4 ms·

My first job out of college in 2007 was building a pdp-11/70 emulator on virtex-5 fpgas to replace the control computers for CANDU nuclear reactors. We had a p

My first job out of college in 2007 was building a pdp-11/70 emulator on virtex-5 fpgas to replace the control computers for CANDU nuclear reactors. We had a punched-tape and microfiche of the xxdp diagnostic test suite to pass: http://bitsavers.org/pdf/dec/pdp11/microfiche/ftp.j-hoppe.de/bw/gh/AH-7968F-MC__PDP11-70__11-70_CPU_%232__CEKBBF0__%28C%2975,80.pdf http://bitsavers.org/pdf/dec/pdp11/microfiche/ftp.j-hoppe.de... Several nuances that we replicated were probably never used by the production software. For example the order of execution of a floating point instruction trap followed by a stack pointer trap due to the pipelining of the fpu instructions, even though we weren’t executing anything out-of-order. I also produced the correct partial result for the division algorithm in the event of overflow condition.

ComputerGuru 5y ago
Test vectors are the biggest secret sauce for any CPU or microcontroller. Word on the street is that the STM32Fxxx test vectors were stolen and that’s why you have perfect replicas being churned out of China, not like the typical cases where your devices fail with the fake chip installed.
- sydthrowaway 5y ago
  I mean, with a list of all test input vectors and expected outputs, you could derive the entire chip right? It’s just logic gates.
  - ComputerGuru 5y ago
    You can for some things, but that wouldn’t be a very efficient result (it’s basically going to give you a massive lookup table). It’s also not that simple since we are not talking about stateless behavior - think more along the lines of interrupts, counters, events, dma, analog input/output, etc. none of which really map into a straightforward input:output relationship, most of which can be used together to some extent to form a gestalt. Even with the test vectors it is a Herculean task.
  - enriquto 5y ago
    Not in a unique nor meaningful way. For example, a valid "derivation" would hold a list of all input/output pairs and give zero otherwise.
  - duskwuff 5y ago
    Not even close. The STM32Fxxx is a series of microcontrollers. They have tons of internal state which isn't exhaustively covered by test vectors. (For example, a basic 16-bit timer peripheral has roughly 60 bits of internal state, and there certainly aren't going to be 2^60 test vectors to cover that.)
  - rkangel 5y ago
    No, there's too much complexity. What you can do is reverse engineer it more manually using data sheets etc., and then use the test vectors to ensure that you got it right. They're likely to be designed to cover all the interesting corner cases that might cause problems.

ComputerGuru 5y ago

Test vectors are the biggest secret sauce for any CPU or microcontroller. Word on the street is that the STM32Fxxx test vectors were stolen and that’s why you have perfect replicas being churned out of China, not like the typical cases where your devices fail with the fake chip installed.

sydthrowaway 5y ago
I mean, with a list of all test input vectors and expected outputs, you could derive the entire chip right? It’s just logic gates.
- ComputerGuru 5y ago
  You can for some things, but that wouldn’t be a very efficient result (it’s basically going to give you a massive lookup table). It’s also not that simple since we are not talking about stateless behavior - think more along the lines of interrupts, counters, events, dma, analog input/output, etc. none of which really map into a straightforward input:output relationship, most of which can be used together to some extent to form a gestalt. Even with the test vectors it is a Herculean task.
- enriquto 5y ago
  Not in a unique nor meaningful way. For example, a valid "derivation" would hold a list of all input/output pairs and give zero otherwise.
- duskwuff 5y ago
  Not even close. The STM32Fxxx is a series of microcontrollers. They have tons of internal state which isn't exhaustively covered by test vectors. (For example, a basic 16-bit timer peripheral has roughly 60 bits of internal state, and there certainly aren't going to be 2^60 test vectors to cover that.)
- rkangel 5y ago
  No, there's too much complexity. What you can do is reverse engineer it more manually using data sheets etc., and then use the test vectors to ensure that you got it right. They're likely to be designed to cover all the interesting corner cases that might cause problems.