diff --git a/libpcsxcore/new_dynarec/emu_if.c b/libpcsxcore/new_dynarec/emu_if.c
index f879ad8c..0ec366d0 100644
--- a/libpcsxcore/new_dynarec/emu_if.c
+++ b/libpcsxcore/new_dynarec/emu_if.c
@@ -323,13 +323,18 @@ static void ari64_shutdown()
 {
 	new_dynarec_cleanup();
 	new_dyna_pcsx_mem_shutdown();
+	(void)ari64_execute;
+	(void)ari64_execute_block;
 }
 
+extern void intExecuteT();
+extern void intExecuteBlockT();
+
 R3000Acpu psxRec = {
 	ari64_init,
 	ari64_reset,
-	ari64_execute,
-	ari64_execute_block,
+	intExecuteT,
+	intExecuteBlockT,
 	ari64_clear,
 	ari64_notify,
 	ari64_apply_config,
@@ -398,7 +403,7 @@ static u32 memcheck_read(u32 a)
 	return *(u32 *)(psxM + (a & 0x1ffffc));
 }
 
-#if 0
+#if 1
 void do_insn_trace(void)
 {
 	static psxRegisters oldregs;
diff --git a/libpcsxcore/new_dynarec/pcsxmem.c b/libpcsxcore/new_dynarec/pcsxmem.c
index 1f37dc29..357f753e 100644
--- a/libpcsxcore/new_dynarec/pcsxmem.c
+++ b/libpcsxcore/new_dynarec/pcsxmem.c
@@ -289,6 +289,8 @@ static void write_biu(u32 value)
 		return;
 	}
 
+extern u32 handler_cycle;
+handler_cycle = psxRegs.cycle;
 	memprintf("write_biu %08x @%08x %u\n", value, psxRegs.pc, psxRegs.cycle);
 	psxRegs.biuReg = value;
 }
diff --git a/libpcsxcore/psxcounters.c b/libpcsxcore/psxcounters.c
index 18bd6a4e..bc2eb3f6 100644
--- a/libpcsxcore/psxcounters.c
+++ b/libpcsxcore/psxcounters.c
@@ -389,9 +389,12 @@ void psxRcntUpdate()
 
 /******************************************************************************/
 
+extern u32 handler_cycle;
+
 void psxRcntWcount( u32 index, u32 value )
 {
     verboseLog( 2, "[RCNT %i] wcount: %x\n", index, value );
+handler_cycle = psxRegs.cycle;
 
     _psxRcntWcount( index, value );
     psxRcntSet();
@@ -400,6 +403,7 @@ void psxRcntWcount( u32 index, u32 value )
 void psxRcntWmode( u32 index, u32 value )
 {
     verboseLog( 1, "[RCNT %i] wmode: %x\n", index, value );
+handler_cycle = psxRegs.cycle;
 
     _psxRcntWmode( index, value );
     _psxRcntWcount( index, 0 );
@@ -411,6 +415,7 @@ void psxRcntWmode( u32 index, u32 value )
 void psxRcntWtarget( u32 index, u32 value )
 {
     verboseLog( 1, "[RCNT %i] wtarget: %x\n", index, value );
+handler_cycle = psxRegs.cycle;
 
     rcnts[index].target = value;
 
@@ -423,6 +428,7 @@ void psxRcntWtarget( u32 index, u32 value )
 u32 psxRcntRcount( u32 index )
 {
     u32 count;
+handler_cycle = psxRegs.cycle;
 
     count = _psxRcntRcount( index );
 
diff --git a/libpcsxcore/psxhw.c b/libpcsxcore/psxhw.c
index 10a2695f..7e4a64da 100644
--- a/libpcsxcore/psxhw.c
+++ b/libpcsxcore/psxhw.c
@@ -437,13 +437,14 @@ void psxHwWrite8(u32 add, u8 value) {
 				return;
 			}
 
+			if (add < 0x1f802000)
 			psxHu8(add) = value;
 #ifdef PSXHW_LOG
 			PSXHW_LOG("*Unknown 8bit write at address %x value %x\n", add, value);
 #endif
 			return;
 	}
-	psxHu8(add) = value;
+	//psxHu8(add) = value;
 #ifdef PSXHW_LOG
 	PSXHW_LOG("*Known 8bit write at address %x value %x\n", add, value);
 #endif
@@ -565,6 +566,7 @@ void psxHwWrite16(u32 add, u16 value) {
 				return;
 			}
 
