[HN Gopher] Notes on the Pentium's Microcode Circuitry
___________________________________________________________________
Notes on the Pentium's Microcode Circuitry
Author : leotravis10
Score : 87 points
Date : 2025-03-31 18:35 UTC (4 hours ago)
(HTM) web link (www.righto.com)
(TXT) w3m dump (www.righto.com)
| kens wrote:
| Author here for your Pentium questions :-)
| mesrik wrote:
| Hi Ken,
|
| Nice article. While reading I remembered that I watched some
| time ago the Oral History of Gary Davidian and he was quite bit
| involved with microcoding. And if I were you I would try asking
| him if he could be able to give you some ideas where to get
| more information about microcode workings and development.
|
| Here are links to that interview, if you have time to watch it.
| It's in two parts.
|
| - https://www.youtube.com/watch?v=l_Go9D1kLNU
|
| - https://www.youtube.com/watch?v=MVEKt_H3FsI
|
| Cheers,
|
| :-) riku
| nxobject wrote:
| This is the Gary Davidian of the Classic MacOS PPC
| nanokernel, no? I wish I've had as much fun work as he's had
| in his career.
| vitalmixofntrnt wrote:
| Can I add my own instruction set extensions to the original x86
| isa as implemented by the 8086 without permission from Intel
| and / or AMD as long as I'm not copying any x86 instruction set
| extensions?
| kens wrote:
| I don't know the legal details here but I think you can do
| whatever you want as long as you're not violating any patents
| (good luck). Also, Intel claims a copyright on the mnemonics
| for 8080 and 8086 assembly language. Microcode is also
| protected by copyright.
| CalRobert wrote:
| Why wasn't the Pentium's successor the Sexium?
| kens wrote:
| Ha ha. Internally, the successor to the Pentium (P5) had the
| codename P6, but it was called the Pentium Pro externally
| rather than anything six-related.
|
| Instead, Intel decided to go with an incomprehensible system
| of naming: Pentium Overdrive, Pentium MMX, Pentium Pro,
| Pentium II, Pentium III, Pentium III Xeon, Pentium D, Pentium
| M, Pentium Extreme Edition, etc. Good luck trying to figure
| out the ordering of these processors.
| kragen wrote:
| E5200.
| nxobject wrote:
| I imagine the same reason why we had the Macintosh II and
| IIx, but not the SE and SEx (instead SE/30)...
| monocasa wrote:
| Or the Hexium.
|
| The CPU serial number debacle of the 90s would have been even
| funnier with more overt mark of the beast references.
| uticus wrote:
| > If you have enough time, you can extract the bits from the
| ROM by examining the silicon and seeing where transistors are
| present.
|
| I'm curious if this is a better way than somehow scanning the
| ROM electronically? Asking based on my very shallow
| understanding of how ROM works in this situation, although I
| did read the bit about M1, M2, and M3 lines/contacts.
|
| [edit: I also read about the testing circuitry, that "runs
| through each address," but it's unclear if this is an auto
| feature running without being asked at startup, or if there is
| some way to tap into / intercept this functionality from
| outside.]
| kens wrote:
| You could put microprobes on the die and read out the ROM
| contents electrically, but that would be difficult and would
| need specialized equipment. Reading out the ROM visually is
| much easier, and there is software that can interpret images
| if they are clear enough, e.g. maskromtool:
| https://github.com/travisgoodspeed/maskromtool
|
| The Pentium's built-in self test is somewhat documented: you
| pull the INIT pin high while the RESET pin goes low to
| trigger the test. You can also execute the RUNBIST
| instruction through boundary scan. I don't think this helps
| you get the ROM data; the test just reports pass/fail.
| mmastrac wrote:
| I'm surprised the microcode ROM and format hasn't been dumped
| already. Is anyone working on this?
|
| EDIT: The later Atom processors were dumped, are there any
| similarities?
|
| [1] https://x.com/_markel___/status/1262697756805795841
|
| [2] https://github.com/chip-red-pill/glm-ucode
|
| EDIT 2: Some Pentium Pro disassembly work:
| https://pbx.sh/pentiumii-part2/
| kens wrote:
| There are some people working on the 386 microcode. Dumping the
| Pentium microcode ROM from the die photos would be
| straightforward (but tedious). The hard part is to figure out
| what all the bits mean.
| mmastrac wrote:
| Any ideas if the mask ROM is scrambled? Apparently the P6
| doesn't have a direct mask ROM : microcode relationship.
|
| https://github.com/peterbjornx/p6tools
| kens wrote:
| The Pentium's ROM appears to be slightly scrambled (see
| footnote 6 in my article). ROMs are often a bit permuted
| for electrical reasons. For example, instead of columns
| ordered ABABABAB..., they will be ordered ABBAABBA... and
| then the A and B select lines can be shared by two columns.
| But the columns in the Pentium appear to be permuted in an
| irregular way. I'm not sure if this was for obfuscation or
| if automated layout software decided this was better.
| mmastrac wrote:
| I'm curious if the register you see near the microcode
| ROM is potentially hooked up to MSRs -- it could
| potentially be a read or write buffer.
|
| https://www.cs.cmu.edu/~ralf/papers/highmsr.html
|
| > To the left of the MAR is a 32-bit register that is
| apparently unrelated to the microcode ROM, although I
| haven't determined its function.
| kens wrote:
| That register could be a Model-Specific Register; I
| haven't looked at it closely enough to see what it does.
| The Pentium is very complicated with 3.1 million
| transistors, so my reverse-engineering of it is
| essentially bits and pieces here and there.
___________________________________________________________________
(page generated 2025-03-31 23:00 UTC)