[Qemu-devel] Newb/OS X/Darwin: Help debugging please...

[dguinan]

I am finding debugging quite an interesting experience.  I am trying to 
track down the problems with the OS X (darwin) port and I have isolated 
the problem to a translation that I could use some log interpretation 
on.  It would be very useful for anyone with some experience to give me 
some pointers on what code I should be isolating during debug sessions 
and a general "debug recipe"..  At any rate, here are the blocks:

FIRST:  On x86 TARGET x86
----------------------------------------
IN:
0x000f090e:  movw   0x6(bp),%bx
0x000f0911:  incw   %bx
0x000f0912:  movw   %bx,0x6(bp)
0x000f0915:  pushw  0x6(bp)
0x000f0918:  movw   $0xf000,%ax
0x000f091b:  pushw  %ax
0x000f091c:  call   0xf059a

--- and a ways down ---

Trace 0x086c4150 [0x000f090e]
EAX=0000f000 EBX=0000da9c ECX=00000000 EDX=00000600
ESI=00000000 EDI=00000500 EBP=0000fff0 ESP=0000ffd8
EIP=0000059a EFL=00000086 [--S--P-]    CPL=0 II=0
ES =0000 00000000 0000ffff 00000000
CS =f000 000f0000 0000ffff 00000000
SS =0000 00000000 0000ffff 00000000
DS =0000 00000000 0000ffff 00000000
FS =0000 00000000 0000ffff 00000000
GS =0000 00000000 0000ffff 00000000
LDT=0000 00000000 0000ffff 00008000
TR =0000 00000000 0000ffff 00008000
GDT=     00000000 0000ffff
IDT=     00000000 0000ffff
CR0=60000010 CR2=00000000 CR3=00000000 CR4=00000000
CCS=00000000 CCD=0000da9c CCO=INCW
Trace 0x086c3af0 [0x000f059a]
EAX=0000f073 EBX=0000da9c ECX=00000000 EDX=00000600
ESI=00000000 EDI=00000500 EBP=0000fff0 ESP=0000ffda
EIP=0000091f EFL=00000086 [--S--P-]    CPL=0 II=0
ES =0000 00000000 0000ffff 00000000
CS =f000 000f0000 0000ffff 00000000
SS =0000 00000000 0000ffff 00000000
DS =0000 00000000 0000ffff 00000000
FS =0000 00000000 0000ffff 00000000
GS =0000 00000000 0000ffff 00000000
LDT=0000 00000000 0000ffff 00008000
TR =0000 00000000 0000ffff 00008000
GDT=     00000000 0000ffff
IDT=     00000000 0000ffff
CR0=60000010 CR2=00000000 CR3=00000000 CR4=00000000
CCS=00000000 CCD=0000da9c CCO=INCW
Trace 0x086c3ee0 [0x000f091f]
EAX=0000f073 EBX=0000da9c ECX=00000000 EDX=00000600
ESI=00000000 EDI=00000500 EBP=0000fff0 ESP=0000ffde
EIP=000007af EFL=00000016 [----AP-]    CPL=0 II=0
ES =0000 00000000 0000ffff 00000000
CS =f000 000f0000 0000ffff 00000000
SS =0000 00000000 0000ffff 00000000
DS =0000 00000000 0000ffff 00000000
FS =0000 00000000 0000ffff 00000000
GS =0000 00000000 0000ffff 00000000
LDT=0000 00000000 0000ffff 00008000
TR =0000 00000000 0000ffff 00008000
GDT=     00000000 0000ffff
IDT=     00000000 0000ffff
CR0=60000010 CR2=00000000 CR3=00000000 CR4=00000000
CCS=00000025 CCD=0000f04e CCO=SUBB
----------------
IN:
0x000f07af:  movw   0xfffffffc(bp),%ax
0x000f07b2:  testw  %ax,%ax
0x000f07b4:  je     0x8ff


And the same on PPC (OS X) Target x86
-------------------------------------------------------

IN:
0x000f090e:  movw   0x6(bp),%bx
0x000f0911:  incw   %bx
0x000f0912:  movw   %bx,0x6(bp)
0x000f0915:  pushw  0x6(bp)
0x000f0918:  movw   $0xf000,%ax
0x000f091b:  pushw  %ax
0x000f091c:  call   0xf059a

--- and a ways down... ---

Trace 0x0020acc0 [0x000f090e]
EAX=0000f000 EBX=0000da9c ECX=00000000 EDX=00000600
ESI=00000000 EDI=00000500 EBP=0000fff0 ESP=0000ffd8
EIP=0000059a EFL=00000086 [--S--P-]    CPL=0 II=0
ES =0000 00000000 0000ffff 00000000
CS =f000 000f0000 0000ffff 00000000
SS =0000 00000000 0000ffff 00000000
DS =0000 00000000 0000ffff 00000000
FS =0000 00000000 0000ffff 00000000
GS =0000 00000000 0000ffff 00000000
LDT=0000 00000000 0000ffff 00008000
TR =0000 00000000 0000ffff 00008000
GDT=     00000000 0000ffff
IDT=     00000000 0000ffff
CR0=60000010 CR2=00000000 CR3=00000000 CR4=00000000
CCS=00000084 CCD=0000da9c CCO=EFLAGS
Trace 0x0020a3e0 [0x000f059a]
EAX=00000000 EBX=0000da9c ECX=00000000 EDX=00000600
ESI=00000000 EDI=00000500 EBP=0000fff0 ESP=0000ffda
EIP=0000091f EFL=00000086 [--S--P-]    CPL=0 II=0
ES =0000 00000000 0000ffff 00000000
CS =f000 000f0000 0000ffff 00000000
SS =0000 00000000 00000000 00000000
DS =0000 00000000 0000ffff 00000000
FS =0000 00000000 0000ffff 00000000
GS =0000 00000000 0000ffff 00000000
LDT=0000 00000000 0000ffff 00008000
TR =0000 00000000 0000ffff 00008000
GDT=     00000000 0000ffff
IDT=     00000000 0000ffff
CR0=60000010 CR2=00000000 CR3=00000000 CR4=00000000
CCS=00000084 CCD=0000da9c CCO=EFLAGS
Trace 0x0020a980 [0x000f091f]
EAX=00000000 EBX=0000da9c ECX=00000000 EDX=00000600
ESI=00000000 EDI=00000500 EBP=0000fff0 ESP=0000ffe0
EIP=000000c4 EFL=00000002 [-------]    CPL=0 II=0
ES =0000 00000000 0000ffff 00000000
CS =f000 000f0000 0000ffff 00000000
SS =0000 00000000 00000000 00000000
DS =0000 00000000 0000ffff 00000000
FS =0000 00000000 0000ffff 00000000
GS =0000 00000000 0000ffff 00000000
LDT=0000 00000000 0000ffff 00008000
TR =0000 00000000 0000ffff 00008000
GDT=     00000000 0000ffff
IDT=     00000000 0000ffff
CR0=60000010 CR2=00000000 CR3=00000000 CR4=00000000
CCS=00000084 CCD=00000000 CCO=[196]
-------------------------------
IN:
The assembly to be translated.
0x000f00c4:  adcb   %ah,0xffffff85(bp)
0x000f00c7:  rolb   $0x89,%bl
0x000f00ca:  stc
0x000f00cb:  jcxz   0xf00e6


--- As you can see, the code does something different under identical 
starting conditions for OS X/ppc  vs Linux/x86 hosts.   Where should I 
be looking for the apparent problems with the values in the registers 
and the choice in branches?  My guess here is that the OS X translation 
is making a mistake, resulting in the execution of code that it 
shouldn't be trying to execute (the 00c4 entry in EIP at the end of the 
call vs the x86 host's 07af).  But there are other discrepencies.

Anyone want to give me debugging tips?