This file documents the PDP-11 emulator p11 version 2.4.

Copyright (c) 1994-1999 Begemot Computer Associates. All rights reserved.

Redistribution of this software and documentation and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:

 1. Redistributions of source code or documentation must retain the above copyright notice, this list of conditions and the following disclaimer.

 2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.

 3. All advertising materials mentioning features or use of this software must display the following acknowledgement:

This product includes software developed by Begemot Computer Associates and its contributors.

 4. The name of Begemot Computer Associates or its contributors may not be used to endorse or promote products derived from this software without specific prior written permission.

THIS SOFTWARE AND DOCUMENTATION IS PROVIDED BY BEGEMOT COMPUTER ASSOCIATES AND ITS CONTRIBUTORS ``AS IS'' AND ANY EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL BEGEMOT COMPUTER ASSOCIATES OR ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

p11
***

Introduction
************

Running the emulator
********************

Command line options
====================

The monitor
===========

KDJ11A monitor commands
-----------------------

The KDJ11A device implements the following commands:

? [COMMAND]
h[elp] [COMMAND]
     Print a list of available commands (if no COMMAND is given) or short help on the given command.

i[nfo]
     Print the state of the processor internal registers.

c[sw]
c[sw] on
c[sw] off
c[sw] VALUE
     Without any argument the csw command prints the contents of the switch and display registers and the enabled/disabled state of the register. An argument of on enables the register, off disables it. If a numeric VALUES is given it is entered into the switch register and can be red by the program (if the register is enabled).

Memory system monitor commands
------------------------------

The memory subsystem implementes the following commands that are accessible through the I monitor command:

? [COMMAND]
h[elp] [COMMAND]
     Print a list of available commands (if no COMMAND is given) or short help on the given command.

i[nfo]
     Print internal status information. The output depends on the type of memory system.

RLV12 monitor commands
----------------------

The RLV12 emulator implements the following commands that can be accessed through the I monitor command:

? [COMMAND]
h[elp] [COMMAND]
     Print a list of available commands (if no COMMAND is given) or short help on the given command.

i[nfo]
     Print the state of the RLV12.

l[oad] drive file
     Load FILE into drive DRIVE and spin-up. If the file cannot be written the write lock bit is set. The image file should have the right size, if not it is extended (if it can be written).

u[nload] drive
     Spin-down drive DRIVE and unload the disk pack.

wl[ock] drive
     Write lock the drive.

wu[nlock] drive
     Unlock the drive. This is possible only if the image file can be written.

RHV70 monitor commands
----------------------

The RLV12 emulator implements the following commands that can be accessed through the I monitor command:

? [COMMAND]
h[elp] [COMMAND]
     Print a list of available commands (if no COMMAND is given) or short help on the given command.

i[nfo]
     Print the state of the RHV70..

l[oad] drive file
     Load FILE into drive DRIVE and spin-up. If the file cannot be written the write lock bit is set. The image file should have the right size. If is has not it is extended (if it can be written).

u[nload] drive
     Spin-down drive DRIVE and unload the disk pack.

wl[ock] drive
     Write lock the drive.

wu[nlock] drive
     Unlock the drive. This is possible only if the image file can be written.

d[ebug] [on|off]
     Switches debugging on or off. If no argument is given print the current debugging state. If debugging is on a message is printed when the disk image is red or written.

RK11 monitor commands
---------------------

KL11 monitor commands
---------------------

Line printer interface monitor commands
---------------------------------------

TM11 monitor commands
---------------------

MRV12 monitor commands
----------------------

DEQNA monitor commands
----------------------

Configuration files
*******************

Configuration file syntax
=========================

Fixed devices
=============

KDJ11A configuration
--------------------

The processor (KDJ11A) is implemented as a pseudo device. It is automatically plugged into the emulator -- there is no need to mention it in the configuration file. It is, however, possible to set the option jumpers and the line clock rate in the configuration file, and to disable the console switch register.

     cpu_options = <value>
     clock_rate = <rate>
     csw_enable = 1|0

If the options are not set, the default value is 2. Note, that the given value is masked with 0177016 -- the other bits are not fixed. The default line clock rate is 50 Hz. The console switch register is enabled by default.

Memory configuration
--------------------

The memory is implemented as a pseudo device. It is automatically plugged into the emulator -- there is no need to mention it in the configuration file.

It is possible to have different kinds of memory. The memory type is selected at compile time (see Memory interface).

