you're better off looking at other methods, no matter how deep your pockets are.
A large percentage of that is simply 6T/cell SRAM L1/L2/etc cache though
Edit: sorry, my neurons got all jumbled and I was thinking of a far more general case, i.e. undocumented behaviour in general, not just undocumented instructions. Indeed, only a relatively small subset of all these transistors is relevant in terms of undocumented instructions specifically.
If anything I'd say that makes it even easier to reverse-engineer, since the layout is far more regular. There are some public tools to do this already - here's one that immediately comes to mind: https://degate.org/
So I would guess studying the microcode does not lead to proving there is nothing else going on.
I am no EE, though.
You will of course have to flash downwards to a vulnerable version but it should give you what you need. Also, as this was fixed prior to Zen2 then you wouldn’t be able to test their newer chips.
Basically AMD has a buffer overflow in a SMM call and they conveniently signed an empty PSP module payload that will be executed nevertheless.
but next CPUs will have vertically stacked circuitry making reverse engineering much more harder (impossible?).
https://en.wikipedia.org/wiki/Three-dimensional_integrated_c...
Also, the fact that they're trying to test undocumented behaviour from within a full OS was a bit unexpected; in the retrocomputing community, where CPUs like the Z80 and 6502 have been studied extensively, the usual way of testing undocumented behaviour is to boot into a very minimal environment whose only purpose is test that behaviour, so as to eliminate any other variables from the process. Logic analysers/bus monitoring are also used sometimes, although that might be harder with a modern high-speed CPU.
Complexity and the ratio of visible behavior over unobservable state is astronomically worse than for a 8bit CPU and therefore a concern, still.
Think McFly!
Edit: 0f 0d /2 is documented as prefetchwt1 but (allegedly) unsupported by the CPUs I tested it on, so the fact it executes at all is undocumented.
You could almost emulate a MMU on a 286
So is this the combined result of market mechanics? Intel being leader their top priority was to release the fastest chips at all costs, letting security/simplicity/sustainability behind? On top of that, complexity becomed another barrier to competitors. This feels insane, unsustainable.
Whole parts of the industry have already switched to alternative architectures. MIPS was prevalent in set-top box, then replaced with ARM in the 2010s. ARM reigns on most mobile devices. Risc-V is on the rise.
Areas craving for performance without concern about power consumption or security still run on Intel. For how long?
Supercomputers get 10x more power from GPUs than CPUs, switching to an alternative may come.
Could we imagine the gamer market switching to nVidia on ARM/RISC?
It Intel architecture a huge sinking ship?
Intel bashing becomes much too easy.
Now we have CPUs that are fundamentally undocumented, unknowable, and untranslatable. The entire infrastructure of the network, the telecoms, and the cpu design itself has all been subverted to the needs of the national security complex or corporate advertising.
I'm not sure what computer science even means anymore. Everything I learned is completely useless.
It's not useless. FPGAs have plummeted in cost and there are now open-source toolchains for some of them. There's also a Free commercial-grade ISA that you can use in your personal designs (RISC-V). These days, it is not expensive to design your own well-understood computer which can run microcode generated by commercial-grade compilation toolchains such as GCC. Even hardware production is getting cheapER with shared wafer runs like MOSIS, although custom silicon is still out of reach for hobbyists.
Chin up, buddy. The US is not the entire world, and the pendulum of our generations' zeitgeist can still swing back towards the ideals of liberty and equality of access which the mavens of computing once stood for. You can already buy ARM application processors from vendors other than Intel/AMD, and I would be surprised if we lived in a world where every new computer comes with "management engine" spyware in its CPU for much longer.
Most if not all top computer science / computer engineering programs in the states teach digital logic design, x86 / x86-64, computer architecture, compilers, communication networks in very fundamental detail as required courses. The emphasis is still there.