Reverse Engineering IBM's MCGA Gate Arrays: Uncovering Hidden Features

As fellow developers, we often marvel at the ingenuity of vintage hardware, and the desire to truly understand its inner workings can lead us down fascinating paths. This project delves into the reverse engineering of IBM’s Multi-Color Graphics Array (MCGA) gate arrays, a low-cost video chipset introduced with the PS/2 models 25 and 30. While some systems, like the Epson Equity 1e, offered MCGA-compatible video, they didn't utilize IBM's original silicon, highlighting the uniqueness of these specific chips. This effort has brought to light several previously undocumented functionalities, offering valuable insights for emulation, hardware preservation, and historical understanding.

The IBM MCGA Chipset: A Brief Overview

The IBM MCGA chipset comprises two primary gate arrays: the Memory Controller Gate Array (72X8300) and the Video Formatter Gate Array (72X8205). These chips were produced using both an internal IBM gate array process and an external Seiko gate array part, indicating IBM's strategy for manufacturing flexibility.

The 72X8300 Memory Controller is responsible for critical functions such as implementing the MC6845 sync generator, managing video RAM interactions with the ISA bus, handling character RAM, and various other tasks including clock selection and monitor ID readback. The particular chip reverse-engineered for this project was a Seiko SLA6430 gate array, boasting 4,342 basic cells, each containing four transistors, arranged in a 167x26 grid using a 2µm CMOS process with two metal layers.

Complementing this, the 72X8205 Video Formatter handles ISA memory and I/O port address decoding, manages the RAMDAC interface, and is crucial for generating pixel data in both graphics and text modes. While an initial attempt on an IBM-processed 72x8205 (72x8205-gl14105fs) was hampered by the loss of the top metal layer during decapping, a Seiko SLA6330 version (72x8205-sla6330j) was successfully analyzed. This chip contains 3,312 basic cells, also with four transistors each, organized into 144 rows and 23 columns.

Deep Dive: Uncovering Undocumented Features

Through meticulous reverse engineering, a wealth of new information about the MCGA's capabilities has emerged.

Memory Controller (72X8300) Insights

Perhaps one of the most intriguing discoveries for the 72X8300 is its genlock capability. The MCGA can synchronize with external HSYNC and VSYNC signals, accessible via video connector pins 11 (ID0) for HSYNC and 12 (ID1) for VSYNC. This mode can be enabled by writing a '1' to bit 3 of register 0x12, a bit previously documented as "Reserved = 0" in the PS/2 Model 30 technical reference manual. This suggests a potential for external clock PLL integration, allowing the MCGA to lock its output to an external video source.

Further analysis of Register 0x10 (Mode Control) revealed additional nuances:

• Bit 3 ("Compatibility"): This bit specifically affects 80x25 text modes, causing horizontal timing registers (like 0x00 and 0x02) to be effectively multiplied by two, with minor adjustments.
• Bit 2 ("Clock = 1"): This controls the clock source for most video circuitry, allowing a switch from the default 25.175MHz clock to the 14.318MHz input by setting this bit to '0'.
• Bit 6 ("Reserved = 0"): Its precise function remains to be fully understood.

Register 0x20, labeled "Reserved," was identified as a manufacturing test mode register. It includes several "speedup modes" for internal counters (horizontal, vertical, cursor position, vertical total adjust), which inject additional clock signals to accelerate counter operation, primarily aiding in factory testing.

Video Formatter (72X8205) Discoveries

The extended mode register (0x1A) on the 72X8205 also harbored two undocumented bits:

• Bit 1: Its exact function is still unknown, but it may have forced 256-color mode regardless of other resolution settings.
• Bit 0: Also unknown, it might have forced the border color across the entire display.

Additional manufacturing test registers were found, accessed by writing an address to register 0x19 and then reading/writing data at 0x18. Notable among these:

• Address 1 (Read-only): Provides the latest data sent to the RAMDAC (P[7:0] pins).
• Address 2 (Read-only): Reveals the latest data received from VRAM (CP[7:0] pins).
• Address 4 (Write-only): Contains bits for a manufacturing hard reset (bit 0) and disabling numerous outputs, including those to the RAMDAC (bit 1).

The Reverse Engineering Methodology

The process for extracting these insights involved a detailed, multi-step approach. Die images of the chips, such as the 21808x21778 pixel image of the 72x8300, were scaled and imported into KiCAD. A key challenge was creating library footprints for each basic cell type, mapping them to schematic symbols, and accounting for mirroring. The gate arrays' two-layer metal interconnects, along with polysilicon and diffusion contacts, required careful tracing. Power and ground lines on both metal 1 and metal 2 layers were identified. Traces were drawn in KiCAD from footprint pads, following the underlying metal layers, assigned net names, and then back-propagated to reconstruct the schematic. This systematic approach allowed for the reconstruction of the complex logic within these gate arrays.

Practical Implications and Future Work

The newly documented registers and capabilities have significant implications for developers working on MCGA emulation, restoration projects, or those with an interest in vintage IBM hardware. Understanding features like genlock and the various clock control options could unlock new possibilities for integrating MCGA-based systems with modern video setups or creating more accurate emulators. The manufacturing test registers, while not for typical user interaction, offer a deeper look into the chip's internal state and testing procedures, which can be invaluable for hardware diagnostics.

The project plans to generate Verilog from the KiCAD netlist, which would further enable simulation and potentially even FPGA-based re-implementations of these historic chips. This ongoing effort continues to shed light on the sophisticated engineering behind early PC graphics.

FAQ

Q: What is the primary significance of the genlock discovery for the 72X8300?

A: The discovery of genlock capability means the MCGA can synchronize its video output with external HSYNC and VSYNC signals provided via its video connector. This feature, previously undocumented, opens possibilities for integrating MCGA-based systems with other video equipment or for more advanced video capture scenarios, potentially requiring an external clock Phase-Locked Loop (PLL).

Q: How do the manufacturing test registers aid in understanding the MCGA chips?

A: The manufacturing test registers, such as those found in 72X8300 (Register 0x20) and 72X8205 (Registers 0x19/0x18), provide insights into the internal testing and diagnostic capabilities of the chips. They allow direct access to internal counters or immediate readouts of data paths (like RAMDAC or VRAM data), which is invaluable for debugging, verifying functionality, and understanding the chip's internal state during factory quality control.

Q: What were the main challenges in reverse engineering the gate array given its structure?

A: Key challenges included accurately identifying and mapping basic cells due to mirroring, understanding the complex interconnections across two metal layers, polysilicon, and diffusion regions, and differentiating signal lines from dedicated power and ground traces. The process involved meticulous manual tracing and reconstruction within KiCAD, requiring careful attention to detail for each individual transistor and gate.