Using SH7305 peripheral modules

[lephe Profile]

Hello everyone,
I'm very new to Casiopeia though I'm known as a moderator on Planète Casio.

As a personal challenge I have written a proper gray engine that runs on the top of my interrupt handler ; it works well and I'd like to port it to fx-9860G II SH4 calculators.

For now I've been working with the documentation of MPU SH7705, and it worked perfectly. While looking over the forums to find which MPU new models used, I found some information given by Simon Lothar :

- SH7305 is Fx9860GII SH4
- SH7337 is Fx9860G SH3
- SH7355 is Fx9860GII SH3

But so far, SH7305 doesn't seem to exist. I didn't found a single reference on the Internet, except on Casio programming websites. The same goes for the two others.

Therefore, my first question is : what are these MPUs ?

What I exactly need is to use the timer unit. Of all the documentation gathered by TeamFX, SH-4A-based MPUs use the same addresses for timer registers, but a test revealed that 32-bit readable/writable registers, particularly TCOR_0 (TCOR0_0 on SH7724) weren't accessible.

I had a look at FTune2's sources, which is said to work for SH7305, but it was indicated that SH7724's information was used. Finally, I found a 7305.h header on Casiopeia but the timer unit structures used the same addresses that other SH-4A-base MPUs.

That's why my second question is : where is the SH7305 timer unit located ?

FWIW, I have tested addresses of all MPUs in TeamFX documentation but no one matched the calculator reading/writing possibilities.

Any help would be appreciated.

[SimonLothar]

SH7305, SH7337 and SH7355 are customized MPUs. The manuals are under non-disclosure agreement. I'd be very surprised, if you get hold of some of these.
SH7705 is the nearest match to the SH7337 and SH7355.
SH7724 is the nearest match to the SH7305.

I had a look at fx_calculators_SuperH_based.chm.
According to this the TMU-base address of the SH7305 is 0xA4490004. I found this some time ago (about 2011). Usually I'd consider me reliable. But you never can tell. I did not verify it today.
If you should check the address and find it to be valid, let us know.

[TeamFX Profile]

Don't forget the SH7291 which is used in the ClassPad 300/300+/330 and the PV-S1600. This MPU is also based on the SH7705 design.

Regarding the SH7305 TMU, the following code is used in syscall 0x420:

Code: Select all

wait_ms:
    sts.l   macl, @-r15
    sts.l   mach, @-r15
    shll    r4
    tst     r4, r4
    bt      wait_2
    mov.w   #h'FA0, r2
    cmp/hi  r2, r4
    bt      wait_2
    mov.l   #h'F4240, r1
    mov     #h'FFFFFFF2, r5
    mov     #h'FFFFFFFF, r7
    mul.l   r4, r1
    sts     macl, r1
    mov.l   #h'78C06387, r4
    dmulu.l r1, r4
    sts     mach, r6
    shld    r5, r6
    mov.l   #h'A4490004, r5         ; TSTR0
    mov.l   r7, @(h'1C,r5)          ; TCOR0_2
    mov.l   r7, @(h'20,r5)          ; TCNT0_2
    mov.b   @r5, r0
    or      #4, r0
    mov.b   r0, @r5

wait_1:
    mov.l   @(h'20,r5), r2
    not     r2, r2
    cmp/hs  r6, r2
    bf      wait_1
    mov.b   @r5, r0
    and     #h'FB, r0
    mov.b   r0, @r5

wait_2:
    lds.l   @r15+, mach
    rts
    lds.l   @r15+, macl

[lephe Profile]

SH7305, SH7337 and SH7355 are customized MPUs. The manuals are under non-disclosure agreement. I'd be very surprised, if you get hold of some of these.

I see. This explains that I couldn't find anything.
But... wait, how do you know that ? x)

According to this the TMU-base address of the SH7305 is 0xA4490004.

Thanks
By the way, could you confirm that the online version of this documentation (on media.taricorp.net) is up-to-date and contains all the chm information ?

If you should check the address and find it to be valid, let us know.

Sure. I'm planning to gather as much interesting information as possible on MPUs, though I doubt there's anything TeamFX hasn't found yet.

Don't forget the SH7291 which is used in the ClassPad 300/300+/330 and the PV-S1600. This MPU is also based on the SH7705 design.

Are these MPUs are modified by Casio ? Is there any technical interest or is it just to prevent programmers from using low-level functionalities ?

Regarding the SH7305 TMU, the following code is used in syscall 0x420:

I've been looking at some point to disassemble syscalls but it ended up way more complicated than I thought. ^^
May you explain me quickly how do you get the source ?

