bs3-cpu-basic-2-template.c@ 60680

Last change on this file since 60680 was 60680, checked in by vboxsync, 9 years ago
bs3kit: updates.
Property svn:eol-style set to `native` Property svn:keywords set to `Author Date Id Revision`
File size: 99.3 KB

Line
1	/* $Id: bs3-cpu-basic-2-template.c 60680 2016-04-24 15:57:16Z vboxsync $ */
2	/** @file
3	* BS3Kit - bs3-cpu-basic-2, C code template.
4	*/
5
6	/*
7	* Copyright (C) 2007-2016 Oracle Corporation
8	*
9	* This file is part of VirtualBox Open Source Edition (OSE), as
10	* available from http://www.215389.xyz. This file is free software;
11	* you can redistribute it and/or modify it under the terms of the GNU
12	* General Public License (GPL) as published by the Free Software
13	* Foundation, in version 2 as it comes in the "COPYING" file of the
14	* VirtualBox OSE distribution. VirtualBox OSE is distributed in the
15	* hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
16	*
17	* The contents of this file may alternatively be used under the terms
18	* of the Common Development and Distribution License Version 1.0
19	* (CDDL) only, as it comes in the "COPYING.CDDL" file of the
20	* VirtualBox OSE distribution, in which case the provisions of the
21	* CDDL are applicable instead of those of the GPL.
22	*
23	* You may elect to license modified versions of this file under the
24	* terms and conditions of either the GPL or the CDDL or both.
25	*/
26
27
28	/*********************************************************************************************************************************
29	* Header Files *
30	*********************************************************************************************************************************/
31	#include <iprt/asm.h>
32	#include <iprt/asm-amd64-x86.h>
33
34
35	/*********************************************************************************************************************************
36	* Defined Constants And Macros *
37	*********************************************************************************************************************************/
38	#undef CHECK_MEMBER
39	#define CHECK_MEMBER(a_szName, a_szFmt, a_Actual, a_Expected) \
40	do \
41	{ \
42	if ((a_Actual) == (a_Expected)) { /* likely */ } \
43	else bs3CpuBasic2_FailedF(a_szName "=" a_szFmt " expected " a_szFmt, (a_Actual), (a_Expected)); \
44	} while (0)
45
46	#ifdef BS3_INSTANTIATING_MODE
47	# undef MyBs3Idt
48	# undef MY_SYS_SEL_R0_CS
49	# undef MY_SYS_SEL_R0_CS_CNF
50	# undef MY_SYS_SEL_R0_DS
51	# undef MY_SYS_SEL_R0_SS
52	# if BS3_MODE_IS_16BIT_SYS(TMPL_MODE)
53	# define MyBs3Idt Bs3Idt16
54	# define MY_SYS_SEL_R0_CS BS3_SEL_R0_CS16
55	# define MY_SYS_SEL_R0_CS_CNF BS3_SEL_R0_CS16_CNF
56	# define MY_SYS_SEL_R0_DS BS3_SEL_R0_DS16
57	# define MY_SYS_SEL_R0_SS BS3_SEL_R0_SS16
58	# elif BS3_MODE_IS_32BIT_SYS(TMPL_MODE)
59	# define MyBs3Idt Bs3Idt32
60	# define MY_SYS_SEL_R0_CS BS3_SEL_R0_CS32
61	# define MY_SYS_SEL_R0_CS_CNF BS3_SEL_R0_CS32_CNF
62	# define MY_SYS_SEL_R0_DS BS3_SEL_R0_DS32
63	# define MY_SYS_SEL_R0_SS BS3_SEL_R0_SS32
64	# elif BS3_MODE_IS_64BIT_SYS(TMPL_MODE)
65	# define MyBs3Idt Bs3Idt64
66	# define MY_SYS_SEL_R0_CS BS3_SEL_R0_CS64
67	# define MY_SYS_SEL_R0_CS_CNF BS3_SEL_R0_CS64_CNF
68	# define MY_SYS_SEL_R0_DS BS3_SEL_R0_DS64
69	# define MY_SYS_SEL_R0_SS BS3_SEL_R0_DS64
70	# else
71	# error "TMPL_MODE"
72	# endif
73	#endif
74
75
76	/*********************************************************************************************************************************
77	* Structures and Typedefs *
78	*********************************************************************************************************************************/
79	#ifdef BS3_INSTANTIATING_CMN
80	typedef struct BS3CB2INVLDESCTYPE
81	{
82	uint8_t u4Type;
83	uint8_t u1DescType;
84	} BS3CB2INVLDESCTYPE;
85
86	typedef struct BS3CB2SIDTSGDT
87	{
88	FPFNBS3FAR fpfnWorker;
89	uint8_t cbInstr;
90	bool fSs;
91	uint8_t bMode;
92	} BS3CB2SIDTSGDT;
93	#endif
94
95
96	/*********************************************************************************************************************************
97	* External Symbols *
98	*********************************************************************************************************************************/
99	#ifdef BS3_INSTANTIATING_CMN
100	extern FNBS3FAR bs3CpuBasic2_Int80;
101	extern FNBS3FAR bs3CpuBasic2_Int81;
102	extern FNBS3FAR bs3CpuBasic2_Int82;
103	extern FNBS3FAR bs3CpuBasic2_Int83;
104	extern FNBS3FAR bs3CpuBasic2_ud2;
105	# define g_bs3CpuBasic2_ud2_FlatAddr BS3_DATA_NM(g_bs3CpuBasic2_ud2_FlatAddr)
106	extern uint32_t g_bs3CpuBasic2_ud2_FlatAddr;
107
108	extern FNBS3FAR bs3CpuBasic2_sidt_bx_ud2_c16;
109	extern FNBS3FAR bs3CpuBasic2_sidt_bx_ud2_c32;
110	extern FNBS3FAR bs3CpuBasic2_sidt_bx_ud2_c64;
111	extern FNBS3FAR bs3CpuBasic2_sidt_ss_bx_ud2_c16;
112	extern FNBS3FAR bs3CpuBasic2_sidt_ss_bx_ud2_c32;
113	extern FNBS3FAR bs3CpuBasic2_sidt_rexw_bx_ud2_c64;
114	extern FNBS3FAR bs3CpuBasic2_sidt_opsize_bx_ud2_c16;
115	extern FNBS3FAR bs3CpuBasic2_sidt_opsize_bx_ud2_c32;
116	extern FNBS3FAR bs3CpuBasic2_sidt_opsize_bx_ud2_c64;
117	extern FNBS3FAR bs3CpuBasic2_sidt_opsize_ss_bx_ud2_c16;
118	extern FNBS3FAR bs3CpuBasic2_sidt_opsize_ss_bx_ud2_c32;
119	extern FNBS3FAR bs3CpuBasic2_sidt_opsize_rexw_bx_ud2_c64;
120
121	extern FNBS3FAR bs3CpuBasic2_sgdt_bx_ud2_c16;
122	extern FNBS3FAR bs3CpuBasic2_sgdt_bx_ud2_c32;
123	extern FNBS3FAR bs3CpuBasic2_sgdt_bx_ud2_c64;
124	extern FNBS3FAR bs3CpuBasic2_sgdt_ss_bx_ud2_c16;
125	extern FNBS3FAR bs3CpuBasic2_sgdt_ss_bx_ud2_c32;
126	extern FNBS3FAR bs3CpuBasic2_sgdt_rexw_bx_ud2_c64;
127	extern FNBS3FAR bs3CpuBasic2_sgdt_opsize_bx_ud2_c16;
128	extern FNBS3FAR bs3CpuBasic2_sgdt_opsize_bx_ud2_c32;
129	extern FNBS3FAR bs3CpuBasic2_sgdt_opsize_bx_ud2_c64;
130	extern FNBS3FAR bs3CpuBasic2_sgdt_opsize_ss_bx_ud2_c16;
131	extern FNBS3FAR bs3CpuBasic2_sgdt_opsize_ss_bx_ud2_c32;
132	extern FNBS3FAR bs3CpuBasic2_sgdt_opsize_rexw_bx_ud2_c64;
133	#endif
134
135
136	/*********************************************************************************************************************************
137	* Global Variables *
138	*********************************************************************************************************************************/
139	#ifdef BS3_INSTANTIATING_CMN
140	# define g_pszTestMode BS3_CMN_NM(g_pszTestMode)
141	static const char BS3_FAR g_pszTestMode = (const char )1;
142	# define g_bTestMode BS3_CMN_NM(g_bTestMode)
143	static uint8_t g_bTestMode = 1;
144	# define g_f16BitSys BS3_CMN_NM(g_f16BitSys)
145	static bool g_f16BitSys = 1;
146
147
148	static BS3CB2SIDTSGDT const g_aSidtWorkers[] =
149	{
150	{ bs3CpuBasic2_sidt_bx_ud2_c16, 3, false, BS3_MODE_CODE_16 \| BS3_MODE_CODE_V86 },
151	{ bs3CpuBasic2_sidt_ss_bx_ud2_c16, 4, true, BS3_MODE_CODE_16 \| BS3_MODE_CODE_V86 },
152	{ bs3CpuBasic2_sidt_opsize_bx_ud2_c16, 4, false, BS3_MODE_CODE_16 \| BS3_MODE_CODE_V86 },
153	{ bs3CpuBasic2_sidt_opsize_ss_bx_ud2_c16, 5, true, BS3_MODE_CODE_16 \| BS3_MODE_CODE_V86 },
154	{ bs3CpuBasic2_sidt_bx_ud2_c32, 3, false, BS3_MODE_CODE_32 },
155	{ bs3CpuBasic2_sidt_ss_bx_ud2_c32, 4, true, BS3_MODE_CODE_32 },
156	{ bs3CpuBasic2_sidt_opsize_bx_ud2_c32, 4, false, BS3_MODE_CODE_32 },
157	{ bs3CpuBasic2_sidt_opsize_ss_bx_ud2_c32, 5, true, BS3_MODE_CODE_32 },
158	{ bs3CpuBasic2_sidt_bx_ud2_c64, 3, false, BS3_MODE_CODE_64 },
159	{ bs3CpuBasic2_sidt_rexw_bx_ud2_c64, 4, false, BS3_MODE_CODE_64 },
160	{ bs3CpuBasic2_sidt_opsize_bx_ud2_c64, 4, false, BS3_MODE_CODE_64 },
161	{ bs3CpuBasic2_sidt_opsize_rexw_bx_ud2_c64, 5, false, BS3_MODE_CODE_64 },
162	};
163
164
165	static BS3CB2SIDTSGDT const g_aSgdtWorkers[] =
166	{
167	{ bs3CpuBasic2_sgdt_bx_ud2_c16, 3, false, BS3_MODE_CODE_16 \| BS3_MODE_CODE_V86 },
168	{ bs3CpuBasic2_sgdt_ss_bx_ud2_c16, 4, true, BS3_MODE_CODE_16 \| BS3_MODE_CODE_V86 },
169	{ bs3CpuBasic2_sgdt_opsize_bx_ud2_c16, 4, false, BS3_MODE_CODE_16 \| BS3_MODE_CODE_V86 },
170	{ bs3CpuBasic2_sgdt_opsize_ss_bx_ud2_c16, 5, true, BS3_MODE_CODE_16 \| BS3_MODE_CODE_V86 },
171	{ bs3CpuBasic2_sgdt_bx_ud2_c32, 3, false, BS3_MODE_CODE_32 },
172	{ bs3CpuBasic2_sgdt_ss_bx_ud2_c32, 4, true, BS3_MODE_CODE_32 },
173	{ bs3CpuBasic2_sgdt_opsize_bx_ud2_c32, 4, false, BS3_MODE_CODE_32 },
174	{ bs3CpuBasic2_sgdt_opsize_ss_bx_ud2_c32, 5, true, BS3_MODE_CODE_32 },
175	{ bs3CpuBasic2_sgdt_bx_ud2_c64, 3, false, BS3_MODE_CODE_64 },
176	{ bs3CpuBasic2_sgdt_rexw_bx_ud2_c64, 4, false, BS3_MODE_CODE_64 },
177	{ bs3CpuBasic2_sgdt_opsize_bx_ud2_c64, 4, false, BS3_MODE_CODE_64 },
178	{ bs3CpuBasic2_sgdt_opsize_rexw_bx_ud2_c64, 5, false, BS3_MODE_CODE_64 },
179	};
180
181
182	/** Table containing invalid CS selector types. */
183	static const BS3CB2INVLDESCTYPE g_aInvalidCsTypes[] =
184	{
185	{ X86_SEL_TYPE_RO, 1 },
186	{ X86_SEL_TYPE_RO_ACC, 1 },
187	{ X86_SEL_TYPE_RW, 1 },
188	{ X86_SEL_TYPE_RW_ACC, 1 },
189	{ X86_SEL_TYPE_RO_DOWN, 1 },
190	{ X86_SEL_TYPE_RO_DOWN_ACC, 1 },
191	{ X86_SEL_TYPE_RW_DOWN, 1 },
192	{ X86_SEL_TYPE_RW_DOWN_ACC, 1 },
193	{ 0, 0 },
194	{ 1, 0 },
195	{ 2, 0 },
196	{ 3, 0 },
197	{ 4, 0 },
198	{ 5, 0 },
199	{ 6, 0 },
200	{ 7, 0 },
201	{ 8, 0 },
202	{ 9, 0 },
203	{ 10, 0 },
204	{ 11, 0 },
205	{ 12, 0 },
206	{ 13, 0 },
207	{ 14, 0 },
208	{ 15, 0 },
209	};
210
211	/** Table containing invalid SS selector types. */
212	static const BS3CB2INVLDESCTYPE g_aInvalidSsTypes[] =
213	{
214	{ X86_SEL_TYPE_EO, 1 },
215	{ X86_SEL_TYPE_EO_ACC, 1 },
216	{ X86_SEL_TYPE_ER, 1 },
217	{ X86_SEL_TYPE_ER_ACC, 1 },
218	{ X86_SEL_TYPE_EO_CONF, 1 },
219	{ X86_SEL_TYPE_EO_CONF_ACC, 1 },
220	{ X86_SEL_TYPE_ER_CONF, 1 },
221	{ X86_SEL_TYPE_ER_CONF_ACC, 1 },
222	{ 0, 0 },
223	{ 1, 0 },
224	{ 2, 0 },
225	{ 3, 0 },
226	{ 4, 0 },
227	{ 5, 0 },
228	{ 6, 0 },
229	{ 7, 0 },
230	{ 8, 0 },
231	{ 9, 0 },
232	{ 10, 0 },
233	{ 11, 0 },
234	{ 12, 0 },
235	{ 13, 0 },
236	{ 14, 0 },
237	{ 15, 0 },
238	};
239
240	#endif /* BS3_INSTANTIATING_CMN - global */
241
242	#ifdef BS3_INSTANTIATING_CMN
243
244	/**
245	* Wrapper around Bs3TestFailedF that prefixes the error with g_usBs3TestStep
246	* and g_pszTestMode.
247	*/
248	# define bs3CpuBasic2_FailedF BS3_CMN_NM(bs3CpuBasic2_FailedF)
249	BS3_DECL_NEAR(void) bs3CpuBasic2_FailedF(const char *pszFormat, ...)
250	{
251	va_list va;
252
253	char szTmp[168];
254	va_start(va, pszFormat);
255	Bs3StrPrintfV(szTmp, sizeof(szTmp), pszFormat, va);
256	va_end(va);
257
258	Bs3TestFailedF("%u - %s: %s", g_usBs3TestStep, g_pszTestMode, szTmp);
259	}
260
261
262	/**
263	* Compares trap stuff.
264	*/
265	# define bs3CpuBasic2_CompareIntCtx1 BS3_CMN_NM(bs3CpuBasic2_CompareIntCtx1)
266	BS3_DECL_NEAR(void) bs3CpuBasic2_CompareIntCtx1(PCBS3TRAPFRAME pTrapCtx, PCBS3REGCTX pStartCtx, uint8_t bXcpt)
267	{
268	uint16_t const cErrorsBefore = Bs3TestSubErrorCount();
269	CHECK_MEMBER("bXcpt", "%#04x", pTrapCtx->bXcpt, bXcpt);
270	CHECK_MEMBER("bErrCd", "%#06RX64", pTrapCtx->uErrCd, 0);
271	Bs3TestCheckRegCtxEx(&pTrapCtx->Ctx, pStartCtx, 2 /int xx/, 0 /cbSpAdjust/, 0 /fExtraEfl/, g_pszTestMode, g_usBs3TestStep);
272	if (Bs3TestSubErrorCount() != cErrorsBefore)
273	{
274	Bs3TrapPrintFrame(pTrapCtx);
275	#if 1
276	Bs3TestPrintf("Halting: g_uBs3CpuDetected=%#x\n", g_uBs3CpuDetected);
277	Bs3TestPrintf("Halting in CompareTrapCtx1: bXcpt=%#x\n", bXcpt);
278	ASMHalt();
279	#endif
280	}
281	}
282
283
284	/**
285	* Compares trap stuff.
286	*/
287	# define bs3CpuBasic2_CompareTrapCtx2 BS3_CMN_NM(bs3CpuBasic2_CompareTrapCtx2)
288	BS3_DECL_NEAR(void) bs3CpuBasic2_CompareTrapCtx2(PCBS3TRAPFRAME pTrapCtx, PCBS3REGCTX pStartCtx, uint16_t cbIpAdjust,
289	uint8_t bXcpt, uint16_t uHandlerCs)
290	{
291	uint16_t const cErrorsBefore = Bs3TestSubErrorCount();
292	CHECK_MEMBER("bXcpt", "%#04x", pTrapCtx->bXcpt, bXcpt);
293	CHECK_MEMBER("bErrCd", "%#06RX64", pTrapCtx->uErrCd, 0);
294	CHECK_MEMBER("uHandlerCs", "%#06x", pTrapCtx->uHandlerCs, uHandlerCs);
295	Bs3TestCheckRegCtxEx(&pTrapCtx->Ctx, pStartCtx, cbIpAdjust, 0 /cbSpAdjust/, 0 /fExtraEfl/, g_pszTestMode, g_usBs3TestStep);
296	if (Bs3TestSubErrorCount() != cErrorsBefore)
297	{
298	Bs3TrapPrintFrame(pTrapCtx);
299	#if 1
300	Bs3TestPrintf("Halting: g_uBs3CpuDetected=%#x\n", g_uBs3CpuDetected);
301	Bs3TestPrintf("Halting in CompareTrapCtx2: bXcpt=%#x\n", bXcpt);
302	ASMHalt();
303	#endif
304	}
305	}
306
307	/**
308	* Compares a CPU trap.
309	*/
310	# define bs3CpuBasic2_CompareCpuTrapCtx BS3_CMN_NM(bs3CpuBasic2_CompareCpuTrapCtx)
311	BS3_DECL_NEAR(void) bs3CpuBasic2_CompareCpuTrapCtx(PCBS3TRAPFRAME pTrapCtx, PCBS3REGCTX pStartCtx, uint16_t uErrCd,
312	uint8_t bXcpt, bool f486ResumeFlagHint)
313	{
314	uint16_t const cErrorsBefore = Bs3TestSubErrorCount();
315	uint32_t fExtraEfl;
316
317	CHECK_MEMBER("bXcpt", "%#04x", pTrapCtx->bXcpt, bXcpt);
318	CHECK_MEMBER("bErrCd", "%#06RX16", (uint16_t)pTrapCtx->uErrCd, (uint16_t)uErrCd); /* 486 only writes a word */
319
320	fExtraEfl = X86_EFL_RF;
321	if ( g_f16BitSys
322	\|\| ( !f486ResumeFlagHint
323	&& (g_uBs3CpuDetected & BS3CPU_TYPE_MASK) <= BS3CPU_80486 ) )
324	fExtraEfl = 0;
325	else
326	fExtraEfl = X86_EFL_RF;
327	#if 0 /** @todo Running on an AMD Phenom II X6 1100T under AMD-V I'm not getting good X86_EFL_RF results. Enable this to get on with other work. */
328	fExtraEfl = pTrapCtx->Ctx.rflags.u32 & X86_EFL_RF;
329	#endif
330	Bs3TestCheckRegCtxEx(&pTrapCtx->Ctx, pStartCtx, 0 /cbIpAdjust/, 0 /cbSpAdjust/, fExtraEfl, g_pszTestMode, g_usBs3TestStep);
331	if (Bs3TestSubErrorCount() != cErrorsBefore)
332	{
333	Bs3TrapPrintFrame(pTrapCtx);
334	#if 1
335	Bs3TestPrintf("Halting: g_uBs3CpuDetected=%#x\n", g_uBs3CpuDetected);
336	Bs3TestPrintf("Halting: bXcpt=%#x uErrCd=%#x\n", bXcpt, uErrCd);
337	ASMHalt();
338	#endif
339	}
340	}
341
342
343	/**
344	* Compares \#GP trap.
345	*/
346	# define bs3CpuBasic2_CompareGpCtx BS3_CMN_NM(bs3CpuBasic2_CompareGpCtx)
347	BS3_DECL_NEAR(void) bs3CpuBasic2_CompareGpCtx(PCBS3TRAPFRAME pTrapCtx, PCBS3REGCTX pStartCtx, uint16_t uErrCd)
348	{
349	bs3CpuBasic2_CompareCpuTrapCtx(pTrapCtx, pStartCtx, uErrCd, X86_XCPT_GP, true /f486ResumeFlagHint/);
350	}
351
352	/**
353	* Compares \#NP trap.
354	*/
355	# define bs3CpuBasic2_CompareNpCtx BS3_CMN_NM(bs3CpuBasic2_CompareNpCtx)
356	BS3_DECL_NEAR(void) bs3CpuBasic2_CompareNpCtx(PCBS3TRAPFRAME pTrapCtx, PCBS3REGCTX pStartCtx, uint16_t uErrCd)
357	{
358	bs3CpuBasic2_CompareCpuTrapCtx(pTrapCtx, pStartCtx, uErrCd, X86_XCPT_NP, true /f486ResumeFlagHint/);
359	}
360
361	/**
362	* Compares \#SS trap.
363	*/
364	# define bs3CpuBasic2_CompareSsCtx BS3_CMN_NM(bs3CpuBasic2_CompareSsCtx)
365	BS3_DECL_NEAR(void) bs3CpuBasic2_CompareSsCtx(PCBS3TRAPFRAME pTrapCtx, PCBS3REGCTX pStartCtx, uint16_t uErrCd, bool f486ResumeFlagHint)
366	{
367	bs3CpuBasic2_CompareCpuTrapCtx(pTrapCtx, pStartCtx, uErrCd, X86_XCPT_SS, f486ResumeFlagHint);
368	}
369
370	/**
371	* Compares \#TS trap.
372	*/
373	# define bs3CpuBasic2_CompareTsCtx BS3_CMN_NM(bs3CpuBasic2_CompareTsCtx)
374	BS3_DECL_NEAR(void) bs3CpuBasic2_CompareTsCtx(PCBS3TRAPFRAME pTrapCtx, PCBS3REGCTX pStartCtx, uint16_t uErrCd)
375	{
376	bs3CpuBasic2_CompareCpuTrapCtx(pTrapCtx, pStartCtx, uErrCd, X86_XCPT_TS, false /f486ResumeFlagHint/);
377	}
378
379	/**
380	* Compares \#PF trap.
381	*/
382	# define bs3CpuBasic2_ComparePfCtx BS3_CMN_NM(bs3CpuBasic2_ComparePfCtx)
383	BS3_DECL_NEAR(void) bs3CpuBasic2_ComparePfCtx(PCBS3TRAPFRAME pTrapCtx, PBS3REGCTX pStartCtx, uint16_t uErrCd, uint64_t uCr2Expected)
384	{
385	uint64_t const uCr2Saved = pStartCtx->cr2.u;
386	pStartCtx->cr2.u = uCr2Expected;
387	bs3CpuBasic2_CompareCpuTrapCtx(pTrapCtx, pStartCtx, uErrCd, X86_XCPT_PF, true /f486ResumeFlagHint/);
388	pStartCtx->cr2.u = uCr2Saved;
389	}
390
391	/**
392	* Compares \#UD trap.
393	*/
394	# define bs3CpuBasic2_CompareUdCtx BS3_CMN_NM(bs3CpuBasic2_CompareUdCtx)
395	BS3_DECL_NEAR(void) bs3CpuBasic2_CompareUdCtx(PCBS3TRAPFRAME pTrapCtx, PCBS3REGCTX pStartCtx)
396	{
397	bs3CpuBasic2_CompareCpuTrapCtx(pTrapCtx, pStartCtx, 0 /no error code/, X86_XCPT_UD, true /f486ResumeFlagHint/);
398	}
399
400
401	# define bs3CpuBasic2_RaiseXcpt1Common BS3_CMN_NM(bs3CpuBasic2_RaiseXcpt1Common)
402	BS3_DECL_NEAR(void) bs3CpuBasic2_RaiseXcpt1Common(uint16_t const uSysR0Cs, uint16_t const uSysR0CsConf, uint16_t const uSysR0Ss,
403	PX86DESC const paIdt, unsigned const cIdteShift)
404	{
405	BS3TRAPFRAME TrapCtx;
406	BS3REGCTX Ctx80;
407	BS3REGCTX Ctx81;
408	BS3REGCTX Ctx82;
409	BS3REGCTX Ctx83;
410	BS3REGCTX CtxTmp;
411	BS3REGCTX CtxTmp2;
412	PBS3REGCTX apCtx8x[4];
413	unsigned iCtx;
414	unsigned iRing;
415	unsigned iDpl;
416	unsigned iRpl;
417	unsigned i, j, k;
418	uint32_t uExpected;
419	bool const f486Plus = (g_uBs3CpuDetected & BS3CPU_TYPE_MASK) >= BS3CPU_80486;
420	# if TMPL_BITS == 16
421	bool const f386Plus = (g_uBs3CpuDetected & BS3CPU_TYPE_MASK) >= BS3CPU_80386;
422	bool const f286 = (g_uBs3CpuDetected & BS3CPU_TYPE_MASK) == BS3CPU_80286;
423	# else
424	bool const f286 = false;
425	bool const f386Plus = true;
426	int rc;
427	uint8_t *pbIdtCopyAlloc;
428	PX86DESC pIdtCopy;
429	const unsigned cbIdte = 1 << (3 + cIdteShift);
430	RTCCUINTXREG uCr0Saved = ASMGetCR0();
431	RTGDTR GdtrSaved;
432	# endif
433	RTIDTR IdtrSaved;
434	RTIDTR Idtr;
435
436	ASMGetIDTR(&IdtrSaved);
437	# if TMPL_BITS != 16
438	ASMGetGDTR(&GdtrSaved);
439	# endif
440
441	/* make sure they're allocated */
442	Bs3MemZero(&TrapCtx, sizeof(TrapCtx));
443	Bs3MemZero(&Ctx80, sizeof(Ctx80));
444	Bs3MemZero(&Ctx81, sizeof(Ctx81));
445	Bs3MemZero(&Ctx82, sizeof(Ctx82));
446	Bs3MemZero(&Ctx83, sizeof(Ctx83));
447	Bs3MemZero(&CtxTmp, sizeof(CtxTmp));
448	Bs3MemZero(&CtxTmp2, sizeof(CtxTmp2));
449
450	/* Context array. */
451	apCtx8x[0] = &Ctx80;
452	apCtx8x[1] = &Ctx81;
453	apCtx8x[2] = &Ctx82;
454	apCtx8x[3] = &Ctx83;
455
456	# if TMPL_BITS != 16
457	/* Allocate memory for playing around with the IDT. */
458	pbIdtCopyAlloc = NULL;
459	if (BS3_MODE_IS_PAGED(g_bTestMode))
460	pbIdtCopyAlloc = Bs3MemAlloc(BS3MEMKIND_FLAT32, 12*_1K);
461	# endif
462
463	/*
464	* IDT entry 80 thru 83 are assigned DPLs according to the number.
465	* (We'll be useing more, but this'll do for now.)
466	*/
467	paIdt[0x80 << cIdteShift].Gate.u2Dpl = 0;
468	paIdt[0x81 << cIdteShift].Gate.u2Dpl = 1;
469	paIdt[0x82 << cIdteShift].Gate.u2Dpl = 2;
470	paIdt[0x83 << cIdteShift].Gate.u2Dpl = 3;
471
472	Bs3RegCtxSave(&Ctx80);
473	Ctx80.rsp.u -= 0x300;
474	Ctx80.rip.u = (uintptr_t)BS3_FP_OFF(&bs3CpuBasic2_Int80);
475	# if TMPL_BITS == 16
476	Ctx80.cs = BS3_MODE_IS_RM_OR_V86(g_bTestMode) ? BS3_SEL_TEXT16 : BS3_SEL_R0_CS16;
477	# elif TMPL_BITS == 32
478	g_uBs3TrapEipHint = Ctx80.rip.u32;
479	# endif
480	Bs3MemCpy(&Ctx81, &Ctx80, sizeof(Ctx80));
481	Ctx81.rip.u = (uintptr_t)BS3_FP_OFF(&bs3CpuBasic2_Int81);
482	Bs3MemCpy(&Ctx82, &Ctx80, sizeof(Ctx80));
483	Ctx82.rip.u = (uintptr_t)BS3_FP_OFF(&bs3CpuBasic2_Int82);
484	Bs3MemCpy(&Ctx83, &Ctx80, sizeof(Ctx80));
485	Ctx83.rip.u = (uintptr_t)BS3_FP_OFF(&bs3CpuBasic2_Int83);
486
487	/*
488	* Check that all the above gates work from ring-0.
489	*/
490	for (iCtx = 0; iCtx < RT_ELEMENTS(apCtx8x); iCtx++)
491	{
492	g_usBs3TestStep = iCtx;
493	# if TMPL_BITS == 32
494	g_uBs3TrapEipHint = apCtx8x[iCtx]->rip.u32;
495	# endif
496	Bs3TrapSetJmpAndRestore(apCtx8x[iCtx], &TrapCtx);
497	bs3CpuBasic2_CompareIntCtx1(&TrapCtx, apCtx8x[iCtx], 0x80+iCtx /bXcpt/);
498	}
499
500	/*
501	* Check that the gate DPL checks works.
502	*/
503	g_usBs3TestStep = 100;
504	for (iRing = 0; iRing <= 3; iRing++)
505	{
506	for (iCtx = 0; iCtx < RT_ELEMENTS(apCtx8x); iCtx++)
507	{
508	Bs3MemCpy(&CtxTmp, apCtx8x[iCtx], sizeof(CtxTmp));
509	Bs3RegCtxConvertToRingX(&CtxTmp, iRing);
510	# if TMPL_BITS == 32
511	g_uBs3TrapEipHint = CtxTmp.rip.u32;
512	# endif
513	Bs3TrapSetJmpAndRestore(&CtxTmp, &TrapCtx);
514	if (iCtx < iRing)
515	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &CtxTmp, ((0x80 + iCtx) << X86_TRAP_ERR_SEL_SHIFT) \| X86_TRAP_ERR_IDT);
516	else
517	bs3CpuBasic2_CompareIntCtx1(&TrapCtx, &CtxTmp, 0x80 + iCtx /bXcpt/);
518	g_usBs3TestStep++;
519	}
520	}
521
522	/*
523	* Modify the gate CS value and run the handler at a different CPL.
524	* Throw RPL variations into the mix (completely ignored) together
525	* with gate presence.
526	* 1. CPL <= GATE.DPL
527	* 2. GATE.P
528	* 3. GATE.CS.DPL <= CPL (non-conforming segments)
529	*/
530	g_usBs3TestStep = 1000;
531	for (i = 0; i <= 3; i++)
532	{
533	for (iRing = 0; iRing <= 3; iRing++)
534	{
535	for (iCtx = 0; iCtx < RT_ELEMENTS(apCtx8x); iCtx++)
536	{
537	# if TMPL_BITS == 32
538	g_uBs3TrapEipHint = apCtx8x[iCtx]->rip.u32;
539	# endif
540	Bs3MemCpy(&CtxTmp, apCtx8x[iCtx], sizeof(CtxTmp));
541	Bs3RegCtxConvertToRingX(&CtxTmp, iRing);
542
543	for (j = 0; j <= 3; j++)
544	{
545	uint16_t const uCs = (uSysR0Cs \| j) + (i << BS3_SEL_RING_SHIFT);
546	for (k = 0; k < 2; k++)
547	{
548	g_usBs3TestStep++;
549	/Bs3TestPrintf("g_usBs3TestStep=%u iCtx=%u iRing=%u i=%u uCs=%04x\n", g_usBs3TestStep, iCtx, iRing, i, uCs);/
550	paIdt[(0x80 + iCtx) << cIdteShift].Gate.u16Sel = uCs;
551	paIdt[(0x80 + iCtx) << cIdteShift].Gate.u1Present = k;
552	Bs3TrapSetJmpAndRestore(&CtxTmp, &TrapCtx);
553	/Bs3TrapPrintFrame(&TrapCtx);/
554	if (iCtx < iRing)
555	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &CtxTmp, ((0x80 + iCtx) << X86_TRAP_ERR_SEL_SHIFT) \| X86_TRAP_ERR_IDT);
556	else if (k == 0)
557	bs3CpuBasic2_CompareNpCtx(&TrapCtx, &CtxTmp, ((0x80 + iCtx) << X86_TRAP_ERR_SEL_SHIFT) \| X86_TRAP_ERR_IDT);
558	else if (i > iRing)
559	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &CtxTmp, uCs & X86_SEL_MASK_OFF_RPL);
560	else
561	{
562	uint16_t uExpectedCs = uCs & X86_SEL_MASK_OFF_RPL;
563	if (i <= iCtx && i <= iRing)
564	uExpectedCs \|= i;
565	bs3CpuBasic2_CompareTrapCtx2(&TrapCtx, &CtxTmp, 2 /int 8xh/, 0x80 + iCtx /bXcpt/, uExpectedCs);
566	}
567	}
568	}
569
570	paIdt[(0x80 + iCtx) << cIdteShift].Gate.u16Sel = uSysR0Cs;
571	paIdt[(0x80 + iCtx) << cIdteShift].Gate.u1Present = 1;
572	}
573	}
574	}
575	BS3_ASSERT(g_usBs3TestStep < 1600);
576
577	/*
578	* Various CS and SS related faults
579	*
580	* We temporarily reconfigure gate 80 and 83 with new CS selectors, the
581	* latter have a CS.DPL of 2 for testing ring transisions and SS loading
582	* without making it impossible to handle faults.
