英特尔:一个漏洞和一个专业人士——布拉德福德·摩根·怀特著
Intel: A Bug and a Pro

原始链接: https://www.abortretry.fail/p/intel-a-bug-and-a-pro

20世纪90年代中期,英特尔凭借其用于个人电脑及其他系统的x86架构在微处理器市场占据主导地位。1993年发布的奔腾处理器,以低于基于RISC架构的工作站CPU的价格,提供了比前几代产品显著的性能提升。然而,1994年,奔腾的浮点运算单元(FDIV)被发现存在缺陷,导致计算错误。尽管英特尔最初轻描淡写了这个问题,但公众的关注和IBM停止奔腾电脑的出货迫使英特尔提供更换,为此公司损失了4.75亿美元。 尽管存在FDIV缺陷,英特尔的i960仍然成为超级计算机中领先的RISC芯片。磁带载体封装技术的发展使得奔腾处理器能够应用于像东芝T4900CT这样的笔记本电脑。1995年Windows 95的发布刺激了个人电脑销售和奔腾处理器需求的显著增长。 1995年末,英特尔推出了面向工作站和服务器的奔腾Pro处理器。它采用超标量乱序执行架构,并提供了令人印象深刻的32位整数性能。尽管与最初的奔腾处理器相比,奔腾Pro的市场成功有限,但它帮助英特尔渗透了工作站和服务器市场。到1996年,英特尔已经成为一家非常成功的公司。

Hacker News 最新 | 过去 | 评论 | 提问 | 展示 | 招聘 | 提交 登录 英特尔:一个漏洞和一个专业人士 – Bradford Morgan White (abortretry.fail) 著 rbanffy 1小时前 11 分 | 隐藏 | 过去 | 收藏 | 1 评论 jmclnx 2分钟前 [–] 关于 F00F 漏洞,一篇不错的文章。 回复 加入我们,参加 6月16-17日于旧金山举办的 AI 初创公司学校! 指南 | 常见问题 | 列表 | API | 安全 | 法律 | 申请 YC | 联系我们 搜索:

原文

By 1994, Intel had managed to capture about 75% of the microprocessor market for personal computers. The company had also found its way into automobiles, industrial controls, telecommunications equipment, and supercomputers. The Intel x86 architecture had propelled the company to these immense heights, and they’d established a cadence of releases in that CPU line of roughly four years. The investment that both individuals and companies had made in hardware and software for the architecture was measured in billions.

While the Pentium had been announced on the 22nd of March in 1993, systems built around the Pentium were announced on the 17th of May in 1993, and volume shipments didn’t occur until later in the year. The Pentium’s 60MHz variant could deliver 100 million instructions per second with the Dhrystone 1.1 benchmark while the 66MHz variant bumped that to 112MIPS. These were the first x86 chips to be capable of this kind of performance, and they nearly doubled the performance of the original i486. This kind of performance nearly put Intel in competition with RISC-based UNIX workstation hardware, and Intel’s biggest software partner, Microsoft, supported those workstations with NT. A key difference, however, was that the Pentium’s price was around $900 while the MIPS R8000 was around $2500 and the Alpha 21064 was over $3000. Naturally, these were all far more reasonably priced when purchased in volume, but Intel was far better in terms of performance per dollar. For less than the cost of a high performance RISC CPU, a customer could purchase an entire Pentium-based PC that, while not as powerful, was capable of the same kinds of work. This is remarkable as PC manufacturers were running into the problems already solved by workstation makers: thermals, volatage variation, RFI, EMI. These kinds of considerations hadn’t been too big a hill to climb with an XT, but they were far more serious issues with a Pentium. They were serious enough that Intel had provided thermal models to system makers before they had provided the silicon.

