video game consoles emulation: howto?

Video GameConsoles

Emulation:HOWTO?

Pierre Bourdon,Nicolas Hureau

Introduction

What is a gameconsole?

Emulation types

Case study 1:bsnes

Case study 2:Dolphin

Conclusion

Video Game Consoles Emulation:HOWTO?

Pierre Bourdon Nicolas Hureau

{delroth,kalenz}@lse.epita.frhttp://lse.epita.fr

July 17, 2012

http://lse.epita.fr

Video GameConsoles

Emulation:HOWTO?


IntroductionWhat is emulation?

Common emulators

Why emulate?

Why are emulatorsinteresting?


Emulation types

Case study 1:bsnes


Conclusion

What is emulation?

Running software made for one platform on anotherplatformRunning software compiled for a CPU on anotherCPUSimulating the hardware in a machine on anothermachine that does not have the same hardware

Video GameConsoles

Emulation:HOWTO?



Common emulators

Why emulate?



Emulation types

Case study 1:bsnes


Conclusion

Common emulators

NestopiazsnesVisual Boy AdvanceProject 64pcsxpcsx2Dolphin

Video GameConsoles

Emulation:HOWTO?



Common emulators

Why emulate?



Emulation types

Case study 1:bsnes


Conclusion

Why?

Preservation: old consoles, collector gamesConvenience: no need to have two separate systemsto playImprovements: resolution, gamepads, turbo mode,3D

Video GameConsoles

Emulation:HOWTO?



Common emulators

Why emulate?



Emulation types

Case study 1:bsnes


Conclusion

Why are emulators so interesting?

Very low levelYou basically rewrite a CPU from scratchHost and emulated hardware rarely match wellThat means difficult technical challenges

Video GameConsoles

Emulation:HOWTO?


Introduction

What is a gameconsole?External interfaces

Internal components

Game consoles software

Conclusion

Emulation types

Case study 1:bsnes


Conclusion

External interfaces

Audio/Video outputs: composite, composante,HDMI, ...Gamepad ports, often a proprietary interface onolder consoles, now often USB/BluetoothStorage devices: memory card, SD card, hard driveGame media reader: cartridge, CDROM, DVDROM,BDROM, GDROM, ...

Video GameConsoles

Emulation:HOWTO?


Introduction


Internal components


Conclusion

Emulation types

Case study 1:bsnes


Conclusion

Internal components

CPU(s) of various architectures (MIPS, PPC, X86)GPU(s) with fixed or programmable pipelineDSP often present to handle sound processingSpecialized chips for security, data decompression,decryption, hashing, ...Network interfaces (Wi-Fi, Ethernet, Bluetooth)Various controllers: optical drive, storage device, ...

Video GameConsoles

Emulation:HOWTO?


Introduction


Internal components


Conclusion

Emulation types

Case study 1:bsnes


Conclusion

Software

Very few game consoles run games on top of anoperating system: Wii, PS3, Xbox 360On all other consoles games run without anythingunder them: they have full privileges (ring0, accessto hardware, etc.)Some consoles (Xbox, PSP, DSi, 3DS) have a "mainmenu" screen which is not an OS, it’s actually morelike a game run by defaultGames directly access hardware mapped registers,read/write to physical memory, control CPU caches,etc. None of this is done through drivers, buthardware manufacturors provide an API to gamedevelopers

Video GameConsoles

Emulation:HOWTO?


Introduction


Internal components


Conclusion

Emulation types

Case study 1:bsnes


Conclusion

Conclusion

Not only a CPU but a large set of chips to reproduceVery different chips, from GPUs to hardwaredecryption modulesLet’s see how we can emulate all of this on acomputer

Video GameConsoles

Emulation:HOWTO?


Introduction


Emulation typesHLE

LLE

Both!

Case study 1:bsnes


Conclusion

High Level Emulation

wine, cxbx (Xbox)No recompilation of the main game code to anotherISASystem calls and standard library calls detection andpatching/hookingSimulate the behavior of these predefined functionswith x86 code instead of simulating the hardwarebehind the predefined functions

Video GameConsoles

Emulation:HOWTO?


Introduction


Emulation typesHLE

LLE

Both!

