X-Git-Url: https://notaz.gp2x.de/cgi-bin/gitweb.cgi?a=blobdiff_plain;f=pico%2F32x%2Fmemory.c;h=6d6bbb76eb9c6bcfd8eee11b53f6d5b2087de47b;hb=df63f1a6ff674808e641b67e3e60027b1e05c781;hp=531a286aa1cb0cd28f52cd6144a2fee6f5379008;hpb=a8fd6e376175c06e2423d0914359c761829d6e93;p=picodrive.git

diff --git a/pico/32x/memory.c b/pico/32x/memory.c
index 531a286..6d6bbb7 100644
--- a/pico/32x/memory.c
+++ b/pico/32x/memory.c
@@ -1,13 +1,10 @@
 /*
  * PicoDrive
- * (C) notaz, 2009,2010
+ * (C) notaz, 2009,2010,2013
  *
  * This work is licensed under the terms of MAME license.
  * See COPYING file in the top-level directory.
  *
- * SH2 addr lines:
- * iii. .cc. ..xx *   // Internal, Cs, x
- *
  * Register map:
  * a15100 F....... R.....EA  F.....AC N...VHMP 4000 // Fm Ren nrEs Aden Cart heN V H cMd Pwm
  * a15102 ........ ......SM  ?                 4002 // intS intM
@@ -25,19 +22,25 @@
  * a1511e ?                  ?                 401e
  * a15120            (16 bytes comm)           2020
  * a15130                 (PWM)                2030
+ *
+ * SH2 addr lines:
+ * iii. .cc. ..xx *   // Internal, Cs, x
+ *
+ * sh2 map, wait/bus cycles (from docs):
+ *                             r    w
+ * rom      0000000-0003fff    1    -
+ * sys reg  0004000-00040ff    1    1
+ * vdp reg  0004100-00041ff    5    5
+ * vdp pal  0004200-00043ff    5    5
+ * rom      2000000-23fffff     6-15
+ * dram/fb  4000000-401ffff 5-12  1-3
+ * fb ovr   4020000-403ffff
+ * sdram    6000000-603ffff   12    2  (cycles)
+ * d.a.    c0000000-?
  */
 #include "../pico_int.h"
 #include "../memory.h"
-#ifdef DRC_SH2
 #include "../../cpu/sh2/compiler.h"
-#endif
-
-#if 0
-#undef ash2_end_run
-#undef SekEndRun
-#define ash2_end_run(x)
-#define SekEndRun(x)
-#endif
 
 static const char str_mars[] = "MARS";
 
@@ -47,70 +50,102 @@ struct Pico32xMem *Pico32xMem;
 static void bank_switch(int b);
 
 // poll detection
-#define POLL_THRESHOLD 6
+#define POLL_THRESHOLD 3
 
-struct poll_det {
-  u32 addr, cycles, cyc_max;
-  int cnt, flag;
-};
-static struct poll_det m68k_poll, sh2_poll[2];
+static struct {
+  u32 addr, cycles;
+  int cnt;
+} m68k_poll;
 
-static int p32x_poll_detect(struct poll_det *pd, u32 a, u32 cycles, int is_vdp)
+static int m68k_poll_detect(u32 a, u32 cycles, u32 flags)
 {
-  int ret = 0, flag = pd->flag;
-
-  if (is_vdp)
-    flag <<= 3;
-
-  if (a - 2 <= pd->addr && pd->addr <= a + 2 && cycles - pd->cycles <= pd->cyc_max) {
-    pd->cnt++;
-    if (pd->cnt > POLL_THRESHOLD) {
-      if (!(Pico32x.emu_flags & flag)) {
-        elprintf(EL_32X, "%s poll addr %08x, cyc %u",
-          flag & (P32XF_68KPOLL|P32XF_68KVPOLL) ? "m68k" :
-          (flag & (P32XF_MSH2POLL|P32XF_MSH2VPOLL) ? "msh2" : "ssh2"), a, cycles - pd->cycles);
+  int ret = 0;
+
+  if (a - 2 <= m68k_poll.addr && m68k_poll.addr <= a + 2
+    && cycles - m68k_poll.cycles <= 64)
+  {
+    if (m68k_poll.cnt++ > POLL_THRESHOLD) {
+      if (!(Pico32x.emu_flags & flags)) {
+        elprintf(EL_32X, "m68k poll addr %08x, cyc %u",
+          a, cycles - m68k_poll.cycles);
         ret = 1;
       }
-      Pico32x.emu_flags |= flag;
+      Pico32x.emu_flags |= flags;
     }
   }
   else {
-    pd->cnt = 0;
-    pd->addr = a;
+    m68k_poll.cnt = 0;
+    m68k_poll.addr = a;
   }
-  pd->cycles = cycles;
+  m68k_poll.cycles = cycles;
 
   return ret;
 }
 
-static int p32x_poll_undetect(struct poll_det *pd, int is_vdp)
+void p32x_m68k_poll_event(u32 flags)
 {
-  int ret = 0, flag = pd->flag;
-  if (is_vdp)
-    flag <<= 3; // VDP only
+  if (Pico32x.emu_flags & flags) {
+    elprintf(EL_32X, "m68k poll %02x -> %02x", Pico32x.emu_flags,
+      Pico32x.emu_flags & ~flags);
+    Pico32x.emu_flags &= ~flags;
+    SekSetStop(0);
+  }
+  m68k_poll.addr = m68k_poll.cnt = 0;
+}
+
+static void sh2_poll_detect(SH2 *sh2, u32 a, u32 flags)
+{
+  int cycles_left = sh2_cycles_left(sh2);
+
+  if (a == sh2->poll_addr && sh2->poll_cycles - cycles_left <= 10) {
+    if (sh2->poll_cnt++ > 3) {
+      if (!(sh2->state & flags))
+        elprintf(EL_32X, "%csh2 state: %02x->%02x", sh2->is_slave?'s':'m',
+          sh2->state, sh2->state | flags);
+
+      sh2->state |= flags;
+      sh2_end_run(sh2, 1);
+      pevt_log_sh2(sh2, EVT_POLL_START);
+      return;
+    }
+  }
   else
-    flag |= flag << 3; // both
-  if (Pico32x.emu_flags & flag) {
-    elprintf(EL_32X, "poll %02x -> %02x", Pico32x.emu_flags, Pico32x.emu_flags & ~flag);
-    ret = 1;
+    sh2->poll_cnt = 0;
+  sh2->poll_addr = a;
+  sh2->poll_cycles = cycles_left;
+}
+
+void p32x_sh2_poll_event(SH2 *sh2, u32 flags, u32 m68k_cycles)
+{
+  if (sh2->state & flags) {
+    elprintf(EL_32X, "%csh2 state: %02x->%02x", sh2->is_slave?'s':'m',
+      sh2->state, sh2->state & ~flags);
+
+    if (sh2->m68krcycles_done < m68k_cycles)
+      sh2->m68krcycles_done = m68k_cycles;
+
+    pevt_log_sh2_o(sh2, EVT_POLL_END);
   }
-  Pico32x.emu_flags &= ~flag;
-  pd->addr = pd->cnt = 0;
-  return ret;
+
+  sh2->state &= ~flags;
+  sh2->poll_addr = sh2->poll_cycles = sh2->poll_cnt = 0;
 }
 
-void p32x_poll_event(int cpu_mask, int is_vdp)
+static void sh2s_sync_on_read(SH2 *sh2)
 {
-  if (cpu_mask & 1)
-    p32x_poll_undetect(&sh2_poll[0], is_vdp);
-  if (cpu_mask & 2)
-    p32x_poll_undetect(&sh2_poll[1], is_vdp);
+  int cycles;
+  if (sh2->poll_cnt != 0)
+    return;
+
+  cycles = sh2_cycles_done(sh2);
+  if (cycles > 600)
+    p32x_sync_other_sh2(sh2, sh2->m68krcycles_done + cycles / 3);
 }
 
 // SH2 faking
 //#define FAKE_SH2
-int p32x_csum_faked;
 #ifdef FAKE_SH2
+static int p32x_csum_faked;
 static const u16 comm_fakevals[] = {
   0x4d5f, 0x4f4b, // M_OK
   0x535f, 0x4f4b, // S_OK
@@ -137,43 +172,210 @@ static u32 sh2_comm_faker(u32 a)
 #endif
 
 // DMAC handling
-static struct {
-  unsigned int sar0, dar0, tcr0; // src addr, dst addr, transfer count
-  unsigned int chcr0; // chan ctl
-  unsigned int sar1, dar1, tcr1; // same for chan 1
-  unsigned int chcr1;
-  int pad[4];
+struct dma_chan {
+  unsigned int sar, dar;  // src, dst addr
+  unsigned int tcr;       // transfer count
+  unsigned int chcr;      // chan ctl
+  // -- dm dm sm sm  ts ts ar am  al ds dl tb  ta ie te de
+  // ts - transfer size: 1, 2, 4, 16 bytes
+  // ar - auto request if 1, else dreq signal
+  // ie - irq enable
+  // te - transfer end
+  // de - dma enable
+  #define DMA_AR (1 << 9)
+  #define DMA_IE (1 << 2)
+  #define DMA_TE (1 << 1)
+  #define DMA_DE (1 << 0)
+};
+
+struct dmac {
+  struct dma_chan chan[2];
+  unsigned int vcrdma0;
+  unsigned int unknown0;
+  unsigned int vcrdma1;
+  unsigned int unknown1;
   unsigned int dmaor;
-} * dmac0;
+  // -- pr ae nmif dme
+  // pr - priority: chan0 > chan1 or round-robin
+  // ae - address error
+  // nmif - nmi occurred
+  // dme - DMA master enable
+  #define DMA_DME  (1 << 0)
+};
+
+static void dmac_te_irq(SH2 *sh2, struct dma_chan *chan)
+{
+  char *regs = (void *)Pico32xMem->sh2_peri_regs[sh2->is_slave];
+  struct dmac *dmac = (void *)(regs + 0x180);
+  int level = PREG8(regs, 0xe2) & 0x0f; // IPRA
+  int vector = (chan == &dmac->chan[0]) ?
+               dmac->vcrdma0 : dmac->vcrdma1;
+
+  elprintf(EL_32X, "dmac irq %d %d", level, vector);
+  sh2_internal_irq(sh2, level, vector & 0x7f);
+}
+
+static void dmac_transfer_complete(SH2 *sh2, struct dma_chan *chan)
+{
+  chan->chcr |= DMA_TE; // DMA has ended normally
+
+  p32x_sh2_poll_event(sh2, SH2_STATE_SLEEP, SekCyclesDoneT());
+  if (chan->chcr & DMA_IE)
+    dmac_te_irq(sh2, chan);
+}
+
+static void dmac_transfer_one(SH2 *sh2, struct dma_chan *chan)
+{
+  u32 size, d;
+
+  size = (chan->chcr >> 10) & 3;
+  switch (size) {
+  case 0:
+    d = p32x_sh2_read8(chan->sar, sh2);
+    p32x_sh2_write8(chan->dar, d, sh2);
+  case 1:
+    d = p32x_sh2_read16(chan->sar, sh2);
+    p32x_sh2_write16(chan->dar, d, sh2);
+    break;
+  case 2:
+    d = p32x_sh2_read32(chan->sar, sh2);
+    p32x_sh2_write32(chan->dar, d, sh2);
+    break;
+  case 3:
+    elprintf(EL_32X|EL_ANOMALY, "TODO: 16byte DMA");
+    chan->sar += 16; // always?
+    chan->tcr -= 4;
+    return;
+  }
+  chan->tcr--;
+
+  size = 1 << size;
+  if (chan->chcr & (1 << 15))
+    chan->dar -= size;
+  if (chan->chcr & (1 << 14))
+    chan->dar += size;
+  if (chan->chcr & (1 << 13))
+    chan->sar -= size;
+  if (chan->chcr & (1 << 12))
+    chan->sar += size;
+}
 
-static void dma_68k2sh2_do(void)
+static void dreq0_do(SH2 *sh2, struct dma_chan *chan)
 {
   unsigned short *dreqlen = &Pico32x.regs[0x10 / 2];
   int i;
 
-  if (dmac0->tcr0 != *dreqlen)
-    elprintf(EL_32X|EL_ANOMALY, "tcr0 and dreq len differ: %d != %d", dmac0->tcr0, *dreqlen);
+  // debug/sanity checks
+  if (chan->tcr != *dreqlen)
+    elprintf(EL_32X|EL_ANOMALY, "dreq0: tcr0 and len differ: %d != %d",
+      chan->tcr, *dreqlen);
+  // note: DACK is not connected, single addr mode should not be used
+  if ((chan->chcr & 0x3f08) != 0x0400)
+    elprintf(EL_32X|EL_ANOMALY, "dreq0: bad control: %04x", chan->chcr);
+  if (chan->sar != 0x20004012)
+    elprintf(EL_32X|EL_ANOMALY, "dreq0: bad sar?: %08x\n", chan->sar);
 
   // HACK: assume bus is busy and SH2 is halted
-  // XXX: use different mechanism for this, not poll det
-  Pico32x.emu_flags |= P32XF_MSH2POLL; // id ? P32XF_SSH2POLL : P32XF_MSH2POLL;
-
-  for (i = 0; i < Pico32x.dmac_ptr && dmac0->tcr0 > 0; i++) {
-    elprintf(EL_32X, "dmaw [%08x] %04x, left %d", dmac0->dar0, Pico32x.dmac_fifo[i], *dreqlen);
-    p32x_sh2_write16(dmac0->dar0, Pico32x.dmac_fifo[i], &msh2);
-    dmac0->dar0 += 2;
-    dmac0->tcr0--;
+  sh2->state |= SH2_STATE_SLEEP;
+
+  for (i = 0; i < Pico32x.dmac0_fifo_ptr && chan->tcr > 0; i++) {
+    elprintf(EL_32X, "dmaw [%08x] %04x, left %d",
+      chan->dar, Pico32x.dmac_fifo[i], *dreqlen);
+    p32x_sh2_write16(chan->dar, Pico32x.dmac_fifo[i], sh2);
+    chan->dar += 2;
+    chan->tcr--;
     (*dreqlen)--;
   }
 
-  Pico32x.dmac_ptr = 0; // HACK
+  if (Pico32x.dmac0_fifo_ptr != i)
+    memmove(Pico32x.dmac_fifo, &Pico32x.dmac_fifo[i],
+      (Pico32x.dmac0_fifo_ptr - i) * 2);
+  Pico32x.dmac0_fifo_ptr -= i;
+
   Pico32x.regs[6 / 2] &= ~P32XS_FULL;
   if (*dreqlen == 0)
     Pico32x.regs[6 / 2] &= ~P32XS_68S; // transfer complete
-  if (dmac0->tcr0 == 0) {
-    dmac0->chcr0 |= 2; // DMA has ended normally
-    p32x_poll_undetect(&sh2_poll[0], 0);
+  if (chan->tcr == 0)
+    dmac_transfer_complete(sh2, chan);
+  else
+    sh2_end_run(sh2, 16);
+}
+
+static void dreq1_do(SH2 *sh2, struct dma_chan *chan)
+{
+  // debug/sanity checks
+  if ((chan->chcr & 0xc308) != 0x0000)
+    elprintf(EL_32X|EL_ANOMALY, "dreq1: bad control: %04x", chan->chcr);
+  if ((chan->dar & ~0xf) != 0x20004030)
+    elprintf(EL_32X|EL_ANOMALY, "dreq1: bad dar?: %08x\n", chan->dar);
+
+  dmac_transfer_one(sh2, chan);
+  if (chan->tcr == 0)
+    dmac_transfer_complete(sh2, chan);
+}
+
+static void dreq0_trigger(void)
+{
+  struct dmac *mdmac = (void *)&Pico32xMem->sh2_peri_regs[0][0x180 / 4];
+  struct dmac *sdmac = (void *)&Pico32xMem->sh2_peri_regs[1][0x180 / 4];
+
+  elprintf(EL_32X, "dreq0_trigger\n");
+  if ((mdmac->dmaor & DMA_DME) && (mdmac->chan[0].chcr & 3) == DMA_DE) {
+    dreq0_do(&msh2, &mdmac->chan[0]);
+  }
+  if ((sdmac->dmaor & DMA_DME) && (sdmac->chan[0].chcr & 3) == DMA_DE) {
+    dreq0_do(&ssh2, &sdmac->chan[0]);
+  }
+}
+
+void p32x_dreq1_trigger(void)
+{
+  struct dmac *mdmac = (void *)&Pico32xMem->sh2_peri_regs[0][0x180 / 4];
+  struct dmac *sdmac = (void *)&Pico32xMem->sh2_peri_regs[1][0x180 / 4];
+  int hit = 0;
+
+  elprintf(EL_32X, "dreq1_trigger\n");
+  if ((mdmac->dmaor & DMA_DME) && (mdmac->chan[1].chcr & 3) == DMA_DE) {
+    dreq1_do(&msh2, &mdmac->chan[1]);
+    hit = 1;
+  }
+  if ((sdmac->dmaor & DMA_DME) && (sdmac->chan[1].chcr & 3) == DMA_DE) {
+    dreq1_do(&ssh2, &sdmac->chan[1]);
+    hit = 1;
+  }
+
+  if (!hit)
+    elprintf(EL_32X|EL_ANOMALY, "dreq1: nobody cared");
+}
+
+// DMA trigger by SH2 register write
+static void dmac_trigger(SH2 *sh2, struct dma_chan *chan)
+{
+  elprintf(EL_32X, "sh2 DMA %08x->%08x, cnt %d, chcr %04x @%06x",
+    chan->sar, chan->dar, chan->tcr, chan->chcr, sh2->pc);
+  chan->tcr &= 0xffffff;
+
+  if (chan->chcr & DMA_AR) {
+    // auto-request transfer
+    while ((int)chan->tcr > 0)
+      dmac_transfer_one(sh2, chan);
+    dmac_transfer_complete(sh2, chan);
+    return;
   }
+
+  // DREQ0 is only sent after first 4 words are written.
+  // we do multiple of 4 words to avoid messing up alignment
+  if (chan->sar == 0x20004012) {
+    if (Pico32x.dmac0_fifo_ptr && (Pico32x.dmac0_fifo_ptr & 3) == 0) {
+      elprintf(EL_32X, "68k -> sh2 DMA");
+      dreq0_trigger();
+    }
+    return;
+  }
+
+  elprintf(EL_32X|EL_ANOMALY, "unhandled DMA: "
+    "%08x->%08x, cnt %d, chcr %04x @%06x",
+    chan->sar, chan->dar, chan->tcr, chan->chcr, sh2->pc);
 }
 
 // ------------------------------------------------------------------
@@ -201,7 +403,7 @@ static u32 p32x_reg_read16(u32 a)
       p32x_sync_sh2s(cycles);
     if (Pico32x.comm_dirty_sh2 & comreg)
       Pico32x.comm_dirty_sh2 &= ~comreg;
-    else if (p32x_poll_detect(&m68k_poll, a, cycles, 0)) {
+    else if (m68k_poll_detect(a, cycles, P32XF_68KCPOLL)) {
       SekSetStop(1);
       SekEndTimeslice(16);
     }
@@ -218,7 +420,7 @@ static u32 p32x_reg_read16(u32 a)
   }
 
   if ((a & 0x30) == 0x30)
-    return p32x_pwm_read16(a);
+    return p32x_pwm_read16(a, SekCyclesDoneT());
 
 out:
   return Pico32x.regs[a / 2];
@@ -245,12 +447,12 @@ static void p32x_reg_write8(u32 a, u32 d)
       if ((d & 1) && !(Pico32x.sh2irqi[0] & P32XI_CMD)) {
         p32x_sync_sh2s(SekCyclesDoneT());
         Pico32x.sh2irqi[0] |= P32XI_CMD;
-        p32x_update_irls(0);
+        p32x_update_irls(NULL);
       }
       if ((d & 2) && !(Pico32x.sh2irqi[1] & P32XI_CMD)) {
         p32x_sync_sh2s(SekCyclesDoneT());
         Pico32x.sh2irqi[1] |= P32XI_CMD;
-        p32x_update_irls(0);
+        p32x_update_irls(NULL);
       }
       return;
     case 5: // bank
@@ -275,14 +477,14 @@ static void p32x_reg_write8(u32 a, u32 d)
     
     if (r8[a ^ 1] == d)
       return;
-    
+
     comreg = 1 << (a & 0x0f) / 2;
     if (Pico32x.comm_dirty_68k & comreg)
       p32x_sync_sh2s(cycles);
 
     r8[a ^ 1] = d;
-    p32x_poll_undetect(&sh2_poll[0], 0);
-    p32x_poll_undetect(&sh2_poll[1], 0);
+    p32x_sh2_poll_event(&sh2s[0], SH2_STATE_CPOLL, cycles);
+    p32x_sh2_poll_event(&sh2s[1], SH2_STATE_CPOLL, cycles);
     Pico32x.comm_dirty_68k |= comreg;
 
     if (cycles - (int)msh2.m68krcycles_done > 120)
@@ -311,13 +513,13 @@ static void p32x_reg_write16(u32 a, u32 d)
     case 0x12: // FIFO reg
       if (!(r[6 / 2] & P32XS_68S)) {
         elprintf(EL_32X|EL_ANOMALY, "DREQ FIFO w16 without 68S?");
-	return;
+        return;
       }
-      if (Pico32x.dmac_ptr < DMAC_FIFO_LEN) {
-        Pico32x.dmac_fifo[Pico32x.dmac_ptr++] = d;
-        if ((Pico32x.dmac_ptr & 3) == 0 && (dmac0->chcr0 & 3) == 1 && (dmac0->dmaor & 1))
-          dma_68k2sh2_do();
-        if (Pico32x.dmac_ptr == DMAC_FIFO_LEN)
+      if (Pico32x.dmac0_fifo_ptr < DMAC_FIFO_LEN) {
+        Pico32x.dmac_fifo[Pico32x.dmac0_fifo_ptr++] = d;
+        if ((Pico32x.dmac0_fifo_ptr & 3) == 0)
+          dreq0_trigger();
+        if (Pico32x.dmac0_fifo_ptr == DMAC_FIFO_LEN)
           r[6 / 2] |= P32XS_FULL;
       }
       break;
@@ -341,8 +543,8 @@ static void p32x_reg_write16(u32 a, u32 d)
       p32x_sync_sh2s(cycles);
 
     r[a / 2] = d;
-    p32x_poll_undetect(&sh2_poll[0], 0);
-    p32x_poll_undetect(&sh2_poll[1], 0);
+    p32x_sh2_poll_event(&sh2s[0], SH2_STATE_CPOLL, cycles);
+    p32x_sh2_poll_event(&sh2s[1], SH2_STATE_CPOLL, cycles);
     Pico32x.comm_dirty_68k |= comreg;
 
     if (cycles - (int)msh2.m68krcycles_done > 120)
@@ -351,7 +553,7 @@ static void p32x_reg_write16(u32 a, u32 d)
   }
   // PWM
   else if ((a & 0x30) == 0x30) {
-    p32x_pwm_write16(a, d);
+    p32x_pwm_write16(a, d, SekCyclesDoneT());
     return;
   }
 
@@ -372,9 +574,6 @@ static void p32x_vdp_write8(u32 a, u32 d)
   u16 *r = Pico32x.vdp_regs;
   a &= 0x0f;
 
-  // for FEN checks between writes
-  sh2_poll[0].cnt = 0;
-
   // TODO: verify what's writeable
   switch (a) {
     case 0x01:
@@ -395,14 +594,14 @@ static void p32x_vdp_write8(u32 a, u32 d)
       // if we are blanking and FS bit is changing
       if (((r[0x0a/2] & P32XV_VBLK) || (r[0] & P32XV_Mx) == 0) && ((r[0x0a/2] ^ d) & P32XV_FS)) {
         r[0x0a/2] ^= P32XV_FS;
-	Pico32xSwapDRAM(d ^ 1);
+        Pico32xSwapDRAM(d ^ 1);
         elprintf(EL_32X, "VDP FS: %d", r[0x0a/2] & P32XV_FS);
       }
       break;
   }
 }
 
-static void p32x_vdp_write16(u32 a, u32 d, u32 cycles)
+static void p32x_vdp_write16(u32 a, u32 d, SH2 *sh2)
 {
   a &= 0x0e;
   if (a == 6) { // fill start
@@ -420,9 +619,10 @@ static void p32x_vdp_write16(u32 a, u32 d, u32 cycles)
     }
     Pico32x.vdp_regs[0x06 / 2] = a;
     Pico32x.vdp_regs[0x08 / 2] = d;
-    if (cycles > 0) {
+    if (sh2 != NULL && len > 4) {
       Pico32x.vdp_regs[0x0a / 2] |= P32XV_nFEN;
-      p32x_event_schedule(P32X_EVENT_FILLEND, cycles, len);
+      // supposedly takes 3 bus/6 sh2 cycles? or 3 sh2 cycles?
+      p32x_event_schedule_sh2(sh2, P32X_EVENT_FILLEND, 3 + len);
     }
     return;
   }
@@ -442,8 +642,8 @@ static u32 p32x_sh2reg_read16(u32 a, int cpuid)
     case 0x00: // adapter/irq ctl
       return (r[0] & P32XS_FM) | Pico32x.sh2_regs[0] | Pico32x.sh2irq_mask[cpuid];
     case 0x04: // H count (often as comm too)
-      if (p32x_poll_detect(&sh2_poll[cpuid], a, ash2_cycles_done(), 0))
-        ash2_end_run(8);
+      sh2_poll_detect(&sh2s[cpuid], a, SH2_STATE_CPOLL);
+      sh2s_sync_on_read(&sh2s[cpuid]);
       return Pico32x.sh2_regs[4 / 2];
     case 0x10: // DREQ len
       return r[a / 2];
@@ -457,13 +657,13 @@ static u32 p32x_sh2reg_read16(u32 a, int cpuid)
     int comreg = 1 << (a & 0x0f) / 2;
     if (Pico32x.comm_dirty_68k & comreg)
       Pico32x.comm_dirty_68k &= ~comreg;
-    else if (p32x_poll_detect(&sh2_poll[cpuid], a, ash2_cycles_done(), 0))
-      ash2_end_run(8);
+    else
+      sh2_poll_detect(&sh2s[cpuid], a, SH2_STATE_CPOLL);
+    sh2s_sync_on_read(&sh2s[cpuid]);
     return r[a / 2];
   }
   if ((a & 0x30) == 0x30) {
-    sh2_poll[cpuid].cnt = 0;
-    return p32x_pwm_read16(a);
+    return p32x_pwm_read16(a, sh2_cycles_done_m68k(&sh2s[cpuid]));
   }
 
   return 0;
@@ -472,22 +672,32 @@ static u32 p32x_sh2reg_read16(u32 a, int cpuid)
 static void p32x_sh2reg_write8(u32 a, u32 d, int cpuid)
 {
   a &= 0xff;
+
+  sh2s[cpuid].poll_addr = 0;
+
   switch (a) {
     case 0: // FM
       Pico32x.regs[0] &= ~P32XS_FM;
       Pico32x.regs[0] |= (d << 8) & P32XS_FM;
       return;
-    case 1: // 
+    case 1: // HEN/irq masks
+      if ((d ^ Pico32x.sh2_regs[0]) & 0x80)
+        elprintf(EL_ANOMALY|EL_32X, "HEN");
       Pico32x.sh2irq_mask[cpuid] = d & 0x8f;
       Pico32x.sh2_regs[0] &= ~0x80;
       Pico32x.sh2_regs[0] |= d & 0x80;
       if (d & 1)
-        p32x_pwm_schedule(sh2s[cpuid].m68krcycles_done); // XXX: timing?
-      p32x_update_irls(1);
+        p32x_pwm_schedule_sh2(&sh2s[cpuid]);
+      p32x_update_irls(&sh2s[cpuid]);
       return;
     case 5: // H count
-      Pico32x.sh2_regs[4 / 2] = d & 0xff;
-      p32x_poll_undetect(&sh2_poll[cpuid ^ 1], 0);
+      d &= 0xff;
+      if (Pico32x.sh2_regs[4 / 2] != d) {
+        Pico32x.sh2_regs[4 / 2] = d;
+        p32x_sh2_poll_event(&sh2s[cpuid ^ 1], SH2_STATE_CPOLL,
+          sh2_cycles_done_m68k(&sh2s[cpuid]));
+        sh2_end_run(&sh2s[cpuid], 4);
+      }
       return;
   }
 
@@ -498,9 +708,9 @@ static void p32x_sh2reg_write8(u32 a, u32 d, int cpuid)
       return;
 
     r8[a ^ 1] = d;
-    if (p32x_poll_undetect(&m68k_poll, 0))
-      SekSetStop(0);
-    p32x_poll_undetect(&sh2_poll[cpuid ^ 1], 0);
+    p32x_m68k_poll_event(P32XF_68KCPOLL);
+    p32x_sh2_poll_event(&sh2s[cpuid ^ 1], SH2_STATE_CPOLL,
+      sh2_cycles_done_m68k(&sh2s[cpuid]));
     comreg = 1 << (a & 0x0f) / 2;
     Pico32x.comm_dirty_sh2 |= comreg;
     return;
@@ -511,6 +721,8 @@ static void p32x_sh2reg_write16(u32 a, u32 d, int cpuid)
 {
   a &= 0xfe;
 
+  sh2s[cpuid].poll_addr = 0;
+
   // comm
   if ((a & 0x30) == 0x20) {
     int comreg;
@@ -518,16 +730,16 @@ static void p32x_sh2reg_write16(u32 a, u32 d, int cpuid)
       return;
 
     Pico32x.regs[a / 2] = d;
-    if (p32x_poll_undetect(&m68k_poll, 0))
-      SekSetStop(0);
-    p32x_poll_undetect(&sh2_poll[cpuid ^ 1], 0);
+    p32x_m68k_poll_event(P32XF_68KCPOLL);
+    p32x_sh2_poll_event(&sh2s[cpuid ^ 1], SH2_STATE_CPOLL,
+      sh2_cycles_done_m68k(&sh2s[cpuid]));
     comreg = 1 << (a & 0x0f) / 2;
     Pico32x.comm_dirty_sh2 |= comreg;
     return;
   }
   // PWM
   else if ((a & 0x30) == 0x30) {
-    p32x_pwm_write16(a, d);
+    p32x_pwm_write16(a, d, sh2_cycles_done_m68k(&sh2s[cpuid]));
     return;
   }
 
@@ -542,8 +754,7 @@ static void p32x_sh2reg_write16(u32 a, u32 d, int cpuid)
     case 0x1a: Pico32x.sh2irqi[cpuid] &= ~P32XI_CMD; goto irls;
     case 0x1c:
       Pico32x.sh2irqs &= ~P32XI_PWM;
-      if (!(Pico32x.emu_flags & P32XF_PWM_PEND))
-        p32x_pwm_schedule(sh2s[cpuid].m68krcycles_done); // timing?
+      p32x_pwm_schedule_sh2(&sh2s[cpuid]);
       goto irls;
   }
 
@@ -551,7 +762,7 @@ static void p32x_sh2reg_write16(u32 a, u32 d, int cpuid)
   return;
 
 irls:
-  p32x_update_irls(1);
+  p32x_update_irls(&sh2s[cpuid]);
 }
 
 // ------------------------------------------------------------------
@@ -677,20 +888,16 @@ static void sh2_peripheral_write32(u32 a, u32 d, int id)
       break;
   }
 
-  if ((a == 0x1b0 || a == 0x18c) && (dmac0->chcr0 & 3) == 1 && (dmac0->dmaor & 1)) {
-    elprintf(EL_32X, "sh2 DMA %08x -> %08x, cnt %d, chcr %04x @%06x",
-      dmac0->sar0, dmac0->dar0, dmac0->tcr0, dmac0->chcr0, sh2_pc(id));
-    dmac0->tcr0 &= 0xffffff;
-
-    // HACK: assume 68k starts writing soon and end the timeslice
-    ash2_end_run(16);
+  // perhaps starting a DMA?
+  if (a == 0x1b0 || a == 0x18c || a == 0x19c) {
+    struct dmac *dmac = (void *)&Pico32xMem->sh2_peri_regs[id][0x180 / 4];
+    if (!(dmac->dmaor & DMA_DME))
+      return;
 
-    // DREQ is only sent after first 4 words are written.
-    // we do multiple of 4 words to avoid messing up alignment
-    if (dmac0->sar0 == 0x20004012 && Pico32x.dmac_ptr && (Pico32x.dmac_ptr & 3) == 0) {
-      elprintf(EL_32X, "68k -> sh2 DMA");
-      dma_68k2sh2_do();
-    }
+    if ((dmac->chan[0].chcr & (DMA_TE|DMA_DE)) == DMA_DE)
+      dmac_trigger(&sh2s[id], &dmac->chan[0]);
+    if ((dmac->chan[1].chcr & (DMA_TE|DMA_DE)) == DMA_DE)
+      dmac_trigger(&sh2s[id], &dmac->chan[1]);
   }
 }
 
@@ -787,17 +994,19 @@ static void PicoWrite8_32x_on(u32 a, u32 d)
     return;
   }
 
-  if ((a & 0xfff0) == 0x5180) { // a15180
-    p32x_vdp_write8(a, d);
-    return;
-  }
+  if (!(Pico32x.regs[0] & P32XS_FM)) {
+    if ((a & 0xfff0) == 0x5180) { // a15180
+      p32x_vdp_write8(a, d);
+      return;
+    }
 
-  // TODO: verify
-  if ((a & 0xfe00) == 0x5200) { // a15200
-    elprintf(EL_32X|EL_ANOMALY, "m68k 32x PAL w8  [%06x]   %02x @%06x", a, d & 0xff, SekPc);
-    ((u8 *)Pico32xMem->pal)[(a & 0x1ff) ^ 1] = d;
-    Pico32x.dirty_pal = 1;
-    return;
+    // TODO: verify
+    if ((a & 0xfe00) == 0x5200) { // a15200
+      elprintf(EL_32X|EL_ANOMALY, "m68k 32x PAL w8  [%06x]   %02x @%06x", a, d & 0xff, SekPc);
+      ((u8 *)Pico32xMem->pal)[(a & 0x1ff) ^ 1] = d;
+      Pico32x.dirty_pal = 1;
+      return;
+    }
   }
 
   elprintf(EL_UIO, "m68k unmapped w8  [%06x]   %02x @%06x", a, d & 0xff, SekPc);
@@ -818,15 +1027,17 @@ static void PicoWrite16_32x_on(u32 a, u32 d)
     return;
   }
 
-  if ((a & 0xfff0) == 0x5180) { // a15180
-    p32x_vdp_write16(a, d, 0); // FIXME?
-    return;
-  }
+  if (!(Pico32x.regs[0] & P32XS_FM)) {
+    if ((a & 0xfff0) == 0x5180) { // a15180
+      p32x_vdp_write16(a, d, NULL); // FIXME?
+      return;
+    }
 
-  if ((a & 0xfe00) == 0x5200) { // a15200
-    Pico32xMem->pal[(a & 0x1ff) / 2] = d;
-    Pico32x.dirty_pal = 1;
-    return;
+    if ((a & 0xfe00) == 0x5200) { // a15200
+      Pico32xMem->pal[(a & 0x1ff) / 2] = d;
+      Pico32x.dirty_pal = 1;
+      return;
+    }
   }
 
   elprintf(EL_UIO, "m68k unmapped w16 [%06x] %04x @%06x", a, d & 0xffff, SekPc);
@@ -1004,8 +1215,7 @@ static u32 sh2_read8_cs0(u32 a, int id)
 
   if ((a & 0x3ff00) == 0x4100) {
     d = p32x_vdp_read16(a);
-    if (p32x_poll_detect(&sh2_poll[id], a, ash2_cycles_done(), 1))
-      ash2_end_run(8);
+    sh2_poll_detect(&sh2s[id], a, SH2_STATE_VPOLL);
     goto out_16to8;
   }
 
@@ -1059,8 +1269,7 @@ static u32 sh2_read16_cs0(u32 a, int id)
 
   if ((a & 0x3ff00) == 0x4100) {
     d = p32x_vdp_read16(a);
-    if (p32x_poll_detect(&sh2_poll[id], a, ash2_cycles_done(), 1))
-      ash2_end_run(8);
+    sh2_poll_detect(&sh2s[id], a, SH2_STATE_VPOLL);
     goto out;
   }
 
@@ -1105,9 +1314,12 @@ static int REGPARM(3) sh2_write8_cs0(u32 a, u32 d, int id)
   elprintf(EL_32X, "%csh2 w8  [%08x]       %02x @%06x",
     id ? 's' : 'm', a, d & 0xff, sh2_pc(id));
 
-  if ((a & 0x3ff00) == 0x4100) {
-    p32x_vdp_write8(a, d);
-    return 0;
+  if (Pico32x.regs[0] & P32XS_FM) {
+    if ((a & 0x3ff00) == 0x4100) {
+      sh2s[id].poll_addr = 0;
+      p32x_vdp_write8(a, d);
+      return 0;
+    }
   }
 
   if ((a & 0x3ff00) == 0x4000) {
@@ -1174,16 +1386,18 @@ static int REGPARM(3) sh2_write16_cs0(u32 a, u32 d, int id)
     elprintf(EL_32X, "%csh2 w16 [%08x]     %04x @%06x",
       id ? 's' : 'm', a, d & 0xffff, sh2_pc(id));
 
-  if ((a & 0x3ff00) == 0x4100) {
-    sh2_poll[id].cnt = 0; // for poll before VDP accesses
-    p32x_vdp_write16(a, d, sh2s[id].m68krcycles_done);
-    return 0;
-  }
+  if (Pico32x.regs[0] & P32XS_FM) {
+    if ((a & 0x3ff00) == 0x4100) {
+      sh2s[id].poll_addr = 0;
+      p32x_vdp_write16(a, d, &sh2s[id]);
+      return 0;
+    }
 
-  if ((a & 0x3fe00) == 0x4200) {
-    Pico32xMem->pal[(a & 0x1ff) / 2] = d;
-    Pico32x.dirty_pal = 1;
-    return 0;
+    if ((a & 0x3fe00) == 0x4200) {
+      Pico32xMem->pal[(a & 0x1ff) / 2] = d;
+      Pico32x.dirty_pal = 1;
+      return 0;
+    }
   }
 
   if ((a & 0x3ff00) == 0x4000) {
@@ -1241,11 +1455,6 @@ static int REGPARM(3) sh2_write16_da(u32 a, u32 d, int id)
 }
 
 
-typedef struct {
-  uptr addr; // stores (membase >> 1) or ((handler >> 1) | (1<<31))
-  u32 mask;
-} sh2_memmap;
-
 typedef u32 (sh2_read_handler)(u32 a, int id);
 typedef int REGPARM(3) (sh2_write_handler)(u32 a, u32 d, int id);
 
@@ -1384,7 +1593,7 @@ static const u16 ssh2_code[] = {
   0x2200, 0x03e4  // slave start pointer in ROM
 };
 
-#define HWSWAP(x) (((x) << 16) | ((x) >> 16))
+#define HWSWAP(x) (((u16)(x) << 16) | ((x) >> 16))
 static void get_bios(void)
 {
   u16 *ps;
@@ -1496,8 +1705,6 @@ void PicoMemSetup32x(void)
     return;
   }
 
-  dmac0 = (void *)&Pico32xMem->sh2_peri_regs[0][0x180 / 4];
-
   get_bios();
 
   // cartridge area becomes unmapped
@@ -1591,31 +1798,25 @@ void PicoMemSetup32x(void)
   msh2.write8_tab  = ssh2.write8_tab  = (const void **)(void *)sh2_write8_map;
   msh2.write16_tab = ssh2.write16_tab = (const void **)(void *)sh2_write16_map;
 
-  // setup poll detector
-  m68k_poll.flag = P32XF_68KPOLL;
-  m68k_poll.cyc_max = 64;
-  sh2_poll[0].flag = P32XF_MSH2POLL;
-  sh2_poll[0].cyc_max = 21;
-  sh2_poll[1].flag = P32XF_SSH2POLL;
-  sh2_poll[1].cyc_max = 16;
-
-#ifdef DRC_SH2
   sh2_drc_mem_setup(&msh2);
   sh2_drc_mem_setup(&ssh2);
-#endif
 }
 
-void Pico32xStateLoaded(void)
+void Pico32xMemStateLoaded(void)
 {
   bank_switch(Pico32x.regs[4 / 2]);
   Pico32xSwapDRAM((Pico32x.vdp_regs[0x0a / 2] & P32XV_FS) ^ P32XV_FS);
-  p32x_poll_event(3, 0);
-  Pico32x.dirty_pal = 1;
   memset(Pico32xMem->pwm, 0, sizeof(Pico32xMem->pwm));
-  p32x_timers_recalc();
-#ifdef DRC_SH2
+  Pico32x.dirty_pal = 1;
+
+  Pico32x.emu_flags &= ~(P32XF_68KCPOLL | P32XF_68KVPOLL);
+  memset(&m68k_poll, 0, sizeof(m68k_poll));
+  msh2.state = 0;
+  msh2.poll_addr = msh2.poll_cycles = msh2.poll_cnt = 0;
+  ssh2.state = 0;
+  ssh2.poll_addr = ssh2.poll_cycles = ssh2.poll_cnt = 0;
+
   sh2_drc_flush_all();
-#endif
 }
 
 // vim:shiftwidth=2:ts=2:expandtab