[TUHS] Does anybody recall how the TU10 bootstrap code actually operates?

[TUHS] Does anybody recall how the TU10 bootstrap code actually operates?

[Noel Chiappa]

    > Thank you for responding so carefully.

The devil is in the details...

    > I have been reading the PDP-11/40 handbook, much too much :)

I'm not sure that's possible! :-)

Yes, yes, I know, the architecture is deader than a doornail for serious use,
but I liken it to sailing vessels: nobody uses them for serious cargo haul any
more, but they are still much beloved (and for good reasons, IMO).

The PDP-11 is an incredibly elegant architecture, perhaps the best ever (IMO),
which remains one of the very best examples ever of how to get 30 pounds into
the proverbial ten-pount sack - like early UNIX (more below).

    > this is really elegant code. The guys who thought this up were amazing.

Nah, it's just a clever hack (small-scale).  What is really, almost
un-approachably, brilliant about early UNIX is the amount of functionality
they got into such a small machine.

It's hard to really appreciate, now, the impact UNIX had when it first
appeared on the scene: just as it's impossible for people who didn't
themselves actually experience the pre-Internet world to _really_ appreciate
what it was like (even turning off all one's computers for a day only
approximates it). I think only people who lived with prior 'small computer
OS's' could really grasp what a giant leap it was, compared to what came
before.

I remember first being shown it in circa 1975 or so, and just being utterly
blown away: the ability to trivially add arbitrary commands, I/O redirection,
invisibly mountable sections of the directory tree - the list just goes on and
on. Heck, it was better than all but a few 'big machine' OS's!

    > Thanks again for your help.

Eh, de nada.

	Noel

[TUHS] Does anybody recall how the TU10 bootstrap code actually operates?

[Larry McVoy]

On Wed, Dec 23, 2015 at 01:02:48PM -0500, Noel Chiappa wrote:
> Yes, yes, I know, the architecture is deader than a doornail for serious use,
> but I liken it to sailing vessels: nobody uses them for serious cargo haul any
> more, but they are still much beloved (and for good reasons, IMO).
> 
> The PDP-11 is an incredibly elegant architecture, perhaps the best ever (IMO),
> which remains one of the very best examples ever of how to get 30 pounds into
> the proverbial ten-pount sack - like early UNIX (more below).

Amen.

[TUHS] Does anybody recall how the TU10 bootstrap code actually operates?

[Clem Cole]

+1

On Wed, Dec 23, 2015 at 1:06 PM, Larry McVoy <lm at mcvoy.com> wrote:

> On Wed, Dec 23, 2015 at 01:02:48PM -0500, Noel Chiappa wrote:
> > Yes, yes, I know, the architecture is deader than a doornail for serious
> use,
> > but I liken it to sailing vessels: nobody uses them for serious cargo
> haul any
> > more, but they are still much beloved (and for good reasons, IMO).
> >
> > The PDP-11 is an incredibly elegant architecture, perhaps the best ever
> (IMO),
> > which remains one of the very best examples ever of how to get 30 pounds
> into
> > the proverbial ten-pount sack - like early UNIX (more below).
>
> Amen.
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://minnie.tuhs.org/pipermail/tuhs/attachments/20151223/92072906/attachment.html>

[TUHS] Does anybody recall how the TU10 bootstrap code actually operates?

[Noel Chiappa]

    > From: Will Senn

    > 000777  HALT

That's actually "BR ."; the difference is important, since the CPU (IIRC)
doesn't honour DMA requests when it is halted, and DMA needs to be working for
the controller to read that first block (a secondary tape bootstrap) into
memory.

    > This seems like gobbledegook to me.

:-)

    > It moves the MTCMA (Magtape Current Memory Address) into R0, then it
    > moves the MTCMA into the MTBRC (Magtape Byte Record Count)

"The address of the MTCMA into", etc. Looking quickly at the programming spec
for the TM11 controllers, it wants a negative of the byte count to transfer in
this register; the address of the MTCMA just happens to also be a large enough
negative number to be usable as the (negative) size of the transfer request.
(The first record is probably shorter than that, but that doesn't matter.)

Note that this code could probably also have been written:

    MOV #172524, R0
    MOV R0, at R0

and been equally functional.

    > then it moves 60003 into the MTC (Magtape control register), which
    > causes a read operation with 800BPI 9 Channel density.

I'm too lazy to look at the programming spec for the details, but that sounds
right.

    > Am I misinterpreting the byte codes or is this some idiosyncratic way to
    > get the Magnetic tape to rewind or something (the TM11 has a control
    > function to rewind, so it seems unlikely that this is the case

No, it's just the shortest possible program to read the first block off the
tape.

