Hacker News new | past | comments | ask | show | jobs | submit login
i8080 precise replica in Verilog, based on reverse engineering of real die (github.com/1801bm1)
112 points by kens 82 days ago | hide | past | favorite | 29 comments

I love that this is a replica of the Soviet replica of the 8080. So a replica of a replica.

Do you have any idea how the Soviet replicas were built?


There's some pretty famous "signs" that companies would put into their chips to show that it was blatently stolen. Also at some point it became a game:


What's fascinating is that you can basically run a country with little to no "actual" development of computer hardware, and just have an entire industry around "copying" to keep yourself up to date (or a few years behind at most).

This is pretty evident with China of the past few years in military tech, and now they are starting to leap frog (See engine issues with their new fighter, and how they are almost there but not quite. Russia is unwilling to sell them newer engines for fear of copying essentially)

Your comment got me interested and i compared die photos of both chips.

Intel 8080A die photo: https://vintageteardown.com/wp-content/uploads/2018/04/Intel...

580BM80A die photo: https://raw.githubusercontent.com/1801BM1/vm80a/master/img/v...

I am not an expert in CPU design, so please correct me if i am wrong, but chips look rather different (at least Intel logo was removed on the 580BM80A die). Could it be that 580BM80A implements Intel's ISA, but actual CPU architecture is of their own? And could we call it a "copy"/"replica" if so? Like could we say that AMD CPUs are replicas of Intel CPUs, because they implement the same ISA?

Those two chips are a lot more different than I'd expect. (Even taking into account the 90 degree rotation.) In particular, the ALU (upper-left in Intel photo) is fairly regular, while the ALU in the Russian photo (lower-left) looks like random logic. And the PLAs and instruction register seem entirely different between the two.

I was skeptical at first, but I think it's possible that the Russian chip is a different implementation, and not just the same circuitry with the layout re-done for their process. It would require a closer look at the circuitry to determine for sure.

For the first link, removing https will avoid the expired certificate warning: http://vintageteardown.com/wp-content/uploads/2018/04/Intel8...

Most likely the same way how enthusiasts are reverse-engineering those 8-bit CPUs today: decapping and tracing the transistors under a microscope.

For the East German Z80 clone U880 there are some wild stories of how the secret service stole blueprints from Zilog, but the more believable version of the story is that some chips were smuggled over the border that had simply been bought in West German electronics stores. The East German Z80 version had definitely been reverse engineered - not simply cloned - because the U880 has a slightly different undocumented behaviour (for instance, the undocumented X and Y flags behave differently than on a real Z80), also apparently the Z80 has various 'trap transistors' which prevent that the mask can simply be cloned, those trap transistors had to be found and fixed (I guess this was the reason why the U880 project was delayed by a year or so).

The much bigger problem than reverse engineering the chips was setting up manufacturing anyway. For East Germany this definitely happened with secret service support. The story goes that a small chip manufacturing company was set up in West Germany, which soon after declared bancrupty with the entire manufacturing equipment sold off to another company somewhere abroad. "Somehow" that equipment disappeared en route and showed up in East Germany a few months later.

There was also a Polish clone, Afair developed as a PHD thesis by two students. Manufactured between 1982-1993. http://retrokolekcja.pl/MCY7880.php

For comparison original 8080A: http://retrokolekcja.pl/zdjecia/MCY7880%20struktura%20ITE.jp...

Polish MCY7880: http://retrokolekcja.pl/zdjecia/MCY7880%20struktura%20ITE.jp...

Russian KR580BM80: http://retrokolekcja.pl/zdjecia/MCY7880_zsrr.jpg

And the absolutely amazing gem. In 1983 legendary science education TV program SONDA documented design and manufacturing of first batches in a humorous lets bake a cake fashion. Paper plotters, light pens, developing/rinsing dies by hand, electron miscroscope debugging, the whole nine yards!

part 1 https://www.youtube.com/watch?v=AJGp7keIA_o

part 2 https://www.youtube.com/watch?v=KHl6m93Hay0

part 3 https://www.youtube.com/watch?v=rcOTwkT-PDU

Its amazing anything worked considering really spartan conditions.

It's my understanding that photos of a semiconductor die (pre-CMOS) aren't 100% useful, since often the sizes of transistors relative to one another becomes an important detail, which is hard to extrapolate to standard logic gates. It's my understanding that the Motorola 68000 still has some outstanding emulation problems (related to the instruction cache), due to using HMOS logic. NMOS chips like the 8080 are also affected by this.

