提交: 6db1bc8e2ccef9bb8f9831cbd36674e404e845f7 - qemu (git)

Commit MetaInfo

• 修訂: 6db1bc8e2ccef9bb8f9831cbd36674e404e845f7 (tree)
• 時間: 2019-01-01 23:53:15
• 作者: Yoshinori Sato <ysato@user...>
• Commiter: Yoshinori Sato

Log Message

Add ms7619se support.

Change Summary

• modified: configure
• add: default-configs/sh2-softmmu.mak
• modified: hw/char/sh_serial.c
• modified: hw/intc/Makefile.objs
• add: hw/intc/sh7619_intc.c
• modified: hw/sh4/Makefile.objs
• add: hw/sh4/ms7619se.c
• add: hw/sh4/sh7619.c
• modified: hw/timer/Makefile.objs
• add: hw/timer/renesas_cmt.c
• add: include/hw/intc/sh7619intc.h
• modified: include/hw/sh4/sh.h
• add: include/hw/sh4/sh7619.h
• modified: include/hw/sh4/sh_intc.h
• add: include/hw/timer/renesas_cmt.h
• modified: target/sh4/cpu-qom.h
• modified: target/sh4/cpu.c
• modified: target/sh4/cpu.h
• modified: target/sh4/helper.c
• modified: target/sh4/translate.c

差異

--- a/configure
+++ b/configure
@@ -7020,7 +7020,7 @@ target_name=$(echo $target | cut -d '-' -f 1)
 target_bigendian="no"
 
 case "$target_name" in
-  armeb|aarch64_be|hppa|lm32|m68k|microblaze|mips|mipsn32|mips64|moxie|or1k|ppc|ppc64|ppc64abi32|s390x|sh4eb|sparc|sparc64|sparc32plus|xtensaeb)
+  armeb|aarch64_be|hppa|lm32|m68k|microblaze|mips|mipsn32|mips64|moxie|or1k|ppc|ppc64|ppc64abi32|s390x|sh2|sh4eb|sparc|sparc64|sparc32plus|xtensaeb)
   target_bigendian=yes
   ;;
 esac
@@ -7185,6 +7185,11 @@ case "$target_name" in
     mttcg=yes
     target_compiler=$cross_cc_riscv64
   ;;
+  sh2)
+    TARGET_ARCH=sh4
+    bflt="yes"
+    target_compiler=$cross_cc_sh4
+  ;;
   sh4|sh4eb)
     TARGET_ARCH=sh4
     bflt="yes"
@@ -7408,7 +7413,7 @@ for i in $ARCH $TARGET_BASE_ARCH ; do
   s390*)
     disas_config "S390"
   ;;
-  sh4)
+  sh*)
     disas_config "SH4"
   ;;
   sparc*)

--- /dev/null
+++ b/default-configs/sh2-softmmu.mak
@@ -0,0 +1,22 @@
+# Default configuration for sh2-softmmu
+
+include pci.mak
+include usb.mak
+CONFIG_SERIAL=y
+CONFIG_SERIAL_ISA=y
+CONFIG_PTIMER=y
+CONFIG_PFLASH_CFI02=y
+CONFIG_SH4=y
+CONFIG_IDE_MMIO=y
+CONFIG_SM501=y
+CONFIG_I2C=y
+CONFIG_DDC=y
+CONFIG_ISA_TESTDEV=y
+CONFIG_I82378=y
+CONFIG_I8259=y
+CONFIG_I8254=y
+CONFIG_PCSPK=y
+CONFIG_I82374=y
+CONFIG_I8257=y
+CONFIG_MC146818RTC=y
+CONFIG_RENESAS_CMT=y

--- a/hw/char/sh_serial.c
+++ b/hw/char/sh_serial.c
@@ -401,16 +401,21 @@ void sh_serial_init(MemoryRegion *sysmem,
 
     sh_serial_clear_fifo(s);
 
-    memory_region_init_io(&s->iomem, NULL, &sh_serial_ops, s,
-                          "serial", 0x100000000ULL);
-
-    memory_region_init_alias(&s->iomem_p4, NULL, "serial-p4", &s->iomem,
-                             0, 0x28);
-    memory_region_add_subregion(sysmem, P4ADDR(base), &s->iomem_p4);
-
-    memory_region_init_alias(&s->iomem_a7, NULL, "serial-a7", &s->iomem,
-                             0, 0x28);
-    memory_region_add_subregion(sysmem, A7ADDR(base), &s->iomem_a7);
+    if (base < 0xf0000000) {
+        memory_region_init_io(&s->iomem, NULL, &sh_serial_ops, s,
+                              "serial", 0x100000000ULL);
+
+        memory_region_init_alias(&s->iomem_p4, NULL, "serial-p4", &s->iomem,
+                                 0, 0x28);
+        memory_region_add_subregion(sysmem, P4ADDR(base), &s->iomem_p4);
+        memory_region_init_alias(&s->iomem_a7, NULL, "serial-a7", &s->iomem,
+                                 0, 0x28);
+        memory_region_add_subregion(sysmem, A7ADDR(base), &s->iomem_a7);
+    } else {
+        memory_region_init_io(&s->iomem, NULL, &sh_serial_ops, s,
+                              "serial", 0x10000);
+        memory_region_add_subregion(sysmem, base, &s->iomem);
+    }
 
     if (chr) {
         qemu_chr_fe_init(&s->chr, chr, &error_abort);

--- a/hw/intc/Makefile.objs
+++ b/hw/intc/Makefile.objs
@@ -33,7 +33,7 @@ obj-$(CONFIG_IOAPIC) += ioapic.o
 obj-$(CONFIG_OMAP) += omap_intc.o
 obj-$(CONFIG_OPENPIC_KVM) += openpic_kvm.o
 obj-$(CONFIG_RASPI) += bcm2835_ic.o bcm2836_control.o
-obj-$(CONFIG_SH4) += sh_intc.o
+obj-$(CONFIG_SH4) += sh_intc.o sh7619_intc.o
 obj-$(CONFIG_XICS) += xics.o
 obj-$(CONFIG_XICS_SPAPR) += xics_spapr.o
 obj-$(CONFIG_XICS_KVM) += xics_kvm.o

