Post

Ken Shirriff
@righto.com

Intel launched the Pentium processor in 1993. Unfortunately, dividing sometimes gave a slightly wrong answer, the famous FDIV bug. Replacing the faulty chips cost Intel $475 million. I reverse-engineered the circuitry and can explain the bug. 1/9

236 reposts708 likes

XPU.news
@xpu.news

F00F isn't a discrete bug. You would end up documenting the whole decoder and pointing out the F00F case isn't handled right.

Ken Shirriff
@righto.com

The Pentium uses a division algorithm called SRT. It generates two bits at a time, making division twice as fast. SRT's secret is quotient digits can be negative: -2, -1, 0, 1, 2. A 2048-entry table gives the digit for a particular divisor and remainder. Unfortunately, 5 entries (red) were wrong. 2/

Ken Shirriff
@righto.com

The table is stored in a PLA (Programmable Logic Array). A PLA stores logic equations in two grids of transistors: the "AND plane" and the "OR plane". Logic equations are defined by putting a transistor (or not) at each grid point. This is much more compact than a ROM: 112 rows instead of 2048. 3/9

Ken Shirriff
@righto.com

I studied the transistor grids under a microscope and extracted the pattern. From this, I reverse-engineered the lookup table for division. The photos show a small part of the grids. A transistor is formed by a polysilicon line crossing doped silicon. No crossing, no transistor. 4/9

Ken Shirriff
@righto.com

Smart mathematicians figured out Pentium's division algorithm and the missing entries in 1995 by examining the pattern of errors. But I can confirm it in silicon. Moreover, I see 16 missing entries in the table, not just 5, but 11 of them don't cause errors due to luck. 5/9

Ken Shirriff
@righto.com

Ha ha. It turns out that the rug doesn't have the bug, since the rug shows the P54C version of the Pentium. This is the higher-frequency version of the original Pentium (P5). The FDIV bug had been fixed by this point. But you can see in the rug exactly where the FDIV bug was.