qemu 无效的 tss 类型

Question

我在 32 位保护模式下从内核模式切换到用户模式（仅分段而不是分页）当我进行切换并在用户空间调用中断时，我从 qemu 收到此错误：

This may indicate that pixbuf loaders or the mime database could not be found.
qemu: fatal: invalid tss type
EAX=00003fec EBX=00001000 ECX=00000002 EDX=00001810
ESI=00000000 EDI=00000000 EBP=00003ff8 ESP=00003fec
EIP=00000000 EFL=00000006 [-----P-] CPL=3 II=0 A20=1 SMM=0 HLT=0
ES =0023 00006000 7fffffff 00c7f300 DPL=3 DS   [-WA]
CS =001b 00006000 7fffffff 00c7fa00 DPL=3 CS32 [-R-]
SS =0023 00006000 7fffffff 00c7f300 DPL=3 DS   [-WA]
DS =0023 00006000 7fffffff 00c7f300 DPL=3 DS   [-WA]
FS =0023 00006000 7fffffff 00c7f300 DPL=3 DS   [-WA]
GS =0023 00006000 7fffffff 00c7f300 DPL=3 DS   [-WA]
LDT=0000 00000000 0000ffff 00008200 DPL=0 LDT
TR =0000 00000000 0000ffff 00008b00 DPL=0 TSS32-busy
GDT=     00007c47 00000027
IDT=     00003000 0000ffff
CR0=00000011 CR2=00000000 CR3=00000000 CR4=00000000
DR0=00000000 DR1=00000000 DR2=00000000 DR3=00000000
DR6=ffff0ff0 DR7=00000400
CCS=00000004 CCD=00003fe8 CCO=EFLAGS
EFER=0000000000000000
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=0000000000000000 0000000000000000 XMM01=0000000000000000 0000000000000000
XMM02=0000000000000000 0000000000000000 XMM03=0000000000000000 0000000000000000
XMM04=0000000000000000 0000000000000000 XMM05=0000000000000000 0000000000000000
XMM06=0000000000000000 0000000000000000 XMM07=0000000000000000 0000000000000000

这里是切换到用户空间的代码：

switchSegments:

    
    
    mov ax, 0x23
    mov ds, ax
    mov es, ax
    mov fs, ax
    mov gs, ax

    mov eax, esp
    push dword 0x23
    push dword eax
    pushf
    
    
    
    push dword 0x1B
    push dword 0x0
    iret

这是 GDT：

gdt_start:
    ;first entry is always null (each entry is 8 bytes or 64 bits)
    dd 0x0 ; 4 byte
    dd 0x0 ; 4 byte

; GDT for code segment. base = 0x00000000, length = 0xfffff
; for flags, refer to os-dev.pdf document, page 36
gdt_code: 
    dw 0xFFFF   ; segment length, bits 0-15
    dw 0x0       ; segment base, bits 0-15
    db 0x0       ; seg2ment base, bits 16-23
    db 10011010b ; flags (8 bits)
    db 11000000b ; flags (4 bits) + segment length, bits 16-19
    db 0x0       ; segment base, bits 24-31

; GDT for data segment. base and length identical to code segment
; some flags changed, again, refer to os-dev.pdf
gdt_data:
    dw 0xFFFF
    dw 0x0
    db 0x0
    db 10010010b
    db 11000000b
    db 0x0

U_code: 
    dw 0xFFFF    ; segment length, bits 0-15
    dw 0x6000    ; segment base, bits 0-15
    db 0x00      ; seg2ment base, bits 16-23
    db 11111010b ; flags (8 bits)
    db 11000111b ; flags (4 bits) + segment length, bits 16-19
    db 0x00       ; segment base, bits 24-31

; GDT for data segment. base and length identical to code segment
; some flags changed, again, refer to os-dev.pdf
U_data:
    dw 0xFFFF
    dw 0x6000
    db 0x00
    db 11110010b
    db 11000111b
    db 0x00
gdt_end:

; GDT descriptor
gdt_descriptor:
    dw gdt_end - gdt_start - 1 ; size (16 bit), always one less of its true size
    dd gdt_start ; address (32 bit)

我正在用 int 2 调用中断。

我不太清楚无效的 TSS 是什么意思。我没有使用分页来保护内存。

让我知道还有哪些其他细节会有所帮助。