I-Appliance BBS
The Official Source for Internet Appliance Upgrades and Mods

Click Here!
BBS Main List | Sign In | Sign Up | Search | Help | Linux-Hacker.netReply to Thread | Printer |

Home / Other I-Appliances / MailStation
MS/Z80 hacking
Z80 hardware and coding in the MS

New MessageMS/Z80 hacking (modified 0 times) hamilton
Profile
Anyone who has hacked their MS hardware please review the data on :
http://www.badcluster.com.ar/mailstation

Please add whatever you can.

01-05-2003 21:57:23

New MessageRE:MS/Z80 hacking (modified 0 times) ThePinkPanther
Profile
PORT definitions
P01 = keyboard (in = cols, out = rows)
P02 = various (see below)
P03 = software masks for isr's
P05 = slot4000page holds A14 - A21, for addresses in #4000-7FFF range.
P06 = slot4000device holds A22 - A29, for addresses in #4000-7FFF range.
P07 = slot8000page holds A14 - A21, for addresses in #8000-BFFF range.
P08 = slot8000device holds A22 - A29, for addresses in #8000-BFFF range.
P09 = printer control & power detect & power button.
P0A = printer control direction
P0D = CPU clock rate control (clock is 8MHz on reset)
P21 = printer status (db25 pins 10,11,12,13,15)
P28 = various (see below)
P2C = printer data direction
P2D = printer data (db25 pins 2 - 9)
P2F = RTC clock rate control????

Port 02 bits: (bit 6 & 2 are input, rest output)
7-lcd_on, 6-callid_data, 5-not_modem_power, 4-yougotmail_LED, 3-LCD_cas, 2-callid_data_rdy, 1-keyrow_9, 0-keyrow_8

Port 03 bits: in's are interrupt source, out's are masks.
The isr's, for the 8 posible interrupt sources are, from highest to lowest priority:
p3.7 = Caller id handler
p3.5 = maybe rtc???
p3.6 = Modem handler
p3.4 = increment time16
p3.3 = null
p3.0 = null
p3.1 = Keyboard handler
p3.2 = null

Ports 05 & 07 are the page registers for slot #4000 & slot #8000 respectively.
Ports 06 & 08 select the device for slot #4000 & slot #8000 respectively.
Device codes:
0 = codeflash (64 pages)
1 = ram ( 8 pages)
2 = LCD (right half) ( 1 page )
3 = dataflash (32 pages)
4 = LCD (left half) ( 1 page )
5 = modem ( 1 page )

Port 09 bits: (bits 0-3 are output, 4-7 input)
P9.7 = +6v good, P9.6 = +5v good, P9.5 = dc-dc good, P9.4 = power_button,
P9.3 = printer_select, P9.2 = printer_init, P9.1 = printer_autofeed, P9.0 = printer_strobe

Port 0D: #f0=8MHz, #30=10MHz, #00=12MHz. Resets to 8MHz. (might be bits 4 & 6 only. bits 0-3 dontcare or somthinelse)

Port 28 bits: (all output)
7,6,5-nc???, 4-callid_FSK/not_DTMF, 3-callid_sleep/reset, 2-callid_dataclock, 1-74C74_pin4_via600ohm, 0-modem_reset

Port 2F: Related to clock speed. might be rtc.


There are a few more ports not doc. here. (probably clock/calendar?????)

Printer port bits all use identical circuitry, whether or no they are ALL bidirectional unknown. printer
data port IS bi-directional!


Just what is a "bank? Is it where memory goes, or the memory that goes there? As in "there are 2 banks, at
#4000 & #8000" versus "there are 64 banks of codeflash", and "32 banks of dataflash", and "8 banks of ram".

Too avoid confusion, I am calling the chunks of memory "pages", and the places those chunks are swapped
into "slots". I find it too confusing to keep calling them both banks.

There are 4 slots, of 16k each, at #0000, #4000, #8000, & #C000.
Only slot #4000 & slot #8000 have been observed to be swappable, with codeflash swapping into #4000, and ram into #8000.
Also, it seems everything except the ram uses #4000 slot. (LCD, dataflash, Modem, caller ID)

slot #0000 is always codeflash page #00
slot #4000 is codeflash pages #01 to #3f (Or LCD, dataflash, Modem, caller ID)
slot #8000 is ram pages #1 to #7
slot #C000 is always ram page #00

On reset, slot4000 and slot8000 both contain codeflash page 0 (dev 0, pg 0).

I would guess that any device can swap into either slot, but so far the ram is the only thing to use #8000 slot, and
it never goes in the #4000 slot.

It seems that the #0000 slot always is codeflash page #00, & since pg #00 has the bank swapping code, this makes sense.
There are a lot of low level routines in this page, too. And if the dataflash and codeflash both swap into slot #4000,
then the only routines to directly access dataflash MUST be in page 0 of codeflash (or copied to ram, as in update mode)
It stands to reason that slot #C000 is fixed ram page, since it contains the stack.
Everything I have seen sez that the #4000 slot is where all the coderom above #003fff is mapped.

