From: "FyberOptic" <fyberoptic@...>
Jan 21, 2010
I've jump around between Mailstation and semi-Mailstation-related ideas lat=
ely, and one of them would involve precise timing. So I was looking at the=
cycles it takes for the Z80 to execute particular instructions, which even=
tually led me to taking another look at the Mailstation's "delay" function.=
In the commented disassembly of page 0 for that function, it shows timi=
ngs of:
@8MHz, 10634 * 0.125 usec =3D 1.33 msec
@12MHz 10634 * 0.083 us=
ec =3D 0.886 msec
Seems to me that if they ran at around like 10mhz, the=
y would have been much closer to 1ms. Then I got to wondering if anyone ha=
d actually proven that the Mailstation can run exactly at these 8 and 12mhz=
speeds, or if these were simply assumptions. Has anyone physically tested=
this somehow to be sure that these are the exact mhz? That would be impor=
tant to know. I would love to just test this myself (among other things on=
the Mailstation) but I simply have no fancy equipment beyond a multimeter.=
Oscilloscopes, logic analyzers, etc, all cost way more than I can afford,=
unfortunately.
Looking at the group here, it seems some Mailstations use =
a "122AS9Y" crystal. Mine uses a "122AP98". 12.2mhz? No way of knowing w=
ithout having the manufacturer's codes.
I was going to test it with softwa=
re, but then I came upon another realization. What if the clock cycles for=
this chip aren't the same as the Z80? Various Z80 microcontroller version=
s I've seen tend to need less clock cycles per instruction. So this would =
seem to make testing either the CPU speed or instruction timing via softwar=
e impossible without knowing one or the other.
I seem to recall someone th=
inking it was a Rabbit brand chip for the CPU once upon a time. I've looke=
d at the lowest Z80-compatible chip they still sell, the Rabbit 2000, and w=
hile it has some similar hardware features, it's fairly different in most o=
ther respects. But it too has the reduced clocks per instruction. Persona=
lly I have no reason to think it's from Rabbit than from any other company,=
based on the part number.
This had me remembering that a lot of these Z80=
microcontrollers are actually Z180/64180 compatibles, and I got to wonderi=
ng if anyone had ever actually tested the Mailstation hardware for this or =
were just basing their Z80 assumption on the disassembly. So I made a quic=
k test, loading HL with some values, then doing the Z180 "mlt" instruction =
on HL, and printing both values to the screen. The values were the same, m=
eaning the instruction didn't work. I even disassembled my binary and it s=
howed for sure that I had used the right opcode. So I think if there was s=
till any doubt, this seems to prove that Z180 capability doesn't exist as f=
ar as I can figure.
Something else that came to mind is that this chip mig=
ht actually have some flash memory in it for all we know, like all these ot=
her Z80 microcontrollers tend to. I have a Dallas 8052 microcontroller tha=
t works like this, where the flash can be disabled by pulling a certain pin=
high or low if you want to use external memory instead. There could be a =
code/dataflash loader, diagnostics, or even just be totally empty.
Of cour=
se, I'm basing my assumptions on more modern chips, where as this thing is =
10 years old now, and those extra features would have been much more expens=
ive back then. So who knows what it has in it, short of someone with a mic=
roscope pulling it apart and visually identifying things!
From: "cyranojones_lalp" <cyranojones_lalp@...>
Jan 22, 2010
semi-Mailstation-
cise
xecute particular instructions, which eventually
r look at the Mailstation's "delay"
assembly of page 0 for that function,
34 * 0.125 usec =3D 1.33 msec
=
been much closer to 1ms.
The mailstation resets to 8 MHz iirc.
At 0000:=
1B37 it shifts to 10 MHz. (I imagine it is
really 10/12ths of 12.2 MHz + =
or - crystal tolerance
+ or - temperature drift.)
I seem to recall (but I'=
d have to check, and I don't
have time right now) that my mbug code ran ms=
at 12 MHz.
The numbers are just rough estimates. I ran some tests
where =
I counted up the T states a delay would take,
assuming standard z80 timing.=
I don't recall exactly,
but I probably ran it for 1 or maybe 10 minutes, =
and it
came out that it was running at pretty close to 8 MHz.
This was at =
the time that it was assumed (via Cidco
press releases) that it was a 27 MH=
z z80.
I wrote bit-banged routines for mbug, assuming 8 MHz.
Later, I dis=
covered that during ms init, it shifted gears
to 10 MHz (I suppose I really=
should say "approximately",
but it is 10 MHz to us non-Vulcans.)
The wa=
y I found it was single stepping thru the init,
till mbug quit responding, =
right after an "out" to
port 0x0d. I wrote a test to set that port in my =
own code,
and tested the delay time again.
A little experimentation showe=
d you could set it to 12 MHz
(again, "approximately").
From the "datasheet=
" in file area (it's under partfiles,
or something like that, where the res=
t of the datasheets
are filed):
Port #0D: CPU clock rate. Resets to 8MHz=
.
#f0=3D8MHz
#30=3D10MHz
#00=3D12MHz.
(might be bits 4 & 6 only. bits=
0-3 dontcare or somthinelse)
The keyboard matrix data is there, too, alon=
g with LCD.
I forgot to tell you when you asked a week or so ago.
Or I shou=
ld say, I started to reply, but I went to bed
in middle, and by next day t=
here was new message that
I started to reply to... I think 3 or 4 unfinish=
ed
replies to your posts got eaten when sdl locked up
X windows.
I would =
guess that since 0 sets clock to ~12 MHz, that
the undivided clock is ~12 M=
Hz.
ilstation can run exactly at these 8 and 12mhz speeds,
simply assumptions.
I guess it depends on your standard of "proven".
(Cl=
ose enough for government work, as they say!!!)
sted this somehow to be sure
e important to know.
I seem to recall rogblake (on linux-hacker board) sai=
d
he scoped it.
(URL)
l?Action=3DShowPost&Board=3Dmswhatever&Post=3D12
But he only said it was a=
lot less... uh, I'll paste it:
"Also, I don't know where the 27 MHz comes=
in, since probing
around yielded a clock of about half that. Maybe they =
have a
PLL or frequency doubler in the CPU?"
He was talking about an art=
icle that was on zilog's
website, but it has been gone for years. Fortuna=
tely, a lot
of what has EVER been on the web is available FOREVER
thanks =
to The Wayback Machine.
As long as you know what URL it was at.
(URL)
web.archive.org/web/20020927112922/(URL)
22100.html
n the Mailstation) but I simply have no fancy equipment
ter. Oscilloscopes, logic analyzers, etc,
afford, unfortunately.
I don't have those myself, but I have found I rarel=
y needed
more than rat-shack meters,and a logic probe. And the logic
probe=
is indispensable IMO.
tions use a
way of knowing without having the manufacturer's codes.
I am ready to jump=
to conclusion it is 12.2 MHz.
The only one I have handy (already opened u=
p) has
at x101 "122AS99". x102 is the smaller, and I assume
it is the rtc =
xtal (yes, datasheet in file area sez
the one connected to cpu pins 126 & 1=
27 is rtc) has
no number that I can see.
The modem xtal x601 sez "524AP99"=
and I recall 52 MHz
was... ok I'll pull up datasheet, the datasheet sez
th=
at the xtal is one of 28.224 MHz, 52.416 MHz,
or 56.448 MHz, depending on =
chip version. I can't
find correlation between numbers on chip and datashe=
et,
but, once again, I am ready to jump to conclusion
that the 524 stamped =
on my xtal means 52.4 MHz,
and therefore my modem chip is the 52 MHz, uh
52=
.416 MHz version.
I am also gonna jump to conclusion that the 99 in
the xt=
al numbers means they were made in 1999,
coz that's just the kind of guy I =
am, always jumping
to conclusions! That, and I know that they often stamp=
date codes on electronic parts.
ut then I came upon another realization. What if the clock cycles for this=
chip aren't the same as the Z80? Various Z80 microcontroller versions I'v=
e seen tend to need less clock cycles per instruction. So this would seem =
to make testing either the CPU speed or instruction timing via software imp=
ossible without knowing one or the other.
I also have wondered about that=
, but I see no evidence of
it, and plenty of evidence points to normal z80.=
On a related idea, I noticed that the c code uses very few
op-codes. The=
page 00 code uses some z80 opcodes, such as
indexed addressing mode, but i=
t is also not as obviously
c compiler generated, as the higher pages all se=
em to be.
I don't believe any higher pages ever use index regs.
So, I won=
der if maybe they used just 8080 opcodes, and the
compiler was really an 80=
80 compiler?
It really does not matter, though! And I am not gonna
take =
a lot of my time to check it out.
as a Rabbit brand chip for the CPU once upon a time. I've looked at the lo=
west Z80-compatible chip they still sell, the Rabbit 2000, and while it has=
some similar hardware features, it's fairly different in most other respec=
ts. But it too has the reduced clocks per instruction. Personally I have =
no reason to think it's from Rabbit than from any other company, based on t=
he part number.
I can't count how many hours I have spent researching
that=
damn cpu, but it is way more than 10, prob more
like 50! The only eviden=
ce for "rabbit" is some guy
once posted on linux-hacker that "maybe" the RS=
in RSDRD
meant Rabbit Semi. He did not do any research to
back up his spe=
culation. But then I started getting
google hits on other embedded system=
boards, where
idiots were posting that it WAS a rabbit part. But the
only=
research *they* did was to skim linux-hacker board.
It's scary how easy r=
umor turns to fact on the net.
Now, I spent quite a bit of my time looking=
at the
rabbit parts, and came to conclusion only similarity
was z80 code. =
And then a year or two later some asshole
posts that he checked, and some =
pins lined up with
something or other on a rabbit part. So I spent an
hou=
r or so once again, seeing if I had missed something.
And the conclusion I=
came to was it was too bad
that they let just anybody post stuff on the ne=
t.
It really is odd how some people will just throw
guesses out, as if the=
y had some inside knowledge,
as if that is somehow advancing the effort.
=
ally Z180/64180 compatibles, and I got to wondering if anyone had ever actu=
ally tested the Mailstation hardware for this or were just basing their Z80=
assumption on the disassembly. So I made a quick test, loading HL with so=
me values, then doing the Z180 "mlt" instruction on HL, and printing both v=
alues to the screen. The values were the same, meaning the instruction did=
n't work. I even disassembled my binary and it showed for sure that I had =
used the right opcode. So I think if there was still any doubt, this seems=
to prove that Z180 capability doesn't exist as far as I can figure.
At le=
ast you tested your hypothesis yourself. :-)
o mind is that this chip might actually have some flash memory in it for al=
l we know, like all these other Z80 microcontrollers tend to. I have a Dal=
las 8052 microcontroller that works like this, where the flash can be disab=
led by pulling a certain pin high or low if you want to use external memory=
instead. There could be a code/dataflash loader, diagnostics, or even jus=
t be totally empty.
I HIGHLY doubt it. If it really was a standard part, =
it might,
but my hunch is that it is a semi-custom asic, made on
a plain ol=
d gate array, that just did not have the capability
to create flash cells f=
rom the gates. Almost anyone (with
the right skills) who is willing to buy=
in the quantity
necessary to justify the up-front engineering costs, can
o=
rder up a semi-custom asic. And I am not talking about
CPLD's, I mean the =
kind where the gates are connected up
in the final metalization layers of t=
he production process.
I suspect that is the reason Parallax's "Propeller"=
CPU does not have flash onboard, but I am just guessing.
And in case anyon=
e is thinking of propagating that
as fact, I'll repeat: I AM JUST GUESSING.=
s thing is 10 years old now, and those extra features would have been much =
more expensive back then. So who knows what it has in it, short of someone=
with a microscope pulling it apart and visually identifying things!
Right=
. I imagine there may be stuff in there we will never know
about. All (or=
most) of my research into this ms has been
exploring how it is used in th=
e ms code. If they did not
use a feature, I probably won't know about it.
=
I know some peoples idea of how to hack the ms involved
(what I call crazy=
) ideas of keeping a database of all possible
key combos, and just brute fo=
rce trying them!!!!
