Discussion
Loading...

Post

  • About
  • Code of conduct
  • Privacy
  • Users
  • Instances
  • About Bonfire
DJ馃尀:donor:
@infosecdj@infosec.exchange  路  activity timestamp 3 weeks ago

Happy #nakeddiefriday to everyone! Let's get this ball rolling.

Today we have a real classic, the MC6845 by Motorola. This is a CRT controller chip used in quite a few video adapters back in the day.

Thanks to @gloriouscow for suggesting this one! We'll do a short thread looking around.

SiPron page: https://siliconprawn.org/archive/doku.php?id=infosecdj:motorola:mc6845p-jr5

#electronics #retrocomputing #reverseengineering #icre

Die overview shot
Die overview shot
Die overview shot
  • Copy link
  • Flag this post
  • Block
DJ馃尀:donor:
@infosecdj@infosec.exchange replied  路  activity timestamp 3 weeks ago

This is mask revision JR5, as displayed on both the package and the die itself. There was a mask ID on every Motorola die I saw. I believe there is at least one more mask revision, decapping of which failed. 馃槄 And I didn't keep the photo, of course. Later ones are 0JR5 and 2JR5, and 1R1H. I should get some to decap and compare...

To the right is a small isolated structure for metrology purposes. It does nothing in the electrical sense.

A snippet showing the die ID.
A snippet showing the die ID.
A snippet showing the die ID.
  • Copy link
  • Flag this comment
  • Block
DJ馃尀:donor:
@infosecdj@infosec.exchange replied  路  activity timestamp 3 weeks ago

For something perceived to be so complex, there is surprisingly not that much going on on the die. The process is large, and the gates are very visible despite this only being imaged at ~200x total. That said, the gate count is not small either; building this from the 74 series would take several boards for sure.

  • Copy link
  • Flag this comment
  • Block
DJ馃尀:donor:
@infosecdj@infosec.exchange replied  路  activity timestamp 3 weeks ago

And here you can see how NMOS and PLA is a match made in heaven. Given the humongous process size, a lot of logic could be compacted into this little array. Only one pull-up per each product (here vertical). Terms coming in from the right, and the complement is generated right there. You can see how this was a copy+paste design by extra poly on the topmost inverter there. 馃槈

PLA close-up.
PLA close-up.
PLA close-up.
  • Copy link
  • Flag this comment
  • Block
DJ馃尀:donor:
@infosecdj@infosec.exchange replied  路  activity timestamp 3 weeks ago

Funnily enough, each product then gets wired into this huge mess of discrete gates, to be inverted and/or NOR'd with others. One would expect the same matrix approach to be used as with products, but no.

This is how product sums are generated...
This is how product sums are generated...
This is how product sums are generated...
  • Copy link
  • Flag this comment
  • Block
DJ馃尀:donor:
@infosecdj@infosec.exchange replied  路  activity timestamp 3 weeks ago

It seems the design team struggled a lot to get this design to work properly.

Here is one part of the input circuitry, specifically pins 21-23 on the bottom of the snippet. pin 21 is routed to a 3-input NOR gate with all input pins connected together, then to a 2-input NOR gate, and only after that it is allowed to proceed elsewhere.

Pin 22 follows a different but no less fun path, going through 4 (four) inverters with what looks like small impromptu capacitors.

You could say signal conditioning, but this looks more like delay tweaking to me.

Pins 21-23 up close and personal.
Pins 21-23 up close and personal.
Pins 21-23 up close and personal.
  • Copy link
  • Flag this comment
  • Block
Log in

bonfire.cafe

A space for Bonfire maintainers and contributors to communicate

bonfire.cafe: About 路 Code of conduct 路 Privacy 路 Users 路 Instances
Bonfire social 路 1.0.0-rc.3.21 no JS en
Automatic federation enabled
  • Explore
  • About
  • Members
  • Code of Conduct
Home
Login