Thanks for this help

[TeamFX Profile]

Are these MPUs modified by Casio?

I guess, Casio just tells Renesas what they would like to have and Renesas produces the custom MPU.

Is there any technical interest or is it just to prevent programmers from using low-level functionalities?

The processors' peripheral modules are changed and extended and sometimes there are new modules added. E.g., the SH7291 processor does not have an SD card interface.

May you explain me quickly how do you get the source?

Copied it from my IDA database...

Here are a few instructions:
- go to address 0x80010070, 0xA0010070 or 0x00010070
(depends on where your OS code segment starts)
- there is a dword entry located at offset 0x0001007C
- this entry denotes the address of the syscall table
- in OS 2.04.0201 (SH-4A) this value is 0x801C7D88
- now calculate: 0x420 * 4 + 0x801C7D88 = 0x801C8E08
- go to address 0x801C8E08, 0xA01C8E08 or 0x001C8E08
- it is good to use the hex-view tab here
- copy the function pointer from this address which is 0x800664A8
- 0x800664A8 is the location of syscall 0x420

[lephe Profile]

If you should check the address and find it to be valid, let us know.

It is valid. That's a good new to me, as I should now be able to get my gray engine working.

- go to address 0x80010070, 0xA0010070 or 0x00010070
(depends on where your OS code segment starts)
- there is a dword entry that contains the address of the syscall table

I used an .fls file generated with fxRemote, supposing that it was a dump of storage memory at 0xa000'0000, but at offset 0x10070 I had address 0xd202'4008 which doesn't seem to be valid. At offset 0x1007c I have address 0x801c'dd84 but I don't think I am looking at the right position.
Is it right to use such a file ?


Additionally... I have some difficulties trying to handle the keyboard. Indeed, I can't use the bare keyboard interrupts since interrupts are continuously generated until the pressed key is released (preventing user program execution). Therefore, I was using a timer and regularly checking if a key was pressed.

This worked well, but I had to use syscall 0x24a to detect the pressed key since Simon Lothar's method, using CheckKeyRow() (found at the end of this page) did not work properly. And under SH7305-based systems, this syscall enables KEYSC interrupts, which were disabled at initialization because I can't handle them : KEYSC addresses in the SH7724 aren't valid.

That's why I'm asking, just in case : do you know where the KEYSC interface is located ?

About CheckKeyRow() function, what happens is that if I use it to check which key is pressed, it prevents further keyboard interrupts generation. To be exact : if I analyze several rows using CheckKeyRow(), once the analysis is done, keyboard interrupts will only be triggered if the pressed key is on the last analyzed row.
For instance, if I analyze rows 8 to 0, then further key presses will only be detected on keys F1 to F6. And if I reverse the order, only keys 0 to EXE will work.
I thought that just calling CheckKeyRow() caused the problem, but my function analyzed the full keyboard whenever it received a keyboard interrupt. Therefore, full analyses were done several times before the first key was released (since interrupts are continuously generated when holding a key pressed). In other words, CheckKeyRow() worked well several times, and stopped working when the first pressed key was released.

If you have any information on such a behavior, please tell me.

[TeamFX Profile]

I used an .fls file generated with fxRemote, supposing that it was a dump of storage memory at 0xa000'0000, but at offset 0x10070 I had address 0xd202'4008 which doesn't seem to be valid. At offset 0x1007c I have address 0x801c'dd84 but I don't think I am looking at the right position.

The address of the syscall table is located at offset 0x0001007C. This offset is the same for all fx-9860G OS releases.

Is it right to use such a file?

If you want to copy or change some bytes and know where they are, then you can use a hex editor.

[lephe Profile]

The address of the syscall table is located at offset 0x0001007C.
This offset is the same for all fx-9860G OS releases.

Thanks ! I've been able to extract the same first bytes you disassembled before.

BTW, is there a simple way to detect a syscall end (for instance, syscall n ends where syscall n+1 begins) ? I'm planning to automatically extract them all from an SH7305 OS in order to find addresses that are different from the SH7724.

[TeamFX Profile]

There is no easy way to detect a syscall's end without using IDA. This is something that needs IDC scripting to reliably work.

[-florian66- Profile]

Hi all, like lephé, I'm on Planete Casio and I try to use SCIF but it doesn't work

Howerver I looked for the port F and do all the things to unlock the serial port but doesn't work again
There's no bug ...

I'd like to know if the adress from SH7724 (SCIF0 -> 0xFFE00000) are the same for SH4A

Thanks