+			if (add < 0x1f802000)
 			psxHu16ref(add) = SWAPu16(value);
 #ifdef PSXHW_LOG
 			PSXHW_LOG("*Unknown 16bit write at address %x value %x\n", add, value);
@@ -756,9 +758,9 @@ void psxHwWrite32(u32 add, u32 value) {
 			return;
 
 		case 0x1f801820:
-			mdecWrite0(value); break;
+			mdecWrite0(value); return;
 		case 0x1f801824:
-			mdecWrite1(value); break;
+			mdecWrite1(value); return;
 
 		case 0x1f801100:
 #ifdef PSXHW_LOG
@@ -826,6 +828,7 @@ void psxHwWrite32(u32 add, u32 value) {
 				return;
 			}
 
+			if (add < 0x1f802000)
 			psxHu32ref(add) = SWAPu32(value);
 #ifdef PSXHW_LOG
 			PSXHW_LOG("*Unknown 32bit write at address %x value %x\n", add, value);
diff --git a/libpcsxcore/psxinterpreter.c b/libpcsxcore/psxinterpreter.c
index 5756bee5..4bf9248d 100644
--- a/libpcsxcore/psxinterpreter.c
+++ b/libpcsxcore/psxinterpreter.c
@@ -238,7 +238,7 @@ static inline void addCycle(psxRegisters *regs)
 {
 	assert(regs->subCycleStep >= 0x10000);
 	regs->subCycle += regs->subCycleStep;
-	regs->cycle += regs->subCycle >> 16;
+	regs->cycle += 2; //regs->subCycle >> 16;
 	regs->subCycle &= 0xffff;
 }
 
@@ -435,7 +435,9 @@ static void doBranch(psxRegisters *regs, u32 tar, enum R3000Abdt taken) {
 		regs->CP0.n.Target = pc_final;
 	regs->branching = 0;
 
+	psxRegs.cycle += 2;
 	psxBranchTest();
+	psxRegs.cycle -= 2;
 }
 
 static void doBranchReg(psxRegisters *regs, u32 tar) {
@@ -960,7 +962,7 @@ void MTC0(psxRegisters *regs_, int reg, u32 val) {
 	}
 }
 
-OP(psxMTC0) { MTC0(regs_, _Rd_, _u32(_rRt_)); }
+OP(psxMTC0) { MTC0(regs_, _Rd_, _u32(_rRt_)); psxBranchTest(); }
 
 // no exception
 static inline void psxNULLne(psxRegisters *regs) {
@@ -1120,6 +1122,7 @@ OP(psxHLE) {
 	}
 	psxHLEt[hleCode]();
 	branchSeen = 1;
+	psxRegs.cycle -= 2;
 }
 
 static void (INT_ATTR *psxBSC[64])(psxRegisters *regs_, u32 code) = {
@@ -1169,18 +1172,20 @@ static void intReset() {
 static inline void execI_(u8 **memRLUT, psxRegisters *regs) {
 	u32 pc = regs->pc;
 
-	addCycle(regs);
+	//addCycle(regs);
 	dloadStep(regs);
 
 	regs->pc += 4;
 	regs->code = fetch(regs, memRLUT, pc);
 	psxBSC[regs->code >> 26](regs, regs->code);
+	psxRegs.cycle += 2;
+	fetchNoCache(regs, memRLUT, regs->pc); // bus err check
 }
 
 static inline void execIbp(u8 **memRLUT, psxRegisters *regs) {
 	u32 pc = regs->pc;
 
-	addCycle(regs);
+	//addCycle(regs);
 	dloadStep(regs);
 
 	if (execBreakCheck(regs, pc))
@@ -1189,6 +1194,8 @@ static inline void execIbp(u8 **memRLUT, psxRegisters *regs) {
 	regs->pc += 4;
 	regs->code = fetch(regs, memRLUT, pc);
 	psxBSC[regs->code >> 26](regs, regs->code);
+	psxRegs.cycle += 2;
+	fetchNoCache(regs, memRLUT, regs->pc); // bus err check
 }
 
 static void intExecute() {
@@ -1218,6 +1225,30 @@ void intExecuteBlock(enum blockExecCaller caller) {
 		execI_(memRLUT, regs_);
 }
 
+extern void do_insn_trace(void);
+
+void intExecuteT() {
+	psxRegisters *regs_ = &psxRegs;
+	u8 **memRLUT = psxMemRLUT;
+	extern int stop;
+
+	while (!stop) {
+		do_insn_trace();
+		execIbp(memRLUT, regs_);
+	}
+}
+
+void intExecuteBlockT() {
+	psxRegisters *regs_ = &psxRegs;
+	u8 **memRLUT = psxMemRLUT;
+
+	branchSeen = 0;
+	while (!branchSeen) {
+		do_insn_trace();
+		execIbp(memRLUT, regs_);
+	}
+}
+
 static void intClear(u32 Addr, u32 Size) {
 }
 
