[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"news-slug-loongarch-la664-atomic-erratum-ai-debug":3,"topics-all":38,"news-related-f6e7c791-0e6b-47c4-8d26-af7163609235":57},{"id":4,"title":5,"summary":6,"content":7,"original_url":8,"source_id":9,"tags":10,"translations":24,"news_slug":31,"published_at":32,"created_at":33,"modified_at":34,"is_published":35,"publish_type":36,"image_url":14,"view_count":37},"f6e7c791-0e6b-47c4-8d26-af7163609235","LoongArch LA664 原子指令丢更新:AI 两天定位,龙芯 14 天出固件","龙芯 LA664 核心在 3A6000 与 3C6000\u002FS 上被发现存在原子指令丢失更新 bug,影响 amadd、amcas 等多款指令。Debian 维护者用 AI 在两天内把触发条件缩小到向量化 memcpy,龙芯在 14 天内推出修复固件,只需把 MCSR24 bit 13 置 1,性能损失很小。","## 一个打包超时,把 CPU 拉进审讯室\n\n2026 年 2 月,Debian 13 龙架构移植版 loong13 维护者王邈在给 normaliz 做交叉编译时遇到一件怪事:这个数学软件的自带测试在 LA664 核心的龙芯服务器上跑着跑着就卡死在循环里出不来。一开始怀疑是 normaliz 自己用了弱内存序,或者 OpenMP 实现的 `pragma omp atomic` 有 bug。但把代码读到底、把 normaliz 简化到极限,问题依然在。\n\n简单复现程序测不出来,意味着这不是软件问题。把目光转向底层,反汇编里 `pragma omp atomic` 被 LLVM 生成了 LoongArch64 的 `amadd.d`,而这条指令本来就是 LoongArch 用来实现原子加的“原子性”保障。\n\n半年后,王邈和 jia.je 一起换了思路:让 AI 去找最小复现,他们负责指挥 AI 的调查方向。两天后,AI 把目光锁定到 normaliz 处理函数里的一段 `memcpy`,进而指向 glibc 在 LA664 上启用的 LASX 向量化内存搬运路径。\n\n## 触发条件的三条腿\n\n把这个 CPU bug 的触发条件拆开看,其实非常具体:\n\n- 两个线程必须跑在不同的物理核上,同一个物理核上的 SMT 逻辑线程之间不会触发;\n- 线程对同一地址执行**不带数据屏障**的原子操作,例如 `amadd.d` 而非 `amadd_db.d`;\n- 至少有一个线程在原子操作之间穿插向量化的内存读取。\n\n在 jia.je 团队的最小复现里,normaliz 的每个数据点正好是 2208 字节、276 个 `uint64_t`,刚好是 LASX 的 256 位寄存器一次能装下的 1\u002F8 区间。两个线程各自分片遍历,先做向量化 `memcpy`,再做 relaxed 原子加,一轮结束比对计数器。复现稳定性高到吓人:在 3C6000\u002FS 两个物理核上跑 30 次试验,\"双方都做 LASX 读\"的触发概率几乎达到 100%;带 `_db` 后缀的 `amcas_db.d` 在相同条件下失败率是 0%。\n\n## Rust 也没躲过\n\n更尴尬的是 Rust 标准库。`std::sync::Arc` 的引用计数、`std::sync::mpsc` 的 `Sender` 克隆,都用了不带数据屏障的 `amadd`。作者构造了一个 safe Rust 程序,用 `Arc` 或 `mpsc` 都能让程序崩溃,表现为 SIGABRT 或 glibc 报告堆被破坏——即典型的 use-after-free 模式。\n\n但工程意义上的可利用面很窄:两个线程必须在同一进程内对同一计数器做 relaxed 原子操作,至少一方做向量化内存读取。这种触发条件天然被进程隔离挡住,不太可能被单方面远程利用。\n\n## 龙芯的 14 天响应\n\n8 月 26 日邮件反馈,9 月 9 日拿到测试固件。修复方法出人意料地轻:把 CPU 内部一个未文档化的 CSR MCSR24 的 bit 13 置 1。单核性能没变化,多核性能也只是略微下降,完全够用。\n\n软件层面其实也有规避路径:编译器可以改生成 `am\u003COP>_db.*`,或者改用 LL\u002FSC 循环。但代价是把所有现存的 LA664 二进制重新编译一遍。这条路在 14 天内显然走不通,而 CSR 一行命令就能修好。\n\n受影响范围限定在使用 LA664 核心的 3C6000\u002FS 和 3A6000 系列;更早的 LA464(3A5000)没有这个问题。龙芯承诺在国庆(10 月 1 日)之前公开发布固件。\n\n## AI 到底干了什么\n\n回过头看,这个故事最有意思的部分不是龙芯的 14 天响应,而是 AI 在六个月的排查里到底起了什么作用。\n\n第一轮排查中,人类已经基本能判断是 `amadd` 在丢更新,但他们没办法把 normaliz 整个代码库裁剪到一个最小复现。AI 在第二轮里做的事,本质上是把代码搜索范围从\"编译原理\u002F内存序\u002FOpenMP 实现\"收缩到\"glibc memcpy 的实现选择\",然后基于 `xvld` 指令的特性,直接拼出了一个稳定复现的最小程序。这是普通程序员不愿意干的\"代码考古\"活儿。\n\n但 AI 也没有自动把所有事做完。明确告知 AI 原子加有问题、要求它聚焦 `memcpy` 这一关键提示,仍然来自开发者。换句话说,AI 干的是\"把已知信息在大规模代码里快速验证并定位到具体一行\",而\"判断这是 CPU bug 不是软件 bug\"这关键一跳,依然是人类工程师的活儿。\n\n## 一个老话题的新注脚\n\nCPU erratum 这件事,ARM 公版核的 Software Developer Errata Notice 里有一堆,Intel\u002FAMD 各自有几十上百条文档化的 erratum,真正影响日常使用的很少。LoongArch 是新架构,生态还在长,这次能从一个普通的打包超时一路追到 CSR 修复,说明两件事:一是用户社区在认真测试,二是厂商在认真响应。\n\n下一次,你在 LA664 上看到一个诡异的多线程 crash,先看一眼 glibc memcpy 是不是开了 LASX、编译器是不是在生成无 `_db` 后缀的原子指令。