28 May
2014
28 May
'14
1:09 p.m.
Actually, the HP 2114/2115/2116 series of
minicomputers could get into an
"infinite indirect loop" that could be really fun to break out of. No
undocumented
features.
If an instruction did an indirect memory reference and the referenced
memory location had bit 15 set (which indicated further redirection) the
instruction won't complete until it fetches a word with bit 15 clear. A bug
where a word refers to itself (with bit 15 set) or back further in the chain
would result in an "infinite indirect loop". This was unbreakable since
interrupts are only processed at the completion of an instruction. A reset
was the only way to break out of it.
THis also applies to the processor used in the HP9810/9820/9830 desktop
'calculaotrs'. It's a related instruction set IIRC, and the indirection
can indeed get into an endless loop. This is handled by the CPU
microcode, and since that's also responsible to checkign interrupts at
the stnart of every instruciton, an interrupt will not get out of it. The
only thing that will is a hardware reset.
For interest, here's the appropraite bit of the CPU microcode (addresses
in split octal, data in hex) :
--
Memory Reference -- calculate address
0012 : 5ef398b : TTM=0;TTT=1;SC=2(TTS);X=7(NOP);R=7(ZTR);ALU=2(IOR);BRC=1
0012 : 5ef398b : IQN=0;XTR=1;clk=9;sec=1;pri=b;
0012 : 5ef398b : M = (T) IOR (0);
0012 : 5ef398b : clocks=10; if (Q10/) goto (1313,1312)
Copy lower 10 bits of instruction (in T) -- address part of the
instuction -- to the M register. The high bits of M, giving the current
page, end up in the LSBs of M. Test bit 10 of the instruction to
determine if it's base page or current page.
1312 : 4e77542 : TTM=0;TTT=1;SC=0(ZTS);X=7(NOP);R=7(ZTR);ALU=3(ZTT);BRC=0
1312 : 4e77542 : IQN=0;XTR=1;clk=5;sec=8;pri=2;
1312 : 4e77542 : M = (0) ZTT (0);
1312 : 4e77542 : clocks=6; goto (1102)
Base page : Shift 6 0's into M, thus forming a base page address
1313 : ee775c2 : TTM=1;TTT=1;SC=1(MTS);X=7(NOP);R=7(ZTR);ALU=3(ZTT);BRC=0
1313 : ee775c2 : IQN=0;XTR=1;clk=5;sec=9;pri=2;
1313 : ee775c2 : = (M) ZTT (0);
1313 : ee775c2 : clocks=6; goto (1102)
Current page : Rotate M by 6 bits, so original 6 MSBs end up in the MSBs
of M (thus keeping the current page)
1102 : cfb1b89 : TTM=1;TTT=1;SC=0(ZTS);X=7(NOP);R=6(RDM);ALU=4(ZTTCBC);BRC=1
1102 : cfb1b89 : IQN=0;XTR=1;clk=b;sec=1;pri=9;
1102 : cfb1b89 : = (0) ZTTCBC (); RDM ;
1102 : cfb1b89 : clocks=12; if (Q15/) goto (0003,0002)
Read in the addressed memory word. Check bit 15 of the instruction (in Q)
to determine if it's indirect or not. Clear BC (needed by PC increment
routine, amongst others)
0003 : 5e13f86 : TTM=0;TTT=1;SC=2(TTS);X=7(NOP);R=4(TQ6);ALU=2(IOR);BRC=0
0003 : 5e13f86 : IQN=0;XTR=1;clk=f;sec=1;pri=6;
0003 : 5e13f86 : M,Q6 = (T) IOR ();
0003 : 5e13f86 : clocks=16; goto (0602)
It is indirect. Copy read-in memory word (indirect address) into M. Shift
bits into Q(6) also, so that Q(6) ends up set to the state of the MSB of
this address. This is set if this address is also indirect
0602 : ceb7b86 : TTM=1;TTT=1;SC=0(ZTS);X=7(NOP);R=6(RDM);ALU=3(ZTT);BRC=1
0602 : ceb7b86 : IQN=0;XTR=1;clk=b;sec=1;pri=6;
0602 : ceb7b86 : = (0) ZTT (); RDM ;
0602 : ceb7b86 : clocks=12; if (Q6/) goto (0003,0002)
Read in data word. Test to see if this needs to be indirected again. If
so, go back and do so
At this point, M contains the address specified in the instruction
(indirected if necessary), T contains the contents of that address.
--
Basiclly, you can get stuck in the 2 microstae loop 0003, 0602 if the
indirect address pointso t oa word with the MSB set each time.
Of coruse the 9810/20/30 were not officially programmable in machine
code. But...
-tony