the intel pentium division flaw alan edelman department of mathematics laboratory for computer...

54
MIT MIT The Intel Pentium Division Flaw Alan Edelman Alan Edelman Department of Mathematics Department of Mathematics Laboratory for Computer Science Laboratory for Computer Science Massachusetts Institute of Massachusetts Institute of Technology Technology

Upload: posy-chapman

Post on 02-Jan-2016

216 views

Category:

Documents


0 download

TRANSCRIPT

Page 1: The Intel Pentium Division Flaw Alan Edelman Department of Mathematics Laboratory for Computer Science Massachusetts Institute of Technology

MITMIT

The Intel Pentium Division Flaw

The Intel Pentium Division Flaw

Alan EdelmanAlan EdelmanDepartment of MathematicsDepartment of Mathematics

Laboratory for Computer ScienceLaboratory for Computer Science

Massachusetts Institute of TechnologyMassachusetts Institute of Technology

Page 2: The Intel Pentium Division Flaw Alan Edelman Department of Mathematics Laboratory for Computer Science Massachusetts Institute of Technology

MITMIT

Not So Well KnownNot So Well Known

The bug itself is The bug itself is (mathematically) (mathematically)

neat!neat!

A Lesson (for me anyway)

So much incomplete So much incomplete information is out there.information is out there.

Page 3: The Intel Pentium Division Flaw Alan Edelman Department of Mathematics Laboratory for Computer Science Massachusetts Institute of Technology

MITMIT

Interesting Related Topics (but my topic is the bug)Interesting Related Topics (but my topic is the bug)

Risk to Pentium ownersRisk to Pentium owners Intel’s chip replacement blunderIntel’s chip replacement blunder KahanKahan’s SRT division tester’s SRT division tester MolerMoler, , CoeCoe, and , and Mathisen Mathisen software software

workaroundworkaround Only the lawyers get richOnly the lawyers get rich Those ubiquitous Pentium jokesThose ubiquitous Pentium jokes

Page 4: The Intel Pentium Division Flaw Alan Edelman Department of Mathematics Laboratory for Computer Science Massachusetts Institute of Technology

MITMIT

OutlineOutline

Nicely’s DiscoveryNicely’s Discovery Computer Science PrerequisitesComputer Science Prerequisites Division (Division (SRTSRT=Sweeney,Robertson,Tocher)=Sweeney,Robertson,Tocher) Pentium Lookup TablePentium Lookup Table Division ExampleDivision Example Six Ones ResultSix Ones Result

Inequality AnalysisInequality Analysis ““Send More Money” PuzzleSend More Money” Puzzle

Always nearly five good digitsAlways nearly five good digits

Page 5: The Intel Pentium Division Flaw Alan Edelman Department of Mathematics Laboratory for Computer Science Massachusetts Institute of Technology

MITMIT

Nicely’s Twin Prime Bug DiscoveryNicely’s Twin Prime Bug Discovery

Twin primes: Twin primes: (5,7) (11,13) (17,19) (29,31) ...(5,7) (11,13) (17,19) (29,31) ... Nicely was summing twin prime reciprocals:Nicely was summing twin prime reciprocals: S = 1/5 + 1/ 7 + 1/11 + 1/13 + 1/17 + 1/19 S = 1/5 + 1/ 7 + 1/11 + 1/13 + 1/17 + 1/19

+ ...+ ... SS is finite. is finite. Nicely computed on many platforms.Nicely computed on many platforms. Nicely checked his work.Nicely checked his work.

Page 6: The Intel Pentium Division Flaw Alan Edelman Department of Mathematics Laboratory for Computer Science Massachusetts Institute of Technology

MITMIT

Computer Science PrerequisitesComputer Science Prerequisites

Carry Save Addition.Carry Save Addition. One’s vs. Two’s Complement.One’s vs. Two’s Complement.

Page 7: The Intel Pentium Division Flaw Alan Edelman Department of Mathematics Laboratory for Computer Science Massachusetts Institute of Technology

MITMIT

Carry-save AdditionCarry-save Addition

1212 2121+ 19+ 19 5252

Page 8: The Intel Pentium Division Flaw Alan Edelman Department of Mathematics Laboratory for Computer Science Massachusetts Institute of Technology

MITMIT

Carry-save AdditionCarry-save Addition

1212 2121+ 19+ 19 5252 2020

Answer (mod 32)

Page 9: The Intel Pentium Division Flaw Alan Edelman Department of Mathematics Laboratory for Computer Science Massachusetts Institute of Technology

MITMIT

Carry-save AdditionCarry-save Addition

0110001100101011010110011100111010010100

++

1212 2121+ 19+ 19 5252 2020

Answer (mod 32)

Page 10: The Intel Pentium Division Flaw Alan Edelman Department of Mathematics Laboratory for Computer Science Massachusetts Institute of Technology

