Extracting ROM constants from the 8087 math coprocessor's die:
Intel introduced the 8087 chip in 1980 to improve floating-point performance on the 8086 and 8088 processors, and it was used with the original IBM PC. Since early microprocessors operated only on integers, arithmetic with floating-point numbers was slow and transcendental operations such as arctangent or logarithms were even worse. Adding the 8087 co-processor chip to a system made floating-point operations up to 100 times faster.
I opened up an 8087 chip and took photos with a microscope. The photo below shows the chip's tiny silicon die. Around the edges of the chip, tiny bond wires connect the chip to the 40 external pins. The labels show the main functional blocks, based on my reverse engineering. By examining the chip closely, various constants can be read out of the chip's ROM, numbers such as pi that the chip uses in its calculations.
The top half of the chip contains the control circuitry. Performing a floating-point instruction might require 1000 steps; the 8087 used microcode to specify these steps. The die photo above shows the "engine" that ran the microcode program; it is basically a simple CPU. Next to it is the large ROM that holds the microcode.
The bottom half of the die holds the circuitry that processes floating-point numbers. A floating-point number consists of a fraction (also called significand or mantissa), an exponent, and a sign bit. (For a base-10 analogy, in the number 6.02×1023, 6.02 is the fraction and 23 is the exponent.) The chip has separate circuitry to process the fraction and the exponent in parallel. The fraction processing circuitry supports 67-bit values, a 64-bit fraction with three extra bits for accuracy. From left to right, the fraction circuitry consists of a constant ROM, a shifter, adder/subtracters, and the register stack. The constant ROM (highlighted in green) is the subject of this post.
Related Stories
How the 8086 processor handles power and clock internally:
One under-appreciated characteristic of early microprocessors is the difficulty of distributing power inside the integrated circuit. While a modern processor might have 15 layers of metal wiring, chips from the 1970s such as the 8086 had just a single layer of metal, making routing a challenge. Similarly, clock signals must be delivered to all parts of the chip to keep it in synchronization.
The photo below shows the 8086's die under a microscope. The metal layer on top of the chip is visible, with the silicon substrate and polysilicon wiring hidden underneath. Around the outside of the die, tiny bond wires connect pads on the die to the external pins. The 8086 has a power pad at the top and ground pads at the top and bottom. Each power and ground pad has two bond wires connected to support twice the current. You can see the wide metal traces from the power and ground pads; these distribute power throughout the chip.
Though orders of magnitude less capable than the processors of today, there was still plenty going on "under the hood" to make it happen. The article also has many pics of the 8086 die with various traces highlighted to ease identification.
Previously:
(2020-06-27) Die Shrink: How Intel Scaled Down the 8086 Processor
(2020-05-21) Extracting ROM Constants from the 8087 Math Coprocessor's Die
http://www.righto.com/2020/08/reverse-engineering-8086s.html
The Intel 8086 processor was introduced in 1978, setting the course of modern computing. While the x86 processor family has supported 64-bit processing for decades, the original 8086 was a 16-bit processor. As such, it has a 16-bit arithmetic logic unit (ALU). The arithmetic logic unit is the heart of a processor: it performs arithmetic operations such as addition and subtraction. It also carries out Boolean logic operations such as bitwise AND and OR as well as also bit shifts and rotates. Since a fast ALU is essential to the overall performance of a processor, ALUs often incorporate interesting design tricks.
The die photo below shows the silicon die of the 8086 processor. The ALU is in the lower-left corner. Above it are the general- and special-purpose registers. An adder, used for address calculation, is in the upper left. (For performance, the 8086 has a separate adder to add the segment register and memory offset when accessing memory.) The large microcode ROM is in the lower right.
Zooming in on the ALU shows that it is constructed from 16 nearly-identical stages, one for each bit. The upper row handles bits 7 to 0 while the lower row handles bits 15 to 8. In between, the flag circuitry indicates the status of an arithmetic operation through condition codes such as zero or nonzero, positive or negative, carry, overflow, parity, and so forth. These are typically used for conditional branches.