It depends on i) the operator having manually set the tape to the right point
(the start of the tape), so that it's the first block that gets read, and ii)
the fact that the reset performed by hitting the 'Start' key on the CPU clears
the TM11 registers, including the Current Memory Address register, so the
block that's read is read into memory location zero.

Hence the direction to 'once the tape has stopped moving, re-start the CPU at
0'.

	Noel

[TUHS] Does anybody recall how the TU10 bootstrap code actually operates?

[Will Senn]

Noel,

Comments inline. This has got to be the most helpful mailing list ever. 
Thank you for responding so carefully.

On 12/23/15 12:59 AM, Noel Chiappa wrote:
>      > From: Will Senn
>
>      > 000777  HALT
>
> That's actually "BR ."; the difference is important, since the CPU (IIRC)
> doesn't honour DMA requests when it is halted, and DMA needs to be working for
> the controller to read that first block (a secondary tape bootstrap) into
> memory.

This one, I worked through in my dreams :). I woke up this morning with 
the full-fledged thought, 000777 isn't halt, it's a branch to the new PC 
+ (2 * offset,  377) - I have been reading the PDP-11/40 handbook, much 
too much :):

0004 BR to PC+2 + (2* Offset of the next six bits, 377)
  3   7   7 - offset in octal
11 111 111 - binary equivalent
00 000 000 - 1's complement
00 000 001 - 2's complement
----------
         -1

So: BR, PC+2 +( 2 * - 1), or .+2-2, or BR . as you say.

>      > This seems like gobbledegook to me.
>
> :-)
>
>      > It moves the MTCMA (Magtape Current Memory Address) into R0, then it
>      > moves the MTCMA into the MTBRC (Magtape Byte Record Count)
>
> "The address of the MTCMA into", etc. Looking quickly at the programming spec
> for the TM11 controllers, it wants a negative of the byte count to transfer in
> this register; the address of the MTCMA just happens to also be a large enough
> negative number to be usable as the (negative) size of the transfer request.
> (The first record is probably shorter than that, but that doesn't matter.)
>
> Note that this code could probably also have been written:
>
>      MOV #172524, R0
>      MOV R0, at R0
>
> and been equally functional.
>
>      > then it moves 60003 into the MTC (Magtape control register), which
>      > causes a read operation with 800BPI 9 Channel density.
>
> I'm too lazy to look at the programming spec for the details, but that sounds
> right.
>
>      > Am I misinterpreting the byte codes or is this some idiosyncratic way to
>      > get the Magnetic tape to rewind or something (the TM11 has a control
>      > function to rewind, so it seems unlikely that this is the case
>
> No, it's just the shortest possible program to read the first block off the
> tape.
Actually, after reflecting on your comments and walking through it 
again, this is really elegant code. The guys who thought this up were 
amazing.  Using the MTCMA is brilliant, as you said, it's a big enough 
negative value to cause the entire block to be read, but it's also the 
value that is used to obtain the destination for that byte count through 
it's decrement and further, to obtain the destination for the command to 
read the data after it's second decrement.
> It depends on i) the operator having manually set the tape to the right point
> (the start of the tape), so that it's the first block that gets read, and ii)
> the fact that the reset performed by hitting the 'Start' key on the CPU clears
> the TM11 registers, including the Current Memory Address register, so the
> block that's read is read into memory location zero.
>
> Hence the direction to 'once the tape has stopped moving, re-start the CPU at
> 0'.
>
> 	Noel
In order to test this and armed with my newfound knowledge, I fired up 
SimH and attached the v6 distribution tape and set it locked for read 
only. I examined memory from 0-100, which was empty. I then deposited 
the bootstrap and ran it. It hung, allowing the NPR. I then stopped the 
CPU with CTRL-E and examined the memory starting at location 0, voila, a 
407 program starting at byte 0. My understanding at this point is that 
the program never touches MTCMA (other than to use it for the byte count 
and decrements) so it is initially 0 based on how SimH works and the 
program simply reads the first block into memory in location 0 and hangs 
until the simulator is suspended.

The next step in the install is to g 0, which runs a program that prints 
the = prompt to which tmrk is a reasonable response. I gather the 407 
program is some kind of minimalist shell that includes tmrk as one of 
its commands.

Thanks again for your help.

Will

[TUHS] Does anybody recall how the TU10 bootstrap code actually operates?

[John Cowan]

Will Senn scripsit:

> Actually, after reflecting on your comments and walking through it
> again, this is really elegant code. The guys who thought this up
> were amazing.  

As usual, they were standing on the shoulders of giants.  The OS/8
bootstrap (on the PDP-8) for the RK8E disk controller was even more
elegant, only two instructions long and requiring no further operator
actions but "clear" and "start".  The first instruction simply read
the current block into the current memory address, which because of
the "clear" read block 0 into memory location 0; the second was also
a branch-to-self.

