- Dec 29, 2021
-
-
Geo Ster authored
* The BIOS now continues by initializing the DMA Controller. This is one of the most important hardware components of the PS2, as it assists the EE with transfering data where it needs to be. I've even read that at times it can do more work than the EE itself. * Since the DMAC isn't used at this stage, we only really have to implement its registers and reads/writes to them, which is pretty easy. However one register D_CTRL is a bit quirky in a sense that writes to it clear/reverse its bits, not overwrite them. * To emulate this, an additional struct is added to the register unions and bitwise operators are used to write to the upper and lower parts of the register appropriately. You can look into the source code for more details. * This allows the EE to start initializing the VU1 which is quite exciting!
-
Geo Ster authored
-
Geo Ster authored
* Allows us to progress futher into the initialization phase
-
Geo Ster authored
* Yeah, timers again, my favourite topic... To be frank the EE timers are a bit simpler than the IOP timers as they have less complexity in their configuration. However, since the BIOS starts to use them at this point, we can't get away with a extermelly partial implementation like the IOP. * The Emotion Engine has four hardware timers, each of them having three registers (four on Timer 0 and 1). They are practically the same with the IOP in that regard, having a count a compare/target and a mode register. Timer 0 and 1 have an additional register Tn_HOLD which keeps track of the count value when a peripheral on the SBUS generates an interrupt. * All the timers increment based on the bus clock which is exactly half of the EE clock. The timers can also be configured to count based on external sources, namely hblank and vblank. These are less accurate but can be used to keep track when the screen refreshes. I had hoped that we could have ignored hblank for now, but the BIOS configures Timer 3 (used for BIOS alarms) to use it so implementing it is necessary. The timings were taken from the timer header [1] of the ps2sdk. * An interesting fact as well is the interrupts as edge triggered which means that an interrupt is sent to the EE when the raised flags in Tn_MODE switch from 0 to 1 [2]. This is easy to implement and so did I, to avoid any headaches in the future. * Since the EE ticks the timers directly, we can't increment the counters each time the function get called. To properly emulate the timer frequency, an internal counter is used, that when its value is equal to the ratio between the EE frequency and the timer clock, the real counter is incremented. * This can be expensive since the timer function gets called every EE cycle so we will probably change it to cycle adding in the future, especially when the JIT will be implemented. [1] https://github.com/ps2dev/ps2sdk/blob/master/ee/kernel/include/timer.h#L53 [2] https://psi-rockin.github.io/ps2tek/#eetimers
-
- Dec 27, 2021
-
-
Geo Ster authored
* Firstly, I fixed a small bug in the Handler that caused data loss on 128bit operations. * The GIF is a marvellous and complicated little piece of hardware that handles transfers between the EE and the GS. It can be "fed" by three paths, PATH1 is from the VPU1 memory, PATH2 is from the VPU1 FIFO and PATH3 is directly from the main bus. Since we don't have any VUs implemented we only care about PATH3 at this stage. * Each primitive sent has the form of a linked list. The EE first sends an 128bit GIFTag that acts as the header and tells the GIF how much more data to expect and what to do with it. The loop ends when the EE sends a GIFTag with the EOP field set to 1. (EE User's Manual [150]) * Each data packet after a GIFTag can be processed in three different ways depending on the FLG field of the tag; PACKED, REGLIST or IMAGE mode. For now we only care about PACKED. * When in PACKED mode, the EE will send NREG * NLOOP (specified in GIFtag) qwords after the tag. Each qword can be processed in different ways depending on the desc in REG field of the GIFTag. Page 152 of the EE User's Manual shows the different modes. The REG field though is in reality a bit array of 4-bit descriptors. To understand this better, here are the processing steps: 1. The first qword after the GIFTag is processed based on the least significant bits (64:67) (the first descriptor) and is output 2. The second qword is processed based on the next descriptor (68:71) (second descriptor) and is output 3. Steps 1,2 are repeated NREG times. 4. Steps 2,3 are repeated NLOOP times There are more variables we have to take into account with PATH3, because it can also be masked by other PATHs which have higher priority. But that is for later. Don't worry though if you didn't get it completetly. The GIF is nowhere near finished, so I will have more chances to explain how it works. For more info you can read the GIF chapter of the provided EE User's Manual.
-
- Dec 26, 2021
-
-
Geo Ster authored
-
Geo Ster authored
* Initially the LQ/SQ instructions were implemented to perform two sequential 64bit operations to emulate 128bit reads/writes. However this won't work well for us, especially when writing to the GIF FIFO. To mitigate this we can use the __int128 gcc extension (yay for switching to clang once again!), which provides us with an optimized way of storing 128bit data.
