Jojojoppe
7b8f9fb4dd
All checks were successful
Build and deploy Hugo website / build-and-deploy (push) Successful in 9s
63 lines
5.9 KiB
Markdown
63 lines
5.9 KiB
Markdown
+++
|
||
title = "CM401 IC Reverse Engineering – Part 2"
|
||
date = 2022-11-11
|
||
tags = ["reverse engineering", "IC", "ALU", "NMOS"]
|
||
+++
|
||
|
||
# CM401 IC Reverse Engineering – Part 2
|
||
|
||
It’s time for part 2! Last time I was left with a schematic of the first region. Part of that is the PAL/PLA-like structure with some circuitry underneath it of which the schematic is shown on the right (Figure 1). After taking some looks I found out it is not that difficult to find out what exactly is happening here.
|
||
|
||
One of the first things we can see is that the big beefy output transistors (which are clearly visible in [part 1](/posts/cm401-01)) are in an open-drain configuration, pulling the output to ground when active. Before the output transistor is an inverter which input is connected to a row of the matrix. The image below (Figure 2) is one of those rows.
|
||
|
||
|
||
|
||
The row of transistors in the matrix together with the resistor on the left form a (in this case) four-input NOR gate and with the inverter behind it together form a four-input OR gate. Altogether, this select line output will be tied to ground with `A+D+E+G`. Below is a table of all the active combinations:
|
||
|
||
| Output | Active Inputs |
|
||
|--------|--------------------|
|
||
| S0 | `A+C+F+H` |
|
||
| S1 | `B+D+F+H` |
|
||
| S2 | `A+C+E+H` |
|
||
| S3 | `B+C+E+H` |
|
||
| S4 | `A+D+E+H` |
|
||
| S5 | `B+D+E+H` |
|
||
| S6 | `A+C+F+G` |
|
||
| S7 | `B+C+F+G` |
|
||
| S8 | `A+D+F+G` |
|
||
| S9 | `B+D+F+G` |
|
||
| S10 | `A+C+E+G` |
|
||
| S11 | `B+C+E+G` |
|
||
| S12 | `A+D+E+G` |
|
||
|
||
|
||
|
||
|
||
|
||
After that I took a look at the ‘column drivers’ at the bottom of the matrix (of which the schematic is shown to the left, Figure 3). When redrawing the part a little bit it becomes clear that the two top transistors form an SR-latch with the set and reset inputs at the bottom. Since the side with the one transistor is connected to the A1 signal and shares it with all other column latches, we can assume this is the reset input, making the other side the set input and the outputs as shown on the top. On the set side the two transistors form an AND gate (well, technically a NAND gate but in this case functions as AND), making the second shared signal A0 a kind of enable signal, with the bottom transistor being the input from another stage.
|
||
|
||
Altogether, it is clear that the matrix activates the select line outputs for different states of the four latches at the bottom. Now it being an OR matrix may sound strange since one could expect outputs to be active for specific combinations and not any form of a combination, but here come the logic rules: `(!A)(!B) = !(A+B)`, so when calling the Q and !Q outputs !Q and Q respectively and assuming the open-drain output is externally inverted, one gets a big matrix that has active outputs for specific combinations of latch states (which sounds more usable and reasonable).
|
||
|
||
##### A new section
|
||
|
||
|
||
|
||
|
||
|
||
Just below the completed section, right under the power strips, there are 4 long sections which serve as input to the set lines of the latches described above. One of those sections looks like Figure 4 (with the extracted masks shown in Figure 5). Extracting the schematic resulted in the monstrosity shown in the right picture (Figure 5) — and yeah, everything is tilted on its side, I wanted to roughly keep the layout of the silicon intact.
|
||
|
||
On the silicon, two round/circular tracks with two transistors can be found which I suspected to be SR latches again — and looking at the schematics, I was right. I will expand them both in their own schematics as done before.
|
||
|
||
|
||
|
||
|
||
The top half of the section contains a latch with set and reset sections which are enabled with a global signal (A10), and a section which sets and resets the latch according to a ‘data line’: when the data line is inactive and the enable signal is active (A11), the latch is reset (and the same for setting the latch). The D signal comes from the circuitry under this section. The set and reset lines come from the right and are shared between multiple sections which look like the one shown.
|
||
|
||
The output of this latch is fed into the set and reset lines (`pQ` and `p!Q`, respectively, in Figure 7) of another latch which is shown on the right. The inverted output of this latch is routed to the top part and is used as the set signal in the circuitry explained in the first section. Again, this latch has a global enable signal (A12), and there is some output circuitry: a NOR gate with the Q output and A13 (a signal shared with all four blocks), whose output again is fed into another NOR gate with A14. Following the output of this gate, it is used as one of the columns in another PAL/PLA section right below.
|
||
|
||
Altogether, we end up with four sets of 3 latches with some set and reset circuitry and a big OR matrix for the select line outputs. How this all plays together with the rest of the IC I do not know yet, so we shall see! These two parts finish the left top quadrant of the IC and roughly a fifth/sixth of the total area of the IC. Still a long way to go, but we are one step closer to the end!
|
||
|
||
|
||
|
||
*Note: the schematics of this region can be found on my [GitHub](https://github.com/Jojojoppe/CM401_reveng)*
|