Subject: Mailstation CPU revisited

From: "FyberOptic" <fyberoptic@...>
Date: Fri, 22 Jan 2010 04:06:44 -0000

I've jump around between Mailstation and semi-Mailstation-related ideas lately, and one of them would involve precise timing.  So I was looking at the cycles it takes for the Z80 to execute particular instructions, which eventually led me to taking another look at the Mailstation's "delay" function.  

In the commented disassembly of page 0 for that function, it shows timings of:
  @8MHz, 10634 * 0.125 usec = 1.33 msec
  @12MHz 10634 * 0.083 usec = 0.886 msec
  
Seems to me that if they ran at around like 10mhz, they would have been much closer to 1ms.  Then I got to wondering if anyone had actually proven that the Mailstation can run exactly at these 8 and 12mhz speeds, or if these were simply assumptions.  Has anyone physically tested this somehow to be sure that these are the exact mhz?  That would be important to know.  I would love to just test this myself (among other things on the Mailstation) but I simply have no fancy equipment beyond a multimeter.  Oscilloscopes, logic analyzers, etc, all cost way more than I can afford, unfortunately.

Looking at the group here, it seems some Mailstations use a "122AS9Y" crystal.  Mine uses a "122AP98".  12.2mhz?  No way of knowing without having the manufacturer's codes.

I was going to test it with software, but then I came upon another realization.  What if the clock cycles for this chip aren't the same as the Z80?  Various Z80 microcontroller versions I've seen tend to need less clock cycles per instruction.  So this would seem to make testing either the CPU speed or instruction timing via software impossible without knowing one or the other.

I seem to recall someone thinking it was a Rabbit brand chip for the CPU once upon a time.  I've looked at the lowest Z80-compatible chip they still sell, the Rabbit 2000, and while it has some similar hardware features, it's fairly different in most other respects.  But it too has the reduced clocks per instruction.  Personally I have no reason to think it's from Rabbit than from any other company, based on the part number.

This had me remembering that a lot of these Z80 microcontrollers are actually Z180/64180 compatibles, and I got to wondering if anyone had ever actually tested the Mailstation hardware for this or were just basing their Z80 assumption on the disassembly.  So I made a quick test, loading HL with some values, then doing the Z180 "mlt" instruction on HL, and printing both values to the screen.  The values were the same, meaning the instruction didn't work.  I even disassembled my binary and it showed for sure that I had used the right opcode.  So I think if there was still any doubt, this seems to prove that Z180 capability doesn't exist as far as I can figure.

Something else that came to mind is that this chip might actually have some flash memory in it for all we know, like all these other Z80 microcontrollers tend to.  I have a Dallas 8052 microcontroller that works like this, where the flash can be disabled by pulling a certain pin high or low if you want to use external memory instead.  There could be a code/dataflash loader, diagnostics, or even just be totally empty.

Of course, I'm basing my assumptions on more modern chips, where as this thing is 10 years old now, and those extra features would have been much more expensive back then.  So who knows what it has in it, short of someone with a microscope pulling it apart and visually identifying things!

---

From: "cyranojones_lalp" <cyranojones_lalp@...>
Date: Fri, 22 Jan 2010 18:03:31 -0000

--- FyberOptic wrote:
>
> I've jump around between Mailstation and semi-Mailstation-
> related ideas lately, and one of them would involve precise
> timing.  So I was looking at the cycles it takes for the 
> Z80 to execute particular instructions, which eventually 
> led me to taking another look at the Mailstation's "delay"
> function.  
> 
> Seems to me that if they ran at around like 10mhz, they would have > been much closer to 1ms.  

The mailstation resets to 8 MHz iirc.
At 0000:1B37 it shifts to 10 MHz.  (I imagine it is 
really 10/12ths of 12.2 MHz + or - crystal tolerance
+ or - temperature drift.)

I seem to recall (but I'd have to check, and I don't 
have time right now) that my mbug code ran ms at 12 MHz. 

