HP 2100 SIMULATOR BUG FIX WRITEUPS ================================== Last update: 2008-09-30 1. PROBLEM: Booting from magnetic tape reports "HALT instruction, P: 77756 (000400)". However, [77755] is HLT 77 (102077), [77756] is ALF,ALF (001727). VERSION: 3.2-0 OBSERVATION: The value 000400 is supposed to be "ALF,ALF", i.e., the decoded memory value at P. CAUSE: "fprint_stopped" in "scp.c" calls "cpu_ex" in "hp2100_cpu.c", which calls "dms_cons" to display the virtual (logical) address. However, at the halt in the mag tape boot loader, DMS is not enabled, so the map registers are meaningless (they happen to be zeros, so the access is to physical address 001756). RESOLUTION: Alter "dms_cons" in "hp2100_cpu.c" to condition DMS mapping on "dms_enb". STATUS: Fixed in version 3.2-1. 2. PROBLEM: Terminal output from RTE is indented three spaces, e.g., "START RECONFIGURATION" appears as " START RECONFIGURATION", and the "- " prompts after answering "YES" to "I/O RECONFIGURATION?" do not appear. VERSION: 3.2-0 OBSERVATION: Use of a debugger reveals that the output sequence to the TTY is - . CAUSE: RTE is outputting nulls to allow the (physical) TTY carriage time to move, but these are overwriting the prompt character in the simulation (note that a real TTY absorbs nulls, i.e., they don't affect the printed output). The TTY emulator should strip nulls from output to console. RESOLUTION: Alter "tto_out" in "hp2100_stddev.c" to suppress nulls sent to the TTY printer. STATUS: Fixed in version 3.2-1. 3. PROBLEM: Completing the reconfiguration and exiting hangs the system after printing the first few characters of the output line. RTE is stuck in a loop in $CIC. VERSION: 3.2-0 OBSERVATION: At the entry to $CIC (system map address 43221), RTE uses the undocumented instruction "SFS 0,C" to both test and turn off the interrupt system. This is confirmed in the "RTE-6/VM Technical Specifications" manual (HP 92084-90015), section 2.3.1 "Process the Interrupt", subsection "A.1 $CIC": "Test to see if the interrupt system is on or off. This is done with the SFS 0,C instruction. In either case, turn it off (the ,C does it)." ...and in section 5.8, "Parity Error Detection": "Because parity error interrupts can occur even when the interrupt system is off, the code at $CIC must be able to save the complete system status. The major hole in being able to save the complete state is in saving the interrupt system state. In order to do this in both the 21MX and the 21XE the instruction 103300 was used to both test the interrupt system and turn it off." CAUSE: The simulator does not respond to the "H/C bit" on the "SFS 0" instruction, so the interrupt system is not turned off. RESOLUTION: Modify "hp2100_cpu.c" and the various devices to respond to the "H/C bit" on the "SFS" and "SFC" instructions, and modify "hp2100_sys.c" to decode the "H/C bit" on those instructions (note that while the documentation refers specifically only to "SFS 0", the schematics of the 21MX appear to indicate that the bit will work on any SFS instruction -- and the SFC instruction too, for that matter). STATUS: Fixed in version 3.2-1. 4. PROBLEM: RTE sits in the idle loop. TBG/TTY interrupts are not occurring, so "SET TIME" is not output. VERSION: 3.2-0 OBSERVATION: The memory protect flag is set, inhibiting all lower-priority interrupts, such as the TBG and TTY. If the MP flag is cleared manually, RTE prints "SET TIME" and comes up sufficiently to respond to operator attention commands. The system time is seen to increment properly. Unlike most other I/O devices, the MP flag flip-flop is cleared automatically when the interrupt is acknowledged and not by a programmed instruction (CLF and STF affect the parity error enable FF instead). Section 4.4.3 "Memory Protect and I/O Interrupt Generation" of the "HP 1000 M/E/F-Series Computers Engineering and Reference Documentation" (HP 92851-90001) says: "When IAK occurs and IRQ5 is asserted, the FLAGBFF is cleared, FLAGFF clocked off at next T2, and IRQ5 will no longer occur." CAUSE: The MP flag flip-flop is not being cleared automatically when the interrupt is acknowledged. RESOLUTION: Modify "hp2100_cpu.c" to reset the MP flag on IAK5. STATUS: Fixed in version 3.2-1. OBSERVATION: The MEV flag indicates the source of the interrupt (set for DMS violation, clear for MP violation). If this is tested with a SFS or SFC instruction after an MP interrupt, it is observed that DMS interrupts are not being indicated properly. SFS 05 never skips. CAUSE: The MP flag is being used to condition the response for SFS 05 and SFC 05. Examination of the schematics for the MP card in the engineering documentation shows that the SFS and SFC I/O backplane signals gate the output of the MEVFF onto the SKF line unconditionally. RESOLUTION: Modify "hp2100_cpu.c" to remove conditioning on MP flag for SFS 05, SFC 05. STATUS: Fixed in version 3.2-1. 5. PROBLEM: Attempting to run any program causes a DM violation. VERSION: 3.2-0 OBSERVATION: BCKOF is scheduled when the system starts and is the first program to DM abort. Examining the DMS maps seems to indicate that the user and system maps are set up reasonably. However, examining memory with the "ex -u" and "ex -s" commands reveals the same data in both sets of locations. The "ex" command isn't using the DMS maps properly. CAUSE: String constants are used instead of character constants, preventing the DMS map switches from being recognized. RESOLUTION: Modify "hp2100_cpu.c" to use character constants rather than string constants in "dms_cons" so that DMS map switches work correctly. STATUS: Fixed in version 3.2-1. OBSERVATION: The DM abort is occurring when JSB EXEC is done from a user program. The EXEC target is below the MP fence, and the expected action is an MP violation interrupt that is recognized and processed by the system as a legal call to the system executive. However, the MP violation isn't occurring, so the SJP instruction at the actual EXEC entry point (present to catch EXEC calls made with the interrupt system off) is attempted, and that causes the DM violation, due to execution of a protected instruction from the user map. CAUSE: Memory writes aren't being checked for an MP violation if DMS is enabled, i.e., if DMS is enabled, and the page is writable, then whether the target is below the MP fence is not checked. RESOLUTION: Modify "hp2100_cpu.c" to do MP check on all writes after DMS translation and violation checks are done (so, to pass, the page must be writable AND the target must be above the MP fence). STATUS: Fixed in version 3.2-1. 6. PROBLEM: The "WHZAT" program isn't showing the current time, program type, priority, etc. VERSION: 3.2-0 OBSERVATION: Running the program with "RU,WHZAT" shows that the current time (etc.) is simply missing, as though zero-length strings are being written, or all characters in the string are being written to the same location. CAUSE: The SBT instruction isn't incrementing the B register, so all characters are being overwritten. RESOLUTION: Modify the processing of the SBT instruction in "hp2100_cpu.c" to increment B. STATUS: Fixed in version 3.2-1. 7. PROBLEM: The simulator may abort with an access exception when examining memory. VERSION: 3.2-0 OBSERVATION: If DMS is enabled but a map register contains a page greater than defined memory, attempting to examine the logical address corresponding to that page register causes an access exception. CAUSE: The "cpu_ex" and "cpu_dep" routines attempt to prevent this, but the validation is being made on the logical, not the physical address. RESOLUTION: Modify "cpu_ex" and "cpu_dep" in "hp2100_cpu.c" to check the physical addresses against the physical memory limit. STATUS: Fixed in version 3.2-1. 8. PROBLEM: Pressing a key during output does not give an RTE prompt. VERSION: 3.2-0 OBSERVATION: Running, e.g., WHZAT and pressing a key during the listing does not interrupt the system as expected. Pressing a key when the system is idle does give a prompt. CAUSE: Detection of key presses during output is accomplished by DVR00 with the 12531C card by reading the data register after output is complete. If no key was pressed, the register will have the value of 377 octal. If a key was pressed, the value will be something other than this. SIMH is not passing the keystrokes into the output data register. RESOLUTION: Modify tty routines in "hp2100_stddev.c" to simulate the shift of a character into the data register concurrently with an output operation. STATUS: Fixed in version 3.2-1. 9. ENHANCEMENT: Programmed halt should report the halt code (i.e., the numeric HLT instruction). VERSION: 3.2-0 OBSERVATION: When a programmed halt occurs on the actual 21MX, the T register (current memory contents) is automatically selected on the CPU front panel. The T register displays the numeric HLT instruction. Many HP programs communicate program status via the numeric halt instruction codes themselves. For example, a HLT 77 (102077) is universally used to mean "proper operation completed." The mag tape boot loader, for instance, will HLT 11 (102011) if a checksum error is detected and HLT 00 (102000) if the mag tape status is anything unexpected. The HP diagnostics also make extensive use of halt codes, and their numeric values are tabulated in the diagnostic manuals to correspond with certain results. Currently, the simulator displays only the P register value (which points to HLT + 1) and the contents of the memory location at P (which displays the instruction one beyond the HLT), e.g.: HALT instruction, P: 77756 (ALF,ALF) sim> This, however, fails to communicate the status implied by the HLT code, which must be obtained by entering "ex 77755" after the halt. RESOLUTION: Modify "hp2100_sys.c" to make the halt status message a variable instead of a constant string, and modify "hp2100_cpu.c" to format the status message with the halt code, as follows: HALT instruction 102077, P: 77756 (ALF,ALF) sim> STATUS: Fixed in version 3.2-1. 10. ENHANCEMENT: Add an M register (current pointer to memory) and a T register (contents of the memory location at P). VERSION: 3.2-0 OBSERVATION: The 21MX computer presents eight hardware registers: A, B, M, T, P, S, O, and E. From the 21MX M-Series Computer Operating and Reference Manual (02108-90037): "The M-register hold the address of the memory cell currently being read from or written into by the CPU. "The data transferred into or out of memory is routed through the T-register. When displayed, the T-register indicates the contents of the memory location currently pointed to by the M-register. The A- or B-register contents are displayed if the M-register contents are 000000 or 000001, respectively." However, the simulator does not expose these registers as part of the CPU state. Internally, they are not needed, but the simulation user would expect to be able to view and set their contents, so they should be implemented. When the machine halts, the front panel microroutines display the T register after initiating a read of memory via the M register. So T always reflects the contents of memory addressed by M. For machine halts due to the front panel HALT button being pressed or due to execution of a HLT instruction not in an interrupt trap cell, M is set to P-1. If, however, the machine halts due to the execution of a HLT instruction in an interrupt trap cell, M is set instead to the address of the trap cell (P still points to the next instruction to be executed). RESOLUTION: Modify "hp2100_cpu.c" to add M and T registers to the CPU state. T must be read-only, because there is no way to determine positively when a store into T has been done. STATUS: Fixed in version 3.2-1. 11. ENHANCEMENT: Change the DMS map register contents to display and enter in the format as documented by the HP hardware manual. VERSION: 3.2-0 OBSERVATION: The simulated DMS map registers are stored in an internal format that does not correspond to the real DMS hardware. Specifically, the physical page address is shifted left by ten bits, and the read- and write-protect bits are in bits 1-0 rather than 15-14. This is done for performance reasons and is reasonable and proper. However, this internal format is exposed as the external representation, which is unfamiliar to the simulation user. The user expects to be able to view and set the DMS map registers in the same format as the real machine. RESOLUTION: Modify "hp2100_cpu.c" and "hp2100_defs.h" to use the documented format. STATUS: Fixed in version 3.2-1. 12. ENHANCEMENT: Provide map-specific simulation breakpoints. VERSION: 3.2-0 OBSERVATION: When DMS is enabled, separate address spaces exist for system and user programs. In debugging, one may have to set breakpoints in either address space. Currently, breakpoints are map-agnostic, i.e., only the address needs to match. This leads to the potential for breaking when not intended and can be frustrating if, for example, the desired user-mode break location happens to correspond with the TBG handling code in the system. RESOLUTION: Modify "hp2100_cpu.c" to add map-specific breakpoints. STATUS: Fixed in version 3.2-1. 13. ENHANCEMENT: Rename the F register to MPFR. VERSION: 3.2-0 OBSERVATION: There is no F register defined in the 21MX register set. Its name is confusing to the new simulation user. Moreover, there is an MPVR (memory protect violation register), but the memory protect fence register appears to be missing. Renaming makes the exposed register set more consistent with HP nomenclature. RESOLUTION: Modify "hp2100_cpu.c" to change the name of the register from "F" to "MPFR", and move the location in the CPU state to precede the memory protect violation register "MPVR", so that these two MP-related values appear together. STATUS: Fixed in version 3.2-1. 14. ENHANCEMENT: Rename the IADDR register to CIR. VERSION: 3.2-0 OBSERVATION: The address of the currently interrupting device is contained in the Central Interrupt Register (CIR) in HP documentation. Renaming makes the exposed register set more consistent with HP nomenclature. RESOLUTION: Modify "hp2100_cpu.c" to change the name of the register from "IADDR" to "CIR". STATUS: Fixed in version 3.2-1. 15. PROBLEM: Under RTE, the backspace key deletes the entire line, rather than just the last character entered. VERSION: 3.2-0 OBSERVATION: Pressing the backspace key should delete the last character entered. Pressing the DEL key (CTRL+BACKSPACE) should delete the entire line. RTE is behaving as though DEL were being sent when the backspace key is pressed. CAUSE: The simulator is unconditionally translating backspace (CTRL+H) to DEL (CTRL+BACKSPACE), ostensibly for the convenience of some DEC operating system. STATUS: Fixed in version 3.2-1. 16. ENHANCEMENT: Provide a settable "auto linefeed" mode so that the TTY will follow each CR with LF (DSGEN and DOS itself require that lines end with CR and LF, contrary to RTE, which uses CR only). VERSION: 3.2-0 OBSERVATION: Always following ENTER with CTRL+J is awkward. An "AUTO LF" mode is desirable. RESOLUTION: Implement a "SET TTY AUTOLF" command to implement "auto linefeed" mode. STATUS: Fixed in version 3.2-1. 17. PROBLEM: Loading an absolute binary paper tape image with "BOOT PTR" causes the boot loader to hang. VERSION: 3.2-0 OBSERVATION: BOOT PTR looks for 12 feed frames (nulls) to signify EOT. A real paper tape would have feed frames punched after the file data for a trailer. CAUSE: At the end of the attached file, "ptr_svc" (hp2100_stddev.c) fails if STOP_IOE is set, otherwise silently does nothing. SIMH wrongly requires that the feed frames appear in the attached file, rather than supplying the feed frames from the PTR simulation. If they are not in the file, the simulation hangs, just as the real paper tape reader would do if the tape ran out. RESOLUTION: Alter "ptr_svc" (hp2100_stddev.c) to fail if STOP_IOE is set, or to supply feed frames upon encountering the end of the attached file. "SET PTR TRLLIM" sets the maximum number of feed frames to supply. Note that RTE needs at least 30 feed frames before signalling EOT. STATUS: Fixed in version 3.2-1. 18. PROBLEM: The 7900 boot loader fails to load any data from the disc into memory. VERSION: 3.2-0 OBSERVATION: The loader completes, but memory is untouched. CAUSE: There is a transcription error in the boot loader code. RESOLUTION: Alter "dp_rom" (hp2100_dp.c) to change the erroneous "OTA 6,C" to the correct "SFS 6,C". STATUS: Fixed in version 3.2-1. 19. PROBLEM: Using the DOS-III D2607 (DVR12) driver with the LPT (2607/12845) simulation results in garbled output. VERSION: 3.2-0 OBSERVATION: Doing an "ATTACH LPT 2607.printer" and then a ":JOB,FRED" in DOS results in the following: 00000000 0C 0A 4A 4F 20 52 44 20-32 4D 59 37 20 54 4D 3D ..JO RD 2MY7 TM= 00000010 30 33 4D 4E 20 32 34 53-43 2E 4A 61 46 56 46 7F 03MN 24SC.JaFVF. 00000020 7F 7F 7F 47 18 73 43 46-21 4D 09 1A 0B 31 1C 67 ...G.sCF!M...1.g 00000030 0A . ...instead of the expected: 00000000 4A 4F 42 20 46 52 45 44-20 20 31 32 2D 4D 41 59 JOB FRED 12-MAY 00000010 2D 37 35 20 20 54 49 4D-45 3D 31 30 35 33 20 4D -75 TIME=1053 M 00000020 49 4E 2E 20 33 32 2E 31-20 53 45 43 53 2E 0D 0A IN. 32.1 SECS... CAUSE: The intercharacter wait time is too long (1000 instructions). The driver waits a maximum of 300 instructions before exiting to wait for the interrupt. However, there is a bug in the driver that garbles output if the wait time expires. It never does when using a real printer, so the bug wasn't seen. Note that the interline time (100 instructions) is actually shorter than the intercharacter time! Also, the interline time appears to be set to the "serial output time," which bears no relation to the parallel line printer! RESOLUTION: Change the intercharacter time to 5 instructions and the interline time to 10,000 instructions in hp2100_lpt.c. STATUS: Fixed in version 3.2-1. 20. PROBLEM: Issuing a read on a magnetic tape for fewer words than are in the pending record (e.g., doing ":LI,8,B" when there are more than 128 words in the next record) results in a parity error ("IOPE L 8 E 8 S 0 22"). VERSION: 3.2-0 OBSERVATION: FMGR only reads the first 128 words of a record. Records longer than 256 bytes should be truncated when listing. Instead, timing errors (status 22) are reported. Records shorter than 128 words are listed properly. CAUSE: DMA termination before the end-of-record is not being handled properly by the 7970E simulator. The RTE driver sets up DMA control word 1 with the STC bit (bit 15) clear and the CLC bit (bit 13) set. The DMA transfer proceeds apace until DMA control word 3 (word count) goes to zero. At this point, the last cycle logic in "dma_cycle" (hp2100_cpu.c, lines 2477-2480) issues a CLC to the mag tape data channel. In "msdio" (hp2100_ms.c, lines 272-275), the command and control flags are cleared in response. The catch here is that the next I/O data transfer is still pending; it was set in "msc_svc" (hp2100_ms.c, lines 461-467) via "sim_activate", because there were still words in the buffer to transfer. When that time expires, "msc_svc" is called again, and because the data flag is still set (the CLC to the data channel issued by DMA to end the transfer occurred _instead_ of the CLF that is issued between data transfers), the parity error and timing overrun bits are set into the return status at line 462 of hp2100_ms.c. RESOLUTION: Alter "msc_svc" (hp2100_ms.c) to terminate a read if the control flip-flop is reset (by DMA termination). STATUS: Fixed in version 3.2-1. 21. PROBLEM: Switching pending line edit modes (under EDIT or EDITR) by entering the appropriate control codes (e.g., CTRL+I or CTRL+C) print graphic characters that disrupt the one-for-one alignment needed for editing. VERSION: 3.2-1 OBSERVATION: Output of control characters that normally do not print or cause observable actions (e.g., CR or BEL) should be suppressed, so that simulated behavior mimics the action of a real terminal. CAUSE: All characters except NULs are output by the TTY routine. RESOLUTION: Alter "tto_out" (hp2100_stddev.c) to suppress output for all control characters (characters < 40 octal), except for BEL, BS, LF, and CR. STATUS: Fixed in version 3.2-2. 22. PROBLEM: Doing an EDIT pending line character insert with CTRL+S doesn't work. VERSION: 3.2-1 OBSERVATION: CTRL+S is not passed through to the simulated program. Instead, pressing CTRL+S and typing simply absorbs the first character, and the editor stays in "replace" mode for the succeeding characters. CAUSE: The keyboard "peek" routine that checks for a pending input character does not operate in "raw" mode. The simulator calls "_kbhit" to determine if an input character is pending and "_getch" to retrieve that character. "_getch" calls the Windows routine "SetConsoleMode" to set the input mode to "raw" (i.e., no processing of the input characters). However, "_kbhit" does not, and so the CTRL+S is intercepted and processed by Windows. RESOLUTION: Modify "sim_ttrun" and "sim_ttcmd" (sim_console.c) to switch the console into and out of "raw" mode. This inhibits "_kbhit" from interpreting the input character stream. As an added benefit, CTRL+C is no longer interpreted as SIGINT, so all of the associated signal-handling code ("win_handler", etc.) may be removed. STATUS: Fixed in version 3.2-2. 23. PROBLEM: The documentation for the DMSMAP register set is wrong. VERSION: 3.2-1 OBSERVATION: "hp2100_doc.txt" says: CPU registers include the visible state of the processor as well as the control registers for the interrupt system. name models size comments DMSMAP[4][16] 21MX 16 DMS maps should be: DMSMAP[4][32] 21MX 16 DMS maps ...as there are 32 map registers (1 per 1K page) per set. RESOLUTION: Fix the text. STATUS: Fixed in version 3.2-2. 24. PROBLEM: The documentation for the 7900 disc boot is wrong. VERSION: 3.2-1 OBSERVATION: "hp2100_doc.txt" says: The 12557A/13210A supports the BOOT command. BOOT DPC copies the IBL for 7900 class disks into memory and starts it running. BOOT -R DP boots from the removable platter (head 2). Entering "boot -r dp" gives "Non-existent device." The correct command is "boot -r dpc". RESOLUTION: Fix the text. STATUS: Fixed in version 3.2-2. 25. PROBLEM: Logging console output to a file produces CR CR LF as line terminators. VERSION: 3.2-1 OBSERVATION: When console logging is enabled, simulator messages as well as the console output from the simulated system are written to the log file. The former outputs CR LF at the end of each line. The latter outputs CR CR LF. CAUSE: The log file is opened in "text mode" by default, which translates LFs (C newlines) to CR LF sequences. Simulator messages terminate with newlines, and these are translated to CR LF sequences. When the simulated system writes characters to the console, they are also written to the log file. When the simulated system outputs a CR, it is output verbatim. When it follows that with an LF, however, that gets translated into a CR LF, so the log file then has CR CR LF as the end of line sequence. RESOLUTION: Flush the accumulated file stream buffer and change the file mode from TEXT to BINARY in "sim_ttrun" (sim_console.c) when the simulation starts, and then back to TEXT in "sim_ttcmd" when the simulation ends. STATUS: Fixed in version 3.2-2. 26. ENHANCEMENT: For certain errors that stop the simulation, reset the PC to report the instruction causing the error, rather than reporting the next instruction. VERSION: 3.2-2 OBSERVATION: Some stops are triggered by the attempted execution of instructions. In these cases, it is more helpful to report the instruction causing the error than the next instruction. Currently, all stops report the instruction beyond the cause of the stop (i.e., "P + 1"). The table below indicates those stops where it would be more helpful to report the instruction causing the stop (i.e., "P"): PC Code Message Text ===== =========== ==================================== P STOP_RSRV Unimplemented instruction P STOP_IODV Non-existent I/O device P STOP_IND Indirect address loop P STOP_NOCONN No connection on interprocessor link RESOLUTION: Before exiting "sim_instr" (hp2100_cpu.c), reset "PC" to "err_PC" for the above cases. STATUS: Fixed in version 3.2-3. 