The legend of “x86 CPUs decode instructions into RISC form internally” (2020)
Related:<p><a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=27334855">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=27334855</a><p><a href="https:&#x2F;&#x2F;www.google.com&#x2F;search?q="christopher+domas"+x86+"god+mode"" rel="nofollow noreferrer">https:&#x2F;&#x2F;www.google.com&#x2F;search?q="christopher+domas"+x86+...</a><p><a href="https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;Alternate_Instruction_Set" rel="nofollow noreferrer">https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;Alternate_Instruction_Set</a><p>&gt;&quot;In 2018 Christopher Domas discovered that some Samuel 2 processors came with the Alternate Instruction Set enabled by default and that by executing AIS instructions from user space, it was possible to gain privilege escalation from Ring 3 to Ring 0.[5] Domas had partially reverse engineered the AIS instruction set using automated fuzzing against a cluster of seven thin clients.[12] Domas used the terms &quot;deeply embedded core&quot; (DEC) plus &quot;deeply embedded instruction set&quot; (DEIS) for the RISC instruction set, &quot;launch instruction&quot; for JMPAI, &quot;bridge instruction&quot; for the x86 prefix wrapper, &quot;global configuration register&quot; for the Feature Control Register (FCR), and documented the privilege escalation with the name &quot;Rosenbridge&quot;.[5]&quot;<p>Also -- I should point out that the debate of <i>if</i> x86 (CISC) CPU&#x27;s contain RISC cores -- is largely academic.<p>Both RISC and CISC CPU&#x27;s contain ALU&#x27;s -- so our only debate, really, if we have one, is <i>how</i> exactly data that the ALU is going to process -- is going to wind up at the ALU...<p>It is well known in the x86 community that the x86 instructions are an abstraction, a level of abstraction which runs on top of lower-level of abstraction, the x86 microcode layer...<p>Historically, intentionally or unintentionally, most x86 vendors have done everything they can to hide, obfuscate, and obscure this layer...  There (to the best of my knowledge, at this point in time) is no official documentation of this layer, how it works (etc., etc.) from any any major x86 vendor.<p>x86 microcode update blobs -- are binary &quot;black boxes&quot; and encrypted.<p>Most of our (limited) knowledge in this area comes from various others who have attempted to understand the internal workings of x86 microcode:<p><a href="https:&#x2F;&#x2F;www.google.com&#x2F;search?q="reverse+engineering+x86+processor+microcode"" rel="nofollow noreferrer">https:&#x2F;&#x2F;www.google.com&#x2F;search?q="reverse+engineering+x86+p...</a><p><a href="https:&#x2F;&#x2F;github.com&#x2F;RUB-SysSec&#x2F;Microcode">https:&#x2F;&#x2F;github.com&#x2F;RUB-SysSec&#x2F;Microcode</a><p><a href="https:&#x2F;&#x2F;twitter.com&#x2F;_markel___&#x2F;status&#x2F;1262697756805795841" rel="nofollow noreferrer">https:&#x2F;&#x2F;twitter.com&#x2F;_markel___&#x2F;status&#x2F;1262697756805795841</a><p><a href="https:&#x2F;&#x2F;www.youtube.com&#x2F;watch?v=lY5kucyhKFc">https:&#x2F;&#x2F;www.youtube.com&#x2F;watch?v=lY5kucyhKFc</a><p>It should be pointed out that even if a complete understanding of x86 microcode were to be had for one generation of CPU -- there would always be successive generations where that implementation might change -- leaving anyone who would wish to fully understand it, back at square one...<p>To (mis)quote Douglas Adams:<p><i>&quot;There is a theory which states that if ever anyone discovers exactly what the x86 microcode layer is for and why it is here, it will instantly disappear and be replaced by something even more bizarre and inexplicable.&quot;<p>There is another theory which states that this has already happened.&quot;</i> :-) &lt;g&gt;