Register

Using SH7305 peripheral modules

Discuss anything related to calculators. For specific help on certain games/programs check the Released Projects subforum.
Junior Member
User avatar
Posts: 17
Joined: Fri Aug 21, 2015 11:54 am
Calculators: Casio fx-9860G, Casio fx-9860 GII

Using SH7305 peripheral modules

Postby lephe » Fri Aug 21, 2015 2:35 pm

Hello everyone,
I'm very new to Casiopeia though I'm known as a moderator on Planète Casio.

As a personal challenge I have written a proper gray engine that runs on the top of my interrupt handler ; it works well and I'd like to port it to fx-9860G II SH4 calculators.

For now I've been working with the documentation of MPU SH7705, and it worked perfectly. While looking over the forums to find which MPU new models used, I found some information given by Simon Lothar :

- SH7305 is Fx9860GII SH4
- SH7337 is Fx9860G SH3
- SH7355 is Fx9860GII SH3


But so far, SH7305 doesn't seem to exist. I didn't found a single reference on the Internet, except on Casio programming websites. The same goes for the two others.

Therefore, my first question is : what are these MPUs ?

What I exactly need is to use the timer unit. Of all the documentation gathered by TeamFX, SH-4A-based MPUs use the same addresses for timer registers, but a test revealed that 32-bit readable/writable registers, particularly TCOR_0 (TCOR0_0 on SH7724) weren't accessible.

I had a look at FTune2's sources, which is said to work for SH7305, but it was indicated that SH7724's information was used. Finally, I found a 7305.h header on Casiopeia but the timer unit structures used the same addresses that other SH-4A-base MPUs.

That's why my second question is : where is the SH7305 timer unit located ?

FWIW, I have tested addresses of all MPUs in TeamFX documentation but no one matched the calculator reading/writing possibilities.

Any help would be appreciated.

Senior Member
User avatar
Posts: 584
Joined: Sat Sep 15, 2012 6:59 am
Location: Krautland ****
Calculators: Casio fx-7400GII, Casio fx-7400GII (SH4), Casio fx-9750 G II, Casio fx-9750 G II (SH4), Casio fx-9860G, Casio fx-9860 G SD, Casio fx-9860G Slim, Casio fx-9860 GII SD, Casio fx-9860 GII SD Power Graphic 2, Casio Classpad 330 plus, Casio fx-CG 20, Casio Classpad fx-cp400, Casio fx-CG 50

Re: Using SH7305 peripheral modules

Postby SimonLothar » Fri Aug 21, 2015 3:53 pm

SH7305, SH7337 and SH7355 are customized MPUs. The manuals are under non-disclosure agreement. I'd be very surprised, if you get hold of some of these.
SH7705 is the nearest match to the SH7337 and SH7355.
SH7724 is the nearest match to the SH7305.

I had a look at fx_calculators_SuperH_based.chm.
According to this the TMU-base address of the SH7305 is 0xA4490004. I found this some time ago (about 2011). Usually I'd consider me reliable. But you never can tell. I did not verify it today.
If you should check the address and find it to be valid, let us know.
I'll be back!

Senior Member
Posts: 97
Joined: Sun Mar 24, 2013 12:01 pm
Calculators: None

Re: Using SH7305 peripheral modules

Postby TeamFX » Sat Aug 22, 2015 11:53 am

Don't forget the SH7291 which is used in the ClassPad 300/300+/330 and the PV-S1600. This MPU is also based on the SH7705 design.

Regarding the SH7305 TMU, the following code is used in syscall 0x420:
Code: Select all
wait_ms:
    sts.l   macl, @-r15
    sts.l   mach, @-r15
    shll    r4
    tst     r4, r4
    bt      wait_2
    mov.w   #h'FA0, r2
    cmp/hi  r2, r4
    bt      wait_2
    mov.l   #h'F4240, r1
    mov     #h'FFFFFFF2, r5
    mov     #h'FFFFFFFF, r7
    mul.l   r4, r1
    sts     macl, r1
    mov.l   #h'78C06387, r4
    dmulu.l r1, r4
    sts     mach, r6
    shld    r5, r6
    mov.l   #h'A4490004, r5         ; TSTR0
    mov.l   r7, @(h'1C,r5)          ; TCOR0_2
    mov.l   r7, @(h'20,r5)          ; TCNT0_2
    mov.b   @r5, r0
    or      #4, r0
    mov.b   r0, @r5

wait_1:
    mov.l   @(h'20,r5), r2
    not     r2, r2
    cmp/hs  r6, r2
    bf      wait_1
    mov.b   @r5, r0
    and     #h'FB, r0
    mov.b   r0, @r5

wait_2:
    lds.l   @r15+, mach
    rts
    lds.l   @r15+, macl

Junior Member
User avatar
Posts: 17
Joined: Fri Aug 21, 2015 11:54 am
Calculators: Casio fx-9860G, Casio fx-9860 GII

Re: Using SH7305 peripheral modules

Postby lephe » Sun Aug 23, 2015 7:37 pm

SimonLothar wrote:SH7305, SH7337 and SH7355 are customized MPUs. The manuals are under non-disclosure agreement. I'd be very surprised, if you get hold of some of these.

I see. This explains that I couldn't find anything.
But... wait, how do you know that ? x)

SimonLothar wrote:According to this the TMU-base address of the SH7305 is 0xA4490004.

Thanks :D
By the way, could you confirm that the online version of this documentation (on media.taricorp.net) is up-to-date and contains all the chm information ?

SimonLothar wrote:If you should check the address and find it to be valid, let us know.

Sure. I'm planning to gather as much interesting information as possible on MPUs, though I doubt there's anything TeamFX hasn't found yet.

TeamFX wrote:Don't forget the SH7291 which is used in the ClassPad 300/300+/330 and the PV-S1600. This MPU is also based on the SH7705 design.

Are these MPUs are modified by Casio ? Is there any technical interest or is it just to prevent programmers from using low-level functionalities ?

TeamFX wrote:Regarding the SH7305 TMU, the following code is used in syscall 0x420:

I've been looking at some point to disassemble syscalls but it ended up way more complicated than I thought. ^^
May you explain me quickly how do you get the source ?

Thanks for this help :)

Senior Member
Posts: 97
Joined: Sun Mar 24, 2013 12:01 pm
Calculators: None

Re: Using SH7305 peripheral modules

Postby TeamFX » Sun Aug 23, 2015 9:13 pm

Are these MPUs modified by Casio?

I guess, Casio just tells Renesas what they would like to have and Renesas produces the custom MPU.

Is there any technical interest or is it just to prevent programmers from using low-level functionalities?

The processors' peripheral modules are changed and extended and sometimes there are new modules added. E.g., the SH7291 processor does not have an SD card interface.

May you explain me quickly how do you get the source?

Copied it from my IDA database...

Here are a few instructions:
- go to address 0x80010070, 0xA0010070 or 0x00010070
(depends on where your OS code segment starts)
- there is a dword entry located at offset 0x0001007C
- this entry denotes the address of the syscall table
- in OS 2.04.0201 (SH-4A) this value is 0x801C7D88
- now calculate: 0x420 * 4 + 0x801C7D88 = 0x801C8E08
- go to address 0x801C8E08, 0xA01C8E08 or 0x001C8E08
- it is good to use the hex-view tab here
- copy the function pointer from this address which is 0x800664A8
- 0x800664A8 is the location of syscall 0x420
Last edited by TeamFX on Tue Aug 25, 2015 11:46 am, edited 1 time in total.

Junior Member
User avatar
Posts: 17
Joined: Fri Aug 21, 2015 11:54 am
Calculators: Casio fx-9860G, Casio fx-9860 GII

Re: Using SH7305 peripheral modules

Postby lephe » Mon Aug 24, 2015 8:07 pm

SimonLothar wrote:If you should check the address and find it to be valid, let us know.

It is valid. That's a good new to me, as I should now be able to get my gray engine working.

