Re: Debugging APM - cat /proc/apm produces oops

[Chuck Ebbert <76306.1226@compuserve.com>]

In-Reply-To: <200607242351.37578.linux@rainbow-software.org>

On Mon, 24 Jul 2006 23:51:37 +0200, Ondrej Zary wrote:
>
> > >  printing eip:
> > > 00002f9d
> > > *pre = 00000000
> > > Oops: 0002 [#4]
> > > Modules linked in:
> > > CPU:    0
> > > EIP:    00c0:[<00002f9d>]    Not tainted VLI
> >
> >           ^^^^
> > This is the APM BIOS 16 bit code segment.
>
> Looking at BIOS disassembly:
> 2F97: push bp
> 2F98: mov bp,sp
> 2F9A: add sp,-2
> 2F9D: mov [bp][-2],bx    <-- it oopses here

That's expected.  You can push/pop/call/ret using the kernel stack
because its 32-bit stack-size attribute controls how the stack is
addressed, but using it like that makes it use 16 bits (the CS
address size.)

This could probably be fixed in the kernel but it doesn't look
worth the trouble since the fix could be really ugly.

> I realized that I can modify the BIOS easily as it's stored in shadow RAM. So 
> I replaced the offending MOV with three NOPs and tested again. This time it 
> oopsed at 0x2FAD:
> 2FAD: cmp w,[bp][-2],1
> 2FB1: je 2FCB
> 
> that jump was taken during my single stepping, so I NOPped out the CMP and 
> replaced JE with JMPS. Then booted Linux and APM seems to work fine - battery 
> percentage and remaining time is there as well as AC power status.
> There seems to be 4 these operations:
> mov [bp][-2],bx
> cmp w,[bp][-2],1
> cmp w,[bp][-2],8002
> cmp w,[bp][-2],8001
> but I've hit only the first two of them. I wonder what's that for (especially 
> when it works without that).

Something is calling this after pushing the arg to the function onto the
stack.  I guess it's always calling it with a 1 if that's all you are seeing.

-- 
Chuck