CDC 1700 emulator added to SIMH

For those of us, who have never heard of the CD 1700, there is a brief page on wikipedia:

And from the announcement on the SIMH mailing list:

For the past couple of years or so, I have been working on a SIMH-based
simulator for the CDC1700 series, a 16-bit system from the mid-1960’s, using
the documentation and software available at bitsavers. It has now sufficiently
stable to allow others to make use ot the software. The base system implements:

  • a 1714 CPU with:
    • 1705 multi-level interrupts and direct storage access bus
    • up to 32KW of memory
    • memory protect system
    • Optional 64KW support
  • 1711-A teletypewriter
  • 1721-A paper tape reader
  • 1723-A paper tape punch
  • 1740 or 1742-30 line printer
  • 1738-B disk pack controller with up to 2 disk packs:
    (853 disk pack – 1.5MW)
    (854 disk pack – 3.0MW)
  • 1733-2 cartridge disk controller with up to 4 drives:
    Each drive has 1 fixed disk and 1 removeable disk:
    (856-2 CDD – 1.13MW per disk)
    (856-4 CDD – 2.25MW per disk)
  • 1732-A or 1732-3 magtape controller with 4 transports

The simulator is able to boot the diagnostic tape (SYSTEM17_SMM_DIAGS.TAP at and successfully execute tests for each of the above
components. Some test sections fail due to various reasons; lack of
documentation, timing issues, feature not implemented etc.

The simulator is also able to boot and install MSOS 5 from an installation
tape (MSOS5_SL136.tap at onto a 1733-2 cartridge drive. This
is a copy of a distribution tape provided by CDC to run on a 64KW system at

I would like to thank Doug Gwyn for answering questions about the system
architecture and providing details about specific diagnostics tests and
Al Kossow for for peripheral documentation so that I could get MSOS 5

So today I came across a ‘new’ 4.1 BSD tape on bitsavers:

4.1 BSD tape

4.1 BSD tape

The label is dated 7/10/81, so I thought this would be fun to install on SIMH.  I chose with the starunix 4.0BSD as a starting point thinking that this should be close enough to boot up 4.1.  However I could not get the boot code to correctly work.  So failing that, I went ahead and ran the 4.0 mkfs, and restor programs, and then swapped tapes to the 4.1 to restore it’s root. dump.  And using the 4.0 disk boot program it worked pretty well!

So I went ahead, and extracted the boot program from the 4.0 tape, and rebuilt the 4.1 tape with the 4.0 standalone boot programs so you can install it from SIMH, if you want to cook up your own install.  You can download it from my site (read the 404 message for the current password) or from sourceforge.

And for those of you who like dmesg output:


VAX 11/780 simulator V4.0-0 Beta        git commit id: b8049645

: hp(0,0)vmunix
123060+27528+24628 start 0xF5C
Berkeley VAX/UNIX Version 4.9  Wed Feb 17 15:27:46 PST 1982
real mem  = 8322048
avail mem = 7738368
mcr0 at tr1
mcr1 at tr2
uba0 at tr3
dz0 at uba0 csr 160100 vec 300, ipl 15
mba0 at tr8
hp0 at mba0 drive 0
hp1 at mba0 drive 1
hp2 at mba0 drive 2
hp3 at mba0 drive 3
mba1 at tr9
ht0 at mba1 drive 0
tu0 at ht0 slave 0
tu1 at ht0 slave 1
root on hp0
WARNING: clock lost 153 days -- CHECK AND RESET THE DATE!
WARNING: should run interleaved swap with >= 2Mb
Automatic reboot in progress...
Mon Feb  2 00:59:55 GMT 1976
/dev/hp0a: 676 files 4278 blocks 3345 free
/dev/rhp0g: 3605 files 18925 blocks 122653 free
Mon Feb  2 00:59:56 GMT 1976
Mounted /usr on /dev/hp0g
preserving editor files
clearing /tmp
starting daemons: update cron accounting network mail printer.
Mon Feb  2 00:59:56 GMT 1976

Berkeley 4.1 VAX/UNIX (Amnesia-Vax)

login: root

Welcome to Berkeley Vax/UNIX (4.1bsd revised 1 Sept. 1981)
Erase is delete
Kill is control-U

For the brave the direct link is here to the original tape image on bitsavers.


SIMH on demand!

Ok starting with my shellinabox post, I’ve expanded to include SIMH’s Altair emulator!

CP/M 2.2 in a box!

CP/M 2.2 in a box!

Executing this is really simple!  A small shell script will take care of the whole thing.

set -m
mkdir /tmp/$PID
cd /tmp/$PID
cp /usr/local/altair/1.ini .
cp /usr/local/altair/cpm22.dsk .
/usr/local/altair/altair 1.ini
cd /tmp
rm -rf /tmp/$PID

Of course I’m assuming dead processes get reaped.  But check it out!

I’ve put BASIC-80 rev 5.21 and ZORK I in there!

Some advice on SIMH thought, you can execute a shell with the ! command (hitting Control-E will interrupt SIMH) so to prevent that alter the line in scp.c to make sure it’s a noop_cmd instead of spawn_cmd.  Not that anyone was doing anything sneaky as the nobody user, but to prevent it.

{ “!”, &noop_cmd, 0, HLP_SPAWN },

Also an ini file of:

attach dsk0 cpm22.dsk
set throttle 2%
go 177400

Keeps SIMH pretty tame.

Additionally I guess I should do a 12 hour cronjob to kill displaced altairs.

Setting up DECNet on VMS 4.7

Years ago, I was given an image of VMS 4.7.  I only tested it for idle capabilities, and that is as far as I got with it.  I never used it for anything else.

But today I needed to verify my Win32 Hecnet project works, so I needed to generate some legit DECNet traffic.  Luckily I still have the VMS image, and in the prevailing years I managed to get a copy of PathWorks for Windows NT (And one for MS-DOS as well!).

So googling around, I found blinkenbone who mentions the command needed to setup some DECNet love.  Now the one thing that is strange about DECNet is that the MAC address needs to be changed to the DECNet area & node id.  Thankfully there is an online calculator, powerdog.  Since I’m just testing, I’ll put my VAX in area 1, node 1, that means the VAX MAC needs to be set to:


So in SIMH, I just use the line:

set xq mac=AA-00-04-00-01-04

Cool.  Now I use ansicon, in the hopes it’ll make the console better, and fire up VMS.

VMS 4.7 booted

VMS 4.7 booted

And then login as system/manager

Now I can setup decnet very simply like this:

Username: SYSTEM
Welcome to VAX/VMS version V4.7
Last interactive login on Saturday, 20-SEP-2008 17:32
$ @sys$manager:netconfig

DECnet-VAX network configuration procedure

This procedure will help you define the parameters needed to get DECnet
running on this machine. You will be shown the changes before they are
executed, in case you wish to perform them manually.

What do you want your DECnet node name to be? : rabbit
What do you want your DECnet address to be? : 1.1
Do you want to operate as a router? [NO (nonrouting)]:
Do you want a default DECnet account? [YES]:

Here are the commands necessary to setup your system.

$ RUN SYS$SYSTEM:NCP ! Remove existing entry, if any
/UIC=[376,376] /ACCOUNT=DECNET –
Press RETURN to continue


Do you want to go ahead and do it? [YES]:
%UAF-I-ADDMSG, user record successfully added
%UAF-I-RDBADDMSGU, identifier DECNET value: [000376,000376] added to RIGHTSLIST.
%UAF-I-DONEMSG, system authorization file modified
%UAF-I-RDBDONEMSG, rights database modified
%NCP-I-NMLRSP, listener response – Success
Logging sink type = monitor
%NML-I-RECADDED, Database entry added

The changes have been made.

If you have not already installed the DECnet-VAX license, then do so now.

After the license has been installed, you should invoke the procedure
SYS$MANAGER:STARTNET.COM to startup DECnet-VAX with these changes.

(If the license is already installed) Do you want DECnet started? [YES]:
%%%%%%%%%%% OPCOM 28-OCT-1987 15:42:37.64 %%%%%%%%%%%
Message from user DECNET
DECnet starting

%RUN-S-PROC_ID, identification of created process is 00000109
%RUN-S-PROC_ID, identification of created process is 0000010B
%%%%%%%%%%% OPCOM 28-OCT-1987 15:42:42.67 %%%%%%%%%%%
Message from user DECNET
DECnet event 4.10, circuit up
From node 1.1 (RABBIT), 28-OCT-1987 15:42:37.69
Circuit QNA-0

It basically set itself up.