MITMIT

Carry-save AdditionCarry-save Addition

0110001100101011010110011100111010010100

01100011001010110101 11 00

Sum Bits (s)

Carry Bits (c)

++++

1212 2121+ 19+ 19 5252 2020

Answer (mod 32)

Page 11: The Intel Pentium Division Flaw Alan Edelman Department of Mathematics Laboratory for Computer Science Massachusetts Institute of Technology

MITMIT

Carry-save AdditionCarry-save Addition

01100011001010110101 11 00

s = xyz = x+y+z (mod 2)c = xy xz yz = (x+y+z | 2)

0110001100101011010110011100111010010100

++++

Sum Bits (s)

Carry Bits (c)

1212 2121+ 19+ 19 5252 2020

Answer (mod 32)

Page 12: The Intel Pentium Division Flaw Alan Edelman Department of Mathematics Laboratory for Computer Science Massachusetts Institute of Technology

MITMIT

Carry-save AdditionCarry-save Addition

0110001100101011010110011100111010010100

01100011001010110101 0101 0000

s = xyz = x+y+z (mod 2)c = xy xz yz = (x+y+z | 2)

++++

Sum Bits (s)

Carry Bits (c)

1212 2121+ 19+ 19 5252 2020

Answer (mod 32)

Page 13: The Intel Pentium Division Flaw Alan Edelman Department of Mathematics Laboratory for Computer Science Massachusetts Institute of Technology

MITMIT

Carry-save AdditionCarry-save Addition

0110001100101011010110011100111010010100

0110001100101011010111001110010100001000

s = xyz = x+y+z (mod 2)c = xy xz yz = (x+y+z | 2)

++++

Sum Bits (s)

Carry Bits (c)

1212 2121+ 19+ 19 5252 2020

Answer (mod 32)

Page 14: The Intel Pentium Division Flaw Alan Edelman Department of Mathematics Laboratory for Computer Science Massachusetts Institute of Technology

MITMIT

Carry-save AdditionCarry-save Addition

0110001100101011010110011100111010010100

0110001100101011010111001110010100001000

s = xyz = x+y+z (mod 2)c = xy xz yz = (x+y+z | 2)

+10011+10011

++++

Sum Bits (s)

Carry Bits (c)

1212 2121+ 19+ 19 5252 2020

Answer (mod 32)

Page 15: The Intel Pentium Division Flaw Alan Edelman Department of Mathematics Laboratory for Computer Science Massachusetts Institute of Technology

MITMIT

Carry-save AdditionCarry-save Addition

0110001100101011010110011100111010010100

0110001100101011010111001110010100001000

s = xyz = x+y+z (mod 2)c = xy xz yz = (x+y+z | 2)

+10011+10011 0001000010 1001010010

Sum Bits (s)

Carry Bits (c)

++++

Sum Bits (s)

Carry Bits (c)

1212 2121+ 19+ 19 5252 2020

Answer (mod 32)

Page 16: The Intel Pentium Division Flaw Alan Edelman Department of Mathematics Laboratory for Computer Science Massachusetts Institute of Technology

MITMIT

One’s vs. Two’s ComplementOne’s vs. Two’s Complement

Two’s ComplementTwo’s Complement

33 0001100011

22 0001000010

11 0000100001

00 0000000000

-1-1 1111111111

-2-2 1111011110

-3-3 1110111101

Page 17: The Intel Pentium Division Flaw Alan Edelman Department of Mathematics Laboratory for Computer Science Massachusetts Institute of Technology

MITMIT

One’s vs. Two’s ComplementOne’s vs. Two’s Complement

Two’s ComplementTwo’s Complement One’s Complement One’s Complement

33 0001100011 0001100011

22 0001000010 0001000010

11 0000100001 0000100001

00 0000000000 0000000000

-1-1 1111111111 1111011110

-2-2 1111011110 1110111101

-3-3 1110111101 1110011100

Page 18: The Intel Pentium Division Flaw Alan Edelman Department of Mathematics Laboratory for Computer Science Massachusetts Institute of Technology

MITMIT

One’s vs. Two’s ComplementOne’s vs. Two’s Complement

Two’s ComplementTwo’s Complement One’s Complement One’s Complement

33 0001100011 0001100011

22 0001000010 0001000010

11 0000100001 0000100001

00 0000000000 0000000000

-1-1 1111111111 1111011110

-2-2 1111011110 1110111101

-3-3 1110111101 1110011100

Page 19: The Intel Pentium Division Flaw Alan Edelman Department of Mathematics Laboratory for Computer Science Massachusetts Institute of Technology

MITMIT

Division Algorithms:Division Algorithms:

