From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mailman by lists.gnu.org with tmda-scanned (Exim 4.43) id 1HMRWm-0001Tu-6r for qemu-devel@nongnu.org; Wed, 28 Feb 2007 11:19:40 -0500 Received: from exim by lists.gnu.org with spam-scanned (Exim 4.43) id 1HMRWj-0001RB-EI for qemu-devel@nongnu.org; Wed, 28 Feb 2007 11:19:39 -0500 Received: from [199.232.76.173] (helo=monty-python.gnu.org) by lists.gnu.org with esmtp (Exim 4.43) id 1HMRWj-0001Qw-78 for qemu-devel@nongnu.org; Wed, 28 Feb 2007 11:19:37 -0500 Received: from gmp-ea-fw-1.sun.com ([192.18.1.36]) by monty-python.gnu.org with esmtp (Exim 4.52) id 1HMRWi-0001Vl-Jj for qemu-devel@nongnu.org; Wed, 28 Feb 2007 11:19:36 -0500 Received: from d1-emea-10.sun.com ([192.18.2.120]) by gmp-ea-fw-1.sun.com (8.13.6+Sun/8.12.9) with ESMTP id l1SGJZsK011168 for ; Wed, 28 Feb 2007 16:19:35 GMT Received: from conversion-daemon.d1-emea-10.sun.com by d1-emea-10.sun.com (Sun Java System Messaging Server 6.2-6.01 (built Apr 3 2006)) id <0JE600101L6WLD00@d1-emea-10.sun.com> (original mail from Vitezslav.Batrla@Sun.COM) for qemu-devel@nongnu.org; Wed, 28 Feb 2007 16:19:35 +0000 (GMT) Received: from cml ([129.157.18.72]) by d1-emea-10.sun.com (Sun Java System Messaging Server 6.2-6.01 (built Apr 3 2006)) with ESMTPSA id <0JE600I45LCMCQB0@d1-emea-10.sun.com> for qemu-devel@nongnu.org; Wed, 28 Feb 2007 16:19:35 +0000 (GMT) From: Vita Batrla In-reply-to: <1172655322.9173.35.camel@cml> Sender: Vitezslav.Batrla@Sun.COM Message-id: <1172679528.9720.28.camel@cml> MIME-version: 1.0 Content-type: text/plain References: <1172655322.9173.35.camel@cml> Content-Transfer-Encoding: quoted-printable Subject: [Qemu-devel] Re: how to debug qemu? Reply-To: qemu-devel@nongnu.org List-Id: qemu-devel.nongnu.org List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Date: Wed, 28 Feb 2007 16:19:40 -0000 To: qemu-devel@nongnu.org Again me, I now see what the problem is, qemu doesn't update the status debug register dr6 on single step trap: Debug Status Register (DR6): The BS bit is associated with the TF (trap flag) bit of the EFLAGS register. The BS bit is set if the debug handler is entered due to the occurrence of a single-step exception. The single-step trap is the highest-priority debug exception; therefore, when BS is set, any of the other debug status bits may also be set. I added two lines in target-i386/helper.c: void raise_interrupt(int intno, int is_int, int error_code, int next_eip_addend) { + if (intno =3D=3D 1) + env->dr[6] |=3D 0x4000; And mdb in Solaris works somehow now.. Vita On Wed, 2007-02-28 at 10:35 +0100, Vita Batrla wrote: > Hi, >=20 > I'm running Solaris inside qemu (i386), Most of things work fine, > exactly like on real machine, however, running modular debugger (mdb) o= n > e.g. /bin/ls turns the virtual machine to worm brick every time I try > it. Same procedure works fine on real hardware. The virtual machine is > flooded by INT 0x01, because env->eflags & TF_MASK is set. How do I fin= d > out which instruction turned TF flag on? >=20 > I'd like to find the original instruction, which did set TF flag by > instrumenting cpu_exec() right after the executing gen_func(). Can I ge= t > it by examination env->current_tb?: >=20 > (gdb) print env->current_tb[0] > $7 =3D {pc =3D 4269802867, cs_base =3D 0, flags =3D 68276, size =3D 8, = cflags =3D 0, > tc_ptr =3D 0x8b4a630 "=EF=BF=BD\020", phys_hash_next =3D 0x0, page_ne= xt =3D {0x81599a0, > 0x0}, page_addr =3D {4194304, 4294967295}, tb_next_offset =3D {6553= 5, 65535}, > tb_jmp_offset =3D {324, 244, 65535, 65535}, jmp_next =3D {0x0, 0x0}, > jmp_first =3D 0x81599e2} >=20 > Where is the non-translated assembler code, or how to find the > instruction more effectively? Can some one help me please? >=20 > Best regards, >=20 > Vita >=20