Case study 1:bsnes


Conclusion

Example

sleep(1)

Implemented in the standard library by loopingwhile a special register (CPU timer) has not reacheda given valueHLE simply replaces that by a call to the native sleepfunction

Video GameConsoles

Emulation:HOWTO?


Introduction


Emulation typesHLE

LLE

Both!

Case study 1:bsnes


Conclusion

Pros/Cons

FastDoes not require a good precision to work on moststuffDoes not require a precise knowledge of how thehardware works internally as long as you have highlevel docsVery hard to get a good precision (timing, edge cases)Reverse engineering the behavior or getting docsoften means infringing copyright and/or patents

Video GameConsoles

Emulation:HOWTO?


Introduction


Emulation typesHLE

LLE

Both!

Case study 1:bsnes


Conclusion

Low Level Emulation

Nestopia, bsnesInstead of reproducing high-level behavior,reproduce the low-level behavior of the chips andrun the original programsSome emulators go as far as emulating the exactbehavior of the memory bus between the chipsEmulates every chip in the virtual hardwareindependently and make them communicatethrough emulated busSchedules execution of the chips to have the sametiming as the real hardware (number of cycles perinstruction for example)

Video GameConsoles

Emulation:HOWTO?


Introduction


Emulation typesHLE

LLE

Both!

Case study 1:bsnes


Conclusion

Example

sleep(1)

With LLE, accesses to the hardware register aredetected when they are sent to the emulated memorycontroller. The timer chip then returns the correctvalue through the busA lot more work to do in the emulator

Video GameConsoles

Emulation:HOWTO?


Introduction


Emulation typesHLE

LLE

Both!

Case study 1:bsnes


Conclusion

Pros/Cons

Very accurate: you control how good the timing isReverse engineering what runs on the specializedchips is not needed, you only need to reimplementtheir ISAVery slow, requires a lot of sync so multicore is noteasy to implementROM dumps for each chip in the console is requiredto run programs properlySome chips are not documented at all and youbasically have to reverse their ISA... which issometimes harder than reversing the ROMs!

Video GameConsoles

Emulation:HOWTO?


Introduction


Emulation typesHLE

LLE

Both!

Case study 1:bsnes


Conclusion

Mixing HLE and LLE

pcsx, pcsx2, Dolphin, Project64Uses HLE for some components of the system andLLE for other componentsMost programmable chips need to be emulated withLLEIn Dolphin: CPU and DSP are LLE, GPU, DSP, DVD,IOS are HLEIn pcsx2: EE and VU1 are LLE, SPU and GPU areHLE

Video GameConsoles

Emulation:HOWTO?


Introduction


Emulation typesHLE

LLE

Both!

Case study 1:bsnes


Conclusion

Example

sleep(1)

The CPU is emulated with LLE, and access to thehardware register containing the current time isinterceptedInstead of fully emulating the timer chip, it isemulated through HLE, so the read on the hardwareregister is translated to a time() call

Video GameConsoles

Emulation:HOWTO?


Introduction


Emulation typesHLE

LLE

Both!

Case study 1:bsnes


Conclusion

Pros/Cons

Good compromise between performance andaccuracyNot relying on very precise timing means you canmultithread the several LLE chips more easilySometimes difficult to make HLE and LLE interactproperly (exceptions/interrupts for example)

Video GameConsoles

Emulation:HOWTO?


Introduction


Emulation types

Case study 1:bsnesSNES/GBA hardware

Cycle-accurate emulation

PPU emulation

Coprocessors


Conclusion

What is bsnes?

Originally an SNES emulator developped by byuuNow supports NES, GB, GBC and GBA (everymainstream 2D Nintendo system)Focus on accuracy instead of speedOpen source project (GPLv3)

Video GameConsoles

Emulation:HOWTO?


Introduction


Emulation types



PPU emulation

Coprocessors


Conclusion

Why focus on accuracy?

Preservation of the consoles (not sold anymore)As close as possible to 100% games supportedNo hack to support games

Video GameConsoles

Emulation:HOWTO?


Introduction


Emulation types



PPU emulation

Coprocessors


Conclusion

SNES Hardware

CPU: 3.58MHz R65816PPU: 64KB VRAMRAM: 128KBGames stored in Game Pak (16MB ROM)

Video GameConsoles

Emulation:HOWTO?