Transistor sizes are easy to extract from photos. What's hard is doping levels, which can make a transistor enhancement or depletion. The type is usually obvious from context. However, the Z-80 designers famously used the "wrong" doping for a few transistors. The purpose of this was to create traps for companies copying the IC from the die, since a straightforward copy would yield a few gates that didn't work right.

I've found a few of these traps in the Z-80, and they were placed very maliciously. The circuit appears reasonable and correct, but fails in subtle ways.

https://www.cl.cam.ac.uk/~sps32/Z80proj/Z80_traps.pdf has very high quality imaging of the doping levels, by Sergei Skorobogatov.

https://retrocomputing.stackexchange.com/questions/11143/in-... references "Zilog oral history" and poses the question, but there isn't a strong answer other than the link to the above.

The oral history document referenced is: http://archive.computerhistory.org/resources/access/text/201... . The discussion of traps begins on page 101.

Have you blogged about it?

I haven't blogged about the Z-80 traps. I was waiting until Sergei wrote about the transistors, but then didn't get around to it.

> It's my understanding that the Motorola 68000 still has some outstanding emulation problems (related to the instruction cache), due to using HMOS logic.

This doesn't sound right to me. For one thing, the idea that you need to simulate analog effects in order to properly emulate an instruction cache sort of flies in the face of my (admittedly amateur) understanding of reasonable chip design. For another, that'd imply that the CMOS versions of the 68K function differently than the HMOS ones, and I can't find any indication of that. Finally, as far as I know the 68000 doesn't have an instruction cache!

I also don’t think the 68000 had an instruction cache. The 68010 added a “loop mode” which was effectively a 2-entry instruction cache.

There were no any problems to recognize n-MOS logic during the reverse - everything was quite obvious regardless the transistor sizes. And I just dropped the sizes in my schematics, it simplified the process a lot.

Although not based on die photos AFAIK, there is a cycle accurate SystemVerilog core. https://github.com/ijor/fx68k

As a person not fluent in processor design, chip design, FPGAs or Verilog, is there some demonstration of actual software running on this implementation? Or is that one or more steps away after synthesising and loading the bitstream in to the FPGA?

There are simple demonstrations in the repo, and he's run it on actual FPGA boards.

But beyond that, the core has already been ported to MiSTer, which would be much more enjoyable to use: https://github.com/MiSTer-devel/Altair8800_Mister

(MiSTer is an open-source FPGA-based retro emulator)


In the tst directory they have .asm files, which they load in the program memory to test the CPU. The abstract mentions that they run it in FPGA, but it wouldn't be difficult to run those tests in simulation too (albeit exceedingly slow).

I've always wondered if a Soviet block made a clone that was better in some way, or if they ever came up with their own CPU architecture.

Didn't IBM have an ALU design that were more harden again calculation errors?

One that shows up on HN occasionally is Setun: https://en.wikipedia.org/wiki/Setun

Setun used balanced ternary logic instead of binary logic. Each trit could be -1, 0, or +1. For numeric values, there was no need to store a sign, since the sign of a number would be inherent in its ternary value.

Then the Soviets decided that it would be easier and faster to just copy western computers, and the concept wasn't developed any further.

I know there has been recent activity in developing a ternary CPU. https://hackaday.com/2016/12/16/building-the-first-ternary-m...

> if [Soviet block] ever came up with their own CPU architecture.

To the best of my knowledge, BESM-6 and Elbrus were not clones


USSR made an incompatible "clone" of Apple-II, called AGAT with better graphics. Also 8086 clone VM86 AFAIK was significantly reingennered. Some PDP-11 clones were also designed from the scratch.

> Didn't IBM have an ALU design that were more harden again calculation errors?

I'm genuinely confused what is meant by this in practice. Like some sort of redundant ALU architecture or rad hard encapsulation?

‘kens has an article about IBM qui-binary arithmetic: http://www.righto.com/2015/10/qui-binary-arithmetic-how-1960...

this might be what is referenced?

That's what I was thinking about!

It could mean either. Rad-hard parts are used in satellites. I am not familiar with the current crop of rad-hard parts.

I did work as a CPU logic desiger at Amdahl. We had full parity through-checking, so an ALU intermittent logic error would raise a parity exception. Certainly IBM would have had the same, it was standard SOTA reliability logic for the era of mainframes when I was a designer.

Guidelines | FAQ | Support | API | Security | Lists | Bookmarklet | Legal | Apply to YC | Contact