diff options
| author | Christian Krinitsin <mail@krinitsin.com> | 2025-06-30 12:34:26 +0000 |
|---|---|---|
| committer | Christian Krinitsin <mail@krinitsin.com> | 2025-06-30 12:35:44 +0000 |
| commit | 25f8033d556aa17afaea4a5196ea7a69fe248320 (patch) | |
| tree | 0f056db167683be54ea1e5e72d29d6069af55e7d /results/classifier/deepseek-2-tmp/output/hypervisor/1503031 | |
| parent | 8e6da29e4ee5fc14bc1cc816a24f21271f14090d (diff) | |
| download | emulator-bug-study-25f8033d556aa17afaea4a5196ea7a69fe248320.tar.gz emulator-bug-study-25f8033d556aa17afaea4a5196ea7a69fe248320.zip | |
add new temporary deepseek-r1:14b results
Diffstat (limited to 'results/classifier/deepseek-2-tmp/output/hypervisor/1503031')
| -rw-r--r-- | results/classifier/deepseek-2-tmp/output/hypervisor/1503031 | 12 |
1 files changed, 12 insertions, 0 deletions
diff --git a/results/classifier/deepseek-2-tmp/output/hypervisor/1503031 b/results/classifier/deepseek-2-tmp/output/hypervisor/1503031 new file mode 100644 index 00000000..988be305 --- /dev/null +++ b/results/classifier/deepseek-2-tmp/output/hypervisor/1503031 @@ -0,0 +1,12 @@ + +32-to-64-bit call gate unsupported in IA32e mode + +In particular, the lcall implementation doesn't support the 64-bit TSS. + +helper_lcall_protected (target-i386/seg_helper.c:1884) calls get_ss_esp_from_tss() on a call gate to a lower privilege level, which tries to extract a 32-bit ESP and 16-bit SS from the TSS. In IA32e mode (64-bit or compatibility mode), this instead grabs the lower 32-bits of the target RSP, and 16 of the upper bits as the SS. Additionally, several of the subsequent checks are incorrect (even if the correct stack pointer were extracted). + +This isn't a problem for interrupts since the interrupts are given their own implementation entirely, that uses get_rsp_from_tss() rather than get_ss_esp_from_tss(). + +I believe the missing logic is from the branch starting "ELSE (* current TSS is 64-bit *)" in the CALL pseudocode in the Intel manual (page 3-124 of the PDF I have). + +Reproduced at master (c0b520dfb8890294a9f8879f4759172900585995), and also as of a qemu built a year ago. \ No newline at end of file |