I finally figured out how to debug Windows XP running in one QEMU instance with WinDbg running in another:
- Compile QEMU with this patch: qemu-20070110-windbg.patch
- Edit boot.ini in the debuggee to add an entry to start Windows XP with "/debugport=com1 /baudrate=115200" arguments.
- Start the debuggee VM with "qemu -net nic -net tap -serial tcp:127.0.0.1:4444,server". QEMU will now wait for a connection on 127.0.0.1:4444.
- Start the debugger VM with "qemu -net nic -net tap -serial tcp:127.0.0.1:4444". This will connect to the debuggee VM and both VMs will now start booting. Make sure to interrupt the debuggee VM's boot menu countdown at this point.
- When the debugger VM has fully booted, start WinDbg in that VM and click "File->Kernel Debug", select "COM", set "Baud Rate" to "115200", "Port" to "com1" and click "Ok".
- In the debuggee VM, select the boot menu entry that will start Windows with remote debugging enabled now.
WinDbg should recognize the debuggee VM now. Have fun.