gamozolabs

7 ms·

1.
by gamozolabs 2y ago
Here's the mempipe benchmark latency for core<->core: https://github.com/MarginResearch/cannoli/blob/main/mempipe/... https://raw.githubusercontent.com/MarginResearch&#x2F
2.
by gamozolabs 2y ago
It can tell you specified topology, like cores, threads, NUMA nodes. But it can’t tell you the physical locations of cores. Processors are binned based on what cores are functional after fabrication, thus your 12 core processor is probably
3.
by gamozolabs 2y ago
There’s one big public work by utexas that covers this in a few places! https://sites.utexas.edu/jdm4372/2021/05/27/locations-of-cor... See additional references for PDFs. I’ve also played around with th
4.
by gamozolabs 2y ago
Oh sliding in here late, but it’s also extremely important to pin your threads to specific cores. I kinda only think about computers in this mode so I didn’t bring it up, but the kernel will effectively randomly schedule your process to dif
5.
by gamozolabs 2y ago
Yeah. So I forget the original tuning I did for that project. But, I fill up a buffer which is on its own cache line (Chunk) and then signal that the chunk is ready for ownership on the other side, thus sending it. I’m not sure why the sign
6.
by gamozolabs 2y ago
Anyways, since you express disappointment in ~1000 cycle cost. That's about right. The latency between cores is actually quite high and there's not much you can do about it, especially on a system like x86 which has extremely stro
7.
by gamozolabs 2y ago
I wrote an extremely fast hot polled pipe in Rust for QEMU instrumentation. I’m sure there’s room to improve but it’s effectively bottlenecking on the uarch. https://github.com/MarginResearch/cannoli/blob/main
8.
by gamozolabs 4y ago
I put some thought into that, unfortunately I had some issues with writing these hooks in QEMU TCG itself. That's what I originally did, such that it was JIT-target agnostic, but unfortunately I couldn't get the register stuff to
9.
by gamozolabs 6y ago
Determinism is already fairly important in fuzzing for 2 major reasons. One, is that having determinism makes it easier to triage bugs. If I find a crash while fuzzing, but there's no way to reproduce it, it's going to pretty much
10.
by gamozolabs 6y ago
Oooh, wasn't really expecting this to make it to HN cause it was meant to be more of an announcement than a description. But yes, I've done about 7 or 8 operating systems for fuzzing in the past and it's a massive performance
11.
Some Thoughts on Fuzzing(gamozolabs.github.io)
1 points by gamozolabs 6y ago|0 comments
12.
Fuzz Week 2020 – Come Learn the Basics to Advanced of Fuzzing(gamozolabs.github.io)
2 points by gamozolabs 6y ago|0 comments
13.
by gamozolabs 6y ago
Oopsies, yep, I got banned making Maplestory cheats with Ghidra when it came out. Nevertheless, I got unbanned and I still stream at: https://www.twitch.tv/gamozo I upload all the vods at: https://www.youtube.com
14.
by gamozolabs 7y ago
Back in Pentium 4 days you could use the DS and CS override prefixes on conditional branches to hint taken and not taken, respectively. Kinda neat, but it's not a thing anymore. Some more info here: https://stackoverflow.com
15.
by gamozolabs 7y ago
The `verrw` legacy instruction has been added to with microcode to flush internal caches (load buffers, store buffers, etc). Any serializing instruction should (hopefully) cause a pipeline flush. This is the mitigation solution Intel made a
16.
by gamozolabs 7y ago
In this case a privilege transition requires flushing caches. The scheduler has to be aware to not schedule two different permission levels/domains on the same core. It's a huge amount of osdev work to make hyperthreading "sa
17.
by gamozolabs 7y ago
I'll eat my hat for this, but effectively the mitigation to this is clearing all caches and internal buffers in the CPU on each context switch. I'm sure we'll see more types of leaks, but unless they're actively fetching
18.
by gamozolabs 7y ago
Sorry about that. This blog kinda just hopped into the meat of it as I was trying to keep it short. It's largely a followup to a previous blog of mine https://gamozolabs.github.io/metrology/2019/08/19&#x2
19.
by gamozolabs 7y ago
Hehe, hyperthreading has some issues. This issue technically works single thread, but it's hard for sensitive data to survive a context switch. That being said, this issue is mitigated in all common OSes and latest microcode. I'll
20.
by gamozolabs 7y ago
The x86 `syscall` instruction stores the return address into `rcx` as well as `RFLAGS` into `r11`. These are unconditionally clobbered and thus cannot be saved or used in a `syscall` transition.
21.
by gamozolabs 7y ago
I currently work at Microsoft, however my work and my hobby are pretty much the same at this point so I put a lot of time into it!
22.
by gamozolabs 7y ago
This kernel is just kind of a playground for projects I have. Specifically there were a few from this past year or so. I used this kernel originally for my vectorized emulator, which is designed as a high-performance fuzzer/harness to
23.
by gamozolabs 7y ago
I greatly appreciate the interest in support! I don't have a need for funding for projects like these, as I get plenty of enjoyment out of doing them on my own. For now I'd suggest helping the many other projects/blogs/c
24.
by gamozolabs 7y ago
Memory related bugs are quite common (I see many daily as a security researcher). I have previous hypervisors and kernels I've written (in assembly, C, and Rust) [ https://github.com/gamozolabs/falkervisor_beta and
25.
by gamozolabs 7y ago
My apologies, I wasn't very clear in my readme. It's intended the kernel itself is multiprocessing (support for multiple cores, and multiple VMs). But currently the intent is only to run a single core per VM for now, as getting VT
26.
System level mutable time-travel debugging [video](youtube.com)
2 points by gamozolabs 8y ago|0 comments
27.
Vectorized Emulation: MMU Design(gamozolabs.github.io)
1 points by gamozolabs 8y ago|0 comments
28.
Finding 0day with the World's Worst Android Kernel Fuzzer(gamozolabs.github.io)
3 points by gamozolabs 8y ago|0 comments
29.
by gamozolabs 8y ago
I do this as much as possible. I even go out of my way to compile things if I have access to source with a weaker version of x86, or even cross compile it for something like MIPS. This is done however not due to a theoretical limitation of
30.
by gamozolabs 8y ago
Bingo

More ›