Topic: The things, you should know before diggin in.
So far we have two data sets :
1. Top metall made at 20x. Complete stitching is impossible by some reasons (mainly due to modern PC memory limitations).
You can download spilt images here : http://psxdev.ru/download
(Dont click at pictures - just Save object as...)
(raw slides are also available by request)
2. Bottom layer (poly/active) made at 40x. Its very dirty in some places. Besides custom blocks (memory buffer) cannot be handled (totally garbled). Although design of standard cells can be analyzed easily.
Image set as raw slides is placed on Google drive : https://plus.google.com/117266572649711 … yYdXZFXqvW
We even dont try to stitch it LOL ) Instead we manually constrcut "rows" of standard cells. Latest progress can be found here : http://psxdev.ru/download/download_cells
Cells distribution is following :
Top metal images and bottom layer are unaligned, because was made at different objectives (20x/40x). And its not just zoomed twice. Bottom layer is slighty stretched on vertical resolution if you try to resize it half and align with top metal.
We are still missing bottom metal layer (M1), but its possible to spot it in some places and know how standard cell is working.
Known standard cells are collected in our wiki : http://wiki.psxdev.ru/index.php/CPU_CELLS (use Google translate)
PSX CPU IC is semi custom bi-metal CMOS. That mean it was made as Verilog (or like) and generated into the netlist.
"reg buffers" are made as custom blocks (can be seen as huge things at the borders of chip surface).
It can be assumed that these buffers are really just "huge cells" that just took not from the library, but generated depending on the size of the buffer.
Netlist routing is crazy nightmare. Routes can go absolutely randomly by router tool dice roll.
http://wiki.psxdev.ru/index.php/CPU_FUNNY_ROUTING
CPU hacking is done in following steps :
1. Choose an area you want to hack from top metal slides
2. Align standard cells on top of it (practically you should extract individual cells from "rows" and align it manually with top layer)
3. Identify known cells. Try to spot M1 and find out unknown ones. Reverse engineer unknown cells and add to wiki.
4. Trace M1/M2 between cells. First try to find out "CLK-like" wires, usually connecting T-input of D-triggers.
5. Continue until you reach nirvana.
How I can find CPU components, like GTE, MDEC and so?
We still don't know, but it seems they uniformly distributed on available chip surface. So there is no certain area, which may be identified as "yes, this is the Root counter".