Debugging Notes === Checkpoint --- This code: F000:F9E9 B000 MOV AL,00 F000:F9EB E620 OUT 20,AL triggers the following warning: notice: PIC0(0x20): unsupported OCW2 automatic EOI command: 0x00 and the very next instruction: F000:F9ED E6A0 OUT A0,AL triggers the same warning: notice: PIC1(0xA0): unsupported OCW2 automatic EOI command: 0x00 Checkpoint --- There's a loop at F000:B5AA that stores 0x4000 DWORDs into RAM (ie, 64Kb), where each DWORD is a single-bit left rotation of the preceding DWORD. This is followed by another loop that loads each DWORD and verifies that it contains the appropriate bit. Then a stack is set up in RAM (at 0030:0100) and the first CALL is issued: F000:BC2E E87DEC CALL A8AE There's some CMOS I/O activity, serial and parallel port I/O, more CMOS I/O, and then some EGA I/O. When arrive here: C000:016D B80700 MOV AX,0007 C000:0170 CD10 INT 10 and we complain that the IDTR limit for the real-mode IDT isn't 0x3FF (it's been set to 0xFFFF instead). That may be OK, but I need to verify that that's what the ROM intended. If it is, then I'll probably need to change our assertion from "cpu.addrIDTLimit == 0x03FF" to "cpu.addrIDTLimit >= 0x03FF". Checkpoint --- The BIOS now progresses as far as F000:F747 (PUSH GS). Checkpoint --- The BIOS now progresses as far as 0030:8618 (MOV AX,GS). Checkpoint --- The BIOS now progresses to a Compaq memory-mapped write operation: stopped (27129586 ops, 2209813 cycles, 361 ms, 6121366 hz) EAX=000098FC EBX=0000E000 ECX=00000000 EDX=00000000 ESP=000000E4 EBP=00000000 ESI=0000FFFF EDI=00007FBE SS=0028[00000300,FFFF] DS=0050[80C00000,FFFF] ES=0048[00FF0000,FFFF] CS=0030[000F0000,FFFF] FS=0000[00000000,FFFF] GS=0304[00003040,FFFF] LD=0000[00000000,0000] GD=[0001C000,005F] ID=[000FF821,0007] TR=0000 A20=ON CR0=0000FFF1 CR2=00000000 CR3=00000000 PS=00000083 V0 D0 I0 T0 S1 Z0 A0 P0 C1 0030:8637 C6060000FC MOV [0000],FC ;history=1 and then gets stuck loading CS:IP of 0x28:0xF4AC: assertion failure in deskpro386.cpu386 Fault 0x0D blocked by Debugger stopped (27572151 ops, 443210 cycles, 340635 ms, 1301 hz) EAX=0000FFF1 EBX=00000080 ECX=0000270F EDX=0000004A ESP=000000FE EBP=00000000 ESI=00007FB6 EDI=00008000 SS=0030[00000300,FFFF] DS=0040[00000400,FFFF] ES=0000[00000000,FFFF] CS=F000[000F0000,FFFF] FS=0000[00000000,FFFF] GS=0304[00003040,FFFF] LD=0000[00000000,0000] GD=[00FF0730,0047] ID=[00000000,FFFF] TR=0000 A20=OFF CR0=0000FFF1 CR2=00000000 CR3=00000000 PS=00000082 V0 D0 I0 T0 S1 Z0 A0 P0 C0 F000:F4A7 EAACF42800 JMP 0028:F4AC Here's the code leading up to it: F000:F494 B000 MOV AL,00 ;history=8 F000:F496 E680 OUT 80,AL ;history=7 F000:F498 2E CS: ;history=6 F000:F499 0F01167E07 LGDT [077E] ;history=5 F000:F49E 0F2000 MOV EAX,CR0 ;history=4 F000:F4A1 0D0100 OR AX,0001 ;history=3 F000:F4A4 0F2200 MOV CR0,EAX ;history=2 F000:F4A7 EAACF42800 JMP 0028:F4AC ;history=1 %00FF073C 92C0 8000 FFFF 0000 - 9200 0000 FFFF 0000 ................ %00FF074C 9A0F 0000 FFFF 0000 - 9200 C000 FFFF 0000 ................ id physaddr blkaddr used size type id physaddr blkaddr used size type -------- --------- -------- ------ ------ ---- -------- --------- -------- ------ ------ ---- 00040006 %00000000: 00000000 0x8000 0x8000 RAM 00040006 %00000000: 00000000 0x8000 0x8000 RAM 00040008 %00008000: 00008000 0x8000 0x8000 RAM 00040008 %00008000: 00008000 0x8000 0x8000 RAM 0004000A %00010000: 00010000 0x8000 0x8000 RAM 0004000A %00010000: 00010000 0x8000 0x8000 RAM 0004000C %00018000: 00018000 0x8000 0x8000 RAM 0004000C %00018000: 00018000 0x8000 0x8000 RAM 0004000E %00020000: 00020000 0x8000 0x8000 RAM 0004000E %00020000: 00020000 0x8000 0x8000 RAM 00040010 %00028000: 00028000 0x8000 0x8000 RAM 00040010 %00028000: 00028000 0x8000 0x8000 RAM 00040012 %00030000: 00030000 0x8000 0x8000 RAM 00040012 %00030000: 00030000 0x8000 0x8000 RAM 00040014 %00038000: 00038000 0x8000 0x8000 RAM 00040014 %00038000: 00038000 0x8000 0x8000 RAM 00040016 %00040000: 00040000 0x8000 0x8000 RAM 00040016 %00040000: 00040000 0x8000 0x8000 RAM 00040018 %00048000: 00048000 0x8000 0x8000 RAM 00040018 %00048000: 00048000 0x8000 0x8000 RAM 0004001A %00050000: 00050000 0x8000 0x8000 RAM 0004001A %00050000: 00050000 0x8000 0x8000 RAM 0004001C %00058000: 00058000 0x8000 0x8000 RAM 0004001C %00058000: 00058000 0x8000 0x8000 RAM 0004001E %00060000: 00060000 0x8000 0x8000 RAM 0004001E %00060000: 00060000 0x8000 0x8000 RAM 00040020 %00068000: 00068000 0x8000 0x8000 RAM 00040020 %00068000: 00068000 0x8000 0x8000 RAM 00040022 %00070000: 00070000 0x8000 0x8000 RAM 00040022 %00070000: 00070000 0x8000 0x8000 RAM 00040024 %00078000: 00078000 0x8000 0x8000 RAM 00040024 %00078000: 00078000 0x8000 0x8000 RAM 00040026 %00080000: 00080000 0x8000 0x8000 RAM 00040026 %00080000: 00080000 0x8000 0x8000 RAM 00040028 %00088000: 00088000 0x8000 0x8000 RAM 00040028 %00088000: 00088000 0x8000 0x8000 RAM 0004002A %00090000: 00090000 0x8000 0x8000 RAM 0004002A %00090000: 00090000 0x8000 0x8000 RAM 0004002C %00098000: 00098000 0x8000 0x8000 RAM 0004002C %00098000: 00098000 0x8000 0x8000 RAM 00040088 %000B8000: 000B8000 0x8000 0x8000 VIDEO 000400A0 %000B8000: 000B8000 0x8000 0x8000 VIDEO 00040002 %000C0000: 000C0000 0x4000 0x8000 ROM 00040002 %000C0000: 000C0000 0x4000 0x8000 ROM 0004003F %000E0000: 000E0000 0x???? 0x8000 ROM 00040041 %000E8000: 000E0000 