This is an automated cleanup. This bug report has been moved to QEMU's new bug tracker on gitlab.com and thus gets marked as 'expired' now. Please continue with the discussion here:
https://gitlab.com/qemu-project/qemu/-/issues/382 ** Changed in: qemu Status: Incomplete => Expired ** Bug watch added: gitlab.com/qemu-project/qemu/-/issues #382 https://gitlab.com/qemu-project/qemu/-/issues/382 -- You received this bug notification because you are a member of qemu- devel-ml, which is subscribed to QEMU. https://bugs.launchpad.net/bugs/1879955 Title: target/i386/seg_helper.c: 16-bit TSS struct format wrong? Status in QEMU: Expired Bug description: In target/i386/seg_helper.c:switch_tss_ra() we have the following code to load registers from a 16-bit TSS struct: /* 16 bit */ new_cr3 = 0; new_eip = cpu_lduw_kernel_ra(env, tss_base + 0x0e, retaddr); new_eflags = cpu_lduw_kernel_ra(env, tss_base + 0x10, retaddr); for (i = 0; i < 8; i++) { new_regs[i] = cpu_lduw_kernel_ra(env, tss_base + (0x12 + i * 2), retaddr) | 0xffff0000; } for (i = 0; i < 4; i++) { new_segs[i] = cpu_lduw_kernel_ra(env, tss_base + (0x22 + i * 4), retaddr); } new_ldt = cpu_lduw_kernel_ra(env, tss_base + 0x2a, retaddr); This doesn't match up with the structure described here: https://www.sandpile.org/x86/tss.htm -- which has only 2-byte slots for the segment registers. It also makes the 3rd segreg use the same offset as the LDTR, which is very suspicious. I suspect that this should use "(0x22 + i * 2)". The code later in the same function that stores the segment registers to the struct has the same bug. Found by code inspection; I don't have a test case to check this. As a non-x86-expert I'm just going to file a bug report in case somebody else feels like confirming the issue and sending a patch. To manage notifications about this bug go to: https://bugs.launchpad.net/qemu/+bug/1879955/+subscriptions