3 ms·

> For example, there was one bug that manifested itself in incorrect instruction decoding if a conditional branch instruction had just the right sequence of tak

> For example, there was one bug that manifested itself in incorrect instruction decoding if a conditional branch instruction had just the right sequence of taken/not-taken history, and the branch instruction was followed immediately by a selector load, and one of the first two instructions at the destination of the branch was itself a jump, call, or return. My brain hurts imagining how they figured out and verified that this bug exists.

jakub_h 10y ago
Judging from the Matt Dillon case, a lot of "nah, the bug must be in my code" must have been involved.
- dingo_bat 10y ago
  What is the Matt Dillon case?
  - jakub_h 10y ago
    The guy who was looking half a year for a bug in his code and then half a year for a bug in GCC (or something like that) only to find out that it was a bug in an AMD CPU.
greglindahl 10y ago
I used crashme to discover a bug in the Broadcom Sibyte CPU that depended on branch prediction history.
- dingo_bat 10y ago
  I'd love to read details about your experience. Have you had a chance to write it up?
  - greglindahl 10y ago
    I never wrote it up. The only weird thing about it was that unmodified crashme wouldn't run because of a prefetch bug in the silicon, plus there was a debugging trap that wasn't handled in the kernel. I added a trivial handler for the trap and pre-processed the randomly-generated crashme code to nop prefetches... 15 seconds later, I saw the hang.