bs3-cpu-basic-2-x0.c@ 89932

Last change on this file since 89932 was 89932, checked in by vboxsync, 4 years ago
bs3-cpu-basic-2: Added an alignment check testcase. bugref:10052
Property svn:eol-style set to `native` Property svn:keywords set to `Author Date Id Revision`
File size: 159.0 KB

Line
1	/* $Id: bs3-cpu-basic-2-x0.c 89932 2021-06-28 14:15:23Z vboxsync $ */
2	/** @file
3	* BS3Kit - bs3-cpu-basic-2, C test driver code (16-bit).
4	*/
5
6	/*
7	* Copyright (C) 2007-2020 Oracle Corporation
8	*
9	* This file is part of VirtualBox Open Source Edition (OSE), as
10	* available from http://www.virtualbox.org. This file is free software;
11	* you can redistribute it and/or modify it under the terms of the GNU
12	* General Public License (GPL) as published by the Free Software
13	* Foundation, in version 2 as it comes in the "COPYING" file of the
14	* VirtualBox OSE distribution. VirtualBox OSE is distributed in the
15	* hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
16	*
17	* The contents of this file may alternatively be used under the terms
18	* of the Common Development and Distribution License Version 1.0
19	* (CDDL) only, as it comes in the "COPYING.CDDL" file of the
20	* VirtualBox OSE distribution, in which case the provisions of the
21	* CDDL are applicable instead of those of the GPL.
22	*
23	* You may elect to license modified versions of this file under the
24	* terms and conditions of either the GPL or the CDDL or both.
25	*/
26
27
28	/*********************************************************************************************************************************
29	* Header Files *
30	*********************************************************************************************************************************/
31	#define BS3_USE_X0_TEXT_SEG
32	#include <bs3kit.h>
33	#include <iprt/asm.h>
34	#include <iprt/asm-amd64-x86.h>
35
36
37	/*********************************************************************************************************************************
38	* Defined Constants And Macros *
39	*********************************************************************************************************************************/
40	#undef CHECK_MEMBER
41	#define CHECK_MEMBER(a_szName, a_szFmt, a_Actual, a_Expected) \
42	do \
43	{ \
44	if ((a_Actual) == (a_Expected)) { /* likely */ } \
45	else bs3CpuBasic2_FailedF(a_szName "=" a_szFmt " expected " a_szFmt, (a_Actual), (a_Expected)); \
46	} while (0)
47
48
49	/** Indicating that we've got operand size prefix and that it matters. */
50	#define BS3CB2SIDTSGDT_F_OPSIZE UINT8_C(0x01)
51	/** Worker requires 386 or later. */
52	#define BS3CB2SIDTSGDT_F_386PLUS UINT8_C(0x02)
53
54
55	/** @name MYOP_XXX - Values for FNBS3CPUBASIC2ACTSTCODE::fOp.
56	* @{ */
57	#define MYOP_LD 0x1
58	#define MYOP_ST 0x2
59	#define MYOP_LD_ST 0x3
60	#define MYOP_EFL 0x4
61	#define MYOP_LD_DIV 0x5
62	/** @} */
63
64
65	/*********************************************************************************************************************************
66	* Structures and Typedefs *
67	*********************************************************************************************************************************/
68	typedef struct BS3CB2INVLDESCTYPE
69	{
70	uint8_t u4Type;
71	uint8_t u1DescType;
72	} BS3CB2INVLDESCTYPE;
73
74	typedef struct BS3CB2SIDTSGDT
75	{
76	const char *pszDesc;
77	FPFNBS3FAR fpfnWorker;
78	uint8_t cbInstr;
79	bool fSs;
80	uint8_t bMode;
81	uint8_t fFlags;
82	} BS3CB2SIDTSGDT;
83
84
85	typedef void BS3_CALL FNBS3CPUBASIC2ACSNIPPET(void);
86
87	typedef struct FNBS3CPUBASIC2ACTSTCODE
88	{
89	FNBS3CPUBASIC2ACSNIPPET BS3_FAR *pfn;
90	uint8_t fOp;
91	uint8_t cbMem;
92	} FNBS3CPUBASIC2ACTSTCODE;
93	typedef FNBS3CPUBASIC2ACTSTCODE const *PCFNBS3CPUBASIC2ACTSTCODE;
94
95	typedef struct BS3CPUBASIC2ACTTSTCMNMODE
96	{
97	uint8_t bMode;
98	uint16_t cEntries;
99	PCFNBS3CPUBASIC2ACTSTCODE paEntries;
100	} BS3CPUBASIC2PFTTSTCMNMODE;
101	typedef BS3CPUBASIC2PFTTSTCMNMODE const *PCBS3CPUBASIC2PFTTSTCMNMODE;
102
103
104	/*********************************************************************************************************************************
105	* External Symbols *
106	*********************************************************************************************************************************/
107	extern FNBS3FAR bs3CpuBasic2_Int80;
108	extern FNBS3FAR bs3CpuBasic2_Int81;
109	extern FNBS3FAR bs3CpuBasic2_Int82;
110	extern FNBS3FAR bs3CpuBasic2_Int83;
111
112	extern FNBS3FAR bs3CpuBasic2_ud2;
113	#define g_bs3CpuBasic2_ud2_FlatAddr BS3_DATA_NM(g_bs3CpuBasic2_ud2_FlatAddr)
114	extern uint32_t g_bs3CpuBasic2_ud2_FlatAddr;
115
116	extern FNBS3FAR bs3CpuBasic2_iret;
117	extern FNBS3FAR bs3CpuBasic2_iret_opsize;
118	extern FNBS3FAR bs3CpuBasic2_iret_rexw;
119
120	extern FNBS3FAR bs3CpuBasic2_sidt_bx_ud2_c16;
121	extern FNBS3FAR bs3CpuBasic2_sidt_bx_ud2_c32;
122	extern FNBS3FAR bs3CpuBasic2_sidt_bx_ud2_c64;
123	extern FNBS3FAR bs3CpuBasic2_sidt_ss_bx_ud2_c16;
124	extern FNBS3FAR bs3CpuBasic2_sidt_ss_bx_ud2_c32;
125	extern FNBS3FAR bs3CpuBasic2_sidt_rexw_bx_ud2_c64;
126	extern FNBS3FAR bs3CpuBasic2_sidt_opsize_bx_ud2_c16;
127	extern FNBS3FAR bs3CpuBasic2_sidt_opsize_bx_ud2_c32;
128	extern FNBS3FAR bs3CpuBasic2_sidt_opsize_bx_ud2_c64;
129	extern FNBS3FAR bs3CpuBasic2_sidt_opsize_ss_bx_ud2_c16;
130	extern FNBS3FAR bs3CpuBasic2_sidt_opsize_ss_bx_ud2_c32;
131	extern FNBS3FAR bs3CpuBasic2_sidt_opsize_rexw_bx_ud2_c64;
132
133	extern FNBS3FAR bs3CpuBasic2_sgdt_bx_ud2_c16;
134	extern FNBS3FAR bs3CpuBasic2_sgdt_bx_ud2_c32;
135	extern FNBS3FAR bs3CpuBasic2_sgdt_bx_ud2_c64;
136	extern FNBS3FAR bs3CpuBasic2_sgdt_ss_bx_ud2_c16;
137	extern FNBS3FAR bs3CpuBasic2_sgdt_ss_bx_ud2_c32;
138	extern FNBS3FAR bs3CpuBasic2_sgdt_rexw_bx_ud2_c64;
139	extern FNBS3FAR bs3CpuBasic2_sgdt_opsize_bx_ud2_c16;
140	extern FNBS3FAR bs3CpuBasic2_sgdt_opsize_bx_ud2_c32;
141	extern FNBS3FAR bs3CpuBasic2_sgdt_opsize_bx_ud2_c64;
142	extern FNBS3FAR bs3CpuBasic2_sgdt_opsize_ss_bx_ud2_c16;
143	extern FNBS3FAR bs3CpuBasic2_sgdt_opsize_ss_bx_ud2_c32;
144	extern FNBS3FAR bs3CpuBasic2_sgdt_opsize_rexw_bx_ud2_c64;
145
146	extern FNBS3FAR bs3CpuBasic2_lidt_bx__sidt_es_di__lidt_es_si__ud2_c16;
147	extern FNBS3FAR bs3CpuBasic2_lidt_bx__sidt_es_di__lidt_es_si__ud2_c32;
148	extern FNBS3FAR bs3CpuBasic2_lidt_bx__sidt_es_di__lidt_es_si__ud2_c64;
149	extern FNBS3FAR bs3CpuBasic2_lidt_ss_bx__sidt_es_di__lidt_es_si__ud2_c16;
150	extern FNBS3FAR bs3CpuBasic2_lidt_ss_bx__sidt_es_di__lidt_es_si__ud2_c32;
151	extern FNBS3FAR bs3CpuBasic2_lidt_rexw_bx__sidt_es_di__lidt_es_si__ud2_c64;
152	extern FNBS3FAR bs3CpuBasic2_lidt_opsize_bx__sidt_es_di__lidt_es_si__ud2_c16;
153	extern FNBS3FAR bs3CpuBasic2_lidt_opsize_bx__sidt32_es_di__lidt_es_si__ud2_c16;
154	extern FNBS3FAR bs3CpuBasic2_lidt_opsize_bx__sidt_es_di__lidt_es_si__ud2_c32;
155	extern FNBS3FAR bs3CpuBasic2_lidt_opsize_bx__sidt_es_di__lidt_es_si__ud2_c64;
156	extern FNBS3FAR bs3CpuBasic2_lidt_opsize_ss_bx__sidt_es_di__lidt_es_si__ud2_c16;
157	extern FNBS3FAR bs3CpuBasic2_lidt_opsize_ss_bx__sidt_es_di__lidt_es_si__ud2_c32;
158	extern FNBS3FAR bs3CpuBasic2_lidt_opsize_rexw_bx__sidt_es_di__lidt_es_si__ud2_c64;
159
160	extern FNBS3FAR bs3CpuBasic2_lgdt_bx__sgdt_es_di__lgdt_es_si__ud2_c16;
161	extern FNBS3FAR bs3CpuBasic2_lgdt_bx__sgdt_es_di__lgdt_es_si__ud2_c32;
162	extern FNBS3FAR bs3CpuBasic2_lgdt_bx__sgdt_es_di__lgdt_es_si__ud2_c64;
163	extern FNBS3FAR bs3CpuBasic2_lgdt_ss_bx__sgdt_es_di__lgdt_es_si__ud2_c16;
164	extern FNBS3FAR bs3CpuBasic2_lgdt_ss_bx__sgdt_es_di__lgdt_es_si__ud2_c32;
165	extern FNBS3FAR bs3CpuBasic2_lgdt_rexw_bx__sgdt_es_di__lgdt_es_si__ud2_c64;
166	extern FNBS3FAR bs3CpuBasic2_lgdt_opsize_bx__sgdt_es_di__lgdt_es_si__ud2_c16;
167	extern FNBS3FAR bs3CpuBasic2_lgdt_opsize_bx__sgdt_es_di__lgdt_es_si__ud2_c32;
168	extern FNBS3FAR bs3CpuBasic2_lgdt_opsize_bx__sgdt_es_di__lgdt_es_si__ud2_c64;
169	extern FNBS3FAR bs3CpuBasic2_lgdt_opsize_ss_bx__sgdt_es_di__lgdt_es_si__ud2_c16;
170	extern FNBS3FAR bs3CpuBasic2_lgdt_opsize_ss_bx__sgdt_es_di__lgdt_es_si__ud2_c32;
171	extern FNBS3FAR bs3CpuBasic2_lgdt_opsize_rexw_bx__sgdt_es_di__lgdt_es_si__ud2_c64;
172
173
174	/* bs3-cpu-basic-2-template.mac: */
175	FNBS3CPUBASIC2ACSNIPPET bs3CpuBasic2_mov_ax_ds_bx__ud2_c16;
176	FNBS3CPUBASIC2ACSNIPPET bs3CpuBasic2_mov_ds_bx_ax__ud2_c16;
177	FNBS3CPUBASIC2ACSNIPPET bs3CpuBasic2_xchg_ds_bx_ax__ud2_c16;
178	FNBS3CPUBASIC2ACSNIPPET bs3CpuBasic2_cmpxchg_ds_bx_cx__ud2_c16;
179	FNBS3CPUBASIC2ACSNIPPET bs3CpuBasic2_div_ds_bx__ud2_c16;
180
181	FNBS3CPUBASIC2ACSNIPPET bs3CpuBasic2_mov_ax_ds_bx__ud2_c32;
182	FNBS3CPUBASIC2ACSNIPPET bs3CpuBasic2_mov_ds_bx_ax__ud2_c32;
183	FNBS3CPUBASIC2ACSNIPPET bs3CpuBasic2_xchg_ds_bx_ax__ud2_c32;
184	FNBS3CPUBASIC2ACSNIPPET bs3CpuBasic2_cmpxchg_ds_bx_cx__ud2_c32;
185	FNBS3CPUBASIC2ACSNIPPET bs3CpuBasic2_div_ds_bx__ud2_c32;
186
187	FNBS3CPUBASIC2ACSNIPPET bs3CpuBasic2_mov_ax_ds_bx__ud2_c64;
188	FNBS3CPUBASIC2ACSNIPPET bs3CpuBasic2_mov_ds_bx_ax__ud2_c64;
189	FNBS3CPUBASIC2ACSNIPPET bs3CpuBasic2_xchg_ds_bx_ax__ud2_c64;
190	FNBS3CPUBASIC2ACSNIPPET bs3CpuBasic2_cmpxchg_ds_bx_cx__ud2_c64;
191	FNBS3CPUBASIC2ACSNIPPET bs3CpuBasic2_div_ds_bx__ud2_c64;
192
193
194	/*********************************************************************************************************************************
195	* Global Variables *
