10

Are there open source projects that completely restore the inner circuitry of modern Intel CPUs? Is it simply possible, or are circuits closed and/or protected by proprietary technology?

Improve this question
0

5 Answers 5

Reset to default
14

Are there open source projects that completely restore the inner circuitry of modern Intel CPUs?

Not for modern CPUs. Not even for 10-15 years old CPUs.

In 2015 the reverse engineering of Intel 8080 was finished, and this CPU is from 1974 year (actually, Soviet i8080 clone KR580VM80A from 1980s was reversed). Both CPUs were made with 6 μm feature size, so the chip can be photographed using cheap optical microscope.

The report in english is here: http://zeptobars.ru/en/read/KR580VM80A-intel-i8080-verilog-reverse-engineering

The project was coordinated here (russian): http://zx-pk.ru/printthread.php?t=23349&pp=40

Availability of detailed documentation (with block-schemes), low amount of transistors (4758 units), coarse features, single metal layer and readable dopant zones allowed to do this project.

Other successful project was MOS 6502 from 1975, 5-16 μm feature size, 3.5 thousands transistors - http://www.visual6502.org/ (They have big collection of chip photos, but they are not reversed to the schematics)

One of KR580VM80A reversers reported project about reversing (russian) MIPS R3051 based Playstation 1 CPU made with 0.8 μm (800 nm) feature size in 1995. Project site is http://psxdev.ru/. This CPU has 250 thousands transistors and three layers of metal. In two years after start, good optical photos of chip and all its layers were made (all metals, silicon and dopant), many standard cells were identified, but only multiplier block was rather fully reversed.

So, 0.25 million-transistor device is out of reach for amateurs, and modern Intel devices have transistor count of 50 millions in Pentium 3/4 (2000, around 130nm), 50 mln in Atom (2008, 45nm); 200-400 mln in Core 2 (2007, 65-45 nm) and more then 1000 millions in bigger chips like Core i7 (2010, 32nm).

Is it simply possible, or are circuits closed and/or protected by proprietary technology?

The circuits and its "sources" (verilog) are proprietary; the software used to convert them into the transistor pattern is proprietary (some by Intel, possibly some by other vendors). And there are not any chance to readout the schematics back from the die (the fabricated chip), because features are too small to be visible in optical microscope; and dopant levels are too low to be read out by even scanning electron microscope (SEM) for the full chip. There just too much information inside the chip (I consider modern photo lithography tools to be most advanced data transfer tools made by mankind; with terabytes per second transferred from photomask into the wafer).

For example, the paper Stealthy Dopant-Level Hardware Trojans says:

Also, optical reverse-engineering does not usually allow to detect changes made to the dopant, especially in small technologies. A dedicated setup could eventually allow to identify the dopant polarity. However, doing so in a large design comprising millions of transistors implemented with small technologies seems impractical ...

There are several companies which are able to reverse engineer some parts of modern chips, but Intel's CPUs are too big to be fully reversed (this process will have impractical cost both in money and in man- and computer-hours). For example, reversing leader, Chipworks - www.chipworks.com - lists some examples:

Examples of our experience and capabilities

  • Stand-alone and embedded memory
  • Field programmable gate array (FPGA) and other gate arrays
  • Analog-to-digital converters (ADC) and digital-to-analog converters (DAC) PLLs and clock generators
  • Wired and wireless devices, including transceivers and mixers
  • Advanced CMOS microprocessors, graphic chips, DSPs, and microcontrollers
  • RFIDs and smartcard chips
  • Power semiconductor devices including regulators and high/low power designs

But most of their projects were reversing of some small chips (made with not the most advanced technology) or reversing of some parts of chips. They are able of opening chip, making some nice SEM photos of chip cross-section, or optical photos of full die top metals or silicon layer in very coarse resolution (good to measure area of chip or its blocks, but no reversing from this).

