By: Igor ((Not Given)), July 24, 2004 11:08 pm
Room: Moderated Discussions
I read that Chip Architect article earlier. I also knew about the patent but I haven't checked yet if this is the same one that I have already read. Anyway, you have made few interesting points.
The most interesting idea would be to read it from the cache provided that update is not followed by an atomic cache flush. I am pretty sure that at least for Pentiums up to 4 microcode must be decrypted in the cache prior to loading.
Here is what I have deduced from patent that I have read. I was trying to figure out whether Hyper-Threading could be enabled on Northwood CPUs which had it disabled in factory (i.e. early Northwood steppings and Celerons). Since the CPU samples A31 on assertion of RESET to see whether it should enable second logical core people thought that by changing the A31 line they could force HTT on. They were wrong because in the patent it says that Pentium CPUs have some sort of EEPROM on a die which is factory programmed. That EEPROM can change socket pin allocation and signal direction (I, O, I/O) among other things. I guess that Intel changed A31 to be output only instead of I/O line like in HTT enabled CPUs and thus trying to change the A31 line state was useless.
What else is in that EEPROM? It can also be used to remap faulty cache lines for example. What is even more interesting is that the famous multiplier lock is in there!
I even know how it works. It is so simple that it is really ingenious -- there are capacitors placed between critical signal path (clock distribution) and ground. All chips are produced equal in terms of speed, after all it would be rediculous (and costly) to have large variations in such a controlled and complex manufacturing process. So the slower chips are just locked down to the required clock speed by programming the EEPROM after manufacturing and testing. How? Well, that EEPROM controls some switches and those switches connect above mentioned capacitors to the critical points along clock distribution lines WEAKENING the signal above desired frequency up to the point at which the CPU becomes unstable and thus unusable.
If I remember correctly, patent also suggests that the microcode can override or augment some parts of the built-in EEPROM functionality.
Frankly, I would be more interested in finding out how to program that EEPROM... But other than breaking into the fab and stealing the binning equipment nothing else comes to mind :)
>Let me know if you have any more information on this (or for that matter even a
>source where I can get the Prescott update blocks. I haven't owned an Intel CPU
>in years...) This sounds really interesting.
Download BIOS update for my mainboard from here. Extract with WinZIP or WinRAR to a folder of your choice. You have CBROM.EXE, right? If yes, then open command prompt and type "cbrom 8ipekpt2.f7 /other 4056:0000 Extract" (without quotes), and you will get file called ncpucode.bin which is actually a bunch of microcodes pasted together. For Intel microcode format description you should read IA-32 Intel Architecture Software Developer's Manual Volume 3: System Programming Guide chapter 9.11. You could also examine BIOS for some newer board (915, 925 chipset). And of course, I can send you the ncpucode.bin to save you some work. Just let me know how to contact you. I am always for a good information exchange.