Emulation Implementation of CPU commands?

Question

I am trying to learn emulation programming. I made a CHIP-8 emulator, under 40 instructions, and lived because of my music. Now I hope to do something a little harder, like SNES. The problem I am facing is the sheer number of CPU instructions. Looking through the list of wiki.SuperFamicom.org 65c816 instructions , it looks like a pain in the rear. And I saw notes here and there on different web pages that the processor is the easiest part of the emulator to implement.

Assuming this was so complicated because I was doing it wrong, I looked around and found a simple explanation: SNES Emulator in 15 minutes , which is about 900 lines of code. Easy enough to work.

So, from SNES Emulator in 15 minutes Source, I found where the CPU instructions are. It looks a lot easier than I thought. I really do not understand this, but these are a few lines of code, not a large mass of code. The first thing I notice is that there is only one implication in the instructions. If you look at the table in SuperFamicom , you will see that it has

ADC #const ADC (_db_),X ADC (_db_,X) ADC addr ADC long ... 

And the emulator source for (I think) ALL of them:

 // Note: op 0x100 means "NMI", 0x101 means "Reset", 0x102 means "IRQ". They are implemented in terms of "BRK". // User is responsible for ensuring that WB() will not store into memory while Reset is being processed. unsigned addr=0, d=0, t=0xFF, c=0, sb=0, pbits = op<0x100 ? 0x30 : 0x20; // Define the opcode decoding matrix, which decides which micro-operations constitute // any particular opcode. (Note: The PLA of 6502 works on a slightly different principle.) const unsigned o8 = op / 32, o8m = 1u << (op%32); // Fetch op'th item from a bitstring encoded in a data-specific variant of base64, // where each character transmits 8 bits of information rather than 6. // This peculiar encoding was chosen to reduce the source code size. // Enum temporaries are used in order to ensure compile-time evaluation. #define t(w8,w7,w6,w5,w4,w3,w2,w1,w0) if( \ (o8<1?w0##u : o8<2?w1##u : o8<3?w2##u : o8<4?w3##u : \ o8<5?w4##u : o8<6?w5##u : o8<7?w6##u : o8<8?w7##u : w8##u) & o8m) t(0,0xAAAAAAAA,0x00000000,0x00000000,0x00000000,0xAAAAA2AA,0x00000000,0x00000000,0x00000000) { c = t; t += A + PC; PV = (c^t) & (A^t) & 0x80; PC = t & 0x100; } 

In short, my general question is:

• Condensation of the phenomenal cosmic power of processor instructions into the bits of code

Questions related to the SNES emulator for 15 minutes (part above):

• How t(0, 0xAAAAAAAA, 0x00000000, ....) parse an instruction? I see stat if , but I don’t know where the number comes from for any of the arguments or what they mean for general code.
• Why is o8 = op / 32 and o8m = 1u << (op%32) ?
• The operation codes for ADC are ADC #const , which has a two-byte operand, or ADC addr , which has an operand of 3 bytes. And the code t(0, 0xAAAAAAAA, ...) inserts both cases?

While I ask:

• What do dp , _dp_ and sr mean, which appear in ADC dp , ADC (_dp_) and ADC sr,S mean?
• What is the difference between ADC (_dp_,X) and ADC dp,X ? (maybe redundand and given the question above).

Answer 1

I cannot answer all of this, but dp means Direct Page, which means that the instruction accepts a single-byte operand, which is the memory address on the direct page. Direct page addressing is an extension of the 6502 zero page addressing mode, where single-byte addresses refer to memory locations $00 through $FF . 6502 16-bit derivatives have a configuration register that basically moves the Zero Page to an alternate location.f

On the wiki page you are linked to, some of the dp in the table have underscores on them, and the rest are in italics. I assume that they are all intended for italics, and wiki markup does not work. A quick check of the Edit link supports this assumption (everyone has an underscore in the wiki source). So do not read anything about it.

In assembly 6502 and its derivatives, ADC dp,X means ... instead of an example, take a specific example ... ADC $10,X means add $10 to the value in register X to get the address, then load the value from this address and add it to the battery. ADC ($10,X) adds an additional level of indirection: add $10 to X to get the address, load the value from this address, interpret the downloaded value as another address and load the value from this address and add it to the battery. Paralyzed operands always add a level of indirection.

Note that the available modes include (dp,X) and (dp),Y , and the placement of the brackets relative to the comma and case is significant. At (dp),Y value is added to the first loaded value to get the address to use in the second boot.

As for this emulator ... code golf does not increase readability! I don’t think that the part that you published is actually understandable in itself, and I don’t want to track it and read it. But the key concept in the t macro is bitstring . Its arguments are a series of 9 bitmaks, each of which contains 32 bits, a total of 288 bits. Each possible operation code (256 of them) plus the three pseudo-codes mentioned in the first comment are therefore represented by one bit in this 288-bit bit string with 29 bits left.

This explains the construction of o8 and o8m . The 8-bit value is divided into the 3-bit part (to select an argument from the 8 arguments provided in t ) and the 5-bit part (to select one bit from the selected argument). Big chain ?: Makes the first choice, and the combination of & and 1 << ... makes the choice.

And then, oh, look that we have a variable called t . This is not related to the macro. Giving them the same name was just cruel.

Maybe I can understand what this bitstream is doing. When the o8 is low, o8 (high digits) will be 0, so the ?: Chain will use w0 , which is the last argument to the macro. As the operation code increases, the selected argument moves left in the argument list to w1 , then w2 ... and the o8m selector also starts on the right and moves to the left ( & (1<<0) is the rightmost bit, & (1<<1) - the next, etc.), and the if condition will be true if the selected bit is 1. Values:

 0, # opcodes $100 and up 0xAAAAAAAA, # opcodes $E0 to $FF 0x00000000, # opcodes $C0 to $DF 0x00000000, # opcodes $A0 to $BF 0x00000000, # opcodes $80 to $9F 0xAAAAA2AA, # opcodes $60 to $7F 0x00000000, # opcodes $40 to $5F 0x00000000, # opcodes $20 to $3F 0x00000000 # opcodes $00 to $1F 

or in binary format

 0, # opcodes $100 and up 0b10101010101010101010101010101010, # opcodes $E0 to $FF 0b00000000000000000000000000000000, # opcodes $C0 to $DF 0b00000000000000000000000000000000, # opcodes $A0 to $BF 0b00000000000000000000000000000000, # opcodes $80 to $9F 0x10101010101010101010001010101010, # opcodes $60 to $7F 0b00000000000000000000000000000000, # opcodes $40 to $5F 0b00000000000000000000000000000000, # opcodes $20 to $3F 0b00000000000000000000000000000000 # opcodes $00 to $1F 

Reading each line from right to left, 1 is in the positions corresponding to these operation codes: $61 $63 $65 $67 $69 $6D $6F $71 $73 $75 $77 $79 $7B $7D $7F $E1 $E3 $E5 $E7 $E9 $EB $ED $EF $F1 $F3 $F5 $F7 $F9 $FB $FD $FF

Hmm ... this seems like a list of ADC and SBC codes, but some of them are wrong.

Oh (I finally gave up and looked at the emulator code) that the NES emulator, not the SNES emulator, so it only has 6502 opcodes.