Subject: PCtel 388 chipset
From: Dave Hwang <david.hwang@eng.sun.com>
Date: Mon, 24 May 1999 23:30:41 -0700 (PDT)

Hi Russell,

I'm CC'ing this reply to the discuss@linmodems.org list.

>>>>> Russell Nelson <nelson@crynwr.com> writes:

 >> They have a patent on the software UART you can find at
 >> www.uspto.gov, searching for "PCtel".

  > Ahhhh, hadn't thought of that.  I suspect that they won't have
  > enough documentation there to actually build one.  You would think
  > that that would make their patent invalid, wouldn't you?

Actually, you'd be surprised. It's very detailed, and seems to explain a 
whole lot. The patent number is: 5,787,305

A quick summary from the patent:

1. The PCtel HSP modem sits in a "predetermined" address space on the
ISA bus, supposedly accessible but out of the way (this address, I would 
probably have to diassemble the init code to find)

2. The PCtel HSP modem powers on in a locked state; with a finite state
machine waiting for the key to unlock it.

3. The host OS needs to query the 4 standard COM port addresses and find 
one that is unavailable.

4. The method of unlocking is to (according to the patent), is to send
it a sequence of bytes, supposedly random enough to prevent "accidental" 
unlocking. 

5. The patent provides as an example implementation, the unlocking
sequence of sending 5 bytes to the predetermined address: the 5 acscii
representations of "P","C","t","e","l"

6. After the proper unlocking sequence, you access the desired com
address, which the PCtel modem will latch, and set as its base adress.

7. Once the modem is unlocked, you can access its registers at the
standard COM address you've determined (0x3F8, 0x2F8, 0x3E8, or 0x2E8)

The patent also goes on to provide an example embodiment of the modem
chip's register set (could this be the 388's register set):

	Offset	Register
	0	Data register (low byte)
	1	Data register (high byte)
	2	Control/Status Register (low byte)
	3	Control/Status Register (high byte)
	4	Input/Output Port Register
	5	Reserved
	6	Reserved

as well as provide a description of their functions:

The PCtel asic seems to be pretty simple: DAC, ADC, and some line
control circuits. That's enough for me to make an answering machine,
anyway. I'm not sure how to go about figuring out what the specific 
commands are. Probably a combination of combing the .ini files for 
some clues, trial and error, and some disassembly. I'm not sure what 
the legal issues are regarding disassembly, so I'll avoid it for now
and get as much "clean room" info as possible.

The PCtel HSP modem claims to provide a standard AT command with voice
and S register interface, so hopefully some of that is actually
implemented as the 388 command set.

By the way, for those on this list in the SF Bay area: These modems are
currently on sale for $15 at Fry's Electronics (sold under the BTC
brand). 

Hope this is helpful info. 

Dave