Information obtained by analyzing CPU73050.dll (DRAFT!)
- "USB address": 0xA4D80050
- "USB request type": 0xA4D80054
- "USB request value": 0xA4D80056
- "USB request index": 0xA4D80058
- "USB request length": 0xA4D8005A
- "USB power control": 0xA40501D4
- "USB receive data": 0xA0010006 (???)
- "USB power supply detection": 0xA0010001 (???)
- "USB transmit data": 0xA0010006 (???)
I have not verified any of these, and the last three seem to fall in the middle of the flash?
- Do those addresses match any known SuperH USB peripheral? Not sure what to say about the addresses in flash. Maybe addresses are stored there?
- Ahelper (talk) 19:29, 15 February 2015 (EST)
- I don't have all the manuals of the SH chips to compare. The addresses that match the flash area aren't really the USB addresses; it appears they are some special case that is encoded differently in the DLL (unfortunately, this is the case for many peripherals). If you look carefully, you'll see the RX data address I listed is the same as the TX data address...
- --Gbl08ma (talk) 15:29, 16 February 2015 (EST)
PFC information from the same DLL:
- PACR - "Port A Control": 0xA4050100 (matches SH7724)
- PBCR - "Port B Control": 0xA4050102 (matches SH7724)
... Port * Control registers match SH7724 up to V (inclusive). The SH7305 doesn't appear to have more ports after Port V.
- PADR - "Port A data": 0xA4050120 (matches SH7724)
... Port * data registers match SH7724 up to N (inclusive). Then there's:
- PPDR - "Port P data": 0xA405016A (doesn't exist on SH7724)
PQDR and the ones that follow up to PVDR (inclusive) match the SH7724.
- PSELA - "Pin group A select": 0xA405014E (matches SH7724)
... match SH7724 ...
- PSELE - "Pin group E select": 0xA405014E (matches SH7724)
- PSELF - "Pin group F select": 0xA405015E (doesn't exist on SH7724)
- PSELG - "Pin group G select": 0xA40501C8 (doesn't exist on SH7724)
- PSELH - "Pin group H select": 0xA40501D6 (doesn't exist on SH7724)
- HIZCRA - "Data pin Hi-Z control A": 0xA4050158 (matches SH7724)
- HIZCRB - "Data pin Hi-Z control B": 0xA405015A (matches SH7724)
- HIZCRC - "Data pin Hi-Z control C": 0xA405015C (matches SH7724)
The SH7305 doesn't appear to have HIZCRD, unlike the SH7724.
- MSELCRA - "Module function select A": 0xA4050180 (matches SH7724)
- MSELCRB - "Module function select B": 0xA4050182 (matches SH7724)
- DRVCRA - "Buffer drive control A": 0xA4050186 (doesn't match SH7724)
- DRVCRB - "Buffer drive control B": 0xA4050188 (doesn't match SH7724)
- DRVCRC - "Buffer drive control C": 0xA405018A (doesn't match SH7724)
- DRVCRD - "Buffer drive control D": 0xA4050184 (doesn't exist on SH7724)
- PULCRBSC - "BSC pull-up/down control": 0xA40501C3 (doesn't exist on SH7724)
- PULCRTRST - "TRST pull-up/down select": 0xA40501C5 (doesn't exist on SH7724)
None of the following appear to exist on the SH7724:
- PULCRA - "Port A pull-up/down control": 0xA4050190
- PULCRB - "Port B pull-up/down control": 0xA4050191
- PULCRC - "Port C pull-up/down control": 0xA4050192
... Add 1 to get pull-up/down control addresses (note that PULCRI doesn't exist), up to:
- PULCRN - "Port N pull-up/down control": 0xA405019C
- PULCRP - "Port P pull-up/down control": 0xA40501C6
- PULCRQ - "Port Q pull-up/down control": 0xA405019D
- PULCRR - "Port R pull-up/down control": 0xA405019E
- PULCRS - "Port S pull-up/down control": 0xA405019F
- PULCRT - "Port T pull-up/down control": 0xA40501C0
- PULCRU - "Port U pull-up/down control": 0xA40501C1
- PULCRV - "Port V pull-up/down control": 0xA40501C2
Apparently this is very different from the PFC on the SH7724; I don't know if there's another chip that matches the SH7305 more closely in this aspect. I couldn't find a direct equivalent to PULCR. At least we now know what those addresses the bootloader accesses mean. --Gbl08ma (talk) 15:23, 16 February 2015 (EST)
- At this point, there may be another PFC in a SuperH CPU that's at different addresses but has the same registers. Will have to look for that
- Ahelper (talk) 11:16, 17 February 2015 (EST)
- While it's possible that this is just a PFC from another SH CPU at a different address with minor modifications, IMO the address inconsistencies point to "patch work" (i.e., they took a PFC from a base model, made a lot of modifications to match their needs). I hope I'm wrong. The SH7305 also contains some Casio-specific modules (that go by the name "Cmod" and "Cmod2A") and nobody knows exactly what they are for. Fortunately, at least the Cmod2A module doesn't seem to be used at all on the Prizm.
- --Gbl08ma (talk) 11:25, 17 February 2015 (EST)