X-Git-Url: https://notaz.gp2x.de/cgi-bin/gitweb.cgi?a=blobdiff_plain;ds=sidebyside;f=cpu%2Fsh2%2Fcompiler.c;h=df2f0d390a1bb16f3167f5eab3c65a2889ba66b8;hb=e15536775962fef2058ffa43cbb290271f649c17;hp=5a9bbed58fe8fc14256ba2889f51fc5eab86d246;hpb=2368651527f2b14e24b7df5f7db3d95dc5bfbd3a;p=picodrive.git

diff --git a/cpu/sh2/compiler.c b/cpu/sh2/compiler.c
index 5a9bbed..df2f0d3 100644
--- a/cpu/sh2/compiler.c
+++ b/cpu/sh2/compiler.c
@@ -1,11 +1,17 @@
 /*
- * vim:shiftwidth=2:expandtab
+ * SH2 recompiler
+ * (C) notaz, 2009,2010
+ *
+ * This work is licensed under the terms of MAME license.
+ * See COPYING file in the top-level directory.
  *
  * notes:
  * - tcache, block descriptor, link buffer overflows result in sh2_translate()
  *   failure, followed by full tcache invalidation for that region
  * - jumps between blocks are tracked for SMC handling (in block_links[]),
  *   except jumps between different tcaches
+ * - non-main block entries are called subblocks, as they have same tracking
+ *   structures that main blocks have.
  *
  * implemented:
  * - static register allocation
@@ -15,7 +21,6 @@
  * - some constant propagation
  *
  * TODO:
- * - proper SMC handling
  * - better constant propagation
  * - stack caching?
  * - bug fixing
@@ -29,15 +34,35 @@
 #include "sh2.h"
 #include "compiler.h"
 #include "../drc/cmn.h"
+#include "../debug.h"
 
 // features
 #define PROPAGATE_CONSTANTS     1
 #define LINK_BRANCHES           1
 
+// limits (per block)
+#define MAX_BLOCK_SIZE          (BLOCK_INSN_LIMIT * 6 * 6)
+
 // max literal offset from the block end
 #define MAX_LITERAL_OFFSET      32*2
+#define MAX_LITERALS            (BLOCK_INSN_LIMIT / 4)
+#define MAX_LOCAL_BRANCHES      32
+
+///
+#define FETCH_OP(pc) \
+  dr_pc_base[(pc) / 2]
+
+#define FETCH32(a) \
+  ((dr_pc_base[(a) / 2] << 16) | dr_pc_base[(a) / 2 + 1])
 
-// debug stuff {
+#ifdef DRC_SH2
+
+// debug stuff
+// 1 - warnings/errors
+// 2 - block info/smc
+// 4 - asm
+// 8 - runtime entries
+// {
 #ifndef DRC_DEBUG
 #define DRC_DEBUG 0
 #endif
@@ -49,7 +74,7 @@
 }
 
 #include "mame/sh2dasm.h"
-#include <platform/linux/host_dasm.h>
+#include <platform/libpicofe/linux/host_dasm.h>
 static int insns_compiled, hash_collisions, host_insn_count;
 #define COUNT_OP \
 	host_insn_count++
@@ -58,7 +83,7 @@ static int insns_compiled, hash_collisions, host_insn_count;
 #define dbg(...)
 #endif
 
-#if (DRC_DEBUG & 2)
+#if (DRC_DEBUG & 4)
 static u8 *tcache_dsm_ptrs[3];
 static char sh2dasm_buff[64];
 #define do_host_disasm(tcid) \
@@ -68,19 +93,19 @@ static char sh2dasm_buff[64];
 #define do_host_disasm(x)
 #endif
 
-#if (DRC_DEBUG & 4)
-static void REGPARM(3) *sh2_drc_announce_entry(void *block, SH2 *sh2, u32 sr)
+#if (DRC_DEBUG & 8) || defined(PDB)
+static void REGPARM(3) *sh2_drc_log_entry(void *block, SH2 *sh2, u32 sr)
 {
-  if (block != NULL)
-    dbg(4, "= %csh2 enter %08x %p, c=%d", sh2->is_slave ? 's' : 'm',
+  if (block != NULL) {
+    dbg(8, "= %csh2 enter %08x %p, c=%d", sh2->is_slave ? 's' : 'm',
       sh2->pc, block, (signed int)sr >> 12);
+    pdb_step(sh2, sh2->pc);
+  }
   return block;
 }
 #endif
 // } debug
 
-#define BLOCK_CYCLE_LIMIT 100
-#define MAX_BLOCK_SIZE (BLOCK_CYCLE_LIMIT * 6 * 6)
 #define TCACHE_BUFFERS 3
 
 // we have 3 translation cache buffers, split from one drc/cmn buffer.
@@ -88,7 +113,7 @@ static void REGPARM(3) *sh2_drc_announce_entry(void *block, SH2 *sh2, u32 sr)
 // and can be discarded early
 // XXX: need to tune sizes
 static const int tcache_sizes[TCACHE_BUFFERS] = {
-  DRC_TCACHE_SIZE * 6 / 8, // ROM, DRAM
+  DRC_TCACHE_SIZE * 6 / 8, // ROM (rarely used), DRAM
   DRC_TCACHE_SIZE / 8, // BIOS, data array in master sh2
   DRC_TCACHE_SIZE / 8, // ... slave
 };
@@ -99,32 +124,49 @@ static u8 *tcache_ptrs[TCACHE_BUFFERS];
 // ptr for code emiters
 static u8 *tcache_ptr;
 
-typedef struct block_desc_ {
+struct block_desc {
   u32 addr;                  // SH2 PC address
-  u32 end_addr;              // TODO rm?
+  u32 end_addr;              // address after last op
   void *tcache_ptr;          // translated block for above PC
-  struct block_desc_ *next;  // next block with the same PC hash
-#if (DRC_DEBUG & 1)
+  struct block_desc *next;   // next block with the same PC hash
+#if (DRC_DEBUG & 2)
   int refcount;
 #endif
-} block_desc;
+};
 
-typedef struct block_link_ {
+struct block_link {
   u32 target_pc;
-  void *jump;
+  void *jump;     // insn address
 //  struct block_link_ *next;
-} block_link;
+};
 
 static const int block_max_counts[TCACHE_BUFFERS] = {
   4*1024,
   256,
   256,
 };
-static block_desc *block_tables[TCACHE_BUFFERS];
-static block_link *block_links[TCACHE_BUFFERS]; 
+static struct block_desc *block_tables[TCACHE_BUFFERS];
+static struct block_link *block_links[TCACHE_BUFFERS]; 
 static int block_counts[TCACHE_BUFFERS];
 static int block_link_counts[TCACHE_BUFFERS];
 
+// used for invalidation
+static const int ram_sizes[TCACHE_BUFFERS] = {
+  0x40000,
+  0x1000,
+  0x1000,
+};
+#define ADDR_TO_BLOCK_PAGE 0x100
+
+struct block_list {
+  struct block_desc *block;
+  struct block_list *next;
+};
+
+// array of pointers to block_lists for RAM and 2 data arrays
+// each array has len: sizeof(mem) / ADDR_TO_BLOCK_PAGE 
+static struct block_list **inval_lookup[TCACHE_BUFFERS];
+
 // host register tracking
 enum {
   HR_FREE,
@@ -148,16 +190,16 @@ typedef struct {
 
 // note: reg_temp[] must have at least the amount of
 // registers used by handlers in worst case (currently 4)
-#ifdef ARM
+#ifdef __arm__
 #include "../drc/emit_arm.c"
 
 static const int reg_map_g2h[] = {
    4,  5,  6,  7,
    8, -1, -1, -1,
   -1, -1, -1, -1,
-  -1, -1, -1,  9,
-  -1, -1, -1, 10,
-  -1, -1, -1, -1,
+  -1, -1, -1,  9, // r12 .. sp
+  -1, -1, -1, 10, // SHR_PC,  SHR_PPC, SHR_PR,   SHR_SR,
+  -1, -1, -1, -1, // SHR_GBR, SHR_VBR, SHR_MACH, SHR_MACL,
 };
 
 static temp_reg_t reg_temp[] = {
@@ -207,29 +249,137 @@ static temp_reg_t reg_temp[] = {
 // ROM hash table
 #define MAX_HASH_ENTRIES 1024
 #define HASH_MASK (MAX_HASH_ENTRIES - 1)
-static void **hash_table;
+static struct block_desc **hash_table;
 