Early in 1994, Intel announced the Pentium P54C for Socket 5. These chips required a 3.3 volt power supply, could run at 75MHz, 90MHz, or 100MHz, and utilized an internal clock multiplier allowing them to operate at a higher frequency than the external buses. These chips bumped the transistor count to 3.3 million, and were built on a half micron BiCMOS process. These Pentiums also added support for use in multiprocessor systems which was the primary source of the increased transistor count. When adding a processor, a machine needs more circuitry for cache, memory, interrupts, and bus utilization.

While most news for Intel was great, not all of it was. A few of the first generation Pentium processors were in the hands of Professor Thomas R. Nicely at Lynchburg College in Virginia where they were put to work researching reciprocals of twin prime numbers. On the 13th of June in 1994, Nicely noted that after adding three Pentium-based computers to his lab, he was getting inconsistent results in floating point divisions. He ruled out all causes other than hardware error on the 19th of October. Specifically, Nicely noted that 1 divided by 824633702441 was incorrect on three different Pentium systems while it was correct on multiple i486 and i386 systems. He then sent an email to Intel on the 24th documenting his discovery. Intel didn’t provide much information to him beyond stating that the issue was known. He then sent an email to several other people on the 30th. His email read:

It appears that there is a bug in the floating point unit (numeric coprocessor) of many, and perhaps all, Pentium processors.

In short, the Pentium FPU is returning erroneous values for certain division operations. For example, 1/824633702441.0 is calculated incorrectly (all digits beyond the eighth significant digit are in error). This can be verified in compiled code, an ordinary spreadsheet such as Quattro Pro or Excel, or even the Windows calculator (use the scientific mode), by computing (824633702441.0)*(1/824633702441.0), which should equal 1 exactly (within some extremely small rounding error; in general, coprocessor results should contain 19 significant decimal digits). However, the Pentiums tested return 0.999999996274709702 for this calculation. A similar erroneous value is obtained for x*(1/x) for most values of x in the interval 824633702418 <= x <= 824633702449, and throughout any interval obtained by multiplying or dividing the above interval by an integer power of 2 (there are yet other intervals which also produce division errors).

The bug can also be observed by calculating 1/(1/x) for the above values of x. The Pentium FPU will fail to return the original x (in fact, it will often return a value exactly 3072 = 6*0x200 larger).

The bug has been observed on all Pentiums I have tested or had tested to date, including a Dell P90, a Gateway P90, a Micron P60, an Insight P60, and a Packard-Bell P60. It has not been observed on any 486 or earlier system, even those with a PCI bus. If the FPU is locked out (not always possible), the error disappears; but then the Pentium becomes a “586SX”, and floating point must run in emulation, slowing down computations by a factor of roughly ten.

I encountered erroneous results which were related to this bug as long ago as June, 1994, but it was not until 19 October 1994 that I felt I had eliminated all other likely sources of error (software logic, compiler, chipset, etc.). I contacted Intel Tech Support regarding this bug on Monday 24 October (call reference number 51270). The contact person later reported that the bug was observed on a 66-MHz system at Intel, but had no further information or explanation, other than the fact that no such bug had been previously reported or observed.

Further information can be obtained by contacting me directly, and by downloading files from the [anonymous.nicely.pentium_bug] directory of the acavax.lynchburg.edu machine via anonymous ftp on Internet (password ANONYMOUS, user ID = Internet ID). These files include a documentation file, a DOS executable image demonstrating the bug, and the source code for the demonstration. The zip file uses PKZIP version 2.04g.

I would be interested in hearing of test results from other Pentiums, and also from 486-DX4s and (if anybody has one yet) the AMD, Cyrix, and NexGen clones of the Pentium.

You may use this information freely as long as you give me attribution by name and employer.