This is just insane, IMO. But I never liked the "sear=
ch
for the hidden rooms" aspect of games, such as Doom. I
mean, blowing th=
e hell out of the bad guys is FUN, but
feeling around every nook and cranny=
to find hidden
rooms - B-O-R-I-N-G!!!!!!
I'd sooner disassemble it, and f=
ind the rooms that way.
That would actually be a lot more fun!!!
CJ
From: "lwoodzw" <lwoodzw@...>
Jan 22, 2010
Hah -- someone just asked me today if I had ever heard of the "RSDRD" so=
I went to look it up... and found this post.
As someone who has worked o=
n the processor designs for Rabbit Semiconductor since 1999, I can _guarant=
ee_ you that the MailStation CPU is not a Rabbit processor :v)
-Lynn
=
...> wrote:
chip for the CPU once upon a time. I've looked at the
tible chip they still sell, the Rabbit
lar hardware features,
ut it
e no reason to think it's from Rabbit than from
on the part number.
ing
only evidence for "rabbit" is some guy
"maybe" the RS in RSDRD
ther embedded system boards, where
it part. But the
.
t quite a bit of my time looking at the
ion only similarity
ole
er on a rabbit part. So I spent an
ad missed something.
that they let just anybody post stuff on the net.
w some people will just throw
wledge,
From: "FyberOptic" <fyberoptic@...>
Jan 22, 2010
=
I went to look it up... and found this post.
d on the processor designs for Rabbit Semiconductor since 1999, I can _guar=
antee_ you that the MailStation CPU is not a Rabbit processor :v)
-Lynn
I've gotta give props to you folks at Rabbit, because it was in fa=
ct me who emailed earlier to ask about it! Not only did I not expect such =
a quick response via email, but I didn't expect to have the question passed=
on to someone who was involved in ASIC design there. So many companies th=
ese days give you unhelpful stock responses to everything, so it's a pleasa=
nt surprise when you find one which actually takes the time to try and help=
. I certainly appreciated it.
I was going to actually mention here about =
the response I got via email and how you guys had tried to help, but I thin=
k this takes care of that!
From: "FyberOptic" <fyberoptic@...>
Jan 22, 2010
p@...> wrote:
8MHz
dontcare or somthinelse)
MHz, that
Some of the Z80 microcontroll=
ers have a divider as well as multiplier. Usually just 2x on the latter. =
I wonder if one of the upper four bits enables that, combined with the divi=
der value? If you had 12 * 2, then divided by 3, you'd get 8 (going by the=
rounded-off mhz values listed above, that is). I mention that since the a=
ssumed 8mhz speed is the only one listed which sets bit 7. Not that that m=
eans anything at this point, but it's worth pointing out.
Many times divid=
ers are even numbers, so I dunno. Not that it's hard to do odd, though. O=
nly takes a couple flip-flops to divide by 3.
In my tinkering before, I fo=
und that setting bits 0-2 made the Mailstation run noticeably slower. I do=
n't remember what method I used to determine this, nor would you ever reall=
y know if it was the CPU speed causing it, or maybe repeated interrupts (li=
ke a watchdog timer or something) bringing it to a crawl (by running the in=
terrupt routine), or what. It'd take more research, which I'll get to one =
of these days I guess!
t to bed
ed to reply to... I think 3 or 4 unfinished
aten when sdl locked up
I copy/paste the reply text into m=
y text editor and type my response there. I think I've actually lost some =
responses to this group before myself. Between possible browser crashes, p=
ower outages, or whatever crazy event might take place, I'd rather just typ=
e it once, since obviously some of these posts can be rather long.
He was talking about an article that was on zilog's
been gone for years. Fortunately, a lot
b is available FOREVER
I've tried t=
o see what was once on that badcluster.ar website via the Wayback Machine, =
but never had any luck. I've always wondered what Mailstation info might h=
ave been posted there.
d I rarely needed
logic
I don't have the logic probe, but it m=
ight be worth spending money on sometime, since they can apparently differe=
ntiate between active and pulsing. That would be handy, rather than the po=
or man's method of sticking a meter on it.
nclusion it is 12.2 MHz.
has
c xtal (yes, datasheet in file area sez
& 127 is rtc) has
I thought the post was h=
ere, but apparently it was an actual email response and not just a Yahoo gr=
oup notification.
Anyhow, a fellow named Steve has tested the crystals wit=
h his scope. I haven't seen him post here before, but the info is certainl=
y appreciated!
Here's what he found:
I just checked the crystals in my Ci=
dco DET1-01 with my scope.
X101: 122AS96 12.2MHz
X102: 32.8kHz
X601: turned=
off (for modem?)
ne of 28.224 MHz, 52.416 MHz,
I can't
nce again, I am ready to jump to conclusion
al means 52.4 MHz,
MHz version.
I looked up how to know which chip needed which crystal befo=
re, but danged if I can remember now.
My modem crystal is "524AS97"
It's =
worth pointing out that the chip in my Mailstation is the "SP" variety, whi=
ch means it has speakerphone capability. Seems kind of a waste, because I'=
m fairly sure there's no microphone.
ion that the 99 in
hat's just the kind of guy I am, always jumping
nd I know that they often stamp
If that'=
s the case, mine is from 97. And my CPU crystal would be from 98. Seems a=
reasonable-enough conclusion for me!
software, but then I came upon another realization. What if the clock cycl=
es for this chip aren't the same as the Z80? Various Z80 microcontroller v=
ersions I've seen tend to need less clock cycles per instruction. So this =
would seem to make testing either the CPU speed or instruction timing via s=
oftware impossible without knowing one or the other.
ndered about that, but I see no evidence of
ints to normal z80.
Well now that it's pretty much certain to be 12.2mh=
z, I think it should be easy now to deduce opcode timing to ensure that it =
uses the traditional speeds. It's just another one of those "whenever I ge=
t around to it" things!
uses very few
=
erated, as the higher pages all seem to be.
pages ever use index regs.
opcodes, and the
s not matter, though! And I am not gonna
it out.
I've also noticed that some seems to be actual assembly and other=
code seems much more generated. Though for curiosity's sake I went and to=
ok a peek at your 8080 assumption, and you may be right. There's lots if u=
se of the index registers throughout the later pages (as seen when I do a g=
rep for it), but when I actually took a quick look at where some of them we=
re, they didn't appear in functions which started out being "localized". S=
o they may very well have used an 8080 C compiler. That, or never turned o=
n Z80 extensions for whatever they used.
This is related to why I wanted t=
o check for sure on Z180 support. I thought they might have just written t=
he OS with a Z80-based compiler, which would have been why no Z180 opcodes =
were ever found in it. But apparently that's not the case, unfortunately. =
I sure would like having those multiplication instructions!
ount how many hours I have spent researching
more than 10, prob more
I've done a little digging on a few=
occasions, though not nearly as much as you apparently, but without any lu=
ck. But I sent Rabbit an email today, and it turns out they weren't involv=
ed (as witnessed by one of their own responding here too, even!), so I thin=
k we put that assumption to rest. I thought about contacting Zilog too, ev=
en, but I have a feeling I won't have as much luck with an answer as I did =
with Rabbit.
t might,
old gate array, that just did not have the capability
lls from the gates. Almost anyone (with
to buy in the quantity
ts, can
, I mean the kind where the gates are connected up
ion layers of the production process.
Well you seem to know way more ab=
out the production of that sort of stuff than me so I'll take your word for=
it. It would make sense anyway, since as I mentioned before, those things=
would have been a lot more expensive back then. It probably would have be=
en cheaper to make a custom chip than to use a stock one with wasted resour=
ces, especially considering the price of flash memory back then.
That said=
, I would love to get into CPLDs and such some day. Or hell even older thi=
ngs like GAL chips for that matter. Problem with this sort of stuff for me=
though is in the cost of the device programmers and all. But it'd sure be=
nice to have a single chip taking care of all the address decoding for an =
entire project!
CPU does not have flash onboard, but I am just guessing.
ne is thinking of propagating that
NG.
So are you saying that's definitely the reason Parallax's chip doesn't=
have flash onboard? ;)
ere we will never know
has been
a feature, I probably won't know about it.
f how to hack the ms involved
base of all possible
=
rooms" aspect of games, such as Doom. I
he bad guys is FUN, but
en
rooms that way.
It takes al=
l kinds, I always say. Those are the kinds of folks who would put bombs on=
every bush and rock in Zelda trying to find secret passages. But as it tu=
rned out, that kind of mindset wasn't a bad thing for something like that!
=
I always liked to find ways to "break" things, or rather to get them to do=
what they're not supposed to. On the subject of video games, I remember t=
rying forever to bust outside of the track in Stunt Race FX on SNES (if you=
've ever heard of it). For all I knew, it was impossible. But finally, on=
e day, I found the perfect spot on one of the tracks to do it, by driving b=
ackwards up one of the downward slopes and jumping/slamming into the invisi=
ble barrier. I must have gone over a spot they didn't block off, but I got=
past it either way. Of course, it was totally useless to drive around out=
side the track, but you weren't supposed to be able to do it!
From: "Neil Morrison" <neilsmorr@...>
Jan 23, 2010
charset="iso-8859-1"
Possibly the original design was based on an 8080 and they didn't bother to=
change it. Or their development system only emitted 8080 code.
All the TR=
S-80 computers used a Z80 but the BASIC code for the interpreters was 8080 =
because that's what Microsoft's system emitted.
Some I/O was done in Z-80 =
because it was hand written.
Neil
From: FyberOptic
I've also noticed t=
hat some seems to be actual assembly and other code seems much more generat=
ed. Though for curiosity's sake I went and took a peek at your 8080 assumpt=
ion, and you may be right. There's lots if use of the index registers throu=
ghout the later pages (as seen when I do a grep for it), but when I actuall=
y took a quick look at where some of them were, they didn't appear in funct=
ions which started out being "localized". So they may very well have used a=
n 8080 C compiler. That, or never turned on Z80 extensions for whatever the=
y used.
This is related to why I wanted to check for sure on Z180 support.=
I thought they might have just written the OS with a Z80-based compiler, w=
hich would have been why no Z180 opcodes were ever found in it. But apparen=
tly that's not the case, unfortunately. I sure would like having those mult=
iplication instructions!
charset="iso-8859-1"
=
=3DMailContainerBody
style=3D"PADDING-RIGHT: 10px; PADDING-LEFT: 10px; PAD=
DING-TOP: 15px; BACKGROUND-COLOR: #fff"
leftMargin=3D0 topMargin=3D0 Canva=
sTabStop=3D"true" name=3D"Compose message area">
ze=3D2>Possibly the original design was based on an 8080
and they didn't b=
other to change it. Or their development system only emitted
8080 code.</F=
ONT></DIV>
face=3DArial size=3D2>All the TRS-80 computers used a Z80 but the BASIC
co=
de for the interpreters was 8080 because that's what Microsoft's system
em=
itted.</FONT></DIV>
IV><FONT face=3DArial size=3D2>Some I/O was done in Z-80 because it was han=
d
written.</FONT></DIV>
V>
0pt Tahoma">
OUND: #f5f5f5">
beroptic@...
href=3D"mailto:fyberoptic@...">FyberOptic</A> </D=
IV>
be actual
assembly and other code seems much more generated. Though for c=
uriosity's sake I
went and took a peek at your 8080 assumption, and you ma=
y be right. There's lots
if use of the index registers throughout the late=
r pages (as seen when I do a
grep for it), but when I actually took a quic=
k look at where some of them were,
they didn't appear in functions which s=
tarted out being "localized". So they may
very well have used an 8080 C co=
mpiler. That, or never turned on Z80 extensions
for whatever they used.<BR=
on Z180 support. I =
thought they might have just written the OS with a Z80-based
compiler, whi=
ch would have been why no Z180 opcodes were ever found in it. But
apparent=
ly that's not the case, unfortunately. I sure would like having those
mult=
iplication instructions!<BR></DIV></DIV></DIV></BODY></HTML>