the sh4's control register area starts at 0x1c000000, not 0x1e000000

src/hw/sh4/sh4.c

@@ -103,8 +103,8 @@ static void sh4_reg_write(struct sh4 *sh4, uint32_t addr, uint32_t data,
   sh4->reg[offset] = data;
 }
 
-static void sh4_translate(void *data, uint32_t addr, struct ir *ir,
-                          int fastmem) {
+static void sh4_translate(void *data, uint32_t addr, struct ir *ir, int fastmem,
+                          int *size) {
   struct sh4 *sh4 = data;
 
   /* analyze the guest block to get its size, cycle count, etc. */
@@ -203,6 +203,9 @@ static void sh4_translate(void *data, uint32_t addr, struct ir *ir,
       ir_branch(ir, ir_alloc_i64(ir, (uint64_t)sh4_dispatch_dynamic));
     }
   }
+
+  /* return size */
+  *size = as.size;
 }
 
 void sh4_clear_interrupt(struct sh4 *sh4, enum sh4_interrupt intr) {
@@ -412,7 +415,7 @@ AM_BEGIN(struct sh4, sh4_data_map)
   AM_RANGE(0x14000000, 0x17ffffff) AM_DEVICE("holly", holly_expansion2_map)
 
   /* internal registers */
-  AM_RANGE(0x1e000000, 0x1fffffff) AM_HANDLE("sh4 reg",
+  AM_RANGE(0x1c000000, 0x1fffffff) AM_HANDLE("sh4 reg",
                                              (mmio_read_cb)&sh4_reg_read,
                                              (mmio_write_cb)&sh4_reg_write)
 

src/hw/sh4/sh4.h

@@ -16,23 +16,17 @@ struct jit_backend;
 
 struct sh4_dtr {
   int channel;
-  /*
-   * when rw is true, addr is the dst address
-   * when rw is false, addr is the src address
-   */
+  /* when rw is true, addr is the dst address
+     when rw is false, addr is the src address */
   int rw;
-  /*
-   * when data is non-null, a single address mode transfer is performed between
-   * the external device memory at data, and the memory at addr for
-   * when data is null, a dual address mode transfer is performed between addr
-   * and SARn / DARn
-   */
+  /* when data is non-null, a single address mode transfer is performed between
+     the external device memory at data, and the memory at addr for
+     when data is null, a dual address mode transfer is performed between addr
+     and SARn / DARn */
   uint8_t *data;
   uint32_t addr;
-  /*
-   * size is only valid for single address mode transfers, dual address mode
-   * transfers honor DMATCR
-   */
+  /* size is only valid for single address mode transfers, dual address mode
+     transfers honor DMATCR */
   int size;
 };
 

src/hw/sh4/sh4_types.h

@@ -64,11 +64,10 @@ union dmaor {
   };
 };
 
-/*
- * control register area (0xfe000000 - 0xffffffff) seems to actually only
- * represent 64 x 256 byte blocks of memory. the block index is represented
- * by bits 17-24 and the block offset by bits 2-7
- */
+/* control register area (0xfc000000 - 0xffffffff) contains only 16kb of
+   physical memory. this memory is mapped as 64 x 256 byte blocks, with the
+   block index being encoded in bits 17-24 of the address, and the block
+   offset offset in bits 2-7 */
 #define SH4_REG_OFFSET(addr) (((addr & 0x1fe0000) >> 11) | ((addr & 0xfc) >> 2))
 
 enum {

src/jit/frontend/armv3/armv3_frontend.c

@@ -5,7 +5,7 @@
 
 static void armv3_frontend_translate_code(struct jit_frontend *base,
                                           uint32_t addr, struct ir *ir,
-                                          int flags) {
+                                          int flags, int *size) {
   struct armv3_frontend *frontend = (struct armv3_frontend *)base;
 
   frontend->translate(frontend->data, addr, ir, flags);

src/jit/frontend/jit_frontend.h

@@ -10,7 +10,7 @@ struct jit_frontend;
 struct jit_frontend {
   struct jit *jit;
   void (*translate_code)(struct jit_frontend *base, uint32_t addr,
-                         struct ir *ir, int fastmem);
+                         struct ir *ir, int fastmem, int *size);
   void (*dump_code)(struct jit_frontend *base, uint32_t addr, int size);
 };
 

src/jit/frontend/sh4/sh4_frontend.c

@@ -9,11 +9,11 @@
 
 static void sh4_frontend_translate_code(struct jit_frontend *base,
                                         uint32_t addr, struct ir *ir,
-                                        int fastmem) {
+                                        int fastmem, int *size) {
   PROF_ENTER("cpu", "sh4_frontend_translate_code");
 
   struct sh4_frontend *frontend = (struct sh4_frontend *)base;
-  frontend->translate(frontend->data, addr, ir, fastmem);
+  frontend->translate(frontend->data, addr, ir, fastmem, size);
 
   PROF_LEAVE();
 }

src/jit/frontend/sh4/sh4_frontend.h

@@ -18,7 +18,7 @@ struct sh4_frontend {
 
   /* runtime interface */
   void *data;
-  void (*translate)(void *, uint32_t, struct ir *, int);
+  void (*translate)(void *, uint32_t, struct ir *, int, int *);
   void (*invalid_instr)(void *, uint64_t);
   void (*prefetch)(void *, uint64_t);
   void (*sr_updated)(void *, uint64_t);

src/jit/jit.c

@@ -277,7 +277,10 @@ void jit_compile_block(struct jit *jit, uint32_t guest_addr) {
   struct ir ir = {0};
   ir.buffer = jit->ir_buffer;
   ir.capacity = sizeof(jit->ir_buffer);
-  jit->frontend->translate_code(jit->frontend, guest_addr, &ir, fastmem);
+
+  int guest_size;
+  jit->frontend->translate_code(jit->frontend, guest_addr, &ir, fastmem,
+                                &guest_size);
 
   /* dump unoptimized block */
   if (jit->dump_compiled_blocks) {