platform ps2, handle audio similar to psp

[picodrive.git] / pico / memory.c

diff --git a/pico/memory.c b/pico/memory.c
index 4f38e5e..91bb2a8 100644 (file)
--- a/pico/memory.c
+++ b/pico/memory.c
@@ -2,6 +2,7 @@
  * memory handling\r
  * (c) Copyright Dave, 2004\r
  * (C) notaz, 2006-2010\r
  * memory handling\r
  * (c) Copyright Dave, 2004\r
  * (C) notaz, 2006-2010\r

+ * (C) irixxxx, 2019-2024\r

  *\r
  * This work is licensed under the terms of MAME license.\r
  * See COPYING file in the top-level directory.\r
  *\r
  * This work is licensed under the terms of MAME license.\r
  * See COPYING file in the top-level directory.\r


@@ -20,7 +21,7 @@ uptr m68k_read16_map [0x1000000 >> M68K_MEM_SHIFT];
 uptr m68k_write8_map [0x1000000 >> M68K_MEM_SHIFT];\r
 uptr m68k_write16_map[0x1000000 >> M68K_MEM_SHIFT];\r
 \r
 uptr m68k_write8_map [0x1000000 >> M68K_MEM_SHIFT];\r
 uptr m68k_write16_map[0x1000000 >> M68K_MEM_SHIFT];\r
 \r

-static void xmap_set(uptr *map, int shift, int start_addr, int end_addr,\r
+static void xmap_set(uptr *map, int shift, u32 start_addr, u32 end_addr,\r

     const void *func_or_mh, int is_func)\r
 {\r
 #ifdef __clang__\r
     const void *func_or_mh, int is_func)\r
 {\r
 #ifdef __clang__\r


@@ -53,20 +54,68 @@ static void xmap_set(uptr *map, int shift, int start_addr, int end_addr,
   }\r
 }\r
 \r
   }\r
 }\r
 \r

-void z80_map_set(uptr *map, int start_addr, int end_addr,\r
+void z80_map_set(uptr *map, u16 start_addr, u16 end_addr,\r

     const void *func_or_mh, int is_func)\r
 {\r
   xmap_set(map, Z80_MEM_SHIFT, start_addr, end_addr, func_or_mh, is_func);\r
     const void *func_or_mh, int is_func)\r
 {\r
   xmap_set(map, Z80_MEM_SHIFT, start_addr, end_addr, func_or_mh, is_func);\r

+#ifdef _USE_CZ80\r
+  if (!is_func)\r
+    Cz80_Set_Fetch(&CZ80, start_addr, end_addr, (FPTR)func_or_mh);\r
+#endif\r

 }\r
 \r
 }\r
 \r

-void cpu68k_map_set(uptr *map, int start_addr, int end_addr,\r
+void cpu68k_map_set(uptr *map, u32 start_addr, u32 end_addr,\r

     const void *func_or_mh, int is_func)\r
 {\r
     const void *func_or_mh, int is_func)\r
 {\r

-  xmap_set(map, M68K_MEM_SHIFT, start_addr, end_addr, func_or_mh, is_func);\r
+  xmap_set(map, M68K_MEM_SHIFT, start_addr, end_addr, func_or_mh, is_func & 1);\r
+#ifdef EMU_F68K\r
+  // setup FAME fetchmap\r
+  if (!(is_func & 1))\r
+  {\r
+    M68K_CONTEXT *ctx = is_func & 2 ? &PicoCpuFS68k : &PicoCpuFM68k;\r
+    int shiftout = 24 - FAMEC_FETCHBITS;\r
+    int i = start_addr >> shiftout;\r
+    uptr base = (uptr)func_or_mh - (i << shiftout);\r
+    for (; i <= (end_addr >> shiftout); i++)\r
+      ctx->Fetch[i] = base;\r
+  }\r
+#endif\r

 }\r
 \r
 // more specialized/optimized function (does same as above)\r
 }\r
 \r
 // more specialized/optimized function (does same as above)\r

-void cpu68k_map_all_ram(int start_addr, int end_addr, void *ptr, int is_sub)\r
+void cpu68k_map_read_mem(u32 start_addr, u32 end_addr, void *ptr, int is_sub)\r
+{\r
+  uptr *r8map, *r16map;\r
+  uptr addr = (uptr)ptr;\r
+  int shift = M68K_MEM_SHIFT;\r
+  int i;\r
+\r
+  if (!is_sub) {\r
+    r8map = m68k_read8_map;\r
+    r16map = m68k_read16_map;\r
+  } else {\r
+    r8map = s68k_read8_map;\r
+    r16map = s68k_read16_map;\r
+  }\r
+\r
+  addr -= start_addr;\r
+  addr >>= 1;\r
+  for (i = start_addr >> shift; i <= end_addr >> shift; i++)\r
+    r8map[i] = r16map[i] = addr;\r
+#ifdef EMU_F68K\r
+  // setup FAME fetchmap\r
+  {\r
+    M68K_CONTEXT *ctx = is_sub ? &PicoCpuFS68k : &PicoCpuFM68k;\r
+    int shiftout = 24 - FAMEC_FETCHBITS;\r
+    i = start_addr >> shiftout;\r
+    addr = (uptr)ptr - (i << shiftout);\r
+    for (; i <= (end_addr >> shiftout); i++)\r
+      ctx->Fetch[i] = addr;\r
+  }\r
+#endif\r
+}\r
+\r
+void cpu68k_map_all_ram(u32 start_addr, u32 end_addr, void *ptr, int is_sub)\r

 {\r
   uptr *r8map, *r16map, *w8map, *w16map;\r
   uptr addr = (uptr)ptr;\r
 {\r
   uptr *r8map, *r16map, *w8map, *w16map;\r
   uptr addr = (uptr)ptr;\r


@@ -89,18 +138,87 @@ void cpu68k_map_all_ram(int start_addr, int end_addr, void *ptr, int is_sub)
   addr >>= 1;\r
   for (i = start_addr >> shift; i <= end_addr >> shift; i++)\r
     r8map[i] = r16map[i] = w8map[i] = w16map[i] = addr;\r
   addr >>= 1;\r
   for (i = start_addr >> shift; i <= end_addr >> shift; i++)\r
     r8map[i] = r16map[i] = w8map[i] = w16map[i] = addr;\r

+#ifdef EMU_F68K\r
+  // setup FAME fetchmap\r
+  {\r
+    M68K_CONTEXT *ctx = is_sub ? &PicoCpuFS68k : &PicoCpuFM68k;\r
+    int shiftout = 24 - FAMEC_FETCHBITS;\r
+    i = start_addr >> shiftout;\r
+    addr = (uptr)ptr - (i << shiftout);\r
+    for (; i <= (end_addr >> shiftout); i++)\r
+      ctx->Fetch[i] = addr;\r
+  }\r
+#endif\r
+}\r
+\r
+void cpu68k_map_read_funcs(u32 start_addr, u32 end_addr, u32 (*r8)(u32), u32 (*r16)(u32), int is_sub)\r
+{\r
+  uptr *r8map, *r16map;\r
+  uptr ar8 = (uptr)r8, ar16 = (uptr)r16;\r
+  int shift = M68K_MEM_SHIFT;\r
+  int i;\r
+\r
+  if (!is_sub) {\r
+    r8map = m68k_read8_map;\r
+    r16map = m68k_read16_map;\r
+  } else {\r
+    r8map = s68k_read8_map;\r
+    r16map = s68k_read16_map;\r
+  }\r
+\r
+  ar8 = (ar8 >> 1 ) | MAP_FLAG;\r
+  ar16 = (ar16 >> 1 ) | MAP_FLAG;\r
+  for (i = start_addr >> shift; i <= end_addr >> shift; i++)\r
+    r8map[i] = ar8, r16map[i] = ar16;\r
+}\r
+\r
+void cpu68k_map_all_funcs(u32 start_addr, u32 end_addr, u32 (*r8)(u32), u32 (*r16)(u32), void (*w8)(u32, u32), void (*w16)(u32, u32), int is_sub)\r
+{\r
+  uptr *r8map, *r16map, *w8map, *w16map;\r
+  uptr ar8 = (uptr)r8, ar16 = (uptr)r16;\r
+  uptr aw8 = (uptr)w8, aw16 = (uptr)w16;\r
+  int shift = M68K_MEM_SHIFT;\r
+  int i;\r
+\r
+  if (!is_sub) {\r
+    r8map = m68k_read8_map;\r
+    r16map = m68k_read16_map;\r
+    w8map = m68k_write8_map;\r
+    w16map = m68k_write16_map;\r
+  } else {\r
+    r8map = s68k_read8_map;\r
+    r16map = s68k_read16_map;\r
+    w8map = s68k_write8_map;\r
+    w16map = s68k_write16_map;\r
+  }\r
+\r
+  ar8 = (ar8 >> 1 ) | MAP_FLAG;\r
+  ar16 = (ar16 >> 1 ) | MAP_FLAG;\r
+  aw8 = (aw8 >> 1 ) | MAP_FLAG;\r
+  aw16 = (aw16 >> 1 ) | MAP_FLAG;\r
+  for (i = start_addr >> shift; i <= end_addr >> shift; i++)\r
+    r8map[i] = ar8, r16map[i] = ar16, w8map[i] = aw8, w16map[i] = aw16;\r
+}\r
+\r
+u32 PicoRead16_floating(u32 a)\r
+{\r
+  // faking open bus\r
+  u32 d = (Pico.m.rotate += 0x41);\r
+  d ^= (d << 5) ^ (d << 8);\r
+  if ((a & 0xff0000) == 0xa10000) return d; // MegaCD pulldowns don't work here curiously\r
+  return (PicoIn.AHW & PAHW_MCD) ? 0x00 : d; // pulldown if MegaCD2 attached\r

 }\r
 \r
 static u32 m68k_unmapped_read8(u32 a)\r
 {\r
   elprintf(EL_UIO, "m68k unmapped r8  [%06x] @%06x", a, SekPc);\r
 }\r
 \r
 static u32 m68k_unmapped_read8(u32 a)\r
 {\r
   elprintf(EL_UIO, "m68k unmapped r8  [%06x] @%06x", a, SekPc);\r

-  return 0; // assume pulldown, as if MegaCD2 was attached\r
+  return a < 0x400000 ? 0 : (u8)PicoRead16_floating(a);\r

 }\r
 \r
 static u32 m68k_unmapped_read16(u32 a)\r
 {\r
   elprintf(EL_UIO, "m68k unmapped r16 [%06x] @%06x", a, SekPc);\r
 }\r
 \r
 static u32 m68k_unmapped_read16(u32 a)\r
 {\r
   elprintf(EL_UIO, "m68k unmapped r16 [%06x] @%06x", a, SekPc);\r

-  return 0;\r
+  return a < 0x400000 ? 0 : PicoRead16_floating(a);\r

 }\r
 \r
 static void m68k_unmapped_write8(u32 a, u32 d)\r
 }\r
 \r
 static void m68k_unmapped_write8(u32 a, u32 d)\r


@@ -113,7 +231,7 @@ static void m68k_unmapped_write16(u32 a, u32 d)
   elprintf(EL_UIO, "m68k unmapped w16 [%06x] %04x @%06x", a, d & 0xffff, SekPc);\r
 }\r
 \r
   elprintf(EL_UIO, "m68k unmapped w16 [%06x] %04x @%06x", a, d & 0xffff, SekPc);\r
 }\r
 \r

-void m68k_map_unmap(int start_addr, int end_addr)\r
+void m68k_map_unmap(u32 start_addr, u32 end_addr)\r

 {\r
 #ifdef __clang__\r
   // workaround bug (segfault) in \r
 {\r
 #ifdef __clang__\r
   // workaround bug (segfault) in \r


@@ -141,12 +259,14 @@ void m68k_map_unmap(int start_addr, int end_addr)
     m68k_write16_map[i] = (addr >> 1) | MAP_FLAG;\r
 }\r
 \r
     m68k_write16_map[i] = (addr >> 1) | MAP_FLAG;\r
 }\r
 \r

+#ifndef _ASM_MEMORY_C\r

 MAKE_68K_READ8(m68k_read8, m68k_read8_map)\r
 MAKE_68K_READ16(m68k_read16, m68k_read16_map)\r
 MAKE_68K_READ32(m68k_read32, m68k_read16_map)\r
 MAKE_68K_WRITE8(m68k_write8, m68k_write8_map)\r
 MAKE_68K_WRITE16(m68k_write16, m68k_write16_map)\r
 MAKE_68K_WRITE32(m68k_write32, m68k_write16_map)\r
 MAKE_68K_READ8(m68k_read8, m68k_read8_map)\r
 MAKE_68K_READ16(m68k_read16, m68k_read16_map)\r
 MAKE_68K_READ32(m68k_read32, m68k_read16_map)\r
 MAKE_68K_WRITE8(m68k_write8, m68k_write8_map)\r
 MAKE_68K_WRITE16(m68k_write16, m68k_write16_map)\r
 MAKE_68K_WRITE32(m68k_write32, m68k_write16_map)\r

+#endif\r

 \r
 // -----------------------------------------------------------------\r
 \r
 \r
 // -----------------------------------------------------------------\r
 \r


@@ -188,7 +308,7 @@ void cyclone_crashed(u32 pc, struct Cyclone *context)
 \r
 static u32 read_pad_3btn(int i, u32 out_bits)\r
 {\r
 \r
 static u32 read_pad_3btn(int i, u32 out_bits)\r
 {\r

-  u32 pad = ~PicoPadInt[i]; // Get inverse of pad MXYZ SACB RLDU\r
+  u32 pad = ~PicoIn.padInt[i]; // Get inverse of pad MXYZ SACB RLDU\r

   u32 value;\r
 \r
   if (out_bits & 0x40) // TH\r
   u32 value;\r
 \r
   if (out_bits & 0x40) // TH\r


@@ -202,7 +322,7 @@ static u32 read_pad_3btn(int i, u32 out_bits)
 \r
 static u32 read_pad_6btn(int i, u32 out_bits)\r
 {\r
 \r
 static u32 read_pad_6btn(int i, u32 out_bits)\r
 {\r

-  u32 pad = ~PicoPadInt[i]; // Get inverse of pad MXYZ SACB RLDU\r
+  u32 pad = ~PicoIn.padInt[i]; // Get inverse of pad MXYZ SACB RLDU\r

   int phase = Pico.m.padTHPhase[i];\r
   u32 value;\r
 \r
   int phase = Pico.m.padTHPhase[i];\r
   u32 value;\r
 \r


@@ -212,9 +332,9 @@ static u32 read_pad_6btn(int i, u32 out_bits)
   }\r
   else if(phase == 3) {\r
     if (out_bits & 0x40)\r
   }\r
   else if(phase == 3) {\r
     if (out_bits & 0x40)\r

-      return (pad & 0x30) | ((pad >> 8) & 0xf);  // ?1CB MXYZ\r
+      value = (pad & 0x30) | ((pad >> 8) & 0xf); // ?1CB MXYZ\r

     else\r
     else\r

-      return ((pad & 0xc0) >> 2) | 0x0f;         // ?0SA 1111\r
+      value = ((pad & 0xc0) >> 2) | 0x0f;        // ?0SA 1111\r

     goto out;\r
   }\r
 \r
     goto out;\r
   }\r
 \r


@@ -228,6 +348,51 @@ out:
   return value;\r
 }\r
 \r
   return value;\r
 }\r
 \r

+static u32 read_pad_team(int i, u32 out_bits)\r
+{\r
+  u32 pad;\r
+  int phase = Pico.m.padTHPhase[i];\r
+  u32 value;\r
+\r
+  switch (phase) {\r
+  case 0:\r
+    value = 0x03;\r
+    break;\r
+  case 1:\r
+    value = 0x0f;\r
+    break;\r
+  case 4: case 5: case 6: case 7: // controller IDs, all 3 btn for now\r
+    value = 0x00;\r
+    break;\r
+  case 8: case 10: case 12: case 14:\r
+    pad = ~PicoIn.padInt[(phase-8) >> 1];\r
+    value = pad & 0x0f;                          // ?x?x RLDU\r
+    break;\r
+  case 9: case 11: case 13: case 15:\r
+    pad = ~PicoIn.padInt[(phase-8) >> 1];\r
+    value = (pad & 0xf0) >>  4;                  // ?x?x SACB\r
+    break;\r
+  default:\r
+    value = 0;\r
+    break;\r
+  }\r
+\r
+  value |= (out_bits & 0x40) | ((out_bits & 0x20)>>1);\r
+  return value;\r
+}\r
+\r
+static u32 read_pad_4way(int i, u32 out_bits)\r
+{\r
+  u32 pad = (PicoMem.ioports[2] & 0x70) >> 4;\r
+  u32 value = 0;\r
+\r
+  if (i == 0 && pad <= 3)\r
+    value = read_pad_3btn(pad, out_bits);\r
+\r
+  value |= (out_bits & 0x40);\r
+  return value;\r
+}\r
+\r

 static u32 read_nothing(int i, u32 out_bits)\r
 {\r
   return 0xff;\r
 static u32 read_nothing(int i, u32 out_bits)\r
 {\r
   return 0xff;\r


@@ -241,14 +406,28 @@ static port_read_func *port_readers[3] = {
   read_nothing\r
 };\r
 \r
   read_nothing\r
 };\r
 \r

+static int padTHLatency[3]; // TODO this should be in the save file structures\r
+\r

 static NOINLINE u32 port_read(int i)\r
 {\r
 static NOINLINE u32 port_read(int i)\r
 {\r

-  u32 data_reg = Pico.ioports[i + 1];\r
-  u32 ctrl_reg = Pico.ioports[i + 4] | 0x80;\r
+  u32 data_reg = PicoMem.ioports[i + 1];\r
+  u32 ctrl_reg = PicoMem.ioports[i + 4] | 0x80;\r

   u32 in, out;\r
 \r
   out = data_reg & ctrl_reg;\r
   u32 in, out;\r
 \r
   out = data_reg & ctrl_reg;\r

-  out |= 0x7f & ~ctrl_reg; // pull-ups\r
+\r
+  // pull-ups: should be 0x7f, but Decap Attack has a bug where it temp.\r
+  // disables output before doing TH-low read, so emulate RC filter for TH.\r
+  // Decap Attack reportedly doesn't work on Nomad but works on must\r
+  // other MD revisions (different pull-up strength?).\r
+  u32 mask = 0x3f;\r
+  if (CYCLES_GE(padTHLatency[i], SekCyclesDone()+100))\r
+    padTHLatency[i] = SekCyclesDone(); // kludge to cope with cycle wrap\r
+  if (CYCLES_GE(SekCyclesDone(), padTHLatency[i])) {\r
+    mask |= 0x40;\r
+    padTHLatency[i] = SekCyclesDone();\r
+  }\r
+  out |= mask & ~ctrl_reg;\r

 \r
   in = port_readers[i](i, out);\r
 \r
 \r
   in = port_readers[i](i, out);\r
 \r


@@ -262,7 +441,10 @@ void PicoSetInputDevice(int port, enum input_device device)
   if (port < 0 || port > 2)\r
     return;\r
 \r
   if (port < 0 || port > 2)\r
     return;\r
 \r

-  switch (device) {\r
+  if (port == 1 && port_readers[0] == read_pad_team)\r
+    func = read_nothing;\r
+\r
+  else switch (device) {\r

   case PICO_INPUT_PAD_3BTN:\r
     func = read_pad_3btn;\r
     break;\r
   case PICO_INPUT_PAD_3BTN:\r
     func = read_pad_3btn;\r
     break;\r


@@ -271,6 +453,14 @@ void PicoSetInputDevice(int port, enum input_device device)
     func = read_pad_6btn;\r
     break;\r
 \r
     func = read_pad_6btn;\r
     break;\r
 \r

+  case PICO_INPUT_PAD_TEAM:\r
+    func = read_pad_team;\r
+    break;\r
+\r
+  case PICO_INPUT_PAD_4WAY:\r
+    func = read_pad_4way;\r
+    break;\r
+\r

   default:\r
     func = read_nothing;\r
     break;\r
   default:\r
     func = read_nothing;\r
     break;\r


@@ -288,7 +478,7 @@ NOINLINE u32 io_ports_read(u32 a)
     case 1:  d = port_read(0); break;\r
     case 2:  d = port_read(1); break;\r
     case 3:  d = port_read(2); break;\r
     case 1:  d = port_read(0); break;\r
     case 2:  d = port_read(1); break;\r
     case 3:  d = port_read(2); break;\r

-    default: d = Pico.ioports[a]; break; // IO ports can be used as RAM\r
+    default: d = PicoMem.ioports[a]; break; // IO ports can be used as RAM\r

   }\r
   return d;\r
 }\r
   }\r
   return d;\r
 }\r


@@ -301,37 +491,62 @@ NOINLINE void io_ports_write(u32 a, u32 d)
   if (1 <= a && a <= 2)\r
   {\r
     Pico.m.padDelay[a - 1] = 0;\r
   if (1 <= a && a <= 2)\r
   {\r
     Pico.m.padDelay[a - 1] = 0;\r

-    if (!(Pico.ioports[a] & 0x40) && (d & 0x40))\r
+    if (port_readers[a - 1] == read_pad_team) {\r
+      if (d & 0x40)\r
+        Pico.m.padTHPhase[a - 1] = 0;\r
+      else if ((d^PicoMem.ioports[a]) & 0x60)\r
+        Pico.m.padTHPhase[a - 1]++;\r
+    } else if (port_readers[0] == read_pad_4way) {\r
+      if (a == 2 && ((PicoMem.ioports[a] ^ d) & 0x70))\r
+        Pico.m.padTHPhase[0] = 0;\r
+      if (a == 1 && !(PicoMem.ioports[a] & 0x40) && (d & 0x40))\r
+        Pico.m.padTHPhase[0]++;\r
+    } else if (!(PicoMem.ioports[a] & 0x40) && (d & 0x40))\r

       Pico.m.padTHPhase[a - 1]++;\r
   }\r
 \r
       Pico.m.padTHPhase[a - 1]++;\r
   }\r
 \r

+  // after switching TH to input there's a latency before the pullup value is \r
+  // read back as input (see Decap Attack, not in Samurai Showdown, 32x WWF Raw)\r
+  if (4 <= a && a <= 5) {\r
+    if ((PicoMem.ioports[a] & 0x40) && !(d & 0x40) && !(PicoMem.ioports[a - 3] & 0x40))\r
+      // latency after switching to input and output was low\r
+      padTHLatency[a - 4] = SekCyclesDone() + 25;\r
+  }\r
+\r

   // certain IO ports can be used as RAM\r
   // certain IO ports can be used as RAM\r

-  Pico.ioports[a] = d;\r
+  PicoMem.ioports[a] = d;\r

 }\r
 \r
 }\r
 \r

-// lame..\r

 static int z80_cycles_from_68k(void)\r
 {\r
 static int z80_cycles_from_68k(void)\r
 {\r

-  return z80_cycle_aim\r
-    + cycles_68k_to_z80(SekCyclesDone() - last_z80_sync);\r
+  int m68k_cnt = SekCyclesDone() - Pico.t.m68c_frame_start;\r
+  return cycles_68k_to_z80(m68k_cnt);\r

 }\r
 \r
 void NOINLINE ctl_write_z80busreq(u32 d)\r
 {\r
   d&=1; d^=1;\r
 }\r
 \r
 void NOINLINE ctl_write_z80busreq(u32 d)\r
 {\r
   d&=1; d^=1;\r

-  elprintf(EL_BUSREQ, "set_zrun: %i->%i [%i] @%06x", Pico.m.z80Run, d, SekCyclesDone(), SekPc);\r
+  elprintf(EL_BUSREQ, "set_zrun: %i->%i [%u] @%06x", Pico.m.z80Run, d, SekCyclesDone(), SekPc);\r

   if (d ^ Pico.m.z80Run)\r
   {\r
     if (d)\r
     {\r
   if (d ^ Pico.m.z80Run)\r
   {\r
     if (d)\r
     {\r

-      z80_cycle_cnt = z80_cycles_from_68k();\r
+      Pico.t.z80c_aim = Pico.t.z80c_cnt = z80_cycles_from_68k() + 2;\r
+      Pico.t.z80c_cnt += Pico.t.z80_busdelay >> 8;\r
+      Pico.t.z80_busdelay &= 0xff;\r

     }\r
     else\r
     {\r
     }\r
     else\r
     {\r

-      if ((PicoOpt&POPT_EN_Z80) && !Pico.m.z80_reset) {\r
+      if ((PicoIn.opt & POPT_EN_Z80) && !Pico.m.z80_reset) {\r
+        // Z80 grants bus after the current M cycle, even within an insn\r
+        // simulate this by accumulating the last insn overhang in busdelay\r
+        unsigned granted;\r

         pprof_start(m68k);\r
         PicoSyncZ80(SekCyclesDone());\r
         pprof_end_sub(m68k);\r
         pprof_start(m68k);\r
         PicoSyncZ80(SekCyclesDone());\r
         pprof_end_sub(m68k);\r

+        granted = Pico.t.z80c_aim + 6; // M cycle is 3-6 cycles \r
+        Pico.t.z80_busdelay += (Pico.t.z80c_cnt - granted) << 8;\r
+        Pico.t.z80c_cnt = granted;\r

       }\r
     }\r
     Pico.m.z80Run = d;\r
       }\r
     }\r
     Pico.m.z80Run = d;\r


@@ -341,28 +556,41 @@ void NOINLINE ctl_write_z80busreq(u32 d)
 void NOINLINE ctl_write_z80reset(u32 d)\r
 {\r
   d&=1; d^=1;\r
 void NOINLINE ctl_write_z80reset(u32 d)\r
 {\r
   d&=1; d^=1;\r

-  elprintf(EL_BUSREQ, "set_zreset: %i->%i [%i] @%06x", Pico.m.z80_reset, d, SekCyclesDone(), SekPc);\r
+  elprintf(EL_BUSREQ, "set_zreset: %i->%i [%u] @%06x", Pico.m.z80_reset, d, SekCyclesDone(), SekPc);\r

   if (d ^ Pico.m.z80_reset)\r
   {\r
     if (d)\r
     {\r
   if (d ^ Pico.m.z80_reset)\r
   {\r
     if (d)\r
     {\r

-      if ((PicoOpt&POPT_EN_Z80) && Pico.m.z80Run) {\r
+      if ((PicoIn.opt & POPT_EN_Z80) && Pico.m.z80Run) {\r

         pprof_start(m68k);\r
         PicoSyncZ80(SekCyclesDone());\r
         pprof_end_sub(m68k);\r
       }\r
         pprof_start(m68k);\r
         PicoSyncZ80(SekCyclesDone());\r
         pprof_end_sub(m68k);\r
       }\r

+      Pico.t.z80_busdelay &= 0xff; // also resets bus request\r

       YM2612ResetChip();\r
       timers_reset();\r
     }\r
     else\r
     {\r
       YM2612ResetChip();\r
       timers_reset();\r
     }\r
     else\r
     {\r

-      z80_cycle_cnt = z80_cycles_from_68k();\r
+      Pico.t.z80c_aim = Pico.t.z80c_cnt = z80_cycles_from_68k() + 2;\r

       z80_reset();\r
     }\r
     Pico.m.z80_reset = d;\r
   }\r
 }\r
 \r
       z80_reset();\r
     }\r
     Pico.m.z80_reset = d;\r
   }\r
 }\r
 \r

+static void psg_write_68k(u32 d)\r
+{\r
+  PsndDoPSG(z80_cycles_from_68k());\r
+  SN76496Write(d);\r
+}\r
+\r
+static void psg_write_z80(u32 d)\r
+{\r
+  PsndDoPSG(z80_cyclesDone());\r
+  SN76496Write(d);\r
+}\r
+\r

 // -----------------------------------------------------------------\r
 \r
 #ifndef _ASM_MEMORY_C\r
 // -----------------------------------------------------------------\r
 \r
 #ifndef _ASM_MEMORY_C\r


@@ -371,21 +599,22 @@ void NOINLINE ctl_write_z80reset(u32 d)
 static u32 PicoRead8_sram(u32 a)\r
 {\r
   u32 d;\r
 static u32 PicoRead8_sram(u32 a)\r
 {\r
   u32 d;\r

-  if (SRam.start <= a && a <= SRam.end && (Pico.m.sram_reg & SRR_MAPPED))\r
+  if (Pico.sv.start <= a && a <= Pico.sv.end && (Pico.m.sram_reg & SRR_MAPPED))\r

   {\r
   {\r

-    if (SRam.flags & SRF_EEPROM) {\r
+    if (Pico.sv.flags & SRF_EEPROM) {\r

       d = EEPROM_read();\r
       if (!(a & 1))\r
         d >>= 8;\r
       d = EEPROM_read();\r
       if (!(a & 1))\r
         d >>= 8;\r

+      d &= 0xff;\r

     } else\r
     } else\r

-      d = *(u8 *)(SRam.data - SRam.start + a);\r
+      d = *(u8 *)(Pico.sv.data - Pico.sv.start + a);\r

     elprintf(EL_SRAMIO, "sram r8  [%06x]   %02x @ %06x", a, d, SekPc);\r
     return d;\r
   }\r
 \r
   // XXX: this is banking unfriendly\r
   if (a < Pico.romsize)\r
     elprintf(EL_SRAMIO, "sram r8  [%06x]   %02x @ %06x", a, d, SekPc);\r
     return d;\r
   }\r
 \r
   // XXX: this is banking unfriendly\r
   if (a < Pico.romsize)\r

-    return Pico.rom[a ^ 1];\r
+    return Pico.rom[MEM_BE2(a)];\r

   \r
   return m68k_unmapped_read8(a);\r
 }\r
   \r
   return m68k_unmapped_read8(a);\r
 }\r


@@ -393,12 +622,12 @@ static u32 PicoRead8_sram(u32 a)
 static u32 PicoRead16_sram(u32 a)\r
 {\r
   u32 d;\r
 static u32 PicoRead16_sram(u32 a)\r
 {\r
   u32 d;\r

-  if (SRam.start <= a && a <= SRam.end && (Pico.m.sram_reg & SRR_MAPPED))\r
+  if (Pico.sv.start <= a && a <= Pico.sv.end && (Pico.m.sram_reg & SRR_MAPPED))\r

   {\r
   {\r

-    if (SRam.flags & SRF_EEPROM)\r
+    if (Pico.sv.flags & SRF_EEPROM)\r

       d = EEPROM_read();\r
     else {\r
       d = EEPROM_read();\r
     else {\r

-      u8 *pm = (u8 *)(SRam.data - SRam.start + a);\r
+      u8 *pm = (u8 *)(Pico.sv.data - Pico.sv.start + a);\r

       d  = pm[0] << 8;\r
       d |= pm[1];\r
     }\r
       d  = pm[0] << 8;\r
       d |= pm[1];\r
     }\r


@@ -416,20 +645,20 @@ static u32 PicoRead16_sram(u32 a)
 \r
 static void PicoWrite8_sram(u32 a, u32 d)\r
 {\r
 \r
 static void PicoWrite8_sram(u32 a, u32 d)\r
 {\r

-  if (a > SRam.end || a < SRam.start || !(Pico.m.sram_reg & SRR_MAPPED)) {\r
+  if (a > Pico.sv.end || a < Pico.sv.start || !(Pico.m.sram_reg & SRR_MAPPED)) {\r

     m68k_unmapped_write8(a, d);\r
     return;\r
   }\r
 \r
   elprintf(EL_SRAMIO, "sram w8  [%06x]   %02x @ %06x", a, d & 0xff, SekPc);\r
     m68k_unmapped_write8(a, d);\r
     return;\r
   }\r
 \r
   elprintf(EL_SRAMIO, "sram w8  [%06x]   %02x @ %06x", a, d & 0xff, SekPc);\r

-  if (SRam.flags & SRF_EEPROM)\r
+  if (Pico.sv.flags & SRF_EEPROM)\r

   {\r
     EEPROM_write8(a, d);\r
   }\r
   else {\r
   {\r
     EEPROM_write8(a, d);\r
   }\r
   else {\r

-    u8 *pm = (u8 *)(SRam.data - SRam.start + a);\r
+    u8 *pm = (u8 *)(Pico.sv.data - Pico.sv.start + a);\r

     if (*pm != (u8)d) {\r
     if (*pm != (u8)d) {\r

-      SRam.changed = 1;\r
+      Pico.sv.changed = 1;\r

       *pm = (u8)d;\r
     }\r
   }\r
       *pm = (u8)d;\r
     }\r
   }\r


@@ -437,22 +666,25 @@ static void PicoWrite8_sram(u32 a, u32 d)
 \r
 static void PicoWrite16_sram(u32 a, u32 d)\r
 {\r
 \r
 static void PicoWrite16_sram(u32 a, u32 d)\r
 {\r

-  if (a > SRam.end || a < SRam.start || !(Pico.m.sram_reg & SRR_MAPPED)) {\r
+  if (a > Pico.sv.end || a < Pico.sv.start || !(Pico.m.sram_reg & SRR_MAPPED)) {\r

     m68k_unmapped_write16(a, d);\r
     return;\r
   }\r
 \r
   elprintf(EL_SRAMIO, "sram w16 [%06x] %04x @ %06x", a, d & 0xffff, SekPc);\r
     m68k_unmapped_write16(a, d);\r
     return;\r
   }\r
 \r
   elprintf(EL_SRAMIO, "sram w16 [%06x] %04x @ %06x", a, d & 0xffff, SekPc);\r

-  if (SRam.flags & SRF_EEPROM)\r
+  if (Pico.sv.flags & SRF_EEPROM)\r

   {\r
     EEPROM_write16(d);\r
   }\r
   else {\r
   {\r
     EEPROM_write16(d);\r
   }\r
   else {\r

-    // XXX: hardware could easily use MSB too..\r
-    u8 *pm = (u8 *)(SRam.data - SRam.start + a);\r
-    if (*pm != (u8)d) {\r
-      SRam.changed = 1;\r
-      *pm = (u8)d;\r
+    u8 *pm = (u8 *)(Pico.sv.data - Pico.sv.start + a);\r
+    if (pm[0] != (u8)(d >> 8)) {\r
+      Pico.sv.changed = 1;\r
+      pm[0] = (u8)(d >> 8);\r
+    }\r
+    if (pm[1] != (u8)d) {\r
+      Pico.sv.changed = 1;\r
+      pm[1] = (u8)d;\r

     }\r
   }\r
 }\r
     }\r
   }\r
 }\r


@@ -461,19 +693,22 @@ static void PicoWrite16_sram(u32 a, u32 d)
 // TODO: verify mirrors VDP and bank reg (bank area mirroring verified)\r
 static u32 PicoRead8_z80(u32 a)\r
 {\r
 // TODO: verify mirrors VDP and bank reg (bank area mirroring verified)\r
 static u32 PicoRead8_z80(u32 a)\r
 {\r

-  u32 d = 0xff;\r
-  if ((Pico.m.z80Run & 1) || Pico.m.z80_reset) {\r
+  u32 d;\r
+  if ((Pico.m.z80Run | Pico.m.z80_reset | (z80_cycles_from_68k() < Pico.t.z80c_cnt)) &&\r
+      !(PicoIn.quirks & PQUIRK_NO_Z80_BUS_LOCK)) {\r

     elprintf(EL_ANOMALY, "68k z80 read with no bus! [%06x] @ %06x", a, SekPc);\r
     elprintf(EL_ANOMALY, "68k z80 read with no bus! [%06x] @ %06x", a, SekPc);\r

-    // open bus. Pulled down if MegaCD2 is attached.\r
-    return 0;\r
+    return (u8)PicoRead16_floating(a);\r

   }\r
   }\r

+  SekCyclesBurnRun(1);\r

 \r
 \r

-  if ((a & 0x4000) == 0x0000)\r
-    d = Pico.zram[a & 0x1fff];\r
-  else if ((a & 0x6000) == 0x4000) // 0x4000-0x5fff\r
+  if ((a & 0x4000) == 0x0000) {\r
+    d = PicoMem.zram[a & 0x1fff];\r
+  } else if ((a & 0x6000) == 0x4000) // 0x4000-0x5fff\r

     d = ym2612_read_local_68k(); \r
     d = ym2612_read_local_68k(); \r

-  else\r
+  else {\r

     elprintf(EL_UIO|EL_ANOMALY, "68k bad read [%06x] @%06x", a, SekPc);\r
     elprintf(EL_UIO|EL_ANOMALY, "68k bad read [%06x] @%06x", a, SekPc);\r

+    d = (u8)PicoRead16_floating(a);\r
+  }\r

   return d;\r
 }\r
 \r
   return d;\r
 }\r
 \r


@@ -485,26 +720,25 @@ static u32 PicoRead16_z80(u32 a)
 \r
 static void PicoWrite8_z80(u32 a, u32 d)\r
 {\r
 \r
 static void PicoWrite8_z80(u32 a, u32 d)\r
 {\r

-  if ((Pico.m.z80Run & 1) || Pico.m.z80_reset) {\r
+  if ((Pico.m.z80Run | Pico.m.z80_reset) && !(PicoIn.quirks & PQUIRK_NO_Z80_BUS_LOCK)) {\r

     // verified on real hw\r
     elprintf(EL_ANOMALY, "68k z80 write with no bus or reset! [%06x] %02x @ %06x", a, d&0xff, SekPc);\r
     return;\r
   }\r
     // verified on real hw\r
     elprintf(EL_ANOMALY, "68k z80 write with no bus or reset! [%06x] %02x @ %06x", a, d&0xff, SekPc);\r
     return;\r
   }\r

+  SekCyclesBurnRun(1);\r

 \r
   if ((a & 0x4000) == 0x0000) { // z80 RAM\r
 \r
   if ((a & 0x4000) == 0x0000) { // z80 RAM\r

-    SekCyclesBurnRun(2); // FIXME hack\r
-    Pico.zram[a & 0x1fff] = (u8)d;\r
+    PicoMem.zram[a & 0x1fff] = (u8)d;\r

     return;\r
   }\r
   if ((a & 0x6000) == 0x4000) { // FM Sound\r
     return;\r
   }\r
   if ((a & 0x6000) == 0x4000) { // FM Sound\r

-    if (PicoOpt & POPT_EN_FM)\r
-      emustatus |= ym2612_write_local(a&3, d&0xff, 0)&1;\r
+    if (PicoIn.opt & POPT_EN_FM)\r
+      ym2612_write_local(a & 3, d & 0xff, 0);\r

     return;\r
   }\r
   // TODO: probably other VDP access too? Maybe more mirrors?\r
   if ((a & 0x7ff9) == 0x7f11) { // PSG Sound\r
     return;\r
   }\r
   // TODO: probably other VDP access too? Maybe more mirrors?\r
   if ((a & 0x7ff9) == 0x7f11) { // PSG Sound\r

-    if (PicoOpt & POPT_EN_PSG)\r
-      SN76496Write(d);\r
+    psg_write_68k(d);\r

     return;\r
   }\r
   if ((a & 0x7f00) == 0x6000) // Z80 BANK register\r
     return;\r
   }\r
   if ((a & 0x7f00) == 0x6000) // Z80 BANK register\r


@@ -537,28 +771,24 @@ u32 PicoRead8_io(u32 a)
     goto end;\r
   }\r
 \r
     goto end;\r
   }\r
 \r

-  // faking open bus (MegaCD pulldowns don't work here curiously)\r
-  d = Pico.m.rotate++;\r
-  d ^= d << 6;\r
+  d = PicoRead16_floating(a);\r

 \r
   if ((a & 0xfc00) == 0x1000) {\r
 \r
   if ((a & 0xfc00) == 0x1000) {\r

-    // bit8 seems to be readable in this range\r
-    if (!(a & 1))\r
-      d &= ~0x01;\r
-\r

     if ((a & 0xff01) == 0x1100) { // z80 busreq (verified)\r
     if ((a & 0xff01) == 0x1100) { // z80 busreq (verified)\r

-      d |= (Pico.m.z80Run | Pico.m.z80_reset) & 1;\r
-      elprintf(EL_BUSREQ, "get_zrun: %02x [%i] @%06x", d, SekCyclesDone(), SekPc);\r
+      // bit8 seems to be readable in this range\r
+      if (!(a & 1)) {\r
+        d &= ~0x01;\r
+        // Z80 ahead of 68K only if in BUSREQ, BUSACK only after 68K reached Z80\r
+        d |= (z80_cycles_from_68k() < Pico.t.z80c_cnt);\r
+        d |= (Pico.m.z80Run | Pico.m.z80_reset) & 1;\r
+        elprintf(EL_BUSREQ, "get_zrun: %02x [%u] @%06x", d, SekCyclesDone(), SekPc);\r
+      }\r

     }\r
     goto end;\r
   }\r
 \r
     }\r
     goto end;\r
   }\r
 \r

-  if (PicoOpt & POPT_EN_32X) {\r
-    d = PicoRead8_32x(a);\r
-    goto end;\r
-  }\r
+  d = PicoRead8_32x(a);\r

 \r
 \r

-  d = m68k_unmapped_read8(a);\r

 end:\r
   return d;\r
 }\r
 end:\r
   return d;\r
 }\r


@@ -573,27 +803,21 @@ u32 PicoRead16_io(u32 a)
     goto end;\r
   }\r
 \r
     goto end;\r
   }\r
 \r

-  // faking open bus\r
-  d = (Pico.m.rotate += 0x41);\r
-  d ^= (d << 5) ^ (d << 8);\r
+  d = PicoRead16_floating(a);\r

 \r
   // bit8 seems to be readable in this range\r
   if ((a & 0xfc00) == 0x1000) {\r
 \r
   // bit8 seems to be readable in this range\r
   if ((a & 0xfc00) == 0x1000) {\r

-    d &= ~0x0100;\r
-\r

     if ((a & 0xff00) == 0x1100) { // z80 busreq\r
     if ((a & 0xff00) == 0x1100) { // z80 busreq\r

+      d &= ~0x0100;\r
+      d |= (z80_cycles_from_68k() < Pico.t.z80c_cnt) << 8;\r

       d |= ((Pico.m.z80Run | Pico.m.z80_reset) & 1) << 8;\r
       d |= ((Pico.m.z80Run | Pico.m.z80_reset) & 1) << 8;\r

-      elprintf(EL_BUSREQ, "get_zrun: %04x [%i] @%06x", d, SekCyclesDone(), SekPc);\r
+      elprintf(EL_BUSREQ, "get_zrun: %04x [%u] @%06x", d, SekCyclesDone(), SekPc);\r

     }\r
     goto end;\r
   }\r
 \r
     }\r
     goto end;\r
   }\r
 \r

-  if (PicoOpt & POPT_EN_32X) {\r
-    d = PicoRead16_32x(a);\r
-    goto end;\r
-  }\r
+  d = PicoRead16_32x(a);\r

 \r
 \r

-  d = m68k_unmapped_read16(a);\r

 end:\r
   return d;\r
 }\r
 end:\r
   return d;\r
 }\r


@@ -618,12 +842,7 @@ void PicoWrite8_io(u32 a, u32 d)
     Pico.m.sram_reg |= (u8)(d & 3);\r
     return;\r
   }\r
     Pico.m.sram_reg |= (u8)(d & 3);\r
     return;\r
   }\r

-  if (PicoOpt & POPT_EN_32X) {\r
-    PicoWrite8_32x(a, d);\r
-    return;\r
-  }\r
-\r
-  m68k_unmapped_write8(a, d);\r
+  PicoWrite8_32x(a, d);\r

 }\r
 \r
 void PicoWrite16_io(u32 a, u32 d)\r
 }\r
 \r
 void PicoWrite16_io(u32 a, u32 d)\r


@@ -646,24 +865,34 @@ void PicoWrite16_io(u32 a, u32 d)
     Pico.m.sram_reg |= (u8)(d & 3);\r
     return;\r
   }\r
     Pico.m.sram_reg |= (u8)(d & 3);\r
     return;\r
   }\r

-  if (PicoOpt & POPT_EN_32X) {\r
-    PicoWrite16_32x(a, d);\r
-    return;\r
-  }\r
-  m68k_unmapped_write16(a, d);\r
+  PicoWrite16_32x(a, d);\r

 }\r
 \r
 #endif // _ASM_MEMORY_C\r
 \r
 // VDP area (0xc00000 - 0xdfffff)\r
 // TODO: verify if lower byte goes to PSG on word writes\r
 }\r
 \r
 #endif // _ASM_MEMORY_C\r
 \r
 // VDP area (0xc00000 - 0xdfffff)\r
 // TODO: verify if lower byte goes to PSG on word writes\r

-static u32 PicoRead8_vdp(u32 a)\r
+u32 PicoRead8_vdp(u32 a)\r

 {\r
 {\r

-  if ((a & 0x00e0) == 0x0000)\r
-    return PicoVideoRead8(a);\r
-\r
-  elprintf(EL_UIO|EL_ANOMALY, "68k bad read [%06x] @%06x", a, SekPc);\r
-  return 0;\r
+  u32 d;\r
+  if ((a & 0x00f0) == 0x0000) {\r
+    switch (a & 0x0d)\r
+    {\r
+      case 0x00: d = PicoVideoRead8DataH(0); break;\r
+      case 0x01: d = PicoVideoRead8DataL(0); break;\r
+      case 0x04: d = PicoVideoRead8CtlH(0); break;\r
+      case 0x05: d = PicoVideoRead8CtlL(0); break;\r
+      case 0x08:\r
+      case 0x0c: d = PicoVideoRead8HV_H(0); break;\r
+      case 0x09:\r
+      case 0x0d: d = PicoVideoRead8HV_L(0); break;\r
+      default:   d = (u8)PicoRead16_floating(a); break;\r
+    }\r
+  } else {\r
+    elprintf(EL_UIO|EL_ANOMALY, "68k bad read [%06x] @%06x", a, SekPc);\r
+    d = (u8)PicoRead16_floating(a);\r
+  }\r
+  return d;\r

 }\r
 \r
 static u32 PicoRead16_vdp(u32 a)\r
 }\r
 \r
 static u32 PicoRead16_vdp(u32 a)\r


@@ -678,8 +907,7 @@ static u32 PicoRead16_vdp(u32 a)
 static void PicoWrite8_vdp(u32 a, u32 d)\r
 {\r
   if ((a & 0x00f9) == 0x0011) { // PSG Sound\r
 static void PicoWrite8_vdp(u32 a, u32 d)\r
 {\r
   if ((a & 0x00f9) == 0x0011) { // PSG Sound\r

-    if (PicoOpt & POPT_EN_PSG)\r
-      SN76496Write(d);\r
+    psg_write_68k(d);\r

     return;\r
   }\r
   if ((a & 0x00e0) == 0x0000) {\r
     return;\r
   }\r
   if ((a & 0x00e0) == 0x0000) {\r


@@ -694,8 +922,7 @@ static void PicoWrite8_vdp(u32 a, u32 d)
 static void PicoWrite16_vdp(u32 a, u32 d)\r
 {\r
   if ((a & 0x00f9) == 0x0010) { // PSG Sound\r
 static void PicoWrite16_vdp(u32 a, u32 d)\r
 {\r
   if ((a & 0x00f9) == 0x0010) { // PSG Sound\r

-    if (PicoOpt & POPT_EN_PSG)\r
-      SN76496Write(d);\r
+    psg_write_68k(d);\r

     return;\r
   }\r
   if ((a & 0x00e0) == 0x0000) {\r
     return;\r
   }\r
   if ((a & 0x00e0) == 0x0000) {\r


@@ -714,7 +941,7 @@ static void m68k_mem_setup(void);
 \r
 PICO_INTERNAL void PicoMemSetup(void)\r
 {\r
 \r
 PICO_INTERNAL void PicoMemSetup(void)\r
 {\r

-  int mask, rs, a;\r
+  int mask, rs, sstart, a;\r

 \r
   // setup the memory map\r
   cpu68k_map_set(m68k_read8_map,   0x000000, 0xffffff, m68k_unmapped_read8, 1);\r
 \r
   // setup the memory map\r
   cpu68k_map_set(m68k_read8_map,   0x000000, 0xffffff, m68k_unmapped_read8, 1);\r


@@ -726,19 +953,21 @@ PICO_INTERNAL void PicoMemSetup(void)
   // align to bank size. We know ROM loader allocated enough for this\r
   mask = (1 << M68K_MEM_SHIFT) - 1;\r
   rs = (Pico.romsize + mask) & ~mask;\r
   // align to bank size. We know ROM loader allocated enough for this\r
   mask = (1 << M68K_MEM_SHIFT) - 1;\r
   rs = (Pico.romsize + mask) & ~mask;\r

+  if (rs > 0xa00000) rs = 0xa00000; // max cartridge area\r

   cpu68k_map_set(m68k_read8_map,  0x000000, rs - 1, Pico.rom, 0);\r
   cpu68k_map_set(m68k_read16_map, 0x000000, rs - 1, Pico.rom, 0);\r
 \r
   // Common case of on-cart (save) RAM, usually at 0x200000-...\r
   cpu68k_map_set(m68k_read8_map,  0x000000, rs - 1, Pico.rom, 0);\r
   cpu68k_map_set(m68k_read16_map, 0x000000, rs - 1, Pico.rom, 0);\r
 \r
   // Common case of on-cart (save) RAM, usually at 0x200000-...\r

-  if ((SRam.flags & SRF_ENABLED) && SRam.data != NULL) {\r
-    rs = SRam.end - SRam.start;\r
+  if ((Pico.sv.flags & SRF_ENABLED) && Pico.sv.data != NULL) {\r
+    sstart = Pico.sv.start & ~mask;\r
+    rs = Pico.sv.end - sstart;\r

     rs = (rs + mask) & ~mask;\r
     rs = (rs + mask) & ~mask;\r

-    if (SRam.start + rs >= 0x1000000)\r
-      rs = 0x1000000 - SRam.start;\r
-    cpu68k_map_set(m68k_read8_map,   SRam.start, SRam.start + rs - 1, PicoRead8_sram, 1);\r
-    cpu68k_map_set(m68k_read16_map,  SRam.start, SRam.start + rs - 1, PicoRead16_sram, 1);\r
-    cpu68k_map_set(m68k_write8_map,  SRam.start, SRam.start + rs - 1, PicoWrite8_sram, 1);\r
-    cpu68k_map_set(m68k_write16_map, SRam.start, SRam.start + rs - 1, PicoWrite16_sram, 1);\r
+    if (sstart + rs >= 0x1000000)\r
+      rs = 0x1000000 - sstart;\r
+    cpu68k_map_set(m68k_read8_map,   sstart, sstart + rs - 1, PicoRead8_sram, 1);\r
+    cpu68k_map_set(m68k_read16_map,  sstart, sstart + rs - 1, PicoRead16_sram, 1);\r
+    cpu68k_map_set(m68k_write8_map,  sstart, sstart + rs - 1, PicoWrite8_sram, 1);\r
+    cpu68k_map_set(m68k_write16_map, sstart, sstart + rs - 1, PicoWrite16_sram, 1);\r

   }\r
 \r
   // Z80 region\r
   }\r
 \r
   // Z80 region\r


@@ -765,10 +994,10 @@ PICO_INTERNAL void PicoMemSetup(void)
 \r
   // RAM and it's mirrors\r
   for (a = 0xe00000; a < 0x1000000; a += 0x010000) {\r
 \r
   // RAM and it's mirrors\r
   for (a = 0xe00000; a < 0x1000000; a += 0x010000) {\r

-    cpu68k_map_set(m68k_read8_map,   a, a + 0xffff, Pico.ram, 0);\r
-    cpu68k_map_set(m68k_read16_map,  a, a + 0xffff, Pico.ram, 0);\r
-    cpu68k_map_set(m68k_write8_map,  a, a + 0xffff, Pico.ram, 0);\r
-    cpu68k_map_set(m68k_write16_map, a, a + 0xffff, Pico.ram, 0);\r
+    cpu68k_map_set(m68k_read8_map,   a, a + 0xffff, PicoMem.ram, 0);\r
+    cpu68k_map_set(m68k_read16_map,  a, a + 0xffff, PicoMem.ram, 0);\r
+    cpu68k_map_set(m68k_write8_map,  a, a + 0xffff, PicoMem.ram, 0);\r
+    cpu68k_map_set(m68k_write16_map, a, a + 0xffff, PicoMem.ram, 0);\r

   }\r
 \r
   // Setup memory callbacks:\r
   }\r
 \r
   // Setup memory callbacks:\r


@@ -785,26 +1014,12 @@ PICO_INTERNAL void PicoMemSetup(void)
   PicoCpuCM68k.fetch32 = NULL;\r
 #endif\r
 #ifdef EMU_F68K\r
   PicoCpuCM68k.fetch32 = NULL;\r
 #endif\r
 #ifdef EMU_F68K\r

-  PicoCpuFM68k.read_byte  = m68k_read8;\r
-  PicoCpuFM68k.read_word  = m68k_read16;\r
-  PicoCpuFM68k.read_long  = m68k_read32;\r
-  PicoCpuFM68k.write_byte = m68k_write8;\r
-  PicoCpuFM68k.write_word = m68k_write16;\r
-  PicoCpuFM68k.write_long = m68k_write32;\r
-\r
-  // setup FAME fetchmap\r
-  {\r
-    int i;\r
-    // by default, point everything to first 64k of ROM\r
-    for (i = 0; i < M68K_FETCHBANK1; i++)\r
-      PicoCpuFM68k.Fetch[i] = (unsigned long)Pico.rom - (i<<(24-FAMEC_FETCHBITS));\r
-    // now real ROM\r
-    for (i = 0; i < M68K_FETCHBANK1 && (i<<(24-FAMEC_FETCHBITS)) < Pico.romsize; i++)\r
-      PicoCpuFM68k.Fetch[i] = (unsigned long)Pico.rom;\r
-    // .. and RAM\r
-    for (i = M68K_FETCHBANK1*14/16; i < M68K_FETCHBANK1; i++)\r
-      PicoCpuFM68k.Fetch[i] = (unsigned long)Pico.ram - (i<<(24-FAMEC_FETCHBITS));\r
-  }\r
+  PicoCpuFM68k.read_byte  = (void *)m68k_read8;\r
+  PicoCpuFM68k.read_word  = (void *)m68k_read16;\r
+  PicoCpuFM68k.read_long  = (void *)m68k_read32;\r
+  PicoCpuFM68k.write_byte = (void *)m68k_write8;\r
+  PicoCpuFM68k.write_word = (void *)m68k_write16;\r
+  PicoCpuFM68k.write_long = (void *)m68k_write32;\r

 #endif\r
 #ifdef EMU_M68K\r
   m68k_mem_setup();\r
 #endif\r
 #ifdef EMU_M68K\r
   m68k_mem_setup();\r


@@ -846,91 +1061,122 @@ static void m68k_mem_setup(void)
 static int get_scanline(int is_from_z80)\r
 {\r
   if (is_from_z80) {\r
 static int get_scanline(int is_from_z80)\r
 {\r
   if (is_from_z80) {\r

-    int cycles = z80_cyclesDone();\r
-    while (cycles - z80_scanline_cycles >= 228)\r
-      z80_scanline++, z80_scanline_cycles += 228;\r
-    return z80_scanline;\r
+    // ugh... compute by dividing cycles since frame start by cycles per line\r
+    // need some fractional resolution here, else there may be an extra line\r
+    int cycles_line = cycles_68k_to_z80((unsigned)(488.5*256))+1; // cycles per line, Q8\r
+    int cycles_z80 = (z80_cyclesLeft<0 ? Pico.t.z80c_aim:z80_cyclesDone())<<8;\r
+    int cycles = cycles_line * Pico.t.z80_scanline;\r
+    // approximation by multiplying with inverse\r
+    if (cycles_z80 - cycles >= 4*cycles_line) {\r
+      // compute 1/cycles_line, storing the result to avoid future dividing\r
+      static int cycles_line_o, cycles_line_i;\r
+      if (cycles_line_o != cycles_line)\r
+        { cycles_line_o = cycles_line, cycles_line_i = (1<<22) / cycles_line; }\r
+      // compute lines = diff/cycles_line = diff*(1/cycles_line)\r
+      int lines = ((cycles_z80 - cycles) * cycles_line_i) >> 22;\r
+      Pico.t.z80_scanline += lines, cycles += cycles_line * lines;\r
+    }\r
+    // handle any rounding leftover\r
+    while (cycles_z80 - cycles >= cycles_line)\r
+      Pico.t.z80_scanline ++, cycles += cycles_line;\r
+    return Pico.t.z80_scanline;\r

   }\r
 \r
   return Pico.m.scanline;\r
 }\r
 \r
   }\r
 \r
   return Pico.m.scanline;\r
 }\r
 \r

+#define ym2612_update_status(xcycles) \\r
+  ym2612.OPN.ST.status &= ~0x80; \\r
+  ym2612.OPN.ST.status |= (xcycles < Pico.t.ym2612_busy) * 0x80; \\r
+  if (xcycles >= Pico.t.timer_a_next_oflow) \\r
+    ym2612.OPN.ST.status |= (ym2612.OPN.ST.mode >> 2) & 1; \\r
+  if (xcycles >= Pico.t.timer_b_next_oflow) \\r
+    ym2612.OPN.ST.status |= (ym2612.OPN.ST.mode >> 2) & 2\r
+\r

 /* probably should not be in this file, but it's near related code here */\r
 void ym2612_sync_timers(int z80_cycles, int mode_old, int mode_new)\r
 {\r
   int xcycles = z80_cycles << 8;\r
 \r
 /* probably should not be in this file, but it's near related code here */\r
 void ym2612_sync_timers(int z80_cycles, int mode_old, int mode_new)\r
 {\r
   int xcycles = z80_cycles << 8;\r
 \r

-  /* check for overflows */\r
-  if ((mode_old & 4) && xcycles > timer_a_next_oflow)\r
-    ym2612.OPN.ST.status |= 1;\r
+  // update timer status\r
+  ym2612_update_status(xcycles);\r

 \r
 \r

-  if ((mode_old & 8) && xcycles > timer_b_next_oflow)\r
-    ym2612.OPN.ST.status |= 2;\r
-\r
-  /* update timer a */\r
+  // update timer a\r

   if (mode_old & 1)\r
   if (mode_old & 1)\r

-    while (xcycles > timer_a_next_oflow)\r
-      timer_a_next_oflow += timer_a_step;\r
+    while (xcycles >= Pico.t.timer_a_next_oflow)\r
+      Pico.t.timer_a_next_oflow += Pico.t.timer_a_step;\r

 \r
 \r

-  if ((mode_old ^ mode_new) & 1) // turning on/off\r
+  // turning on/off\r
+  if ((mode_old ^ mode_new) & 1)\r

   {\r
     if (mode_old & 1)\r
   {\r
     if (mode_old & 1)\r

-      timer_a_next_oflow = TIMER_NO_OFLOW;\r
-    else\r
-      timer_a_next_oflow = xcycles + timer_a_step;\r
+      Pico.t.timer_a_next_oflow = TIMER_NO_OFLOW;\r
+    else {\r
+      /* The internal tick of the YM2612 takes 144 clock cycles (with clock\r
+       * being OSC/7), or 67.2 z80 cycles. Timers are run once each tick.\r
+       * Starting a timer takes place at the next tick, so xcycles needs to be\r
+       * rounded up to that: t = next tick# = (xcycles / TICK_ZCYCLES) + 1\r
+       */\r
+      unsigned t = ((xcycles * (((1LL<<32)/TIMER_A_TICK_ZCYCLES)+1))>>32) + 1;\r
+      Pico.t.timer_a_next_oflow = t*TIMER_A_TICK_ZCYCLES + Pico.t.timer_a_step;\r
+    }\r

   }\r
   }\r

+\r

   if (mode_new & 1)\r
   if (mode_new & 1)\r

-    elprintf(EL_YMTIMER, "timer a upd to %i @ %i", timer_a_next_oflow>>8, z80_cycles);\r
+    elprintf(EL_YMTIMER, "timer a upd to %i @ %i", Pico.t.timer_a_next_oflow>>8, z80_cycles);\r

 \r
 \r

-  /* update timer b */\r
+  // update timer b\r

   if (mode_old & 2)\r
   if (mode_old & 2)\r

-    while (xcycles > timer_b_next_oflow)\r
-      timer_b_next_oflow += timer_b_step;\r
+    while (xcycles >= Pico.t.timer_b_next_oflow)\r
+      Pico.t.timer_b_next_oflow += Pico.t.timer_b_step;\r

 \r
 \r

+  // turning on/off\r

   if ((mode_old ^ mode_new) & 2)\r
   {\r
     if (mode_old & 2)\r
   if ((mode_old ^ mode_new) & 2)\r
   {\r
     if (mode_old & 2)\r

-      timer_b_next_oflow = TIMER_NO_OFLOW;\r
-    else\r
-      timer_b_next_oflow = xcycles + timer_b_step;\r
+      Pico.t.timer_b_next_oflow = TIMER_NO_OFLOW;\r
+    else {\r
+      /* timer b has a divider of 16 which runs in its own counter. It is not\r
+       * reset by loading timer b. The first run of timer b after loading is\r
+       * therefore shorter by up to 15 ticks.\r
+       */\r
+      unsigned t = ((xcycles * (((1LL<<32)/TIMER_A_TICK_ZCYCLES)+1))>>32) + 1;\r
+      int step = Pico.t.timer_b_step - TIMER_A_TICK_ZCYCLES*(t&15);\r
+      Pico.t.timer_b_next_oflow = t*TIMER_A_TICK_ZCYCLES + step;\r
+    }\r

   }\r
   }\r

+\r

   if (mode_new & 2)\r
   if (mode_new & 2)\r

-    elprintf(EL_YMTIMER, "timer b upd to %i @ %i", timer_b_next_oflow>>8, z80_cycles);\r
+    elprintf(EL_YMTIMER, "timer b upd to %i @ %i", Pico.t.timer_b_next_oflow>>8, z80_cycles);\r

 }\r
 \r
 // ym2612 DAC and timer I/O handlers for z80\r
 static int ym2612_write_local(u32 a, u32 d, int is_from_z80)\r
 {\r
 }\r
 \r
 // ym2612 DAC and timer I/O handlers for z80\r
 static int ym2612_write_local(u32 a, u32 d, int is_from_z80)\r
 {\r

+  int cycles = is_from_z80 ? z80_cyclesDone() : z80_cycles_from_68k();\r

   int addr;\r
 \r
   a &= 3;\r
   int addr;\r
 \r
   a &= 3;\r

-  if (a == 1 && ym2612.OPN.ST.address == 0x2a) /* DAC data */\r
-  {\r
-    int scanline = get_scanline(is_from_z80);\r
-    //elprintf(EL_STATUS, "%03i -> %03i dac w %08x z80 %i", PsndDacLine, scanline, d, is_from_z80);\r
-    ym2612.dacout = ((int)d - 0x80) << 6;\r
-    if (PsndOut && ym2612.dacen && scanline >= PsndDacLine)\r
-      PsndDoDAC(scanline);\r
-    return 0;\r
-  }\r
-\r

   switch (a)\r
   {\r
     case 0: /* address port 0 */\r
   switch (a)\r
   {\r
     case 0: /* address port 0 */\r

+    case 2: /* address port 1 */\r

       ym2612.OPN.ST.address = d;\r
       ym2612.OPN.ST.address = d;\r

-      ym2612.addr_A1 = 0;\r
+      ym2612.addr_A1 = (a & 2) >> 1;\r

 #ifdef __GP2X__\r
 #ifdef __GP2X__\r

-      if (PicoOpt & POPT_EXT_FM) YM2612Write_940(a, d, -1);\r
+      if (PicoIn.opt & POPT_EXT_FM) YM2612Write_940(a, d, -1);\r

 #endif\r
       return 0;\r
 \r
     case 1: /* data port 0    */\r
 #endif\r
       return 0;\r
 \r
     case 1: /* data port 0    */\r

-      if (ym2612.addr_A1 != 0)\r
-        return 0;\r
-\r
-      addr = ym2612.OPN.ST.address;\r
+    case 3: /* data port 1    */\r
+      addr = ym2612.OPN.ST.address | ((int)ym2612.addr_A1 << 8);\r

       ym2612.REGS[addr] = d;\r
 \r
       ym2612.REGS[addr] = d;\r
 \r

+      // the busy flag in the YM2612 status is actually a 32 cycle timer\r
+      // (89.6 Z80 cycles), triggered by any write to the data port.\r
+      Pico.t.ym2612_busy = (cycles << 8) + YMBUSY_ZCYCLES; // Q8 for convenience\r
+\r

       switch (addr)\r
       {\r
         case 0x24: // timer A High 8\r
       switch (addr)\r
       {\r
         case 0x24: // timer A High 8\r


@@ -939,42 +1185,35 @@ static int ym2612_write_local(u32 a, u32 d, int is_from_z80)
                                      : ((ym2612.OPN.ST.TA & 0x3fc)|(d&3));\r
           if (ym2612.OPN.ST.TA != TAnew)\r
           {\r
                                      : ((ym2612.OPN.ST.TA & 0x3fc)|(d&3));\r
           if (ym2612.OPN.ST.TA != TAnew)\r
           {\r

+            ym2612_sync_timers(cycles, ym2612.OPN.ST.mode, ym2612.OPN.ST.mode);\r

             //elprintf(EL_STATUS, "timer a set %i", TAnew);\r
             ym2612.OPN.ST.TA = TAnew;\r
             //ym2612.OPN.ST.TAC = (1024-TAnew)*18;\r
             //ym2612.OPN.ST.TAT = 0;\r
             //elprintf(EL_STATUS, "timer a set %i", TAnew);\r
             ym2612.OPN.ST.TA = TAnew;\r
             //ym2612.OPN.ST.TAC = (1024-TAnew)*18;\r
             //ym2612.OPN.ST.TAT = 0;\r

-            timer_a_step = TIMER_A_TICK_ZCYCLES * (1024 - TAnew);\r
-            if (ym2612.OPN.ST.mode & 1) {\r
-              // this is not right, should really be done on overflow only\r
-              int cycles = is_from_z80 ? z80_cyclesDone() : z80_cycles_from_68k();\r
-              timer_a_next_oflow = (cycles << 8) + timer_a_step;\r
-            }\r
-            elprintf(EL_YMTIMER, "timer a set to %i, %i", 1024 - TAnew, timer_a_next_oflow>>8);\r
+            Pico.t.timer_a_step = TIMER_A_TICK_ZCYCLES * (1024 - TAnew);\r
+            elprintf(EL_YMTIMER, "timer a set to %i, %i", 1024 - TAnew, Pico.t.timer_a_next_oflow>>8);\r

           }\r
           return 0;\r
         }\r
         case 0x26: // timer B\r
           if (ym2612.OPN.ST.TB != d) {\r
           }\r
           return 0;\r
         }\r
         case 0x26: // timer B\r
           if (ym2612.OPN.ST.TB != d) {\r

+            ym2612_sync_timers(cycles, ym2612.OPN.ST.mode, ym2612.OPN.ST.mode);\r

             //elprintf(EL_STATUS, "timer b set %i", d);\r
             ym2612.OPN.ST.TB = d;\r
             //ym2612.OPN.ST.TBC = (256-d) * 288;\r
             //ym2612.OPN.ST.TBT  = 0;\r
             //elprintf(EL_STATUS, "timer b set %i", d);\r
             ym2612.OPN.ST.TB = d;\r
             //ym2612.OPN.ST.TBC = (256-d) * 288;\r
             //ym2612.OPN.ST.TBT  = 0;\r

-            timer_b_step = TIMER_B_TICK_ZCYCLES * (256 - d); // 262800\r
-            if (ym2612.OPN.ST.mode & 2) {\r
-              int cycles = is_from_z80 ? z80_cyclesDone() : z80_cycles_from_68k();\r
-              timer_b_next_oflow = (cycles << 8) + timer_b_step;\r
-            }\r
-            elprintf(EL_YMTIMER, "timer b set to %i, %i", 256 - d, timer_b_next_oflow>>8);\r
+            Pico.t.timer_b_step = TIMER_B_TICK_ZCYCLES * (256 - d);\r
+            elprintf(EL_YMTIMER, "timer b set to %i, %i", 256 - d, Pico.t.timer_b_next_oflow>>8);\r

           }\r
           return 0;\r
         case 0x27: { /* mode, timer control */\r
           int old_mode = ym2612.OPN.ST.mode;\r
           }\r
           return 0;\r
         case 0x27: { /* mode, timer control */\r
           int old_mode = ym2612.OPN.ST.mode;\r

-          int cycles = is_from_z80 ? z80_cyclesDone() : z80_cycles_from_68k();\r
-          ym2612.OPN.ST.mode = d;\r

 \r
           elprintf(EL_YMTIMER, "st mode %02x", d);\r
           ym2612_sync_timers(cycles, old_mode, d);\r
 \r
 \r
           elprintf(EL_YMTIMER, "st mode %02x", d);\r
           ym2612_sync_timers(cycles, old_mode, d);\r
 \r

+          ym2612.OPN.ST.mode = d;\r
+\r

           /* reset Timer a flag */\r
           if (d & 0x10)\r
             ym2612.OPN.ST.status &= ~1;\r
           /* reset Timer a flag */\r
           if (d & 0x10)\r
             ym2612.OPN.ST.status &= ~1;\r


@@ -985,63 +1224,49 @@ static int ym2612_write_local(u32 a, u32 d, int is_from_z80)
 \r
           if ((d ^ old_mode) & 0xc0) {\r
 #ifdef __GP2X__\r
 \r
           if ((d ^ old_mode) & 0xc0) {\r
 #ifdef __GP2X__\r

-            if (PicoOpt & POPT_EXT_FM) return YM2612Write_940(a, d, get_scanline(is_from_z80));\r
+            if (PicoIn.opt & POPT_EXT_FM) return YM2612Write_940(a, d, get_scanline(is_from_z80));\r

 #endif\r
 #endif\r

+            PsndDoFM(cycles);\r

             return 1;\r
           }\r
           return 0;\r
         }\r
             return 1;\r
           }\r
           return 0;\r
         }\r

+        case 0x2a: { /* DAC data */\r
+          //elprintf(EL_STATUS, "%03i dac w %08x z80 %i", cycles, d, is_from_z80);\r
+          if (ym2612.dacen)\r
+            PsndDoDAC(cycles);\r
+          ym2612.dacout = ((int)d - 0x80) << 6;\r
+          return 0;\r
+        }\r

         case 0x2b: { /* DAC Sel  (YM2612) */\r
         case 0x2b: { /* DAC Sel  (YM2612) */\r

-          int scanline = get_scanline(is_from_z80);\r

           ym2612.dacen = d & 0x80;\r
           ym2612.dacen = d & 0x80;\r

-          if (d & 0x80) PsndDacLine = scanline;\r

 #ifdef __GP2X__\r
 #ifdef __GP2X__\r

-          if (PicoOpt & POPT_EXT_FM) YM2612Write_940(a, d, scanline);\r
+          if (PicoIn.opt & POPT_EXT_FM) YM2612Write_940(a, d, get_scanline(is_from_z80));\r

 #endif\r
           return 0;\r
         }\r
       }\r
       break;\r
 #endif\r
           return 0;\r
         }\r
       }\r
       break;\r

-\r
-    case 2: /* address port 1 */\r
-      ym2612.OPN.ST.address = d;\r
-      ym2612.addr_A1 = 1;\r
-#ifdef __GP2X__\r
-      if (PicoOpt & POPT_EXT_FM) YM2612Write_940(a, d, -1);\r
-#endif\r
-      return 0;\r
-\r
-    case 3: /* data port 1    */\r
-      if (ym2612.addr_A1 != 1)\r
-        return 0;\r
-\r
-      addr = ym2612.OPN.ST.address | 0x100;\r
-      ym2612.REGS[addr] = d;\r
-      break;\r

   }\r
 \r
 #ifdef __GP2X__\r
   }\r
 \r
 #ifdef __GP2X__\r

-  if (PicoOpt & POPT_EXT_FM)\r
+  if (PicoIn.opt & POPT_EXT_FM)\r

     return YM2612Write_940(a, d, get_scanline(is_from_z80));\r
 #endif\r
     return YM2612Write_940(a, d, get_scanline(is_from_z80));\r
 #endif\r

+  PsndDoFM(cycles);\r

   return YM2612Write_(a, d);\r
 }\r
 \r
 \r
   return YM2612Write_(a, d);\r
 }\r
 \r
 \r

-#define ym2612_read_local() \\r
-  if (xcycles >= timer_a_next_oflow) \\r
-    ym2612.OPN.ST.status |= (ym2612.OPN.ST.mode >> 2) & 1; \\r
-  if (xcycles >= timer_b_next_oflow) \\r
-    ym2612.OPN.ST.status |= (ym2612.OPN.ST.mode >> 2) & 2\r
-\r

 static u32 ym2612_read_local_z80(void)\r
 {\r
   int xcycles = z80_cyclesDone() << 8;\r
 \r
 static u32 ym2612_read_local_z80(void)\r
 {\r
   int xcycles = z80_cyclesDone() << 8;\r
 \r

-  ym2612_read_local();\r
+  ym2612_update_status(xcycles);\r

 \r
 \r

-  elprintf(EL_YMTIMER, "timer z80 read %i, sched %i, %i @ %i|%i", ym2612.OPN.ST.status,\r
-      timer_a_next_oflow>>8, timer_b_next_oflow>>8, xcycles >> 8, (xcycles >> 8) / 228);\r
+  elprintf(EL_YMTIMER, "timer z80 read %i, sched %i, %i @ %i|%i",\r
+    ym2612.OPN.ST.status, Pico.t.timer_a_next_oflow >> 8,\r
+    Pico.t.timer_b_next_oflow >> 8, xcycles >> 8, (xcycles >> 8) / 228);\r

   return ym2612.OPN.ST.status;\r
 }\r
 \r
   return ym2612.OPN.ST.status;\r
 }\r
 \r


@@ -1049,37 +1274,42 @@ static u32 ym2612_read_local_68k(void)
 {\r
   int xcycles = z80_cycles_from_68k() << 8;\r
 \r
 {\r
   int xcycles = z80_cycles_from_68k() << 8;\r
 \r

-  ym2612_read_local();\r
+  ym2612_update_status(xcycles);\r

 \r
 \r

-  elprintf(EL_YMTIMER, "timer 68k read %i, sched %i, %i @ %i|%i", ym2612.OPN.ST.status,\r
-      timer_a_next_oflow>>8, timer_b_next_oflow>>8, xcycles >> 8, (xcycles >> 8) / 228);\r
+  elprintf(EL_YMTIMER, "timer 68k read %i, sched %i, %i @ %i|%i",\r
+    ym2612.OPN.ST.status, Pico.t.timer_a_next_oflow >> 8,\r
+    Pico.t.timer_b_next_oflow >> 8, xcycles >> 8, (xcycles >> 8) / 228);\r

   return ym2612.OPN.ST.status;\r
 }\r
 \r
 void ym2612_pack_state(void)\r
 {\r
   // timers are saved as tick counts, in 16.16 int format\r
   return ym2612.OPN.ST.status;\r
 }\r
 \r
 void ym2612_pack_state(void)\r
 {\r
   // timers are saved as tick counts, in 16.16 int format\r

-  int tac, tat = 0, tbc, tbt = 0;\r
+  int tac, tat = 0, tbc, tbt = 0, busy = 0;\r

   tac = 1024 - ym2612.OPN.ST.TA;\r
   tbc = 256  - ym2612.OPN.ST.TB;\r
   tac = 1024 - ym2612.OPN.ST.TA;\r
   tbc = 256  - ym2612.OPN.ST.TB;\r

-  if (timer_a_next_oflow != TIMER_NO_OFLOW)\r
-    tat = (int)((double)(timer_a_step - timer_a_next_oflow) / (double)timer_a_step * tac * 65536);\r
-  if (timer_b_next_oflow != TIMER_NO_OFLOW)\r
-    tbt = (int)((double)(timer_b_step - timer_b_next_oflow) / (double)timer_b_step * tbc * 65536);\r
+  if (Pico.t.ym2612_busy > 0)\r
+    busy = cycles_z80_to_68k(Pico.t.ym2612_busy);\r
+  if (Pico.t.timer_a_next_oflow != TIMER_NO_OFLOW)\r
+    tat = (int)((double)(Pico.t.timer_a_step - Pico.t.timer_a_next_oflow)\r
+          / (double)Pico.t.timer_a_step * tac * 65536);\r
+  if (Pico.t.timer_b_next_oflow != TIMER_NO_OFLOW)\r
+    tbt = (int)((double)(Pico.t.timer_b_step - Pico.t.timer_b_next_oflow)\r
+          / (double)Pico.t.timer_b_step * tbc * 65536);\r

   elprintf(EL_YMTIMER, "save: timer a %i/%i", tat >> 16, tac);\r
   elprintf(EL_YMTIMER, "save: timer b %i/%i", tbt >> 16, tbc);\r
 \r
 #ifdef __GP2X__\r
   elprintf(EL_YMTIMER, "save: timer a %i/%i", tat >> 16, tac);\r
   elprintf(EL_YMTIMER, "save: timer b %i/%i", tbt >> 16, tbc);\r
 \r
 #ifdef __GP2X__\r

-  if (PicoOpt & POPT_EXT_FM)\r
+  if (PicoIn.opt & POPT_EXT_FM)\r

     YM2612PicoStateSave2_940(tat, tbt);\r
   else\r
 #endif\r
     YM2612PicoStateSave2_940(tat, tbt);\r
   else\r
 #endif\r

-    YM2612PicoStateSave2(tat, tbt);\r
+    YM2612PicoStateSave2(tat, tbt, busy);\r

 }\r
 \r
 void ym2612_unpack_state(void)\r
 {\r
 }\r
 \r
 void ym2612_unpack_state(void)\r
 {\r

-  int i, ret, tac, tat, tbc, tbt;\r
+  int i, ret, tac, tat, tbc, tbt, busy = 0;\r

   YM2612PicoStateLoad();\r
 \r
   // feed all the registers and update internal state\r
   YM2612PicoStateLoad();\r
 \r
   // feed all the registers and update internal state\r


@@ -1105,28 +1335,29 @@ void ym2612_unpack_state(void)
   }\r
 \r
 #ifdef __GP2X__\r
   }\r
 \r
 #ifdef __GP2X__\r

-  if (PicoOpt & POPT_EXT_FM)\r
+  if (PicoIn.opt & POPT_EXT_FM)\r

     ret = YM2612PicoStateLoad2_940(&tat, &tbt);\r
   else\r
 #endif\r
     ret = YM2612PicoStateLoad2_940(&tat, &tbt);\r
   else\r
 #endif\r

-    ret = YM2612PicoStateLoad2(&tat, &tbt);\r
+    ret = YM2612PicoStateLoad2(&tat, &tbt, &busy);\r

   if (ret != 0) {\r
     elprintf(EL_STATUS, "old ym2612 state");\r
     return; // no saved timers\r
   }\r
 \r
   if (ret != 0) {\r
     elprintf(EL_STATUS, "old ym2612 state");\r
     return; // no saved timers\r
   }\r
 \r

+  Pico.t.ym2612_busy = cycles_68k_to_z80(busy);\r

   tac = (1024 - ym2612.OPN.ST.TA) << 16;\r
   tbc = (256  - ym2612.OPN.ST.TB) << 16;\r
   if (ym2612.OPN.ST.mode & 1)\r
   tac = (1024 - ym2612.OPN.ST.TA) << 16;\r
   tbc = (256  - ym2612.OPN.ST.TB) << 16;\r
   if (ym2612.OPN.ST.mode & 1)\r

-    timer_a_next_oflow = (int)((double)(tac - tat) / (double)tac * timer_a_step);\r
+    Pico.t.timer_a_next_oflow = (int)((double)(tac - tat) / (double)tac * Pico.t.timer_a_step);\r

   else\r
   else\r

-    timer_a_next_oflow = TIMER_NO_OFLOW;\r
+    Pico.t.timer_a_next_oflow = TIMER_NO_OFLOW;\r

   if (ym2612.OPN.ST.mode & 2)\r
   if (ym2612.OPN.ST.mode & 2)\r

-    timer_b_next_oflow = (int)((double)(tbc - tbt) / (double)tbc * timer_b_step);\r
+    Pico.t.timer_b_next_oflow = (int)((double)(tbc - tbt) / (double)tbc * Pico.t.timer_b_step);\r

   else\r
   else\r

-    timer_b_next_oflow = TIMER_NO_OFLOW;\r
-  elprintf(EL_YMTIMER, "load: %i/%i, timer_a_next_oflow %i", tat>>16, tac>>16, timer_a_next_oflow >> 8);\r
-  elprintf(EL_YMTIMER, "load: %i/%i, timer_b_next_oflow %i", tbt>>16, tbc>>16, timer_b_next_oflow >> 8);\r
+    Pico.t.timer_b_next_oflow = TIMER_NO_OFLOW;\r
+  elprintf(EL_YMTIMER, "load: %i/%i, timer_a_next_oflow %i", tat>>16, tac>>16, Pico.t.timer_a_next_oflow >> 8);\r
+  elprintf(EL_YMTIMER, "load: %i/%i, timer_b_next_oflow %i", tbt>>16, tbc>>16, Pico.t.timer_b_next_oflow >> 8);\r

 }\r
 \r
 #if defined(NO_32X) && defined(_ASM_MEMORY_C)\r
 }\r
 \r
 #if defined(NO_32X) && defined(_ASM_MEMORY_C)\r


@@ -1140,9 +1371,39 @@ void PicoWrite16_32x(u32 a, u32 d) {}
 // -----------------------------------------------------------------\r
 //                        z80 memhandlers\r
 \r
 // -----------------------------------------------------------------\r
 //                        z80 memhandlers\r
 \r

+static void access_68k_bus(int delay) // bus delay as Q8\r
+{\r
+  // TODO: if the 68K is in DMA wait, Z80 has to wait until DMA ends\r
+\r
+  // 68k bus access delay for z80. The fractional part needs to be accumulated\r
+  // until an additional cycle is full. That is then added to the integer part.\r
+  Pico.t.z80_busdelay += (delay&0xff); // accumulate\r
+  z80_subCLeft((delay>>8) + (Pico.t.z80_busdelay>>8));\r
+  Pico.t.z80_busdelay &= 0xff; // leftover cycle fraction\r
+  // don't use SekCyclesBurn() here since the Z80 doesn't run in cycle lock to\r
+  // the 68K. Count the stolen cycles to be accounted later in the 68k CPU runs\r
+  Pico.t.z80_buscycles += 8; // TODO <=8.4 for Rick 2, but >=8.9 for misc_test\r
+}\r
+\r

 static unsigned char z80_md_vdp_read(unsigned short a)\r
 {\r
 static unsigned char z80_md_vdp_read(unsigned short a)\r
 {\r

-  // TODO?\r
+  if ((a & 0xff00) == 0x7f00) {\r
+    // 68k bus access delay=3.3 per kabuto, for notaz picotest 2.42<delay<2.57?\r
+    access_68k_bus(0x280); // Q8, picotest: 0x26d(>2.42) - 0x292(<2.57)\r
+\r
+    switch (a & 0x0d)\r
+    {\r
+      case 0x00: return PicoVideoRead8DataH(1);\r
+      case 0x01: return PicoVideoRead8DataL(1);\r
+      case 0x04: return PicoVideoRead8CtlH(1);\r
+      case 0x05: return PicoVideoRead8CtlL(1);\r
+      case 0x08:\r
+      case 0x0c: return PicoVideoGetV(get_scanline(1), 1);\r
+      case 0x09:\r
+      case 0x0d: return Pico.m.rotate++;\r
+    }\r
+  }\r
+\r

   elprintf(EL_ANOMALY, "z80 invalid r8 [%06x] %02x", a, 0xff);\r
   return 0xff;\r
 }\r
   elprintf(EL_ANOMALY, "z80 invalid r8 [%06x] %02x", a, 0xff);\r
   return 0xff;\r
 }\r


@@ -1150,12 +1411,16 @@ static unsigned char z80_md_vdp_read(unsigned short a)
 static unsigned char z80_md_bank_read(unsigned short a)\r
 {\r
   unsigned int addr68k;\r
 static unsigned char z80_md_bank_read(unsigned short a)\r
 {\r
   unsigned int addr68k;\r

-  unsigned char ret;\r
+  unsigned char ret = 0xff;\r

 \r
 \r

-  addr68k = Pico.m.z80_bank68k<<15;\r
-  addr68k += a & 0x7fff;\r
+  // 68k bus access delay=3.3 per kabuto, but for notaz picotest 3.02<delay<3.32\r
+  access_68k_bus(0x340); // Q8, picotest: 0x306(>3.02)-0x351(<3.32)\r

 \r
 \r

-  ret = m68k_read8(addr68k);\r
+  addr68k = Pico.m.z80_bank68k << 15;\r
+  addr68k |= a & 0x7fff;\r
+\r
+  if (addr68k < 0xe00000) // can't read from 68K RAM\r
+    ret = m68k_read8(addr68k);\r

 \r
   elprintf(EL_Z80BNK, "z80->68k r8 [%06x] %02x", addr68k, ret);\r
   return ret;\r
 \r
   elprintf(EL_Z80BNK, "z80->68k r8 [%06x] %02x", addr68k, ret);\r
   return ret;\r


@@ -1163,19 +1428,18 @@ static unsigned char z80_md_bank_read(unsigned short a)
 \r
 static void z80_md_ym2612_write(unsigned int a, unsigned char data)\r
 {\r
 \r
 static void z80_md_ym2612_write(unsigned int a, unsigned char data)\r
 {\r

-  if (PicoOpt & POPT_EN_FM)\r
-    emustatus |= ym2612_write_local(a, data, 1) & 1;\r
+  if (PicoIn.opt & POPT_EN_FM)\r
+    ym2612_write_local(a, data, 1);\r

 }\r
 \r
 static void z80_md_vdp_br_write(unsigned int a, unsigned char data)\r
 {\r
 }\r
 \r
 static void z80_md_vdp_br_write(unsigned int a, unsigned char data)\r
 {\r

-  // TODO: allow full VDP access\r

   if ((a&0xfff9) == 0x7f11) // 7f11 7f13 7f15 7f17\r
   {\r
   if ((a&0xfff9) == 0x7f11) // 7f11 7f13 7f15 7f17\r
   {\r

-    if (PicoOpt & POPT_EN_PSG)\r
-      SN76496Write(data);\r
+    psg_write_z80(data);\r

     return;\r
   }\r
     return;\r
   }\r

+  // at least VDP data writes hang my machine\r

 \r
   if ((a>>8) == 0x60)\r
   {\r
 \r
   if ((a>>8) == 0x60)\r
   {\r


@@ -1192,6 +1456,9 @@ static void z80_md_bank_write(unsigned int a, unsigned char data)
 {\r
   unsigned int addr68k;\r
 \r
 {\r
   unsigned int addr68k;\r
 \r

+  // 68k bus access delay=3.3 per kabuto, but for notaz picotest 3.02<delay<3.32\r
+  access_68k_bus(0x340); // Q8, picotest: 0x306(>3.02)-0x351(<3.32)\r
+\r

   addr68k = Pico.m.z80_bank68k << 15;\r
   addr68k += a & 0x7fff;\r
 \r
   addr68k = Pico.m.z80_bank68k << 15;\r
   addr68k += a & 0x7fff;\r
 \r


@@ -1214,14 +1481,14 @@ static void z80_md_out(unsigned short p, unsigned char d)
 \r
 static void z80_mem_setup(void)\r
 {\r
 \r
 static void z80_mem_setup(void)\r
 {\r

-  z80_map_set(z80_read_map, 0x0000, 0x1fff, Pico.zram, 0);\r
-  z80_map_set(z80_read_map, 0x2000, 0x3fff, Pico.zram, 0);\r
+  z80_map_set(z80_read_map, 0x0000, 0x1fff, PicoMem.zram, 0);\r
+  z80_map_set(z80_read_map, 0x2000, 0x3fff, PicoMem.zram, 0);\r

   z80_map_set(z80_read_map, 0x4000, 0x5fff, ym2612_read_local_z80, 1);\r
   z80_map_set(z80_read_map, 0x6000, 0x7fff, z80_md_vdp_read, 1);\r
   z80_map_set(z80_read_map, 0x8000, 0xffff, z80_md_bank_read, 1);\r
 \r
   z80_map_set(z80_read_map, 0x4000, 0x5fff, ym2612_read_local_z80, 1);\r
   z80_map_set(z80_read_map, 0x6000, 0x7fff, z80_md_vdp_read, 1);\r
   z80_map_set(z80_read_map, 0x8000, 0xffff, z80_md_bank_read, 1);\r
 \r

-  z80_map_set(z80_write_map, 0x0000, 0x1fff, Pico.zram, 0);\r
-  z80_map_set(z80_write_map, 0x2000, 0x3fff, Pico.zram, 0);\r
+  z80_map_set(z80_write_map, 0x0000, 0x1fff, PicoMem.zram, 0);\r
+  z80_map_set(z80_write_map, 0x2000, 0x3fff, PicoMem.zram, 0);\r

   z80_map_set(z80_write_map, 0x4000, 0x5fff, z80_md_ym2612_write, 1);\r
   z80_map_set(z80_write_map, 0x6000, 0x7fff, z80_md_vdp_br_write, 1);\r
   z80_map_set(z80_write_map, 0x8000, 0xffff, z80_md_bank_write, 1);\r
   z80_map_set(z80_write_map, 0x4000, 0x5fff, z80_md_ym2612_write, 1);\r
   z80_map_set(z80_write_map, 0x6000, 0x7fff, z80_md_vdp_br_write, 1);\r
   z80_map_set(z80_write_map, 0x8000, 0xffff, z80_md_bank_write, 1);\r


@@ -1231,8 +1498,6 @@ static void z80_mem_setup(void)
   drZ80.z80_out = z80_md_out;\r
 #endif\r
 #ifdef _USE_CZ80\r
   drZ80.z80_out = z80_md_out;\r
 #endif\r
 #ifdef _USE_CZ80\r

-  Cz80_Set_Fetch(&CZ80, 0x0000, 0x1fff, (FPTR)Pico.zram); // main RAM\r
-  Cz80_Set_Fetch(&CZ80, 0x2000, 0x3fff, (FPTR)Pico.zram); // mirror\r

   Cz80_Set_INPort(&CZ80, z80_md_in);\r
   Cz80_Set_OUTPort(&CZ80, z80_md_out);\r
 #endif\r
   Cz80_Set_INPort(&CZ80, z80_md_in);\r
   Cz80_Set_OUTPort(&CZ80, z80_md_out);\r
 #endif\r