DMG-CPU Research

Die-level reverse engineering

DMG-CPU Research

The DMG-CPU is the system-on-a-chip of the original Nintendo Game Boy. This project rebuilds it from silicon: modules are traced from die photographs with the Deroute utility into netlists and die-perfect Verilog — and the real netlists are exercised by Icarus regression suites for the SM83 core, PPU, APU and the small clock/arbiter/MMIO/serial domain.

Explore the SoC SoC overview Testbenches
  • die-perfect Verilog netlist
  • Icarus regression suites on the real netlist
  • open research, sources in the repo
Photograph of the Nintendo DMG-CPU die
DMG-CPU A — photo by Christian Bassow (Wikimedia Commons)

§1 The SoC

functional blocks of the LR35902 system-on-a-chip
1.01

SoC overview

Block diagram, architecture notes and the full internal bus list of the chip.

 1.02

Bonding pads & I/O terminals

Pinout and pad circuits of the DMG-CPU.

 1.03

Cells library

The standard cells the SoC is built from.

 1.04

Clock generator

The bushy clock tree that drives the whole chip.

 1.05

Serial link

Serial I/O (link port) circuitry.

 1.06

Bus arbiter

Arbitration between internal and external buses.

 1.07

MMIO & interrupts

Divider, timer, DMA and the interrupt controller (IF).

 1.08

HRAM

The internal high RAM macro.

 1.09

Boot ROM

The mask-ROM holding the bootstrap program.

 1.10

OAM

The object-attribute memory macro.

 1.11

PPU

Picture processing unit index; PPU1 + PPU2 split and links.

 1.12

PPU1 — BG/WIN

Background & window pipeline, H/V counters, LCD interface.

 1.13

PPU2 — sprites

Object / OAM side of the pipeline.

 1.14

APU — sound

Four-channel sound generator (chips-era synthesis).

 1.15

Wave RAM

The channel-3 sample RAM macro.

 1.16

Sound DAC

The audio output digital-to-analogue stage.

 1.17

Schematics

Module circuits compared against @msinger's dmg-schematics.

 1.18

@msinger's map

Cell-by-cell rows of the Rev B die map.

§2 SM83 core

the Game Boy CPU: topology, buses, ALU, decoders, sequencer
2.01

Core overview

Component map of the core; where every block sits on the die.

 2.02

Topology

Metal/poly/diffusion layers and how the core is organised.

 2.03

Buses

Internal data movement: rbus, wbus, idu, hl bus.

 2.04

Rails & precharge

Power rails and the old-school bus-precharge trick.

 2.05

Clocks

The clock set the core consumes.

 2.06

Ports

Core I/O against the rest of the SoC.

 2.07

Register file

Registers, SP, PC and the incrementer/decrementer.

 2.08

ALU & flags

The arithmetic/logic unit and the Z/N/H/C flag block.

 2.09

Data mux

Bus multiplexing and the datalatch.

 2.10

IDU

The instruction decoder units.

 2.11

Sequencer

The M/T-cycle state machine that drives everything.

 2.12

Decoder 1

First-level instruction decoder output table.

 2.13

Decoder 2

Second-level decoder output table.

 2.14

Decoder 3

Third-level decoder: the w/x signal law.

 2.15

The Thingy

The small but important circuit next to the decoder.

 2.16

Interrupts

IRQ control logic of the core.

 2.17

Investigations

Historical debug notes from bringing up the SM83 HDL.

 2.18

SM83 reference

Opcode tables and external references.

§3 Verilog & regression suites

die-perfect HDL driven by Icarus testbenches
3.01

SM83 core HDL

All core modules as Verilog.

 3.02

Icarus suites & tooling

Regression suites and the GTKWave-based workflow.

 3.03

SM83 suite

Icarus regression on the real SM83 netlist (issue #400).

 3.04

SM83 suite — waves

Waveform documentation of every suite test.

 3.05

SM83 suite — status

Per-test status and measured timing facts.

 3.06

Small-domain suite

ClkGen / Arb / MMIO / Ser testbench (issue #396).

 3.07

Small-domain — waves

Waveform documentation: mmio, ser, hram, arb, clkgen, div.

 3.08

PPU suite

PPU1/PPU2 testbench (issue #390).

 3.09

PPU suite — waves

Waveform documentation: regs, frame, scroll, window, sprites.

 3.10

APU suite

APU testbench (issue #398).

 3.11

APU suite — waves

Waveform documentation: channels 1–4, mix, regs.

 3.12

GTKWave skill

How the waves are rendered (vcd2png + .gtkw).

§4 References & process

how the research is done and where the data lives
4.01

Reference PCB

DMG-CPU-06 board reconstruction used for verification.

 4.02

Research methods

ACID-FREE chip opening and imaging workflow.

 4.03

Datasets

Public die photographs per chip revision.

 4.04

Netlists

Recovered netlists and the Deroute workflow.

 4.05

SM83 netlist

Core netlist sources.

 4.06

SoC netlist

Rest-of-chip netlist sources.

 4.07

Logisim models

Interactive models of the most intricate circuits.

 4.08

Layer imagery

SM83 core topography pictures: metal, poly, diffusion, vias.

 4.09

BANK register

The $FF50 BANK register circuit.