--- /dev/null
+++ b/hw/intc/sh7619_intc.c
@@ -0,0 +1,351 @@
+/*
+ * SH7619 Interrupt controller
+ *
+ * Copyright (c) 2018 Yoshinori Sato
+ *
+ * This code is licensed under the GPL.
+ */
+
+#include "qemu/osdep.h"
+#include "qemu-common.h"
+#include "cpu.h"
+#include "hw/hw.h"
+#include "hw/sysbus.h"
+#include "hw/sh4/sh_intc.h"
+#include "hw/intc/sh7619intc.h"
+#include "qemu/error-report.h"
+
+static void sh7619intc_set_irq(void *opaque, int n_IRQ, int level)
+{
+    SH7619INTCState *intc = opaque;
+    struct IRQSource *src;
+    int issue = 0;
+
+    n_IRQ += 64;
+    if (n_IRQ < 64 || n_IRQ >= 128) {
+        error_report("%s: IRQ %d out of range", __func__, n_IRQ);
+        return;
+    }
+
+    src = &intc->src[n_IRQ - 64];
+
+    level = (level != 0);
+    if (n_IRQ >= 64 && n_IRQ <= 71) {
+        if (level)    
+            intc->irqsr |= (0x100 << (n_IRQ - 64));
+        else
+            intc->irqsr &= ~(0x100 << (n_IRQ - 64));
+    }
+    switch (src->sense) {
+    case TRG_LEVEL:
+        /* level-sensitive irq */
+        issue = (level == 0);
+        break;
+    case TRG_NEDGE:
+        issue = (level == 0 && src->level == 1);
+        break;
+    case TRG_PEDGE:
+        issue = (level == 1 && src->level == 0);
+        break;
+    case TRG_BEDGE:
+        issue = ((level ^ src->level) & 1);
+        break;
+    }
+    src->level = level;
+    if (issue == 0 && src->sense == TRG_LEVEL) {
+        if (n_IRQ >= 64 && n_IRQ <= 71)
+            intc->irqsr &= ~(1 << (n_IRQ - 64));
+        if (intc->req_irq == n_IRQ) {
+            qemu_set_irq(intc->irq, 0);
+            src->req = 0;
+            intc->req_irq = -1;
+        }
+        return;
+    }
+    if (issue) {
+        if (n_IRQ >= 64 && n_IRQ <= 71)
+            intc->irqsr |= (1 << (n_IRQ - 64));
+        src->req = 1;
+        if(intc->req_irq < 0) {
+            qemu_set_irq(intc->irq, 1);
+            intc->req_irq = n_IRQ;
+        }
+    }   
+}
+
+static int priority(SH7619INTCState *intc, int req)
+{
+    static const int map[] = {
+        3, 2, 1, 0, -1, -1, -1, -1,
+        -1, -1, -1, -1, -1, -1, -1, -1,
+        7, 6, 5, 4, 11, 10, 9, 8,
+        15, 15, 15, 15, 14, 14, 14, 14,
+        13, 13, 13, 13, 19, 18, -1, -1,
+        23, 22, 21, 20, 27, -1, -1, -1,
+        -1, -1, -1, -1, -1, -1, -1, -1,
+        -1, -1, -1, -1, -1, -1, -1, -1,
+    };
+    int offset;
+    int pos;
+    offset = map[req - 64] / 4;
+    pos = map[req - 64] % 4;
+    return (intc->ipr[offset] >> pos) & 0x000f;
+}
+
+int sh2_intc_get_pending_vector(void *state, int imask, int *level)
+{
+    SH7619INTCState *intc = SH7619INTC(state);
+    int pri = priority(intc, intc->req_irq);
+    int ret = -1;
+    int i;
+    int pend;
+
+    if (pri > imask) {
+        *level = pri;
+        ret = intc->req_irq;
+        intc->src[intc->req_irq - 64].req = 0;
+        intc->req_irq = -1;
+    }
+    pri = -1;
+    pend = -1;
+    for (i = 0; i < 64; i++) {
+        if (intc->src[i].req && pri < priority(intc, i + 64)) {
+            pri = priority(intc, i + 64);
+            pend = i + 64;
+        }
+    }
+    if (pend >= 0) {
+        qemu_set_irq(intc->irq, 1);
+        intc->req_irq = pend;
+    }
+    return ret;
+}
+
+static void intc_write1(void *opaque, hwaddr addr, uint64_t val, unsigned size)
+{
+    int reg = (addr & 0x0f) >> 1;
+    SH7619INTCState *intc = SH7619INTC(opaque);
+
+    if (reg < 5)
+        intc->ipr[reg + 2] = val;
+    else
+        error_report("sh7619intc: unsupported write request at %08lx", addr);
+}
+
+static uint64_t intc_read1(void *opaque, hwaddr addr, unsigned size)
+{
+    int reg = (addr & 0x0f) >> 1;
+    SH7619INTCState *intc = SH7619INTC(opaque);
+
+    if (reg < 5)
+        return intc->ipr[reg + 2];
+    else {
+        error_report("sh7619intc: unsupported write request at %08lx", addr);
+        return 0;
+    }
+}
+
+static void update_byte(unsigned int *word, uint64_t val, int pos)
+{
+    *word &= 0xff << (pos * 8);
+    *word |= (val & 0xff) << ((1 - pos) * 8);
+}
+
+static void write_irqsr(SH7619INTCState *intc, uint64_t val)
+{
+    int mask = ~intc->read_sr;
+    intc->irqsr &= mask;
+    intc->irqsr |= val & 0xff;
+}
+
+static void update_trigger(SH7619INTCState *intc)
+{
+    int i;
+    for (i = 0; i < 8; i++) {
+        intc->src[i].sense = (intc->irqcr >> (i * 2)) & 3;
+    }
+}
+
+static void intc_write2(void *opaque, hwaddr addr, uint64_t val, unsigned size)
+{
+    SH7619INTCState *intc = SH7619INTC(opaque);
+    int error = 0;
+
+    if (size == 2) {
+        switch (addr & 0x0f) {
+        case 0: /* ICR0 */
+            intc->icr0 &= ~0x80;
+            intc->icr0 |= val & 0x80;
+            break;
+        case 2:	/* IRQCR */
+            intc->irqcr = val;
+            update_trigger(intc);
+            break;
+        case 4:
+            write_irqsr(intc, val);
+            break;
+        case 6: /* IPR */
+        case 8:
+            intc->ipr[((addr & 0x0f) - 8) / 2] = val;
+            break;
+        default:
+            error=1;
+            break;
+        }
+    } else {
+        switch (addr & 0x0f) {
+        case 1: /* ICR0 */
+            intc->icr0 &= ~0x80;
+            intc->icr0 |= val & 0x80;
+            break;
+        case 2 ... 3: /* IRQCR */
+            update_byte(&intc->irqcr, val, addr & 1);
+            update_trigger(intc);
+            break;
+        case 5: /* IRQSR */
+            write_irqsr(intc, val);
+            break;
+        case 6 ... 9: /* IPR */
+            update_byte(&intc->ipr[((addr & 0x0f) - 8) / 2], val, addr & 1);
+            break;
+        default:
+            error = 1;
+        }
+    }
+    if (error)
+        error_report("sh7619intc: unsupported write request at %08lx", addr);
+}
+
+static unsigned int read_byte(unsigned int val, int pos)
+{
+    return (val >> ((1 - pos) * 8)) & 0xff;
+}
+
+static uint64_t intc_read2(void *opaque, hwaddr addr, unsigned size)
+{
+    SH7619INTCState *intc = SH7619INTC(opaque);
+    int error = 0;
+
+    if (size == 2) {
+        switch (addr & 0x0f) {
+        case 0: /* ICR0 */
+            return intc->icr0;
+            break;
+        case 2:	/* IRQCR */
+            return intc->irqcr;
+            break;
+        case 4:	/* IRQSR */
+            intc->read_sr = intc->irqsr & 0xff;
+            return intc->irqsr;
+            break;
+        case 6: /* IPR */
+        case 8:
+            return intc->ipr[((addr & 0x0f) - 8) / 2];
+            break;
+        default:
+            error=1;
+            break;
+        }
+    } else {
+        switch (addr & 0x0f) {
+        case 0 ... 1: /* ICR0 */
+            return read_byte(intc->icr0, addr & 1);
+            break;
+        case 2 ... 3: /* IRQCR */
+            return read_byte(intc->irqcr, addr & 1);
+            break;
+        case 4 ... 5: /* IRQCR */
+            if (addr & 1)
+                intc->read_sr = intc->irqsr & 0xff;
+            return read_byte(intc->irqsr, addr & 1);
+            break;
+        case 6 ... 9: /* IPR */
+            return read_byte(intc->ipr[((addr & 0x0f) - 8) / 2], addr & 1);
+            break;
+        default:
+            error = 1;
+        }
+    }
+    if (error)
+        error_report("sh7619intc: unsupported write request at %08lx", addr);
+    return -1;
+}
+
+static const MemoryRegionOps intc_ops1 = {
+    .write = intc_write1,
+    .read  = intc_read1,
+    .endianness = DEVICE_BIG_ENDIAN,
+    .impl = {
+        .min_access_size = 2,
+        .max_access_size = 2,
+    },
+};
+
+static const MemoryRegionOps intc_ops2 = {
+    .write = intc_write2,
+    .read  = intc_read2,
+    .endianness = DEVICE_BIG_ENDIAN,
+    .impl = {
+        .min_access_size = 1,
+        .max_access_size = 2,
+    },
+};
+
+static void sh7619intc_realize(DeviceState *dev, Error **errp)
+{
+    SH7619INTCState *intc = SH7619INTC(dev);
+    int i;
+
+    for (i = 0; i < 64; i++) {
+        intc->src[i].sense = TRG_PEDGE;
+    }
+    intc->req_irq = -1;
+}
+
+static void sh7619intc_init(Object *obj)
+{
+    SysBusDevice *d = SYS_BUS_DEVICE(obj);
+    SH7619INTCState *intc = SH7619INTC(obj);
+    
+    memory_region_init_io(&intc->memory[0], OBJECT(intc), &intc_ops1,
+                          intc, "sh7619-intc-1", 0x10);
+    memory_region_init_io(&intc->memory[1], OBJECT(intc), &intc_ops2,
+                          intc, "sh7619-intc-2", 0x10);
+    sysbus_init_mmio(d, &intc->memory[0]);
+    sysbus_init_mmio(d, &intc->memory[1]);
+
+    qdev_init_gpio_in(DEVICE(d), sh7619intc_set_irq, 64);
+    sysbus_init_irq(d, &intc->irq);
+}
+
+static const VMStateDescription vmstate_sh7619intc = {
+    .name = "sh7619-intc",
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .fields = (VMStateField[]) {
+        VMSTATE_END_OF_LIST()
+    }
+};
+
+static void sh7619intc_class_init(ObjectClass *klass, void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(klass);
+
+    dc->realize = sh7619intc_realize;
+    dc->vmsd = &vmstate_sh7619intc;
+}
+
+static const TypeInfo sh7619intc_info = {
+    .name       = TYPE_SH7619INTC,
+    .parent     = TYPE_SYS_BUS_DEVICE,
+    .instance_size = sizeof(SH7619INTCState),
+    .instance_init = sh7619intc_init,
+    .class_init = sh7619intc_class_init,
+};
+
+static void sh7619intc_register_types(void)
+{
+    type_register_static(&sh7619intc_info);
+}
+
+type_init(sh7619intc_register_types)

