Revert "import inofficial 1.0.4pre by joshua"

This reverts commit 9859b44888.

This change causes 2 bugs with the GBC game Cannon Fodder

( Cannon Fodder (U) (M5) [C][!].gbc
  md5sum 762d6c94874d8ac894ad100c0a4b50ab )

1) the 3D scenes flicker and there are some artifacts in the title
   screen,
2) as soon as mission 2 starts, the CPU goes into an endless loop
   and doesn't process input anymore - this is really nasty, as it
   is even impossible to get out of gnuboy itself, at least in fb
   mode.

i was skeptical about this inofficial patch since the beginning,
since it was not done by laguna himself but by some gamers, and
now it's confirmed that it's broken. afaict this patch includes
3-4 logical changes, if further issues are experienced it may make
sense to try one after the other to see if it fixes them.

README

@@ -45,20 +45,19 @@ all of the following and much more:
   Wave pattern memory corruption when sound channel 3 is played.
   Pad, timer, divide counter, and other basic hardware registers.
   CGB double-speed CPU mode.
-  Sorting sprites by X coordinate in DMG mode.
-  HALT instruction skipping in DMG mode.
-  CPU stalls during HDMA and GDMA.
-  Configurable color filters to provide more authentic LCD look.
 
 Aspects not emulated at this time include:
 
 * Serial IO (link cable).
   Undocumented 'extra' ram in OAM space on Gameboy Color.
-* All Super Gameboy extensions.
+  All Super Gameboy extensions.
 * GBC, HuC1, and HuC3 IR ports.
 * Obscure mappers such as TAMA5.
+  Sorting sprites by X coordinate in DMG mode.
+  HALT instruction skipping in DMG mode.
+  CPU stalls during HDMA and GDMA.
 
-Only the ones marked by * are known to affect the playability of
+Only the two marked by * are known to affect the playability of
 actual games or demos; the rest are just listed for completeness'
 sake.
 
@@ -129,6 +128,7 @@ Here's a brief list of what may appear in gnuboy in the future:
   Super Gameboy support.
   Serial link over the internet.
   Serial link to a real Gameboy with a custom cable.
+  Configurable color filters to provide more authentic LCD look.
   Custom colorization of DMG games on a per-tile basis.
   Support for more colorspaces in the hardware scaler.
   Recording audio.

cpucore.h

@@ -7,7 +7,7 @@ const static byte cycles_table[256] =
 	1, 3, 2, 2, 1, 1, 2, 1, 5, 2, 2, 2, 1, 1, 2, 1,
 	1, 3, 2, 2, 1, 1, 2, 1, 3, 2, 2, 2, 1, 1, 2, 1,
 	3, 3, 2, 2, 1, 1, 2, 1, 3, 2, 2, 2, 1, 1, 2, 1,
-	3, 3, 2, 2, 3, 3, 3, 1, 3, 2, 2, 2, 1, 1, 2, 1,
+	3, 3, 2, 2, 1, 3, 3, 3, 3, 2, 2, 2, 1, 1, 2, 1,
 	
 	1, 1, 1, 1, 1, 1, 2, 1, 1, 1, 1, 1, 1, 1, 2, 1,
 	1, 1, 1, 1, 1, 1, 2, 1, 1, 1, 1, 1, 1, 1, 2, 1,

docs/CHANGES

@@ -9,22 +9,6 @@ GNUBOY CHANGES FILE -- detailed list of all changes made
   For an easy-to-read user-oriented list of major changes in each
   release, please refer to the file WHATSNEW.
 
-1.0.4-cvs
-fixed a possible out-of-bounds access which could allow a hacked savestate to
-crash gnuboy and possibly run arbitrary code on the host machine. Challenge:
-try to find a way to exploit it
-removed an incorrect restriction on when LY=LYC interrupts can occur, which
-broke at least one game and several PD roms. (extra special thanks to beware
-for helping us track this down!)
-fixed an SDL keymap issue which prevented the keypad '5' key from working when
-num-lock was off
-replaced the channel 4 PRNG tables with a computer-generated PRNG output table,
-as opposed to an approximation based on wavefiles
-fixed the HDMA behavior (properly?), several pinball games developed by 'Left
-Field Productions' now work correctly (thanks to beware for pointing us in the
-right direction)
-fixed GDMA so it consumes cpu cycles properly, now the intro to Magical Drop
-works correctly
 
 1.0.3
 fixed a typo in the SDL keymap file that kept . from working

docs/WHATSNEW

@@ -8,32 +8,6 @@
 
 
 
-CVS 1.0.4
-
-Fixed a possible out-of-bounds access which could allow a hacked savestate to
-crash gnuboy and possibly run arbitrary code on the host machine. Challenge:
-try to find a way to exploit it
-
-Removed an incorrect restriction on when LY=LYC interrupts can occur (from 
-0.9.13, possibly to fix montezuma's return or pokemon yellow, though both games
-work fine now without it) which broke at least one commercial game and several
-PD roms. (extra special thanks to beware for helping us track this down!)
-
-Fixed an SDL keymap issue which prevented the keypad '5' key from working when
-num-lock was off
-
-Replaced the channel 4 PRNG tables with a shifter-generated PRNG output table,
-as opposed to the old approximations based on wavefiles
-
-Fixed the HDMA timing behavior (properly?), several pinball games developed by
-'Left Field Productions' now work correctly (thanks to beware for pointing us
-in the right direction)
-
-Fixed the GDMA behavior so it consumes cpu cycles as it should. This fixes the
-intro scene animation in 'Magical Drop'
-
-
-
 RELEASE 1.0.3
 
 All ANSI C incompatibilities should be fixed. Please report any that

hw.c

@@ -54,33 +54,6 @@ void hw_dma(byte b)
 		lcd.oam.mem[i] = readb(a);
 }
 
-/* COMMENT A:
- * Beware was pretty sure that this HDMA implementation was incorrect, as when
- * he used it in bgb, it broke Pokemon Crystal (J). I tested it with this and
- * it seems to work fine, so until I find any problems with it, it's staying.
- * (Lord Nightmare)
- */
-
-
-void hw_hdma()
-{
-	int cnt;
-	addr sa;
-	int da;
-
-	sa = ((addr)R_HDMA1 << 8) | (R_HDMA2&0xf0);
-	da = 0x8000 | ((int)(R_HDMA3&0x1f) << 8) | (R_HDMA4&0xf0);
-	cnt = 16;
-	while (cnt--)
-		writeb(da++, readb(sa++));
-	cpu_timers(16); /* SEE COMMENT A ABOVE */
-	R_HDMA1 = sa >> 8;
-	R_HDMA2 = sa & 0xF0;
-	R_HDMA3 = 0x1F & (da >> 8);
-	R_HDMA4 = da & 0xF0;
-	R_HDMA5--;
-	hw.hdma--;
-}
 
 
 void hw_hdma_cmd(byte c)
@@ -94,7 +67,6 @@ void hw_hdma_cmd(byte c)
 	{
 		hw.hdma = c;
 		R_HDMA5 = c & 0x7f;
-		if ((R_STAT&0x03) == 0x00) hw_hdma(); /* SEE COMMENT A ABOVE */
 		return;
 	}
 	
@@ -104,8 +76,6 @@ void hw_hdma_cmd(byte c)
 	cnt = ((int)c)+1;
 	/* FIXME - this should use cpu time! */
 	/*cpu_timers(102 * cnt);*/
-	cpu_timers((460>>cpu.speed)+cnt*16); /*dalias*/
-	/*cpu_timers(228 + (16*cnt));*/ /* this should be right according to no$ */
 	cnt <<= 4;
 	while (cnt--)
 		writeb(da++, readb(sa++));
@@ -117,6 +87,26 @@ void hw_hdma_cmd(byte c)
 }
 
 
+void hw_hdma()
+{
+	int cnt;
+	addr sa;
+	int da;
+
+	sa = ((addr)R_HDMA1 << 8) | (R_HDMA2&0xf0);
+	da = 0x8000 | ((int)(R_HDMA3&0x1f) << 8) | (R_HDMA4&0xf0);
+	cnt = 16;
+	while (cnt--)
+		writeb(da++, readb(sa++));
+	R_HDMA1 = sa >> 8;
+	R_HDMA2 = sa & 0xF0;
+	R_HDMA3 = 0x1F & (da >> 8);
+	R_HDMA4 = da & 0xF0;
+	R_HDMA5--;
+	hw.hdma--;
+}
+
+
 /*
  * pad_refresh updates the P1 register from the pad states, generating
  * the appropriate interrupts (by quickly raising and lowering the

lcdc.c

@@ -23,10 +23,10 @@
 
 void stat_trigger()
 {
-	static const int condbits[4] = { 0x08, 0x10, 0x20, 0x00 };
+	static const int condbits[4] = { 0x08, 0x30, 0x20, 0x00 };
 	int flag = 0;
 
-	if (R_LY == R_LYC)
+	if ((R_LY < 0x91) && (R_LY == R_LYC))
 	{
 		R_STAT |= 0x04;
 		if (R_STAT & 0x40) flag = IF_STAT;

mem.c

@@ -33,9 +33,6 @@ void mem_updatemap()
 	int n;
 	byte **map;
 	
-	mbc.rombank &= (mbc.romsize - 1);
-	mbc.rambank &= (mbc.ramsize - 1);
-	
 	map = mbc.rmap;
 	map[0x0] = rom.bank[0];
 	map[0x1] = rom.bank[0];
@@ -162,9 +159,6 @@ void ioreg_write(byte r, byte b)
 		}
 		R_SC = b; /* & 0x7f; */
 		break;
-	case RI_SB:
-		REG(r) = b;
-		break;
 	case RI_DIV:
 		REG(r) = 0;
 		break;
@@ -436,6 +430,8 @@ void mbc_write(int a, byte b)
 		}
 		break;
 	}
+	mbc.rombank &= (mbc.romsize - 1);
+	mbc.rambank &= (mbc.ramsize - 1);
 	/* printf("%02X\n", mbc.rombank); */
 	mem_updatemap();
 }

sound.c

@@ -134,14 +134,14 @@ void sound_off()
 	R_NR30 = 0x7F;
 	R_NR31 = 0xFF;
 	R_NR32 = 0x9F;
-	R_NR34 = 0xBF;
+	R_NR33 = 0xBF;
 	R_NR41 = 0xFF;
 	R_NR42 = 0x00;
 	R_NR43 = 0x00;
 	R_NR44 = 0xBF;
 	R_NR50 = 0x77;
 	R_NR51 = 0xF3;
-	R_NR52 = 0x70;
+	R_NR52 = 0xF1;
 	sound_dirty();
 }
 
@@ -153,7 +153,6 @@ void sound_reset()
 	memcpy(WAVE, hw.cgb ? cgbwave : dmgwave, 16);
 	memcpy(ram.hi+0x30, WAVE, 16);
 	sound_off();
-	R_NR52 = 0xF1;
 }