And on the Windows NT side, I simply set itself up as node 2 in area 1.

Windows NT + Pathworks

Windows NT + Pathworks

And now I can use CTERM to connect to the VAX.



Nice!.  And it even works through my port of HECNet.

On reboots you have to manually start the network.  I don’t have EDT, or I don’t know where to find it (remember the gold key? ugh).

Manually starting the network

Manually starting the network

But it’s a simple command:


And you are good to go!

Likewise shutting down is accomplished with this:


And that’s about all I know about VMS.  But it’s good to see that configuring this was pain free!

Wyse Telnet & Serial emulator

While messing around with SIMH & CP/M, I had some weird terminal issue, and wanted to try something that wasn’t ANSI.  So I thought I’d try to find a free Wyse 50/60 emulator, and as I kind of expected this type of emulation isn’t cheap.

But then I found, and they made their Win16 stuff free as in beer ware.  Well that sounds pretty good.  Even better is that WINE can still run Win16 applications!

WyseTerm on SIMH

WyseTerm on SIMH

The only real catch I’ve found is that it ONLY will telnet to port 23.

But yeah, a free Wyse terminal emulator.  So far as a CP/M console it seems to be running pretty well.


Somehow, I missed this as a ‘beta’ driver for the last public release of SIMH.

68k CP/M 1.2

68k CP/M 1.2

What makes the 68000 version of CP/M different from the i8080 version is that it was coded in C.  And of course 68k CP/M suffered the same problem every other processor incompatible ‘same os’ OS has ever suffered which is no applications.  But that is when I remembered the COM, which started out it’s life as an 8080 emulator for the 68000.  With a LOT of creative googlling, I managed to find the source, mysteriously labelled 8088M.ZIP.  I also found a binary here. But unfortunately that is as far as I got.  I haven’t managed to figure out a way to inject files into the SAGE CP/M IMD disk images.

So this is where I’m stuck, and this is my call for help.  If anyone knows how to get files in/out of these IMD files give me a shout.  For anyone interested in 68k CP/M this is your chance to get it running.

The one funny thing I found in a hex editor of the disk image was this:

Screen Shot 2013-12-05 at 12.20.20 AM

Cryptic message

Oh well.



Never mind, me and a friend of mine (hi Lorenzo!) got the disk image thing figured out!

Qemu enters the 1.7 testing phase

I built 1.7rc2 on OSX, and I’ve only tested the x86 portion… x86_64 of course still fails on vista & friends… 2003 of course hangs at “starting windows” so no progress there.  I haven’t tried any MIPS, PowerPC, or SPARC things…

Also the Adlib/SoundBlaster is still broken in this release, there is a source change in adlib.c that has to be made.  Also I just noticed that IRQ sharing works in ISA mode again, so the Ne2000 can go back to 0x300 IRQ 9.

Also speaking of emulation, I was thinking of shoving a VAX-11/780 into the world for the heck of it.  Although I don’t think anyone would care.  I’ll have to dig out the source to 4.3 and give the shell the ability to add new users.  I wrote it once, and I fear I’ve lost those changes but it was cool for something back then.

Anyways post back here if you want an account on !

So a few things …

So after this comment, I decided to put a SIMH VAX running 4.3 BSD.  Back in the day, I used to keep a bunch of legacy systems online for the heck of it.  Although I don’t think it ever really took off.. But yeah I figured I should get something back online.

So this time I thought I’d make it somewhat.. different.. So anyways if you feel so inclined go ahead and telnet to

And from there you can create a user account on the mud, and then it’ll create a user in the operating system.


I’ve loaded up a bunch of 3rd party stuff.. And since we are living in the past I managed to get the old news reader ‘rn’ to talk to  The first time it runs it’ll complain a bunch but there isn’t much you can do except enjoy the ride.

Lynx is present but.. downloading stuff kind of stalls.

All I ask is you play nice.

I’ve added in the flash telnet app.

