Seth Morabito • A Weblog

3B2 Math Acceleration

Monday, September 10 2018 at 9:50 AM PDT

I recently started on a quest to finish up a loose end on the AT&T 3B2 emulator by finally implementing a simulation of the WE32106 Math Acceleration Unit (MAU). The MAU is an IC that accelerates floating point operations, and it could be fitted onto the 3B2 motherboard as an optional part. I've seen quite a few 3B2 systems that didn't have one; if it's not present, the 3B2 uses software floating point emulation, and gets on just fine without it. This means the 3B2 emulator is totally usable without the MAU. But still, wouldn't it be nice to simulate it?

Lucky for me, one of the critical pieces of documentation I've managed to find over the last few years is the WE32106 Math Acceleration Unit Information Manual. This little book describes the implementation details of the WE32106, and without it it would be hopeless to even try to simulate it. (Speaking of which: The book hasn't been scanned yet, which is a high priority. I have the only copy I've ever seen.)

But even with the book, this is no simple task. So let's dive in a little deeper and look under the hood of the WE32106.

Why I'm Leaving Twitter

Tuesday, September 4 2018 at 8:21 PM PDT


I've had a Twitter account since March of 2007. That's eleven years, going on twelve. I think that's enough.

When I started, Twitter was the simplest of services: you typed out up to 140 characters in a status box, clicked a button, and your tweet went into the linear timelines of all of your friends. If you really wanted to, you could directly message a friend. And that's it. That's all it was, the entirety of its functionality.

Eleven years later, Twitter doesn't look very much like it did back then. We're prevented from using our favorite third-party clients, bombarded with promoted tweets, shown randomly selected favorites from people we follow, fed mysteriously sorted timelines that go out of order, curated by algorithms that think they know better than we do, and perhaps worst of all, we're faced with a management that is singularly uninterested in being introspective about the negative aspects of its platform. It is, to put it bluntly, not fun any more.

There have been innumerable straws piled onto the camel's back over the last few years. Every new feature has made the platform worse. Bad actors go unpunished while good people are suspended without reason or warning. Jack has looked the other way at all of these warning signs, seemingly uncaring about the toll the changes are taking on its users.

The final straw, though, is the hostile attitude Twitter has taken toward policing its own rules. They are applied arbitrarily and capriciously, with the popularity of the account they're being applied to taken more heavily into account than the nature of the actual wrong-doing. It's ugly. And frankly, it's not something I want to be a part of any more.

There are things I'll miss about twitter, but what I really miss is a memory of long ago. Twitter looks nothing like that memory, now. It's time to move on to other things.

For the time being, you can follow me on mastodon at, but there's a good chance I won't be very active there. I'd suggest email and this blog as the best way of following what I'm up to.

Hard Disk Imaging

Monday, August 27 2018 at 11:00 AM PDT


This weekend's project was to image all of my AT&T 3B2 hard disks to preserve the bits on them. To do this, I used David Gesswein's MFM Reader and Emulator board, which allows you to either emulate an MFM hard disk, or read MFM data off of a real hard disk.


A nice side effect is that the images you pull off of a hard disk are compatible with my 3B2 Emulator, so once they've been read off, you can just boot the image as if it were running on a real 3B2. Nice!

I've been pretty impressed with the MFM Reader and Emulator board. It's a nice piece of kit to have around, and it's fully open source. If you've got any MFM systems or hard drives lying around, give it a shot. It's sold either in kit form or fully assembled at a very reasonable price.

More On Emacs Blogging

Friday, August 10 2018 at 5:40 PM PDT

After much hacking on elisp, I'm happy to announce two changes: First, I've finally implemented pagination on my blog, so the entire nine years of archives isn't rendered in one huge page. And second, there's now an RSS feed available at Woohoo!

Getting both of these features implemented was a bit of a challenge. The built-in Org-Mode publishing feature provided by ox-publish.el is very much geared toward publishing a single page. Really, it's supposed to be for publishing a site map of your website layout. Using it to publish a blog is actually kind of a kludge and an abuse of the feature, to be frank. But here we are, that's how most Org-Mode bloggers publish their blogs.

If you want to check out the Emacs setup for this site and blog, you can look here on GitHub. It's a fairly complicated bit of hacking designed to work around the single-page limitation. I've also altered the default RSS backend, supplied by ox-rss.el, to filter out some unwanted noise from my RSS feed.

The only thing I can't yet figure out is how to force Org Publish to always generate absolute URLs. I actually don't think it's possible, yet.

Emacs Blogging for Fun and Profit

Thursday, July 12 2018 at 6:30 AM PDT

You may notice something quite different about this blog if you've been here before. The look and feel is different, yes, but it's more than just skin deep.

For the last nine years, I've kept my blog in WordPress, a very capable blogging platform. But, starting today, I've switched my entire website to a technology from the 1970s: Emacs, the venerable text editor.

Am I crazy? No, I just think it suits my workflow better.

Emulating The AT&T 3B2 Computer

Tuesday, May 22 2018 at 2:59 PM PDT

On November 29, 2014, I posted the following message to the Classic Computer Mailing List.


For some reason I got it in my head that writing an AT&T 3B2
emulator might be a good idea. That idea has pretty much
been derailed by lack of documentation.

I have been unable to find any detailed technical description
of any 3B2 systems. Visual inspection of a 3B2 300 main board
reveals the following major components:

  - WE32100 CPU
  - WE32101 MMU
  - 4 x D2764A EPROM
  - TMS2797NL floppy disk controller
  - PD7261A hard disk controller
  - SCN2681A dual UART
  - AM9517A Multimode DMA Controller

How these are addressed is anybody's guess.

To even dream of doing an emulator, I at least need to know
the system memory map -- what physical addresses these devices
map to. Without that it's pretty pointless to get started.

If anyone has access to this kind of information, please drop
me a line. Otherwise, I'll just put this one on the far-back


When I sent that message, I had no idea that it would lead to almost four years of effort, and perhaps if I had known I would have given up. But thankfully I didn't, and today I'm happy to say that the effort was, at long last, successful. The 3B2/400 emulator works well enough that I have released it to the world and rolled it back into the parent SIMH source tree.

Because this project required so much reverse engineering, and because documentation about the 3B2 is still so scarce and hard to come by, I wanted to take the time to document how the emulator came about.

MMU Caching Finally Explained

Friday, March 24 2017 at 6:19 PM PDT

I had an absolute breakthrough tonight regarding how the WE32101 MMU handles caching. In fact, when I implemented the change, my simulator went from having 108 page miss errors during kernel boot, to 3. The cache is getting hit on almost every virtual address translation, and because of what I learned, the code is more efficient, too.

The key to all this was finally looking up 2-way set associative caching (see here, here, and here), which the WE32101 manual identifies as the caching strategy on the chip. Once I read about it, I was enlightened.

3B2 System Timers and SIMH

Friday, March 24 2017 at 8:26 AM PDT

I think I made a grievous error when I originally laid out how the 3B2 system timers would work in SIMH, and last night I started down the path of correcting that.

The 3B2/400 has multiple sources of clocks and interrupts: There's a programmable interval timer with three outputs being driven at 100KHz, a timer on the UART that runs at 235KHz, and a Time-of-Day clock. They're all driven at different speeds, and they're all important to system functionality.

SIMH offers a timing service that allows the developer to tie any of these clocks to the real wall clock. This is essential for time-of-day clocks or anything else that wants to keep track of time. I used this functionality to drive the UART and programmable interval timers at their correct clock speeds.

But that's completely wrong. Of course this is obvious in retrospect, but it seemed like a good idea at the time. The problem is that the main CPU clock is free to run as fast as it can the SIMH host. On some hosts it will run very fast, on some hosts it will run quite a bit slower. You can't possibly know how fast the simulated CPU is stepping.

When your timers are tied to the wall clock but your CPU is running as fast as it can, there are going to be all kinds of horrible timing issues. I had lots of unpredictable and non-reproducible behavior.

Last night, I undid all of that. The timers are now counting down in CPU machine cycles. I used the simple power of arithmetic to figure out how many CPU machine cycles each step of each timer would take, and just did that instead.

Now, it seems like everything is a lot more stable, and much less unpredictable.

Simulating the Disk Controller

Thursday, March 23 2017 at 7:48 AM PDT

I spent last night probing my 3B2/310's hard disk controller with a logic analyzer so I can see exactly how it behaves, both with and without a hard disk attached to the system. It proved to be very tricky to get the logic analyzer probes attached because the motherboard is so incredibly dense. In fact, I couldn't get a probe attached to the chip select line no matter how hard I tried. There just wasn't any room to fit a probe between the chip and a nearby resistor array, so I resorted to using a little piece of wire to just touch against the pin. I could have used three hands for that operation.

It's Hard Disk Time

Wednesday, March 22 2017 at 8:34 AM PDT

My next mini-project in the 3B2/400 simulator will be emulating the hard disk. The 3B2/400 used a NEC ?PD7261A hard disk controller (PDF datasheet here), which has proved to be harder to emulate correctly than I would have liked.

So far, my hard disk controller emulation has been limited to the most minimal functionality needed to get the emulator to pass self-checks at all. Other than that, it's just a skeleton. But I believe that it's actually hanging up the floppy boot process now when UNIX tries to discover what hard drives are attached, so it's time to get serious and fix it.

My progress isn't good. I am following the datasheet to the letter, trying to give the correct status bits at the correct time, but the 3B2 just gets confused. It never even tries to read data off the drive, it just gives up trying to read status bits. So, clearly I'm doing something wrong, but I don't know what it is.

Tonight I will strap a logic analyzer to the PD7261a in my real 3B2 and see exactly what it's doing. I'll report on my findings when I have them.

The Equipped Device Table Question is Answered

Tuesday, March 21 2017 at 7:59 PM PDT

And just like that, it's solved. I figured out the mystery of the Equipped Device Table.

The answer was in some obscure piece of System V Release 3 source code. The 3B2 system board has a 16-bit register called the Control and Status Register (CSR). In the CSR is a bit called named TIMEO that I never figured out.

It turns out that I just wasn't reading the disassembled ROM code closely enough. The exception handler checks this status bit whenever it catches a processor exception while filling the EDT. If the bit is set, it skips the device.

So what is TIMEO? It's the System Bus Timeout flag, according to the SVR3 source code.

The correct behavior, then, if nothing is listening at an I/O card's address is to set an External Memory Exception, plus set this bit in the CSR. Once I implemented that in my simulator, the EDT started working exactly the same as it does on my real 3B2/310. Success!

The Mystery of the Equipped Device Table

Tuesday, March 21 2017 at 8:18 AM PDT

EDIT: I have made a followup post detailing the answer to this mystery!

There is yet one more puzzling aspect of the 3B2 that I do not yet understand, and that is the equipped device table, or EDT. I've documented the nitty-gritty details on my main 3B2 reverse-engineering page, so I won't bore you with the details. But here's the short version.