196	*********************************************************************************************************************************/
197	static const char BS3_FAR g_pszTestMode = (const char )1;
198	static uint8_t g_bTestMode = 1;
199	static bool g_f16BitSys = 1;
200
201
202	/** SIDT test workers. */
203	static BS3CB2SIDTSGDT const g_aSidtWorkers[] =
204	{
205	{ "sidt [bx]", bs3CpuBasic2_sidt_bx_ud2_c16, 3, false, BS3_MODE_CODE_16 \| BS3_MODE_CODE_V86, 0 },
206	{ "sidt [ss:bx]", bs3CpuBasic2_sidt_ss_bx_ud2_c16, 4, true, BS3_MODE_CODE_16 \| BS3_MODE_CODE_V86, 0 },
207	{ "o32 sidt [bx]", bs3CpuBasic2_sidt_opsize_bx_ud2_c16, 4, false, BS3_MODE_CODE_16 \| BS3_MODE_CODE_V86, BS3CB2SIDTSGDT_F_386PLUS },
208	{ "o32 sidt [ss:bx]", bs3CpuBasic2_sidt_opsize_ss_bx_ud2_c16, 5, true, BS3_MODE_CODE_16 \| BS3_MODE_CODE_V86, BS3CB2SIDTSGDT_F_386PLUS },
209	{ "sidt [ebx]", bs3CpuBasic2_sidt_bx_ud2_c32, 3, false, BS3_MODE_CODE_32, 0 },
210	{ "sidt [ss:ebx]", bs3CpuBasic2_sidt_ss_bx_ud2_c32, 4, true, BS3_MODE_CODE_32, 0 },
211	{ "o16 sidt [ebx]", bs3CpuBasic2_sidt_opsize_bx_ud2_c32, 4, false, BS3_MODE_CODE_32, 0 },
212	{ "o16 sidt [ss:ebx]", bs3CpuBasic2_sidt_opsize_ss_bx_ud2_c32, 5, true, BS3_MODE_CODE_32, 0 },
213	{ "sidt [rbx]", bs3CpuBasic2_sidt_bx_ud2_c64, 3, false, BS3_MODE_CODE_64, 0 },
214	{ "o64 sidt [rbx]", bs3CpuBasic2_sidt_rexw_bx_ud2_c64, 4, false, BS3_MODE_CODE_64, 0 },
215	{ "o32 sidt [rbx]", bs3CpuBasic2_sidt_opsize_bx_ud2_c64, 4, false, BS3_MODE_CODE_64, 0 },
216	{ "o32 o64 sidt [rbx]", bs3CpuBasic2_sidt_opsize_rexw_bx_ud2_c64, 5, false, BS3_MODE_CODE_64, 0 },
217	};
218
219	/** SGDT test workers. */
220	static BS3CB2SIDTSGDT const g_aSgdtWorkers[] =
221	{
222	{ "sgdt [bx]", bs3CpuBasic2_sgdt_bx_ud2_c16, 3, false, BS3_MODE_CODE_16 \| BS3_MODE_CODE_V86, 0 },
223	{ "sgdt [ss:bx]", bs3CpuBasic2_sgdt_ss_bx_ud2_c16, 4, true, BS3_MODE_CODE_16 \| BS3_MODE_CODE_V86, 0 },
224	{ "o32 sgdt [bx]", bs3CpuBasic2_sgdt_opsize_bx_ud2_c16, 4, false, BS3_MODE_CODE_16 \| BS3_MODE_CODE_V86, BS3CB2SIDTSGDT_F_386PLUS },
225	{ "o32 sgdt [ss:bx]", bs3CpuBasic2_sgdt_opsize_ss_bx_ud2_c16, 5, true, BS3_MODE_CODE_16 \| BS3_MODE_CODE_V86, BS3CB2SIDTSGDT_F_386PLUS },
226	{ "sgdt [ebx]", bs3CpuBasic2_sgdt_bx_ud2_c32, 3, false, BS3_MODE_CODE_32, 0 },
227	{ "sgdt [ss:ebx]", bs3CpuBasic2_sgdt_ss_bx_ud2_c32, 4, true, BS3_MODE_CODE_32, 0 },
228	{ "o16 sgdt [ebx]", bs3CpuBasic2_sgdt_opsize_bx_ud2_c32, 4, false, BS3_MODE_CODE_32, 0 },
229	{ "o16 sgdt [ss:ebx]", bs3CpuBasic2_sgdt_opsize_ss_bx_ud2_c32, 5, true, BS3_MODE_CODE_32, 0 },
230	{ "sgdt [rbx]", bs3CpuBasic2_sgdt_bx_ud2_c64, 3, false, BS3_MODE_CODE_64, 0 },
231	{ "o64 sgdt [rbx]", bs3CpuBasic2_sgdt_rexw_bx_ud2_c64, 4, false, BS3_MODE_CODE_64, 0 },
232	{ "o32 sgdt [rbx]", bs3CpuBasic2_sgdt_opsize_bx_ud2_c64, 4, false, BS3_MODE_CODE_64, 0 },
233	{ "o32 o64 sgdt [rbx]", bs3CpuBasic2_sgdt_opsize_rexw_bx_ud2_c64, 5, false, BS3_MODE_CODE_64, 0 },
234	};
235
236	/** LIDT test workers. */
237	static BS3CB2SIDTSGDT const g_aLidtWorkers[] =
238	{
239	{ "lidt [bx]", bs3CpuBasic2_lidt_bx__sidt_es_di__lidt_es_si__ud2_c16, 11, false, BS3_MODE_CODE_16 \| BS3_MODE_CODE_V86, 0 },
240	{ "lidt [ss:bx]", bs3CpuBasic2_lidt_ss_bx__sidt_es_di__lidt_es_si__ud2_c16, 12, true, BS3_MODE_CODE_16 \| BS3_MODE_CODE_V86, 0 },
241	{ "o32 lidt [bx]", bs3CpuBasic2_lidt_opsize_bx__sidt_es_di__lidt_es_si__ud2_c16, 12, false, BS3_MODE_CODE_16 \| BS3_MODE_CODE_V86, BS3CB2SIDTSGDT_F_OPSIZE \| BS3CB2SIDTSGDT_F_386PLUS },
242	{ "o32 lidt [bx]; sidt32", bs3CpuBasic2_lidt_opsize_bx__sidt32_es_di__lidt_es_si__ud2_c16, 27, false, BS3_MODE_CODE_16 \| BS3_MODE_CODE_V86, BS3CB2SIDTSGDT_F_OPSIZE \| BS3CB2SIDTSGDT_F_386PLUS },
243	{ "o32 lidt [ss:bx]", bs3CpuBasic2_lidt_opsize_ss_bx__sidt_es_di__lidt_es_si__ud2_c16, 13, true, BS3_MODE_CODE_16 \| BS3_MODE_CODE_V86, BS3CB2SIDTSGDT_F_OPSIZE \| BS3CB2SIDTSGDT_F_386PLUS },
244	{ "lidt [ebx]", bs3CpuBasic2_lidt_bx__sidt_es_di__lidt_es_si__ud2_c32, 11, false, BS3_MODE_CODE_32, 0 },
245	{ "lidt [ss:ebx]", bs3CpuBasic2_lidt_ss_bx__sidt_es_di__lidt_es_si__ud2_c32, 12, true, BS3_MODE_CODE_32, 0 },
246	{ "o16 lidt [ebx]", bs3CpuBasic2_lidt_opsize_bx__sidt_es_di__lidt_es_si__ud2_c32, 12, false, BS3_MODE_CODE_32, BS3CB2SIDTSGDT_F_OPSIZE },
247	{ "o16 lidt [ss:ebx]", bs3CpuBasic2_lidt_opsize_ss_bx__sidt_es_di__lidt_es_si__ud2_c32, 13, true, BS3_MODE_CODE_32, BS3CB2SIDTSGDT_F_OPSIZE },
248	{ "lidt [rbx]", bs3CpuBasic2_lidt_bx__sidt_es_di__lidt_es_si__ud2_c64, 9, false, BS3_MODE_CODE_64, 0 },
249	{ "o64 lidt [rbx]", bs3CpuBasic2_lidt_rexw_bx__sidt_es_di__lidt_es_si__ud2_c64, 10, false, BS3_MODE_CODE_64, 0 },
250	{ "o32 lidt [rbx]", bs3CpuBasic2_lidt_opsize_bx__sidt_es_di__lidt_es_si__ud2_c64, 10, false, BS3_MODE_CODE_64, 0 },
251	{ "o32 o64 lidt [rbx]", bs3CpuBasic2_lidt_opsize_rexw_bx__sidt_es_di__lidt_es_si__ud2_c64, 11, false, BS3_MODE_CODE_64, 0 },
252	};
253
254	/** LGDT test workers. */
255	static BS3CB2SIDTSGDT const g_aLgdtWorkers[] =
256	{
257	{ "lgdt [bx]", bs3CpuBasic2_lgdt_bx__sgdt_es_di__lgdt_es_si__ud2_c16, 11, false, BS3_MODE_CODE_16 \| BS3_MODE_CODE_V86, 0 },
258	{ "lgdt [ss:bx]", bs3CpuBasic2_lgdt_ss_bx__sgdt_es_di__lgdt_es_si__ud2_c16, 12, true, BS3_MODE_CODE_16 \| BS3_MODE_CODE_V86, 0 },
259	{ "o32 lgdt [bx]", bs3CpuBasic2_lgdt_opsize_bx__sgdt_es_di__lgdt_es_si__ud2_c16, 12, false, BS3_MODE_CODE_16 \| BS3_MODE_CODE_V86, BS3CB2SIDTSGDT_F_OPSIZE \| BS3CB2SIDTSGDT_F_386PLUS },
260	{ "o32 lgdt [ss:bx]", bs3CpuBasic2_lgdt_opsize_ss_bx__sgdt_es_di__lgdt_es_si__ud2_c16, 13, true, BS3_MODE_CODE_16 \| BS3_MODE_CODE_V86, BS3CB2SIDTSGDT_F_OPSIZE \| BS3CB2SIDTSGDT_F_386PLUS },
261	{ "lgdt [ebx]", bs3CpuBasic2_lgdt_bx__sgdt_es_di__lgdt_es_si__ud2_c32, 11, false, BS3_MODE_CODE_32, 0 },
262	{ "lgdt [ss:ebx]", bs3CpuBasic2_lgdt_ss_bx__sgdt_es_di__lgdt_es_si__ud2_c32, 12, true, BS3_MODE_CODE_32, 0 },
263	{ "o16 lgdt [ebx]", bs3CpuBasic2_lgdt_opsize_bx__sgdt_es_di__lgdt_es_si__ud2_c32, 12, false, BS3_MODE_CODE_32, BS3CB2SIDTSGDT_F_OPSIZE },
264	{ "o16 lgdt [ss:ebx]", bs3CpuBasic2_lgdt_opsize_ss_bx__sgdt_es_di__lgdt_es_si__ud2_c32, 13, true, BS3_MODE_CODE_32, BS3CB2SIDTSGDT_F_OPSIZE },
265	{ "lgdt [rbx]", bs3CpuBasic2_lgdt_bx__sgdt_es_di__lgdt_es_si__ud2_c64, 9, false, BS3_MODE_CODE_64, 0 },
266	{ "o64 lgdt [rbx]", bs3CpuBasic2_lgdt_rexw_bx__sgdt_es_di__lgdt_es_si__ud2_c64, 10, false, BS3_MODE_CODE_64, 0 },
267	{ "o32 lgdt [rbx]", bs3CpuBasic2_lgdt_opsize_bx__sgdt_es_di__lgdt_es_si__ud2_c64, 10, false, BS3_MODE_CODE_64, 0 },
268	{ "o32 o64 lgdt [rbx]", bs3CpuBasic2_lgdt_opsize_rexw_bx__sgdt_es_di__lgdt_es_si__ud2_c64, 11, false, BS3_MODE_CODE_64, 0 },
269	};
270
271
272
273	#if 0
274	/** Table containing invalid CS selector types. */
275	static const BS3CB2INVLDESCTYPE g_aInvalidCsTypes[] =
276	{
277	{ X86_SEL_TYPE_RO, 1 },
278	{ X86_SEL_TYPE_RO_ACC, 1 },
279	{ X86_SEL_TYPE_RW, 1 },
280	{ X86_SEL_TYPE_RW_ACC, 1 },
281	{ X86_SEL_TYPE_RO_DOWN, 1 },
282	{ X86_SEL_TYPE_RO_DOWN_ACC, 1 },
283	{ X86_SEL_TYPE_RW_DOWN, 1 },
284	{ X86_SEL_TYPE_RW_DOWN_ACC, 1 },
285	{ 0, 0 },
286	{ 1, 0 },
287	{ 2, 0 },
288	{ 3, 0 },
289	{ 4, 0 },
290	{ 5, 0 },
291	{ 6, 0 },
292	{ 7, 0 },
293	{ 8, 0 },
294	{ 9, 0 },
295	{ 10, 0 },
296	{ 11, 0 },
297	{ 12, 0 },
298	{ 13, 0 },
299	{ 14, 0 },
300	{ 15, 0 },
301	};
302
303	/** Table containing invalid SS selector types. */
304	static const BS3CB2INVLDESCTYPE g_aInvalidSsTypes[] =
305	{
306	{ X86_SEL_TYPE_EO, 1 },
307	{ X86_SEL_TYPE_EO_ACC, 1 },
308	{ X86_SEL_TYPE_ER, 1 },
309	{ X86_SEL_TYPE_ER_ACC, 1 },
310	{ X86_SEL_TYPE_EO_CONF, 1 },
311	{ X86_SEL_TYPE_EO_CONF_ACC, 1 },
312	{ X86_SEL_TYPE_ER_CONF, 1 },
313	{ X86_SEL_TYPE_ER_CONF_ACC, 1 },
314	{ 0, 0 },
315	{ 1, 0 },
316	{ 2, 0 },
317	{ 3, 0 },
318	{ 4, 0 },
319	{ 5, 0 },
320	{ 6, 0 },
321	{ 7, 0 },
322	{ 8, 0 },
323	{ 9, 0 },
324	{ 10, 0 },
325	{ 11, 0 },
326	{ 12, 0 },
327	{ 13, 0 },
328	{ 14, 0 },
329	{ 15, 0 },
330	};
331	#endif
332
333
334	static const FNBS3CPUBASIC2ACTSTCODE g_aCmn16[] =
335	{
336	{ bs3CpuBasic2_mov_ax_ds_bx__ud2_c16, MYOP_LD, 2 },
337	{ bs3CpuBasic2_mov_ds_bx_ax__ud2_c16, MYOP_ST, 2 },
338	{ bs3CpuBasic2_xchg_ds_bx_ax__ud2_c16, MYOP_LD_ST, 2 },
339	{ bs3CpuBasic2_cmpxchg_ds_bx_cx__ud2_c16, MYOP_LD_ST \| MYOP_EFL, 2 },
340	{ bs3CpuBasic2_div_ds_bx__ud2_c16, MYOP_LD_DIV, 2 },
341	};
342
343	static const FNBS3CPUBASIC2ACTSTCODE g_aCmn32[] =
344	{
345	{ bs3CpuBasic2_mov_ax_ds_bx__ud2_c32, MYOP_LD, 4 },
346	{ bs3CpuBasic2_mov_ds_bx_ax__ud2_c32, MYOP_ST, 4 },
347	{ bs3CpuBasic2_xchg_ds_bx_ax__ud2_c32, MYOP_LD_ST, 4 },
348	{ bs3CpuBasic2_cmpxchg_ds_bx_cx__ud2_c32, MYOP_LD_ST \| MYOP_EFL, 4 },
349	{ bs3CpuBasic2_div_ds_bx__ud2_c32, MYOP_LD_DIV, 4 },
350	};
351
352	static const FNBS3CPUBASIC2ACTSTCODE g_aCmn64[] =
353	{
354	{ bs3CpuBasic2_mov_ax_ds_bx__ud2_c64, MYOP_LD, 8 },
355	{ bs3CpuBasic2_mov_ds_bx_ax__ud2_c64, MYOP_ST, 8 },
356	{ bs3CpuBasic2_xchg_ds_bx_ax__ud2_c64, MYOP_LD_ST, 8 },
357	{ bs3CpuBasic2_cmpxchg_ds_bx_cx__ud2_c64, MYOP_LD_ST \| MYOP_EFL, 8 },
358	{ bs3CpuBasic2_div_ds_bx__ud2_c64, MYOP_LD_DIV, 8 },
359	};
360
361	static const BS3CPUBASIC2PFTTSTCMNMODE g_aCmnModes[] =
362	{
363	{ BS3_MODE_CODE_16, RT_ELEMENTS(g_aCmn16), g_aCmn16 },
364	{ BS3_MODE_CODE_V86, RT_ELEMENTS(g_aCmn16), g_aCmn16 },
365	{ BS3_MODE_CODE_32, RT_ELEMENTS(g_aCmn32), g_aCmn32 },
366	{ BS3_MODE_CODE_64, RT_ELEMENTS(g_aCmn64), g_aCmn64 },
367	};
368
369
370	/**
371	* Sets globals according to the mode.
