Re: [Qemu-devel] Physical address debugging

[Jan Kiszka]

On 2011-08-26 20:02, Blue Swirl wrote:
> 2011/8/26 Jan Kiszka <address@hidden>:
>> On 2011-08-26 19:34, Blue Swirl wrote:
>>> 2011/8/26 Jan Kiszka <address@hidden>:
>>>> On 2011-08-26 16:21, Zeus Gómez Marmolejo wrote:
>>>>> Hi all,
>>>>>
>>>>> I just want to do a very simple task. I'm using QEMU for debugging a new 
>>>>> OS
>>>>> and I see that there is a memory region that is being updated by an 
>>>>> unknown
>>>>> task. I don't know if it's another process or the kernel itself.
>>>>>
>>>>> So I would like to put a physical memory watchpoint. I don't know how to 
>>>>> do
>>>>> that. As the GDB stub is operating using virtual addressing, I cannot 
>>>>> place
>>>>> a watchpoint on an address as it's not stopping.
>>>>>
>>>>> To make it short, I want the equivalent of the Bochs command "watch write
>>>>> addr", which inserts a write watch point at physical address 'addr'. I
>>>>> haven't seen this is possible on the QEMU monitor...
>>>>
>>>> Indeed, it isn't. It's impossible with KVM (due to lacking hardware
>>>> support) but would be feasible with TCG if you extend (or ad-hoc hack)
>>>> QEMU code accordingly.
>>>
>>> Why impossible? The existing watchpoints replace original physical
>>> memory with io_mem_watch MMIO, virtual addresses are translated to
>>> physical in exec.c:tlb_set_page(). The only missing piece is to allow
>>> setting watchpoints with physical addresses directly.
>>>
>>> Since KVM can handle MMIO, I think it should also be able to handle
>>> watchpoints.
>>
>> KVM uses x86 debug registers for watchpoints. And the SDM states:
>>
>> 16.2.1 Debug Address Registers (DR0-DR3)
>>
>> Each of the debug-address registers (DR0 through DR3) holds the 32-bit
>> linear address of a breakpoint (see Figure 16-1). Breakpoint comparisons
>> are made before physical address translation occurs. [...]
> 
> KVM could be changed to use the TCG version. What's the benefit of
> using debug registers, speed? Is that important for debugging?

When debugging tiny SMP races, yes as it may change the timing.

But MMIO based watchpoints may indeed work as well and also would
overcome the "Who needs more than 4 hw breakpoints?". But configuring
watchpoints on physical address or manually switching between soft and
hard ones need some configuration interface, ideally one that gdb can
drive. We also need some interface to finally add monitor trap support
(single stepping without injecting TF into guest flags, an Intel VT-x
feature). Just takes someone to do all this... :)

Jan

-- 
Siemens AG, Corporate Technology, CT T DE IT 1
Corporate Competence Center Embedded Linux