Memory size is currently determined at compile time. The constant PHYSMEM in proc.h controls the amount of memory in bytes.

[TODO: 16/18/22 bit ...]

Configurable devices
====================

RLV12 disk controller configuration
-----------------------------------

The rl device implements a RLV12 disk controller with up to 4 disks. Register addresses and the interrupt vector are configurable so more than one controller can be used at the same time in the same emulator.

The configuration syntax for the RLV12 is:

     ctrl rl CSR-BASE VECTOR IRQ-LEVEL SYNC-INTERVAL
        DISK-NO IMAGE-FILE
        ...
     end

CSR-BASE is the base address of the register block (usually 017774400), VECTOR the interrupt vector (usually 0160) and IRQ-LEVEL the interrupt request level (4). SYNC-INTERVAL is the interval in milliseconds between flushes to the disk images. 4000 is a good value.

Each of the following lines loads a disk image into a drive. These lines consist of two fields: the drive number (0...3) and the name of the image files. If the image file is read-only the write lock flag is set for that drive.

A typical example would be:

     ctrl rl 017774400 0160 4 4000
       0 ../disks/sysimage.rl
     end

This plugs a RLV12 controller with the default jumper settings into the bus and loads a disk into drive 0. The disk is flushed every 4 seconds.

Disk image files must be formattet with fmt (see Disk format program). This program creates an image file of the right size and writes pack number information.

RHV70 disk controller configuration
-----------------------------------

The rp device emulates a RHV70 controller with up to eight disk drives. I/O addresses and vectors are configurable so more than one controller can be used in the same emulator. Note, that it may not be possible to load more that 8 or 10 disks. The disk images are mapped into the emulators virtual memory which is limited (depending on the operating system).

The configuration syntax for the RHV70 is:

     ctrl rp CSR-BASE VECTOR IRQ-LEVEL SYNC-INTERVAL
        DISK-NO IMAGE-FILE SERIAL-NUMBER
        ...
     end

CSR-BASE is the base address of the register block (usually 017776700), VECTOR is the interrupt vector address (254) and IRQ-LEVEL the interrupt priority level (5). SYNC-INTERVAL is the interval in milliseconds between flushes to the disk images.  4000 is a good value.

Each of the following lines loads a disk image into a drive. These lines consist of three fields: the drive number (0...7), the name of the image files and the pack serial number. If the image file is read-only the write lock flag is set for that drive. The serial number can be red by the program in the serial number register.

A typical example would be:

     ctrl rp 017776700 0254 5 4000
       0 ../disks/sysimage.rp 7708
     end

This plugs a RHV70 controller with the default jumper settings into the bus and loads a disk into drive 0. The disk is flushed every 4 seconds.

Disk image files must be formattet with fmt (see Disk format program). This program creates an image file of the right size and writes pack number information.

RK11 disk controller configuration
----------------------------------

The rk device emulates a RK11 controller with up to eight disk drives. I/O addresses and vectors are configurable so more than one controller can be used in the same emulator. Note, that the RK11 is a 18-bit controller. Therefor it may crash operating systems, that need a UNIBUS map on 22-bit systems (like RSX-11M).

The configuration syntax for the RK11 is:

     ctrl rk CSR-BASE VECTOR IRQ-LEVEL SYNC-INTERVAL
        DISK-NO IMAGE-FILE
        ...
     end

CSR-BASE is the base address of the register block (usually 017777400), VECTOR is the interrupt vector address (220) and IRQ-LEVEL the interrupt priority level (5). SYNC-INTERVAL is the interval in milliseconds between flushes to the disk images. 4000 is a good value.

Each of the following lines loads a disk image into a drive. These lines consist of two fields: the drive number (0...7) and the name of the image file. If the image file is read-only the write lock flag is set for that drive.

A typical example would be:

     ctrl rk 017777400 0220 5 4000
       0 ../disks/sysimage.rk
     end

This plugs a RK11 controller with the default jumper settings into the bus and loads a disk into drive 0. The disk is flushed every 4 seconds.

KL11 serial line controller configuration
-----------------------------------------

The KL11 controller (kl) emulates up to 4 serial lines. I/O addresses and vectors are configurable so that more than one controller can be used in one system. The connection to a real device is done by an external program (the terminal driver). There are different terminal drivers to connect the emulated serial line to different real devices.