This… was exactly the sort of thing folks at Intel would not have wanted to have happen. Andrew Schulman, author of Undocumented DOS and Undocumented Windows, was among the recipients of that email. At this time, Schulman didn’t own a Pentium, so he forwarded the email to Richard Smith of Phar Lap and asked him to test it. Smith and his company confirmed the bug, and Smith posted the email to a CompuServe forum. Within 24 hours, there were 10 more confirmations. This was called the FDIV bug (after the x86 assembly language mnemonic for floating point division), and it made headlines. On the 7th of November in 1994, the Electronic Engineering Times ran an article titled: Intel fixes a Pentium FPU glitch which read:

To correct an anomaly that caused inaccurate results on some high-precision calculations, Intel Corp. last week confirmed that it had updated the floating-point unit (FPU) in the Pentium microprocessor

The company said that the glitch was discovered midyear and was fixed with a mask change in recent silicon. "This was a very rare condition that happened once every 9 to 10 billion operand pairs," said Steve Smith, a Pentium engineering manager at Intel.

A spot check last week indicated the problem is present in at least one recently made Pentium-based PC. Intel said it could not quantify how many such systems were in the field.

Said an Intel spokesman: "This doesn't even qualify as an errata. We fixed it in a subsequent stepping."

Erroneous division

The issue came to light last week in a message, on Compuserve's "Canopus" forum, which was a reposting of a private e-mail communication from Lynchburg College (Lynchburg,Va.) mathematics professor Thomas Nicely. "The Pentium floating-point unit is returning erroneous values for certain division operations," he wrote. "For example, 1/824633702441 is calculated incorrectly (all digits beyond the eigth significant digit are in error). This can be verified...by computing (824633702441.0) X (1/824633702441.0), which should equal 1 exactly (within some exteremely small rounding error; in general, coprocessor results should contain 19 significant decimal digits). However, the Pentiums tested return 0.999999996274709702 for this calculation."

"The bug has been observed on all Pentiums I have tested or had tested to date, including a Dell P90, a Gateway P90, a Micron P60, an Insight P60 and a Packard-Bell P60. It has not been observed on any 486 or earlier system, even those with a PCI bus. If the floating-point unit is locked out (not always possible), the error disappears."

Intel's Smith emphasized that the anomaly would not affect the average user. Speaking of Nicely, Smith said: "He's the most exterme user. He spends round-the-clock time calculating reciprocals. What he observed after running this for months is an instance where we have eight decimal points correct, and the ninth not showing up correctly. So you get an error in the ninth decimal digit to the right of the mantissa. I think even if you're an engineer, you're not going to see this."

Nicely said he pointed out the problem to Intel, because "it has a major effect in mathematics, because we have to have absolute precision. I suspect that, to the majority of people, it will be irrelevant. But engineers may have a different outlook."

A spot check conducted at EE Times last week tested out Nicely's expression on an AcerPower Minitower Pentium/60 machine, which was just received from Acer America. The result was 0.999999996247.

Intel said it discovered the anomaly through its own random testing. The fix involved a mask change to the Pentium's floating-poing unit. Specifically, according to Intel's Smith, the correction entailed an update to the programmable-logic array (PLA) on the Pentium.

"This is related to the state machine in the floating-point unit. There are certain cases where, way out in the operation, we didn't handle the precision correctly," he said. "It's an iterative calculation, and at each point, you have to go through a lookup process that says what your next approximation for the bits further out in the mantissa, [which equates to the digits] further to the right of the decimal point."

Better results

The fix entailed adding terms, or additional gate-sequences, to the PLA. That corrected the erroneous results returned from the problematic lookup table accesses.

Intel said there are no part-number designations or other markings on the updated microprocessors - which became available in the last few months - to differentiate them from the earlier anomalous parts. However, an Intel spokesman said, "If customers are concerned, they can call and we'll replace" any of the parts that contained the bug.

CNN reported on the bug on the 22nd of November, and then on the 23rd of November in 1994, the New York Times ran an article titled: Flaw Undermines Accuracy of Pentium Chips, which read in part:

The flaw appears in all Pentium chips now on the market, in certain types of division problems involving more than five significant digits, a mathematical term that can include numbers before and after a decimal point.

Intel declined to say how many Pentium chips it made or sold, but Dataquest, a market research company in San Jose, Calif., estimated that in 1994 Intel would sell 5.5 million to 6 million Pentiums, roughly 10 percent of the number of personal computers sold worldwide.