Introduction


Emulation types



PPU emulation

Coprocessors


Conclusion

GBA Hardware

CPU: 16.78MHz ARM7TDMIPPU: 96KB VRAMRAM: 256KB + 32KB + optional 32-64KB in theGame PakGames stored in Game Pak (32MB ROM)

Video GameConsoles

Emulation:HOWTO?


Introduction


Emulation types



PPU emulation

Coprocessors


Conclusion

Old hardware

High-end desktops have 3.5GHz quad-core CPUsShould be fairly straightforward to emulate, right?

Video GameConsoles

Emulation:HOWTO?


Introduction


Emulation types



PPU emulation

Coprocessors


Conclusion

Synchronization

Well, not really... Being cycle accurate is far fromeasy!The more accurate you are, the more computingpower you require: more accuracy => sloweremulatorLots of synchronizations between the chipsTherefore a high overhead

Video GameConsoles

Emulation:HOWTO?


Introduction


Emulation types



PPU emulation

Coprocessors


Conclusion

Synchronization

The whole goal of synchronization is not to executethings on a chip too early (or too late) which mightdepend on unexecuted things on other chipsWe need predictability over the whole executionPreemptive threading is therefore not a good option

Video GameConsoles

Emulation:HOWTO?


Introduction


Emulation types



PPU emulation

Coprocessors


Conclusion

libco

Cooperative threading library developped for bsnescothread_t co_create(uint size, void (*entrypoint)(void))

fastcall void co_swap(cothread_t new, cothread_t current)

mov [edx], espmov esp, [ecx]pop eaxmov [edx+0x4], ebpmov [edx+0x8], esimov [edx+0xc], edimov [edx+0x10], ebxmov ebp, [ecx+0x4]mov esi, [ecx+0x8]mov edi, [ecx+0xc]mov ebx, [ecx+0x10]jmp eax

Video GameConsoles

Emulation:HOWTO?


Introduction


Emulation types



PPU emulation

Coprocessors


Conclusion

Userspace scheduling

co_switch used to switch between threads whensynchronization is needed

void CPU::step(unsigned clocks) {/* ... */input.port1->clock -= clocks * input.port1->frequency;input.port2->clock -= clocks * input.port2->frequency;synchronize_controllers();

}

void CPU::synchronize_controllers() {if (input.port1->clock < 0) co_switch(input.port1->thread);if (input.port2->clock < 0) co_switch(input.port2->thread);

}

Video GameConsoles

Emulation:HOWTO?


Introduction


Emulation types



PPU emulation

Coprocessors


Conclusion

Userspace scheduling

Scheduler which can re-enter last executed threadwith Scheduler::enter and get out of it passing anevent along using Scheduler::exit

enum class ExitReason : unsigned {UnknownEvent,FrameEvent,SynchronizeEvent

};

Video GameConsoles

Emulation:HOWTO?


Introduction


Emulation types



PPU emulation

Coprocessors


Conclusion

Scanline based renderer

We’ll focus on one particular problem : scanlinebased rendererBasically render one entire scanline at a timeFast

Video GameConsoles

Emulation:HOWTO?


Introduction


Emulation types



PPU emulation

Coprocessors


Conclusion

Demo

Air Strike Patrol running on bsnes v088 (compatibilityprofile)

Video GameConsoles

Emulation:HOWTO?


Introduction


Emulation types



PPU emulation

Coprocessors


Conclusion

Problem

What if a game is relying on something happeningduring the rendering of the scanline?Air Strike PatrolIt uses mid-scanline raster effect to show a shadowunder the user’s plane

Video GameConsoles

Emulation:HOWTO?


Introduction


Emulation types



PPU emulation

Coprocessors


Conclusion

Mid-scanline raster effect

When the scanline is being rendered, developer canalter a few pixels using precise timingFor Air Strike Patrol, the Display Register brightnessis adjusted for a few scanlines in the middle of thescreenLess brightness => shadowUseful as it is a gameplay element (allow betteraiming when dropping bombs

Video GameConsoles

Emulation:HOWTO?


Introduction


Emulation types



PPU emulation

Coprocessors


Conclusion

Pixel based renderer

Instead of rendering whole scanlines at a time, pixelare rendered individuallyWe now have our shadow!

Video GameConsoles

Emulation:HOWTO?


Introduction


Emulation types



PPU emulation

Coprocessors


Conclusion

Demo

Air Strike Patrol running on bsnes v088 (accuracy profile)

Video GameConsoles

Emulation:HOWTO?


Introduction


Emulation types



PPU emulation

Coprocessors


Conclusion

Coprocessors

Quick word on a funny thing about emulating oldhardware: coprocessorsQuite a few games were using coprocessorsembedded in the Game Pak to speed up calculations,or do specific tasks

Super FX: RISC CPU used to create 3D worlds withpolygonsDSP-1: Used for 2D, 3D coordinate tramformationsSA-1: R65816, same CPU as in the console, butclocked at 10MHz

Video GameConsoles

Emulation:HOWTO?


Introduction


Emulation types

Case study 1:bsnes

Case study 2:DolphinGamecube/Wii hardware

CPU emulation

GPU emulation

DSP emulation

IOS emulation

Conclusion

What is Dolphin?

Gamecube and Wii emulator - yes, both with thesame programOpen source project (GPL) projectAbout 80 total contributors, 10 activeA lot of usersAccurate enough to run most games that are releasedon Wii on day 1 of their release!

Video GameConsoles

Emulation:HOWTO?


Introduction


Emulation types

Case study 1:bsnes


CPU emulation

GPU emulation

DSP emulation

IOS emulation

Conclusion

Gamecube hardware

CPU: 486MHz PowerPC (codenamed Gekko)GPU: custom ATI chipset (codenamed Flipper)RAM: 24MB SRAM + 16MB slower, DMA DRAMDSP: 81MHz custom Macronix CPUGames stored on DVD with a custom burningmethod2 memory card slots (EXI), 4 controller ports (serial)

Video GameConsoles

Emulation:HOWTO?


Introduction


Emulation types

Case study 1:bsnes


CPU emulation

GPU emulation

DSP emulation

IOS emulation

Conclusion

Wii hardware

CPU: 729MHz PowerPC (codenamed Broadway)GPU: custom ATI chipset (codenamed Hollywood)RAM: 24MB SRAM + 64MB SDRAMDSP: 162MHz custom Macronix CPUIOB: 243MHz ARM CPU running an operatingsystemGames stored on (larger) DVD with a customburning method2 memory card slots (EXI), 4 controller ports (serial)USB, Bluetooth, Wi-Fi

Video GameConsoles

Emulation:HOWTO?


Introduction


Emulation types

Case study 1:bsnes


CPU emulation

GPU emulation

DSP emulation

IOS emulation

Conclusion

PowerPC primer

Designed by IBM, Apple and Motorola in 199132 bit RISC architecture, 32 registers, 4 bytesinstructionsSeparate instruction and data caches which aremanually controlled (flush, invalidate, prefetch,disable)Several special registers (SPR) used for internal CPUfeatures: disabling interrupts, enabling pagination,etc.Used in all modern gaming consoles: Wii, Xbox 360,PS3

Video GameConsoles

Emulation:HOWTO?


Introduction


Emulation types

Case study 1:bsnes


CPU emulation

GPU emulation

DSP emulation

IOS emulation

Conclusion

Interpreter mode

Each instruction of the CPU is decoded and executedwhen it needs to be executedEasy to implement but you can’t reach 700MHz thatway

while (true){

u32 instr = fetch();handler h = decode(instr);h();

}

Video GameConsoles

Emulation:HOWTO?


Introduction


Emulation types

Case study 1:bsnes


CPU emulation

GPU emulation

DSP emulation

IOS emulation

Conclusion

Static recompilation

Before executing the program, recompile thePowerPC code to X86 codeFetch/Decode only done once per instructionDoes not work: static recompilation can only be usedin very specific casesIf the PowerPC code is modified during execution,then the recompiled program is no longer validWe’ll talk more about static recompilation later

Video GameConsoles

Emulation:HOWTO?


Introduction


Emulation types

Case study 1:bsnes


CPU emulation

GPU emulation

DSP emulation

IOS emulation

Conclusion

Dynamic recompilation

Also called Dynarec or JIT recompilationMain emulation method for CPUs in modernemulatorsRecompile blocks of PowerPC code when they arefirst executedWhen they are executed again, reuse the compiledversionThe hard part is detecting when to invalidate thecompiled version because of PowerPC code changes

Video GameConsoles

Emulation:HOWTO?


Introduction


Emulation types

Case study 1:bsnes


CPU emulation

GPU emulation

DSP emulation

IOS emulation

Conclusion

Block dispatcher

Small function written in x64 assembly that serves asthe entry point of the CPU emulationReads the current PC, checks if there is a jit blockalready compiled, if not compiles it, then jumps thereAllows easy indirect jumps emulation: when youdon’t know where you’re going to jump, update PCand jump to the dispatcherIn Dolphin, also checks for pending interrupts andlimits the CPU speed to avoid going too fast

Video GameConsoles

Emulation:HOWTO?


Introduction


Emulation types

Case study 1:bsnes


CPU emulation

GPU emulation

DSP emulation

IOS emulation

Conclusion

JIT cache invalidation

Tracking every memory write operation is too slowCode and data are in the same memory space so youcan’t use tricks like guard pagesDolphin cheats and uses the fact that games "need"to invalidate the CPU icache manually afterrewriting codeInvalidate a JIT code block when a CPU icache blockis invalidated

Video GameConsoles

Emulation:HOWTO?


Introduction


Emulation types

Case study 1:bsnes


CPU emulation

GPU emulation

DSP emulation

IOS emulation

Conclusion

Constant values propagation

CVP is a technique mostly used in compilers, but itcan also help a lot in recompilationPowerPC has no instruction that takes 32 bitsimmediate valuesLoad 32 bits == load 16 bits high then or with 16 bitsCVP would detect at the first load that the registervalue is a constant and would not translate theinstructionWhen the constant value is used for the first time it isloaded to a registerJust one example of where CVP is useful... there are alot moreWould be even better with VM techniques like partialblock specialization (yet to be tried in an emulator)

Video GameConsoles

Emulation:HOWTO?


Introduction


Emulation types

Case study 1:bsnes


CPU emulation

GPU emulation

DSP emulation

IOS emulation

Conclusion

Register allocator

PowerPC has 32 general registers, X64 has only 16registersA dynamic way to allocate PPC registers to X64registers is requiredDolphin uses a very simple register allocator thatuses all available registers and removes the firstallocated ones when neededPossible improvement, but work on other emulators(NullDC) showed that the gain might be very small

Video GameConsoles

Emulation:HOWTO?


Introduction


Emulation types

Case study 1:bsnes


CPU emulation

GPU emulation

DSP emulation

IOS emulation

Conclusion

Experiments

Block merging / block linking: allows jumpingdirectly from one block to another without goingthrough the dispatcher when a jump address isconstantJitIL: an implementation of the JIT which compilesPowerPC instructions first to an intermediatelanguage composed of several micro-ops, thenapplies optimizations on the micro-ops stream, andtranslates the micro-ops to X64. Unfortunately notyet faster than the normal JIT

Video GameConsoles

Emulation:HOWTO?


Introduction


Emulation types

Case study 1:bsnes


CPU emulation

GPU emulation

DSP emulation

IOS emulation

Conclusion

GC GPU description

Fixed pipeline: not programmable but a lot ofpossible states and configuration variablesThat means we can HLE that chip by reproducing itsbehavior without trying to understand how it isimplemented by the real hardareThe GPU takes commands from the CPU in order toset rendering mode and get vertices, colors, textures,indices

Video GameConsoles

Emulation:HOWTO?


Introduction


Emulation types

Case study 1:bsnes


CPU emulation

GPU emulation

DSP emulation

IOS emulation

Conclusion

FIFO

The FIFO is a memory zone from which the GPUreads commands pushed by the CPUIt’s the main synchronization point between CPUand GPUThe CPU can configure the GPU to get exceptionswhen the FIFO becomes too full, which makes it hardto emulate in a separate threadContinous zone of improvements in emulationstability

Video GameConsoles

Emulation:HOWTO?


Introduction


Emulation types

Case study 1:bsnes


CPU emulation

GPU emulation

DSP emulation

IOS emulation

Conclusion

Texture cache

The GC GPU has high speed access to the RAM, sothere is no need for texture uploads like on PCThe texture cache uploads requested textures to thePC GPU on demand and removes textures whenthey aren’t needed anymoreCurrently uses hashing to detect data modificationSomeone is working on using the same system theJIT cache uses (data cache invalidation) to gainperformance

Video GameConsoles

Emulation:HOWTO?


Introduction


Emulation types

Case study 1:bsnes


CPU emulation

GPU emulation

DSP emulation

IOS emulation

Conclusion

Shader generators

PC GPUs are programmable through shaders, thefixed GL/DX pipeline is implemented through thatmechanismDolphin implements the GC fixed pipeline in thesame way, generating vertex/fragment shaders onpipeline state changesAlready compiled shaders are cached in memory,and on disk when using the DX9 emulation backendThe shaders are where the meat of the GPUemulation is

Video GameConsoles

Emulation:HOWTO?


Introduction


Emulation types

Case study 1:bsnes


CPU emulation

GPU emulation

DSP emulation

IOS emulation

Conclusion

Vertex loaders

Vertices are passed to the GPU either through theFIFO (immediate mode) or through a vertex arrayTheir format and components are defined by theGPU stateParsing the vertices and transforming their data in aform usable by the PC GPU is done by the vertexloadersTo make the vertex loaders faster, the translationfunction is compiled dynamically when the vertexformat changesWhen possible vectorization is also used in order totranslate several vertices at the same time

Video GameConsoles

Emulation:HOWTO?


Introduction


Emulation types

Case study 1:bsnes


CPU emulation

GPU emulation

DSP emulation

IOS emulation

Conclusion

EFB

The EFB is the name given to the framebuffer inwhich graphics are rendered by the GPUIt can be either accessed directly by the CPU(mapped in memory) or copied to main memory forfurther processingHard to implement on PC because the GPU and CPUdo not share memory and there is no directframebuffer accessDolphin has an option to emulate EFB copiesaccurately by copying and reencoding the GPUframebuffer to GC RAMIt can also emulate it in a faster way by copying theEFB to a texture, which is enough for the needs ofmost games

Video GameConsoles

Emulation:HOWTO?


Introduction


Emulation types

Case study 1:bsnes


CPU emulation

GPU emulation

DSP emulation

IOS emulation

Conclusion

Possible improvements

Vertex arrays hashing with a vertex array cache toreduce transfers between CPU and GPUAutomatic detection of EFB copy mode (to RAM orto Texture)Better state tracking to avoid useless changes whichcause useless vertices flushesOffloading more work on the GPU (OpenCL texturedecoding, transform feedback, etc.)

Video GameConsoles

Emulation:HOWTO?


Introduction


Emulation types

Case study 1:bsnes


CPU emulation

GPU emulation

DSP emulation

IOS emulation

Conclusion

GC DSP description

Coprocessor handling sound data and mixing themtogether to get one final stream as an outputRuns at 1/6 of the CPU frequencyTightly coupled with the CPU so his timing has to bevery precise in some casesRuns code uploaded by the CPU to the DSP RAM

Video GameConsoles

Emulation:HOWTO?


Introduction


Emulation types

Case study 1:bsnes


CPU emulation

GPU emulation

DSP emulation

IOS emulation

Conclusion

CPU architecture primer

Separate data/code memory spaces (Harvardarchitecture)Registers have specific uses: index registers, addressregisters, accumulators, multiplication result, etc.Most registers are 32 bits, accumulators are 48 bitsMost instructions can be followed by an extendedopcode which performs another independantoperationVery domain specific and does not match X64 well

Video GameConsoles

Emulation:HOWTO?


Introduction


Emulation types

Case study 1:bsnes


CPU emulation

GPU emulation

DSP emulation

IOS emulation

Conclusion

UCode, ROM, coeffs

The DSP ucode is the program sent by the game tothe DSPThe DSP also has access to a ROM which containssome unrolled mixing functions in order to savespace in the ucodeThis ROM cannot be distributed with Dolphin (it’sNintendo IP) so it has to be dumped by the usersThe ROM also contains a table containingcoefficients, suspected to be used as FIR interpolatorinput dataVery few different ucodes as most developers use theone given by Nintendo in their SDK

Video GameConsoles

Emulation:HOWTO?