The configuration syntax for the KL11 is:

     ctrl kl
        CSR-BASE IVECTOR OVECTOR IRQ-LEVEL CMD ARGS ...
        ...
     end

CSR-BASE is the base address of the four register block in the i/o space. IVECTOR is the interrupt vector address for the keyboard interrupt and OVECTOR is the vector address for the display interrupt. IRQ-LEVEL is the interrupt priority level. CMD is the name of the external terminal driver followed by arguments for the driver program (See the following sections).

A typical example would be:

     ctrl kl
       017777560  060  064 4 tty_xterm -7 -t p11-console
       017776500 0300 0304 4 tty_tty -7 /dev/ttyd1
       017776510 0310 0314 4 tty_net -7 -t 10000
       017776520 0320 0324 4 tty_net -7 -t 10001
     end

This configures a KL11 controller with four serial lines. The first one is the standard PDP-11 console and opens an xterm in 7 bit mode. The second line is connected to the serial line /dev/ttyd1 of the host computer. A real terminal could be connected there. The other two emulated lines are connected to listening TCP sockets so it's possible to use telnet to connect to the emulator.

xterm terminal driver
.....................

The xterm serial line driver tty_xterm opens a pseudo terminal and starts a xterm on the slave side. The program then relays all output and input between the xterm and p11.

The format of the tty_xterm command line is:

     tty_xterm [OPTIONS] [-x ARGS ...]

All options begin with a -. tty_xterm understands the following options:

-7
     Mask out the highest bit of each character on output. On the PDP-11 this bit was used as the parity bit. Modern displays often have 8 bit character sets and bytes with the parity bit on may produce funny characters.

-gGEOMETRY
     Specify the geometry of the xterm window as COLUMNSxROWS. The default format is 24x80.

-pPOSITION
     Specify the position of the xterm window. This is specified as -/+Y-POS-/+X-POS. The - or + indicate position relative to the bottom resp. right side of the screen (if -) or the left resp. top (if +). Y-POS and X-POS are the distances in characters sizes from the screen border. There is no default for the position.

     The arguments to the -p and -g switch together form a standard X11 geometry string.

-tTITLE
     Use TITLE in the title bar of the xterm window. The default is p11-tty.

-i
     Start the xterm in iconic state.

-x
     Pass the remaining arguments to the xterm.

Serial line terminal driver
...........................

The serial line terminal driver tty_tty may be used to connect an emulated serial line to a real one. The format of the call is:

     tty_tty [OPTIONS] FILE

tty_tty understands the following options:

-7
     Mask out the highest bit of each character on output. On the PDP-11 this bit was used as the parity bit. Modern displays oftern have 8 bit character sets and bytes with the parity bit on may produce funny characters.

The FILE argument is the name of the device file for the real serial line. Currently there is no way to change the parameters of this line. tty_tty should pass the remaining arguments to a stty(1).

Telnet terminal driver
......................

tty_net is kind of a network terminal. It enables the user to telnet to an emulated PDP-11 serial line. In this way the emulator can be used across the internet. tty_net has the following syntax:

     tty_net [OPTIONS] TCP-PORT

The following options are supported:

-7
     Mask out the highest bit of each character on output. On the PDP-11 this bit was used as the parity bit. Modern displays oftern have 8 bit character sets and bytes with the parity bit on may produce funny characters.

-t
     Telnet mode. Emulate some features of a telnetd.

-lFILE
     Log connects and disconnects to the given file.

TCP-PORT is the port number where the program should listen for incoming connection requests.

tty_net creates a listening TCP socket on the given port. When a connection request comes in tty_net accepts the request and forks. The child handles the connection between the emulator and the remote user, whereas the parent waits for other connection requests. If a new request arrives, while the old one is still beeing served tty_net accepts the new request, sends a string explaining that the port is busy and closes the connection.

If the program was started in telnet mode the child tries to switch the remote telnet into binary mode and remote echo by sending: WILL_SGA, WILL_ECHO, WILL_BINARY and DO_BINARY. The telnet state machine is implemented only partial -- tty_net never expects the remote telnet to start any option negotiation. All received options are expected to be answers.  If the expected state is not achieved after a reasonable amount of time (3 ticks of 10 seconds each) tty_net gives up, sends a warning to the remote site and tries to continue with the state it has.

The child then enters a loop, relaying the data stream between the remote user and the emulator. If the TCP connection is closed the child exits and the parent can accept a new connection.

FIFO terminal driver
....................