They sells some photos and reports about Intel chips, for example of Core i5-660: * 200 USD for die photo (top metal?) * 2500 USD for M1 (lower metal) photo * 11000 USD for report of used package * 15-15.5 thousands USD for Layout and Design (DfM) Analysis or Transistor Characterization * 24.5 thousands USD for Structural Analysis Report

Some people think, that it will be much cheaper to redevelop the modern CPU than trying to reverse engineer it from the chip. And, possibly, some federal agencies may infiltrate their federal agents into the company to try to steal the CPU sources; but I think that they can get sources to the agent's hands, but will be not able to get them outside the buildings.

Improve this answer
6
  • Intro paper from Chipworks about reverse engineering of chips chipworks.com/images/content-documents/TCA/whitepapers-articles/… - page 8: "Circuit extraction of semiconductor chips becomes increasingly more difficult with each new generation. In the “good old days” of 10 to 20 years ago, a circuit analyst’s life was much simpler. A typical IC of those days may have had one layer of metal, and used 1 µm - 2 µm technology. After package removal, all features could usually be seen from the top level metal planar view".. Optical for 250nm; SEM for 180nm and less
    – osgx
    Apr 23, 2015 at 0:18
  • This looks like a 4004 (1971) reverse engineer from 2009: 4004.com the grandfather of modern CPUs.
    – Ciro Santilli OurBigBook.com
    Oct 27, 2015 at 9:54
  • 1
    There are good methods for huge companies. As I know, Google prohibit any data storage device to leave datacenter - they even destroy broken hdd inside the building google.com/about/datacenters/inside/data-security "We destroy hard drives.." They have a lot of internal rules, even for suppliers (Intel): supplier.intel.com/static/governance/documents/… - 4.a "background checks to the extent permitted by applicable law.", 4.c, 5. No open Internet access (7. f,g,h,i,j). Even secure chain web.mit.edu/supplychain/repository/intel_lund_120502.ppt
    – osgx
    Oct 28, 2015 at 0:36
  • 1
    Intel threat model - sbs.ox.ac.uk/cybersecurity-capacity/system/files/… Threat Agent Library...2007 wp by Casey - includes "external and internal threat agents ranging from industrial spies to untrained employees" .. " ranging from government spies to untrained employees".. "Table 2. (Strength of Threat rating is proprietary and not included) .. Government Spy; Insider; Tactics: Theft of IP or business data; Description: State-sponsored spy as a trusted insider, supporting idealistic goals"
    – osgx
    Oct 28, 2015 at 0:44
  • 1
    In newer wp - 2010 (link from communities.intel.com/thread/49315 by Casey) - communities.intel.com/docs/DOC-4693 Whitepaper: Prioritizing Information Security Risks with Threat Agent Risk Assessment - they still think about spies, but Highest Risk is assigned in the example to "Disgruntled Employee" (Will they have their own Snowden and why NSA's risk assessment failed for this disgruntled backup administrator? - arstechnica.com/information-technology/2013/08/… - the " two-person" rule is only after Ed.)
    – osgx
    Oct 28, 2015 at 0:58
4

OpenCores is a project aiming at rebuilding the design of usual integrated-circuits with Open Source licenses.

One of the sub-project is dedicated to rebuild the i386 architecture, it is called Zet.

I don't know how they rebuild the instruction set, there must be a bit of reverse-engineering. But, the specifications given by Intel should be enough (of course, this design will be far from being as efficient as Intel CPUs. Intel did a lot of progress during all these years, it would be difficult to get the same result at the end).

But, I don't know if this question is really related to reverse-engineering (yet, I don't know where you should have asked it, so...).

Improve this answer
3

I found this site containing a hires zoomable picture of the 80486.

And here an effort to reverseengineer the AMD microcode format.

Googling for siliconpr0n and intel yields even more people trying something similar.

Improve this answer
3

From a now deleted Quora comment:

Non-Intel superset: https://electronics.stackexchange.com/questions/13472/is-it-possible-to-reverse-engineer-a-chip-design

Improve this answer
0

ReProgramming the processor is quite difficult (you will nead to create your own simi motherboard) . But reconstruct the microprocessor (changing its architecture and developing your own firmware by micro ops )is impossible in modern inter microprocessors . Even the updates to firmware is encrypted with key that is kept inside the processor. This beacause intel wants to protect its processors firmware from malware. And if the firmware is infected the result will be a real disaster.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.