Skip to content

Add configurable VM debug snapshots - #7110

Open
spark2k06 wants to merge 5 commits into
86Box:masterfrom
spark2k06:debug-vm
Open

Add configurable VM debug snapshots#7110
spark2k06 wants to merge 5 commits into
86Box:masterfrom
spark2k06:debug-vm

Conversation

@spark2k06

@spark2k06 spark2k06 commented May 2, 2026

Copy link
Copy Markdown

Summary

Add a paused-VM debug snapshot facility for collecting emulator state into timestamped directories under the VM path.

The snapshot contents are configurable from the UI and currently include:

  • CPU registers and bytes around CS:IP
  • Conventional RAM dump, capped at 640 KB and reduced when the configured machine RAM is smaller
  • Recent I/O port trace
  • Active device list
  • Detailed device dumps through an optional device_t callback

Detailed device snapshot support is currently implemented for:

  • IBM EGA and compatible EGA variants (ega.txt, ega_vram.bin)
  • IBM CGA and Pravetz VDC-2 (cga.txt, cga_vram.bin)

This is intended to make paused emulator state easier to inspect and share when debugging hardware-specific issues, while keeping the mechanism extensible for additional devices.

Checklist

  • Closes N/A
  • I have tested my changes locally and validated that the functionality works as intended
  • This pull request does not require changes to the ROM set
  • This pull request does not require changes to the asset set

References

The initial use case for this feature is comparing paused emulator state while improving compatibility in MiSTer PC/XT-family FPGA cores and derived projects. The snapshot output makes it easier to compare CPU state, conventional RAM, I/O activity, and video adapter state against 86Box.

Related projects:

No ROM or asset changes are required.

spark2k06 added 4 commits May 2, 2026 20:44
Add a paused-VM snapshot facility that writes CPU state, recent I/O port accesses, conventional RAM, and active device metadata to timestamped directories.

Expose snapshot contents through the Qt UI and add an optional device_t callback so devices can provide detailed dumps without manual provider registration. The conventional RAM dump is capped at 640 KB and records the actual configured size in the manifest.
Implement the device debug snapshot callback for IBM EGA and compatible EGA variants.

The dump records EGA registers and key display state in ega.txt, and writes the current EGA VRAM contents to ega_vram.bin for offline comparison.
Implement the device debug snapshot callback for IBM CGA and the Pravetz VDC-2 variant.

The dump records CGA CRTC registers, mode and timing state in cga.txt, and writes the 16 KB CGA VRAM contents to cga_vram.bin.
Describe the paused-VM snapshot workflow, selectable core data, conventional RAM sizing, and the currently implemented EGA and CGA device dumps.

Also document that future devices can opt in by filling the optional debug_snapshot callback in their device_t definition.
Comment thread src/device.c Fixed
Comment thread src/device.c Fixed
Comment thread src/utils/debug_snapshot.c Fixed
Comment thread src/utils/debug_snapshot.c Fixed
Comment thread src/utils/debug_snapshot.c Fixed
Comment thread src/video/vid_cga.c Fixed
Comment thread src/video/vid_cga.c Fixed
Comment thread src/video/vid_ega.c Fixed
Comment thread src/video/vid_ega.c Fixed
@spark2k06

Copy link
Copy Markdown
Author

Addressed the CodeQL findings in de4a54c96.

Changes made:

  • Replaced localtime() with localtime_s() / localtime_r().
  • Centralized snapshot file creation through debug_snapshot_fopen_write().
  • Restricted POSIX-created snapshot files to user read/write permissions.
  • Sanitized device snapshot directory names before using them as path components.
  • Replaced the new strncpy() uses with bounded snprintf() copies.

#ifdef _WIN32
return plat_fopen(path, "wb");
#else
int fd = open(path, O_WRONLY | O_CREAT | O_TRUNC, S_IRUSR | S_IWUSR);
@spark2k06

Copy link
Copy Markdown
Author

This remaining CodeQL path-injection alert is on the centralized snapshot file helper.

The filename component is now restricted to fixed/sanitized names and POSIX files are created with 0600. The remaining tainted part is the VM/user path itself, which is intentionally user-configurable because snapshots are expected to be written under the VM path.

I believe this is a false positive for this feature rather than an additional security issue.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants