kernel: 0.770
socket: 0.767
graphic: 0.763
device: 0.757
performance: 0.735
ppc: 0.731
mistranslation: 0.729
x86: 0.709
architecture: 0.703
network: 0.680
vnc: 0.670
VMM: 0.667
assembly: 0.666
debug: 0.661
PID: 0.647
files: 0.647
register: 0.639
user-level: 0.632
risc-v: 0.607
permissions: 0.592
semantic: 0.586
hypervisor: 0.581
arm: 0.571
KVM: 0.558
virtual: 0.546
peripherals: 0.534
boot: 0.530
TCG: 0.380
i386: 0.332

CALL FWORD PTR [ESP] handled incorrectly

To keep the story short, this 32-bit code crashes on 64-bit Windows whereas it works fine on real system and VMware:

    push 33h
    push offset _far_call
    call fword ptr[esp]
    jmp _ret
_far_call:
    retf
_ret:

32-bit code running under WoW64 on 64-bit Windows has the ability to switch to the 64-bit mode via so called "Heaven's gate". In order to do that you have to make a far call/jmp by 0x33 selector how the code snippet above shows. QEMU throws an access violation exception whereas the code snippet runs with no problems on real CPU and VMware. By the way, this code works fine under QEMU, I hope it gives you a hint where to look:

    push 23h
    push offset _far_call
    call fword ptr[esp]
    jmp _ret
_far_call:
    retf
_ret:

0x23 is a default 32-bit selector for 32-bit processes running under WoW64.

Environment:
QEMU: 2.10.93, command line: qemu-system-x86_64.exe -m 2G -snapshot -cdrom full_path_to_iso fullP_path_to_img
Guest OS: Windows 7 x64 SP1 build 7601 or Windows 10 version 1709 build 16299.19
Host OS: Windows 10 x64 version 1703 build 15063.786



The QEMU project is currently considering to move its bug tracking to another system. For this we need to know which bugs are still valid and which could be closed already. Thus we are setting older bugs to "Incomplete" now.
If you still think this bug report here is valid, then please switch the state back to "New" within the next 60 days, otherwise this report will be marked as "Expired". Or mark it as "Fix Released" if the problem has been solved with a newer version of QEMU already. Thank you and sorry for the inconvenience.


[Expired for QEMU because there has been no activity for 60 days.]