Page 20: The Intel Pentium Division Flaw Alan Edelman Department of Mathematics Laboratory for Computer Science Massachusetts Institute of Technology

MITMIT

Long Division ExampleLong Division Example

1.428571.42857 771010.00000 .00000 7 7 3030 28 28 2020 1414 6060

Page 21: The Intel Pentium Division Flaw Alan Edelman Department of Mathematics Laboratory for Computer Science Massachusetts Institute of Technology

MITMIT

Long Division ExampleLong Division Example

qq00 qq11qq22qq33qq44qq55

1.428571.42857 710.00000 710.00000 7 7 30 30 28 28 20 20 1414 60 60

Chosen to satisfyusual inequalities

Page 22: The Intel Pentium Division Flaw Alan Edelman Department of Mathematics Laboratory for Computer Science Massachusetts Institute of Technology

MITMIT

p = 10, d = 7p = 10, d = 710d = 7010d = 70

ppk+1k+1 = 10(p = 10(pkk–q–qkkd)d)0 ≤ p0 ≤ pk+1k+1 < 70 < 70

p = 10, d = 7p = 10, d = 710d = 7010d = 70

ppk+1k+1 = 10(p = 10(pkk–q–qkkd)d)0 ≤ p0 ≤ pk+1k+1 < 70 < 70

Long Division ExampleLong Division Example

qq00 qq11qq22qq33qq44qq55

1.428571.42857 710.00000 710.00000 pp00

7 7 30 30 pp11

28 28 20 20 pp22

1414 60 60 pp33

Page 23: The Intel Pentium Division Flaw Alan Edelman Department of Mathematics Laboratory for Computer Science Massachusetts Institute of Technology

MITMIT

Long Division Radix 10Long Division Radix 10Compute Compute q = p / dq = p / d..

pp00 := p := p

for k=0,1,...for k=0,1,... Find the digit Find the digit qqk k {0, 1, 2, …, {0, 1, 2, …, 9}9}such thatsuch that ppk+1 k+1 := 10(p:= 10(pk k - q- qk k d) d) satisfiessatisfies p pk +1 k +1 [0, [0, 10)d10)dendend

q = p / d = q q = p / d = q i i / 10 / 10 ii

pp00 := p := p

for k=0,1,...for k=0,1,... Find the digit Find the digit qqk k {0, 1, 2, …, {0, 1, 2, …, 9}9}such thatsuch that ppk+1 k+1 := 10(p:= 10(pk k - q- qk k d) d) satisfiessatisfies p pk +1 k +1 [0, [0, 10)d10)dendend

q = p / d = q q = p / d = q i i / 10 / 10 ii

i=0i=0

Page 24: The Intel Pentium Division Flaw Alan Edelman Department of Mathematics Laboratory for Computer Science Massachusetts Institute of Technology

MITMIT

SRT Division Radix 4SRT Division Radix 4

Such qSuch qkk exists? exists?

Algorithm correct?Algorithm correct?

Compute Compute q = p / dq = p / d..

pp00 := p := p

for k=0,1,...for k=0,1,... Look up a digit Look up a digit qqk k such such thatthat ppk+1 k+1 := 4(p:= 4(pk k - q- qk k d) d) satisfiessatisfies|p|pk +1k +1|≤ |≤ (8/3)d(8/3)dendend

q = p / d = q q = p / d = q i i / 4 / 4 ii

pp00 := p := p

for k=0,1,...for k=0,1,... Look up a digit Look up a digit qqk k such such thatthat ppk+1 k+1 := 4(p:= 4(pk k - q- qk k d) d) satisfiessatisfies|p|pk +1k +1|≤ |≤ (8/3)d(8/3)dendend

q = p / d = q q = p / d = q i i / 4 / 4 ii

i=0i=0

Page 25: The Intel Pentium Division Flaw Alan Edelman Department of Mathematics Laboratory for Computer Science Massachusetts Institute of Technology

MITMIT

Such q qkk exists? exists? Such q qkk exists? exists?

Given Given p,d<2. Compute q=p/d.p,d<2. Compute q=p/d.

pp00 := p := p

for k=0,1,...for k=0,1,... Look up a digit qLook up a digit qk k such thatsuch that ppk+1 k+1 := 4(p:= 4(pk k - q- qk k d) satisfies|pd) satisfies|pk +1k +1|≤ (8/3)d|≤ (8/3)dendend

q = p/d = qq = p/d = qi i / 4/ 4ii

pp00 := p := p

for k=0,1,...for k=0,1,... Look up a digit qLook up a digit qk k such thatsuch that ppk+1 k+1 := 4(p:= 4(pk k - q- qk k d) satisfies|pd) satisfies|pk +1k +1|≤ (8/3)d|≤ (8/3)dendend

q = p/d = qq = p/d = qi i / 4/ 4iii=0i=0

qqk k := 0:= 0qqkk := –2 := –2 qqkk := +2 := +2

qqk k := +1:= +1qqkk := –1 := –1 3388 dd88

33dd

3322 dd22

33dd

Page 26: The Intel Pentium Division Flaw Alan Edelman Department of Mathematics Laboratory for Computer Science Massachusetts Institute of Technology

MITMIT

4(p4(pk k - 0)- 0)

Such q qkk exists? exists?Such q qkk exists? exists?