这两点组合到一起,大概能解释 9 成 LoongArch 上\"明明代码看起来对但就是不稳\"的玄学问题。","https:\u002F\u002Fwww.solidot.org\u002Fstory?sid=85484","d59894d3-308e-4fd8-8865-86dc1eeac4a2",[11,15,18,21],{"id":12,"name":13,"slug":13,"description":14,"color":14},"5e628969-6d2a-437f-998a-104e4b16cfb1","ai-progress",null,{"id":16,"name":17,"slug":17,"description":14,"color":14},"40269b40-7942-4650-9672-ed2e6524d37a","ai-technology",{"id":19,"name":20,"slug":20,"description":14,"color":14},"e82b2d09-81b2-43d1-977e-e018443b3c14","coding-agent",{"id":22,"name":23,"slug":23,"description":14,"color":14},"e0d31e94-ce47-4c8f-831c-d3d2926d42f3","hardware",[25],{"id":26,"lang":27,"title":28,"summary":29,"content":30},"fc9f4908-d596-43cd-a0d4-acd5c78d53b5","en","LoongArch LA664 Atomic Lost-Update: AI 2 Days, Fix 14","Loongson's LA664 atomic lost-update bug was pinned to vectorised memcpy by AI in 2 days; Loongson shipped a firmware fix in 14 days via one CSR bit.","## A Packaging Timeout That Brought a CPU to the Bench\n\nIn February 2026, while cross-compiling `normaliz` for the loong13 (Debian 13 port to LoongArch), maintainer Wang Miao hit a strange failure: the math library's self-test looped indefinitely on a LA664-based Loongson server. The first instinct was to blame weak memory ordering inside `normaliz` itself, or a bug in the OpenMP runtime's `#pragma omp atomic`. After reading the source end-to-end and shrinking the test program down repeatedly, the issue refused to go away.\n\nThe fact that simple atomic-add microbenchmarks could not reproduce the issue meant the problem was not in the application layer. Looking at the disassembly, the compiler turned `#pragma omp atomic` into a LoongArch64 `amadd.d`—the very instruction supposed to guarantee atomicity for atomic adds.\n\nSix months later, Wang Miao and jia.je changed tack: let AI search for a minimal reproducer while they steered the investigation. Within two days, AI's attention locked onto a `memcpy` call inside the normaliz processing function, which in turn pointed at the LASX-vectorised memory-copy path that glibc had enabled on LA664.\n\n## Three Legs of the Trigger\n\nWhen the CPU bug is unpacked, the trigger conditions turn out to be very specific:\n\n- The two threads must run on different physical cores—two SMT siblings on the same core do not trigger it.\n- Both threads perform atomic operations **without a data barrier** on the same address—e.g. `amadd.d` rather than `amadd_db.d`.\n- At least one of the threads interleaves vectorised memory loads between atomic operations.\n\nIn the team's minimal reproducer, each `normaliz` data point is exactly 2208 bytes (276 `uint64_t`s), which sits inside one LASX 256-bit register window. Two threads each slice the list, run a vectorised `memcpy` first, then a relaxed atomic-add, and finally compare their counters at the end of the round. The reproduction is startlingly stable: on a 3C6000\u002FS with two physical cores and 30 trials, the \"both sides doing LASX reads\" configuration triggers near 100% of the time; `amcas_db.d` (with the data-barrier suffix) under the same conditions fails 0%.\n\n## Rust Did Not Escape Either\n\nWhat is more embarrassing is that the Rust standard library fell into the same trap. Both the reference-counting in `std::sync::Arc` and the `Sender` clone inside `std::sync::mpsc` lower to barrier-less `amadd`. The authors built a safe Rust program that, using `Arc` or `mpsc`, crashed with SIGABRT or glibc heap-corruption reports—the classic signature of a use-after-free.