--- a/hw/sh4/Makefile.objs
+++ b/hw/sh4/Makefile.objs
@@ -1,4 +1,5 @@
-obj-y += shix.o r2d.o
+obj-y += shix.o r2d.o ms7619se.o
 
 obj-y += sh7750.o sh7750_regnames.o
 obj-y += sh_pci.o
+obj-y += sh7619.o
\ No newline at end of file

--- /dev/null
+++ b/hw/sh4/ms7619se.c
@@ -0,0 +1,157 @@
+/*
+ * SolutionEngine MS7619SE emulation
+ *
+ * Copyright (c) 2018 Yoshinori Sato
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */
+
+#include "qemu/osdep.h"
+#include "qemu/units.h"
+#include "qapi/error.h"
+#include "qemu-common.h"
+#include "cpu.h"
+#include "hw/hw.h"
+#include "hw/sysbus.h"
+#include "hw/loader.h"
+#include "hw/sh4/sh7619.h"
+#include "sysemu/sysemu.h"
+#include "sysemu/qtest.h"
+#include "sysemu/device_tree.h"
+#include "hw/boards.h"
+#include "hw/block/flash.h"
+#include "exec/address-spaces.h"
+#include "exec/cpu-all.h"
+
+#define FLASH_BASE 0x00000000
+#define FLASH_SIZE 0x02000000
+
+#define SDRAM_BASE 0x0c000000 /* Physical location of SDRAM: Area 3 */
+#define SDRAM_SIZE 0x04000000
+
+#define BOOT_PARAMS_OFFSET 0x0001000
+/* CONFIG_BOOT_LINK_OFFSET of Linux kernel */
+#define LINUX_LOAD_OFFSET  0x0800000
+#define INITRD_LOAD_OFFSET 0x1800000
+
+static struct QEMU_PACKED
+{
+    int mount_root_rdonly;
+    int ramdisk_flags;
+    int orig_root_dev;
+    int loader_type;
+    int initrd_start;
+    int initrd_size;
+
+    char pad[232];
+
+    char kernel_cmdline[256];
+} boot_params;
+
+static void ms7619se_init(MachineState *machine)
+{
+    SuperHCPU *cpu;
+    SH7619State *s;
+    MemoryRegion *sysmem = get_system_memory();
+    MemoryRegion *sdram = g_new(MemoryRegion, 1);
+    DriveInfo *dinfo;
+    const char *kernel_filename = machine->kernel_filename;
+    const char *kernel_cmdline = machine->kernel_cmdline;
+    const char *initrd_filename = machine->initrd_filename;
+
+    /* Allocate memory space */
+    memory_region_init_ram(sdram, NULL, "ms7619se.sdram", 0x04000000,
+                           &error_fatal);
+    memory_region_add_subregion(sysmem, 0x0c000000, sdram);
+    dinfo = drive_get(IF_PFLASH, 0, 0);
+    pflash_cfi02_register(0x0, NULL, "ms7619se.flash", FLASH_SIZE,
+                          dinfo ? blk_by_legacy_dinfo(dinfo) : NULL,
+                          16 * KiB, FLASH_SIZE >> 16,
+                          1, 4, 0x0000, 0x0000, 0x0000, 0x0000,
+                          0x555, 0x2aa, 0);
+
+    cpu = SUPERH_CPU(cpu_create(machine->cpu_type));
+    s = sh7619_init(cpu, sysmem);
+
+    memset(&boot_params, 0, sizeof(boot_params));
+
+    if (kernel_filename) {
+        int kernel_size;
+
+        kernel_size = load_image_targphys(kernel_filename,
+                                          SDRAM_BASE + LINUX_LOAD_OFFSET,
+                                          INITRD_LOAD_OFFSET - LINUX_LOAD_OFFSET);
+        if (kernel_size < 0) {
+          fprintf(stderr, "qemu: could not load kernel '%s'\n", kernel_filename);
+          exit(1);
+        }
+        cpu->env.pc = 0x80000000 + SDRAM_BASE + LINUX_LOAD_OFFSET;
+        s->frqcr = 0x1103;
+    }
+
+    if (initrd_filename) {
+        int initrd_size;
+
+        initrd_size = load_image_targphys(initrd_filename,
+                                          SDRAM_BASE + INITRD_LOAD_OFFSET,
+                                          SDRAM_SIZE - INITRD_LOAD_OFFSET);
+
+        if (initrd_size < 0) {
+          fprintf(stderr, "qemu: could not load initrd '%s'\n", initrd_filename);
+          exit(1);
+        }
+
+        /* initialization which should be done by firmware */
+        boot_params.loader_type = tswap32(1);
+        boot_params.initrd_start = tswap32(INITRD_LOAD_OFFSET);
+        boot_params.initrd_size = tswap32(initrd_size);
+    }
+
+    if (kernel_cmdline) {
+        /* I see no evidence that this .kernel_cmdline buffer requires
+           NUL-termination, so using strncpy should be ok. */
+        strncpy(boot_params.kernel_cmdline, kernel_cmdline,
+                sizeof(boot_params.kernel_cmdline));
+    }
+
+    rom_add_blob_fixed("boot_params", &boot_params, sizeof(boot_params),
+                       SDRAM_BASE + BOOT_PARAMS_OFFSET);
+}
+
+static void ms7619se_class_init(ObjectClass *oc, void *data)
+{
+    MachineClass *mc = MACHINE_CLASS(oc);
+
+    mc->desc = "MS7619SE";
+    mc->init = ms7619se_init;
+    mc->default_cpu_type = TYPE_SH7619_CPU;
+}
+
+static const TypeInfo ms7619se_type = {
+    .name = MACHINE_TYPE_NAME("ms7619se"),
+    .parent = TYPE_MACHINE,
+    .class_init = ms7619se_class_init,
+};
+
+static void ms7619se_machine_init(void)
+{
+    type_register_static(&ms7619se_type);
+}
+
+type_init(ms7619se_machine_init)

--- /dev/null
+++ b/hw/sh4/sh7619.c
@@ -0,0 +1,171 @@
+/*
+ * SH7619 device
+ *
+ * Copyright (c) 2018 Yoshinori Sato
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */
+#include "qemu/osdep.h"
+#include "qapi/error.h"
+#include "hw/hw.h"
+#include "hw/sh4/sh7619.h"
+#include "sysemu/sysemu.h"
+#include "hw/loader.h"
+#include "hw/intc/sh7619intc.h"
+#include "hw/timer/renesas_cmt.h"
+#include "cpu.h"
+#include "exec/exec-all.h"
+
+#define SCIF0_ERI	(88 - 64)
+#define SCIF0_RXI	(89 - 64)
+#define SCIF0_BRI	(90 - 64)
+#define SCIF0_TXI	(91 - 64)
+#define SCIF1_ERI	(92 - 64)
+#define SCIF1_RXI	(93 - 64)
+#define SCIF1_BRI	(94 - 64)
+#define SCIF1_TXI	(95 - 64)
+#define SCIF2_ERI	(96 - 64)
+#define SCIF2_RXI	(97 - 64)
+#define SCIF2_BRI	(98 - 64)
+#define SCIF2_TXI	(99 - 64)
+
+static void sh7619_set_irq(void *opaque, int no, int request)
+{
+    SuperHCPU *cpu = SUPERH_CPU(opaque);
+    CPUState *cs = CPU(cpu);
+    if (request)
+        cpu_interrupt(cs, CPU_INTERRUPT_HARD);
+    else
+        cpu_reset_interrupt(cs, CPU_INTERRUPT_HARD);
+}
+
+static SH7619INTCState *register_intc(SH7619State *s)
+{
+    SysBusDevice *intc;
+    int i;
+    
+    intc = SYS_BUS_DEVICE(qdev_create(NULL, TYPE_SH7619INTC));
+    sysbus_mmio_map(intc, 0, 0xf8080000);
+    sysbus_mmio_map(intc, 1, 0xf8140000);
+    for (i = 0; i < 64; i++)
+        s->irq[i] = qdev_get_gpio_in(DEVICE(intc), i);
+    
+    qdev_init_nofail(DEVICE(intc));
+    sysbus_connect_irq(SYS_BUS_DEVICE(intc), 0,
+                       qdev_get_gpio_in(DEVICE(s->cpu), 0));
+
+    return SH7619INTC(intc);
+}
+
+static RCMTState *register_cmt(SH7619State *s)
+{
+    SysBusDevice *cmt;
+    int i;
+    
+    cmt = SYS_BUS_DEVICE(qdev_create(NULL, TYPE_RCMT));
+    sysbus_mmio_map(cmt, 0, 0xf84a0070);
+    qdev_prop_set_uint64(DEVICE(cmt), "input-freq", 31250000);
+    
+    qdev_init_nofail(DEVICE(cmt));
+    for (i = 0; i < 2; i++)
+        sysbus_connect_irq(cmt, i, s->irq[(86 + i) - 64]);
+    
+    return RCMT(cmt);
+}
+
+static void cache_write(void *opaque, hwaddr addr,
+                        uint64_t mem_value, unsigned size)
+{
+}
+
+static uint64_t cache_read(void *opaque, hwaddr addr,
+                           unsigned size)
+{
+    return 0;
+}
+
+
+static const MemoryRegionOps cache_ops = {
+    .read = cache_read,
+    .write = cache_write,
+    .endianness = DEVICE_BIG_ENDIAN,
+};
+
+static void cpg_write(void *opaque, hwaddr addr,
+                        uint64_t mem_value, unsigned size)
+{
+    SH7619State *s = opaque;
+    s->frqcr = mem_value;
+}
+
+static uint64_t cpg_read(void *opaque, hwaddr addr,
+                           unsigned size)
+{
+    SH7619State *s = opaque;
+    return s->frqcr;
+}
+
+
+static const MemoryRegionOps cpg_ops = {
+    .read = cpg_read,
+    .write = cpg_write,
+    .endianness = DEVICE_BIG_ENDIAN,
+    .impl = {
+        .min_access_size = 2,
+        .max_access_size = 2,
+    },
+};
+
+#define SCIF(no) \
+    sh_serial_init(s->sysmem, 0xf8400000 + no * 0x00010000,             \
+                   SH_SERIAL_FEAT_SCIF,                                 \
+                   31250000, serial_hd(no),                             \
+                   s->irq[SCIF ## no ## _ERI],                          \
+                   s->irq[SCIF ## no ## _RXI],                          \
+                   s->irq[SCIF ## no ## _TXI],                          \
+                   NULL,                                                \
+                   s->irq[SCIF ## no ## _BRI])
+
+SH7619State *sh7619_init(SuperHCPU *cpu, MemoryRegion *sysmem)
+{
+    SH7619State *s;
+
+    s = g_malloc0(sizeof(SH7619State));
+    s->cpu = cpu;
+    s->sysmem = sysmem;
+
+    memory_region_init_io(&s->cache, NULL, &cache_ops,
+                          NULL, "cache", 0x02000000);
+    memory_region_add_subregion(s->sysmem, 0xf0000000, &s->cache);
+    memory_region_init_io(&s->cpg, NULL, &cpg_ops,
+                          s, "cpg", 0x00000002);
+    memory_region_add_subregion(s->sysmem, 0xf815ff80, &s->cpg);
+    memory_region_init_ram(&s->uram, NULL, "uram", 0x4000, NULL);
+    memory_region_add_subregion(s->sysmem, 0xe55fc000, &s->uram);
+
+    qdev_init_gpio_in(DEVICE(cpu), sh7619_set_irq, 1);
+    s->intc = register_intc(s);
+    s->cpu->env.intc_handle = s->intc;
+    register_cmt(s);
+    SCIF(0);
+    SCIF(1);
+    SCIF(2);
+
+    return s;
+}

--- a/hw/timer/Makefile.objs
+++ b/hw/timer/Makefile.objs
@@ -32,6 +32,7 @@ obj-$(CONFIG_OMAP) += omap_gptimer.o
 obj-$(CONFIG_OMAP) += omap_synctimer.o
 obj-$(CONFIG_PXA2XX) += pxa2xx_timer.o
 obj-$(CONFIG_SH4) += sh_timer.o
+obj-$(CONFIG_RENESAS_CMT) += renesas_cmt.o
 obj-$(CONFIG_DIGIC) += digic-timer.o
 obj-$(CONFIG_MIPS_CPS) += mips_gictimer.o
 

--- /dev/null
+++ b/hw/timer/renesas_cmt.c
@@ -0,0 +1,218 @@
+/*
+ * Renesas Compare-match timer
+ *
+ * Copyright (c) 2018 Yoshinori Sato
+ *
+ * This code is licensed under the GPL version 2 or later.
+ *
+ */
+
+#include "qemu/osdep.h"
+#include "qemu-common.h"
+#include "qemu/timer.h"
+#include "cpu.h"
+#include "hw/hw.h"
+#include "hw/sysbus.h"
+#include "hw/timer/renesas_cmt.h"
+#include "qemu/error-report.h"
+
+#define freq_to_ns(freq) (1000000000LL / freq)
+static const int clkdiv[] = {8,32,128,512};
+
+static void update_events(RCMTState *cmt, int ch)
+{
+    uint16_t diff;
+
+    if ((cmt->cmstr & (1 << ch))== 0)
+        return ;
+    diff = cmt->cmcor[ch] - cmt->cmcnt[ch];
+    timer_mod(cmt->timer[ch],
+              qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) +
+              diff * freq_to_ns(cmt->input_freq) *
+              clkdiv[cmt->cmcr[ch] & 3]);
+}
+
+static uint64_t read_cmcnt(RCMTState *cmt, int ch)
+{
+    int64_t delta, now = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
+
+    if (cmt->cmstr & (1 << ch)) {
+        delta = (now - cmt->tick[ch]) / freq_to_ns(cmt->input_freq);
+        delta /= clkdiv[cmt->cmcr[ch] & 0x03];
+        return cmt->cmcnt[ch] + delta;
+    } else
+        return cmt->cmcnt[ch];
+}
+
+static uint64_t cmt_read(void *opaque, hwaddr addr, unsigned size)
+{
+    hwaddr offset = addr & 0x0f;
+    RCMTState *cmt = opaque;
+    int ch = offset / 0x08;
+    int error = 1;
+
+    if (offset == 0) {
+        return cmt->cmstr;
+        error = 0;
+    } else {
+        offset &= 0x07;
+        if (ch == 0)
+            offset -= 0x02;
+        error = 0;
+        switch(offset) {
+        case 0:
+            return cmt->cmcr[ch];
+        case 2:
+            return read_cmcnt(cmt, ch);
+        case 4:
+            return cmt->cmcor[ch];
+        default:
+            error = 1;
+        }
+    }
+    if (error)
+        error_report("rcmt: unsupported read request to %08lx", addr);
+    return 0xffffffffffffffffUL;
+}
+
+static void start_stop(RCMTState *cmt, int ch, int st)
+{
+    if (st)
+        update_events(cmt, ch);
+    else
+        timer_del(cmt->timer[ch]);
+}
+
+static void cmt_write(void *opaque, hwaddr addr, uint64_t val, unsigned size)
+{
+    hwaddr offset = addr & 0x0f;
+    RCMTState *cmt = opaque;
+    int ch = offset / 0x08;
+    int error = 1;
+
+    if (offset == 0) {
+        cmt->cmstr = val;
+        start_stop(cmt, 0, cmt->cmstr & 1);
+        start_stop(cmt, 1, (cmt->cmstr >> 1) & 1);
+        error = 0;
+    } else {
+        offset &= 0x07;
+        if (ch == 0)
+            offset -= 0x02;
+        error = 0;
+        switch(offset) {
+        case 0:
+            cmt->cmcr[ch] = val;
+            break;
+        case 2:
+            cmt->cmcnt[ch] = val;
+            break;
+        case 4:
+            cmt->cmcor[ch] = val;
+            break;
+        default:
+            error = 1;
+        }
+        if (error == 0 && cmt->cmstr & (1 << ch))
+            update_events(cmt, ch);
+    }
+    if (error)
+        error_report("rcmt: unsupported write request to %08lx", addr);
+}
+
+static const MemoryRegionOps cmt_ops = {
+    .write = cmt_write,
+    .read  = cmt_read,
+    .endianness = DEVICE_NATIVE_ENDIAN,
+    .impl = {
+        .min_access_size = 2,
+        .max_access_size = 2,
+    },
+};
+
+static void timer_events(RCMTState *cmt, int ch)
+{
+    cmt->cmcnt[ch] = 0;
+    cmt->tick[ch] = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
+    update_events(cmt, ch);
+    if (cmt->cmcr[ch] & 0x40)
+        qemu_irq_pulse(cmt->cmi[ch]);
+}
+
+static void timer_event0(void *opaque)
+{
+    RCMTState *cmt = opaque;
+    
+    timer_events(cmt, 0);
+}
+
+static void timer_event1(void *opaque)
+{
+    RCMTState *cmt = opaque;
+    
+    timer_events(cmt, 1);
+}
+
+static void rcmt_reset(DeviceState *dev)
+{
+    RCMTState *cmt = RCMT(dev);
+    cmt->cmstr = 0;
+    cmt->cmcr[0] = cmt->cmcr[1] = 0;
+    cmt->cmcnt[0] = cmt->cmcnt[1] = 0;
+    cmt->cmcor[0] = cmt->cmcor[1] = 0xffff;
+}
+
+static void rcmt_init(Object *obj)
+{
+    SysBusDevice *d = SYS_BUS_DEVICE(obj);
+    RCMTState *cmt = RCMT(obj);
+    int i;
+    
+    memory_region_init_io(&cmt->memory, OBJECT(cmt), &cmt_ops,
+                          cmt, "renesas-cmt", 0x10);
+    sysbus_init_mmio(d, &cmt->memory);
+
+    for (i = 0; i < 2; i++) {
+        sysbus_init_irq(d, &cmt->cmi[i]);
+    }
+    cmt->timer[0] = timer_new_ns(QEMU_CLOCK_VIRTUAL, timer_event0, cmt);
+    cmt->timer[1] = timer_new_ns(QEMU_CLOCK_VIRTUAL, timer_event1, cmt);
+}
+
+static const VMStateDescription vmstate_rcmt = {
+    .name = "rx-cmt",
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .fields = (VMStateField[]) {
+        VMSTATE_END_OF_LIST()
+    }
+};
+
+static Property rcmt_properties[] = {
+    DEFINE_PROP_UINT64("input-freq", RCMTState, input_freq, 0),
+    DEFINE_PROP_END_OF_LIST(),
+};
+
+static void rcmt_class_init(ObjectClass *klass, void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(klass);
+
+    dc->props = rcmt_properties;
+    dc->vmsd = &vmstate_rcmt;
+    dc->reset = rcmt_reset;
+}
+
+static const TypeInfo rcmt_info = {
+    .name       = TYPE_RCMT,
+    .parent     = TYPE_SYS_BUS_DEVICE,
+    .instance_size = sizeof(RCMTState),
+    .instance_init = rcmt_init,
+    .class_init = rcmt_class_init,
+};
+
+static void rcmt_register_types(void)
+{
+    type_register_static(&rcmt_info);
+}
+
+type_init(rcmt_register_types)