372	*
373	* @param bTestMode The test mode.
374	*/
375	static void bs3CpuBasic2_SetGlobals(uint8_t bTestMode)
376	{
377	g_bTestMode = bTestMode;
378	g_pszTestMode = Bs3GetModeName(bTestMode);
379	g_f16BitSys = BS3_MODE_IS_16BIT_SYS(bTestMode);
380	g_usBs3TestStep = 0;
381	}
382
383
384	/**
385	* Wrapper around Bs3TestFailedF that prefixes the error with g_usBs3TestStep
386	* and g_pszTestMode.
387	*/
388	static void bs3CpuBasic2_FailedF(const char *pszFormat, ...)
389	{
390	va_list va;
391
392	char szTmp[168];
393	va_start(va, pszFormat);
394	Bs3StrPrintfV(szTmp, sizeof(szTmp), pszFormat, va);
395	va_end(va);
396
397	Bs3TestFailedF("%u - %s: %s", g_usBs3TestStep, g_pszTestMode, szTmp);
398	}
399
400
401	#if 0
402	/**
403	* Compares trap stuff.
404	*/
405	static void bs3CpuBasic2_CompareIntCtx1(PCBS3TRAPFRAME pTrapCtx, PCBS3REGCTX pStartCtx, uint8_t bXcpt)
406	{
407	uint16_t const cErrorsBefore = Bs3TestSubErrorCount();
408	CHECK_MEMBER("bXcpt", "%#04x", pTrapCtx->bXcpt, bXcpt);
409	CHECK_MEMBER("bErrCd", "%#06RX64", pTrapCtx->uErrCd, 0);
410	Bs3TestCheckRegCtxEx(&pTrapCtx->Ctx, pStartCtx, 2 /int xx/, 0 /cbSpAdjust/, 0 /fExtraEfl/, g_pszTestMode, g_usBs3TestStep);
411	if (Bs3TestSubErrorCount() != cErrorsBefore)
412	{
413	Bs3TrapPrintFrame(pTrapCtx);
414	#if 1
415	Bs3TestPrintf("Halting: g_uBs3CpuDetected=%#x\n", g_uBs3CpuDetected);
416	Bs3TestPrintf("Halting in CompareTrapCtx1: bXcpt=%#x\n", bXcpt);
417	ASMHalt();
418	#endif
419	}
420	}
421	#endif
422
423
424	#if 0
425	/**
426	* Compares trap stuff.
427	*/
428	static void bs3CpuBasic2_CompareTrapCtx2(PCBS3TRAPFRAME pTrapCtx, PCBS3REGCTX pStartCtx, uint16_t cbIpAdjust,
429	uint8_t bXcpt, uint16_t uHandlerCs)
430	{
431	uint16_t const cErrorsBefore = Bs3TestSubErrorCount();
432	CHECK_MEMBER("bXcpt", "%#04x", pTrapCtx->bXcpt, bXcpt);
433	CHECK_MEMBER("bErrCd", "%#06RX64", pTrapCtx->uErrCd, 0);
434	CHECK_MEMBER("uHandlerCs", "%#06x", pTrapCtx->uHandlerCs, uHandlerCs);
435	Bs3TestCheckRegCtxEx(&pTrapCtx->Ctx, pStartCtx, cbIpAdjust, 0 /cbSpAdjust/, 0 /fExtraEfl/, g_pszTestMode, g_usBs3TestStep);
436	if (Bs3TestSubErrorCount() != cErrorsBefore)
437	{
438	Bs3TrapPrintFrame(pTrapCtx);
439	#if 1
440	Bs3TestPrintf("Halting: g_uBs3CpuDetected=%#x\n", g_uBs3CpuDetected);
441	Bs3TestPrintf("Halting in CompareTrapCtx2: bXcpt=%#x\n", bXcpt);
442	ASMHalt();
443	#endif
444	}
445	}
446	#endif
447
448	/**
449	* Compares a CPU trap.
450	*/
451	static void bs3CpuBasic2_CompareCpuTrapCtx(PCBS3TRAPFRAME pTrapCtx, PCBS3REGCTX pStartCtx, uint16_t uErrCd,
452	uint8_t bXcpt, bool f486ResumeFlagHint)
453	{
454	uint16_t const cErrorsBefore = Bs3TestSubErrorCount();
455	uint32_t fExtraEfl;
456
457	CHECK_MEMBER("bXcpt", "%#04x", pTrapCtx->bXcpt, bXcpt);
458	CHECK_MEMBER("bErrCd", "%#06RX16", (uint16_t)pTrapCtx->uErrCd, (uint16_t)uErrCd); /* 486 only writes a word */
459
460	fExtraEfl = X86_EFL_RF;
461	if ( g_f16BitSys
462	\|\| ( !f486ResumeFlagHint
463	&& (g_uBs3CpuDetected & BS3CPU_TYPE_MASK) <= BS3CPU_80486 ) )
464	fExtraEfl = 0;
465	else
466	fExtraEfl = X86_EFL_RF;
467	#if 0 /** @todo Running on an AMD Phenom II X6 1100T under AMD-V I'm not getting good X86_EFL_RF results. Enable this to get on with other work. */
468	fExtraEfl = pTrapCtx->Ctx.rflags.u32 & X86_EFL_RF;
469	#endif
470	Bs3TestCheckRegCtxEx(&pTrapCtx->Ctx, pStartCtx, 0 /cbIpAdjust/, 0 /cbSpAdjust/, fExtraEfl, g_pszTestMode, g_usBs3TestStep);
471	if (Bs3TestSubErrorCount() != cErrorsBefore)
472	{
473	Bs3TrapPrintFrame(pTrapCtx);
474	#if 1
475	Bs3TestPrintf("Halting: g_uBs3CpuDetected=%#x\n", g_uBs3CpuDetected);
476	Bs3TestPrintf("Halting: bXcpt=%#x uErrCd=%#x\n", bXcpt, uErrCd);
477	ASMHalt();
478	#endif
479	}
480	}
481
482
483	/**
484	* Compares \#GP trap.
485	*/
486	static void bs3CpuBasic2_CompareGpCtx(PCBS3TRAPFRAME pTrapCtx, PCBS3REGCTX pStartCtx, uint16_t uErrCd)
487	{
488	bs3CpuBasic2_CompareCpuTrapCtx(pTrapCtx, pStartCtx, uErrCd, X86_XCPT_GP, true /f486ResumeFlagHint/);
489	}
490
491	#if 0
492	/**
493	* Compares \#NP trap.
494	*/
495	static void bs3CpuBasic2_CompareNpCtx(PCBS3TRAPFRAME pTrapCtx, PCBS3REGCTX pStartCtx, uint16_t uErrCd)
496	{
497	bs3CpuBasic2_CompareCpuTrapCtx(pTrapCtx, pStartCtx, uErrCd, X86_XCPT_NP, true /f486ResumeFlagHint/);
498	}
499	#endif
500
501	/**
502	* Compares \#SS trap.
503	*/
504	static void bs3CpuBasic2_CompareSsCtx(PCBS3TRAPFRAME pTrapCtx, PCBS3REGCTX pStartCtx, uint16_t uErrCd, bool f486ResumeFlagHint)
505	{
506	bs3CpuBasic2_CompareCpuTrapCtx(pTrapCtx, pStartCtx, uErrCd, X86_XCPT_SS, f486ResumeFlagHint);
507	}
508
509	#if 0
510	/**
511	* Compares \#TS trap.
512	*/
513	static void bs3CpuBasic2_CompareTsCtx(PCBS3TRAPFRAME pTrapCtx, PCBS3REGCTX pStartCtx, uint16_t uErrCd)
514	{
515	bs3CpuBasic2_CompareCpuTrapCtx(pTrapCtx, pStartCtx, uErrCd, X86_XCPT_TS, false /f486ResumeFlagHint/);
516	}
517	#endif
518
519	/**
520	* Compares \#PF trap.
521	*/
522	static void bs3CpuBasic2_ComparePfCtx(PCBS3TRAPFRAME pTrapCtx, PBS3REGCTX pStartCtx, uint16_t uErrCd, uint64_t uCr2Expected)
523	{
524	uint64_t const uCr2Saved = pStartCtx->cr2.u;
525	pStartCtx->cr2.u = uCr2Expected;
526	bs3CpuBasic2_CompareCpuTrapCtx(pTrapCtx, pStartCtx, uErrCd, X86_XCPT_PF, true /f486ResumeFlagHint/);
527	pStartCtx->cr2.u = uCr2Saved;
528	}
529
530	/**
531	* Compares \#UD trap.
532	*/
533	static void bs3CpuBasic2_CompareUdCtx(PCBS3TRAPFRAME pTrapCtx, PCBS3REGCTX pStartCtx)
534	{
535	bs3CpuBasic2_CompareCpuTrapCtx(pTrapCtx, pStartCtx, 0 /no error code/, X86_XCPT_UD, true /f486ResumeFlagHint/);
536	}
537
538	/**
539	* Compares \#AC trap.
540	*/
541	static void bs3CpuBasic2_CompareAcCtx(PCBS3TRAPFRAME pTrapCtx, PCBS3REGCTX pStartCtx)
542	{
543	bs3CpuBasic2_CompareCpuTrapCtx(pTrapCtx, pStartCtx, 0 /always zero/, X86_XCPT_AC, true /f486ResumeFlagHint/);
544	}
545
546
547	#if 0 /* convert me */
548	static void bs3CpuBasic2_RaiseXcpt1Common(uint16_t const uSysR0Cs, uint16_t const uSysR0CsConf, uint16_t const uSysR0Ss,
549	PX86DESC const paIdt, unsigned const cIdteShift)
550	{
551	BS3TRAPFRAME TrapCtx;
552	BS3REGCTX Ctx80;
553	BS3REGCTX Ctx81;
554	BS3REGCTX Ctx82;
555	BS3REGCTX Ctx83;
556	BS3REGCTX CtxTmp;
557	BS3REGCTX CtxTmp2;
558	PBS3REGCTX apCtx8x[4];
559	unsigned iCtx;
560	unsigned iRing;
561	unsigned iDpl;
562	unsigned iRpl;
563	unsigned i, j, k;
564	uint32_t uExpected;
565	bool const f486Plus = (g_uBs3CpuDetected & BS3CPU_TYPE_MASK) >= BS3CPU_80486;
566	# if TMPL_BITS == 16
567	bool const f386Plus = (g_uBs3CpuDetected & BS3CPU_TYPE_MASK) >= BS3CPU_80386;
568	bool const f286 = (g_uBs3CpuDetected & BS3CPU_TYPE_MASK) == BS3CPU_80286;
569	# else
570	bool const f286 = false;
571	bool const f386Plus = true;
572	int rc;
573	uint8_t *pbIdtCopyAlloc;
574	PX86DESC pIdtCopy;
575	const unsigned cbIdte = 1 << (3 + cIdteShift);
576	RTCCUINTXREG uCr0Saved = ASMGetCR0();
577	RTGDTR GdtrSaved;
578	# endif
579	RTIDTR IdtrSaved;
580	RTIDTR Idtr;
581
582	ASMGetIDTR(&IdtrSaved);
583	# if TMPL_BITS != 16
584	ASMGetGDTR(&GdtrSaved);
585	# endif
586
587	/* make sure they're allocated */
588	Bs3MemZero(&TrapCtx, sizeof(TrapCtx));
589	Bs3MemZero(&Ctx80, sizeof(Ctx80));
590	Bs3MemZero(&Ctx81, sizeof(Ctx81));
591	Bs3MemZero(&Ctx82, sizeof(Ctx82));
592	Bs3MemZero(&Ctx83, sizeof(Ctx83));
593	Bs3MemZero(&CtxTmp, sizeof(CtxTmp));
594	Bs3MemZero(&CtxTmp2, sizeof(CtxTmp2));
595
596	/* Context array. */
597	apCtx8x[0] = &Ctx80;
598	apCtx8x[1] = &Ctx81;
599	apCtx8x[2] = &Ctx82;
600	apCtx8x[3] = &Ctx83;
601
602	# if TMPL_BITS != 16
603	/* Allocate memory for playing around with the IDT. */
604	pbIdtCopyAlloc = NULL;
605	if (BS3_MODE_IS_PAGED(g_bTestMode))
606	pbIdtCopyAlloc = Bs3MemAlloc(BS3MEMKIND_FLAT32, 12*_1K);
607	# endif
608
609	/*
610	* IDT entry 80 thru 83 are assigned DPLs according to the number.
611	* (We'll be useing more, but this'll do for now.)
612	*/
613	paIdt[0x80 << cIdteShift].Gate.u2Dpl = 0;
614	paIdt[0x81 << cIdteShift].Gate.u2Dpl = 1;
615	paIdt[0x82 << cIdteShift].Gate.u2Dpl = 2;
616	paIdt[0x83 << cIdteShift].Gate.u2Dpl = 3;
617
618	Bs3RegCtxSave(&Ctx80);
619	Ctx80.rsp.u -= 0x300;
620	Ctx80.rip.u = (uintptr_t)BS3_FP_OFF(&bs3CpuBasic2_Int80);
621	# if TMPL_BITS == 16
622	Ctx80.cs = BS3_MODE_IS_RM_OR_V86(g_bTestMode) ? BS3_SEL_TEXT16 : BS3_SEL_R0_CS16;
623	# elif TMPL_BITS == 32
624	g_uBs3TrapEipHint = Ctx80.rip.u32;
625	# endif
626	Bs3MemCpy(&Ctx81, &Ctx80, sizeof(Ctx80));
627	Ctx81.rip.u = (uintptr_t)BS3_FP_OFF(&bs3CpuBasic2_Int81);
628	Bs3MemCpy(&Ctx82, &Ctx80, sizeof(Ctx80));
629	Ctx82.rip.u = (uintptr_t)BS3_FP_OFF(&bs3CpuBasic2_Int82);
630	Bs3MemCpy(&Ctx83, &Ctx80, sizeof(Ctx80));
631	Ctx83.rip.u = (uintptr_t)BS3_FP_OFF(&bs3CpuBasic2_Int83);
632
633	/*
634	* Check that all the above gates work from ring-0.
635	*/
636	for (iCtx = 0; iCtx < RT_ELEMENTS(apCtx8x); iCtx++)
637	{
638	g_usBs3TestStep = iCtx;
639	# if TMPL_BITS == 32
640	g_uBs3TrapEipHint = apCtx8x[iCtx]->rip.u32;
641	# endif
642	Bs3TrapSetJmpAndRestore(apCtx8x[iCtx], &TrapCtx);
643	bs3CpuBasic2_CompareIntCtx1(&TrapCtx, apCtx8x[iCtx], 0x80+iCtx /bXcpt/);
644	}
645
646	/*
647	* Check that the gate DPL checks works.
648	*/
649	g_usBs3TestStep = 100;
650	for (iRing = 0; iRing <= 3; iRing++)
651	{
652	for (iCtx = 0; iCtx < RT_ELEMENTS(apCtx8x); iCtx++)
653	{
654	Bs3MemCpy(&CtxTmp, apCtx8x[iCtx], sizeof(CtxTmp));
655	Bs3RegCtxConvertToRingX(&CtxTmp, iRing);
656	# if TMPL_BITS == 32
657	g_uBs3TrapEipHint = CtxTmp.rip.u32;
658	# endif
659	Bs3TrapSetJmpAndRestore(&CtxTmp, &TrapCtx);
660	if (iCtx < iRing)
661	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &CtxTmp, ((0x80 + iCtx) << X86_TRAP_ERR_SEL_SHIFT) \| X86_TRAP_ERR_IDT);
662	else
663	bs3CpuBasic2_CompareIntCtx1(&TrapCtx, &CtxTmp, 0x80 + iCtx /bXcpt/);
664	g_usBs3TestStep++;
665	}
666	}
667
668	/*
669	* Modify the gate CS value and run the handler at a different CPL.
670	* Throw RPL variations into the mix (completely ignored) together
671	* with gate presence.
672	* 1. CPL <= GATE.DPL
673	* 2. GATE.P
674	* 3. GATE.CS.DPL <= CPL (non-conforming segments)
675	*/
676	g_usBs3TestStep = 1000;
677	for (i = 0; i <= 3; i++)
678	{
679	for (iRing = 0; iRing <= 3; iRing++)
680	{
681	for (iCtx = 0; iCtx < RT_ELEMENTS(apCtx8x); iCtx++)
682	{
683	# if TMPL_BITS == 32
684	g_uBs3TrapEipHint = apCtx8x[iCtx]->rip.u32;
685	# endif
686	Bs3MemCpy(&CtxTmp, apCtx8x[iCtx], sizeof(CtxTmp));
687	Bs3RegCtxConvertToRingX(&CtxTmp, iRing);
688
689	for (j = 0; j <= 3; j++)
690	{
691	uint16_t const uCs = (uSysR0Cs \| j) + (i << BS3_SEL_RING_SHIFT);
692	for (k = 0; k < 2; k++)
693	{
694	g_usBs3TestStep++;
695	/Bs3TestPrintf("g_usBs3TestStep=%u iCtx=%u iRing=%u i=%u uCs=%04x\n", g_usBs3TestStep, iCtx, iRing, i, uCs);/
696	paIdt[(0x80 + iCtx) << cIdteShift].Gate.u16Sel = uCs;
697	paIdt[(0x80 + iCtx) << cIdteShift].Gate.u1Present = k;
698	Bs3TrapSetJmpAndRestore(&CtxTmp, &TrapCtx);
699	/Bs3TrapPrintFrame(&TrapCtx);/
700	if (iCtx < iRing)
701	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &CtxTmp, ((0x80 + iCtx) << X86_TRAP_ERR_SEL_SHIFT) \| X86_TRAP_ERR_IDT);
702	else if (k == 0)
703	bs3CpuBasic2_CompareNpCtx(&TrapCtx, &CtxTmp, ((0x80 + iCtx) << X86_TRAP_ERR_SEL_SHIFT) \| X86_TRAP_ERR_IDT);
704	else if (i > iRing)
705	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &CtxTmp, uCs & X86_SEL_MASK_OFF_RPL);
706	else
707	{
708	uint16_t uExpectedCs = uCs & X86_SEL_MASK_OFF_RPL;
709	if (i <= iCtx && i <= iRing)
710	uExpectedCs \|= i;
711	bs3CpuBasic2_CompareTrapCtx2(&TrapCtx, &CtxTmp, 2 /int 8xh/, 0x80 + iCtx /bXcpt/, uExpectedCs);
712	}
713	}
714	}
715
716	paIdt[(0x80 + iCtx) << cIdteShift].Gate.u16Sel = uSysR0Cs;
717	paIdt[(0x80 + iCtx) << cIdteShift].Gate.u1Present = 1;
718	}
719	}
720	}
721	BS3_ASSERT(g_usBs3TestStep < 1600);
722
723	/*
724	* Various CS and SS related faults
725	*
726	* We temporarily reconfigure gate 80 and 83 with new CS selectors, the
727	* latter have a CS.DPL of 2 for testing ring transisions and SS loading
728	* without making it impossible to handle faults.
729	*/
730	g_usBs3TestStep = 1600;
731	Bs3GdteTestPage00 = Bs3Gdt[uSysR0Cs >> X86_SEL_SHIFT];
732	Bs3GdteTestPage00.Gen.u1Present = 0;
733	Bs3GdteTestPage00.Gen.u4Type &= ~X86_SEL_TYPE_ACCESSED;
734	paIdt[0x80 << cIdteShift].Gate.u16Sel = BS3_SEL_TEST_PAGE_00;
735
736	/* CS.PRESENT = 0 */
737	Bs3TrapSetJmpAndRestore(&Ctx80, &TrapCtx);
738	bs3CpuBasic2_CompareNpCtx(&TrapCtx, &Ctx80, BS3_SEL_TEST_PAGE_00);
739	if (Bs3GdteTestPage00.Gen.u4Type & X86_SEL_TYPE_ACCESSED)
740	bs3CpuBasic2_FailedF("selector was accessed");
741	g_usBs3TestStep++;
742
743	/* Check that GATE.DPL is checked before CS.PRESENT. */
744	for (iRing = 1; iRing < 4; iRing++)
745	{
746	Bs3MemCpy(&CtxTmp, &Ctx80, sizeof(CtxTmp));
747	Bs3RegCtxConvertToRingX(&CtxTmp, iRing);
748	Bs3TrapSetJmpAndRestore(&CtxTmp, &TrapCtx);
749	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &CtxTmp, (0x80 << X86_TRAP_ERR_SEL_SHIFT) \| X86_TRAP_ERR_IDT);
750	if (Bs3GdteTestPage00.Gen.u4Type & X86_SEL_TYPE_ACCESSED)
751	bs3CpuBasic2_FailedF("selector was accessed");
752	g_usBs3TestStep++;
753	}
754
755	/* CS.DPL mismatch takes precedence over CS.PRESENT = 0. */
756	Bs3GdteTestPage00.Gen.u4Type &= ~X86_SEL_TYPE_ACCESSED;
757	Bs3TrapSetJmpAndRestore(&Ctx80, &TrapCtx);
758	bs3CpuBasic2_CompareNpCtx(&TrapCtx, &Ctx80, BS3_SEL_TEST_PAGE_00);
759	if (Bs3GdteTestPage00.Gen.u4Type & X86_SEL_TYPE_ACCESSED)
760	bs3CpuBasic2_FailedF("CS selector was accessed");
761	g_usBs3TestStep++;
762	for (iDpl = 1; iDpl < 4; iDpl++)
763	{
764	Bs3GdteTestPage00.Gen.u2Dpl = iDpl;
765	Bs3TrapSetJmpAndRestore(&Ctx80, &TrapCtx);
766	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &Ctx80, BS3_SEL_TEST_PAGE_00);
767	if (Bs3GdteTestPage00.Gen.u4Type & X86_SEL_TYPE_ACCESSED)
768	bs3CpuBasic2_FailedF("CS selector was accessed");
769	g_usBs3TestStep++;
770	}
771
772	/* 1608: Check all the invalid CS selector types alone. */
773	Bs3GdteTestPage00 = Bs3Gdt[uSysR0Cs >> X86_SEL_SHIFT];
774	for (i = 0; i < RT_ELEMENTS(g_aInvalidCsTypes); i++)
775	{
776	Bs3GdteTestPage00.Gen.u4Type = g_aInvalidCsTypes[i].u4Type;
777	Bs3GdteTestPage00.Gen.u1DescType = g_aInvalidCsTypes[i].u1DescType;
778	Bs3TrapSetJmpAndRestore(&Ctx80, &TrapCtx);
779	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &Ctx80, BS3_SEL_TEST_PAGE_00);
780	if (Bs3GdteTestPage00.Gen.u4Type != g_aInvalidCsTypes[i].u4Type)
781	bs3CpuBasic2_FailedF("Invalid CS type %#x/%u -> %#x/%u\n",
782	g_aInvalidCsTypes[i].u4Type, g_aInvalidCsTypes[i].u1DescType,
783	Bs3GdteTestPage00.Gen.u4Type, Bs3GdteTestPage00.Gen.u1DescType);
784	g_usBs3TestStep++;
785
786	/* Incorrect CS.TYPE takes precedence over CS.PRESENT = 0. */
787	Bs3GdteTestPage00.Gen.u1Present = 0;
788	Bs3TrapSetJmpAndRestore(&Ctx80, &TrapCtx);
789	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &Ctx80, BS3_SEL_TEST_PAGE_00);
790	Bs3GdteTestPage00.Gen.u1Present = 1;
791	g_usBs3TestStep++;
792	}
793
794	/* Fix CS again. */
795	Bs3GdteTestPage00 = Bs3Gdt[uSysR0Cs >> X86_SEL_SHIFT];
796
797	/* 1632: Test SS. */
798	if (!BS3_MODE_IS_64BIT_SYS(g_bTestMode))
799	{
800	uint16_t BS3_FAR *puTssSs2 = BS3_MODE_IS_16BIT_SYS(g_bTestMode) ? &Bs3Tss16.ss2 : &Bs3Tss32.ss2;
801	uint16_t const uSavedSs2 = *puTssSs2;
802	X86DESC const SavedGate83 = paIdt[0x83 << cIdteShift];
803
804	/* Make the handler execute in ring-2. */
805	Bs3GdteTestPage02 = Bs3Gdt[(uSysR0Cs + (2 << BS3_SEL_RING_SHIFT)) >> X86_SEL_SHIFT];
806	Bs3GdteTestPage02.Gen.u4Type &= ~X86_SEL_TYPE_ACCESSED;
807	paIdt[0x83 << cIdteShift].Gate.u16Sel = BS3_SEL_TEST_PAGE_02 \| 2;
808
809	Bs3MemCpy(&CtxTmp, &Ctx83, sizeof(CtxTmp));
810	Bs3RegCtxConvertToRingX(&CtxTmp, 3); /* yeah, from 3 so SS:xSP is reloaded. */
811	Bs3TrapSetJmpAndRestore(&CtxTmp, &TrapCtx);
812	bs3CpuBasic2_CompareIntCtx1(&TrapCtx, &CtxTmp, 0x83);
813	if (!(Bs3GdteTestPage02.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
814	bs3CpuBasic2_FailedF("CS selector was not access");
815	g_usBs3TestStep++;
816
817	/* Create a SS.DPL=2 stack segment and check that SS2.RPL matters and
818	that we get #SS if the selector isn't present. */
819	i = 0; /* used for cycling thru invalid CS types */
820	for (k = 0; k < 10; k++)
821	{
822	/* k=0: present,
823	k=1: not-present,
824	k=2: present but very low limit,
825	k=3: not-present, low limit.
826	k=4: present, read-only.
827	k=5: not-present, read-only.
828	k=6: present, code-selector.
829	k=7: not-present, code-selector.
830	k=8: present, read-write / no access + system (=LDT).
831	k=9: not-present, read-write / no access + system (=LDT).
832	*/
833	Bs3GdteTestPage03 = Bs3Gdt[(uSysR0Ss + (2 << BS3_SEL_RING_SHIFT)) >> X86_SEL_SHIFT];
834	Bs3GdteTestPage03.Gen.u1Present = !(k & 1);
835	if (k >= 8)
836	{
837	Bs3GdteTestPage03.Gen.u1DescType = 0; /* system */
838	Bs3GdteTestPage03.Gen.u4Type = X86_SEL_TYPE_RW; /* = LDT */
839	}
840	else if (k >= 6)
841	Bs3GdteTestPage03.Gen.u4Type = X86_SEL_TYPE_ER;
842	else if (k >= 4)
843	Bs3GdteTestPage03.Gen.u4Type = X86_SEL_TYPE_RO;
844	else if (k >= 2)
845	{
846	Bs3GdteTestPage03.Gen.u16LimitLow = 0x400;
847	Bs3GdteTestPage03.Gen.u4LimitHigh = 0;
848	Bs3GdteTestPage03.Gen.u1Granularity = 0;
849	}
850
851	for (iDpl = 0; iDpl < 4; iDpl++)
852	{
853	Bs3GdteTestPage03.Gen.u2Dpl = iDpl;
854
855	for (iRpl = 0; iRpl < 4; iRpl++)
856	{
857	*puTssSs2 = BS3_SEL_TEST_PAGE_03 \| iRpl;
858	//Bs3TestPrintf("k=%u iDpl=%u iRpl=%u step=%u\n", k, iDpl, iRpl, g_usBs3TestStep);
859	Bs3GdteTestPage02.Gen.u4Type &= ~X86_SEL_TYPE_ACCESSED;
860	Bs3GdteTestPage03.Gen.u4Type &= ~X86_SEL_TYPE_ACCESSED;
861	Bs3TrapSetJmpAndRestore(&CtxTmp, &TrapCtx);
862	if (iRpl != 2 \|\| iRpl != iDpl \|\| k >= 4)
863	bs3CpuBasic2_CompareTsCtx(&TrapCtx, &CtxTmp, BS3_SEL_TEST_PAGE_03);
864	else if (k != 0)
865	bs3CpuBasic2_CompareSsCtx(&TrapCtx, &CtxTmp, BS3_SEL_TEST_PAGE_03,
866	k == 2 /f486ResumeFlagHint/);
867	else
868	{
869	bs3CpuBasic2_CompareIntCtx1(&TrapCtx, &CtxTmp, 0x83);
870	if (TrapCtx.uHandlerSs != (BS3_SEL_TEST_PAGE_03 \| 2))
871	bs3CpuBasic2_FailedF("uHandlerSs=%#x expected %#x\n", TrapCtx.uHandlerSs, BS3_SEL_TEST_PAGE_03 \| 2);
872	}
873	if (!(Bs3GdteTestPage02.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
874	bs3CpuBasic2_FailedF("CS selector was not access");
875	if ( TrapCtx.bXcpt == 0x83
876	\|\| (TrapCtx.bXcpt == X86_XCPT_SS && k == 2) )
877	{
878	if (!(Bs3GdteTestPage03.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
879	bs3CpuBasic2_FailedF("SS selector was not accessed");
880	}
881	else if (Bs3GdteTestPage03.Gen.u4Type & X86_SEL_TYPE_ACCESSED)
882	bs3CpuBasic2_FailedF("SS selector was accessed");
883	g_usBs3TestStep++;
884
885	/* +1: Modify the gate DPL to check that this is checked before SS.DPL and SS.PRESENT. */
886	paIdt[0x83 << cIdteShift].Gate.u2Dpl = 2;
887	Bs3TrapSetJmpAndRestore(&CtxTmp, &TrapCtx);
888	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &CtxTmp, (0x83 << X86_TRAP_ERR_SEL_SHIFT) \| X86_TRAP_ERR_IDT);
889	paIdt[0x83 << cIdteShift].Gate.u2Dpl = 3;
890	g_usBs3TestStep++;
891
892	/* +2: Check the CS.DPL check is done before the SS ones. Restoring the
893	ring-0 INT 83 context triggers the CS.DPL < CPL check. */
894	Bs3TrapSetJmpAndRestore(&Ctx83, &TrapCtx);
895	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &Ctx83, BS3_SEL_TEST_PAGE_02);
896	g_usBs3TestStep++;
897
898	/* +3: Now mark the CS selector not present and check that that also triggers before SS stuff. */
899	Bs3GdteTestPage02.Gen.u1Present = 0;
900	Bs3TrapSetJmpAndRestore(&CtxTmp, &TrapCtx);
901	bs3CpuBasic2_CompareNpCtx(&TrapCtx, &CtxTmp, BS3_SEL_TEST_PAGE_02);
902	Bs3GdteTestPage02.Gen.u1Present = 1;
903	g_usBs3TestStep++;
904
905	/* +4: Make the CS selector some invalid type and check it triggers before SS stuff. */
906	Bs3GdteTestPage02.Gen.u4Type = g_aInvalidCsTypes[i].u4Type;
907	Bs3GdteTestPage02.Gen.u1DescType = g_aInvalidCsTypes[i].u1DescType;
908	Bs3TrapSetJmpAndRestore(&CtxTmp, &TrapCtx);
909	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &CtxTmp, BS3_SEL_TEST_PAGE_02);
910	Bs3GdteTestPage02.Gen.u4Type = X86_SEL_TYPE_ER_ACC;
911	Bs3GdteTestPage02.Gen.u1DescType = 1;
912	g_usBs3TestStep++;
913
914	/* +5: Now, make the CS selector limit too small and that it triggers after SS trouble.
