7 ms·
Pentium floating-point division bug (1994)
- ForOldHack 3y agohttps://www.science.org/doi/10.1126/science.267.5195.175 https://www.science.org/doi/10.1126/science.267.5195.175
- kstrauser 3y agoA joke at the time riffed off a Star Trek TNG quote: “I am Pentium of Borg. Division is futile.”
- CamperBob2 3y agoI had friends at the time who made six-figure gains from buying INTC calls during the initial panic. Fortis fortuna.
- bombcar 3y agoI think it was the first time that the "public at large", even the computer nerds, had really realized that the hardware could have bugs, serious bugs.
- benreesman 3y agoThat’s why they called it the Pentium and not the 586: on the bench it kept coming out at 585.9999999. I’m sorry. To pay my way for the silliness: I will highly recommend “The Pentium Chronicles” for a view into that time and place. It covers the development of the P6 arch, but there is some inside baseball about the P5. And it’s just one of the best books I’ve ever read about really amazingly well-run engineering efforts.
- NovaDudely 3y agoI will always appreciate the old jokes like this. Never apologies for them no matter how cheesy! My favorite from the 90's was, what does a computer and an air conditioner have in common? Both stop working when you open windows.
- weinzierl 3y agoWhy is Linux like a Wigwam? No Windows, no Gates and Apache inside.
- 1-more 3y agoTIL that wigwam and wickiup are two names for similar enough dwellings that we may consider them the same thing. I always thought that wigwams were bigger. They're usually called wigwams in the northeast among the Iroquois confederacy and wickiups in the southwest among the Apache.
- BearOso 3y agoI think the Iroquois were mostly associated with longhouses, not huts.
- 1-more 3y agoyeah I think my issue stems from getting taught that wigwam was a synonym for longhouse when we learned the terms in school in the Northeast (like dead in the middle of an Iroquois nation). Haudenosaunee (endonym for Iroquois) literally references the longhouse. Wigwam has nothing to do with longhouse! It's an Algonquian word (further East from the Iroquois). Will keep this in mind.
- Cyphase 3y agoThis reminds me of another old line: "In a world without walls or fences, who needs Windows or Gates?"
- 3y ago
- mpixel 3y agowhat's interesting is that this isn't as serious as some of the issues today. just following the example, the result is wrong after the 4th digit. this is absolutely 'could be handled in software with a significant performance loss' territory. that isn't to say this isn't breaking -- it absolutely is. what I'm getting at is that my CPU runs 30% slower with mitigations. if I were running multiple servers like the computer I use, and I was near the capacity of my resources, I would need to add some machine(s) -- and people do. in the same way this is serious, these current issues are the same yet somehow we've lost some stuff along the way and we just don't do recalls or even receive any remedies. where's my check?
- mjg59 3y agoFor the most part, the bugs we've seen in recent history can be handled at the kernel level - there's largely no need for applications to care about them (browsers to an extent being a counterexample, but even then if you disable hyperthreading it can basically be ignored at the browser level). The floating point division bug was something that every single application would need to have handling code for. From a "What is the worst case outcome", the Spectre family of bugs may win. From a "What is going to require the most engineering effort to fix in software", fdiv would probably have been a much bigger deal.
- nextaccountic 3y agoOne option would be to have an x86 to x86 compiler that automatically fixed your code. In principle you don't need access to source and it could be shipped by the OS
- dustfree_mt 3y agoUVM, formal verification, co-simulation through DPI were at their infancy back then, thus such silly(albeit critical) errors kept popping up and were really hard to catch during pre/post-silicon testing. You can't catch spectre or similar things where multiple blocks all doing the wrong thing together with UVM or formal nowadays either(too large search space), so I'm eager to see what kind of top-level verif. methodologies people will invent as the designs grow larger and larger.
- nopinsight 3y agoI recall my former professor at UT Austin, J Strother Moore, sharing how Intel utilized an Automatic Theorem Prover he helped create to spot bugs in processors. But when engineers tweaked the design just a little, thinking it was a no-brainer that it wouldn't cause issues, they skipped the automated checks. And just like that, the infamous Pentium bug hit the headlines globally.
