On-Chip Peripherals

The SH7305 is comprised of many different peripherals that surround a SH4a core in the SH7305. Due to a lack of known documentation, the peripherals included in the SH7305 are guessed based on similarities to other SuperH CPUs with known documentation.

Unknown Peripherals #

Please document all reads/writes to unknown peripherals. This is an effort to produce documentation by analyzing their usage. Please report the address, access size in bytes, mark read and/or write, and note what the surrounding code was doing or any hypothesis about the function. Note that 0x8xxxxxxx-0x9xxxxxxx and 0xAxxxxxxx-0xBxxxxxxx addresses are identical, standardize on 0xAxxxxxxx-0xBxxxxxxx addresses.

Address Size Read Write Notes
A400 0010 4 🔴 🔵 Writes 4 on cold start. Later, reads it, then writes 0x808 and 0.
A400 001C 4 🔵 🔵 Writes 0x800 on cold start
A400 0024 4 🔵 🔴
A42F 0004 4 🔴 🔵 Right after reading BSC, before reading/write to A400001C
A405 0184 2 🔴 🔵 Writes 0x9554 on cold start. Order for next 3: …86, …88, …8A, …84. This overlaps with the SH7724’s PFC’s PULCR (pullup control register), but most likely not the same.
A405 0186 2 🔴 🔵 Writes 0x5555 on cold start. Overlaps with the SH7724’s PFC
A405 0188 2 🔴 🔵 Writes 0x5555 on cold start. Overlaps with the SH7724’s PFC
A405 018A 2 🔴 🔵 Writes 0x5515 on cold start. Overlaps with the SH7724’s PFC
A408 0008 2 🔵 🔵 Reads and writes 0 back.
A408 008C 1 🔴 🔵 Writes 0xC
A415 0014 4 🔵 🔵 Writes 0x100. This occurs in a block of writing 0x100 to A415 003C and A415 0008 (CPG-related).
A44D 00D0 1 🔴 🔵 Initialized to 0x01 in a large peripheral init block
A44D 00D4 4 🔴 🔵 Initialized to 0xFFFFFFFF in a large peripheral init block
A44D 00D8 4 🔴 🔵 Initialized to 0xFFFFFFFF in a large peripheral init block
A44D 00DC 1 🔴 🔵 Initialized to 0x0 in a large peripheral init block
FEC1 5040 2 🔵 🔴 Reads on boot in a BSC-reading block. If this is the SH7730, then it read 2 bytes in a write-only 4-byte SDRAM mode register.
FE20 0000 4 🔵 🔵 This is the base of a memory block from 0xFE200000 to 0xFE227FFF (160KB). Bootloader copies… something from high to lower, whole address range.
FE24 0000 4 🔵 🔵 This is the base of a memory block from 0xFE240000 to 0xFE269FFF (168KB). Bootloader copies… something from high to lower, whole address range.
FE28 0000 4 🔵 🔵 This is the base of a memory block from 0xFE280000 to 0xFE28BFFF (176KB). Bootloader copies… something from high to lower, whole address range.
FE30 0000 4 🔵 🔵 This is the base of another memory block from 0xFE300000 to 0xFE327FFF (160KB). Also has something copied high to low right after the 0xFE200000 copy.
FE34 0000 4 🔵 🔵 This is the base of another memory block from 0xFE340000 to 0xFE369FFF (168KB). Also has something copied high to low right after the 0xFE240000 copy.
FE38 0000 4 🔵 🔵 This is the base of another memory block from 0xFE380000 to 0xFE38BFFF (176KB). Also has something copied high to low right after the 0xFE280000 copy. (0xBC000 bytes/752KB total above

Peripherals List #

List of peripherals that match documentation

Name

SH Core

Base Address

Verified

Emulated

Notes

BSC

SH7730

FEC1 0048

:white_circle:

:red_circle:

Assumed to be SH7724 before, register accesses match up with SH7730, maybe others. See FEC1 5040 in table above, oddity.

RTC

SH7720

A413 FEC0

:large_blue_circle:

:white_circle:

I've tested this, from Simon's docs

RWDT

SH7724

A452 0000

:red_circle:

:red_circle:

Matches the documentation

CPG

SH7724

A415 0000

:large_blue_circle:

:white_circle:

It is mostly understood, but there are still hardware quirks that make using this "tricky".

CMT

SH7724
SH7730

A44A 0000

:large_blue_circle:

:large_blue_circle:

There are OS syscalls for interfacing with the CMT.

PFC

Unknown

A405 0100

:white_circle:

:red_circle:

See above table for unknown accesses in the PFC.

FSI

SH7724

FE3C 0000

:red_circle:

:red_circle:

This is just a guess on what matched, bootloader writes to the CLK_RST, SOFT_RST with valid values that match what it should be doing to initialize the peripheral. Note, this is a sound I/O interface, a peripheral of the SPU2 (sound processing unit 2) audio processing circuit. There is no indication yet if the SPU2 is present. If this is present, then there will be 2 DSPs included in the die for audio decoding. Documentation is under an NDA, however Linux kernel code exists to interface with this module. (Only thing I can think of that would use this is serial transfers, but that seems wrong).

INTC

SH7724

A408 0000

:large_blue_circle:

:red_circle:

Interrupt controller form simon's docs, USB is on INT 9.

DMAC

SH7724

FE00 8020

:large_blue_circle:

:red_circle:

From simon's docs.

UBC

SH?????

FF20 0000

:large_blue_circle:

:red_circle:

Simon has knowledge on this

H-UDI

SH????

FC11 0000

:red_circle:

:red_circle:

No pins from this have been found on the Prizm PCB yet

SPU2

SH7724

FE2F FC00

:large_blue_circle:

:red_circle:

Official emulator has this, FSI was detected on hardware

FSI

SH7724

FE3C 0000

:large_blue_circle:

:red_circle:

FSI detected

DSP0

SH7724?

FE2F FD00

:large_blue_circle:

:red_circle:

Official emulator has this

DSP1

SH7724?

FE3F FD00

:large_blue_circle:

:red_circle:

Official emulator has this

Key Interface Unit

SH????

A44B 0000

:large_blue_circle:

:red_circle:

Official emulator has this

Peripherals on Cold Start #

  • (SH7724) STBCR <- 0 (Standby control)
  • (SH7724) MSTPCR0 <- 0 (module stop 0)
  • (SH7724) MSTPCR0 <- 0xFFFFFFFF (module stop 2)
  • <snip>
  • Watchdog timer is disabled, counter set to 0, and sets the WDT clock to Rφ/64, or 500ms
  • Busy-loop waiting for the R64CNT register to hit != 0. (Verify it wants != 0)

(TODO)

Calendar January 17, 2023
Edit Edit this page