Peripherals

The SH7305 is comprised of many different peripherals that surround a SH4a core in the SH7305. Due to a lack of known documentation, the peripherals included in the SH7305 are guessed based on similarities to other SuperH CPUs with known documentation.

Unknown Peripherals

Please document all reads/writes to unknown peripherals. This is an effort to produce documentation by analyzing their usage. Please report the address, access size in bytes, mark read and/or write, and note what the surrounding code was doing or any hypothesis about the function. Note that 0x8xxxxxxx-0x9xxxxxxx and 0xAxxxxxxx-0xBxxxxxxx addresses are identical, standardize on 0xAxxxxxxx-0xBxxxxxxx addresses.

Address	Size	Read	Write	Notes
A400 0010	4	No	Yes	Writes 4 on cold start. Later, reads it, then writes 0x808 and 0.
A400 001C	4	Yes	Yes	Writes 0x800 on cold start
A400 0024	4	Yes	No
A42F 0004	4	No	Yes	Right after reading BSC, before reading/write to A400001C
A405 0184	2	No	Yes	Writes 0x9554 on cold start. Order for next 3: ...86, ...88, ...8A, ...84. This overlaps with the SH7724's PFC's PULCR (pullup control register), but most likely not the same.
A405 0186	2	No	Yes	Writes 0x5555 on cold start. Overlaps with the SH7724's PFC
A405 0188	2	No	Yes	Writes 0x5555 on cold start. Overlaps with the SH7724's PFC
A405 018A	2	No	Yes	Writes 0x5515 on cold start. Overlaps with the SH7724's PFC
A408 0008	2	Yes	Yes	Reads and writes 0 back.
A408 008C	1	No	Yes	Writes 0xC
A415 0014	4	Yes	Yes	Writes 0x100. This occurs in a block of writing 0x100 to A415 003C and A415 0008 (CPG-related).
A44D 00D0	1	No	Yes	Initialized to 0x01 in a large peripheral init block
A44D 00D4	4	No	Yes	Initialized to 0xFFFFFFFF in a large peripheral init block
A44D 00D8	4	No	Yes	Initialized to 0xFFFFFFFF in a large peripheral init block
A44D 00DC	1	No	Yes	Initialized to 0x0 in a large peripheral init block
FEC1 5040	2	Yes	No	Reads on boot in a BSC-reading block. If this is the SH7730, then it read 2 bytes in a write-only 4-byte SDRAM mode register.
FE20 0000	4	Yes	Yes	This is the base of a memory block from 0xFE200000 to 0xFE227FFF (160KB). Bootloader copies... something from high to lower, whole address range.
FE24 0000	4	Yes	Yes	This is the base of a memory block from 0xFE240000 to 0xFE269FFF (168KB). Bootloader copies... something from high to lower, whole address range.
FE28 0000	4	Yes	Yes	This is the base of a memory block from 0xFE280000 to 0xFE28BFFF (176KB). Bootloader copies... something from high to lower, whole address range.
FE30 0000	4	Yes	Yes	This is the base of another memory block from 0xFE300000 to 0xFE327FFF (160KB). Also has something copied high to low right after the 0xFE200000 copy.
FE34 0000	4	Yes	Yes	This is the base of another memory block from 0xFE340000 to 0xFE369FFF (168KB). Also has something copied high to low right after the 0xFE240000 copy.
FE38 0000	4	Yes	Yes	This is the base of another memory block from 0xFE380000 to 0xFE38BFFF (176KB). Also has something copied high to low right after the 0xFE280000 copy. (0xBC000 bytes/752KB total above!!!)

Peripherals List

List of peripherals that match documentation

Name	SH Core	Base Address	Verified	Emulated	Notes
BSC	SH7730	FEC1 0000	Partial	No	Assumed to be SH7724 before, register accesses match up with SH7730, maybe others. See FEC1 5040 in table above, oddity.
RTC	SH7720	A413 FEC0	Yes	Partial	I've tested this, from Simon's docs
RWDT	SH7724	A452 0000	No	No	Matches the documentation
CPG	SH7724	A415 0000	Yes	Partial	It is mostly understood, but there are still hardware quirks that make using this "tricky".
CMT	SH7724 SH7730	A44A 0000	Yes	No	There are OS syscalls for interfacing with the CMT.
PFC	Unknown	A405 0100	Partial	No	See above table for unknown accesses in the PFC.
FSI	SH7724	FE3C 0000	No	No	This is just a guess on what matched, bootloader writes to the CLK_RST, SOFT_RST with valid values that match what it should be doing to initialize the peripheral. Note, this is a sound I/O interface, a peripheral of the SPU2 (sound processing unit 2) audio processing circuit. There is no indication yet if the SPU2 is present. If this is present, then there will be 2 DSPs included in the die for audio decoding. Documentation is under an NDA, however Linux kernel code exists to interface with this module. (Only thing I can think of that would use this is serial transfers, but that seems wrong).
INTC	SH7724	A408 0000	Yes	No	Interrupt controller form simon's docs, USB is on INT 9.
DMAC	SH7724	FE00 0820	Yes	No	From simon's docs.

Peripherals on Cold Start

• (SH7724) STBCR <- 0 (Standby control)
• (SH7724) MSTPCR0 <- 0 (module stop 0)
• (SH7724) MSTPCR0 <- 0xFFFFFFFF (module stop 2)
• <snip>
• Watchdog timer is disabled, counter set to 0, and sets the WDT clock to Rφ/64, or 500ms
• Busy-loop waiting for the R64CNT register to hit != 0. (Verify it wants != 0)

(TODO)