This turned up today. Anyone doing any work with x86 embedded development, well, this looks to be just up your alley!
Wesley Parish ---------- Forwarded Message ---------- Subject: [Qemu-devel] [ANNOUNCE] SerialICE - QEMU based x86 firmware debugger Date: Saturday 06 June 2009 08:30 From: Stefan Reinauer <ste...@coresystems.de> To: Coreboot <coreb...@coreboot.org>, qemu-de...@nongnu.org Dear x86 hardware and low-level software developers and enthusiasts! coresystems GmbH is proud to release the first version of our "Integrated Circuit Emulator over Serial", short SerialICE. This piece of software consists of two parts: - a serial console "rom shell" compiled with romcc, with minimal footprint. (Due to romcc the image is still 128k because it did not fit in 64k but this can be optimized later) - a patch to Qemu 0.10.4, which adds a new "SerialICE" machine. Short description: SerialICE is a BIOS/Firmware debugging tool. It allows you to run and observe BIOS images (such as coreboot®: http://www.coreboot.org/) written for real hardware in Qemu (http://www.nongnu.org/qemu) for debugging purposes. Thanks to Qemu's compelling feature set, it's also possible to debug this BIOS code with GNU GDB. SerialICE can be downloaded from http://www.coresystems.de/download/SerialICE-1.0.tar.bz2 With "qemu -m serialice -serialice /dev/ttyS0 -L path-to-your-bios.bin-dir -hda /dev/zero" you can run an arbitrary BIOS binary written for your target hardware in Qemu, thus logging all IO and memory accesses. Those operations will additionally be transmitted to the target system's shell and are executed there, while their results are submitted back to Qemu. Operations sent to the target: - memory reads/writes (some of them) - IO reads/writes - MSR reads/writes - CPUID calls (the bios code path might rely on this) Note: The code is very experimental and still buggy, but it was already useful in some debugging scenarios we had and was able to reveil information that would normally only be available with a hardware debugger of the price of a new car. Don't expect SerialICE to completely replace a ICE/JTAG/ITP device, but it might just work for your case, as it did for us. The code needs minimal board/chipset specific setup in order to have serial console operational for communication with Qemu. See mainboard/* for an example. This release contains demo code for two mainboards with Intel® CPUs. Also, some hardware accesses have to be caught in the Qemu code (hw/serialice.c) in order to prevent the system from locking up (ie. by disabling the serial console). Known issues: - The code is ugly, and the Qemu part is light years from a state where integration would be possible. - infrastructure for compiling with gcc + xmmstack is there, but it still fails with some odd assembler errors. This should push the SerialICE rom shell clearly below 64k again. - microcode updates from within emulated ROM code will fail. - some rarely used calls of cpuid will not give the correct information (those using two registers for input) Special thanks go to * Alex Graf for listening to my odd ideas while embedded world and supporting this project from early on. * Paul Brook for helping me find the last bug that prevented surviving all of RAM initialization on one board. * Patrick Georgi for Development and Testing. * Ron Minnich for advice and encouragement. * Eric Biederman for romcc Comments and patches are of course very welcome! Best regards, Stefan Reinauer -- coresystems GmbH • Brahmsstr. 16 • D-79104 Freiburg i. Br. Tel.: +49 761 7668825 • Fax: +49 761 7664613 Email: i...@coresystems.de • http://www.coresystems.de/ Registergericht: Amtsgericht Freiburg • HRB 7656 Geschäftsführer: Stefan Reinauer • Ust-IdNr.: DE245674866 ------------------------------------------------------- -- Clinersterton beademung, with all of love - RIP James Blish ----- Are couch potatoes good to eat? A nose by any other name would smell as sweet. (By Bacon under the pseudonym of Shakespeare) ----- Mau e ki, he aha te mea nui? You ask, what is the most important thing? Maku e ki, he tangata, he tangata, he tangata. I reply, it is people, it is people, it is people.