I found a bug in qemu, version 1.6.0 rc2. When i invoke:

cpu_physical_memory_rw(addr, mem_buf, noOfBytes, 0);

where addr=0xffff0 and noOfBytes=50, qemu will has segmentation fault. I called the cpu_physical_memory_rw right after the qemu is started (haven’t run yet) with gdb. The vm was in real mode, i am not sure it is crossing memory boundary problem. But i just failed for address 0xffff0. For address 0xfff and 0xfffff0 are ok.

Peter.