wfjm/w11

PDP-11/70 CPU core and SoC

w11's Issues

w11 clock rate limited by CACHE-to-CACHE false path

So far all Series-7 w11a systems ran with 80 MHz clock. The sys_w11_arty design (with DDR memory support via MIG) also achieves timing closure under Vivado 2017.2, but fails (with a small negative slack) under Vivado 2018.3.

The failing data path has

  Source:      SYS70/CACHE/CMEM_DAT1/sv_ram_reg_0/DOADO[1]
  Destination: SYS70/CACHE/CMEM_DAT3/sv_ram_reg_0/DIADI[1]
  via            VMBOX->SEQ->OUNIT->SEQ->DPATH->SEQ->VMBOX

The connectivity of the multiplexers in pdp_dpath in principle allows such a data flow, but pdp11_sequencer will never configure the multiplexers in such a way. So technically this is a false path.

It seems that the placer strategy changed from Vivado 2017.2 to 2018.3 and that 2018.3 is less tolerant to the sub-optimal w11a design.

This will be fixed in a future release, either by setting up an appropriate false_path constraint, or by changing the data path structure.

How to run testbench

I use vivado 2016 and run following commands:

cd $RETROBASE
 time nice tbrun -j 2 -norun -tag=viv -tee=tbrun_make_viv_bsim.log
 time nice tbrun -j 2 -nomake -tag=viv -tee=tbrun_run_viv_bsim.log

then

#----------------------------------------
# t000 - tags: default,viv,comlib,cdata2byte
tbw tb_cdata2byte 2>&1 | tbfilt -tee tb_cdata2byte_bsim.log
real 0m0.021s   user 0m0.012s   sys 0m0.000s
tbfilt-I: no DONE seen; FAIL
tbrun-I: test FAILed with exit status 1,0
#----------------------------------------
# t001 - tags: default,viv,serport,rx
tbw tb_serport_uart_rx 2>&1 | tbfilt -tee tb_serport_uart_rx_bsim.log
real 0m0.020s   user 0m0.008s   sys 0m0.004s
tbfilt-I: no DONE seen; FAIL
tbrun-I: test FAILed with exit status 1,0
#----------------------------------------
# t002 - tags: default,viv,serport,rxtx
tbw tb_serport_uart_rxtx 2>&1 | tbfilt -tee tb_serport_uart_rxtx_bsim.log
real 0m0.023s   user 0m0.012s   sys 0m0.004s
tbfilt-I: no DONE seen; FAIL
tbrun-I: test FAILed with exit status 1,0
#----------------------------------------

and I don't know why, please help me

asm-11 compiles nnn(pc) as nnn

A mov -14(pc),2(pc) should compile to 016767 174660 174674.
asm-11 generates an output like 016767 174660 174674 as one gets for mov -14 -2.

This bug went undetected because explicit use of indexed mode with pc is very unusual.
It was detected when coding test benches.

rlink throughput on basys3/nexys4 limited by serial port stack round trip times

The communication to basys3 and nexys4 boards is handled via the serial port driver. The combination of the FTDI USB UART and the Linux serial port stack gives a round trip time of 2 ms. On nexys3 and nexys2 boards and communication via the Cypress FX2 one gets a round trip time of 0.125 ms.

In many cases rlink throughput is limited by round trip time. It seems possible to improve it on basys3 and nexys4 boards with a libusb based custom driver.

originally filed as issue V0.64-4 on 2015-03-01

Vivado xelab sometimes extremely slow

As of vivado 2016.2 xelab shows sometimes extremely long build times, especially for generated post-synthesis vhdl models. But also building a behavioral simulation for a w11a design can take 25 min. Even though post-synthesis or post-routing models are now generated in verilog working with xsim is cumbersome and time consuming.

originally filed as issue V0.73-1 on 2016-06-26

Help wanted: Testing with Nexys4 DDR (or Nexys A7-100T) appreciated

The w11a design for Nexys4 DDR, see rtl/sys_gen/w11a/nexys4d, was provided to support also an up-to-date Nexys4 board. It is so far only simulation tested.

Testing done with a real Nexyx4 DDR, or a newer Nexys A7-100T, would be highly appreciated. Please double check the pin assignments (see mig_a.prj and nexys4d*.xdc) with the documentation of your board to avoid potential damage.

Looking forward to receive test reports.