Intel said yesterday that it did not believe the chip needed to be recalled, asserting that the typical user would have but one chance in more than nine billion of encountering an inaccurate result as a consequence of the error, and thus there was no noticeable consequence to users of business or home computers. Indeed, the company said it was continuing to send computer makers Pentium chips built before the problem was detected.

This was, most likely, the first widely publicized instance of a hardware error in a microprocessor. The publicity, however, didn’t get Intel to act. They would ship replacements only if a customer could prove to an Intel representative that he/she required accuracy beyond what his/her Pentium could provide. On the 12th of December, IBM announced that it was halting shipments of Pentium-based machines. While Intel had stated that an average user might encounter the bug once in 27,000 years, IBM found that a user would likely encounter this bug every few days. Intel quickly changed their plans announcing on the 19th that they’d replace all flawed Pentiums. This cost them $475 million (or roughly $1.018 billion in 2025 dollars).

Ken Sherriff found the bug in silicon and provided an in-depth explanation for what exactly went wrong and how it got corrected if you’d like more detailed coverage of it.

The year was far better for Intel in the supercomputer space with the i960 becoming the leading RISC chip in total number of chips sold. This little flake of silicon could be found in networking devices, laser printers, and the world’s most powerful supercomputer at the time built of two Intel Paragon XP/S 140s at Sandia National Laboratories.

By the end of the year, Intel’s Tape Carrier Packaging (TCP) had made its way to market. Intel described TCP as offering reduced pitch, thin package profiles, and a small on-board footprint. They also stated: “Key package features include surface mount technology design, lead pitch of 0.25 mm, 48 mm tape format, polyimide-up for pick and place, and slide carrier handling. Shipped flat in slide carriers, the leads are designed to be formed into a ‘gull-wing’ configuration and reflowed onto the PCB by one of several methods.” What this meant was that the Pentium could be used in notebooks. The first of these was (as far as I could find) was the Toshiba T4900CT. This notebook featured an Intel Pentium clocked at 75MHz (3.3 volt, 16K cache), 10.4” SVGA TFT-LCD, 772MB HDD, 8MB of RAM (expandable to 40MB), 2x PCMCIA, VL-bus GPU, 3.5 inch 1.44MB floppy disk drive, and it ran Windows 3.11 for Workgroups. If you are aware of an early Pentium notebook, please let me know in the comments.

Despite the FDIV bug and a healthy $3.55 billion spent on capital and R&D, Intel’s income for 1994 was $2.28 billion on revenues of $11.5 billion.

With corrected Pentiums and the P54C out in the wild, 1995 was a great year for the company. With the launch of Windows 95 on the 24th of August, sales for the Pentium increased significantly with PC sales increasing by 25% globally to around 60 million. Microsoft’s success was lifting all boats in the PC markets, and it was doing so in a dramatic way. It’s support for the PCI bus didn’t hurt Intel either.

On the 1st of November in 1995, Intel launched the Pentium Pro, and had Intel kept its original naming scheme, this would have been the i686. The original Pentium Pro was built of 5.5 million transistors on either a half micron or a 0.35 micron BiCMOS process. It shipped in a 387-pin CPGA (Socket 8), supported a clock speed of 150MHz to 200MHz, and could support single, dual, and quad processor configurations. While a 32bit CPU, the Pentium Pro had a 36bit address width and supported PAE which allowed it to address up to 64GB of RAM. It had an 8K L1 instruction cache, an 8K L1 data cache, and a 256K L2 on the low-end and up to 1MB L2 on the high-end. The L2 was on-package but not on-chip, and it had its own back-side bus. This design allowed the CPU to read memory and cache concurrently. TDP ranged from 29.2W to 44W depending upon the clock, bus speed (60MHz or 66MHz), and cache size.

