{"id":20342,"date":"2018-01-29T09:26:18","date_gmt":"2018-01-29T14:26:18","guid":{"rendered":"https:\/\/mjtsai.com\/blog\/?p=20342"},"modified":"2020-07-17T16:04:29","modified_gmt":"2020-07-17T20:04:29","slug":"finding-a-cpu-design-bug-in-the-xbox-360","status":"publish","type":"post","link":"https:\/\/mjtsai.com\/blog\/2018\/01\/29\/finding-a-cpu-design-bug-in-the-xbox-360\/","title":{"rendered":"Finding a CPU Design Bug in the Xbox 360"},"content":{"rendered":"

Bruce Dawson<\/a> (via Mike Ash<\/a>, Hacker News<\/a>):<\/p>\n

But, the CPU was for a video game console and performance trumped all so a new instruction was added – xdcbt<\/em><\/a>. The normal PowerPC dcbt<\/em> instruction was a typical prefetch instruction. The xdcbt<\/a><\/em> instruction was an extended<\/em> prefetch instruction that fetched straight from memory to the L1 d-cache, skipping L2. This meant that memory coherency was no longer guaranteed, but hey, we’re video game programmers, we know what we’re doing, it will be fine.<\/p>

[…]<\/p>

So, the branch predictor makes a prediction and the predicted instructions are fetched, decoded, and executed – but not retired until the prediction is known to be correct. Sound familiar? The realization I had – it was new to me at the time – was what it meant to speculatively execute a prefetch. The latencies were long, so it was important to get the prefetch transaction on the bus as soon as possible, and once a prefetch had been initiated there was no way to cancel it. So a speculatively-executed xdcbt<\/em> was identical to a real<\/em>xdcbt!<\/em> (a speculatively-executed load instruction was just a prefetch, FWIW).<\/p>

And that was the problem – the branch predictor would sometimes cause xdcbt<\/em> instructions to be speculatively executed and that was just as bad as really executing them.<\/p>

[…]<\/p>

I knew<\/em> that would be the result and yet it was still amazing. All these years later, and even after reading about Meltdown<\/em>, it’s still nerdy cool to see solid proof that instructions that were not executed<\/em> were causing crashes.<\/p><\/blockquote>\n\n

Previously: Intel CPU Design Flaw Necessitates Kernel Page Table Isolation<\/a>.<\/p>","protected":false},"excerpt":{"rendered":"

Bruce Dawson (via Mike Ash, Hacker News): But, the CPU was for a video game console and performance trumped all so a new instruction was added – xdcbt. The normal PowerPC dcbt instruction was a typical prefetch instruction. The xdcbt instruction was an extended prefetch instruction that fetched straight from memory to the L1 d-cache, […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"apple_news_api_created_at":"2020-07-17T20:04:31Z","apple_news_api_id":"57818671-6895-4160-8c79-db07ccb2217a","apple_news_api_modified_at":"2020-07-17T20:04:31Z","apple_news_api_revision":"AAAAAAAAAAD\/\/\/\/\/\/\/\/\/\/w==","apple_news_api_share_url":"https:\/\/apple.news\/AV4GGcWiVQWCMedsHzLIheg","apple_news_coverimage":0,"apple_news_coverimage_caption":"","apple_news_is_hidden":false,"apple_news_is_paid":false,"apple_news_is_preview":false,"apple_news_is_sponsored":false,"apple_news_maturity_rating":"","apple_news_metadata":"\"\"","apple_news_pullquote":"","apple_news_pullquote_position":"","apple_news_slug":"","apple_news_sections":"\"\"","apple_news_suppress_video_url":false,"apple_news_use_image_component":false,"footnotes":""},"categories":[2],"tags":[131,402,260,970],"class_list":["post-20342","post","type-post","status-publish","format-standard","hentry","category-technology","tag-bug","tag-powerpc","tag-processors","tag-xbox-360"],"apple_news_notices":[],"_links":{"self":[{"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/posts\/20342","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/comments?post=20342"}],"version-history":[{"count":1,"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/posts\/20342\/revisions"}],"predecessor-version":[{"id":20343,"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/posts\/20342\/revisions\/20343"}],"wp:attachment":[{"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/media?parent=20342"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/categories?post=20342"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/tags?post=20342"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}