Re: Towards better x86 system debugging support

[Doug Evans <dje at google dot com>]

On Sun, Jan 4, 2009 at 5:34 AM, Jan Kiszka <jan.kiszka@web.de> wrote:
> Hi,
>
> as many of you may know, there is a gdb server in QEMU that allows to
> debug kernels, boot loaders and other low-level stuff without real
> target hardware. I'm e.g. using it heavily for analyzing Linux kernel
> issues on x86 targets (thanks to KVM, you can even debug weird SMP races
> in NMI-using kernel debuggers...).
>
> Unfortunately, the x86 support is incomplete in so far that neither the
> gdb remote protocol nor the gdb backend are aware of most special
> registers x86 system-level software uses. This comes with several drawbacks:
>
>  o Current code bit width (16, 32 or 64) is unknown to the debugger,
>   so correct disassembling is not automatically possible
>  o Real mode cannot be detected, which would include setting 16 bit
>   disassembly mode and calculating segment bases appropriately
>  o Manually setting the architecture (set arch i8086/i386/i386:x86-64)
>   influences the register set layout of the remote protocol, preventing
>   straightforward switches from 16-bit bootloader/BIOS code to 64-bit
>   kernel code (to give just one example)
>  o Only flat memory models are supported and debugging becomes very
>   hairy when some segment uses a non-zero base address - note that this
>   also prevents support for TLS variable lookup (which is GS or
>   FS-based)
>
> As a first step toward enhanced x86 support, I think there is a need for
> an extended register set in the remote protocol. The following registers
> should be added:
>
>  o GDTR, LDTR, IDTR, TR (visible part, ie. selector value)
>  o CR0..4
>  o DR0..7
>  o selected MSRs, at least
>    - IA32_EFER (64-bit mode detection)
>    - IA32_FS_Base (TLS)
>    - IA32_GS_Base (TLS)
>    - IA32_KernelGSbase (TLS)
>  o Shadow states of segment registers, GDTR, LDTR, IDTR and TR
>   (relevant for virtual targets where the VM often has access to these
>   hidden states, helpful when debugging targets that modify in-use
>   descriptor table entries)
>
> If anyone thinks that there should be more registers or MSRs included,
> please extend this list!

I know of one linux program that uses modify_ldt() and changes all
segment registers, so I would add cs_base,ds_base,es_base,ss_base.
Some folks would presumably find *_limit, *_flags useful too.