QEMU crashes (segfaults) on code breakpoint in DR7

[Ralph26]

Hi.
I am writing a simple program in NASM that starts from MS-DOS (installed in QEMU), sets up GDT, IDT, LDT, TSS, etc and then switches to protected mode; now I am trying to use this program to test debug registers DR0, DR!, etc.
I decided to use QEMU because it is one of the few emulators/virtual machines that supports 80386 debug registers.

In the data segment (DATASEG32) there is a 32 bit variable, named var32a; so, in the code segment (CODESEG32) I add this code:

Code: Select all

xor      eax, eax             	; EAX = 0
mov      ax, DATASEG32      	; AX = 16 bit segment
shl      eax, 4               	; Base Address = DATASEG32 * 16
add      eax, offset var32a	; physical addr. = Base + Offset
mov      dr0, eax		; DR0 = var32a physical address
xor      eax, eax		; EAX = 0
mov      dr6, eax		; clear DR6
; break on data writes, length=4 bytes, L0=1, LE=1
mov      eax, 00000000000011010000000100000001b
mov      dr7, eax
 

This code works as expected; when the CPU encounters this instruction:

Code: Select all

mov		[var32a], eax

generates an exception 1 and calls the associated Interrupt service routine.

Now consider this code that enables a code breakpoint in CODESEG32 at a label named brk_point:

Code: Select all

xor      eax, eax             	; EAX = 0
mov      ax, CODESEG32      	; AX = 16 bit segment
shl      eax, 4               	; Base Address = CODESEG32 * 16
add      eax, offset brk_point	; physical addr. = Base + Offset
mov      dr0, eax		; DR0 = brk_point label physical address
xor      eax, eax		; EAX = 0
mov      dr6, eax		; clear DR6
; break on instruction execution, length=1 byte, L0=1, LE=1
mov      eax, 00000000000000000000000100000001b
mov      dr7, eax
 

When the CPU encounters the label brk_point, QEMU crashes (segmentation fault)
GDB says that the program gets stuck exactly at the brk_point label; so, the interrupt service routine is never called.

Does anyone know what's happening?

P.S. I know that there is a QEMU mailing list, but it is too difficult to get an account.

[Octocontrabass]

Which version of QEMU? Which command-line options? Do you have a disk image you can share that demonstrates the problem? (You can share the disk image if you use FreeDOS instead of MS-DOS.)

[Ralph26]

Which version of QEMU? Which command-line options? Do you have a disk image you can share that demonstrates the problem? (You can share the disk image if you use FreeDOS instead of MS-DOS.)

QEMU version 8.2.9, provided by OpenSUSE Leap 15.6.
Command line:

Code: Select all

qemu-system-i386 -machine pc -cpu 486 -hda ./qemudisk.img -m 32M -hdb fat:rw:./SHARED/

SHARED is a directory shared between QEMU and Linux.

[Ralph26]

Now I have tested this program in Virtualbox and it works!
So, the segmentation fault in QEMU could be a bug; it happens also with QEMU 10.x.

[Octocontrabass]

Can you share a disk image that causes the segmentation fault in QEMU?

[Ralph26]

I'm using MS-DOS; I don't know if the disk image can be shared.
I have created the disk image with:

Code: Select all

qemu-img create -f qcow qemudisk.disk 256M

[Octocontrabass]

If you use FreeDOS or one of the MIT-licensed versions of MS-DOS, you can share the disk image.

[MichaelPetch]

I tried your code both with a breakpoint on a variable and code and both worked as expected. I had an int 1 generated. I am not running under DOS but the code snippets worked as expected with the removal of the segment:offset addressing calculation which didn't apply to my code since I was using a flat address space. I am using QEMU 6.2.0. If you could put your code into Github so it can tested that may help as well if you are able to make your code public.