27. ENHANCEMENT: Add an "echo" command to print arbitrary strings on the simulation console for use in simulation command files. VERSION: 3.2-2 OBSERVATION: Simulation command files allow automation of complex or tedious simulator setups. Because of the potentially lengthy sequence, it would be helpful if the command file had a way to inform the user where it was in the process. Providing a command to do this allows messages such as "Loading diagnostic," "Configuring diagnostic," etc., to be printed during command file execution. RESOLUTION: Implement an "echo " command (scp.c). STATUS: Fixed in version 3.2-3. 28. PROBLEM: Booting 2000E TSB hangs after printing "READY". VERSION: 3.2-2 OBSERVATION: The code is stuck in a loop, waiting for the 7900 disc data channel flag to set. CAUSE: To perform a disc read, the TSB disc driver issues a seek command but does not wait for seek completion before issuing the read command to the interface. This is allowed by the interface manual. The eventual interrupt signifies the completion of both the seek and the read commands. However, the "drive attention" flag that is normally generated at the end of the seek isn't set if the commands overlap in this manner. When a read command is received with a seek in progress, the simulator cancels the seek timer and establishes a read timer of a longer duration in its place. But the cancellation of the seek timer also cancels the setting of the "drive attention" bit that would have occurred had the seek completed normally, and the simulator doesn't supply it explicitly in this case. The HP "7900A Disc Drive Operating and Service Manual" (07900-90002) says, in section 4-67, "Attention is set high everytime a seek has been completed and Access Ready comes high." TSB code loads the "drive attention" word from the command channel to create a "request status" command. The code assumes that either bit 0 or bit 1 will be set, so an "ADA =D-1" is done to transform the retrieved 000001 or 000010 into 000000 or 000001, respectively. This effectively becomes a "request status for unit 0/1" command, which is output to the drive as a command. However, the simulator bug causes the drive attention word to be 0, so the ADA makes the value 177777. This is an illegal command, so the data channel flag never sets. RESOLUTION: Alter "dp_goc" (hp2100_dp.c) to set drive attention when seek completion is simulated. STATUS: Fixed in version 3.2-3. 29. PROBLEM: Running 2000/Access, the 7900 disc fails to format. VERSION: 3.2-2 OBSERVATION: The code is hung in a loop, waiting for a drive attention flag after the execution of an "Initialize Data" command. CAUSE: The 13210A disc interface passes through attention flags that the drives generate as a result of seek completions. However, the interface also generates its own drive attention flag at the conclusion of every command except "Status Check." This internally generated flag is not being provided by the 7900 simulator. The schematics and flowcharts in the 13210A manual indicate that a local attention bit, derived from the unit number in the last command, is provided at the conclusion of every command issued except: * "Status Check" -- executing this command clears the attention bit. * "Seek" -- if the drive is not ready, then a local attention bit is provided immediately, else the attention bit from the drive is provided when the seek completes. RESOLUTION: Alter (hp2100_dp.c) to provide the needed attention bits. STATUS: Fixed in version 3.2-3. 30. PROBLEM: Booting 2000/Access reports "CAN'T USE TAPE" when loading from 7970. VERSION: 3.2-2 OBSERVATION: No data is returned in response to reading the first tape record. CAUSE: Rewind at BOT should return immediately but is not. Access does not wait for rewind to complete, so it issues the read command while the transport is busy. The command is rejected, so Access tries a CLEAR and then a retry, but a bug in Access causes DMA to be started after the CLEAR is sent. When CLEAR completes, READ is attempted again, but DMA is not reset. Also, the simulator is processing rejected commands when STC CC,C follows a rejection. This should be a NOP. RESOLUTION: Change hp2100_ms.c to do immediate completion for REWIND at BOT and to NOP an STC CC,C after a command reject. Note that this "fixes" the problem as long as the tape is at load point when the Access bootstrap is run. This would normally be the case, but it appears as though Access wouldn't work if the tape had to be rewound! STATUS: Fixed in version 3.2-3. 31. PROBLEM: Running the 7970 diagnostic reports "Unit not attached, P: 02741 (CLF 77)" when executing Test 0. VERSION: 3.2-2 OBSERVATION: The error is occurring in the basic I/O test for the command channel. The test for the data channel is succeeding. CAUSE: The diagnostic does a STC CC as part of the I/O test. The last command sent was to the interface was SL3. Unit selects are not supposed to be executed, but examination of the card schematics reveals that this will set the command FF and the card busy bit and take no further action. The simulator, however, is scheduling an I/O event in response, and when the event occurs, unit 3 is not attached, so an error is reported. RESOLUTION: Modify "mscio" (hp2100_ms.c) to not schedule an I/O event if the last command was a unit select. STATUS: Fixed in version 3.2-3. 32. PROBLEM: Running the 7970 diagnostic reports "Magtape library I/O error: Invalid argument" when executing Test 4. VERSION: 3.2-2 OBSERVATION: The error occurs when a write is aborted with a clear command. CAUSE: If a CLR command is issued with a write in progress, the simulator attempts to mark the record as bad on the tape by adding the "MTR_ERF" flag to the "sim_tape_wrrecf" call. Unfortunately, that function does not remove the flag before calling "sim_fwrite", and so the eventual OS call sees the equivalent of a very large record length and therefore returns EINVAL. RESOLUTION: Modify "sim_tape_wrrecf" (sim_tape.c) to mask off the "MTR_ERF" flag when determining the record length. STATUS: Fixed in version 3.2-3. OBSERVATION: The library error is not stopping the simulator, even though the STOP_IOE variable is set. CAUSE: "sim_tape_ioerr" is returning "SCPE_IOERR" instead of "MTSE_IOERR", and "ms_map_err" maps this to "SCPE_OK", so the simulator isn't halted. RESOLUTION: Modify "sim_tape_ioerr" (sim_tape.c) to return "MTSE_IOERR" instead of "SCPE_IOERR". STATUS: Fixed in version 3.2-3. 33. PROBLEM: Running the 7970 diagnostic reports a number of timing errors, with events taking longer or shorter than expected. VERSION: 3.2-2 OBSERVATION: The diagnostic times certain tape functions (e.g., the time from issuing a WRITE command until the first data is requested). Most of these are reported as diagnostic failures. CAUSE: I/O time modelling is not done properly. In some cases, the times indicated are incorrect. In others, certain characteristics (e.g., that operations from BOT take longer, due to the initial gap) aren't modelled at all. RESOLUTION: Revise "mscio" and "msc_svc" (hp2100_ms.c) to model actual I/O timing characteristics correctly. STATUS: Fixed in version 3.2-3. 34. ENHANCEMENT: Provide a method of selecting between realistic and fast (optimized) command execution times for the 7970 simulator. VERSION: 3.2-2 OBSERVATION: The 7970 diagnostic checks command execution times, so to pass, the simulator must model these times. However, they are generally much longer than are required by the various operating systems. RESOLUTION: Modify "hp2100_ms.c" to add SET MSC REALTIME, SET MSC FASTTIME, and SHOW MSC TIMING commands. Timing is now set according to the timing and interface models in use. STATUS: Fixed in version 3.2-3. 35. ENHANCEMENT: Provide a means of printing the internal state of the 7970 tape simulator. VERSION: 3.2-2 OBSERVATION: Debugging tape errors would be easier if the tape interface commands and status were observable and recordable. SIMH provides a "DEBUG" mode command set to allow devices to provide this information. RESOLUTION: Modify "hp2100_ms.c" to add debug-mode calls. STATUS: Fixed in version 3.2-3. 36. PROBLEM: The 7970 tape diagnostic fails Test 12, Subtest 4. VERSION: 3.2-2 OBSERVATION: Test 12 forces data and timing errors. Execution reports: H154 UNIT 000000 H102 RECORD 000103 H054 COMMAND 000223 H155 STATUS IS 1 000 100 010 000 010 H155 AND SHOULD BE 1 000 000 010 010 010 TEST 12 E100 DATA OR ODD BYTE ERROR In test 12, step 3, a 100-word WRITE is interrupted after 64 words with a CLEAR command, followed by a WRITE FILE MARK. The diagnostic manual says, "This procedure creates a record with a known parity error." The simulator CLEAR command processing detects the write-in-progress and writes a simulated tape record with the MTR_ERF flag to indicate a bad record. In step 4, the records are backspaced, and a READ UNTIL FILE MARK command is issued without transferring any data. This should set the timing error bit (bit 4) in the status word. In the status word reported, it is not set. CAUSE: The simulator implementation of the CLEAR command erroneously clears the data channel command FF. When the READ UNTIL FILE MARK command is issued, no data transfer is attempted, so the timing error does not occur. RESOLUTION: Modify the CLR command in "mscio" (hp2100_ms.c) to leave the data channel control and flag FFs untouched. STATUS: Fixed in version 3.2-3. 37. PROBLEM: Running the RTE off-line disc backup program DBKUP and doing a save to tape with verify hangs after printing "VERIFYING." VERSION: 3.2-2 OBSERVATION: Using the 7970 debug mode reveals that the program does a rewind in preparation for verifying. Then, after the command completes but while the rewind is in progress, a read is issued. This is rejected due to REW + TBUSY being set (rewind still in progress). After rejection, a clear is issued and completes. At this point, the program appears to hang. CAUSE: The RTE tape driver retries rejected commands by clearing the interface and reissuing the originally rejected command. However, the simulator erroneously clears both command and data channel control FFs and sets both flag FFs in response to the CLR command. Clearing the control FFs means that no completion interrupt is generated as a result of the CLR, so the driver is never reentered to reissue the rejected command, and the program stays in the I/O suspend state forever. RESOLUTION: Modify the CLR command in "mscio" (hp2100_ms.c) to set both the command control and data FFs. STATUS: Fixed in version 3.2-3. 38. PROBLEM: The 13183A (7970) simulator reports "odd byte" status when an EOF is detected. VERSION: 3.2-2 OBSERVATION: For the NRZI (13181A) interface, an EOF is a single special character in the data stream, so odd byte status is set when it is detected. For the PE (13183A) interface, EOF is an erasure pattern that is detected by the drive itself and communicated to the interface as a status line. Odd byte status is not set when the 13183A interface indicates an EOF. CAUSE: Odd byte status on EOF is not conditional on interface type. RESOLUTION: Modify "ms_map_err" (hp2100_ms.c) to condition odd byte status with EOF on interface type. OBSERVATION: The FSF and BSF processors in "msc_svc" treat EOF separately from other tape errors, but the separate code takes precisely the same action as does the generic error mapper. RESOLUTION: Modify "msc_svc" (hp2100_ms.c) to remove the separate treatment and call the generic error mapper unconditionally. STATUS: Fixed in version 3.2-3. 39. PROBLEM: The 7970 simulator does not report "odd byte" status when a tape record with an odd byte length is read. VERSION: 3.2-2 OBSERVATION: A tape record containing an odd number of bytes is read, but the odd byte status bit isn't set at completion of the read. CAUSE: The RC and RFF processors in "msc_svc" are not testing for this condition. RESOLUTION: Modify "msc_svc" (hp2100_ms.c) to set the odd byte status bit if the last record read contained an odd number of bytes and to zero the unused byte (as specified on page 4-11 of the 13181B manual). STATUS: Fixed in version 3.2-3. 40. PROBLEM: The 7970 simulator fails Test 12, Subtest 2 when configured as a 13183A interface. VERSION: 3.2-2 OBSERVATION: The test issues a RFF command and waits for the first data flag. It then reads status in a loop and waits for the odd byte bit to set before continuing. If this bit doesn't set within 65K iterations, the test fails. CAUSE: The 13183A hardware passes the odd/even byte FF output through as the odd byte status bit, so this bit will be seen to toggle as data is received. The simulator, by contrast, sets the odd byte flag only at the end of the transfer. While the interface manual states that the odd byte status is only valid after the command flag FF sets, the diagnostic depends on seeing this bit toggle once during the transfer. The 13181A hardware enables the odd byte status bit only when the end-of-record is detected. However, because odd byte status occurs when EOF is detected, the diagnostic test will still succeed, albeit at the end of the RFF command rather than at the beginning. RESOLUTION: Modify "msc_svc" (hp2100_ms.c) to set the odd byte status bit at the beginning of the transfer if configured as a 13183A interface and then to set or clear it as appropriate at the end of the transfer. STATUS: Fixed in version 3.2-3. 41. ENHANCEMENT: Add a configurable reel length setting to the 7970 simulator and provide end-of-tape status returns. VERSION: 3.2-2 OBSERVATION: The 7970 diagnostic provides an option to inhibit rewinds during test loops to allow the EOT status to be tested. The simulated tape, however, is effectively infinite; EOT is never returned, as there is no predefined tape length. An option to provide a simulated end-of-tape indication would be helpful. RESOLUTION: Modify "hp2100_ms.c" to add SET MSCn REEL= and SHOW MSCn REEL and to return EOT status if motion beyond the defined tape length is attempted. Reel lengths may be set to 600, 1200, or 2400 (feet). Setting the length to 0 inhibits EOT, i.e., the reel length is effectively unlimited. Modify "mscio" to return EOT status when current tape position is beyond a calculated end-of-tape marker position (marker position is calculated as the ideal tape reel capacity, i.e., the number of bytes per inch times the length of the tape in inches). STATUS: Fixed in version 3.2-3. 42. PROBLEM: Running the RTE off-line disc backup program PSAVE and doing a save to a new tape gives an initial "IOPE" after specifying the tape label. VERSION: 3.2-2 OBSERVATION: Upping the driver causes the program to continue properly. Saving to a "used" tape does not exhibit this problem. CAUSE: The PSAVE program is attempting to read the new tape. The tape simulation library is reporting MTSE_EOM (end of medium), as the newly created tape image file is zero-length. This is translated to STA_PAR by "ms_map_err". In response, the RTE tape driver retries the read ten times and then gives up and reports the parity error. RESOLUTION: End-of-medium has no hardware analog; one cannot have a physical tape of zero length. So the translation to simulated tape status is arbitrary. A new physical tape will "run away," i.e., never return data. Some programs, e.g., the RTE tape driver, are written to detect this. However, those that aren't will simply hang. A more useful translation is to return EOF marks when a motion is attempted beyond the end of the medium, as many programs interpret two successive EOFs as "logical end-of-medium." Modify "ms_map_err" (hp2100_ms.c) to return EOF status for MSTE_EOM. STATUS: Fixed in version 3.2-3. 43. PROBLEM: EDIT/1000 uses the HT character (CTRL+I) to insert a tab, but printing of this character is suppressed. VERSION: 3.2-2 OBSERVATION: There is no visual indication that the TAB key was pressed to insert a HT character. CAUSE: "CNTL_SET" does not include the HT character. RESOLUTION: Modify "hp2100_stddev.c" to add "HT_FLAG", defined as "CHAR_FLAG('\t')", to "CNTL_SET". STATUS: Fixed in version 3.2-3. 44. PROBLEM: The 7900 disc diagnostic fails Step 55 if two or more units are connected. VERSION: 3.2-2 OBSERVATION: Altering the unit table at the start of the diagnostic to include two units (e.g., "0,1") and then running a short pass produces this output: H65 SHORT PASS 0004,HEADS 0/1,UNIT 00, 0000 ERRORS H44 SEEK IN STEP 55 E10 NO COMMAND FLAG H33 ATTENTION/SEEK-STATUS 000002 000000 H51 CYL 0202 HEAD 01 SECTOR 19 WORD COUNT 0128 UNIT 00 The step tests overlapping seeks. CAUSE: The command channel flag set that normally indicates seek command completion is not being deferred by the CLC CC issued in preparation for sending another command. The simulator must defer the flag set until a subsequent STATUS CHECK command is issued (this command normally does not set the command channel flag but will do so if a pending drive attention bit is set). RESOLUTION: Add a "poll attention" state to the simulator and set the command channel flag if polling is enabled and one or more drive attention bits are set. STATUS: Fixed in version 3.2-3. 45. PROBLEM: The 7900 disc diagnostic fails the not-ready tests in Step 14. VERSION: 3.2-2 OBSERVATION: Running the 7900 diagnostic with S bit 4 set to execute the interactive part of Section 1 causes this failure: H70 UNLOAD UNIT 0,PUSH RUN HALT instruction 102002, P: 03364 (JSB 1430) sim> detach dpc0 sim> go H46 READ IN STEP 14 E64 STATUS IS 000101 SHOULD BE 000105 H51 CYL 0202 HEAD 00 SECTOR 00 WORD COUNT 1024 UNIT 00 The diagnostic is expecting the DRIVE BUSY bit to be set. CAUSE: The "unit not attached" simulator state maps to the "drive not ready" hardware state. In this state, both the NOT READY and the DRIVE BUSY status bits should be set. Referring to the "Drive Control Assembly A9" schematic on page 5-43 of the "7900A Disc Drive Operating and Service Manual" (HP 07900-90002), the "Drive Ready" signal is forced low via U22B if the "Load Switch Off" signal is asserted (setting the "Load Switch" off unloads the heads). Also, the "Access Ready" signal is forced low via U35A if the "Drive Ready" signal is low. Schematic "Input/Output Multiplex Assembly A7" on page 5-39 shows that these signals are inverted and driven onto the cable to the CPU interface. The 13210A interface manual schematic for "Disc Interface PCA 1" shows that both signals are inverted twice and presented to the CPU as status bits 6 and 2, respectively. So "not Drive Ready" becomes NOT READY, and "not Access Ready" becomes DRIVE BUSY. RESOLUTION: Modify "dpd_svc" (hp2100_dp.c) to set both the NOT READY and DRIVE BUSY bits when the unit is not attached. STATUS: Fixed in version 3.2-3. 46. PROBLEM: The 7900 disc diagnostic loops forever in Step 15. VERSION: 3.2-2 OBSERVATION: Running the 7900 diagnostic with S bit 4 set to execute the interactive part of Section 1 causes this failure: H40 PROTECT U/D THEN READY UNIT 0 [CTRL+E] Simulation stopped, P: 76734 (TIMER) sim> set dpc0 locked sim> att dpc0 7900-U0.scratch.disc sim> go H40 PROTECT U/D THEN READY UNIT 0 H40 PROTECT U/D THEN READY UNIT 0 H40 PROTECT U/D THEN READY UNIT 0 The diagnostic is waiting for the CC flag to set when the drive becomes ready (i.e., when the unit is attached). CAUSE: Section 4-67 of the "7900A Disc Drive Operating and Service Manual" (HP 07900-90002) says, "Attention is set high everytime a seek has completed and Access Ready comes high." This includes the initial head-loading seek when the drive becomes ready. The "Troubleshooting Diagrams (Sheet 2 of 4)" on page 5-17 show that after the heads load, Drive Ready, First Status, Access Ready (a.k.a. not Busy), and Attention are asserted. The corresponding code in "dpc_attach" sets First Status but not Attention. In addition, the last diagnostic command prior to the loop is a STATUS CHECK. This leaves the 13210A interface polling for attention bits, and when one is asserted, the command channel flag FF is set. However, the simulator makes no provision for this; the flag is checked once at the end of the status command, but no further checks are made thereafter. RESOLUTION: Modify "dpc_attach" (hp2100_dp.c) to set the ATN flag when the unit is attached and, if drive polling is enabled, to set the command channel flag. STATUS: Fixed in version 3.2-3. 47. PROBLEM: The 7900 disc diagnostic fails the write-protect tests in Step 16. VERSION: 3.2-2 OBSERVATION: Running the 7900 diagnostic with S bit 4 set to execute the interactive part of Section 1 causes this failure: H40 PROTECT U/D THEN READY UNIT 0 [CTRL+E] Simulation stopped, P: 76734 (TIMER) sim> set dpc0 locked sim> attach dpc0 7900-U0.scratch.disc sim> go H44 SEEK IN STEP 16 E64 STATUS IS 040001 SHOULD BE 042001 H51 CYL 0000 HEAD 00 SECTOR 00 WORD COUNT 0128 UNIT 00 The diagnostic is expecting the DATA PROTECT bit to be set. CAUSE: The UNIT_WPRT flag is being checked in the FNC_STA processing in "dpd_svc", but the referenced unit is the data channel unit, not the command channel unit where the flag is actually set. RESOLUTION: Alter "dpd_svc" (hp2100_dp.c) to check the command channel unit instead of the data channel unit when looking for write-protect indication. STATUS: Fixed in version 3.2-3. 48. PROBLEM: The 7970E diagnostic hangs in test 33 if the tape is not at BOT. VERSION: 3.2-2 OBSERVATION: The test issues a REWIND/OFFLINE to each unit in turn and looks for the REW status bit to deny before proceeding. CAUSE: The simulator resets this bit for the REWIND command but not for REWIND/OFFLINE. More generically, though, the simulator is reporting unit status (REW, BOT) when the unit is off-line. RESOLUTION: Modify "mscio" (hp2100_ms.c) to remove unit-specific status from the status return when the unit is not attached. STATUS: Fixed in version 3.2-3. OBSERVATION: The status for REWIND/OFFLINE when not at BOT isn't quite correct. The hardware indicates "Rewinding" (bit 10) for a short time before going off-line. CAUSE: The simulator is detaching (i.e., going off-line) immediately upon command execution. RESOLUTION: Modify "mscio" (hp2100_ms.c) to detach after the interface execution delay. STATUS: Fixed in version 3.2-3. OBSERVATION: The status for REWIND and REWIND/OFFLINE when at BOT isn't quite correct. The hardware does not indicate "Tape Unit Busy" (bit 9) if the unit is at BOT, because the tape never moves. CAUSE: The simulator generates "Tape Unit Busy" whenever a service event is scheduled, but this status should not occur if a rewind is issued at BOT. RESOLUTION: Modify "mscio" (hp2100_ms.c) to condition STA_TBSY on rewind at BOT. STATUS: Fixed in version 3.2-3. 49. PROBLEM: The "do" command does not obey the "-v" ("verbose") option switch when console logging is in effect. VERSION: 3.2-2 OBSERVATION: Command file commands are always written to the console log file, regardless of the setting of the "-v" switch. Commands are only displayed on the console when "-v" is specified. The console log file, therefore, is not a copy of what appeared on the console. CAUSE: Output of the file commands is not conditional on the "-v" switch. RESOLUTION: Modify "do_cmd" (scp.c) to condition writing file commands to the console log on the "-v" switch. STATUS: Fixed in version 3.2-3. 50. PROBLEM: The "echo" command does not echo to the console log file. VERSION: 3.2-2 OBSERVATION: The "echo" command writes its argument only to the console. If logging is in effect, the echoed strings will not appear in the file. CAUSE: This action was omitted. RESOLUTION: Modify "echo_cmd" (scp.c) to copy the echoed argument string to the console log file if logging is in effect. STATUS: Fixed in version 3.2-3. 51. PROBLEM: The diagnostic configurator mis-identifies the host CPU. VERSION: 3.2-3 OBSERVATION: Running the diagnostic configurator in conversational mode produces these hardware detection results using various CPU settings (note that STOP_INST must first be set to 0 to prevent unimplemented instruction traps): set cpu 2116 --> "2114, DMA, NO MPRT, 32K MEMORY" set cpu 2100 --> "21MX E, DMA, NO MPRT, 32K MEMORY" set cpu 21MX --> "21MX E, DMA, MPRT, 32K MEMORY" CAUSE: Two model-specific behaviors are not implemented: * The S-register is read-only on the 2115/2116. * LIA 6/7 (actually, the "floating" state of the internal S-bus) returns -1 on the 21MX, and 0 on the 2114/2115/2116/2100. These behaviors are tested by the configurator to determine the CPU type. NOTE: the 21MX is detected as a "E-Series" model. This is due to the presence of the TIMER instruction (TIMER is not implemented on the "M-Series" and is decoded as an MPY instruction on that system). RESOLUTION: Modify "ovfio", "dmpio", and "nulio" (hp2100_cpu.c) to implement the above behaviors. STATUS: Fixed in version 3.3-0. 52. PROBLEM: Displaying the CCA, CCB, and CCE instructions via "examine -m" prints "CLA,CMA", "CLB,CMB", and "CLE,CME" respectively. VERSION: 3.2-3 OBSERVATION: While "CLA,CMA" (e.g.) is logically what the "CCA" instruction does, it is invalid assembler syntax (although it is accepted by the "deposit" routine). CAUSE: The "mtab" array contains values to mask the instruction under consideration to the significant bits. For the CLA/B, CMA/B, and CCA/B instructions, the mask values are 006400, 007000, and 007400, respectively. They should all be 007400. For the CLE, CME, and CCE instructions, the mask values are 002100, 002200, and 002300. They should all be 002300. RESOLUTION: Modify "mtab" (hp2100_sys.c) to use the proper masks for these alter-skip group instructions. STATUS: Fixed in version 3.3-0. 53. PROBLEM: The paper tape diagnostic has several tests that depend on creating and using a tape loop. VERSION: 3.2-3 OBSERVATION: Tests 4, 5, and 11 use a loop of tape. The pattern for the loop is punched by test 7. To run tests 4, 5, and 11, multiple copies of the pattern must be stored in a "loop" file, and the tests must be exited before the "loop" runs out. A better solution would be to have a settable "loop mode" that rewinds the tape image file when EOF is encountered. RESOLUTION: Modify "ptr_mod" (hp2100_stddev.c) to add SET PTR DIAG and SET PTR READER commands, and modify "ptr_svc" to add support for loop mode. STATUS: Fixed in version 3.3-0. 54. PROBLEM: The time base generator (CLK) cannot be disabled. VERSION: 3.2-3 OBSERVATION: The TBG was an option for HP systems, and certain DOS operating system features behave differently, depending on the presence or absence of the TBG. It is desirable to allow those features to be observed during simulation. CAUSE: The "clk_dev" structure lacks the DEV_DISABLE flag. RESOLUTION: Modify "clk_dev" (hp2100_stddev.c) to add the DEV_DISABLE flag. STATUS: Fixed in version 3.3-0. 55. ENHANCEMENT: Move the memory protect simulation from the CPU to a new MP device, allow MP to be disabled, and add the 12892B memory protect feature jumpers W5 (JSB), W6 (INT), and W7 (SEL1). VERSION: 3.2-3 OBSERVATION: Memory protect is an option card in 2116/21MX systems and should have its own device entry in the simulator. The device should be disabled to indicate that the card is absent. Setting the CPU model to 2100 or 21MX should enable MP, although it may be subsequently disabled if desired. Setting the CPU model to 2116 should disable MP. The simulator should initialize with MP disabled. The "B" version of the 21MX memory protect card added three jumpers to modify the "standard" memory protect behavior. The W5 (JSB) option prohibited JSB to locations 0 and 1. The W6 (INT) option inhibited the indirect interrupt holdoff. The W7 (SEL1) option allowed I/O instructions referencing select codes other than 1. RESOLUTION: Modify "hp2100_cpu.c" to create the MP device and add commands for setting the above options and support for the associated features. STATUS: Fixed in version 3.3-0. 56. ENHANCEMENT: Allow DMA to be disabled. VERSION: 3.2-3 OBSERVATION: DMA is an option card on all machines, so disabling it should be allowed. Note that disabling DMA0 should disable DMA1 and vice-versa. (There was no single-channel DMA option except on the 2114.) RESOLUTION: Modify "hp2100_cpu.c" to permit DMA to be disabled. STATUS: Fixed in version 3.3-0. 57. PROBLEM: Setting the CPU to 21MX and a memory size > 32K and then changing the CPU to either 2100 or 2116 does not reset the memory size to a legal value. VERSION: 3.2-3 OBSERVATION: The 2100 and 2116 machines have a maximum memory size of 32K. This limit is enforced when setting the memory size, i.e., "Invalid argument" is reported when attempting to set these machines to a memory size > 32K. However, if the machine is first set to 21MX, the memory size is increased beyond 32K, and then the machine is reset to 2100 or 2116, the memory size will remain larger than 32K. CAUSE: No check on memory size is made when the machine type is set. RESOLUTION: Modify "cpu_mod[]" (hp2100_cpu.c) to call "cpu_set_opt" when changing the CPU model, and modify "cpu_set_opt" to call "cpu_set_size" if the current memory size is > 32K and the new model is 2100 or 2116. If the memory above 32K is not empty, and the "Really truncate memory" question is answered in the negative, "Command not completed" is printed, and the CPU change is aborted. STATUS: Fixed in version 3.3-0. 58. PROBLEM: According to the HELP display, SET , SET , and SET CONSOLE should allow a comma-separated list of parameters, but such commands are rejected with "Non-existent parameter." VERSION: 3.2-3 OBSERVATION: Doing HELP SET lists the following syntax for the above commands: set console arg{,arg...} set console options set arg{,arg...} set device parameters set arg{,arg...} set unit parameters None of these work, however, as each accepts only a single argument. Note that the corresponding SHOWs do accept multiple arguments. CAUSE: The "get_glyph" routines that parse the command parameters are missing the option to indicate that commas are glyph separators. RESOLUTION: Modify the appropriate calls to "get_glyph" (scp.c, sim_console.c) to specify ',' as the the "optional end of glyph character" parameter. STATUS: Fixed in version 3.3-0. 59. ENHANCEMENT: The 2607 line printer simulator (LPT) now supports local OFFLINE/ONLINE and POWEROFF/POWERON settings. VERSION: 3.2-3 OBSERVATION: The 2607 printer returns different status for power-off and offline conditions. A local "power off" command is needed to simulate the power-off or cable-disconnected state, and a local offline command is needed to simulate the PRINT button up state. This allows proper status to be returned to programs that expect it (e.g., RTE, diagnostics). RESOLUTION: Modify "lptio" (hp2100_lpt.c) to implement local power off and offline settings and to return proper status for these conditions. STATUS: Fixed in version 3.3-0. 60. PROBLEM: The 2607 line printer simulator (LPT) does not supply the proper status for the paper-out condition. VERSION: 3.2-3 OBSERVATION: Paper-out is simulated by detaching the printer image file. When detached, the simulator returns status 040000 (paper out). However, the 12845 Line Printer Operating and Service Manual (HP 12845-90001) states in section 2-33, "[The paper-out] signal is asserted only when the format tape in the line printer has reached the bottom of form." So the expected status should be 000000 unless the printer is positioned at BOF. CAUSE: "lptio" is not checking for BOF before returning paper-out status. RESOLUTION: Modify "lptio" (hp2100_lpt.c) to set the paper-out status bit only if the current print location is BOF. STATUS: Fixed in version 3.3-0. 61. PROBLEM: Issuing a TOF to the 2607 line printer (LPT) leaves the paper on the second line instead of the first. VERSION: 3.2-3 OBSERVATION: The RTE driver for the 2607 printer implements a top-of-form request by issuing a VFU call to channel zero. On a real printer, this leaves the paper positioned at the first line on the page. The simulator, however, leaves the paper positioned at the second line. Examining the LPT registers shows that LCNT is 0 immediately after an ATTACH but is 1 after a TOF request. CAUSE: The TOF is simulated by sending a form-feed to the printer image file. This is being incorrectly followed by a line-feed and a line counter increment. RESOLUTION: Modify "lpt_svc" (hp2100_lpt.c) to suppress the line-feed and line counter increment after a TOF request. STATUS: Fixed in version 3.3-0. 62. ENHANCEMENT: The 2767 line printer simulator (LPS) now supports local OFFLINE/ONLINE and POWEROFF/POWERON settings. VERSION: 3.2-3 OBSERVATION: The 2767 printer returns different status for power-off and offline conditions. A local "power off" command is needed to simulate the power-off or cable-disconnected state, and a local offline command is needed to simulate the PRINT button up state. This allows proper status to be returned to programs that expect it (e.g., RTE, diagnostics). RESOLUTION: Modify "lpsio" (hp2100_lps.c) to implement local power off and offline settings and to return proper status for these conditions. STATUS: Fixed in version 3.3-0. 63. PROBLEM: Command files that reduce CPU memory size cannot run unattended. VERSION: 3.2-3 OBSERVATION: Command files that change CPU settings will pause for operator intervention if memory size is being reduced, previous memory size was more than 32K, and the memory being truncated contained non-zero data. In this case, a prompt ("Really truncate memory?") is issued to the console. As the response is not taken from the command file, there is no way to continue without user intervention. CAUSE: The "cpu_set_size" routine calls "get_yn", which reads from "stdin." RESOLUTION: Modify "cpu_set_size" (hp2100_cpu.c) to respond to a new "-F" switch that indicates that truncation should be forced without prompting. STATUS: Fixed in version 3.3-0. 64. PROBLEM: Attempting to output to the 2767 simulator (LPS) via RTE-IVB causes not-ready and illegal interrupt errors. VERSION: 3.2-3 OBSERVATION: With the 2767 printer assigned to select code 21 and logical unit 12, attempting to print results in "IONR L 12 E12 S 0 0", followed by one "ILL INT 21" error for each character output. CAUSE: The RTE driver understands that the 2767 prints in four 20-character zones and that character output within a zone is buffered. It therefore assumes that a buffered character will be accepted within three instruction times. If the printer is still busy after that, the printer is declared "not ready" and is downed. Subsequent interrupts are not expected (the printer is assumed to be malfunctioning), resulting in the illegal interrupt messages. The 2767 simulator defines the character transfer time as four instructions and has no provision for detecting print zones. The driver assumes that it can fill a zone rapidly within the driver and will have to exit the driver to wait for an interrupt at the end of each zone. RESOLUTION: Modify "lpsio" and "lps_svc" (hp2100_lps.c) to reduce the buffer transfer time to two instructions and to determine the end of a zone in order to take an appropriately longer time before interrupting. STATUS: Fixed in version 3.3-0. 65. ENHANCEMENT: Provide a method of selecting between realistic and fast (optimized) command execution times for the 2767 simulator. VERSION: 3.2-3 OBSERVATION: The 2767 diagnostic checks command execution times, so to pass, the simulator must model these times. However, they are generally much longer than are required by the various operating systems. RESOLUTION: Modify "hp2100_lps.c" to add SET LPS REALTIME and SET LPS FASTTIME commands. Timing is now set according to the timing model in use. STATUS: Fixed in version 3.3-0. 66. ENHANCEMENT: Provide a means of printing the internal state of the 2767 printer simulator. VERSION: 3.2-3 OBSERVATION: Debugging printer errors would be easier if the printer interface commands and status were observable and recordable. SIMH provides a "DEBUG" mode command set to allow devices to provide this information. RESOLUTION: Modify "hp2100_lps.c" to add debug-mode printouts. STATUS: Fixed in version 3.3-0. 67. PROBLEM: The console "break" and "delete" character settings are not saved across a simulation SAVE/RESTORE. VERSION: 3.2-3 OBSERVATION: The console interrupt character set via SET CONSOLE WRU= is preserved when the simulation is SAVEd and then later RESTOREd. However, the values set via SET CONSOLE BRK= and SET CONSOLE DEL= are lost and revert to their default settings. CAUSE: Only "sim_int_char" is included in the hidden CPU state. RESOLUTION: Modify "cpu_reg" (hp2100_cpu.c) to include BRK and DEL registers corresponding to "sim_brk_char" and "sim_del_char". STATUS: Fixed in version 3.3-0. 68. PROBLEM: Attached device output files and debug log files cannot be examined after a simulation stop. VERSION: 3.2-3 OBSERVATION: After stopping simulation, either via a breakpoint or CTRL+E, viewing attached device output files or the device debug log file reveals incomplete data, limiting the ability to determine what has been output at the point of interruption. CAUSE: All files are buffered, and the last bytes output haven't been flushed to disk. RESOLUTION: Modify "run_cmd" (scp.c) to flush the console log file, the debug log file, and any attached output files before returning. STATUS: Fixed in version 3.3-0. 69. PROBLEM: Attempting to disable the DP controller by doing SET DPD DISABLED is rejected with "Command not allowed." Attempting to disable the DR controller by doing SET DRD DISABLED is accepted, but the controller remains enabled. VERSION: 3.2-3 OBSERVATION: Section 2.3 of "hp2100_doc.txt" states, "For devices with more than one device number, disabling or enabling any device in the set disables all the devices." This is not true, however, for most multiple-card devices. SET DISABLED is rejected for the DPD, DQD, MSD, MUXL, and MUXM devices. For the DRD, IPLI, and MTD devices, the command is accepted but does not disable the device. CAUSE: The "DEV_DISABLE" flag is missing from the "DEVICE" structures of the DPD, DQD, MSD, MUXL, and MUXM devices. Also, for all multiple devices, the device "dev_reset" function must call "hp_enbdis_pair" with the appropriate parameter to synchronize the enable/disable state of both devices. RESOLUTION: Modify the "DEVICE" structures and "dev_reset" routines as needed to the affected source files (hp2100_dp.c, hp2100_dq.c, hp2100_dr.c, hp2100_ipl.c, hp2100_ms.c, hp2100_mt.c, and hp2100_mux.c). STATUS: Fixed in version 3.3-0. 70. PROBLEM: The 2871 disc diagnostic fails Status Checks in Step 1. The checks are related to the ANY ERROR bit. VERSION: 3.2-3 OBSERVATION: Running the 2871 diagnostic causes this failure: H44 SEEK IN S1 E64 STATUS IS 000001 SHOULD BE 000000 H51 CYL 0000 HEAD 00 SECTOR 00 WORD COUNT 0000 UNIT 00 The diagnostic is not expecting the ANY ERROR bit (bit 0) to be set with the ATTENTION bit (bit 15). The simulator is returning status 100001 from the seek operation (bit 15 is always masked by the diagnostic before reporting). Resuming the diagnostic produces this error: H44 SEEK IN S1 E64 STATUS IS 000005 SHOULD BE 000004 H51 CYL 0001 HEAD 00 SECTOR 00 WORD COUNT 0000 UNIT 00 The diagnostic is not expecting the ANY ERROR bit (bit 0) to be set with the BUSY bit (bit 2). CAUSE: The ANY ERROR bit is set by the simulator if any status bit is set other than bit 10 (HUNTING) or bit 7 (unused). This is correct for the 13210A interface but not for the 12557A interface. From the "12557A Cartridge Disc Interface Operating and Service Manual" (HP 12557-90001, September 1970), Table 2.6, "Disc Status Word" lists the following meanings for the status bits: Bit 0: ANY ERROR. A "1" indicates that any of the remaining 15 bits (except bits 2, 3, and 7) is a "1". Bit 15: ATTENTION. A "1" indicates that an operation previously in progress on the selected disc drive unit has terminated either through normal completion or due to occurrence of an error or other unusual condition. During execution of all commands except Status Check, the condition is generated when command execution terminates regardless of the cause for termination. This would imply that the ANY ERROR bit would set with the ATTENTION bit. However, on page 2-16, Section 2.50, "Design Considerations," this statement appears: Following each interrupt, the program must issue a Status Check command to the disc drive unit that executed the storage command and verify that the ANY ERROR bit (bit 0) is not a "1" in the disc status word. Given that the ATTENTION bit sets for each command completion, and given that the ANY ERROR bit is expected to be zero after a normal command completion, the implication is that ATTENTION does not set ANY ERROR. RESOLUTION: Modify "dpcio" (hp2100_dp.c) to set the ANY ERROR bit for all status bits except bits 2, 3, 7, and 15 if the 12557A interface is selected. STATUS: Fixed in version 3.3-0. 71. PROBLEM: The 2871 disc diagnostic fails not-ready Status Checks in Step 0. VERSION: 3.2-3 OBSERVATION: Running the 2871 diagnostic causes this failure: H43 UNIT 0 NOT READY CHECK IN S0 E64 STATUS IS 000105 SHOULD BE 000101 H51 CYL 0202 HEAD 00 SECTOR 00 WORD COUNT 3072 UNIT 00 The diagnostic is not expecting the DRIVE BUSY bit (bit 2) to be set when the drive is not ready. CAUSE: The simulator is returning both NOT READY and DRIVE BUSY. This is correct for the 13210A interface but not for the 12557A interface. RESOLUTION: Modify "dpd_svc" (hp2100_dp.c) to set the DRIVE BUSY bit for the "drive not ready" condition only if the 13210A interface is selected. STATUS: Fixed in version 3.3-0. 72. PROBLEM: The 2871 disc diagnostic fails the head-load test in Step 0. VERSION: 3.2-3 OBSERVATION: Running the 2871 diagnostic reports this message to test for head loading: H40 READY UNIT 0 After stopping the simulation, attaching a disc image file, and resuming, the above message continues to repeat. The diagnostic is expecting the command-channel flag to set and drive status to return ATTENTION (bit 15) and FIRST SEEK (bit 14). CAUSE: To prepare the interface to poll for drive attention, the diagnostic issues a Status Check command to the interface. However, because the returned status word is not of interest, the diagnostic does not precede this with an STC,C to the data channel. As the data command flip-flop is not set, the simulator waits in "dpd_svc" in state "FNC_STA", rather than proceeding to state "FNC_STA1", where the poll flag is set. With the poll flag clear, the subsequent file attach does not set the command-channel flag or the associated drive status. Figure 3-7, "Status Check Operation Flow Diagram", on page 3-17 of the "12557A Cartridge Disc Interface Operating and Service Manual" (HP 12557-90001, September 1970) implies that the data-channel command flip-flop must be set before the command-channel control flip-flop is set to initiate the command. However, there is no hardware interlock on the interface to require this. Moreover, the diagnostic clearly expects the drive attention to be detected, so the drive poll must occur, even without the data transfer. The STC DC asserts the "data encode" signal to the disc controller, and the STC CC asserts the "command encode" signal. The latter initiates the Status Check operation, but there is no indication as to what happens if the "data encode" assertion does not precede it. Typical operation would be that "device encode" initiates the operation and "device flag" signals the termination. Without "device encode", "device flag" wouldn't occur. Based on the diagnostic expectation, the implication is that the data-channel flag does not set, but the Status Check command does complete, and drive polling does start. RESOLUTION: Modify "dpd_svc" (hp2100_dp.c) to complete the Status Check command and proceed to polling without setting the data-channel flag if the command flip-flop is not set, and the 12557A interface is selected. STATUS: Fixed in version 3.3-0. 73. PROBLEM: The 2883 diagnostic fails the cyclic-check test in Step 4. VERSION: 3.2-3 OBSERVATION: Running the diagnostic causes this failure: H22 CYCLIC CHECK IN S4 E10 NO COMMAND FLAG H51 CYL 0000 HEAD 00 SECTOR 00 WORD COUNT 0000 UNIT 00 The error is a result of the diagnostic executing a Cyclic Check command with a sector count of 0. Coupled with an initial seek to cylinder 0, head 0, and sector 0, this should check the maximum of 460 sectors before terminating with an End of Cylinder status. CAUSE: The diagnostic is timing out. The "12565A Disc Interface Kit Operating and Service Manual" (HP 12565-90003, August 1973) states in Section 2-45 on page 2-11, "The data rate of the disc drive is 156,000 words per second," giving a transfer time of 6.41 microseconds. At an average of 2 microseconds per instruction, the transfer time should be 3 instructions. It is currently set to 5. RESOLUTION: Change "dqc_xtime" (hp2100_dq.c) from 5 to 3. STATUS: Fixed in version 3.3-0. 74. PROBLEM: The 2883 disc diagnostic fails not-ready Status Checks in Step 0. VERSION: 3.2-3 OBSERVATION: Running the diagnostic causes this failure: H43 UNIT 0 NOT READY CHECK IN S0 E64 STATUS IS 000104 SHOULD BE 000101 H51 CYL 0202 HEAD 19 SECTOR 00 WORD COUNT 0046 UNIT 00 The diagnostic is expecting the ANY ERROR bit (bit 0) and is not expecting the POSITIONER BUSY bit (bit 2) to be set when the drive is not ready. CAUSE: The simulator is returning both NOT READY and POSITIONER BUSY. From the "12565A Disc Interface Kit Operating and Service Manual" (12565-90003, Aug-1973), page 2-12, Table 2-5, "Disc Status Word," we have: Bit 6, NOT READY. A "1" indicates that the selected disc drive unit is not connected to the disc controller, or is not sequenced up with disc spinning and heads loaded, or is in an unsafe condition. Bit 2, POSITIONER BUSY. A "1" indicates the selected drive is busy executing a Position command. Bit 0, ANY ERROR. A "1" indicates that "PL0 unsafe" condition has been detected or that one or more of the remaining 7 bits is a "1". RESOLUTION: Modify "dqd_svc" (hp2100_dq.c) to set the ANY ERROR bit and remove the POSITIONER BUSY bit for the "drive not ready" condition. STATUS: Fixed in version 3.3-0. 75. PROBLEM: Doing an OTA/OTB to the command channel of the 13210A interface fails to clear the control and command flip-flops. VERSION: 3.2-3 OBSERVATION: From the "13210A Disc Drive Interface Kit Operating and Service Manual" (13210-90003, Nov-1974), examination of Figure 5-2, "Disc Interface 1 PCA Schematic Diagram" shows that doing an OTA or OTB to the command channel will clear the control and command flip-flops. Gate U16C feeds both the qualified CLC and IOO signals to the reset side of the command-channel control flip-flop. Therefore, an output operation additionally will act as though a CLC had been done. CAUSE: The action was omitted. RESOLUTION: Modify "dpcio" (hp2100_dp.c) to perform a CLC CC if an OTA or OTB CC occurs, and the 13210A interface is selected. STATUS: Fixed in version 3.3-0. 76. PROBLEM: The 2883 disc diagnostic fails the multi-unit Cyclic Check test in Step 5. VERSION: 3.2-3 OBSERVATION: Running the diagnostic causes this failure: H22 CYCLIC CHECK IN S5 E64 STATUS IS 000000 SHOULD BE 000021 H51 CYL 0001 HEAD 00 SECTOR 00 WORD COUNT 0128 UNIT 00 The diagnostic does a seek to CHS 0/0/0 of unit 0, followed by a seek to CHS 1/0/0 of unit 1, followed by a Cyclic Check of one sector of unit 0. This should cause ADDRESS ERROR, because the second seek sets the controller Record Address Register (RAR) to 1/0/0, the read of unit 0 is done from 0/0/0 (set by the first seek), and the two do not compare. However, the simulator returns NO ERROR. CAUSE: The DQ simulator has separate RARs for each unit. The 12565A controller has a single RAR that is shared between all units. (Note that the DP simulator has the same problem.) RESOLUTION: Modify "hp2100_dq.c" and "hp2100_dp.c" to implement a single, shared RAR and per-unit current positions. STATUS: Fixed in version 3.3-0. 