Skip to content

Reference VrDebug bitmask

pappadf edited this page Sep 14, 2026 · 1 revision

Reference: the veneer's VrDebug bitmask

This page owns: the veneer's built-in tracing flags, which are not documented anywhere else we could find.

VENEER.EXE carries extensive tracing, controlled by a bitmask in its image. Turning the right bits on is the fastest way to find out what the firmware is actually doing, and it is free.


Setting it

The mask is a word at veneer image address 0x60C0C. Written with the little-endian word munge, as every poke here is:

machine.memory.poke.l 0x60c08 0x2060

Or, via the generator:

python3 tools/mkbootscript.py --vrdebug 0x2060 …

Little-endian PowerPC for why the poke address differs from the image address.


The bits

Bit Traces
0x0001 VrGetChild, VrGetPeer, VrGetParent, VrGetComponent, VrGetConfigurationData
0x0002 OFCallMethod
0x0008 the Open Firmware → ARC device-tree conversion (convert_node, walk_obp, PCI conversion)
0x0010 memory descriptors, VrCreateMemoryDescriptors
0x0020 main, parse_args, find_boot_dev, select_boot; the boot file and OsLoader paths
0x0040 the Vr*Initialize phases, choose_args, InitRestartBlocks
0x0080 image section processing
0x0100 ArcPathToNode, NodeToPath — how an ARC path becomes an Open Firmware path
0x0200 VrOpen, VrClose, VrMount, VrGetFileInformation, VrGetDirectoryEntry, OFOpen
0x0400 file-table dumps
0x0800 VrLoad
0x1000 VrRead, VrWrite, VrSeek, VrGetReadStatus
0x2000 Argv[n] — the argument list actually handed to the loader
0x4000 VrGetEnvironmentVariable, VrSetEnvironmentVariable, GetEnvVar, FindInLocalEnv

Which to turn on, and when

Question Mask
What did the firmware tell the loader? 0x2000
Is it reading the partition, or the whole disk? 0x1200
Why did an ARC path resolve to that device? 0x0300
Is the environment being found at all? 0x4000
General "what is happening" 0x2060

0x2000 is the one to know by heart. One line of output answers "did the environment reach the loader?", which is otherwise several hours of inference:

Argv[1]: OsLoader=multi(0)scsi(1)disk(0)rdisk(0)partition(1)\os\winnt40\osloader.exe
Argv[2]: SystemPartition=multi(0)scsi(1)disk(0)rdisk(0)partition(1)

0x1000 is the second. It settles the raw-versus-file open question that has caused two separate walls:

VrSeek: Entry - FileId: 4 Offset: 0.0 Mode: 0
VrRead: Entry - FileId: 4 Buf: 4dbc0 len: 62
VrRead: Exit ReadCount: 62

A 62-byte read at offset 0 is NT's FAT recogniser asking for a BIOS parameter block. What comes back tells you whether the firmware gave it the partition or the MBR.

A warning: 0x1000 is voluminous. A full boot produces thousands of lines.


Caveat

These addresses are for the VENEER.EXE on the OEM 000-48303 CD, loaded at image base 0x50000. A different veneer build would differ.


Next

Clone this wiki locally