←back to thread

Notes on the Pentium's microcode circuitry

(www.righto.com)
180 points leotravis10 | 4 comments | 31 Mar 25 18:35 UTC | HN request time: 1.759s | source
Show context
mmastrac ◴[31 Mar 25 20:47 UTC] No.43539796[source]▶
I'm surprised the microcode ROM and format hasn't been dumped already. Is anyone working on this?

EDIT: The later Atom processors were dumped, are there any similarities?

[1] https://x.com/_markel___/status/1262697756805795841

[2] https://github.com/chip-red-pill/glm-ucode

EDIT 2: Some Pentium Pro disassembly work: https://pbx.sh/pentiumii-part2/

replies(2): >>43540008 #>>43543707 #
kens ◴[31 Mar 25 21:11 UTC] No.43540008[source]▶
There are some people working on the 386 microcode. Dumping the Pentium microcode ROM from the die photos would be straightforward (but tedious). The hard part is to figure out what all the bits mean.
replies(1): >>43540100 #
1. mmastrac ◴[31 Mar 25 21:19 UTC] No.43540100[source]▶
Any ideas if the mask ROM is scrambled? Apparently the P6 doesn't have a direct mask ROM : microcode relationship.

https://github.com/peterbjornx/p6tools

replies(1): >>43540148 #
2. kens ◴[31 Mar 25 21:24 UTC] No.43540148[source]▶
The Pentium's ROM appears to be slightly scrambled (see footnote 6 in my article). ROMs are often a bit permuted for electrical reasons. For example, instead of columns ordered ABABABAB..., they will be ordered ABBAABBA... and then the A and B select lines can be shared by two columns. But the columns in the Pentium appear to be permuted in an irregular way. I'm not sure if this was for obfuscation or if automated layout software decided this was better.
replies(1): >>43540290 #
3. mmastrac ◴[31 Mar 25 21:40 UTC] No.43540290[source]▶
I'm curious if the register you see near the microcode ROM is potentially hooked up to MSRs -- it could potentially be a read or write buffer.

https://www.cs.cmu.edu/~ralf/papers/highmsr.html

> To the left of the MAR is a 32-bit register that is apparently unrelated to the microcode ROM, although I haven't determined its function.

replies(1): >>43540433 #
4. kens ◴[31 Mar 25 21:59 UTC] No.43540433{3}[source]▶
That register could be a Model-Specific Register; I haven't looked at it closely enough to see what it does. The Pentium is very complicated with 3.1 million transistors, so my reverse-engineering of it is essentially bits and pieces here and there.