SH-4 core has inverted 32-bit words in double-precision FPRs

[MooglyGuy]

MAME's SH-4 core assumes that one can simply cast a float pointer to a double pointer and have the individual 32-bit words land in the correct order. This is not, nor has it ever been, a safe assumption.

Among surely other bugs, this causes the car Pole Position in Namco Museum on the Dreamcast pointed to the left. If and when this bug is fixed, it will point directly ahead.

[snickerbockers]

It looks like the problem is that when the sh4 code calls into a cfunc, it only saves the general-purpose registers to their backing and none of the FPU registers. If the cfunc makes any changes to the FPU registers, then m_fd_regmap, m_fs_regmap, and m_sh2_state->m_fr will all become inconsistent with each other.

Having said that, there's an even bigger problem which is that the DRC doesn't seem to be aware that the double-precision registers and the single-precision registers are supposed to be overlapped. They're created as two separate mappings to the same backing: https://github.com/mamedev/mame/blob/master/src/devices/cpu/sh/sh4.cpp#L2233.

Right now I have this fixed in my fork at snickerbockers@977d99e by replacing all the FPU instructions with cfuncs; that way the FR and DR register sets are always consistent because they're never accessed through UML.

I think the best way to fix this is to include the PR bit and the SZ bit into the hash for each code block, and make each code block end whenever it encounters an instruction that might toggle either of those bits (and maybe also instructions that might toggle the FR bit, which does bank-switching). This will also solve the problem of needing to do a conditional jump and an unconditional jump in every FPU opcode.

Also discovered that this bug is preventing Hanagumi Taisen Columns 2 from booting with the DRC enabled. When this is fixed, that title will be in-game.

[angelosa]

Still happening as in 0.228