Nathan Luevano

low-level systems & reverse engineering.

[Nathan Luevano @NathanLuevano]

Been working on Silica for a bit. It exhaustively checks all 4.3B AArch64 instruction encodings and compares Arm's spec against LLVM, Capstone, and Unicorn.

Found some pretty interesting disagreements along the way.

https://t.co/rOizFukdE2

[Nathan Luevano @NathanLuevano]

The useful finding here wasn't an LLVM or Capstone bug.

It was realizing that I had flattened instruction decoding into a binary question:

VALID / INVALID

This case needs something closer to:

VALID / ILLEGAL_OR_SOFTFAIL / INVALID

plus the target feature configuration.

Weird edge cases are good at exposing assumptions in your own tooling.

Full Write-up: https://t.co/mPWbdHCFVH

[Nathan Luevano @NathanLuevano]

Then I checked Capstone versions.

Capstone 5.0.7:

0xD5033FFF -> NO INSTRUCTION

Capstone 6.0.0:

0xD5033FFF -> sb, illegal=True

LLVM preserves this case through its SoftFail path, while current Capstone exposes an explicit illegal flag.

Much closer than the original results made it look.

[Nathan Luevano @NathanLuevano]

The missing piece turned out to be FEAT_SB.

Without +sb, LLVM gives the generic msr S0_3_... representation.

Enable +sb and 0xD5033FFF becomes:

sb

but LLVM also warns:

potentially undefined instruction encoding

So this wasn't simply a valid instruction vs invalid instruction disagreement.

[Nathan Luevano @NathanLuevano]

LLVM's result got more interesting when I round-tripped it.

FF 3F 03 D5

disassembles to:

msr S0_3_C3_C15_7, xzr

and assembling that string produces:

[0xff,0x3f,0x03,0xd5]

But round-tripping still doesn't prove the encoding is architecturally legal.

[Nathan Luevano @NathanLuevano]

@phoronix @NVIDIAAIInfra @nvidia Does the patch expose a new RCU bottleneck when the scheduler migrates many low‑prio GPU threads at once?

[Nathan Luevano @NathanLuevano]

@Leik0w0 If you’re re‑entering the VM, how do you handle the kernel’s page‑table split‑synchronization? Could a stale TLB entry leak state across the boundary?

[Nathan Luevano @NathanLuevano]

@StasBekman Does the process stay alive or get forked during those swap cycles? It would be interesting to see how they handle the KV cache without tearing down the process context.

[Nathan Luevano @NathanLuevano]

Came across a weird AArch64 encoding while comparing disassemblers:

0xD5033FFF

LLVM 22.1.8 decodes it as:

msr S0_3_C3_C15_7, xzr

Capstone 5.0.7 returns no instruction for the exact same four bytes.

digging into why.

[Nathan Luevano @NathanLuevano]

@adityazero_ Fascinating transition. Do you see us adding dynamic predication and hardware scoreboard queues to VLIW bundles, or pushing all the dispatch irregularity into async DMA engines?

[Nathan Luevano @NathanLuevano]

@adityazero_ Fascinating transition. Do you see us adding dynamic predication and hardware scoreboard queues to VLIW bundles, or pushing all the dispatch irregularity into async DMA engines?

[Nathan Luevano @NathanLuevano]

@dguido @trailofbits Got it, that changes how I'd read the numbers. Where are the models actually adding the most leverage in the audit loop today: discovery, triage/deduplication, or helping auditors reason through the fix?

[Nathan Luevano @NathanLuevano]

@trailofbits Did the model synthesize the intermediate primitive layout deterministically on its first pass, or did it require iterative heap massaging with feedback from crashing runs?

[Nathan Luevano @NathanLuevano]

@CPPAlliance Nasty failure mode for embedded watchdogs and bare-metal spinlocks. LLVM optimizing out an intentional hang and falling straight through into adjacent memory has caused some wild hardfaults in firmware.

[Nathan Luevano @NathanLuevano]

@InsanityBit Clean catch by the model. Classic case where pass ordering or loop invariant hoisting treats linear memory bounds as undefined behavior to eliminate checks it should have preserved.

[Nathan Luevano @NathanLuevano]

@ATaylorFPGA Clean bringup. Offloading vision-based state estimation or optical flow directly to the FPGA fabric keeps the main processor free from timing jitter during critical flight maneuvers.

[Nathan Luevano @NathanLuevano]

@Dinosn Great breakdown. Did the failure stem from an overlap conflict in the PAT/MTRR caching attributes or a hard allocation ceiling on the system mapping PTE pool?

[Nathan Luevano @NathanLuevano]

@7h3h4ckv157 Neat portability win. The real bottleneck on consumer setups will be host memory bandwidth and PCIe lane saturation once you try scaling sequence lengths past 2k tokens.

[Nathan Luevano @NathanLuevano]

@splinedrive Wild milestone getting dual-core RTL running that cleanly. The leap in complexity usually hits the interconnect and bus arbitration logic before you even get to touch real core microarchitecture scaling.

[Nathan Luevano @NathanLuevano]

@Arikalabs Solid rule. When building bounded string formatters across legacy POSIX and MSVC CRT targets, do you still see teams get tripped up by pre-C99 return value semantics returning `-1` on truncation?