Reverse engineering modern Intel CPUs

4 min read Original article ↗

Are there open source projects that completely restore the inner circuitry of modern Intel CPUs?

Not for modern CPUs. Not even for 10-15 years old CPUs.

In 2015 the reverse engineering of Intel 8080 was finished, and this CPU is from 1974 year (actually, Soviet i8080 clone KR580VM80A from 1980s was reversed). Both CPUs were made with 6 μm feature size, so the chip can be photographed using cheap optical microscope.

The report in english is here: http://zeptobars.ru/en/read/KR580VM80A-intel-i8080-verilog-reverse-engineering

The project was coordinated here (russian): http://zx-pk.ru/printthread.php?t=23349&pp=40

Availability of detailed documentation (with block-schemes), low amount of transistors (4758 units), coarse features, single metal layer and readable dopant zones allowed to do this project.

Other successful project was MOS 6502 from 1975, 5-16 μm feature size, 3.5 thousands transistors - http://www.visual6502.org/ (They have big collection of chip photos, but they are not reversed to the schematics)

One of KR580VM80A reversers reported project about reversing (russian) MIPS R3051 based Playstation 1 CPU made with 0.8 μm (800 nm) feature size in 1995. Project site is http://psxdev.ru/. This CPU has 250 thousands transistors and three layers of metal. In two years after start, good optical photos of chip and all its layers were made (all metals, silicon and dopant), many standard cells were identified, but only multiplier block was rather fully reversed.

So, 0.25 million-transistor device is out of reach for amateurs, and modern Intel devices have transistor count of 50 millions in Pentium 3/4 (2000, around 130nm), 50 mln in Atom (2008, 45nm); 200-400 mln in Core 2 (2007, 65-45 nm) and more then 1000 millions in bigger chips like Core i7 (2010, 32nm).

Is it simply possible, or are circuits closed and/or protected by proprietary technology?

The circuits and its "sources" (verilog) are proprietary; the software used to convert them into the transistor pattern is proprietary (some by Intel, possibly some by other vendors). And there are not any chance to readout the schematics back from the die (the fabricated chip), because features are too small to be visible in optical microscope; and dopant levels are too low to be read out by even scanning electron microscope (SEM) for the full chip. There just too much information inside the chip (I consider modern photo lithography tools to be most advanced data transfer tools made by mankind; with terabytes per second transferred from photomask into the wafer).

For example, the paper Stealthy Dopant-Level Hardware Trojans says:

Also, optical reverse-engineering does not usually allow to detect changes made to the dopant, especially in small technologies. A dedicated setup could eventually allow to identify the dopant polarity. However, doing so in a large design comprising millions of transistors implemented with small technologies seems impractical ...

There are several companies which are able to reverse engineer some parts of modern chips, but Intel's CPUs are too big to be fully reversed (this process will have impractical cost both in money and in man- and computer-hours). For example, reversing leader, Chipworks - www.chipworks.com - lists some examples:

Examples of our experience and capabilities

  • Stand-alone and embedded memory
  • Field programmable gate array (FPGA) and other gate arrays
  • Analog-to-digital converters (ADC) and digital-to-analog converters (DAC) PLLs and clock generators
  • Wired and wireless devices, including transceivers and mixers
  • Advanced CMOS microprocessors, graphic chips, DSPs, and microcontrollers
  • RFIDs and smartcard chips
  • Power semiconductor devices including regulators and high/low power designs

But most of their projects were reversing of some small chips (made with not the most advanced technology) or reversing of some parts of chips. They are able of opening chip, making some nice SEM photos of chip cross-section, or optical photos of full die top metals or silicon layer in very coarse resolution (good to measure area of chip or its blocks, but no reversing from this).

They sells some photos and reports about Intel chips, for example of Core i5-660: * 200 USD for die photo (top metal?) * 2500 USD for M1 (lower metal) photo * 11000 USD for report of used package * 15-15.5 thousands USD for Layout and Design (DfM) Analysis or Transistor Characterization * 24.5 thousands USD for Structural Analysis Report

Some people think, that it will be much cheaper to redevelop the modern CPU than trying to reverse engineer it from the chip. And, possibly, some federal agencies may infiltrate their federal agents into the company to try to steal the CPU sources; but I think that they can get sources to the agent's hands, but will be not able to get them outside the buildings.