The numbers are just rough estimates. I ran some tests
where I counted up the T states a delay would take,
assuming standard z80 timing.  I don't recall exactly,
but I probably ran it for 1 or maybe 10 minutes, and it
came out that it was running at pretty close to 8 MHz.

This was at the time that it was assumed (via Cidco
press releases) that it was a 27 MHz z80.

I wrote bit-banged routines for mbug, assuming 8 MHz.

Later, I discovered that during ms init, it shifted gears
to 10 MHz (I suppose I really should say "approximately",
but it is 10 MHz to us non-Vulcans.)  

The way I found it was single stepping thru the init,
till mbug quit responding, right after an "out" to 
port 0x0d.  I wrote a test to set that port in my own code, 
and tested the delay time again.

A little experimentation showed you could set it to 12 MHz
(again, "approximately").

From the "datasheet" in file area (it's under partfiles,
or something like that, where the rest of the datasheets 
are filed):

Port #0D: CPU clock rate.  Resets to 8MHz. 
 #f0=8MHz 
 #30=10MHz
 #00=12MHz. 
(might be bits 4 & 6 only. bits 0-3 dontcare or somthinelse)

The keyboard matrix data is there, too, along with LCD.
I forgot to tell you when you asked a week or so ago.
Or I should say, I started to reply, but I went to bed 
in middle, and by next day there was new message that
I started to reply to...  I think 3 or 4 unfinished 
replies to your posts got eaten when sdl locked up
X windows.

I would guess that since 0 sets clock to ~12 MHz, that
the undivided clock is ~12 MHz.

> Then I got to wondering if anyone had actually proven that 
> the Mailstation can run exactly at these 8 and 12mhz speeds, 
> or if these were simply assumptions.  

I guess it depends on your standard of "proven".
(Close enough for government work, as they say!!!)

> Has anyone physically tested this somehow to be sure 
> that these are the exact mhz?  That would be important to know.

I seem to recall rogblake (on linux-hacker board) said
he scoped it.
http://www.linux-hacker.net/cgi-bin/UltraBoard/UltraBoard.pl?Action=ShowPost&Board=mswhatever&Post=12

But he only said it was a lot less... uh, I'll paste it:

"Also, I don't know where the 27 MHz comes in, since probing 
 around yielded a clock of about half that. Maybe they have a 
 PLL or frequency doubler in the CPU?"

He was talking about an article that was on zilog's 
website, but it has been gone for years.  Fortunately, a lot 
of what has EVER been on the web is available FOREVER 
thanks to The Wayback Machine.  

As long as you know what URL it was at.

http://web.archive.org/web/20020927112922/http://www.zilog.com/about/relatednews/022100.html

> I would love to just test this myself (among other things
> on the Mailstation) but I simply have no fancy equipment 
> beyond a multimeter.  Oscilloscopes, logic analyzers, etc, 
> all cost way more than I can afford, unfortunately.

I don't have those myself, but I have found I rarely needed
more than rat-shack meters,and a logic probe.  And the logic
probe is indispensable IMO.
 
> Looking at the group here, it seems some Mailstations use a
> "122AS9Y" crystal.  Mine uses a "122AP98".  12.2 mhz?  No 
> way of knowing without having the manufacturer's codes.

I am ready to jump to conclusion it is 12.2 MHz.

The only one I have handy (already opened up) has
at x101 "122AS99".  x102 is the smaller, and I assume
it is the rtc xtal (yes, datasheet in file area sez
the one connected to cpu pins 126 & 127 is rtc) has
no number that I can see.

The modem xtal x601 sez "524AP99" and I recall 52 MHz
was... ok I'll pull up datasheet, the datasheet sez
that the xtal is one of 28.224 MHz, 52.416 MHz, 
or 56.448 MHz, depending on chip version.  I can't
find correlation between numbers on chip and datasheet,
but, once again, I am ready to jump to conclusion
that the 524 stamped on my xtal means 52.4 MHz,
and therefore my modem chip is the 52 MHz, uh
52.416 MHz version.

I am also gonna jump to conclusion that the 99 in
the xtal numbers means they were made in 1999,
coz that's just the kind of guy I am, always jumping 
to conclusions!  That, and I know that they often stamp
date codes on electronic parts.

> I was going to test it with software, but then I came upon another realization.  What if the clock cycles for this chip aren't the same as the Z80?  Various Z80 microcontroller versions I've seen t…

I also have wondered about that, but I see no evidence of
it, and plenty of evidence points to normal z80.

On a related idea, I noticed that the c code uses very few
op-codes.  The page 00 code uses some z80 opcodes, such as
indexed addressing mode, but it is also not as obviously
c compiler generated, as the higher pages all seem to be.

I don't believe any higher pages ever use index regs.

So, I wonder if maybe they used just 8080 opcodes, and the
compiler was really an 8080 compiler?

It really does not matter, though!  And I am not gonna 
take a lot of my time to check it out.

> I seem to recall someone thinking it was a Rabbit brand chip for the CPU once upon a time.  I've looked at the lowest Z80-compatible chip they still sell, the Rabbit 2000, and while it has some sim…

I can't count how many hours I have spent researching
that damn cpu, but it is way more than 10, prob more 
like 50!  The only evidence for "rabbit" is some guy
once posted on linux-hacker that "maybe" the RS in RSDRD
meant Rabbit Semi.  He did not do any research to
back up his speculation.  But then I started getting 
google hits on other embedded system boards, where
idiots were posting that it WAS a rabbit part.  But the
only research *they* did was to skim linux-hacker board.

It's scary how easy rumor turns to fact on the net.

Now, I spent quite a bit of my time looking at the
rabbit parts, and came to conclusion only similarity
was z80 code.  And then a year or two later some asshole
posts that he checked, and some pins lined up with
something or other on a rabbit part.  So I spent an 
hour or so once again, seeing if I had missed something.

And the conclusion I came to was it was too bad
that they let just anybody post stuff on the net.

It really is odd how some people will just throw
guesses out, as if they had some inside knowledge,
as if that is somehow advancing the effort.
 
> This had me remembering that a lot of these Z80 microcontrollers are actually Z180/64180 compatibles, and I got to wondering if anyone had ever actually tested the Mailstation hardware for this or…

At least you tested your hypothesis yourself.  :-)

> Something else that came to mind is that this chip might actually have some flash memory in it for all we know, like all these other Z80 microcontrollers tend to.  I have a Dallas 8052 microcontrol…

I HIGHLY doubt it.  If it really was a standard part, it might,
but my hunch is that it is a semi-custom asic, made on
a plain old gate array, that just did not have the capability
to create flash cells from the gates.  Almost anyone (with
the right skills) who is willing to buy in the quantity
necessary to justify the up-front engineering costs, can
order up a semi-custom asic.  And I am not talking about
CPLD's, I mean the kind where the gates are connected up
in the final metalization layers of the production process.

I suspect that is the reason Parallax's "Propeller"
CPU does not have flash onboard, but I am just guessing.
And in case anyone is thinking of propagating that
as fact, I'll repeat: I AM JUST GUESSING.

> Of course, I'm basing my assumptions on more modern chips, where as this thing is 10 years old now, and those extra features would have been much more expensive back then.  So who knows what it has…

Right.  I imagine there may be stuff in there we will never know
about.  All (or  most) of my research into this ms has been
exploring how it is used in the ms code.  If they did not
use a feature, I probably won't know about it.

I know some peoples idea of how to hack the ms involved
(what I call crazy) ideas of keeping a database of all possible
key combos, and just brute force trying them!!!!

This is just insane, IMO.  But I never liked the "search
for the hidden rooms" aspect of games, such as Doom.  I
mean, blowing the hell out of the bad guys is FUN, but
feeling around every nook and cranny to find hidden
rooms - B-O-R-I-N-G!!!!!!

