Luke T. Shumaker
I'm trying to boot #plan9 1e (1992). Using entirely #FreeSoftware.
It has a surprising number of ports, but for most of them the install process is a very non-trivial procedure that you run on the existing Unix. Figuring out how to run Solaris 2 sun4c or RISC/os binaries feels both out-of-scope and probably involves non-free software. Also they require multiple boxes.
But the 386/486 PC port has no install procedure; just boot this floppy!
Luke T. Shumaker
But remember how we used to have a bunch of bootloaders and kernels that were #MSDOS programs, so that #DOS could initialize the hardware for it (eg: syslinux)? That's the #Plan9 1e process; run `b.com` from DOS, and that will load the `9dos` kernel.
And unlike Solaris 2 or RISC/os or whatever, #FreeDOS is #FreeSoftware and is easy to get running in #Qemu.
Luke T. Shumaker
But depending on my `fdconfig.sys` I either get it in a boot-loop (IDK if from b.com or 9dos) or a kernel-panic from 9dos (at least it's getting out of b.com!).
Anyone have troubleshooting resources for adjusting #FreeDOS `fdconfig.sys` or #Qemu flags (or other emulators) for circa-1992 software?
I'm too young to remember config.sys, and my #RetroComputing hasn't involved much #DOS yet.
Luke T. Shumaker
It was known to work on the "AT&T Safari", "AT&T 6386", and "Gateway 486". That probably means MS-DOS 3.2 or 4.01.
Luke T. Shumaker
In the long-run, the easiest way to run #Plan9 1e (esp on non-PC platforms) will probably be to write a simple #GNULinux server program that serves BOOTP (pre-DHCP!) + TFTP for PXE boot, and #9P of the archive tarball. But 1e uses a much too old dialect of 9P for any existing software except for 1e itself to be able to serve it. And I don't want to try to write a server for it if I don't have a client to test with.
So getting `/sys/lib/pcdisk` to boot from FreeDOS is in the bootstrapping path.
Luke T. Shumaker
Actually, #Plan9 4e has a program for serving the old 2e/3e protocol (9P1). And so maybe 2e has a program for serving the old 1e protocol (which I call 9P0)?
So if I can't get the 1e stand-alone PC version working, maybe I get 4e serving PXE+9P1 to boot 2e, and then I get that serving 9P0 to boot 1e?
Keeping the boot quirks of multiple versions of Plan9 straight in my head at once doesn't seem fun tho.
Luke T. Shumaker
Actually, I think u9fs can serve both 9P2000 and 9P1. So I guess I could cut 4e out of that chain.
WAIT! 1e had /sys/src/cmd/unix/u9fs/ too! That'll serve 9P0! It'll probably take some minor modification to get it to build on a modern system, but that is another potential path.
Luke T. Shumaker
After spending some time in ghidra mapping addresses to lines of code:
The boot-loop is from the 9dos kernel, not from the b.com bootloader.
Luke T. Shumaker
... and it's after the scheduler has started :(
I was really expecting it to be in early initialization. That would have made debugging it a lot easier.
Luke T. Shumaker
And I'm evidently confused about how the memory map is set up. I seem to have (most of?) the code in the right place in ghidra, but global variables are clearly wack.
Luke T. Shumaker
"return 0 if OK, -1 if bullshit"
Luke T. Shumaker
So I figured out yesterday that `BOOT` is not defined (as in `#ifdef BOOT`). But I still had some assumptions about the memory map in my head that were based on assuming that #ifdef BOOT
Luke T. Shumaker
Besides the fact that I've mostly been dealing with ARM for the last few months:
Any hope of keeping x86 asm operand order straight has been annihilated by dealing with 3 different assembly syntaxes: whatever it is that GDB shows me (AT&T syntax), whatever it is that Ghidra shows me (Intel syntax), and Plan 9 assembler (which--despite being out of AT&T--superficially looks more like Intel syntax but with AT&T order).
Luke T. Shumaker
Why is #ghidra's memory map editor so difficult to use?
Luke T. Shumaker
So from the kernel's initialization, I have figured out exactly which region it considers to be BSS. And there's conspicuously a gap between data and BSS in the memory map.
I have data right after text. But looking back at the bootloader, isn't read into `text_addr+text_size`, it's read into `PGROUND(text_addr+text_size)`, so fingers crossed that moving that forward a bit makes things start making sense!
Luke T. Shumaker
The memory map now indeed makes sense in ghidra! And the gap between data and BSS went away.
Luke T. Shumaker
And I got to the login screen!
...
by trying to single-step to find the crash. I guess it's timing related where the kernel couldn't handle the CPU going that fast?
Luke T. Shumaker
But now it's hanging at "fs..."
Luke T. Shumaker
char Egreg[] = "it's a thermal problem";
Who is Greg? #Plan9
Luke T. Shumaker
Ugg, ret-sync is useless here. It relies on gdb `info proc mappings`, which doesn't work on remote targets. But I have already put the mappings in #Ghidra!
Luke T. Shumaker
@me_ 1e needs a MIPS Magnum 3000, a 4000 won't do.
I've got in my notes:
NeXT: Previous
MIPS: MAME
Sparc: MAME or TME
My concern with those is more the bootstrapping process with the existing UNIX that is assumed to be running on them, rather than the hardware emulation itself.
Michael Engel
@lukeshu There are a number of open source emulators available. qemu should be able to emulate the MIPS magnum (MIPS R4k-based) and I managed to run the 2nd edition NeXT port on Previous (https://sourceforge.net/projects/previous/), haven't tested 1e. A Sun 4c Sparcstation 2 is emulated by tme (https://people.csail.mit.edu/fredette/tme/index.html), but that's difficult to build. Working emulators for the Hobbit, Gnot, or Indigo are not available AFAIK. But yes, the PC port is probably the easiest way to run 1e.
Luke T. Shumaker
So somehow I didn't know about #qemu `-d in_asm`, which is letting me finally make progress on figuring out why #Plan9 1e for PC is crashing .
So far:
- "0x800012c6: 00 80 0e 00 00 00 addb %al, 0xe(%eax)": that's not the instructions at that address, it must be getting overwritten
- a few gdb watchpoints later: %sp is getting set to in the code area, so "benign" instructions are corrupting things.
Now to figure out how %sp is getting messed up.
Luke T. Shumaker
So a INT=0x18 (which is supposed to be reserved???) is happening inside of runproc(), but then a INT=0x0e pagefault happens inside of intrcommon, and then a pagefault happens inside of fault386(), and then a pagefault happens inside of fault386(), and that recurses ~2000 times with the stack growing each time until it overflows all the way into the text area.
Luke T. Shumaker
Oh, ok, INT=0x18-0x1F are the first 8259 PIC, and #Plan9 programs it such that INT=0x18 is the clock interrupt.
Luke T. Shumaker
The pagefaulting instruction is
0x80001255: 0f a9 popl %gs
At first I was thinking "it's just a pop; how in the world could the stack have gotten paged out!?" and "`qemu -d mem` says there aren't any mmu operations between the corresponding `pushl` and that popl".
But CR2=000004c0, and that neither looks like a stack address nor looks much like SP=0008:80064c08.
Ahh, GS is a register related to segmented memory; GS=04c7.
I don't want to learn segmented memory :(
GNU social JP is a social network, courtesy of GNU social JP管理人. It runs on GNU social, version 2.0.2-dev, available under the GNU Affero General Public License.
All GNU social JP content and data are available under the Creative Commons Attribution 3.0 license.