4 ms·

i8080 precise replica in Verilog, based on reverse engineering of real die

112 points by kens 6y ago

phendrenad2 6y ago
It's my understanding that photos of a semiconductor die (pre-CMOS) aren't 100% useful, since often the sizes of transistors relative to one another becomes an important detail, which is hard to extrapolate to standard logic gates. It's my understanding that the Motorola 68000 still has some outstanding emulation problems (related to the instruction cache), due to using HMOS logic. NMOS chips like the 8080 are also affected by this.
- kens 6y ago
  Transistor sizes are easy to extract from photos. What's hard is doping levels, which can make a transistor enhancement or depletion. The type is usually obvious from context. However, the Z-80 designers famously used the "wrong" doping for a few transistors. The purpose of this was to create traps for companies copying the IC from the die, since a straightforward copy would yield a few gates that didn't work right. I've found a few of these traps in the Z-80, and they were placed very maliciously. The circuit appears reasonable and correct, but fails in subtle ways.
  - bonzini 6y ago
    Have you blogged about it?
    - kens 6y ago
      I haven't blogged about the Z-80 traps. I was waiting until Sergei wrote about the transistors, but then didn't get around to it.
  - raphlinus 6y ago
    https://www.cl.cam.ac.uk/~sps32/Z80proj/Z80_traps.pdf https://www.cl.cam.ac.uk/~sps32/Z80proj/Z80_traps.pdf has very high quality imaging of the doping levels, by Sergei Skorobogatov. https://retrocomputing.stackexchange.com/questions/11143/in-the-original-z80-layout-where-are-the-traps-located-and-what-are-their-ef https://retrocomputing.stackexchange.com/questions/11143/in-... references "Zilog oral history" and poses the question, but there isn't a strong answer other than the link to the above. The oral history document referenced is: http://archive.computerhistory.org/resources/access/text/2012/07/102658025-05-01-acc.pdf http://archive.computerhistory.org/resources/access/text/201... . The discussion of traps begins on page 101.
- wk_end 6y ago
  > It's my understanding that the Motorola 68000 still has some outstanding emulation problems (related to the instruction cache), due to using HMOS logic. This doesn't sound right to me. For one thing, the idea that you need to simulate analog effects in order to properly emulate an instruction cache sort of flies in the face of my (admittedly amateur) understanding of reasonable chip design. For another, that'd imply that the CMOS versions of the 68K function differently than the HMOS ones, and I can't find any indication of that. Finally, as far as I know the 68000 doesn't have an instruction cache!
  - krallja 6y ago
    I also don’t think the 68000 had an instruction cache. The 68010 added a “loop mode” which was effectively a 2-entry instruction cache.
- TD-Linux 6y ago
  Although not based on die photos AFAIK, there is a cycle accurate SystemVerilog core. https://github.com/ijor/fx68k https://github.com/ijor/fx68k
- K1801BM1 6y ago
  There were no any problems to recognize n-MOS logic during the reverse - everything was quite obvious regardless the transistor sizes. And I just dropped the sizes in my schematics, it simplified the process a lot.
oneplane 6y ago
As a person not fluent in processor design, chip design, FPGAs or Verilog, is there some demonstration of actual software running on this implementation? Or is that one or more steps away after synthesising and loading the bitstream in to the FPGA?
- happycube 6y ago
  There are simple demonstrations in the repo, and he's run it on actual FPGA boards. But beyond that, the core has already been ported to MiSTer, which would be much more enjoyable to use: https://github.com/MiSTer-devel/Altair8800_Mister https://github.com/MiSTer-devel/Altair8800_Mister
  - watersb 6y ago
    (MiSTer is an open-source FPGA-based retro emulator) https://emulation.gametechwiki.com/index.php/MiSTer https://emulation.gametechwiki.com/index.php/MiSTer
- sasaf5 6y ago
  In the tst directory they have .asm files, which they load in the program memory to test the CPU. The abstract mentions that they run it in FPGA, but it wouldn't be difficult to run those tests in simulation too (albeit exceedingly slow).
cmrdporcupine 6y ago
I love that this is a replica of the Soviet replica of the 8080. So a replica of a replica.
- bonzini 6y ago
  Do you have any idea how the Soviet replicas were built?
  - virtue3 6y ago
    https://retrocomputing.stackexchange.com/questions/1858/how-were-western-computer-chips-reverse-engineered-in-ussr https://retrocomputing.stackexchange.com/questions/1858/how-... There's some pretty famous "signs" that companies would put into their chips to show that it was blatently stolen. Also at some point it became a game: https://micro.magnet.fsu.edu/creatures/pages/russians.html https://micro.magnet.fsu.edu/creatures/pages/russians.html What's fascinating is that you can basically run a country with little to no "actual" development of computer hardware, and just have an entire industry around "copying" to keep yourself up to date (or a few years behind at most). This is pretty evident with China of the past few years in military tech, and now they are starting to leap frog (See engine issues with their new fighter, and how they are almost there but not quite. Russia is unwilling to sell them newer engines for fear of copying essentially)
    - a_concerned 6y ago
      Your comment got me interested and i compared die photos of both chips. Intel 8080A die photo: https://vintageteardown.com/wp-content/uploads/2018/04/Intel8080A_10x-1.jpg https://vintageteardown.com/wp-content/uploads/2018/04/Intel... 580BM80A die photo: https://raw.githubusercontent.com/1801BM1/vm80a/master/img/vm80a.jpg https://raw.githubusercontent.com/1801BM1/vm80a/master/img/v... I am not an expert in CPU design, so please correct me if i am wrong, but chips look rather different (at least Intel logo was removed on the 580BM80A die). Could it be that 580BM80A implements Intel's ISA, but actual CPU architecture is of their own? And could we call it a "copy"/"replica" if so? Like could we say that AMD CPUs are replicas of Intel CPUs, because they implement the same ISA?
xellisx 6y ago
I've always wondered if a Soviet block made a clone that was better in some way, or if they ever came up with their own CPU architecture. Didn't IBM have an ALU design that were more harden again calculation errors?
- metaphor 6y ago
  > Didn't IBM have an ALU design that were more harden again calculation errors? I'm genuinely confused what is meant by this in practice. Like some sort of redundant ALU architecture or rad hard encapsulation?
  - krallja 6y ago
    ‘kens has an article about IBM qui-binary arithmetic: http://www.righto.com/2015/10/qui-binary-arithmetic-how-1960s-ibm.html http://www.righto.com/2015/10/qui-binary-arithmetic-how-1960... this might be what is referenced?
    - xellisx 6y ago
      That's what I was thinking about!
  - dbcurtis 6y ago
    It could mean either. Rad-hard parts are used in satellites. I am not familiar with the current crop of rad-hard parts. I did work as a CPU logic desiger at Amdahl. We had full parity through-checking, so an ALU intermittent logic error would raise a parity exception. Certainly IBM would have had the same, it was standard SOTA reliability logic for the era of mainframes when I was a designer.
- Miiko 6y ago
  > if [Soviet block] ever came up with their own CPU architecture. To the best of my knowledge, BESM-6 and Elbrus were not clones https://en.wikipedia.org/wiki/Elbrus_(computer) https://en.wikipedia.org/wiki/Elbrus_(computer)
- 6y ago

