github.com/PDP-10.its
1
0
Fork 0
mirror of https://github.com/PDP-10/its.git synced 2026-01-11 23:53:12 +00:00
Code Issues Releases Wiki Activity

11SIM - PDP-11 emulator.

Browse Source
This commit is contained in:
Lars Brinkhoff 2016-12-09 21:58:08 +01:00
parent ac7b1da7dc
commit 8fddeb53cf
4 changed files with 12750 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
README.md
View File

@ -65,7 +65,8 @@ There's a [DDT cheat sheet](doc/DDT.md) for Unix users.
5. Remaining programs are rebuilt:
- @, cross reference generation tool
- 11SIM, PDP-11 emulator.
- @, cross reference generation tool.
- ARCDEV, transparent file system access to archive files.
- ARCSAL, archive salvager.
- ARGUS, alerts you when specified users login or logout.

4
build/build.tcl
View File

@ -714,6 +714,10 @@ expect ":KILL"
respond "*" ":midas sys;ts palx_sysen1;palx\r"
expect ":KILL"
# 11sim
respond "*" ":midas sys1;ts pdp11_syseng;11sim\r"
expect ":KILL"
# idle
respond "*" ":midas sys1;ts idle_gren;idle\r"
expect ":KILL"

682
doc/_info_/pdp11.order Executable file
View File

@ -0,0 +1,682 @@
Documentation file for the PDP11 simulator, PDP11 and PDP45.
On the pdp-11 simulated:
The instructions:
mov %0,-(%0) ,etc., store the original contents of the register,
rather than the altered contents.
this is correct for the 11/45 but not the 11/20.
the low speed reader is not implemented, since it's a lsr.
the run time ratio of simulated to real pdp11/20 is near 30.
simulated real time is maintained to precision of .1 microsec.
(probably not quite 20% accurate).
Characters effective at interrupt level:
^G (bell) is a quit-character.
if typed while simulating, causes DDT to be called.
a ;p command will resume simulation.
if typed while in ddt, causes an immediate return to ddt's main loop.
^G^G is identical in effect to ^G^S
^G^G^G causes ddt to be called immediately.
it is useful when the simulator itself is hung.
^S is used to stop printout from the time it is typed
to the time it is actually read by the simulated program.
^B turns on output to the lpt,
^E turns it off.
^V turns on output to tty,
^W turns it off.
^Q causes the next character typed not to have any special effects.
thus, it can be used enter a ^G, ^S, ^B, ^E, ^V, ^W or ^Q .
^Q is also useful in ddt, to put one of the interrupt chars in an ascii value,
to put ":, ";, ",, " , or ^M in a filename,
and to put non-squoze chars and initial digits in symbols.
within ddt, if a char quoted by a ^Q is rubbed out,
the ^Q that quoted it is also automatically rubbed out.
when ddt is entered, it prints:
loc/ insn
where loc is the address of the next instruction to be executed.
that location is not open for modification, however.
in the 1145 version, the permanent, temporary and 1-shot mapping
modes are all set to the i-space of the processor's current
mode (or to $a if paging is off).
normally, ddt is only called between instructions.
3 ^G's, however, will cause ddt to be called immediately,
usually within an instruction. system variables might be only
partially updated.
in that case, proceeding will just return from ddt,
while ;g will start at the beginning of an instruction.
Expressions in the simulator's ddt:
Expressions are made up of terms separated by operators.
terms are either octal numbers,
decimal numbers followed by ".",
ascii values of the form 'a or "ab,
defined symbols,
unary + or - preceded by a term,
or expressions in angle brackets.
operators defined are:
level 0: @(mapping)
level 1: *,!(divide)
level 2: +,-
level 3: &,\(or),#(xor)
level 4: space (addition)
(the syntax for the mapping operator "@" is:
<term>@<mode> where <mode> is a mapping mode name
(one of "0","2","4","6","a","ki","kd","si","sd","ui","ud").
the term is mapped as if it were an address being opened,
and the absolute location that would have been opened
is the value of the operator. thus, foo@ki= types out what
foo in kernel i-space maps into. registers are not allowed
as the first argument of an @).
some special symbols whose values are automatically set are:
. as in pdp-10 ddt.
