Introduction
SuperH (SH) is a 32-bit RISC family designed by Hitachi in the early 1990s and later made by Renesas. Its mark is a fixed 16-bit instruction word with 16 general registers: the short code made it popular in embedded systems and consoles. The Sega Saturn has two SH-2 processors and the Sega 32X add-on for the Mega Drive has two more, all big-endian; the Sega Dreamcast has an SH-4 with a floating-point unit, run little-endian. The family also powered car dashboards, printers, set-top boxes and the Windows CE handhelds (SH-3).
The explorer's own disassembler reads SH-1, SH-2, SH-3, SH-4 and SH-4A as variants you choose, in either byte order. The pages: registers and status bits, instruction formats and length, delay slots, the instructions in groups (data transfer, arithmetic, logic, shifts, branches, system control, floating point, cache) and the differences between the chips. Every instruction has an anchor, so a disassembled instruction in the explorer links to its entry.
A SuperH program opens in the explorer today as an ELF file (e_machine 42): the
chip comes from the file's e_flags and the byte order from the file. The Saturn, 32X and Dreamcast ROM and disc
formats are not read yet; the decoder takes the variant, byte order, load address and entry point as options so that they can use it.
The variants the explorer decodes
The options bar picks one. A word that is an instruction of a later chip but not of the chosen one is shown as not in this chip, with the name of the chip that introduced it.
| Variant | Chips and machines | Usual byte order | Notes |
|---|---|---|---|
| SH-1 | SH7032, SH7034 | big | The first chip. No multiply-long, no delayed conditional branches. |
| SH-2 | Sega Saturn (two), Sega 32X (two), SH7604 | big | Adds BF/S, BT/S, BRAF, BSRF, DT, MUL.L, MAC.L, DMULS.L, DMULU.L. |
| SH-3 | SH7708, SH7709; Windows CE and Linux handhelds | either (usually little) | Adds the MMU and the privileged mode: SSR, SPC, banked registers, SHAD, SHLD, PREF, LDTLB, CLRS, SETS. |
| SH-4 | SH7750, SH7091 (Sega Dreamcast), SH7751 | little (Dreamcast) | Adds the floating-point unit, the cache block instructions, MOVCA.L, SGR and DBR. |
| SH-4A | SH7780, SH7785 | either | Adds FSCA, FSRRA, FPCHG, MOVLI.L, MOVCO.L, MOVUA.L, ICBI, PREFI, SYNCO, BRK. |
| SH-4 and SH-4A without FPU | the SH4_NOFPU and SH4A_NOFPU ELF machine values | either | The same integer set; every word of line F is not defined. |
Status of an instruction
Every word has a status for the chosen chip, shown with its own highlight and the status in words:
| Status | Meaning |
|---|---|
| Documented | An instruction of the chosen chip. |
| Not in this ISA | An instruction of a later chip: for example DT on an SH-1, or any FPU instruction on an SH-2. It would raise a general illegal instruction exception. |
| Illegal | No SuperH chip defines this encoding, or the instruction sits in a delay slot where the chip does not allow it (a branch, or a PC-relative load). It raises a general illegal instruction exception or a slot illegal instruction exception. |
| Reserved | A floating-point instruction whose register field the manual reserves: with FPSCR.PR = 1 the register of a double-precision operand must be even. |
| Unpredictable | A floating-point instruction used in the wrong precision mode: FMAC, FLDI0, FLDI1, FIPR, FTRV, FSCA and FSRRA need FPSCR.PR = 0, FCNVSD and FCNVDS need PR = 1. The manual calls the result undefined. |
An instruction that traps in user mode (the privileged ones of SH-3 and later) is not a status of its own: the note says "privileged". The SH-1 and SH-2 have no privilege levels.
Notation
The disassembly writes a mnemonic in lower case, the operands as the GNU assembler does and a signed immediate in decimal:
mov.l @(0x14,pc),r1, mov #-1,r0, add #4,r15, mov.l r14,@-r15. A branch shows its
target address (or, with the setting "offset", the byte displacement from PC + 4). A PC-relative load shows the displacement
as encoded and the address of the literal in a note (or, with the setting "address", the literal's address as the operand).
In the Renesas syntax the mnemonics and registers are in capitals. An instruction in a delay slot is marked. The explorer
decodes each 2-byte aligned address; an odd byte at the start of a region shows as a byte only.
Options
| Option | Choices |
|---|---|
| Chip (variant) | SH-1, SH-2, SH-3, SH-4, SH-4A, SH-4 or SH-4A without FPU. In an ELF file the default is the one the machine field of e_flags names. |
| Byte order | From the file, big or little. The Saturn and the 32X are big-endian, the Dreamcast little-endian. |
| FPSCR.SZ | FMOV moves 32 bits (fr) or 64 bits (dr, xd). See the modes. |
| FPSCR.PR | Single or double precision for the arithmetic instructions. |
| Register 15 | Written r15 or sp. |
| Syntax | GNU (lower case) or Renesas (upper case). |
| PC-relative loads | The displacement as encoded, or the address of the literal. |
| Branch targets | The target address or the byte displacement. |
The decoder does not track FPSCR: it cannot know what an lds r1,fpscr loaded. The user chooses the SZ and PR the code
runs with, and an instruction that changes or depends on them says so in its note (FSCHG, FRCHG, FPCHG and the loads of FPSCR).
How the decoder was checked
The decoder is the explorer's own. No SuperH disassembler exists on the machine it was built on: llvm has no SuperH target and no GNU binutils for SuperH was found. So the checks are weaker than for the MIPS decoder and the page says so:
- All 65,536 sixteen-bit words, as a little-endian SH-4 with FPSCR.SZ = PR = 0, were compared with the small SH-4 disassembler of the
emulators.org debugger (written separately, covering the integer set and a part of the FPU). 62,967 words gave the same text or
were not instructions for both, 2,313 words are decoded only by ours (the instructions that disassembler does not cover) and 256 differed:
that disassembler reads
0xCFxxas TRAPA, but TRAPA is0xC3xxand0xCFxxis OR.B. - A second table was written separately in the notation of the Renesas manuals and compared with the decoder for every word, both byte orders, all seven variants and all four combinations of SZ and PR on the floating-point line (1,089,722 comparisons, no difference). It was written by the same author from the same memory of the manuals, so it finds slips, not a belief that is wrong in both.
- The ELF viewer was checked on ELF32 files built for the test (big-endian SH-2, little-endian SH-4) with instruction sequences worked out by hand.
What this does not establish is listed under Not described.
Not described
Known, not yet covered
- Reference and viewer: the SH-2A (the 32-bit instructions with 20-bit immediates and 12-bit displacements,
bit operations, banked registers,
JSR/N,RTS/N, double-precision FPU). A file that asks for it is read as an SH-2 and the 32-bit forms show as illegal. - Reference and viewer: the SH-DSP, SH3-DSP and SH4AL-DSP parallel instructions (the DSP extension of the 16-bit encodings).
- Reference and viewer: the SH-2E and SH-3E single-precision FPU instructions (a subset of the SH-4's, with different encodings for some forms).
- Viewer: the Saturn, 32X and Dreamcast ROM and disc formats, which will use this decoder.
- Viewer: cycle counts are not shown (no table was sourced).
Unknown
- Reference: the encodings and chip assignments were written from memory of the Renesas software manuals and the GNU assembler's table; no manual could be opened while building the pages. The chip that introduced BRK, the SH-3 and SH-4A extras and the exact list of privileged and slot-illegal instructions are the least certain parts.
- Reference: the numbers of the
e_flagsmachine field for the less common chips.
Links
Reference
- SuperH – an overview of the family, its chips and the machines that used them
- SH-4 32-bit CPU Core Architecture – the SH-4 software manual, a mirror at retrocdn.net (not the vendor's own download)
- SH-dependent features of the GNU assembler – the assembler syntax and chip options (the Texinfo source)