CPU: The AIB bit in MMU PDR register set independant of ACF field

The MMU should set the AIB A bit in the the PDR only when "trap condition is met by the Access Control Field (ACF)". Thus for

   ACF=001 read-only  trap on read
   ACF=100 read/write trap on read or write
   ACF=101 read/write trap on write

The current pdp11_mmu implementation always sets the bit, the logic is simply

    if doabort = '0' then
      AIB_SETA <= '1';
      AIB_SETW <= CNTL.wacc or CNTL.macc;
    end if;

Since the MMU trap mechanism is is only available on 11/45 and 11/70, but not in the J11, it is not used by common operating systems.

Therefore this is considered a to be a minor deficit. Will be fixed in an upcoming release.

originally filed as issue w11a_V0.50-5 and TCK-029 dated 2009-05-09.

fx2 interface blocks for certain workloads

The fx2 transport can block for certain workloads. Only observed when testing DEUNA on nexys3 boards. The issue seems to be triggered to the long rblk/wblk sequence used in DEUNA. Only a complete board reset recovers this situation.

MMU: D space used instead of I space for PC deferred specifiers

Test 072 of ekbee1 fails with

    D-SPACE ENABLE CIRCUITRY HAS FAILED
    ERROR   AUTOI/D VIRTUAL
    REGISTR REGISTR ADDRESS TESTNO  PC AT ABORT
    100027  000000  060410  000072  060412  
    100027  000027  060416  000072  060422  

The test does

    060410: tst  (pc)
    060416: cmp  #240,(pc)

and expects that these accesses are done to I space.
They are done to D space instead.

The w11 uses D space only for (pc)+ and @(pc)+ specifiers.
Clearly a bug.
Wasn't detected so far because this access mode has no practical value
and this therefore not used in normal software.

TM11 controller doesn't support odd transfer size

The TM11 controller transfers data byte wise (all disk do it 16bit word wise) and allows for odd byte length transfers. Odd length transfers are currently not supported and rejected as invalid command. Odd byte length records aren't used by OS, so in practice this limitation isn't relevant.

originally filed as issue V0.66-1 on 2015-06-05

tcl getters accessing a const reference crash with a SIGSEGV

tcl commands like

  cpu0 get type
  cpu0rka get class
  rlc get timeout

crash with a SIGSEGV. Apparently all getters which internally return a const reference are affected. Observed with gcc 5.4.0. Unclear whether this is a coding bug introduced when boost::bind was replaced by lambdas (in commit 1620ee3) or a compiler issue.

PSW changed after MMU aborts in dstw flows

The dstw flow updates the condition codes before the the last possible MMU abort.
Example is the ccwe = 1 in s_dstw_def.
The condition codes are therefore changed when an MMU abort happens.

Detected in a code rewiew.
Not practical consequences because only CLR, SXT, and MOV are affected.
Only SXT depends on a condition code (N), but doesn't change this condition code.
Therefore, an instruction re-execution will always give the correct result.
But clearly a BUG, the condition codes must not change in case of MMU aborts.

CPU: no mmu trap when instruction which clears trap enable itself causes a trap

The MMU should issue an mmu trap if the instruction clearing the 'mmu trap enable' bit (bit 9 in mmr0) itself causes a trap. The 11/70 documentation clearly describes this behavior.

This is the reason why test 063 of the ekbee1 diagnostics currently fails.

Since the MMU trap mechanism is is only available on 11/45 and 11/70, but not in the J11, it is not used by common operating systems.

Therefore this is considered a to be a minor deficit. Will be fixed in an upcoming release.

originally filed as issue w11a_V0.50-3 and TCK-025 dated 2009-05-03.

DZ11: modem control not implemented in backend

The DZ11 device contains all modem control register bits.
However, the backend currently does not implement any modem control functionality.

IO delays still unconstraint in Vivado

Sounds worse than it is: all critical IOs use explicitly IOB flops, thus timing well defined. But should be resolved.

originally filed as issue V0.64-6 on 2015-03-01

MMU trap delayed/lost when prefetch in s_idecode done

The s_idecode prefetch logic checks only for tflag and int_pending, but not for pending MMU traps.
If the instruction read of an RR instruction, like ROR R0 or ADD R0,R1 causes an MMU trap, this trap will not executed.
In fact, it's not even queued, it's lost.
Detected in a code review.

No practical consequences, MMU traps are not used by any OS.
But clearly a BUG, such cases should trigger an MMU trap.

CPU: several deficits in trap logic

The current w11a implementation has several deficits in the handling of traps and interrupts which lead to non-conforming behavior when multiple trap, fault and interrupt conditions occur simultaneously, for example

• bad stack frame when IOT trigger stack violation (TCK-003)
• bad stack frame when interrupt triggers stack violation (TCK-004)
• no yellow stack trap when jsr triggers a stack violation (TCK-006)
• no odd address trap when EMT is executed with odd SP (TCK-007)
• no yellow stack abort for mov (sp),(sp) (TCK-028)

These situations never occur during the execution of operation systems, and in case they do, the operating system will crash anyway. Thus there is no impact in normal usage, but diagnostics programs do complain. Will be fixed in an upcoming release.

originally filed as issue w11a_V0.50-1 and TCK-003,004,006,007,028 dated 2008-04-18 to 2009-05-03

Many post-synthesis simulations fail

Many post-synthesis functional and especially post-routing timing simulations currently fail due to startup and initialization problems. Cause is MMCM/PLL startup, which is not properly reflected in the test bench. Will be resolved in an upcoming release.

Note: behavioral simulations work fine, and the real FPGA too.

originally filed as issue V0.73-2 on 2016-06-26

time tbrun does not report correct CPU time

A time tbrun command does not report the correct CPU time, example

time nice tbrun -j 4 -nomake -all
  tbrun-I: all tests passed, 102 tests selected from 102 found
  real 6m46.345s   user 2m14.553s   sys 0m11.417s

The tbrun command ran for more than 6 minutes in 4 parallel threads, usually with 100% CPU time.
One expects a total CPU of about 4*6=24 minutes, time reports only 2 minutes.
Likely some wait harvesting issue.

dmscnt and dmcmon disabled in Vivado based flows

The 'state number generator' code in pdp11_sequencer causes in vivado 2016.1 (and .2) that the main FSM isn't re-coded anymore, which has high impact on achievable clock rate. The two optional debug units depending on the state number, dmscnt and dmcmon, are therefore currently deactivated in
all Artix based systems (but are available on all Spartan based systems).

originally filed as issue V0.73-3 on 2016-06-26

CPU: MMR0 trap bit set when access aborted

The MMU should set the 'trap bit' in MMR0 only when the access is not aborted. The current pdp11_mmu implementation sets the bit even when the access is aborted.

This is the reason why test 064 of the ekbee1 diagnostics currently fails.

Since the MMU trap mechanism is is only available on 11/45 and 11/70, but not in the J11, it is not used by common operating systems. Therefore this is considered a to be a minor deficit. Will be fixed in an upcoming release.

originally filed as issue w11a_V0.50-6 and TCK-030 dated 2009-05-09.

SimH scmd files fail on current 4.* version; only 3.* supported

The SimH scmd scripts were originally developed for SimH 3.8, and worked for SimH 3.9 and later releases. The SimH 4.* development team decided not to provide releases anymore, and over time this version became incompatible with the scmd scripts used for w11. That is most pronounced for the RT11 V4.3 oskit. A simple

  cd $RETROBASE/tools/oskit/rt11-53_rl
  console_starter -s -d DL0  &
  pdp11 rt11-53_rl_boot.scmd

works fine for SimH V3.9, V3.10 and V3.11-1, but fails

• for pdp11-4.0-beta1 with core dump
• for pdp11-2016-12-26-5ced037b with signal SIGSEGV in pdp11_xu
• for pdp11-2019-07-28-2f707ffc with signal SIGSEGV in pdp11_xu
• for pdp11-2020-03-26-261abfc3 with signal SIGSEGV in pdp11_xu
• for pdp11-2021-08-22-64b12234 with signal SIGSEGV in pdp11_xu
• for pdp11-2022-04-17-d3f1ee09 with with errors like
  • Device auto configuration is now disabled
  • Command not allowed (for set rha enabled)
  • container incompatible with the RL device

Bottom line:

• the provided scmd scripts work only with SimH V3.9, V3.10 or V3.11-1
• an update to the SimH V4.* has low priority

Designs fail to build under Vivado 2016.3 and 2016.4

Under Vivado 2016.3 and 2016.4 designs fail to build due to CRITICAL WARNINGS's originating from clock domain crossing constraints. Apparently the naming of objects generated by synthesis has changed.

All designs build fine under Vivado 2016.2 and 2015.4.

How to understand tb log

Hello, I want to know the meaning of tb log file, thanks.

I have an ARTY S7 board, I'd like to try your w11 code.

Hello , I'm an Japanese software engineer, I used to work for DEC Japan.
I supported RSX-11M operation system and I did programming on it in Macro-11 and FORTRAN.

I'm VERY VERY interested in your w11 work. I hope your w11 code works on my ARTY S7.

I'm just an novice at FPGA, but I'm expert on UNIX/Linux.
I published some books about PDP-11/UNIX/RSX-11 on Rapsberry Pi using SIMH
in Amazon Kindle book store.

Your project have a lot of information and I'm lost, so would you help me?

rlink v4 error recovery not yet implemented, will crash on error

RlinkConnect::Exec() does not yet implement error recovery.

originally filed as issue V0.62-2 on 2014-12-20

issues not relevant for w11 backend over USB usage because the USB channel is usually error
free

RK11,RL11: no proper NXM check in 18bit systems

No NXM error is generated when a UNIBUS device DMA transfer reaches the top of memory in 18 bit addressing. Seen originally for RK11, but RL11 and DEUNA are also affected.

In normal operation is minor non-conformity is not relevant because operating systems never setup DMA transfers to/from non-existing memory. However, some highly space optimized crash dump routines use this to detect end-of-memory and might endless loop. Also diagnostics, like zrkkf2, might test this border case and fail.

originally filed as issue w11a_V0.50-8 and TCK-035 dated 2009-05-15

ti_rri crashes in normal rundown in very rare cases

ti_rri crashes in very rare cases in normal rundown (exit or ^D) when a cuff: type rlink is active. One gets

      terminate called after throwing an instance of 'Retro::Rexception'
        what():  RlinkPortCuff::Cleanup(): driver thread failed to stop

Doesn't affect normal operation, will be fixed in upcoming release.

originally filed as issue V0.65-1 on 2015-05-14

RK11: write protect action too slow

Some simple RK11 drivers, especially in test codes, don't poll for completion of a write protect command. Due to the emulated I/O this can cause errors.

One example is the boot sequence of RK based XXDP, as seen for example for the dzzza disk. On simh the disk is immediately switched to write protect mode, on w11 it is not. The pertinent part of the code is

    000214  B003:  mov	#000017,@#rk.cs   ; #rk.fwl+rk.go;  func=write_lock
    000222         bic	#017777,r2      
    000226         clc	
    000230         rol	r2
    000232         rol	r2
    000234         rol	r2
    000236         rol	r2
    000240         mov	r2,D040
    000244         mov	#000001,@#rk.cs   ; #rk.go;         func=control reset

The monitor does two writes to the RK11 CSR without busy polling and just a few instructions in between. In the w11 implementation the first write will set func=write_lock and cause an attn request. But before the attn can be serviced the CSR is overwritten with func=creset. The write lock is lost, only the creset is executed.

Can be resolved by handling write lock locally. Normal OS always do a busy poll before starting a function, therefore this is considered a minor deficit. Might be fixed in an upcoming release.

originally filed as issue w11a_V0.50-2 and TCK-025 dated 2008-05-03.

Bad throughput for DL11 emulation for low speed links

The large default transfer size for disk accesses leads to bad throughput in the DL11 emulation for low speed links, like the 460kBaud the S3board is limited to. Will be overcome by a DL11 controller with more buffering.

originally filed as issue V0.64-1 on 2015-03-01

CPU: src+dst deltas summed in mmr1 if register identical

Test 12 of maindec ekbee1 fails because it expects after a

        mov    #100000,@#mmr0

which sets an error bit in mmr0 and thus freezes mmr0, that mmr1 contains

  013427 (00010 111 00010 111) (+2,r7;+2,r7)

while w11a gives

  000047 (00000 000 00100 111) (--,--;+4,r7)

The mmr1 content is different compared to the original 11/70 behavior, but is logically correct, fault recovery in OS (like in 211bsd) will work correctly. Therefore this is considered a to be a minor deficit.

The 11/70 documentation clearly states that there is an additional state bit that counts the write accesses to mmr1. This ensures that each of the two logged accesses end in separate bytes (byte 0 filled first).

The w11a only uses byte 1 when the register number differs. Will be fixed in an upcoming release.

originally filed as issue w11a_V0.50-4 and TCK-026 dated 2009-05-03.

add external ram support on basys3 Implementation

Onboard memory size of 176 kB is too small to boot 211bsd .

https://github.com/machdyne/qqspi

provides design of ram with Pmod™ compatible interface which can be mounted on basys3 .

The ram chip [APS6404L-3SQR] manufacture[apmemory] provide the verilog model of the chip through emal.
https://www.apmemory.com/products/psram-iot-ram/

Can w11 add support for basys3 + pmod sram configuration ?

rlink command lists aren't split to fit in retransmit buffer size

RlinkConnect::Exec() doesn't split command lists in case they produce a response which overflows the response buffer. Will lead to a command abort.

originally filed as issue V0.62-1 on 2014-12-20

issue not relevant for w11 backend over USB usage because the backend produces proper sized command lists

MMU: ACF=1 traps on any access

Test 055 of ekbee1 fails with

    MEMORY MANAGEMENT TRAP OR ABORT HAD INCORRECT CONDITION
    EXPECTD ERROR   AUTOI/D VIRTUAL
    CONDITN REGISTR REGISTR ADDRESS TESTNO  PC AT ABORT
    020011  030011  013427  054032  000055  054040

This is caused by a bug in pdp11_mmu. For ACF=1 a trap is taken for any access, it should be taken only for read accesses.

A

migrate from Travis to GitHub actions

Travis is now defunct and has been removed in 6b8c063.
So it's time to migrate CI/CD to GitHub actions.

MMU: PDR A bit is set for every access

The PDR A bit is described in the Technical Manual as

A bit (bit 7) - This bit is used by software to determine whether or not
any accesses to this page met the trap condition specified by the Access
Control Field (ACF). (A = I is affirmative). The A bit is used in the
process of gathering Memory Management statistics.

It is set when the page ACF enables an MMU trap, thus for

• ACF=1 and read access
• ACF=4 and any access
• ACF=5 and write access

The w11 currently sets the 'A' bit on any non-aborted access regardless of the ACF value.

No practical impact, the 'A' bit in PDR is a 11/45 11/70 only feature and not used in OS software.

DL11: output chars lost when device polling used

Part of the console output can be lost when xxdp test eqkce1 is run on FPGA, also some kernel messages during the 2.11bsd boot sequence. In both cases very simple polling output routines are used. Most likely cause is that device ready polls timeout before the rlink interface can serve the output request.

Will be overcome by a DL11 controller with more buffering and improved interrupt rate control.

originally filed as issue w11a_V0.50-10 and TCK-038 dated 2009-08-01

SEGFAULT core dump after detach; ReventLoop::RemovePollHandler() can cause race condition

The detach of a tcp type virtual terminal or a tap type virtual ethernet device can lead to a SEGFAULT core dump, e.g. after a

    cpu0ttb0 det

This is caused by a race condition between the detach run-down and the implementation of
ReventLoop::RemovePollHandler().

Help wanted: Testing with Arty S7 appreciated

The w11a design for Arty S7 (50 die size), see rtl/sys_gen/w11a/artys7, was provided to support also an up-to-date Spartan-7 based board. Turned out that speed is equivalent to Artix-7. It is so far only simulation tested.

Testing done with a real Arty S7, would be highly appreciated. Please double check the pin assignments (see mig_a.prj and artys7*.xdc) with the documentation of your board to avoid potential damage.

Looking forward to receive test reports.

DEUNA: buffer chaining not implemened in backend

The DEUNA supports buffer chaining, an Ethernet frame can be stored in a set of chained buffers.
2.11BSD doesn't use this feature, it always uses buffers large enough for a maximal size Ethernet frame.
However, DEC OS use buffer chaining.

The current backend doesn't support buffer chaining. No problem with 2.11BSD.
But this limitation prevents usage of Ethernet connectivity in DEC OS.

Some exotic RH70/RP/RM features not implemented

Some exotic RH70/RP/RM features and conditions are not yet implemented

• last block transfered flag (in DS)
• CS2.BAI currently ignored and not handled
• read or write 'with header' gives currently ILF

All this isn't used by any OS, so in practice not relevant.

originally filed as issue V0.65-2 on 2015-05-14