4 ms·

Author here for any questions. Hopefully you're not tired of the 386 yet!

by kens 3y ago

h2odragon 3y ago
Not at all tired of the 386; an unrelated question comes up tho. Have you done much on "high power" semiconductors yet? It occurs to me that we're throwing around amps on ICs now that would've been well past "magic smoke" territory not all that long ago; perhaps you might find some ESC chips or something that demonstrate how this progress is being made?
- kens 3y ago
  I've looked at a few higher-power chips, such as the venerable 7805 voltage regulator, but I don't know if that's high-power enough for you :-) There's no high-power secret inside that chip except it uses large transistors. https://www.righto.com/2014/09/reverse-engineering-counterfeit-7805.html https://www.righto.com/2014/09/reverse-engineering-counterfe...
  - rzzzt 3y ago
    Parent might be thinking of those Gallium-Nitride FETs that enable manufacturers to build suspiciously small power bricks.
    - ace2358 3y ago
      I thought that was due to the higher switching frequency of the power transistors, perhaps unrelated to higher current draw in the transistor?
ksaj 3y ago
If you do a writeup on the prefetch queue and want some original code for tampering with it, let me know. I did some deep experimentation with it in the 90's, and still have the code archived. The prefetch queue could be (ab)used in some very interesting and sometimes baffling ways. One of the creations causes a divide by zero if you try to debug it, even if viewing the code doesn't look like it should. Also, I did some experimenting with shrinking code by replacing INT3h with INT21h (one byte, versus two), which similarly lent itself to anti-debugger effects.
- kens 3y ago
  It sounds like you did some very interesting experimentation with the prefetch queue. Realistically, I'm unlikely to investigate the 386 prefetch queue to that level of detail, but if I do, your tests would be useful.
mmastrac 3y ago
Is the self-test exposed in any interesting ways? Any interesting JTAG-like interfaces that could be explored?
- kens 3y ago
  I was thinking of writing about the self-test circuitry. It doesn't expose things in a JTAG-like way, which came later. The main self-test is that if you boot the chip with the BUSY pin set, it goes through a self-test of all the PLA and microcode entries, accumulating a signature using linear-feedback shift registers. It then XORs with the correct value and writes the result to a register. So the visible result is you see 0 in a register, not too exciting. There are also self-test instructions to do things such as write entries to the TLB and read entries, to make sure it is operating correctly. For details, there's a paper on "Design and Test of the 80386" by Pat Gelsinger, who is now CEO of Intel. https://ieeexplore.ieee.org/document/4069991 https://ieeexplore.ieee.org/document/4069991 (paywalled).

Author here for any questions. Hopefully you're not tired of the 386 yet!

by kens 3y ago

Author here for any questions. Hopefully you're not tired of the 386 yet!

Not at all tired of the 386; an unrelated question comes up tho. Have you done much on "high power" semiconductors yet? It occurs to me that we're throwing around amps on ICs now that would've been well past "magic smoke" territory not all that long ago; perhaps you might find some ESC chips or something that demonstrate how this progress is being made?

kens 3y ago
I've looked at a few higher-power chips, such as the venerable 7805 voltage regulator, but I don't know if that's high-power enough for you :-) There's no high-power secret inside that chip except it uses large transistors. https://www.righto.com/2014/09/reverse-engineering-counterfeit-7805.html https://www.righto.com/2014/09/reverse-engineering-counterfe...
- rzzzt 3y ago
  Parent might be thinking of those Gallium-Nitride FETs that enable manufacturers to build suspiciously small power bricks.
  - ace2358 3y ago
    I thought that was due to the higher switching frequency of the power transistors, perhaps unrelated to higher current draw in the transistor?

ksaj 3y ago

If you do a writeup on the prefetch queue and want some original code for tampering with it, let me know. I did some deep experimentation with it in the 90's, and still have the code archived. The prefetch queue could be (ab)used in some very interesting and sometimes baffling ways. One of the creations causes a divide by zero if you try to debug it, even if viewing the code doesn't look like it should. Also, I did some experimenting with shrinking code by replacing INT3h with INT21h (one byte, versus two), which similarly lent itself to anti-debugger effects.

kens 3y ago
It sounds like you did some very interesting experimentation with the prefetch queue. Realistically, I'm unlikely to investigate the 386 prefetch queue to that level of detail, but if I do, your tests would be useful.

mmastrac 3y ago

Is the self-test exposed in any interesting ways? Any interesting JTAG-like interfaces that could be explored?

kens 3y ago
I was thinking of writing about the self-test circuitry. It doesn't expose things in a JTAG-like way, which came later. The main self-test is that if you boot the chip with the BUSY pin set, it goes through a self-test of all the PLA and microcode entries, accumulating a signature using linear-feedback shift registers. It then XORs with the correct value and writes the result to a register. So the visible result is you see 0 in a register, not too exciting. There are also self-test instructions to do things such as write entries to the TLB and read entries, to make sure it is operating correctly. For details, there's a paper on "Design and Test of the 80386" by Pat Gelsinger, who is now CEO of Intel. https://ieeexplore.ieee.org/document/4069991 https://ieeexplore.ieee.org/document/4069991 (paywalled).