The tty_fifo program can be used to connect an emulated serial line to a fifo file (which is assumed to be bi-directional). The call syntax is:

     tty_fifo [OPTIONS] FIFO-NAME

The following options are supported:

-7
     Mask out the highest bit of each character on output. On the PDP-11 this bit was used as the parity bit. Modern displays oftern have 8 bit character sets and bytes with the parity bit on may produce funny characters.

FIFO-NAME is the name of the fifo-file. The fifo is created by tty_fifo with mode 0666.

Line printer parallel interface configuration
---------------------------------------------

TM11 tape controller configuration
----------------------------------

MRV12 boot PROM configuration
-----------------------------

DEQNA ethernet controller configuration
---------------------------------------

Emulated hardware description
*****************************

KDJ11 emulation
===============

The processor implements the following registers:

017777776
     processor status word

017777772
     programmed interrupt request register

017777766
     cpu error register

017777750
     maintenance register

017777570
     console switch register

017777546
     line clock control register

These registers are at fixed addresses that cannot be changed without recompilation. Not all bits in all registers are implemented. The following paragraphs give a short description of each of the registers.

The processor status word has the following format:

      15  14  13  12  11  10  9   8   7   6   5   4   3   2   1   0
     +---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+
     |CurMode|PrvMode|RGS| . | . | . |InterrLevel| T | N | Z | V | C |
     +---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+

CurMode is the current processor mode and PrvMode the previous mode. For both fields a value of 00 denotes kernel mode, 01 supervisor mode and 11 user mode. 10 is illegal and traps to 10 if set in the CurMode field. CurMode selects also one of three different stack pointers (R6/SP). RGS selects one of two sets of the registers R0...R5.  InterrLevel is the current processor priority. Interrupts with the same or lower priority are blocked. T is the trace trap bit. If set the processor traps to location 014. N, Z, V and C are the arithmetic flags.

The programmed interrupt request register is used to trigger interrupts under program control:

      15  14  13  12  11  10  9   8   7   6   5   4   3   2   1   0
     `+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+
     |IR7|IR6|IR5|IR4|IR3|IR2|IR1| . |InterrLevel|   |InterrLevel| . |
     +---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+

The IR1...IR7 fields can be set under program control and request an interrupt of the corresponding priority. The two InterrLevel fields contain the binary encoding of the highest bit set in the upper byte and are read-only.

The CPU error register contains bits that are set when a trap to location 4 occurres. The bits are accumulativ, i.e. they are cleared only when the register is written by the processor (Note, that the register is always cleared whatever value is written).

      15  14  13  12  11  10  9   8   7   6   5   4   3   2   1   0
     +---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+
     | . | . | . | . | . | . | . | . |Hlt|Odd|Mem|I/O| . | . | . | . |
     +---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+

Hlt indicates the executing of a HALT instruction in a mode other then kernel mode.  Odd is set when an odd address trap occurres.  Mem indicates a non-existing memory access. I/O is set when a I/O pages address does not respond.

The maintenance register allows to read in the jumper settings on the KDJ11A board. The following bits are defined:

      15  14  13  12  11  10  9   8   7   6   5   4   3   2   1   0
     +---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+
     |    User Boot Address      |FPA|  Module Ident |Hlt|BootOpt|POK|
     +---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+

POK is the power OK bit. This bit is initially set by the processor and can be cleared by the x command in the monitor or when the monitor is entered while the emulator is running in background mode (this may happen on double traps or HALT instructions). If the bit is cleared a trap to location 024 is executed. BootOpt determines what should happen on start-up. The following options are implemented: 00 -- vector to 024, 01 -- enter the monitor, 10 -- power up to 173000 and 11 -- power up to user boot address. Module Ident contains the fixed value of 0001. FPA is always 0 and denotes that no floating point accelerator is available.  The remaining bits contain the user's boot address. These bits are loaded directly into the corresponding bits of the PC, the lower bits are set to zero to construct the boot address.

The KDJ11A normally has no console switch register. For convinience, however, it is implemented but can be disabled (see KDJ11A monitor commands). If a values is written to the register that is different from the current one the new value is printed in octal on the emulators console. The switches that are readable under program control can be set from the monitor (see KDJ11A monitor commands).

The line clock control register contains only the interrupt enable bit for the line clock. The clock tick rate is initially set to 50 Hz but can be changed within the configuration file (see KDJ11A configuration):

      15  14  13  12  11  10  9   8   7   6   5   4   3   2   1   0
     +---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+
     | . | . | . | . | . | . | . | . | . |IEN| . | . | . | . | . | . |
     +---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+

If IEN is set the clock will interrupt to vector 0100.

Memory emulation
================

The memory system implements the following registers:

017777572
     memory management register 0

017777574
     memory management register 1

017777576
     memory management register 2

017772516
     memory management register 3

017777744
     memory system error register

017777746
     cache control register

017777752
     hit/miss register

017772300 - 017772316
     kernel I-space page descriptor registers

017772320 - 017772336
     kernel D-space page descriptor registers

017772340 - 017772356
     kernel I-space page address registers

017772360 - 017772376
     kernel D-space page address registers

017772200 - 017772216
     supervisor I-space page descriptor registers

017772220 - 017772236
     supervisor D-space page descriptor registers

017772240 - 017772256
     supervisor I-space page address registers

017772260 - 017772276
     supervisor D-space page address registers

017777600 - 017777616
     user I-space page descriptor registers

017777620 - 017777636
     user D-space page descriptor registers

017777640 - 017777656
     user I-space page address registers

017777660 - 017777676
     user D-space page address registers

The addresses of these registers are fixed and can be changed only at compile time.

The memory management register has the following format:

      15  14  13  12  11  10  9   8   7   6   5   4   3   2   1   0
     +---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+
     |ANR|APL|ARO| . | . | . | . |MAI| . |AboMode|Spc|PageNumber |ENB|
     +---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+

The bits ANR (abort non-resident), APL (abort page length) and ARO (abort read-only) are set when a memory access error occures. These bits can also be set under program control. If any of the abort bits is set the memory management registers are frozen to facilitate recovery from the abort situation. The maintenance bit MAI is not implemented. In case of an abort AboMode, Spc and PageNumber are set to the current processor mode, the address space of the access (1 for D-space and 0 for I-space) and the aborting page number. ENB enables memory management if set.

MMR1 records the changes made to the general purpose registers during the current command because of auto-increment and auto-decrement modes. In the case of a memory access abort this register is frozen to simplify register backup.

      15  14  13  12  11  10  9   8   7   6   5   4   3   2   1   0
     +---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+
     |    dest-amount    |  dest-reg |   source-amount   | source-reg|
     +---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+

dest-reg and source-reg contain the register numbers of the registers modified in the last instruction. dest-amount and source-amount are interpreted as 5-bit signed numbers. These number should be subtracted from the register value to get the value of the register just before the aborted instruction started. Note, that changes to the PC are not recorded. The PC is backed up by MMR2.

MMR2 is loaded with the virtual PC of each instruction just before the instruction starts. If a memory access abort occures the register is frozen, thus MMR2 points to the offending instruction.

MMR3 controls the 22-bit and seperate I/D space mapping:

      15  14  13  12  11  10  9   8   7   6   5   4   3   2   1   0
     +---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+
     | . | . | . | . | . | . | . | . | . | . |IOM|22B| . | K | S | U |
     +---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+

IOM is not implemented in the emulator. 22B enables 22-bit mapping (provided that MMR0 bit 0 is also set). If memory mangement is enabled but 22B is off, 18-bit mapping is used. K, S and U enable seperate I/D space for kernel mode, supervisor mode and user mode resp.

The memory system error register reads as zero, writes are ignored.

The cache control register is implemented in mem_cache. In mem_small bits 03377 can be written and red back but are ignored.

      15  14  13  12  11  10  9   8   7   6   5   4   3   2   1   0
     +---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+
     | . | . | . | . | . | ? | ? |Fls| ? | ? |Ds0|Ds1| ? | ? | ? | ? |
     +---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+

The following description holds for mem_cache. If the Fls is written as 1 the cache is flushed. If one of the bits Ds0 or Ds1 are set the cache is disabled. All other bits are ignored.

The cache hit/miss register always reads back as zero. Writes are ignored.

RLV12 emulation
===============

The RLV12 device emulates a RLV12 controller with up to 4 RL02 disks. The emulated RLV12 does not try to emulate the timing of the real drives. Instead it works synchronuosly. This means that for the program the executing of a command occures almost instantely.

The following i/o space registers are implemented (these are run-time configurable):

017774400
     Control/status register.

17774402
     Bus address register.

17774404
     Disk address register.

17774406
     Multipurpose register.

17774410
     Bus address extension register.

The control and status register has the following format:

      15  14  13  12  11  10  9   8   7   6   5   4   3   2   1   0
     +---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+
     |ERR|DER|ER2|ER1|ER0|OPI|DrivSel|RDY|IEN| BAExt | Function  |DRY|
     +---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+

DRY is the drive ready bit and reads as 1 if the selected drive is loaded, as 0 if it is not loaded. Function is the function code (see next table). BAExt are bus address bits 16 and 17. If IEN is set the controller wil generate interrupts. RDY is the controller ready bit. DrivSel selects one of up to 8 drives. OPI and ER0...ER2 contain an error code in case of an error. DER is set on volume-check and write-lock errors. ERR is set, if any of the other error bits is set.

The following functions are implemented:

000
     Maintenance mode. This is a NOP in the emulator.

001
     Write check.

010
     Get status.

011
     Seek.

100
     Read header.

101
     Write data.

110
     Read data.

111
     Read data without header check.

The error bits E0...E2 and OPI may be set as follows:

0001
     Non-existent drive. Illegal sector number. Trying an implicit seek in mid-transfer. No disk loaded.

1000
     Non-existent memory.

0101
     Implicit seek.

The bus address register is read-write except for bit 0, which always reads as 0 and cannot be written.

The format of the disk address register is different for the seek and the read, write or write check functions. For the seek function it is:

      15  14  13  12  11  10  9   8   7   6   5   4   3   2   1   0
     +---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+
     |        Cylinder Difference        | . | . |HDS| 0 |DIR| 0 | 1 |
     +---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+

The Cylinder Difference field contains the number of cylinders to seek. HDS is the head select bit and DIR denotes the direction of the seek (1 - seek to higher cylinders, 0 - seek to lower cylinders). Bits 3, 1 and 0 must have the indicated value.

For the other functions the register has the following format:

      15  14  13  12  11  10  9   8   7   6   5   4   3   2   1   0
     +---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+
     |          Cylinder address         |HDS|     Sector address    |
     +---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+

Cylinder address and Sector address hold the cylinder resp. sector number; HDS is the head select bit.

The format of the Multipurpose register depends on the function. For the Get Status function the following value must be written:

      15  14  13  12  11  10  9   8   7   6   5   4   3   2   1   0
     +---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+
     | . | . | . | . | . | . | . | . | 0 | 0 | 0 | 0 |RST| 0 | 1 | 1 |
     +---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+

If RST is set the drive is reset to status (BHO|HDO|RL2) and a load state of 101 (lock on) if no disk is loaded in the selected drive; to (BHO|RL2) and load state 000 (loaded) if a disk is loaded. Bits 0...2 and 4...7 must have the indicated value.

For data transfer commands the word count as the 2's complement should be written to the MPR.

For the Read Header function three words can be red out from the MPR. The first contains the current disk address in the same format as the disk address register for read, write or read header. The second word is zero and the third word contains a fake CRC of 0123456.

The Get Status returns the following word in the MPR:

      15  14  13  12  11  10  9   8   7   6   5   4   3   2   1   0
     +---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+
     |WER|HCE|WEL|STO|SPE|WGE|VCH|DSE|RL2|HDS|COO|HDO|BHO| LoadState |
     +---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+

Bits 15, 14, 12...10, 8 and 5 always read as 0. WEL is set if the write lock is set. VCH is set if a disk is loaded into a drive, cleared with a Get Status function with the reset bit set. RL2 reads always as 1. HDS is the currently selected head on the drive. BHO is set if no disk is loaded. LoadState is either 101 if no disk is loaded or 000 if it is loaded.

The bus address extension register is a 6-bit register containing bits 18-21 of the bus address for data transfer functions.

RHV70 emulation
===============

The RHV70 device emulates a RHV70 massbus controller with up to 8 RP06 disks.  The emulated RHV70 does not try to emulate the timing of the real drives.  Instead it works synchronuosly. This means that for the program the executing of a command occures almost instantely.

RK11 emulation
==============

KL11 emulation
==============

Line printer parallel interface emulation
=========================================

TM11 emulation
==============

MRV12 boot PROM emulation
=========================

DEQNA emulation
===============

The Begemot boot PROM
*********************

The HELP command
================

The BOOT command
================

The MEMORY command
==================

Boot PROM implementation notes
==============================

p11 implementation notes
************************

The instruction table file
==========================

The device interface
====================

KL11 serial line driver programs
================================

DEQNA ethernet driver programs
==============================

LP driver programs
==================

Memory interface
================

Miscellaneous programs and scripts
**********************************

Disk format program fmt
=======================

Building and porting p11
************************

Building for supported architectures
====================================

Porting to unsupported architectures
====================================

Performance and compatibility
*****************************

Acknowledgements
****************