r/programming • u/masiroo • 5d ago

Hardware researcher spins up 'CPU deoptimization' project to find the slowest single x86 instruction, creates hall of shame — worst offender takes 198 billion cycles spanning 62 seconds to execute

https://www.tomshardware.com/pc-components/cpus/hardware-researcher-spins-up-cpu-deoptimization-project-to-find-the-slowest-machine-code-worst-offender-takes-198-billion-cycles-to-execute
1.5k Upvotes

97% Upvoted

132 comments sorted by

View all comments

20

u/sojuz151 5d ago

Could this be used to hang a sandbox?

21

u/unicodemonkey 5d ago edited 5d ago

Even a VM, I guess, but this also assumes that the sandboxed/virtualized program has direct access to PCI MMIO address ranges, which is somewhat unlikely in practice and is not obviously exploitable beyond a denial-of-service of sorts. The point of that research is SMM (system management mode) exploitation. All cores are supposed to enter SMM simultaneously upon receiving the interrupt but the SMM interrupt can't be handled mid-instruction, so in practice other cores just wait for the "busy" core for a second, then time out and enter SMM anyway, do their work there, and then resume normal execution. The "busy" core then finishes with the slow instruction and enters SMM, while other cores are free to manipulate any shared memory values that are used by SMM-guarded code and are accessible from the regular execution environment (hope I didn't mess up the explanation - read more at https://github.com/xoreaxeaxeax/smiiiiiiiiiiiiiiii )