1 /*
2  *  Copyright (C) 2006-2020  Anders Gavare.  All rights reserved.
3  *
4  *  Redistribution and use in source and binary forms, with or without
5  *  modification, are permitted provided that the following conditions are met:
6  *
7  *  1. Redistributions of source code must retain the above copyright
8  *     notice, this list of conditions and the following disclaimer.
9  *  2. Redistributions in binary form must reproduce the above copyright
10  *     notice, this list of conditions and the following disclaimer in the
11  *     documentation and/or other materials provided with the distribution.
12  *  3. The name of the author may not be used to endorse or promote products
13  *     derived from this software without specific prior written permission.
14  *
15  *  THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
16  *  ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
17  *  IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
18  *  ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
19  *  FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
20  *  DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
21  *  OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
22  *  HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
23  *  LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
24  *  OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
25  *  SUCH DAMAGE.
26  *
27  *
28  *  COMMENT: SH4-specific memory mapped registers (0xf0000000 - 0xffffffff)
29  *
30  *  TODO: Among other things:
31  *
32  *	x)  Interrupt masks (msk register stuff). Are these really correct?
33  *	x)  BSC (Bus state controller).
34  *	x)  DMA: Right now there's a hack for Dreamcast emulation
35  *	x)  UBC (User Break Controller)
36  *	x)  ...
37  */
38 
39 #include <stdio.h>
40 #include <stdlib.h>
41 #include <string.h>
42 
43 #include "bus_pci.h"
44 #include "console.h"
45 #include "cpu.h"
46 #include "device.h"
47 #include "devices.h"
48 #include "interrupt.h"
49 #include "machine.h"
50 #include "memory.h"
51 #include "misc.h"
52 #include "sh4_dmacreg.h"
53 #include "timer.h"
54 
55 #include "thirdparty/sh4_bscreg.h"
56 #include "thirdparty/sh4_cache.h"
57 #include "thirdparty/sh4_exception.h"
58 #include "thirdparty/sh4_intcreg.h"
59 #include "thirdparty/sh4_mmu.h"
60 #include "thirdparty/sh4_pcicreg.h"
61 #include "thirdparty/sh4_rtcreg.h"
62 #include "thirdparty/sh4_scifreg.h"
63 #include "thirdparty/sh4_scireg.h"
64 #include "thirdparty/sh4_tmureg.h"
65 
66 
67 #define	SH4_REG_BASE		0xff000000
68 #define	SH4_TICK_SHIFT		14
69 #define	N_SH4_TIMERS		3
70 
71 /*  PCI stuff:  */
72 #define	N_PCIC_REGS			(0x224 / sizeof(uint32_t))
73 #define	N_PCIC_IRQS			16
74 #define	PCIC_REG(addr)			((addr - SH4_PCIC) / sizeof(uint32_t))
75 #define	PCI_VENDOR_HITACHI		0x1054
76 #define	PCI_PRODUCT_HITACHI_SH7751	0x3505
77 #define	PCI_PRODUCT_HITACHI_SH7751R	0x350e
78 
79 #define	SCIF_TX_FIFO_SIZE	16
80 #define	SCIF_DELAYED_TX_VALUE	2	/*  2 to be safe, 1 = fast but buggy  */
81 
82 #ifdef UNSTABLE_DEVEL
83 // #define SH4_DEBUG
84 /*  #define debug fatal  */
85 #endif
86 
87 // Clock/occilation related
88 #define SH4_CPG_FRQCR		0xffc00000	/* 16-bit */
89 #define SH4_CPG_STBCR 		0xffc00004	/* 8-bit */
90 #define SH4_CPG_WTCNT 		0xffc00008	/* 8/16-bit */
91 #define SH4_CPG_WTCSR 		0xffc0000c	/* 8/16-bit */
92 #define SH4_CPG_STBCR2 		0xffc00010	/* 8-bit */
93 
94 
95 struct sh4_data {
96 	/*  Store Queues:  */
97 	uint8_t		sq[32 * 2];
98 
99 	/*  SCIF (Serial controller):  */
100 	uint16_t	scif_smr;
101 	uint8_t		scif_brr;
102 	uint16_t	scif_scr;
103 	uint16_t	scif_ssr;
104 	uint16_t	scif_fcr;
105 	uint16_t	scif_lsr;
106 	int		scif_delayed_tx;
107 	int		scif_console_handle;
108 	uint8_t		scif_tx_fifo[SCIF_TX_FIFO_SIZE + 1];
109 	size_t		scif_tx_fifo_cursize;
110 	struct interrupt scif_tx_irq;
111 	struct interrupt scif_rx_irq;
112 	int		scif_tx_irq_asserted;
113 	int		scif_rx_irq_asserted;
114 
115 	/*  Bus State Controller:  */
116 	uint32_t	bsc_bcr1;
117 	uint16_t	bsc_bcr2;
118 	uint16_t	bsc_bcr3;	/*  SH7751R  */
119 	uint32_t	bsc_wcr1;
120 	uint32_t	bsc_wcr2;
121 	uint32_t	bsc_wcr3;
122 	uint32_t	bsc_mcr;
123 	uint16_t	bsc_pcr;
124 	uint16_t	bsc_rtcsr;
125 	uint16_t	bsc_rtcor;
126 	uint16_t	bsc_rfcr;
127 
128 	/*  CPG:  */
129 	uint16_t	cpg_frqcr;
130 	uint8_t		cpg_stbcr;
131 	uint16_t	cpg_wtcnt;
132 	uint16_t	cpg_wtcsr;
133 	uint8_t		cpg_stbcr2;
134 
135 	/*  GPIO:  */
136 	uint32_t	pctra;		/*  Port Control Register A  */
137 	uint32_t	pdtra;		/*  Port Data Register A  */
138 	uint32_t	pctrb;		/*  Port Control Register B  */
139 	uint32_t	pdtrb;		/*  Port Data Register B  */
140 	uint16_t	bsc_gpioic;
141 
142 	/*  PCIC (PCI controller):  */
143 	struct pci_data	*pci_data;
144 	struct interrupt cpu_pcic_interrupt[N_PCIC_IRQS];
145 	uint32_t	pcic_reg[N_PCIC_REGS];
146 
147 	/*  SCI (serial interface):  */
148 	int		sci_bits_outputed;
149 	int		sci_bits_read;
150 	uint8_t		sci_scsptr;
151 	uint8_t		sci_curbyte;
152 	uint8_t		sci_cur_addr;
153 
154 	/*  SD-RAM:  */
155 	uint16_t	sdmr2;
156 	uint16_t	sdmr3;
157 
158 	/*  Timer Management Unit:  */
159 	struct timer	*sh4_timer;
160 	struct interrupt timer_irq[4];
161 	uint32_t	tocr;
162 	uint32_t	tstr;
163 	uint32_t	tcnt[N_SH4_TIMERS];
164 	uint32_t	tcor[N_SH4_TIMERS];
165 	uint32_t	tcr[N_SH4_TIMERS];
166 	int		timer_interrupts_pending[N_SH4_TIMERS];
167 	double		timer_hz[N_SH4_TIMERS];
168 
169 	/*  RTC:  */
170 	uint32_t	rtc_reg[14];	/*  Excluding rcr1 and rcr2  */
171 	uint8_t		rtc_rcr1;
172 	uint8_t		rtc_rcr2;
173 };
174 
175 
176 #define	SH4_PSEUDO_TIMER_HZ	110.0
177 
178 
179 /*
180  *  sh4_timer_tick():
181  *
182  *  This function is called SH4_PSEUDO_TIMER_HZ times per real-world second.
183  *  Its job is to update the SH4 timer counters, and if necessary, increase
184  *  the number of pending interrupts.
185  *
186  *  Also, RAM Refresh is also faked here.
187  */
sh4_timer_tick(struct timer * t,void * extra)188 static void sh4_timer_tick(struct timer *t, void *extra)
189 {
190 	struct sh4_data *d = (struct sh4_data *) extra;
191 	int i;
192 
193 	/*  Fake RAM refresh:  */
194 	d->bsc_rfcr ++;
195 	if (d->bsc_rtcsr & (RTCSR_CMIE | RTCSR_OVIE)) {
196 		fatal("sh4: RTCSR_CMIE | RTCSR_OVIE: TODO\n");
197 		/*  TODO: Implement refresh interrupts etc.  */
198 		exit(1);
199 	}
200 
201 	/*  Timer interrupts:  */
202 	for (i=0; i<N_SH4_TIMERS; i++) {
203 		int32_t old = d->tcnt[i];
204 
205 		/*  printf("tcnt[%i] = %08x   tcor[%i] = %08x\n",
206 		    i, d->tcnt[i], i, d->tcor[i]);  */
207 
208 		/*  Only update timers that are currently started:  */
209 		if (!(d->tstr & (TSTR_STR0 << i)))
210 			continue;
211 
212 		/*  Update the current count:  */
213 		d->tcnt[i] -= (uint32_t) (d->timer_hz[i] / SH4_PSEUDO_TIMER_HZ);
214 
215 		/*  Has the timer underflowed?  */
216 		if ((int32_t)d->tcnt[i] < 0 && old >= 0) {
217 			d->tcr[i] |= TCR_UNF;
218 
219 			if (d->tcr[i] & TCR_UNIE)
220 				d->timer_interrupts_pending[i] ++;
221 
222 			/*
223 			 *  Set tcnt[i] to tcor[i]. Note: Since this function
224 			 *  is only called now and then, adding tcor[i] to
225 			 *  tcnt[i] produces more correct values for long
226 			 *  running timers.
227 			 */
228 			d->tcnt[i] += d->tcor[i];
229 
230 			/*  At least make sure that tcnt is non-negative...  */
231 			if ((int32_t)d->tcnt[i] < 0)
232 				d->tcnt[i] = 0;
233 		}
234 	}
235 }
236 
237 
sh4_pcic_interrupt_assert(struct interrupt * interrupt)238 static void sh4_pcic_interrupt_assert(struct interrupt *interrupt)
239 {
240 	struct sh4_data *d = (struct sh4_data *) interrupt->extra;
241 	INTERRUPT_ASSERT(d->cpu_pcic_interrupt[interrupt->line]);
242 }
sh4_pcic_interrupt_deassert(struct interrupt * interrupt)243 static void sh4_pcic_interrupt_deassert(struct interrupt *interrupt)
244 {
245 	struct sh4_data *d = (struct sh4_data *) interrupt->extra;
246 	INTERRUPT_DEASSERT(d->cpu_pcic_interrupt[interrupt->line]);
247 }
248 
249 
scif_reassert_interrupts(struct sh4_data * d)250 static void scif_reassert_interrupts(struct sh4_data *d)
251 {
252 	int old_tx_asserted = d->scif_tx_irq_asserted;
253 	int old_rx_asserted = d->scif_rx_irq_asserted;
254 
255 	d->scif_rx_irq_asserted =
256 	    d->scif_scr & SCSCR2_RIE && d->scif_ssr & SCSSR2_DR;
257 
258 	if (d->scif_rx_irq_asserted && !old_rx_asserted)
259 		INTERRUPT_ASSERT(d->scif_rx_irq);
260 	else if (!d->scif_rx_irq_asserted && old_rx_asserted)
261 		INTERRUPT_DEASSERT(d->scif_rx_irq);
262 
263 	d->scif_tx_irq_asserted =
264 	    d->scif_scr & SCSCR2_TIE &&
265 	    d->scif_ssr & (SCSSR2_TDFE | SCSSR2_TEND);
266 
267 	if (d->scif_tx_irq_asserted && !old_tx_asserted)
268 		INTERRUPT_ASSERT(d->scif_tx_irq);
269 	else if (!d->scif_tx_irq_asserted && old_tx_asserted)
270 		INTERRUPT_DEASSERT(d->scif_tx_irq);
271 }
272 
273 
DEVICE_TICK(sh4)274 DEVICE_TICK(sh4)
275 {
276 	struct sh4_data *d = (struct sh4_data *) extra;
277 	unsigned int i;
278 
279 	/*
280 	 *  Serial controller interrupts:
281 	 *
282 	 *  RX: Cause interrupt if any char is available.
283 	 *  TX: Send entire TX FIFO contents, and interrupt.
284 	 */
285 	if (console_charavail(d->scif_console_handle))
286 		d->scif_ssr |= SCSSR2_DR;
287 	else
288 		d->scif_ssr &= ~SCSSR2_DR;
289 
290 	if (d->scif_delayed_tx) {
291 		if (--d->scif_delayed_tx == 0) {
292 			/*  Send TX FIFO contents:  */
293 			for (i=0; i<d->scif_tx_fifo_cursize; i++)
294 				console_putchar(d->scif_console_handle,
295 				    d->scif_tx_fifo[i]);
296 
297 			/*  Clear FIFO:  */
298 			d->scif_tx_fifo_cursize = 0;
299 
300 			/*  Done sending; cause a transmit end interrupt:  */
301 			d->scif_ssr |= SCSSR2_TDFE | SCSSR2_TEND;
302 		}
303 	}
304 
305 	scif_reassert_interrupts(d);
306 
307 	/*  Timer interrupts:  */
308 	for (i=0; i<N_SH4_TIMERS; i++)
309 		if (d->timer_interrupts_pending[i] > 0) {
310 			INTERRUPT_ASSERT(d->timer_irq[i]);
311 			d->tcr[i] |= TCR_UNF;
312 		}
313 }
314 
315 
316 /*
317  *  sh4_dmac_transfer():
318  *
319  *  Called whenever a DMA transfer is to be executed.
320  *  Clears the lowest bit of the corresponding channel's CHCR when done.
321  */
sh4_dmac_transfer(struct cpu * cpu,struct sh4_data * d,int channel)322 void sh4_dmac_transfer(struct cpu *cpu, struct sh4_data *d, int channel)
323 {
324 	/*  According to the SH7760 manual, bits 31..29 are ignored in  */
325 	/*  both the SAR and DAR.  */
326 	uint32_t sar = cpu->cd.sh.dmac_sar[channel] & 0x1fffffff;
327 	uint32_t dar = cpu->cd.sh.dmac_dar[channel] & 0x1fffffff;
328 	uint32_t count = cpu->cd.sh.dmac_tcr[channel] & 0x1fffffff;
329 	uint32_t chcr = cpu->cd.sh.dmac_chcr[channel];
330 	int transmit_size = 1;
331 	int src_delta = 0, dst_delta = 0;
332 	int cause_interrupt = chcr & CHCR_IE;
333 
334 	/*  DMAC not enabled? Then just return.  */
335 	if (!(chcr & CHCR_TD))
336 		return;
337 
338 	/*  Transfer End already set? Then don't transfer again.  */
339 	if (chcr & CHCR_TE)
340 		return;
341 
342 	/*  Special case: 0 means 16777216:  */
343 	if (count == 0)
344 		count = 16777216;
345 
346 	switch (chcr & CHCR_TS) {
347 	case CHCR_TS_8BYTE: transmit_size = 8; break;
348 	case CHCR_TS_1BYTE: transmit_size = 1; break;
349 	case CHCR_TS_2BYTE: transmit_size = 2; break;
350 	case CHCR_TS_4BYTE: transmit_size = 4; break;
351 	case CHCR_TS_32BYTE: transmit_size = 32; break;
352 	default: fatal("Unimplemented transmit size?! CHCR[%i] = 0x%08x\n",
353 	    channel, chcr);
354 	exit(1);
355 	}
356 
357 	switch (chcr & CHCR_DM) {
358 	case CHCR_DM_FIXED:       dst_delta = 0; break;
359 	case CHCR_DM_INCREMENTED: dst_delta = 1; break;
360 	case CHCR_DM_DECREMENTED: dst_delta = -1; break;
361 	default: fatal("Unimplemented destination delta?! CHCR[%i] = 0x%08x\n",
362 	    channel, chcr);
363 	exit(1);
364 	}
365 
366 	switch (chcr & CHCR_SM) {
367 	case CHCR_SM_FIXED:       src_delta = 0; break;
368 	case CHCR_SM_INCREMENTED: src_delta = 1; break;
369 	case CHCR_SM_DECREMENTED: src_delta = -1; break;
370 	default: fatal("Unimplemented source delta?! CHCR[%i] = 0x%08x\n",
371 	    channel, chcr);
372 	exit(1);
373 	}
374 
375 	src_delta *= transmit_size;
376 	dst_delta *= transmit_size;
377 
378 #ifdef SH4_DEBUG
379 	fatal("|SH4 DMA transfer, channel %i\n", channel);
380 	fatal("|Source addr:      0x%08x (delta %i)\n", (int) sar, src_delta);
381 	fatal("|Destination addr: 0x%08x (delta %i)\n", (int) dar, dst_delta);
382 	fatal("|Count:            0x%08x\n", (int) count);
383 	fatal("|Transmit size:    0x%08x\n", (int) transmit_size);
384 	fatal("|Interrupt:        %s\n", cause_interrupt? "yes" : "no");
385 #endif
386 
387 	switch (chcr & CHCR_RS) {
388 	case 0x200:
389 		/*
390 		 *  Single Address Mode
391 		 *  External Address Space => external device
392 		 */
393 
394 		// Avoid compiler warnings about unused sar and dar.
395 		(void)sar;
396 		(void)dar;
397 
398 		/*  Note: No transfer is done here! It is up to the
399 		    external device to do the transfer itself!  */
400 		break;
401 
402 	default:fatal("Unimplemented SH4 RS DMAC: 0x%08x\n",
403 		    (int) (chcr & CHCR_RS));
404 		exit(1);
405 	}
406 
407 	if (cause_interrupt) {
408 		fatal("TODO: sh4 dmac interrupt!\n");
409 		exit(1);
410 	}
411 }
412 
413 
414 /*
415  *  sh4_sci_cmd():
416  *
417  *  Handle a SCI command byte.
418  *
419  *  Bit:   Meaning:
420  *   7      Ignored (usually 1?)
421  *   6      0=Write, 1=Read
422  *   5      AD: Address transfer
423  *   4      DT: Data transfer
424  *   3..0   Data or address bits
425  */
sh4_sci_cmd(struct sh4_data * d,struct cpu * cpu)426 static void sh4_sci_cmd(struct sh4_data *d, struct cpu *cpu)
427 {
428 	uint8_t cmd = d->sci_curbyte;
429 	int writeflag = cmd & 0x40? 0 : 1;
430 	int address_transfer;
431 
432 	/*  fatal("[ CMD BYTE %02x ]\n", cmd);  */
433 
434 	if (!(cmd & 0x80)) {
435 		fatal("SCI cmd bit 7 not set? TODO\n");
436 		exit(1);
437 	}
438 
439 	if ((cmd & 0x30) == 0x20)
440 		address_transfer = 1;
441 	else if ((cmd & 0x30) == 0x10)
442 		address_transfer = 0;
443 	else {
444 		fatal("SCI: Neither data nor address transfer? TODO\n");
445 		exit(1);
446 	}
447 
448 	if (address_transfer)
449 		d->sci_cur_addr = cmd & 0x0f;
450 
451 	if (!writeflag) {
452 		/*  Read data from the current address:  */
453 		uint8_t data_byte;
454 
455 		cpu->memory_rw(cpu, cpu->mem, SCI_DEVICE_BASE + d->sci_cur_addr,
456 		    &data_byte, 1, MEM_READ, PHYSICAL);
457 
458 		debug("[ SCI: read addr=%x data=%x ]\n",
459 		    d->sci_cur_addr, data_byte);
460 
461 		d->sci_curbyte = data_byte;
462 
463 		/*  Set bit 7 right away:  */
464 		d->sci_scsptr &= ~SCSPTR_SPB1DT;
465 		if (data_byte & 0x80)
466 			d->sci_scsptr |= SCSPTR_SPB1DT;
467 	}
468 
469 	if (writeflag && !address_transfer) {
470 		/*  Write the 4 data bits to the current address:  */
471 		uint8_t data_byte = cmd & 0x0f;
472 
473 		debug("[ SCI: write addr=%x data=%x ]\n",
474 		    d->sci_cur_addr, data_byte);
475 
476 		cpu->memory_rw(cpu, cpu->mem, SCI_DEVICE_BASE + d->sci_cur_addr,
477 		    &data_byte, 1, MEM_WRITE, PHYSICAL);
478 	}
479 }
480 
481 
482 /*
483  *  sh4_sci_access():
484  *
485  *  Reads or writes a bit via the SH4's serial interface. If writeflag is
486  *  non-zero, input is used. If writeflag is zero, a bit is outputed as
487  *  the return value from this function.
488  */
sh4_sci_access(struct sh4_data * d,struct cpu * cpu,int writeflag,uint8_t input)489 static uint8_t sh4_sci_access(struct sh4_data *d, struct cpu *cpu,
490 	int writeflag, uint8_t input)
491 {
492 	if (writeflag) {
493 		/*  WRITE:  */
494 		int clockpulse;
495 		uint8_t old = d->sci_scsptr;
496 		d->sci_scsptr = input;
497 
498 		/*
499 		 *  Clock pulse (SCSPTR_SPB0DT going from 0 to 1,
500 		 *  when SCSPTR_SPB0IO was already set):
501 		 */
502 		clockpulse = old & SCSPTR_SPB0IO &&
503 		    d->sci_scsptr & SCSPTR_SPB0DT &&
504 		    !(old & SCSPTR_SPB0DT);
505 
506 		if (!clockpulse)
507 			return 0;
508 
509 		/*  Are we in output or input mode?  */
510 		if (d->sci_scsptr & SCSPTR_SPB1IO) {
511 			/*  Output:  */
512 			int bit = d->sci_scsptr & SCSPTR_SPB1DT? 1 : 0;
513 			d->sci_curbyte <<= 1;
514 			d->sci_curbyte |= bit;
515 			d->sci_bits_outputed ++;
516 			if (d->sci_bits_outputed == 8) {
517 				/*  4 control bits and 4 address/data bits have
518 				    been written.  */
519 				sh4_sci_cmd(d, cpu);
520 				d->sci_bits_outputed = 0;
521 			}
522 		} else {
523 			/*  Input:  */
524 			int bit;
525 			d->sci_bits_read ++;
526 			d->sci_bits_read &= 7;
527 
528 			bit = d->sci_curbyte & (0x80 >> d->sci_bits_read);
529 
530 			d->sci_scsptr &= ~SCSPTR_SPB1DT;
531 			if (bit)
532 				d->sci_scsptr |= SCSPTR_SPB1DT;
533 		}
534 
535 		/*  Return (value doesn't matter).  */
536 		return 0;
537 	} else {
538 		/*  READ:  */
539 		return d->sci_scsptr;
540 	}
541 }
542 
543 
DEVICE_ACCESS(sh4_itlb_aa)544 DEVICE_ACCESS(sh4_itlb_aa)
545 {
546 	uint64_t idata = 0, odata = 0;
547 	int e = (relative_addr & SH4_ITLB_E_MASK) >> SH4_ITLB_E_SHIFT;
548 
549 	if (writeflag == MEM_WRITE) {
550 		int safe_to_invalidate = 0;
551 		uint32_t old_hi = cpu->cd.sh.itlb_hi[e];
552 		if ((cpu->cd.sh.itlb_lo[e] & SH4_PTEL_SZ_MASK)==SH4_PTEL_SZ_4K)
553 			safe_to_invalidate = 1;
554 
555 		idata = memory_readmax64(cpu, data, len);
556 		cpu->cd.sh.itlb_hi[e] &=
557 		    ~(SH4_PTEH_VPN_MASK | SH4_PTEH_ASID_MASK);
558 		cpu->cd.sh.itlb_hi[e] |= (idata &
559 		    (SH4_ITLB_AA_VPN_MASK | SH4_ITLB_AA_ASID_MASK));
560 		cpu->cd.sh.itlb_lo[e] &= ~SH4_PTEL_V;
561 		if (idata & SH4_ITLB_AA_V)
562 			cpu->cd.sh.itlb_lo[e] |= SH4_PTEL_V;
563 
564 		/*  Invalidate if this ITLB entry previously belonged to the
565 		    currently running process, or if it was shared:  */
566 		if (cpu->cd.sh.ptel & SH4_PTEL_SH ||
567 		    (old_hi & SH4_ITLB_AA_ASID_MASK) ==
568 		    (cpu->cd.sh.pteh & SH4_PTEH_ASID_MASK)) {
569 			if (safe_to_invalidate)
570 				cpu->invalidate_translation_caches(cpu,
571 				    old_hi & ~0xfff, INVALIDATE_VADDR);
572 			else
573 				cpu->invalidate_translation_caches(cpu,
574 				    0, INVALIDATE_ALL);
575 		}
576 	} else {
577 		odata = cpu->cd.sh.itlb_hi[e] &
578 		    (SH4_ITLB_AA_VPN_MASK | SH4_ITLB_AA_ASID_MASK);
579 		if (cpu->cd.sh.itlb_lo[e] & SH4_PTEL_V)
580 			odata |= SH4_ITLB_AA_V;
581 		memory_writemax64(cpu, data, len, odata);
582 	}
583 
584 	return 1;
585 }
586 
587 
DEVICE_ACCESS(sh4_itlb_da1)588 DEVICE_ACCESS(sh4_itlb_da1)
589 {
590 	uint32_t mask = SH4_PTEL_SH | SH4_PTEL_C | SH4_PTEL_SZ_MASK |
591 	    SH4_PTEL_PR_MASK | SH4_PTEL_V | 0x1ffffc00;
592 	uint64_t idata = 0, odata = 0;
593 	int e = (relative_addr & SH4_ITLB_E_MASK) >> SH4_ITLB_E_SHIFT;
594 
595 	if (relative_addr & 0x800000) {
596 		fatal("sh4_itlb_da1: TODO: da2 area\n");
597 		exit(1);
598 	}
599 
600 	if (writeflag == MEM_WRITE) {
601 		uint32_t old_lo = cpu->cd.sh.itlb_lo[e];
602 		int safe_to_invalidate = 0;
603 		if ((cpu->cd.sh.itlb_lo[e] & SH4_PTEL_SZ_MASK)==SH4_PTEL_SZ_4K)
604 			safe_to_invalidate = 1;
605 
606 		idata = memory_readmax64(cpu, data, len);
607 		cpu->cd.sh.itlb_lo[e] &= ~mask;
608 		cpu->cd.sh.itlb_lo[e] |= (idata & mask);
609 
610 		/*  Invalidate if this ITLB entry belongs to the
611 		    currently running process, or if it was shared:  */
612 		if (old_lo & SH4_PTEL_SH ||
613 		    (cpu->cd.sh.itlb_hi[e] & SH4_ITLB_AA_ASID_MASK) ==
614 		    (cpu->cd.sh.pteh & SH4_PTEH_ASID_MASK)) {
615 			if (safe_to_invalidate)
616 				cpu->invalidate_translation_caches(cpu,
617 				    cpu->cd.sh.itlb_hi[e] & ~0xfff,
618 				    INVALIDATE_VADDR);
619 			else
620 				cpu->invalidate_translation_caches(cpu,
621 				    0, INVALIDATE_ALL);
622 		}
623 	} else {
624 		odata = cpu->cd.sh.itlb_lo[e] & mask;
625 		memory_writemax64(cpu, data, len, odata);
626 	}
627 
628 	return 1;
629 }
630 
631 
DEVICE_ACCESS(sh4_utlb_aa)632 DEVICE_ACCESS(sh4_utlb_aa)
633 {
634 	uint64_t idata = 0, odata = 0;
635 	int i, e = (relative_addr & SH4_UTLB_E_MASK) >> SH4_UTLB_E_SHIFT;
636 	int a = relative_addr & SH4_UTLB_A;
637 
638 	if (writeflag == MEM_WRITE) {
639 		int n_hits = 0;
640 		int safe_to_invalidate = 0;
641 		uint32_t vaddr_to_invalidate = 0;
642 
643 		idata = memory_readmax64(cpu, data, len);
644 		if (a) {
645 			for (i=-SH_N_ITLB_ENTRIES; i<SH_N_UTLB_ENTRIES; i++) {
646 				uint32_t lo, hi;
647 				uint32_t mask = 0xfffff000;
648 				int sh;
649 
650 				if (i < 0) {
651 					lo = cpu->cd.sh.itlb_lo[
652 					    i + SH_N_ITLB_ENTRIES];
653 					hi = cpu->cd.sh.itlb_hi[
654 					    i + SH_N_ITLB_ENTRIES];
655 				} else {
656 					lo = cpu->cd.sh.utlb_lo[i];
657 					hi = cpu->cd.sh.utlb_hi[i];
658 				}
659 
660 				sh = lo & SH4_PTEL_SH;
661 				if (!(lo & SH4_PTEL_V))
662 					continue;
663 
664 				switch (lo & SH4_PTEL_SZ_MASK) {
665 				case SH4_PTEL_SZ_1K:  mask = 0xfffffc00; break;
666 				case SH4_PTEL_SZ_64K: mask = 0xffff0000; break;
667 				case SH4_PTEL_SZ_1M:  mask = 0xfff00000; break;
668 				}
669 
670 				if ((hi & mask) != (idata & mask))
671 					continue;
672 
673 				if ((lo & SH4_PTEL_SZ_MASK) ==
674 				    SH4_PTEL_SZ_4K) {
675 					safe_to_invalidate = 1;
676 					vaddr_to_invalidate = hi & mask;
677 				}
678 
679 				if (!sh && (hi & SH4_PTEH_ASID_MASK) !=
680 				    (cpu->cd.sh.pteh & SH4_PTEH_ASID_MASK))
681 					continue;
682 
683 				if (i < 0) {
684 					cpu->cd.sh.itlb_lo[i +
685 					    SH_N_ITLB_ENTRIES] &= ~SH4_PTEL_V;
686 					if (idata & SH4_UTLB_AA_V)
687 						cpu->cd.sh.itlb_lo[
688 						    i+SH_N_ITLB_ENTRIES] |=
689 						    SH4_PTEL_V;
690 				} else {
691 					cpu->cd.sh.utlb_lo[i] &=
692 					    ~(SH4_PTEL_D | SH4_PTEL_V);
693 					if (idata & SH4_UTLB_AA_D)
694 						cpu->cd.sh.utlb_lo[i] |=
695 						    SH4_PTEL_D;
696 					if (idata & SH4_UTLB_AA_V)
697 						cpu->cd.sh.utlb_lo[i] |=
698 						    SH4_PTEL_V;
699 				}
700 
701 				if (i >= 0)
702 					n_hits ++;
703 			}
704 
705 			if (n_hits > 1)
706 				sh_exception(cpu,
707 				    EXPEVT_RESET_TLB_MULTI_HIT, 0, 0);
708 		} else {
709 			if ((cpu->cd.sh.utlb_lo[e] & SH4_PTEL_SZ_MASK) ==
710 			    SH4_PTEL_SZ_4K) {
711 				safe_to_invalidate = 1;
712 				vaddr_to_invalidate =
713 				    cpu->cd.sh.utlb_hi[e] & ~0xfff;
714 			}
715 
716 			cpu->cd.sh.utlb_hi[e] &=
717 			    ~(SH4_PTEH_VPN_MASK | SH4_PTEH_ASID_MASK);
718 			cpu->cd.sh.utlb_hi[e] |= (idata &
719 			    (SH4_UTLB_AA_VPN_MASK | SH4_UTLB_AA_ASID_MASK));
720 
721 			cpu->cd.sh.utlb_lo[e] &= ~(SH4_PTEL_D | SH4_PTEL_V);
722 			if (idata & SH4_UTLB_AA_D)
723 				cpu->cd.sh.utlb_lo[e] |= SH4_PTEL_D;
724 			if (idata & SH4_UTLB_AA_V)
725 				cpu->cd.sh.utlb_lo[e] |= SH4_PTEL_V;
726 		}
727 
728 		if (safe_to_invalidate)
729 			cpu->invalidate_translation_caches(cpu,
730 			    vaddr_to_invalidate, INVALIDATE_VADDR);
731 		else
732 			cpu->invalidate_translation_caches(cpu, 0,
733 			    INVALIDATE_ALL);
734 	} else {
735 		odata = cpu->cd.sh.utlb_hi[e] &
736 		    (SH4_UTLB_AA_VPN_MASK | SH4_UTLB_AA_ASID_MASK);
737 		if (cpu->cd.sh.utlb_lo[e] & SH4_PTEL_D)
738 			odata |= SH4_UTLB_AA_D;
739 		if (cpu->cd.sh.utlb_lo[e] & SH4_PTEL_V)
740 			odata |= SH4_UTLB_AA_V;
741 		memory_writemax64(cpu, data, len, odata);
742 	}
743 
744 	return 1;
745 }
746 
747 
DEVICE_ACCESS(sh4_utlb_da1)748 DEVICE_ACCESS(sh4_utlb_da1)
749 {
750 	uint32_t mask = SH4_PTEL_WT | SH4_PTEL_SH | SH4_PTEL_D | SH4_PTEL_C
751 	    | SH4_PTEL_SZ_MASK | SH4_PTEL_PR_MASK | SH4_PTEL_V | 0x1ffffc00;
752 	uint64_t idata = 0, odata = 0;
753 	int e = (relative_addr & SH4_UTLB_E_MASK) >> SH4_UTLB_E_SHIFT;
754 
755 	if (relative_addr & 0x800000) {
756 		fatal("sh4_utlb_da1: TODO: da2 area\n");
757 		exit(1);
758 	}
759 
760 	if (writeflag == MEM_WRITE) {
761 		uint32_t old_lo = cpu->cd.sh.utlb_lo[e];
762 		int safe_to_invalidate = 0;
763 		if ((cpu->cd.sh.utlb_lo[e] & SH4_PTEL_SZ_MASK)==SH4_PTEL_SZ_4K)
764 			safe_to_invalidate = 1;
765 
766 		idata = memory_readmax64(cpu, data, len);
767 		cpu->cd.sh.utlb_lo[e] &= ~mask;
768 		cpu->cd.sh.utlb_lo[e] |= (idata & mask);
769 
770 		/*  Invalidate if this UTLB entry belongs to the
771 		    currently running process, or if it was shared:  */
772 		if (old_lo & SH4_PTEL_SH ||
773 		    (cpu->cd.sh.utlb_hi[e] & SH4_ITLB_AA_ASID_MASK) ==
774 		    (cpu->cd.sh.pteh & SH4_PTEH_ASID_MASK)) {
775 			if (safe_to_invalidate)
776 				cpu->invalidate_translation_caches(cpu,
777 				    cpu->cd.sh.utlb_hi[e] & ~0xfff,
778 				    INVALIDATE_VADDR);
779 			else
780 				cpu->invalidate_translation_caches(cpu,
781 				    0, INVALIDATE_ALL);
782 		}
783 	} else {
784 		odata = cpu->cd.sh.utlb_lo[e] & mask;
785 		memory_writemax64(cpu, data, len, odata);
786 	}
787 
788 	return 1;
789 }
790 
791 
DEVICE_ACCESS(sh4_pcic)792 DEVICE_ACCESS(sh4_pcic)
793 {
794 	struct sh4_data *d = (struct sh4_data *) extra;
795 	uint64_t idata = 0, odata = 0;
796 
797 	if (writeflag == MEM_WRITE)
798 		idata = memory_readmax64(cpu, data, len);
799 
800 	relative_addr += SH4_PCIC;
801 
802 	/*  Register read/write:  */
803 	if (writeflag == MEM_WRITE)
804 		d->pcic_reg[PCIC_REG(relative_addr)] = idata;
805 	else
806 		odata = d->pcic_reg[PCIC_REG(relative_addr)];
807 
808 	/*  Special cases:  */
809 
810 	switch (relative_addr) {
811 
812 	case SH4_PCICONF0:
813 		if (writeflag == MEM_WRITE) {
814 			fatal("[ sh4_pcic: TODO: Write to SH4_PCICONF0? ]\n");
815 			exit(1);
816 		} else {
817 			if (strcmp(cpu->cd.sh.cpu_type.name, "SH7751") == 0) {
818 				odata = PCI_ID_CODE(PCI_VENDOR_HITACHI,
819 				    PCI_PRODUCT_HITACHI_SH7751);
820 			} else if (strcmp(cpu->cd.sh.cpu_type.name,
821 			    "SH7751R") == 0) {
822 				odata = PCI_ID_CODE(PCI_VENDOR_HITACHI,
823 				    PCI_PRODUCT_HITACHI_SH7751R);
824 			} else {
825 				fatal("sh4_pcic: TODO: PCICONF0 read for"
826 				    " unimplemented CPU type?\n");
827 				exit(1);
828 			}
829 		}
830 		break;
831 
832 	case SH4_PCICONF1:
833 	case SH4_PCICONF2:
834 	case SH4_PCICR:
835 	case SH4_PCIBCR1:
836 	case SH4_PCIBCR2:
837 	case SH4_PCIBCR3:
838 	case SH4_PCIWCR1:
839 	case SH4_PCIWCR2:
840 	case SH4_PCIWCR3:
841 	case SH4_PCIMCR:
842 		break;
843 
844 	case SH4_PCICONF5:
845 		/*  Hardcoded to what OpenBSD/landisk uses:  */
846 		if (writeflag == MEM_WRITE && idata != 0xac000000) {
847 			fatal("sh4_pcic: SH4_PCICONF5 unknown value"
848 			    " 0x%" PRIx32"\n", (uint32_t) idata);
849 			exit(1);
850 		}
851 		break;
852 
853 	case SH4_PCICONF6:
854 		/*  Hardcoded to what OpenBSD/landisk uses:  */
855 		if (writeflag == MEM_WRITE && idata != 0x8c000000) {
856 			fatal("sh4_pcic: SH4_PCICONF6 unknown value"
857 			    " 0x%" PRIx32"\n", (uint32_t) idata);
858 			exit(1);
859 		}
860 		break;
861 
862 	case SH4_PCILSR0:
863 		/*  Hardcoded to what OpenBSD/landisk uses:  */
864 		if (writeflag == MEM_WRITE && idata != ((64 - 1) << 20)) {
865 			fatal("sh4_pcic: SH4_PCILSR0 unknown value"
866 			    " 0x%" PRIx32"\n", (uint32_t) idata);
867 			exit(1);
868 		}
869 		break;
870 
871 	case SH4_PCILAR0:
872 		/*  Hardcoded to what OpenBSD/landisk uses:  */
873 		if (writeflag == MEM_WRITE && idata != 0xac000000) {
874 			fatal("sh4_pcic: SH4_PCILAR0 unknown value"
875 			    " 0x%" PRIx32"\n", (uint32_t) idata);
876 			exit(1);
877 		}
878 		break;
879 
880 	case SH4_PCILSR1:
881 		/*  Hardcoded to what OpenBSD/landisk uses:  */
882 		if (writeflag == MEM_WRITE && idata != ((64 - 1) << 20)) {
883 			fatal("sh4_pcic: SH4_PCILSR1 unknown value"
884 			    " 0x%" PRIx32"\n", (uint32_t) idata);
885 			exit(1);
886 		}
887 		break;
888 
889 	case SH4_PCILAR1:
890 		/*  Hardcoded to what OpenBSD/landisk uses:  */
891 		if (writeflag == MEM_WRITE && idata != 0xac000000) {
892 			fatal("sh4_pcic: SH4_PCILAR1 unknown value"
893 			    " 0x%" PRIx32"\n", (uint32_t) idata);
894 			exit(1);
895 		}
896 		break;
897 
898 	case SH4_PCIMBR:
899 		if (writeflag == MEM_WRITE && idata != SH4_PCIC_MEM) {
900 			fatal("sh4_pcic: PCIMBR set to 0x%" PRIx32", not"
901 			    " 0x%" PRIx32"? TODO\n", (uint32_t) idata,
902 			    (uint32_t) SH4_PCIC_MEM);
903 			exit(1);
904 		}
905 		break;
906 
907 	case SH4_PCIIOBR:
908 		if (writeflag == MEM_WRITE && idata != SH4_PCIC_IO) {
909 			fatal("sh4_pcic: PCIIOBR set to 0x%" PRIx32", not"
910 			    " 0x%" PRIx32"? TODO\n", (uint32_t) idata,
911 			    (uint32_t) SH4_PCIC_IO);
912 			exit(1);
913 		}
914 		break;
915 
916 	case SH4_PCIPAR:
917 		/*  PCI bus access Address Register:  */
918 		{
919 			int bus  = (idata >> 16) & 0xff;
920 			int dev  = (idata >> 11) & 0x1f;
921 			int func = (idata >>  8) &    7;
922 			int reg  =  idata        & 0xff;
923 			bus_pci_setaddr(cpu, d->pci_data, bus, dev, func, reg);
924 		}
925 		break;
926 
927 	case SH4_PCIPDR:
928 		/*  PCI bus access Data Register:  */
929 		bus_pci_data_access(cpu, d->pci_data, writeflag == MEM_READ?
930 		    &odata : &idata, len, writeflag);
931 		break;
932 
933 	default:if (writeflag == MEM_READ) {
934 			fatal("[ sh4_pcic: read from addr 0x%x: TODO ]\n",
935 			    (int)relative_addr);
936 		} else {
937 			fatal("[ sh4_pcic: write to addr 0x%x: 0x%x: TODO ]\n",
938 			    (int)relative_addr, (int)idata);
939 		}
940 		exit(1);
941 	}
942 
943 	if (writeflag == MEM_READ)
944 		memory_writemax64(cpu, data, len, odata);
945 
946 	return 1;
947 }
948 
949 
DEVICE_ACCESS(sh4_sq)950 DEVICE_ACCESS(sh4_sq)
951 {
952 	struct sh4_data *d = (struct sh4_data *) extra;
953 	size_t i;
954 
955 	if (writeflag == MEM_WRITE) {
956 		for (i=0; i<len; i++)
957 			d->sq[(relative_addr + i) % sizeof(d->sq)] = data[i];
958 	} else {
959 		for (i=0; i<len; i++)
960 			data[i] = d->sq[(relative_addr + i) % sizeof(d->sq)];
961 	}
962 
963 	return 1;
964 }
965 
966 
DEVICE_ACCESS(sh4)967 DEVICE_ACCESS(sh4)
968 {
969 	struct sh4_data *d = (struct sh4_data *) extra;
970 	uint64_t idata = 0, odata = 0;
971 	int timer_nr = 0, dma_channel = 0;
972 
973 	if (writeflag == MEM_WRITE)
974 		idata = memory_readmax64(cpu, data, len);
975 
976 	relative_addr += SH4_REG_BASE;
977 
978 	/*  SD-RAM access uses address only:  */
979 	if (relative_addr >= 0xff900000 && relative_addr <= 0xff97ffff) {
980 		/*  Possibly not 100% correct... TODO  */
981 		int v = (relative_addr >> 2) & 0xffff;
982 		if (relative_addr & 0x00040000)
983 			d->sdmr3 = v;
984 		else
985 			d->sdmr2 = v;
986 		debug("[ sh4: sdmr%i set to 0x%04" PRIx16" ]\n",
987 		    relative_addr & 0x00040000? 3 : 2, v);
988 		return 1;
989 	}
990 
991 
992 	switch (relative_addr) {
993 
994 	/*************************************************/
995 
996 	case SH4_PVR_ADDR:
997 		odata = cpu->cd.sh.cpu_type.pvr;
998 		break;
999 
1000 	case SH4_PRR_ADDR:
1001 		odata = cpu->cd.sh.cpu_type.prr;
1002 		break;
1003 
1004 	case SH4_PTEH:
1005 		if (writeflag == MEM_READ)
1006 			odata = cpu->cd.sh.pteh;
1007 		else {
1008 			unsigned int old_asid = cpu->cd.sh.pteh
1009 			    & SH4_PTEH_ASID_MASK;
1010 			cpu->cd.sh.pteh = idata;
1011 
1012 			if ((idata & SH4_PTEH_ASID_MASK) != old_asid) {
1013 				/*
1014 				 *  TODO: Don't invalidate everything,
1015 				 *  only those pages that belonged to the
1016 				 *  old asid.
1017 				 */
1018 				cpu->invalidate_translation_caches(
1019 				    cpu, 0, INVALIDATE_ALL);
1020 			}
1021 		}
1022 		break;
1023 
1024 	case SH4_PTEL:
1025 		if (writeflag == MEM_READ)
1026 			odata = cpu->cd.sh.ptel;
1027 		else
1028 			cpu->cd.sh.ptel = idata;
1029 		break;
1030 
1031 	case SH4_TTB:
1032 		if (writeflag == MEM_READ)
1033 			odata = cpu->cd.sh.ttb;
1034 		else
1035 			cpu->cd.sh.ttb = idata;
1036 		break;
1037 
1038 	case SH4_TEA:
1039 		if (writeflag == MEM_READ)
1040 			odata = cpu->cd.sh.tea;
1041 		else
1042 			cpu->cd.sh.tea = idata;
1043 		break;
1044 
1045 	case SH4_PTEA:
1046 		if (writeflag == MEM_READ)
1047 			odata = cpu->cd.sh.ptea;
1048 		else
1049 			cpu->cd.sh.ptea = idata;
1050 		break;
1051 
1052 	case SH4_MMUCR:
1053 		if (writeflag == MEM_READ) {
1054 			odata = cpu->cd.sh.mmucr;
1055 		} else {
1056 			if (idata & SH4_MMUCR_TI) {
1057 				/*  TLB invalidate.  */
1058 				int i;
1059 				for (i = 0; i < SH_N_ITLB_ENTRIES; i++)
1060 					cpu->cd.sh.itlb_lo[i] &=
1061 					    ~SH4_PTEL_V;
1062 
1063 				for (i = 0; i < SH_N_UTLB_ENTRIES; i++)
1064 					cpu->cd.sh.utlb_lo[i] &=
1065 					    ~SH4_PTEL_V;
1066 
1067 				cpu->invalidate_translation_caches(cpu,
1068 				    0, INVALIDATE_ALL);
1069 
1070 				/*  The TI bit should always read as 0.  */
1071 				idata &= ~SH4_MMUCR_TI;
1072 			}
1073 
1074 			cpu->cd.sh.mmucr = idata;
1075 		}
1076 		break;
1077 
1078 	case SH4_CCR:
1079 		if (writeflag == MEM_READ) {
1080 			odata = cpu->cd.sh.ccr;
1081 		} else {
1082 			cpu->cd.sh.ccr = idata;
1083 		}
1084 		break;
1085 
1086 	case SH4_QACR0:
1087 		if (writeflag == MEM_READ) {
1088 			odata = cpu->cd.sh.qacr0;
1089 		} else {
1090 			cpu->cd.sh.qacr0 = idata;
1091 		}
1092 		break;
1093 
1094 	case SH4_QACR1:
1095 		if (writeflag == MEM_READ) {
1096 			odata = cpu->cd.sh.qacr1;
1097 		} else {
1098 			cpu->cd.sh.qacr1 = idata;
1099 		}
1100 		break;
1101 
1102 	case SH4_TRA:
1103 		if (writeflag == MEM_READ)
1104 			odata = cpu->cd.sh.tra;
1105 		else
1106 			cpu->cd.sh.tra = idata;
1107 		break;
1108 
1109 	case SH4_EXPEVT:
1110 		if (writeflag == MEM_READ)
1111 			odata = cpu->cd.sh.expevt;
1112 		else
1113 			cpu->cd.sh.expevt = idata;
1114 		break;
1115 
1116 	case SH4_INTEVT:
1117 		if (writeflag == MEM_READ)
1118 			odata = cpu->cd.sh.intevt;
1119 		else
1120 			cpu->cd.sh.intevt = idata;
1121 		break;
1122 
1123 
1124 	/********************************/
1125 	/*  UBC: User Break Controller  */
1126 
1127 	case 0xff000014:    /*  SH4_UBC_BASRA  */
1128 	case 0xff000018:    /*  SH4_UBC_BASRB  */
1129 
1130 	case 0xff200000:    /*  SH4_UBC_BARA  */
1131 	case 0xff200004:    /*  SH4_UBC_BAMRA  */
1132 	case 0xff200008:    /*  SH4_UBC_BBRA  */
1133 	case 0xff20000c:    /*  SH4_UBC_BARB  */
1134 	case 0xff200010:    /*  SH4_UBC_BAMRB  */
1135 	case 0xff200014:    /*  SH4_UBC_BBRB  */
1136 	case 0xff200018:    /*  SH4_UBC_BDRB  */
1137 	case 0xff20001c:    /*  SH4_UBC_BDMRB  */
1138 	case 0xff200020:    /*  SH4_UBC_BRCR  */
1139 		/*  TODO  */
1140 		break;
1141 
1142 
1143 	/********************************/
1144 	/*  TMU: Timer Management Unit  */
1145 
1146 	case SH4_TOCR:
1147 		/*  Timer Output Control Register  */
1148 		if (writeflag == MEM_WRITE) {
1149 			d->tocr = idata;
1150 			if (idata & TOCR_TCOE)
1151 				fatal("[ sh4 timer: TCOE not yet "
1152 				    "implemented ]\n");
1153 		} else {
1154 			odata = d->tocr;
1155 		}
1156 		break;
1157 
1158 	case SH4_TSTR:
1159 		/*  Timer Start Register  */
1160 		if (writeflag == MEM_READ) {
1161 			odata = d->tstr;
1162 		} else {
1163 			if (idata & 1 && !(d->tstr & 1))
1164 				debug("[ sh4 timer: starting timer 0 ]\n");
1165 			if (idata & 2 && !(d->tstr & 2))
1166 				debug("[ sh4 timer: starting timer 1 ]\n");
1167 			if (idata & 4 && !(d->tstr & 4))
1168 				debug("[ sh4 timer: starting timer 2 ]\n");
1169 			if (!(idata & 1) && d->tstr & 1)
1170 				debug("[ sh4 timer: stopping timer 0 ]\n");
1171 			if (!(idata & 2) && d->tstr & 2)
1172 				debug("[ sh4 timer: stopping timer 1 ]\n");
1173 			if (!(idata & 4) && d->tstr & 4)
1174 				debug("[ sh4 timer: stopping timer 2 ]\n");
1175 			d->tstr = idata;
1176 		}
1177 		break;
1178 
1179 	case SH4_TCOR2:
1180 		timer_nr ++;
1181 		// fall through
1182 	case SH4_TCOR1:
1183 		timer_nr ++;
1184 		// fall through
1185 	case SH4_TCOR0:
1186 		/*  Timer Constant Register  */
1187 		if (writeflag == MEM_READ)
1188 			odata = d->tcor[timer_nr];
1189 		else
1190 			d->tcor[timer_nr] = idata;
1191 		break;
1192 
1193 	case SH4_TCNT2:
1194 		timer_nr ++;
1195 		// fall through
1196 	case SH4_TCNT1:
1197 		timer_nr ++;
1198 		// fall through
1199 	case SH4_TCNT0:
1200 		/*  Timer Counter Register  */
1201 		if (writeflag == MEM_READ)
1202 			odata = d->tcnt[timer_nr];
1203 		else
1204 			d->tcnt[timer_nr] = idata;
1205 		break;
1206 
1207 	case SH4_TCR2:
1208 		timer_nr ++;
1209 		// fall through
1210 	case SH4_TCR1:
1211 		timer_nr ++;
1212 		// fall through
1213 	case SH4_TCR0:
1214 		/*  Timer Control Register  */
1215 		if (writeflag == MEM_READ) {
1216 			odata = d->tcr[timer_nr];
1217 		} else {
1218 			if (cpu->cd.sh.pclock == 0) {
1219 				fatal("INTERNAL ERROR: pclock must be set"
1220 				    " for this machine. Aborting.\n");
1221 				exit(1);
1222 			}
1223 
1224 			switch (idata & 3) {
1225 			case TCR_TPSC_P4:
1226 				d->timer_hz[timer_nr] = cpu->cd.sh.pclock/4.0;
1227 				break;
1228 			case TCR_TPSC_P16:
1229 				d->timer_hz[timer_nr] = cpu->cd.sh.pclock/16.0;
1230 				break;
1231 			case TCR_TPSC_P64:
1232 				d->timer_hz[timer_nr] = cpu->cd.sh.pclock/64.0;
1233 				break;
1234 			case TCR_TPSC_P256:
1235 				d->timer_hz[timer_nr] = cpu->cd.sh.pclock/256.0;
1236 				break;
1237 			}
1238 
1239 			debug("[ sh4 timer %i clock set to %f Hz ]\n",
1240 			    timer_nr, d->timer_hz[timer_nr]);
1241 
1242 			if (idata & (TCR_ICPF | TCR_ICPE1 | TCR_ICPE0 |
1243 			    TCR_CKEG1 | TCR_CKEG0 | TCR_TPSC2)) {
1244 				fatal("Unimplemented SH4 timer control"
1245 				    " bits: 0x%08" PRIx32". Aborting.\n",
1246 				    (int) idata);
1247 				exit(1);
1248 			}
1249 
1250 			INTERRUPT_DEASSERT(d->timer_irq[timer_nr]);
1251 
1252 			if (d->tcr[timer_nr] & TCR_UNF && !(idata & TCR_UNF)) {
1253 				if (d->timer_interrupts_pending[timer_nr] > 0)
1254 					d->timer_interrupts_pending[timer_nr]--;
1255 			}
1256 
1257 			d->tcr[timer_nr] = idata;
1258 		}
1259 		break;
1260 
1261 
1262 	/*************************************************/
1263 	/*  DMAC: DMA Controller                         */
1264 	/*  4 channels on SH7750                         */
1265 	/*  8 channels on SH7760                         */
1266 
1267 	case SH4_SAR7:	dma_channel ++;
1268 			// fall through
1269 	case SH4_SAR6:	dma_channel ++;
1270 			// fall through
1271 	case SH4_SAR5:	dma_channel ++;
1272 			// fall through
1273 	case SH4_SAR4:	dma_channel ++;
1274 			// fall through
1275 	case SH4_SAR3:	dma_channel ++;
1276 			// fall through
1277 	case SH4_SAR2:	dma_channel ++;
1278 			// fall through
1279 	case SH4_SAR1:	dma_channel ++;
1280 			// fall through
1281 	case SH4_SAR0:
1282 		if (writeflag == MEM_READ)
1283 			odata = cpu->cd.sh.dmac_sar[dma_channel];
1284 		else
1285 			cpu->cd.sh.dmac_sar[dma_channel] = idata;
1286 		break;
1287 
1288 	case SH4_DAR7:	dma_channel ++;
1289 			// fall through
1290 	case SH4_DAR6:	dma_channel ++;
1291 			// fall through
1292 	case SH4_DAR5:	dma_channel ++;
1293 			// fall through
1294 	case SH4_DAR4:	dma_channel ++;
1295 			// fall through
1296 	case SH4_DAR3:	dma_channel ++;
1297 			// fall through
1298 	case SH4_DAR2:	dma_channel ++;
1299 			// fall through
1300 	case SH4_DAR1:	dma_channel ++;
1301 			// fall through
1302 	case SH4_DAR0:
1303 		if (writeflag == MEM_READ)
1304 			odata = cpu->cd.sh.dmac_dar[dma_channel];
1305 		else
1306 			cpu->cd.sh.dmac_dar[dma_channel] = idata;
1307 		break;
1308 
1309 	case SH4_DMATCR7: dma_channel ++;
1310 			// fall through
1311 	case SH4_DMATCR6: dma_channel ++;
1312 			// fall through
1313 	case SH4_DMATCR5: dma_channel ++;
1314 			// fall through
1315 	case SH4_DMATCR4: dma_channel ++;
1316 			// fall through
1317 	case SH4_DMATCR3: dma_channel ++;
1318 			// fall through
1319 	case SH4_DMATCR2: dma_channel ++;
1320 			// fall through
1321 	case SH4_DMATCR1: dma_channel ++;
1322 			// fall through
1323 	case SH4_DMATCR0:
1324 		if (writeflag == MEM_READ)
1325 			odata = cpu->cd.sh.dmac_tcr[dma_channel] & 0x00ffffff;
1326 		else {
1327 			if (idata & ~0x00ffffff) {
1328 				fatal("[ SH4 DMA: Attempt to set top 8 "
1329 				    "bits of the count register? 0x%08"
1330 				    PRIx32" ]\n", (uint32_t) idata);
1331 				exit(1);
1332 			}
1333 
1334 			cpu->cd.sh.dmac_tcr[dma_channel] = idata;
1335 		}
1336 		break;
1337 
1338 	case SH4_CHCR7:	dma_channel ++;
1339 			// fall through
1340 	case SH4_CHCR6:	dma_channel ++;
1341 			// fall through
1342 	case SH4_CHCR5:	dma_channel ++;
1343 			// fall through
1344 	case SH4_CHCR4:	dma_channel ++;
1345 			// fall through
1346 	case SH4_CHCR3:	dma_channel ++;
1347 			// fall through
1348 	case SH4_CHCR2:	dma_channel ++;
1349 			// fall through
1350 	case SH4_CHCR1:	dma_channel ++;
1351 			// fall through
1352 	case SH4_CHCR0:
1353 		if (writeflag == MEM_READ) {
1354 			odata = cpu->cd.sh.dmac_chcr[dma_channel];
1355 		} else {
1356 			/*  CHCR_CHSET always reads back as 0:  */
1357 			idata &= ~CHCR_CHSET;
1358 
1359 			cpu->cd.sh.dmac_chcr[dma_channel] = idata;
1360 
1361 			/*  Perform a transfer?  */
1362 			if (idata & CHCR_TD)
1363 				sh4_dmac_transfer(cpu, d, dma_channel);
1364 		}
1365 		break;
1366 
1367 	case SH4_DMAOR:
1368 		if (writeflag == MEM_READ) {
1369 			odata = cpu->cd.sh.dmaor;
1370 		} else {
1371 			// Only some bits are writable:
1372 			idata &= (DMAOR_DDT | DMAOR_PR1 | DMAOR_PR0 | DMAOR_DME);
1373 			cpu->cd.sh.dmaor = idata;
1374 		}
1375 		break;
1376 
1377 	/*************************************************/
1378 	/*  BSC: Bus State Controller                    */
1379 
1380 	case SH4_BCR1:
1381 		if (writeflag == MEM_WRITE)
1382 			d->bsc_bcr1 = idata & 0x033efffd;
1383 		else {
1384 			odata = d->bsc_bcr1;
1385 			if (cpu->byte_order == EMUL_LITTLE_ENDIAN)
1386 				odata |= BCR1_LITTLE_ENDIAN;
1387 		}
1388 		break;
1389 
1390 	case SH4_BCR2:
1391 		if (len != sizeof(uint16_t)) {
1392 			fatal("Non-16-bit SH4_BCR2 access?\n");
1393 			exit(1);
1394 		}
1395 		if (writeflag == MEM_WRITE)
1396 			d->bsc_bcr2 = idata & 0x3ffd;
1397 		else
1398 			odata = d->bsc_bcr2;
1399 		break;
1400 
1401 	case SH4_BCR3:
1402 		if (len != sizeof(uint16_t)) {
1403 			fatal("Non-16-bit SH4_BCR3 access?\n");
1404 			exit(1);
1405 		}
1406 		if (writeflag == MEM_WRITE)
1407 			d->bsc_bcr3 = idata;
1408 		else
1409 			odata = d->bsc_bcr3;
1410 		break;
1411 
1412 	case SH4_WCR1:
1413 		if (writeflag == MEM_WRITE)
1414 			d->bsc_wcr1 = idata & 0x77777777;
1415 		else
1416 			odata = d->bsc_wcr1;
1417 		break;
1418 
1419 	case SH4_WCR2:
1420 		if (writeflag == MEM_WRITE)
1421 			d->bsc_wcr2 = idata & 0xfffeefff;
1422 		else
1423 			odata = d->bsc_wcr2;
1424 		break;
1425 
1426 	case SH4_WCR3:
1427 		if (writeflag == MEM_WRITE)
1428 			d->bsc_wcr3 = idata & 0x77777777;
1429 		else
1430 			odata = d->bsc_wcr3;
1431 		break;
1432 
1433 	case SH4_MCR:
1434 		if (writeflag == MEM_WRITE)
1435 			d->bsc_mcr = idata & 0xf8bbffff;
1436 		else
1437 			odata = d->bsc_mcr;
1438 		break;
1439 
1440 	case SH4_PCR:
1441 		if (writeflag == MEM_WRITE)
1442 			d->bsc_pcr = idata;
1443 		else
1444 			odata = d->bsc_pcr;
1445 		break;
1446 
1447 	case SH4_RTCSR:
1448 		/*
1449 		 *  Refresh Time Control/Status Register. Called RTCSR in
1450 		 *  NetBSD, but RTSCR in the SH7750 manual?
1451 		 */
1452 		if (writeflag == MEM_WRITE) {
1453 			idata &= 0x00ff;
1454 			if (idata & RTCSR_CMF) {
1455 				idata = (idata & ~RTCSR_CMF)
1456 				    | (d->bsc_rtcsr & RTCSR_CMF);
1457 			}
1458 			d->bsc_rtcsr = idata & 0x00ff;
1459 		} else
1460 			odata = d->bsc_rtcsr;
1461 		break;
1462 
1463 	case SH4_RTCOR:
1464 		/*  Refresh Time Constant Register (8 bits):  */
1465 		if (writeflag == MEM_WRITE)
1466 			d->bsc_rtcor = idata & 0x00ff;
1467 		else
1468 			odata = d->bsc_rtcor & 0x00ff;
1469 		break;
1470 
1471 	case SH4_RFCR:
1472 		/*  Refresh Count Register (10 bits):  */
1473 		if (writeflag == MEM_WRITE)
1474 			d->bsc_rfcr = idata & 0x03ff;
1475 		else
1476 			odata = d->bsc_rfcr & 0x03ff;
1477 		break;
1478 
1479 
1480 	/*******************************************/
1481 	/*  GPIO:  General-purpose I/O controller  */
1482 
1483 	case SH4_PCTRA:
1484 		if (writeflag == MEM_WRITE) {
1485 			d->pctra = idata;
1486 
1487 			// Hack: Makes the Dreamcast BIOS pass "cable select"
1488 			// detection, it seems, without hanging in an endless
1489 			// loop.
1490 			d->pdtra |= 0x03;
1491 		} else {
1492 			odata = d->pctra;
1493 		}
1494 		break;
1495 
1496 	case SH4_PDTRA:
1497 		if (writeflag == MEM_WRITE) {
1498 			// debug("[ sh4: pdtra: write 0x%08x (while pctra = 0x%08x) ]\n", (int)idata, (int)d->pctra);
1499 			d->pdtra = idata;
1500 
1501 			// Hack: Makes the Dreamcast BIOS pass "cable select"
1502 			// detection, it seems, without hanging in an endless
1503 			// loop.
1504 			if ((idata & 1) == 0 || (idata & 2) == 0)
1505 				d->pdtra &= ~3;
1506 		} else {
1507 			// debug("[ sh4: pdtra: read ]\n");
1508 			odata = d->pdtra;
1509 
1510 			// bits 8..9 on Dreamcast mean:
1511 			//  00 = VGA, 10 = RGB, 11 = composite.
1512 			odata |= (0 << 8);
1513 		}
1514 		break;
1515 
1516 	case SH4_PCTRB:
1517 		if (writeflag == MEM_WRITE)
1518 			d->pctrb = idata;
1519 		else
1520 			odata = d->pctrb;
1521 		break;
1522 
1523 	case SH4_PDTRB:
1524 		if (writeflag == MEM_WRITE) {
1525 			debug("[ sh4: pdtrb: write: TODO ]\n");
1526 			d->pdtrb = idata;
1527 		} else {
1528 			debug("[ sh4: pdtrb: read: TODO ]\n");
1529 			odata = d->pdtrb;
1530 		}
1531 		break;
1532 
1533 	case SH4_GPIOIC:
1534 		if (writeflag == MEM_WRITE)
1535 			d->bsc_gpioic = idata;
1536 		else
1537 			odata = d->bsc_gpioic;
1538 		break;
1539 
1540 
1541 	/****************************/
1542 	/*  SCI:  Serial Interface  */
1543 
1544 	case SHREG_SCSPTR:
1545 		odata = sh4_sci_access(d, cpu,
1546 		    writeflag == MEM_WRITE? 1 : 0, idata);
1547 
1548 		/*
1549 		 *  TODO
1550 		 *
1551 		 *  Find out the REAL way to make OpenBSD/landisk 4.1 run
1552 		 *  in a stable manner! This is a SUPER-UGLY HACK which
1553 		 *  just side-steps the real bug.
1554 		 *
1555 		 *  NOTE:  Snapshots of OpenBSD/landisk _after_ 4.1 seem
1556 		 *  to work WITHOUT this hack, but NOT with it!
1557 		 */
1558 		cpu->invalidate_translation_caches(cpu, 0, INVALIDATE_ALL);
1559 
1560 		break;
1561 
1562 
1563 	/*********************************/
1564 	/*  INTC:  Interrupt Controller  */
1565 
1566 	case SH4_ICR:
1567 		if (writeflag == MEM_WRITE) {
1568 			if (idata & 0x80) {
1569 				fatal("SH4 INTC: IRLM not yet "
1570 				    "supported. TODO\n");
1571 				exit(1);
1572 			}
1573 		}
1574 		break;
1575 
1576 	case SH4_IPRA:
1577 		if (writeflag == MEM_READ)
1578 			odata = cpu->cd.sh.intc_ipra;
1579 		else {
1580 			cpu->cd.sh.intc_ipra = idata;
1581 			sh_update_interrupt_priorities(cpu);
1582 		}
1583 		break;
1584 
1585 	case SH4_IPRB:
1586 		if (writeflag == MEM_READ)
1587 			odata = cpu->cd.sh.intc_iprb;
1588 		else {
1589 			cpu->cd.sh.intc_iprb = idata;
1590 			sh_update_interrupt_priorities(cpu);
1591 		}
1592 		break;
1593 
1594 	case SH4_IPRC:
1595 		if (writeflag == MEM_READ)
1596 			odata = cpu->cd.sh.intc_iprc;
1597 		else {
1598 			cpu->cd.sh.intc_iprc = idata;
1599 			sh_update_interrupt_priorities(cpu);
1600 		}
1601 		break;
1602 
1603 	case SH4_IPRD:
1604 		if (writeflag == MEM_READ)
1605 			odata = cpu->cd.sh.intc_iprd;
1606 		else {
1607 			cpu->cd.sh.intc_iprd = idata;
1608 			sh_update_interrupt_priorities(cpu);
1609 		}
1610 		break;
1611 
1612 	case SH4_INTPRI00:
1613 		if (writeflag == MEM_READ)
1614 			odata = cpu->cd.sh.intc_intpri00;
1615 		else {
1616 			cpu->cd.sh.intc_intpri00 = idata;
1617 			sh_update_interrupt_priorities(cpu);
1618 		}
1619 		break;
1620 
1621 	case SH4_INTPRI00 + 4:
1622 		if (writeflag == MEM_READ)
1623 			odata = cpu->cd.sh.intc_intpri04;
1624 		else {
1625 			cpu->cd.sh.intc_intpri04 = idata;
1626 			sh_update_interrupt_priorities(cpu);
1627 		}
1628 		break;
1629 
1630 	case SH4_INTPRI00 + 8:
1631 		if (writeflag == MEM_READ)
1632 			odata = cpu->cd.sh.intc_intpri08;
1633 		else {
1634 			cpu->cd.sh.intc_intpri08 = idata;
1635 			sh_update_interrupt_priorities(cpu);
1636 		}
1637 		break;
1638 
1639 	case SH4_INTPRI00 + 0xc:
1640 		if (writeflag == MEM_READ)
1641 			odata = cpu->cd.sh.intc_intpri0c;
1642 		else {
1643 			cpu->cd.sh.intc_intpri0c = idata;
1644 			sh_update_interrupt_priorities(cpu);
1645 		}
1646 		break;
1647 
1648 	case SH4_INTMSK00:
1649 		/*  Note: Writes can only set bits, not clear them.  */
1650 		if (writeflag == MEM_READ)
1651 			odata = cpu->cd.sh.intc_intmsk00;
1652 		else
1653 			cpu->cd.sh.intc_intmsk00 |= idata;
1654 		break;
1655 
1656 	case SH4_INTMSK00 + 4:
1657 		/*  Note: Writes can only set bits, not clear them.  */
1658 		if (writeflag == MEM_READ)
1659 			odata = cpu->cd.sh.intc_intmsk04;
1660 		else
1661 			cpu->cd.sh.intc_intmsk04 |= idata;
1662 		break;
1663 
1664 	case SH4_INTMSKCLR00:
1665 		/*  Note: Writes can only clear bits, not set them.  */
1666 		if (writeflag == MEM_WRITE)
1667 			cpu->cd.sh.intc_intmsk00 &= ~idata;
1668 		break;
1669 
1670 	case SH4_INTMSKCLR00 + 4:
1671 		/*  Note: Writes can only clear bits, not set them.  */
1672 		if (writeflag == MEM_WRITE)
1673 			cpu->cd.sh.intc_intmsk04 &= ~idata;
1674 		break;
1675 
1676 
1677 	/*************************************************/
1678 	/*  SCIF: Serial Controller Interface with FIFO  */
1679 
1680 	case SH4_SCIF_BASE + SCIF_SMR:
1681 		if (writeflag == MEM_WRITE) {
1682 			d->scif_smr = idata;
1683 		} else {
1684 			odata = d->scif_smr;
1685 		}
1686 		break;
1687 
1688 	case SH4_SCIF_BASE + SCIF_BRR:
1689 		if (writeflag == MEM_WRITE) {
1690 			d->scif_brr = idata;
1691 		} else {
1692 			odata = d->scif_brr;
1693 		}
1694 		break;
1695 
1696 	case SH4_SCIF_BASE + SCIF_SCR:
1697 		if (writeflag == MEM_WRITE) {
1698 			d->scif_scr = idata;
1699 			scif_reassert_interrupts(d);
1700 		} else {
1701 			odata = d->scif_scr;
1702 		}
1703 		break;
1704 
1705 	case SH4_SCIF_BASE + SCIF_FTDR:
1706 		if (writeflag == MEM_WRITE) {
1707 			/*  Add to TX fifo:  */
1708 			if (d->scif_tx_fifo_cursize >=
1709 			    sizeof(d->scif_tx_fifo)) {
1710 				fatal("[ SCIF TX fifo overrun! ]\n");
1711 				d->scif_tx_fifo_cursize = 0;
1712 			}
1713 
1714 			d->scif_tx_fifo[d->scif_tx_fifo_cursize++] = idata;
1715 			d->scif_delayed_tx = SCIF_DELAYED_TX_VALUE;
1716 		}
1717 		break;
1718 
1719 	case SH4_SCIF_BASE + SCIF_SSR:
1720 		if (writeflag == MEM_READ) {
1721 			odata = d->scif_ssr;
1722 		} else {
1723 			d->scif_ssr = idata;
1724 			scif_reassert_interrupts(d);
1725 		}
1726 		break;
1727 
1728 	case SH4_SCIF_BASE + SCIF_FRDR:
1729 		{
1730 			int x = console_readchar(d->scif_console_handle);
1731 			if (x == 13)
1732 				x = 10;
1733 			odata = x < 0? 0 : x;
1734 			if (console_charavail(d->scif_console_handle))
1735 				d->scif_ssr |= SCSSR2_DR;
1736 			else
1737 				d->scif_ssr &= ~SCSSR2_DR;
1738 			scif_reassert_interrupts(d);
1739 		}
1740 		break;
1741 
1742 	case SH4_SCIF_BASE + SCIF_FCR:
1743 		if (writeflag == MEM_WRITE) {
1744 			d->scif_fcr = idata;
1745 		} else {
1746 			odata = d->scif_fcr;
1747 		}
1748 		break;
1749 
1750 	case SH4_SCIF_BASE + SCIF_FDR:
1751 		/*  Nr of bytes in the TX and RX fifos, respectively:  */
1752 		{
1753 			int chars_avail = console_charavail(d->scif_console_handle);
1754 			if (chars_avail > 255) {
1755 				fatal("[ SH4: Too many chars avail; dropping some ]\n");
1756 				chars_avail = 255;
1757 			}
1758 
1759 			odata = chars_avail | (d->scif_tx_fifo_cursize << 8);
1760 		}
1761 		break;
1762 
1763 	case SH4_SCIF_BASE + SCIF_SPTR:
1764 		/*  TODO: Implement all bits.  */
1765 		odata = 0;
1766 		break;
1767 
1768 	case SH4_SCIF_BASE + SCIF_LSR:
1769 		/*  TODO: Implement all bits.  */
1770 		odata = 0;
1771 		break;
1772 
1773 
1774 	/*************************************************/
1775 
1776 	case SH4_CPG_FRQCR:	// 0xffc00000	16-bit
1777 		if (writeflag == MEM_WRITE)
1778 			d->cpg_frqcr = idata;
1779 		else
1780 			odata = d->cpg_frqcr;
1781 		break;
1782 
1783 	case SH4_CPG_STBCR: 	// 0xffc00004	8-bit
1784 		if (writeflag == MEM_WRITE)
1785 			d->cpg_stbcr = idata;
1786 		else
1787 			odata = d->cpg_stbcr;
1788 		break;
1789 
1790 	case SH4_CPG_WTCNT:	// 0xffc00008	8/16-bit
1791 		if (writeflag == MEM_WRITE)
1792 			d->cpg_wtcnt = idata;
1793 		else
1794 			odata = d->cpg_wtcnt;
1795 		break;
1796 
1797 	case SH4_CPG_WTCSR:	// 0xffc0000c	8/16-bit
1798 		if (writeflag == MEM_WRITE)
1799 			d->cpg_wtcsr = idata;
1800 		else
1801 			odata = d->cpg_wtcsr;
1802 		break;
1803 
1804 	case SH4_CPG_STBCR2:	// 0xffc00010	8-bit
1805 		if (writeflag == MEM_WRITE)
1806 			d->cpg_stbcr2 = idata;
1807 		else
1808 			odata = d->cpg_stbcr2;
1809 		break;
1810 
1811 
1812 	/*************************************************/
1813 
1814 	case SH4_RSECCNT:
1815 	case SH4_RMINCNT:
1816 	case SH4_RHRCNT:
1817 	case SH4_RWKCNT:
1818 	case SH4_RDAYCNT:
1819 	case SH4_RMONCNT:
1820 	case SH4_RYRCNT:
1821 	case SH4_RSECAR:
1822 	case SH4_RMINAR:
1823 	case SH4_RHRAR:
1824 	case SH4_RWKAR:
1825 	case SH4_RDAYAR:
1826 	case SH4_RMONAR:
1827 		if (writeflag == MEM_WRITE) {
1828 			d->rtc_reg[(relative_addr - 0xffc80000) / 4] = idata;
1829 		} else {
1830 			/*  TODO: Update rtc_reg based on host's date/time.  */
1831 			odata = d->rtc_reg[(relative_addr - 0xffc80000) / 4];
1832 		}
1833 		break;
1834 
1835 	case SH4_RCR1:
1836 		if (writeflag == MEM_READ)
1837 			odata = d->rtc_rcr1;
1838 		else {
1839 			d->rtc_rcr1 = idata;
1840 			if (idata & 0x18) {
1841 				fatal("SH4: TODO: RTC interrupt enable\n");
1842 				exit(1);
1843 			}
1844 		}
1845 		break;
1846 
1847 	case SH4_RCR2:
1848 		if (writeflag == MEM_READ)
1849 			odata = d->rtc_rcr2;
1850 		else {
1851 			d->rtc_rcr2 = idata;
1852 			// bit 1 (i.e. idata == 0x02) means reset.
1853 			if (idata != 0x02) {
1854 				debug("[ SH4: TODO: RTC RCR2 value 0x%02x ignored. ]\n", (int)idata);
1855 			}
1856 		}
1857 		break;
1858 
1859 
1860 	/*************************************************/
1861 
1862 	default:if (writeflag == MEM_READ) {
1863 			fatal("[ sh4: read from addr 0x%x ]\n",
1864 			    (int)relative_addr);
1865 		} else {
1866 			fatal("[ sh4: write to addr 0x%x: 0x%x ]\n",
1867 			    (int)relative_addr, (int)idata);
1868 		}
1869 
1870 #ifdef SH4_DEBUG
1871 		exit(1);
1872 #endif
1873 	}
1874 
1875 	if (writeflag == MEM_READ)
1876 		memory_writemax64(cpu, data, len, odata);
1877 
1878 	return 1;
1879 }
1880 
1881 
DEVINIT(sh4)1882 DEVINIT(sh4)
1883 {
1884 	char tmp[200], n[200];
1885 	int i;
1886 	struct machine *machine = devinit->machine;
1887 	struct sh4_data *d;
1888 
1889 	CHECK_ALLOCATION(d = (struct sh4_data *) malloc(sizeof(struct sh4_data)));
1890 	memset(d, 0, sizeof(struct sh4_data));
1891 
1892 
1893 	/*
1894 	 *  Main SH4 device, and misc memory stuff:
1895 	 */
1896 
1897 	memory_device_register(machine->memory, devinit->name,
1898 	    SH4_REG_BASE, 0x01000000, dev_sh4_access, d, DM_DEFAULT, NULL);
1899 
1900 	/*  On-chip RAM/cache:  */
1901 	dev_ram_init(machine, 0x1e000000, 0x8000, DEV_RAM_RAM, 0x0);
1902 
1903 	/*  0xe0000000: Store queues:  */
1904 	memory_device_register(machine->memory, "sh4_sq",
1905 	    0xe0000000, 0x04000000, dev_sh4_sq_access, d, DM_DEFAULT, NULL);
1906 
1907 
1908 	/*
1909 	 *  SCIF (Serial console):
1910 	 */
1911 
1912 	d->scif_console_handle = console_start_slave(devinit->machine,
1913 	    "SH4 SCIF", 1);
1914 
1915 	snprintf(tmp, sizeof(tmp), "%s.irq[0x%x]",
1916 	    devinit->interrupt_path, SH4_INTEVT_SCIF_RXI);
1917 	INTERRUPT_CONNECT(tmp, d->scif_rx_irq);
1918 	snprintf(tmp, sizeof(tmp), "%s.irq[0x%x]",
1919 	    devinit->interrupt_path, SH4_INTEVT_SCIF_TXI);
1920 	INTERRUPT_CONNECT(tmp, d->scif_tx_irq);
1921 
1922 
1923 	/*
1924 	 *  Caches (fake):
1925  	 *
1926 	 *  0xf0000000	SH4_CCIA	I-Cache address array
1927 	 *  0xf1000000	SH4_CCID	I-Cache data array
1928 	 *  0xf4000000	SH4_CCDA	D-Cache address array
1929 	 *  0xf5000000	SH4_CCDD	D-Cache data array
1930 	 *
1931 	 *  TODO: Implement more correct cache behavior?
1932 	 */
1933 
1934 	dev_ram_init(machine, SH4_CCIA, SH4_ICACHE_SIZE * 2, DEV_RAM_RAM, 0x0);
1935 	dev_ram_init(machine, SH4_CCID, SH4_ICACHE_SIZE,     DEV_RAM_RAM, 0x0);
1936 	dev_ram_init(machine, SH4_CCDA, SH4_DCACHE_SIZE * 2, DEV_RAM_RAM, 0x0);
1937 	dev_ram_init(machine, SH4_CCDD, SH4_DCACHE_SIZE,     DEV_RAM_RAM, 0x0);
1938 
1939 	/*  0xf2000000	SH4_ITLB_AA  */
1940 	memory_device_register(machine->memory, "sh4_itlb_aa", SH4_ITLB_AA,
1941 	    0x01000000, dev_sh4_itlb_aa_access, d, DM_DEFAULT, NULL);
1942 
1943 	/*  0xf3000000	SH4_ITLB_DA1  */
1944 	memory_device_register(machine->memory, "sh4_itlb_da1", SH4_ITLB_DA1,
1945 	    0x01000000, dev_sh4_itlb_da1_access, d, DM_DEFAULT, NULL);
1946 
1947 	/*  0xf6000000	SH4_UTLB_AA  */
1948 	memory_device_register(machine->memory, "sh4_utlb_aa", SH4_UTLB_AA,
1949 	    0x01000000, dev_sh4_utlb_aa_access, d, DM_DEFAULT, NULL);
1950 
1951 	/*  0xf7000000	SH4_UTLB_DA1  */
1952 	memory_device_register(machine->memory, "sh4_utlb_da1", SH4_UTLB_DA1,
1953 	    0x01000000, dev_sh4_utlb_da1_access, d, DM_DEFAULT, NULL);
1954 
1955 
1956 	/*
1957 	 *  PCIC (PCI controller) at 0xfe200000:
1958 	 */
1959 
1960 	memory_device_register(machine->memory, "sh4_pcic", SH4_PCIC,
1961 	    N_PCIC_REGS * sizeof(uint32_t), dev_sh4_pcic_access, d,
1962 	    DM_DEFAULT, NULL);
1963 
1964 	/*  Initial PCI control register contents:  */
1965 	d->bsc_bcr2 = BCR2_PORTEN;
1966 	d->pcic_reg[PCIC_REG(SH4_PCICONF2)] = PCI_CLASS_CODE(PCI_CLASS_BRIDGE,
1967 	    PCI_SUBCLASS_BRIDGE_HOST, 0);
1968 
1969 	/*  Register 16 PCIC interrupts:  */
1970 	for (i=0; i<N_PCIC_IRQS; i++) {
1971 		struct interrupt templ;
1972 		snprintf(n, sizeof(n), "%s.pcic.%i",
1973 		    devinit->interrupt_path, i);
1974 		memset(&templ, 0, sizeof(templ));
1975 		templ.line = i;
1976 		templ.name = n;
1977 		templ.extra = d;
1978 		templ.interrupt_assert = sh4_pcic_interrupt_assert;
1979 		templ.interrupt_deassert = sh4_pcic_interrupt_deassert;
1980 		interrupt_handler_register(&templ);
1981 
1982 		snprintf(tmp, sizeof(tmp), "%s.irq[0x%x]",
1983 		    devinit->interrupt_path, SH4_INTEVT_IRQ0 + 0x20 * i);
1984 		INTERRUPT_CONNECT(tmp, d->cpu_pcic_interrupt[i]);
1985 	}
1986 
1987 	/*  Register the PCI bus:  */
1988 	snprintf(tmp, sizeof(tmp), "%s.pcic", devinit->interrupt_path);
1989 	d->pci_data = bus_pci_init(
1990 	    devinit->machine,
1991 	    tmp,			/*  pciirq  */
1992 	    0,				/*  pci device io offset  */
1993 	    0,				/*  pci device mem offset  */
1994 	    SH4_PCIC_IO,		/*  PCI portbase  */
1995 	    SH4_PCIC_MEM,		/*  PCI membase  */
1996 	    tmp,			/*  PCI irqbase  */
1997 	    0x00000000,			/*  ISA portbase  */
1998 	    0x00000000,			/*  ISA membase  */
1999 	    "TODOisaIrqBase");		/*  ISA irqbase  */
2000 
2001 	/*  Return PCI bus pointer, to allow per-machine devices
2002 	    to be added later:  */
2003 	devinit->return_ptr = d->pci_data;
2004 
2005 
2006 	/*
2007 	 *  Timer:
2008 	 */
2009 
2010 	d->sh4_timer = timer_add(SH4_PSEUDO_TIMER_HZ, sh4_timer_tick, d);
2011 	machine_add_tickfunction(devinit->machine, dev_sh4_tick, d,
2012 	    SH4_TICK_SHIFT);
2013 
2014 	/*  Initial Timer values, according to the SH7750 manual:  */
2015 	d->tcor[0] = 0xffffffff; d->tcnt[0] = 0xffffffff;
2016 	d->tcor[1] = 0xffffffff; d->tcnt[1] = 0xffffffff;
2017 	d->tcor[2] = 0xffffffff; d->tcnt[2] = 0xffffffff;
2018 
2019 	snprintf(tmp, sizeof(tmp), "machine[0].cpu[0].irq[0x%x]",
2020 	    SH_INTEVT_TMU0_TUNI0);
2021 	if (!interrupt_handler_lookup(tmp, &d->timer_irq[0])) {
2022 		fatal("Could not find interrupt '%s'.\n", tmp);
2023 		exit(1);
2024 	}
2025 	snprintf(tmp, sizeof(tmp), "machine[0].cpu[0].irq[0x%x]",
2026 	    SH_INTEVT_TMU1_TUNI1);
2027 	if (!interrupt_handler_lookup(tmp, &d->timer_irq[1])) {
2028 		fatal("Could not find interrupt '%s'.\n", tmp);
2029 		exit(1);
2030 	}
2031 	snprintf(tmp, sizeof(tmp), "machine[0].cpu[0].irq[0x%x]",
2032 	    SH_INTEVT_TMU2_TUNI2);
2033 	if (!interrupt_handler_lookup(tmp, &d->timer_irq[2])) {
2034 		fatal("Could not find interrupt '%s'.\n", tmp);
2035 		exit(1);
2036 	}
2037 
2038 
2039 	// The RTC RCR2 register is "basically" initialized to 0x09, with
2040 	// some bit undefined. :-) According to the manual.
2041 	d->rtc_rcr2 = 0x09;
2042 
2043 
2044 	/*
2045 	 *  Bus State Controller initial values, according to the
2046 	 *  SH7760 manual:
2047 	 */
2048 
2049 	d->bsc_bcr2 = 0x3ffc;
2050 	d->bsc_wcr1 = 0x77777777;
2051 	d->bsc_wcr2 = 0xfffeefff;
2052 	d->bsc_wcr3 = 0x77777777;
2053 
2054 	return 1;
2055 }
2056 
2057