Given Given p,d<2. Compute q=p/d.p,d<2. Compute q=p/d.

pp00 := p := p

for k=0,1,...for k=0,1,... Look up a digit qLook up a digit qk k such thatsuch that ppk+1 k+1 := 4(p:= 4(pk k - q- qk k d) satisfies|pd) satisfies|pk +1k +1|≤ (8/3)d|≤ (8/3)dendend

q = p/d = qq = p/d = qi i / 4/ 4ii

pp00 := p := p

for k=0,1,...for k=0,1,... Look up a digit qLook up a digit qk k such thatsuch that ppk+1 k+1 := 4(p:= 4(pk k - q- qk k d) satisfies|pd) satisfies|pk +1k +1|≤ (8/3)d|≤ (8/3)dendend

q = p/d = qq = p/d = qi i / 4/ 4ii∞∞i=0i=0

qqkk := 0 := 0

-2 / 3d ≤ p-2 / 3d ≤ pkk ≤ 2 / 3d ≤ 2 / 3d

ppk+1 k+1 := := 4(p4(pk k - 0)- 0)

3388 dd88

33dd

3322 dd22

33dd

Page 27: The Intel Pentium Division Flaw Alan Edelman Department of Mathematics Laboratory for Computer Science Massachusetts Institute of Technology

MITMIT

Such q qkk exists? exists?Such q qkk exists? exists?

Given Given p,d<2. Compute q=p/d.p,d<2. Compute q=p/d.

pp00 := p := p

for k=0,1,...for k=0,1,... Look up a digit qLook up a digit qk k such thatsuch that ppk+1 k+1 := 4(p:= 4(pk k - q- qk k d) satisfies|pd) satisfies|pk +1k +1|≤ (8/3)d|≤ (8/3)dendend

q = p/d = qq = p/d = qi i / 4/ 4ii

pp00 := p := p

for k=0,1,...for k=0,1,... Look up a digit qLook up a digit qk k such thatsuch that ppk+1 k+1 := 4(p:= 4(pk k - q- qk k d) satisfies|pd) satisfies|pk +1k +1|≤ (8/3)d|≤ (8/3)dendend

q = p/d = qq = p/d = qi i / 4/ 4iii=0i=0

4 / 3d ≤ p4 / 3d ≤ pkk ≤ 8 / 3d ≤ 8 / 3d

ppk+1 k+1 := 4(p:= 4(pk k - - 22d)d)

qqkk := +2 := +2

3344 dd

3388 dd88

33dd

Page 28: The Intel Pentium Division Flaw Alan Edelman Department of Mathematics Laboratory for Computer Science Massachusetts Institute of Technology

MITMIT

Such q qkk exists? exists?Such q qkk exists? exists?

Given Given p,d<2. Compute q=p/d.p,d<2. Compute q=p/d.

p0 := p

for k=0,1,...,... Look up a digit qLook up a digit qk k such thatsuch that ppk+1 k+1 := 4(p:= 4(pk k - q- qk k d) satisfies|pd) satisfies|pk +1k +1|≤ (8/3)d|≤ (8/3)dendend

q = p/d = qq = p/d = qi i / 4/ 4ii

p0 := p

for k=0,1,...,... Look up a digit qLook up a digit qk k such thatsuch that ppk+1 k+1 := 4(p:= 4(pk k - q- qk k d) satisfies|pd) satisfies|pk +1k +1|≤ (8/3)d|≤ (8/3)dendend

q = p/d = qq = p/d = qi i / 4/ 4iii=0i=0

4/3 ≤ p4/3 ≤ pkk ≤ 8/3 ≤ 8/3

ppk+1 k+1 := 4(:= 4(ppk k - 2d- 2d))

qqkk := +2 := +2ppk k - 2d- 2d3388 dd88

33dd

3322 dd22

33dd

Page 29: The Intel Pentium Division Flaw Alan Edelman Department of Mathematics Laboratory for Computer Science Massachusetts Institute of Technology

MITMIT

4(p4(pk k - 2d)- 2d)

Such q qkk exists? exists?Such q qkk exists? exists?

Given Given p,d<2. Compute q=p/d.p,d<2. Compute q=p/d.

pp00 := p := p

for k=0,1,...for k=0,1,... Look up a digit qLook up a digit qk k such thatsuch that ppk+1 k+1 := 4(p:= 4(pk k - q- qk k d) satisfies|pd) satisfies|pk +1k +1|≤ (8/3)d|≤ (8/3)dendend

q = p/d = qq = p/d = qi i / 4/ 4ii

pp00 := p := p

for k=0,1,...for k=0,1,... Look up a digit qLook up a digit qk k such thatsuch that ppk+1 k+1 := 4(p:= 4(pk k - q- qk k d) satisfies|pd) satisfies|pk +1k +1|≤ (8/3)d|≤ (8/3)dendend

q = p/d = qq = p/d = qi i / 4/ 4iii=0i=0

qqkk := +2 := +2

4 / 3d ≤ p4 / 3d ≤ pkk ≤ 8 / 3d ≤ 8 / 3d

ppk+1 k+1 := := 4(p4(pk k - 2d)- 2d)

ppk k - 2d- 2d3388 dd88

33dd

3322 dd22

33dd

Page 30: The Intel Pentium Division Flaw Alan Edelman Department of Mathematics Laboratory for Computer Science Massachusetts Institute of Technology

MITMIT

A q qkk For Every Point For Every PointA q qkk For Every Point For Every Point

qqk k := 0:= 0qqkk := –2 := –2 qqkk := +2 := +2

qqk k := +1:= +1qqkk := –1 := –1 3388 dd88

33dd

3322 dd22

33dd

Page 31: The Intel Pentium Division Flaw Alan Edelman Department of Mathematics Laboratory for Computer Science Massachusetts Institute of Technology

MITMIT

Algorithm Correct?Algorithm Correct?

Claim:Claim:p qp q11 q qk-1k-1 ppkk

d 4 4d 4 4k-1 k-1 dd

Proof by Induction:Proof by Induction:ppkk+1 +1 = 4(p= 4(pkk - q - qkkd) d)

ppk k qqk k ppk+1k+1

dd 4 4kk d d

— — = q= q00 + — + . . . + ––– + + — + . . . + ––– + –— 4–— 4-k-k

— — 44-k-k = — + —— 4 = — + —— 4-(k+1)-(k+1)

Page 32: The Intel Pentium Division Flaw Alan Edelman Department of Mathematics Laboratory for Computer Science Massachusetts Institute of Technology

MITMIT

Algorithm Correct?Algorithm Correct?

Claim:Claim:p qp q11 q qk-1k-1 qqk k ppk+1k+1

d 4 4d 4 4k-1 k-1 44kk d d

Proof by Induction:Proof by Induction:ppkk+1 +1 = 4(p= 4(pkk - q - qkkd) d)

ppkk qqk k ppk+1k+1

dd 44kk d d

— — = q= q00 + — + . . . + ––– + + — + . . . + ––– + — + ––— 4— + ––— 4-(k+1)-(k+1)

— — 44-k-k = — + —— 4= — + —— 4-(k+1)-(k+1)

Page 33: The Intel Pentium Division Flaw Alan Edelman Department of Mathematics Laboratory for Computer Science Massachusetts Institute of Technology

MITMIT

Algorithm Correct?Algorithm Correct?

Claim:Claim:p qp q11 q qk-1k-1 q qk k ppk+1k+1

d 4 4d 4 4k-1 k-1 44kk d d

Proof by Induction:Proof by Induction:ppkk+1 +1 = 4(p= 4(pkk - q - qkkd) d)

ppkk qqk k ppk+1k+1

dd 44kk d d

Letting Letting kk proves provesp qp q11 q q22

d 4 4d 4 422

— — = q= q00 + — + . . . + ––– + — + ––— 4 + — + . . . + ––– + — + ––— 4-(k+1)-(k+1)

— — 44-k-k = — + —— 4= — + —— 4-(k+1)-(k+1)

— — = q= q00 + — + — + . . . + — + — + . . .

Page 34: The Intel Pentium Division Flaw Alan Edelman Department of Mathematics Laboratory for Computer Science Massachusetts Institute of Technology

MITMIT

0000.000

0001.000

0010.000

0011.000

0100.000

0101.000

1111.000

1110.000

1101.000

1100.000

1011.000

0000.000

0001.000

0010.000

0011.000

0100.000

0101.000

1111.000

1110.000

1101.000

1100.000

1011.000

Pentium Lookup Table (P-d plot)Pentium Lookup Table (P-d plot)

Divisor

Sh

ifte

d P

arti

al R

ema

ind

er

1.0

00

01

.00

01

1.0

01

01

.00

11

1.0

10

01

.01

01

1.0

11

01

.01

11

1.1

00

01

.10

01

1.1

01

01

.10

11

1.1

10

01

.11

01

1.1

11

01

.11

11

1/161/8

Blue

Greenq := 2

q := 1

q := 0

q := -1

q:= -2

Page 35: The Intel Pentium Division Flaw Alan Edelman Department of Mathematics Laboratory for Computer Science Massachusetts Institute of Technology

MITMIT

0000.000

0001.000

0010.000

0011.000

0100.000

0101.000

1111.000

1110.000

1101.000

1100.000

1011.000

0000.000

0001.000

0010.000

0011.000

0100.000

0101.000

1111.000

1110.000

1101.000

1100.000

1011.000

Pentium Lookup Table (P-d plot)Pentium Lookup Table (P-d plot)

Sh

ifte

d P

arti

al R

ema

ind

er

Divisor

1.0

00

01

.00

01

1.0

01

01

.00

11

1.0

10

01

.01

01

1.0

11

01

.01

11

1.1

00

01

.10

01

1.1

01

01

.10

11

1.1

10

01

.11

01

1.1

11

01

.11

11

Blue

Greenq := 2

q := 1

q := 0

q := -1

q:= -2

1/161/8

Page 36: The Intel Pentium Division Flaw Alan Edelman Department of Mathematics Laboratory for Computer Science Massachusetts Institute of Technology

MITMIT

A Close-up Look at One Column (D=1.0001) A Close-up Look at One Column (D=1.0001)

22

11

00

-1-1

-2-2

2.8752.875

1.51.5 1.3751.375 0.375 0.375 0.250.25

-0.5-0.5-0.625-0.625

-1.625-1.625-1.75-1.75

-3-3

P

Page 37: The Intel Pentium Division Flaw Alan Edelman Department of Mathematics Laboratory for Computer Science Massachusetts Institute of Technology

MITMIT

22

11

00

-1-1

-2-2

2.8752.875

1.51.5 1.3751.375 0.375 0.375 0.250.25

-0.5-0.5-0.625-0.625

-1.625-1.625-1.75-1.75

-3-3

0000

2222222222

P

3.375 Off the Chart3.25 Off the Chart3.125 Off the Chart3 Off the Chart2.875 Buggy Entry2.75 Foothold

A Close-up Look at One Column (D=1.0001) A Close-up Look at One Column (D=1.0001)

Page 38: The Intel Pentium Division Flaw Alan Edelman Department of Mathematics Laboratory for Computer Science Massachusetts Institute of Technology

MITMIT

Pentium Division Example: 1.875/1.000Pentium Division Example: 1.875/1.000

ppk+1k+1 := 4(p := 4(pkk – q – qkkd)d)

0001.111 00000000000 0001.111 00000000000 SS0000.000 00000000000 0000.000 00000000000 CC1.875 = 1.875 = {

qqkk:=0:=0qqkk:=–2:=–2 qqkk:=+2:=+2qqkk:=+1:=+1qqkk:=–1:=–1

Page 39: The Intel Pentium Division Flaw Alan Edelman Department of Mathematics Laboratory for Computer Science Massachusetts Institute of Technology

MITMITppk+1k+1 := 4 := 4(p(pkk – q – qkkd)d)

0001.111 00000000000 0001.111 00000000000 SS0000.000 00000000000 0000.000 00000000000 CC1101.111 111111111111101.111 111111111111100.000 11111111111 1100.000 11111111111 SS0011.110 00000000001 0011.110 00000000001 CC

qqkk:=0:=0qqkk:=–2:=–2 qqkk:=+2:=+2qqkk:=+1:=+1qqkk:=–1:=–1

– – 221 =1 =

-0.125 = -0.125 = {

1.875 = 1.875 = {Pentium Division Example: 1.875/1.000Pentium Division Example: 1.875/1.000

Page 40: The Intel Pentium Division Flaw Alan Edelman Department of Mathematics Laboratory for Computer Science Massachusetts Institute of Technology

MITMIT

-0.125-0.1254 = 4 = -0.5 = -0.5 = {

ppk+1k+1 := := 44(p(pkk – q – qkkd)d)

0001.111 00000000000 0001.111 00000000000 SS0000.000 00000000000 0000.000 00000000000 CC1101.111 111111111111101.111 111111111110000.011 1111111110000.011 11111111100 00 SS1111.000 0000000011111.000 00000000100 00 CC

qqkk:=0:=0qqkk:=–2:=–2 qqkk:=+2:=+2qqkk:=+1:=+1qqkk:=–1:=–1

– – 221 =1 =

Pentium Division Example: 1.875/1.000Pentium Division Example: 1.875/1.000

1.875 = 1.875 = {

Page 41: The Intel Pentium Division Flaw Alan Edelman Department of Mathematics Laboratory for Computer Science Massachusetts Institute of Technology

MITMITppk+1k+1 := 4(p := 4(pkk – q – qkkd)d)

0001.111 00000000000 0001.111 00000000000 SS0000.000 00000000000 0000.000 00000000000 CC1101.111 111111111111101.111 111111111110000.011 11111111100 0000.011 11111111100 SS1111.000 00000000100 1111.000 00000000100 CC0001.000 000000000000001.000 000000000001001.111 11111100000 1001.111 11111100000 SS1000.000 00000100000 1000.000 00000100000 CC

qqkk:=0:=0qqkk:=–2:=–2 qqkk:=+2:=+2qqkk:=+1:=+1qqkk:=–1:=–1

––221 =1 =

– –– –111 =1 =

1.875 = 1.875 = {Pentium Division Example: 1.875/1.000Pentium Division Example: 1.875/1.000

Page 42: The Intel Pentium Division Flaw Alan Edelman Department of Mathematics Laboratory for Computer Science Massachusetts Institute of Technology

MITMIT22//11 + + –1–1//44 + + 22//1616 + + 00//6464 = = 1.8751.875//1.0001.000

0001.111 00000000000 0001.111 00000000000 SS0000.000 00000000000 0000.000 00000000000 CC1101.111 111111111111101.111 111111111110000.011 11111111100 0000.011 11111111100 SS1111.000 00000000100 1111.000 00000000100 CC0001.000 000000000000001.000 000000000001001.111 11111100000 1001.111 11111100000 SS1000.000 00000100000 1000.000 00000100000 CC1101.111 111111111111101.111 111111111110000.000 00011111100 0000.000 00011111100 SS1111.111 11100000100 1111.111 11100000100 CC0000.000 000000000000000.000 000000000001111.111 11111100000 1111.111 11111100000 SS0000.000 00000100000 0000.000 00000100000 CC

qqkk:=0:=0qqkk:=–2:=–2 qqkk:=+2:=+2qqkk:=+1:=+1qqkk:=–1:=–1

––221 =1 =

– –– –111 =1 =

––221 =1 =

––001 =1 =

1.875 = 1.875 = {Pentium Division Example: 1.875/1.000Pentium Division Example: 1.875/1.000

Page 43: The Intel Pentium Division Flaw Alan Edelman Department of Mathematics Laboratory for Computer Science Massachusetts Institute of Technology

MITMIT

Inequality AnalysisInequality AnalysisInequality AnalysisInequality Analysis

PPkk ≤ p ≤ pkk ≤ P ≤ Pkk + 1/4 + 1/4

D ≤ d ≤ DD ≤ d ≤ D++ D + 1/16 D + 1/16

PPk+1k+1 = 4(P = 4(Pkk – q – qkkDD++) + R) + Rkk

RRkk ≤ R ≤ Rkk MaxMax

3/4 if q3/4 if qkk = –2 = –23/4 if q3/4 if qkk = –1 = –1 3/4 if q3/4 if qkk = 0 = 0 1 if q1 if qkk = 1 = 15/4 if q5/4 if qkk = 2 = 2

Page 44: The Intel Pentium Division Flaw Alan Edelman Department of Mathematics Laboratory for Computer Science Massachusetts Institute of Technology

MITMIT

Reaching the Flaw is Not Easy!Reaching the Flaw is Not Easy!

22

qqk k PPk+1k+1

––22 ≤ P≤ Pbadbad - 1/8 - 1/8

––11 ≤ P≤ Pbadbad - 1/8 - 1/8

00 < P< Pbadbad - 1/8 - 1/8

11 < P< Pbadbad - 1/8 - 1/8

PPkk < P < Pbadbad - 1/8 - 1/8 ≤ P≤ Pbadbad - 1/8 - 1/8

PPkk = P = Pbadbad - 1/8 - 1/8 ≤ P≤ Pbadbad

Page 45: The Intel Pentium Division Flaw Alan Edelman Department of Mathematics Laboratory for Computer Science Massachusetts Institute of Technology

MITMIT

foothold

buggy entry

Page 46: The Intel Pentium Division Flaw Alan Edelman Department of Mathematics Laboratory for Computer Science Massachusetts Institute of Technology

MITMIT

“Send More Money” Puzzle“Send More Money” Puzzle

SENDSEND+MORE+MOREMONEYMONEY

32¢

Massachusetts Institue of Technology

77 Massachusetts Ave.

Cambridge, MA 02139

intel22 Mission College Blvd.Santa Clara, CA 95052

Page 47: The Intel Pentium Division Flaw Alan Edelman Department of Mathematics Laboratory for Computer Science Massachusetts Institute of Technology

MITMIT

The Path to FailureThe Path to FailureBad DivisorsBad Divisors: d = 1.d: d = 1.d11dd22dd33dd44111111111111dd1111……

.... .. .. 11 11 11 11 11

.... .. .. 11 11 11 11 11

.d.d22dd33dd4411 11 11 11 11

.... 11 11 11 11 11

..11 11 11 11 11 11

.d.d22dd33dd4400 00 00

.... 00 00 00

.1.1 11 11 ..

six onessix ones

q = –2q = –2q = –2q = –2

q = 2q = 2q = 2q = 2

bugbugbugbug

Page 48: The Intel Pentium Division Flaw Alan Edelman Department of Mathematics Laboratory for Computer Science Massachusetts Institute of Technology

MITMIT

At Least Nine Steps to FailureAt Least Nine Steps to Failure................................................

