[Qemu-devel] [Bug 1699867] [NEW] x86_64 qemu crashes at far call into long-mode

[Anatol Pomozov]

Public bug reported:

I am experimenting with this OS https://github.com/phil-opp/blog_os and
spotted a weird behavior with qemu.

I am looking at code that does transition from 32bit mode to 64bit mode.
Right now it does 'jmp $SELECTOR,64bitfunction'. https://github.com
/phil-
opp/blog_os/blob/557c6a58ea11e31685b9d014d307002d64df5c22/src/arch/x86_64/boot.asm#L32

This code works fine with qemu/kvm/vmware.

To transition from 32 to 64 bit code it is possible to use 'call'
operation. So I am trying to replace that code with 'call
$SELECTOR,64bitfunction'. It works fine with kvm and wmware. But it
fails with Qemu emulation. See the interrup debug log attached. qemu
crashes at 10302c (far call mnemonic).


  103016:       e8 18 00 00 00          callq  103033 <set_up_page_tables>
  10301b:       e8 5c 00 00 00          callq  10307c <enable_paging>
  103020:       e8 ec 00 00 00          callq  103111 <set_up_SSE>
  103025:       0f 01 15 28 00 10 00    lgdt   0x100028(%rip)        # 203054 
<GCC_except_table2+0xdb5f8>
  10302c:       9a                      (bad)  
  10302d:       40 31 10                rex xor %edx,(%rax)
  103030:       00 08                   add    %cl,(%rax)


As the code works at hardware I expect it to work with qemu. Thus current qemu 
behavior looks like a bug.

** Affects: qemu
     Importance: Undecided
         Status: New

** Attachment added: "Debug log for qemu crash at far call"
   https://bugs.launchpad.net/bugs/1699867/+attachment/4901095/+files/debug.log

-- 
You received this bug notification because you are a member of qemu-
devel-ml, which is subscribed to QEMU.
https://bugs.launchpad.net/bugs/1699867

Title:
  x86_64 qemu crashes at far call into long-mode

Status in QEMU:
  New

Bug description:
  I am experimenting with this OS https://github.com/phil-opp/blog_os
  and spotted a weird behavior with qemu.

  I am looking at code that does transition from 32bit mode to 64bit
  mode. Right now it does 'jmp $SELECTOR,64bitfunction'.
  https://github.com/phil-
  
opp/blog_os/blob/557c6a58ea11e31685b9d014d307002d64df5c22/src/arch/x86_64/boot.asm#L32

  This code works fine with qemu/kvm/vmware.

  To transition from 32 to 64 bit code it is possible to use 'call'
  operation. So I am trying to replace that code with 'call
  $SELECTOR,64bitfunction'. It works fine with kvm and wmware. But it
  fails with Qemu emulation. See the interrup debug log attached. qemu
  crashes at 10302c (far call mnemonic).

  
    103016:       e8 18 00 00 00          callq  103033 <set_up_page_tables>
    10301b:       e8 5c 00 00 00          callq  10307c <enable_paging>
    103020:       e8 ec 00 00 00          callq  103111 <set_up_SSE>
    103025:       0f 01 15 28 00 10 00    lgdt   0x100028(%rip)        # 203054 
<GCC_except_table2+0xdb5f8>
    10302c:       9a                      (bad)  
    10302d:       40 31 10                rex xor %edx,(%rax)
    103030:       00 08                   add    %cl,(%rax)

  
  As the code works at hardware I expect it to work with qemu. Thus current 
qemu behavior looks like a bug.

To manage notifications about this bug go to:
https://bugs.launchpad.net/qemu/+bug/1699867/+subscriptions