 #define HASH_FUNC(hash_tab, addr) \
-  ((block_desc **)(hash_tab))[(addr) & HASH_MASK]
+  (hash_tab)[(addr) & HASH_MASK]
 
 static void REGPARM(1) (*sh2_drc_entry)(SH2 *sh2);
 static void            (*sh2_drc_dispatcher)(void);
 static void            (*sh2_drc_exit)(void);
 static void            (*sh2_drc_test_irq)(void);
+
+static u32  REGPARM(2) (*sh2_drc_read8)(u32 a, SH2 *sh2);
+static u32  REGPARM(2) (*sh2_drc_read16)(u32 a, SH2 *sh2);
+static u32  REGPARM(2) (*sh2_drc_read32)(u32 a, SH2 *sh2);
 static void REGPARM(2) (*sh2_drc_write8)(u32 a, u32 d);
 static void REGPARM(2) (*sh2_drc_write8_slot)(u32 a, u32 d);
 static void REGPARM(2) (*sh2_drc_write16)(u32 a, u32 d);
 static void REGPARM(2) (*sh2_drc_write16_slot)(u32 a, u32 d);
+static int  REGPARM(3) (*sh2_drc_write32)(u32 a, u32 d, SH2 *sh2);
+
+// address space stuff
+static int dr_ctx_get_mem_ptr(u32 a, u32 *mask)
+{
+  int poffs = -1;
+
+  if ((a & ~0x7ff) == 0) {
+    // BIOS
+    poffs = offsetof(SH2, p_bios);
+    *mask = 0x7ff;
+  }
+  else if ((a & 0xfffff000) == 0xc0000000) {
+    // data array
+    poffs = offsetof(SH2, p_da);
+    *mask = 0xfff;
+  }
+  else if ((a & 0xc6000000) == 0x06000000) {
+    // SDRAM
+    poffs = offsetof(SH2, p_sdram);
+    *mask = 0x03ffff;
+  }
+  else if ((a & 0xc6000000) == 0x02000000) {
+    // ROM
+    poffs = offsetof(SH2, p_rom);
+    *mask = 0x3fffff;
+  }
+
+  return poffs;
+}
+
+static struct block_desc *dr_get_bd(u32 pc, int is_slave, int *tcache_id)
+{
+  *tcache_id = 0;
+
+  // we have full block id tables for data_array and RAM
+  // BIOS goes to data_array table too
+  if ((pc & 0xe0000000) == 0xc0000000 || (pc & ~0xfff) == 0) {
+    int blkid = Pico32xMem->drcblk_da[is_slave][(pc & 0xfff) >> SH2_DRCBLK_DA_SHIFT];
+    *tcache_id = 1 + is_slave;
+    if (blkid & 1)
+      return &block_tables[*tcache_id][blkid >> 1];
+  }
+  // RAM
+  else if ((pc & 0xc6000000) == 0x06000000) {
+    int blkid = Pico32xMem->drcblk_ram[(pc & 0x3ffff) >> SH2_DRCBLK_RAM_SHIFT];
+    if (blkid & 1)
+      return &block_tables[0][blkid >> 1];
+  }
+  // ROM
+  else if ((pc & 0xc6000000) == 0x02000000) {
+    struct block_desc *bd = HASH_FUNC(hash_table, pc);
 
-extern void REGPARM(2) sh2_do_op(SH2 *sh2, int opcode);
+    for (; bd != NULL; bd = bd->next)
+      if (bd->addr == pc)
+        return bd;
+  }
+
+  return NULL;
+}
+
+// ---------------------------------------------------------------
+
+// block management
+static void add_to_block_list(struct block_list **blist, struct block_desc *block)
+{
+  struct block_list *added = malloc(sizeof(*added));
+  if (!added) {
+    elprintf(EL_ANOMALY, "drc OOM (1)");
+    return;
+  }
+  added->block = block;
+  added->next = *blist;
+  *blist = added;
+}
+
+static void rm_from_block_list(struct block_list **blist, struct block_desc *block)
+{
+  struct block_list *prev = NULL, *current = *blist;
+  for (; current != NULL; prev = current, current = current->next) {
+    if (current->block == block) {
+      if (prev == NULL)
+        *blist = current->next;
+      else
+        prev->next = current->next;
+      free(current);
+      return;
+    }
+  }
+  dbg(1, "can't rm block %p (%08x-%08x)",
+    block, block->addr, block->end_addr);
+}
+
+static void rm_block_list(struct block_list **blist)
+{
+  struct block_list *tmp, *current = *blist;
+  while (current != NULL) {
+    tmp = current;
+    current = current->next;
+    free(tmp);
+  }
+  *blist = NULL;
+}
 
-static void flush_tcache(int tcid)
+static void REGPARM(1) flush_tcache(int tcid)
 {
+  int i;
+
   dbg(1, "tcache #%d flush! (%d/%d, bds %d/%d)", tcid,
     tcache_ptrs[tcid] - tcache_bases[tcid], tcache_sizes[tcid],
     block_counts[tcid], block_max_counts[tcid]);
 
   block_counts[tcid] = 0;
+  block_link_counts[tcid] = 0;
   tcache_ptrs[tcid] = tcache_bases[tcid];
   if (tcid == 0) { // ROM, RAM
     memset(hash_table, 0, sizeof(hash_table[0]) * MAX_HASH_ENTRIES);
@@ -237,19 +387,23 @@ static void flush_tcache(int tcid)
   }
   else
     memset(Pico32xMem->drcblk_da[tcid - 1], 0, sizeof(Pico32xMem->drcblk_da[0]));
-#if (DRC_DEBUG & 2)
+#if (DRC_DEBUG & 4)
   tcache_dsm_ptrs[tcid] = tcache_bases[tcid];
 #endif
+
+  for (i = 0; i < ram_sizes[tcid] / ADDR_TO_BLOCK_PAGE; i++)
+    rm_block_list(&inval_lookup[tcid][i]);
 }
 
+#if LINK_BRANCHES
 // add block links (tracked branches)
 static int dr_add_block_link(u32 target_pc, void *jump, int tcache_id)
 {
-  block_link *bl = block_links[tcache_id];
+  struct block_link *bl = block_links[tcache_id];
   int cnt = block_link_counts[tcache_id];
 
   if (cnt >= block_max_counts[tcache_id] * 2) {
-    printf("bl overflow for tcache %d\n", tcache_id);
+    dbg(1, "bl overflow for tcache %d\n", tcache_id);
     return -1;
   }
 
@@ -259,32 +413,34 @@ static int dr_add_block_link(u32 target_pc, void *jump, int tcache_id)
 
   return 0;
 }
+#endif
 
-static void *dr_find_block(block_desc *tab, u32 addr)
-{
-  for (tab = tab->next; tab != NULL; tab = tab->next)
-    if (tab->addr == addr)
-      break;
-
-  if (tab != NULL)
-    return tab->tcache_ptr;
-
-  printf("block miss for %08x\n", addr);
-  return NULL;
-}
-
-static block_desc *dr_add_block(u32 addr, int tcache_id, int *blk_id)
+static struct block_desc *dr_add_block(u32 addr, u32 end_addr, int is_slave, int *blk_id)
 {
-  int *bcount = &block_counts[tcache_id];
-  block_desc *bd;
+  struct block_desc *bd;
+  int tcache_id;
+  int *bcount;
+
+  bd = dr_get_bd(addr, is_slave, &tcache_id);
+  if (bd != NULL) {
+    dbg(2, "block override for %08x", addr);
+    bd->tcache_ptr = tcache_ptr;
+    bd->end_addr = end_addr;
+    *blk_id = bd - block_tables[tcache_id];
+    return bd;
+  }
 
+  bcount = &block_counts[tcache_id];
   if (*bcount >= block_max_counts[tcache_id]) {
-    printf("bd overflow for tcache %d\n", tcache_id);
+    dbg(1, "bd overflow for tcache %d", tcache_id);
     return NULL;
   }
+  if (*bcount == 0)
+    (*bcount)++; // not using descriptor 0
 
   bd = &block_tables[tcache_id][*bcount];
   bd->addr = addr;
+  bd->end_addr = end_addr;
   bd->tcache_ptr = tcache_ptr;
   *blk_id = *bcount;
   (*bcount)++;
@@ -292,7 +448,7 @@ static block_desc *dr_add_block(u32 addr, int tcache_id, int *blk_id)
   if ((addr & 0xc6000000) == 0x02000000) { // ROM
     bd->next = HASH_FUNC(hash_table, addr);
     HASH_FUNC(hash_table, addr) = bd;
-#if (DRC_DEBUG & 1)
+#if (DRC_DEBUG & 2)
     if (bd->next != NULL) {
       printf(" hash collision with %08x\n", bd->next->addr);
       hash_collisions++;
@@ -303,14 +459,76 @@ static block_desc *dr_add_block(u32 addr, int tcache_id, int *blk_id)
   return bd;
 }
 
+static void REGPARM(3) *dr_lookup_block(u32 pc, int is_slave, int *tcache_id)
+{
+  struct block_desc *bd = NULL;
+  void *block = NULL;
+
+  bd = dr_get_bd(pc, is_slave, tcache_id);
+  if (bd != NULL)
+    block = bd->tcache_ptr;
+
+#if (DRC_DEBUG & 2)
+  if (bd != NULL)
+    bd->refcount++;
+#endif
+  return block;
+}
+
+static void *dr_failure(void)
+{
+  lprintf("recompilation failed\n");
+  exit(1);
+}
+
+static void *dr_prepare_ext_branch(u32 pc, SH2 *sh2, int tcache_id)
+{
+#if LINK_BRANCHES
+  int target_tcache_id;
+  void *target;
+  int ret;
+
+  target = dr_lookup_block(pc, sh2->is_slave, &target_tcache_id);
+  if (target_tcache_id == tcache_id) {
+    // allow linking blocks only from local cache
+    ret = dr_add_block_link(pc, tcache_ptr, tcache_id);
+    if (ret < 0)
+      return NULL;
+  }
+  if (target == NULL || target_tcache_id != tcache_id)
+    target = sh2_drc_dispatcher;
+
+  return target;
+#else
+  return sh2_drc_dispatcher;
+#endif
+}
+
+static void dr_link_blocks(void *target, u32 pc, int tcache_id)
+{
+#if LINK_BRANCHES
+  struct block_link *bl = block_links[tcache_id];
+  int cnt = block_link_counts[tcache_id];
+  int i;
+
+  for (i = 0; i < cnt; i++) {
+    if (bl[i].target_pc == pc) {
+      dbg(2, "- link from %p", bl[i].jump);
+      emith_jump_patch(bl[i].jump, target);
+      // XXX: sync ARM caches (old jump should be fine)?
+    }
+  }
+#endif
+}
+
 #define ADD_TO_ARRAY(array, count, item, failcode) \
   array[count++] = item; \
   if (count >= ARRAY_SIZE(array)) { \
-    printf("warning: " #array " overflow\n"); \
+    dbg(1, "warning: " #array " overflow"); \
     failcode; \
   }
 
