VWE TESLA · Division VelociRender · i860 firmware emulator

The board's own firmware
is rendering again

A cycle-faithful Intel i860 interpreter now runs the game's actual shipped firmware — booted, initialised, and fed a complete recorded mission over the wire. It replays every command, emits the real PXPL5 IGC render stream, and projects the scene geometry. Below is an object it drew, its vertices and normals pulled straight off the emulated chip and reconstructed in 3D — geometry this board's firmware has not computed in thirty years.

reconstructed · firmware geometry + normals
the object cap7 was drawing — its 45 projected vertices resolve into a complete 9×5 height-field surface, rebuilt here in true 3D and lit by the board's own per-vertex normals. Pulled live off the emulated i860.
trace · i860 execution → IGC command DMA
26,422
wire commands replayed (whole mission)
8,562
draw_scene frames processed
191/192
screen regions binned with geometry
0
unimplemented ops remaining on the path

01 The render signal chain

Nothing here is re-interpreted by us. Each stage is the firmware's own code executing on the emulated i860 — from parsing the wire packet to writing the bit-serial micro-program the Pixel-Planes array runs.

in
Wire
dN_receive → 42-action dispatch
cpu
i860
transform · clip · classify
geom
Binitize
per-region 64×128 bins
out
IGC DMA
SEND / TILE / FLUSH stream
px
Pixel-Planes
array model simulated · §05

02 The output, decoded

The firmware DMAs the render to the card as an opcode stream (DMAENGN.H). Left: a real per-region command list captured from the emulator. Right: where each SEND lands — bit-serial IGC micro-code, not plain floats, which is why final pixels need the array simulator.

 region 0x0801f000 · DMA list
# addr            opcode
0x08015800  SEND(4)      ; edge coeffs
0x00000000  FLUSH
0x08015820  SENDE(0x35)  ; z / colour
0x080159e0  SEND(0x18)
0x08015aa0  SEND(6)
0x00000000  FLUSH
0x08015ae0  SENDE(0x5c)
0x08015dc0  SEND(9)      ; …binned per 64×128 tile
 SEND target 0x0801f100 · IGC micro-code
# bit-serial Pixel-Planes program
+000  00000100   ; header
+008  46800000   ; 16384.0 scale
+01c  0610ff00  00401000
+024  0610ff08  00401081
+02c  0610ff10  00401102
+034  0610ff18  00401183
      ; MEM += MEM, bit-serial
      ; eval Ax+By+C across the tile

03 Where the geometry landed

At the frame flush the firmware walks the screen-bin array and hands the IGC one descriptor per 64×128 region. This grid is drawn from the real captured descriptor scan — filled cells are regions that received transformed geometry. A full mission view fills nearly the whole frame: ground plane and sky, exactly as expected.

region has geometry empty region (shared page) 96 × 2 descriptor grid · 191 of 192 filled

04 How the death-camera saw it

The surface above is the same 45 vertices, sorted back into model space — they form an exact 9 × 5 height-field grid (x and z in even 2-unit steps, y the height at every node; all 45 cells filled). What the board actually wrote to screen is below: cap7's death-camera views that surface nearly edge-on, so the frame the i860 projected is a thin, folded sliver. It is authentic output — just an awkward angle. Left, that projection Gouraud-shaded; right, its raw VSTRIP wireframe.

the board's screen-space frame — Gouraud-shaded, grazing near-edge-on angle
raw VSTRIP wireframe — 4 strips, 45 vertices, exactly as the i860 emitted them

05 The Pixel-Planes array, simulated

This is the final stage in silicon — and it now runs in software. The PXPL5 IGC is a region rasteriser: the screen splits into 64 × 128 tiles; every pixel carries a 26-byte bit-memory and an enable bit; all pixels evaluate one linear tree in lockstep — eval_ltree(x,y,A,B,C) = (int)(x·A + y·B + C). A triangle becomes three edge trees into the enable register, then Z and R/G/B planes interpolated per pixel and z-buffered in pixel memory (IGCOPS.C). Fed the captured surface, the model lights the tiles below and renders pixels that match our reference rasteriser to within edge anti-aliasing — the array reproduced faithfully.

the object's footprint across the array — 18 of 50 tiles lit, each a 64×128 region of pixel processors
pixel memory · 26 bytes = 208 bits
Z · 24bR·8G·8 B·8enable + working bits
  • three edge trees → the enable register (the inside test)
  • Z / R / G / B are planes, evaluated per pixel by the linear tree
  • z-buffer via MEM2geMEM2; every write gated by enable
  • output read back out of pixel memory → framebuffer
  • validated pixel-faithful to the reference — ~1%, at edges only

What this is not, yet: a decode of the compiled bit-serial micro-code the DMA actually ships (§02, right). That binary encoding is still undecoded, and it is how the ground and sky — which carry no stored vertices — reach the array. This is the array's computational model: the pixels that micro-code would produce.

06 What it took to get here

The i860 core was corrected against the toolchain's own assembler output and MAME's validated i860 model. A selection of the load-bearing fixes:

store encoding
i860 stores keep the source in bits 15:11 and split the offset — every function return went to 0 until this was found. Prologues now save r1.
op 0x13 escape
lock / calli / unlock share one opcode; everything decoded as calli, so every spinlock jumped to address 0. The phantom "exit stub."
FP pipeline
Exact PFAM/PFMAM dual-ops, per-stage precision, fdest bypass. The Newton–Raphson divide now yields 16 ÷ 16 = 1 through the pipes, unhooked.
pipelined pftrunc
Float→int through the adder pipe — a form no prior i860 emulator implemented. Killed an 8.3-million phantom-row loop.
IGC drain
Per-page completion is nonzero-on-done, and consumed pages reset their write index. Frames stopped saturating after ~1,400 draws.
Landed Firmware → render command stream, end to end

Verified working

  • Cold boot of the capture's own firmware build on the emulated i860
  • Full recorded mission replays to completion — 26,422 commands
  • Scene graph, transform, frustum classify on real geometry
  • Real PXPL5 IGC opcode stream emitted and decoded (SEND / TILE / FLUSH)
  • Geometry binned into 191 screen regions
  • Object recovered and shaded — a 9×5 height-field surface, lit by the firmware's own normals (above)
  • Pixel-Planes array simulated (§05) — 64×128 tiles, per-pixel memory, edge trees + z-buffer, validated pixel-faithful

The last mile to pixels

  • The array's computational model runs and matches the reference — the piece left is the board's own compiled micro-code
  • The DMA's SEND payloads are bit-serial Pixel-Planes micro-code; that binary encoding is still undecoded
  • It is how the ground and sky — which carry no stored vertices — reach the array
  • Cross-referencing the 0x0610ff / 0x00401 words against IGCOPS.C + the PXPL5 assembler is the next decode