cpu11

cpu11 copied to clipboard

Abstract

This CPU11 repository contains the results of historical PDP-11 microprocessors reverse engineering.

Typically the results include:

• high-resolution photos of decapsulated crystals, both for top metal and diffusion layers
• restored crystal topology in Sprint Layout 6.0 format, can be easily exported to Gerber
• restored topology in PCAD format
• restored gate-level schematics in PCAD and pdf formats
• original asynchronous Verilog-HDL model of processor
• refactored original Verilog-HDL model to synchronous one to run on real FPGA

There are a few words regarding the reverse engineering process stages:

• sample decapsulating, milling die from the plastic package with CNC, then etching with 104 percents boiling oleum
• serialized photographing of die with a motorized metallurgical microscope, hundreds of shots
• shot stitching, getting the resulting high-resolution panoramic shot
• removing the top metal layer with a polishing
• getting the high-resolution panoramic shot of the diffusion layer
• manual images vectorization - traces, vias, pads, etc.
• gate recognition
• transferring vectorized images to PCB CAD system
• schematic restoration using PCB CAD back annotation
• manual schematic refactoring into human-readable form
• writing the original asynchronous Verilog HDL model, with all original schematics specifics
• simulating and debug the original Verilog HDL model, running PDP-11 factory test software on the model
• Verilog HDL model refactoring to get synchronous model, running on real FPGA
• transforming processor-specific bus to standard Wishbone master interface to integrate into SoC

Processors

• 1801BM1 - USSR microprocessor, no DEC prototype, proprietary die design
• 1801BM2 - USSR microprocessor, no DEC prototype, proprietary die design
• 1801BM3 - USSR microprocessor, no DEC prototype, proprietary die design
• LSI-11 - Soviet 581-series, DEC LSI-11 clone, Western Digital MCP-1600 chipset
• F-11 - Soviet 1811-series, DEC F-11 clone, DEC DC302/DC303/DC304 "Fonz" chipset
• M4 - Soviet replica of military LSI-11M, AMD Am2900 bit-slices

PI-test performance

The 1000 signs of Pi calculation test is based on spigot algorithm. The digits are the times in 50Hz ticks. All models were Wishbone-compatible and run on the DE0 board with the same system configurations, software was placed into static memory with zero wait states. LSI-11 was running at 80MHz and results are multiplied by 0.8 to match with other ones. M4 was running at 50MHz and results are multiplied by 0.5. There are three variants of the test with various combinations of supported EIS instructions.

Notes: "cpm" means core clocks per microinstruction, how many clocks model takes to execute single microcode instruction. For LSI-11 the four phases c1-c4 were refactored to the single core clock, for F-11 four phases were refactored to two core clocks. In addition the 1801ВМ2 performs the instruction prefetch gaining some boost.

Supported FPGA development boards

The synchronous models are planned to be run (and appropriate sample projects to be included in repo) on the following Development Kits:

• Altera DE0 - Altera Cyclone-III
• Altera DE1 - Altera Cyclone-II
• Altera DE2-115 - Altera Cyclone-IV
• Altera DE10-lite - Altera Max-10
• Alinx AX309 - Xilinx Spartan-6
• QMTech QC5-core - Altera Cyclone-V
• QMTech QC10-core - Altera Cyclone-10LP
• QMTech QA7-core - Xilinx Artix-7
• Lichee Tang Primer - Anlogic Eagle EG4S20