schlae/IBM_MCGA: IBM MCGA reverse engineered chips · GitHub

IBM’s MCGA (Multi-Color Graphics Array) is a low-cost video chipset introduced with PS/2 models 25 and 30. The Epson Equity 1e uses MCGA compatible video but does not use the same chips.

The IBM chipset includes a memory controller gate array and a video formatter gate array. Some of these examples were produced on an internal IBM gate array process, while others used an external gate array part by Seiko.

This gate array contains an implementation of the MC6845 sync generator IC, manages the video RAM interface on the ISA bus, manages the character RAM interface, and performs some other miscellaneous functions including clock selection and monitor ID readback.

The example I reverse engineered is implemented using a Seiko SLA6430 gate array. It has 4,342 basic cells (BC) each containing 4 transistors. The BC is organized into 167 rows and 26 columns. It is a 2um CMOS process with 2 metal layers.

Image is from 72×8300-sla6430j

The reverse engineered schematic and layout can be found in the mcga72x8300flat subdirectory.

The formatter gate array decodes ISA memory and IO port addresses, manages the RAMDAC interface, and generates pixel data in both graphics and text modes.

There are two images of this IC. First, the 72×8205-gl14105fs appears to be on an internal IBM gate array process. Unfortunately, during decapping, the top metal layer was removed, so the netlist could not be extracted. The second, 72×8205-sla6330j, has been reverse engineered: see mcga72x8205flat subdirectory.

This is a Seiko SLA6330 gate array. It has 3,312 basic cells each containing 4 transistors. The BC is organized into 144 rows and 23 columns.

Based on reverse engineering efforts, new information about MCGA has been discovered.

• The MCGA can genelock external HSYNC and VSYNC signals. These signals are brought to the video connector: Pin 12 (ID1) is VSYNC and Pin 11 (ID0) is HSYNC. To enable this mode, write bit 1 to bit 3 of register 0x12 (character generator interface and sync polarity, or display sense). In the technical reference manual for the PS/2 Model 30, this bit is listed as “Reserved = 0”. Presumably, this genlock mode would require an external clock PLL connected to the 25 MHz or 14 MHz clock input.

• Register 0x10 (Mode Control) Bit 3, “Compatibility”, affects 80×25 text mode only. This causes the horizontal timing registers to be multiplied by 2 (and in the case of 0x00, the horizontal total is increased by one, and in the case of 0x02, decreased by one, starting horizontal sync).

• Register 0x10 (Mode Control) bit 2, “Clock=1”, controls which clock drives the video circuitry. By default, most video circuitry uses a 25.175MHz clock. You can set the clock frequency to 14.318 MHz input by changing this bit to 0.

• Register 0x10 (Mode Control) bit 6, “Reserved = 0”, is not fully understood yet.

• Register 0x20 (reserved) is a manufacturing test mode register.

Part	Celebration
7	14.318 MHz alternative clock mode (unknown)
6	VCK pin alternate mode (normally VCKIN only goes to VCK)
5	Speedup Mode: Unknown
4	Speedup mode: cursor position high counter
3	Speedup Mode: Cursor Position Low/Char Counter
2	Speedup Mode: Vertical Total Adjustment Counter
1	Speedup Mode: Vertical Counter
0	Speedup Mode: Horizontal Counter

Counter Speedup mode basically injects a clock signal into the upper four bits of each counter as well as the lower four bits, causing the counter to run out quicker. It is an aid to factory testing in chip tester.

The extended mode register, 0x1A, has two unwritten bits:

Part	Celebration
1	Unknown, may force 256 color mode even with other resolutions.
0	Unknown, can impose a border color on the entire display.

Additional manufacturing test registers are available by accessing the following locations:

• Register 0x19 – Manufacturing Register Address
• Register 0x18 – Manufacturing Register Data

To access a particular manufacturing test register, load an address into register 0x19 and read or write the contents to register 0x18.

The manufacturing test registers are:

Address	register
0	not implemented
1	read only. It contains the latest contents of the data being sent to the RAMDAC (P)[7:0] Pin).
2	read only. It contains the latest contents of the data received from VRAM (CP).[7:0] Pin).
3	read only. Contains unknown 16-color mode data from formatting logic.
4	Write register only, see below for operation.

The write-only register at address 4 implements only the following two bits:

Part	Celebration
0	Creating a hard reset equivalent to a reset pin. Write ‘1’ to put the device into reset, ‘0’ to take it out of reset.
1	Write ‘1’ to disable a large number of outputs, including those going to RAMDAC.

The 72×8300 image was scaled down from 21808×21778 to 10904×10889. The output jpg file was set to 85% compression to save space, set to 48DPI, and imported into KiCAD at a scale factor of 0.103170. This results in a BC-to-BC difference of “3 mm” in KiCAD units.

Library footprints were created for each native cell type as they were identified and associated with schematic symbols. All pads were placed in the center so that the footprint could be rotated, as many BCs were mirrored in the original.

The gate array uses two layers of metal, and understanding the connections between the layers can be challenging. In general, there are only a few acceptable contacts:

• metal 1 to metal 2
• Metal 2 to Polysilicon (Gate)
• metal 2 diffusion

Each column has two parallel wires on metal 2 that carry VCC (on the right) and GND (on the left). Therefore, the left two transistors in each BC are NMOS and the right two transistors are PMOS. In a BC, two transistors share a single gate, and each gate has three connecting pads. Contacts can attach VCC or GND to diffusion regions on a shared channel connection between two transistors, or add isolated channel connections on one transistor, the other, or both.

External signals entering or leaving a logic gate usually Connect using horizontal marks crossing the entire cell on metal 1. The internal wiring of a logic gate is usually done on metal 2.

In addition to the vertical parallel wires carrying power and ground on metal 2, there is another set of horizontal wires (on metal 1) that also carry power and ground. In my reverse-engineered layout marks are not placed on top of these lines because these are not signal lines.

The traces were given a pure name, starting from the footprint pad, following the underlying metal, and tying to all other connected pads, and then propagated back to the schematic (unlike the normal KiCAD process).

• Consider generating Verilog from KiCAD netlist