Wow... A speculative branch prediction path actually get's preemptively executed despite the branch outcome? No matter if the execution has side-affects??? That's quite amazing. Are modern CPUs doing speculative execution like this and just put extra safeguards around affects or do they just prefetch / decode instructions now-a-days?
Finding a CPU Design Bug in the Xbox 360 (2018)
41–50 of 55 posts
Re: Finding a CPU Design Bug in the Xbox 360 (2018)
#42Wow... A speculative branch prediction path actually get's preemptively executed despite the branch outcome? No matter if the execution has side-affects??? That's quite amazing. Are modern CPUs doing speculative execution like this and just put extra safeguards around affects or do they just prefetch / decode instructions now-a-days?
Speculative execution, however, can cause less problematic side effects. For instance, a speculatively executed load or prefetch will usually actually prefetch which will pollute the cache, TLB, etc., and reveal side-band information, but that is a performance problem and perhaps a subtle security flaw, not a correctness bug like this was.
Re: Finding a CPU Design Bug in the Xbox 360 (2018)
#43It is interesting that IBM dominated this generation of consoles, and was vanquished in the next. The high failure rates of the Xbox 360 did not help. https://en.wikipedia.org/wiki/Xbox_360_technical_problems
Re: Finding a CPU Design Bug in the Xbox 360 (2018)
#44Earlier quoted context omitted.
Fundamentally it's still a memory limitation, just in terms of memory latency/cache misses instead of capacity. If you double the size of your numbers you're doubling the space it takes up and all the problems that come with it.
No it isn't. The 64-bit capabilities of modern CPUs have almost nothing to do with memory. The address space is rarely 64 bits of physical address space anyways. A "64-bit" computer doesn't actually have the ability to deal with 64 bits of memory. If you double the size of numbers, sure it takes up twice the space. If the total size is still less that one page it isn't likely to make a big difference anyways. What re…
It's possible but rare for systems to have 64-bit GPRs but a 32-bit address space. Examples I can think of include the Nintendo 64 (MIPS; apparently commercial games rarely actually used the 64-bit instructions, so the console's name was pretty much a misnomer), some Apple Watch models (standard 64-bit ARM but with a compiler ABI that made pointers 32 bits to save memory), and the ill-fated x32 ABI on Linux (same thing but on x86-64).
That said, even "32-bit" CPUs usually have some kind of support for 64-bit floats (except for tiny embedded CPUs).
Re: Finding a CPU Design Bug in the Xbox 360 (2018)
#45Earlier quoted context omitted.
How does XBox get hacked when it uses Secure Boot?
Voltage glitching. An outside attacker who has direct, extremely fine-grained control over the power supply to the chip can cause it to brown out for one instruction cycle, preventing a result of an instruction from being written. With enough sophistication, physical access is more powerful than root access, no exceptions.
Re: Finding a CPU Design Bug in the Xbox 360 (2018)
#46Wow... A speculative branch prediction path actually get's preemptively executed despite the branch outcome? No matter if the execution has side-affects??? That's quite amazing. Are modern CPUs doing speculative execution like this and just put extra safeguards around affects or do they just prefetch / decode instructions now-a-days?
Author here: This is not a common problem. I think I was told that Alpha had basically the same bug but it is a bug, for sure. Speculative execution causing problematic side effects is a deal killer. Speculative execution, however, can cause less problematic side effects. For instance, a speculatively executed load or prefetch will usually actually prefetch which will pollute the cache, TLB, etc., and reveal side-ban…
In the last week Raymond Chen on his The Old New Thing mentioned the concept of delay slots on some CPUs.
It sounds like a similar thing, just formalized so it’s not a bug. Knowing that the instruction after a branch always executes, regardless of if the branch is taken.
Do I have that right?
Re: Finding a CPU Design Bug in the Xbox 360 (2018)
#47Earlier quoted context omitted.
> It is interesting that IBM dominated this generation of consoles, and was vanquished in the next. IBM's Power was the only logical option at the time. These consoles were being designed around 2000. Intel and AMD weren't partnering on bespoke CPUs at that time. I don't even think AMD would have been considered a viable partner. Neither had viable 64 bit options and part of console marketing at the time was the ever…
By the way, the AMD athlon 64-bit launched 2003. The PS3 launched in 2006. I had an AMD64 bit process in my laptop in 2005. What wasn't viable?
Even they could use off-the-shelf SKU it wouldn't be viable - neither one had one that fits in power envelope (not that it helped xbox...)
Re: Finding a CPU Design Bug in the Xbox 360 (2018)
#48Earlier quoted context omitted.
> It is interesting that IBM dominated this generation of consoles, and was vanquished in the next. IBM's Power was the only logical option at the time. These consoles were being designed around 2000. Intel and AMD weren't partnering on bespoke CPUs at that time. I don't even think AMD would have been considered a viable partner. Neither had viable 64 bit options and part of console marketing at the time was the ever…
By the way, the AMD athlon 64-bit launched 2003. The PS3 launched in 2006. I had an AMD64 bit process in my laptop in 2005. What wasn't viable?
Do you trust the new line of CPUs that just launched that year?
Re: Finding a CPU Design Bug in the Xbox 360 (2018)
#49Earlier quoted context omitted.
No it isn't. The 64-bit capabilities of modern CPUs have almost nothing to do with memory. The address space is rarely 64 bits of physical address space anyways. A "64-bit" computer doesn't actually have the ability to deal with 64 bits of memory. If you double the size of numbers, sure it takes up twice the space. If the total size is still less that one page it isn't likely to make a big difference anyways. What re…
Typically, it doesn't have the ability to deal with a full 64 bits of memory, but it does have the ability to deal with more than 32 bits of memory, and all pointers are 64 bits long for alignment reasons. It's possible but rare for systems to have 64-bit GPRs but a 32-bit address space. Examples I can think of include the Nintendo 64 (MIPS; apparently commercial games rarely actually used the 64-bit instructions, so…
Re: Finding a CPU Design Bug in the Xbox 360 (2018)
#50Earlier quoted context omitted.
By the way, the AMD athlon 64-bit launched 2003. The PS3 launched in 2006. I had an AMD64 bit process in my laptop in 2005. What wasn't viable?
Because consoles don't use off-the-shelf CPUs for many reasons. Neither Intel nor AMD of that time would even consider making a bespoke CPU for Sony or MS. Even they could use off-the-shelf SKU it wouldn't be viable - neither one had one that fits in power envelope (not that it helped xbox...)