-int find_in_array(u32 *array, size_t size, u32 what)
+static int find_in_array(u32 *array, size_t size, u32 what)
 {
   size_t i;
   for (i = 0; i < size; i++)
@@ -322,6 +540,7 @@ int find_in_array(u32 *array, size_t size, u32 what)
 
 // ---------------------------------------------------------------
 
+// register cache / constant propagation stuff
 typedef enum {
   RC_GR_READ,
   RC_GR_WRITE,
@@ -336,9 +555,9 @@ static u32 dr_gcregs[24];
 static u32 dr_gcregs_mask;
 static u32 dr_gcregs_dirty;
 
+#if PROPAGATE_CONSTANTS
 static void gconst_new(sh2_reg_e r, u32 val)
 {
-#if PROPAGATE_CONSTANTS
   int i;
 
   dr_gcregs_mask  |= 1 << r;
@@ -353,8 +572,8 @@ static void gconst_new(sh2_reg_e r, u32 val)
       reg_temp[i].flags = 0;
     }
   }
-#endif
 }
+#endif
 
 static int gconst_get(sh2_reg_e r, u32 *val)
 {
@@ -413,7 +632,6 @@ static void gconst_invalidate(void)
   dr_gcregs_mask = dr_gcregs_dirty = 0;
 }
 
-// register chache
 static u16 rcache_counter;
 
 static temp_reg_t *rcache_evict(void)
@@ -551,9 +769,8 @@ static int rcache_get_arg_id(int arg)
     if (reg_temp[i].hreg == r)
       break;
 
-  if (i == ARRAY_SIZE(reg_temp))
-    // let's just say it's untracked arg reg
-    return r;
+  if (i == ARRAY_SIZE(reg_temp)) // can't happen
+    exit(1);
 
   if (reg_temp[i].type == HR_CACHED) {
     // writeback
@@ -585,7 +802,7 @@ static int rcache_get_tmp_arg(int arg)
 static int rcache_get_reg_arg(int arg, sh2_reg_e r)
 {
   int i, srcr, dstr, dstid;
-  int dirty = 0;
+  int dirty = 0, src_dirty = 0;
 
   dstid = rcache_get_arg_id(arg);
   dstr = reg_temp[dstid].hreg;
@@ -601,6 +818,8 @@ static int rcache_get_reg_arg(int arg, sh2_reg_e r)
          reg_temp[i].greg == r)
     {
       srcr = reg_temp[i].hreg;
+      if (reg_temp[i].flags & HRF_DIRTY)
+        src_dirty = 1;
       goto do_cache;
     }
   }
@@ -617,13 +836,22 @@ static int rcache_get_reg_arg(int arg, sh2_reg_e r)
 do_cache:
   if (dstr != srcr)
     emith_move_r_r(dstr, srcr);
+#if 1
+  else
+    dirty |= src_dirty;
+
+  if (dirty)
+    // must clean, callers might want to modify the arg before call
+    emith_ctx_write(dstr, r * 4);
+#else
+  if (dirty)
+    reg_temp[dstid].flags |= HRF_DIRTY;
+#endif
 
   reg_temp[dstid].stamp = ++rcache_counter;
   reg_temp[dstid].type = HR_CACHED;
   reg_temp[dstid].greg = r;
   reg_temp[dstid].flags |= HRF_LOCKED;
-  if (dirty)
-    reg_temp[dstid].flags |= HRF_DIRTY;
   return dstr;
 }
 
@@ -691,70 +919,17 @@ static void rcache_flush(void)
 
 // ---------------------------------------------------------------
 
-// address space stuff
-static void *dr_get_pc_base(u32 pc, int is_slave)
-{
-  void *ret = NULL;
-  u32 mask = 0;
-
-  if ((pc & ~0x7ff) == 0) {
-    // BIOS
-    ret = is_slave ? Pico32xMem->sh2_rom_s : Pico32xMem->sh2_rom_m;
-    mask = 0x7ff;
-  }
-  else if ((pc & 0xfffff000) == 0xc0000000) {
-    // data array
-    ret = Pico32xMem->data_array[is_slave];
-    mask = 0xfff;
-  }
-  else if ((pc & 0xc6000000) == 0x06000000) {
-    // SDRAM
-    ret = Pico32xMem->sdram;
-    mask = 0x03ffff;
-  }
-  else if ((pc & 0xc6000000) == 0x02000000) {
-    // ROM
-    ret = Pico.rom;
-    mask = 0x3fffff;
-  }
-
-  if (ret == NULL)
-    return (void *)-1; // NULL is valid value
-
-  return (char *)ret - (pc & ~mask);
-}
-
 static int emit_get_rbase_and_offs(u32 a, u32 *offs)
 {
-  int poffs = -1;
   u32 mask = 0;
+  int poffs;
   int hr;
 
-  if ((a & ~0x7ff) == 0) {
-    // BIOS
-    poffs = offsetof(SH2, p_bios);
-    mask = 0x7ff;
-  }
-  else if ((a & 0xfffff000) == 0xc0000000) {
-    // data array
-    poffs = offsetof(SH2, p_da);
-    mask = 0xfff;
-  }
-  else if ((a & 0xc6000000) == 0x06000000) {
-    // SDRAM
-    poffs = offsetof(SH2, p_sdram);
-    mask = 0x03ffff;
-  }
-  else if ((a & 0xc6000000) == 0x02000000) {
-    // ROM
-    poffs = offsetof(SH2, p_rom);
-    mask = 0x3fffff;
-  }
-
+  poffs = dr_ctx_get_mem_ptr(a, &mask);
   if (poffs == -1)
     return -1;
 
-  // XXX: could use related reg
+  // XXX: could use some related reg
   hr = rcache_get_tmp();
   emith_ctx_read(hr, poffs);
   emith_add_r_imm(hr, a & mask & ~0xff);
@@ -762,49 +937,6 @@ static int emit_get_rbase_and_offs(u32 a, u32 *offs)
   return hr;
 }
 
-static void REGPARM(3) *lookup_block(u32 pc, int is_slave, int *tcache_id)
-{
-  block_desc *bd = NULL;
-  void *block = NULL;
-  *tcache_id = 0;
-
-  // we have full block id tables for data_array and RAM
-  // BIOS goes to data_array table too
-  if ((pc & 0xe0000000) == 0xc0000000 || (pc & ~0xfff) == 0) {
-    int blkid = Pico32xMem->drcblk_da[is_slave][(pc & 0xfff) >> SH2_DRCBLK_DA_SHIFT];
-    *tcache_id = 1 + is_slave;
-    if (blkid & 1) {
-      bd = &block_tables[*tcache_id][blkid >> 1];
-      block = bd->tcache_ptr;
-    }
-  }
-  // RAM
-  else if ((pc & 0xc6000000) == 0x06000000) {
-    int blkid = Pico32xMem->drcblk_ram[(pc & 0x3ffff) >> SH2_DRCBLK_RAM_SHIFT];
-    if (blkid & 1) {
-      bd = &block_tables[0][blkid >> 1];
-      block = bd->tcache_ptr;
-    }
-  }
-  // ROM
-  else if ((pc & 0xc6000000) == 0x02000000) {
-    bd = HASH_FUNC(hash_table, pc);
-
-    if (bd != NULL) {
-      if (bd->addr == pc)
-        block = bd->tcache_ptr;
-      else
-        block = dr_find_block(bd, pc);
-    }
-  }
-
-#if (DRC_DEBUG & 1)
-  if (bd != NULL)
-    bd->refcount++;
-#endif
-  return block;
-}
-
 static void emit_move_r_imm32(sh2_reg_e dst, u32 imm)
 {
 #if PROPAGATE_CONSTANTS
@@ -848,7 +980,7 @@ static int emit_memhandler_read_(int size, int ram_check)
   arg1 = rcache_get_tmp_arg(1);
   emith_move_r_r(arg1, CONTEXT_REG);
 
-#if 1
+#ifndef PDB_NET
   if (ram_check && Pico.rom == (void *)0x02000000 && Pico32xMem->sdram == (void *)0x06000000) {
     int tmp = rcache_get_tmp();
     emith_and_r_r_imm(tmp, arg0, 0xfb000000);
@@ -859,14 +991,14 @@ static int emit_memhandler_read_(int size, int ram_check)
       emith_eor_r_imm_c(DCOND_EQ, arg0, 1);
       emith_read8_r_r_offs_c(DCOND_EQ, arg0, arg0, 0);
       EMITH_SJMP3_MID(DCOND_NE);
-      emith_call_cond(DCOND_NE, p32x_sh2_read8);
+      emith_call_cond(DCOND_NE, sh2_drc_read8);
       EMITH_SJMP3_END();
       break;
     case 1: // 16
       EMITH_SJMP3_START(DCOND_NE);
       emith_read16_r_r_offs_c(DCOND_EQ, arg0, arg0, 0);
       EMITH_SJMP3_MID(DCOND_NE);
-      emith_call_cond(DCOND_NE, p32x_sh2_read16);
+      emith_call_cond(DCOND_NE, sh2_drc_read16);
       EMITH_SJMP3_END();
       break;
     case 2: // 32
@@ -874,7 +1006,7 @@ static int emit_memhandler_read_(int size, int ram_check)
       emith_read_r_r_offs_c(DCOND_EQ, arg0, arg0, 0);
       emith_ror_c(DCOND_EQ, arg0, arg0, 16);
       EMITH_SJMP3_MID(DCOND_NE);
-      emith_call_cond(DCOND_NE, p32x_sh2_read32);
+      emith_call_cond(DCOND_NE, sh2_drc_read32);
       EMITH_SJMP3_END();
       break;
     }
@@ -884,17 +1016,21 @@ static int emit_memhandler_read_(int size, int ram_check)
   {
     switch (size) {
     case 0: // 8
-      emith_call(p32x_sh2_read8);
+      emith_call(sh2_drc_read8);
       break;
     case 1: // 16
-      emith_call(p32x_sh2_read16);
+      emith_call(sh2_drc_read16);
       break;
     case 2: // 32
-      emith_call(p32x_sh2_read32);
+      emith_call(sh2_drc_read32);
       break;
     }
   }
   rcache_invalidate();
+
+  if (reg_map_g2h[SHR_SR] != -1)
+    emith_ctx_read(reg_map_g2h[SHR_SR], SHR_SR * 4);
+
   // assuming arg0 and retval reg matches
   return rcache_get_tmp_arg(0);
 }
@@ -952,6 +1088,9 @@ static void emit_memhandler_write(int size, u32 pc, int delay)
 {
   int ctxr;
   host_arg2reg(ctxr, 2);
+  if (reg_map_g2h[SHR_SR] != -1)
+    emith_ctx_write(reg_map_g2h[SHR_SR], SHR_SR * 4);
+
   switch (size) {
   case 0: // 8
     // XXX: consider inlining sh2_drc_write8
@@ -974,9 +1113,12 @@ static void emit_memhandler_write(int size, u32 pc, int delay)
     break;
   case 2: // 32
     emith_move_r_r(ctxr, CONTEXT_REG);
-    emith_call(p32x_sh2_write32);
+    emith_call(sh2_drc_write32);
     break;
   }
+
+  if (reg_map_g2h[SHR_SR] != -1)
+    emith_ctx_read(reg_map_g2h[SHR_SR], SHR_SR * 4);
   rcache_invalidate();
 }
 
@@ -1044,16 +1186,19 @@ static void emit_do_static_regs(int is_write, int tmpr)
 
 static void emit_block_entry(void)
 {
-  int arg0, arg1, arg2;
+  int arg0;
 
   host_arg2reg(arg0, 0);
+
+#if (DRC_DEBUG & 8) || defined(PDB)
+  int arg1, arg2;
   host_arg2reg(arg1, 1);
   host_arg2reg(arg2, 2);
 
-#if (DRC_DEBUG & 4)
+  emit_do_static_regs(1, arg2);
   emith_move_r_r(arg1, CONTEXT_REG);
   emith_move_r_r(arg2, rcache_get_reg(SHR_SR, RC_GR_READ));
-  emith_call(sh2_drc_announce_entry);
+  emith_call(sh2_drc_log_entry);
   rcache_invalidate();
 #endif
   emith_tst_r_r(arg0, arg0);
@@ -1062,46 +1207,6 @@ static void emit_block_entry(void)
   EMITH_SJMP_END(DCOND_EQ);
 }
 
-void dr_link_blocks(void *target, u32 pc, int tcache_id)
-{
-#if LINK_BRANCHES
-  block_link *bl = block_links[tcache_id];
-  int cnt = block_link_counts[tcache_id];
-  int i;
-
-  for (i = 0; i < cnt; i++) {
-    if (bl[i].target_pc == pc) {
-      dbg(1, "- link from %p", bl[i].jump);
-      emith_jump_patch(bl[i].jump, target);
-      // XXX: sync ARM caches (old jump should be fine)?
-    }
-  }
-#endif
-}
-
-void *dr_prepare_ext_branch(u32 pc, SH2 *sh2, int tcache_id)
-{
-#if LINK_BRANCHES
-  int target_tcache_id;
-  void *target;
-  int ret;
-
-  target = lookup_block(pc, sh2->is_slave, &target_tcache_id);
-  if (target_tcache_id == tcache_id) {
-    // allow linking blocks only from local cache
-    ret = dr_add_block_link(pc, tcache_ptr, tcache_id);
-    if (ret < 0)
-      return NULL;
-  }
-  if (target == NULL || target_tcache_id != tcache_id)
-    target = sh2_drc_dispatcher;
-
-  return target;
-#else
-  return sh2_drc_dispatcher;
-#endif
-}
-
 #define DELAYED_OP \
   drcf.delayed_op = 2
 
@@ -1125,12 +1230,6 @@ void *dr_prepare_ext_branch(u32 pc, SH2 *sh2, int tcache_id)
     goto default_; \
 }
 
-#define FETCH_OP(pc) \
-  dr_pc_base[(pc) / 2]
-
-#define FETCH32(a) \
-  ((dr_pc_base[(a) / 2] << 16) | dr_pc_base[(a) / 2 + 1])
-
 #define GET_Fx() \
   ((op >> 4) & 0x0f)
 
@@ -1143,24 +1242,23 @@ void *dr_prepare_ext_branch(u32 pc, SH2 *sh2, int tcache_id)
   if (GET_Fx() >= n) \
     goto default_
 
-#define MAX_LOCAL_BRANCHES 32
-
-// op_flags: data from 1st pass
-#define OP_FLAGS(pc) op_flags[((pc) - base_pc) / 2]
-#define OF_DELAY_OP (1 << 0)
+static void *dr_get_pc_base(u32 pc, int is_slave);
 
 static void REGPARM(2) *sh2_translate(SH2 *sh2, int tcache_id)
 {
   // XXX: maybe use structs instead?
-  void *branch_target_ptr[MAX_LOCAL_BRANCHES];
   u32 branch_target_pc[MAX_LOCAL_BRANCHES];
+  void *branch_target_ptr[MAX_LOCAL_BRANCHES];
+  int branch_target_blkid[MAX_LOCAL_BRANCHES];
   int branch_target_count = 0;
   void *branch_patch_ptr[MAX_LOCAL_BRANCHES];
   u32 branch_patch_pc[MAX_LOCAL_BRANCHES];
   int branch_patch_count = 0;
+  u32 literal_addr[MAX_LITERALS];
+  int literal_addr_count = 0;
   int pending_branch_cond = -1;
   int pending_branch_pc = 0;
-  u8 op_flags[BLOCK_CYCLE_LIMIT + 1];
+  u8 op_flags[BLOCK_INSN_LIMIT];
   struct {
     u32 delayed_op:2;
     u32 test_irq:1;
@@ -1169,9 +1267,8 @@ static void REGPARM(2) *sh2_translate(SH2 *sh2, int tcache_id)
 
   // PC of current, first, last, last_target_blk SH2 insn
   u32 pc, base_pc, end_pc, out_pc;
-  u32 last_inlined_literal = 0;
   void *block_entry;
-  block_desc *this_block;
+  struct block_desc *this_block;
   u16 *dr_pc_base;
   int blkid_main = 0;
   int skip_op = 0;
@@ -1191,75 +1288,43 @@ static void REGPARM(2) *sh2_translate(SH2 *sh2, int tcache_id)
   }
 
   tcache_ptr = tcache_ptrs[tcache_id];
-  this_block = dr_add_block(base_pc, tcache_id, &blkid_main);
-  if (this_block == NULL)
-    return NULL;
 
   // predict tcache overflow
   tmp = tcache_ptr - tcache_bases[tcache_id];
   if (tmp > tcache_sizes[tcache_id] - MAX_BLOCK_SIZE) {
-    printf("tcache %d overflow\n", tcache_id);
+    dbg(1, "tcache %d overflow", tcache_id);
     return NULL;
   }
 
+  // 1st pass: scan forward for local branches
+  scan_block(base_pc, sh2->is_slave, op_flags, &end_pc);
+
+  this_block = dr_add_block(base_pc, end_pc + MAX_LITERAL_OFFSET, // XXX
+                 sh2->is_slave, &blkid_main);
+  if (this_block == NULL)
+    return NULL;
+
   block_entry = tcache_ptr;
-  dbg(1, "== %csh2 block #%d,%d %08x -> %p", sh2->is_slave ? 's' : 'm',
-    tcache_id, blkid_main, base_pc, block_entry);
+  dbg(2, "== %csh2 block #%d,%d %08x-%08x -> %p", sh2->is_slave ? 's' : 'm',
+    tcache_id, blkid_main, base_pc, end_pc, block_entry);
 
   dr_link_blocks(tcache_ptr, base_pc, tcache_id);
 
-  // 1st pass: scan forward for local branches
-  memset(op_flags, 0, sizeof(op_flags));
-  for (cycles = 0, pc = base_pc; cycles < BLOCK_CYCLE_LIMIT; cycles++, pc += 2) {
-    op = FETCH_OP(pc);
-    if ((op & 0xf000) == 0xa000 || (op & 0xf000) == 0xb000) { // BRA, BSR
-      signed int offs = ((signed int)(op << 20) >> 19);
-      pc += 2;
-      OP_FLAGS(pc) |= OF_DELAY_OP;
-      ADD_TO_ARRAY(branch_target_pc, branch_target_count, pc + offs + 2,);
-      break;
-    }
-    if ((op & 0xf000) == 0) {
-      op &= 0xff;
-      if (op == 0x1b) // SLEEP
-        break;
-      if (op == 0x23 || op == 0x03 || op == 0x0b || op == 0x2b) { // BRAF, BSRF, RTS, RTE
-        pc += 2;
-        OP_FLAGS(pc) |= OF_DELAY_OP;
-        break;
-      }
+  // collect branch_targets that don't land on delay slots
+  for (pc = base_pc; pc < end_pc; pc += 2) {
+    if (!(OP_FLAGS(pc) & OF_BTARGET))
+      continue;
+    if (OP_FLAGS(pc) & OF_DELAY_OP) {
+      OP_FLAGS(pc) &= ~OF_BTARGET;
       continue;
     }
-    if ((op & 0xf0df) == 0x400b) { // JMP, JSR
-      pc += 2;
-      OP_FLAGS(pc) |= OF_DELAY_OP;
-      break;
-    }
-    if ((op & 0xf900) == 0x8900) { // BT(S), BF(S)
-      signed int offs = ((signed int)(op << 24) >> 23);
-      if (op & 0x0400)
-        OP_FLAGS(pc + 2) |= OF_DELAY_OP;
-      ADD_TO_ARRAY(branch_target_pc, branch_target_count, pc + offs + 4, break);
-    }
-    if ((op & 0xff00) == 0xc300) // TRAPA
-      break;
+    ADD_TO_ARRAY(branch_target_pc, branch_target_count, pc, break);
   }
 
-  end_pc = pc;
-
-  // clean branch_targets that are not really local,
-  // and that land on delay slots
-  for (i = 0, tmp = 0; i < branch_target_count; i++) {
-    pc = branch_target_pc[i];
-    if (base_pc <= pc && pc <= end_pc && !(OP_FLAGS(pc) & OF_DELAY_OP))
-      branch_target_pc[tmp++] = branch_target_pc[i];
-  }
-  branch_target_count = tmp;
-  memset(branch_target_ptr, 0, sizeof(branch_target_ptr[0]) * branch_target_count);
-#if !LINK_BRANCHES
-  // for debug
-  branch_target_count = 0;
-#endif
+  if (branch_target_count > 0) {
+    memset(branch_target_ptr, 0, sizeof(branch_target_ptr[0]) * branch_target_count);
+    memset(branch_target_blkid, 0, sizeof(branch_target_blkid[0]) * branch_target_count);
+  }
 
   // -------------------------------------------------
   // 2nd pass: actual compilation
@@ -1274,15 +1339,13 @@ static void REGPARM(2) *sh2_translate(SH2 *sh2, int tcache_id)
 
     op = FETCH_OP(pc);
 
-    i = find_in_array(branch_target_pc, branch_target_count, pc);
-    if (i >= 0)
+    if ((OP_FLAGS(pc) & OF_BTARGET) || pc == base_pc)
     {
-      if (pc != sh2->pc)
+      i = find_in_array(branch_target_pc, branch_target_count, pc);
+      if (pc != base_pc)
       {
         /* make "subblock" - just a mid-block entry */
-        block_desc *subblock;
-        u16 *drcblk;
-        int blkid;
+        struct block_desc *subblock;
 
         sr = rcache_get_reg(SHR_SR, RC_GR_RMW);
         FLUSH_CYCLES(sr);
@@ -1293,28 +1356,19 @@ static void REGPARM(2) *sh2_translate(SH2 *sh2, int tcache_id)
           rcache_flush();
         do_host_disasm(tcache_id);
 
-        subblock = dr_add_block(pc, tcache_id, &blkid);
+        dbg(2, "-- %csh2 subblock #%d,%d %08x -> %p", sh2->is_slave ? 's' : 'm',
+          tcache_id, branch_target_blkid[i], pc, tcache_ptr);
+
+        subblock = dr_add_block(pc, end_pc + MAX_LITERAL_OFFSET, // XXX
+                     sh2->is_slave, &branch_target_blkid[i]);
         if (subblock == NULL)
           return NULL;
-        subblock->end_addr = pc;
-
-        if (tcache_id != 0) { // data array, BIOS
-          drcblk = Pico32xMem->drcblk_da[sh2->is_slave];
-          drcblk += (pc & 0x00fff) >> SH2_DRCBLK_DA_SHIFT;
-          *drcblk = (blkid << 1) | 1;
-        } else if ((this_block->addr & 0xc7fc0000) == 0x06000000) { // DRAM
-          drcblk = Pico32xMem->drcblk_ram;
-          drcblk += (pc & 0x3ffff) >> SH2_DRCBLK_RAM_SHIFT;
-          *drcblk = (blkid << 1) | 1;
-        }
-
-        dbg(1, "-- %csh2 subblock #%d,%d %08x -> %p", sh2->is_slave ? 's' : 'm',
-          tcache_id, blkid, pc, tcache_ptr);
 
         // since we made a block entry, link any other blocks that jump to current pc
         dr_link_blocks(tcache_ptr, pc, tcache_id);
       }
-      branch_target_ptr[i] = tcache_ptr;
+      if (i >= 0)
+        branch_target_ptr[i] = tcache_ptr;
 
       // must update PC
       emit_move_r_imm32(SHR_PC, pc);
@@ -1325,14 +1379,31 @@ static void REGPARM(2) *sh2_translate(SH2 *sh2, int tcache_id)
       emith_cmp_r_imm(sr, 0);
       emith_jump_cond(DCOND_LE, sh2_drc_exit);
       do_host_disasm(tcache_id);
+      rcache_unlock_all();
     }
 
-#if (DRC_DEBUG & 3)
-    insns_compiled++;
 #if (DRC_DEBUG & 2)
+    insns_compiled++;
+#endif
+#if (DRC_DEBUG & 4)
     DasmSH2(sh2dasm_buff, pc, op);
-    printf("%08x %04x %s\n", pc, op, sh2dasm_buff);
+    printf("%c%08x %04x %s\n", (OP_FLAGS(pc) & OF_BTARGET) ? '*' : ' ',
+      pc, op, sh2dasm_buff);
 #endif
+#ifdef DRC_CMP
+    //if (out_pc != 0 && out_pc != (u32)-1)
+    //  emit_move_r_imm32(SHR_PC, out_pc);
+    //else 
+    if (!drcf.delayed_op) {
+      emit_move_r_imm32(SHR_PC, pc);
+      sr = rcache_get_reg(SHR_SR, RC_GR_RMW);
+      FLUSH_CYCLES(sr);
+      // rcache_clean(); // FIXME
+      rcache_flush();
+      emit_do_static_regs(1, 0);
+      emith_pass_arg_r(0, CONTEXT_REG);
+      emith_call(do_sh2_cmp);
+    }
 #endif
 
     pc += 2;
@@ -1550,7 +1621,7 @@ static void REGPARM(2) *sh2_translate(SH2 *sh2, int tcache_id)
         EMITH_JMP_END(DCOND_EQ);
 
         rcache_free_tmp(tmp);
-        cycles += 3;
+        cycles += 2;
         goto end_op;
       }
       goto default_;
@@ -1673,8 +1744,6 @@ static void REGPARM(2) *sh2_translate(SH2 *sh2, int tcache_id)
           emith_clear_msb(tmp2, tmp3, 16);
         emith_mul(tmp, tmp, tmp2);
         rcache_free_tmp(tmp2);
-//      FIXME: causes timing issues in Doom?
-//        cycles++;
         goto end_op;
       }
       goto default_;
@@ -1762,6 +1831,7 @@ static void REGPARM(2) *sh2_translate(SH2 *sh2, int tcache_id)
         tmp3 = rcache_get_reg(SHR_MACL, RC_GR_WRITE);
         tmp4 = rcache_get_reg(SHR_MACH, RC_GR_WRITE);
         emith_mul_u64(tmp3, tmp4, tmp, tmp2);
+        cycles++;
         goto end_op;
       case 0x08: // SUB     Rm,Rn       0011nnnnmmmm1000
       case 0x0c: // ADD     Rm,Rn       0011nnnnmmmm1100
@@ -1811,6 +1881,7 @@ static void REGPARM(2) *sh2_translate(SH2 *sh2, int tcache_id)
         tmp3 = rcache_get_reg(SHR_MACL, RC_GR_WRITE);
         tmp4 = rcache_get_reg(SHR_MACH, RC_GR_WRITE);
         emith_mul_s64(tmp3, tmp4, tmp, tmp2);
+        cycles++;
         goto end_op;
       }
       goto default_;
@@ -1836,18 +1907,20 @@ static void REGPARM(2) *sh2_translate(SH2 *sh2, int tcache_id)
           sr  = rcache_get_reg(SHR_SR, RC_GR_RMW);
           if (drcf.delayed_op)
             DELAY_SAVE_T(sr);
+#ifndef DRC_CMP
           if (FETCH_OP(pc) == 0x8bfd) { // BF #-2
             if (gconst_get(GET_Rn(), &tmp)) {
               // XXX: limit burned cycles
               emit_move_r_imm32(GET_Rn(), 0);
               emith_or_r_imm(sr, T);
-              cycles += tmp * 4;
+              cycles += tmp * 4 + 1; // +1 syncs with noconst version, not sure why
               skip_op = 1;
             }
             else
               emith_sh2_dtbf_loop();
             goto end_op;
           }
+#endif
           tmp = rcache_get_reg(GET_Rn(), RC_GR_RMW);
           emith_bic_r_imm(sr, T);
           emith_subf_r_imm(tmp, 1);
@@ -1899,12 +1972,15 @@ static void REGPARM(2) *sh2_translate(SH2 *sh2, int tcache_id)
           break;
         case 0x03: // STC.L    SR,@–Rn   0100nnnn00000011
           tmp = SHR_SR;
+          cycles++;
           break;
         case 0x13: // STC.L    GBR,@–Rn  0100nnnn00010011
           tmp = SHR_GBR;
+          cycles++;
           break;
         case 0x23: // STC.L    VBR,@–Rn  0100nnnn00100011
           tmp = SHR_VBR;
+          cycles++;
           break;
         default:
           goto default_;
@@ -1976,12 +2052,15 @@ static void REGPARM(2) *sh2_translate(SH2 *sh2, int tcache_id)
           break;
         case 0x07: // LDC.L @Rm+,SR   0100mmmm00000111
           tmp = SHR_SR;
+          cycles += 2;
           break;
         case 0x17: // LDC.L @Rm+,GBR  0100mmmm00010111
           tmp = SHR_GBR;
+          cycles += 2;
           break;
         case 0x27: // LDC.L @Rm+,VBR  0100mmmm00100111
           tmp = SHR_VBR;
+          cycles += 2;
           break;
         default:
           goto default_;
@@ -2264,7 +2343,6 @@ static void REGPARM(2) *sh2_translate(SH2 *sh2, int tcache_id)
       case 0x0d00: // BT/S label 10001101dddddddd
       case 0x0f00: // BF/S label 10001111dddddddd
         DELAYED_OP;
-        cycles--;
         // fallthrough
       case 0x0900: // BT   label 10001001dddddddd
       case 0x0b00: // BF   label 10001011dddddddd
@@ -2272,7 +2350,6 @@ static void REGPARM(2) *sh2_translate(SH2 *sh2, int tcache_id)
         pending_branch_cond = (op & 0x0200) ? DCOND_EQ : DCOND_NE;
         i = ((signed int)(op << 24) >> 23);
         pending_branch_pc = pc + i + 2;
-        cycles += 2;
         goto end_op;
       }
       goto default_;
@@ -2282,10 +2359,9 @@ static void REGPARM(2) *sh2_translate(SH2 *sh2, int tcache_id)
       // MOV.W @(disp,PC),Rn  1001nnnndddddddd
       tmp = pc + (op & 0xff) * 2 + 2;
 #if PROPAGATE_CONSTANTS
-      if (tmp < end_pc + MAX_LITERAL_OFFSET) {
+      if (tmp < end_pc + MAX_LITERAL_OFFSET && literal_addr_count < MAX_LITERALS) {
+        ADD_TO_ARRAY(literal_addr, literal_addr_count, tmp,);
         gconst_new(GET_Rn(), (u32)(int)(signed short)FETCH_OP(tmp));
-        if (last_inlined_literal < tmp)
-          last_inlined_literal = tmp;
       }
       else
 #endif
@@ -2424,10 +2500,9 @@ static void REGPARM(2) *sh2_translate(SH2 *sh2, int tcache_id)
       // MOV.L @(disp,PC),Rn  1101nnnndddddddd
       tmp = (pc + (op & 0xff) * 4 + 2) & ~3;
 #if PROPAGATE_CONSTANTS
-      if (tmp < end_pc + MAX_LITERAL_OFFSET) {
+      if (tmp < end_pc + MAX_LITERAL_OFFSET && literal_addr_count < MAX_LITERALS) {
+        ADD_TO_ARRAY(literal_addr, literal_addr_count, tmp,);
         gconst_new(GET_Rn(), FETCH32(tmp));
-        if (last_inlined_literal < tmp)
-          last_inlined_literal = tmp;
       }
       else
 #endif
@@ -2451,13 +2526,6 @@ static void REGPARM(2) *sh2_translate(SH2 *sh2, int tcache_id)
     default_:
       elprintf(EL_ANOMALY, "%csh2 drc: unhandled op %04x @ %08x",
         sh2->is_slave ? 's' : 'm', op, pc - 2);
-#ifdef DRC_DEBUG_INTERP
-      emit_move_r_imm32(SHR_PC, pc - 2);
-      rcache_flush();
-      emith_pass_arg_r(0, CONTEXT_REG);
-      emith_pass_arg_imm(1, op);
-      emith_call(sh2_do_op);
-#endif
       break;
     }
 
@@ -2468,17 +2536,21 @@ end_op:
     if (pending_branch_cond != -1 && drcf.delayed_op != 2)
     {
       u32 target_pc = pending_branch_pc;
+      int ctaken = drcf.delayed_op ? 1 : 2;
       void *target;
 
       sr = rcache_get_reg(SHR_SR, RC_GR_RMW);
-      // handle cycles
       FLUSH_CYCLES(sr);
-      rcache_clean();
       if (drcf.use_saved_t)
         emith_tst_r_imm(sr, T_save);
       else
         emith_tst_r_imm(sr, T);
 
+      // handle cycles
+      emith_sub_r_imm_c(pending_branch_cond, sr, ctaken<<12);
+      rcache_clean();
+
+#if LINK_BRANCHES
       if (find_in_array(branch_target_pc, branch_target_count, target_pc) >= 0) {
         // local branch
         // XXX: jumps back can be linked already
@@ -2488,11 +2560,13 @@ end_op:
 
         branch_patch_count++;
         if (branch_patch_count == MAX_LOCAL_BRANCHES) {
-          printf("warning: too many local branches\n");
+          dbg(1, "warning: too many local branches");
           break;
         }
       }
-      else {
+      else
+#endif
+      {
         // can't resolve branch locally, make a block exit
         emit_move_r_imm32(SHR_PC, target_pc);
         rcache_clean();
@@ -2552,8 +2626,8 @@ end_op:
     t = find_in_array(branch_target_pc, branch_target_count, branch_patch_pc[i]);
     target = branch_target_ptr[t];
     if (target == NULL) {
-      // flush pc and go back to dispatcher (should no longer happen)
-      printf("stray branch to %08x %p\n", branch_patch_pc[i], tcache_ptr);
+      // flush pc and go back to dispatcher (this should no longer happen)
+      dbg(1, "stray branch to %08x %p", branch_patch_pc[i], tcache_ptr);
       target = tcache_ptr;
       emit_move_r_imm32(SHR_PC, branch_patch_pc[i]);
       rcache_flush();
@@ -2562,47 +2636,68 @@ end_op:
     emith_jump_patch(branch_patch_ptr[i], target);
   }
 
-  this_block->end_addr = pc;
-  if (last_inlined_literal > pc)
-    this_block->end_addr = last_inlined_literal + 4;
+  end_pc = pc;
 
   // mark memory blocks as containing compiled code
-  if (tcache_id != 0) {
-    // data array, BIOS
-    u16 *drcblk = Pico32xMem->drcblk_da[sh2->is_slave];
-    tmp  = (this_block->addr & 0xfff) >> SH2_DRCBLK_DA_SHIFT;
-    tmp2 = (this_block->end_addr & 0xfff) >> SH2_DRCBLK_DA_SHIFT;
-    drcblk[tmp] = (blkid_main << 1) | 1;
-    for (++tmp; tmp < tmp2; tmp++) {
-      if (drcblk[tmp])
-        continue; // dont overwrite overlay block(s)
-      drcblk[tmp] = blkid_main << 1;
+  // override any overlay blocks as they become unreachable anyway
+  if (tcache_id != 0 || (this_block->addr & 0xc7fc0000) == 0x06000000)
+  {
+    u16 *p, *drc_ram_blk = NULL;
+    u32 addr, mask = 0, shift = 0;
+
+    if (tcache_id != 0) {
+      // data array, BIOS
+      drc_ram_blk = Pico32xMem->drcblk_da[sh2->is_slave];
+      shift = SH2_DRCBLK_DA_SHIFT;
+      mask = 0xfff;
     }
-  }
-  else if ((this_block->addr & 0xc7fc0000) == 0x06000000) { // DRAM
-    tmp  = (this_block->addr & 0x3ffff) >> SH2_DRCBLK_RAM_SHIFT;
-    tmp2 = (this_block->end_addr & 0x3ffff) >> SH2_DRCBLK_RAM_SHIFT;
-    Pico32xMem->drcblk_ram[tmp] = (blkid_main << 1) | 1;
-    for (++tmp; tmp < tmp2; tmp++) {
-      if (Pico32xMem->drcblk_ram[tmp])
-        continue;
-      Pico32xMem->drcblk_ram[tmp] = blkid_main << 1;
+    else if ((this_block->addr & 0xc7fc0000) == 0x06000000) {
+      // SDRAM
+      drc_ram_blk = Pico32xMem->drcblk_ram;
+      shift = SH2_DRCBLK_RAM_SHIFT;
+      mask = 0x3ffff;
+    }
+
+    drc_ram_blk[(base_pc & mask) >> shift] = (blkid_main << 1) | 1;
+    for (pc = base_pc + 2; pc < end_pc; pc += 2) {
+      p = &drc_ram_blk[(pc & mask) >> shift];
+      *p = blkid_main << 1;
+    }
+
+    // mark block entries (used by dr_get_bd())
+    for (i = 0; i < branch_target_count; i++)
+      if (branch_target_blkid[i] != 0)
+        drc_ram_blk[(branch_target_pc[i] & mask) >> shift] =
+          (branch_target_blkid[i] << 1) | 1;
+
+    // mark literals
+    for (i = 0; i < literal_addr_count; i++) {
+      tmp = literal_addr[i];
+      p = &drc_ram_blk[(tmp & mask) >> shift];
+      *p = blkid_main << 1;
+      if (!(tmp & 3) && shift == 1)
+        p[1] = p[0]; // assume long
+    }
+
+    // add to invalidation lookup lists
+    addr = base_pc & ~(ADDR_TO_BLOCK_PAGE - 1);
+    for (; addr < end_pc + MAX_LITERAL_OFFSET; addr += ADDR_TO_BLOCK_PAGE) {
+      i = (addr & mask) / ADDR_TO_BLOCK_PAGE;
+      add_to_block_list(&inval_lookup[tcache_id][i], this_block);
     }
   }
 
   tcache_ptrs[tcache_id] = tcache_ptr;
 
-#ifdef ARM
-  cache_flush_d_inval_i(block_entry, tcache_ptr);
-#endif
+  host_instructions_updated(block_entry, tcache_ptr);
 
   do_host_disasm(tcache_id);
-  dbg(1, " block #%d,%d tcache %d/%d, insns %d -> %d %.3f",
-    tcache_id, block_counts[tcache_id],
+  dbg(2, " block #%d,%d tcache %d/%d, insns %d -> %d %.3f",
+    tcache_id, blkid_main,
     tcache_ptr - tcache_bases[tcache_id], tcache_sizes[tcache_id],
-    insns_compiled, host_insn_count, (double)host_insn_count / insns_compiled);
+    insns_compiled, host_insn_count, (float)host_insn_count / insns_compiled);
   if ((sh2->pc & 0xc6000000) == 0x02000000) // ROM
-    dbg(1, "  hash collisions %d/%d", hash_collisions, block_counts[tcache_id]);
+    dbg(2, "  hash collisions %d/%d", hash_collisions, block_counts[tcache_id]);
 /*
  printf("~~~\n");
  tcache_dsm_ptrs[tcache_id] = block_entry;
@@ -2610,7 +2705,7 @@ end_op:
  printf("~~~\n");
 */
 
-#if (DRC_DEBUG & 2)
+#if (DRC_DEBUG & 4)
   fflush(stdout);
 #endif
 
@@ -2622,6 +2717,11 @@ static void sh2_generate_utils(void)
   int arg0, arg1, arg2, sr, tmp;
   void *sh2_drc_write_end, *sh2_drc_write_slot_end;
 
+  sh2_drc_write32 = p32x_sh2_write32;
+  sh2_drc_read8  = p32x_sh2_read8;
+  sh2_drc_read16 = p32x_sh2_read16;
+  sh2_drc_read32 = p32x_sh2_read32;
+
   host_arg2reg(arg0, 0);
   host_arg2reg(arg1, 1);
   host_arg2reg(arg2, 2);
@@ -2641,7 +2741,7 @@ static void sh2_generate_utils(void)
   emith_ctx_read(arg0, SHR_PC * 4);
   emith_ctx_read(arg1, offsetof(SH2, is_slave));
   emith_add_r_r_imm(arg2, CONTEXT_REG, offsetof(SH2, drc_tmp));
-  emith_call(lookup_block);
+  emith_call(dr_lookup_block);
   emit_block_entry();
   // lookup failed, call sh2_translate()
   emith_move_r_r(arg0, CONTEXT_REG);
@@ -2656,7 +2756,7 @@ static void sh2_generate_utils(void)
   emith_call(sh2_translate);
   emit_block_entry();
   // XXX: can't translate, fail
-  emith_call(exit);
+  emith_call(dr_failure);
 
   // sh2_drc_test_irq(void)
   // assumes it's called from main function (may jump to dispatcher)
@@ -2679,7 +2779,7 @@ static void sh2_generate_utils(void)
   tmp = rcache_get_reg_arg(1, SHR_SR);
   emith_clear_msb(tmp, tmp, 22);
   emith_move_r_r(arg2, CONTEXT_REG);
-  emith_call(p32x_sh2_write32);
+  emith_call(p32x_sh2_write32); // XXX: use sh2_drc_write32?
   rcache_invalidate();
   // push PC
   rcache_get_reg_arg(0, SHR_SP);
@@ -2722,7 +2822,6 @@ static void sh2_generate_utils(void)
   EMITH_SJMP_START(DCOND_NE);
   emith_jump_ctx_c(DCOND_EQ, offsetof(SH2, drc_tmp)); // return
   EMITH_SJMP_END(DCOND_NE);
-  // since PC is up to date, jump to it's block instead of returning
   emith_call(sh2_drc_test_irq);
   emith_jump_ctx(offsetof(SH2, drc_tmp));
 
@@ -2763,8 +2862,52 @@ static void sh2_generate_utils(void)
   emith_ctx_read(arg2, offsetof(SH2, write16_tab));
   emith_sh2_wcall(arg0, arg2, sh2_drc_write_slot_end);
 
+#ifdef PDB_NET
+  // debug
+  #define MAKE_READ_WRAPPER(func) { \
+    void *tmp = (void *)tcache_ptr; \
+    emith_push_ret(); \
+    emith_call(func); \
+    emith_ctx_read(arg2, offsetof(SH2, pdb_io_csum[0]));  \
+    emith_addf_r_r(arg2, arg0);                           \
+    emith_ctx_write(arg2, offsetof(SH2, pdb_io_csum[0])); \
+    emith_ctx_read(arg2, offsetof(SH2, pdb_io_csum[1]));  \
+    emith_adc_r_imm(arg2, 0x01000000);                    \
+    emith_ctx_write(arg2, offsetof(SH2, pdb_io_csum[1])); \
+    emith_pop_and_ret(); \
+    func = tmp; \
+  }
+  #define MAKE_WRITE_WRAPPER(func) { \
+    void *tmp = (void *)tcache_ptr; \
+    emith_ctx_read(arg2, offsetof(SH2, pdb_io_csum[0]));  \
+    emith_addf_r_r(arg2, arg1);                           \
+    emith_ctx_write(arg2, offsetof(SH2, pdb_io_csum[0])); \
+    emith_ctx_read(arg2, offsetof(SH2, pdb_io_csum[1]));  \
+    emith_adc_r_imm(arg2, 0x01000000);                    \
+    emith_ctx_write(arg2, offsetof(SH2, pdb_io_csum[1])); \
+    emith_move_r_r(arg2, CONTEXT_REG);                    \
+    emith_jump(func); \
+    func = tmp; \
+  }
+
+  MAKE_READ_WRAPPER(sh2_drc_read8);
+  MAKE_READ_WRAPPER(sh2_drc_read16);
+  MAKE_READ_WRAPPER(sh2_drc_read32);
+  MAKE_WRITE_WRAPPER(sh2_drc_write8);
+  MAKE_WRITE_WRAPPER(sh2_drc_write8_slot);
+  MAKE_WRITE_WRAPPER(sh2_drc_write16);
+  MAKE_WRITE_WRAPPER(sh2_drc_write16_slot);
+  MAKE_WRITE_WRAPPER(sh2_drc_write32);
+#if (DRC_DEBUG & 4)
+  host_dasm_new_symbol(sh2_drc_read8);
+  host_dasm_new_symbol(sh2_drc_read16);
+  host_dasm_new_symbol(sh2_drc_read32);
+  host_dasm_new_symbol(sh2_drc_write32);
+#endif
+#endif
+
   rcache_invalidate();
-#if (DRC_DEBUG & 2)
+#if (DRC_DEBUG & 4)
   host_dasm_new_symbol(sh2_drc_entry);
   host_dasm_new_symbol(sh2_drc_dispatcher);
   host_dasm_new_symbol(sh2_drc_exit);
@@ -2778,60 +2921,96 @@ static void sh2_generate_utils(void)
 #endif
 }
 
-static void sh2_smc_rm_block(u16 *drcblk, u16 *p, block_desc *btab, u32 a)
+static void sh2_smc_rm_block_entry(struct block_desc *bd, int tcache_id, u32 ram_mask)
 {
-  u16 id = *p >> 1;
-  block_desc *bd = btab + id;
+  void *tmp;
+  u32 i, addr;
+
+  // XXX: kill links somehow?
+  dbg(2, "  killing entry %08x-%08x, blkid %d,%d",
+    bd->addr, bd->end_addr, tcache_id, bd - block_tables[tcache_id]);
+  if (bd->addr == 0 || bd->tcache_ptr == NULL) {
+    dbg(1, "  killing dead block!? %08x", bd->addr);
+    return;
+  }
 
-  // FIXME: skip subblocks; do both directions
-  // FIXME: collect all branches
-  dbg(1, "  killing block %08x", bd->addr);
-  bd->addr = bd->end_addr = 0;
+  // remove from inval_lookup
+  addr = bd->addr & ~(ADDR_TO_BLOCK_PAGE - 1);
+  for (; addr < bd->end_addr; addr += ADDR_TO_BLOCK_PAGE) {
+    i = (addr & ram_mask) / ADDR_TO_BLOCK_PAGE;
+    rm_from_block_list(&inval_lookup[tcache_id][i], bd);
+  }
 
-  while (p > drcblk && (p[-1] >> 1) == id)
-    p--;
+  // since we never reuse space of dead blocks,
+  // insert jump to dispatcher for blocks that are linked to this point
+  //emith_jump_at(bd->tcache_ptr, sh2_drc_dispatcher);
 
-  // check for possible overlay block
-  if (p > 0 && p[-1] != 0) {
-    bd = btab + (p[-1] >> 1);
-    if (bd->addr <= a && a < bd->end_addr)
-      sh2_smc_rm_block(drcblk, p - 1, btab, a);
+  // attempt to handle self-modifying blocks by exiting at nearest known PC
+  tmp = tcache_ptr;
+  tcache_ptr = bd->tcache_ptr;
+  emit_move_r_imm32(SHR_PC, bd->addr);
+  rcache_flush();
+  emith_jump(sh2_drc_dispatcher);
+
+  host_instructions_updated(bd->tcache_ptr, tcache_ptr);
+  tcache_ptr = tmp;
+
+  bd->addr = bd->end_addr = 0;
+}
+
+static void sh2_smc_rm_block(u32 a, u16 *drc_ram_blk, int tcache_id, u32 shift, u32 mask)
+{
+  struct block_list **blist = NULL, *entry;
+  u32 from = ~0, to = 0;
+  struct block_desc *block;
+
+  blist = &inval_lookup[tcache_id][(a & mask) / ADDR_TO_BLOCK_PAGE];
+  entry = *blist;
+  while (entry != NULL) {
+    block = entry->block;
+    if (block->addr <= a && a < block->end_addr) {
+      if (block->addr < from)
+        from = block->addr;
+      if (block->end_addr > to)
+        to = block->end_addr;
+
+      sh2_smc_rm_block_entry(block, tcache_id, mask);
+
+      // entry lost, restart search
+      entry = *blist;
+      continue;
+    }
+    entry = entry->next;
   }
 
-  do {
-    *p++ = 0;
+  // clear entry points
+  if (from < to) {
+    u16 *p = drc_ram_blk + ((from & mask) >> shift);
+    memset(p, 0, (to - from) >> (shift - 1));
   }
-  while ((*p >> 1) == id);
 }
 
 void sh2_drc_wcheck_ram(unsigned int a, int val, int cpuid)
 {
-  u16 *drcblk = Pico32xMem->drcblk_ram;
-  u16 *p = drcblk + ((a & 0x3ffff) >> SH2_DRCBLK_RAM_SHIFT);
-
-  dbg(1, "%csh2 smc check @%08x", cpuid ? 's' : 'm', a);
-  sh2_smc_rm_block(drcblk, p, block_tables[0], a);
+  dbg(2, "%csh2 smc check @%08x", cpuid ? 's' : 'm', a);
+  sh2_smc_rm_block(a, Pico32xMem->drcblk_ram, 0, SH2_DRCBLK_RAM_SHIFT, 0x3ffff);
 }
 
 void sh2_drc_wcheck_da(unsigned int a, int val, int cpuid)
 {
-  u16 *drcblk = Pico32xMem->drcblk_da[cpuid];
-  u16 *p = drcblk + ((a & 0xfff) >> SH2_DRCBLK_DA_SHIFT);
-
-  dbg(1, "%csh2 smc check @%08x", cpuid ? 's' : 'm', a);
-  sh2_smc_rm_block(drcblk, p, block_tables[1 + cpuid], a);
+  dbg(2, "%csh2 smc check @%08x", cpuid ? 's' : 'm', a);
+  sh2_smc_rm_block(a, Pico32xMem->drcblk_da[cpuid],
+    1 + cpuid, SH2_DRCBLK_DA_SHIFT, 0xfff);
 }
 
-void sh2_execute(SH2 *sh2c, int cycles)
+int sh2_execute(SH2 *sh2c, int cycles)
 {
   int ret_cycles;
-  sh2 = sh2c; // XXX
 
-  sh2c->cycles_aim += cycles;
-  cycles = sh2c->cycles_aim - sh2c->cycles_done;
+  sh2c->cycles_timeslice = cycles;
 
   // cycles are kept in SHR_SR unused bits (upper 20)
-  // bit19 contains T saved for delay slot
+  // bit11 contains T saved for delay slot
   // others are usual SH2 flags
   sh2c->sr &= 0x3f3;
   sh2c->sr |= cycles << 12;
@@ -2840,12 +3019,12 @@ void sh2_execute(SH2 *sh2c, int cycles)
   // TODO: irq cycles
   ret_cycles = (signed int)sh2c->sr >> 12;
   if (ret_cycles > 0)
-    printf("warning: drc returned with cycles: %d\n", ret_cycles);
+    dbg(1, "warning: drc returned with cycles: %d", ret_cycles);
 
-  sh2c->cycles_done += cycles - ret_cycles;
+  return sh2c->cycles_timeslice - ret_cycles;
 }
 
-#if (DRC_DEBUG & 1)
+#if (DRC_DEBUG & 2)
 void block_stats(void)
 {
   int c, b, i, total = 0;
@@ -2857,7 +3036,7 @@ void block_stats(void)
         total += block_tables[b][i].refcount;
 
   for (c = 0; c < 10; c++) {
-    block_desc *blk, *maxb = NULL;
+    struct block_desc *blk, *maxb = NULL;
     int max = 0;
     for (b = 0; b < ARRAY_SIZE(block_tables); b++) {
       for (i = 0; i < block_counts[b]; i++) {
@@ -2914,6 +3093,11 @@ int sh2_drc_init(SH2 *sh2)
       block_links[i] = calloc(block_max_counts[i] * 2, sizeof(*block_links[0]));
       if (block_links[i] == NULL)
         goto fail;
+
+      inval_lookup[i] = calloc(ram_sizes[i] / ADDR_TO_BLOCK_PAGE,
+                               sizeof(inval_lookup[0]));
+      if (inval_lookup[i] == NULL)
+        goto fail;
     }
     memset(block_counts, 0, sizeof(block_counts));
     memset(block_link_counts, 0, sizeof(block_link_counts));
@@ -2921,9 +3105,7 @@ int sh2_drc_init(SH2 *sh2)
     drc_cmn_init();
     tcache_ptr = tcache;
     sh2_generate_utils();
-#ifdef ARM
-    cache_flush_d_inval_i(tcache, tcache_ptr);
-#endif
+    host_instructions_updated(tcache, tcache_ptr);
 
     tcache_bases[0] = tcache_ptrs[0] = tcache_ptr;
     for (i = 1; i < ARRAY_SIZE(tcache_bases); i++)
@@ -2932,7 +3114,7 @@ int sh2_drc_init(SH2 *sh2)
     // tmp
     PicoOpt |= POPT_DIS_VDP_FIFO;
 
-#if (DRC_DEBUG & 2)
+#if (DRC_DEBUG & 4)
     for (i = 0; i < ARRAY_SIZE(block_tables); i++)
       tcache_dsm_ptrs[i] = tcache_bases[i];
     // disasm the utils
@@ -2961,11 +3143,13 @@ void sh2_drc_finish(SH2 *sh2)
 {
   int i;
 
+  sh2_drc_flush_all();
+
   if (block_tables[0] != NULL) {
     block_stats();
 
     for (i = 0; i < TCACHE_BUFFERS; i++) {
-#if (DRC_DEBUG & 2)
+#if (DRC_DEBUG & 4)
       printf("~~~ tcache %d\n", i);
       tcache_dsm_ptrs[i] = tcache_bases[i];
       tcache_ptr = tcache_ptrs[i];
@@ -2978,6 +3162,10 @@ void sh2_drc_finish(SH2 *sh2)
       if (block_links[i] == NULL)
         free(block_links[i]);
       block_links[i] = NULL;
+
+      if (inval_lookup[i] == NULL)
+        free(inval_lookup[i]);
+      inval_lookup[i] = NULL;
     }
 
     drc_cmn_cleanup();
@@ -2988,3 +3176,91 @@ void sh2_drc_finish(SH2 *sh2)
     hash_table = NULL;
   }
 }
+
+#endif /* DRC_SH2 */
+
+static void *dr_get_pc_base(u32 pc, int is_slave)
+{
+  void *ret = NULL;
+  u32 mask = 0;
+
+  if ((pc & ~0x7ff) == 0) {
+    // BIOS
+    ret = is_slave ? Pico32xMem->sh2_rom_s : Pico32xMem->sh2_rom_m;
+    mask = 0x7ff;
+  }
+  else if ((pc & 0xfffff000) == 0xc0000000) {
+    // data array
+    ret = Pico32xMem->data_array[is_slave];
+    mask = 0xfff;
+  }
+  else if ((pc & 0xc6000000) == 0x06000000) {
+    // SDRAM
+    ret = Pico32xMem->sdram;
+    mask = 0x03ffff;
+  }
+  else if ((pc & 0xc6000000) == 0x02000000) {
+    // ROM
+    ret = Pico.rom;
+    mask = 0x3fffff;
+  }
+
+  if (ret == NULL)
+    return (void *)-1; // NULL is valid value
+
+  return (char *)ret - (pc & ~mask);
+}
+
+void scan_block(u32 base_pc, int is_slave, u8 *op_flags, u32 *end_pc)
+{
+  u16 *dr_pc_base;
+  u32 pc, target, op;
+  int cycles;
+
+  memset(op_flags, 0, BLOCK_INSN_LIMIT);
+
+  dr_pc_base = dr_get_pc_base(base_pc, is_slave);
+
+  for (cycles = 0, pc = base_pc; cycles < BLOCK_INSN_LIMIT-1; cycles++, pc += 2) {
+    op = FETCH_OP(pc);
+    if ((op & 0xf000) == 0xa000 || (op & 0xf000) == 0xb000) { // BRA, BSR
+      signed int offs = ((signed int)(op << 20) >> 19);
+      pc += 2;
+      OP_FLAGS(pc) |= OF_DELAY_OP;
+      target = pc + offs + 2;
+      if (base_pc <= target && target < base_pc + BLOCK_INSN_LIMIT * 2)
+        OP_FLAGS(target) |= OF_BTARGET;
+      break;
+    }
+    if ((op & 0xf000) == 0) {
+      op &= 0xff;
+      if (op == 0x1b) // SLEEP
+        break;
+      // BRAF, BSRF, RTS, RTE
+      if (op == 0x23 || op == 0x03 || op == 0x0b || op == 0x2b) {
+        pc += 2;
+        OP_FLAGS(pc) |= OF_DELAY_OP;
+        break;
+      }
+      continue;
+    }
+    if ((op & 0xf0df) == 0x400b) { // JMP, JSR
+      pc += 2;
+      OP_FLAGS(pc) |= OF_DELAY_OP;
+      break;
+    }
+    if ((op & 0xf900) == 0x8900) { // BT(S), BF(S)
+      signed int offs = ((signed int)(op << 24) >> 23);
+      if (op & 0x0400)
+        OP_FLAGS(pc + 2) |= OF_DELAY_OP;
+      target = pc + offs + 4;
+      if (base_pc <= target && target < base_pc + BLOCK_INSN_LIMIT * 2)
+        OP_FLAGS(target) |= OF_BTARGET;
+    }
+    if ((op & 0xff00) == 0xc300) // TRAPA
+      break;
+  }
+  *end_pc = pc;
+}
+
+// vim:shiftwidth=2:ts=2:expandtab