583	*/
584	g_usBs3TestStep = 1600;
585	Bs3GdteTestPage00 = Bs3Gdt[uSysR0Cs >> X86_SEL_SHIFT];
586	Bs3GdteTestPage00.Gen.u1Present = 0;
587	Bs3GdteTestPage00.Gen.u4Type &= ~X86_SEL_TYPE_ACCESSED;
588	paIdt[0x80 << cIdteShift].Gate.u16Sel = BS3_SEL_TEST_PAGE_00;
589
590	/* CS.PRESENT = 0 */
591	Bs3TrapSetJmpAndRestore(&Ctx80, &TrapCtx);
592	bs3CpuBasic2_CompareNpCtx(&TrapCtx, &Ctx80, BS3_SEL_TEST_PAGE_00);
593	if (Bs3GdteTestPage00.Gen.u4Type & X86_SEL_TYPE_ACCESSED)
594	bs3CpuBasic2_FailedF("selector was accessed");
595	g_usBs3TestStep++;
596
597	/* Check that GATE.DPL is checked before CS.PRESENT. */
598	for (iRing = 1; iRing < 4; iRing++)
599	{
600	Bs3MemCpy(&CtxTmp, &Ctx80, sizeof(CtxTmp));
601	Bs3RegCtxConvertToRingX(&CtxTmp, iRing);
602	Bs3TrapSetJmpAndRestore(&CtxTmp, &TrapCtx);
603	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &CtxTmp, (0x80 << X86_TRAP_ERR_SEL_SHIFT) \| X86_TRAP_ERR_IDT);
604	if (Bs3GdteTestPage00.Gen.u4Type & X86_SEL_TYPE_ACCESSED)
605	bs3CpuBasic2_FailedF("selector was accessed");
606	g_usBs3TestStep++;
607	}
608
609	/* CS.DPL mismatch takes precedence over CS.PRESENT = 0. */
610	Bs3GdteTestPage00.Gen.u4Type &= ~X86_SEL_TYPE_ACCESSED;
611	Bs3TrapSetJmpAndRestore(&Ctx80, &TrapCtx);
612	bs3CpuBasic2_CompareNpCtx(&TrapCtx, &Ctx80, BS3_SEL_TEST_PAGE_00);
613	if (Bs3GdteTestPage00.Gen.u4Type & X86_SEL_TYPE_ACCESSED)
614	bs3CpuBasic2_FailedF("CS selector was accessed");
615	g_usBs3TestStep++;
616	for (iDpl = 1; iDpl < 4; iDpl++)
617	{
618	Bs3GdteTestPage00.Gen.u2Dpl = iDpl;
619	Bs3TrapSetJmpAndRestore(&Ctx80, &TrapCtx);
620	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &Ctx80, BS3_SEL_TEST_PAGE_00);
621	if (Bs3GdteTestPage00.Gen.u4Type & X86_SEL_TYPE_ACCESSED)
622	bs3CpuBasic2_FailedF("CS selector was accessed");
623	g_usBs3TestStep++;
624	}
625
626	/* 1608: Check all the invalid CS selector types alone. */
627	Bs3GdteTestPage00 = Bs3Gdt[uSysR0Cs >> X86_SEL_SHIFT];
628	for (i = 0; i < RT_ELEMENTS(g_aInvalidCsTypes); i++)
629	{
630	Bs3GdteTestPage00.Gen.u4Type = g_aInvalidCsTypes[i].u4Type;
631	Bs3GdteTestPage00.Gen.u1DescType = g_aInvalidCsTypes[i].u1DescType;
632	Bs3TrapSetJmpAndRestore(&Ctx80, &TrapCtx);
633	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &Ctx80, BS3_SEL_TEST_PAGE_00);
634	if (Bs3GdteTestPage00.Gen.u4Type != g_aInvalidCsTypes[i].u4Type)
635	bs3CpuBasic2_FailedF("Invalid CS type %#x/%u -> %#x/%u\n",
636	g_aInvalidCsTypes[i].u4Type, g_aInvalidCsTypes[i].u1DescType,
637	Bs3GdteTestPage00.Gen.u4Type, Bs3GdteTestPage00.Gen.u1DescType);
638	g_usBs3TestStep++;
639
640	/* Incorrect CS.TYPE takes precedence over CS.PRESENT = 0. */
641	Bs3GdteTestPage00.Gen.u1Present = 0;
642	Bs3TrapSetJmpAndRestore(&Ctx80, &TrapCtx);
643	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &Ctx80, BS3_SEL_TEST_PAGE_00);
644	Bs3GdteTestPage00.Gen.u1Present = 1;
645	g_usBs3TestStep++;
646	}
647
648	/* Fix CS again. */
649	Bs3GdteTestPage00 = Bs3Gdt[uSysR0Cs >> X86_SEL_SHIFT];
650
651	/* 1632: Test SS. */
652	if (!BS3_MODE_IS_64BIT_SYS(g_bTestMode))
653	{
654	uint16_t BS3_FAR *puTssSs2 = BS3_MODE_IS_16BIT_SYS(g_bTestMode) ? &Bs3Tss16.ss2 : &Bs3Tss32.ss2;
655	uint16_t const uSavedSs2 = *puTssSs2;
656	X86DESC const SavedGate83 = paIdt[0x83 << cIdteShift];
657
658	/* Make the handler execute in ring-2. */
659	Bs3GdteTestPage02 = Bs3Gdt[(uSysR0Cs + (2 << BS3_SEL_RING_SHIFT)) >> X86_SEL_SHIFT];
660	Bs3GdteTestPage02.Gen.u4Type &= ~X86_SEL_TYPE_ACCESSED;
661	paIdt[0x83 << cIdteShift].Gate.u16Sel = BS3_SEL_TEST_PAGE_02 \| 2;
662
663	Bs3MemCpy(&CtxTmp, &Ctx83, sizeof(CtxTmp));
664	Bs3RegCtxConvertToRingX(&CtxTmp, 3); /* yeah, from 3 so SS:xSP is reloaded. */
665	Bs3TrapSetJmpAndRestore(&CtxTmp, &TrapCtx);
666	bs3CpuBasic2_CompareIntCtx1(&TrapCtx, &CtxTmp, 0x83);
667	if (!(Bs3GdteTestPage02.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
668	bs3CpuBasic2_FailedF("CS selector was not access");
669	g_usBs3TestStep++;
670
671	/* Create a SS.DPL=2 stack segment and check that SS2.RPL matters and
672	that we get #SS if the selector isn't present. */
673	i = 0; /* used for cycling thru invalid CS types */
674	for (k = 0; k < 10; k++)
675	{
676	/* k=0: present,
677	k=1: not-present,
678	k=2: present but very low limit,
679	k=3: not-present, low limit.
680	k=4: present, read-only.
681	k=5: not-present, read-only.
682	k=6: present, code-selector.
683	k=7: not-present, code-selector.
684	k=8: present, read-write / no access + system (=LDT).
685	k=9: not-present, read-write / no access + system (=LDT).
686	*/
687	Bs3GdteTestPage03 = Bs3Gdt[(uSysR0Ss + (2 << BS3_SEL_RING_SHIFT)) >> X86_SEL_SHIFT];
688	Bs3GdteTestPage03.Gen.u1Present = !(k & 1);
689	if (k >= 8)
690	{
691	Bs3GdteTestPage03.Gen.u1DescType = 0; /* system */
692	Bs3GdteTestPage03.Gen.u4Type = X86_SEL_TYPE_RW; /* = LDT */
693	}
694	else if (k >= 6)
695	Bs3GdteTestPage03.Gen.u4Type = X86_SEL_TYPE_ER;
696	else if (k >= 4)
697	Bs3GdteTestPage03.Gen.u4Type = X86_SEL_TYPE_RO;
698	else if (k >= 2)
699	{
700	Bs3GdteTestPage03.Gen.u16LimitLow = 0x400;
701	Bs3GdteTestPage03.Gen.u4LimitHigh = 0;
702	Bs3GdteTestPage03.Gen.u1Granularity = 0;
703	}
704
705	for (iDpl = 0; iDpl < 4; iDpl++)
706	{
707	Bs3GdteTestPage03.Gen.u2Dpl = iDpl;
708
709	for (iRpl = 0; iRpl < 4; iRpl++)
710	{
711	*puTssSs2 = BS3_SEL_TEST_PAGE_03 \| iRpl;
712	//Bs3TestPrintf("k=%u iDpl=%u iRpl=%u step=%u\n", k, iDpl, iRpl, g_usBs3TestStep);
713	Bs3GdteTestPage02.Gen.u4Type &= ~X86_SEL_TYPE_ACCESSED;
714	Bs3GdteTestPage03.Gen.u4Type &= ~X86_SEL_TYPE_ACCESSED;
715	Bs3TrapSetJmpAndRestore(&CtxTmp, &TrapCtx);
716	if (iRpl != 2 \|\| iRpl != iDpl \|\| k >= 4)
717	bs3CpuBasic2_CompareTsCtx(&TrapCtx, &CtxTmp, BS3_SEL_TEST_PAGE_03);
718	else if (k != 0)
719	bs3CpuBasic2_CompareSsCtx(&TrapCtx, &CtxTmp, BS3_SEL_TEST_PAGE_03,
720	k == 2 /f486ResumeFlagHint/);
721	else
722	{
723	bs3CpuBasic2_CompareIntCtx1(&TrapCtx, &CtxTmp, 0x83);
724	if (TrapCtx.uHandlerSs != (BS3_SEL_TEST_PAGE_03 \| 2))
725	bs3CpuBasic2_FailedF("uHandlerSs=%#x expected %#x\n", TrapCtx.uHandlerSs, BS3_SEL_TEST_PAGE_03 \| 2);
726	}
727	if (!(Bs3GdteTestPage02.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
728	bs3CpuBasic2_FailedF("CS selector was not access");
729	if ( TrapCtx.bXcpt == 0x83
730	\|\| (TrapCtx.bXcpt == X86_XCPT_SS && k == 2) )
731	{
732	if (!(Bs3GdteTestPage03.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
733	bs3CpuBasic2_FailedF("SS selector was not accessed");
734	}
735	else if (Bs3GdteTestPage03.Gen.u4Type & X86_SEL_TYPE_ACCESSED)
736	bs3CpuBasic2_FailedF("SS selector was accessed");
737	g_usBs3TestStep++;
738
739	/* +1: Modify the gate DPL to check that this is checked before SS.DPL and SS.PRESENT. */
740	paIdt[0x83 << cIdteShift].Gate.u2Dpl = 2;
741	Bs3TrapSetJmpAndRestore(&CtxTmp, &TrapCtx);
742	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &CtxTmp, (0x83 << X86_TRAP_ERR_SEL_SHIFT) \| X86_TRAP_ERR_IDT);
743	paIdt[0x83 << cIdteShift].Gate.u2Dpl = 3;
744	g_usBs3TestStep++;
745
746	/* +2: Check the the CS.DPL check is done before the SS ones. Restoring the
747	ring-0 INT 83 context triggers the CS.DPL < CPL check. */
748	Bs3TrapSetJmpAndRestore(&Ctx83, &TrapCtx);
749	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &Ctx83, BS3_SEL_TEST_PAGE_02);
750	g_usBs3TestStep++;
751
752	/* +3: Now mark the CS selector not present and check that that also triggers before SS stuff. */
753	Bs3GdteTestPage02.Gen.u1Present = 0;
754	Bs3TrapSetJmpAndRestore(&CtxTmp, &TrapCtx);
755	bs3CpuBasic2_CompareNpCtx(&TrapCtx, &CtxTmp, BS3_SEL_TEST_PAGE_02);
756	Bs3GdteTestPage02.Gen.u1Present = 1;
757	g_usBs3TestStep++;
758
759	/* +4: Make the CS selector some invalid type and check it triggers before SS stuff. */
760	Bs3GdteTestPage02.Gen.u4Type = g_aInvalidCsTypes[i].u4Type;
761	Bs3GdteTestPage02.Gen.u1DescType = g_aInvalidCsTypes[i].u1DescType;
762	Bs3TrapSetJmpAndRestore(&CtxTmp, &TrapCtx);
763	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &CtxTmp, BS3_SEL_TEST_PAGE_02);
764	Bs3GdteTestPage02.Gen.u4Type = X86_SEL_TYPE_ER_ACC;
765	Bs3GdteTestPage02.Gen.u1DescType = 1;
766	g_usBs3TestStep++;
767
768	/* +5: Now, make the CS selector limit too small and that it triggers after SS trouble.
769	The 286 had a simpler approach to these GP(0). */
770	Bs3GdteTestPage02.Gen.u16LimitLow = 0;
771	Bs3GdteTestPage02.Gen.u4LimitHigh = 0;
772	Bs3GdteTestPage02.Gen.u1Granularity = 0;
773	Bs3TrapSetJmpAndRestore(&CtxTmp, &TrapCtx);
774	if (f286)
775	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &CtxTmp, 0 /uErrCd/);
776	else if (iRpl != 2 \|\| iRpl != iDpl \|\| k >= 4)
777	bs3CpuBasic2_CompareTsCtx(&TrapCtx, &CtxTmp, BS3_SEL_TEST_PAGE_03);
778	else if (k != 0)
779	bs3CpuBasic2_CompareSsCtx(&TrapCtx, &CtxTmp, BS3_SEL_TEST_PAGE_03, k == 2 /f486ResumeFlagHint/);
780	else
781	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &CtxTmp, 0 /uErrCd/);
782	Bs3GdteTestPage02 = Bs3Gdt[(uSysR0Cs + (2 << BS3_SEL_RING_SHIFT)) >> X86_SEL_SHIFT];
783	g_usBs3TestStep++;
784	}
785	}
786	}
787
788	/* Check all the invalid SS selector types alone. */
789	Bs3GdteTestPage02 = Bs3Gdt[(uSysR0Cs + (2 << BS3_SEL_RING_SHIFT)) >> X86_SEL_SHIFT];
790	Bs3GdteTestPage03 = Bs3Gdt[(uSysR0Ss + (2 << BS3_SEL_RING_SHIFT)) >> X86_SEL_SHIFT];
791	*puTssSs2 = BS3_SEL_TEST_PAGE_03 \| 2;
792	Bs3TrapSetJmpAndRestore(&CtxTmp, &TrapCtx);
793	bs3CpuBasic2_CompareIntCtx1(&TrapCtx, &CtxTmp, 0x83);
794	g_usBs3TestStep++;
795	for (i = 0; i < RT_ELEMENTS(g_aInvalidSsTypes); i++)
796	{
797	Bs3GdteTestPage03.Gen.u4Type = g_aInvalidSsTypes[i].u4Type;
798	Bs3GdteTestPage03.Gen.u1DescType = g_aInvalidSsTypes[i].u1DescType;
799	Bs3TrapSetJmpAndRestore(&CtxTmp, &TrapCtx);
800	bs3CpuBasic2_CompareTsCtx(&TrapCtx, &CtxTmp, BS3_SEL_TEST_PAGE_03);
801	if (Bs3GdteTestPage03.Gen.u4Type != g_aInvalidSsTypes[i].u4Type)
802	bs3CpuBasic2_FailedF("Invalid SS type %#x/%u -> %#x/%u\n",
803	g_aInvalidSsTypes[i].u4Type, g_aInvalidSsTypes[i].u1DescType,
804	Bs3GdteTestPage03.Gen.u4Type, Bs3GdteTestPage03.Gen.u1DescType);
805	g_usBs3TestStep++;
806	}
807
808	/*
809	* Continue the SS experiments with a expand down segment. We'll use
810	* the same setup as we already have with gate 83h being DPL and
811	* having CS.DPL=2.
812	*
813	* Expand down segments are weird. The valid area is practically speaking
814	* reversed. So, a 16-bit segment with a limit of 0x6000 will have valid
815	* addresses from 0xffff thru 0x6001.
816	*
817	* So, with expand down segments we can more easily cut partially into the
818	* pushing of the iret frame and trigger more interesting behavior than
819	* with regular "expand up" segments where the whole pushing area is either
820	* all fine or not not fine.