%. location actually open.
% set to contents of pc at entry to ddt.
%opc address of last or current instruction
%q last qty. typed in or out.
%p within a multi-word expression,
holds value of previous word.
otherwise same as %q.
%b address of last breakpoint taken.
%s last explicit source address.
%d last explicit destination address.
also set by branches.
%l length of last qty in or out.
%ol length of what was last opened or stored.
%il length of next insn (printed at entry)
%go starting address for ;g with no arg.
%core number of bytes of core attached.
first nonexistent address.
%swr address of switch register.
%csx addr. of place where ;x puts its instruction.
%ps address of ps word (=-2).
%jpc sometimes set to addr. of last jump or trap.
%0, etc. register 0 - %1, ... %7 similar.
also, symbols are defined for various device registers.
see device control commands.
a value can be either ordinary or a register number.
an expression evaluates to a register number iff any term in it does.
a term has a register value iff
it is a register-valued expression in angle-brackets,
or it is a register symbol.
the only initially present register symbols are %0...%7
because the pdp-11 has multi-word insn,
the ddt can handle multi-word values.
they are the values if expressions with the following forms:
<exp1,exp2,...,expn>
or: op-code operand1,operand2 (maybe 0 or 1 operands).
where exp1...expn are expressions,
op-code's and operand's are as in pal-11.
if one multi-word expression occurs within another,
only the first word of the inner one is used.
there is one incompatibility between ddt's instructions and pal-11's:
for: use:
sec sfl @c
sev sfl @v
scc sfl @znvc or sfl @vncz , etc.
clz cfl @z
etc. etc.
commands to open, close, etc.
arg represents any expression.
if 2 expressions are typed in a row, only the second is used.
arg/ open location arg in current mode, change . .
/ similar, but location %q, and don't change . .
arg[ similar, but open in numeric mode.
[ similar, but %q.
arg= retype arg in numeric mode.
= similar, but %q.
arg] similar, but current mode.
] similar, but %q.
_ reopen location now open, in current mode.
^I close open loc, open location addressed by it.
^J close open loc, if word open, open .+%ol
if byte open, open .+1 as a byte
the new location is opened in the
same mapping mode as the location last opened.
^ close open loc, if word open, open .-2
if byte open, open .-1 as byte
the new location is opened in the
same mapping mode as the location last opened.
^M close open loc.
arg>sym define symbol sym with value arg.
>sym same as %q>sym .
arg>sym^K similar, but half-kills sym.
>sym^K same as %q>sym^K .
^K sym complement half-kill switch for symbol sym.
in the 11-45 version of the simulator, several mapping modes are
available for opening addresses in various paged spaces. these
modes affect the actions of the commands that open locations.
in particular, they affect which copy of a register will be
examined. see "mapping modes".
ddt attempts to remember the length of what is open.
this length is set from %l when the location is opened,
and is updated if an = or ] is given to retype it before any
value is typed in or the location is closed.
when something is deposited, %ol is set to its length.
linefeed uses %ol to determine the next location to open;
the patch commands, to determine what value to give to patch or %patr.
patching:
:pat arg closes the open location, storing in it a special
device code, and the value arg.
this special device causes a break when read or written by
the simulated program.
if an instruction is fetched from it, it acts like a jmp arg instruction.
opening the location in ddt causes :pat argx to be typed,
where argx will have the same value as arg, but may look
different.
storing in it from ddt will cause the patch-device to be removed.
patch-devices will load and dump properly.
:pat also does %q+%ol>%patr - ie. it saves the
addr of the next instruction to facilitate patching back.
example:
!foo/ movb a20,%1 :pat xyz
!foo/ :pat zbc =1074 xyz=1074
^\ like :pat patch, but opens location patch.
^] like :pat %patr, but sets patch instead of %patr.
arg^] like arg ^j ^]
example:
!foo/ inc r1 ^\
patch/ halt dec r2^j
patch+2/ halt inc r1^]
!
!foo/ :pat patloc ^i
patloc/ dec r2 ^j
patloc+2/ inc r1 ^j
patloc+4/ :pat foo+2 ^j
patch/ halt
the value of patch is initially 1, so ^\ will fail.
typeout mode commands:
example of a series of typeout mode commands.
$b set 1-shot byte mode.
$$b set 1-shot and temporary byte mode.
$$$b set 1-shot, temporary and permanent byte mode.
$-b clear 1-shot byte mode.
$$-b clear 1-shot and temporary byte mode.
$$$-b clear 1-shot, temporary and permanent byte mode.
locations opened while 1-shot byte mode is set are opened as bytes.
the 1-shot modes are the ones actually referred to when printing.
they are restored from the temporary modes after each command,
except after typeout-mode commands.
the temporary modes are restored from the permanent modes
whenever ddt prompts with "!".
each typeout mode is represented by 3 bits: 1 for the 1-shot
setting, 1 for the temporary setting, and 1 for the permanent.
if several conflicting 1-shot modes are set, one overrides the
others, according to the ordering described below.
other series of typeout-mode commands:
$i, etc. instruction mode.
when opening a location, print as instruction.
$r, etc. register mode.
print register quantities numerically.
$!, etc. non-printing mode.
when opening a location, don't print its contents.
overrides all other modes. %s and %d aren't set, but %q is.
$", etc. ascii mode.
print quantities, except special addresses, as ascii values.
$', etc. both ascii mode and byte mode.
$n, etc. numeric mode.
print quantities, except special addresses, numerically.
overrides ascii mode.
$d, etc. decimal mode.
when printing a number, use base 10. .
(otherwise, base 8. is used).
mapping modes: (1145 only)
a series of mapping mode commands is like a series of typeout
mode commands except that the minus sign may not be used.
the 11. mapping modes for a set of alternatives. thus, at any
time the 1-shot mapping mode is one of those 11., the temporary
mapping mode is a (perhaps) different one, and the permanent
mapping mode is also one of those 11.
$0, etc. when opening a location, use the
specified 18-bit address unmodified.
$2, etc. add 200000 to the spec'd 18-bit address.
$4, etc. add 400000 .
$6, etc. add 600000 . good for io-device regs.
$a, etc. map the low 16 bits as if paging were off
that is, the bottom 28.k are unchanged, and the
rest refer to io-device registers.
this mode is also good for open device reg
symbols such as %tkb.
$ki, etc. map the spec'd address in kernel i-space, using
the current contents of the kernel i-space sdrs
and sars. it works to change the sdrs or sars in
ddt and then map through them. a nonresident
segment or segment length error will give
an error message.
the $kd, $si, $sd, $ui, and $ud mapping modes all exist.
when %6 is opened, the copy of %6 referred to depends on the
mapping mode. if it is $k..., $s..., or $u..., the %6 associated
with the mapping mode is opened. otherwise, the r6 currently being
used by the processor is opened. when %0 through %5 are opened,
you get the register set being used by the processor except in
$6 mode, when you get the register set not being used.
$!, $i, $b and mapping modes are consulted when opening a location.
$" and $n are consulted when printing a quantity.
(also $r if it is a register value).
$d is consulted when printing a number.
special addresses are those of locations being opened (e.g. by ^i, ^j),
addresses of breakpoints, branches, patches.
expressione preceding typeout mode commands are treated as if they followed the commands.
e.g. 10 $d= is equivalent to $d10= .
breakpoint commands:
arg;b set type 7 bpt. (any processor access) at arg.
arg is mapped using the 1-shot mapping mode
just as if it were about to be opened. (this is
true for all the breakpoint setting commands
when they are given 1 prefix argument).
arg;u remove any breakpoint at arg.
arg;f set a fetch-only bkpt at arg (type 1).
arg;r set processor-read breakpoint at arg.
arg;w set processor-write breakpoint at arg.
;b set breakpoints of type 7 everywhere.
;u remove all breakpoints.
;f, ;r, ;w analogous.
<arg0,arg1>;b set breakpoints of type 7 everywhere from arg0 to arg1.
arg0 and arg1 are treated as 18-bit absolute
addresses; they are not mapped. the "@" operator
may be used in them if mapping is desired.
<arg0,arg1>;u remove all breakpoints in that range.
;f, ;r, ;w with such args act analogously.
arg;arg2b set breakpoint of type arg2 at arg1.
if arg2=0, remove breakpoint.
arg is mapped.
;u, ;f, ;r, ;w with such args act identically to ;b .
;arg2b,;arg2u,<arg0,arg1>;arg2b,<arg0,arg1>;arg2u --
all analogous.
breakpoint types:
a breakpoint type is a 7 bit number. the bits are as follows:
1 break on insn fetches.
2 break on write references by cpu.
4 break on cpu read references (not insn fetches).
10 if set, don't call ddt - just print message.
20 break on write references by i-o devices (df, etc).
40 break on device read references.
100 autoflush breakpoint.
thus, a breakpoint of type 12 will break only on cpu writes,
and won't stop - it will just print a message.
read and write breakpoints type out the old contents of location,
and the breaking insn.
non-stop fetch breakpoints type out the insn, and the previous insn.
stopping fetch breakpoints are unique in stopping before the insn.
autoflush breakpoints break on fetch referrences, and always stop
before executing the insn. in addition, they reset themselves
(but not any other breakpoints that may be on the same word).
their action is completely independent of the setting of the
other breakpoint bits - in particular, they will call ddt
even if bit 10 is set.
they print "break(f)" instead of "break".
:lbrks prints $b commands that would
create the existing breakpoints.
<a1,a2>:lbrks similar, for breakpoints between a1 and a2.
trap message control commands:
arg;arg2 t sets the trap action code for trap thru arg to arg2.
;arg2 t sets all trap action codes to arg2
arg;t same as arg;0t
;t same as ;0t
the trap action codes are:
0 continue simulation (of the trap).
1 set %jpc from %opc and continue.
2 print message and continue.
3 print message and stop at end of insn.
jump and branch printout commands:
0;arg2 t causes the pc change action code to be set to arg2.
0;t same as 0;0t
the pc change action code determines what
will be done whenever the pc changes except by normal incrementing.
it is interpreted just as the trap action codes are.
buss error memory:
:buss print out the locations, times and causes of last 3 buss errors.
various printouts:
:regs prints contents of pdp11 accumulators.
:lsyms prints values of all symbols defined.
execution commands:
arg^N execute arg instructions.
^N execute 1 instruction.
;p return from ddt, resume simlation.
^P same as ;p .
arg;g go to address arg, aborting current instruction.
;g similar, but starts from location %go .
arg;a2 g starts at arg, and executes a2 insns.
arg;0g starts at arg and returns immediately to ddt.
;a2 g like %go;a2 g .
;0g like %go;0g .
;n like $$^N in 10-ddt.
starting at an odd address will cause a bus error trap.
reinitialization:
;i executes a reset instruction, zeros the ps,
and zeros the cumulative virtual time.
also forgets old buss errors and
aborts the instruction (if in superquit).
executing a particular instruction:
( ;x commands must be terminated by a cr (i.e. ^M )).
;x insn executes the instruction insn.
;x executes whatever insn was last ;x'd (usually).
arg;x insn like ;x insn , but puts arg in %1 before execution,
and restores %1's old contents afterwards.
arg;x similar, but uses same insn as last time.
if the instruction ;x'd causes a transfer of control, simulation will
continue until control returns, or ddt is called for some other reason
(e.g. a breakpoint).
the contents of %7 are restored when the insn finishes normally
(that is, when control reaches the word after the insn).
to execute an insn, ;x first stores it at location %csx.
normally, %csx is set to 177720. you can cause insns to be
stored and executed at any other loc. by the :s%csx command.
it is possible to put an insn at %csx normally, e.g.
%csx/ halt jsr pc,print
or %csx: jsr pc,print in the source file.
future ;x's which do not specify an insn
will use the one that was stored at %csx.
examples: ;x inc xloc adds 1 to the contents of xloc.
1506;x jsr pc,print calls the routine print
with 1506 in %1. ddt takes over on return from print,
and %1's old contents are restored.
i-o device control commands:
(must be terminated by a carriage return)
;a prints names of available devices.
;d same
arg;a dev info attaches device dev. (how info is used
depends on the device being attached).
arg;d dev info detaches device dev.
note: different devices expect different kinds of info.
some expect none. only some devices use an arg.
the following options for arg;a name info
are available (blank arg or info column indicates that the
arg or info shouldn't be present for that option)
name arg info action
core # k add that many k virt. core.
dc file attach dc11 to file, both directions.
dcr file attach for receive only.
dct file attach for transmit only.
df file attach rf11 disk drive 0, using file (see rk device)
df drive# file attach that drive, using spec'd file (see rk device)
dm print dm11 line attach status.
dm line # file attach line as file both rcv & trans.
dmr print receive line attach status.
dmr line # file attach line as file, receive only.
dmt print transmit line attach status.
dmt line # file attach line as file, transmit only.
eae causes an eae to exist.
i45 causes some pdp11-45 insns to work.
lk cps attaches line freq clock, arg is freq.
lp file attaches lpt as file.
master enter i.t.s. master mode.
ngdis ? ? attaches knight display, i don't know args.
nuldis ? ? attaches something that looks like a knight
display but doesn't display or need 340.
pk ? attaches programmable clock.
pp attaches virt. punch as real punch.
ppa file attaches virt. punch as file, ascii mode.
ppi file attaches virt punch as file, 1 byte per word.
pr attaches virt. reader as real reader.
pra file attaches virt. reader as file, ascii mode.
good for reading i.t.s. ascii files.
pri file attaches virt. rdr as file, 1 byte per word.
suitable for absolute loader, etc.
rk creates the registers for the rk-11 if they
don't exist. doesn't make any drives ready.
rk drv # file as above if nec., and makes that drive exist
note that if no sname is spec'd, the sname
last used for this drive will be used, not
changing the current sname. (the current
sname will be used the 1st time)
if the file doesn't exist it will be created.
the rk must be detached to force data still
in core to be written into the file.
tk causes a tty input dev. to exist.
tp causes a tty output dev. to exist.
the following options for arg;d name info exist.
name arg info action.
core # k remove that many k virt. core.
dc detach dc11 both directions.
dcr detach receive only. (dc11 registers go away...
dct detach trans. only. ...when neither direction attached).
df detach all drivds of rf11. registers go away.
detaces each drive individually.
df drv # detaches spec'd drive of rf11.
any pages in core are written out into the file
the drive was attached from.
dm same as ;a dm .
dm line detcach that line, both directions.
dmr same as ;a dmr .
dmr line detach that line, receive only.
dmt same as ;a dmt
dmt line detach that line, trans. only.
eae eae ceases to exist.
i45 pdp11-45 insns trap thru 10 again.
lk detach line freq clock, registers become nxm.
lp " lpt, " " " .
master leave i.t.s. master mode.
ngdis " knight display, " " "
nuldis same as ngdis.
pk programmable clock,
pp punch,
ppa,ppi same as pp.
pr reader,
pra,pri same as pr.
rk drv # writes out data for that drive and forgets
about it (it isn't ready, file still exists)
rk does so for all drives, then destroys regs,
frees core used for buffers, etc.
tk detach teletype keyboard, regs become nxm.
tp teletype printer,
initially, there are 8. k of core, the lk, tk, tp and eae are attached,
and all other devices are detached.
:reset dev resets that dev - ie does what a reset
instruction would do to that dev.
for rk, writes out all data in core.
:devtim dev types that dev's "time constant" as
xxxx.y where xxxx is in virt. microsec.
arg:devtim dev sets the time constant, and prints it.
arg should be a number of 10^-7 sec.
the device rk has 3 time constants:
rk - sector rotation time,
rkc - seek time per cylinder,
rkx - basic seek time.
dumping and loading:
(these commands must be terminated by a carriage return)
:load filspc loads file specified.
:lod filspc same.
:lodcor filspc loads only core from file specified.
:lodsym filspc loads only symbols from file specified.
:lodptr loads from tape reader in 8-bit mode.
;l filspc zeros core and symbols, does a ;i, then loads file specified.
:dmpcor filspc dumps all core (but not device register contents).
<a1,a2> :dmpcor filspc dumps from a1 to a2.
:dmpsym filspc dumps all symbol defs.
:dmptpv filspc dumps the trap and pc change action codes set by ;t ("tpv").
:dmp filspc dumps all core, symbols and tpv.
;y filspc same.
<a1,a2> :dmp filspc dumps core from a1 to a2, all symbols and tpv.
<a1,a2> ;y filspc same.
:adump filspc dumps core in absolute loader format, followed by symbols.
<a1,a2> :adump filspc similar but dumps specified range of core.
;l will load absolute loader format files.
however, it will not load pdp11 type absolute loader tapes,
since it uses block-mode i-o.
paper tapes should be loaded with :lodptr instead.
;y dumps in a special, compressed format which
;l can read, but the absolute loader can't.
a filspc contains filenames separated by" ", ";" and ":",
and is terminated by a ^M or ",.
exception: the chars ":;, " can go into filenames if quoted by ^Q.
names followed by colons are device specifications;
names followed by semicolons, sname specifications;
other names are, in this order: fname1, fname2, dev, sname.
names not specified are left the same as they
were in the last ;l or ;y command,
except the sname, which, if unspecified, is the same as
was specified in the last filspc in any command.
zeroing core:
;z zeros all core.
arg;z sets all words to arg.
<a1,a2>;z zeros all core from a1 to a2.
<a1,a2,a3>;z similar, but sets to a3.
timing commands:
:time prints the cumulative virtual run-time in decimal.
:ztime zeros " " " " " .
the ;i command also resets the time.
file i-o:
:xfile filspc executes the ddt commands in the file filspc,
printing them on the tty as it does so.
when reading from a file, linefeeds that follow carriage returns are ignored.
on starting pdp11, if a file .pdp11 (init) is found, it
will be automatically :xfile'd.
:wallp filspc starts outputting to filspc as well as tty.
future uses of ^b will output to filspc,
instead of lpt: .
colon commands -- all terminated with carriage return:
:lcoms list all colon comands
:lsyms print definitions of all symbols except instructions.
:flsyms kills all user symbols.
arg:s%csx sets up arg for use by ;x .
:s%csx sets up default addr. (177720) for ;x .
:odmp filspc open a permanent dump file.
:cdmp close one.
ordinary dump commands between a :odmp
and a :cdmp all dump into the file
opened by the :odmp.
arg:core either detaches or attaches core
so there will be arg k.
:core prints the number of k of core.
:altsem switches the roles of "; and "$ in commands -
mode setting commands use ";,
special action commands use "$.
prints "switched" if that is the case.
if they were already switched,
prints "normal" and restores them.
^L clears the screen. otherwise ignored.

12062
src/syseng/11sim.426 Executable file
View File

File diff suppressed because it is too large Load Diff