Hacker News Reader

> For example, there was one bug that manifested itself in incorrect instruction decoding if a conditional branch instruction had just the right sequence of taken/not-taken history, and the branch instruction was followed immediately by a selector load, and one of the first two instructions at the destination of the branch was itself a jump, call, or return.

My brain hurts imagining how they figured out and verified that this bug exists.

View on HN

Judging from the Matt Dillon case, a lot of "nah, the bug must be in my code" must have been involved.

What is the Matt Dillon case?

The guy who was looking half a year for a bug in his code and then half a year for a bug in GCC (or something like that) only to find out that it was a bug in an AMD CPU.

I used crashme to discover a bug in the Broadcom Sibyte CPU that depended on branch prediction history.

I'd love to read details about your experience. Have you had a chance to write it up?

I never wrote it up. The only weird thing about it was that unmodified crashme wouldn't run because of a prefetch bug in the silicon, plus there was a debugging trap that wasn't handled in the kernel. I added a trivial handler for the trap and pre-processed the randomly-generated crashme code to nop prefetches... 15 seconds later, I saw the hang.

Reply on news.ycombinator.com