\n\nIn practical security terms, however, the exploitability is narrow: both threads must operate on the same in-process counter with relaxed atomicity, and at least one of them must run vectorised memory reads. That trigger condition is naturally fenced off by process isolation, so it is hard to weaponise one-sided.\n\n## Loongson's 14-Day Response\n\nEmail sent on 26 August, test firmware delivered on 9 September. The fix is surprisingly lightweight: set bit 13 of an undocumented internal CSR, MCSR24. Single-core performance is unchanged; multi-core performance drops only slightly—well within usable range.\n\nThere is also a software-side mitigation: compilers could be patched to emit `am\u003COP>_db.*` instead, or to fall back to LL\u002FSC loops. The catch is that every existing LA664 binary would need to be recompiled. That path obviously does not fit inside a 14-day window, whereas the CSR tweak takes a single command.\n\nThe affected scope is limited to chips using the LA664 core, namely the 3C6000\u002FS and 3A6000 families. The earlier LA464 (3A5000) is unaffected. Loongson promised to publish the firmware before the National Day window (1 October).\n\n## What the AI Actually Did\n\nLooking back, the most interesting part of this story is not Loongson's 14-day turnaround, but what role AI played in the six months of debugging.\n\nIn the first round, humans had largely concluded that `amadd` was losing updates, but they could not reduce the entire normaliz codebase to a minimal reproducer. What AI did in the second round was, in effect, narrow the code-search space from \"compiler theory \u002F memory ordering \u002F OpenMP runtime\" down to \"glibc memcpy implementation choice,\" and then, using properties of the `xvld` instruction, assemble a stable minimal reproducer. This is exactly the kind of \"code archaeology\" that working programmers dislike.\n\nBut AI did not finish the job on its own. The crucial hint that explicitly told AI the atomic-add was broken, and that pushed it toward `memcpy`, still came from the developers. In other words, AI's contribution is \"rapidly verifying known hypotheses across large codebases and pinning them down to a single line,\" whereas the decisive jump—\"this is a CPU bug, not a software bug\"—remains a human engineer's job.\n\n## A New Footnote on an Old Topic\n\nCPU errata are everywhere: ARM's public-cores Software Developer Errata Notice has plenty, Intel and AMD each have dozens to hundreds of documented errata, and only a handful of them really affect daily use. LoongArch is a young architecture whose ecosystem is still growing. The fact that an ordinary packaging timeout could be traced all the way to a CSR-level fix says two things: the user community is testing seriously, and the vendor is responding seriously.