IBM MCGA Gate Array Reverse Engineering

IBM's MCGA (Multi-Color Graphics Array) is a low-cost video chipset introduced with the PS/2 models 25 and 30. The Epson Equity 1e uses MCGA compatible video but does not use the same chips. The IBM chipset consists of the memory controller gate array and the video formatter gate array. Some examples of these were fabricated on an internal IBM gate array process, while others used an external gate array part by Seiko. This gate array contains an implementation of the MC6845 sync generator IC, manages the video RAM interface to the ISA bus, manages the character RAM interface, and a few other miscellaneous functions including clock selection and monitor ID readback. The example I have reverse engineered is implemented using a Seiko SLA6430 gate array. It contains 4,342 basic cells (BCs) with 4 transistors each. The BCs are arranged in 167 rows and 26 columns. This is a 2um CMOS process with 2 metal layers. The reverse engineered schematic and layout can be found in the mcga72x8300flat subdirectory. The formatter gate array decodes the ISA memory and IO port addresses, manages the RAMDAC interface, and generates pixel data in both graphics and text modes. There are two images of this IC. The first, 72x8205-gl14105fs appears to be on an internal IBM gate array process. Unfortunately, during decapping, the top metal layer was removed, so the netlist could not be extracted. The second, 72x8205-sla6330j, has been reverse engineered: see the mcga72x8205flat subdirectory. It is a Seiko SLA6330 gate array. It contains 3,312 basic cells with 4 transistors each. The BCs are arranged in 144 rows and 23 columns. Based on the reverse engineering efforts, new information about MCGA has been discovered. MCGA can genlock to external HSYNC and VSYNC signals. These signals are brought out to the video connector: pin 12 (ID1) is VSYNC and pin 11 (ID0) is HSYNC. To enable this mode, write a 1 to bit 3 of register 0x12 (character generator interface and sync polarity, or display sense). In the technical reference manual for the PS/2 model 30, this bit is listed as "Reserved = 0". Presumably, this genlock mode would require an external clock PLL connected to the 25MHz or the 14MHz clock input. Register 0x10 (Mode Control) bit 3, "Compatibility", only affects 80x25 text modes. It causes the horizontal timing registers to be multiplied by 2 (and incremented by one, in the case of 0x00, horizontal total, and subtracted by one, in the case of 0x02, start horizontal sync). Register 0x10 (Mode Control) bit 2, "Clock = 1", controls which clock drives the video circuitry. In the default state, most of the video circuitry uses the 25.175MHz clock. You can set clock frequency to the 14.318MHz input by changing this bit to a 0. Register 0x10 (Mode Control) bit 6, "Reserved = 0", is not yet fully understood. Register 0x20 (Reserved) is a manufacturing test mode register. The counter speedup modes basically inject a clock signal into the upper four bits of each counter as well as the lower four bits, so the counter runs out quicker. This is an aid for the factory test in the chip tester. The extended mode register, 0x1A, has two undocumented bits: Additional manufacturing test registers are available by accessing the following locations: To access a particular manufacturing test register, load an address into register 0x19 and read or write the contents at 0x18. The write only register at address 4 implements only the following two bits: The 72x8300 image was scaled from 21808x21778 to 10904x10889. The output jpg file was set to 85% compression to save space, set to 48DPI, and imported into KiCAD at a scale factor of 0.103170. This results with a BC-to-BC spacing of "3mm" in KiCAD units. Library footprints were created for each basic cell type as they were identified and associated with schematic symbols. Pads were all placed in the center so the footprint could be rotated, since many of the BCs in the original were mirrored. The gate array uses two layers of metal, and it can be challenging to understand the connections between layers. In general, there are only a few allowable contacts: Each column has two parallel wires on metal 2 that carry VCC (on the right) and GND (on the left). Therefore, the left two transistors in each BC are NMOS and the right two transistors are PMOS. In a BC, two transistors share a single gate, and each gate has three connecting pads. Contacts can attach VCC or GND to diffusion regions on the shared channel connection between two transistors, or the isolated channel connection on one transistor, the other, or both. External signals entering or leaving a logic gate usually connect using horizontal traces that cross the entire cell on metal 1. Wiring internal to a logic gate is typically done on metal 2. Besides the vertical parallel wires on metal 2 carrying power and ground, there is another set of horizontal wires (on metal 1) that also carry power and ground. My reverse-engineered layou

IBM MCGA Gate Array Reverse Engineering

Key takeaways

More in computer-science