md: approximate some 32x memory timings

Timings are still *way* off, but better;
Framebuffer and SDRAM writes are no longer free.

ares/md/m32x/bus-internal.cpp

@@ -15,6 +15,9 @@ auto M32X::readInternal(n1 upper, n1 lower, n32 address, n16 data) -> n16 {
       if(shs.active()) shs.step(1);
     }
 
+    // TODO: SH2 ROM accesses need to stall while the m68k is on the bus
+    if(shm.active()) shm.step(6);
+    if(shs.active()) shs.step(6);
     return cartridge.child->read(upper, lower, address, data);
   }
 
@@ -37,13 +40,17 @@ auto M32X::writeInternal(n1 upper, n1 lower, n32 address, n16 data) -> void {
   if(address >= 0x0400'0000 && address <= 0x0401'ffff) {
     if (!vdp.framebufferAccess) return;
     if(!data && (!upper || !lower)) return;  //8-bit 0x00 writes do not go through
+    if(shm.active()) shm.step(4);
+    if(shs.active()) shs.step(4);
     if(upper) vdp.bbram[address >> 1 & 0xffff].byte(1) = data.byte(1);
     if(lower) vdp.bbram[address >> 1 & 0xffff].byte(0) = data.byte(0);
     return;
   }
 
   if(address >= 0x0402'0000 && address <= 0x0403'ffff) {
     if (!vdp.framebufferAccess) return;
+    if(shm.active()) shm.step(4);
+    if(shs.active()) shs.step(4);
     if(upper && data.byte(1)) vdp.bbram[address >> 1 & 0xffff].byte(1) = data.byte(1);
     if(lower && data.byte(0)) vdp.bbram[address >> 1 & 0xffff].byte(0) = data.byte(0);
     return;
@@ -52,12 +59,16 @@ auto M32X::writeInternal(n1 upper, n1 lower, n32 address, n16 data) -> void {
   if(address >= 0x0404'0000 && address <= 0x0405'ffff) {
     if (!vdp.framebufferAccess) return;
     if(!data && (!upper || !lower)) return;  //8-bit 0x00 writes do not go through
+    if(shm.active()) shm.step(4);
+    if(shs.active()) shs.step(4);
     if(upper) vdp.bbram[address >> 1 & 0xffff].byte(1) = data.byte(1);
     if(lower) vdp.bbram[address >> 1 & 0xffff].byte(0) = data.byte(0);
     return;
   }
 
   if(address >= 0x0600'0000 && address <= 0x0603'ffff) {
+    if(shm.active()) shm.step(1);
+    if(shs.active()) shs.step(1);
     if(upper) sdram[address >> 1 & 0x1ffff].byte(1) = data.byte(1);
     if(lower) sdram[address >> 1 & 0x1ffff].byte(0) = data.byte(0);
     return;