Previously:
(2020-08-15) How the 8086 Processor Handles Power and Clock Internally
(2020-06-27) Die Shrink: How Intel Scaled Down the 8086 Processor
(2020-05-21) Extracting ROM Constants from the 8087 Math Coprocessor's Die
(Score: 4, Interesting) by FatPhil on Thursday May 21 2020, @09:16AM (4 children)
Robert Munafo's RIES almost instantly gives this as the "meaning" of the number:
4 sqrt(2 x) = (1/4+1)^9 ('exact' match) {123}
so sqrt(2x) = (5/4)^9/4, or 2x = (5/4)^18/16, or x = (5^18)/(2^41) = 10^18/2^59
Another thing that stands out about those numbers is that several of the CORDIC ones are programattically trivial, and it almost seems a waste to store them explicitly. Most of the atan(2^-n) constants can be calculated as atan(x) = x - 1/3*x^3 + O(x^5), and 1/3 is just alternating 0s and 1s.
e.g., and set fonts to teletype:
binary(atan(2^-10))
[[0], [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 0, 1, 0, 1, 0, 1, 0, 1, 0, 1, 0, 1, 0, 1, 0, 1, 0, 1, 0, 1,
. . . .^--------------------------^ ^--------------------------^ ^--------------------------^ ^--------------------------------------------------------^
. . . . . . . . 10 zeroes . . . . . . . . . . . 10 ones . . . . . . . . . . 10 ones . . . . . . . . . . . . . . . . . . 10 "one-zero"s
(and the sequence continues with groups of 1101 from the x^5 term until the 70th bit, 1101 being repeating binary for 1-1/3+1/5
It just seems like it should be trivial for hardware to construct such numbers very quickly. However, the fact that 1.0, which has the most trivial representation of all, is stored in the ROM also tells me that ROM was considered very cheap indeed.
Great minds discuss ideas; average minds discuss events; small minds discuss people; the smallest discuss themselves
(Score: 2) by epitaxial on Thursday May 21 2020, @05:43PM
English, motherfucker do you speak it?
(Score: 1, Insightful) by Anonymous Coward on Thursday May 21 2020, @07:13PM (1 child)
We're talking about constants, yes? Where do you get the x in sqrt(2x) from?
What am I missing here?
(Score: 2) by FatPhil on Sunday May 24 2020, @06:51PM
I should have used the -s option for RIES, which makes things clearer:
x = ((1/4+1)^9/4)^2/2 for x = T + 4.33681e-19 {125}
(Stopping now because best match is within 7.52e-19 of target value.)
Great minds discuss ideas; average minds discuss events; small minds discuss people; the smallest discuss themselves
(Score: 1) by shrewdsheep on Friday May 22 2020, @10:01AM
I am not sure about this. I believe the "trivial" construction of the constants would require more silicon than the constant itself (at least on average). Also the timing aspect is important. Why reconstruct those constants on the fly to introduce complex timing issues? If pre-calculated, we talk about very expensive registers. Just think of ordinary programming. A lot of constants are pre-defined in say, the standard C library, that could be constructed by very short algorithms. This form of pre-calculation usually pays off handily later.
(Score: 2) by All Your Lawn Are Belong To Us on Thursday May 21 2020, @09:12PM (1 child)
It's an interesting article and I enjoyed perusing it. But I assume that it has more to do with showing how one can understand things by reverse engineering from decapping chips. Because surely someone at Intel should have been able to answer this question and learning it that way would have to have been much less labor intensive than this process. Doesn't make it less cool, really. But the core of engineering is to use the least energy to obtain the necessary results.
This sig for rent.
(Score: 0) by Anonymous Coward on Friday May 22 2020, @01:01AM
"someone at Intel should have been able to answer this question"
And how does J Random Hacker penetrate the Cone of Silence surrounding all that is Intel CPU Engineering?