No-AI and solid end-to-end encryption is the new tech hype.

If you don't invest heavily in solid end-to-end encryption, privacy-protective and No-AI features, you will be left behind. People might even laugh at you.

Tell everyone.

#NoAI #Encryption #RootForE2EE #Privacy #Tech

There’s an entire rant buried in here but, in short, I absolutely agree.

With that said, welcome to another installment of #nakeddiefriday. What I have for you today is one p/n TMP47C420AF by Toshiba. This is a "high-speed and high-performance 4-bit single chip microcomputer" which is part of the TLCS-47 series and has an LCD controller circuit, together with 4Kx8 mask ROM and 256x4 RAM.

https://siliconpr0n.org/archive/doku.php?id=infosecdj:toshiba:tmp47c420af

Let's explore! 🧵

#electronics #reverseengineering #icre

@apzpins exactly.

@f4grx Unfortunately, in the looks only. It is way different if you zoom in enough.

With that, I think I will bring the thread to a close. Thanks for joining me on this #nakeddiefriday today! More to come in the future. Sorry it has been a bit sporadic the last two months, life happens.

If you'd like to support my work, I am always happy to receive donations in the form of chips! And I also do have a patreon page should you prefer that instead: https://patreon.com/NakedSilicon

Cheers! /thread end :-)

Oh. The G458 is likely the mask set ID; each Toshiba die has a 4-character one.

Probably finally, there's this circuit nugget. Note how it is not connected to anything else. This is likely a test circuit, used during production to control circuit parameters. At a quick glance, this looks like a bunch of inverters in a ring, so maybe ring oscillators to control the speed?

The other test pattern is your typical transistor pair.

Deciphering the control logic there is beyond me. :D So we move to the next thing.

Locating the internal bus, at least the data part of it, is super easy. Just look which common lines are tapped by the I/O ports. Here the two lines on the left are both driven and read by port bit circuitry on the right. Notably, the drive seems to be single ended, as there is only one (set of) transistors driving the line. So at least the data bus may be precharged.

The address bus should be terminated at the memories. I wonder if this design has separate or multiplexed address-data busses.

In the array itself, the left side is connected to a power rail, and the right side seems to pick the terms up. At times several lines are joined, might be the OR function in the PLA?

Interestingly, each line has two extra transistors on the right. Probably the other part of the "gate" formed by each PLA output.

Just noticed that in addition to 22 lines coming from above left, the two leftmost lines are driven from different circuits. One is right at the top right of the array, the other is at the bottom left. Looks like some enable lines maybe?

Let's have a look at that circuitry next, then. The microcode ROM is driven with 12 signals, both straight and inverse of each is provided except one. So in this regard it is more like a PLA than a ROM, I suppose. Maybe 8 instruction bits + some extra control lines? At least one line seems to come straight from a set of 8 gates on a line right below the ROM, so that might be the instruction register?

The ROM seems to be made using ion implantation, so no chance of reading it optically without spicy chemistry.

Unfortunately for us but quite logically, the same tech was chosen for the microcode ROM/PLA in the very middle of the CPU logic blob. No microcode for us today.

Ah, and the line of logic cells right at the bottom of the ROM likely handles bit line selection and bit output to the internal bus.

From the cursory look over the instruction set, one should be able to use the ROM for both instructions and data.

I believe there are two selection lines coming in from the left (on the previous snippet) and one coming from the right; here is the word line driver snippet showing that one control line. Possibly each driver unit produces one line specific for each horizontal block, running above and below the drivers, and one line common for all blocks. You can see two common lines driven here, the first and second from the left.

The ROM is the NAND type, with 8 chunks providing 8 bits of output. Here, I show how data bits are routed out: the use "wires" formed with diffusion regions, which are then get picked up by metal wiring. Bit lines (vertical) are not precharged. Each bit output is selected from 16 bit lines by a group of pass transistors, so each bit line handles 4096/16=256 bits. There are 16 smaller chunks vertically, so each chunk is 16 bits. Bit transistors are to each side of the bit line, then; there are 11 word lines so 8 for data and 3 for selection and control I think.

The density difference between ROM and RAM is striking. Here in this small snippet, the RAM only has 4 bits, whereas the ROM has about 32 bits for each vertical metal piece. Area wise, both units take approximately the same space, but the ROM is 16x the capacity.

You can see how the whole chunk is copy-paste, the metal lines end at the bottom where the copied chunk ends. They could have optimised this further by merging some metal of driver transistors, but I guess there was no need.

Of particular interest are the segment drivers of the LCD controller. They are organised as a long shift register. Here are the SEG0 and SEG1 pins. Most lines running through are common for all the segments, the only exception is a short run of metal between each pad circuitry passing the data over.

For some reason I expected them to be controlled in parallel, but this way is certainly way cheaper, if you don't need high refresh speed.

This is how I see it mapping onto the actual die. Unfortunately, there is no way to tell where the smaller blocks are without spending a lot of time reverse engineering the thing.

The internal bus is assumed to go around the die.

The datasheet gives us this overview. There is the LCD driver, a whole bunch of CPU innards like registers and the ALU, and a whole bunch of 4-bit I/O ports. There are also two 12-bit timers and a 4-bit serial interface to boot! All tied with the internal bus of unspecified width and structure.