22 KiB
22 KiB
Debugging Notes
Checkpoint
This code:
F000:F9E9 B000 MOV AL,00
F000:F9EB E620 OUT 20,AL
triggers the following warning:
notice: PIC0(0x20): unsupported OCW2 automatic EOI command: 0x00
and the very next instruction:
F000:F9ED E6A0 OUT A0,AL
triggers the same warning:
notice: PIC1(0xA0): unsupported OCW2 automatic EOI command: 0x00
Checkpoint
There's a loop at F000:B5AA that stores 0x4000 DWORDs into RAM (ie, 64Kb), where each DWORD is a single-bit left rotation of the preceding DWORD. This is followed by another loop that loads each DWORD and verifies that it contains the appropriate bit.
Then a stack is set up in RAM (at 0030:0100) and the first CALL is issued:
F000:BC2E E87DEC CALL A8AE
There's some CMOS I/O activity, serial and parallel port I/O, more CMOS I/O, and then some EGA I/O.
When arrive here:
C000:016D B80700 MOV AX,0007
C000:0170 CD10 INT 10
and we complain that the IDTR limit for the real-mode IDT isn't 0x3FF (it's been set to 0xFFFF instead). That may be OK, but I need to verify that that's what the ROM intended. If it is, then I'll probably need to change our assertion from "cpu.addrIDTLimit == 0x03FF" to "cpu.addrIDTLimit >= 0x03FF".
Checkpoint
The BIOS now progresses as far as F000:F747 (PUSH GS).
Checkpoint
The BIOS now progresses as far as 0030:8618 (MOV AX,GS).
Checkpoint
The BIOS now progresses to a Compaq memory-mapped write operation:
stopped (27129586 ops, 2209813 cycles, 361 ms, 6121366 hz)
EAX=000098FC EBX=0000E000 ECX=00000000 EDX=00000000
ESP=000000E4 EBP=00000000 ESI=0000FFFF EDI=00007FBE
SS=0028[00000300,FFFF] DS=0050[80C00000,FFFF] ES=0048[00FF0000,FFFF]
CS=0030[000F0000,FFFF] FS=0000[00000000,FFFF] GS=0304[00003040,FFFF]
LD=0000[00000000,0000] GD=[0001C000,005F] ID=[000FF821,0007] TR=0000 A20=ON
CR0=0000FFF1 CR2=00000000 CR3=00000000 PS=00000083 V0 D0 I0 T0 S1 Z0 A0 P0 C1
0030:8637 C6060000FC MOV [0000],FC ;history=1
and then gets stuck loading CS:IP of 0x28:0xF4AC:
assertion failure in deskpro386.cpu386
Fault 0x0D blocked by Debugger
stopped (27572151 ops, 443210 cycles, 340635 ms, 1301 hz)
EAX=0000FFF1 EBX=00000080 ECX=0000270F EDX=0000004A
ESP=000000FE EBP=00000000 ESI=00007FB6 EDI=00008000
SS=0030[00000300,FFFF] DS=0040[00000400,FFFF] ES=0000[00000000,FFFF]
CS=F000[000F0000,FFFF] FS=0000[00000000,FFFF] GS=0304[00003040,FFFF]
LD=0000[00000000,0000] GD=[00FF0730,0047] ID=[00000000,FFFF] TR=0000 A20=OFF
CR0=0000FFF1 CR2=00000000 CR3=00000000 PS=00000082 V0 D0 I0 T0 S1 Z0 A0 P0 C0
F000:F4A7 EAACF42800 JMP 0028:F4AC
Here's the code leading up to it:
F000:F494 B000 MOV AL,00 ;history=8
F000:F496 E680 OUT 80,AL ;history=7
F000:F498 2E CS: ;history=6
F000:F499 0F01167E07 LGDT [077E] ;history=5
F000:F49E 0F2000 MOV EAX,CR0 ;history=4
F000:F4A1 0D0100 OR AX,0001 ;history=3
F000:F4A4 0F2200 MOV CR0,EAX ;history=2
F000:F4A7 EAACF42800 JMP 0028:F4AC ;history=1
%00FF073C 92C0 8000 FFFF 0000 - 9200 0000 FFFF 0000 ................
%00FF074C 9A0F 0000 FFFF 0000 - 9200 C000 FFFF 0000 ................
id physaddr blkaddr used size type id physaddr blkaddr used size type
-------- --------- -------- ------ ------ ---- -------- --------- -------- ------ ------ ----
00040006 %00000000: 00000000 0x8000 0x8000 RAM 00040006 %00000000: 00000000 0x8000 0x8000 RAM
00040008 %00008000: 00008000 0x8000 0x8000 RAM 00040008 %00008000: 00008000 0x8000 0x8000 RAM
0004000A %00010000: 00010000 0x8000 0x8000 RAM 0004000A %00010000: 00010000 0x8000 0x8000 RAM
0004000C %00018000: 00018000 0x8000 0x8000 RAM 0004000C %00018000: 00018000 0x8000 0x8000 RAM
0004000E %00020000: 00020000 0x8000 0x8000 RAM 0004000E %00020000: 00020000 0x8000 0x8000 RAM
00040010 %00028000: 00028000 0x8000 0x8000 RAM 00040010 %00028000: 00028000 0x8000 0x8000 RAM
00040012 %00030000: 00030000 0x8000 0x8000 RAM 00040012 %00030000: 00030000 0x8000 0x8000 RAM
00040014 %00038000: 00038000 0x8000 0x8000 RAM 00040014 %00038000: 00038000 0x8000 0x8000 RAM
00040016 %00040000: 00040000 0x8000 0x8000 RAM 00040016 %00040000: 00040000 0x8000 0x8000 RAM
00040018 %00048000: 00048000 0x8000 0x8000 RAM 00040018 %00048000: 00048000 0x8000 0x8000 RAM
0004001A %00050000: 00050000 0x8000 0x8000 RAM 0004001A %00050000: 00050000 0x8000 0x8000 RAM
0004001C %00058000: 00058000 0x8000 0x8000 RAM 0004001C %00058000: 00058000 0x8000 0x8000 RAM
0004001E %00060000: 00060000 0x8000 0x8000 RAM 0004001E %00060000: 00060000 0x8000 0x8000 RAM
00040020 %00068000: 00068000 0x8000 0x8000 RAM 00040020 %00068000: 00068000 0x8000 0x8000 RAM
00040022 %00070000: 00070000 0x8000 0x8000 RAM 00040022 %00070000: 00070000 0x8000 0x8000 RAM
00040024 %00078000: 00078000 0x8000 0x8000 RAM 00040024 %00078000: 00078000 0x8000 0x8000 RAM
00040026 %00080000: 00080000 0x8000 0x8000 RAM 00040026 %00080000: 00080000 0x8000 0x8000 RAM
00040028 %00088000: 00088000 0x8000 0x8000 RAM 00040028 %00088000: 00088000 0x8000 0x8000 RAM
0004002A %00090000: 00090000 0x8000 0x8000 RAM 0004002A %00090000: 00090000 0x8000 0x8000 RAM
0004002C %00098000: 00098000 0x8000 0x8000 RAM 0004002C %00098000: 00098000 0x8000 0x8000 RAM
00040088 %000B8000: 000B8000 0x8000 0x8000 VIDEO 000400A0 %000B8000: 000B8000 0x8000 0x8000 VIDEO
00040002 %000C0000: 000C0000 0x4000 0x8000 ROM 00040002 %000C0000: 000C0000 0x4000 0x8000 ROM
0004003F %000E0000: 000E0000 0x???? 0x8000 ROM
00040041 %000E8000: 000E0000 0x???? 0x8000 ROM
00040004 %000F0000: 000F8000 0x8000 0x8000 ROM 00040043 %000F0000: 000E0000 0x???? 0x8000 ROM
00040004 %000F8000: 000F8000 0x8000 0x8000 ROM 00040045 %000F8000: 000E0000 0x???? 0x8000 ROM
00040048 %00100000: 00100000 0x8000 0x8000 RAM 00040048 %00100000: 00100000 0x8000 0x8000 RAM
0004004A %00108000: 00108000 0x8000 0x8000 RAM 0004004A %00108000: 00108000 0x8000 0x8000 RAM
0004004C %00110000: 00110000 0x8000 0x8000 RAM 0004004C %00110000: 00110000 0x8000 0x8000 RAM
0004004E %00118000: 00118000 0x8000 0x8000 RAM 0004004E %00118000: 00118000 0x8000 0x8000 RAM
00040050 %00120000: 00120000 0x8000 0x8000 RAM 00040050 %00120000: 00120000 0x8000 0x8000 RAM
00040052 %00128000: 00128000 0x8000 0x8000 RAM 00040052 %00128000: 00128000 0x8000 0x8000 RAM
00040054 %00130000: 00130000 0x8000 0x8000 RAM 00040054 %00130000: 00130000 0x8000 0x8000 RAM
00040056 %00138000: 00138000 0x8000 0x8000 RAM 00040056 %00138000: 00138000 0x8000 0x8000 RAM
00040058 %00140000: 00140000 0x8000 0x8000 RAM 00040058 %00140000: 00140000 0x8000 0x8000 RAM
0004005A %00148000: 00148000 0x8000 0x8000 RAM 0004005A %00148000: 00148000 0x8000 0x8000 RAM
0004005C %00150000: 00150000 0x8000 0x8000 RAM 0004005C %00150000: 00150000 0x8000 0x8000 RAM
0004005E %00158000: 00158000 0x8000 0x8000 RAM 0004005E %00158000: 00158000 0x8000 0x8000 RAM
00040060 %00160000: 00160000 0x8000 0x8000 RAM 00040060 %00160000: 00160000 0x8000 0x8000 RAM
00040062 %00168000: 00168000 0x8000 0x8000 RAM 00040062 %00168000: 00168000 0x8000 0x8000 RAM
00040064 %00170000: 00170000 0x8000 0x8000 RAM 00040064 %00170000: 00170000 0x8000 0x8000 RAM
00040066 %00178000: 00178000 0x8000 0x8000 RAM 00040066 %00178000: 00178000 0x8000 0x8000 RAM
00040068 %00180000: 00180000 0x8000 0x8000 RAM 00040068 %00180000: 00180000 0x8000 0x8000 RAM
0004006A %00188000: 00188000 0x8000 0x8000 RAM 0004006A %00188000: 00188000 0x8000 0x8000 RAM
0004006C %00190000: 00190000 0x8000 0x8000 RAM 0004006C %00190000: 00190000 0x8000 0x8000 RAM
0004006E %00198000: 00198000 0x8000 0x8000 RAM 0004006E %00198000: 00198000 0x8000 0x8000 RAM
00040070 %001A0000: 001A0000 0x8000 0x8000 RAM 00040070 %001A0000: 001A0000 0x8000 0x8000 RAM
00040072 %001A8000: 001A8000 0x8000 0x8000 RAM 00040072 %001A8000: 001A8000 0x8000 0x8000 RAM
00040074 %001B0000: 001B0000 0x8000 0x8000 RAM 00040074 %001B0000: 001B0000 0x8000 0x8000 RAM
00040076 %001B8000: 001B8000 0x8000 0x8000 RAM 00040076 %001B8000: 001B8000 0x8000 0x8000 RAM
00040078 %001C0000: 001C0000 0x8000 0x8000 RAM 00040078 %001C0000: 001C0000 0x8000 0x8000 RAM
0004007A %001C8000: 001C8000 0x8000 0x8000 RAM 0004007A %001C8000: 001C8000 0x8000 0x8000 RAM
0004007C %001D0000: 001D0000 0x8000 0x8000 RAM 0004007C %001D0000: 001D0000 0x8000 0x8000 RAM
0004007E %001D8000: 001D8000 0x8000 0x8000 RAM 0004007E %001D8000: 001D8000 0x8000 0x8000 RAM
00040080 %001E0000: 001E0000 0x8000 0x8000 RAM 00040080 %001E0000: 001E0000 0x8000 0x8000 RAM
00040082 %001E8000: 001E8000 0x8000 0x8000 RAM 00040082 %001E8000: 001E8000 0x8000 0x8000 RAM
00040084 %001F0000: 001F0000 0x8000 0x8000 RAM 00040084 %001F0000: 001F0000 0x8000 0x8000 RAM
00040086 %001F8000: 001F8000 0x8000 0x8000 RAM 00040086 %001F8000: 001F8000 0x8000 0x8000 RAM
0004002E %00FA0000: 00FA0000 0x8000 0x8000 RAM 0004002E %00FA0000: 00FA0000 0x8000 0x8000 RAM
00040030 %00FA8000: 00FA8000 0x8000 0x8000 RAM 00040030 %00FA8000: 00FA8000 0x8000 0x8000 RAM
00040032 %00FB0000: 00FB0000 0x8000 0x8000 RAM 00040032 %00FB0000: 00FB0000 0x8000 0x8000 RAM
00040034 %00FB8000: 00FB8000 0x8000 0x8000 RAM 00040034 %00FB8000: 00FB8000 0x8000 0x8000 RAM
00040036 %00FC0000: 00FC0000 0x8000 0x8000 RAM 00040036 %00FC0000: 00FC0000 0x8000 0x8000 RAM
00040038 %00FC8000: 00FC8000 0x8000 0x8000 RAM 00040038 %00FC8000: 00FC8000 0x8000 0x8000 RAM
0004003A %00FD0000: 00FD0000 0x8000 0x8000 RAM 0004003A %00FD0000: 00FD0000 0x8000 0x8000 RAM
0004003C %00FD8000: 00FD8000 0x8000 0x8000 RAM 0004003C %00FD8000: 00FD8000 0x8000 0x8000 RAM
0004003E %00FE0000: 00FE0000 0x8000 0x8000 RAM 0004003E %00FE0000: 00FE0000 0x8000 0x8000 RAM
00040040 %00FE8000: 00FE8000 0x8000 0x8000 RAM 00040040 %00FE8000: 00FE8000 0x8000 0x8000 RAM
00040042 %00FF0000: 00FF0000 0x8000 0x8000 RAM 00040042 %00FF0000: 00FF0000 0x8000 0x8000 RAM
00040044 %00FF8000: 00FF8000 0x8000 0x8000 RAM 00040044 %00FF8000: 00FF8000 0x8000 0x8000 RAM
00040046 %80C00000: 80C00000 0x0001 0x8000 H/W 00040046 %80C00000: 80C00000 0x0001 0x8000 H/W
00040004 %FFFF0000: 000F8000 0x8000 0x8000 ROM 00040004 %FFFF0000: 000F8000 0x8000 0x8000 ROM
00040004 %FFFF8000: 000F8000 0x8000 0x8000 ROM 00040004 %FFFF8000: 000F8000 0x8000 0x8000 ROM
But when we stopped here next, it was no longer good:
breakpoint hit: F000:F498 (exec)
stopped (27572162 ops, 443166 cycles, 143 ms, 3099063 hz)
EAX=0000FF00 EBX=00000080 ECX=0000270F EDX=0000004A
ESP=000000FE EBP=00000000 ESI=00007FB6 EDI=00008000
SS=0030 DS=0040 ES=0000 FS=0000 GS=0304 PS=00000046 V0 D0 I0 T0 S0 Z1 A0 P1 C0
F000:F498 2E CS:
F000:F499 0F01167E07 LGDT [077E]
F000:077E 0047 0730 00FF FFFF - 0000 0000 87AA 0018 G.0.............
F000:078E 87F8 0018 8828 0018 - 0F2E 1601 0778 200F ....(.......x..
%00FF0730 0000 0000 0000 0000 - 0000 0000 0000 0000 ................
%00FF0740 0000 0000 0000 0000 - 0000 0000 0000 0000 ................
Turns out this is because the A20 line has been disabled.
Let's look at a complete run:
EAX=00000000 EBX=00000000 ECX=00000000 EDX=00000304
ESP=00000000 EBP=00000000 ESI=00000000 EDI=00000000
SS=0000 DS=0000 ES=0000 FS=0000 GS=0000 PS=00000002 V0 D0 I0 T0 S0 Z0 A0 P0 C0
F000:FFF0 EA05F900F0 JMP F000:F905
I want to catch writes to the top-left corner of the screen, so I set a write breakpoint:
bw b800:0
which reports:
write breakpoint added to memory block 000B8000
breakpoint enabled: B800:0000 (write)
and then we're off:
running
chipset.outPort(0x0084,DMA.SPARE0.PAGE,0x00) @F000:F907
chipset.outPort(0x0084,DMA.SPARE0.PAGE,0x01) @F000:F926
chipset.outPort(0x0084,DMA.SPARE0.PAGE,0x02) @F000:F93C
chipset.outPort(0x0084,DMA.SPARE0.PAGE,0x03) @F000:F942
chipset.outPort(0x0084,DMA.SPARE0.PAGE,0x04) @F000:F946
chipset.outPort(0x0084,DMA.SPARE0.PAGE,0x05) @F000:F95F
chipset.outPort(0x0084,DMA.SPARE0.PAGE,0x06) @F000:F978
chipset.outPort(0x0084,DMA.SPARE0.PAGE,0x08) @F000:F9AA
notice: PIC0(0x20): unsupported OCW2 automatic EOI command: 0x00
stopped (149 ops, 622 cycles, 92 ms, 6761 hz)
EAX=0000F000 EBX=00000000 ECX=00000008 EDX=00000020
ESP=00000000 EBP=00000000 ESI=0000F8E7 EDI=00000000
SS=0000 DS=F000 ES=0000 FS=0000 GS=0304 PS=00000046 V0 D0 I0 T0 S0 Z1 A0 P1 C0
F000:F9ED E6A0 OUT A0,AL
running
notice: PIC1(0xA0): unsupported OCW2 automatic EOI command: 0x00
stopped (150 ops, 5 cycles, 19 ms, 263 hz)
EAX=0000F000 EBX=00000000 ECX=00000008 EDX=00000020
ESP=00000000 EBP=00000000 ESI=0000F8E7 EDI=00000000
SS=0000 DS=F000 ES=0000 FS=0000 GS=0304 PS=00000046 V0 D0 I0 T0 S0 Z1 A0 P1 C0
F000:F9EF B009 MOV AL,09
running
chipset.outPort(0x0084,DMA.SPARE0.PAGE,0x09) @F000:F9F1
chipset.outPort(0x0084,DMA.SPARE0.PAGE,0x0F) @F000:BAAA
chipset.outPort(0x0084,DMA.SPARE0.PAGE,0x10) @F000:BAFB
bus.outPort(0x004B,unknown,0x12) @F000:BAFF
bus.outPort(0x004B,unknown,0x42) @F000:BB03
bus.outPort(0x004B,unknown,0x92) @F000:BB07
chipset.outPort(0x0084,DMA.SPARE0.PAGE,0x11) @F000:BB29
chipset.outPort(0x0084,DMA.SPARE0.PAGE,0x12) @F000:BB70
breakpoint hit: B800:0000 (write)
stopped (413 ops, 959 cycles, 80 ms, 11988 hz)
EAX=00000720 EBX=0000BA77 ECX=00001FFF EDX=000003D8
ESP=00000000 EBP=0000BB78 ESI=0000F0C6 EDI=00000002
SS=0000 DS=F000 ES=B800 FS=0000 GS=0304 PS=00000046 V0 D0 I0 T0 S0 Z1 A0 P1 C0
F000:9C05 F3 REPZ
F000:9C06 AB STOSW
This is where screen memory is first initialized ("blanked").
chipset.outPort(0x0084,DMA.SPARE0.PAGE,0x13) @F000:BB90
chipset.outPort(0x0084,DMA.SPARE0.PAGE,0x14) @F000:BBB8
chipset.outPort(0x0084,DMA.SPARE0.PAGE,0x15) @F000:BBD8
chipset.outPort(0x0084,DMA.SPARE0.PAGE,0x17) @F000:BC08
chipset.outPort(0x0084,DMA.SPARE0.PAGE,0x18) @F000:BC14
chipset.outPort(0x0084,DMA.SPARE0.PAGE,0x40) @F000:B552
chipset.outPort(0x0084,DMA.SPARE0.PAGE,0x2F) @0018:87B4
chipset.outPort(0x0084,DMA.SPARE0.PAGE,0x41) @F000:B572
chipset.outPort(0x0084,DMA.SPARE0.PAGE,0x42) @F000:B599
chipset.outPort(0x0084,DMA.SPARE0.PAGE,0x43) @F000:B5C4
chipset.outPort(0x0084,DMA.SPARE0.PAGE,0x44) @F000:B5D2
chipset.outPort(0x0084,DMA.SPARE0.PAGE,0x45) @F000:B600
chipset.outPort(0x0084,DMA.SPARE0.PAGE,0x43) @F000:B5C4
chipset.outPort(0x0084,DMA.SPARE0.PAGE,0x44) @F000:B5D2
chipset.outPort(0x0084,DMA.SPARE0.PAGE,0x45) @F000:B600
chipset.outPort(0x0084,DMA.SPARE0.PAGE,0x46) @F000:B61C
chipset.outPort(0x0084,DMA.SPARE0.PAGE,0x19) @F000:BC2C
chipset.outPort(0x0084,DMA.SPARE0.PAGE,0x30) @F000:A8B0
chipset.outPort(0x0084,DMA.SPARE0.PAGE,0x31) @F000:A905
chipset.outPort(0x0084,DMA.SPARE0.PAGE,0x32) @F000:A91D
chipset.outPort(0x0084,DMA.SPARE0.PAGE,0x33) @F000:A93B
chipset.outPort(0x0084,DMA.SPARE0.PAGE,0x34) @F000:A953
chipset.outPort(0x0084,DMA.SPARE0.PAGE,0x36) @F000:A991
chipset.outPort(0x0084,DMA.SPARE0.PAGE,0x38) @F000:A99C
chipset.outPort(0x0084,DMA.SPARE0.PAGE,0x39) @F000:A9BC
bus.inPort(0x03BC,unknown) @F000:A9CA
bus.outPort(0x03BC,unknown,0x00) @F000:A9CD
bus.inPort(0x03BC,unknown) @F000:A9D0
bus.inPort(0x0378,unknown) @F000:A9CA
bus.outPort(0x0378,unknown,0x00) @F000:A9CD
bus.inPort(0x0378,unknown) @F000:A9D0
bus.inPort(0x0278,unknown) @F000:A9CA
bus.outPort(0x0278,unknown,0x00) @F000:A9CD
bus.inPort(0x0278,unknown) @F000:A9D0
chipset.outPort(0x0084,DMA.SPARE0.PAGE,0x3A) @F000:A9DE
chipset.outPort(0x0084,DMA.SPARE0.PAGE,0x3B) @F000:A9FB
chipset.outPort(0x0084,DMA.SPARE0.PAGE,0x52) @F000:AA41
chipset.outPort(0x0084,DMA.SPARE0.PAGE,0x53) @F000:AA54
bus.outPort(0x03B9,unknown,0x30) @F000:9BE7
write breakpoint added to memory block 000B8000
write breakpoint added to memory block 000B8000
breakpoint hit: B800:0000 (write)
stopped (1340834 ops, 3291994 cycles, 821 ms, 4009737 hz)
EAX=00000720 EBX=00000720 ECX=00003FFF EDX=0000B800
ESP=000000D0 EBP=FFFF2230 ESI=00000CBA EDI=00000002
SS=0030 DS=0000 ES=B800 FS=0000 GS=0304 PS=00000246 V0 D0 I1 T0 S0 Z1 A0 P1 C0
C000:0E93 F3 REPZ
C000:0E94 AB STOSW
Now the video card's own BIOS is doing the same thing, followed by more of the same:
write breakpoint added to memory block 000B8000
write breakpoint added to memory block 000B8000
breakpoint hit: B800:0000 (write)
stopped (1384492 ops, 79242 cycles, 52 ms, 1523885 hz)
EAX=00000720 EBX=00000720 ECX=00003FFF EDX=0000B800
ESP=000000C8 EBP=FFFF2230 ESI=00000C3A EDI=00000002
SS=0030 DS=0000 ES=B800 FS=0000 GS=0304 PS=00000246 V0 D0 I1 T0 S0 Z1 A0 P1 C0
C000:0E93 F3 REPZ
C000:0E94 AB STOSW
running
breakpoint hit: B800:0000 (write)
stopped (1476959 ops, 347538 cycles, 67 ms, 5187134 hz)
EAX=00000FDB EBX=00000FDB ECX=00000050 EDX=000003DA
ESP=000000CC EBP=FFFF00E2 ESI=00000000 EDI=00000002
SS=0030 DS=0000 ES=B800 FS=0000 GS=0304 PS=00000246 V0 D0 I1 T0 S0 Z1 A0 P1 C0
C000:18D7 FB STI
running
write breakpoint added to memory block 000B8000
write breakpoint added to memory block 000B8000
breakpoint hit: B800:0000 (write)
stopped (2824784 ops, 4644466 cycles, 528 ms, 8796337 hz)
EAX=00000720 EBX=00000720 ECX=00003FFF EDX=0000B800
ESP=000000C8 EBP=FFFF2230 ESI=00000CBA EDI=00000002
SS=0030 DS=0000 ES=B800 FS=0000 GS=0304 PS=00000246 V0 D0 I1 T0 S0 Z1 A0 P1 C0
C000:0E93 F3 REPZ
C000:0E94 AB STOSW
running
chipset.outPort(0x0084,DMA.SPARE0.PAGE,0x8C) @F000:D05C
chipset.outPort(0x0084,DMA.SPARE0.PAGE,0x1A) @F000:BC79
chipset.outPort(0x0084,DMA.SPARE0.PAGE,0x50) @F000:AA76
chipset.outPort(0x0084,DMA.SPARE0.PAGE,0x51) @F000:AA7F
chipset.outPort(0x0084,DMA.SPARE0.PAGE,0x52) @F000:AA9C
chipset.outPort(0x0084,DMA.SPARE0.PAGE,0x1B) @F000:BC80
chipset.outPort(0x0084,DMA.SPARE0.PAGE,0x1C) @F000:BC87
chipset.outPort(0x0084,DMA.SPARE0.PAGE,0x90) @F000:CC53
chipset.outPort(0x0084,DMA.SPARE0.PAGE,0x91) @F000:CC85
chipset.outPort(0x0084,DMA.SPARE0.PAGE,0x1D) @F000:BC8E
chipset.outPort(0x0084,DMA.SPARE0.PAGE,0x93) @F000:CC8A
chipset.outPort(0x0084,DMA.SPARE0.PAGE,0x94) @F000:CD06
chipset.outPort(0x0084,DMA.SPARE0.PAGE,0x95) @F000:CD3C
chipset.outPort(0x0084,DMA.SPARE0.PAGE,0x96) @F000:CD6A
chipset.outPort(0x0084,DMA.SPARE0.PAGE,0x2D) @F000:BC95
chipset.outPort(0x0084,DMA.SPARE0.PAGE,0x0D) @F000:E107
bus.outPort(0x004B,unknown,0x12) @F000:E10B
bus.outPort(0x0048,unknown,0x22) @F000:E112
bus.outPort(0x004B,unknown,0x00) @F000:E139
bus.inPort(0x0048,unknown) @F000:E13B
bus.inPort(0x0048,unknown) @F000:E13E
bus.outPort(0x004B,unknown,0x12) @F000:E11A
chipset.outPort(0x0084,DMA.SPARE0.PAGE,0x0E) @F000:E11E
bus.outPort(0x004B,unknown,0x92) @F000:E122
bus.outPort(0x004A,unknown,0x22) @F000:E129
bus.outPort(0x004B,unknown,0x80) @F000:E139
bus.inPort(0x004A,unknown) @F000:E13B
bus.inPort(0x004A,unknown) @F000:E13E
bus.outPort(0x004B,unknown,0x92) @F000:E131
chipset.outPort(0x0084,DMA.SPARE0.PAGE,0x1E) @F000:BC9C
chipset.outPort(0x0084,DMA.SPARE0.PAGE,0x80) @F000:CFDF
chipset.outPort(0x0084,DMA.SPARE0.PAGE,0x81) @F000:CFF7
chipset.outPort(0x0084,DMA.SPARE0.PAGE,0x82) @F000:D011
chipset.outPort(0x0084,DMA.SPARE0.PAGE,0x84) @F000:D02D
chipset.outPort(0x0084,DMA.SPARE0.PAGE,0x1F) @F000:BCA3
chipset.outPort(0x0084,DMA.SPARE0.PAGE,0x75) @F000:F74D
chipset.outPort(0x0084,DMA.SPARE0.PAGE,0x76) @F000:F761
chipset.outPort(0x0084,DMA.SPARE0.PAGE,0x77) @0030:F772
chipset.outPort(0x0084,DMA.SPARE0.PAGE,0x78) @0030:F790
chipset.outPort(0x0084,DMA.SPARE0.PAGE,0x00) @F000:F907
chipset.outPort(0x0084,DMA.SPARE0.PAGE,0x07) @F000:F986
chipset.outPort(0x0084,DMA.SPARE0.PAGE,0x08) @F000:F9AA
notice: PIC0(0x20): unsupported OCW2 automatic EOI command: 0x00
stopped (19729382 ops, 81457037 cycles, 7165 ms, 11368742 hz)
EAX=0000F000 EBX=00000006 ECX=00000008 EDX=00000020
ESP=00000000 EBP=00000000 ESI=0000F8E7 EDI=00000000
SS=0000 DS=F000 ES=0000 FS=0000 GS=0000 PS=00000046 V0 D0 I0 T0 S0 Z1 A0 P1 C0
F000:F9ED E6A0 OUT A0,AL
running
notice: PIC1(0xA0): unsupported OCW2 automatic EOI command: 0x00
stopped (19729383 ops, 5 cycles, 20 ms, 250 hz)
EAX=0000F000 EBX=00000006 ECX=00000008 EDX=00000020
ESP=00000000 EBP=00000000 ESI=0000F8E7 EDI=00000000
SS=0000 DS=F000 ES=0000 FS=0000 GS=0000 PS=00000046 V0 D0 I0 T0 S0 Z1 A0 P1 C0
F000:F9EF B009 MOV AL,09
We're back in the Compaq BIOS, the video card appears to be fully initialized now, so perhaps the next write to video memory will be the first memory test results.
And in fact, it is. But the "bw b800:0" command doesn't work, because the memory test results are being performed in protected-mode, and there is no segment 0xB800 mapped to video memory at that point.
So the write breakpoint must be specified as "bw %b8000" instead. Now we catch it:
chipset.outPort(0x0084,DMA.SPARE0.PAGE,0x09) @F000:F9F1
chipset.outPort(0x0084,DMA.SPARE0.PAGE,0x79) @F000:F7CD
chipset.outPort(0x0084,DMA.SPARE0.PAGE,0x7B) @F000:F814
chipset.outPort(0x0084,DMA.SPARE0.PAGE,0x20) @F000:BCAA
chipset.outPort(0x0084,DMA.SPARE0.PAGE,0x60) @F000:D6E6
chipset.outPort(0x0084,DMA.SPARE0.PAGE,0x61) @F000:D704
chipset.outPort(0x0084,DMA.SPARE0.PAGE,0x18) @0030:870A
chipset.outPort(0x0084,DMA.SPARE0.PAGE,0x18) @0030:8715
chipset.outPort(0x0084,DMA.SPARE0.PAGE,0x62) @0030:D719
chipset.outPort(0x0084,DMA.SPARE0.PAGE,0x63) @0030:D761
chipset.outPort(0x0084,DMA.SPARE0.PAGE,0x70) @0030:DB38
breakpoint hit: %000B8000 (write)
stopped (19736120 ops, 23810 cycles, 165 ms, 144303 hz)
EAX=00000000 EBX=0000000A ECX=0000000A EDX=00000730
ESP=000000D0 EBP=00000080 ESI=00000095 EDI=00008002
SS=0028[00000300,FFFF] DS=0018[0001C000,FFFF] ES=0040[000B0000,FFFF]
CS=0030[000F0000,FFFF] FS=0000[00000000,FFFF] GS=0304[00003040,FFFF]
LD=0000[00000000,0000] GD=[0001C000,005F] ID=[000FF821,0007] TR=0000 A20=ON
CR0=0000FFF1 CR2=00000000 CR3=00000000 PS=00000082 V0 D0 I0 T0 S1 Z0 A0 P0 C0
0030:80DA F3 REPZ
0030:80DB A5 MOVSW
x8509: Memory test of top 128Kb of top 16Mb? xdb33: