Hacker News Reader

Comment by phendrenad2 | Hacker News Reader

It's my understanding that photos of a semiconductor die (pre-CMOS) aren't 100% useful, since often the sizes of transistors relative to one another becomes an important detail, which is hard to extrapolate to standard logic gates. It's my understanding that the Motorola 68000 still has some outstanding emulation problems (related to the instruction cache), due to using HMOS logic. NMOS chips like the 8080 are also affected by this.

View on HN

Transistor sizes are easy to extract from photos. What's hard is doping levels, which can make a transistor enhancement or depletion. The type is usually obvious from context. However, the Z-80 designers famously used the "wrong" doping for a few transistors. The purpose of this was to create traps for companies copying the IC from the die, since a straightforward copy would yield a few gates that didn't work right.

I've found a few of these traps in the Z-80, and they were placed very maliciously. The circuit appears reasonable and correct, but fails in subtle ways.

Have you blogged about it?

I haven't blogged about the Z-80 traps. I was waiting until Sergei wrote about the transistors, but then didn't get around to it.

https://www.cl.cam.ac.uk/~sps32/Z80proj/Z80_traps.pdf has very high quality imaging of the doping levels, by Sergei Skorobogatov.

https://retrocomputing.stackexchange.com/questions/11143/in-... references "Zilog oral history" and poses the question, but there isn't a strong answer other than the link to the above.

The oral history document referenced is: http://archive.computerhistory.org/resources/access/text/201... . The discussion of traps begins on page 101.

> It's my understanding that the Motorola 68000 still has some outstanding emulation problems (related to the instruction cache), due to using HMOS logic.

This doesn't sound right to me. For one thing, the idea that you need to simulate analog effects in order to properly emulate an instruction cache sort of flies in the face of my (admittedly amateur) understanding of reasonable chip design. For another, that'd imply that the CMOS versions of the 68K function differently than the HMOS ones, and I can't find any indication of that. Finally, as far as I know the 68000 doesn't have an instruction cache!

I also don’t think the 68000 had an instruction cache. The 68010 added a “loop mode” which was effectively a 2-entry instruction cache.

There were no any problems to recognize n-MOS logic during the reverse - everything was quite obvious regardless the transistor sizes. And I just dropped the sizes in my schematics, it simplified the process a lot.

Although not based on die photos AFAIK, there is a cycle accurate SystemVerilog core. https://github.com/ijor/fx68k

Reply on news.ycombinator.com