821	*/
822	Bs3GdteTestPage02 = Bs3Gdt[(uSysR0Cs + (2 << BS3_SEL_RING_SHIFT)) >> X86_SEL_SHIFT];
823	Bs3GdteTestPage03 = Bs3Gdt[(uSysR0Ss + (2 << BS3_SEL_RING_SHIFT)) >> X86_SEL_SHIFT];
824	Bs3GdteTestPage03.Gen.u2Dpl = 2;
825	Bs3GdteTestPage03.Gen.u4Type = X86_SEL_TYPE_RW_DOWN;
826	*puTssSs2 = BS3_SEL_TEST_PAGE_03 \| 2;
827
828	/* First test, limit = max --> no bytes accessible --> #GP */
829	Bs3TrapSetJmpAndRestore(&CtxTmp, &TrapCtx);
830	bs3CpuBasic2_CompareSsCtx(&TrapCtx, &CtxTmp, BS3_SEL_TEST_PAGE_03, true /f486ResumeFlagHint/);
831
832	/* Second test, limit = 0 --> all by zero byte accessible --> works */
833	Bs3GdteTestPage03.Gen.u16LimitLow = 0;
834	Bs3GdteTestPage03.Gen.u4LimitHigh = 0;
835	Bs3TrapSetJmpAndRestore(&CtxTmp, &TrapCtx);
836	bs3CpuBasic2_CompareIntCtx1(&TrapCtx, &CtxTmp, 0x83);
837
838	/* Modify the gate handler to be a dummy that immediately does UD2
839	and triggers #UD, then advance the limit down till we get the #UD. */
840	Bs3GdteTestPage03.Gen.u1Granularity = 0;
841
842	Bs3MemCpy(&CtxTmp2, &CtxTmp, sizeof(CtxTmp2)); /* #UD result context */
843	if (g_f16BitSys)
844	{
845	CtxTmp2.rip.u = g_bs3CpuBasic2_ud2_FlatAddr - BS3_ADDR_BS3TEXT16;
846	Bs3Trap16SetGate(0x83, X86_SEL_TYPE_SYS_286_INT_GATE, 3, BS3_SEL_TEST_PAGE_02, CtxTmp2.rip.u16, 0 /cParams/);
847	CtxTmp2.rsp.u = Bs3Tss16.sp2 - 2*5;
848	}
849	else
850	{
851	CtxTmp2.rip.u = g_bs3CpuBasic2_ud2_FlatAddr;
852	Bs3Trap32SetGate(0x83, X86_SEL_TYPE_SYS_386_INT_GATE, 3, BS3_SEL_TEST_PAGE_02, CtxTmp2.rip.u32, 0 /cParams/);
853	CtxTmp2.rsp.u = Bs3Tss32.esp2 - 4*5;
854	}
855	CtxTmp2.bMode = g_bTestMode; /* g_bBs3CurrentMode not changed by the UD2 handler. */
856	CtxTmp2.cs = BS3_SEL_TEST_PAGE_02 \| 2;
857	CtxTmp2.ss = BS3_SEL_TEST_PAGE_03 \| 2;
858	CtxTmp2.bCpl = 2;
859
860	/* test run. */
861	Bs3TrapSetJmpAndRestore(&CtxTmp, &TrapCtx);
862	bs3CpuBasic2_CompareUdCtx(&TrapCtx, &CtxTmp2);
863	g_usBs3TestStep++;
864
865	/* Real run. */
866	i = (g_f16BitSys ? 2 : 4) * 6 + 1;
867	while (i-- > 0)
868	{
869	Bs3GdteTestPage03.Gen.u16LimitLow = CtxTmp2.rsp.u16 + i - 1;
870	Bs3TrapSetJmpAndRestore(&CtxTmp, &TrapCtx);
871	if (i > 0)
872	bs3CpuBasic2_CompareSsCtx(&TrapCtx, &CtxTmp, BS3_SEL_TEST_PAGE_03, true /f486ResumeFlagHint/);
873	else
874	bs3CpuBasic2_CompareUdCtx(&TrapCtx, &CtxTmp2);
875	g_usBs3TestStep++;
876	}
877
878	/* Do a run where we do the same-ring kind of access. */
879	Bs3RegCtxConvertToRingX(&CtxTmp, 2);
880	if (g_f16BitSys)
881	{
882	CtxTmp2.rsp.u32 = CtxTmp.rsp.u32 - 2*3;
883	i = 2*3 - 1;
884	}
885	else
886	{
887	CtxTmp2.rsp.u32 = CtxTmp.rsp.u32 - 4*3;
888	i = 4*3 - 1;
889	}
890	CtxTmp.ss = BS3_SEL_TEST_PAGE_03 \| 2;
891	CtxTmp2.ds = CtxTmp.ds;
892	CtxTmp2.es = CtxTmp.es;
893	CtxTmp2.fs = CtxTmp.fs;
894	CtxTmp2.gs = CtxTmp.gs;
895	while (i-- > 0)
896	{
897	Bs3GdteTestPage03.Gen.u16LimitLow = CtxTmp2.rsp.u16 + i - 1;
898	Bs3TrapSetJmpAndRestore(&CtxTmp, &TrapCtx);
899	if (i > 0)
900	bs3CpuBasic2_CompareSsCtx(&TrapCtx, &CtxTmp, 0 /BS3_SEL_TEST_PAGE_03/, true /f486ResumeFlagHint/);
901	else
902	bs3CpuBasic2_CompareUdCtx(&TrapCtx, &CtxTmp2);
903	g_usBs3TestStep++;
904	}
905
906	*puTssSs2 = uSavedSs2;
907	paIdt[0x83 << cIdteShift] = SavedGate83;
908	}
909	paIdt[0x80 << cIdteShift].Gate.u16Sel = uSysR0Cs;
910	BS3_ASSERT(g_usBs3TestStep < 3000);
911
912	/*
913	* Modify the gate CS value with a conforming segment.
914	*/
915	g_usBs3TestStep = 3000;
916	for (i = 0; i <= 3; i++) /* cs.dpl */
917	{
918	for (iRing = 0; iRing <= 3; iRing++)
919	{
920	for (iCtx = 0; iCtx < RT_ELEMENTS(apCtx8x); iCtx++)
921	{
922	Bs3MemCpy(&CtxTmp, apCtx8x[iCtx], sizeof(CtxTmp));
923	Bs3RegCtxConvertToRingX(&CtxTmp, iRing);
924	# if TMPL_BITS == 32
925	g_uBs3TrapEipHint = CtxTmp.rip.u32;
926	# endif
927
928	for (j = 0; j <= 3; j++) /* rpl */
929	{
930	uint16_t const uCs = (uSysR0CsConf \| j) + (i << BS3_SEL_RING_SHIFT);
931	/Bs3TestPrintf("g_usBs3TestStep=%u iCtx=%u iRing=%u i=%u uCs=%04x\n", g_usBs3TestStep, iCtx, iRing, i, uCs);/
932	paIdt[(0x80 + iCtx) << cIdteShift].Gate.u16Sel = uCs;
933	Bs3TrapSetJmpAndRestore(&CtxTmp, &TrapCtx);
934	//Bs3TestPrintf("%u/%u/%u/%u: cs=%04x hcs=%04x xcpt=%02x\n", i, iRing, iCtx, j, uCs, TrapCtx.uHandlerCs, TrapCtx.bXcpt);
935	/Bs3TrapPrintFrame(&TrapCtx);/
936	g_usBs3TestStep++;
937	if (iCtx < iRing)
938	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &CtxTmp, ((0x80 + iCtx) << X86_TRAP_ERR_SEL_SHIFT) \| X86_TRAP_ERR_IDT);
939	else if (i > iRing)
940	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &CtxTmp, uCs & X86_SEL_MASK_OFF_RPL);
941	else
942	bs3CpuBasic2_CompareIntCtx1(&TrapCtx, &CtxTmp, 0x80 + iCtx /bXcpt/);
943	}
944	paIdt[(0x80 + iCtx) << cIdteShift].Gate.u16Sel = uSysR0Cs;
945	}
946	}
947	}
948	BS3_ASSERT(g_usBs3TestStep < 3500);
949
950	/*
951	* The gates must be 64-bit in long mode.
952	*/
953	if (cIdteShift != 0)
954	{
955	g_usBs3TestStep = 3500;
956	for (i = 0; i <= 3; i++)
957	{
958	for (iRing = 0; iRing <= 3; iRing++)
959	{
960	for (iCtx = 0; iCtx < RT_ELEMENTS(apCtx8x); iCtx++)
961	{
962	Bs3MemCpy(&CtxTmp, apCtx8x[iCtx], sizeof(CtxTmp));
963	Bs3RegCtxConvertToRingX(&CtxTmp, iRing);
964
965	for (j = 0; j < 2; j++)
966	{
967	static const uint16_t s_auCSes[2] = { BS3_SEL_R0_CS16, BS3_SEL_R0_CS32 };
968	uint16_t uCs = (s_auCSes[j] \| i) + (i << BS3_SEL_RING_SHIFT);
969	g_usBs3TestStep++;
970	/Bs3TestPrintf("g_usBs3TestStep=%u iCtx=%u iRing=%u i=%u uCs=%04x\n", g_usBs3TestStep, iCtx, iRing, i, uCs);/
971	paIdt[(0x80 + iCtx) << cIdteShift].Gate.u16Sel = uCs;
972	Bs3TrapSetJmpAndRestore(&CtxTmp, &TrapCtx);
973	/Bs3TrapPrintFrame(&TrapCtx);/
974	if (iCtx < iRing)
975	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &CtxTmp, ((0x80 + iCtx) << X86_TRAP_ERR_SEL_SHIFT) \| X86_TRAP_ERR_IDT);
976	else
977	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &CtxTmp, uCs & X86_SEL_MASK_OFF_RPL);
978	}
979	paIdt[(0x80 + iCtx) << cIdteShift].Gate.u16Sel = uSysR0Cs;
980	}
981	}
982	}
983	BS3_ASSERT(g_usBs3TestStep < 4000);
984	}
985
986	/*
987	* IDT limit check. The 286 does not access X86DESCGATE::u16OffsetHigh.
988	*/
989	g_usBs3TestStep = 5000;
990	i = (0x80 << (cIdteShift + 3)) - 1;
991	j = (0x82 << (cIdteShift + 3)) - (!f286 ? 1 : 3);
992	k = (0x83 << (cIdteShift + 3)) - 1;
993	for (; i <= k; i++, g_usBs3TestStep++)
994	{
995	Idtr = IdtrSaved;
996	Idtr.cbIdt = i;
997	ASMSetIDTR(&Idtr);
998	Bs3TrapSetJmpAndRestore(&Ctx81, &TrapCtx);
999	if (i < j)
1000	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &Ctx81, (0x81 << X86_TRAP_ERR_SEL_SHIFT) \| X86_TRAP_ERR_IDT);
1001	else
1002	bs3CpuBasic2_CompareIntCtx1(&TrapCtx, &Ctx81, 0x81 /bXcpt/);
1003	}
1004	ASMSetIDTR(&IdtrSaved);
1005	BS3_ASSERT(g_usBs3TestStep < 5100);
1006
1007	# if TMPL_BITS != 16 /* Only do the paging related stuff in 32-bit and 64-bit modes. */
1008
1009	/*
1010	* IDT page not present. Placing the IDT copy such that 0x80 is on the
1011	* first page and 0x81 is on the second page. We need proceed to move
1012	* it down byte by byte to check that any inaccessible byte means #PF.
1013	*
1014	* Note! We must reload the alternative IDTR for each run as any kind of
1015	* printing to the string (like error reporting) will cause a switch
1016	* to real mode and back, reloading the default IDTR.
1017	*/
1018	g_usBs3TestStep = 5200;
1019	if (BS3_MODE_IS_PAGED(g_bTestMode) && pbIdtCopyAlloc)
1020	{
1021	uint32_t const uCr2Expected = Bs3SelPtrToFlat(pbIdtCopyAlloc) + _4K;
1022	for (j = 0; j < cbIdte; j++)
1023	{
1024	pIdtCopy = (PX86DESC)&pbIdtCopyAlloc[_4K - cbIdte * 0x81 - j];
1025	Bs3MemCpy(pIdtCopy, paIdt, cbIdte * 256);
1026
1027	Idtr.cbIdt = IdtrSaved.cbIdt;
1028	Idtr.pIdt = Bs3SelPtrToFlat(pIdtCopy);
1029
1030	ASMSetIDTR(&Idtr);
1031	Bs3TrapSetJmpAndRestore(&Ctx81, &TrapCtx);
1032	bs3CpuBasic2_CompareIntCtx1(&TrapCtx, &Ctx81, 0x81 /bXcpt/);
1033	g_usBs3TestStep++;
1034
1035	ASMSetIDTR(&Idtr);
1036	Bs3TrapSetJmpAndRestore(&Ctx80, &TrapCtx);
1037	bs3CpuBasic2_CompareIntCtx1(&TrapCtx, &Ctx80, 0x80 /bXcpt/);
1038	g_usBs3TestStep++;
1039
1040	rc = Bs3PagingProtect(uCr2Expected, _4K, 0 /fSet/, X86_PTE_P /fClear/);
1041	if (RT_SUCCESS(rc))
1042	{
1043	ASMSetIDTR(&Idtr);
1044	Bs3TrapSetJmpAndRestore(&Ctx80, &TrapCtx);
1045	bs3CpuBasic2_CompareIntCtx1(&TrapCtx, &Ctx80, 0x80 /bXcpt/);
1046	g_usBs3TestStep++;
1047
1048	ASMSetIDTR(&Idtr);
1049	Bs3TrapSetJmpAndRestore(&Ctx81, &TrapCtx);
1050	if (f486Plus)
1051	bs3CpuBasic2_ComparePfCtx(&TrapCtx, &Ctx81, 0 /uErrCd/, uCr2Expected);
1052	else
1053	bs3CpuBasic2_ComparePfCtx(&TrapCtx, &Ctx81, X86_TRAP_PF_RW /uErrCd/, uCr2Expected + 4 - RT_MIN(j, 4));
1054	g_usBs3TestStep++;
1055
1056	Bs3PagingProtect(uCr2Expected, _4K, X86_PTE_P /fSet/, 0 /fClear/);
1057
1058	/* Check if that the entry type is checked after the whole IDTE has been cleared for #PF. */
1059	pIdtCopy[0x80 << cIdteShift].Gate.u4Type = 0;
1060	rc = Bs3PagingProtect(uCr2Expected, _4K, 0 /fSet/, X86_PTE_P /fClear/);
1061	if (RT_SUCCESS(rc))
1062	{
1063	ASMSetIDTR(&Idtr);
1064	Bs3TrapSetJmpAndRestore(&Ctx81, &TrapCtx);
1065	if (f486Plus)
1066	bs3CpuBasic2_ComparePfCtx(&TrapCtx, &Ctx81, 0 /uErrCd/, uCr2Expected);
1067	else
1068	bs3CpuBasic2_ComparePfCtx(&TrapCtx, &Ctx81, X86_TRAP_PF_RW /uErrCd/, uCr2Expected + 4 - RT_MIN(j, 4));
1069	g_usBs3TestStep++;
1070
1071	Bs3PagingProtect(uCr2Expected, _4K, X86_PTE_P /fSet/, 0 /fClear/);
1072	}
1073	}
1074	else
1075	Bs3TestPrintf("Bs3PagingProtectPtr: %d\n", i);
1076
1077	ASMSetIDTR(&IdtrSaved);
1078	}
1079	}
1080
1081	/*
1082	* The read/write and user/supervisor bits the IDT PTEs are irrelevant.
1083	*/
1084	g_usBs3TestStep = 5300;
1085	if (BS3_MODE_IS_PAGED(g_bTestMode) && pbIdtCopyAlloc)
1086	{
1087	Bs3MemCpy(pbIdtCopyAlloc, paIdt, cbIdte * 256);
1088	Idtr.cbIdt = IdtrSaved.cbIdt;
1089	Idtr.pIdt = Bs3SelPtrToFlat(pbIdtCopyAlloc);
1090
1091	ASMSetIDTR(&Idtr);
1092	Bs3TrapSetJmpAndRestore(&Ctx81, &TrapCtx);
1093	bs3CpuBasic2_CompareIntCtx1(&TrapCtx, &Ctx81, 0x81 /bXcpt/);
1094	g_usBs3TestStep++;
1095
1096	rc = Bs3PagingProtect(Idtr.pIdt, _4K, 0 /fSet/, X86_PTE_RW \| X86_PTE_US /fClear/);
1097	if (RT_SUCCESS(rc))
1098	{
1099	ASMSetIDTR(&Idtr);
1100	Bs3TrapSetJmpAndRestore(&Ctx81, &TrapCtx);
1101	bs3CpuBasic2_CompareIntCtx1(&TrapCtx, &Ctx81, 0x81 /bXcpt/);
1102	g_usBs3TestStep++;
1103
1104	Bs3PagingProtect(Idtr.pIdt, _4K, X86_PTE_RW \| X86_PTE_US /fSet/, 0 /fClear/);
1105	}
1106	ASMSetIDTR(&IdtrSaved);
1107	}
1108
1109	/*
1110	* Check that CS.u1Accessed is set to 1. Use the test page selector #0 and #3 together
1111	* with interrupt gates 80h and 83h, respectively.
1112	*/
1113	/** @todo Throw in SS.u1Accessed too. */
1114	g_usBs3TestStep = 5400;
1115	if (BS3_MODE_IS_PAGED(g_bTestMode) && pbIdtCopyAlloc)
1116	{
1117	Bs3GdteTestPage00 = Bs3Gdt[uSysR0Cs >> X86_SEL_SHIFT];
1118	Bs3GdteTestPage00.Gen.u4Type &= ~X86_SEL_TYPE_ACCESSED;
1119	paIdt[0x80 << cIdteShift].Gate.u16Sel = BS3_SEL_TEST_PAGE_00;
1120
1121	Bs3GdteTestPage03 = Bs3Gdt[(uSysR0Cs + (3 << BS3_SEL_RING_SHIFT)) >> X86_SEL_SHIFT];
1122	Bs3GdteTestPage03.Gen.u4Type &= ~X86_SEL_TYPE_ACCESSED;
1123	paIdt[0x83 << cIdteShift].Gate.u16Sel = BS3_SEL_TEST_PAGE_03; /* rpl is ignored, so leave it as zero. */
1124
1125	/* Check that the CS.A bit is being set on a general basis and that
1126	the special CS values work with out generic handler code. */
1127	Bs3TrapSetJmpAndRestore(&Ctx80, &TrapCtx);
1128	bs3CpuBasic2_CompareIntCtx1(&TrapCtx, &Ctx80, 0x80 /bXcpt/);
1129	if (!(Bs3GdteTestPage00.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
1130	bs3CpuBasic2_FailedF("u4Type=%#x, not accessed", Bs3GdteTestPage00.Gen.u4Type);
1131	g_usBs3TestStep++;
1132
1133	Bs3MemCpy(&CtxTmp, &Ctx83, sizeof(CtxTmp));
1134	Bs3RegCtxConvertToRingX(&CtxTmp, 3);
1135	Bs3TrapSetJmpAndRestore(&CtxTmp, &TrapCtx);
1136	bs3CpuBasic2_CompareIntCtx1(&TrapCtx, &CtxTmp, 0x83 /bXcpt/);
1137	if (!(Bs3GdteTestPage03.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
1138	bs3CpuBasic2_FailedF("u4Type=%#x, not accessed!", Bs3GdteTestPage00.Gen.u4Type);
1139	if (TrapCtx.uHandlerCs != (BS3_SEL_TEST_PAGE_03 \| 3))
1140	bs3CpuBasic2_FailedF("uHandlerCs=%#x, expected %#x", TrapCtx.uHandlerCs, (BS3_SEL_TEST_PAGE_03 \| 3));
1141	g_usBs3TestStep++;
1142
1143	/*
1144	* Now check that setting CS.u1Access to 1 does __NOT__ trigger a page
1145	* fault due to the RW bit being zero.
1146	* (We check both with with and without the WP bit if 80486.)
1147	*/
1148	if ((g_uBs3CpuDetected & BS3CPU_TYPE_MASK) >= BS3CPU_80486)
1149	ASMSetCR0(uCr0Saved \| X86_CR0_WP);
1150
1151	Bs3GdteTestPage00.Gen.u4Type &= ~X86_SEL_TYPE_ACCESSED;
1152	Bs3GdteTestPage03.Gen.u4Type &= ~X86_SEL_TYPE_ACCESSED;
1153	rc = Bs3PagingProtect(GdtrSaved.pGdt + BS3_SEL_TEST_PAGE_00, 8, 0 /fSet/, X86_PTE_RW /fClear/);
1154	if (RT_SUCCESS(rc))
1155	{
1156	/* ring-0 handler */
1157	Bs3TrapSetJmpAndRestore(&Ctx80, &TrapCtx);
1158	bs3CpuBasic2_CompareIntCtx1(&TrapCtx, &Ctx80, 0x80 /bXcpt/);
1159	if (!(Bs3GdteTestPage00.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
1160	bs3CpuBasic2_FailedF("u4Type=%#x, not accessed!", Bs3GdteTestPage00.Gen.u4Type);
1161	g_usBs3TestStep++;
1162
1163	/* ring-3 handler */
1164	Bs3MemCpy(&CtxTmp, &Ctx83, sizeof(CtxTmp));
1165	Bs3RegCtxConvertToRingX(&CtxTmp, 3);
1166	Bs3TrapSetJmpAndRestore(&CtxTmp, &TrapCtx);
1167	bs3CpuBasic2_CompareIntCtx1(&TrapCtx, &CtxTmp, 0x83 /bXcpt/);
1168	if (!(Bs3GdteTestPage03.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
1169	bs3CpuBasic2_FailedF("u4Type=%#x, not accessed!", Bs3GdteTestPage00.Gen.u4Type);
1170	g_usBs3TestStep++;
1171
1172	/* clear WP and repeat the above. */
1173	if ((g_uBs3CpuDetected & BS3CPU_TYPE_MASK) >= BS3CPU_80486)
1174	ASMSetCR0(uCr0Saved & ~X86_CR0_WP);
1175	Bs3GdteTestPage00.Gen.u4Type &= ~X86_SEL_TYPE_ACCESSED; /* (No need to RW the page - ring-0, WP=0.) */
1176	Bs3GdteTestPage03.Gen.u4Type &= ~X86_SEL_TYPE_ACCESSED; /* (No need to RW the page - ring-0, WP=0.) */
1177
1178	Bs3TrapSetJmpAndRestore(&Ctx80, &TrapCtx);
1179	bs3CpuBasic2_CompareIntCtx1(&TrapCtx, &Ctx80, 0x80 /bXcpt/);
1180	if (!(Bs3GdteTestPage00.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
1181	bs3CpuBasic2_FailedF("u4Type=%#x, not accessed!", Bs3GdteTestPage00.Gen.u4Type);
1182	g_usBs3TestStep++;
1183
1184	Bs3TrapSetJmpAndRestore(&CtxTmp, &TrapCtx);
1185	bs3CpuBasic2_CompareIntCtx1(&TrapCtx, &CtxTmp, 0x83 /bXcpt/);
1186	if (!(Bs3GdteTestPage03.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
1187	bs3CpuBasic2_FailedF("u4Type=%#x, not accessed!n", Bs3GdteTestPage03.Gen.u4Type);
1188	g_usBs3TestStep++;
1189
1190	Bs3PagingProtect(GdtrSaved.pGdt + BS3_SEL_TEST_PAGE_00, 8, X86_PTE_RW /fSet/, 0 /fClear/);
1191	}
1192
1193	ASMSetCR0(uCr0Saved);
1194
1195	/*
1196	* While we're here, check that if the CS GDT entry is a non-present
1197	* page we do get a #PF with the rigth error code and CR2.
1198	*/
1199	Bs3GdteTestPage00.Gen.u4Type &= ~X86_SEL_TYPE_ACCESSED; /* Just for fun, really a pointless gesture. */
1200	Bs3GdteTestPage03.Gen.u4Type &= ~X86_SEL_TYPE_ACCESSED;
1201	rc = Bs3PagingProtect(GdtrSaved.pGdt + BS3_SEL_TEST_PAGE_00, 8, 0 /fSet/, X86_PTE_P /fClear/);
1202	if (RT_SUCCESS(rc))
1203	{
1204	Bs3TrapSetJmpAndRestore(&Ctx80, &TrapCtx);
1205	if (f486Plus)
1206	bs3CpuBasic2_ComparePfCtx(&TrapCtx, &Ctx80, 0 /uErrCd/, GdtrSaved.pGdt + BS3_SEL_TEST_PAGE_00);
1207	else
1208	bs3CpuBasic2_ComparePfCtx(&TrapCtx, &Ctx80, X86_TRAP_PF_RW, GdtrSaved.pGdt + BS3_SEL_TEST_PAGE_00 + 4);
1209	g_usBs3TestStep++;
1210
1211	/* Do it from ring-3 to check ErrCd, which doesn't set X86_TRAP_PF_US it turns out. */
1212	Bs3MemCpy(&CtxTmp, &Ctx83, sizeof(CtxTmp));
1213	Bs3RegCtxConvertToRingX(&CtxTmp, 3);
1214	Bs3TrapSetJmpAndRestore(&CtxTmp, &TrapCtx);
1215
1216	if (f486Plus)
1217	bs3CpuBasic2_ComparePfCtx(&TrapCtx, &CtxTmp, 0 /uErrCd/, GdtrSaved.pGdt + BS3_SEL_TEST_PAGE_03);
1218	else
1219	bs3CpuBasic2_ComparePfCtx(&TrapCtx, &CtxTmp, X86_TRAP_PF_RW, GdtrSaved.pGdt + BS3_SEL_TEST_PAGE_03 + 4);
1220	g_usBs3TestStep++;
1221
1222	Bs3PagingProtect(GdtrSaved.pGdt + BS3_SEL_TEST_PAGE_00, 8, X86_PTE_P /fSet/, 0 /fClear/);
1223	if (Bs3GdteTestPage00.Gen.u4Type & X86_SEL_TYPE_ACCESSED)
1224	bs3CpuBasic2_FailedF("u4Type=%#x, accessed! #1", Bs3GdteTestPage00.Gen.u4Type);
1225	if (Bs3GdteTestPage03.Gen.u4Type & X86_SEL_TYPE_ACCESSED)
1226	bs3CpuBasic2_FailedF("u4Type=%#x, accessed! #2", Bs3GdteTestPage03.Gen.u4Type);
1227	}
1228
1229	/* restore */
1230	paIdt[0x80 << cIdteShift].Gate.u16Sel = uSysR0Cs;
1231	paIdt[0x83 << cIdteShift].Gate.u16Sel = uSysR0Cs;// + (3 << BS3_SEL_RING_SHIFT) + 3;
1232	}
1233
1234	# endif /* 32 \|\| 64*/
1235
1236	/*
1237	* Check broad EFLAGS effects.
1238	*/
1239	g_usBs3TestStep = 5600;
1240	for (iCtx = 0; iCtx < RT_ELEMENTS(apCtx8x); iCtx++)
1241	{
1242	for (iRing = 0; iRing < 4; iRing++)
1243	{
1244	Bs3MemCpy(&CtxTmp, apCtx8x[iCtx], sizeof(CtxTmp));
1245	Bs3RegCtxConvertToRingX(&CtxTmp, iRing);
1246
1247	/* all set */
1248	CtxTmp.rflags.u32 &= X86_EFL_VM \| X86_EFL_1;
1249	CtxTmp.rflags.u32 \|= X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF /* \| X86_EFL_TF / /\| X86_EFL_IF*/
1250	\| X86_EFL_DF \| X86_EFL_OF \| X86_EFL_IOPL /* \| X86_EFL_NT*/;
1251	if (f486Plus)
1252	CtxTmp.rflags.u32 \|= X86_EFL_AC;
1253	if (f486Plus && !g_f16BitSys)
1254	CtxTmp.rflags.u32 \|= X86_EFL_RF;
1255	if (g_uBs3CpuDetected & BS3CPU_F_CPUID)
1256	CtxTmp.rflags.u32 \|= X86_EFL_VIF \| X86_EFL_VIP;
1257	Bs3TrapSetJmpAndRestore(&CtxTmp, &TrapCtx);
1258	CtxTmp.rflags.u32 &= ~X86_EFL_RF;
1259
1260	if (iCtx >= iRing)
1261	bs3CpuBasic2_CompareIntCtx1(&TrapCtx, &CtxTmp, 0x80 + iCtx /bXcpt/);
1262	else
1263	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &CtxTmp, ((0x80 + iCtx) << X86_TRAP_ERR_SEL_SHIFT) \| X86_TRAP_ERR_IDT);
1264	uExpected = CtxTmp.rflags.u32
1265	& ( X86_EFL_1 \| X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_DF
1266	\| X86_EFL_OF \| X86_EFL_IOPL \| X86_EFL_NT \| X86_EFL_VM \| X86_EFL_AC \| X86_EFL_VIF \| X86_EFL_VIP
1267	\| X86_EFL_ID /\| X86_EFL_TF/ /\| X86_EFL_IF/ /\| X86_EFL_RF/ );
1268	if (TrapCtx.fHandlerRfl != uExpected)
1269	bs3CpuBasic2_FailedF("unexpected handler rflags value: %RX64 expected %RX32; CtxTmp.rflags=%RX64 Ctx.rflags=%RX64\n",
1270	TrapCtx.fHandlerRfl, uExpected, CtxTmp.rflags.u, TrapCtx.Ctx.rflags.u);
1271	g_usBs3TestStep++;
1272
1273	/* all cleared */
1274	if ((g_uBs3CpuDetected & BS3CPU_TYPE_MASK) < BS3CPU_80286)
1275	CtxTmp.rflags.u32 = apCtx8x[iCtx]->rflags.u32 & (X86_EFL_RA1_MASK \| UINT16_C(0xf000));
1276	else
1277	CtxTmp.rflags.u32 = apCtx8x[iCtx]->rflags.u32 & (X86_EFL_VM \| X86_EFL_RA1_MASK);
1278	Bs3TrapSetJmpAndRestore(&CtxTmp, &TrapCtx);
1279	if (iCtx >= iRing)
1280	bs3CpuBasic2_CompareIntCtx1(&TrapCtx, &CtxTmp, 0x80 + iCtx /bXcpt/);
1281	else
1282	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &CtxTmp, ((0x80 + iCtx) << X86_TRAP_ERR_SEL_SHIFT) \| X86_TRAP_ERR_IDT);
1283	uExpected = CtxTmp.rflags.u32;
1284	if (TrapCtx.fHandlerRfl != uExpected)
1285	bs3CpuBasic2_FailedF("unexpected handler rflags value: %RX64 expected %RX32; CtxTmp.rflags=%RX64 Ctx.rflags=%RX64\n",
1286	TrapCtx.fHandlerRfl, uExpected, CtxTmp.rflags.u, TrapCtx.Ctx.rflags.u);
1287	g_usBs3TestStep++;
1288	}
1289	}
1290
1291	/** @todo CS.LIMIT / canonical(CS) */
1292
1293
1294	/*
1295	* Check invalid gate types.
1296	*/
1297	g_usBs3TestStep = 32000;
1298	for (iRing = 0; iRing <= 3; iRing++)
1299	{
1300	static const uint16_t s_auCSes[] = { BS3_SEL_R0_CS16, BS3_SEL_R0_CS32, BS3_SEL_R0_CS64,
1301	BS3_SEL_TSS16, BS3_SEL_TSS32, BS3_SEL_TSS64, 0, BS3_SEL_SPARE_1f };
1302	static uint16_t const s_auInvlTypes64[] = { 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 13,
1303	0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17,
1304	0x18, 0x19, 0x1a, 0x1b, 0x1c, 0x1d, 0x1e, 0x1f };
1305	static uint16_t const s_auInvlTypes32[] = { 0, 1, 2, 3, 8, 9, 10, 11, 13,
1306	0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17,
1307	0x18, 0x19, 0x1a, 0x1b, 0x1c, 0x1d, 0x1e, 0x1f,
1308	/286:/ 12, 14, 15 };
1309	uint16_t const * const pauInvTypes = cIdteShift != 0 ? s_auInvlTypes64 : s_auInvlTypes32;
1310	uint16_t const cInvTypes = cIdteShift != 0 ? RT_ELEMENTS(s_auInvlTypes64)
1311	: f386Plus ? RT_ELEMENTS(s_auInvlTypes32) - 3 : RT_ELEMENTS(s_auInvlTypes32);
1312
1313
1314	for (iCtx = 0; iCtx < RT_ELEMENTS(apCtx8x); iCtx++)
1315	{
1316	unsigned iType;
1317
1318	Bs3MemCpy(&CtxTmp, apCtx8x[iCtx], sizeof(CtxTmp));
1319	Bs3RegCtxConvertToRingX(&CtxTmp, iRing);
1320	# if TMPL_BITS == 32
1321	g_uBs3TrapEipHint = CtxTmp.rip.u32;
1322	# endif
1323	for (iType = 0; iType < cInvTypes; iType++)
1324	{
1325	uint8_t const bSavedType = paIdt[(0x80 + iCtx) << cIdteShift].Gate.u4Type;
1326	paIdt[(0x80 + iCtx) << cIdteShift].Gate.u1DescType = pauInvTypes[iType] >> 4;
1327	paIdt[(0x80 + iCtx) << cIdteShift].Gate.u4Type = pauInvTypes[iType] & 0xf;
1328
1329	for (i = 0; i < 4; i++)
1330	{
1331	for (j = 0; j < RT_ELEMENTS(s_auCSes); j++)
1332	{
1333	uint16_t uCs = (unsigned)(s_auCSes[j] - BS3_SEL_R0_FIRST) < (unsigned)(4 << BS3_SEL_RING_SHIFT)
1334	? (s_auCSes[j] \| i) + (i << BS3_SEL_RING_SHIFT)
1335	: s_auCSes[j] \| i;
1336	/Bs3TestPrintf("g_usBs3TestStep=%u iCtx=%u iRing=%u i=%u uCs=%04x type=%#x\n", g_usBs3TestStep, iCtx, iRing, i, uCs, pauInvTypes[iType]);/
1337	paIdt[(0x80 + iCtx) << cIdteShift].Gate.u16Sel = uCs;
1338	Bs3TrapSetJmpAndRestore(&CtxTmp, &TrapCtx);
1339	g_usBs3TestStep++;
1340	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &CtxTmp, ((0x80 + iCtx) << X86_TRAP_ERR_SEL_SHIFT) \| X86_TRAP_ERR_IDT);
1341
1342	/* Mark it not-present to check that invalid type takes precedence. */
1343	paIdt[(0x80 + iCtx) << cIdteShift].Gate.u1Present = 0;
1344	Bs3TrapSetJmpAndRestore(&CtxTmp, &TrapCtx);
1345	g_usBs3TestStep++;
1346	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &CtxTmp, ((0x80 + iCtx) << X86_TRAP_ERR_SEL_SHIFT) \| X86_TRAP_ERR_IDT);
1347	paIdt[(0x80 + iCtx) << cIdteShift].Gate.u1Present = 1;
1348	}
1349	}
1350
1351	paIdt[(0x80 + iCtx) << cIdteShift].Gate.u16Sel = uSysR0Cs;
1352	paIdt[(0x80 + iCtx) << cIdteShift].Gate.u4Type = bSavedType;
1353	paIdt[(0x80 + iCtx) << cIdteShift].Gate.u1DescType = 0;
1354	paIdt[(0x80 + iCtx) << cIdteShift].Gate.u1Present = 1;
1355	}
1356	}
1357	}
1358	BS3_ASSERT(g_usBs3TestStep < 62000U && g_usBs3TestStep > 32000U);
1359
1360
1361	/** @todo
1362	* - Run \#PF and \#GP (and others?) at CPLs other than zero.
1363	* - Quickly generate all faults.
1364	* - All the peculiarities v8086.
1365	*/
1366
1367	# if TMPL_BITS != 16
1368	Bs3MemFree(pbIdtCopyAlloc, 12*_1K);
1369	# endif
1370	}
1371
1372
1373	/**
1374	* Executes one round of SIDT and SGDT tests using one assembly worker.
1375	*
1376	* This is written with driving everything from the 16-bit or 32-bit worker in
1377	* mind, i.e. not assuming the test bitcount is the same as the current.
1378	*/
1379	# define bs3CpuBasic2_sidt_sgdt_One BS3_CMN_NM(bs3CpuBasic2_sidt_sgdt_One)
1380	BS3_DECL_NEAR(void) bs3CpuBasic2_sidt_sgdt_One(BS3CB2SIDTSGDT const BS3_FAR *pWorker, uint8_t bTestMode, uint8_t bRing,
1381	uint8_t const *pabExpected)
1382	{
1383	BS3TRAPFRAME TrapCtx;
1384	BS3REGCTX Ctx;
1385	BS3REGCTX CtxUdExpected;
1386	BS3REGCTX TmpCtx;
1387	uint8_t const cbBuf = 82; / test buffer area */
1388	uint8_t abBuf[82 + 8 + 8]; / test buffer w/ misalignment test space and some extra guard. */
1389	uint8_t BS3_FAR *pbBuf = abBuf;
1390	uint8_t const cbIdtr = BS3_MODE_IS_64BIT_CODE(bTestMode) ? 2+8 : 2+4;
1391	bool const f286 = (g_uBs3CpuDetected & BS3CPU_TYPE_MASK) == BS3CPU_80286;
1392	uint8_t bFiller;
1393	int off;
1394	unsigned cb;
1395	uint8_t BS3_FAR *pbTest;
1396
1397	/* make sure they're allocated */
1398	Bs3MemZero(&Ctx, sizeof(Ctx));
1399	Bs3MemZero(&CtxUdExpected, sizeof(CtxUdExpected));
1400	Bs3MemZero(&TmpCtx, sizeof(TmpCtx));
1401	Bs3MemZero(&TrapCtx, sizeof(TrapCtx));
1402	Bs3MemZero(&abBuf, sizeof(abBuf));
1403
1404	/* Create a context, give this routine some more stack space, point the context
1405	at our SIDT [xBX] + UD2 combo, and point DS:xBX at abBuf. */
1406	Bs3RegCtxSaveEx(&Ctx, bTestMode, 256 /cbExtraStack/);
1407	Bs3RegCtxSetGrpSegFromCurPtr(&Ctx, &Ctx.rbx, pWorker->fSs ? &Ctx.ss : &Ctx.ds, abBuf);
1408	Bs3RegCtxSetRipCsFromLnkPtr(&Ctx, pWorker->fpfnWorker);
1409	if (BS3_MODE_IS_16BIT_SYS(bTestMode))
1410	g_uBs3TrapEipHint = Ctx.rip.u32;
1411	if (!BS3_MODE_IS_RM_OR_V86(bTestMode))
1412	Bs3RegCtxConvertToRingX(&Ctx, bRing);
1413
1414	/* For successful SIDT attempts, we'll stop at the UD2. */
1415	Bs3MemCpy(&CtxUdExpected, &Ctx, sizeof(Ctx));
1416	CtxUdExpected.rip.u += pWorker->cbInstr;
1417
1418	/*
1419	* Check that it works at all and that only bytes we expect gets written to.
1420	*/
1421	/* First with zero buffer. */
1422	Bs3MemZero(abBuf, sizeof(abBuf));
1423	if (!ASMMemIsAllU8(abBuf, sizeof(abBuf), 0))
1424	Bs3TestFailedF("ASMMemIsAllU8 or Bs3MemZero is busted: abBuf=%.*Rhxs\n", sizeof(abBuf), pbBuf);
1425	if (!ASMMemIsZero(abBuf, sizeof(abBuf)))
1426	Bs3TestFailedF("ASMMemIsZero or Bs3MemZero is busted: abBuf=%.*Rhxs\n", sizeof(abBuf), pbBuf);
1427	Bs3TrapSetJmpAndRestore(&Ctx, &TrapCtx);
1428	bs3CpuBasic2_CompareUdCtx(&TrapCtx, &CtxUdExpected);
1429	if (f286 && abBuf[cbIdtr - 1] != 0xff)
1430	Bs3TestFailedF("286: Top base byte isn't 0xff (#1): %#x\n", abBuf[cbIdtr - 1]);
1431	if (!ASMMemIsZero(&abBuf[cbIdtr], cbBuf - cbIdtr))
1432	Bs3TestFailedF("Unexpected buffer bytes set (#1): cbIdtr=%u abBuf=%.*Rhxs\n", cbIdtr, cbBuf, pbBuf);
1433	if (Bs3MemCmp(abBuf, pabExpected, cbIdtr) != 0)
1434	Bs3TestFailedF("Mismatch (#1): expected %.Rhxs, got %.Rhxs\n", cbIdtr, pabExpected, cbIdtr, abBuf);
1435	g_usBs3TestStep++;
1436
1437	/* Again with buffer filled a byte not occuring in the previous result. */
1438	bFiller = 0x55;
1439	while (Bs3MemChr(abBuf, bFiller, cbBuf) != NULL)
1440	bFiller++;
1441	Bs3MemSet(abBuf, bFiller, sizeof(abBuf));
1442	if (!ASMMemIsAllU8(abBuf, sizeof(abBuf), bFiller))
1443	Bs3TestFailedF("ASMMemIsAllU8 or Bs3MemSet is busted: bFiller=%#x abBuf=%.*Rhxs\n", bFiller, sizeof(abBuf), pbBuf);
1444
1445	Bs3TrapSetJmpAndRestore(&Ctx, &TrapCtx);
1446	bs3CpuBasic2_CompareUdCtx(&TrapCtx, &CtxUdExpected);
1447	if (f286 && abBuf[cbIdtr - 1] != 0xff)
1448	Bs3TestFailedF("286: Top base byte isn't 0xff (#2): %#x\n", abBuf[cbIdtr - 1]);
1449	if (!ASMMemIsAllU8(&abBuf[cbIdtr], cbBuf - cbIdtr, bFiller))
1450	Bs3TestFailedF("Unexpected buffer bytes set (#2): cbIdtr=%u bFiller=%#x abBuf=%.*Rhxs\n", cbIdtr, bFiller, cbBuf, pbBuf);
1451	if (Bs3MemChr(abBuf, bFiller, cbIdtr) != NULL)
1452	Bs3TestFailedF("Not all bytes touched: cbIdtr=%u bFiller=%#x abBuf=%.*Rhxs\n", cbIdtr, bFiller, cbBuf, pbBuf);
1453	if (Bs3MemCmp(abBuf, pabExpected, cbIdtr) != 0)
1454	Bs3TestFailedF("Mismatch (#2): expected %.Rhxs, got %.Rhxs\n", cbIdtr, pabExpected, cbIdtr, abBuf);
1455	g_usBs3TestStep++;
1456
1457	/*
1458	* Slide the buffer along 8 bytes to cover misalignment.
1459	*/
1460	for (off = 0; off < 8; off++)
1461	{
1462	pbBuf = &abBuf[off];
1463	Bs3RegCtxSetGrpSegFromCurPtr(&Ctx, &Ctx.rbx, pWorker->fSs ? &Ctx.ss : &Ctx.ds, &abBuf[off]);
1464	CtxUdExpected.rbx.u = Ctx.rbx.u;
1465
1466	/* First with zero buffer. */
1467	Bs3MemZero(abBuf, sizeof(abBuf));
1468	Bs3TrapSetJmpAndRestore(&Ctx, &TrapCtx);
1469	bs3CpuBasic2_CompareUdCtx(&TrapCtx, &CtxUdExpected);
1470	if (off > 0 && !ASMMemIsZero(abBuf, off))
1471	Bs3TestFailedF("Unexpected buffer bytes set before (#3): cbIdtr=%u off=%u abBuf=%.*Rhxs\n",
1472	cbIdtr, off, off + cbBuf, abBuf);
1473	if (!ASMMemIsZero(&abBuf[off + cbIdtr], sizeof(abBuf) - cbIdtr - off))
1474	Bs3TestFailedF("Unexpected buffer bytes set after (#3): cbIdtr=%u off=%u abBuf=%.*Rhxs\n",
1475	cbIdtr, off, off + cbBuf, abBuf);
1476	if (f286 && abBuf[off + cbIdtr - 1] != 0xff)
1477	Bs3TestFailedF("286: Top base byte isn't 0xff (#3): %#x\n", abBuf[off + cbIdtr - 1]);
1478	if (Bs3MemCmp(&abBuf[off], pabExpected, cbIdtr) != 0)
1479	Bs3TestFailedF("Mismatch (#3): expected %.Rhxs, got %.Rhxs\n", cbIdtr, pabExpected, cbIdtr, &abBuf[off]);
1480	g_usBs3TestStep++;
1481
1482	/* Again with buffer filled a byte not occuring in the previous result. */
1483	Bs3MemSet(abBuf, bFiller, sizeof(abBuf));
1484	Bs3TrapSetJmpAndRestore(&Ctx, &TrapCtx);
1485	bs3CpuBasic2_CompareUdCtx(&TrapCtx, &CtxUdExpected);
1486	if (off > 0 && !ASMMemIsAllU8(abBuf, off, bFiller))
1487	Bs3TestFailedF("Unexpected buffer bytes set before (#4): cbIdtr=%u off=%u bFiller=%#x abBuf=%.*Rhxs\n",
1488	cbIdtr, off, bFiller, off + cbBuf, abBuf);
1489	if (!ASMMemIsAllU8(&abBuf[off + cbIdtr], sizeof(abBuf) - cbIdtr - off, bFiller))
1490	Bs3TestFailedF("Unexpected buffer bytes set after (#4): cbIdtr=%u off=%u bFiller=%#x abBuf=%.*Rhxs\n",
1491	cbIdtr, off, bFiller, off + cbBuf, abBuf);
1492	if (Bs3MemChr(&abBuf[off], bFiller, cbIdtr) != NULL)
1493	Bs3TestFailedF("Not all bytes touched (#4): cbIdtr=%u off=%u bFiller=%#x abBuf=%.*Rhxs\n",
1494	cbIdtr, off, bFiller, off + cbBuf, abBuf);
1495	if (f286 && abBuf[off + cbIdtr - 1] != 0xff)
1496	Bs3TestFailedF("286: Top base byte isn't 0xff (#4): %#x\n", abBuf[off + cbIdtr - 1]);
1497	if (Bs3MemCmp(&abBuf[off], pabExpected, cbIdtr) != 0)
1498	Bs3TestFailedF("Mismatch (#4): expected %.Rhxs, got %.Rhxs\n", cbIdtr, pabExpected, cbIdtr, &abBuf[off]);
1499	g_usBs3TestStep++;
1500	}
1501	pbBuf = abBuf;
1502	Bs3RegCtxSetGrpSegFromCurPtr(&Ctx, &Ctx.rbx, pWorker->fSs ? &Ctx.ss : &Ctx.ds, abBuf);
1503	CtxUdExpected.rbx.u = Ctx.rbx.u;
1504
1505	/*
1506	* Play with the selector limit if the target mode supports limit checking
1507	* We use BS3_SEL_TEST_PAGE_00 for this
1508	*/
1509	if ( !BS3_MODE_IS_RM_OR_V86(bTestMode)
1510	&& !BS3_MODE_IS_64BIT_CODE(bTestMode))
1511	{
1512	uint16_t cbLimit;
1513	uint32_t uFlatBuf = Bs3SelPtrToFlat(abBuf);
1514	Bs3GdteTestPage00 = Bs3Gdte_DATA16;
1515	Bs3GdteTestPage00.Gen.u2Dpl = bRing;
1516	Bs3GdteTestPage00.Gen.u16BaseLow = (uint16_t)uFlatBuf;
1517	Bs3GdteTestPage00.Gen.u8BaseHigh1 = (uint8_t)(uFlatBuf >> 16);
1518	Bs3GdteTestPage00.Gen.u8BaseHigh2 = (uint8_t)(uFlatBuf >> 24);
1519
1520	if (pWorker->fSs)
1521	CtxUdExpected.ss = Ctx.ss = BS3_SEL_TEST_PAGE_00 \| bRing;
1522	else
1523	CtxUdExpected.ds = Ctx.ds = BS3_SEL_TEST_PAGE_00 \| bRing;
1524
1525	/* Expand up (normal). */
1526	for (off = 0; off < 8; off++)
1527	{
1528	CtxUdExpected.rbx.u = Ctx.rbx.u = off;
1529	for (cbLimit = 0; cbLimit < cbIdtr*2; cbLimit++)
1530	{
1531	Bs3GdteTestPage00.Gen.u16LimitLow = cbLimit;
1532	Bs3MemSet(abBuf, bFiller, sizeof(abBuf));
1533	Bs3TrapSetJmpAndRestore(&Ctx, &TrapCtx);
1534	if (off + cbIdtr <= cbLimit + 1)
1535	{
1536	bs3CpuBasic2_CompareUdCtx(&TrapCtx, &CtxUdExpected);
1537	if (Bs3MemChr(&abBuf[off], bFiller, cbIdtr) != NULL)
1538	Bs3TestFailedF("Not all bytes touched (#5): cbIdtr=%u off=%u cbLimit=%u bFiller=%#x abBuf=%.*Rhxs\n",
1539	cbIdtr, off, cbLimit, bFiller, off + cbBuf, abBuf);
1540	if (Bs3MemCmp(&abBuf[off], pabExpected, cbIdtr) != 0)
1541	Bs3TestFailedF("Mismatch (#5): expected %.Rhxs, got %.Rhxs\n", cbIdtr, pabExpected, cbIdtr, &abBuf[off]);
1542	if (f286 && abBuf[off + cbIdtr - 1] != 0xff)
1543	Bs3TestFailedF("286: Top base byte isn't 0xff (#5): %#x\n", abBuf[off + cbIdtr - 1]);
1544	}
1545	else
1546	{
1547	if (pWorker->fSs)
1548	bs3CpuBasic2_CompareSsCtx(&TrapCtx, &Ctx, 0, false /f486ResumeFlagHint/);
1549	else
1550	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &Ctx, 0);
1551	if (off + 2 <= cbLimit + 1)
1552	{
1553	if (Bs3MemChr(&abBuf[off], bFiller, 2) != NULL)
1554	Bs3TestFailedF("Limit bytes not touched (#6): cbIdtr=%u off=%u cbLimit=%u bFiller=%#x abBuf=%.*Rhxs\n",
1555	cbIdtr, off, cbLimit, bFiller, off + cbBuf, abBuf);
1556	if (Bs3MemCmp(&abBuf[off], pabExpected, 2) != 0)
1557	Bs3TestFailedF("Mismatch (#6): expected %.2Rhxs, got %.2Rhxs\n", pabExpected, &abBuf[off]);
1558	if (!ASMMemIsAllU8(&abBuf[off + 2], cbIdtr - 2, bFiller))
1559	Bs3TestFailedF("Base bytes touched on #GP (#6): cbIdtr=%u off=%u cbLimit=%u bFiller=%#x abBuf=%.*Rhxs\n",
1560	cbIdtr, off, cbLimit, bFiller, off + cbBuf, abBuf);
1561	}
1562	else if (!ASMMemIsAllU8(abBuf, sizeof(abBuf), bFiller))
1563	Bs3TestFailedF("Bytes touched on #GP: cbIdtr=%u off=%u cbLimit=%u bFiller=%#x abBuf=%.*Rhxs\n",
1564	cbIdtr, off, cbLimit, bFiller, off + cbBuf, abBuf);
1565	}
1566
1567	if (off > 0 && !ASMMemIsAllU8(abBuf, off, bFiller))
1568	Bs3TestFailedF("Leading bytes touched (#7): cbIdtr=%u off=%u cbLimit=%u bFiller=%#x abBuf=%.*Rhxs\n",
1569	cbIdtr, off, cbLimit, bFiller, off + cbBuf, abBuf);
1570	if (!ASMMemIsAllU8(&abBuf[off + cbIdtr], sizeof(abBuf) - off - cbIdtr, bFiller))
1571	Bs3TestFailedF("Trailing bytes touched (#7): cbIdtr=%u off=%u cbLimit=%u bFiller=%#x abBuf=%.*Rhxs\n",
1572	cbIdtr, off, cbLimit, bFiller, off + cbBuf, abBuf);
1573
1574	g_usBs3TestStep++;
1575	}
1576	}
1577
1578	/* Expand down (weird). Inverted valid area compared to expand up,
1579	so a limit of zero give us a valid range for 0001..0ffffh (instead of
1580	a segment with one valid byte at 0000h). Whereas a limit of 0fffeh
1581	means one valid byte at 0ffffh, and a limit of 0ffffh means none
1582	(because in a normal expand up the 0ffffh means all 64KB are
1583	accessible). */
1584	Bs3GdteTestPage00.Gen.u4Type = X86_SEL_TYPE_RW_DOWN_ACC;
1585	for (off = 0; off < 8; off++)
1586	{
1587	CtxUdExpected.rbx.u = Ctx.rbx.u = off;
1588	for (cbLimit = 0; cbLimit < cbIdtr*2; cbLimit++)
1589	{
1590	Bs3GdteTestPage00.Gen.u16LimitLow = cbLimit;
1591	Bs3MemSet(abBuf, bFiller, sizeof(abBuf));
1592	Bs3TrapSetJmpAndRestore(&Ctx, &TrapCtx);
1593
1594	if (off > cbLimit)
1595	{
1596	bs3CpuBasic2_CompareUdCtx(&TrapCtx, &CtxUdExpected);
1597	if (Bs3MemChr(&abBuf[off], bFiller, cbIdtr) != NULL)
1598	Bs3TestFailedF("Not all bytes touched (#8): cbIdtr=%u off=%u cbLimit=%u bFiller=%#x abBuf=%.*Rhxs\n",
1599	cbIdtr, off, cbLimit, bFiller, off + cbBuf, abBuf);
1600	if (Bs3MemCmp(&abBuf[off], pabExpected, cbIdtr) != 0)
1601	Bs3TestFailedF("Mismatch (#8): expected %.Rhxs, got %.Rhxs\n", cbIdtr, pabExpected, cbIdtr, &abBuf[off]);
1602	if (f286 && abBuf[off + cbIdtr - 1] != 0xff)
1603	Bs3TestFailedF("286: Top base byte isn't 0xff (#8): %#x\n", abBuf[off + cbIdtr - 1]);
1604	}
1605	else
1606	{
1607	if (pWorker->fSs)
1608	bs3CpuBasic2_CompareSsCtx(&TrapCtx, &Ctx, 0, false /f486ResumeFlagHint/);
1609	else
1610	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &Ctx, 0);
1611	if (!ASMMemIsAllU8(abBuf, sizeof(abBuf), bFiller))
1612	Bs3TestFailedF("Bytes touched on #GP: cbIdtr=%u off=%u cbLimit=%u bFiller=%#x abBuf=%.*Rhxs\n",
1613	cbIdtr, off, cbLimit, bFiller, off + cbBuf, abBuf);
1614	}
1615
1616	if (off > 0 && !ASMMemIsAllU8(abBuf, off, bFiller))
1617	Bs3TestFailedF("Leading bytes touched (#9): cbIdtr=%u off=%u cbLimit=%u bFiller=%#x abBuf=%.*Rhxs\n",
1618	cbIdtr, off, cbLimit, bFiller, off + cbBuf, abBuf);
1619	if (!ASMMemIsAllU8(&abBuf[off + cbIdtr], sizeof(abBuf) - off - cbIdtr, bFiller))
1620	Bs3TestFailedF("Trailing bytes touched (#9): cbIdtr=%u off=%u cbLimit=%u bFiller=%#x abBuf=%.*Rhxs\n",
1621	cbIdtr, off, cbLimit, bFiller, off + cbBuf, abBuf);
1622
1623	g_usBs3TestStep++;
1624	}
1625	}
1626
1627	Bs3RegCtxSetGrpSegFromCurPtr(&Ctx, &Ctx.rbx, pWorker->fSs ? &Ctx.ss : &Ctx.ds, abBuf);
1628	CtxUdExpected.rbx.u = Ctx.rbx.u;
1629	CtxUdExpected.ss = Ctx.ss;
1630	CtxUdExpected.ds = Ctx.ds;
1631	}
1632
1633	/*
1634	* Play with the paging.
1635	*/
1636	if ( BS3_MODE_IS_PAGED(bTestMode)
1637	&& (!pWorker->fSs \|\| bRing == 3) /* SS.DPL == CPL, we'll get some tiled ring-3 selector here. */
1638	&& (pbTest = (uint8_t BS3_FAR *)Bs3MemGuardedTestPageAlloc(BS3MEMKIND_TILED)) != NULL)
1639	{
1640	RTCCUINTXREG uFlatTest = Bs3SelPtrToFlat(pbTest);
1641
1642	/*
1643	* Slide the buffer towards the trailing guard page. We'll observe the
1644	* first word being written entirely separately from the 2nd dword/qword.
1645	*/
1646	for (off = X86_PAGE_SIZE - cbIdtr - 4; off < X86_PAGE_SIZE + 4; off++)
1647	{
1648	Bs3MemSet(&pbTest[X86_PAGE_SIZE - cbIdtr * 2], bFiller, cbIdtr * 2);
1649	Bs3RegCtxSetGrpSegFromCurPtr(&Ctx, &Ctx.rbx, pWorker->fSs ? &Ctx.ss : &Ctx.ds, &pbTest[off]);
1650	Bs3TrapSetJmpAndRestore(&Ctx, &TrapCtx);
1651	if (off + cbIdtr <= X86_PAGE_SIZE)
1652	{
1653	CtxUdExpected.rbx = Ctx.rbx;
1654	CtxUdExpected.ss = Ctx.ss;
1655	CtxUdExpected.ds = Ctx.ds;
1656	bs3CpuBasic2_CompareUdCtx(&TrapCtx, &CtxUdExpected);
1657	if (Bs3MemCmp(&pbTest[off], pabExpected, cbIdtr) != 0)
1658	Bs3TestFailedF("Mismatch (#9): expected %.Rhxs, got %.Rhxs\n", cbIdtr, pabExpected, cbIdtr, &pbTest[off]);
1659	}
1660	else
1661	{
1662	bs3CpuBasic2_ComparePfCtx(&TrapCtx, &Ctx, X86_TRAP_PF_RW \| (Ctx.bCpl == 3 ? X86_TRAP_PF_US : 0),
1663	uFlatTest + RT_MAX(off, X86_PAGE_SIZE));
1664	if ( off <= X86_PAGE_SIZE - 2
1665	&& Bs3MemCmp(&pbTest[off], pabExpected, 2) != 0)
1666	Bs3TestPrintf("Mismatch (#10): Expected limit %.2Rhxs, got %.2Rhxs; off=%#x\n",
1667	pabExpected, &pbTest[off], off);
1668	if ( off < X86_PAGE_SIZE - 2
1669	&& !ASMMemIsAllU8(&pbTest[off + 2], X86_PAGE_SIZE - off - 2, bFiller))
1670	Bs3TestPrintf("Wrote partial base on #PF (#10): bFiller=%#x, got %.*Rhxs; off=%#x\n",
1671	bFiller, X86_PAGE_SIZE - off - 2, &pbTest[off + 2], off);
1672	if (off == X86_PAGE_SIZE - 1 && pbTest[off] != bFiller)
1673	Bs3TestPrintf("Wrote partial limit on #PF (#10): Expected %02x, got %02x\n", bFiller, pbTest[off]);
1674	}
1675	g_usBs3TestStep++;
1676	}
1677
1678	/*
1679	* Now, do it the other way around. It should look normal now since writing
1680	* the limit will #PF first and nothing should be written.
1681	*/
1682	for (off = cbIdtr + 4; off >= -cbIdtr - 4; off--)
1683	{
1684	Bs3MemSet(pbTest, bFiller, 32);
1685	Bs3RegCtxSetGrpSegFromCurPtr(&Ctx, &Ctx.rbx, pWorker->fSs ? &Ctx.ss : &Ctx.ds, &pbTest[off]);
1686	Bs3TrapSetJmpAndRestore(&Ctx, &TrapCtx);
1687	if (off >= 0)
1688	{
1689	CtxUdExpected.rbx = Ctx.rbx;
1690	CtxUdExpected.ss = Ctx.ss;
1691	CtxUdExpected.ds = Ctx.ds;
1692	bs3CpuBasic2_CompareUdCtx(&TrapCtx, &CtxUdExpected);
1693	if (Bs3MemCmp(&pbTest[off], pabExpected, cbIdtr) != 0)
1694	Bs3TestFailedF("Mismatch (#11): expected %.Rhxs, got %.Rhxs\n", cbIdtr, pabExpected, cbIdtr, &pbTest[off]);
1695	}
1696	else
1697	{
1698	bs3CpuBasic2_ComparePfCtx(&TrapCtx, &Ctx, X86_TRAP_PF_RW \| (Ctx.bCpl == 3 ? X86_TRAP_PF_US : 0), uFlatTest + off);
1699	if ( -off < cbIdtr
1700	&& !ASMMemIsAllU8(pbTest, cbIdtr + off, bFiller))
1701	Bs3TestPrintf("Wrote partial content on #PF (#12): bFiller=%#x, found %.*Rhxs; off=%d\n",
1702	bFiller, cbIdtr + off, pbTest, off);
1703	}
1704	if (!ASMMemIsAllU8(&pbTest[RT_MAX(cbIdtr + off, 0)], 16, bFiller))
1705	Bs3TestPrintf("Wrote beyond expected area (#13): bFiller=%#x, found %.16Rhxs; off=%d\n",
1706	bFiller, &pbTest[RT_MAX(cbIdtr + off, 0)], off);
1707	g_usBs3TestStep++;
1708	}
1709
1710	/*
1711	* Combine paging and segment limit and check ordering.
1712	* This is kind of interesting here since it the instruction seems to
1713	* be doing two separate writes.
1714	*/
1715	if ( !BS3_MODE_IS_RM_OR_V86(bTestMode)
1716	&& !BS3_MODE_IS_64BIT_CODE(bTestMode))
1717	{
1718	uint16_t cbLimit;
1719
1720	Bs3GdteTestPage00 = Bs3Gdte_DATA16;
1721	Bs3GdteTestPage00.Gen.u2Dpl = bRing;
1722	Bs3GdteTestPage00.Gen.u16BaseLow = (uint16_t)uFlatTest;
1723	Bs3GdteTestPage00.Gen.u8BaseHigh1 = (uint8_t)(uFlatTest >> 16);
1724	Bs3GdteTestPage00.Gen.u8BaseHigh2 = (uint8_t)(uFlatTest >> 24);
1725
1726	if (pWorker->fSs)
1727	CtxUdExpected.ss = Ctx.ss = BS3_SEL_TEST_PAGE_00 \| bRing;
1728	else
1729	CtxUdExpected.ds = Ctx.ds = BS3_SEL_TEST_PAGE_00 \| bRing;
1730
1731	/* Expand up (normal), approaching tail guard page. */
1732	for (off = X86_PAGE_SIZE - cbIdtr - 4; off < X86_PAGE_SIZE + 4; off++)
1733	{
1734	CtxUdExpected.rbx.u = Ctx.rbx.u = off;
1735	for (cbLimit = X86_PAGE_SIZE - cbIdtr2; cbLimit < X86_PAGE_SIZE + cbIdtr2; cbLimit++)
1736	{
1737	Bs3GdteTestPage00.Gen.u16LimitLow = cbLimit;
1738	Bs3MemSet(&pbTest[X86_PAGE_SIZE - cbIdtr * 2], bFiller, cbIdtr * 2);
1739	Bs3TrapSetJmpAndRestore(&Ctx, &TrapCtx);
1740	if (off + cbIdtr <= cbLimit + 1)
1741	{
1742	/* No #GP, but maybe #PF. */
1743	if (off + cbIdtr <= X86_PAGE_SIZE)
1744	{
1745	bs3CpuBasic2_CompareUdCtx(&TrapCtx, &CtxUdExpected);
1746	if (Bs3MemCmp(&pbTest[off], pabExpected, cbIdtr) != 0)
1747	Bs3TestFailedF("Mismatch (#14): expected %.Rhxs, got %.Rhxs\n",
1748	cbIdtr, pabExpected, cbIdtr, &pbTest[off]);
1749	}
1750	else
1751	{
1752	bs3CpuBasic2_ComparePfCtx(&TrapCtx, &Ctx, X86_TRAP_PF_RW \| (Ctx.bCpl == 3 ? X86_TRAP_PF_US : 0),
1753	uFlatTest + RT_MAX(off, X86_PAGE_SIZE));
1754	if ( off <= X86_PAGE_SIZE - 2
1755	&& Bs3MemCmp(&pbTest[off], pabExpected, 2) != 0)
1756	Bs3TestPrintf("Mismatch (#15): Expected limit %.2Rhxs, got %.2Rhxs; off=%#x\n",
1757	pabExpected, &pbTest[off], off);
1758	cb = X86_PAGE_SIZE - off - 2;
1759	if ( off < X86_PAGE_SIZE - 2
1760	&& !ASMMemIsAllU8(&pbTest[off + 2], cb, bFiller))
1761	Bs3TestPrintf("Wrote partial base on #PF (#15): bFiller=%#x, got %.*Rhxs; off=%#x\n",
1762	bFiller, cb, &pbTest[off + 2], off);
1763	if (off == X86_PAGE_SIZE - 1 && pbTest[off] != bFiller)
1764	Bs3TestPrintf("Wrote partial limit on #PF (#15): Expected %02x, got %02x\n", bFiller, pbTest[off]);
1765	}
1766	}
1767	else if (off + 2 <= cbLimit + 1)
1768	{
1769	/* [ig]tr.limit writing does not cause #GP, but may cause #PG, if not writing the base causes #GP. */
1770	if (off <= X86_PAGE_SIZE - 2)
1771	{
1772	if (pWorker->fSs)
1773	bs3CpuBasic2_CompareSsCtx(&TrapCtx, &Ctx, 0, false /f486ResumeFlagHint/);
1774	else
1775	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &Ctx, 0);
1776	if (Bs3MemCmp(&pbTest[off], pabExpected, 2) != 0)
1777	Bs3TestPrintf("Mismatch (#16): Expected limit %.2Rhxs, got %.2Rhxs; off=%#x\n",
1778	pabExpected, &pbTest[off], off);
1779	cb = X86_PAGE_SIZE - off - 2;
1780	if ( off < X86_PAGE_SIZE - 2
1781	&& !ASMMemIsAllU8(&pbTest[off + 2], cb, bFiller))
1782	Bs3TestPrintf("Wrote partial base with limit (#16): bFiller=%#x, got %.*Rhxs; off=%#x\n",
1783	bFiller, cb, &pbTest[off + 2], off);
1784	}
1785	else
1786	{
1787	bs3CpuBasic2_ComparePfCtx(&TrapCtx, &Ctx, X86_TRAP_PF_RW \| (Ctx.bCpl == 3 ? X86_TRAP_PF_US : 0),
1788	uFlatTest + RT_MAX(off, X86_PAGE_SIZE));
1789	if ( off < X86_PAGE_SIZE
1790	&& !ASMMemIsAllU8(&pbTest[off], X86_PAGE_SIZE - off, bFiller))
1791	Bs3TestPrintf("Mismatch (#16): Partial limit write on #PF: bFiller=%#x, got %.*Rhxs\n",
1792	bFiller, X86_PAGE_SIZE - off, &pbTest[off]);
1793	}
1794	}
1795	else
1796	{
1797	/* #GP/#SS on limit. */
1798	if (pWorker->fSs)
1799	bs3CpuBasic2_CompareSsCtx(&TrapCtx, &Ctx, 0, false /f486ResumeFlagHint/);
1800	else
1801	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &Ctx, 0);
1802	if ( off < X86_PAGE_SIZE
1803	&& !ASMMemIsAllU8(&pbTest[off], X86_PAGE_SIZE - off, bFiller))
1804	Bs3TestPrintf("Mismatch (#17): Partial write on #GP: bFiller=%#x, got %.*Rhxs\n",
1805	bFiller, X86_PAGE_SIZE - off, &pbTest[off]);
1806	}
1807
1808	cb = RT_MIN(cbIdtr * 2, off - (X86_PAGE_SIZE - cbIdtr*2));
1809	if (!ASMMemIsAllU8(&pbTest[X86_PAGE_SIZE - cbIdtr * 2], cb, bFiller))
1810	Bs3TestFailedF("Leading bytes touched (#18): cbIdtr=%u off=%u cbLimit=%u bFiller=%#x pbTest=%.*Rhxs\n",
1811	cbIdtr, off, cbLimit, bFiller, cb, pbTest[X86_PAGE_SIZE - cbIdtr * 2]);
1812
1813	g_usBs3TestStep++;
1814
1815	/* Set DS to 0 and check that we get #GP(0). */
1816	if (!pWorker->fSs)
1817	{
1818	Ctx.ds = 0;
1819	Bs3TrapSetJmpAndRestore(&Ctx, &TrapCtx);
1820	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &Ctx, 0);
1821	Ctx.ds = BS3_SEL_TEST_PAGE_00 \| bRing;
1822	g_usBs3TestStep++;
1823	}
1824	}
1825	}
1826
1827	/* Expand down. */
1828	pbTest -= X86_PAGE_SIZE; /* Note! we're backing up a page to simplify things */
1829	uFlatTest -= X86_PAGE_SIZE;
1830
1831	Bs3GdteTestPage00.Gen.u4Type = X86_SEL_TYPE_RW_DOWN_ACC;
1832	Bs3GdteTestPage00.Gen.u16BaseLow = (uint16_t)uFlatTest;
1833	Bs3GdteTestPage00.Gen.u8BaseHigh1 = (uint8_t)(uFlatTest >> 16);
1834	Bs3GdteTestPage00.Gen.u8BaseHigh2 = (uint8_t)(uFlatTest >> 24);
1835
1836	for (off = X86_PAGE_SIZE - cbIdtr - 4; off < X86_PAGE_SIZE + 4; off++)
1837	{
1838	CtxUdExpected.rbx.u = Ctx.rbx.u = off;
1839	for (cbLimit = X86_PAGE_SIZE - cbIdtr2; cbLimit < X86_PAGE_SIZE + cbIdtr2; cbLimit++)
1840	{
1841	Bs3GdteTestPage00.Gen.u16LimitLow = cbLimit;
1842	Bs3MemSet(&pbTest[X86_PAGE_SIZE], bFiller, cbIdtr * 2);
1843	Bs3TrapSetJmpAndRestore(&Ctx, &TrapCtx);
1844	if (cbLimit < off && off >= X86_PAGE_SIZE)
1845	{
1846	bs3CpuBasic2_CompareUdCtx(&TrapCtx, &CtxUdExpected);
1847	if (Bs3MemCmp(&pbTest[off], pabExpected, cbIdtr) != 0)
1848	Bs3TestFailedF("Mismatch (#19): expected %.Rhxs, got %.Rhxs\n",
1849	cbIdtr, pabExpected, cbIdtr, &pbTest[off]);
1850	cb = X86_PAGE_SIZE + cbIdtr*2 - off;
1851	if (!ASMMemIsAllU8(&pbTest[off + cbIdtr], cb, bFiller))
1852	Bs3TestFailedF("Trailing bytes touched (#20): cbIdtr=%u off=%u cbLimit=%u bFiller=%#x pbTest=%.*Rhxs\n",
1853	cbIdtr, off, cbLimit, bFiller, cb, pbTest[off + cbIdtr]);
1854	}
1855	else
1856	{
1857	if (cbLimit < off && off < X86_PAGE_SIZE)
1858	bs3CpuBasic2_ComparePfCtx(&TrapCtx, &Ctx, X86_TRAP_PF_RW \| (Ctx.bCpl == 3 ? X86_TRAP_PF_US : 0),
1859	uFlatTest + off);
1860	else if (pWorker->fSs)
1861	bs3CpuBasic2_CompareSsCtx(&TrapCtx, &Ctx, 0, false /f486ResumeFlagHint/);
1862	else
1863	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &Ctx, 0);
1864	cb = cbIdtr*2;
1865	if (!ASMMemIsAllU8(&pbTest[X86_PAGE_SIZE], cb, bFiller))
1866	Bs3TestFailedF("Trailing bytes touched (#20): cbIdtr=%u off=%u cbLimit=%u bFiller=%#x pbTest=%.*Rhxs\n",
1867	cbIdtr, off, cbLimit, bFiller, cb, pbTest[X86_PAGE_SIZE]);
1868	}
1869	g_usBs3TestStep++;
1870	}
1871	}
1872
1873	pbTest += X86_PAGE_SIZE;
1874	uFlatTest += X86_PAGE_SIZE;
1875	}
1876
1877	Bs3MemGuardedTestPageFree(pbTest);
1878	}
1879
1880	/*
1881	* Check non-canonical 64-bit space.
1882	*/
1883	if (BS3_MODE_IS_64BIT_CODE(bTestMode))
1884	{
1885
1886	}
1887	}
1888
1889	# define bs3CpuBasic2_sidt_sgdt_Common BS3_CMN_NM(bs3CpuBasic2_sidt_sgdt_Common)
1890	BS3_DECL_NEAR(void) bs3CpuBasic2_sidt_sgdt_Common(uint8_t bTestMode, BS3CB2SIDTSGDT const BS3_FAR *paWorkers, unsigned cWorkers,
1891	uint8_t const *pabExpected)
1892	{
1893	unsigned idx;
1894	unsigned bRing;
1895	unsigned iStep = 0;
1896
1897	/* Note! We skip the SS checks for ring-0 since we badly mess up SS in the
1898	test and don't want to bother with double faults. */
1899	for (bRing = 0; bRing <= 3; bRing++)
1900	{
1901	for (idx = 0; idx < cWorkers; idx++)
1902	if ( (paWorkers[idx].bMode & (bTestMode & BS3_MODE_CODE_MASK))
1903	&& (!paWorkers[idx].fSs \|\| bRing != 0))
1904	{
1905	g_usBs3TestStep = iStep;
1906	bs3CpuBasic2_sidt_sgdt_One(&paWorkers[idx], bTestMode, bRing, pabExpected);
1907	iStep += 1000;
1908	}
1909	if (BS3_MODE_IS_RM_OR_V86(bTestMode))
1910	break;
1911	}
1912	}
1913
1914
1915	# if ARCH_BITS != 64
1916
1917	/**
1918	* Worker for bs3CpuBasic2_TssGateEsp that tests the INT 80 from outer rings.
1919	*/
1920	# define bs3CpuBasic2_TssGateEsp_AltStackOuterRing BS3_CMN_NM(bs3CpuBasic2_TssGateEsp_AltStackOuterRing)
1921	BS3_DECL_NEAR(void) bs3CpuBasic2_TssGateEsp_AltStackOuterRing(PCBS3REGCTX pCtx, uint8_t bRing, uint8_t *pbAltStack,
1922	size_t cbAltStack, bool f16BitStack, bool f16BitTss,
1923	bool f16BitHandler, unsigned uLine)
1924	{
1925	uint8_t const cbIretFrame = f16BitHandler ? 52 : 54;
1926	BS3REGCTX Ctx2;
1927	BS3TRAPFRAME TrapCtx;
1928	uint8_t *pbTmp;
1929	g_usBs3TestStep = uLine;
1930
1931	Bs3MemCpy(&Ctx2, pCtx, sizeof(Ctx2));
1932	Bs3RegCtxConvertToRingX(&Ctx2, bRing);
1933
1934	if (pbAltStack)
1935	{
1936	Ctx2.rsp.u = Bs3SelPtrToFlat(pbAltStack + 0x1980);
1937	Bs3MemZero(pbAltStack, cbAltStack);
1938	}
1939
1940	Bs3TrapSetJmpAndRestore(&Ctx2, &TrapCtx);
1941
1942	if (!f16BitStack && f16BitTss)
1943	Ctx2.rsp.u &= UINT16_MAX;
1944
1945	bs3CpuBasic2_CompareIntCtx1(&TrapCtx, &Ctx2, 0x80 /bXcpt/);
1946	CHECK_MEMBER("bCpl", "%u", TrapCtx.Ctx.bCpl, bRing);
1947	CHECK_MEMBER("cbIretFrame", "%#x", TrapCtx.cbIretFrame, cbIretFrame);
1948
1949	if (pbAltStack)
1950	{
1951	uint64_t uExpectedRsp = (f16BitTss ? Bs3Tss16.sp0 : Bs3Tss32.esp0) - cbIretFrame;
1952	if (f16BitStack)
1953	{
1954	uExpectedRsp &= UINT16_MAX;
1955	uExpectedRsp \|= Ctx2.rsp.u & ~(uint64_t)UINT16_MAX;
1956	}
1957	if ( TrapCtx.uHandlerRsp != uExpectedRsp
1958	\|\| TrapCtx.uHandlerSs != (f16BitTss ? Bs3Tss16.ss0 : Bs3Tss32.ss0))
1959	bs3CpuBasic2_FailedF("handler SS:ESP=%04x:%08RX64, expected %04x:%08RX16",
1960	TrapCtx.uHandlerSs, TrapCtx.uHandlerRsp, Bs3Tss16.ss0, uExpectedRsp);
1961
1962	pbTmp = (uint8_t *)ASMMemFirstNonZero(pbAltStack, cbAltStack);
1963	if ((f16BitStack \|\| TrapCtx.uHandlerRsp <= UINT16_MAX) && pbTmp != NULL)
1964	bs3CpuBasic2_FailedF("someone touched the alt stack (%p) with SS:ESP=%04x:%#RX32: %p=%02x",
1965	pbAltStack, Ctx2.ss, Ctx2.rsp.u32, pbTmp, *pbTmp);
1966	else if (!f16BitStack && TrapCtx.uHandlerRsp > UINT16_MAX && pbTmp == NULL)
1967	bs3CpuBasic2_FailedF("the alt stack (%p) was not used SS:ESP=%04x:%#RX32\n", pbAltStack, Ctx2.ss, Ctx2.rsp.u32);
1968	}
1969	}
1970
1971	# define bs3CpuBasic2_TssGateEspCommon BS3_CMN_NM(bs3CpuBasic2_TssGateEspCommon)
1972	BS3_DECL_NEAR(void) bs3CpuBasic2_TssGateEspCommon(bool const g_f16BitSys, PX86DESC const paIdt, unsigned const cIdteShift)
1973	{
1974	BS3TRAPFRAME TrapCtx;
1975	BS3REGCTX Ctx;
1976	BS3REGCTX Ctx2;
1977	# if TMPL_BITS == 16
1978	uint8_t *pbTmp;
1979	# endif
1980
1981	/* make sure they're allocated */
1982	Bs3MemZero(&Ctx, sizeof(Ctx));
1983	Bs3MemZero(&Ctx2, sizeof(Ctx2));
1984	Bs3MemZero(&TrapCtx, sizeof(TrapCtx));
1985
1986	Bs3RegCtxSave(&Ctx);
1987	Ctx.rsp.u -= 0x80;
1988	Ctx.rip.u = (uintptr_t)BS3_FP_OFF(&bs3CpuBasic2_Int80);
1989	# if TMPL_BITS == 32
1990	g_uBs3TrapEipHint = Ctx.rip.u32;
1991	# endif
1992
1993	/*
1994	* We'll be using IDT entry 80 and 81 here. The first one will be
1995	* accessible from all DPLs, the latter not. So, start with setting
1996	* the DPLs.
1997	*/
1998	paIdt[0x80 << cIdteShift].Gate.u2Dpl = 3;
1999	paIdt[0x81 << cIdteShift].Gate.u2Dpl = 0;
2000
2001	/*
2002	* Check that the basic stuff works first.
2003	*/
2004	Bs3TrapSetJmpAndRestore(&Ctx, &TrapCtx);
2005	g_usBs3TestStep = __LINE__;
2006	bs3CpuBasic2_CompareIntCtx1(&TrapCtx, &Ctx, 0x80 /bXcpt/);
2007
2008	bs3CpuBasic2_TssGateEsp_AltStackOuterRing(&Ctx, 1, NULL, 0, g_f16BitSys, g_f16BitSys, g_f16BitSys, __LINE__);
2009	bs3CpuBasic2_TssGateEsp_AltStackOuterRing(&Ctx, 2, NULL, 0, g_f16BitSys, g_f16BitSys, g_f16BitSys, __LINE__);
2010	bs3CpuBasic2_TssGateEsp_AltStackOuterRing(&Ctx, 3, NULL, 0, g_f16BitSys, g_f16BitSys, g_f16BitSys, __LINE__);
2011
2012	/*
2013	* Check that the upper part of ESP is preserved when doing .
2014	*/
2015	if ((g_uBs3CpuDetected & BS3CPU_TYPE_MASK) >= BS3CPU_80386)
2016	{
2017	size_t const cbAltStack = _8K;
2018	uint8_t *pbAltStack = Bs3MemAllocZ(BS3MEMKIND_TILED, cbAltStack);
2019	if (pbAltStack)
2020	{
2021	/* same ring */
2022	g_usBs3TestStep = __LINE__;
2023	Bs3MemCpy(&Ctx2, &Ctx, sizeof(Ctx2));
2024	Ctx2.rsp.u = Bs3SelPtrToFlat(pbAltStack + 0x1980);
2025	if (Bs3TrapSetJmp(&TrapCtx))
2026	Bs3RegCtxRestore(&Ctx2, 0); /* (does not return) */
2027	bs3CpuBasic2_CompareIntCtx1(&TrapCtx, &Ctx2, 0x80 /bXcpt/);
2028	# if TMPL_BITS == 16
2029	if ((pbTmp = (uint8_t *)ASMMemFirstNonZero(pbAltStack, cbAltStack)) != NULL)
2030	bs3CpuBasic2_FailedF("someone touched the alt stack (%p) with SS:ESP=%04x:%#RX32: %p=%02x\n",
2031	pbAltStack, Ctx2.ss, Ctx2.rsp.u32, pbTmp, *pbTmp);
2032	# else
2033	if (ASMMemIsZero(pbAltStack, cbAltStack))
2034	bs3CpuBasic2_FailedF("alt stack wasn't used despite SS:ESP=%04x:%#RX32\n", Ctx2.ss, Ctx2.rsp.u32);
2035	# endif
2036
2037	/* Different rings (load SS0:SP0 from TSS). */
2038	bs3CpuBasic2_TssGateEsp_AltStackOuterRing(&Ctx, 1, pbAltStack, cbAltStack,
2039	g_f16BitSys, g_f16BitSys, g_f16BitSys, __LINE__);
2040	bs3CpuBasic2_TssGateEsp_AltStackOuterRing(&Ctx, 2, pbAltStack, cbAltStack,
2041	g_f16BitSys, g_f16BitSys, g_f16BitSys, __LINE__);
2042	bs3CpuBasic2_TssGateEsp_AltStackOuterRing(&Ctx, 3, pbAltStack, cbAltStack,
2043	g_f16BitSys, g_f16BitSys, g_f16BitSys, __LINE__);
2044
2045	/* Different rings but switch the SS bitness in the TSS. */
2046	if (g_f16BitSys)
2047	{
2048	Bs3Tss16.ss0 = BS3_SEL_R0_SS32;
2049	bs3CpuBasic2_TssGateEsp_AltStackOuterRing(&Ctx, 1, pbAltStack, cbAltStack,
2050	false, g_f16BitSys, g_f16BitSys, __LINE__);
2051	Bs3Tss16.ss0 = BS3_SEL_R0_SS16;
2052	}
2053	else
2054	{
2055	Bs3Tss32.ss0 = BS3_SEL_R0_SS16;
2056	bs3CpuBasic2_TssGateEsp_AltStackOuterRing(&Ctx, 1, pbAltStack, cbAltStack,
2057	true, g_f16BitSys, g_f16BitSys, __LINE__);
2058	Bs3Tss32.ss0 = BS3_SEL_R0_SS32;
2059	}
2060
2061	Bs3MemFree(pbAltStack, cbAltStack);
2062	}
2063	else
2064	Bs3TestPrintf("%s: Skipping ESP check, alloc failed\n", g_pszTestMode);
2065	}
2066	else
2067	Bs3TestPrintf("%s: Skipping ESP check, CPU too old\n", g_pszTestMode);
2068	}
2069
2070	# endif /* ARCH_BITS != 64 */
2071	#endif /* BS3_INSTANTIATING_CMN */
2072
2073
2074	/*
2075	* Mode specific code.
2076	* Mode specific code.
2077	* Mode specific code.
2078	*/
2079	#ifdef BS3_INSTANTIATING_MODE
2080
2081	BS3_DECL_FAR(uint8_t) TMPL_NM(bs3CpuBasic2_TssGateEsp)(uint8_t bMode)
2082	{
2083	uint8_t bRet = 0;
2084
2085	g_pszTestMode = TMPL_NM(g_szBs3ModeName);
2086	g_bTestMode = bMode;
2087	g_f16BitSys = BS3_MODE_IS_16BIT_SYS(TMPL_MODE);
2088
2089	# if TMPL_MODE == BS3_MODE_PE16 \
2090	\|\| TMPL_MODE == BS3_MODE_PE16_32 \
2091	\|\| TMPL_MODE == BS3_MODE_PP16 \
2092	\|\| TMPL_MODE == BS3_MODE_PP16_32 \
2093	\|\| TMPL_MODE == BS3_MODE_PAE16 \
2094	\|\| TMPL_MODE == BS3_MODE_PAE16_32 \
2095	\|\| TMPL_MODE == BS3_MODE_PE32
2096	bs3CpuBasic2_TssGateEspCommon(BS3_MODE_IS_16BIT_SYS(TMPL_MODE),
2097	(PX86DESC)MyBs3Idt,
2098	BS3_MODE_IS_64BIT_SYS(TMPL_MODE) ? 1 : 0);
2099	# else
2100	bRet = BS3TESTDOMODE_SKIPPED;
2101	# endif
2102
2103	/*
2104	* Re-initialize the IDT.
2105	*/
2106	Bs3TrapInit();
2107	return bRet;
2108	}
2109
2110
2111	BS3_DECL_FAR(uint8_t) TMPL_NM(bs3CpuBasic2_RaiseXcpt1)(uint8_t bMode)
2112	{
2113	g_pszTestMode = TMPL_NM(g_szBs3ModeName);
2114	g_bTestMode = bMode;
2115	g_f16BitSys = BS3_MODE_IS_16BIT_SYS(TMPL_MODE);
2116
2117	# if !BS3_MODE_IS_RM_OR_V86(TMPL_MODE)
2118
2119	/*
2120	* Pass to common worker which is only compiled once per mode.
2121	*/
2122	bs3CpuBasic2_RaiseXcpt1Common(MY_SYS_SEL_R0_CS,
2123	MY_SYS_SEL_R0_CS_CNF,
2124	MY_SYS_SEL_R0_SS,
2125	(PX86DESC)MyBs3Idt,
2126	BS3_MODE_IS_64BIT_SYS(TMPL_MODE) ? 1 : 0);
2127
2128	/*
2129	* Re-initialize the IDT.
2130	*/
2131	Bs3TrapInit();
2132	return 0;
2133	# elif TMPL_MODE == BS3_MODE_RM
2134
2135	/*
2136	* Check
2137	*/
2138	/** @todo check */
2139	return BS3TESTDOMODE_SKIPPED;
2140
2141	# else
2142	return BS3TESTDOMODE_SKIPPED;
2143	# endif
2144	}
2145
2146
2147	BS3_DECL_FAR(uint8_t) TMPL_NM(bs3CpuBasic2_iret)(uint8_t bMode)
2148	{
2149	g_pszTestMode = TMPL_NM(g_szBs3ModeName);
2150	g_bTestMode = bMode;
2151	g_f16BitSys = BS3_MODE_IS_16BIT_SYS(TMPL_MODE);
2152
2153	Bs3PrintStrN(RT_STR_TUPLE("Hello world!\n"));
2154	# if !BS3_MODE_IS_V86(TMPL_MODE)
2155	Bs3TestPrintf(RT_STR_TUPLE("Hi there!\n"));
2156	# endif
2157	return BS3TESTDOMODE_SKIPPED;
2158	}
2159
2160
2161	BS3_DECL_FAR(uint8_t) TMPL_NM(bs3CpuBasic2_sidt)(uint8_t bMode)
2162	{
2163	//if (bMode == BS3_MODE_PE16_V86)
2164	//if (bMode & BS3_MODE_CODE_V86)
2165	{
2166	union
2167	{
2168	RTIDTR Idtr;
2169	uint8_t ab[16];
2170	} Expected;
2171
2172	g_pszTestMode = TMPL_NM(g_szBs3ModeName);
2173	g_bTestMode = bMode;
2174	g_f16BitSys = BS3_MODE_IS_16BIT_SYS(TMPL_MODE);
2175
2176	BS3_ASSERT(bMode == TMPL_MODE);
2177
2178	/*
2179	* Pass to common worker which is only compiled once per mode.
2180	*/
2181	Bs3MemZero(&Expected, sizeof(Expected));
2182	ASMGetIDTR(&Expected.Idtr);
2183	bs3CpuBasic2_sidt_sgdt_Common(bMode, g_aSidtWorkers, RT_ELEMENTS(g_aSidtWorkers), Expected.ab);
2184
2185	/*
2186	* Re-initialize the IDT.
2187	*/
2188	Bs3TrapInit();
2189	}
2190
2191	return 0;
2192	}
2193
2194
2195	BS3_DECL_FAR(uint8_t) TMPL_NM(bs3CpuBasic2_sgdt)(uint8_t bMode)
2196	{
2197	union
2198	{
2199	RTGDTR Gdtr;
2200	uint8_t ab[16];
2201	} Expected;
2202
2203	g_pszTestMode = TMPL_NM(g_szBs3ModeName);
2204	g_bTestMode = bMode;
2205	g_f16BitSys = BS3_MODE_IS_16BIT_SYS(TMPL_MODE);
2206
2207	BS3_ASSERT(bMode == TMPL_MODE);
2208
2209	/*
2210	* Pass to common worker which is only compiled once per mode.
2211	*/
2212	Bs3MemZero(&Expected, sizeof(Expected));
2213	ASMGetGDTR(&Expected.Gdtr);
2214	bs3CpuBasic2_sidt_sgdt_Common(bMode, g_aSgdtWorkers, RT_ELEMENTS(g_aSgdtWorkers), Expected.ab);
2215
2216	/*
2217	* Re-initialize the IDT.
2218	*/
2219	Bs3TrapInit();
2220	return 0;
2221	}
2222
2223	#endif /* BS3_INSTANTIATING_MODE */
2224

Note: See TracBrowser for help on using the repository browser.

source: vbox/trunk/src/VBox/ValidationKit/bootsectors/bs3-cpu-basic-2-template.c@ 60680

Download in other formats: