3 replies to this topic

[TeamFX]

Does anyone know something about the "ClassPad 200" prototype that was created alongside the PV-S1600? There are some references on the web. Even Casio states that they did create a prototype in 2002.

http://web.archive.o...ws/history.html
http://www.hpcc.org/...6copenhagen.pdf

Edited by TeamFX, 17 June 2014 - 07:53 PM.

[flyingfisch]

Interesting, I never heard of it before.

[TeamFX]

The PV-S1600 SDK includes a file named CasioROMinit.mem which contains the boot code data. It's compressed and I don't know the format, but have extracted its content by using a small PV add-in. It's not fully compatible with a real PV boot code, e.g. some memory addresses are clearly wrong - obviously, they are not used in the emulator.
Now the interesting part: This boot code identifies itself as version 1.01 and the file dates back to 2002-09-20.
It seems that version 1.00 is only present in PV-S1600 and ClassPad 300 prototypes. Unfortunately, no pocket viewer hacker has ever created a real boot code dump. So we don't know if maybe the PV-S1600 emulator just uses the ClassPad's boot code or if both use version 1.01 and they could still be different despite having the same version number.

An interesting aspect of the version 1.01 boot code is that it is stored inside the processor. This functionality can be enabled via the SH7705 processor pin MD6 by connecting it to Vcc/Vdd. It's not documented by Renesas, though the ClassPad 300+/330 uses an external boot ROM and you can clearly see that MD6 is now connected to ground.

All ClassPad OSes do some special calculation when they find a boot code with checksum 0xB9EC. In this case, the ROM size is increased to 2 MB, the first 64k are ignored (this is where the boot code resides) and all bytes beyond this are checked if they are equal to 0xFF (this means that they have never been written to). The OS will report "NG" ("no good", Japanese opposite of "OK") if it finds a written byte.
We can conclude from this that they used an external boot ROM which is quite large (2 MB compared to 256k in the ClassPad 300+/330). Also, they prepared the boot code for in-processor usage which only allows 64k. So the OS warns when there is something written beyond these 64k.

Too bad I can't have the prototype hardware...

More info on the timeframe:
- The Emulators and prototypes have been completed in early 2002
- The PV-S1600 was released around September 2002 with OS 1.00
- The last OS update (version 1.03) dates back to 2002-12-11
- The ClassPad 300 was released around March 2003 with OS 1.00

Edited by TeamFX, 21 September 2014 - 06:24 PM.

[TeamFX]

The PV-S1600 emulator is the only real "ClassPad" emulator because you can run assembly code.
Anyone interested can download the SDK here: http://world.casio.c.../sdk/s1600.html

If you want to call some of the test mode routines, just include this in one of the sample program's main function:

/*
   0xD201	 mov.l   #h'8C000000, r2
   0xE400	 mov	 #h'00, r4
   0x422B	 jmp	 @r2
   0x0009	 nop
   0x8C00	 .data.w h'8C00
   0x0000	 .data.w h'0000
*/
// unsigned int code[] = {0xD201E400, 0x422B0009, 0x8C06ED4C}; // TEST MAIN MENU
// unsigned int code[] = {0xD201E400, 0x422B0009, 0x8C06EAC4}; // PAD MODE MENU
void (*jump)(void) = (void (*)(void))code;

jump();
/*
   Converting a hex editor address into a RAM address:
   0x8C0????? = addr + 0x24800 - 0x1A38
*/

In case the function takes an argument which is normally used as an on/off switch, modify the instruction 0xE4??

To build a PV project, execute "BuildAll.bat" and ensure that all paths inside "PathSET.BAT" are correct. Start the Casio SimSH Simulator, open the project and click "Run". The software may not work correctly under Windows Vista/7/8.

Edited by TeamFX, 18 June 2014 - 04:31 PM.