915	The 286 had a simpler approach to these GP(0). */
916	Bs3GdteTestPage02.Gen.u16LimitLow = 0;
917	Bs3GdteTestPage02.Gen.u4LimitHigh = 0;
918	Bs3GdteTestPage02.Gen.u1Granularity = 0;
919	Bs3TrapSetJmpAndRestore(&CtxTmp, &TrapCtx);
920	if (f286)
921	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &CtxTmp, 0 /uErrCd/);
922	else if (iRpl != 2 \|\| iRpl != iDpl \|\| k >= 4)
923	bs3CpuBasic2_CompareTsCtx(&TrapCtx, &CtxTmp, BS3_SEL_TEST_PAGE_03);
924	else if (k != 0)
925	bs3CpuBasic2_CompareSsCtx(&TrapCtx, &CtxTmp, BS3_SEL_TEST_PAGE_03, k == 2 /f486ResumeFlagHint/);
926	else
927	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &CtxTmp, 0 /uErrCd/);
928	Bs3GdteTestPage02 = Bs3Gdt[(uSysR0Cs + (2 << BS3_SEL_RING_SHIFT)) >> X86_SEL_SHIFT];
929	g_usBs3TestStep++;
930	}
931	}
932	}
933
934	/* Check all the invalid SS selector types alone. */
935	Bs3GdteTestPage02 = Bs3Gdt[(uSysR0Cs + (2 << BS3_SEL_RING_SHIFT)) >> X86_SEL_SHIFT];
936	Bs3GdteTestPage03 = Bs3Gdt[(uSysR0Ss + (2 << BS3_SEL_RING_SHIFT)) >> X86_SEL_SHIFT];
937	*puTssSs2 = BS3_SEL_TEST_PAGE_03 \| 2;
938	Bs3TrapSetJmpAndRestore(&CtxTmp, &TrapCtx);
939	bs3CpuBasic2_CompareIntCtx1(&TrapCtx, &CtxTmp, 0x83);
940	g_usBs3TestStep++;
941	for (i = 0; i < RT_ELEMENTS(g_aInvalidSsTypes); i++)
942	{
943	Bs3GdteTestPage03.Gen.u4Type = g_aInvalidSsTypes[i].u4Type;
944	Bs3GdteTestPage03.Gen.u1DescType = g_aInvalidSsTypes[i].u1DescType;
945	Bs3TrapSetJmpAndRestore(&CtxTmp, &TrapCtx);
946	bs3CpuBasic2_CompareTsCtx(&TrapCtx, &CtxTmp, BS3_SEL_TEST_PAGE_03);
947	if (Bs3GdteTestPage03.Gen.u4Type != g_aInvalidSsTypes[i].u4Type)
948	bs3CpuBasic2_FailedF("Invalid SS type %#x/%u -> %#x/%u\n",
949	g_aInvalidSsTypes[i].u4Type, g_aInvalidSsTypes[i].u1DescType,
950	Bs3GdteTestPage03.Gen.u4Type, Bs3GdteTestPage03.Gen.u1DescType);
951	g_usBs3TestStep++;
952	}
953
954	/*
955	* Continue the SS experiments with a expand down segment. We'll use
956	* the same setup as we already have with gate 83h being DPL and
957	* having CS.DPL=2.
958	*
959	* Expand down segments are weird. The valid area is practically speaking
960	* reversed. So, a 16-bit segment with a limit of 0x6000 will have valid
961	* addresses from 0xffff thru 0x6001.
962	*
963	* So, with expand down segments we can more easily cut partially into the
964	* pushing of the iret frame and trigger more interesting behavior than
965	* with regular "expand up" segments where the whole pushing area is either
966	* all fine or not not fine.
967	*/
968	Bs3GdteTestPage02 = Bs3Gdt[(uSysR0Cs + (2 << BS3_SEL_RING_SHIFT)) >> X86_SEL_SHIFT];
969	Bs3GdteTestPage03 = Bs3Gdt[(uSysR0Ss + (2 << BS3_SEL_RING_SHIFT)) >> X86_SEL_SHIFT];
970	Bs3GdteTestPage03.Gen.u2Dpl = 2;
971	Bs3GdteTestPage03.Gen.u4Type = X86_SEL_TYPE_RW_DOWN;
972	*puTssSs2 = BS3_SEL_TEST_PAGE_03 \| 2;
973
974	/* First test, limit = max --> no bytes accessible --> #GP */
975	Bs3TrapSetJmpAndRestore(&CtxTmp, &TrapCtx);
976	bs3CpuBasic2_CompareSsCtx(&TrapCtx, &CtxTmp, BS3_SEL_TEST_PAGE_03, true /f486ResumeFlagHint/);
977
978	/* Second test, limit = 0 --> all by zero byte accessible --> works */
979	Bs3GdteTestPage03.Gen.u16LimitLow = 0;
980	Bs3GdteTestPage03.Gen.u4LimitHigh = 0;
981	Bs3TrapSetJmpAndRestore(&CtxTmp, &TrapCtx);
982	bs3CpuBasic2_CompareIntCtx1(&TrapCtx, &CtxTmp, 0x83);
983
984	/* Modify the gate handler to be a dummy that immediately does UD2
985	and triggers #UD, then advance the limit down till we get the #UD. */
986	Bs3GdteTestPage03.Gen.u1Granularity = 0;
987
988	Bs3MemCpy(&CtxTmp2, &CtxTmp, sizeof(CtxTmp2)); /* #UD result context */
989	if (g_f16BitSys)
990	{
991	CtxTmp2.rip.u = g_bs3CpuBasic2_ud2_FlatAddr - BS3_ADDR_BS3TEXT16;
992	Bs3Trap16SetGate(0x83, X86_SEL_TYPE_SYS_286_INT_GATE, 3, BS3_SEL_TEST_PAGE_02, CtxTmp2.rip.u16, 0 /cParams/);
993	CtxTmp2.rsp.u = Bs3Tss16.sp2 - 2*5;
994	}
995	else
996	{
997	CtxTmp2.rip.u = g_bs3CpuBasic2_ud2_FlatAddr;
998	Bs3Trap32SetGate(0x83, X86_SEL_TYPE_SYS_386_INT_GATE, 3, BS3_SEL_TEST_PAGE_02, CtxTmp2.rip.u32, 0 /cParams/);
999	CtxTmp2.rsp.u = Bs3Tss32.esp2 - 4*5;
1000	}
1001	CtxTmp2.bMode = g_bTestMode; /* g_bBs3CurrentMode not changed by the UD2 handler. */
1002	CtxTmp2.cs = BS3_SEL_TEST_PAGE_02 \| 2;
1003	CtxTmp2.ss = BS3_SEL_TEST_PAGE_03 \| 2;
1004	CtxTmp2.bCpl = 2;
1005
1006	/* test run. */
1007	Bs3TrapSetJmpAndRestore(&CtxTmp, &TrapCtx);
1008	bs3CpuBasic2_CompareUdCtx(&TrapCtx, &CtxTmp2);
1009	g_usBs3TestStep++;
1010
1011	/* Real run. */
1012	i = (g_f16BitSys ? 2 : 4) * 6 + 1;
1013	while (i-- > 0)
1014	{
1015	Bs3GdteTestPage03.Gen.u16LimitLow = CtxTmp2.rsp.u16 + i - 1;
1016	Bs3TrapSetJmpAndRestore(&CtxTmp, &TrapCtx);
1017	if (i > 0)
1018	bs3CpuBasic2_CompareSsCtx(&TrapCtx, &CtxTmp, BS3_SEL_TEST_PAGE_03, true /f486ResumeFlagHint/);
1019	else
1020	bs3CpuBasic2_CompareUdCtx(&TrapCtx, &CtxTmp2);
1021	g_usBs3TestStep++;
1022	}
1023
1024	/* Do a run where we do the same-ring kind of access. */
1025	Bs3RegCtxConvertToRingX(&CtxTmp, 2);
1026	if (g_f16BitSys)
1027	{
1028	CtxTmp2.rsp.u32 = CtxTmp.rsp.u32 - 2*3;
1029	i = 2*3 - 1;
1030	}
1031	else
1032	{
1033	CtxTmp2.rsp.u32 = CtxTmp.rsp.u32 - 4*3;
1034	i = 4*3 - 1;
1035	}
1036	CtxTmp.ss = BS3_SEL_TEST_PAGE_03 \| 2;
1037	CtxTmp2.ds = CtxTmp.ds;
1038	CtxTmp2.es = CtxTmp.es;
1039	CtxTmp2.fs = CtxTmp.fs;
1040	CtxTmp2.gs = CtxTmp.gs;
1041	while (i-- > 0)
1042	{
1043	Bs3GdteTestPage03.Gen.u16LimitLow = CtxTmp2.rsp.u16 + i - 1;
1044	Bs3TrapSetJmpAndRestore(&CtxTmp, &TrapCtx);
1045	if (i > 0)
1046	bs3CpuBasic2_CompareSsCtx(&TrapCtx, &CtxTmp, 0 /BS3_SEL_TEST_PAGE_03/, true /f486ResumeFlagHint/);
1047	else
1048	bs3CpuBasic2_CompareUdCtx(&TrapCtx, &CtxTmp2);
1049	g_usBs3TestStep++;
1050	}
1051
1052	*puTssSs2 = uSavedSs2;
1053	paIdt[0x83 << cIdteShift] = SavedGate83;
1054	}
1055	paIdt[0x80 << cIdteShift].Gate.u16Sel = uSysR0Cs;
1056	BS3_ASSERT(g_usBs3TestStep < 3000);
1057
1058	/*
1059	* Modify the gate CS value with a conforming segment.
1060	*/
1061	g_usBs3TestStep = 3000;
1062	for (i = 0; i <= 3; i++) /* cs.dpl */
1063	{
1064	for (iRing = 0; iRing <= 3; iRing++)
1065	{
1066	for (iCtx = 0; iCtx < RT_ELEMENTS(apCtx8x); iCtx++)
1067	{
1068	Bs3MemCpy(&CtxTmp, apCtx8x[iCtx], sizeof(CtxTmp));
1069	Bs3RegCtxConvertToRingX(&CtxTmp, iRing);
1070	# if TMPL_BITS == 32
1071	g_uBs3TrapEipHint = CtxTmp.rip.u32;
1072	# endif
1073
1074	for (j = 0; j <= 3; j++) /* rpl */
1075	{
1076	uint16_t const uCs = (uSysR0CsConf \| j) + (i << BS3_SEL_RING_SHIFT);
1077	/Bs3TestPrintf("g_usBs3TestStep=%u iCtx=%u iRing=%u i=%u uCs=%04x\n", g_usBs3TestStep, iCtx, iRing, i, uCs);/
1078	paIdt[(0x80 + iCtx) << cIdteShift].Gate.u16Sel = uCs;
1079	Bs3TrapSetJmpAndRestore(&CtxTmp, &TrapCtx);
1080	//Bs3TestPrintf("%u/%u/%u/%u: cs=%04x hcs=%04x xcpt=%02x\n", i, iRing, iCtx, j, uCs, TrapCtx.uHandlerCs, TrapCtx.bXcpt);
1081	/Bs3TrapPrintFrame(&TrapCtx);/
1082	g_usBs3TestStep++;
1083	if (iCtx < iRing)
1084	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &CtxTmp, ((0x80 + iCtx) << X86_TRAP_ERR_SEL_SHIFT) \| X86_TRAP_ERR_IDT);
1085	else if (i > iRing)
1086	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &CtxTmp, uCs & X86_SEL_MASK_OFF_RPL);
1087	else
1088	bs3CpuBasic2_CompareIntCtx1(&TrapCtx, &CtxTmp, 0x80 + iCtx /bXcpt/);
1089	}
1090	paIdt[(0x80 + iCtx) << cIdteShift].Gate.u16Sel = uSysR0Cs;
1091	}
1092	}
1093	}
1094	BS3_ASSERT(g_usBs3TestStep < 3500);
1095
1096	/*
1097	* The gates must be 64-bit in long mode.
1098	*/
1099	if (cIdteShift != 0)
1100	{
1101	g_usBs3TestStep = 3500;
1102	for (i = 0; i <= 3; i++)
1103	{
1104	for (iRing = 0; iRing <= 3; iRing++)
1105	{
1106	for (iCtx = 0; iCtx < RT_ELEMENTS(apCtx8x); iCtx++)
1107	{
1108	Bs3MemCpy(&CtxTmp, apCtx8x[iCtx], sizeof(CtxTmp));
1109	Bs3RegCtxConvertToRingX(&CtxTmp, iRing);
1110
1111	for (j = 0; j < 2; j++)
1112	{
1113	static const uint16_t s_auCSes[2] = { BS3_SEL_R0_CS16, BS3_SEL_R0_CS32 };
1114	uint16_t uCs = (s_auCSes[j] \| i) + (i << BS3_SEL_RING_SHIFT);
1115	g_usBs3TestStep++;
1116	/Bs3TestPrintf("g_usBs3TestStep=%u iCtx=%u iRing=%u i=%u uCs=%04x\n", g_usBs3TestStep, iCtx, iRing, i, uCs);/
1117	paIdt[(0x80 + iCtx) << cIdteShift].Gate.u16Sel = uCs;
1118	Bs3TrapSetJmpAndRestore(&CtxTmp, &TrapCtx);
1119	/Bs3TrapPrintFrame(&TrapCtx);/
1120	if (iCtx < iRing)
1121	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &CtxTmp, ((0x80 + iCtx) << X86_TRAP_ERR_SEL_SHIFT) \| X86_TRAP_ERR_IDT);
1122	else
1123	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &CtxTmp, uCs & X86_SEL_MASK_OFF_RPL);
1124	}
1125	paIdt[(0x80 + iCtx) << cIdteShift].Gate.u16Sel = uSysR0Cs;
1126	}
1127	}
1128	}
1129	BS3_ASSERT(g_usBs3TestStep < 4000);
1130	}
1131
1132	/*
1133	* IDT limit check. The 286 does not access X86DESCGATE::u16OffsetHigh.
1134	*/
1135	g_usBs3TestStep = 5000;
1136	i = (0x80 << (cIdteShift + 3)) - 1;
1137	j = (0x82 << (cIdteShift + 3)) - (!f286 ? 1 : 3);
1138	k = (0x83 << (cIdteShift + 3)) - 1;
1139	for (; i <= k; i++, g_usBs3TestStep++)
1140	{
1141	Idtr = IdtrSaved;
1142	Idtr.cbIdt = i;
1143	ASMSetIDTR(&Idtr);
1144	Bs3TrapSetJmpAndRestore(&Ctx81, &TrapCtx);
1145	if (i < j)
1146	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &Ctx81, (0x81 << X86_TRAP_ERR_SEL_SHIFT) \| X86_TRAP_ERR_IDT);
1147	else
1148	bs3CpuBasic2_CompareIntCtx1(&TrapCtx, &Ctx81, 0x81 /bXcpt/);
1149	}
1150	ASMSetIDTR(&IdtrSaved);
1151	BS3_ASSERT(g_usBs3TestStep < 5100);
1152
1153	# if TMPL_BITS != 16 /* Only do the paging related stuff in 32-bit and 64-bit modes. */
1154
1155	/*
1156	* IDT page not present. Placing the IDT copy such that 0x80 is on the
1157	* first page and 0x81 is on the second page. We need proceed to move
1158	* it down byte by byte to check that any inaccessible byte means #PF.
1159	*
1160	* Note! We must reload the alternative IDTR for each run as any kind of
1161	* printing to the string (like error reporting) will cause a switch
1162	* to real mode and back, reloading the default IDTR.
1163	*/
1164	g_usBs3TestStep = 5200;
1165	if (BS3_MODE_IS_PAGED(g_bTestMode) && pbIdtCopyAlloc)
1166	{
1167	uint32_t const uCr2Expected = Bs3SelPtrToFlat(pbIdtCopyAlloc) + _4K;
1168	for (j = 0; j < cbIdte; j++)
1169	{
1170	pIdtCopy = (PX86DESC)&pbIdtCopyAlloc[_4K - cbIdte * 0x81 - j];
1171	Bs3MemCpy(pIdtCopy, paIdt, cbIdte * 256);
1172
1173	Idtr.cbIdt = IdtrSaved.cbIdt;
1174	Idtr.pIdt = Bs3SelPtrToFlat(pIdtCopy);
1175
1176	ASMSetIDTR(&Idtr);
1177	Bs3TrapSetJmpAndRestore(&Ctx81, &TrapCtx);
1178	bs3CpuBasic2_CompareIntCtx1(&TrapCtx, &Ctx81, 0x81 /bXcpt/);
1179	g_usBs3TestStep++;
1180
1181	ASMSetIDTR(&Idtr);
1182	Bs3TrapSetJmpAndRestore(&Ctx80, &TrapCtx);
1183	bs3CpuBasic2_CompareIntCtx1(&TrapCtx, &Ctx80, 0x80 /bXcpt/);
1184	g_usBs3TestStep++;
1185
1186	rc = Bs3PagingProtect(uCr2Expected, _4K, 0 /fSet/, X86_PTE_P /fClear/);
1187	if (RT_SUCCESS(rc))
1188	{
1189	ASMSetIDTR(&Idtr);
1190	Bs3TrapSetJmpAndRestore(&Ctx80, &TrapCtx);
1191	bs3CpuBasic2_CompareIntCtx1(&TrapCtx, &Ctx80, 0x80 /bXcpt/);
1192	g_usBs3TestStep++;
1193
1194	ASMSetIDTR(&Idtr);
1195	Bs3TrapSetJmpAndRestore(&Ctx81, &TrapCtx);
1196	if (f486Plus)
1197	bs3CpuBasic2_ComparePfCtx(&TrapCtx, &Ctx81, 0 /uErrCd/, uCr2Expected);
1198	else
1199	bs3CpuBasic2_ComparePfCtx(&TrapCtx, &Ctx81, X86_TRAP_PF_RW /uErrCd/, uCr2Expected + 4 - RT_MIN(j, 4));
1200	g_usBs3TestStep++;
1201
1202	Bs3PagingProtect(uCr2Expected, _4K, X86_PTE_P /fSet/, 0 /fClear/);
1203
1204	/* Check if that the entry type is checked after the whole IDTE has been cleared for #PF. */
1205	pIdtCopy[0x80 << cIdteShift].Gate.u4Type = 0;
1206	rc = Bs3PagingProtect(uCr2Expected, _4K, 0 /fSet/, X86_PTE_P /fClear/);
1207	if (RT_SUCCESS(rc))
1208	{
1209	ASMSetIDTR(&Idtr);
1210	Bs3TrapSetJmpAndRestore(&Ctx81, &TrapCtx);
1211	if (f486Plus)
1212	bs3CpuBasic2_ComparePfCtx(&TrapCtx, &Ctx81, 0 /uErrCd/, uCr2Expected);
1213	else
1214	bs3CpuBasic2_ComparePfCtx(&TrapCtx, &Ctx81, X86_TRAP_PF_RW /uErrCd/, uCr2Expected + 4 - RT_MIN(j, 4));
1215	g_usBs3TestStep++;
1216
1217	Bs3PagingProtect(uCr2Expected, _4K, X86_PTE_P /fSet/, 0 /fClear/);
1218	}
1219	}
1220	else
1221	Bs3TestPrintf("Bs3PagingProtectPtr: %d\n", i);
1222
1223	ASMSetIDTR(&IdtrSaved);
1224	}
1225	}
1226
1227	/*
1228	* The read/write and user/supervisor bits the IDT PTEs are irrelevant.
1229	*/
1230	g_usBs3TestStep = 5300;
1231	if (BS3_MODE_IS_PAGED(g_bTestMode) && pbIdtCopyAlloc)
1232	{
1233	Bs3MemCpy(pbIdtCopyAlloc, paIdt, cbIdte * 256);
1234	Idtr.cbIdt = IdtrSaved.cbIdt;
1235	Idtr.pIdt = Bs3SelPtrToFlat(pbIdtCopyAlloc);
1236
1237	ASMSetIDTR(&Idtr);
1238	Bs3TrapSetJmpAndRestore(&Ctx81, &TrapCtx);
1239	bs3CpuBasic2_CompareIntCtx1(&TrapCtx, &Ctx81, 0x81 /bXcpt/);
1240	g_usBs3TestStep++;
1241
1242	rc = Bs3PagingProtect(Idtr.pIdt, _4K, 0 /fSet/, X86_PTE_RW \| X86_PTE_US /fClear/);
1243	if (RT_SUCCESS(rc))
1244	{
1245	ASMSetIDTR(&Idtr);
1246	Bs3TrapSetJmpAndRestore(&Ctx81, &TrapCtx);
1247	bs3CpuBasic2_CompareIntCtx1(&TrapCtx, &Ctx81, 0x81 /bXcpt/);
1248	g_usBs3TestStep++;
1249
1250	Bs3PagingProtect(Idtr.pIdt, _4K, X86_PTE_RW \| X86_PTE_US /fSet/, 0 /fClear/);
1251	}
1252	ASMSetIDTR(&IdtrSaved);
1253	}
1254
1255	/*
1256	* Check that CS.u1Accessed is set to 1. Use the test page selector #0 and #3 together
1257	* with interrupt gates 80h and 83h, respectively.
1258	*/
1259	/** @todo Throw in SS.u1Accessed too. */
1260	g_usBs3TestStep = 5400;
1261	if (BS3_MODE_IS_PAGED(g_bTestMode) && pbIdtCopyAlloc)
1262	{
1263	Bs3GdteTestPage00 = Bs3Gdt[uSysR0Cs >> X86_SEL_SHIFT];
1264	Bs3GdteTestPage00.Gen.u4Type &= ~X86_SEL_TYPE_ACCESSED;
1265	paIdt[0x80 << cIdteShift].Gate.u16Sel = BS3_SEL_TEST_PAGE_00;
1266
1267	Bs3GdteTestPage03 = Bs3Gdt[(uSysR0Cs + (3 << BS3_SEL_RING_SHIFT)) >> X86_SEL_SHIFT];
1268	Bs3GdteTestPage03.Gen.u4Type &= ~X86_SEL_TYPE_ACCESSED;
1269	paIdt[0x83 << cIdteShift].Gate.u16Sel = BS3_SEL_TEST_PAGE_03; /* rpl is ignored, so leave it as zero. */
1270
1271	/* Check that the CS.A bit is being set on a general basis and that
1272	the special CS values work with out generic handler code. */
1273	Bs3TrapSetJmpAndRestore(&Ctx80, &TrapCtx);
1274	bs3CpuBasic2_CompareIntCtx1(&TrapCtx, &Ctx80, 0x80 /bXcpt/);
1275	if (!(Bs3GdteTestPage00.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
1276	bs3CpuBasic2_FailedF("u4Type=%#x, not accessed", Bs3GdteTestPage00.Gen.u4Type);
1277	g_usBs3TestStep++;
1278
1279	Bs3MemCpy(&CtxTmp, &Ctx83, sizeof(CtxTmp));
1280	Bs3RegCtxConvertToRingX(&CtxTmp, 3);
1281	Bs3TrapSetJmpAndRestore(&CtxTmp, &TrapCtx);
1282	bs3CpuBasic2_CompareIntCtx1(&TrapCtx, &CtxTmp, 0x83 /bXcpt/);
1283	if (!(Bs3GdteTestPage03.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
1284	bs3CpuBasic2_FailedF("u4Type=%#x, not accessed!", Bs3GdteTestPage00.Gen.u4Type);
1285	if (TrapCtx.uHandlerCs != (BS3_SEL_TEST_PAGE_03 \| 3))
1286	bs3CpuBasic2_FailedF("uHandlerCs=%#x, expected %#x", TrapCtx.uHandlerCs, (BS3_SEL_TEST_PAGE_03 \| 3));
1287	g_usBs3TestStep++;
1288
1289	/*
1290	* Now check that setting CS.u1Access to 1 does __NOT__ trigger a page
1291	* fault due to the RW bit being zero.
1292	* (We check both with with and without the WP bit if 80486.)
1293	*/
1294	if ((g_uBs3CpuDetected & BS3CPU_TYPE_MASK) >= BS3CPU_80486)
1295	ASMSetCR0(uCr0Saved \| X86_CR0_WP);
1296
1297	Bs3GdteTestPage00.Gen.u4Type &= ~X86_SEL_TYPE_ACCESSED;
1298	Bs3GdteTestPage03.Gen.u4Type &= ~X86_SEL_TYPE_ACCESSED;
1299	rc = Bs3PagingProtect(GdtrSaved.pGdt + BS3_SEL_TEST_PAGE_00, 8, 0 /fSet/, X86_PTE_RW /fClear/);
1300	if (RT_SUCCESS(rc))
1301	{
1302	/* ring-0 handler */
1303	Bs3TrapSetJmpAndRestore(&Ctx80, &TrapCtx);
1304	bs3CpuBasic2_CompareIntCtx1(&TrapCtx, &Ctx80, 0x80 /bXcpt/);
1305	if (!(Bs3GdteTestPage00.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
1306	bs3CpuBasic2_FailedF("u4Type=%#x, not accessed!", Bs3GdteTestPage00.Gen.u4Type);
1307	g_usBs3TestStep++;
1308
1309	/* ring-3 handler */
1310	Bs3MemCpy(&CtxTmp, &Ctx83, sizeof(CtxTmp));
1311	Bs3RegCtxConvertToRingX(&CtxTmp, 3);
1312	Bs3TrapSetJmpAndRestore(&CtxTmp, &TrapCtx);
1313	bs3CpuBasic2_CompareIntCtx1(&TrapCtx, &CtxTmp, 0x83 /bXcpt/);
1314	if (!(Bs3GdteTestPage03.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
1315	bs3CpuBasic2_FailedF("u4Type=%#x, not accessed!", Bs3GdteTestPage00.Gen.u4Type);
1316	g_usBs3TestStep++;
1317
1318	/* clear WP and repeat the above. */
1319	if ((g_uBs3CpuDetected & BS3CPU_TYPE_MASK) >= BS3CPU_80486)
1320	ASMSetCR0(uCr0Saved & ~X86_CR0_WP);
1321	Bs3GdteTestPage00.Gen.u4Type &= ~X86_SEL_TYPE_ACCESSED; /* (No need to RW the page - ring-0, WP=0.) */
1322	Bs3GdteTestPage03.Gen.u4Type &= ~X86_SEL_TYPE_ACCESSED; /* (No need to RW the page - ring-0, WP=0.) */
1323
1324	Bs3TrapSetJmpAndRestore(&Ctx80, &TrapCtx);
1325	bs3CpuBasic2_CompareIntCtx1(&TrapCtx, &Ctx80, 0x80 /bXcpt/);
1326	if (!(Bs3GdteTestPage00.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
1327	bs3CpuBasic2_FailedF("u4Type=%#x, not accessed!", Bs3GdteTestPage00.Gen.u4Type);
1328	g_usBs3TestStep++;
1329
1330	Bs3TrapSetJmpAndRestore(&CtxTmp, &TrapCtx);
1331	bs3CpuBasic2_CompareIntCtx1(&TrapCtx, &CtxTmp, 0x83 /bXcpt/);
1332	if (!(Bs3GdteTestPage03.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
1333	bs3CpuBasic2_FailedF("u4Type=%#x, not accessed!n", Bs3GdteTestPage03.Gen.u4Type);
1334	g_usBs3TestStep++;
1335
1336	Bs3PagingProtect(GdtrSaved.pGdt + BS3_SEL_TEST_PAGE_00, 8, X86_PTE_RW /fSet/, 0 /fClear/);
1337	}
1338
1339	ASMSetCR0(uCr0Saved);
1340
1341	/*
1342	* While we're here, check that if the CS GDT entry is a non-present
1343	* page we do get a #PF with the rigth error code and CR2.