I'd sooner disassemble it, and find the rooms that way.
That would actually be a lot more fun!!!

CJ

---

From: "lwoodzw" <lwoodzw@...>
Date: Fri, 22 Jan 2010 22:56:21 -0000

Hah -- someone just asked me today if I had ever heard of the "RSDRD" so I went to look it up...  and found this post.

As someone who has worked on the processor designs for Rabbit Semiconductor since 1999, I can _guarantee_ you that the MailStation CPU is not a Rabbit processor :v)

     -Lynn

--- In [email-masked], "cyranojones_lalp" <cyranojones_lalp@...> wrote:
>> I seem to recall someone thinking it was a Rabbit brand 
>> chip for the CPU once upon a time.  I've looked at the 
>> lowest Z80-compatible chip they still sell, the Rabbit 
>> 2000, and while it has some similar hardware features, 
>> it's fairly different in most other respects.  But it 
>> too has the reduced clocks per instruction.  Personally 
>> I have no reason to think it's from Rabbit than from
>> any other company, based on the part number.

---

From: "FyberOptic" <fyberoptic@...>
Date: Sat, 23 Jan 2010 00:17:01 -0000

> As someone who has worked on the processor designs for Rabbit Semiconductor since 1999, I can _guarantee_ you that the MailStation CPU is not a Rabbit processor :v)

I've gotta give props to you folks at Rabbit, because it was in fact me who emailed earlier to ask about it!  Not only did I not expect such a quick response via email, but I didn't expect to have the question passed on to someone who was involved in ASIC design there.  So many companies these days give you unhelpful stock responses to everything, so it's a pleasant surprise when you find one which actually takes the time to try and help.  I certainly appreciated it.

I was going to actually mention here about the response I got via email and how you guys had tried to help, but I think this takes care of that!

---

From: "FyberOptic" <fyberoptic@...>
Date: Sat, 23 Jan 2010 01:48:20 -0000

> the undivided clock is ~12 MHz.

Some of the Z80 microcontrollers have a divider as well as multiplier.  Usually just 2x on the latter.  I wonder if one of the upper four bits enables that, combined with the divider value?  If you had 12 * 2, then divided by 3, you'd get 8 (going by the rounded-off mhz values listed above, that is).  I mention that since the assumed 8mhz speed is the only one listed which sets bit 7.  Not that that means anything at this point, but it's worth pointing out.

Many times dividers are even numbers, so I dunno.  Not that it's hard to do odd, though.  Only takes a couple flip-flops to divide by 3.

In my tinkering before, I found that setting bits 0-2 made the Mailstation run noticeably slower.  I don't remember what method I used to determine this, nor would you ever really know if it was the CPU speed causing it, or maybe repeated interrupts (like a watchdog timer or something) bringing it to a crawl (by running the interrupt routine), or what.  It'd take more research, which I'll get to one of these days I guess!

> replies to your posts got eaten when sdl locked up

I copy/paste the reply text into my text editor and type my response there.  I think I've actually lost some responses to this group before myself.  Between possible browser crashes, power outages, or whatever crazy event might take place, I'd rather just type it once, since obviously some of these posts can be rather long.

> thanks to The Wayback Machine.  

I've tried to see what was once on that badcluster.ar website via the Wayback Machine, but never had any luck.  I've always wondered what Mailstation info might have been posted there.  

> probe is indispensable IMO.

I don't have the logic probe, but it might be worth spending money on sometime, since they can apparently differentiate between active and pulsing.  That would be handy, rather than the poor man's method of sticking a meter on it.

> no number that I can see.

I thought the post was here, but apparently it was an actual email response and not just a Yahoo group notification.

Anyhow, a fellow named Steve has tested the crystals with his scope.  I haven't seen him post here before, but the info is certainly appreciated!

Here's what he found:

I just checked the crystals in my Cidco DET1-01 with my scope.
X101: 122AS96 12.2MHz
X102: 32.8kHz
X601: turned off (for modem?)

> and therefore my modem chip is the 52 MHz, uh

I looked up how to know which chip needed which crystal before, but danged if I can remember now.

My modem crystal is "524AS97"

It's worth pointing out that the chip in my Mailstation is the "SP" variety, which means it has speakerphone capability.  Seems kind of a waste, because I'm fairly sure there's no microphone.

> date codes on electronic parts.

If that's the case, mine is from 97.  And my CPU crystal would be from 98.  Seems a reasonable-enough conclusion for me!

> it, and plenty of evidence points to normal z80.

Well now that it's pretty much certain to be 12.2mhz, I think it should be easy now to deduce opcode timing to ensure that it uses the traditional speeds.  It's just another one of those "whenever I get around to it" things!

> take a lot of my time to check it out.

I've also noticed that some seems to be actual assembly and other code seems much more generated.  Though for curiosity's sake I went and took a peek at your 8080 assumption, and you may be right.  There's lots if use of the index registers throughout the later pages (as seen when I do a grep for it), but when I actually took a quick look at where some of them were, they didn't appear in functions which started out being "localized".  So they may very well have used an 8080 C compiler.  That, or never turned on Z80 extensions for whatever they used.

This is related to why I wanted to check for sure on Z180 support.  I thought they might have just written the OS with a Z80-based compiler, which would have been why no Z180 opcodes were ever found in it.  But apparently that's not the case, unfortunately.  I sure would like having those multiplication instructions!

> like 50!  

I've done a little digging on a few occasions, though not nearly as much as you apparently, but without any luck.  But I sent Rabbit an email today, and it turns out they weren't involved (as witnessed by one of their own responding here too, even!), so I think we put that assumption to rest.  I thought about contacting Zilog too, even, but I have a feeling I won't have as much luck with an answer as I did with Rabbit.

> in the final metalization layers of the production process.

Well you seem to know way more about the production of that sort of stuff than me so I'll take your word for it.  It would make sense anyway, since as I mentioned before, those things would have been a lot more expensive back then.  It probably would have been cheaper to make a custom chip than to use a stock one with wasted resources, especially considering the price of flash memory back then.

That said, I would love to get into CPLDs and such some day.  Or hell even older things like GAL chips for that matter.  Problem with this sort of stuff for me though is in the cost of the device programmers and all.  But it'd sure be nice to have a single chip taking care of all the address decoding for an entire project!

> as fact, I'll repeat: I AM JUST GUESSING.

So are you saying that's definitely the reason Parallax's chip doesn't have flash onboard?  ;)

> That would actually be a lot more fun!!!

It takes all kinds, I always say.  Those are the kinds of folks who would put bombs on every bush and rock in Zelda trying to find secret passages.  But as it turned out, that kind of mindset wasn't a bad thing for something like that!

I always liked to find ways to "break" things, or rather to get them to do what they're not supposed to.  On the subject of video games, I remember trying forever to bust outside of the track in Stunt Race FX on SNES (if you've ever heard of it).  For all I knew, it was impossible.  But finally, one day, I found the perfect spot on one of the tracks to do it, by driving backwards up one of the downward slopes and jumping/slamming into the invisible barrier.  I must have gone over a spot they didn't block off, but I got past it either way.  Of course, it was totally useless to drive around outside the track, but you weren't supposed to be able to do it!

---

From: "Neil Morrison" <neilsmorr@...>
Date: Fri, 22 Jan 2010 21:16:37 -0800

Possibly the original design was based on an 8080 and they didn't bother to change it. Or their development system only emitted 8080 code.

All the TRS-80 computers used a Z80 but the BASIC code for the interpreters was 8080 because that's what Microsoft's system emitted.

Some I/O was done in Z-80 because it was hand written.

Neil

From: FyberOptic