12-31-2003 05:55:56

New MessageRE:MS/Z80 hacking (modified 0 times) ThePinkPanther
Profile
MCU Pinout (RSDRD 3SI176 0A)

1 gnd
2 /reset
3
4 A0 address bus
5 A1
6 A2
7 A3
8 A4
9 A5
10 A6
11 A7
12 A8
13 A18
14 A19
15
16
17 A9
18 A10
19 A11
20 A12
21 A13
22 A14
23 A15
24 A16
25 A17
26 /dev6 ???? (device selects)
27 /dev5 modembus
28 /dev4 LCD1
29 /dev3 dataflash
30 /dev2 LCD0
31 /dev1 RAM
32 /dev0 codeflash

33 +5v
34 D0 data bus
35 D1
36 D2
37 D3
38 D4
39 D5
40 D6
41 D7
42 P1.0 in K0 (keyboard columns)
43 P1.1 in K1
44 P1.2 in K2
45 P1.3 in K3
46 P1.4 in K4
47 P1.5 in K5
48 P1.6 in K6
49 P1.7 in K7
50 P1.0 out R0 (keyboard rows)
51 P1.0 out R1
52 P1.0 out R2
53 P1.0 out R3
54 P1.0 out R4
55 P1.0 out R5
56 P1.0 out R6
57 P1.0 out R7
58 P2.0 out R8
59 P2.1 out R9
60 P2.2 in callid FSK data ready
61 P2.3 out LCD /CAS
62 xtal1 CPU clock
63 xtal1
64 gnd

65 +5v
66
67
68
69 P21.7 in printer status busy
70 P21.6 in printer status ack
71 P21.5 in printer status paper end
72 P21.4 in printer status select
73 P21.3 in printer status error
74 P21.2
75 P21.1
76 P21.0
77 P28.0 out modem /reset
78 P28.1 out 74c74 pin 4 via 600 ohm
79 P28.2 out callid data clock
80 P28.3 out callid sleep/reset
81 P28.4 out callid fsk/dtmf
82 P2.4 out new email LED
83 P2.5 U606 (missing on mine, 4 term device, 2 conn. to phone line. ring detect???)
84 P2.6 in callid data
85 P2.7 out LCD pin 6 (lcd on/off)
86 gnd
87
88
89
90
91
92
93
94
95
96

97 gnd
98
99
100
101
102 P2D.0 printer data 0
103 P2D.1 printer data 1
104 P2D.2 printer data 2
105 P2D.3 printer data 3
106 P2D.4 printer data 4
107 P2D.5 printer data 5
108 P2D.6 printer data 6
109 P2D.7 printer data 7
110 P9.0 printer control strobe
111 P9.1 printer control autofeed
112 P9.2 printer control init
113 P9.3 printer control select
114 P9.4 power button
115 P9.5 low battery
116 P9.6 +6 volt good
117 P9.7 +5 volt good
118
119
120 /int (or /nmi) modem interrupt
121
122 /int (or /nmi) callid chip interrupt
123
124 /wr
125 /rd
126 xtal2 rtc
127 xtal2
128 +5v

Unlabeled = unknown at this time

12-31-2003 06:04:34

New MessageRE:MS/Z80 hacking (modified 0 times) ThePinkPanther
Profile
U101 - RSDRD 3SI176 0A - Z80 style mcu
U202 - M5M51008-70 ----- 128 kbyte static ram (cpu data)
U203 - 28SF040-120 ----- 4 Mbit flash rom (cpu data)
U204 - 74HC245 --------- octal xcvr (cpu/modem data bus bridge)
U205 - 29F080-90 ------- 8 Mbit flash rom (cpu code)
U220 - 74HC245 --------- octal xcvr (cpu/modem control bus bridge)
U302 - 74HC74 ---------- dual D flip-flop (power on/off)
U303 - AIC1631-5 ------- dc-dc converter (battery -> 5v)
U305 - TA7806F --------- 6 volt regulator
U601 - 27C1000 --------- otp eprom (modem code)
U602 - W24257AS-35 ----- ram (modem scratchpad)
U603 - RCV336ACFW/SP --- 33.6 kbps modem
U604 - W91030S --------- caller id
12-31-2003 06:22:46

New MessageRE:MS/Z80 hacking (modified 0 times) hamilton
Profile
For those who have asked for the ROM dump.

I have created a yahoo goup to store the files involved.

Create a yahoo email account and become a member at:

http://groups.yahoo.com/group/mailstation/

Lets make this fun.


Hamilton

Opportunity is missed by most people,
Because it is dressed in overalls and looks like work.

02-08-2004 14:21:24

New MessageRE:MS/Z80 hacking (modified 0 times) whatever
Profile
Trying to hunt down the mystery processor I'm wondering about RSDRD.
Google finds very litlle on RSDRD, including:
Rsdrd Info stands for “Restricted Information”
You'd think if it was a vendor code, google would generate lots of hits. Plus it looks odd for a vendor code.

128 pin "Z80?" - wow how times have changed.

02-11-2004 22:35:21

New MessageRE:MS/Z80 hacking (modified 0 times) metalgimp
Profile
How has the 3SI176 been equated to a Z80 derivative?
Are there any documents that people have found?
I have searched as far as I can to find any information about the 3SI176.
03-08-2004 22:10:39

New MessageRE:MS/Z80 hacking (modified 0 times) metalgimp
Profile
I have been reviewing the datasheets for the flash devices. Some things don't seem to add up. There are two flash devices, one for data (28SF040) and one for code (29F080). The flash used for code (29F080, again) has negligible coding requirements and has a guaranteed 1,000,000 write lifecycle. The data flash (28SF040) uses an antiquated erase, verification, write, and re-verification algorithm and has a limited 100,000 write lifecycle.
Strangely, the 28SF040 in my MS's all come from AMD, but they don't have that device listed on their website. They do have the 29F040 which uses the same pin-out. It does not make any sense to place the code in a 1M cycle device while the data device only has spec'ed 100K cycle. Is the 28SF040 *really* a 29F040?
03-09-2004 21:59:42

New MessageRE:MS/Z80 hacking (modified 0 times) CyranoJones
Profile
The 28SF040 has 2048 sectors of 256 bytes, while the 29F080 is arranged as only 16 sectors of 65536 bytes. When you erase data in either of them, you have to erase a whole sector. So, by using the smaller sectored chip for the data, they minimize the wear when erasing small files.

Mine have SST28SF040, 4 Mbit SuperFlash EEPROM, from Silicon Storage Technology, Inc. My 29F080's are from Fujitsu.

As for docs on the CPU, I don't know of any (except for earlier in this thread). A couple of years ago, Google could find press releases that said it was a Z80, one of them on ZiLOG's website. Also, a few people have dug into the code, and they think it is a Z80. But your welcome to remain skeptical.

Badcluster is gone AFAIK, but you might like to check out http://groups.yahoo.com/group/mailstation/

03-10-2004 20:31:43

New MessageRE:MS/Z80 hacking (modified 0 times) Neil
Profile
"Also, a few people have dug into the code, and they think it is a Z80"

The code certainly looks like Z-80 and the memory map is pure Z-80. I'mm looking to see if there are 'odd' instructions.

04-14-2004 21:46:28

New MessageRE:MS/Z80 hacking (modified 0 times) mrelectronic
Profile
Hello

I think that the RSDRD could be a manufacture name and then the 3SI176 will be the component name.
It could be an ASIC produced to the mailstation. If it was a standard chip there will more information about it.

I have just bought an easicom 300 from BT (British Telecom) that has the same circuit board as the one in the pictures at the yahoo group.

Cheers
Rune

07-05-2004 03:41:06

New MessageRE:MS/Z80 hacking (modified 0 times) lorenzo
Profile
RSRD - Rabbit Semiconductor Research and Development possibly, I posted this on another area, this is probably more appropriate area, cheers.

The Blue mailstation model 150 looks like it could have a Rabbit Semiconductor 3000 microprocessor, I traced several of the necessary in-circuit programming interface pins (10 total pins) to one of the Keyboard headders and also possibly the parallel port. Looks like pin 2 and 3 on the parallel port could be TTL serial port.

The Rabbit CPU is Z80 based and alos the right pin count, I bet they are using their boot loader, if someone has desoldered the FLASH paste the first 1024 HEX bytes and the last 1024 HEX bytes and I'll verify. RS in the part number could be Rabbid semiconductor!

Get your magnifier glass out and you can read the partnumber for the LCD controller on the flex cables containing the IC for the LCD.
Good luck,

04-18-2005 15:04:24

New MessageRE:MS/Z80 hacking (modified 0 times) ganadoms
Profile
CJ said:
==
As for docs on the CPU, I don't know of any (except for earlier in this thread). A couple of years ago, Google could find press releases that said it was a Z80, one of them on ZiLOG's website. Also, a few people have dug into the code, and they think it is a Z80. But your welcome to remain skeptical.

Badcluster is gone AFAIK, but you might like to check out http://groups.yahoo.com/group/mailstation/
==
I went to the venerable Internet Archive and found a reference to 7 pages stored for Badcluster in 2001. But, not one of them showed up when I asked for a copy of them. <wah> Do tell more about Badcluster.

I looked at:
http://web.archive.org/web/*/http://www.badcluster.com


Ham Radio Talks Worldwide
Real computers have clock speeds slower than 5 MHz
05-26-2005 04:53:36

Reply to Thread | Printer |
All times are PSTPowered by UltraBoard v1.62



Copyright © 2000, Netmake Inc. All Rights Reserved.
See Terms and Conditions for more information.




i-opener opener laptop notebook computer help drivers dll free windows dos repair fix linux mac macintosh 2000 95 98 nt pc configure hardware software sound video netscape explorer network networking lan wan software cmos fat bios printer card mouse modem ide scsi cd rom controllers scanner tape hard drive cgi scripts source code mp3