@@ -1246,7 +1277,7 @@ static void setupCop(u32 sr)
 	else
 		psxBSC[17] = psxCOPd;
 	if (sr & (1u << 30))
-		psxBSC[18] = Config.DisableStalls ? psxCOP2 : psxCOP2_stall;
+		psxBSC[18] = psxCOP2;
 	else
 		psxBSC[18] = psxCOPd;
 	if (sr & (1u << 31))
@@ -1265,7 +1296,7 @@ void intApplyConfig() {
 	assert(psxSPC[26] == psxDIV   || psxSPC[26] == psxDIV_stall);
 	assert(psxSPC[27] == psxDIVU  || psxSPC[27] == psxDIVU_stall);
 
-	if (Config.DisableStalls) {
+	if (1) {
 		psxBSC[18] = psxCOP2;
 		psxBSC[50] = gteLWC2;
 		psxBSC[58] = gteSWC2;
diff --git a/libpcsxcore/psxmem.c b/libpcsxcore/psxmem.c
index 42755e52..4fa4316b 100644
--- a/libpcsxcore/psxmem.c
+++ b/libpcsxcore/psxmem.c
@@ -289,10 +289,13 @@ void psxMemOnIsolate(int enable)
 			: R3000ACPU_NOTIFY_CACHE_UNISOLATED, NULL);
 }
 
+extern u32 last_io_addr;
+
 u8 psxMemRead8(u32 mem) {
 	char *p;
 	u32 t;
 
+	last_io_addr = mem;
 	t = mem >> 16;
 	if (t == 0x1f80 || t == 0x9f80 || t == 0xbf80) {
 		if ((mem & 0xffff) < 0x400)
@@ -318,6 +321,7 @@ u16 psxMemRead16(u32 mem) {
 	char *p;
 	u32 t;
 
+	last_io_addr = mem;
 	t = mem >> 16;
 	if (t == 0x1f80 || t == 0x9f80 || t == 0xbf80) {
 		if ((mem & 0xffff) < 0x400)
@@ -343,6 +347,7 @@ u32 psxMemRead32(u32 mem) {
 	char *p;
 	u32 t;
 
+	last_io_addr = mem;
 	t = mem >> 16;
 	if (t == 0x1f80 || t == 0x9f80 || t == 0xbf80) {
 		if ((mem & 0xffff) < 0x400)
@@ -370,6 +375,7 @@ void psxMemWrite8(u32 mem, u8 value) {
 	char *p;
 	u32 t;
 
+	last_io_addr = mem;
 	t = mem >> 16;
 	if (t == 0x1f80 || t == 0x9f80 || t == 0xbf80) {
 		if ((mem & 0xffff) < 0x400)
@@ -397,6 +403,7 @@ void psxMemWrite16(u32 mem, u16 value) {
 	char *p;
 	u32 t;
 
+	last_io_addr = mem;
 	t = mem >> 16;
 	if (t == 0x1f80 || t == 0x9f80 || t == 0xbf80) {
 		if ((mem & 0xffff) < 0x400)
@@ -424,6 +431,7 @@ void psxMemWrite32(u32 mem, u32 value) {
 	char *p;
 	u32 t;
 
+	last_io_addr = mem;
 //	if ((mem&0x1fffff) == 0x71E18 || value == 0x48088800) SysPrintf("t2fix!!\n");
 	t = mem >> 16;
 	if (t == 0x1f80 || t == 0x9f80 || t == 0xbf80) {
@@ -442,6 +450,8 @@ void psxMemWrite32(u32 mem, u32 value) {
 #endif
 		} else {
 			if (mem == 0xfffe0130) {
+extern u32 handler_cycle;
+handler_cycle = psxRegs.cycle;
 				psxRegs.biuReg = value;
 				return;
 			}
diff --git a/libpcsxcore/r3000a.c b/libpcsxcore/r3000a.c
index 48881068..47c40940 100644
--- a/libpcsxcore/r3000a.c
+++ b/libpcsxcore/r3000a.c
@@ -127,6 +127,8 @@ void psxException(u32 cause, enum R3000Abdt bdt, psxCP0Regs *cp0) {
 }
 
 void psxBranchTest() {
+ extern u32 irq_test_cycle;
+ irq_test_cycle = psxRegs.cycle;
 	if ((psxRegs.cycle - psxNextsCounter) >= psxNextCounter)
 		psxRcntUpdate();