The Pentium Pro shared almost nothing with its predecessors beyond its name, manufacturer, and ISA. The lead designer was Fred Pollack who’d previously worked on the iAPX 432. Internally, the Pentium Pro was a superscalar, out of order, RISC chip with support for speculative execution and register renaming. On every cycle, up to 16bytes were fetched from the instruction cache and sent to decoders of which there were three. These decoders took x86 instructions and translated them into RISC micro-operations. Two of these were intended only for simple x86 instructions (simple defined here as instructions that are translated into a single RISC micro-operation in a single cycle) while the third could handle any instruction. The Pentium Pro heavily relied upon microcode and that microcode was upgradeable under either the BIOS or operating system control. Yet another deviation from earlier x86 chips was backward compatibility. Unlike earlier Intel x86 CPUs, the Pentium Pro, while capable of running 16bit code, didn’t emphasize this, and it was, indeed, slower than other x86 chips of that time at executing 16bit code. The cause of the slow down was that a read from a large register, say EAX, would stall until a write to a partial register, say AX, retired. This stall would then result in a pipeline flush. The Pentium Pro was meant to run fully 32bit software, and the ability to run software for earlier chips was meant to be a convenience. The Pentium Pro was specifically targetted at workstations and servers where one wouldn’t usually be running a standard word processor, spreadsheet, or video game. Those applications were the domain of the i386, i486, or original Pentium.

For those workstation and server users who wanted crazy performance more cheaply than a traditional UNIX on RISC system, the Pentium Pro delivered. When the chip shipped on the 2nd of November, pricing stood at $974 to $1325 (the top end SKU would ship slightly later at a price of $1989), and it was faster than all competitors at 32bit integer performance. While it lagged in floating point, the ability to combine multiple Pentiums Pro in a single system, allowed Intel to compete well despite that disadvantage. Truly, the Pentium Pro was remarkable. The slowest part, at 166MHz, delivered slightly more than double the integer performance of a 200MHz R4400 in SYSmark/NT. Obviously, when dealing with real-world applications, this could vary, but for many applications, the Pentium Pro did punch above its price. To put the pricing of full systems into perspective, Intergraph would launch the first quad-CPU Pentium Pro workstations in November of 1996. All of the machines in this lineup featured a graphics add-in card made by Intergraph (G76, G95, or Intense 3D). The cheapest was the TD-200 ranging from $1500 to $5000 depending upon the graphics card used. In that top of the line single-CPU model, the machine delivered roughly twice the graphical performance of an SGI O2 (according to Intergraph). Completing the line up from Intergraph were the TD-310, TD-410, and TD-610. These came with one, two, or four Pentiums Pro. These could be configured with up to 1GB of RAM, an Ultra SCSI hard disk, an ethernet controller, a Creative Labs Vibra 16c (integrated), up to ten expansion slots (PCI and ISA) in desk-side models, an 8x CD-ROM, a 3.5 inch floppy disk drive, dual-screen support, and Windows NT 4.0.

The Pentium Pro would not have anywhere near the market success of the Pentium, but that wasn’t its purpose. It was meant to break into the workstation and server markets; goals it accomplished. Additionally, the architecture of the Pentium Pro (P6) would server Intel quite well for more than a decade.

Intel closed 1995 with $3.5 billion in income on $16.2 billion in revenues. Starting 1996 with the Pentium, Windows 95, and the explosion of the World Wide Web, Intel was benefiting from massive ecosystem growth. While the FDIV bug certainly got quite a bit of press, cost quite a bit of money, and was something Intel would surely rather have avoided, it didn’t hurt the company’s trajectory at all. Intel made it to number 5 on Fortune’s most admired companies list in 1996, and the company’s market value reached $111 billion. Intel closed 1996 with $5.157 billion in income on revenues of $20.847 billion, assets of $13.684 billion, and liabilities of $4.863 billion.

I now have readers from many of the companies whose history I cover, and many of you were present for time periods I cover. A few of you are mentioned by name in my articles. All corrections to the record are welcome; feel free to leave a comment.

联系我们 contact @ memedata.com