IBM’s Multi-Color Graphics Array (MCGA) is a low-cost video chipset used in PS/2 models 25 and 30. Recent reverse engineering of the 72X8300 and 72X8205 gate arrays reveals undocumented capabilities, including genlock support and hidden manufacturing test registers not listed in original technical manuals.
How does the MCGA chipset architecture function?
The MCGA system divides video processing between two primary gate arrays: the 72X8300 Memory Controller and the 72X8205 Video Formatter. According to technical reverse engineering documentation, the 72X8300 integrates an MC6845 sync generator and manages the video RAM interface to the ISA bus and the character RAM interface. It also handles clock selection and monitor ID readback.
The 72X8205 Video Formatter handles the remaining logic, including ISA memory and IO port address decoding. It manages the RAMDAC interface and generates pixel data for both graphics and text modes. While IBM used internal fabrication for some units, other versions utilized external gate arrays produced by Seiko.
What undocumented features were discovered in the 72X8300?
Reverse engineering of the 72X8300 reveals a genlock mode that allows the hardware to synchronize with external HSYNC and VSYNC signals. These signals are routed through the video connector via pin 11 (HSYNC) and pin 12 (VSYNC). Technical analysis shows this mode activates when a 1 is written to bit 3 of register 0x12. This feature is absent from the official PS/2 Model 30 technical reference manual, which labels the bit as “Reserved = 0.”
Other discovered register functions include:
- Register 0x10, Bit 3 (Compatibility): Affects 80×25 text modes by multiplying horizontal timing registers by two.
- Register 0x10, Bit 2 (Clock): Switches the video circuitry clock between the default 25.175MHz and a 14.318MHz input.
- Register 0x20: Functions as a manufacturing test mode register that uses “speedup modes” to inject clock signals into counters, allowing for faster factory chip testing.
Which manufacturing registers exist in the 72X8205?
The 72X8205 contains hidden manufacturing test registers accessible by loading an address into register 0x19 and reading or writing the data via register 0x18. According to the reverse engineering data, these registers provide direct access to the chip’s internal state:
- Address 1: Read-only access to data being sent to the RAMDAC (P[7:0] pins).
- Address 2: Read-only access to data received from VRAM (CP[7:0] pins).
- Address 3: Read-only access to 16-color mode data from formatting logic.
- Address 4: A write-only register where bit 0 triggers a hardware reset and bit 1 disables various outputs, including those directed to the RAMDAC.
Additionally, the extended mode register (0x1A) contains two undocumented bits. Bit 1 may force 256-color mode regardless of resolution, and bit 0 may force the border color across the entire display.
How were the Seiko and IBM gate arrays fabricated?
The hardware was produced using different fabrication processes depending on the batch. The 72X8300 was implemented as a Seiko SLA6430 gate array, utilizing a 2um CMOS process with two metal layers. This chip contains 4,342 basic cells (BCs) arranged in 167 rows and 26 columns, with each cell consisting of four transistors.
The 72X8205 was implemented as a Seiko SLA6330 gate array. It is smaller than the memory controller, containing 3,312 basic cells arranged in 144 rows and 23 columns. Some 72X8205 units were fabricated using internal IBM processes, though these were more difficult to map due to metal layer removal during the decapping process.
| Feature | 72X8300 (Memory Controller) | 72X8205 (Video Formatter) |
|---|---|---|
| Seiko Part No. | SLA6430 | SLA6330 |
| Basic Cell Count | 4,342 | 3,312 |
| Primary Function | Sync generation & VRAM interface | Address decoding & RAMDAC interface |
| Cell Layout | 167 rows x 26 columns | 144 rows x 23 columns |
What was the process for reverse engineering these chips?
The reverse engineering process began by scaling high-resolution silicon imagery. For the 72X8300, images were scaled from 21808×21778 down to 10904×10889 and imported into KiCAD at a scale factor of 0.103170. Analysts created library footprints for each basic cell type and mapped the connections based on the metal layers.
The circuitry utilizes two metal layers. Metal 1 typically carries horizontal traces for external signals crossing the cells. Metal 2 handles internal logic wiring and carries vertical parallel wires for VCC (right) and GND (left). In each basic cell, the left two transistors are NMOS and the right two are PMOS, sharing a single gate with three connecting pads.