\n\nNext time you see a baffling multi-threaded crash on LA664, the first thing to check is whether glibc's memcpy has LASX enabled, and whether the compiler is emitting barrier-less atomics. The combination of those two factors probably explains nine out of ten \"code looks right but the run is unstable\" mysteries on LoongArch.","loongarch-la664-atomic-erratum-ai-debug","2026-10-07T03:00:00Z","2026-10-07T03:06:14.853728Z","2026-10-07T03:06:14.853756Z",true,"agent",502,[39,48],{"slug":40,"tag_slug":40,"title_zh":41,"title_en":42,"intro_zh":43,"intro_en":44,"id":45,"is_active":35,"created_at":46,"modified_at":47},"ai-for-science","AI for Science 2026：从 UniPert 到 GPT-Rosalind 的硬核进化","AI for Science 2026: from UniPert to GPT-Rosalind","生命科学、化学材料、物理世界模型——AI 正在从\"语言工具\"变成\"实验伙伴\"。本专题收录 AI 在三大科学方向的关键节点：UniPert 统一基因与化学扰动空间、GPT-Rosalind 端到端生命科学推理、达摩院 AI 智能体 28 小时找到 4 种超导新材料、Anthropic Claude Science 把工作台做成标准品。","From language tool to lab partner — AI is reshaping life sciences, chemistry\u002Fmaterials, and physical world models. This topic covers the key milestones: UniPert unifying genetic-chemical perturbation spaces, GPT-Rosalind's end-to-end life-sciences reasoning, DAMO's AI agent discovering 4 superconducting materials in 28 hours, and Anthropic's Claude Science workbench going mainstream.","988a4300-5fab-41c4-b5d8-63711a2dc757","2026-09-10T01:34:15.296649Z","2026-09-10T01:34:15.296663Z",{"slug":49,"tag_slug":49,"title_zh":50,"title_en":51,"intro_zh":52,"intro_en":53,"id":54,"is_active":35,"created_at":55,"modified_at":56},"h3-series","MiniMax H3 系列：从开源权重到 35 倍吞吐","MiniMax H3 Series: from open weights to 35x throughput","MiniMax H3 自 2026 年 8 月开源以来节奏密集：官方把生成、参考与编辑收回一个模型；ComfyUI 当天压进 RTX 3060；摩尔线程 3 小时完成国产 GPU 适配；fal 后训练版把吞吐拉到 35 倍；FastH3 蒸馏再砍推理成本。本专题持续追踪 H3 的发布—开源—蒸馏—部署全链路。","Since MiniMax open-sourced H3 in August 2026 the pace has been relentless: one unified omni-modal model, same-day ComfyUI support down to an RTX 3060, a 3-hour Day-0 port to Moore Threads GPUs, fal's post-trained H3 Max at 35x throughput, and FastH3 distillation cutting inference cost further. This topic tracks the full H3 chain — release, open weights, distillation, deployment.","83ef0daa-3c31-4cb3-86ed-e5ee58654d5f","2026-09-08T07:33:19.942193Z","2026-09-08T07:33:19.942209Z",{"items":58},[59,64,69,74,79,84],{"id":60,"title":61,"news_slug":62,"published_at":63},"a86df58c-c601-4949-b42d-ba26c2feccb2","AI 两天锁 LoongArch 原子加丢更新:谁干关键活?","loongarch-la664-atomic-add-lost-ai-debug-2026","2026-09-28T01:00:00+00:00",{"id":65,"title":66,"news_slug":67,"published_at":68},"552761c1-2fb8-4952-bee5-b2a35c712ccb","谷歌把 TPU 卫星送上天:Gemma 只能跑 15 分钟","google-project-suncatcher-trillium-tpu-gemma-orbit-prototype","2026-10-18T04:00:00+00:00",{"id":70,"title":71,"news_slug":72,"published_at":73},"9db08b3d-e12c-4761-9a34-69451e126ae1","谷歌把冰箱大小的 Suncatcher 送上近地轨道","google-suncatcher-tpu-gemma-orbital-launch-v2","2026-10-06T00:00:00+00:00",{"id":75,"title":76,"news_slug":77,"published_at":78},"e1374b1b-13f1-4e08-a58a-c45e4f6b92af","AMD 82亿美元拿下 World Labs：李飞飞出任 AMD 首席科学家","amd-acquires-world-labs-fei-fei-li","2026-09-29T04:00:00+00:00",{"id":80,"title":81,"news_slug":82,"published_at":83},"33c8038a-f1dc-4b64-b6b7-604baf43f729","CESA 数据:85.8% 日本游戏开发者已把生成式 AI 写进工作流","cesa-2026-japan-game-dev-genai-85pct","2026-09-20T00:00:00+00:00",{"id":85,"title":86,"news_slug":87,"published_at":88},"b398dc77-58a1-498e-a9ed-c045c83c90be","AI 抢走消费级 DRAM:一年涨价五倍,手机路由器全被拖下水","ai-dram-consumer-electronics-price-surge","2026-09-14T01:00:00+00:00"]