0x???? 0x8000 ROM 00040004 %000F0000: 000F8000 0x8000 0x8000 ROM 00040043 %000F0000: 000E0000 0x???? 0x8000 ROM 00040004 %000F8000: 000F8000 0x8000 0x8000 ROM 00040045 %000F8000: 000E0000 0x???? 0x8000 ROM 00040048 %00100000: 00100000 0x8000 0x8000 RAM 00040048 %00100000: 00100000 0x8000 0x8000 RAM 0004004A %00108000: 00108000 0x8000 0x8000 RAM 0004004A %00108000: 00108000 0x8000 0x8000 RAM 0004004C %00110000: 00110000 0x8000 0x8000 RAM 0004004C %00110000: 00110000 0x8000 0x8000 RAM 0004004E %00118000: 00118000 0x8000 0x8000 RAM 0004004E %00118000: 00118000 0x8000 0x8000 RAM 00040050 %00120000: 00120000 0x8000 0x8000 RAM 00040050 %00120000: 00120000 0x8000 0x8000 RAM 00040052 %00128000: 00128000 0x8000 0x8000 RAM 00040052 %00128000: 00128000 0x8000 0x8000 RAM 00040054 %00130000: 00130000 0x8000 0x8000 RAM 00040054 %00130000: 00130000 0x8000 0x8000 RAM 00040056 %00138000: 00138000 0x8000 0x8000 RAM 00040056 %00138000: 00138000 0x8000 0x8000 RAM 00040058 %00140000: 00140000 0x8000 0x8000 RAM 00040058 %00140000: 00140000 0x8000 0x8000 RAM 0004005A %00148000: 00148000 0x8000 0x8000 RAM 0004005A %00148000: 00148000 0x8000 0x8000 RAM 0004005C %00150000: 00150000 0x8000 0x8000 RAM 0004005C %00150000: 00150000 0x8000 0x8000 RAM 0004005E %00158000: 00158000 0x8000 0x8000 RAM 0004005E %00158000: 00158000 0x8000 0x8000 RAM 00040060 %00160000: 00160000 0x8000 0x8000 RAM 00040060 %00160000: 00160000 0x8000 0x8000 RAM 00040062 %00168000: 00168000 0x8000 0x8000 RAM 00040062 %00168000: 00168000 0x8000 0x8000 RAM 00040064 %00170000: 00170000 0x8000 0x8000 RAM 00040064 %00170000: 00170000 0x8000 0x8000 RAM 00040066 %00178000: 00178000 0x8000 0x8000 RAM 00040066 %00178000: 00178000 0x8000 0x8000 RAM 00040068 %00180000: 00180000 0x8000 0x8000 RAM 00040068 %00180000: 00180000 0x8000 0x8000 RAM 0004006A %00188000: 00188000 0x8000 0x8000 RAM 0004006A %00188000: 00188000 0x8000 0x8000 RAM 0004006C %00190000: 00190000 0x8000 0x8000 RAM 0004006C %00190000: 00190000 0x8000 0x8000 RAM 0004006E %00198000: 00198000 0x8000 0x8000 RAM 0004006E %00198000: 00198000 0x8000 0x8000 RAM 00040070 %001A0000: 001A0000 0x8000 0x8000 RAM 00040070 %001A0000: 001A0000 0x8000 0x8000 RAM 00040072 %001A8000: 001A8000 0x8000 0x8000 RAM 00040072 %001A8000: 001A8000 0x8000 0x8000 RAM 00040074 %001B0000: 001B0000 0x8000 0x8000 RAM 00040074 %001B0000: 001B0000 0x8000 0x8000 RAM 00040076 %001B8000: 001B8000 0x8000 0x8000 RAM 00040076 %001B8000: 001B8000 0x8000 0x8000 RAM 00040078 %001C0000: 001C0000 0x8000 0x8000 RAM 00040078 %001C0000: 001C0000 0x8000 0x8000 RAM 0004007A %001C8000: 001C8000 0x8000 0x8000 RAM 0004007A %001C8000: 001C8000 0x8000 0x8000 RAM 