-
Notifications
You must be signed in to change notification settings - Fork 0
Reference VrDebug bitmask
This page owns: the veneer's built-in tracing flags, which are not documented anywhere else we could find.
VENEER.EXE carries extensive tracing, controlled by a bitmask in its image. Turning the right
bits on is the fastest way to find out what the firmware is actually doing, and it is free.
The mask is a word at veneer image address 0x60C0C. Written with the little-endian word
munge, as every poke here is:
machine.memory.poke.l 0x60c08 0x2060
Or, via the generator:
python3 tools/mkbootscript.py --vrdebug 0x2060 …→ Little-endian PowerPC for why the poke address differs from the image address.
| Bit | Traces |
|---|---|
0x0001 |
VrGetChild, VrGetPeer, VrGetParent, VrGetComponent, VrGetConfigurationData
|
0x0002 |
OFCallMethod |
0x0008 |
the Open Firmware → ARC device-tree conversion (convert_node, walk_obp, PCI conversion) |
0x0010 |
memory descriptors, VrCreateMemoryDescriptors
|
0x0020 |
main, parse_args, find_boot_dev, select_boot; the boot file and OsLoader paths |
0x0040 |
the Vr*Initialize phases, choose_args, InitRestartBlocks
|
0x0080 |
image section processing |
0x0100 |
ArcPathToNode, NodeToPath — how an ARC path becomes an Open Firmware path |
0x0200 |
VrOpen, VrClose, VrMount, VrGetFileInformation, VrGetDirectoryEntry, OFOpen
|
0x0400 |
file-table dumps |
0x0800 |
VrLoad |
0x1000 |
VrRead, VrWrite, VrSeek, VrGetReadStatus
|
0x2000 |
Argv[n] — the argument list actually handed to the loader |
0x4000 |
VrGetEnvironmentVariable, VrSetEnvironmentVariable, GetEnvVar, FindInLocalEnv
|
| Question | Mask |
|---|---|
| What did the firmware tell the loader? | 0x2000 |
| Is it reading the partition, or the whole disk? | 0x1200 |
| Why did an ARC path resolve to that device? | 0x0300 |
| Is the environment being found at all? | 0x4000 |
| General "what is happening" | 0x2060 |
0x2000 is the one to know by heart. One line of output answers "did the environment reach
the loader?", which is otherwise several hours of inference:
Argv[1]: OsLoader=multi(0)scsi(1)disk(0)rdisk(0)partition(1)\os\winnt40\osloader.exe
Argv[2]: SystemPartition=multi(0)scsi(1)disk(0)rdisk(0)partition(1)
0x1000 is the second. It settles the raw-versus-file open question that has caused two
separate walls:
VrSeek: Entry - FileId: 4 Offset: 0.0 Mode: 0
VrRead: Entry - FileId: 4 Buf: 4dbc0 len: 62
VrRead: Exit ReadCount: 62
A 62-byte read at offset 0 is NT's FAT recogniser asking for a BIOS parameter block. What comes back tells you whether the firmware gave it the partition or the MBR.
A warning: 0x1000 is voluminous. A full boot produces thousands of lines.
These addresses are for the VENEER.EXE on the OEM 000-48303 CD, loaded at image base 0x50000.
A different veneer build would differ.
Corrections welcome — this wiki is edited directly, so nothing here has had a review. Repository · STORY.md · GPL-2.0-only
Start here
Theory
- Why NT on a Power Mac is hard
- Open Firmware
- ARC
- The veneer
- The NT boot chain
- The HAL contract
- The NT PowerPC ABI
- Little-endian PowerPC
- How Setup chooses a HAL
- The NT video stack
Machines
Emulator
- Getting Granny Smith
- Media you must supply
- Building the HAL
- Making an OEM CD
- Preparing disks
- Running text-mode Setup
- Capturing the installed image
- Booting the installed system
- Iterating on the HAL
- Checkpoints and deltas
Real hardware
Debugging
- The emulator shell
- Reading NT binaries
- Decoding a bugcheck
- When your instrumentation lies
- Debugging recipes
Reference
- HAL exports
- ARC environment variables
- The veneer's VrDebug bitmask
- Veneer patch catalogue
- Address and interrupt map
- Error codes seen
Project