VWE TESLA · Division VelociRender · i860 firmware emulator

The board's own firmware
is rendering again

A cycle-faithful Intel i860 interpreter now runs the game's actual shipped firmware — booted, initialised, and fed a complete recorded mission over the wire. It replays every command, emits the real PXPL5 IGC render stream, and projects the scene geometry. Below is an object it drew, its vertices and normals pulled straight off the emulated chip and reconstructed in 3D — geometry this board's firmware has not computed in thirty years.

reconstructed · firmware geometry + normals
the object cap7 was drawing — its 45 projected vertices resolve into a complete 9×5 height-field surface, rebuilt here in true 3D and lit by the board's own per-vertex normals. Pulled live off the emulated i860.
trace · i860 execution → IGC command DMA
26,422
wire commands replayed (whole mission)
8,562
draw_scene frames processed
191/192
screen regions binned with geometry
0
unimplemented ops remaining on the path

01 The render signal chain

Nothing here is re-interpreted by us. Each stage is the firmware's own code executing on the emulated i860 — from parsing the wire packet to writing the bit-serial micro-program the Pixel-Planes array runs.

in
Wire
dN_receive → 42-action dispatch
cpu
i860
transform · clip · classify
geom
Binitize
per-region 64×128 bins
out
IGC DMA
SEND / TILE / FLUSH stream
px
Pixel-Planes
bit-serial array — next build

02 The output, decoded

The firmware DMAs the render to the card as an opcode stream (DMAENGN.H). Left: a real per-region command list captured from the emulator. Right: where each SEND lands — bit-serial IGC micro-code, not plain floats, which is why final pixels need the array simulator.

 region 0x0801f000 · DMA list
# addr            opcode
0x08015800  SEND(4)      ; edge coeffs
0x00000000  FLUSH
0x08015820  SENDE(0x35)  ; z / colour
0x080159e0  SEND(0x18)
0x08015aa0  SEND(6)
0x00000000  FLUSH
0x08015ae0  SENDE(0x5c)
0x08015dc0  SEND(9)      ; …binned per 64×128 tile
 SEND target 0x0801f100 · IGC micro-code
# bit-serial Pixel-Planes program
+000  00000100   ; header
+008  46800000   ; 16384.0 scale
+01c  0610ff00  00401000
+024  0610ff08  00401081
+02c  0610ff10  00401102
+034  0610ff18  00401183
      ; MEM += MEM, bit-serial
      ; eval Ax+By+C across the tile

03 Where the geometry landed

At the frame flush the firmware walks the screen-bin array and hands the IGC one descriptor per 64×128 region. This grid is drawn from the real captured descriptor scan — filled cells are regions that received transformed geometry. A full mission view fills nearly the whole frame: ground plane and sky, exactly as expected.

region has geometry empty region (shared page) 96 × 2 descriptor grid · 191 of 192 filled

04 How the death-camera saw it

The surface above is the same 45 vertices, sorted back into model space — they form an exact 9 × 5 height-field grid (x and z in even 2-unit steps, y the height at every node; all 45 cells filled). What the board actually wrote to screen is below: cap7's death-camera views that surface nearly edge-on, so the frame the i860 projected is a thin, folded sliver. It is authentic output — just an awkward angle. Left, that projection Gouraud-shaded; right, its raw VSTRIP wireframe.

the board's screen-space frame — Gouraud-shaded, grazing near-edge-on angle
raw VSTRIP wireframe — 4 strips, 45 vertices, exactly as the i860 emitted them

05 What it took to get here

The i860 core was corrected against the toolchain's own assembler output and MAME's validated i860 model. A selection of the load-bearing fixes:

store encoding
i860 stores keep the source in bits 15:11 and split the offset — every function return went to 0 until this was found. Prologues now save r1.
op 0x13 escape
lock / calli / unlock share one opcode; everything decoded as calli, so every spinlock jumped to address 0. The phantom "exit stub."
FP pipeline
Exact PFAM/PFMAM dual-ops, per-stage precision, fdest bypass. The Newton–Raphson divide now yields 16 ÷ 16 = 1 through the pipes, unhooked.
pipelined pftrunc
Float→int through the adder pipe — a form no prior i860 emulator implemented. Killed an 8.3-million phantom-row loop.
IGC drain
Per-page completion is nonzero-on-done, and consumed pages reset their write index. Frames stopped saturating after ~1,400 draws.
Landed Firmware → render command stream, end to end

Verified working

  • Cold boot of the capture's own firmware build on the emulated i860
  • Full recorded mission replays to completion — 26,422 commands
  • Scene graph, transform, frustum classify on real geometry
  • Real PXPL5 IGC opcode stream emitted and decoded (SEND / TILE / FLUSH)
  • Geometry binned into 191 screen regions
  • Object recovered and shaded — a 9×5 height-field surface, lit by the firmware's own normals (above)

The last mile to pixels

  • Our software-shaded frame is here — the board's own hardware-shaded, textured frame is what remains
  • The SEND payloads are bit-serial Pixel-Planes micro-code, not stored triangles
  • A shaded frame needs the 128×64 pixel-processor array simulator
  • The model is known — IGCOPS.C: eval_ltree = Ax+By+C, an enable register, bit-serial MEM ops