Peripherals

From WikiPrizm
Revision as of 20:29, 15 February 2015 by Ahelper (talk | contribs) (Added some additional peripherals, needs info to be filled in)
Jump to navigationJump to search

The SH7305 is comprised of many different peripherals that surround a SH4a core in the SH7305. Due to a lack of known documentation, the peripherals included in the SH7305 are guessed based on similarities to other SuperH CPUs with known documentation.

Unknown Peripherals

Please document all reads/writes to unknown peripherals. This is an effort to produce documentation by analyzing their usage. Please report the address, access size in bytes, mark read and/or write, and note what the surrounding code was doing or any hypothesis about the function. Note that 0x8xxxxxxx-0x9xxxxxxx and 0xAxxxxxxx-0xBxxxxxxx addresses are identical, standardize on 0xAxxxxxxx-0xBxxxxxxx addresses.

Address Size Read Write Notes
A400 0010 4 No Yes Writes 4 on cold start. Later, reads it, then writes 0x808 and 0.
A400 001C 4 Yes Yes Writes 0x800 on cold start
A400 0024 4 Yes No
A42F 0004 4 No Yes Right after reading BSC, before reading/write to A400001C
A405 0184 2 No Yes Writes 0x9554 on cold start. Order for next 3: ...86, ...88, ...8A, ...84. This overlaps with the SH7724's PFC's PULCR (pullup control register), but most likely not the same.
A405 0186 2 No Yes Writes 0x5555 on cold start. Overlaps with the SH7724's PFC
A405 0188 2 No Yes Writes 0x5555 on cold start. Overlaps with the SH7724's PFC
A405 018A 2 No Yes Writes 0x5515 on cold start. Overlaps with the SH7724's PFC
A408 0008 2 Yes Yes Reads and writes 0 back.
A408 008C 1 No Yes Writes 0xC
A415 0014 4 Yes Yes Writes 0x100. This occurs in a block of writing 0x100 to A415 003C and A415 0008 (CPG-related).
A44D 00D0 1 No Yes Initialized to 0x01 in a large peripheral init block
A44D 00D4 4 No Yes Initialized to 0xFFFFFFFF in a large peripheral init block
A44D 00D8 4 No Yes Initialized to 0xFFFFFFFF in a large peripheral init block
A44D 00DC 1 No Yes Initialized to 0x0 in a large peripheral init block
FEC1 5040 2 Yes No Reads on boot in a BSC-reading block. If this is the SH7730, then it read 2 bytes in a write-only 4-byte SDRAM mode register.
FE20 0000 4 Yes Yes This is the base of a memory block from 0xFE200000 to 0xFE227FFF (160KB). Bootloader copies... something from high to lower, whole address range.
FE24 0000 4 Yes Yes This is the base of a memory block from 0xFE240000 to 0xFE269FFF (168KB). Bootloader copies... something from high to lower, whole address range.
FE28 0000 4 Yes Yes This is the base of a memory block from 0xFE280000 to 0xFE28BFFF (176KB). Bootloader copies... something from high to lower, whole address range.
FE30 0000 4 Yes Yes This is the base of another memory block from 0xFE300000 to 0xFE327FFF (160KB). Also has something copied high to low right after the 0xFE200000 copy.
FE34 0000 4 Yes Yes This is the base of another memory block from 0xFE340000 to 0xFE369FFF (168KB). Also has something copied high to low right after the 0xFE240000 copy.
FE38 0000 4 Yes Yes This is the base of another memory block from 0xFE380000 to 0xFE38BFFF (176KB). Also has something copied high to low right after the 0xFE280000 copy. (0xBC000 bytes/752KB total above!!!)

Peripherals List

List of peripherals that match documentation

Name SH Core Base Address Verified Emulated Notes
BSC SH7730 FEC1 0000 Partial No Assumed to be SH7724 before, register accesses match up with SH7730, maybe others. See FEC1 5040 in table above, oddity.
RTC SH7720 A413 FEC0 Yes Partial I've tested this, from Simon's docs
RWDT SH7724 A452 0000 No No Matches the documentation
CPG SH7724 A415 0000 Yes Partial It is mostly understood, but there are still hardware quirks that make using this "tricky".
CMT SH7724
SH7730
A44A 0000 Yes Yes There are OS syscalls for interfacing with the CMT.
PFC Unknown A405 0100 Partial No See above table for unknown accesses in the PFC.
FSI SH7724 FE3C 0000 No No This is just a guess on what matched, bootloader writes to the CLK_RST, SOFT_RST with valid values that match what it should be doing to initialize the peripheral. Note, this is a sound I/O interface, a peripheral of the SPU2 (sound processing unit 2) audio processing circuit. There is no indication yet if the SPU2 is present. If this is present, then there will be 2 DSPs included in the die for audio decoding. Documentation is under an NDA, however Linux kernel code exists to interface with this module. (Only thing I can think of that would use this is serial transfers, but that seems wrong).
INTC SH7724 A408 0000 Yes No Interrupt controller form simon's docs, USB is on INT 9.
DMAC SH7724 FE00 0820 Yes No From simon's docs.
UBC SH????? ???? ???? Yes No Simon has knowledge on this
H-UDI SH???? ???? ???? No No No pins from this have been found on the Prizm PCB yet
SPU2 SH7724 ---- ---- Yes No Official emulator has this, FSI was detected on hardware
FSI SH7724 ???? ???? Yes No FSI detected
DSP0 SH7724? ???? ???? Yes No Official emulator has this
DSP1 SH7724? ???? ???? Yes No Official emulator has this
Key Interface Unit SH???? ???? ???? Yes No Official emulator has this

Peripherals on Cold Start

  • (SH7724) STBCR <- 0 (Standby control)
  • (SH7724) MSTPCR0 <- 0 (module stop 0)
  • (SH7724) MSTPCR0 <- 0xFFFFFFFF (module stop 2)
  • <snip>
  • Watchdog timer is disabled, counter set to 0, and sets the WDT clock to Rφ/64, or 500ms
  • Busy-loop waiting for the R64CNT register to hit != 0. (Verify it wants != 0)

(TODO)