IBM MCGA 门阵列逆向工程
IBM MCGA Gate Array Reverse Engineering

原始链接: https://github.com/schlae/IBM_MCGA

本摘要涵盖了 IBM 多彩图形阵列 (MCGA) 芯片组的逆向工程,该芯片组曾应用于早期的 PS/2 机型。该芯片组包含两个主要组件:内存控制器门阵列 (72X8300) 和视频格式化门阵列 (72X8205)。 研究人员成功对这些由精工 (Seiko) 制造的门阵列进行了开盖和逆向工程。通过在 KiCAD 中映射双层 CMOS 结构,他们恢复了电路图并识别出此前未记录的功能。主要发现包括: * **视频同步 (Genlock) 功能:** MCGA 可通过视频接口与外部 HSYNC 和 VSYNC 信号同步,该功能可通过特定的寄存器设置启用。 * **未公开的寄存器:** 深入分析揭示了用于工厂测试的隐藏“加速”模式、用于 RAMDAC/VRAM 诊断的生产寄存器,以及控制时钟频率和水平定时的特定位。 * **架构:** 逆向工程过程涉及对基本单元 (BC) 的详细识别、VCC/GND 布线的映射,以及将物理布局中的信号网回推至电路图。 这些工作为 IBM 的硬件设计提供了深刻见解,记录了内部逻辑、生产测试模式以及几十年来一直鲜为人知的“保留”寄存器功能。未来的工作目标是从提取出的网表中生成 Verilog 代码。

Hacker News | 最新 | 过往 | 评论 | 提问 | 展示 | 招聘 | 提交 | 登录 IBM MCGA 门阵列逆向工程 (github.com/schlae) 5 分,由 userbinator 发布于 42 分钟前 | 隐藏 | 过往 | 收藏 | 1 条评论 | 帮助 bitwize 10 分钟前 [–] 竟然自带了同步锁(genlock)?多年来我一直以为只有 Amiga 才有这东西! 回复 准则 | 常见问题 | 列表 | API | 安全 | 法律 | 申请 YC | 联系 搜索:
相关文章

原文

IBM's MCGA (Multi-Color Graphics Array) is a low-cost video chipset introduced with the PS/2 models 25 and 30. The Epson Equity 1e uses MCGA compatible video but does not use the same chips.

The IBM chipset consists of the memory controller gate array and the video formatter gate array. Some examples of these were fabricated on an internal IBM gate array process, while others used an external gate array part by Seiko.

Memory Controller Gate Array (72X8300)

This gate array contains an implementation of the MC6845 sync generator IC, manages the video RAM interface to the ISA bus, manages the character RAM interface, and a few other miscellaneous functions including clock selection and monitor ID readback.

The example I have reverse engineered is implemented using a Seiko SLA6430 gate array. It contains 4,342 basic cells (BCs) with 4 transistors each. The BCs are arranged in 167 rows and 26 columns. This is a 2um CMOS process with 2 metal layers.

The image is from 72x8300-sla6430j

The reverse engineered schematic and layout can be found in the mcga72x8300flat subdirectory.

Video Formatter Gate Array (72X8205)

The formatter gate array decodes the ISA memory and IO port addresses, manages the RAMDAC interface, and generates pixel data in both graphics and text modes.

There are two images of this IC. The first, 72x8205-gl14105fs appears to be on an internal IBM gate array process. Unfortunately, during decapping, the top metal layer was removed, so the netlist could not be extracted. The second, 72x8205-sla6330j, has been reverse engineered: see the mcga72x8205flat subdirectory.

It is a Seiko SLA6330 gate array. It contains 3,312 basic cells with 4 transistors each. The BCs are arranged in 144 rows and 23 columns.

72x8300 (Memory Controller Gate Array) Notes

Based on the reverse engineering efforts, new information about MCGA has been discovered.

  • MCGA can genlock to external HSYNC and VSYNC signals. These signals are brought out to the video connector: pin 12 (ID1) is VSYNC and pin 11 (ID0) is HSYNC. To enable this mode, write a 1 to bit 3 of register 0x12 (character generator interface and sync polarity, or display sense). In the technical reference manual for the PS/2 model 30, this bit is listed as "Reserved = 0". Presumably, this genlock mode would require an external clock PLL connected to the 25MHz or the 14MHz clock input.