Some minor work on SIMH

So it’d been a while since I’ve booted it up, and I just went with the 3.8-2 rc2 release (I forget did that version ever get released..?) Anyways since I wanted to run my SIMH instance under a Linux VM..

Soooo I went through some fun to recompile it as a 32bit binary, as the slirp doesn’t work on 64bit machines..

I just built the 11/780 emulator as I wanted to run 4.3 UWisc on my VM (in a VM)..

You can download the build here.

As a reminder the installation instructions for 4.3 BSD Uwisc can be found on gunkies, and all the files needed are on sourceforge.  Also the 4.x BSD if_de.c driver errors out on receiving packets, and I’ve found it easier to just remove the error checking from the driver, and recompile the kernel and just boot that up.

I’m thinking of rebuilding the login process on 4.3 BSD to bring back AberMud, and self service user creation.  Years ago I used to host all kinds of ancient UNIX, and I’d like to bring back at least one..

SIMH 3.9-0 released!

And among the changes …


  • added *nix READLINE support (Mark Pizzolato)
  • fixed handling of DO with no arguments (Dave Bryan)
  • fixed “SHOW DEVICE” with only one enabled unit (Dave Bryan)
  • clarified some help messages (Mark Pizzolato)
  • added “SHOW SHOW” and “SHOW <dev> SHOW” commands (Mark Pizzolato)
  • fixed bug in deposit stride for numeric input (John Dundas)


  • added support for BREAK key on Windows (Mark Pizzolato)


  • major revision (Dave Hittner and Mark Pizzolato)
  • fixed array overrun which caused SEGFAULT on hosts with many devices which libpcap can access.
  • fixed duplicate MAC address detection to work reliably on switch connected LANs


  • made telnet option negotiation more reliable, VAX simulator now works with PuTTY as console (Mark Pizzolato)


  • fixed bugs in MPY, DIV introduced in 3.8-1 (from Theo Engel)
  • fixed bugs in double precision, normalization, SC (from Adrian Wise)
  • fixed XR behavior (from Adrian Wise)

hp2100 all peripherals (Dave Bryan):

  • Changed I/O signal handlers for newly revised signal model
  • Deprecated DEVNO modifier in favor of SC

hp2100_cpu.c (Dave Bryan):

  • Minor speedup in “is_mapped”
  • Added casts to cpu_mod, dmasio, dmapio, cpu_reset, dma_reset
  • Fixed I/O return status bug for DMA cycles
  • Failed I/O cycles now stop on failing instruction
  • Revised DMA for new multi-card paradigm
  • Consolidated DMA reset routines
  • DMA channels renamed from 0,1 to 1,2 to match documentation
  • Changed I/O instructions, handlers, and DMA for revised signal model
  • Changed I/O dispatch table to use DIB pointers
  • Removed DMA latency counter
  • Fixed DMA requests to enable stealing every cycle
  • Fixed DMA priority for channel 1 over channel 2
  • Corrected comments for “cpu_set_idle”


  • Changed declarations for VMS compiler

hp2100_cpu0.c (Dave Bryan):

  • Removed DS note regarding PIF card (is now implemented)

hp2100_cpu4.c (Dave Bryan):

  • Added OPSIZE casts to fp_accum calls in .FPWR/.TPWR

hp2100_cpu5.c (Dave Bryan):

  • Added sign extension for dim count in “cpu_ema_resolve”
  • Eliminated unused variable in “cpu_ema_vset”

hp2100_cpu6.c (Dave Bryan):

  • DMA channels renamed from 0,1 to 1,2 to match documentation

hp2100_cpu7.c (Dave Bryan):

  • Corrected “opsize” parameter type in vis_abs

hp2100_defs.h (Dave Bryan):

  • Added hp_setsc, hp_showsc functions to support SC modifier
  • DMA channels renamed from 0,1 to 1,2 to match documentation
  • Revised I/O signal enum values for concurrent signals
  • Revised I/O macros for new signal handling
  • Added DA and DC device select code assignments

hp2100_di.c, hp2100_di.h (Dave Bryan):

  • Implemented 12821A HP-IB Disc Interface

hp2100_di_da.c (Dave Bryan):

  • Implemented 7906H/20H/25H ICD disc drives

hp2100_dp.c (Dave Bryan):

  • Added CNTLR_TYPE cast to dp_settype

hp2100_ds.c (Dave Bryan):

  • Rewritten to use the MAC/ICD disc controller library
  • ioIOO now notifies controller service of parameter output
  • Corrected SRQ generation and FIFO under/overrun detection
  • Corrected Clear command to conform to the hardware
  • Fixed Request Status to return Unit Unavailable if illegal
  • Seek and Cold Load Read now Seek Check if seek in progress
  • Remodeled command wait for seek completion
  • Corrected status returns for disabled drive, auto-seek beyond drive limits, Request Sector Address and Wakeup with invalid or offline unit
  • Address verification reenabled if auto-seek during
  • Read Without Verify

hp2100_fp1.c (Dave Bryan):

  • Added missing precision on constant “one” in fp_trun
  • Completed the comments for divide; no code changes

hp2100_ipl.c (Dave Bryan):

  • Added CARD_INDEX casts to dib.card_index
  • A failed STC may now be retried
  • Consolidated reporting of consecutive CRS signals
  • Revised for new multi-card paradigm

hp2100_lps.c (Dave Bryan):

  • Revised detection of CLC at last DMA cycle
  • Corrected 12566B (DIAG mode) jumper settings

hp2100_ms.c (Dave Bryan):

  • Added CNTLR_TYPE cast to ms_settype

hp2100_mt.c (Dave Bryan):

  • Removed redundant MTAB_VUN from “format” MTAB entry
  • Fixed command scanning error in mtcio ioIOO handler

hp2100_stddev.c (Dave Bryan):

  • Add TBG as a logical name for the CLK device

hp2100_sys.c (Dave Bryan):

  • Deprecated DEVNO in favor of SC
  • Added hp_setsc, hp_showsc functions to support SC modifier
  • Added DA and dummy DC devices
  • DMA channels renamed from 0,1 to 1,2 to match documentation
  • Changed DIB access for revised signal model

hp_disclib.c, hp_disclib.h (Dave Bryan)

  • Created MAC/ICD disc controller library


  • fixed read stacker operation in column binary mode
  • fixed punch stacker operation (Van Snyder)


  • fixed TT_GET_MODE test to use TTUF_MODE_x (Michael Bloom)
  • revised to use clock coscheduling

id_tt.c, id_ttc.p:

  • revised to use clock coscheduling


  • added clock coscheduling routine


  • reverted multiple tape indicator implementation
  • fixed EOT indicator test not to clear indicator (Van Snyder)
  • fixed divide not to clear word marks in quotient (Van Snyder)
  • revised divide algorithm (Van Snyder)


  • reverted multiple tape indicator implementation
  • fixed END indicator test not to clear indicator (Van Snyder)
  • fixed backspace over tapemark not to set EOR (Van Snyder)
  • added no rewind option (Van Snyder)


  • fixed misuse of & instead of && in decode (Peter Schorn)


  • fixed misuse of & instead of && in Ea_ch (Michael Bloom)


  • fixed unitialized variable in tty output service (Michael Bloom)


  • revised to use clock coscheduling


  • fixed priority of PIRQ vs IO; added INT_INTERNALn


  • fixed Qbus interrupts to treat all IO devices (except clock) as BR4
  • fixed order of int_internal (Jordi Guillaumes i Pons)


  • fixed bug in updating mem addr extension (Peter Schorn)


  • fixed bug in read header (Walter F Mueller)


  • added debug support


  • added RD32 support

pdp11_tq.c: (Mark Pizzolato)

  • set UNIT_SXC flag when a tape mark is encountered during forward motion read operations
  • fixed logic which clears UNIT_SXC to check command modifier
  • added CMF_WR flag to tq_cmf entry for OP_WTM
  • made non-immediate rewind positioning operations take 2 seconds
  • added UNIT_IDLE flag to tq units.
  • fixed debug output of tape file positions when they are 64b
  • added more debug output after positioning operations
  • added textual display of the command being performed
  • fixed comments about register addresses


  • fixed t_addr printouts for 64b big-endian systems (Mark Pizzolato)


  • fixed t_addr printouts for 64b big-endian systems (Mark Pizzolato)

pdp11_vh.c: (Mark Pizzolato)

  • fixed SET VH LINES=n to correctly adjust the number of lines available to be 8, 16, 24, or 32.
  • fixed performance issue avoiding redundant polling

pdp11_xq.c: (Mark Pizzolato)

  • Fixed missing information from save/restore which caused operations to not complete correctly after a restore until the OS reset the controller.
  • Added address conflict check during attach.
  • Fixed loopback processing to correctly handle forward packets.
  • Fixed interrupt dispatch issue which caused delivered packets (in and out) to sometimes not interrupt the CPU after processing.
  • Fixed the SCP visibile SA registers to always display the ROM mac address, even after it is changed by SET XQ MAC=.
  • Added changes so that the Console DELQA diagnostic (>>>TEST 82) will succeed.
  • Added DELQA-T (aka DELQA Plus) device emulation support.
  • Added dropped frame statistics to record when the receiver discards received packets due to the receiver being disabled, or due to the XQ device’s packet receive queue being full.
  • Fixed bug in receive processing when we’re not polling. This could cause receive processing to never be activated again if we don’t read all available packets via eth_read each time we get the opportunity.
  • Added the ability to Coalesce received packet interrupts. This is enabled by SET XQ POLL=DELAY=nnn where nnn is a number of microseconds to delay the triggering of an interrupt when a packet is received.
  • Added SET XQ POLL=DISABLE (aka SET XQ POLL=0) to operate without polling for packet read completion.
  • Changed the sanity and id timer mechanisms to use a separate timer unit so that transmit and recieve activities can be dealt with by the normal xq_svc routine.
  • Dynamically determine the timer polling rate based on the calibrated tmr_poll and clk_tps values of the simulator.
  • Enabled the SET XQ POLL to be meaningful if the simulator currently doesn’t support idling.
  • Changed xq_debug_setup to use sim_debug instead of printf so that all debug output goes to the same place.
  • Restored the call to xq_svc after all successful calls to eth_write to allow receive processing to happen before the next event service time. This must have been inadvertently commented out while other things were being tested.

pdp11_xu.c: (Mark Pizzolato)

  • Added SHOW XU FILTERS modifier (Dave Hittner)
  • Corrected SELFTEST command, enabling use by VMS 3.7, VMS 4.7, and Ultrix 1.1 (Dave Hittner)
  • Added address conflict check during attach.
  • Added loopback processing support
  • Fixed the fact that no broadcast packets were received by the DEUNA
  • Fixed transmitted packets to have the correct source MAC address.
  • Fixed incorrect address filter setting calling eth_filter().


  • added clock coscheduling
  • revised TTI to use clock coscheduling and to fix perpetual CAF bug


  • revised to use clock coscheduling


  • added clock coscheduling

pdp8_fpp.c: (Rick Murphy)

  • many bug fixes; now functional


  • revised to use clock coscheduling and to fix perpetual CAF bug


  • revised to use clock cosheduling


  • added link to FPP


  • fixed SDLC to clear AC (Dave Gesswein)


  • fixed bug in scan function decode (Peter Schorn)


  • revised idle design (Mark Pizzolato)
  • fixed bug in SET CPU IDLE
  • fixed failure to clear PSL<tp> in BPT, XFC


  • revised idle design Mark Pizzolato)
  • added VEC_QMODE test in interrupt handler


  • fixed integer overflow bug in EMODx (Camiel Vanderhoeven)
  • fixed POLYx normalizing before add mask bug (Camiel Vanderhoeven)
  • fixed missing arguments in 32b floating add (Mark Pizzolato)

vax_octa.c (Camiel Vanderhoeven)

  • fixed integer overflow bug in EMODH
  • fixed POLYH normalizing before add mask bug


  • revised to use clock coscheduling


  • fixed t_addr printouts for 64b big-endian systems (Mark Pizzolato)


  • added power clear call to boot routine (Mark Pizzolato)


  • added AUTORESTART switch support (Mark Pizzolato)


  • added REBOOT support (Mark Pizzolato)
  • revised to use clock coscheduling


  • moved all Qbus devices to BR4; deleted RP definitions


As always you can download it from the homepage, or from sourceforge.