77. PROBLEM: The 2773 (DR) drum diagnostic is unable to determine the number of sectors per track during initialization. VERSION: 3.2-3 OBSERVATION: Running the diagnostic causes this failure: H46 DEVICE PARAMETER DETERMINATION E47 UNABLE TO DETERMINE SECTORS PER TRACK H44 TRACK 0000 SECTOR 00 WORD COUNT 0000 The diagnostic is attempting to determine the number of sectors per track by repeatedly reading the disc status word and examining the current sector field. CAUSE: The disc status word is malformed. The next sector address should appear in bits 14-8, but instead they are ORed with the lower-byte status flags, corrupting the status return value. RESOLUTION: Modify "drcio" (hp2100_dr.c) to shift the next sector address to the upper byte before merging the status flags. STATUS: Fixed in version 3.3-0. 78. PROBLEM: The 2773 (DR) drum diagnostic reports read/write status failures. VERSION: 3.2-3 OBSERVATION: Running the diagnostic causes this failure: H41 WRITE IN ST E35 STATUS IS 0 000 110 010 000 000 SHOULD BE D DDD DDD D10 D00 1D0 H44 TRACK 0000 SECTOR 00 WORD COUNT 0064 The diagnostic is expecting the Writing Enabled Flag bit to be set. CAUSE: The simulation fails to return Writing Enabled status on tracks for which writing is permitted (all tracks). RESOLUTION: Modify "drcio" (hp2100_dr.c) to set the Writing Enabled status when the track control word is output. STATUS: Fixed in version 3.3-0. 79. PROBLEM: The 7900 disc drive (DP) fails to seek check if an invalid sector is supplied. VERSION: 3.2-3 OBSERVATION: From the "13210A Disc Drive Interface Kit Operating and Service Manual" (13210-90003, Nov-1974), section 3-55 states that Seek Check status is set during a Seek command for three conditions: the cylinder addressed is greater than 202, the sector addressed is greater than 23, or a head-positioning operation is still in progress. The simulator fails to implement the second condition. CAUSE: The check is omitted. RESOLUTION: Modify "dpd_svc" (hp2100_dp.c) to set Seek Check status if the sector is out of range and the 13210A interface is selected. STATUS: Fixed in version 3.3-0. 80. PROBLEM: The 2773 (DR) drum diagnostic fails the read test in Step 2. VERSION: 3.2-3 OBSERVATION: Running the diagnostic causes this failure: H42 READ IN S2 E43 DATA WORD 0063 IS 000000 SHOULD BE 046160 H44 TRACK 0000 SECTOR 00 WORD COUNT 0064 Examination of the data file reveals that the failure is occurring on write. The last word of the buffer is not being written to the drum (64 words are to be transferred via DMA, but only 63 are output). CAUSE: The DMA control word is set up to do a CLC on the last word. On all words but the last, DMA dispatches an OTA DC followed by a CLF DC. On the last word, DMA dispatches OTA DC followed by CLC DC,C. This does a "sim_cancel", causing the scheduled transfer of the last word to be aborted. RESOLUTION: Modify "hp2100_dr.c" to add "drc_run" to model the "Run Flip-Flop" from the hardware interface, and call "sim_cancel" in "drdio" only if "drc_run" is zero (i.e., not during a transfer). STATUS: Fixed in version 3.3-0. 81. PROBLEM: If a partial sector is written to the 2773 drum, the remainder of the sector is filled with zeroes instead of replicating the last word written. VERSION: 3.2-3 OBSERVATION: The "12606B Disc Memory Interface Kit Operating and Service Manual" (12606-90012, Mar-1970) and "12610B Drum Memory Interface Kit Operating and Service Manual" (12610-9001, Feb-1970) state in Section 4-91 and 4-92, respectively, that "...The last word will be repeated on the drum until the end of the sector is reached." The simulator replicates zeros instead. CAUSE: The wrong value was used. RESOLUTION: Modify "drc_svc" (hp2100_dr.c) to use "drd_obuf" instead of "0" to fill out the remainder of a sector. STATUS: Fixed in version 3.3-0. 82. PROBLEM: The 2773 (DR) diagnostic fails the sector address check in Step 1. VERSION: 3.2-3 OBSERVATION: Running the diagnostic causes this failure: H21 SECTOR ADDRESS CHECK IN S1 E55 SECTOR 27 MISSING IN STATUS H44 TRACK 0000 SECTOR 00 WORD COUNT 0000 The number of the missing sector is random. The diagnostic checks to ensure that each sector in the track is detected by checking current sector field of the status word. The loop to read status words is 13 instructions long. The simulator computes a current sector number from the current time; this sector changes every 10 instructions. Therefore, in a 13-instruction loop, a sector eventually will be skipped. CAUSE: The timing model of the drum is incorrect. Sectors should increment about every 256 instructions for the 2770/2771 and every 384 instructions for the 2773/2774/2775. RESOLUTION: Modify "dr_set_size" (hp2100_dr.c) to set the per-word transfer time to reflect the model in use, and modify "GET_CURSEC" to determine the sector number properly from the current simulation time. STATUS: Fixed in version 3.3-0. 83. PROBLEM: The 2770 (DR) diagnostic fails the write test in step T. VERSION: 3.2-3 OBSERVATION: Running the diagnostic causes this failure: H41 WRITE IN ST E7 PARITY BIT ERROR H44 TRACK 0000 SECTOR 00 WORD COUNT 0064 The diagnostic is expecting the parity error bit (bit 1) to be set at the conclusion of writes when using the 12606 interface. This is an artifact of the interface design. CAUSE: The status return from the 12606 interface is not modelled properly. RESOLUTION: Modify "drv_svc" (hp2100_dr.c) to return DRS_PER at the conclusion of writes when configured as a 2770/2771 disk. STATUS: Fixed in version 3.3-0. 84. PROBLEM: The 2770 (DR) diagnostic fails the track origin test in step T. VERSION: 3.2-3 OBSERVATION: Running the diagnostic causes this failure: E2 CLF OR SFS FAILED-CHANNEL 27 The diagnostic is expecting an SFS CC instruction to skip when the track origin is detected. Section 3-62 of the "12606B Disc Memory Interface Kit Operating and Service Manual" (12606-90012, March 1970) states, "If the track origin has been passed since performance of the CLF instruction, a program skip occurs." This is not occurring. CAUSE: The track origin detection feature of the 12606 interface is not implemented. RESOLUTION: Modify "drcio" (hp2100_dr.c) to schedule an "origin passed" event on the data channel when CLF is executed and to check to see if that event timer is still running when SFS is executed to determine if the track origin has passed. STATUS: Fixed in version 3.3-0. 85. PROBLEM: The 2770 (DR) diagnostic fails the SCP flip-flop test in step T. VERSION: 3.2-3 OBSERVATION: Running the diagnostic causes this failure: E3 SFC FAILED WITH FLAG CLEAR-CHANNEL 27 The diagnostic is expecting an SFC CC instruction to skip when the SCP (Sector Clock Phase) flip-flop is clear. Section 3-65 of the "12606B Disc Memory Interface Kit Operating and Service Manual" (12606-90012, March 1970) states, "If the SCP flip-flop is clear, a program skip takes place. If the flip-flop is in the set state, no skip occurs." This is not occurring. Also, the SCP flip-flop state is not being reflected in status bit 15 ("Sector Flag"). Finally, the 12610 command-channel interface does not drive the SKF backplane signal, so SFC CC on that interface should never skip. CAUSE: The SCP test feature of the 12606 interface is not implemented. RESOLUTION: Modify "drcio" (hp2100_dr.c) to skip when SFC CC is executed if the simulated head position is more than three words from the end of the current sector and the 12606 interface is selected, not to skip when SFC CC is executed and the 12610 interface is selected, and to reflect the SCP flip-flop state in bit 15 of the status word for both interfaces. STATUS: Fixed in version 3.3-0. 86. PROBLEM: The 2770 (DR) diagnostic fails the read inhibit test in step 1. VERSION: 3.2-3 OBSERVATION: Running the diagnostic causes this failure: H53 READ INHIBIT CHECK IN S1 E35 STATUS IS 0 011 001 110 000 100 SHOULD BE D DDD DDD D11 D00 100 H44 TRACK 0000 SECTOR 00 WORD COUNT 0000 The diagnostic is expecting the read inhibit bit (bit 6) to be set for one sector time after an OTA/OTB instruction specifies a read operation when using the 12606 interface. Section 4-113 of the "12606B Disc Memory Interface Kit Operating and Service Manual" (12606-90012, March 1970) states, "...The RI [Read Inhibit] signal from the disc ensures that at least a full sector elapses between the occurrence of sector coincidence and the setting of the SAC FF." This is not occurring. CAUSE: The read-inhibit feature of the 12606 interface is not implemented. RESOLUTION: Modify "drcio" (hp2100_dr.c) to save the simulation time when an OTA/OTB is executed that specifies a read operation and to compare that to the current simulation time when LIA/LIB is executed and set the Read Inhibit status bit if one sector time has not elapsed. STATUS: Fixed in version 3.3-0. 87. PROBLEM: The 2770 (DR) diagnostic fails the sector address check in step 1. VERSION: 3.2-3 OBSERVATION: Running the diagnostic causes this failure: H66 BEGIN S1 H21 SECTOR ADDRESS CHECK IN S1 E55 SECTOR 90 MISSING IN STATUS H44 TRACK 0000 SECTOR 00 WORD COUNT 0000 The diagnostic checks to ensure that each sector in the track is detected by checking current sector field of the status word. The sector counter is one ahead of the sector currently under the head. For the 90-sector 2770/2771 disk, sector numbers are expected to range from 0 to 90, with the 90 state being provided while the last sector is under the head, and the 0 state being provided transiently between the "Track Origin" signal and the start of the first sector. Note that this problem does not occur on the 32-sector 2773/2774/2775 drum, because the sector counter is only five bits long, so instead of indicating sector 32 while sector 31 is under the head, the counter wraps around to zero while the last sector is under the head, and the 0 state persists a bit longer than the others. CAUSE: The simulated sector counter is calculated incorrectly. RESOLUTION: Replace the previous "GET_CURSEC" macro with a new "dr_seccntr" function (hp2100_dr.c) to model the sector counter accurately. STATUS: Fixed in version 3.3-0. 88. ENHANCEMENT: Add a TRACKPROT=n modifier to specify the number of protected tracks and PROTECTED and UNPROTECTED modifiers to change the protection state of the designated tracks to the 277x (DR) simulator. VERSION: 3.2-3 OBSERVATION: The 12606/12610 interfaces provide a track protection switch on the data channel card and specification of the number of tracks to be protected. The simulation should provide this feature. RESOLUTION: Modify "drc_mod" (hp2100_dr.c) to add track protection features to the command channel (Bob says that this is a "controller" feature). STATUS: Fixed in version 3.3-0. 89. PROBLEM: The 2767 line printer should not print non-printing characters. VERSION: 3.2-3 OBSERVATION: The 2767 printer repertoire is the 64 character ASCII subset from codes 32 to 95 (SPACE to "_"). Section 4-6 of the "2767A Line Printer Operating and Service Manual" (HP 02767-90002) says, in part, "On entering the print cycle, the characters in memory are checked for nonprintable characters and scanned and compared against the output of the character counter. Nonprintable characters are immediately erased from memory." This does not occur with the LPS simulator; all characters are passed through to the line printer image file. CAUSE: There is no check for non-printing characters. RESOLUTION: Modify "lps_svc" (hp2100_lps.c) to replace non-printing characters with blanks (equivalent to the hardware not firing the associated print hammer). STATUS: Fixed in version 3.3-0. 90. PROBLEM: The 2767 line printer should overprint the current line if sent more than 80 characters. VERSION: 3.2-3 OBSERVATION: The 2767 printer drum is 80 columns wide. Section 4-4 of the "2767A Line Printer Operating and Service Manual" (HP 02767-90002) says, in part, "The 80 print positions are divided into four zones, each having 20 consecutive print positions," and Section 4-5 says, in part, "Up to 20 characters can be received and stored in this manner, and the print cycle is started on receipt of either the 20th character or a format control character." Section 4-8 says, "If the print cycle is originally initiated on receipt of the 20th printable character, then signal ZCAV is generated upon completion of printing. The zone control register is incremented by 1 and DEMAND LINE enabled. The next printable character received will be printed in the leftmost position of zone 2." The implication is that the 81st printable character sent will be printed in zone 1, column 1. CAUSE: There is no check for the maximum character count per line. RESOLUTION: Modify "lps_svc" (hp2100_lps.c) to output a CR after every 80 characters sent without an intervening LF or FF to simulate overprinting. STATUS: Fixed in version 3.3-0. 91. PROBLEM: The DO command does not report errors to the log file. VERSION: 3.3-0 OBSERVATION: Commands contained in a DO file that cause errors do not report the errors to the console log file. They are reported to the console. For example: sim> set console log=wibble.log Logging to file "wibble.log" sim> wibble Unknown command sim> do wibble.sim (contains "wibble" as a command) Unknown command sim> quit Goodbye Log file closed But wibble.log contains: Logging to file "wibble.log" sim> wibble Unknown command sim> do wibble.sim sim> quit Goodbye Log file closed Note that the second "Unknown command" message is missing from the log file. CAUSE: "do_cmd" reports errors "stdout" only. RESOLUTION: Modify "do_cmd" to report errors to "sim_log" if it is not null. STATUS: Fixed in version 3.3-1. 92. ENHANCEMENT: The T register now reflects changes to the M register made during simulation stop. VERSION: 3.3-0 OBSERVATION: On a real HP 21xx, the T (memory contents) register is updated automatically after changing the M (memory address) register while the CPU is halted. Under simulation during a simulation stop, this does not occur. Providing it would very useful, though, as it would allow the ASSERT command to test the contents of memory locations. In particular, it would allow the diagnostics command file to test the Diagnostic Serial Number of the loaded program to ensure that the expected value is present. RESOLUTION: Modify "hp2100_cpu.c" to add a "sim_vm_post" routine that updates the T register. STATUS: Fixed in version 3.3-1. 93. PROBLEM: The 2767 and 2607 (LPS and LPT) simulators do not respond properly to output operations initiated when the printers are powered off, offline, or out of paper. VERSION: 3.3-0 OBSERVATION: On the hardware, issuing an STC to start a print operation with the power off or with the printer offline or out of paper sets the control and command flip-flops, sending the "device command" signal to the printer. The operation then "hangs" until the error is corrected, at which point the "device flag" signal is returned to the card. This causes the flag buffer and flag flip-flops to set, completing the operation. On the simulator, the operation hangs forever if the paper is out, or completes normally if the printer is powered off or offline. Both actions are wrong. CAUSE: There is no provision for detecting the correction of the foregoing situations and rescheduling the I/O event. RESOLUTION: Modify "lpt_svc" and "lps_svc" to stop execution if STOP_IOE is set and the printer is powered off, offline, or out of paper. Add "lpt_restart" and "lps_restart" routines to restart a hung I/O operation when the printer is powered on, set online, or attached. Modify "hp2100_defs.h" and "sim_stop_messages" (hp2100_sys.c) to add support for STOP_OFFLINE and STOP_PWROFF simulator stop codes. STATUS: Fixed in version 3.3-1. 94. PROBLEM: The column count on the 2767 printer doesn't increment when blanks are substituted for non-printing characters. VERSION: 3.3-0 OBSERVATION: Control characters sent to the printer are replaced by blanks before being output to the file. However, the column counter does not increment for the replaced characters. CAUSE: Logic error in "lpsio". RESOLUTION: Modify "lpsio" (hp2100_lps.c) to count replaced non-printing characters in the column count. STATUS: Fixed in version 3.3-1. 95. PROBLEM: Attempting to reboot RTE-IVB after a successful boot fails with HLT 02. VERSION: 3.3-0 OBSERVATION: Starting SIMH and booting RTE-IVB works as expected. However, if the simulation is halted, and an attempt is made to boot RTE a second time, the boot fails. Examination of memory shows that the bootstrap extension is being loaded at the wrong address. The 7900 boot loader outputs DMA control word 2 to select code 2, then sets the control flip-flop on select code 2, then outputs DMA control word 3. This sequence depends on the select code 2 control flip-flop (CTL2FF) being clear before the loader executes. Examination shows that the BOOT command is not clearing this flip-flop, so both outputs write to control word 3, leaving control word 2 (the target address) set to 0. CAUSE: The "dma0_reset" function is not clearing CTL2FF (on the hardware, the front panel PRESET button clears CTL2FF). RESOLUTION: Modify "dma0_reset" and "dma1_reset" (hp2100_cpu.c) to clear the control flip-flops on select codes 2 and 3, respectively, as well as clearing the control flip-flops on select codes 6 and 7. STATUS: Fixed in version 3.3-1. 96. PROBLEM: The control flip-flops on select codes 2 and 3 (the DMA initialization channels) are not visible. VERSION: 3.3-0 OBSERVATION: Displaying the DMA channels shows the values of the control (and flag, etc.) flip-flops for select codes 6 and 7. The control flip-flops of channels 2 and 3 are not visible and may not be altered via the simulator user interface. CAUSE: CTL(2) and CTL(3) have no register assignments in the DMA devices. RESOLUTION: Modify "dma0_dev" and "dma1_dev" (hp2100_cpu.c) to add registers for the control flip-flops on select codes 2 and 3. STATUS: Fixed in version 3.3-1. 97. PROBLEM: RESET erroneously clears the DMA control words 1-3. VERSION: 3.3-0 OBSERVATION: Attempting to slow-boot RTE from a 7905 disc fails with a "Data Overrun" error from the disc controller. Examination shows that the disc read isn't performed because DMA Control Word 1 (select code) is zero. CAUSE: The RESET (preset) that is done as part of the slow-boot process is calling "dma0_reset", which is clearing the three DMA control words. The 12897B schematic shows that CRS does not alter the control registers. RESOLUTION: Modify "dma0_reset" and "dma1_reset" (hp2100_cpu.c) to clear the control words only on power-on reset. STATUS: Fixed in version 3.3-1. 98. PROBLEM: DMA transfers to addresses 0/1 erroneously overwrite the A/B register contents. VERSION: 3.3-0 OBSERVATION: Attempting to boot RTE from a 7905 disc fails with a "Indirect address loop" simulation halt. Examination shows that the B register, which is being used as an address pointer, is corrupted by a DMA transfer from the disc to address 00001. The disc read succeeds but overwrites the A and B register contents in the process. Section I, Paragraph 4-17, "Store Field", of the "HP 1000 M/E/F-Series Computers Engineering and Reference Documentation" (HP 92851-90001) says: "The A and B addressable flip-slops (ABFF) [38A] can be clocked at the end of every microcycle. Addresses 0 and 1 are detected on the M-bus and the flip-flops are set accordingly. When DCPC uses the M-bus the ABFFST signal is suppressed." CAUSE: The "ReadIO" and "WriteIO" routines, used by DMA, are not separating accesses to locations 0/1 from accesses to A/B. RESOLUTION: Modify hp2100_cpu.c to separate the A/B registers from memory locations 0/1 and to map them equivalently, except during DMA accesses. STATUS: Fixed in version 3.3-1. 99. ENHANCEMENT: Add SET CPU modifiers for 21MX-M and 21MX-E variants. VERSION: 3.3-0 OBSERVATION: The RTE-6/VM startup routine ($STRT) determines whether it is executing on a M-series or E-series by executing the TIMER instruction and seeing if the B register is incremented. If it is, then OS microcode instructions are used, but these are not supported by SIMH, and an "Unimplemented instruction" simulation stop occurs. RTE-6/VM will boot if the CPU is detected as an M-series. RESOLUTION: Modify hp2100_cpu.c to add SET CPU 21MX-M and SET CPU 21MX-E modifiers, and enable the TIMER instruction only if the E-series variant is selected. STATUS: Fixed in version 3.3-1. 100. PROBLEM: The JPY instruction does not work. VERSION: 3.3-0 OBSERVATION: JPY is supposed to add the contents of P+1 to the Y register and use the result as the jump target address. Actually, JPY is adding the contents of P+2. CAUSE: The "e_inst" array that indicates how to process operands for the extended instructions has the wrong value for the JPY entry. RESOLUTION: Modify "e_inst" (hp2100_cpu.c) to replace the erroneous "X_MR" value with the correct "X_NO" value. STATUS: Fixed in version 3.3-1. 101. PROBLEM: The JRS instruction does not perform a memory protect check on the jump target. VERSION: 3.3-1 OBSERVATION: A JRS to a location below the MP fence is allowed, presuming that DMS conditions are satisfied. CAUSE: The JRS simulation routine is missing a memory protect check on the target address. RESOLUTION: Add a call to "mp_dms_jmp" in the JRS simulator routine (hp2100_cpu1.c) to validate the target address. STATUS: Fixed in version 3.3-2. 102. PROBLEM: The EXECUTE instruction was never implemented on the 21MX-E. VERSION: 3.3-1 OBSERVATION: Section 5.7, "Special Instructions," of the "HP 1000 M/E/F-Series Computers Engineering and Reference Documentation" (HP 92851-90001) documents three "unsupported" instructions added to the 21MX-E series CPU: DIAG, TIMER, and EXECUTE. Examination of the microcode reveals that the EXECUTE instruction (100120) was never implemented; the microcode executes a NOP for this instruction code. CAUSE: Improper documentation. RESOLUTION: Alter "cpu_eau" (hp2100_cpu1.c) to handle EXECUTE as an undefined instruction. STATUS: Fixed in version 3.3-2. 103. PROBLEM: Rounding negative unpacked floating-point numbers may yield unnormalized results. VERSION: 3.3-1 OBSERVATION: The floating-point pack routine first rounds by adding +/- 1/2 LSB to the mantissa. If rounding causes a carry, the resulting value is unnormalized. An overflow check is made on positive numbers (i.e., "011..." becoming "100..."), but no check for carry into the MSB-1 is made for negative numbers ("101..." becoming "110..."). CAUSE: The case was omitted. RESOLUTION: Modify "StoreFP" (hp2100_fp.c) to add a normalization check for negative numbers. STATUS: Fixed in version 3.3-2. 104. ENHANCEMENT: Add a command to abort command file execution if a specified simulator condition is not met. VERSION: 3.3-1 OBSERVATION: Command files need a means of reacting to unexpected program behavior. Currently, if a program deviates from expected behavior, e.g., if a diagnostic fails, the command file will become unsynchronized with the program, leading to nonsensical operation. To provide an escape mechanism for this situation, a command that tests assertions of the simulator state and aborts a running command file if the assertion fails is needed. The syntax is: ASSERT {} {} If is not specified, CPU is assumed. is a register (scalar or subscripted) belonging to the indicated device. The and optional are the same as those provided by the "examine" and "deposit" commands. The s are expressed in the radix specified for , not in the radix for the device. If the and are specified, the target register value is first altered as indicated. The result is then compared to the via the . If the result is false, an "Assertion failed" message is printed, and any running command file is aborted. Otherwise, the command has no effect. RESOLUTION: Modify "scp.c" to add "assert_cmd" and associated command table entries. STATUS: Fixed in version 3.3-2. 105. ENHANCEMENT: The option flags for the various CPU models and options were reorganized. VERSION: 3.3-2 OBSERVATION: To simplify handling of optional instruction sets, the flags describing the configuration of the simulated system are reorganized into CPU type, model, and options. This allows simple testing of a class of machines (e.g., all 21MX models) or installed options (e.g., IOP microcode on any CPU), without having to test each possible machine/option combination. RESOLUTION: Modify option flags in "hp2100_cpu.c" and "hp2100_cpu.h" to reflect logical hardware grouping and change "cpu_set_opt" accordingly. STATUS: Fixed in version 3.4-0. 