1344	*/
1345	Bs3GdteTestPage00.Gen.u4Type &= ~X86_SEL_TYPE_ACCESSED; /* Just for fun, really a pointless gesture. */
1346	Bs3GdteTestPage03.Gen.u4Type &= ~X86_SEL_TYPE_ACCESSED;
1347	rc = Bs3PagingProtect(GdtrSaved.pGdt + BS3_SEL_TEST_PAGE_00, 8, 0 /fSet/, X86_PTE_P /fClear/);
1348	if (RT_SUCCESS(rc))
1349	{
1350	Bs3TrapSetJmpAndRestore(&Ctx80, &TrapCtx);
1351	if (f486Plus)
1352	bs3CpuBasic2_ComparePfCtx(&TrapCtx, &Ctx80, 0 /uErrCd/, GdtrSaved.pGdt + BS3_SEL_TEST_PAGE_00);
1353	else
1354	bs3CpuBasic2_ComparePfCtx(&TrapCtx, &Ctx80, X86_TRAP_PF_RW, GdtrSaved.pGdt + BS3_SEL_TEST_PAGE_00 + 4);
1355	g_usBs3TestStep++;
1356
1357	/* Do it from ring-3 to check ErrCd, which doesn't set X86_TRAP_PF_US it turns out. */
1358	Bs3MemCpy(&CtxTmp, &Ctx83, sizeof(CtxTmp));
1359	Bs3RegCtxConvertToRingX(&CtxTmp, 3);
1360	Bs3TrapSetJmpAndRestore(&CtxTmp, &TrapCtx);
1361
1362	if (f486Plus)
1363	bs3CpuBasic2_ComparePfCtx(&TrapCtx, &CtxTmp, 0 /uErrCd/, GdtrSaved.pGdt + BS3_SEL_TEST_PAGE_03);
1364	else
1365	bs3CpuBasic2_ComparePfCtx(&TrapCtx, &CtxTmp, X86_TRAP_PF_RW, GdtrSaved.pGdt + BS3_SEL_TEST_PAGE_03 + 4);
1366	g_usBs3TestStep++;
1367
1368	Bs3PagingProtect(GdtrSaved.pGdt + BS3_SEL_TEST_PAGE_00, 8, X86_PTE_P /fSet/, 0 /fClear/);
1369	if (Bs3GdteTestPage00.Gen.u4Type & X86_SEL_TYPE_ACCESSED)
1370	bs3CpuBasic2_FailedF("u4Type=%#x, accessed! #1", Bs3GdteTestPage00.Gen.u4Type);
1371	if (Bs3GdteTestPage03.Gen.u4Type & X86_SEL_TYPE_ACCESSED)
1372	bs3CpuBasic2_FailedF("u4Type=%#x, accessed! #2", Bs3GdteTestPage03.Gen.u4Type);
1373	}
1374
1375	/* restore */
1376	paIdt[0x80 << cIdteShift].Gate.u16Sel = uSysR0Cs;
1377	paIdt[0x83 << cIdteShift].Gate.u16Sel = uSysR0Cs;// + (3 << BS3_SEL_RING_SHIFT) + 3;
1378	}
1379
1380	# endif /* 32 \|\| 64*/
1381
1382	/*
1383	* Check broad EFLAGS effects.
1384	*/
1385	g_usBs3TestStep = 5600;
1386	for (iCtx = 0; iCtx < RT_ELEMENTS(apCtx8x); iCtx++)
1387	{
1388	for (iRing = 0; iRing < 4; iRing++)
1389	{
1390	Bs3MemCpy(&CtxTmp, apCtx8x[iCtx], sizeof(CtxTmp));
1391	Bs3RegCtxConvertToRingX(&CtxTmp, iRing);
1392
1393	/* all set */
1394	CtxTmp.rflags.u32 &= X86_EFL_VM \| X86_EFL_1;
1395	CtxTmp.rflags.u32 \|= X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF /* \| X86_EFL_TF / /\| X86_EFL_IF*/
1396	\| X86_EFL_DF \| X86_EFL_OF \| X86_EFL_IOPL /* \| X86_EFL_NT*/;
1397	if (f486Plus)
1398	CtxTmp.rflags.u32 \|= X86_EFL_AC;
1399	if (f486Plus && !g_f16BitSys)
1400	CtxTmp.rflags.u32 \|= X86_EFL_RF;
1401	if (g_uBs3CpuDetected & BS3CPU_F_CPUID)
1402	CtxTmp.rflags.u32 \|= X86_EFL_VIF \| X86_EFL_VIP;
1403	Bs3TrapSetJmpAndRestore(&CtxTmp, &TrapCtx);
1404	CtxTmp.rflags.u32 &= ~X86_EFL_RF;
1405
1406	if (iCtx >= iRing)
1407	bs3CpuBasic2_CompareIntCtx1(&TrapCtx, &CtxTmp, 0x80 + iCtx /bXcpt/);
1408	else
1409	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &CtxTmp, ((0x80 + iCtx) << X86_TRAP_ERR_SEL_SHIFT) \| X86_TRAP_ERR_IDT);
1410	uExpected = CtxTmp.rflags.u32
1411	& ( X86_EFL_1 \| X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_DF
1412	\| X86_EFL_OF \| X86_EFL_IOPL \| X86_EFL_NT \| X86_EFL_VM \| X86_EFL_AC \| X86_EFL_VIF \| X86_EFL_VIP
1413	\| X86_EFL_ID /\| X86_EFL_TF/ /\| X86_EFL_IF/ /\| X86_EFL_RF/ );
1414	if (TrapCtx.fHandlerRfl != uExpected)
1415	bs3CpuBasic2_FailedF("unexpected handler rflags value: %RX64 expected %RX32; CtxTmp.rflags=%RX64 Ctx.rflags=%RX64\n",
1416	TrapCtx.fHandlerRfl, uExpected, CtxTmp.rflags.u, TrapCtx.Ctx.rflags.u);
1417	g_usBs3TestStep++;
1418
1419	/* all cleared */
1420	if ((g_uBs3CpuDetected & BS3CPU_TYPE_MASK) < BS3CPU_80286)
1421	CtxTmp.rflags.u32 = apCtx8x[iCtx]->rflags.u32 & (X86_EFL_RA1_MASK \| UINT16_C(0xf000));
1422	else
1423	CtxTmp.rflags.u32 = apCtx8x[iCtx]->rflags.u32 & (X86_EFL_VM \| X86_EFL_RA1_MASK);
1424	Bs3TrapSetJmpAndRestore(&CtxTmp, &TrapCtx);
1425	if (iCtx >= iRing)
1426	bs3CpuBasic2_CompareIntCtx1(&TrapCtx, &CtxTmp, 0x80 + iCtx /bXcpt/);
1427	else
1428	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &CtxTmp, ((0x80 + iCtx) << X86_TRAP_ERR_SEL_SHIFT) \| X86_TRAP_ERR_IDT);
1429	uExpected = CtxTmp.rflags.u32;
1430	if (TrapCtx.fHandlerRfl != uExpected)
1431	bs3CpuBasic2_FailedF("unexpected handler rflags value: %RX64 expected %RX32; CtxTmp.rflags=%RX64 Ctx.rflags=%RX64\n",
1432	TrapCtx.fHandlerRfl, uExpected, CtxTmp.rflags.u, TrapCtx.Ctx.rflags.u);
1433	g_usBs3TestStep++;
1434	}
1435	}
1436
1437	/** @todo CS.LIMIT / canonical(CS) */
1438
1439
1440	/*
1441	* Check invalid gate types.
1442	*/
1443	g_usBs3TestStep = 32000;
1444	for (iRing = 0; iRing <= 3; iRing++)
1445	{
1446	static const uint16_t s_auCSes[] = { BS3_SEL_R0_CS16, BS3_SEL_R0_CS32, BS3_SEL_R0_CS64,
1447	BS3_SEL_TSS16, BS3_SEL_TSS32, BS3_SEL_TSS64, 0, BS3_SEL_SPARE_1f };
1448	static uint16_t const s_auInvlTypes64[] = { 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 13,
1449	0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17,
1450	0x18, 0x19, 0x1a, 0x1b, 0x1c, 0x1d, 0x1e, 0x1f };
1451	static uint16_t const s_auInvlTypes32[] = { 0, 1, 2, 3, 8, 9, 10, 11, 13,
1452	0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17,
1453	0x18, 0x19, 0x1a, 0x1b, 0x1c, 0x1d, 0x1e, 0x1f,
1454	/286:/ 12, 14, 15 };
1455	uint16_t const * const pauInvTypes = cIdteShift != 0 ? s_auInvlTypes64 : s_auInvlTypes32;
1456	uint16_t const cInvTypes = cIdteShift != 0 ? RT_ELEMENTS(s_auInvlTypes64)
1457	: f386Plus ? RT_ELEMENTS(s_auInvlTypes32) - 3 : RT_ELEMENTS(s_auInvlTypes32);
1458
1459
1460	for (iCtx = 0; iCtx < RT_ELEMENTS(apCtx8x); iCtx++)
1461	{
1462	unsigned iType;
1463
1464	Bs3MemCpy(&CtxTmp, apCtx8x[iCtx], sizeof(CtxTmp));
1465	Bs3RegCtxConvertToRingX(&CtxTmp, iRing);
1466	# if TMPL_BITS == 32
1467	g_uBs3TrapEipHint = CtxTmp.rip.u32;
1468	# endif
1469	for (iType = 0; iType < cInvTypes; iType++)
1470	{
1471	uint8_t const bSavedType = paIdt[(0x80 + iCtx) << cIdteShift].Gate.u4Type;
1472	paIdt[(0x80 + iCtx) << cIdteShift].Gate.u1DescType = pauInvTypes[iType] >> 4;
1473	paIdt[(0x80 + iCtx) << cIdteShift].Gate.u4Type = pauInvTypes[iType] & 0xf;
1474
1475	for (i = 0; i < 4; i++)
1476	{
1477	for (j = 0; j < RT_ELEMENTS(s_auCSes); j++)
1478	{
1479	uint16_t uCs = (unsigned)(s_auCSes[j] - BS3_SEL_R0_FIRST) < (unsigned)(4 << BS3_SEL_RING_SHIFT)
1480	? (s_auCSes[j] \| i) + (i << BS3_SEL_RING_SHIFT)
1481	: s_auCSes[j] \| i;
1482	/Bs3TestPrintf("g_usBs3TestStep=%u iCtx=%u iRing=%u i=%u uCs=%04x type=%#x\n", g_usBs3TestStep, iCtx, iRing, i, uCs, pauInvTypes[iType]);/
1483	paIdt[(0x80 + iCtx) << cIdteShift].Gate.u16Sel = uCs;
1484	Bs3TrapSetJmpAndRestore(&CtxTmp, &TrapCtx);
1485	g_usBs3TestStep++;
1486	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &CtxTmp, ((0x80 + iCtx) << X86_TRAP_ERR_SEL_SHIFT) \| X86_TRAP_ERR_IDT);
1487
1488	/* Mark it not-present to check that invalid type takes precedence. */
1489	paIdt[(0x80 + iCtx) << cIdteShift].Gate.u1Present = 0;
1490	Bs3TrapSetJmpAndRestore(&CtxTmp, &TrapCtx);
1491	g_usBs3TestStep++;
1492	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &CtxTmp, ((0x80 + iCtx) << X86_TRAP_ERR_SEL_SHIFT) \| X86_TRAP_ERR_IDT);
1493	paIdt[(0x80 + iCtx) << cIdteShift].Gate.u1Present = 1;
1494	}
1495	}
1496
1497	paIdt[(0x80 + iCtx) << cIdteShift].Gate.u16Sel = uSysR0Cs;
1498	paIdt[(0x80 + iCtx) << cIdteShift].Gate.u4Type = bSavedType;
1499	paIdt[(0x80 + iCtx) << cIdteShift].Gate.u1DescType = 0;
1500	paIdt[(0x80 + iCtx) << cIdteShift].Gate.u1Present = 1;
1501	}
1502	}
1503	}
1504	BS3_ASSERT(g_usBs3TestStep < 62000U && g_usBs3TestStep > 32000U);
1505
1506
1507	/** @todo
1508	* - Run \#PF and \#GP (and others?) at CPLs other than zero.
1509	* - Quickly generate all faults.
1510	* - All the peculiarities v8086.
1511	*/
1512
1513	# if TMPL_BITS != 16
1514	Bs3MemFree(pbIdtCopyAlloc, 12*_1K);
1515	# endif
1516	}
1517	#endif /* convert me */
1518
1519
1520	static void bs3CpuBasic2_RaiseXcpt11Worker(uint8_t bMode, uint8_t *pbBuf, bool fAm,
1521	BS3CPUBASIC2PFTTSTCMNMODE const BS3_FAR *pCmn)
1522	{
1523	BS3TRAPFRAME TrapCtx;
1524	BS3REGCTX Ctx;
1525	BS3REGCTX CtxUdExpected;
1526	uint8_t const cRings = bMode == BS3_MODE_RM ? 1 : 4;
1527	uint8_t iRing;
1528	uint16_t iTest;
1529
1530	/* make sure they're allocated */
1531	Bs3MemZero(&TrapCtx, sizeof(TrapCtx));
1532	Bs3MemZero(&Ctx, sizeof(Ctx));
1533	Bs3MemZero(&CtxUdExpected, sizeof(CtxUdExpected));
1534
1535	/*
1536	* Test all relevant rings.
1537	*
1538	* The memory operand is ds:xBX, so point it to pbBuf.
1539	* The test snippets mostly use xAX as operand, with the div
1540	* one also using xDX, so make sure they make some sense.
1541	*/
1542	Bs3RegCtxSaveEx(&Ctx, bMode, 0);
1543
1544	for (iRing = 0; iRing < cRings; iRing++)
1545	{
1546	uint32_t uEbx;
1547	uint8_t fAc;
1548
1549	Bs3RegCtxConvertToRingX(&Ctx, iRing);
1550
1551	Bs3RegCtxSetGrpDsFromCurPtr(&Ctx, &Ctx.rbx, pbBuf);
1552	uEbx = Ctx.rbx.u32;
1553
1554	Ctx.rax.u = (bMode & BS3_MODE_CODE_MASK) == BS3_MODE_CODE_64
1555	? UINT64_C(0x80868028680386fe) : UINT32_C(0x65020686);
1556	Ctx.rdx.u = UINT32_C(0x00100100); /* careful with range due to div */
1557
1558	Bs3MemCpy(&CtxUdExpected, &Ctx, sizeof(Ctx));
1559
1560	/*
1561	* AC flag loop.
