Counting the transistors in the 8086 processor: it's harder than you might think | Hacker News Reader

Counting the transistors in the 8086 processor: it's harder than you might think

righto.com

175 pointszdw39 comments

http://web.archive.org/web/20230114190129/http://www.righto....

Very interesting.

Anyone has any idea about the technology that could be used for imaging more dense ICs and multilayer PCBs? In a presentation elsewhere, Ken says that he used a metallurgical telescope and USB microscope. So the imaging is done with visible light and limited resolution. It is enough for old chips, e.g. the 8086 discussed in this article is made with a 3um process.

As I look around I see recent Intel chips haven't been reversed. [0] There are allusions to x-ray tomography and electron microscopes [1]. Anyway a plebs can get close for cheap?

[0] https://reverseengineering.stackexchange.com/questions/5878/...

[1] https://www.youtube.com/watch?v=WOZqoTuAGKY

There's a reason I mostly stick to chips from the 1970s. Moore's law makes reverse engineering (literally) exponentially harder for later chips. Multiple layers of metal on the make it much more difficult; you can remove layer-by-layer but it's very hard. An electron microscope helps, and you can get one for semi-hobbyist prices if you try. X-ray tomography looks like a cool technology but it is very cutting edge and extremely expensive. See: https://spectrum.ieee.org/chip-x-ray

My Dad used to do and teach VLSI design from the 1970s on. Later in his life he designed environmental microphones and recording systems using Excel and assembly respectively because, "I don't need software tools because I know the equations" and "I don't need compiled languages because I know where the bits need to go."

Sorry for the thread-jack. Three years on since the passing of a true polymath.

Kudos to your dad, sounds like he was a great engineer.

I know this is an unecessarily long comment for what might just be a typo, but I'd like to know If I'm getting this right myself.

I believe 'a pleb' is short for 'a plebeian'. 'Plebs' would be plural of 'pleb', so 'a plebs' seems incorrect.

I could be wrong though. English is not my first language, and I'd love to be corrected if I indeed am wrong.

English is my first language and I believe you are correct.

I think a 486 is the last generation for which the feature size is flirting with the wavelength of visible light. Not sure how that translates to reverse engineering but not much road there.

Another great post from Ken - thanks again for all your work.

Looking at the transistor / vacancy counts for microcode it struck me just how this reduces the count of those used for logic in the rest of the CPU - down to less than 12,000 I think. [1]

The 8086's competitor the Z8000 had c17,500 and didn't use microcode so must have been significantly more complex to design - so giving Intel the advantage in getting to market first.

[1] This ignores the transistors used for registers etc.

Author here, if anyone has questions about the 8086.

You mention that you have traced out every transistor from die photos, and I was wondering how much work there would be to make a netlist for the 8086 like that which was used to produce the visual 6502 simulator?

It that feasable or is there lots of work to do to get to that stage?

I'm loving your series on the 8086 btw :)

I'm working on a simulator :-)

Oh fantastic! this makes me super happy to hear :) I'd love to play with it.

(That sounds brilliant!)

Using an HDL like Verilog or VHDL? Something else?

I'm planning on a visual6502-style simulator in a browser.

What is the most recent generation of Intel cpu for which an optical microscope can see enough to (at least theoretically) do what you are doing with the 8086.

In the enlarged photo of the ROM transistors, the transistor in the third row, second column, seems like it should be marked as disconnected.

Should it? Or is there something I'm missing in the way the transistors are connected?

Oops, yes you are correct. Now I need to fix my diagram :(

Off-topic: how do you you find out that your site has been mentioned on Hacker News? Do you notice a surge in traffic? Do you check Hacker News periodically? Did you feel a disturbance in the force?

I use f5bot.com, a free service that checks Reddit, Hacker News, and Lobsters for keywords.

You could use an analytics tool like Google Analytics to see referrer data.

How did you actually count the transistors? Was it a completely maddening manual process or did you develop a tool or other approach to reduce toil and preserve sanity?

I traced out the layers of the chip using GIMP, which was tedious and took several days. I have a super-hacky program that extracts transistors from these layers, figures out connectivity, and generates gates from the transistors. So I didn't need to count the transistors one-by-one, but I did need to trace out each one.

I think it'd be interesting to see a bit of that process in a blog post. Maybe something about how you do what you do and how your techniques have progressed? Even if it's a hacky mess, it sounds neat.

Is it true that lots of embedded system today still use a 8086 of some kind, because they're really cheap/easy to understand?

An 80186 core was reasonably popular in LCD controllers (for OSD etc.) and miscellaneous stuff a while ago:

https://www.cpushack.com/2013/01/12/the-intel-80186-gets-tur...

These days, I think 8051 has taken over due to their smaller die area, and the increased clock frequencies due to smaller process sizes have made their performance sufficient.

I think the Intel 8051 is still used in embedded systems. I don't know about the 8086 but it wouldn't surprise me.

8051 is the basis for many microcontrollers today. They aren't compatible since vendors add all kinds of custom instructions or modifications to the original design but some vendors do still make drop in replacements. You can also get soft core versions for FPGAs that can run original software.

x86 is a fairly uncommon choice in embedded systems, but it does show up occasionally. The DisplayPort to HDMI chip used in some current-generation Apple laptops has an embedded 80186 core, for example.

What you will find all over are 8051-compatible cores. Those show up everywhere, even in some places where you might not have expected to find a microcontroller at all.

If they are still manufactured, which process is used?

I guess even a 65nm 8086 would be tiny.

Production of the 8086 by Intel stopped in 1998. I imagine that it may have continued by another manufacturer, but I doubt it. 8051 descendants/derivatives are manufactured, but no longer by Intel.

In general ARM and RISC-V have taken much of the low end market and microcontroller market.

And lightning fast.

i don't have any questions but i do have a lot of appreciation

thank you for writing this series

Thanks! It's nice to know that people are finding it interesting.

Out of the 20000 you counted, which transistor is your favorite?

I'd pick a driver transistor in the charge pump because it's kind of wild to have this analog circuit generating negative voltage in this otherwise digital chip.

Does there exist a logic gate diagram of the 8086, or similar cpu's (e.g. 6502)? I mean a way to see the discrete digital logic, as opposed to transistors, of the ALU and also any other random logic and control.

Always an informative read, thank you so much, Ken!

This is what happens tv becomes unwatchable.

Reply on news.ycombinator.com