x86 debug registers? \ VOGONS

x86 debug registers?

Topic actions

First post, by superfury

Posted on 2025-07-28, 18:07

superfury Offline

Rank l33t++

Rank: l33t++
Posts: 5855
Joined: 2014-03-08, 11:25
Location: Netherlands

Do the x86 debug registers work while in virtual 8086 mode?
What about in real mode? Is DR6 still updated when a single step trap is thrown (setting bit 14)?
Edit: OK. So DR6 is still updated, even in real mode from what I can learn from Bochs' source code (looking into it's exception handling from the exception() call).
I've adjusted my emulator to do the same.

Real and virtual 8086 mode also get debugged in the same way, although just on the logical address part (like in protected mode), which effectively is the same as a physical address in real mode.

Ran WinDBG, used a debugger command to set the DR register up for an instruction faulting:

1Kernel base = 0x807c2000 PsLoadedModuleList = 0x8083ce28
2System Uptime: not available
3Break instruction exception - code 80000003 (first chance)
4*******************************************************************************
5*                                                                             *
6*   You are seeing this message because you pressed either                    *
7*       CTRL+C (if you run kd.exe) or,                                        *
8*       CTRL+BREAK (if you run WinDBG),                                       *
9*   on your debugger machine's keyboard.                                      *
10*                                                                             *
11*                   THIS IS NOT A BUG OR A SYSTEM CRASH                       *
12*                                                                             *
13* If you did not intend to break into the debugger, press the "g" key, then   *
14* press the "Enter" key now.  This message might immediately reappear.  If it *
15* does, press "g" and "Enter" again.                                          *
16*                                                                             *
17*******************************************************************************
18ntkrnlmp!RtlpBreakWithStatusInstruction:
19807e984c cc               int     3
20kd> t
21ntkrnlmp!RtlpBreakWithStatusInstruction+1:
22807e984d c20400           ret     0x4
23kd> t
24ntkrnlmp!ExpInitializeExecutive+310:
2580964c28 8b4358           mov     eax,[ebx+0x58]
26kd> g
27Breakpoint 0 hit
28ntkrnlmp!ExpInitializeExecutive+316:
2980964c2e 7206             jb ntkrnlmp!ExpInitializeExecutive+0x31e (80964c36)
30kd> ba e 1 80964c31
31kd> t
32ntkrnlmp!ExpInitializeExecutive+318:
3380964c30 53               push    ebx
34kd> g
35CS descriptor lookup failed
36Breakpoint 1 hit
374c31:7000 ??              ???
38kd> t
39
40*** Fatal System Error: 0x0000007f
41                       (0x0000000D,0x00000000,0x00000000,0x00000000)
42
43
44A fatal system error has occurred.
45Debugger entered on first try; Bugcheck callbacks have not been invoked.
46
47A fatal system error has occurred.
48
49*******************************************************************************
50*                                                                             *
51*                        Bugcheck Analysis                                    *
52*                                                                             *
53*******************************************************************************
54
55Use !analyzebugcheck -v to get more information.
56
57BugCheck 7F, {d, 0, 0, 0}
58*** Bugcheck Analysis may not be correct, please followup with the following.
59Followup : MachineOwner
60

…Show last 3 lines

61ntkrnlmp!RtlpBreakWithStatusInstruction:
62807e984c cc               int     3

Although the breakpoint hit correctly, somehow the return address was invalid it look like, leading to a 0x7F bugcheck?

Author of the UniPCemu emulator.
UniPCemu Git repository
UniPCemu for Android, Windows, PSP, Vita and Switch on itch.io

Reply 1 of 8, by superfury

Posted on 2025-07-30, 17:22

superfury Offline

Rank l33t++

Rank: l33t++
Posts: 5855
Joined: 2014-03-08, 11:25
Location: Netherlands

Remade the exception handling code for both interrupts (#DB) and VIP/VIF before an instruction starts.
Now both are crafted again, being based upon the INTA logic (although starting a different interrupt and exception of course).
The only exception in those cases are that that they fault using the normal logic (#DB or #GP) after the initial interrupt start-up logic (which resets state to the start of the executed instruction properly, taking REP-prefixes and savestate etc. into account).

I've also improved the REP-prefix behaviour in this case, as it could be interfering with the above mechanics otherwise (as it was possible resetting the EIP to the instruction beforehand, which is shouldn't, depending on the instruction state).

Said function points (for #DB and #GP) also now properly jump to the correct point in execution, instead of aborting the entire CPU execution handling (which might be incorrect, based on the INTA/NMI/SMI handling startup code I wrote).
Edit: Interesting: the 0x7B 0xD seems to imply a double fault happened.
I've just also applied the same logic to the double fault handler, just in case such a thing happens during instruction fetching (it shouldn't easily, but there's a possibility during interrupt handling, which requires correct behaviour).
Edit: Also added the logic to all other fault handlers, as they might occur when an instruction is started (due to interrupt and fault logic itself triggering at that point), properly resetting state for the fault.
Also added the logic to the SMI/NMI/INTA startup handling, as they require it as well for a consistent state. Basically said function makes sure that the return point of an exception or interrupt-type (SMI/NMI/INTA) returns to the correct spot and state.

Author of the UniPCemu emulator.
UniPCemu Git repository
UniPCemu for Android, Windows, PSP, Vita and Switch on itch.io

Reply 2 of 8, by superfury

Posted on 2025-07-30, 22:50

superfury Offline

Rank l33t++

Rank: l33t++
Posts: 5855
Joined: 2014-03-08, 11:25
Location: Netherlands

Having fixed the interrupt/fault handling when starting a new instruction, I can now at last set breakpoints (simply a few instructions ahead and performing a "go" command to let it trigger), I now get a proper state when said breakpoint hits.
Although that might also fix all other kinds of interrupts that happen inside various OSes.

Some output from my debugger(WinDBG) that's connected on the serial port (through COM0COM and another UniPCemu instance):

1Microsoft (R) Windows Kernel Debugger  Version 3.0.0020.0
2Copyright (c) Microsoft Corporation. All rights reserved.
3
4Waiting to reconnect...
5Will request initial breakpoint at next boot.
6Connected to Windows XP 2600 x86 compatible target, ptr64 FALSE
7Kernel Debugger connection established.  (Initial Breakpoint requested)
8Loaded dbghelp extension DLL
9Loaded ext extension DLL
10Loaded exts extension DLL
11Loaded kext extension DLL
12Loaded kdexts extension DLL
13Symbol search path is: c:\windowsxprtm2600\symbols;srv*c:\myserversymbols*https://msdl.microsoft.com/download/symbols;c:\windowsxprtm2600\symbols
14Symbol search path is: c:\windowsxprtm2600\symbols;srv*c:\myserversymbols*https://msdl.microsoft.com/download/symbols;c:\windowsxprtm2600\symbols;C:\windowsxprtm2600\symbols;srv*C:\MyServerSymbols*https://msdl.microsoft.com/download/symbols
15Executable search path is: 
16PsLoadedModuleList not initialized yet.  Delay kernel load.
17Windows XP Kernel Version 2600 MP (1 procs) Free x86 compatible
18Built by: 2600.xpclient.010817-1148
19Kernel base = 0x807c2000 PsLoadedModuleList = 0x8083ce28
20System Uptime: not available
21Break instruction exception - code 80000003 (first chance)
22*******************************************************************************
23*                                                                             *
24*   You are seeing this message because you pressed either                    *
25*       CTRL+C (if you run kd.exe) or,                                        *
26*       CTRL+BREAK (if you run WinDBG),                                       *
27*   on your debugger machine's keyboard.                                      *
28*                                                                             *
29*                   THIS IS NOT A BUG OR A SYSTEM CRASH                       *
30*                                                                             *
31* If you did not intend to break into the debugger, press the "g" key, then   *
32* press the "Enter" key now.  This message might immediately reappear.  If it *
33* does, press "g" and "Enter" again.                                          *
34*                                                                             *
35*******************************************************************************
36ntkrnlmp!RtlpBreakWithStatusInstruction:
37807e984c cc               int     3
38kd> !pci 0 1
39kd> !pci 1 0
40PCI Bus 0
4100:0  8086:1237.00  Cmd[0006:.mb...]  Sts[0280:.....]  Device  Host bridge
42      cf8:80000000  IntPin:0  IntLine:0  Rom:0  cis:0  cap:0
43
4401:0  8086:7000.02  Cmd[000f:imb...]  Sts[0200:.....]  Device  ISA bridge
45      cf8:80000800  IntPin:0  IntLine:ff  Rom:0  cis:0  cap:0
46
4701:1  8086:7010.02  Cmd[0007:imb...]  Sts[0000:.....]  Device  Class:1:1:80
48      cf8:80000900  IntPin:0  IntLine:ff  Rom:0  cis:0  cap:0
49      IO[4]:e801       
50
510f:0  1283:8888.01  Cmd[0007:imb...]  Sts[0000:.....]  Device  SubID:100c:3203  Other bridge device
52      cf8:80007800  IntPin:0  IntLine:0  Rom:0  cis:0  cap:0
53      MEM[0]:e7000000  
54
55kd> !pcitree
56PciFdoExtensionListHead forward pointer is NULL, list is empty
57kd> lm
58start    end        module name
5980190000 801b4000   halapic      (deferred)                 
60807c2000 809aa000   nt           c:\windowsxprtm2600\symbols\exe\ntkrnlmp.pdb

…Show last 185 lines

61fc0de000 fc160400   ntfs         (deferred)                 
62fc161000 fc184580   fastfat      (deferred)                 
63fc185000 fc198780   ksecdd       (deferred)                 
64fc199000 fc257a80   dmboot       (deferred)                 
65fc2f8000 fc323d80   dac2w2k      (deferred)                 
66fc324000 fc33ce00   adpu160m     (deferred)                 
67fc33d000 fc34fd80   tffsport     (deferred)                 
68fc350000 fc365280   atapi        (deferred)                 
69fc366000 fc37bf80   scsiport     (deferred)                 
70fc37c000 fc39a180   usbport      (deferred)                 
71fc39b000 fc3beb80   dmio         (deferred)                 
72fc3bf000 fc3dd880   ftdisk       (deferred)                 
73fc3de000 fc3fa680   pcmcia       (deferred)                 
74fc3fb000 fc426c00   acpi         (deferred)                 
75fc427000 fc499d80   setupdd      (deferred)                 
76fc4bb000 fc4ca400   pci          c:\windowsxprtm2600\symbols\sys\pci.pdb
77fc4cb000 fc4d3c00   isapnp       (deferred)                 
78fc4db000 fc4e8880   ohci1394     (deferred)                 
79fc4eb000 fc4f7180   1394bus      (deferred)                 
80fc4fb000 fc504280   mountmgr     (deferred)                 
81fc50b000 fc514280   sbp2port     (deferred)                 
82fc51b000 fc523280   lbrtfdc      (deferred)                 
83fc52b000 fc537600   usbhub       (deferred)                 
84fc53b000 fc543180   hidclass     (deferred)                 
85fc54b000 fc55a400   serial       (deferred)                 
86fc55b000 fc56ae00   videoprt     (deferred)                 
87fc56b000 fc577700   i8042prt     (deferred)                 
88fc57b000 fc588e80   aic78xx      (deferred)                 
89fc58b000 fc593180   ql10wnt      (deferred)                 
90fc59b000 fc5a4e00   ql1240       (deferred)                 
91fc5ab000 fc5b8780   aic78u2      (deferred)                 
92fc5bb000 fc5c3f80   ultra        (deferred)                 
93fc5cb000 fc5d4d80   ql1080       (deferred)                 
94fc5db000 fc5e6f80   ql1280       (deferred)                 
95fc5eb000 fc5f6100   ql12160      (deferred)                 
96fc5fb000 fc604500   hpt3xx       (deferred)                 
97fc60b000 fc616980   cdrom        (deferred)                 
98fc61b000 fc625f80   classpnp     (deferred)                 
99fc62b000 fc633380   disk         (deferred)                 
100fc63b000 fc64a300   cdfs         (deferred)                 
101fc73b000 fc740c80   pciidex      (deferred)                 
102fc743000 fc747900   partmgr      (deferred)                 
103fc74b000 fc751680   fdc          (deferred)                 
104fc753000 fc757a00   usbuhci      (deferred)                 
105fc75b000 fc761180   usbccgp      (deferred)                 
106fc763000 fc768c80   hidparse     (deferred)                 
107fc76b000 fc770500   usbstor      (deferred)                 
108fc773000 fc777c80   vga          (deferred)                 
109fc77b000 fc780b80   kbdclass     (deferred)                 
110fc783000 fc787a80   sparrow      (deferred)                 
111fc78b000 fc78f480   i2omp        (deferred)                 
112fc793000 fc799780   asc          (deferred)                 
113fc79b000 fc79f380   mraid35x     (deferred)                 
114fc7a3000 fc7aaf80   symc8xx      (deferred)                 
115fc7ab000 fc7b1ee0   sym_hi       (deferred)                 
116fc7b3000 fc7ba7e0   sym_u3       (deferred)                 
117fc7bb000 fc7c0780   asc3350p     (deferred)                 
118fc7c3000 fc7c8c00   abp480n5     (deferred)                 
119fc7cb000 fc7cfee0   dpti2o       (deferred)                 
120fc7d3000 fc7d9aa0   perc2        (deferred)                 
121fc7db000 fc7e1560   hpn          (deferred)                 
122fc7e3000 fc7e7d00   flpydisk     (deferred)                 
123fc8cb000 fc8ce000   bootvid      (deferred)                 
124fc8cf000 fc8d1d80   acpiec       (deferred)                 
125fc8d3000 fc8d6d00   usbohci      (deferred)                 
126fc8d7000 fc8d9580   hidusb       (deferred)                 
127fc8db000 fc8dea80   serenum      (deferred)                 
128fc8df000 fc8e2680   kbdhid       (deferred)                 
129fc8e3000 fc8e6a80   cpqarray     (deferred)                 
130fc8e7000 fc8ea200   aha154x      (deferred)                 
131fc8eb000 fc8eef80   symc810      (deferred)                 
132fc8ef000 fc8f2980   dac960nt     (deferred)                 
133fc8f3000 fc8f5f00   amsint       (deferred)                 
134fc8f7000 fc8faa00   asc3550      (deferred)                 
135fc8fb000 fc8fee80   ini910u      (deferred)                 
136fc8ff000 fc902680   cbidf2k      (deferred)                 
137fc903000 fc905900   sfloppy      (deferred)                 
138fc907000 fc909300   ramdisk      (deferred)                 
139fc9bb000 fc9bcb80   kdcom        (deferred)                 
140fc9bd000 fc9be100   wmilib       (deferred)                 
141fc9bf000 fc9c0200   intelide     (deferred)                 
142fc9c1000 fc9c2100   viaide       (deferred)                 
143fc9c3000 fc9c4a00   cmdide       (deferred)                 
144fc9c5000 fc9c6380   toside       (deferred)                 
145fc9c7000 fc9c8480   aliide       (deferred)                 
146fc9c9000 fc9ca700   dmload       (deferred)                 
147fc9cb000 fc9cc280   usbd         (deferred)                 
148fc9cd000 fc9cee00   cd20xrnt     (deferred)                 
149fca83000 fca83d80   spddlang     (deferred)                 
150fca84000 fca84d80   oprghdlr     (deferred)                 
151fca85000 fca85d00   pciide       (deferred)                 
152
153Unloaded modules:
154
155kd> ba e 1 807e984d
156kd> g 0xffffffff80964c28
157ntkrnlmp!ExpInitializeExecutive+310:
15880964c28 8b4358           mov     eax,[ebx+0x58]
159kd> ba e 1 80964c2e
160kd> g
161Breakpoint 1 hit
162ntkrnlmp!ExpInitializeExecutive+316:
16380964c2e 7206             jb ntkrnlmp!ExpInitializeExecutive+0x31e (80964c36)
164kd> t
165ntkrnlmp!ExpInitializeExecutive+318:
16680964c30 53               push    ebx
167kd> t
168ntkrnlmp!ExpInitializeExecutive+319:
16980964c31 e8296c0100       call    ntkrnlmp!HeadlessInit (8097b85f)
170kd> t
171ntkrnlmp!HeadlessInit:
1728097b85f 55               push    ebp
173kd> g
174Break instruction exception - code 80000003 (first chance)
175*******************************************************************************
176*                                                                             *
177*   You are seeing this message because you pressed either                    *
178*       CTRL+C (if you run kd.exe) or,                                        *
179*       CTRL+BREAK (if you run WinDBG),                                       *
180*   on your debugger machine's keyboard.                                      *
181*                                                                             *
182*                   THIS IS NOT A BUG OR A SYSTEM CRASH                       *
183*                                                                             *
184* If you did not intend to break into the debugger, press the "g" key, then   *
185* press the "Enter" key now.  This message might immediately reappear.  If it *
186* does, press "g" and "Enter" again.                                          *
187*                                                                             *
188*******************************************************************************
189ntkrnlmp!RtlpBreakWithStatusInstruction:
190807e984c cc               int     3
191kd> t
192ntkrnlmp!RtlpBreakWithStatusInstruction+1:
193807e984d c20400           ret     0x4
194kd> t
195ntkrnlmp!KeUpdateSystemTime+152:
196807efaec ebb3             jmp    ntkrnlmp!KeUpdateSystemTime+0x107 (807efaa1)
197kd> t
198ntkrnlmp!KeUpdateSystemTime+107:
199807efaa1 833d1440838000  cmp dword ptr [ntkrnlmp!KiTickOffset (80834014)],0x0
200kd> g 0xffffffff801937e2
201halapic!HalpReleaseHighLevelLock+2:
202801937e2 c3               ret
203kd> t
204halapic!HalpEnableNMI+5c:
205801a7608 5f               pop     edi
206kd> g 0xffffffff801b10d2
207halapic!HalInitSystem+434:
208801b10d2 b001             mov     al,0x1
209kd> g 0xffffffff80965298
210ntkrnlmp!Phase1Initialization+55:
21180965298 84c0             test    al,al
212kd> t
213ntkrnlmp!Phase1Initialization+57:
2148096529a 7507             jnz   ntkrnlmp!Phase1Initialization+0x60 (809652a3)
215kd> t
216ntkrnlmp!Phase1Initialization+60:
217809652a3 8b4644           mov     eax,[esi+0x44]
218kd> t
219ntkrnlmp!Phase1Initialization+63:
220809652a6 3bc3             cmp     eax,ebx
221kd> t
222ntkrnlmp!Phase1Initialization+65:
223809652a8 57               push    edi
224kd> t
225ntkrnlmp!Phase1Initialization+66:
226809652a9 740b             jz    ntkrnlmp!Phase1Initialization+0x73 (809652b6)
227kd> t
228ntkrnlmp!Phase1Initialization+68:
229809652ab 50               push    eax
230kd> t
231ntkrnlmp!Phase1Initialization+69:
232809652ac e8eba3ebff       call    ntkrnlmp!_strupr (8081f69c)
233kd> p
234ntkrnlmp!Phase1Initialization+6e:
235809652b1 59               pop     ecx
236kd> p
237ntkrnlmp!Phase1Initialization+6f:
238809652b2 8bf8             mov     edi,eax
239kd> p
240ntkrnlmp!Phase1Initialization+71:
241809652b4 eb02             jmp   ntkrnlmp!Phase1Initialization+0x75 (809652b8)
242kd> p
243ntkrnlmp!Phase1Initialization+75:
244809652b8 3bfb             cmp     edi,ebx

It seems to behave properly there now. 😁

Author of the UniPCemu emulator.
UniPCemu Git repository
UniPCemu for Android, Windows, PSP, Vita and Switch on itch.io

Reply 3 of 8, by GloriousCow

Posted on 2025-07-31, 12:49

GloriousCow Offline

Rank Member

Rank: Member
Posts: 497
Joined: 2022-09-12, 20:00

I have a 386 under Arduino control, if you can conceive of any assembly programs that can test a scenario you want.

I can confirm, however, that the DR7 register is not ignored in real mode - I can hang the CPU by fiddling with the reserved bits like 000004000h

MartyPC: A cycle-accurate IBM PC/XT emulator | https://github.com/dbalsom/martypc

Reply 4 of 8, by BloodyCactus

Posted on 2025-07-31, 23:57

BloodyCactus Offline

Rank Oldbie

Rank: Oldbie
Posts: 1532
Joined: 2016-02-03, 13:34
Location: Lexington VA

i have a weird and probably wrong tingling sensation that the debug registers under realmode need to be linearly mapped not to whatever the virtual address is. some old brain memory triggered but I'm probably wrong

--/\-[ Stu : Bloody Cactus :: [ https://bloodycactus.com :: http://kråketær.com ]-/\--

Reply 5 of 8, by GloriousCow

Posted on Yesterday, 16:50

GloriousCow Offline

Rank Member

Rank: Member
Posts: 497
Joined: 2022-09-12, 20:00

BloodyCactus wrote on 2025-07-31, 23:57:

i have a weird and probably wrong tingling sensation that the debug registers under realmode need to be linearly mapped not to whatever the virtual address is. some old brain memory triggered but I'm probably wrong

how do you "linearly map" a register?

MartyPC: A cycle-accurate IBM PC/XT emulator | https://github.com/dbalsom/martypc

Reply 6 of 8, by BloodyCactus

Posted on Yesterday, 19:33

BloodyCactus Offline

Rank Oldbie

Rank: Oldbie
Posts: 1532
Joined: 2016-02-03, 13:34
Location: Lexington VA

by that i mean a physical linear/raw address not virtual mapped address.

--/\-[ Stu : Bloody Cactus :: [ https://bloodycactus.com :: http://kråketær.com ]-/\--

Reply 7 of 8, by GloriousCow

Posted on Yesterday, 21:44

GloriousCow Offline

Rank Member

Rank: Member
Posts: 497
Joined: 2022-09-12, 20:00

oh, you're talking about the breakpoints in dr0-dr3?

MartyPC: A cycle-accurate IBM PC/XT emulator | https://github.com/dbalsom/martypc

Reply 8 of 8, by superfury

Posted on Yesterday, 23:10

superfury Offline

Rank l33t++

Rank: l33t++
Posts: 5855
Joined: 2014-03-08, 11:25
Location: Netherlands

From what I understand, it's always applying at the linear address stage (so after logical address conversion, but before applying paging (if in protected mode and enabled, otherwise it's a physical address (as there is no linear-physical address translation applied))).

Looking at the Bochs source code seems to confirm that.

Managed to set some breakpoints debugging a Windows XP home 2600 CD-ROM boot (Using the usual UniPCemu TCP to UniPCemu, which is connected to COM0COM, where the other serial port on the COM0COM connection is WinDBG that's compatible with the OS required.

Managed to single step and use breakpoint instructions to trap on an address, so the breakpoints should be working (at least in protected mode). I've also removed the condition of it requiring protected mode to apply, thus the breakpoints will apply in virtual 8086 mode (on linear addresses) or real mode (on 'physical' addresses, although effectively performed on linear addresses by my code (the output from the logical to linear address translation, before it's fed into the physical address generation (which takes paging into account)), which aren't translated due to paging being disabled in real mode).

Found some bugs in pre-instruction handling of protection faults. They should be properly operating now (taking the pre-instruction instruction state (things like instruction execution status, REP prefixes being pending to reset etc.) into account properly). If no exception is triggered, stuff like REP still continues the loop, until it either ends normally or throws an exception during execution or pre-instruction.

Author of the UniPCemu emulator.
UniPCemu Git repository
UniPCemu for Android, Windows, PSP, Vita and Switch on itch.io

Go to top of page Go to top of page

Back to PC Emulation