CPU:
sysTrapPceNativeCall, ARM Emulator
Trace T1 bit, should be unused by the OS and applications anyway
Test what bits of IMR are writable
On hardware PDIRQEG seems not to actually work at all(CPUID:0x57000000)
SCR privilege violation doesnt trigger the same as on hardware(likely has to do with not emulating the unused chip selects)
TCN2 is unimplemented and seems to be used by the same routines that turn the CPU off for sleep mode

CPU I/O:
Peripheral Control Register, audio ppm mixing selection
Setting the battery dead bit(PDDATA 0x80) if the emulated battery percent gets too low(don't know how low this is, a test will be slow and painful with how big the battery is on my device)
DRAMC write enable
Port M Infrared shutdown (PMDATA 0x20)
some undocumented I/O might be on port e and port j
SPI1, probably the SD card since SD cards use SPI for data transfer
SPITEST SSTATUS is undocumented and therefore unemulated
may need to trigger an interrupt if a IMR masked interrupt becomes unmasked and its bit is still set in IPR
When SPICLK2, SPITXD or SPIRXD on port e is disabled ADS7846 functions should respond appropriately(not transmitting or receiving or blocking both for the clock)
REFREQ clock frequency in RTCCTL should slow down the RTC when enabled
Dont know if it possible to have the backlight on and the display off at the same time(theres no reason for it but it may be possible)
SPI1 slave mode, should never be used
port d data register INT* bits seem to have there data bits cleared when an edge triggered interrupt is cleared(according to MC68VZ328UM.pdf Page 10-15)
RxOverflow on SPI1, don't know if back or front of FIFO is overwritten on overflow(currently losing oldest entry)
ICR POL(1,2,3,6) may flip the pin value as well as the interrupt, POL5 does not flip the INT5 pin though, this was confirmed with a hardware test(it doesnt seem to but there is instability on the pin when the SD card is plugged in, this may have to do with card detect also being a data line on the SD pinout)
edge triggered INT* don't clear on write to ISR when masked in IMR(at least that seems to be the reason)
Cyclone will cause SIGSEGVs, don't know why yet
PWM2 is not implemented
don't know if flushing the PWM1 FIFO sets all the bytes to 0x00, or just sets the read pointer to the write pointer preserving the newest sample and making the size 0(readPtr = writePtr has significantly cleaner audio then 0ing it out though)
while it is stated that the PLL is turned off "30 clocks" after the DISPLL bit is set, it doesnt state where the clocks come from, CLK32 or SYSCLK
SPI1 SPISPC register
UART1 USTCNT1
PLLFSR has a hack that makes busy wait loops finish faster by toggling the CLK32 bit on read, for power button issue
PDKBEN also has a hack for power on

Memory:
SD card can't be read or written to by Palm OS
unknown if DRAM bit expanded address space is used for CSC when its not an extension of CSD
there is conflicting information on whether the DRAM bit effects CSC, needs a test made
the unemulated chip selects(CSB1, CSC0/1) privilege violation interrupts will not be handled properly

SED1376:
swivelview register

ADS7846:
verify chip select(no test has been done yet, but everything points to port g bit 2)
need to trigger a false PENIRQ interrupt on reading certain channels
electrical noise on lines(conversions probably should have +-20 added to values)(probably no need for this, it works so theres no need to use less precise values)
in the edge case that SPICLK2 is disabled while using ADS7846 and a 1 was the last bit shifted out 0s will still be shifted in

SD Card:
IRQ2 may actually be attached to the SD Card data out pin, triggering an interrupt when a 0 is received to process the return data

Debug tools:
ADS7846 channels can't be read in single reference mode in hwTestSuite

MakePalmBitmap:


Fixed:
power button must be pushed twice to turn the CPU back on(when debugging it works the first time, then must be pushed twice to turn off instead of on)(this also occurs in the RetroArch build)
the power button double press issue may be because the button map I am using was taken from POSE source, the power button may be mapped to other locations on the button matrix than expected
if a sound interrupt is triggered while the button interrupt is disabled the button interrupt will still trigger(in galax game)(seems to be an issue with FIFOAV always = true hack and how INT_PWM1 needed to be cleared on read or write)
SED1376 16 bpp mode is broken and crushed to the top of the screen
audio can max out the resampler buffer, the max 1 FIFO sample can play is around 2.16 minutes(CLK32 / period(257) / clockDivider(16) / prescaler(128) / repeat(8))(257 * 16 * 128 * 8 / 32768=128.5 seconds)(safety check added, >= 1 second duty cycle is useless and will just make annoying cracks anyway)
Cyclone CPU emulator is not working
PWM1 output value is not a direct range cast of 0<->255 to 0<->32767, its additive, see properPwmSineWave.png
inductor dosent properly drain when PWM1 gets disabled
PWM1 FIFOAV is always set true
may need to force sound generation until buffer is adequately filled when sound is on(not possible, INT_PWM1 is masked)
if a timer triggers more than once per CLK32(> 32768 times a second) it will lose any triggers after the first and get out of sync(still not perfect but resolution is much higher)
Peripheral Control Register, timer cascade mode
MakePalmIcon 8bpp bitmaps have corrupt palettes
missing home screen icons
EMUCS memory range is unemulated(used for emu registers if enabled, invalid access otherwise)
port g data bit 2 may need to be 0 to access ADS7846(it is)
pen input
pulling chip select low when high state likely resets the ADS7846 bit stream(this is currently being done when the SPI bus is enabled)(resetting on disable, that would make more sense because the chip needs to be read/written instantly once chip select is pulled low)
From ADS7846 datasheet:Chip Select Input. Controls conversion timing and enables the serial input/output register. (this means the chip timing is likely reset when cs goes low)
the ADS7846 is currently being reset every time the SPI is disabled and reenabled(happens when ADS7846 chip select is turned off, not on SPI enable)
Port G SPI stuff(ADS7846 chip select was on port g)
Edge triggered IRQ* interrupt pins may actually read the value of the interrupt instead of the pin value(IRQ* reads the pin, INT* still hasn't been tested yet)
ADS7846 channels are not implemented properly in the emulator(works now)
ADS7846 Channels 3 and 4(they need to be scaled differently)(works now)
CPU32 table lookup opcodes(there is no CPU32)
USB chip seems to share an interrupt with the SD card(the SD card interrupt is unimplemented at boot and triggers a printf over USB instead, if USB is not properly emulated that will cause a lock up)
IRQ2 seems to not even be hooked up in IDA(IRQ2 is setup after boot by the SD driver, the kernels IRQ2 driver only sends a debug message over USB or serial)
framebuffer accesses can cause a buffer overflow(this was always the case, its not a new bug)(just increased the buffer to an address line maskable size)
chipselect mirroring is wrong(CS*0 and CS*1 are considered continuous when mapped with more address space than memory, mirroring is currently [CS*0, CS*1, repeat alternating till the end of address space] it should be [CS*0, repeat CS*0 until half way through CS* address space, CS*1, repeat CS*1 until end of CS* address space])
the second line on all the chip selects is not properly emulated, they should be empty and trigger a bus error(except CSD1, it seems to follow different rules) but currently mirror the first half
USB chip address range
USB chip may be swapped into address space with a GPIO and reconfiguring CSC chip select
the CSC address space is never accessed, this may be because the DRAM controller takes it over
CSC0 and CSA1 ranges overlap, something specifically stated as what not to do(the CSA1 pin is disabled though)(its actually CSC that is disabled)
CSC is owned by CSD for DRAM, CSA1 controls USB access
All edge triggered interrupts(currently always level triggered)
interrupt control register(ICR) edge trigger selects
port d IRQ* bits edge triggered interrupt mode is not emulated
edgeTriggeredInterruptLastValue may need to be locked when PLL is off(just checking if PLL is on before triggering an interrupt in edge triggered mode)
Edge triggered interrupt seem needed for SD card(interrupt is disabled after card is inserted)(don't know if they are needed, but they are implemented now)
on changing ICR all port d interrupts and IRQ5 need to be refreshed
SD card can't be inserted or removed
SD card has no error handling in save/load state
there was what appeared to be memory corruption because a byte was incrementing and decrementing for loading and saving the same state but it was just the precision cast from uint64_t > double > uint64_t made it increment by 1
STOP opcode may be causing issues with the power button(it may be setting a separate CPU disable option)(not a bug)
add 320*320 frame buffer silkscreen, 2xBRZ should be able to make 320*320 version of the 160*160 silkscreen(not hooked up but one has been created)
Tango icons don't grow enough with a big window
a reset caused by the watchdog may cause undefined behavior(it just resets, same as if a reset opcode where called)
CSD and CSC chaining to create a 16mb address space from 4x4mb chunks(this is just completely wrong, the address lines are controlled by the DRAM module that was unemulated)
RAM wait states(not happening)
All of DRAMMC
need to investigate SDRAM registers
Since chipselects must be aligned to there memory size the start address doesnt need to be subtracted from each address calculation
PENIRQ can be read even when PFSEL bit 1 is false
early on I swapped RGB16 R and B, the LUT register addresses for red and blue were swapped though, red actually is the top 5 bits
Allow IMR to mask interrupts after they are created
ADC7846 temperature sensors
ADC7846 dock sensor
storage RAM protect(already done from fixing chip select bits, ROP bit set in CSD, verified with hardware test)
interrupt control register(ICR) POL5
port g backlight state readback
Timer capture events, I don't think there possible though with the Palms hardware(there not possible, the power button LED occupies the TIN pin which is required for capture events)
port b pin 6 is xored with the power detection on the alarm/power LED, if docked it turns the LED off, if not docked it turns the LED on
touch interrupt seems to not use IRQ5(it does, theres a test for it now)
port d seems to allow using special function pins as inputs while active unlike other ports, this needs to be verified(verified by MC68VZ328UM.pdf Page 10-15)
CPU_RUN_MODE is not preserved on save state and could allow executing after an address error if a save and load are performed(CPU_RUN_MODE is not used when address error is disabled)
Bootloader memory access
need to check REFREQ clock frequency in RTCCTL
PLLCR CLKEN being off should also disable the SED1376 but this would require a bank refresh on writing to PLLCR
proper clearing of timer interrupts
PCTLR should not divide palmCrystalCycles or dmaclksPerClk32 can't use it(removed palmCrystalCycles from dmaclksPerClk32)
if PCTLR divides the PLL it may also affect DMACLK, SYSCLK and the timers(it doesnt)
timers shouldn't allow comp bits to be cleared until read with a 1 in them and should remain in interrupt state until they are cleared(the interrupt state part is unverified)
SED1376 byte and word swap bits
qt play pause icon not working for emu control button
SED1376 register access
SED1376 picture in picture registers
PCTLR, can divide CPU speed by 1<->31
Palm OS usage of the "rte" instruction is incompatible with the 68020, switch to 68000 core
System Control Register, 0xXXFFF000 all upper banks are registers mode
Port D keyboard enable register
(HW verified)PDPOL inverts interrupts by inverting PDDATA bits, the data register is affected by PDPOL
Endian safe savestates
PLL Control Register, Wake Select
(Resolved by MC68VZ328UM_CORRECTIONS datasheet, its 0xA28, 16 bits)The data sheet says LRRA is 0xFFFFFA29 and 0xFFFFFA28 but its only 8 bits?
(All except edge triggered INT0/1/2/3 restart PLL)Check if interrupts restart PLL when its disabled
Disabling PLL also turns off general purpose timer 1 and 2 unless they are set to use CLK32 as there source
All chip select registers
The boot memory mapping where ROM starts at 0x00000000 and RAM is swapped in
Bits 15 and 14 of the chip selects, currently only the upper 16 bits are taken into account
Supervisor only chip select bits
RAM location and size setting, Dragonball VZ can set the page mapping SDCTRL(SDCTRL only sets external physical pins not RAM mapping)