  • Register 0x10 (Mode Control) bit 3, "Compatibility", only affects 80x25 text modes. It causes the horizontal timing registers to be multiplied by 2 (and incremented by one, in the case of 0x00, horizontal total, and subtracted by one, in the case of 0x02, start horizontal sync).

  • Register 0x10 (Mode Control) bit 2, "Clock = 1", controls which clock drives the video circuitry. In the default state, most of the video circuitry uses the 25.175MHz clock. You can set clock frequency to the 14.318MHz input by changing this bit to a 0.

  • Register 0x10 (Mode Control) bit 6, "Reserved = 0", is not yet fully understood.

  • Register 0x20 (Reserved) is a manufacturing test mode register.

Bit Function
7 14.318MHz alternate clock mode (unknown)
6 VCK pin alternate mode (normally VCKIN just goes to VCK)
5 Speedup mode: unknown
4 Speedup mode: Cursor position high counter
3 Speedup mode: Cursor position low/char counter
2 Speedup mode: Vertical total adjust counter
1 Speedup mode: Vertical counter
0 Speedup mode: Horizontal counter

The counter speedup modes basically inject a clock signal into the upper four bits of each counter as well as the lower four bits, so the counter runs out quicker. This is an aid for the factory test in the chip tester.

72x8205 (Video Formatter Gate Array) Notes

The extended mode register, 0x1A, has two undocumented bits:

Bit Function
1 Unknown, may force 256 color mode even with other resolutions.
0 Unknown, may force border color onto entire display.

Additional manufacturing test registers are available by accessing the following locations:

  • Register 0x19 - Manufacturing register address
  • Register 0x18 - Manufacturing register data

To access a particular manufacturing test register, load an address into register 0x19 and read or write the contents at 0x18.

Manufacturing test registers are:

Address Register
0 Not implemented
1 Read only. Contains latest contents of data being sent to the RAMDAC (P[7:0] pins).
2 Read only. Contains latest contents of data being received from VRAM (CP[7:0] pins).
3 Read only. Contains unknown 16-color mode data from formatting logic.
4 Write only register, see below for operation.

The write only register at address 4 implements only the following two bits:

Bit Function
0 Manufacturing hard reset equivalent to the reset pin. Write a '1' to put the device in reset, write a '0' to take it out of reset.
1 Write a '1' to disable a large number of outputs, including ones going to the RAMDAC.

Reverse Engineering Process Information

The 72x8300 image was scaled from 21808x21778 to 10904x10889. The output jpg file was set to 85% compression to save space, set to 48DPI, and imported into KiCAD at a scale factor of 0.103170. This results with a BC-to-BC spacing of "3mm" in KiCAD units.

Library footprints were created for each basic cell type as they were identified and associated with schematic symbols. Pads were all placed in the center so the footprint could be rotated, since many of the BCs in the original were mirrored.

The gate array uses two layers of metal, and it can be challenging to understand the connections between layers. In general, there are only a few allowable contacts:

  • Metal 1 to metal 2
  • Metal 2 to polysilicon (gate)
  • Metal 2 to diffusion

Each column has two parallel wires on metal 2 that carry VCC (on the right) and GND (on the left). Therefore, the left two transistors in each BC are NMOS and the right two transistors are PMOS. In a BC, two transistors share a single gate, and each gate has three connecting pads. Contacts can attach VCC or GND to diffusion regions on the shared channel connection between two transistors, or the isolated channel connection on one transistor, the other, or both.

External signals entering or leaving a logic gate usually connect using horizontal traces that cross the entire cell on metal 1. Wiring internal to a logic gate is typically done on metal 2.

Besides the vertical parallel wires on metal 2 carrying power and ground, there is another set of horizontal wires (on metal 1) that also carry power and ground. My reverse-engineered layout does not have traces placed on top of these lines since they are not signal lines.

Traces were placed starting at a footprint pad, following the underlying metal, and tying to all other connected pads, given a net name, and then back-propagated to the schematic (the reverse of the usual KiCAD process).

  • Look into generating Verilog from the KiCAD netlist
联系我们 contact @ memedata.com