[Qemu-devel] [Bug 1738434] [NEW] CALL FWORD PTR [ESP] handled incorrectly

[Oleg Boyarchuk]

Public bug reported:

To keep the story short, this 32-bit code crashes on 64-bit Windows
whereas it works fine on real system and VMware:

    push 33h
    push offset _far_call
    call fword ptr[esp]
    jmp _ret
_far_call:
    retf
_ret:

32-bit code running under WoW64 on 64-bit Windows has the ability to
switch to the 64-bit mode via so called "Heaven's gate". In order to do
that you have to make a far call/jmp by 0x33 selector how the code
snippet above shows. QEMU throws an access violation exception whereas
the code snippet runs with no problems on real CPU and VMware. By the
way, this code works fine under QEMU, I hope it gives you a hint where
to look:

    push 23h
    push offset _far_call
    call fword ptr[esp]
    jmp _ret
_far_call:
    retf
_ret:

0x23 is a default 32-bit selector for 32-bit processes running under
WoW64.

Environment:
QEMU: 2.10.93, command line: qemu-system-x86_64.exe -m 2G -snapshot -cdrom 
full_path_to_iso fullP_path_to_img
Guest OS: Windows 7 x64 SP1 build 7601 or Windows 10 version 1709 build 16299.19
Host OS: Windows 10 x64 version 1703 build 15063.786

** Affects: qemu
     Importance: Undecided
         Status: New

** Attachment added: "OllyDbg screenshot explains the problem"
   
https://bugs.launchpad.net/bugs/1738434/+attachment/5023064/+files/call_fword_ptr_bug.png

-- 
You received this bug notification because you are a member of qemu-
devel-ml, which is subscribed to QEMU.
https://bugs.launchpad.net/bugs/1738434

Title:
  CALL FWORD PTR [ESP] handled incorrectly

Status in QEMU:
  New

Bug description:
  To keep the story short, this 32-bit code crashes on 64-bit Windows
  whereas it works fine on real system and VMware:

      push 33h
      push offset _far_call
      call fword ptr[esp]
      jmp _ret
  _far_call:
      retf
  _ret:

  32-bit code running under WoW64 on 64-bit Windows has the ability to
  switch to the 64-bit mode via so called "Heaven's gate". In order to
  do that you have to make a far call/jmp by 0x33 selector how the code
  snippet above shows. QEMU throws an access violation exception whereas
  the code snippet runs with no problems on real CPU and VMware. By the
  way, this code works fine under QEMU, I hope it gives you a hint where
  to look:

      push 23h
      push offset _far_call
      call fword ptr[esp]
      jmp _ret
  _far_call:
      retf
  _ret:

  0x23 is a default 32-bit selector for 32-bit processes running under
  WoW64.

  Environment:
  QEMU: 2.10.93, command line: qemu-system-x86_64.exe -m 2G -snapshot -cdrom 
full_path_to_iso fullP_path_to_img
  Guest OS: Windows 7 x64 SP1 build 7601 or Windows 10 version 1709 build 
16299.19
  Host OS: Windows 10 x64 version 1703 build 15063.786

To manage notifications about this bug go to:
https://bugs.launchpad.net/qemu/+bug/1738434/+subscriptions