--- /dev/null
+++ b/include/hw/intc/sh7619intc.h
@@ -0,0 +1,36 @@
+#ifndef SH7619INTC_H
+#define SH7619INTC_H
+
+#include "qemu-common.h"
+#include "hw/irq.h"
+
+struct IRQSource {
+    int sense;
+    int level;
+    int req;
+};
+
+struct SH7619INTCState {
+    SysBusDevice parent_obj;
+
+    MemoryRegion memory[2];
+    unsigned int icr0;
+    unsigned int irqcr;
+    unsigned int irqsr;
+    unsigned int ipr[7];
+    struct IRQSource src[64];
+    qemu_irq irq;
+    int req_irq;
+    unsigned int read_sr;
+};
+typedef struct SH7619INTCState SH7619INTCState;
+
+#define TYPE_SH7619INTC "sh7619-intc"
+#define SH7619INTC(obj) OBJECT_CHECK(SH7619INTCState, (obj), TYPE_SH7619INTC)
+
+#define TRG_LEVEL 0
+#define TRG_NEDGE 1
+#define TRG_PEDGE 2
+#define TRG_BEDGE 3
+
+#endif /* SH7619INTC_H */

--- a/include/hw/sh4/sh.h
+++ b/include/hw/sh4/sh.h
@@ -55,4 +55,8 @@ qemu_irq sh7750_irl(struct SH7750State *s);
 /* tc58128.c */
 int tc58128_init(struct SH7750State *s, const char *zone1, const char *zone2);
 
+/* sh7619.c */
+struct SH7619State;
+struct SH7619State *sh7619_init(SuperHCPU *cpu, struct MemoryRegion *sysmem);
+
 #endif

--- /dev/null
+++ b/include/hw/sh4/sh7619.h
@@ -0,0 +1,36 @@
+/*
+ * SH7619 Object
+ *
+ * Copyright (c) 2018 Yoshinori Sato
+ *
+ * This code is licensed under the GPL version 2 or later.
+ *
+ */
+
+#ifndef HW_RX_SH7619_H
+#define HW_RX_SH7619_H
+
+#include "hw/sysbus.h"
+#include "hw/sh4/sh.h"
+#include "hw/intc/sh7619intc.h"
+#include "target/sh4/cpu-qom.h"
+
+#define SH7619(obj) OBJECT_CHECK(SH7619State, (obj), TYPE_SH7619_CPU)
+
+typedef struct SH7619State {
+    SysBusDevice parent_obj;
+
+    SuperHCPU *cpu;
+    SH7619INTCState *intc;
+
+    MemoryRegion *sysmem;
+    bool kernel;
+    
+    MemoryRegion uram;
+    MemoryRegion cache;
+    MemoryRegion cpg;
+    qemu_irq irq[64];
+    uint16_t frqcr;
+} SH7619State;
+
+#endif

--- a/include/hw/sh4/sh_intc.h
+++ b/include/hw/sh4/sh_intc.h
@@ -59,6 +59,7 @@ struct intc_desc {
 };
 
 int sh_intc_get_pending_vector(struct intc_desc *desc, int imask);
+int sh2_intc_get_pending_vector(void *state, int imask, int *level);
 struct intc_source *sh_intc_source(struct intc_desc *desc, intc_enum id);
 void sh_intc_toggle_source(struct intc_source *source,
 			   int enable_adj, int assert_adj);

--- /dev/null
+++ b/include/hw/timer/renesas_cmt.h
@@ -0,0 +1,33 @@
+/*
+ * Renesas Compare-match timer Object
+ *
+ * Copyright (c) 2018 Yoshinori Sato
+ *
+ * This code is licensed under the GPL version 2 or later.
+ *
+ */
+
+#ifndef HW_RENESAS_CMT_H
+#define HW_RENESAS_CMT_H
+
+#include "hw/sysbus.h"
+
+#define TYPE_RCMT "rcmt"
+#define RCMT(obj) OBJECT_CHECK(RCMTState, (obj), TYPE_RCMT)
+
+typedef struct RCMTState {
+    SysBusDevice parent_obj;
+
+    uint64_t input_freq;
+    MemoryRegion memory;
+
+    uint16_t cmstr;
+    uint16_t cmcr[2];
+    uint16_t cmcnt[2];
+    uint16_t cmcor[2];
+    int64_t tick[2];
+    qemu_irq cmi[2];
+    QEMUTimer *timer[2];
+} RCMTState;
+
+#endif

--- a/target/sh4/cpu-qom.h
+++ b/target/sh4/cpu-qom.h
@@ -24,6 +24,7 @@
 
 #define TYPE_SUPERH_CPU "superh-cpu"
 
+#define TYPE_SH7619_CPU SUPERH_CPU_TYPE_NAME("sh7619")
 #define TYPE_SH7750R_CPU SUPERH_CPU_TYPE_NAME("sh7750r")
 #define TYPE_SH7751R_CPU SUPERH_CPU_TYPE_NAME("sh7751r")
 #define TYPE_SH7785_CPU  SUPERH_CPU_TYPE_NAME("sh7785")

--- a/target/sh4/cpu.c
+++ b/target/sh4/cpu.c
@@ -59,14 +59,23 @@ static void superh_cpu_reset(CPUState *s)
 
     memset(env, 0, offsetof(CPUSH4State, end_reset_fields));
 
-    env->pc = 0xA0000000;
+    if (env->features != SH_FEATURE_SH2)
+        env->pc = 0xA0000000;
+    else {
+        env->pc = ldl_phys(s->as, 0x00000000);
+        env->gregs[15] = ldl_phys(s->as, 0x00000004);
+    }
 #if defined(CONFIG_USER_ONLY)
     env->fpscr = FPSCR_PR; /* value for userspace according to the kernel */
     set_float_rounding_mode(float_round_nearest_even, &env->fp_status); /* ?! */
 #else
-    env->sr = (1u << SR_MD) | (1u << SR_RB) | (1u << SR_BL) |
-              (1u << SR_I3) | (1u << SR_I2) | (1u << SR_I1) | (1u << SR_I0);
-    env->fpscr = FPSCR_DN | FPSCR_RM_ZERO; /* CPU reset value according to SH4 manual */
+    if (env->features != SH_FEATURE_SH2) {
+        env->sr = (1u << SR_MD) | (1u << SR_RB) | (1u << SR_BL) |
+            (1u << SR_I3) | (1u << SR_I2) | (1u << SR_I1) | (1u << SR_I0);
+        env->fpscr = FPSCR_DN | FPSCR_RM_ZERO; /* CPU reset value according to SH4 manual */
+    } else {
+        env->sr = (1u << SR_I3) | (1u << SR_I2) | (1u << SR_I1) | (1u << SR_I0);
+    }
     set_float_rounding_mode(float_round_to_zero, &env->fp_status);
     set_flush_to_zero(1, &env->fp_status);
 #endif
@@ -129,6 +138,19 @@ out:
     return oc;
 }
 
+static void sh7619_cpu_initfn(Object *obj)
+{
+    SuperHCPU *cpu = SUPERH_CPU(obj);
+    CPUSH4State *env = &cpu->env;
+
+    env->id = SH_CPU_SH7619;
+    env->features = SH_FEATURE_SH2;
+}
+
+static void sh7619_class_init(ObjectClass *oc, void *data)
+{
+}
+
 static void sh7750r_cpu_initfn(Object *obj)
 {
     SuperHCPU *cpu = SUPERH_CPU(obj);
@@ -195,8 +217,8 @@ static void superh_cpu_realizefn(DeviceState *dev, Error **errp)
         return;
     }
 
-    cpu_reset(cs);
     qemu_init_vcpu(cs);
+    cpu_reset(cs);
 
     scc->parent_realize(dev, errp);
 }
@@ -269,6 +291,8 @@ static const TypeInfo superh_cpu_type_infos[] = {
         .class_size = sizeof(SuperHCPUClass),
         .class_init = superh_cpu_class_init,
     },
+    DEFINE_SUPERH_CPU_TYPE(TYPE_SH7619_CPU, sh7619_class_init,
+                           sh7619_cpu_initfn),
     DEFINE_SUPERH_CPU_TYPE(TYPE_SH7750R_CPU, sh7750r_class_init,
                            sh7750r_cpu_initfn),
     DEFINE_SUPERH_CPU_TYPE(TYPE_SH7751R_CPU, sh7751r_class_init,

--- a/target/sh4/cpu.h
+++ b/target/sh4/cpu.h
@@ -33,6 +33,7 @@
 #define SH_CPU_SH7751  (1 << 3)
 #define SH_CPU_SH7751R (1 << 4)
 #define SH_CPU_SH7785  (1 << 5)
+#define SH_CPU_SH7619  (1 << 6)
 #define SH_CPU_SH7750_ALL (SH_CPU_SH7750 | SH_CPU_SH7750S | SH_CPU_SH7750R)
 #define SH_CPU_SH7751_ALL (SH_CPU_SH7751 | SH_CPU_SH7751R)
 
@@ -138,6 +139,7 @@ typedef struct tlb_t {
 enum sh_features {
     SH_FEATURE_SH4A = 1,
     SH_FEATURE_BCR3_AND_BCR4 = 2,
+    SH_FEATURE_SH2 = 3,
 };
 
 typedef struct memory_content {

--- a/target/sh4/helper.c
+++ b/target/sh4/helper.c
@@ -20,6 +20,7 @@
 
 #include "cpu.h"
 #include "exec/exec-all.h"
+#include "exec/cpu_ldst.h"
 #include "exec/log.h"
 #include "sysemu/sysemu.h"
 
@@ -85,13 +86,14 @@ void superh_cpu_do_interrupt(CPUState *cs)
     CPUSH4State *env = &cpu->env;
     int do_irq = cs->interrupt_request & CPU_INTERRUPT_HARD;
     int do_exp, irq_vector = cs->exception_index;
+    int level = 0;
 
     /* prioritize exceptions over interrupts */
 
     do_exp = cs->exception_index != -1;
     do_irq = do_irq && (cs->exception_index == -1);
 
-    if (env->sr & (1u << SR_BL)) {
+    if ((env->features != SH_FEATURE_SH2) && (env->sr & (1u << SR_BL))) {
         if (do_exp && cs->exception_index != 0x1e0) {
             /* In theory a masked exception generates a reset exception,
                which in turn jumps to the reset vector. However this only
@@ -109,8 +111,13 @@ void superh_cpu_do_interrupt(CPUState *cs)
     env->in_sleep = 0;
 
     if (do_irq) {
-        irq_vector = sh_intc_get_pending_vector(env->intc_handle,
-						(env->sr >> 4) & 0xf);
+        if (env->features != SH_FEATURE_SH2)
+            irq_vector = sh_intc_get_pending_vector(env->intc_handle,
+                                                    (env->sr >> 4) & 0xf);
+        else
+            irq_vector = sh2_intc_get_pending_vector(env->intc_handle,
+                                                     (env->sr >> 4) & 0xf,
+                                                     &level);
         if (irq_vector == -1) {
             return; /* masked */
 	}
@@ -170,8 +177,10 @@ void superh_cpu_do_interrupt(CPUState *cs)
     env->ssr = cpu_read_sr(env);
     env->spc = env->pc;
     env->sgr = env->gregs[15];
-    env->sr |= (1u << SR_BL) | (1u << SR_MD) | (1u << SR_RB);
-    env->lock_addr = -1;
+    if (env->features != SH_FEATURE_SH2) {
+        env->sr |= (1u << SR_BL) | (1u << SR_MD) | (1u << SR_RB);
+        env->lock_addr = -1;
+    }
 
     if (env->flags & DELAY_SLOT_MASK) {
         /* Branch instruction should be executed again before delay slot. */
@@ -180,34 +189,67 @@ void superh_cpu_do_interrupt(CPUState *cs)
         env->flags &= ~DELAY_SLOT_MASK;
     }
 
-    if (do_exp) {
-        env->expevt = cs->exception_index;
-        switch (cs->exception_index) {
-        case 0x000:
-        case 0x020:
-        case 0x140:
-            env->sr &= ~(1u << SR_FD);
-            env->sr |= 0xf << 4; /* IMASK */
-            env->pc = 0xa0000000;
-            break;
-        case 0x040:
-        case 0x060:
-            env->pc = env->vbr + 0x400;
-            break;
-        case 0x160:
-            env->spc += 2; /* special case for TRAPA */
-            /* fall through */
-        default:
-            env->pc = env->vbr + 0x100;
-            break;
+    if (env->features == SH_FEATURE_SH2) {
+        int v = -1;
+        uint32_t sp = env->gregs[15];
+        cpu_stl_kernel(env, sp, env->ssr);
+        sp -= 4;
+        if (!do_exp || cs->exception_index != 0x160)
+            cpu_stl_kernel(env, sp, env->spc);
+        else
+            cpu_stl_kernel(env, sp, env->spc + 2);
+        sp -= 4;
+        env->gregs[15] = sp;
+        env->sr &= (~0xf0);
+        env->sr |= level << 4;
+        if (do_exp) {
+            switch(cs->exception_index) {
+            case 0x180:
+                v = 4; break;
+            case 0x1a0:
+                v = 6; break;
+            case 0x0e0:
+            case 0x100:
+                v = 9; break;
+            case 0x160:
+                v = env->tra; break;
+            }
+        }
+        if (do_irq) {
+            v = irq_vector;
         }
+        env->pc = cpu_ldl_kernel(env, env->vbr + v * 4);
         return;
-    }
+    } else {
+        if (do_exp) {
+            env->expevt = cs->exception_index;
+            switch (cs->exception_index) {
+            case 0x000:
+            case 0x020:
+            case 0x140:
+                env->sr &= ~(1u << SR_FD);
+                env->sr |= 0xf << 4; /* IMASK */
+                env->pc = 0xa0000000;
+                break;
+            case 0x040:
+            case 0x060:
+                env->pc = env->vbr + 0x400;
+                break;
+            case 0x160:
+                env->spc += 2; /* special case for TRAPA */
+                /* fall through */
+            default:
+                env->pc = env->vbr + 0x100;
+                break;
+            }
+            return;
+        }
 
-    if (do_irq) {
-        env->intevt = irq_vector;
-        env->pc = env->vbr + 0x600;
-        return;
+        if (do_irq) {
+            env->intevt = irq_vector;
+            env->pc = env->vbr + 0x600;
+            return;
+        }
     }
 }
 
@@ -458,6 +500,34 @@ static int get_physical_address(CPUSH4State * env, target_ulong * physical,
     return get_mmu_address(env, physical, prot, address, rw, access_type);
 }
 
+static int get_physical_address_sh2(CPUSH4State * env, target_ulong * physical,
+                                    int *prot, target_ulong address)
+{
+    /* P1, P2 and P4 areas do not use translation */
+    if ((address >= 0x80000000 && address < 0xc0000000) ||
+	address >= 0xe0000000) {
+	if (address >= 0x80000000 && address < 0xc0000000) {
+	    /* Mask upper 3 bits for P1 and P2 areas */
+	    *physical = address & 0x1fffffff;
+	} else {
+	    *physical = address;
+	}
+	*prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC;
+	return MMU_OK;
+    }
+
+    if (address < 0x80000000) {
+        /* P0 */
+        *physical = address & 0x7FFFFFFF;
+        *prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC;
+    } else {
+        /* P3 */
+        *physical = address & 0x1FFFFFFF;
+        *prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC;
+    }
+    return MMU_OK;
+}
+
 int superh_cpu_handle_mmu_fault(CPUState *cs, vaddr address, int size, int rw,
                                 int mmu_idx)
 {
@@ -466,10 +536,15 @@ int superh_cpu_handle_mmu_fault(CPUState *cs, vaddr address, int size, int rw,
     target_ulong physical;
     int prot, ret, access_type;
 
-    access_type = ACCESS_INT;
-    ret =
-	get_physical_address(env, &physical, &prot, address, rw,
-			     access_type);
+    if (env->features != SH_FEATURE_SH2) {
+        access_type = ACCESS_INT;
+        ret =
+            get_physical_address(env, &physical, &prot, address, rw,
+                                 access_type);
+    } else {
+        ret =
+            get_physical_address_sh2(env, &physical, &prot, address);
+    }
 
     if (ret != MMU_OK) {
 	env->tea = address;
@@ -527,7 +602,11 @@ hwaddr superh_cpu_get_phys_page_debug(CPUState *cs, vaddr addr)
     target_ulong physical;
     int prot;
 
-    get_physical_address(&cpu->env, &physical, &prot, addr, 0, 0);
+    if (cpu->env.features != SH_FEATURE_SH2)
+        get_physical_address(&cpu->env, &physical, &prot, addr, 0, 0);
+    else
+        get_physical_address_sh2(&cpu->env, &physical, &prot, addr);
+
     return physical;
 }
 

--- a/target/sh4/translate.c
+++ b/target/sh4/translate.c
@@ -373,7 +373,7 @@ static inline void gen_store_fpr64(DisasContext *ctx, TCGv_i64 t, int reg)
     }
 
 #define CHECK_PRIVILEGED \
-    if (IS_USER(ctx)) {                     \
+    if (!(ctx->features & SH_FEATURE_SH2) && IS_USER(ctx)) {    \
         goto do_illegal;                    \
     }
 
@@ -397,6 +397,11 @@ static inline void gen_store_fpr64(DisasContext *ctx, TCGv_i64 t, int reg)
         goto do_illegal;                      \
     }
 
+#define CHECK_SH2 \
+    if (!(ctx->features & SH_FEATURE_SH2)) { \
+        goto do_illegal;                      \
+    }
+
 static void _decode_opc(DisasContext * ctx)
 {
     /* This code tries to make movcal emulation sufficiently
@@ -451,36 +456,51 @@ static void _decode_opc(DisasContext * ctx)
 	tcg_gen_movi_i32(cpu_macl, 0);
 	return;
     case 0x0048:		/* clrs */
+        CHECK_SH2
         tcg_gen_andi_i32(cpu_sr, cpu_sr, ~(1u << SR_S));
 	return;
     case 0x0008:		/* clrt */
         tcg_gen_movi_i32(cpu_sr_t, 0);
 	return;
     case 0x0038:		/* ldtlb */
+        CHECK_SH2
 	CHECK_PRIVILEGED
         gen_helper_ldtlb(cpu_env);
 	return;
     case 0x002b:		/* rte */
 	CHECK_PRIVILEGED
 	CHECK_NOT_DELAY_SLOT
-        gen_write_sr(cpu_ssr);
-	tcg_gen_mov_i32(cpu_delayed_pc, cpu_spc);
+        if (ctx->features != SH_FEATURE_SH2) {
+            gen_write_sr(cpu_ssr);
+            tcg_gen_mov_i32(cpu_delayed_pc, cpu_spc);
+        } else {
+            TCGv sr = tcg_temp_local_new();
+            tcg_gen_qemu_ld32u(sr, cpu_gregs[15], 0);
+            tcg_gen_addi_i32(cpu_gregs[15], cpu_gregs[15], 4);
+            tcg_gen_qemu_ld32u(cpu_delayed_pc, cpu_gregs[15], 0);
+            tcg_gen_addi_i32(cpu_gregs[15], cpu_gregs[15], 4);
+            gen_write_sr(sr);
+            tcg_temp_free(sr);
+        }
         ctx->envflags |= DELAY_SLOT_RTE;
 	ctx->delayed_pc = (uint32_t) - 1;
         ctx->base.is_jmp = DISAS_STOP;
 	return;
     case 0x0058:		/* sets */
+        CHECK_SH2
         tcg_gen_ori_i32(cpu_sr, cpu_sr, (1u << SR_S));
 	return;
     case 0x0018:		/* sett */
         tcg_gen_movi_i32(cpu_sr_t, 1);
 	return;
     case 0xfbfd:		/* frchg */
+        CHECK_SH2
         CHECK_FPSCR_PR_0
 	tcg_gen_xori_i32(cpu_fpscr, cpu_fpscr, FPSCR_FR);
         ctx->base.is_jmp = DISAS_STOP;
 	return;
     case 0xf3fd:		/* fschg */
+        CHECK_SH2
         CHECK_FPSCR_PR_0
         tcg_gen_xori_i32(cpu_fpscr, cpu_fpscr, FPSCR_SZ);
         ctx->base.is_jmp = DISAS_STOP;
@@ -894,6 +914,7 @@ static void _decode_opc(DisasContext * ctx)
 	return;
     case 0x400c:		/* shad Rm,Rn */
 	{
+            CHECK_SH2
             TCGv t0 = tcg_temp_new();
             TCGv t1 = tcg_temp_new();
             TCGv t2 = tcg_temp_new();
@@ -920,6 +941,7 @@ static void _decode_opc(DisasContext * ctx)
 	return;
     case 0x400d:		/* shld Rm,Rn */
 	{
+            CHECK_SH2
             TCGv t0 = tcg_temp_new();
             TCGv t1 = tcg_temp_new();
             TCGv t2 = tcg_temp_new();
@@ -989,6 +1011,7 @@ static void _decode_opc(DisasContext * ctx)
 	tcg_gen_xor_i32(REG(B11_8), REG(B11_8), REG(B7_4));
 	return;
     case 0xf00c: /* fmov {F,D,X}Rm,{F,D,X}Rn - FPSCR: Nothing */
+        CHECK_SH2
 	CHECK_FPU_ENABLED
         if (ctx->tbflags & FPSCR_SZ) {
             int xsrc = XHACK(B7_4);
@@ -1000,6 +1023,7 @@ static void _decode_opc(DisasContext * ctx)
 	}
 	return;
     case 0xf00a: /* fmov {F,D,X}Rm,@Rn - FPSCR: Nothing */
+        CHECK_SH2
 	CHECK_FPU_ENABLED
         if (ctx->tbflags & FPSCR_SZ) {
             TCGv_i64 fp = tcg_temp_new_i64();
@@ -1011,6 +1035,7 @@ static void _decode_opc(DisasContext * ctx)
 	}
 	return;
     case 0xf008: /* fmov @Rm,{F,D,X}Rn - FPSCR: Nothing */
+        CHECK_SH2
 	CHECK_FPU_ENABLED
         if (ctx->tbflags & FPSCR_SZ) {
             TCGv_i64 fp = tcg_temp_new_i64();
@@ -1022,6 +1047,7 @@ static void _decode_opc(DisasContext * ctx)
 	}
 	return;
     case 0xf009: /* fmov @Rm+,{F,D,X}Rn - FPSCR: Nothing */
+        CHECK_SH2
 	CHECK_FPU_ENABLED
         if (ctx->tbflags & FPSCR_SZ) {
             TCGv_i64 fp = tcg_temp_new_i64();
@@ -1035,6 +1061,7 @@ static void _decode_opc(DisasContext * ctx)
 	}
 	return;
     case 0xf00b: /* fmov {F,D,X}Rm,@-Rn - FPSCR: Nothing */
+        CHECK_SH2
 	CHECK_FPU_ENABLED
         {
             TCGv addr = tcg_temp_new_i32();
@@ -1053,6 +1080,7 @@ static void _decode_opc(DisasContext * ctx)
         }
 	return;
     case 0xf006: /* fmov @(R0,Rm),{F,D,X}Rm - FPSCR: Nothing */
+        CHECK_SH2
 	CHECK_FPU_ENABLED
 	{
 	    TCGv addr = tcg_temp_new_i32();
@@ -1069,6 +1097,7 @@ static void _decode_opc(DisasContext * ctx)
 	}
 	return;
     case 0xf007: /* fmov {F,D,X}Rn,@(R0,Rn) - FPSCR: Nothing */
+        CHECK_SH2
 	CHECK_FPU_ENABLED
 	{
 	    TCGv addr = tcg_temp_new();
@@ -1091,6 +1120,7 @@ static void _decode_opc(DisasContext * ctx)
     case 0xf004: /* fcmp/eq Rm,Rn - FPSCR: R[PR,Enable.V]/W[Cause,Flag] */
     case 0xf005: /* fcmp/gt Rm,Rn - FPSCR: R[PR,Enable.V]/W[Cause,Flag] */
 	{
+            CHECK_SH2
 	    CHECK_FPU_ENABLED
             if (ctx->tbflags & FPSCR_PR) {
                 TCGv_i64 fp0, fp1;
@@ -1156,6 +1186,7 @@ static void _decode_opc(DisasContext * ctx)
 	}
 	return;
     case 0xf00e: /* fmac FR0,RM,Rn */
+        CHECK_SH2
         CHECK_FPU_ENABLED
         CHECK_FPSCR_PR_0
         gen_helper_fmac_FT(FREG(B11_8), cpu_env,
@@ -1352,19 +1383,23 @@ static void _decode_opc(DisasContext * ctx)
 
     switch (ctx->opcode & 0xf08f) {
     case 0x408e:		/* ldc Rm,Rn_BANK */
+        CHECK_SH2
 	CHECK_PRIVILEGED
 	tcg_gen_mov_i32(ALTREG(B6_4), REG(B11_8));
 	return;
     case 0x4087:		/* ldc.l @Rm+,Rn_BANK */
+        CHECK_SH2
 	CHECK_PRIVILEGED
         tcg_gen_qemu_ld_i32(ALTREG(B6_4), REG(B11_8), ctx->memidx, MO_TESL);
 	tcg_gen_addi_i32(REG(B11_8), REG(B11_8), 4);
 	return;
     case 0x0082:		/* stc Rm_BANK,Rn */
+        CHECK_SH2
 	CHECK_PRIVILEGED
 	tcg_gen_mov_i32(REG(B11_8), ALTREG(B6_4));
 	return;
     case 0x4083:		/* stc.l Rm_BANK,@-Rn */
+        CHECK_SH2
 	CHECK_PRIVILEGED
 	{
 	    TCGv addr = tcg_temp_new();
@@ -1497,6 +1532,7 @@ static void _decode_opc(DisasContext * ctx)
         ctx->base.is_jmp = DISAS_STOP;
 	return;
     case 0x4066:		/* lds.l @Rm+,FPSCR */
+        CHECK_SH2
 	CHECK_FPU_ENABLED
 	{
 	    TCGv addr = tcg_temp_new();
@@ -1508,10 +1544,12 @@ static void _decode_opc(DisasContext * ctx)
 	}
 	return;
     case 0x006a:		/* sts FPSCR,Rn */
+        CHECK_SH2
 	CHECK_FPU_ENABLED
 	tcg_gen_andi_i32(REG(B11_8), cpu_fpscr, 0x003fffff);
 	return;
     case 0x4062:		/* sts FPSCR,@-Rn */
+        CHECK_SH2
 	CHECK_FPU_ENABLED
 	{
 	    TCGv addr, val;
@@ -1615,17 +1653,20 @@ static void _decode_opc(DisasContext * ctx)
         }
         return;
     case 0x0093:		/* ocbi @Rn */
+        CHECK_SH2
 	{
             gen_helper_ocbi(cpu_env, REG(B11_8));
 	}
 	return;
     case 0x00a3:		/* ocbp @Rn */
     case 0x00b3:		/* ocbwb @Rn */
+        CHECK_SH2
         /* These instructions are supposed to do nothing in case of
            a cache miss. Given that we only partially emulate caches
            it is safe to simply ignore them. */
 	return;
     case 0x0083:		/* pref @Rn */
+        CHECK_SH2
 	return;
     case 0x00d3:		/* prefi @Rn */
         CHECK_SH4A
@@ -1707,14 +1748,17 @@ static void _decode_opc(DisasContext * ctx)
         }
         return;
     case 0xf00d: /* fsts FPUL,FRn - FPSCR: Nothing */
+        CHECK_SH2
 	CHECK_FPU_ENABLED
         tcg_gen_mov_i32(FREG(B11_8), cpu_fpul);
 	return;
     case 0xf01d: /* flds FRm,FPUL - FPSCR: Nothing */
+        CHECK_SH2
 	CHECK_FPU_ENABLED
         tcg_gen_mov_i32(cpu_fpul, FREG(B11_8));
 	return;
     case 0xf02d: /* float FPUL,FRn/DRn - FPSCR: R[PR,Enable.I]/W[Cause,Flag] */
+        CHECK_SH2
 	CHECK_FPU_ENABLED
         if (ctx->tbflags & FPSCR_PR) {
 	    TCGv_i64 fp;
@@ -1731,6 +1775,7 @@ static void _decode_opc(DisasContext * ctx)
 	}
 	return;
     case 0xf03d: /* ftrc FRm/DRm,FPUL - FPSCR: R[PR,Enable.V]/W[Cause,Flag] */
+        CHECK_SH2
 	CHECK_FPU_ENABLED
         if (ctx->tbflags & FPSCR_PR) {
 	    TCGv_i64 fp;
@@ -1747,14 +1792,17 @@ static void _decode_opc(DisasContext * ctx)
 	}
 	return;
     case 0xf04d: /* fneg FRn/DRn - FPSCR: Nothing */
+        CHECK_SH2
 	CHECK_FPU_ENABLED
         tcg_gen_xori_i32(FREG(B11_8), FREG(B11_8), 0x80000000);
 	return;
     case 0xf05d: /* fabs FRn/DRn - FPCSR: Nothing */
+        CHECK_SH2
 	CHECK_FPU_ENABLED
         tcg_gen_andi_i32(FREG(B11_8), FREG(B11_8), 0x7fffffff);
 	return;
     case 0xf06d: /* fsqrt FRn */
+        CHECK_SH2
 	CHECK_FPU_ENABLED
         if (ctx->tbflags & FPSCR_PR) {
             if (ctx->opcode & 0x0100) {
@@ -1770,21 +1818,25 @@ static void _decode_opc(DisasContext * ctx)
 	}
 	return;
     case 0xf07d: /* fsrra FRn */
+        CHECK_SH2
 	CHECK_FPU_ENABLED
         CHECK_FPSCR_PR_0
         gen_helper_fsrra_FT(FREG(B11_8), cpu_env, FREG(B11_8));
 	break;
     case 0xf08d: /* fldi0 FRn - FPSCR: R[PR] */
+        CHECK_SH2
 	CHECK_FPU_ENABLED
         CHECK_FPSCR_PR_0
         tcg_gen_movi_i32(FREG(B11_8), 0);
         return;
     case 0xf09d: /* fldi1 FRn - FPSCR: R[PR] */
+        CHECK_SH2
 	CHECK_FPU_ENABLED
         CHECK_FPSCR_PR_0
         tcg_gen_movi_i32(FREG(B11_8), 0x3f800000);
         return;
     case 0xf0ad: /* fcnvsd FPUL,DRn */
+        CHECK_SH2
 	CHECK_FPU_ENABLED
 	{
 	    TCGv_i64 fp = tcg_temp_new_i64();
@@ -1794,6 +1846,7 @@ static void _decode_opc(DisasContext * ctx)
 	}
 	return;
     case 0xf0bd: /* fcnvds DRn,FPUL */
+        CHECK_SH2
 	CHECK_FPU_ENABLED
 	{
 	    TCGv_i64 fp = tcg_temp_new_i64();
@@ -1803,6 +1856,7 @@ static void _decode_opc(DisasContext * ctx)
 	}
 	return;
     case 0xf0ed: /* fipr FVm,FVn */
+        CHECK_SH2
         CHECK_FPU_ENABLED
         CHECK_FPSCR_PR_1
         {
@@ -1815,6 +1869,7 @@ static void _decode_opc(DisasContext * ctx)
         }
         break;
     case 0xf0fd: /* ftrv XMTRX,FVn */
+        CHECK_SH2
         CHECK_FPU_ENABLED
         CHECK_FPSCR_PR_1
         {
@@ -2256,8 +2311,11 @@ static void sh4_tr_init_disas_context(DisasContextBase *dcbase, CPUState *cs)
     ctx->delayed_pc = -1; /* use delayed pc from env pointer */
     ctx->features = env->features;
     ctx->has_movcal = (tbflags & TB_FLAG_PENDING_MOVCA);
-    ctx->gbank = ((tbflags & (1 << SR_MD)) &&
-                  (tbflags & (1 << SR_RB))) * 0x10;
+    if (env->features != SH_FEATURE_SH2)
+        ctx->gbank = ((tbflags & (1 << SR_MD)) &&
+                      (tbflags & (1 << SR_RB))) * 0x10;
+    else
+        ctx->gbank = 0;
     ctx->fbank = tbflags & FPSCR_FR ? 0x10 : 0;
 
     if (tbflags & GUSA_MASK) {