0004007C %001D0000: 001D0000 0x8000 0x8000 RAM 0004007C %001D0000: 001D0000 0x8000 0x8000 RAM 0004007E %001D8000: 001D8000 0x8000 0x8000 RAM 0004007E %001D8000: 001D8000 0x8000 0x8000 RAM 00040080 %001E0000: 001E0000 0x8000 0x8000 RAM 00040080 %001E0000: 001E0000 0x8000 0x8000 RAM 00040082 %001E8000: 001E8000 0x8000 0x8000 RAM 00040082 %001E8000: 001E8000 0x8000 0x8000 RAM 00040084 %001F0000: 001F0000 0x8000 0x8000 RAM 00040084 %001F0000: 001F0000 0x8000 0x8000 RAM 00040086 %001F8000: 001F8000 0x8000 0x8000 RAM 00040086 %001F8000: 001F8000 0x8000 0x8000 RAM 0004002E %00FA0000: 00FA0000 0x8000 0x8000 RAM 0004002E %00FA0000: 00FA0000 0x8000 0x8000 RAM 00040030 %00FA8000: 00FA8000 0x8000 0x8000 RAM 00040030 %00FA8000: 00FA8000 0x8000 0x8000 RAM 00040032 %00FB0000: 00FB0000 0x8000 0x8000 RAM 00040032 %00FB0000: 00FB0000 0x8000 0x8000 RAM 00040034 %00FB8000: 00FB8000 0x8000 0x8000 RAM 00040034 %00FB8000: 00FB8000 0x8000 0x8000 RAM 00040036 %00FC0000: 00FC0000 0x8000 0x8000 RAM 00040036 %00FC0000: 00FC0000 0x8000 0x8000 RAM 00040038 %00FC8000: 00FC8000 0x8000 0x8000 RAM 00040038 %00FC8000: 00FC8000 0x8000 0x8000 RAM 0004003A %00FD0000: 00FD0000 0x8000 0x8000 RAM 0004003A %00FD0000: 00FD0000 0x8000 0x8000 RAM 0004003C %00FD8000: 00FD8000 0x8000 0x8000 RAM 0004003C %00FD8000: 00FD8000 0x8000 0x8000 RAM 0004003E %00FE0000: 00FE0000 0x8000 0x8000 RAM 0004003E %00FE0000: 00FE0000 0x8000 0x8000 RAM 00040040 %00FE8000: 00FE8000 0x8000 0x8000 RAM 00040040 %00FE8000: 00FE8000 0x8000 0x8000 RAM 00040042 %00FF0000: 00FF0000 0x8000 0x8000 RAM 00040042 %00FF0000: 00FF0000 0x8000 0x8000 RAM 00040044 %00FF8000: 00FF8000 0x8000 0x8000 RAM 00040044 %00FF8000: 00FF8000 0x8000 0x8000 RAM 00040046 %80C00000: 80C00000 0x0001 0x8000 H/W 00040046 %80C00000: 80C00000 0x0001 0x8000 H/W 00040004 %FFFF0000: 000F8000 0x8000 0x8000 ROM 00040004 %FFFF0000: 000F8000 0x8000 0x8000 ROM 00040004 %FFFF8000: 000F8000 0x8000 0x8000 ROM 00040004 %FFFF8000: 000F8000 0x8000 0x8000 ROM But when we stopped here next, it was no longer good: breakpoint hit: F000:F498 (exec) stopped (27572162 ops, 443166 cycles, 143 ms, 3099063 hz) EAX=0000FF00 EBX=00000080 ECX=0000270F EDX=0000004A ESP=000000FE EBP=00000000 ESI=00007FB6 EDI=00008000 SS=0030 DS=0040 ES=0000 FS=0000 GS=0304 PS=00000046 V0 D0 I0 T0 S0 Z1 A0 P1 C0 F000:F498 2E CS: F000:F499 0F01167E07 LGDT [077E] F000:077E 0047 0730 00FF FFFF - 0000 0000 87AA 0018 G.0............. F000:078E 87F8 0018 8828 0018 - 0F2E 1601 0778 200F ....(.......x.. %00FF0730 0000 0000 0000 0000 - 0000 0000 0000 0000 ................ %00FF0740 0000 0000 0000 0000 - 0000 0000 0000 0000 ................ Turns out this is because the A20 line has been disabled. ------------------------------------------------------------------------------------------------- Let's look at a complete run: EAX=00000000 EBX=00000000 ECX=00000000 EDX=00000304 ESP=00000000 EBP=00000000 ESI=00000000 EDI=00000000 SS=0000 DS=0000 ES=0000 FS=0000 GS=0000 PS=00000002 V0 D0 I0 T0 S0 Z0 A0 P0 C0 F000:FFF0 EA05F900F0 JMP F000:F905 I want to catch writes to the top-left corner of the screen, so I set a write breakpoint: bw b800:0 which reports: write breakpoint added to memory block 000B8000 breakpoint enabled: B800:0000 (write) and then we're off: running chipset.outPort(0x0084,DMA.SPARE0.PAGE,0x00) @F000:F907 chipset.outPort(0x0084,DMA.SPARE0.PAGE,0x01) @F000:F926 chipset.outPort(0x0084,DMA.SPARE0.PAGE,0x02) @F000:F93C chipset.outPort(0x0084,DMA.SPARE0.PAGE,0x03) @F000:F942 chipset.outPort(0x0084,DMA.SPARE0.PAGE,0x04) @F000:F946 chipset.outPort(0x0084,DMA.SPARE0.PAGE,0x05) @F000:F95F chipset.outPort(0x0084,DMA.SPARE0.PAGE,0x06) @F000:F978 chipset.outPort(0x0084,DMA.SPARE0.PAGE,0x08) @F000:F9AA notice: PIC0(0x20): unsupported OCW2 automatic EOI command: 0x00 stopped (149 ops, 622 cycles, 92 ms, 6761 hz) EAX=0000F000 EBX=00000000 ECX=00000008 EDX=00000020 ESP=00000000 EBP=00000000 ESI=0000F8E7 EDI=00000000 SS=0000 DS=F000 ES=0000 FS=0000 GS=0304 PS=00000046 V0 D0 I0 T0 S0 Z1 A0 P1 C0 F000:F9ED E6A0 OUT A0,AL running notice: PIC1(0xA0): unsupported OCW2 automatic EOI command: 0x00 stopped (150 ops, 5 cycles, 19 ms, 263 hz) EAX=0000F000 EBX=00000000 ECX=00000008 EDX=00000020 ESP=00000000 EBP=00000000 ESI=0000F8E7 EDI=00000000 SS=0000 DS=F000 ES=0000 FS=0000 GS=0304 PS=00000046 V0 D0 I0 T0 S0 Z1 A0 P1 C0 F000:F9EF B009 MOV AL,09 running chipset.outPort(0x0084,DMA.SPARE0.PAGE,0x09) @F000:F9F1 chipset.outPort(0x0084,DMA.SPARE0.PAGE,0x0F) @F000:BAAA chipset.outPort(0x0084,DMA.SPARE0.PAGE,0x10) @F000:BAFB bus.outPort(0x004B,unknown,0x12) @F000:BAFF bus.outPort(0x004B,unknown,0x42) @F000:BB03 bus.outPort(0x004B,unknown,0x92) @F000:BB07 chipset.outPort(0x0084,DMA.SPARE0.PAGE,0x11) @F000:BB29 chipset.outPort(0x0084,DMA.SPARE0.PAGE,0x12) @F000:BB70 breakpoint hit: B800:0000 (write) stopped (413 ops, 959 cycles, 80 ms, 11988 hz) EAX=00000720 EBX=0000BA77 ECX=00001FFF EDX=000003D8 ESP=00000000 EBP=0000BB78 ESI=0000F0C6 EDI=00000002 SS=0000 DS=F000 ES=B800 FS=0000 GS=0304 PS=00000046 V0 D0 I0 T0 S0 Z1 A0 P1 C0 F000:9C05 F3 REPZ F000:9C06 AB STOSW This is where screen memory is first initialized ("blanked"). chipset.outPort(0x0084,DMA.SPARE0.PAGE,0x13) @F000:BB90 chipset.outPort(0x0084,DMA.SPARE0.PAGE,0x14) @F000:BBB8 chipset.outPort(0x0084,DMA.SPARE0.PAGE,0x15) @F000:BBD8 chipset.outPort(0x0084,DMA.SPARE0.PAGE,0x17) @F000:BC08 chipset.outPort(0x0084,DMA.SPARE0.PAGE,0x18) @F000:BC14 chipset.outPort(0x0084,DMA.SPARE0.PAGE,0x40) @F000:B552 chipset.outPort(0x0084,DMA.SPARE0.PAGE,0x2F) @0018:87B4 chipset.outPort(0x0084,DMA.SPARE0.PAGE,0x41) @F000:B572 chipset.outPort(0x0084,DMA.SPARE0.PAGE,0x42) @F000:B599 chipset.outPort(0x0084,DMA.SPARE0.PAGE,0x43) @F000:B5C4 chipset.outPort(0x0084,DMA.SPARE0.PAGE,0x44) @F000:B5D2 chipset.outPort(0x0084,DMA.SPARE0.PAGE,0x45) @F000:B600 chipset.outPort(0x0084,DMA.SPARE0.PAGE,0x43) @F000:B5C4 chipset.outPort(0x0084,DMA.SPARE0.PAGE,0x44) @F000:B5D2 chipset.outPort(0x0084,DMA.SPARE0.PAGE,0x45) @F000:B600 chipset.outPort(0x0084,DMA.SPARE0.PAGE,0x46) @F000:B61C chipset.outPort(0x0084,DMA.SPARE0.PAGE,0x19) @F000:BC2C chipset.outPort(0x0084,DMA.SPARE0.PAGE,0x30) @F000:A8B0 chipset.outPort(0x0084,DMA.SPARE0.PAGE,0x31) @F000:A905 chipset.outPort(0x0084,DMA.SPARE0.PAGE,0x32) @F000:A91D chipset.outPort(0x0084,DMA.SPARE0.PAGE,0x33) @F000:A93B chipset.outPort(0x0084,DMA.SPARE0.PAGE,0x34) @F000:A953 chipset.outPort(0x0084,DMA.SPARE0.PAGE,0x36) @F000:A991 chipset.outPort(0x0084,DMA.SPARE0.PAGE,0x38) @F000:A99C chipset.outPort(0x0084,DMA.SPARE0.PAGE,0x39) @F000:A9BC bus.inPort(0x03BC,unknown) @F000:A9CA bus.outPort(0x03BC,unknown,0x00) @F000:A9CD bus.inPort(0x03BC,unknown) @F000:A9D0 bus.inPort(0x0378,unknown) @F000:A9CA bus.outPort(0x0378,unknown,0x00) @F000:A9CD bus.inPort(0x0378,unknown) @F000:A9D0 bus.inPort(0x0278,unknown) @F000:A9CA bus.outPort(0x0278,unknown,0x00) @F000:A9CD bus.inPort(0x0278,unknown) @F000:A9D0 chipset.outPort(0x0084,DMA.SPARE0.PAGE,0x3A) @F000:A9DE chipset.outPort(0x0084,DMA.SPARE0.PAGE,0x3B) @F000:A9FB chipset.outPort(0x0084,DMA.SPARE0.PAGE,0x52) @F000:AA41 chipset.outPort(0x0084,DMA.SPARE0.PAGE,0x53) @F000:AA54 bus.outPort(0x03B9,unknown,0x30) @F000:9BE7 write breakpoint added to memory block 000B8000 write breakpoint added to memory block 000B8000 breakpoint hit: B800:0000 (write) stopped (1340834 ops, 3291994 cycles, 821 ms, 4009737 hz) EAX=00000720 EBX=00000720 ECX=00003FFF EDX=0000B800 ESP=000000D0 EBP=FFFF2230 ESI=00000CBA EDI=00000002 SS=0030 DS=0000 ES=B800 FS=0000 GS=0304 PS=00000246 V0 D0 I1 T0 S0 Z1 A0 P1 C0 C000:0E93 F3 REPZ C000:0E94 AB STOSW Now the video card's own BIOS is doing the same thing, followed by more of the same: write breakpoint added to memory block 000B8000 write breakpoint added to memory block 000B8000 breakpoint hit: B800:0000 (write) stopped (1384492 ops, 79242 cycles, 52 ms, 1523885 hz) EAX=00000720 EBX=00000720 ECX=00003FFF EDX=0000B800 ESP=000000C8 EBP=FFFF2230 ESI=00000C3A EDI=00000002 SS=0030 DS=0000 ES=B800 FS=0000 GS=0304 PS=00000246 V0 D0 I1 T0 S0 Z1 A0 P1 C0 C000:0E93 F3 REPZ C000:0E94 AB STOSW running breakpoint hit: B800:0000 (write) stopped (1476959 ops, 347538 cycles, 67 ms, 5187134 hz) EAX=00000FDB EBX=00000FDB ECX=00000050 EDX=000003DA ESP=000000CC EBP=FFFF00E2 ESI=00000000 EDI=00000002 SS=0030 DS=0000 ES=B800 FS=0000 GS=0304 PS=00000246 V0 D0 I1 T0 S0 Z1 A0 P1 C0 C000:18D7 FB STI running write breakpoint added to memory block 000B8000 write breakpoint added to memory block 000B8000 breakpoint hit: B800:0000 (write) stopped (2824784 ops, 4644466 cycles, 528 ms, 8796337 hz) EAX=00000720 EBX=00000720 ECX=00003FFF EDX=0000B800 ESP=000000C8 EBP=FFFF2230 ESI=00000CBA EDI=00000002 SS=0030 DS=0000 ES=B800 FS=0000 GS=0304 PS=00000246 V0 D0 I1 T0 S0 Z1 A0 P1 C0 C000:0E93 F3 REPZ C000:0E94 AB STOSW running chipset.outPort(0x0084,DMA.SPARE0.PAGE,0x8C) @F000:D05C chipset.outPort(0x0084,DMA.SPARE0.PAGE,0x1A) @F000:BC79 chipset.outPort(0x0084,DMA.SPARE0.PAGE,0x50) @F000:AA76 chipset.outPort(0x0084,DMA.SPARE0.PAGE,0x51) @F000:AA7F chipset.outPort(0x0084,DMA.SPARE0.PAGE,0x52) @F000:AA9C chipset.outPort(0x0084,DMA.SPARE0.PAGE,0x1B) @F000:BC80 chipset.outPort(0x0084,DMA.SPARE0.PAGE,0x1C) @F000:BC87 chipset.outPort(0x0084,DMA.SPARE0.PAGE,0x90) @F000:CC53 chipset.outPort(0x0084,DMA.SPARE0.PAGE,0x91) @F000:CC85 chipset.outPort(0x0084,DMA.SPARE0.PAGE,0x1D) @F000:BC8E chipset.outPort(0x0084,DMA.SPARE0.PAGE,0x93) @F000:CC8A chipset.outPort(0x0084,DMA.SPARE0.PAGE,0x94) @F000:CD06 chipset.outPort(0x0084,DMA.SPARE0.PAGE,0x95) @F000:CD3C chipset.outPort(0x0084,DMA.SPARE0.PAGE,0x96) @F000:CD6A chipset.outPort(0x0084,DMA.SPARE0.PAGE,0x2D) @F000:BC95 chipset.outPort(0x0084,DMA.SPARE0.PAGE,0x0D) @F000:E107 bus.outPort(0x004B,unknown,0x12) @F000:E10B bus.outPort(0x0048,unknown,0x22) @F000:E112 bus.outPort(0x004B,unknown,0x00) @F000:E139 bus.inPort(0x0048,unknown) @F000:E13B bus.inPort(0x0048,unknown) @F000:E13E bus.outPort(0x004B,unknown,0x12) @F000:E11A chipset.outPort(0x0084,DMA.SPARE0.PAGE,0x0E) @F000:E11E bus.outPort(0x004B,unknown,0x92) @F000:E122 bus.outPort(0x004A,unknown,0x22) @F000:E129 bus.outPort(0x004B,unknown,0x80) @F000:E139 bus.inPort(0x004A,unknown) @F000:E13B bus.inPort(0x004A,unknown) @F000:E13E bus.outPort(0x004B,unknown,0x92) @F000:E131 chipset.outPort(0x0084,DMA.SPARE0.PAGE,0x1E) @F000:BC9C chipset.outPort(0x0084,DMA.SPARE0.PAGE,0x80) @F000:CFDF chipset.outPort(0x0084,DMA.SPARE0.PAGE,0x81) @F000:CFF7 chipset.outPort(0x0084,DMA.SPARE0.PAGE,0x82) @F000:D011 chipset.outPort(0x0084,DMA.SPARE0.PAGE,0x84) @F000:D02D chipset.outPort(0x0084,DMA.SPARE0.PAGE,0x1F) @F000:BCA3 chipset.outPort(0x0084,DMA.SPARE0.PAGE,0x75) @F000:F74D chipset.outPort(0x0084,DMA.SPARE0.PAGE,0x76) @F000:F761 chipset.outPort(0x0084,DMA.SPARE0.PAGE,0x77) @0030:F772 chipset.outPort(0x0084,DMA.SPARE0.PAGE,0x78) @0030:F790 chipset.outPort(0x0084,DMA.SPARE0.PAGE,0x00) @F000:F907 chipset.outPort(0x0084,DMA.SPARE0.PAGE,0x07) @F000:F986 chipset.outPort(0x0084,DMA.SPARE0.PAGE,0x08) @F000:F9AA notice: PIC0(0x20): unsupported OCW2 automatic EOI command: 0x00 stopped (19729382 ops, 81457037 cycles, 7165 ms, 11368742 hz) EAX=0000F000 EBX=00000006 ECX=00000008 EDX=00000020 ESP=00000000 EBP=00000000 ESI=0000F8E7 EDI=00000000 SS=0000 DS=F000 ES=0000 FS=0000 GS=0000 PS=00000046 V0 D0 I0 T0 S0 Z1 A0 P1 C0 F000:F9ED E6A0 OUT A0,AL running notice: PIC1(0xA0): unsupported OCW2 automatic EOI command: 0x00 stopped (19729383 ops, 5 cycles, 20 ms, 250 hz) EAX=0000F000 EBX=00000006 ECX=00000008 EDX=00000020 ESP=00000000 EBP=00000000 ESI=0000F8E7 EDI=00000000 SS=0000 DS=F000 ES=0000 FS=0000 GS=0000 PS=00000046 V0 D0 I0 T0 S0 Z1 A0 P1 C0 F000:F9EF B009 MOV AL,09 We're back in the Compaq BIOS, the video card appears to be fully initialized now, so perhaps the next write to video memory will be the first memory test results. And in fact, it is. But the "bw b800:0" command doesn't work, because the memory test results are being performed in protected-mode, and there is no segment 0xB800 mapped to video memory at that point. So the write breakpoint must be specified as "bw %b8000" instead. Now we catch it: chipset.outPort(0x0084,DMA.SPARE0.PAGE,0x09) @F000:F9F1 chipset.outPort(0x0084,DMA.SPARE0.PAGE,0x79) @F000:F7CD chipset.outPort(0x0084,DMA.SPARE0.PAGE,0x7B) @F000:F814 chipset.outPort(0x0084,DMA.SPARE0.PAGE,0x20) @F000:BCAA chipset.outPort(0x0084,DMA.SPARE0.PAGE,0x60) @F000:D6E6 chipset.outPort(0x0084,DMA.SPARE0.PAGE,0x61) @F000:D704 chipset.outPort(0x0084,DMA.SPARE0.PAGE,0x18) @0030:870A chipset.outPort(0x0084,DMA.SPARE0.PAGE,0x18) @0030:8715 chipset.outPort(0x0084,DMA.SPARE0.PAGE,0x62) @0030:D719 chipset.outPort(0x0084,DMA.SPARE0.PAGE,0x63) @0030:D761 chipset.outPort(0x0084,DMA.SPARE0.PAGE,0x70) @0030:DB38 breakpoint hit: %000B8000 (write) stopped (19736120 ops, 23810 cycles, 165 ms, 144303 hz) EAX=00000000 EBX=0000000A ECX=0000000A EDX=00000730 ESP=000000D0 EBP=00000080 ESI=00000095 EDI=00008002 SS=0028[00000300,FFFF] DS=0018[0001C000,FFFF] ES=0040[000B0000,FFFF] CS=0030[000F0000,FFFF] FS=0000[00000000,FFFF] GS=0304[00003040,FFFF] LD=0000[00000000,0000] GD=[0001C000,005F] ID=[000FF821,0007] TR=0000 A20=ON CR0=0000FFF1 CR2=00000000 CR3=00000000 PS=00000082 V0 D0 I0 T0 S1 Z0 A0 P0 C0 0030:80DA F3 REPZ 0030:80DB A5 MOVSW x8509: Memory test of top 128Kb of top 16Mb? xdb33: