From WikiPrizm
Revision as of 04:11, 11 February 2015 by Ahelper (talk | contribs) (Odd memory? Or some peripheral?)
Jump to navigationJump to search

The SH7305 is comprised of many different peripherals that surround a SH4a core in the SH7305. Due to a lack of known documentation, the peripherals included in the SH7305 are guessed based on similarities to other SuperH CPUs with known documentation.

Unknown Peripherals

Please document all reads/writes to unknown peripherals. This is an effort to produce documentation by analyzing their usage. Please report the address, access size in bytes, mark read and/or write, and note what the surrounding code was doing or any hypothesis about the function. Note that 0x8xxxxxxx-0x9xxxxxxx and 0xAxxxxxxx-0xBxxxxxxx addresses are identical, standardize on 0xAxxxxxxx-0xBxxxxxxx addresses.

Address Size Read Write Notes
A400 0010 4 No Yes Writes 4 on cold start. Later, reads it, then writes 0x808 and 0.
A400 001C 4 Yes Yes Writes 0x800 on cold start
A400 0024 4 Yes No
A42F 0004 4 No Yes Right after reading BSC, before reading/write to A400001C
A405 0184 2 No Yes Writes 0x9554 on cold start. Order for next 3: ...86, ...88, ...8A, ...84. This overlaps with the SH7724's PFC's PULCR (pullup control register), but most likely not the same.
A405 0186 2 No Yes Writes 0x5555 on cold start. Overlaps with the SH7724's PFC
A405 0188 2 No Yes Writes 0x5555 on cold start. Overlaps with the SH7724's PFC
A405 018A 2 No Yes Writes 0x5515 on cold start. Overlaps with the SH7724's PFC
A408 0008 2 Yes Yes Reads and writes 0 back.
A408 008C 1 No Yes Writes 0xC
FEC1 5040 2 Yes No Reads on boot in a BSC-reading block. If this is the SH7730, then it read 2 bytes in a write-only 4-byte SDRAM mode register.
FE20 0000 4 Yes Yes This is the base of a memory block from 0xFE200000 to 0xFE227FFF (160KB). Bootloader copies... something from high to lower, whole address range.
FE30 0000 4 Yes Yes This is the base of another memory block from 0xFE300000 to 0xFE327FFF (160KB). Also has something copied high to low right after the 0xFE200000 copy.

Peripherals List

List of peripherals that match documentation

Name SH Core Base Address Verified Emulated Notes
BSC SH7730 FEC1 0000 Partial No Assumed to be SH7724 before, register accesses match up with SH7730, maybe others. See FEC1 5040 in table above, oddity.
RTC SH7720 A413 FEC0 Yes Partial I've tested this, from Simon's docs
RWDT SH7724 A452 0000 No No Matches the documentation
CPG SH7724 A415 0000 Yes Partial It is mostly understood, but there are still hardware quirks that make using this "tricky".
CMT SH7724
A44A 0000 Yes No There are OS syscalls for interfacing with the CMT.
PFC Unknown A405 0100 Partial No See above table for unknown accesses in the PFC.
FSI SH7724 FE3C 0000 No No This is just a guess on what matched, bootloader writes to the CLK_RST, SOFT_RST with valid values that match what it should be doing to initialize the peripheral. Note, this is a sound I/O interface, a peripheral of the SPU2 (sound processing unit 2) audio processing circuit. There is no indication yet if the SPU2 is present. If this is present, then there will be 2 DSPs included in the die for audio decoding. Documentation is under an NDA, however Linux kernel code exists to interface with this module. (Only thing I can think of that would use this is serial transfers, but that seems wrong).

Peripherals on Cold Start

  • (SH7724) STBCR <- 0 (Standby control)
  • (SH7724) MSTPCR0 <- 0 (module stop 0)
  • (SH7724) MSTPCR0 <- 0xFFFFFFFF (module stop 2)
  • <snip>
  • Watchdog timer is disabled, counter set to 0, and sets the WDT clock to Rφ/64, or 500ms
  • Busy-loop waiting for the R64CNT register to hit != 0. (Verify it wants != 0)