VOGONS


First post, by superfury

User metadata
Rank l33t++
Rank
l33t++

I get the following thing on the screen:

Creative DOS Multimedia Architecture (v1.00)
CTSOUND Physical-Level driver (v1.01) for Sound Blaster 2.
Copyright (C) Creative Technology Ltd., 1993. All rights reserved.
Driver Unit Number = 0
Base I/O Addx = 220 hex
IRQ = 5

The program is executing a JMP to self, opcode EB, at 0000:03B6. DS=5D7C; ES=0; SS=0B54; AX=0B54; BX=4F0B; CX=3D49; DX=5D7C; SP=029E; BP=02AB; SI=FFFF; DI=022C; FLAGS=F882. Only IRQ0 has an request.
That is what the debugger tells me at that point.

SinceI see it jumping to it's own address, it's a 0xEBFE(JMP $-2) instruction.

Increasing the cycle count (instead of 8088 accurate speeds, using 3000 Dosbox-style cycles), makes the application not crash at that point.

Anyone knows what the cause of this might be? Is there an error in my Sound Blaster that's causing it?

Author of the UniPCemu emulator.
UniPCemu Git repository
UniPCemu for Android, Windows, PSP, Vita and Switch on itch.io

Reply 1 of 6, by Jo22

User metadata
Rank l33t++
Rank
l33t++

Hi superfury, I've got a SB 2.0 and a 4.77MHz PC (got it recently).
If you like, I can run this driver on the real thing and tell you if it crashes (btw, what is this driver for ?).

"Time, it seems, doesn't flow. For some it's fast, for some it's slow.
In what to one race is no time at all, another race can rise and fall..." - The Minstrel

//My video channel//

Reply 2 of 6, by Jepael

User metadata
Rank Oldbie
Rank
Oldbie

What is the driver for? Most games just use the card directly, but yeah some programs want to use the TSR programs so they don't have to use it directly.

My first thought is that something has gone horribly wrong as the code area it is running in (0000:03B6) is in the area reserved for interrupt vectors (0:0..0:3ff). There might be a reason for this but it is very suspicious.

Reply 3 of 6, by superfury

User metadata
Rank l33t++
Rank
l33t++

Hmmm... maybe an interrupt vector is missing(the Sound Blaster IRQ5 handler) for some reason? It has something to do with timing it seems, as 3000 cycles doesn't give the bug, but 8088 speed(4.77MHz accurate timing w/ 8088 CPU clock cycles) gives the bug. Maybe the reset command (which uses 20us timeout before triggering the IRQ5)? Is that one correct(based on Dosbox)?

The driver is installed by the Creative Sound Blaster 2.0 install disks (4 disks gotten from vogonsdrivers). I think it needs it for accessing the hardware, when using the supplied programs (play.exe etc.)?

@Jo22: Yes, please test it on the actual hardware. I want to know if it's a bug in my emulator, or if it's the actual hardware timings or emulation that is at fault(if any).

Author of the UniPCemu emulator.
UniPCemu Git repository
UniPCemu for Android, Windows, PSP, Vita and Switch on itch.io

Reply 4 of 6, by superfury

User metadata
Rank l33t++
Rank
l33t++

I've modified the Sound Blaster code a bit: The timeout for command 0xF2 'IRQ Request' for the Sound Blaster DSP was 20ns instead of 20us(after comparing code to Dosbox's blaster.cpp ( https://sourceforge.net/p/dosbox/code-0/HEAD/ … re/sblaster.cpp )

My latest Sound Blaster code:
https://bitbucket.org/superfury/unipcemu/src/ … ter.c?at=master

It now crashes at a different point.

Command: <HLT>
OP: 06
ROP: F4
CS:0000
IP:0005
DS:0000
ES:0000
SS:86C4
AX:DA00
BX:3736
CX:E005
DX:A4CF
SP:8AD7
BP:0000
SI:A6EE
DI:0000
F:F492
c1p0A0zStiDo1111H
0000000000000001
VGA@842,289(CRT:0,323)
Display=801,446

That's what's dumped by the emulator's debugger.
OP is the first active opcode byte, ROP is the active opcode byte(the first non-prefix opcode), F is flags register. The flags described are 0/1 for unchangable values, lower case for not set, upper case for set, H means HLT state(same with the command being <HLT>).
The final big number is the binary value of the IRQ requests pending.
VGA@x1,y1(CRT:x2,y2)
Display=z1,z2 means that the VGA's raster is at x1,y1(virtual point), while it's CRT emulation is at position x2,y2. z1,z2 is the current display resolution detected by the monitor.

Author of the UniPCemu emulator.
UniPCemu Git repository
UniPCemu for Android, Windows, PSP, Vita and Switch on itch.io

Reply 5 of 6, by superfury

User metadata
Rank l33t++
Rank
l33t++

After enabling a special log of invalid commands sent to the DSP I notice it receives two invalid commands:
Commands 08h and 55h. Both don't exist, according to this list: http://the.earth.li/~tfm/oldpage/sb_dsp.html.

Looking at the Dosbox source code, command 08h is SB16 ASP get version, but why would the Sound Blaster 2.0 driver call that command for a Sound Blaster 2.0?

Edit: These are the current commands executed on the DSP by the program:

00:05:54:54.07168: Command: E0@ver. 0200
00:06:15:59.03984: Command: E4@ver. 0200
00:06:35:44.02528: Command: E8@ver. 0200
00:06:46:95.07696: Command: E1@ver. 0200
00:06:58:13.04464: Command: E1@ver. 0200
00:07:05:48.02112: Command: E1@ver. 0200
00:07:16:12.06016: Invalid Command: 08@ver. 0200
00:07:42:44.02208: Invalid Command: 55@ver. 0200
00:07:49:22.02720: Command: F2@ver. 0200
00:07:59:02.08992: Command: 40@ver. 0200
00:09:01:78.04576: Command: 24@ver. 0200

It ends with commands F2(Raise IRQ), 40(Set Time Constant) and 24(DMA ADC 8-bit). Though I don't know why it would execute a DMA ADC 8-bit command? The DMA transaction won't start until the first sample is read using Direct mode, according to TFM's DSP commands Page. However, directly after the command is executed, it gives the error? Is an IRQ supposed to be raised there?

Edit: Fixed the handling and initialization of the driver by implementing the command 0x24(Direct DMA ADC) bug, which raises an interrupt, gives the first sample through Direct ADC, then continues using normal DMA ADC.

It seems Dosbox doesn't emulate this bug, which is used in the Sound Blaster 2.0 driver? Why doesn't Dosbox emulate this bug?

Author of the UniPCemu emulator.
UniPCemu Git repository
UniPCemu for Android, Windows, PSP, Vita and Switch on itch.io

Reply 6 of 6, by Jo22

User metadata
Rank l33t++
Rank
l33t++

Hello again, the driver seems to work fine on my PC/XT clone.
It previously came with german MS-DOS 3.2 installed and a few utilities were also left behind.
The driver loads normaly and shows a message during boot up (see picture below):

MS-DOS 6.22 was booted clean without any additional drivers, just ctsb2.sys.
Note that I had to change the card from IRQ5 to IRQ7, because my MFM controller is on IRQ5.

I tested the driver with this computer model and these cards:

- Sound Blaster 2.0 CT1350B (DSP 2.02)
- Sound Machine (DSP 2.02)
- Aztech (DSP 2.01)

The first two were accepted by the driver without any issues.
The third one didn't work. The Creative software complained "This driver only works for SB 2.0" or similar.
Without any card installed, it complained about a wrong parameter in config.sys.

I also wrote down the memory addresses from CheckIt! for you.
These were shown with the original card installed.

-- Interrupt Vector Table (IVT) --

0321:D00C INT EFh CTSOUND0

036C:C800 INT F6h CTSOUND0

0000:FFFF INT FFh CTSOUND0

- DOS DEVICES -

0B81:0000 CTSOUND0 ATTR=C800 DOS3.20 IOCTL

I hope this can somehow be useful for you.
I also attached the logs from MSD and System Information (SI)..

"Time, it seems, doesn't flow. For some it's fast, for some it's slow.
In what to one race is no time at all, another race can rise and fall..." - The Minstrel

//My video channel//