Introduction


Emulation types

Case study 1:bsnes


CPU emulation

GPU emulation

DSP emulation

IOS emulation

Conclusion

HLE

Because there is only a few ucodes Dolphin canemulate the behavior of each of these ucodes withoutemulating their instructions directly (HLE)Very complex behavior and it’s hard to keep thesame timing as the ucodeA lot of games have sound issues with DSP HLE.Most games using sequenced music have missinginstruments because the update interval is too large

Video GameConsoles

Emulation:HOWTO?


Introduction


Emulation types

Case study 1:bsnes


CPU emulation

GPU emulation

DSP emulation

IOS emulation

Conclusion

LLE

Uses the same JIT approach as the CPU emulationNo cache expiration because code modifications canonly be done through upload which is easilydetectableNo register allocator used because all registers can fitin X64 registersBecause the ISA does not match X64 very well it’shard to get good performance

Video GameConsoles

Emulation:HOWTO?


Introduction


Emulation types

Case study 1:bsnes


CPU emulation

GPU emulation

DSP emulation

IOS emulation

Conclusion


Static recompilation: the only thing missing for thatis a way to handle indirect jumpsUsing LLVM in order to optimize the recompiledcodeImproving HLE with a better documentation reverseengineered from the ucodes

Video GameConsoles

Emulation:HOWTO?


Introduction


Emulation types

Case study 1:bsnes


CPU emulation

GPU emulation

DSP emulation

IOS emulation

Conclusion

What is IOS?

Wii OS that runs on the Starlet ARM CPUGames still run with full privileges on the PPC CPUbut must communicate with IOS for some hardwareaccessBluetooth, NAND, USB, Wi-FiThis is emulated using HLE, the simple syscallinterface makes it very easy to do so

Video GameConsoles

Emulation:HOWTO?


Introduction


Emulation types

Case study 1:bsnes


CPU emulation

GPU emulation

DSP emulation

IOS emulation

Conclusion

IPC registers

PPC communicates with IOS through four hardwareregisters2 readable, 2 writablePPC sends the address of a request structure inmemory to make a syscall requestIOS then handles the request, sends a response andtriggers an interrupt

Video GameConsoles

Emulation:HOWTO?


Introduction


Emulation types

Case study 1:bsnes


CPU emulation

GPU emulation

DSP emulation

IOS emulation

Conclusion

Synchronous/asynchronous requests

Some of the syscalls must be handled synchronously,some can be done in a threadFor example, Bluetooth needs precise timing, doingit asynchronously could cause problemsDoing DVD IO synchronously causes stuttering dueto hard drive access timeBoth styles are handled in Dolphin in order to get thebest out of IOS HLE

Video GameConsoles

Emulation:HOWTO?


Introduction


Emulation types

Case study 1:bsnes


CPU emulation

GPU emulation

DSP emulation

IOS emulation

Conclusion


Implement some missing IOS features (network is inprogress)Maybe one day IOS LLE? Hard to implement andnot very useful, but could be a fun project forsomeone wanting to do an ARM emulator

Video GameConsoles

Emulation:HOWTO?


Introduction


Emulation types

Case study 1:bsnes


Conclusion

Emulation is fun

Working on a program that emulates a wholecomplex system is a very interesting challengeThere is still a lot of room for improvement, and a lotof systems not yet emulated (or not properly)Emulation becomes harder and harder becauseconsole CPUs are getting very near PC CPUs interms of per core performanceYou can get started with emulation very easily, writea Chip-8 emulator, then work on Gameboy!

Video GameConsoles

Emulation:HOWTO?


Introduction


Emulation types

Case study 1:bsnes


Conclusion

Questions?

@delroth_, @kalenz

http://code.google.com/p/dolphin-emu/

http://byuu.org/bsnes

#dolphin-emu @ efnet

http://code.google.com/p/dolphin-emu/

http://byuu.org/bsnes

video game consoles emulation: howto?

Documents