106. ENHANCEMENT: Modularize the handling of optional instruction sets to allow for future microcode option simulations. VERSION: 3.3-2 OBSERVATION: The current CPU simulation decodes all UIG instructions inline, so that microcode options that share instruction codes (e.g., the 2100 IOP and the 2100 FP/FFP) must have tests for CPU type at each code point. Also, tabular instruction operand processing is complicated when instructions with differing requirements share code points. RESOLUTION: Split optional CPU instruction (EAU/UIG) processing into its own source file (hp2100_cpu1.c), represent each option as a function that determines CPU applicability and decodes its own instructions, and restructure operand processing so that it is per-option-module, rather than global for all options. STATUS: Fixed in version 3.4-0. 107. ENHANCEMENT: Add the Fast FORTRAN Processor (FFP) microcode option. VERSION: 3.3-2 OBSERVATION: The Pascal/1000 compiler will not load in an RTE system with a three-page driver partition if the FFP option is not present (required to reduce code size to fit the logical address space). Also, RTE systems generated with the FFP option will not run unless the option is present. RESOLUTION: Add a simulation of the FFP to "hp2100_cpu1.c", add a new extended-precision floating point module "hp2100_fp1.c", and add FFP helpers to "hp2100_fp.c" for single-precision operations. STATUS: Fixed in version 3.4-0. 108. ENHANCEMENT: Separate the online/offline and attach/detach functions for the magnetic tape and disc drive simulations. VERSION: 3.3-2 OBSERVATION: Currently, devices that have loadable media and an offline mode simulate both via attach and detach, i.e., attached implies online, and detached implies offline. It is desirable to separate the two, so that performing a magnetic tape "rewind/offline" command or disc "head unload" action does not detach the image file. The RTE tape backup programs set the tape units offline when they are exited, and it is awkward to have to respecify the image filename in an attach command in order to put the unit back online for a succeeding operation (the real tape drive merely requires pressing the "ONLINE" button). Also, being able to "down" untargeted disc drives when performing certain read/write operations, e.g., new system installation, is a useful safety measure (simply toggling the "UNLOAD" switch accomplishes this on a real disc drive). RESOLUTION: Modify "hp2100_ms.c" to add SET OFFLINE/ONLINE and "hp2100_dp.c", "hp2100_dq.c", and "hp2100_ds.c" to add SET UNLOADED/LOADED commands, as well as to decouple setting a device offline from detaching the associated image file. STATUS: Fixed in version 3.4-0. 109. ENHANCEMENT: Allow the DO command to nest to some finite level. VERSION: 3.3-2 OBSERVATION: Allowing a limited depth of nested DO invocations is useful for modularizing simulator command files. The current prohibition is not necessary, as "do_cmd" is reentrant. RESOLUTION: Modify "do_cmd" (scp.c) to allow DO command nesting, provide a recursion counter to disallow infinite nesting, and alter the text of the SCPE_NEST error to reflect allowed nesting. STATUS: Fixed in version 3.4-0. 110. PROBLEM: SET DEBUG=n1,n2,... doesn't work. VERSION: 3.3-2 OBSERVATION: For devices with multiple debug flags, trying to set more than one with the above command fails with "Non-existent parameter." Setting the flags one at a time with separate commands works as expected. CAUSE: The command parser breaks SET commands at commas, so "n2" is interpreted as the next top-level SET command, rather than as another debug flag. RESOLUTION: Alter the debug flag separator from "," to ";". STATUS: Fixed in version 3.4-0. 111. ENHANCEMENT: Allow SET DEBUG to mean "set all debug flags." VERSION: 3.3-2 OBSERVATION: Currently, if a device has multiple debug flags, SET DEBUG is rejected. To set all flags, they must be specified individually. RESOLUTION: Alter "set_dev_debug" (scp.c) to set all debug flags if none are specified in the SET DEBUG command. STATUS: Fixed in version 3.4-0. 112. ENHANCEMENT: Improve reporting of conflicting I/O assignments. VERSION: 3.5-1 OBSERVATION: The current "dev_conflict" (hp2100_cpu.c) routine has three behaviors that might be improved: 1. It reports only the first device conflict encountered. 2. It reports the name and select code of only one of the two conflicting devices. 3. It reports the select code in decimal. Here is a console log demonstrating these behaviors: sim> set ds dev=12 sim> set muxm dev=12 sim> set lpt dev=13 sim> run DS device number conflict, devno = 10 Simulation stopped, P: 00000 (NOP) We altered the default configuration to place PTP, DS, and MUXM at select code 12 (octal), and CLK and LPT at select code 13 (octal). Note that the above reported select code (10) is decimal. RESOLUTION: Modify "dev_conflict" behavior as follows: 1. Report all device conflicts in ascending select code order. 2. Report device names for all conflicting devices. 3. Report conflicting select codes in octal. Here is the same console log demonstrating the enhanced behaviors: sim> set ds dev=12 sim> set muxm dev=12 sim> set lpt dev=13 sim> run Select code 12 conflict: PTP and DS and MUXM Select code 13 conflict: CLK and LPT Simulation stopped, P: 00000 (NOP) STATUS: Fixed in version 3.5-2. 113. PROBLEM: "SET CONSOLE DEBUG" with no parameter crashes the simulator. VERSION: 3.6-0 OBSERVATION: Entering "SET CONSOLE DEBUG" without the "=" causes the simulator to crash with an access error. CAUSE: Null pointer dereferenced in "sim_set_debon". RESOLUTION: Return SCPE_2FARG if "cptr" is null (no parameter supplied) or points to a null character (empty parameter supplied). STATUS: Fixed in version 3.6-1. 114. PROBLEM: Nested command files do not abort on assertion failure. VERSION: 3.6-0 OBSERVATION: While a failed assertion will abort a running command file, it will not abort if the assertion is in a nested command file invocation. CAUSE: "do_cmd" is always passing back SCPE_OK, regardless of whether an invoked command returns an error status. This is apparently an attempt to avoid duplicate error messages if the last command in a command file fails (the error is printed within "do_cmd" and then again in the main command loop). RESOLUTION: Modify "do_cmd" (scp.c) to return all command error codes and to return SCPE_OK on command file EOF. STATUS: Fixed in version 3.7-0. 115. ENHANCEMENT: Provide an -E switch to DO to abort a command file on any error. VERSION: 3.6-0 OBSERVATION: Current DO processing ignores command errors. That is, if a command returns an error, the error message is printed, but processing continues with the next command in the file. This is inherently risky, as command files must be written with the expectation that every command will succeed (because there is no error trapping or conditional execution). RESOLUTION: Add a new -E switch to cause command file execution to be aborted at the first error encountered. Note that SCPE_STEP is not considered an error, and simulator-specific errors, e.g., "infinite indirect loop," does not cause an error abort (simulator limitation). STATUS: Fixed in version 3.7-0. 116. ENHANCEMENT: Two gcc compiler warnings are corrected. VERSION: 3.6-0 OBSERVATION: Running gcc in strict ISO C99 standard mode (-std=c99 -Wall -pedantic) reveals two warnings: HP2100/hp2100_mux.c:160: warning: missing braces around initializer HP2100/hp2100_mux.c:160: warning: (near initialization for `mux_ldsc[0]') and: sim_ether.c: In function `eth_mac_scan': sim_ether.c:271: warning: short unsigned int format, short int arg (arg 3) CAUSE: The first warning is due to an incompletely specified declaration. The variable is an array of structures, so the (partial) initializer should be "{ { 0 } }" but is actually "{ 0 }". The second warning is due to a mismatch between a "sscanf" format and the corresponding parameter type. The format, "%hx", requires a short unsigned int parameter, but the parameter is declared as short int. RESOLUTION: The code causing the warnings is corrected. STATUS: Fixed in version 3.7-0. 117. PROBLEM: The 7970 magnetic tape simulator defaults tape capacity to a 300-foot reel instead of to an unlimited-size reel. VERSION: 3.6-0 OBSERVATION: In the absence of an explicit size command, the 7970 tape drive reel size is intended to default to an unlimited size, wherein EOT never occurs. In fact, EOT occurs after 300 feet. CAUSE: The logic was inadvertently broken on February 16, 2006 when the "revision for new EOT test" was made. RESOLUTION: Remove the "capac" assignments in "mscio" and "msc_svc" and add an assignment to "ms_set_reelsize" (hp2100_ms.c), allowing the default capacity to remain as 0 (a zero capacity causes "sim_tape_eot" to return FALSE). STATUS: Fixed in version 3.6-1. 118. ENHANCEMENT: Add CAPACITY to 7970 simulator as an alternate to REEL. VERSION: 3.6-0 OBSERVATION: Other magnetic tape simulators allow setting a CAPACITY to indicate the number of megabytes to read or write before returning EOT. The 7970 simulator REEL size predated CAPACITY, but it's desirable for commonality if both were allowed. RESOLUTION: Alter hp2100_ms.c to support SET CAPACITY in addition to SET REEL, and enhance SHOW to display the capacity in MB or feet as appropriate. STATUS: Fixed in version 3.6-1. 119. PROBLEM: The RTE off-line magnetic tape restore program (DSKUP) hangs on the first write to the 79xx/13037 disc. VERSION: 3.6-1 OBSERVATION: The RTE offline restore program hangs when it tries to write to the 79xx disc. The program is looping in a routine that obtains drive status by sending the REQUEST STATUS command to the drive. CAUSE: The program expects that the REQUEST STATUS operation will clear the status. If this operation returns DRIVE ATTENTION, the program loops until it does not. However, the simulator does not the clear status value, so after the seek completes, DRIVE ATTENTION is returned forever. Page 10-10 of the 13037 Disc Controller Technical Information Package (HP 13037-90902, August 1980) contains this description of the REQUEST STATUS command: "After receipt of this command, the controller returns two status words to the interface. [...] The controller then clears Status-1 and waits for a command from the same interface or a timeout to occur." The controller firmware routine STATS handles the status request. It calls routine CLRST. The comment for the CLRST routine is, "Subroutine CLRST clears status for all commands but status request," but examination of the routine shows that it is unconditional. RESOLUTION: Modify the "DSC_RSTA" case in "ds_docmd" (hp2100_ds.c) to clear status-1 after returning it. STATUS: Fixed in version 3.7-0. 120. ENHANCEMENT: Separate TTY mode settings so that keyboard and display may be set independently. VERSION: 3.6-1 OBSERVATION: HP terminals had a CAPS LOCK setting that allowed upper-case input with mixed-case output. The current TTY simulator allows several I/O options, but the keyboard and display settings are locked together. RESOLUTION: Modified "tty_set_opt" (hp2100_stddev.c) to allow keyboard (TTY0) and display (TTY1) to be set independently. STATUS: Fixed in version 3.7-0. 121. ENHANCEMENT: Add the HP 93585A double integer instruction set firmware option. VERSION: 3.6-1 OBSERVATION: Later versions of RTE-6/VM were not supported on the 21MX M-Series due to logical address space limitations. The RTE-6 OS and VMA firmware options were not available for the M-Series, and some vital system programs exceeded the available address space and failed to load when the software equivalents were used. To run these programs, either the OS/VMA or double integer firmware support must be added to reduce the address space required. RESOLUTION: Add an implementation of the double integer instruction set to "hp2100_cpu1.c" and add "DBI/NODBI" options to "cpu_mod[]" (hp2100_cpu.c) to enable and disable the instructions. Note that the 93585A product worked only on the E-Series, but it is available under simulation on the M-Series as well. STATUS: Fixed in version 3.7-0. 122. ENHANCEMENT: Add "1000-M" and "1000-E" CPU options as synonyms for "21MX-M" and "21MX-E". VERSION: 3.6-1 OBSERVATION: The 21MX computer series was renamed the 1000 series with the introduction of the F-Series in 1978. The 21MX/21MX-M became the 1000 M-Series, and the 21XE/21MX-E became the 1000 E-Series. There is some internal HP documentation that refers to the F-Series as the 21MX-F, but the machine was introduced as the 1000 F-Series, and the other machines were renamed at the same time. RESOLUTION: Modify "cpu_mod[]" (hp2100_cpu.c) to add "1000-M" and "1000-E" options. STATUS: Fixed in version 3.7-0. 123. ENHANCEMENT: The DMA device is automatically assigned the logical name "DCPC" when SET CPU 21MX is done. VERSION: 3.6-1 OBSERVATION: The term "DMA" is used with the 2116 and 2100 machines. For the 21MX, the equivalent card is termed the "Dual Channel Port Controller." "DCPC" is used exclusively in the HP 21MX literature, and users are used to working with the "DCPC" name. RESOLUTION: Modify "cpu_set_opt" (hp2100_cpu.c) to assign and deassign logical names in response to SET CPU 2116/2100/21MX commands, and add "assign_device" and "deassign_device" (scp.h) to the list of global routines. Note that this enhancement does not proscribe users from using the DMA device name with 21MX simulations. STATUS: Fixed in version 3.7-0. 124. PROBLEM: Running FC under RTE aborts the simulation with an "Invalid magtape record length" error. VERSION: 3.6-1 OBSERVATION: Attempting to run the RTE "FC" ("File Copy") tape archive program to generate a tape image fails. The Read command is failing with tape library error 4, "Invalid record length." Enabling the debug mode of the 7970 tape drive simulator reveals that FC is attempting to leave space at the beginning of the tape for the archive directory by issuing a series of GAP commands. After the files are stored, the tape is rewound, and the directory is written, intending to overwrite the erased area. CAUSE: FC writes items to the tape in this order: header, marker, comment, directory, data file(s), and two EOFs. FC is issuing GAP commands to leave space at the start of the tape for the tape header, which must be written after the tape is complete, because the header indicates the number of data files that fit on the tape. The SIMH mag tape library does not implement the "erase gap" feature, and the 7970 simulator treats GAP as a NOP, so no space is reserved at the start of the tape image. When FC rewinds and writes the directory, it overwrites the existing records, resulting in a corrupt tape image. RESOLUTION: Implement an "erase gap" feature in the SIMH tape library by defining GAP metadata markers, adding a "sim_tape_wrgap" command and enhancing the "sim_tape_rdlntf" and "sim_tape_rdlntr" internal functions to skip over GAP metadata markers (sim_tape.c). Alter the 7970 simulator (hp2100_ms.c) to use it. Also, update the "mtdump" utility to report erase gaps in tape images. Note: All HP 7970 mag tape drivers (SIO, BCS, DOS, RTE) employ the GFM (erase gap and write file mark) command to write an EOF to tape. Also, the tape diagnostic tests that an initial gap precedes the first data record or EOF written at BOT (a function of the interface card). Consequently, generated tape images contain substantial amounts of GAP metadata. In almost all cases, they are unnecessary. Therefore, these gaps are written only if the REALTIME option is selected. Note that this does not affect the GAP command itself, which always writes gap metadata to tape images. STATUS: Fixed in version 3.7-0. 125. ENHANCEMENT: Improve error reporting from the 7970 tape simulator. VERSION: 3.6-1 OBSERVATION: The new "erase gap" support is only implemented for SIMH-format tape images. Attempting to write an erase gap with other formats selected correctly returns MTSE_FMT from the library. However, the 7970 simulator maps that error (and the MTSE_UNATT error) to SCPE_IERR. The resulting "Internal error" message does not help the user identify the source of the problem. RESOLUTION: Modify "ms_map_err" (hp2100_ms.c) to return SCPE_FMT and SCPE_UNATT for the tape library errors MTSE_FMT and MTSE_UNATT, respectively. STATUS: Fixed in version 3.7-0. 126. PROBLEM: "calc_dma" and "calc_int" are being called needlessly for most UIG 0 and UIG 1 instructions. VERSION: 3.6-1 OBSERVATION: The "calc_dma" and "calc_int" routines must be called after any routine that might change the I/O priority chain or set SRQ. This would be after any I/O Group instruction or card I/O action (i.e., card service routine called). In "hp2100_cpu.c", the dispatch points for "cpu_uig_0" and "cpu_uig_1" call these routines unconditionally, but they're only needed if an IOP "PRFIO" or "PRFEI" instruction is executed (these execute standard I/O instructions as part of their actions). CAUSE: The current code was a temporary expediency when the IOP instructions were moved into a separate source module. RESOLUTION: Define a new "NOTE_IOG" status return (hp2100_defs.h) to request recalculation of I/O interrupts after instruction execution completes, and rename "STOP_INDINT" to "NOTE_INDINT" to reflect that it notifies the main instruction execution loop of an interruptibility condition, rather than stopping the simulation. Alter "iogrp" and "resolve" (hp2100_cpu.c) respectively, to use these notification codes. STATUS: Fixed in version 3.7-0. 127. ENHANCEMENT: Use the tape simulator library routine "sim_tape_bot" to determine BOT status dynamically for the 7970 simulator. VERSION: 3.6-1. OBSERVATION: The 7970 simulator maintains its own BOT status by tracking rewinds and motion commands. It would be simpler to use the routine provided by the tape simulation library for this, rather than tracking each tape movement. Note that prior to the addition of erase gap support, this would not work. The diagnostic moved the tape off of BOT by using the GAP command, but this was a NOP for the tape simulation library, and the tape remained at BOT, leading to diagnostic failures. RESOLUTION: Modify "hp2100_ms.c" to use "sim_tape_bot" instead of tracking BOT internally. STATUS: Fixed in version 3.7-0. 128. PROBLEM: Sending a "controller clear" command to the 7970 magnetic tape simulator may cause an unintended write. VERSION: 3.6-1 OBSERVATION: Clearing a write-in-progress properly writes any accumulated partial record. Sending a second clear may write the record again. CAUSE: Receipt of a CLR command initiates a check for a write-in-progress among active units. If the data buffer pointer is non-zero, then partial data has been accumulated, and this is written to the tape image. The data buffer pointer is normally zeroed when a write record command is received and the command time delay has transpired. If a second write command is sent, and another CLR is done before the command time has transpired (and therefore before any data has been received from the CPU), then the previous partial record will be written again. This happens because the buffer pointer was not cleared and so implies the presence of another partial buffer of data. RESOLUTION: Modify "mscio" (hp2100_ms.c) to clear the buffer pointer after a partial record is written. STATUS: Fixed in version 3.7-0. 129. ENHANCEMENT: Improve debugging information from the 7970 simulator. VERSION: 3.6-1 OBSERVATION: Debugging problems such as the "controller clear" bug would be easier if the debug logging decoded the tape commands and included all controller actions. Currently, tape commands are reported in octal, and only some actions are reported. RESOLUTION: Modify "hp2100_ms.c" to add additional debug logging and debug flags to select subsets of the available information. STATUS: Fixed in version 3.7-0. 130. ENHANCEMENT: Partition the various microcode options in "hp2100_cpu1.c" into separate modules for easier maintenance. VERSION: 3.6-1 OBSERVATION: With the addition of the double integer instructions and potential addition of the RTE-6/VM OS and VMA instructions, the microcode option source module, "hp2100_cpu1.c", is becoming unwieldy. It is currently the largest HP source module -- about 50% larger than the rest of the CPU implementation. RESOLUTION: Move the microcode options into separate source files, grouped by function, and restrict "hp2100_cpu1.c" to contain dispatching and common routines. STATUS: Fixed in version 3.7-0. 131. PROBLEM: Errors in nested command files give no indication where the error occurred. VERSION: 3.6-1 OBSERVATION: Unless the -V switch is specified, errors in command files report the error message but not the offending command. With the advent of nested command files, the problem becomes more acute, as there is no indication in which of perhaps several nested command files the offending command is located, nor even which command is causing the error. And because -V is not transitive, each DO command appearing in each command file must be edited to add the -V switch if the error is to be located. CAUSE: The implication of errors in nested command files was overlooked when nesting was enabled. RESOLUTION: Modify "do_cmd" (scp.c) to echo commands causing errors, regardless of the -V switch, unless -Q (quiet) is supplied when starting SIMH. Also, report the name of the file containing an offending command. Note: because commands returning error status are now displayed, error message processing for the ASSERT command is simplified. In particular, the extra code that merged the assertion into the error message is no longer required. STATUS: Fixed in version 3.7-0. 132. PROBLEM: The simulator stops with an "Indirect address loop" error when running the HP 1000-F FFP diagnostic .GOTO test. VERSION: 3.6-1 OBSERVATION: According to the HP 2100 documentation, the simulator will stop if "more than INDMAX indirect references are detected during memory reference address decoding." INDMAX defaults to 16. However, attempting a reference with exactly 16 indirects stops the simulator with an "Indirect address loop" error. CAUSE: The indirect address resolution loop in the "resolve" function executes a maximum of INDMAX times. However, the decision to report an error considers only whether the loop counter reached INDMAX and not whether the indirect chain was resolved. Therefore, resolution on the last available pass through the loop is still reported as an error. RESOLUTION: Modify "resolve" (hp2100_cpu.c) to report an error if the indirect chain is not resolved after exiting the loop. STATUS: Fixed in version 3.7-0. 133. ENHANCEMENT: Add support for the HP 1000 F-Series CPU model. VERSION: 3.6-1 OBSERVATION: The Fast FORTRAN Processor option adds simulation support for three-word floating-point operations. Generalizing these to support two, three, and four-word operations would allow simulation of the F-Series floating-point processor. RESOLUTION: Rework the FFP arithmetic simulations (hp2100_cpu3.c) into general operations on multiple-precision operands. Add support for the F-Series FPP instructions. Add support for the F-Series Scientific Instruction Set (SIS) firmware. Add "1000-F" as a CPU option (hp2100_cpu.c). Note: rather than have two floating-point simulations (hp2100_fp.c and hp2100_fp1.c) that provide the two-word single-precision floating-point instructions, they are alternately conditionally compiled, depending on whether 64-bit integers are supported. As the FPP depends on this support, compiling with it enables the FPP and therefore the F-Series option, and "hp2100_fp1.c" handles the single-precision instructions for the other CPU models. If 64-bit support is not available, then "hp2100_fp.c" handles the single-precision instructions, and the F-Series is not available. STATUS: Fixed in version 3.7-0. 134. ENHANCEMENT: Add support for the 2114 and 2115 CPU models. VERSION: 3.6-1 OBSERVATION: The 2114 and 2115 are reduced-feature versions of the 2116 computer. One could restrict the 2116 environment to give an approximation of the 2114 and 2115. However, these units used a unique DMA card that behaved somewhat differently than that used in the 2100 and 1000 (the 12607 card for the 2114 supported only one DMA channel, for example). So it would be desirable to support the 2114 and 2115 directly and therefore more faithfully. RESOLUTION: Add "2114" and "2115" CPU model options (hp2100_cpu.c). STATUS: Fixed in version 3.7-0. 135. ENHANCEMENT: Add support for 12K and 24K memory sizes. VERSION: 3.6-1 OBSERVATION: The 2114 and 2115 CPUs supported up to 16K of memory in 4K increments. For accurate simulation, finer granularity than the current 4K/8K/16K/32K choices is needed. RESOLUTION: Alter the table of memory size (hp2100_cpu.c) to add 12K and 24K options. STATUS: Fixed in version 3.7-0. 136. PROBLEM: The DMS self-test instruction (10x701) should be a NOP on 1000-M machines. VERSION: 3.6-1 OBSERVATION: The DMS self-test instruction should complement the A or B register only on the 1000-E and F. On the M, it should be a NOP. In fact, it complements on the M as well. CAUSE: Oversight. RESOLUTION: Modify "cpu_dms" (hp2100_cpu2.c) to execute 10x701 as NOP on M-Series machines. STATUS: Fixed in version 3.7-0. 137. ENHANCEMENT: Add support for 21xx loader enable and disable. VERSION: 3.6-1 OBSERVATION: The 21xx CPUs are core-based machines. Binary loaders are kept in the top 64 memory locations and are protected from reading and writing by front panel LOADER ENABLE switches. When the switch is off, main memory effectively ends 64 locations earlier, i.e., the loader area is treated as non-existent. Some 21xx diagnostics test for this feature and will not proceed if the loader area is unprotected. RESOLUTION: Modify hp2100_cpu.c to add loader protection for 21xx models. STATUS: Fixed in version 3.7-0. 138. PROBLEM: The General Purpose Register Diagnostic fails when run on a 2100. VERSION: 3.6-1 OBSERVATION: The GP register diagnostic and other diagnostics that test the I/O system fail when run on 21xx CPUs. The failure is in the Basic I/O test, Test 00. The failure is, "E015 INT RTN ADDR ERROR." CAUSE: The 21xx and 1000 CPUs behave differently when holding off interrupt requests after executing certain instructions. At instruction fetch time, a pending interrupt request may be deferred if the previous instruction was a JMP indirect, JSB indirect, STC, CLC, STF, CLF, SFS (1000 only), or SFC (1000 only), or was executing from an interrupt trap cell. If the CPU is a 1000, then the request is always deferred until after the current instruction completes. If the CPU is a 21xx, then the request is deferred unless the current instruction is an MRG instruction other than JMP or JMP,I or JSB,I. Note that for the 21xx, SFS and SFC are not included in the deferral criteria. RESOLUTION: Modify "sim_instr" (hp2100_cpu.c) to clear "ion_defer" if executing on a 21xx-series CPU and the current instruction is an MRG instruction other than JMP or JMP,I or JSB,I. STATUS: Fixed in version 3.7-0. 139. PROBLEM: The 2100-specific Memory Protect Diagnostic fails when testing indirect holdoffs. VERSION: 3.6-1 OBSERVATION: Running the 2100-specific MP diagnostic fails, even though the combined 2100/21MX MP diagnostic passes. The failure is: E26. RETURN ADDRESS INCORRECT FOR CHAINED JMP,I INTERRUPTS CAUSE: The memory protect feature adds an indirect counter that allows a pending interrupt to be serviced if more than three levels of indirection are encountered. Currently, the "resolve" routine handles this by returning a status code that aborts the current instruction if an interrupt is pending and the third indirect level is encountered. However, the actual action of the hardware is to clear any interrupt deferral at the third level and to abort the instruction at the fourth. The diagnostic tests that a two-level JMP,I jumps and defers interrupts, a three-level JMP,I jumps and then allows interrupts, and a four-level JMP,I aborts and then allows interrupts. RESOLUTION: Modify "resolve" (hp2100_cpu.c) to obey the foregoing rules, and modify "sim_instr" to set "ion_defer" before calling "resolve" for JMP,I and JSB,I instructions. STATUS: Fixed in version 3.7-0. 140. PROBLEM: The 2114/2115/2116/2100 DMA diagnostic fails with an unexpected trap cell halt. VERSION: 3.6-1 OBSERVATION: Running the 21xx-specific DMA diagnostic fails, even though the combined 2100/21MX DMA diagnostic passes. The failure manifests itself as an unexpected trap cell halt, 106002. CAUSE: The diagnostic issues STF 6 and STC 6 instructions to cause a DMA interrupt without a transfer to test the priority chain. This sets the transfer (command) flip-flop on SC 6. In the next test, it does a CLC 0 and then sets up a one-word DMA transfer from the test device. Then it asserts device SRQ by doing CLC SC and STF SC, and finally it starts the device and DMA with STC SC and STC 6,C. However, with command set, asserting SRQ starts the transfer immediately, even though the control flip-flop is clear. So the word count has rolled over to zero and the transfer terminated by the time the STC 6,C is done to "start" the transfer. At that point, a second transfer is started, and the word count of zero implies a transfer of 64K words, which begins scribbling over memory. As the value 140000 had been written to the card before the transfer, and as the card is in a loopback mode, 140000 is read from the card on each transfer, and so this value overwrites memory. Eventually, the diagnostic attempts a jump indirect through an overwritten location. The target value 140000 is interpreted as a DEF 40000,I, and because location 40000 contains zero, control transfers to location 0, leading to execution of the trap cell halt 106002 in location 2. The problem is that the simulator incorrectly implements CRS ("Control Reset," the backplane signal that is generated by the CLC 0 instruction) by sending a CLC SC to each I/O card. For many cards, CLC 0 (CRS) and CLC SC (CLC) invoke the same action. They do not on the DMA card, which clears the control flip-flop for CLC, but clears the control and command flip-flops for CRS. Clearing the command flip-flop prevents the DMA transfer from starting until the STC 6,C instruction in the diagnostic is executed. RESOLUTION: Modify "cpuio" (hp2100_cpu.c) to send a new signal, "ioCRS", in response to CLC 0 and modify the I/O handlers of all devices to handle "ioCRS" as "ioCTL" temporarily until each card response can be verified from the schematics. STATUS: Fixed in version 3.7-0. 141. PROBLEM: The 12566B diagnostic interface card (LPS) does not clear the command flip-flop when CLC is done. VERSION: 3.6-1 OBSERVATION: In SET LPS DIAG mode, a 12566B microcircuit interface card with a loopback connector is simulated. This is provided for the use of certain diagnostics that test the I/O system. Attempting to use this simulation with the 2114/2115/2116/2100 DMA diagnostic fails with: E136. D1-I/O FLG SET even though the combined 2100/21MX DMA diagnostic passes. CAUSE: The diagnostic requires that jumper W9 be set to the "A" position. This enables clearing of the device command flip-flop when the CLC instruction is executed. Clearing CMD is intended to stop any I/O in progress. The diagnostic sets up a one-word output with STC and CLC specified in the control word. At the end of the transfer, "dma_cycle" (hp2100_cpu.c) correctly sends LPS a STC,C followed by a CLC,C. The STC,C starts a transfer and therefore schedules an I/O event for completion in one instruction. The CLC,C clears the control flip-flop and the device flag, but because "sim_cancel" is not called, the I/O event remains. When it fires, the device flag is set. The diagnostic is expecting the flag to be clear. The 2100/21MX diagnostic tests for flag clear by using a control word that has neither STC nor CLC present. This generates a CLF to the interface, which correctly clears the device flag (without starting another operation). RESOLUTION: Modify "lpsio" (hp2100_lps.c) diagnostic mode to latch the input data on STC and schedule the command clear and flag set in two instructions. Also, clear the command flip-flop and cancel any pending I/O event if CLC is executed in diagnostic mode. This more correctly implements the response of the hardware under DMA control. STATUS: Fixed in version 3.7-0. 142. ENHANCEMENT: Add diagnostic loopback capability to the 12920A multiplexer. VERSION: 3.7-0 OBSERVATION: To run the HP multiplexer diagnostic, a loopback cable is needed that interconnects two ports. To test all sixteen ports, eight cables are needed, or the diagnostic must be run eight times while moving the single cable from port pair to port pair. The diagnostic cannot be run under simulation, because the 12920A simulator does not provide loopback capability. RESOLUTION: Add DIAG/TERM commands to switch between diagnostic cable (loopback) mode and terminal cable (Telnet connection) mode. STATUS: Fixed in version 3.7-1. 143. PROBLEM: The 12920A multiplexer control card diagnostic fails in test 0. VERSION: 3.7-0 OBSERVATION: Running the control diagnostic reports this failure: TEST 00 E027 PRESET DID NOT CLEAR STATUS ON PORT 01 The diagnostic is testing each channel after PRESET to verify that the status is reset, but the value returned is not as expected. CAUSE: Page 3-6, paragraph 3-38 of the multiplexer service manual states, "The channel number is four bits (10 through 13) of every output or input word. When the scan bit is cleared (logic 0) during an OTA/B command, the channel number does not change and the status of the same channel is loaded by the next LIA/B command." The diagnostic sets the channel number by an OTA to the control card select code. However, the "ioOTX" handler in "muxcio" is not setting the channel to the supplied value for subsequent LIA/B use. RESOLUTION: Set "muxc_chan" (hp2100_mux.c) to the channel number supplied in the "ioOTX" handler in "muxcio." STATUS: Fixed in version 3.7-1. 144. PROBLEM: The 12920A multiplexer control card diagnostic fails in test 4. VERSION: 3.7-0 OBSERVATION: Running the control diagnostic reports this failure: TEST 04 E034 STORED STATUS NO. 1 FAILED TO INTERRUPT The diagnostic sets the multiplexer channel to interrupt on a change in S1 status, but the interrupt did not occur as expected. CAUSE: The "mux_cntl_int" returns immediately if "muxc_scan" (the scan bit) is zero. This behavior is incorrect; with the scan bit set to zero, only the current channel should be tested for interrupt. Note that Figure 3-3, the "Simplified Schematic Diagram" on page 3-9 of the service manual shows that the status interrupt is conditional on the scan bit, but the actual schematic in figure 5-4 on page 5-15 shows that this is not the case. RESOLUTION: Modify "mux_cntl_int" (hp2100_mux.c) to test the current channel for a status interrupt condition if "muxc_scan" is zero, rather than returning directly. STATUS: Fixed in version 3.7-1. 145. PROBLEM: The 12920A multiplexer data card diagnostic fails in test 1. VERSION: 3.7-0 OBSERVATION: Running the data diagnostic reports this failure: TEST 01 E032 SEND PORT NUMBER IS 00 SHOULD BE 01 The diagnostic is reading the transmitted data from the lower select code to determine the transmit channel, but the channel number is wrong. CAUSE: The "mux_data_int" function is setting only the upper select code status value in response to a transmit interrupt. The lower select code card schematic, figure 5-3 on page 5-11 of the service manual, shows that the interrupting channel number is presented on bits 14-10 of the status words supplied by both the upper and lower cards. RESOLUTION: Modify "mux_data_int" (hp2100_mux.c) to set "muxl_ibuf" as well as "muxu_ibuf" in response to a transmit interrupt. STATUS: Fixed in version 3.7-1. 146. PROBLEM: The 12920A multiplexer data card diagnostic fails in test 1. VERSION: 3.7-0 OBSERVATION: Running the data diagnostic reports this failure: TEST 01 E034 DATA RECEIVED ON PORT 00 IS 2125 SHOULD BE 3525 Data is sent out on one channel is compared for equality when received on the other channel. The values are not equal. CAUSE: Characters delivered to the multiplexer are contained in bits 10-0 of data words output from the CPU. In the "ioCTL" handler in "muxlio," the output word is masked with OTL_CHAR (01777) to retain just the data before storing the result in "mux_xbuf". However, "mux_xbuf" and the corresponding "mux_rbuf" are declared as "uint8", so the upper three bits are lost. RESOLUTION: Change the declarations of "mux_xbuf" and "mux_rbuf" (hp2100_mux.c) from "uint8" to "uint16" to retain all of the character data bits. STATUS: Fixed in version 3.7-1. 147. PROBLEM: The 12920A multiplexer data card diagnostic fails in test 2. VERSION: 3.7-0 OBSERVATION: Running the data diagnostic reports this failure: TEST 02 E041 BREAK BIT SHOULD BE SET The diagnostic is transmitting an all-space character and testing whether the receiver detects this as a break. The break bit is not being set. CAUSE: The error is misleading. The actual cause is that an interrupt is not occurring on the receive channel, because "mux_rchp" is not being set for the target line in "muxi_svc" if SCPE_BREAK is detected, even though the break flag is being set in the status word. RESOLUTION: Modify "muxi_svc" (hp2100_mux.c) to indicate a pending character if a break is detected. STATUS: Fixed in version 3.7-1. 148. PROBLEM: The 12920A multiplexer data card diagnostic fails in test 3. VERSION: 3.7-0 OBSERVATION: Running the data diagnostic reports this failure: TEST 03 E042 PARITY BIT SHOULD BE SET The diagnostic is checking that the "parity check" bit (bit 15) of the received status word is 1 when odd parity is sent. The bit is 0. CAUSE: The "odd_par" table has numerous errors in it. For example, the values in columns 006 and 007 should be the opposite of the values in columns 016 and 017, but in many cases they are not. Also, the "RCV_PAR" macro is setting LIL_PAR if the data has even parity, not odd parity. For example, it returns LIL_PAR on a data value of zero. Paragraph 3-23 on page 3-6 of the service manual says, "The parity bit is set (logic 1) for odd parity and turned off (logic 0) for even parity." RESOLUTION: Correct the "odd_par" table (hp2100_mux.c) to reflect the correct odd parity for all values. Reverse the sense of the test in "RCV_PAR" so that "LIL_PAR" is returned if the received value has odd parity. STATUS: Fixed in version 3.7-1. 149. PROBLEM: The 12920A multiplexer data card diagnostic fails in test 3. VERSION: 3.7-0 OBSERVATION: Running the data diagnostic reports this failure: TEST 03 E043 RAW PARITY BIT 7 The diagnostic is checking that bit 7 of the data word contains the desired parity (odd or even). Bit 7 has the wrong value. CAUSE: Parity is not being generated for transmitted characters. RESOLUTION: Modify the "ioCTL" handler in "muxlio" (hp2100_mux.c) to generate odd parity and add it to the data if bit 12 of the transmission configuration word is set. STATUS: Fixed in version 3.7-1. 150. PROBLEM: The 12920A multiplexer data card diagnostic fails in test 4. VERSION: 3.7-0 OBSERVATION: Running the data diagnostic reports this failure: TEST 04 E033 RECEIVE PORT NUMBER IS 00 SHOULD BE 16 The diagnostic is configuring the diagnose channels and presuming that an initial CLC 0 will clear the configuration parameters for all channels. CAUSE: The CLC handler is not performing the master clear function, so the previously configured channel 0 is interrupting before the expected channel 16. Also, the interrupting channel number is truncated to four bits by the "PUT_CCH" macro in "mux_data_int", so an interrupt on channel 16 is reported as being on channel 0. Control card channel numbers are four bits in size, but data channel numbers are five bits; the wrong macro is being used to form the status word. RESOLUTION: Modify the "ioCRS" handler in "muxlio" (hp2100_mux.c) to clear all 37 channel transmit and receive parameters in response to a CLC 0. Modify "mux_data_int" to use the "PUT_DCH" macro to put the data channel number into the return status. STATUS: Fixed in version 3.7-1. 151. ENHANCEMENT: Add debug printouts to the 12920A multiplexer. VERSION: 3.7-0 OBSERVATION: Debugging multiplexer behavior would be easier if the internal state of the simulator was observable and recordable. RESOLUTION: Modify "hp2100_mux.c" to add debug-mode printouts. STATUS: Fixed in version 3.7-1. 152. ENHANCEMENT: Add debug printouts to the 12875A Interprocessor Link. VERSION: 3.7-0 OBSERVATION: Debugging HP 2000 Time Shared BASIC systems would be easier if the internal state of the link simulator was observable and recordable. RESOLUTION: Modify "hp2100_ipl.c" to add debug-mode printouts. Modify "sim_defs.h" to add a "DEBUG_PRJ" macro. STATUS: Fixed in version 3.7-1. 153. PROBLEM: The 2000 Access terminal multiplexer does not initialize properly approximately three starts in ten on multiprocessor host systems. VERSION: 3.7-0 OBSERVATION: Booting the 2000 Access Time Shared BASIC system appears to start the system correctly, but the terminal multiplexer does not work. Typing a CR does not produce the expected "PLEASE LOG IN" message, even though the system console is responsive. Restarting the system often corrects the problem. CAUSE: There is a race condition between the system processor (SP) and the I/O processor (IOP) during initialization. A 321-word DMA transfer is done from the IOP to the SP. Immediately after DMA completion, the SP pulses the interprocessor link to "set correct flag direction" (according to the Access source). The SP depends on the IOP still being in the DMA completion interrupt handler when that pulse occurs, so that it does not cause an interrupt and subsequent command processing. On a multiprocessor host system, the SP and IOP SIMH processes may run in parallel. If the SP is blocked after DMA completion and before the IPL pulse, the IOP may complete its own DMA completion interrupt handling and therefore see the pulse as a second DMA command request. If that occurs, the IOP hangs in the DMA transfer, so it never completes initialization of the terminal multiplexer. RESOLUTION: Modify the "ioEDT" handler in "iplio" (hp2100_ipl.c) to sleep for one millisecond before signalling a DMA completion interrupt for an output transfer. This allows the SP time to pulse the IPL before the IOP processes the DMA completion interrupt. Modify "dma_cycle" (hp2100_cpu.c) to pass the DMA channel number and I/O direction flag in the "dat" parameter to EDT handlers. Note that this is a workaround, and not a solution, as the SP can still block between DMA completion and IPL pulsing, which would allow the IOP to complete its DMA handling first. STATUS: Fixed in version 3.7-1. 154. PROBLEM: The 12920A multiplexer simulator encounters a buffer overrun error when the five "diagnose" lines are employed. VERSION: 3.7-0 OBSERVATION: Multiplexer line status is kept in "mux_sta", which is defined with 16 elements. However, there are 21 receive lines for which status is kept. When "mux_diag" is called to service the "diagnose" lines (lines 16-20), "mux_sta" is indexed beyond the end of its definition. CAUSE: The size should be "MUX_LINES + MUX_ILINES" instead of "MUX_LINES". RESOLUTION: Modify the size of "mux_sta" (hp2100_mux.c) from 16 to 21 elements. STATUS: Fixed in version 3.7-1. 155. PROBLEM: Resetting the 12920A multiplexer does not clear status for the receive-only "diagnose" lines. VERSION: 3.7-0 OBSERVATION: Line status is kept in "mux_sta[0..20]". Doing a multiplexer reset (e.g. RESET, RUN, etc.) clears line status only in lines 0-15. CAUSE: Multiplexer line reset is handled by "mux_reset_ln" in response to a device reset. "mux_reset_ln" is called only for lines 0-15. RESOLUTION: Modify "muxc_reset" (hp2100_mux.c) to clear the variables associated with lines 16-20. STATUS: Fixed in version 3.7-1. 156. PROBLEM: Breakpoint actions aren't executed properly if the breakpoint occurs in a DO file. VERSION: 3.7-0 OBSERVATION: Breakpoint actions are not reliably executed if they appear in a DO file. Given this "t.sim" command file: break 100; e 0-1 go break 200; e 2-3 go e 4-5 ...then entering "do t.sim" at the command prompt produces this output: Breakpoint, P: 00100 (NOP) Breakpoint, P: 00200 (NOP) 4: 000000 5: 000000 sim> e 2-3 2: 000000 3: 000000 Note that the "e 0-1" is not executed at all, and the "e 2-3" is executed after the "e 4-5". CAUSE: Breakpoint actions are executed by a call to "sim_brk_getact" in the main execution loop. The call is missing from the execution loop in "do_cmd". In the test case, the "e 2-3" is being executed by the "sim_brk_getact" in the main execution loop after command file execution terminates. This out-of-sequence execution could have serious consequences, e.g. if the command were intended to clear a log file prior to a debug run ("! del big.log") but instead deleted it at the end of the run when the DO file terminated. RESOLUTION: Modify "do_cmd" (scp.c) to incorporate a call to "sim_brk_getact" to process breakpoint commands as they occur. STATUS: Fixed in version 3.7-1. 157. PROBLEM: The .DMP instruction returns erroneous results. VERSION: 3.7-3 OBSERVATION: After creating a FMGR file that occupies the rest of the cartridge, the "next track" field in the directory list is wildly incorrect. CAUSE: An unsigned multiply is done instead of a signed multiply. Multiplying by a small negative number returns an overflow condition. RESOLUTION: Convert the operands to signed integers before multiplying in "hp2100_cpu3.c". STATUS: Fixed in version 3.8-0. 158. PROBLEM: The .DDI instruction returns erroneous results. VERSION: 3.7-3 OBSERVATION: Attempting to scan an indexed library file that is split into multiple extents returns FMGR -012 (SOF or EOF error). Accessing the library file sequentially avoids the error. CAUSE: Extent calculations are in error. An unsigned divide is done instead of a signed divide. RESOLUTION: Convert the operands to signed integers before dividing in "hp2100_cpu3.c" STATUS: Fixed in version 3.8-0. 159. ENHANCEMENT: Portable unsigned-to-signed conversions were added. VERSION: 3.7-3 OBSERVATION: Conversions from unsigned to signed values, e.g., from "uint16" to "int16", using casts or union store/load are not portable. They will fail if the size in bits is > 16. Portable versions are needed. RESOLUTION: Add portable "INT16" and "INT32" macros (hp2100_defs.h) to provide uint16-to-int16 and uint32-to-int32 conversions. STATUS: Fixed in version 3.8-0. 160. PROBLEM: The action of jumpers W5 (JSB), W6 (INT), and W7 (SEL1) for the 12892B Memory Protect card are reversed. VERSION: 3.7-3 OBSERVATION: The SET/SHOW MP command sets/reports the jumpers in the wrong state. A jumper flag of 1 is reported as "in" but it is treated as "out" by the simulation. CAUSE: The "mp_mod" table treats a jumper flag bit on as indicating an installed jumper, but the flag bit actually indicates a removed jumper. RESOLUTION: Reverse the jumper sense in the "mp_mod" table (hp2100_cpu.c). STATUS: Fixed in version 3.8-0. 161. PROBLEM: The action of jumper W5 (JSB) is incorrect. VERSION: 3.7-3 OBSERVATION: Executing a JSB below the MP fence and to a write-protected page should cause a DM violation. This occurs if W5 is in, but an MP violation is reported if W5 is out. CAUSE: The W5 check is wrong. RESOLUTION: Correct the JSB handler in "sim_instr" (hp2100_cpu.c) to report a DM error with W5 out (unless the instruction is JSB 0 or JSB 1, in which case an MP error is correct). STATUS: Fixed in version 3.8-0. 162. PROBLEM: The memory protect MEVFF is not reset when an I/O instruction is executed from a trap cell during an interrupt. VERSION: 3.7-3 OBSERVATION: The Memory Expansion Violation Flip-Flop (MEVFF) is set on any DMS violation: read protect, write protect, base-page protect, or privilege. The MEVFF is cleared when MP is re-enabled after the violation is handled. Any interrupt request automatically disables MP. MP is re-enabled explicitly via an STC 5 instruction or implicitly after a non-HLT I/O instruction is executed in the interrupt trap cell. This latter case does not clear the MEVFF under simulation. CAUSE: Improper coding in the interrupt handler. RESOLUTION: Modify "sim_instr" (hp2100_cpu.c) to set "mp_mevff" to zero if a non-HLT I/O instruction is executed from a trap cell. STATUS: Fixed in version 3.8-0. 163. PROBLEM: Running certain RTE-6/VM configurations will cause an "unimplemented instruction" stop for the DIAG (100000) instruction. VERSION: 3.7-3 OBSERVATION: If an RTE-6/VM system is generated with a firmware replacement for the $LIBR routine, and a program using the software equivalent is run under that system, an "unimplemented instruction" stop occurs. This is actually due to a bug in $RQST (EXEC6). The instruction sequence executed is: XOR INSTR NOW HAVE THE ADDRESS RAL,CLE,SLA,ERA IF INDIRECT INDR XLA A,I GET NEXT LEVEL RAL,CLE,SLA,ERA CHECK FOR MULTI LEVEL JMP INDR FOUND ONE SO LOOP (MUST END) If the sign bit of the A register is zero, the first "RAL,CLE,SLA,ERA" improperly skips the first word of the two-word instruction "XLA A,I" and executes the second word (100000). This decodes as a DIAG instruction. DIAG should execute as a NOP with the CPU running, as it is only effective when executed from single-step mode. This would mask the bug, as the second "RAL,CLE,SLA,ERA" would also skip, taking execution out of the sequence; the bug fix would be to replace the first "RAL,CLE,SLA,ERA" with a "JMP *+3". However, the simulator stops instead. CAUSE: The DIAG processor executes as NOP on the E-Series, but no equivalent test is made for the F-Series. RESOLUTION: Modify "cpu_eau" (hp2100_cpu1.c) to allow DIAG as NOP on the F-Series as well as the E-Series. STATUS: Fixed in version 3.8-0. 164. ENHANCEMENT: Add the RTE-6/VM operating system accelerator and virtual memory firmware instructions. VERSION: 3.7-3 OBSERVATION: RTE-6/VM "primary" (i.e., factory distribution) systems after revision 2401 were generated with the OS/VMA firmware replacements. Such systems will not run under SIMH due to the lack of firmware support. To get later revision systems running without firmware replacements requires a bootstrapping process that begins with revision 2340 and generates successive systems until the desired revision is reached. Moreover, later revisions of some programs (e.g., TF) will not load due to exceeding the logical address space available when software replacements are used. RESOLUTION: Add the OS/VMA instructions (hp2100_cpu5.c, hp2100_cpu6.c) to support later primaries and to provide address space reductions in later programs. Add CPU debug support and flags for OS and VMA instructions. STATUS: Fixed in version 3.8-0. 165. ENHANCEMENT: Change the default breakpoint type from the current static setting of "-e" (break unconditionally) to a dynamic setting that matches the current DMS mapping ("-n", "-s", or "-u"). VERSION: 3.2-1 OBSERVATION: After reaching a map-specific breakpoint (e.g., a system-map breakpoint to debug a device driver), the most common action is to examine memory locations and set another breakpoint farther ahead in the code. That breakpoint will, of course, be set in the same mapping mode as the one just reached, i.e., in the current DMS mapping mode. Therefore, defaulting to "the same map as is currently enabled" leads to the most-used cases not requiring additional switches (and therefore the chance of operator error). RESOLUTION: Before exiting "sim_instr" (hp2100_cpu.c), set "sim_brk_dflt" to a switch corresponding to the current DMS mapping mode. STATUS: Fixed in version 3.8-0. 166. ENHANCEMENT: Change the default examine/deposit addressing mode from the current static setting of "address is physical" to a dynamic setting that matches the current DMS mapping ("-s" or "-u"), and provide a new modifier option ("-n") to specify that an address is a physical address. VERSION: 3.2-1 OBSERVATION: After reaching a breakpoint, it is common to examine memory contents. The most common requirement is to examine memory under the currently enabled map, i.e., if a break occurred under the system map, then examination of system memory is most likely to be requested (and correspondingly for user-map breakpoints). However, the current default is to examine the first 32K of physical memory. This is a reasonable default for non-DMS systems, or when DMS is not enabled, but is awkward when debugging mapped environments. A switch ("-v") is currently provided to request access under the current DMS map, but debugging with DMS active essentially requires specifying that switch on every EXAMINE and DEPOSIT command. It would be more useful if this action were the default. RESOLUTION: Modify "cpu_ex", "cpu_dep", and "dms_cons" (hp2100_cpu.c) to respond to redefined switch modifiers as follows: Old New Description === === =========================================================== -v if DMS enabled, use current map, else use unmapped -n use unmapped -s -s if DMS enabled, use system map, else illegal -u -u if DMS enabled, use user map, else illegal -p -p if DMS enabled, use DCPC port A map, else illegal -q -q if DMS enabled, use DCPC port B map, else illegal If a map specifier is used when DMS is not enabled, "Command not allowed" results. Note that the SAVE and RESTORE commands always access memory unmapped. Also, note that operation in non-DMS environments is unchanged, i.e., EXAMINE and DEPOSIT with no modifiers still access physical memory as before. STATUS: Fixed in version 3.8-0. 167. ENHANCEMENT: NOBR with no argument clears breakpoint at the current PC. VERSION: 3.7-0 OBSERVATION: Breakpoints are often required only once, e.g., when establishing which of several paths through a routine is taken. In this case, when a breakpoint is reached, it is immediately removed. The existing breakpoint clear syntax requires specification of the address. It would be helpful if the address defaulted to the current PC, i.e., the location of the breakpoint just hit. RESOLUTION: Modify "ssh_break" (scp.c) to allow omission of the address argument and, if omitted, to clear the breakpoint corresponding to the current PC. STATUS: Fixed in version 3.8-0. 168. ENHANCEMENT: The SHOW VERSION command now reports the patch level. VERSION: 3.3-2 OBSERVATION: Having multiple patched versions of SIMH that report the same version number leads to confusion. But official releases often increment the minor version only. RESOLUTION: Modify "show_version" (scp.c) and "sim_rev.h" to add a reported "patch delta" version number. STATUS: Fixed in version 3.8-0. 169. PROBLEM: The DPTR register in the DS device cannot be set to any value other than 0 or 1. VERSION: 3.7-3 OBSERVATION: The DPTR register is documented as an 8-bit "sector buffer pointer." However, it is implemented as a single-bit flag in the REG structure. This prohibits setting any value other than 0/1. CAUSE: DPTR is improperly defined with the FLDATA macro. It should use DRDATA instead. RESOLUTION: Modify "ds_reg" (hp2100_ds.c) to define the DPTR register as DRDATA instead of FLDATA. STATUS: Fixed in version 3.8-0. 170. ENHANCEMENT: Add an implementation of the 12966A Buffered Asynchronous Communications Interface (BACI) card. VERSION: 3.7-3 OBSERVATION: Newer RTE primary systems will not run without a system console connected to a BACI card using DVR05, as support for the Teletype interface using DVR00 had been dropped. Reconfiguring to a DVR00 driver is problematic if another "type 00 driver" (e.g., DVM00) is present in the equipment table ahead of DVR00. Also, some RTE features, such as command-stack editing, don't work with the Teletype interface. Having a BACI simulation would allow these systems to run "out of the box." RESOLUTION: Add a BACI simulation (hp2100_baci.c) to the HP simulator. STATUS: Fixed in version 3.8-0. 171. ENHANCEMENT: Expose the current time base generator (CLK) poll time via a device register. VERSION: 3.7-3 OBSERVATION: It is often helpful to know the number of simulated CPU instructions per second on a host machine. As the CLK device is calibrated to real time, knowing the tick rate and the service poll time would allow the calculation of the simulated MIPS. The tick rate is given by the "SEL" register, but the poll time is set using a local variable and is not visible to the user. RESOLUTION: Added global variable "clk_tick" and register "IPTICK" (instructions per tick) to the CLK device (hp2100_stddev.c). STATUS: Fixed in version 3.8-0. 172. PROBLEM: The "ioCRS" actions are incorrect in several devices. VERSION: 3.7-3 OBSERVATION: The "ioCRS" signal was added in 3.7-0 to all devices. As an expedient, the action was defaulted to CLC SC, which was how CRS was handled before. Most devices handle CRS as CLC, but not all do. In particular, the TTY and DS devices do not. CAUSE: Expediency. RESOLUTION: Modified the "ioCRS" handlers in "tty_svc" (hp2100_stddev.c) and "ds_svc" (hp2100_ds.c) to implement the control reset signal correctly. STATUS: Fixed in version 3.8-0. 173. PROBLEM: The paper tape reader hangs at EOT after "rewinding" a tape. VERSION: 3.7-3 OBSERVATION: The POS register records the current position of the file attached to the PTR device. The manual says, "...by changing POS, the user can backspace or advance the reader." Attempting to re-read a tape by setting POS to 0 causes the reader to hang when the end-of-tape is encountered the second time. CAUSE: The trailing-null counter, "ptr_trlcnt", is not reset when the position is. Therefore, the automatic trailer function does not work the second time, and the reader hangs. RESOLUTION: Reset "ptr_trlcnt" when a non-null character is read. STATUS: Fixed in version 3.8-0. 174. PROBLEM: The .PWR2 instruction returns the wrong value in the A register. VERSION: 3.7-3 OBSERVATION: The .PWR2 instruction returns the result of the expression (ab * 2 ^ n) in the A and B registers. The B-register value is correct, but the A-register value is always 0. CAUSE: The conversion of the high-word value in "fp_unpack" from "fop" to "mantissa" is incorrect. Specifically, the cast to 16 bits should be done on the shifted value, but it is improperly done on the unshifted value, so that shifting right by 16 always yields a zero value. Note that the only other instruction to use "fp_unpack" is .FLUN, but that discards the A-register (high mantissa) value and instead returns the exponent in A, so the error does not manifest itself there. Also note that there are two "fp_unpack" implementations. The one in error is the firmware floating-point version. The hardware floating-point version in "hp2100_fp1.c" is correct and is used when HAVE_INT64 is defined during compilation. RESOLUTION: Modify "fp_unpack" (hp2100_fp.c) to correct the conversion. STATUS: Fixed in version 3.8-0. 175. PROBLEM: The DBI self-test instruction does not skip. VERSION: 3.7-3 OBSERVATION: The double-integer firmware self-test is supposed to set the S register to 102077 octal and return to P+1. Neither of these actions occur. CAUSE: At the time that the DBI firmware was implemented, the source microcode and the installation manual were unavailable. Subsequently, the source microcode was located, and the self-test action is now known. RESOLUTION: Modify "cpu_dbi" (hp2100_cpu3.c) to add the proper implementation of the DBI self-test instruction. STATUS: Fixed in version 3.8-0. 176. PROBLEM: The DEPOSIT command will change in some other device if the name is unique to that other device. VERSION: 3.7-3 OBSERVATION: Entering "deposit ptr ppos 0" actually changes the "ppos" register in the "tty" device. It should give an error that "ppos" does not exist in the "ptr" device. CAUSE: The "exdep_cmd" routine is calling "find_reg_glob" if the "find_reg" routine returns a not-found error for the selected device. "find_reg_glob" searches for a unique name among all devices and returns it if found. RESOLUTION: None. STATUS: Fixed in version 3.8-0. 177. PROBLEM: The four-word double-precision sine and cosine functions return erroneous results. VERSION: 3.7-3 OBSERVATION: The .SIN and .COS functions return improper values when SIS firmware is present. When the firmware is absent, the results are correct. CAUSE: .SIN and .COS call /CMRT, the common range reduction routine. This routine is implemented in the SIS firmware. The /CMRT firmware simulation is not setting the B register properly to the lower 16 bits of the reduction multiple. RESOLUTION: Correct "cpu_sis" (hp2100_cpu4.c) to return the proper value in the B register for the /CMRT instruction. STATUS: Fixed in version 3.8-0. 178. PROBLEM: The free HP 700/92 terminal emulator, QCTERM from AICS, does not work with SIMH. VERSION: 3.7-0 OBSERVATION: Attempting to run QCTERM as a Telnet client with SIMH loses characters. Specifically, the first character typed after a CR is lost. CAUSE: QCTERM is sending "bare" carriage-return characters to SIMH. SIMH presumes that CR will always be followed by LF or NUL in text mode, so it simply drops the next character. For QCTERM, this is the first character of the subsequent transmission. Examination of the Telnet connection initiation code shows that SIMH is sending several command sequences but is not checking the client replies (except for binary mode). A correct negotiation mechanism must be implemented to handle the variety of Telnet clients properly. WORKAROUND: Modify the TNS_SKIP case in "tmxr_poll_rx" (sim_txmxr.c) to skip only LF or NUL following CR. Any other character is processed as is. STATUS: Fixed in version 3.8-0. 179. ENHANCEMENT: Add infrastructure changes to support CPU idling in a future release. VERSION: 3.7-3 OBSERVATION: Idle support would be a welcome addition to the HP simulator. RESOLUTION: Modify hp2100_stddev.c to change the TTY (console) input poll to use a 10 millisecond calibrated timer, to provide a synchronization routine for use by other devices with input polls, and to synchronize the CLK to the console poll if it is set for a 10-millisecond period. Add UNIT_IDLE flags to the CLK and TTY input units. Modify hp2100_mux.c and hp2100_baci.c to synchronize Telnet polling with the console poll. STATUS: Fixed in version 3.8-0. 180. PROBLEM: There is some dead code in hp2100_stddev.c, now that control character handling is in sim_console.c. VERSION: 3.7-0 OBSERVATION: In version 3.2-2, "tto_out" (hp2100_stddev.c) was altered to suppress output for all control characters (characters < 40 octal), except for BEL, BS, LF, and CR. This was in support of the RTE line editor. In version 3.5-2, generalized support for control character output suppression was added to sim_console.c. This obviated the HP-specific handling. However, some of that code remained in hp2100_stddev.c. CAUSE: Oversight. RESOLUTION: Removed the redundant code. STATUS: Fixed in version 3.8-0. 181. ENHANCEMENT: Add the RTE-IVB extended memory area firmware instructions. VERSION: 3.7-3 OBSERVATION: The Pascal/1000 compiler (HP 92832A) relies on EMA instructions to manage its internal memory. EMA software is available, but the compiler can exceed the available logical address space if they are employed, due to the size of the software routines. RESOLUTION: Add the EMA instructions (hp2100_cpu5.c) to provide address space reductions in the Pascal compiler. Add CPU debug support and flags for the EMA instructions. STATUS: Fixed in version 3.8-0. 182. ENHANCEMENT: Add the Vector Instruction Set firmware instructions. VERSION: 3.7-3 OBSERVATION: VIS was used in some HP programs, notably SPICE. RESOLUTION: Add the VIS instructions (hp2100_cpu7.c) to provide support for HP-SPICE. Add CPU debug support and flags for the VIS instructions. STATUS: Fixed in version 3.8-0. 183. PROBLEM: Single-stepping through interrupts does not report instruction execution properly. VERSION: 3.7-3 OBSERVATION: When single-stepping, the simulator prints the next instruction to be executed before pausing for a command. When an interrupt is pending, the instruction printed is not correct. Moreover, a single-step command at this point will execute two instructions. CAUSE: There are two problems with the simulator. The first is with the simulator routine that prints the next instruction to be executed at the end of a step. It is not checking whether an interrupt is pending. The instruction printed is the next instruction that would have been executed, if there had not been an interrupt pending. But because there was an interrupt pending, the next instruction actually executed is the trap-cell instruction. The second problem is that the simulator is not counting down events during the trap cell instruction execution. During each normal instruction, the simulator decreases the event counter, including the step counter. But it omits the decrement for the trap cell instruction. So single-stepping with an interrupt pending actually causes two instruction executions: the trap-cell instruction, and the subsequent instruction (usually the target of the JMP or JSB in the trap cell). RESOLUTION: Modify "fprint_sym" (hp2100_sys.c) to check for a pending interrupt, and if so, to print the trap cell instruction instead of the instruction at PC. Modify "sim_instr" (hp2100_cpu.c) to decrement the event counter for trap cell instructions. STATUS: Fixed in version 3.8-0. 184. PROBLEM: The TTY output interrupt time is too short for MSU BASIC. VERSION: 3.7-3 OBSERVATION: When running MSU BASIC, this code eventually produces an "Indirect address loop, P: 37001 (STA 1,I)" error: 10 PRINT "HELLO WORLD!" 20 GOTO 10 30 END CAUSE: The TTY output rate is abnormally fast compared to the original hardware. The ASR-33 operated at 10 characters per second. The HP 2116 processor ran at about 600 instructions per millisecond. Therefore, the TTY would interrupt approximately every 60000 CPU instructions. But the default SIMH configuration (SERIAL_OUT_WAIT) is to interrupt every 100 instructions -- about 600x the rate of the actual Teletype. MSU BASIC (a contributed library program) maintains per-user I/O state buffers, one for each of four users, plus one for the I/O system. When a TTY interrupt occurs, the program copies the per-user state into the I/O state buffer, enters the TTY driver to output a character, copies the updated I/O state back to the per-user buffer, and returns to a monitor loop to wait for the completion interrupt, which would occur 100 milliseconds later on a real machine. It takes 85 instructions from the STC that starts the TTY output until the updated state copy is completed. With the TTIME default of 100 instructions, that is normally just enough time to complete the buffer transfer before another interrupt occurs. However, MSU BASIC also runs the time base generator (CLK) with a one-second period. The TBG interrupt handler takes from 25 to 71 instructions. If the TBG interrupts while the TTY event is active, it will absorb enough instructions to cause the TTY interrupt to occur before the updated state copy is finished. That leaves the per-user state buffer inconsistent. As a result of the TTY interrupt, that inconsistent buffer is copied to the I/O state buffer, and mayhem ensues. RESOLUTION: Lengthened the TTY output time in "tty_unit" (hp2100_stddev.c) from 100 to 200 instructions. STATUS: Fixed in version 3.8-0. 185. ENHANCEMENT: Add the SIGNAL/1000 firmware instructions. VERSION: 3.7-3 OBSERVATION: SIGNAL provides firmware acceleration for Fast Fourier Transforms and was used in some signal processing applications. RESOLUTION: Add the SIGNAL instructions (hp2100_cpu7.c). Add CPU debug support and flags for the SIGNAL instructions. STATUS: Fixed in version 3.8-0. 186. ENHANCEMENT: Add idle support to the HP 2100 simulator. VERSION: 3.8-0 OBSERVATION: The DOS and RTE operating systems keep the current time of day by counting TBG ticks. To maintain accurate time, a simulation must run continuously. Given this requirement for continuous operation, it would be helpful if the simulator idled the host processor when these operating systems were idle themselves. RESOLUTION: Alter "cpu_mod" to add SET CPU IDLE/NOIDLE commands, and alter "sim_instr" to add idle detection for DOS and RTE (hp2100_cpu.c). STATUS: Fixed in version 3.8-1. 187. ENHANCEMENT: Report the device and line number for Telnet connections. VERSION: 3.8-0 OBSERVATION: When connecting a Telnet client to a simulator device via the multiplexer library, the client receives a "welcome" message of the format: Connected to the HP2100 simulator It would be helpful if the user knew to which device and line the client had connected. For example: Connected to the HP2100 simulator MUX device, line 3 The report for single-line devices, e.g., additional terminal devices, would suppress the line number: Connected to the HP2100 simulator BACI device RESOLUTION: Modify sim_tmxr.h to add a "DEVICE *dptr" field at the end of the TMXR structure. Change tmxr_attach() to look up the device from the unit via find_dev_from_unit() and set "dptr" to point at the device. Change tmxr_poll_conn() to print the device name and line number (if more than one line defined) in the greeting message. STATUS: Fixed in version 3.8-1. 188. ENHANCEMENT: Add a simulation of the 12792C eight-channel multiplexer. VERSION: 3.8-0 OBSERVATION: The main terminal multiplexer for later RTEs was the 12792, and direct support was generated into primary systems from HP. The A/B/C revisions of the multiplexer firmware used the same protocol and drivers on RTE-IVB and RTE-6/VM. The D revision used an incompatible protocol and required different drivers that were supported only on RTE-6/VM. RESOLUTION: Add the MPX device (hp2100_mpx.c) to simulate the 12792A/B/C, and alter "hp2100_sys.c" and "hp2100_defs.h" to add the device structure and default select code assignment. STATUS: Fixed in version 3.8-1. 189. ENHANCEMENT: Add a mechanism to provide a device-specified connection order for terminal multiplexers. VERSION: 3.8-0 OBSERVATION: Some operating systems allow per-line device drivers for multiplexers (e.g., the HP 12792 and 12920 under RTE). These change the line behavior, so that the existing model of multiplexers as pools of identical lines is no longer valid. A method of specifying line connection order is needed, so that connection to specific device drivers is possible. RESOLUTION: Modify the TMXR structure (sim_tmxr.h) to add an "int32 *lnorder" field that points at an array specifying the line connection order. Modify "tmxr_poll_conn" (sim_tmxr.c) to connect in the order given by *lnorder, if defined, else to connect in ascending port number order. Add "tmxr_set_lnorder" and "tmxr_show_lnorder" routines to provide support for SET LINEORDER= and SHOW LINEORDER commands. STATUS: Fixed in version 3.8-1. 190. ENHANCEMENT: Add a simulation of the 12620A/12936A Privileged Interrupt Fences. VERSION: 3.8-0 OBSERVATION: Privileged DOS and RTE systems require the use of a privileged interrupt fence card. This is needed to run the 12920A 16-channel multiplexer under RTE. When configured for DIAG operation, the LPS device may be used as an RTE fence, although the corresponding line printer function is then lost. The DOS fence (12936A) had a unique operation that is not duplicated by any existing simulation. RESOLUTION: Add the PIF device (hp2100_pif.c) to simulate the 12620A and 12936A, and alter "hp2100_sys.c" and "hp2100_defs.h" to add the device structure and default select code assignment. STATUS: Fixed in version 3.8-1. 191. PROBLEM: The action of certain I/O cards (e.g., the 12936A Privileged Interrupt Fence) cannot be modelled by SIMH. VERSION: 3.8-0 OBSERVATION: Certain I/O actions cannot be implemented within the current design of the I/O simulation. For example, the 12936A card breaks the interrupt priority chain when flag OR control is set. Simulation assumes that priority is broken when flag AND control are set. CAUSE: The hardware has I/O signals for interrupt request (IRQ) and interrupt priority to lower-priority devices (PRL). These signals are not modelled directly in SIMH. Rather, they are implied by control, flag, and flag buffer set (for IRQ) and control and flag set (for PRL). If an I/O card does not follow these conventions, then the proper action cannot be simulated. RESOLUTION: Modify the I/O simulation structure to model hardware signals, rather than I/O instructions. Verify each simulated device's action in response to each I/O backplane signal. Verify each device's reset routine to ensure the proper response to RESET (POPIO signal) and RESET -P (PON signal). STATUS: Fixed in version 3.8-1. 192. PROBLEM: Escaping backslashes in DO commands does not work. VERSION: 3.8-0 OBSERVATION: The SIMH User's Guide says in Section 3.13, "Executing Command Files:" The string %n is recognized as meaning argument n from the DO command line. The character \ has the usual UNIX meaning of an escape character; the next character is interpreted literally, even if it is % or \. The sequence "\%" is recognized as a literal "%" character. The sequence "\\" is not recognized as a literal "\" character; instead, it is left unaltered. In fact, "\%" is the only recognized escape; "\" followed by any other character will not be processed, i.e., the "\" and that character will remain. This makes using parameters in Windows file paths impossible, as this: attach dev c:\path\to\\%1 substitutes for "%1" but leaves the double-backslashes, and this: attach dev c:\path\to\%1 ...does not substitute for "%1" and parses as "c:\path\to%1". Actually, the documented behavior (escaping every character) is undesirable, as it will invalidate every current command file that uses Windows path names. Were it implemented as documented, then a path such as "c:\path\to\file" would be parsed as "c:pathtofile". Even restricting the change to escaping just "\" and "%" will still invalidate current command files that use network paths (e.g., "\\server\\share\\path\to\file" will become "\server\share\path\to\file", which is a local path. This at least is fixable, whereas there is no workaround for the current situation. CAUSE: The argument substituter is checking only for the "\%" case. RESOLUTION: Modify "sub_args" (scp.c) to accept "\\" as a literal backslash, in addition to "\%" as a literal percent sign. STATUS: Fixed in version 3.8-1. 193. PROBLEM: The DR and IPL boot loaders do not work. VERSION: 3.8-0 OBSERVATION: Attempting to boot the DR or IPL devices results in a hang in the bootstrap. Examination shows that the I/O instructions are not being configured. CAUSE: The loader protection feature added at revision 3.7-0 must be turned off in order to write programmatically to the boot loader area. Protection is automatically disabled for the devices using the "ibl_copy" function in the CPU, but the DR and IPL devices install their bootstraps within their boot routines and do not call "ibl_copy". RESOLUTION: Modify "ipl_boot" (hp2100_ipl.c) and "drc_boot" (hp2100_dr.c) to use the "ibl_copy" routine. STATUS: Fixed in version 3.8-1. 194. PROBLEM: Omitted parameters to DO command files do not substitute null strings for the corresponding arguments. VERSION: 3.8-0 OBSERVATION: Given a command file "cmdfile" containing "echo %1 and %2", the command "do cmdfile a b" results in: a and b ...which is as expected. However, "do cmdfile a" results in: a and %2 ...which is unexpected; the expected response is: a and ...i.e., the null string is substituted for "%2". This would be consistent with argument substitution in operating system command shells. CAUSE: Arguments for omitted parameters are not being considered for substitution. RESOLUTION: Modify "do_cmd" (scp.c) to initialize omitted arguments to NULL and modify "sub_args" to skip null arguments during substitution. STATUS: Fixed in version 3.8-1. 195. PROBLEM: JSB to 0/1 with W5 out and fence = 0 erroneously causes MP abort. VERSION: 3.8-0 OBSERVATION: The upper bound of protected memory is set by the memory protect fence, and the lower bound is normally location 2. However, the lower bound is 0 if the instruction is a JMP, or if the instruction is a JSB and jumper W5 is out. That is, a JMP or a JSB (with W5 out) to any location under the memory protect fence will cause a violation. If the fence is set to or below the lower bound, though, then MP violations will not occur. However, a JSB 0 or JSB 1 with the fence set to 0 or 1 and jumper W5 out still causes an MP abort. CAUSE: Improper coding of the W5 test in the JSB simulation. RESOLUTION: Modify the instruction dispatcher "sim_instr" (hp2100_cpu.c) to set the protected lower bound for JSB as indicated by W5 and to test the target address against the lower bound as well as the MP fence. STATUS: Fixed in version 3.8-1. 196. PROBLEM: The MEM (DMS) violation register is not being set properly. VERSION: 3.8-0 OBSERVATION: The STC handler within the MP I/O instruction routine "proio" contains an explicit clear of the MEM violation register. There is no such action shown on either the MP or MEM card schematics. When the statement is removed, the Memory Expansion Module Diagnostic (DSN 102103) fails in TST21, the "Violation Register Map Bits Test," with an "E302 VR MAP 00" error. TST21 generates three MEM violations and one MP violation. The value of the MEM violation register is checked after all four violations to confirm that the map register address corresponds to the violation location. The value after the MP violation is in error; the violation register still contains the value from the prior MEM violation. CAUSE: The simulator updates the violation register whenever a MEM violation occurs. The hardware actually updates the violation register for every memory read, every memory write above the lower bound of protected memory, and every execution of a privileged DMS instruction. The register is "frozen" when MP is disabled by an MP or DM error to capture the state of the MEM (MEVFF sets or CTL5FF clears). Examining the violation register value after each MEM violation produces the expected result. Examining it after the MP violation does not, because the register is not being set. As it happens, the MP violation in the diagnostic occurs on page 0, so the problem is masked if the violation register is set to 0 when MP is enabled. Other bits in the register are wrong in this case, but the diagnostic does not check them. It would be proper to fix this problem by updating the violation register after each memory access, as is done in hardware. Fortunately, this isn't necessary, as the visible state of the violation register is only available via a programmed RVA/B instruction or via the SCP interface. Therefore, it is sufficient if the register is updated: - at a DM violation (when freezing) - at an MP violation (when freezing) - during RVA/B execution (if not frozen) - before returning to SCP after a simulator stop (if not frozen) The first of these conditions is currently implemented. The other three must be added to address the issue. RESOLUTION: Add a new "dms_upd_vr" routine (hp2100_cpu.c) to update the MEM violation register value. Modify the ABORT macro to take the address of the last memory access as the parameter. Modify the MP abort handler to use the memory address to update the MEM violation register. Add new update calls to the RVA/B simulator and to the cleanup code at the end of "sim_instr" before returning to SCP. STATUS: Fixed in version 3.8-1. 197. PROBLEM: The ME Bus Enabled bit in the MEM violation register is not being set properly. VERSION: 3.8-0 OBSERVATION: The ME Bus Enabled bit in the violation register reflects the state of the MEBEN (ME Bus Enable) signal on the MEM card. MEBEN is asserted if the MEM is enabled (MAPON signal) and the last memory access was not to the unmapped portion of the base page (OFA signal). Under simulation, this bit is set if a MEM violation is either a read violation or a write violation, and it is clear otherwise (base page or privileged instruction violation). This is correct only for the base page violation case; for the other three cases, MEBEN may be either high or low. CAUSE: Incorrect logic in the "dms_viol" routine. A base page violation, by definition, occurs if a write is attempted to the unmapped portion of the base page. MEBEN must be off in this case (BPV is qualified by -MEBEN). Each of the other three violations could occur with MEBEN either asserted or denied. Consider a read from the base page with map 0 indicating read protection. If the read is from the mapped portion, MEBEN will be asserted. If the read is from the unmapped portion, MEBEN will be denied. In either case, a read violation will be indicated. The same conditions pertain to a write to the base page with map 0 indicating write protection, and to an attempted privileged instruction execution from the base page. RESOLUTION: Modify "dms_upd_vr" (hp2100_cpu.c) to call a new "is_mapped" routine to determine if an access is to unmapped memory. STATUS: Fixed in version 3.8-1. 198. PROBLEM: JMP to a write-protected page fails to signal a DMS violation. VERSION: 3.8-0 OBSERVATION: The "21MX M-Series Computer Operating and Reference Manual" states on page 4-2: Any attempt to write to a write-protected page will result in a write violation and the memory will not be altered. In addition, if a page is write-protected, a jump or jump indirect instruction to that page will cause a write violation and the jump will not occur. The write violation for a JMP to a write-protected page does not occur. CAUSE: Coding error in "mp_dms_jmp". MEM write and base-page violations are checked when an MPCK micro-order is executed. MPCK asserts the MPCND signal if the address is above the lower bound of protected memory (0 for a JMP). MPCND is qualified with the accessed page's write-protect bit for write violations, and with an "unmapped access to the base page" signal for base-page violations. Any instruction that executes MPCK will enable these two violation checks, and all jump-type instructions do. Under simulation, the MEM check for base-page violations is done by the "mp_dms_jmp" routine. However, this routine does not check for write violations. RESOLUTION: Modify "mp_dms_jmp" (hp2100_cpu.c) to check for write violations as well as base-page violations. STATUS: Fixed in version 3.8-1. 199. PROBLEM: .GOTO to A/B causes incorrect MP violation. VERSION: 3.8-0 OBSERVATION: The lower bound of protected memory is normally location 2, allowing unrestricted access to the A and B registers (locations 0 and 1, respectively). The MP card checks the instruction register and uses a lower bound of 0 for JMP, as well as for JSB if jumper W5 is out. The JLY and JPY microcode also requests a lower bound of 0 by setting the IR to the JMP opcode before the MP check. Under simulation, the MP check against a lower bound of 0 is done by the "mp_dms_jmp" routine (hp2100_cpu.c). However, this routine is also called for the DJP, SJP, UJP, JRS, and .GOTO instructions. These latter instructions should allow access to the A/B registers, but they don't. CAUSE: Logic error. RESOLUTION: Modify "mp_dms_jmp" (hp2100_cpu.c) to accept the protected lower bound as a parameter, and modify the JMP, JSB, JLY, JPY, DJP, SJP, UJP, JRS, and .GOTO instruction handlers (hp2100_cpu.c, hp2100_cpu2.c, and hp2100_cpu3.c) to pass the desired lower bound value. STATUS: Fixed in version 3.8-1. 200. PROBLEM: UJP fails erroneously with a write-protect violation. VERSION: 3.8-0 OBSERVATION: Attempting to enable the user map with a UJP instruction fails if the target page in the system map is write-protected. CAUSE: The instruction is checking the jump target in the wrong map. The DJP, SJP, and UJP instructions validate that the target address is not below the MP fence and on a write-protected page. In firmware, these instructions alter the Memory Expansion Unit before validating the jump address. For example, UJP enables the user map and then checks the target address using the user map. Under simulation, the "mp_dms_jmp" check is issued before the map is changed, leading to failures. RESOLUTION: Modify "cpu_dms" (hp2100_cpu2.c) to move the "mp_dms_jmp" checks to after the MEU update for the DJP, SJP, and UJP instructions. STATUS: Fixed in version 3.8-1. 201. PROBLEM: Several HP 2100 devices use registers variables < 32 bits without REG_FIT. VERSION: 3.8-0 OBSERVATION: Scalar register variables must be either 32 bits in size or declared with the REG_FIT flag. In the absence of REG_FIT, a 32-bit access is assumed by the examine and deposit routines. Several HP 2100 devices use 8- or 16-bit scalar variables as registers without REG_FIT. This will cause failures on big-endian machines. Note that arrayed registers are automatically accessed at the minimum size implied by the "width" and "offset" values and therefore do not need REG_FIT. CAUSE: Coding errors. RESOLUTION: Modify hp2100_baci.c, hp2100_dp.c, hp2100_dq.c, and hp2100_mpx.c to add REG_FIT where needed. STATUS: Fixed in version 3.8-1. 202. PROBLEM: The HP 2100 CPU simulation shadows the A and B registers unnecessarily. VERSION: 3.8-0 OBSERVATION: The A and B register values are stored in two places: as "uint16 ABREG[2]" duing execution, and as "uint32 saved_AR" and "uint32 saved_BR" between executions. The latter was to accommodate the requirement that register variables must be 32 bits in size. That requirement was removed in version 3.5-2 for registers declared with the REG_FIT flag. With REG_FIT, "ABREG[0]" and "ABREG[1]" can be used directly as register values, and the code associated with saving and restoring the A and B registers can be eliminated. CAUSE: The code wasn't updated to take advantage of the new feature. RESOLUTION: Modify hp2100_cpu.c to use "ABREG[]" variables as register values with REG_FIT, and remove the "saved_AR" and "saved_BR" values and associated code. Modify "msc_boot" (hp2100_ms.c) to use "AR" instead of "saved_AR". STATUS: Fixed in version 3.8-1. 203. PROBLEM: RTE break mode does not work with the 12920A multiplexer on fast host machines. VERSION: 3.8-0 OBSERVATION: Hitting the BREAK key when the terminal is idle or output is in progress should produce an RTE prompt. BREAK works properly when the terminal is idle, but hitting BREAK when output is in progress does not produce a prompt. This means that long outputs can be neither paused nor aborted. CAUSE: The RTE multiplexer driver is a privileged driver. Privileged drivers bypass RTE to provide rapid interrupt handling. To inform RTE that an operation is complete, e.g., that a line has been written, the interrupt section of the driver sets a device timeout of one clock tick (10 milliseconds). When that timeout occurs, RTE is entered normally to complete the I/O transaction. While the completion timeout is pending, the driver ignores any further interrupts from the multiplexer line. The maximum communication rate for the multiplexer is 2400 baud, or approximately 4.2 milliseconds per character transferred. A typical line of 20 characters would therefore take ~85 milliseconds, plus the 10 millisecond completion timeout, or about 95 milliseconds total. BREAK recognition would be ignored for roughly 10% of that time. At lower baud rates, recognition would be ignored for a correspondingly smaller percentage of the time. However, SIMH uses an optimized timing of 500 instructions per character transfer, rather than the ~6600 instructions that a character transfer should take, and so a typical 20-character line will take about 11,000 instructions. On the other hand, the clock tick is calibrated to real time, and 10 milliseconds of real time takes about 420,000 instructions on a 2.0 GHz PC. To be recognized, then, the BREAK key must be pressed in a window that is open for about 2.5% of the time. Therefore, the BREAK key will be ignored about 97.5% of the time, and RTE break-mode effectively will not work. RESOLUTION: Defer BREAK recognition until either a character is output or a second successive input poll occurs, providing that we are not in diagnostic mode. This ensures that the BREAK interrupt will be accepted. Added a "mux_defer[]" flag (hp2100_mux.c) to record break deferrals. STATUS: Fixed in version 3.8-1. 204. ENHANCEMENT: Add line connection order support to the 12920A multiplexer. VERSION: 3.8-0 OBSERVATION: RTE and DOS provide per-line device drivers for the 12920A multiplexer. A method of specifying line connection order is needed, so that connection to specific device drivers is possible. RESOLUTION: Add "SET MUX LINEORDER=" and "SHOW MUX LINEORDER" commands to the 12920A simulator. STATUS: Fixed in version 3.8-1. 205. PROBLEM: The LOCKED, WRITEENABLED, and FORMAT commands do not work as documented. VERSION: 3.8-0 OBSERVATION: The HP2100 documentation says that the "SET MTC LOCKED" command write-locks the tape drive. Attempting this, however, results in a "Non-existent parameter" error. CAUSE: The commands are part of the wrong command table (MTD instead of MTC). RESOLUTION: Modify "mtd_mod" and "mtc_mod" (hp2100_mt.c) to move the LOCKED, WRITEENABLED, and FORMAT commands to the command channel to be compatible with the MS tape device. STATUS: Fixed in version 3.8-1. 206. PROBLEM: Wrong mnemonic reported in IAK display for RTE-6/VM OS dual-use microcode instructions. VERSION: 3.8-0 OBSERVATION: RTE-6/VM OS instructions have four "dual-use" opcodes. These have different meanings, and thus different mnemonics, depending on whether they are used in interrupt trap cells or not. For example, the 105357 opcode is $TBG (time-base generator interrupt handler) if in a trap cell and .DSPI (set display indicator) if not. The mnemonic is correct for the EXAMINE command. A single-step through an interrupt acknowledgement displays the wrong mnemonic: [CTRL+E] Simulation stopped, P: 02040 (JMP 2037) sim> s Step expired, P: 02037 (IAK 15: .DSPI) sim> e -m 15 15: $TBG The IAK report should also display $TBG. CAUSE: The "fprint_sym" routine detects the IAK and obtains the trap cell value, but it fails to change the instruction address, so the address remains that of the interrupted instruction. As dual-use mnemonics depend on the instruction address, the mnemonic reported is incorrect. RESOLUTION: Modify "fprint_sym" (hp2100_sys.c) to set the instruction address for an interrupt acknowledgement to the interrupt trap cell address. STATUS: Fixed in version 3.8-1. 207. PROBLEM: The 3030 mag tape does not interrupt after a CLR command. VERSION: 3.8-0 OBSERVATION: Page 2-6 of the 12559A 9-Track Magnetic Tape Unit Interface Kit Operating and Service Manual says that the CLR command channel flag flip-flop when the command completes. The MT simulator does not, so the command channel does not interrupt. CAUSE: Coding error. RESOLUTION: Modify "mtcio" (hp2100_mt.c) to set the command channel flag when the command completes. STATUS: Fixed in version 3.8-1. 208. PROBLEM: Exiting the simulator does not report "Disconnected from the HP 2100 simulator" on MUX sessions. VERSION: 3.8-0 OBSERVATION: Exiting the simulator detaches all devices. Detaching multiplexer-type devices, such as BACI and MPX, reports "Disconnected from the simulator" on each connected Telnet session. However, no such report appears on MUX sessions. Doing a DETACH ALL does report the disconnection on MUX sessions. CAUSE: As part of simulator shutdown, "detach_all" is called with the "shutdown" parameter set to TRUE. This causes the detach routines for non-attachable units to be called. "ds_detach" calls "detach_unit", which returns SCPE_NOATT for unit 8 (the controller unit). "detach_all" exits on a non-zero status return from a device detach routine, so the devices after DS in the device array are never detached. Doing a DETACH ALL calls "detach_all" with the "shutdown" parameter set to FALSE. This calls device detach routines only for attached units. All of these return SCPE_OK, so MUX is eventually detached, and the disconnection reports are sent to the MUX sessions. Note that the same problem would arise if an attached unit fails to detach cleanly, e.g., due to a file write error. The remaining devices would not be detached before simulator exit. RESOLUTION: Modify "detach_all" (scp.c) to ignore errors from device detach routines during shutdown, so that all devices will be detached. STATUS: Fixed in version 3.8-1. 209. ENHANCEMENT: Add a microcode simulation module for site-specific microprograms. VERSION: 3.8-0 OBSERVATION: The 2100 and 1000 CPUs supported user microprogramming. A user of the HP2100 simulator may have user-written microcode that he would like to add to SIMH. It would be helpful to have the infrastructure in place to aid in the implementation of site-specific microprogram simulations. RESOLUTION: Add a new "cpu_user" microcode dispatcher and an example skeleton microcode simulator (hp2100_cpu0.c). Alter "cpu_uig_0" and "cpu_uig_1" (hp2100_cpu1.c) to route any instruction not allocated to an installed firmware option to the user-microcode dispatcher. In the absence of a user-microcode simulation for a given instruction, execution will cause an undefined instruction stop. STATUS: Fixed in version 3.8-1. 210. PROBLEM: The VIS and IOP options conflict on the 1000-F. VERSION: 3.8-0 OBSERVATION: The Vector Instruction Set and 2000/Access I/O Processor instructions share the same opcode range. Only one or the other should be present at a time. The SET CPU option processor does not enforce this. CAUSE: The case was overlooked when VIS was added. RESOLUTION: Modify "cpu_set_opt" (hp2100_cpu.c) to make the VIS and IOP options mutually exclusive on the 1000-F. STATUS: Fixed in version 3.8-1. 211. PROBLEM: Pressing BREAK on a BACI terminal under RTE locks the card. VERSION: 3.8-0 OBSERVATION: Under RTE, pressing the BREAK key on a BACI terminal session will cause that session to lock up. If the session was writing, it will resume in four seconds. If it was reading or idle, it will re-enable after the timeout period specified for the device in RTE. If no timeout was specified, then the session will remain locked forever. CAUSE: The RTE driver operates the BACI in character mode. Normally, pressing a key while the session is writing or idle will bring up the RTE system prompt. Pressing BREAK enters a NUL into the FIFO and interrupts with the BREAK CONDITION bit set in the status word. The driver ignores this by sending a "reset break status" command and then re-enabling interrupts with an STC sc,C instruction. But the original interrupt was caused not by the BREAK status (there is no explicit interrupt-on-BREAK function) but rather by the presence of a received character in the FIFO. So the BACI attempts to interrupt again, this time with the BREAK CONDITION bit clear. This second interrupt would normally be allowed, as the STC sc,C instruction clears the "interrupt lockout" flag that was set when the first interupt was generated. However, the STC signal handler checks for interrupt status between the STC and the succeeding CLF, rather than after the CLF. The result is that the STC clears lockout, then the FIFO status sets the flag and lockout, and then the CLF clears the flag, leaving interrupt lockout set. At that point, no interrupt is pending, and no future interrupts can occur, because the lockout flag prevents them. When device timeout occurs, the card is reinitialized and then re-enabled, so it becomes responsive again. RESOLUTION: Modify "baci_io" (hp2100_baci.c) to update the interrupt status after the CLF of a STC sc,C instruction. STATUS: Fixed in version 3.8-1. 212. PROBLEM: Setting a breakpoint on an interrupt trap cell does not work. VERSION: 3.8-0 OBSERVATION: If a breakpoint is set on an interrupt trap cell, the breakpoint does not trip when the corresponding interrupt occurs and the trap cell contents are executed. CAUSE: The breakpoint detection code is only in the "normal instruction" execution path. RESOLUTION: Modify "sim_instr" (hp2100_cpu.c) to add breakpoint detection to the "interrupt trap cell" execution path. STATUS: Fixed in version 3.8-1.