TeamFX wrote:- go to address 0x80010070, 0xA0010070 or 0x00010070
(depends on where your OS code segment starts)
- there is a dword entry that contains the address of the syscall table

I used an .fls file generated with fxRemote, supposing that it was a dump of storage memory at 0xa000'0000, but at offset 0x10070 I had address 0xd202'4008 which doesn't seem to be valid. At offset 0x1007c I have address 0x801c'dd84 but I don't think I am looking at the right position.
Is it right to use such a file ?


Additionally... I have some difficulties trying to handle the keyboard. Indeed, I can't use the bare keyboard interrupts since interrupts are continuously generated until the pressed key is released (preventing user program execution). Therefore, I was using a timer and regularly checking if a key was pressed.

This worked well, but I had to use syscall 0x24a to detect the pressed key since Simon Lothar's method, using CheckKeyRow() (found at the end of this page) did not work properly. And under SH7305-based systems, this syscall enables KEYSC interrupts, which were disabled at initialization because I can't handle them : KEYSC addresses in the SH7724 aren't valid.

That's why I'm asking, just in case : do you know where the KEYSC interface is located ?

About CheckKeyRow() function, what happens is that if I use it to check which key is pressed, it prevents further keyboard interrupts generation. To be exact : if I analyze several rows using CheckKeyRow(), once the analysis is done, keyboard interrupts will only be triggered if the pressed key is on the last analyzed row.
For instance, if I analyze rows 8 to 0, then further key presses will only be detected on keys F1 to F6. And if I reverse the order, only keys 0 to EXE will work.
I thought that just calling CheckKeyRow() caused the problem, but my function analyzed the full keyboard whenever it received a keyboard interrupt. Therefore, full analyses were done several times before the first key was released (since interrupts are continuously generated when holding a key pressed). In other words, CheckKeyRow() worked well several times, and stopped working when the first pressed key was released.

If you have any information on such a behavior, please tell me.

Senior Member
Posts: 97
Joined: Sun Mar 24, 2013 12:01 pm
Calculators: None

Re: Using SH7305 peripheral modules

Postby TeamFX » Tue Aug 25, 2015 11:42 am

lephe wrote:I used an .fls file generated with fxRemote, supposing that it was a dump of storage memory at 0xa000'0000, but at offset 0x10070 I had address 0xd202'4008 which doesn't seem to be valid. At offset 0x1007c I have address 0x801c'dd84 but I don't think I am looking at the right position.

The address of the syscall table is located at offset 0x0001007C. This offset is the same for all fx-9860G OS releases.

Is it right to use such a file?

If you want to copy or change some bytes and know where they are, then you can use a hex editor.

Junior Member
User avatar
Posts: 17
Joined: Fri Aug 21, 2015 11:54 am
Calculators: Casio fx-9860G, Casio fx-9860 GII

Re: Using SH7305 peripheral modules

Postby lephe » Tue Aug 25, 2015 11:57 am

TeamFX wrote:The address of the syscall table is located at offset 0x0001007C.
This offset is the same for all fx-9860G OS releases.

Thanks ! I've been able to extract the same first bytes you disassembled before.

BTW, is there a simple way to detect a syscall end (for instance, syscall n ends where syscall n+1 begins) ? I'm planning to automatically extract them all from an SH7305 OS in order to find addresses that are different from the SH7724.

Senior Member
Posts: 97
Joined: Sun Mar 24, 2013 12:01 pm
Calculators: None

Re: Using SH7305 peripheral modules

Postby TeamFX » Tue Aug 25, 2015 2:09 pm

There is no easy way to detect a syscall's end without using IDA. This is something that needs IDC scripting to reliably work.

Junior Member
Posts: 7
Joined: Sat Sep 13, 2014 6:11 pm
Calculators: Casio fx-9860 GII, Casio fx-CG 20

Re: Using SH7305 peripheral modules

Postby -florian66- » Thu Aug 27, 2015 12:20 pm

Hi all, like lephé, I'm on Planete Casio and I try to use SCIF but it doesn't work :(

Howerver I looked for the port F and do all the things to unlock the serial port but doesn't work again
There's no bug ...

I'd like to know if the adress from SH7724 (SCIF0 -> 0xFFE00000) are the same for SH4A ;)

Thanks
A new people on this site !!

Next

Return to General

Who is online

Users browsing this forum: No registered users and 9 guests