But the real cleverness was that the bootstrap was placed at locations
30 and 31.  As the disk block was read in by DMA, location 30 was
overwritten with the "skip if disk is ready" instruction and location
31 with "branch to previous location".  So first the CPU was idling in
a one-instruction infinite loop, then in a two-instruction loop as long
as the block was still loading, and finally would continue executing at
location 32 when the disk bootstrap was fully loaded.  The code there
loaded the full device driver for the RK8E into reserved memory at
07600-07777 and jumped to the code within it that loaded the Keyboard
Monitor (the shell) at location 0 and jumped into it.

-- 
John Cowan          http://www.ccil.org/~cowan        cowan at ccil.org
A rose by any other name may smell as sweet, but if you called it
an onion you'd get cooks very confused.          --RMS

[TUHS] Does anybody recall how the TU10 bootstrap code actually operates?

[Ronald Natalie]

[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #1: Type: text/plain, Size: 887 bytes --]

Noel is correct.   The code sticks a number that’s big enough in the byte record count register and then does a  command which is
800 bpi 9 track READ and GO.   The code makes use of the fact that after a bus reset the memory address register is zero.

As long as you stick a number in the BRC that is bigger than the the record size on the tape (and not bigger than the available memory on your system),
it will work.

777 is indeed BR .

It loads the first (assuming the tape is rewound) record into memory at location zero.
You then start the processor at zero to load that bootstrap program which does the rest of the magic.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 2284 bytes
Desc: not available
URL: <http://minnie.tuhs.org/pipermail/tuhs/attachments/20151224/33147fcd/attachment.bin>

[TUHS] Does anybody recall how the TU10 bootstrap code actually operates?

[Will Senn]

[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #1: Type: text/plain, Size: 3106 bytes --]

All,

I am in the process of gaining a deeper understanding of PDP-11 machine 
instructions and how the bootstrap loader and its cousins function. As 
part of that process, I am analyzing the code. I am concurrently working 
through the DEC bootstrap loader and the bootstrap loader that is 
described in the v6 documentation. The DEC bootstrap loader, while 
fascinating and elegant, is relatively straightforward, given its 
enormous range and the fact that it is self-modifying. I wrote up my 
preliminary notes here:

http://decuser.blogspot.com/2015/12/analysis-of-pdp-11-bootloader-code.html

The code that is in the v6 documentation on the other hand is not 
yielding easily to reasonable interpretation and I was hoping y'all 
might be able to shed some light on how it works.

The following is the TU10 (TM11) bootstrap code from "Setting Up Unix - 
Sixth Edition":
TU10
012700
172526
010040
012740
060003
000777

The author's notes around the code are:
The tape should move and the CPU loop. (The TU10 code is not the DEC 
bulk ROM for tape; it reads block 0, not block 1.)
Halt and restart the CPU at 0. The tape should rewind. The console 
should type ‘=’.

Of course, following the instructions results in a successful outcome, 
but understanding what is happening is difficult given that this is a 
virtual environment and no discernible tape movement can be detected.

My attempt at interpretation is along the following lines, I 
manufactured the dissasembly based on my reading of the PDP-11/40 
handbook and the machine codes:

012700  MOV #172526, R0 ; moves the TM11 Current Memory Address Register 
(MTCMA) address into R0
172526                                  ; the immediate operand
010040  MOV R0,-(R0)        ; moves the contents of R0, 172526, into 
memory location 172524, the TM11 Byte Record Counter (MTBRC)
012740  MOV #60003,-(R0); moves 60003 into memory location 172522, the 
TM11 Command Register (MTC)
060003                                   ; immediate data
000777  HALT

This seems like gobbledegook to me. It moves the MTCMA (Magtape Current 
Memory Address) into R0, then it moves the MTCMA into the MTBRC (Magtape 
Byte Record Count), then it moves 60003 into the MTC (Magtape control 
register), which causes a read operation with 800BPI 9 Channel density. 
172526 is -5252 in 2's complement.

Am I misinterpreting the byte codes or is this some idiosyncratic way to 
get the Magnetic tape to rewind or something (the TM11 has a control 
function to rewind, so it seems unlikely that this is the case, but I'm 
mystified)?

I single stepped through the code in the simulator, and the TM11 
registers appear to be pretty unobservable (examining these three 
registers always displays 0's, but if I change from referencing the TM11 
registers to another area of memory, say 100500 I see the values I would 
expect to see as they are being moved from the registers into memory).

Thanks,

Will
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://minnie.tuhs.org/pipermail/tuhs/attachments/20151223/6f3fefdc/attachment.html>