112 points by kens 6y ago

It's my understanding that photos of a semiconductor die (pre-CMOS) aren't 100% useful, since often the sizes of transistors relative to one another becomes an important detail, which is hard to extrapolate to standard logic gates. It's my understanding that the Motorola 68000 still has some outstanding emulation problems (related to the instruction cache), due to using HMOS logic. NMOS chips like the 8080 are also affected by this.

kens 6y ago
Transistor sizes are easy to extract from photos. What's hard is doping levels, which can make a transistor enhancement or depletion. The type is usually obvious from context. However, the Z-80 designers famously used the "wrong" doping for a few transistors. The purpose of this was to create traps for companies copying the IC from the die, since a straightforward copy would yield a few gates that didn't work right. I've found a few of these traps in the Z-80, and they were placed very maliciously. The circuit appears reasonable and correct, but fails in subtle ways.
- bonzini 6y ago
  Have you blogged about it?
  - kens 6y ago
    I haven't blogged about the Z-80 traps. I was waiting until Sergei wrote about the transistors, but then didn't get around to it.
- raphlinus 6y ago
  https://www.cl.cam.ac.uk/~sps32/Z80proj/Z80_traps.pdf https://www.cl.cam.ac.uk/~sps32/Z80proj/Z80_traps.pdf has very high quality imaging of the doping levels, by Sergei Skorobogatov. https://retrocomputing.stackexchange.com/questions/11143/in-the-original-z80-layout-where-are-the-traps-located-and-what-are-their-ef https://retrocomputing.stackexchange.com/questions/11143/in-... references "Zilog oral history" and poses the question, but there isn't a strong answer other than the link to the above. The oral history document referenced is: http://archive.computerhistory.org/resources/access/text/2012/07/102658025-05-01-acc.pdf http://archive.computerhistory.org/resources/access/text/201... . The discussion of traps begins on page 101.
wk_end 6y ago
> It's my understanding that the Motorola 68000 still has some outstanding emulation problems (related to the instruction cache), due to using HMOS logic. This doesn't sound right to me. For one thing, the idea that you need to simulate analog effects in order to properly emulate an instruction cache sort of flies in the face of my (admittedly amateur) understanding of reasonable chip design. For another, that'd imply that the CMOS versions of the 68K function differently than the HMOS ones, and I can't find any indication of that. Finally, as far as I know the 68000 doesn't have an instruction cache!
- krallja 6y ago
  I also don’t think the 68000 had an instruction cache. The 68010 added a “loop mode” which was effectively a 2-entry instruction cache.
TD-Linux 6y ago
Although not based on die photos AFAIK, there is a cycle accurate SystemVerilog core. https://github.com/ijor/fx68k https://github.com/ijor/fx68k
K1801BM1 6y ago
There were no any problems to recognize n-MOS logic during the reverse - everything was quite obvious regardless the transistor sizes. And I just dropped the sizes in my schematics, it simplified the process a lot.

oneplane 6y ago

As a person not fluent in processor design, chip design, FPGAs or Verilog, is there some demonstration of actual software running on this implementation? Or is that one or more steps away after synthesising and loading the bitstream in to the FPGA?

happycube 6y ago
There are simple demonstrations in the repo, and he's run it on actual FPGA boards. But beyond that, the core has already been ported to MiSTer, which would be much more enjoyable to use: https://github.com/MiSTer-devel/Altair8800_Mister https://github.com/MiSTer-devel/Altair8800_Mister
- watersb 6y ago
  (MiSTer is an open-source FPGA-based retro emulator) https://emulation.gametechwiki.com/index.php/MiSTer https://emulation.gametechwiki.com/index.php/MiSTer
sasaf5 6y ago
In the tst directory they have .asm files, which they load in the program memory to test the CPU. The abstract mentions that they run it in FPGA, but it wouldn't be difficult to run those tests in simulation too (albeit exceedingly slow).

cmrdporcupine 6y ago

I love that this is a replica of the Soviet replica of the 8080. So a replica of a replica.

bonzini 6y ago
Do you have any idea how the Soviet replicas were built?
- virtue3 6y ago
  https://retrocomputing.stackexchange.com/questions/1858/how-were-western-computer-chips-reverse-engineered-in-ussr https://retrocomputing.stackexchange.com/questions/1858/how-... There's some pretty famous "signs" that companies would put into their chips to show that it was blatently stolen. Also at some point it became a game: https://micro.magnet.fsu.edu/creatures/pages/russians.html https://micro.magnet.fsu.edu/creatures/pages/russians.html What's fascinating is that you can basically run a country with little to no "actual" development of computer hardware, and just have an entire industry around "copying" to keep yourself up to date (or a few years behind at most). This is pretty evident with China of the past few years in military tech, and now they are starting to leap frog (See engine issues with their new fighter, and how they are almost there but not quite. Russia is unwilling to sell them newer engines for fear of copying essentially)
  - a_concerned 6y ago
    Your comment got me interested and i compared die photos of both chips. Intel 8080A die photo: https://vintageteardown.com/wp-content/uploads/2018/04/Intel8080A_10x-1.jpg https://vintageteardown.com/wp-content/uploads/2018/04/Intel... 580BM80A die photo: https://raw.githubusercontent.com/1801BM1/vm80a/master/img/vm80a.jpg https://raw.githubusercontent.com/1801BM1/vm80a/master/img/v... I am not an expert in CPU design, so please correct me if i am wrong, but chips look rather different (at least Intel logo was removed on the 580BM80A die). Could it be that 580BM80A implements Intel's ISA, but actual CPU architecture is of their own? And could we call it a "copy"/"replica" if so? Like could we say that AMD CPUs are replicas of Intel CPUs, because they implement the same ISA?

xellisx 6y ago

I've always wondered if a Soviet block made a clone that was better in some way, or if they ever came up with their own CPU architecture. Didn't IBM have an ALU design that were more harden again calculation errors?

metaphor 6y ago
> Didn't IBM have an ALU design that were more harden again calculation errors? I'm genuinely confused what is meant by this in practice. Like some sort of redundant ALU architecture or rad hard encapsulation?
- krallja 6y ago
  ‘kens has an article about IBM qui-binary arithmetic: http://www.righto.com/2015/10/qui-binary-arithmetic-how-1960s-ibm.html http://www.righto.com/2015/10/qui-binary-arithmetic-how-1960... this might be what is referenced?
  - xellisx 6y ago
    That's what I was thinking about!
- dbcurtis 6y ago
  It could mean either. Rad-hard parts are used in satellites. I am not familiar with the current crop of rad-hard parts. I did work as a CPU logic desiger at Amdahl. We had full parity through-checking, so an ALU intermittent logic error would raise a parity exception. Certainly IBM would have had the same, it was standard SOTA reliability logic for the era of mainframes when I was a designer.
Miiko 6y ago
> if [Soviet block] ever came up with their own CPU architecture. To the best of my knowledge, BESM-6 and Elbrus were not clones https://en.wikipedia.org/wiki/Elbrus_(computer) https://en.wikipedia.org/wiki/Elbrus_(computer)
6y ago