-
- Dec 25, 2021
-
-
Geo Ster authored
This commit fixes some issues preventing IOP interrupts from working correctly while also seperating them into a seperate class for convenience. * Previously the pending flag was written to the first bit of cause.IP, which while correct was flawed. To understandw why let's look at how interrupts get triggered. COP0 has 2 8 bit masks, IP (cause) and Im (status). On both of these registers the first 2 bits are ignored because they are used for software interrupts which are unsupported on the IOP. However while Im was including these unused bits, IP did not thus causing mistaken comparions. Below is a diagram that shows the issue. IP was bits 10-15 while Im was bits 8-15. Comparing diffent ranges like this doesn't work. Cause: ... 00|111111| ... Status: ... |00111111| ... The fix was to make IP point to 8-15 range and adjust the writing mechanism in the INTR::interrupt_pending function. * In addition the usage of >= instead of == in the timers, caused a bug where the timer would continiously send interrupts after reaching target which is not the intended behaviour. Fix that as well.
-
Geo Ster authored
This is a pretty big commit so the description is probably going to be a whole essay again explaining all the changes. Emulation is extermely complicated and thus I need to explain all of my reasoning and sources. This commit contains 3 major changes that all work together to form the new memory subsystem: * New handler infrastrucutre * Compiler switch to clang-cl * Initial implementation of EE interrupts Now, you reader, might wonder why I decided to redo the relatively simple and straightforward system we had before. Well that system had some drawbacks that I think needed to be addressed early on. Firstly, it is highly centralized, which means that for every new component the read/write functions of the ComponentManger (now Emulator) need to updated. This isn't that big of an issue as the second one though. The old system relies heavily on branches to figure out the destination of a read/write which is bad for performance. Especially because our address ranges aren't continuous, the compiler can't optimize the switch statement in any way. This leads to a lot of assembly code, many jumps. The initial idea for this new system was taken from a PCSX2 devblog I read recently: https://pcsx2.net/developer-blog/218-so-maybe-it-s-about-time-we-explained-vtlb.html It explains a system, where the address range is divided into pages, where each page is handled by a handler function. This is perfect for us, because it moves most of the code to the initialization phase (when the components register their handlers), while reads/writes are very fast, only having to lookup the handler table and calling the appropriate function. However is isn't as easy to implement to implement though. The main problem was how to store class member function of different classes in a single array and call them without knowing their type. Firstly I thought of using std::function, which is perfect for this due to its type erasure but is was quickly ruled out because of the very high overhead. Next, I considered inheritence and virtual functions, which was a step to the right direction. However that also has the overhead of looking up the vtable. Finally, though, I discovered a neat little trick with function pointers. You can actually cast a pointer to a base class member function, to a derived class member function as long as the function isn't ambigious. So the final solution was to make all the components inherit from an empty (for now) Compoent class and store a common Component function pointer. The compiler will handle the rest, with some dose of magic and inheritance! The handler interface is located in the common/component.h file. You can check out the IOP DMA controller constructor for how a component can register handlers with this system. This is very efficient, generating only 10-15 lines of assembly (with clang 12.0), which leads me to the second change, that of the compiler. The switch to clang-cl was made primarily for performance reasons. clang generates a lot more efficient code than MSVC does so the switch will improve perfomance down the road. It also catches more warnings and code issues, allowing for cleaner code overall. The next hurdle, was figuring the handler page size. This is more difficult than it seems, because there are additional "hidden" addresses the BIOS writes to, which aren't listed in the ps2tek memory map. Making the page size too big, will lead to these garbage addresses being handled by our compoents which defeats the purpose of this whole system. Making the page size too small though, will both make the handler array table massive and require compoents to register many handlers to cover their address ranges. So after studying the memory map for a while, I decided that 0x80 = 128 is the best size. For example in the DMAC (EE DMA) each channel takes up exactly 0x80, while the IOP DMA each channel group is also exactly 0x80 in size. 0x80 is, in addition, small enough that garbage addresses don't get caught. Even in the case we have something like that, I have placed asserts on debug builds to capture them. Our struggle isn't done though! The initial handler table ended up causing stack overflows because the array was too large. To mitigate this, the stack size was increased to 10MB and a small optimization was implemented. If you view all the addresses in the memory map of the PS2, a pattern emerges. It turns out that a byte inside the address is always zero, no matter the address (except for 0xfffe addresses which we don't care about). This means we can "squash" the address by removing that byte, allowing us to significantly reduce the handler table size: 0x100|0|3070 -> 0x1003070 0x120|0|0060 -> 0x1200060 0x1F4|0|2006 -> 0x1F42006 0x1F8|0|1120 -> 0x1F81120 0x1F9|0|01AC -> 0x1F901AC This is implemented in the Emulator::calculate_page function. A debug assert is also placed here to ensure nothing our of the ordinary happens. Finally, I also implemented EE interrupts because they are needed at this stage. Timer 5, should normally be ticking now (next commit I promise), and is waiting to cause an interrupt, thus we need to have those implemented. The implementation is taken from a new document I found, which is the same as the previous one, but more focused on the EE and its features, something that should help us a lot in the near future. Right now its not finished, but that will come in the next commit.
-
- Dec 12, 2021
-
-
Geo Ster authored
Wtf, why did I miss this?
-
Geo Ster authored
* After a while the IOP starts setting up timer 5 so we need to start implementing timer support. Timers are pretty simple actually. Each one has 3 32bit registers (we use 64bit registers to check for overflow), a count register that counts the number of cycles, the mode register which configures the timer and the target register which generates an interrupt when count == target. For now that's all we need. * In addition, interrupts are also implmented. These are a bit more complicated since they involve COP0, but not to difficult either. The IOP has 3 registers, I_MASK, I_STAT and I_CTRL. I_CTRL acts as a global enable/disable so it's pretty simple. I_STAT is a bit mask that states which interrupts are pending. I_MASK on the other hand has the ability to enable/disable specific interrupts. So to check if the interrupt will be executed we must do !I_CTRL && (I_MASK & I_STAT). All info can be found on ps2tek/nocash psx * On the EE side, a few new instructions are added to progress further. Now the EE starts setting up the GIF, which is quite exciting! * I think it's a good time to also elaborate on how we read structs. Instead of using switch statements I prefer pointers and struct because these generate a lot more compat code, even with compiler optimizations and eliminate the need for branches. This should not be of concern on normal applications but we are special ;). Most registers on the console are 32bit, so structs are cast to uint32_t* to access them. And since the offsets are always in bytes we must divide them by sizeof(uint32_t) = 4 (I prefer >> 2 since it's more efficient) * Some registers however are peculiar in a sense that a parts of them are located in completely different address ranges. This is bad because for example timer 0 and timer 3 have the same offset of 0 from their relative address ranges. To fix this, we introduce a variable called group that records which "group" the write/read is refering to, with some simple bit masks. The result is casted to bool which converts the result to 0 or 1. Then the expression "offset + group * <number>" is used to access registers. In the timer examples accessing timer 0 will give group 0 and offset 0 so timer 0 will be accessed. With timer 3 though group will be 1 so 0 + 1 * 3 = 3 will be accessed. This a convenient way to bypass branches.
-
- Dec 02, 2021
-
-
Geo Ster authored
* Nothing to really say here, just looks better imo
-
- Dec 01, 2021
-
-
Geo Ster authored
* On reads/writes it is important to check the address alignment before proceeding with the operation. However unalignment errors almost never happen in real world games, so let the compiler know that these branches are unlikely to happen to speed them up a bit.
-
- Nov 30, 2021
-
-
Geo Ster authored
* So after a week, it's finally here! The initial implementation of the IOP has been added to the emulator. You might wonder why did it take so long? This was mostly because I wanted to make the implementation as complete as possible and also test it to ensure it's bug free. So this is actually based on the MIPS R3000A interpreter I wrote last year for my PS1 emulator. So did I just copy the code and call it a day? Hell no, the code in that ancient project is awful, even if it works. So I completely rewrote the interpreter by using our modern techiniques of storing state. So rewriting the old code allowed me to test if it actually worked in that environment and could boot PSX games. * Due to this, the implementation is a bit more complete than the EE as it includes interrupt support. In addition we have to account for the fact that the IOP runs at 36.864MHz, in constrast to the EE which clocks at 295MHz. This maps approximatly to an 1/8 ratio, which means that 1 IOP instruction will run every 8 EE cycles. The current implementation of this is hacky and a bit inaccurate because some EE instructions can take more than 1 cycle to execute, but it's good enough for now (Play! assumes this as well and can boot 40%+ of games). * Because both the CPU emulators can share a lot of naming conventions, to avoid confusion each processor has been seperated into a namespace so we can always know which CPU we are refering to. Finally, for now reads/writes except for the BIOS and IOP RAM, haven't been implemented but will come soon.
-