- sn41 3y agoThanks for that nice anecdote. Moore is also famous for the Boyer-Moore string matching algorithm. Also, in the memory of Dr. Thomas R. Nicely (1943-2019), who found the bug: https://faculty.lynchburg.edu/~nicely/ https://faculty.lynchburg.edu/~nicely/
- dcminter 3y agoBack in the day this was the more interesting bug to me even if it was less serious in practice: https://en.m.wikipedia.org/wiki/Pentium_F00F_bug https://en.m.wikipedia.org/wiki/Pentium_F00F_bug
- wscott 3y ago[ time to re-share my Dr. Nicely story ] Dr. Nicely caused quite a bit of excitement at Intel. I was on the p6 architecture team when he discovered the FDIV bug. Our FPU was formally verified and didn't have the same bug. To be nice to Dr Nicely we sent him a pre-release p6 development system to test with his program to demonstrate that his bug was fixed. He was working on a prime number sieve program and came back reporting that the p6 ran at 1/2 the speed of a Pentium for his code. Wow, another blackeye/firestorm caused by Dr. Nicely. He had too much of an audience for him to report to the world this new processor was slower. So I got to spend a lot of time learning how to sieve works and what is happening. For the most part, it allocates a huge array in memory with each byte representing a number. You walk the array with a stride of known primes setting bytes and whatever is left must be prime. ie. every 3 is not prime, every 5 is not prime, every 7... So in the steady state, you are writing a single byte to a cache line without reading anything. And every write hits a different cache line. Now p6 had a write-allocate cache, but the Pentium would only allocate on read, so on the Pentium a write that misses the cache would become a write to memory. On the p6 that write would need to load the cache line from memory into the cache and then the line in the cache was modified. And since every line in the cache was also modified we had to flush some other cache line first to make room. So every 1-byte write would become a 32-byte write to memory followed by a 32-byte read from memory. Normally write-allocate is a good thing, but in this case, it was a killer. We were stumped. Then the magic observation: 99% of these writes were marking a space that was already marked. When you get up to walking by large strides most of those were already covered by one of the smaller factors. So if you change the code from: array[N] = 1 to: if (!array[N]) array[N] = 1 Now suddenly we are doing a read first, and after that read we skip the write so the data in the cache doesn't become modified and can be discarded in the future. Also, the p6 was a super-scalar machine that ran multiple iterations of this loop in parallel and could have multiple reads going to memory at the same time. With that small tweak, the program got 4X faster and we went from being 1/2X the speed of a Pentium to being twice the speed. And this was at the same clock frequency. The test hardware ran 100Mhz, we released at 200Mhz and went up from there.
- nextaccountic 3y agoCould this transformation be still effective in modern processors?
- ajsnigrutin 3y agoIt's funny how they had to recall the CPUs (even if they tried to make it harder), and now, with all the security issues (from spectre to downfall), where the patches cause a massive CPU performance hit, noone is yelling for a recall.
- jansan 3y agoI would rather call it "noteworthy" than "funny".
- H8crilA 3y agoVolkswagen also pretty much got away with selling cars that do not reach power specifications (if you remove the environmental problem).
- toast0 3y agoI don't know about outside the US, but in the US, they had to offer to buy back the cars and/or modify them to fit the environmental spec. I don't know about power specs, but the mileage specs were done under the compliant engine control regime; so post modification you would get mileage to spec as opposed to the better mileage available earlier. The buy back option was based on pricing before the news broke and for a good condition vehicle, there was an adjustment for odometer miles, but the vehicle could be in any condition, just had to run and move on its own power. They were not permitted to resale purchased vehicles anywhere globally unless they were modified to properly comply with emissions controls. And they were forced into selling EVs and building a charging network. Maybe that will work out for them, maybe not.
- ghaff 3y agoWell, the "solution" to side channel attacks (including those that haven't been discovered yet) on pretty much every out-of-order execution processor out there, which is to say pretty much every high performance processor, is to disable a lot of features and significantly throttle them--which no one really wants to do.
- 3y ago
- print_goto_ten 3y agoI recall VB6 having a checkbox for dealing with this bug when you complied.
- baggy_trough 3y agoIs it known how those few entries in the table got the wrong values?
- whycome 3y agoIntel's whitepaper on it has a bit more information. But still seems to (after a skim) kinda handwave away just HOW the bug got introduced. https://users.fmi.uni-jena.de/~nez/rechnerarithmetik_5/fdiv_bug/intel_white11.pdf https://users.fmi.uni-jena.de/~nez/rechnerarithmetik_5/fdiv_...
- dbcurtis 3y agoYes. Off-by-one error in a bash script that generated them.
- lizknope 3y agoMy first PC was a Pentium 90 that I got in summer 1994. It had the FDIV bug. I read about the bug, didn't think it was a big deal for how I used my computer and never got a replacement chip. I still have the CPU in a box in the closet.
- klinquist 3y ago"Intel Inside Can't Divide!" was what people said when this news broke.
- dbcurtis 3y agoMy take away from this a lesson about validation strategy. First, I will point out that exhaustive testing for 2^64 * 2^64 operand pairs is impractical, for scale recall that there are around 2^75 (I maybe off a bit here) atoms in the universe. So you wont run all pairs, much less generate expected results for all pairs. So, you must sample. Purely random sampling is mostly going to generate operand pairs that are not edge cases and corner cases, where one or both of the operands falls precisely on a binate boundary (the precise point on the floating point number line where the exponent increments/decrements by 1). Your sampling must be heavier for the edge cases. Lesson: Understand the edge cases and be sure to attack them.
- colejohnson66 3y agoThe x87 FPU used here gives 80 bits of storage, so it's actually 2^80*2^80 operand pairs.
- dbcurtis 3y agoyes, I was simplifying. also 32 bot mode.
- jgalt212 3y agoI have always wondered if anyone was able to construct an interest rate derivatives pick-off play based on this bug. My searches of the intertubes have found nothing so far.