.00000000000000000000000.00000000000000000000000

................................................

................................................

................................................

................................................

................................................

................................................

................................................

................................................

................................................

................................................

................................................

................................................

................................................

........1111111111..............................

........1111111111..............................

..........11111111..............................Step 6Step 6Step 6Step 6

Step 5Step 5Step 5Step 5

Step 4Step 4Step 4Step 4

Step 3Step 3Step 3Step 3

Step 2Step 2Step 2Step 2

Step 1Step 1Step 1Step 1

: 2

mo

re : 2

mo

re s

teps

step

s

Page 49: The Intel Pentium Division Flaw Alan Edelman Department of Mathematics Laboratory for Computer Science Massachusetts Institute of Technology

MITMIT

At Least Nine Steps to FailureAt Least Nine Steps to Failure......................................11........

.00000000000000000000000.00000000000000000000000

......................................11........

................................11..............

................................11..............

................................11..............

..........................1111..................

..........................1111..................

..........................1111..................

....................111111......................

....................111111......................

....................111111......................

..............11111111..........................

..............11111111..........................

..............11111111..........................

........1111111111..............................

........1111111111..............................

..........11111111..............................Step 6Step 6Step 6Step 6

Step 5Step 5Step 5Step 5

Step 4Step 4Step 4Step 4

Step 3Step 3Step 3Step 3

Step 2Step 2Step 2Step 2

Step 1Step 1Step 1Step 1

: 2

mo

re : 2

mo

re s

teps

step

s

Page 50: The Intel Pentium Division Flaw Alan Edelman Department of Mathematics Laboratory for Computer Science Massachusetts Institute of Technology

MITMIT

At Least Nine Steps to FailureAt Least Nine Steps to Failure......................................11........

.000000000000000000.0000000000000000000000000000

......................................11........

................................1100............

................................1111............

................................1111............

..........................110110................

..........................111111................

..........................111111................

....................11101110....................

....................11111111....................

....................11111111....................

..............1111011110........................

..............1111111111........................

..............1111111111........................

........111110111110............................

........1111111111..............................

..........11111111..............................Step 6Step 6Step 6Step 6

Step 5Step 5Step 5Step 5

Step 4Step 4Step 4Step 4

Step 3Step 3Step 3Step 3

Step 2Step 2Step 2Step 2

Step 1Step 1Step 1Step 1

: 2

mo

re : 2

mo

re s

teps

step

s

Page 51: The Intel Pentium Division Flaw Alan Edelman Department of Mathematics Laboratory for Computer Science Massachusetts Institute of Technology

MITMIT

At Least Nine Steps to FailureAt Least Nine Steps to Failure......................................1111111111

.00000000000000000000000.00000000000000000000000

......................................1111111111

................................100000100000....

................................1111111111......

................................1111111111......

..........................110000110000..........

..........................1111111111............

..........................1111111111............

....................111000111000................

....................1111111111..................

....................1111111111..................

..............111100111100......................

..............1111111111........................

..............1111111111........................

........111110111110............................

........1111111111..............................

..........11111111..............................Step 6Step 6Step 6Step 6

Step 5Step 5Step 5Step 5

Step 4Step 4Step 4Step 4

Step 3Step 3Step 3Step 3

Step 2Step 2Step 2Step 2

Step 1Step 1Step 1Step 1

: 2

mo

re : 2

mo

re s

teps

step

s

Page 52: The Intel Pentium Division Flaw Alan Edelman Department of Mathematics Laboratory for Computer Science Massachusetts Institute of Technology

MITMIT

ConclusionsConclusions

Mathematical analysis is possible.Mathematical analysis is possible. Bug is more subtle and more interesting Bug is more subtle and more interesting

than most people realize.than most people realize. One should not be so quick to laugh at One should not be so quick to laugh at

Intel’s Expense.Intel’s Expense.

Page 53: The Intel Pentium Division Flaw Alan Edelman Department of Mathematics Laboratory for Computer Science Massachusetts Institute of Technology

MITMIT

Thanks to Teddy Slottow for his technical Thanks to Teddy Slottow for his technical assistance in preparing this presentationassistance in preparing this presentation

Page 54: The Intel Pentium Division Flaw Alan Edelman Department of Mathematics Laboratory for Computer Science Massachusetts Institute of Technology