1562	*/
1563	for (fAc = 0; fAc < 2; fAc++)
1564	{
1565	if (fAc)
1566	Ctx.rflags.u32 \|= X86_EFL_AC;
1567	else
1568	Ctx.rflags.u32 &= ~X86_EFL_AC;
1569
1570	/*
1571	* Loop over the test snippets.
1572	*/
1573	for (iTest = 0; iTest < pCmn->cEntries; iTest++)
1574	{
1575	uint8_t const cbMem = pCmn->paEntries[iTest].cbMem;
1576	uint8_t const fOp = pCmn->paEntries[iTest].fOp;
1577	uint8_t offMem;
1578	uint8_t BS3_FAR poffUd = (uint8_t BS3_FAR )Bs3SelLnkPtrToCurPtr(pCmn->paEntries[iTest].pfn);
1579	Bs3RegCtxSetRipCsFromLnkPtr(&Ctx, pCmn->paEntries[iTest].pfn);
1580	CtxUdExpected.rip = Ctx.rip;
1581	CtxUdExpected.rip.u = Ctx.rip.u + poffUd[-1];
1582	CtxUdExpected.cs = Ctx.cs;
1583	CtxUdExpected.rflags = Ctx.rflags;
1584	if (bMode == BS3_MODE_RM) CtxUdExpected.rflags.u32 &= ~X86_EFL_AC; /** @todo investigate. automatically cleared, or is it just our code? */
1585	CtxUdExpected.rdx = Ctx.rdx;
1586	CtxUdExpected.rax = Ctx.rax;
1587	if (fOp & MYOP_LD)
1588	{
1589	switch (cbMem)
1590	{
1591	case 2:
1592	CtxUdExpected.rax.u16 = 0x0101;
1593	break;
1594	case 4:
1595	CtxUdExpected.rax.u32 = UINT32_C(0x01010101);
1596	break;
1597	case 8:
1598	CtxUdExpected.rax.u64 = UINT64_C(0x0101010101010101);
1599	break;
1600	}
1601	}
1602
1603	/*
1604	* Buffer misalignment loop.
1605	*/
1606	for (offMem = 0; offMem < cbMem; offMem++)
1607	{
1608	unsigned offBuf = cbMem * 2 + cbMem;
1609	while (offBuf-- > 0)
1610	pbBuf[offBuf] = 1; /* byte-by-byte to make sure it doesn't trigger AC. */
1611
1612	CtxUdExpected.rbx.u32 = Ctx.rbx.u32 = uEbx + offMem; /* ASSUMES memory in first 4GB (cur stack, so okay). */
1613	if (BS3_MODE_IS_16BIT_SYS(bMode))
1614	g_uBs3TrapEipHint = Ctx.rip.u32;
1615
1616	//Bs3TestPrintf("iRing=%d iTest=%d cs:rip=%04RX16:%08RX32 ds:rbx=%04RX16:%08RX32\n",
1617	// iRing, iTest, Ctx.cs, Ctx.rip.u32, Ctx.ds, Ctx.rbx.u32);
1618
1619	Bs3TrapSetJmpAndRestore(&Ctx, &TrapCtx);
1620
1621	if (!fAm \|\| iRing != 3 \|\| !fAc \|\| !(offMem & (cbMem - 1))) /** @todo assumes cbMem is a power of two! */
1622	{
1623	if (fOp & MYOP_EFL)
1624	{
1625	CtxUdExpected.rflags.u16 &= ~X86_EFL_STATUS_BITS;
1626	CtxUdExpected.rflags.u16 \|= TrapCtx.Ctx.rflags.u16 & X86_EFL_STATUS_BITS;
1627	}
1628	if (fOp == MYOP_LD_DIV)
1629	{
1630	CtxUdExpected.rax = TrapCtx.Ctx.rax;
1631	CtxUdExpected.rdx = TrapCtx.Ctx.rdx;
1632	}
1633	bs3CpuBasic2_CompareUdCtx(&TrapCtx, &CtxUdExpected);
1634	}
1635	else
1636	{
1637	bs3CpuBasic2_CompareAcCtx(&TrapCtx, &Ctx);
1638	}
1639
1640	g_usBs3TestStep++;
1641	}
1642	}
1643	}
1644	}
1645	}
1646
1647
1648	/**
1649	* Entrypoint for \#AC tests.
1650	*
1651	* @returns 0 or BS3TESTDOMODE_SKIPPED.
1652	* @param bMode The CPU mode we're testing.
1653	*
1654	* @note When testing v8086 code, we'll be running in v8086 mode. So, careful
1655	* with control registers and such.
1656	*/
1657	BS3_DECL_FAR(uint8_t) BS3_CMN_FAR_NM(bs3CpuBasic2_RaiseXcpt11)(uint8_t bMode)
1658	{
1659	uint8_t abBuf[4096 /** @todo 128 - but that went crazy in real mode; now it's long mode going wrong. */];
1660	uint8_t BS3_FAR *pbBuf;
1661	unsigned idxCmnModes;
1662	uint32_t fCr0;
1663	Bs3MemZero(&abBuf, sizeof(abBuf));
1664
1665	/*
1666	* Skip if 386 or older.
1667	*/
1668	if ((g_uBs3CpuDetected & BS3CPU_TYPE_MASK) < BS3CPU_80486)
1669	{
1670	Bs3TestSkipped("#AC test requires 486 or later");
1671	return BS3TESTDOMODE_SKIPPED;
1672	}
1673
1674	bs3CpuBasic2_SetGlobals(bMode);
1675
1676	/* Get us a 64-byte aligned buffer. */
1677	pbBuf = abBuf;
1678	if (BS3_FP_OFF(pbBuf) & 63)
1679	pbBuf = &abBuf[64 - BS3_FP_OFF(pbBuf) & 63];
1680	//Bs3TestPrintf("pbBuf=%p\n", pbBuf);
1681
1682	/* Find the g_aCmnModes entry. */
1683	idxCmnModes = 0;
1684	while (g_aCmnModes[idxCmnModes].bMode != (bMode & BS3_MODE_CODE_MASK))
1685	idxCmnModes++;
1686	//Bs3TestPrintf("idxCmnModes=%d bMode=%#x\n", idxCmnModes, bMode);
1687
1688	/* First round is w/o aligment checks enabled. */
1689	fCr0 = Bs3RegGetCr0();
1690	BS3_ASSERT(!(fCr0 & X86_CR0_AM));
1691	Bs3RegSetCr0(fCr0 & ~X86_CR0_AM);
1692	bs3CpuBasic2_RaiseXcpt11Worker(bMode, pbBuf, false /fAm/, &g_aCmnModes[idxCmnModes]);
1693
1694	#if 1
1695	/* The second round is with aligment checks enabled. */
1696	Bs3RegSetCr0(Bs3RegGetCr0() \| X86_CR0_AM);
1697	bs3CpuBasic2_RaiseXcpt11Worker(bMode, pbBuf, true /fAm/, &g_aCmnModes[idxCmnModes]);
1698	#endif
1699
1700	Bs3RegSetCr0(fCr0);
1701	return 0;
1702	}
1703
1704
1705	/**
1706	* Executes one round of SIDT and SGDT tests using one assembly worker.
1707	*
1708	* This is written with driving everything from the 16-bit or 32-bit worker in
1709	* mind, i.e. not assuming the test bitcount is the same as the current.
1710	*/
1711	static void bs3CpuBasic2_sidt_sgdt_One(BS3CB2SIDTSGDT const BS3_FAR *pWorker, uint8_t bTestMode, uint8_t bRing,
1712	uint8_t const *pbExpected)
1713	{
1714	BS3TRAPFRAME TrapCtx;
1715	BS3REGCTX Ctx;
1716	BS3REGCTX CtxUdExpected;
1717	BS3REGCTX TmpCtx;
1718	uint8_t const cbBuf = 82; / test buffer area */
1719	uint8_t abBuf[82 + 8 + 8]; / test buffer w/ misalignment test space and some extra guard. */
1720	uint8_t BS3_FAR *pbBuf = abBuf;
1721	uint8_t const cbIdtr = BS3_MODE_IS_64BIT_CODE(bTestMode) ? 2+8 : 2+4;
1722	bool const f286 = (g_uBs3CpuDetected & BS3CPU_TYPE_MASK) == BS3CPU_80286;
1723	uint8_t bFiller;
1724	int off;
1725	int off2;
1726	unsigned cb;
1727	uint8_t BS3_FAR *pbTest;
1728
1729	/* make sure they're allocated */
1730	Bs3MemZero(&Ctx, sizeof(Ctx));
1731	Bs3MemZero(&CtxUdExpected, sizeof(CtxUdExpected));
1732	Bs3MemZero(&TmpCtx, sizeof(TmpCtx));
1733	Bs3MemZero(&TrapCtx, sizeof(TrapCtx));
1734	Bs3MemZero(&abBuf, sizeof(abBuf));
1735
1736	/* Create a context, give this routine some more stack space, point the context
1737	at our SIDT [xBX] + UD2 combo, and point DS:xBX at abBuf. */
1738	Bs3RegCtxSaveEx(&Ctx, bTestMode, 256 /cbExtraStack/);
1739	Bs3RegCtxSetGrpSegFromCurPtr(&Ctx, &Ctx.rbx, pWorker->fSs ? &Ctx.ss : &Ctx.ds, abBuf);
1740	Bs3RegCtxSetRipCsFromLnkPtr(&Ctx, pWorker->fpfnWorker);
1741	if (BS3_MODE_IS_16BIT_SYS(bTestMode))
1742	g_uBs3TrapEipHint = Ctx.rip.u32;
1743	if (!BS3_MODE_IS_RM_OR_V86(bTestMode))
1744	Bs3RegCtxConvertToRingX(&Ctx, bRing);
1745
1746	/* For successful SIDT attempts, we'll stop at the UD2. */
1747	Bs3MemCpy(&CtxUdExpected, &Ctx, sizeof(Ctx));
1748	CtxUdExpected.rip.u += pWorker->cbInstr;
1749
1750	/*
1751	* Check that it works at all and that only bytes we expect gets written to.
1752	*/
1753	/* First with zero buffer. */
1754	Bs3MemZero(abBuf, sizeof(abBuf));
1755	if (!ASMMemIsAllU8(abBuf, sizeof(abBuf), 0))
1756	Bs3TestFailedF("ASMMemIsAllU8 or Bs3MemZero is busted: abBuf=%.*Rhxs\n", sizeof(abBuf), pbBuf);
1757	if (!ASMMemIsZero(abBuf, sizeof(abBuf)))
1758	Bs3TestFailedF("ASMMemIsZero or Bs3MemZero is busted: abBuf=%.*Rhxs\n", sizeof(abBuf), pbBuf);
1759	Bs3TrapSetJmpAndRestore(&Ctx, &TrapCtx);
1760	bs3CpuBasic2_CompareUdCtx(&TrapCtx, &CtxUdExpected);
1761	if (f286 && abBuf[cbIdtr - 1] != 0xff)
1762	Bs3TestFailedF("286: Top base byte isn't 0xff (#1): %#x\n", abBuf[cbIdtr - 1]);
1763	if (!ASMMemIsZero(&abBuf[cbIdtr], cbBuf - cbIdtr))
1764	Bs3TestFailedF("Unexpected buffer bytes set (#1): cbIdtr=%u abBuf=%.*Rhxs\n", cbIdtr, cbBuf, pbBuf);
1765	if (Bs3MemCmp(abBuf, pbExpected, cbIdtr) != 0)
1766	Bs3TestFailedF("Mismatch (%s,#1): expected %.Rhxs, got %.Rhxs\n", pWorker->pszDesc, cbIdtr, pbExpected, cbIdtr, abBuf);
1767	g_usBs3TestStep++;
1768
1769	/* Again with a buffer filled with a byte not occuring in the previous result. */
1770	bFiller = 0x55;
1771	while (Bs3MemChr(abBuf, bFiller, cbBuf) != NULL)
1772	bFiller++;
1773	Bs3MemSet(abBuf, bFiller, sizeof(abBuf));
1774	if (!ASMMemIsAllU8(abBuf, sizeof(abBuf), bFiller))
1775	Bs3TestFailedF("ASMMemIsAllU8 or Bs3MemSet is busted: bFiller=%#x abBuf=%.*Rhxs\n", bFiller, sizeof(abBuf), pbBuf);
1776
1777	Bs3TrapSetJmpAndRestore(&Ctx, &TrapCtx);
1778	bs3CpuBasic2_CompareUdCtx(&TrapCtx, &CtxUdExpected);
1779	if (f286 && abBuf[cbIdtr - 1] != 0xff)
1780	Bs3TestFailedF("286: Top base byte isn't 0xff (#2): %#x\n", abBuf[cbIdtr - 1]);
1781	if (!ASMMemIsAllU8(&abBuf[cbIdtr], cbBuf - cbIdtr, bFiller))
1782	Bs3TestFailedF("Unexpected buffer bytes set (#2): cbIdtr=%u bFiller=%#x abBuf=%.*Rhxs\n", cbIdtr, bFiller, cbBuf, pbBuf);
1783	if (Bs3MemChr(abBuf, bFiller, cbIdtr) != NULL)
1784	Bs3TestFailedF("Not all bytes touched: cbIdtr=%u bFiller=%#x abBuf=%.*Rhxs\n", cbIdtr, bFiller, cbBuf, pbBuf);
1785	if (Bs3MemCmp(abBuf, pbExpected, cbIdtr) != 0)
1786	Bs3TestFailedF("Mismatch (%s,#2): expected %.Rhxs, got %.Rhxs\n", pWorker->pszDesc, cbIdtr, pbExpected, cbIdtr, abBuf);
1787	g_usBs3TestStep++;
1788
1789	/*
1790	* Slide the buffer along 8 bytes to cover misalignment.
1791	*/
1792	for (off = 0; off < 8; off++)
1793	{
1794	pbBuf = &abBuf[off];
1795	Bs3RegCtxSetGrpSegFromCurPtr(&Ctx, &Ctx.rbx, pWorker->fSs ? &Ctx.ss : &Ctx.ds, &abBuf[off]);
1796	CtxUdExpected.rbx.u = Ctx.rbx.u;
1797
1798	/* First with zero buffer. */
1799	Bs3MemZero(abBuf, sizeof(abBuf));
1800	Bs3TrapSetJmpAndRestore(&Ctx, &TrapCtx);
1801	bs3CpuBasic2_CompareUdCtx(&TrapCtx, &CtxUdExpected);
1802	if (off > 0 && !ASMMemIsZero(abBuf, off))
1803	Bs3TestFailedF("Unexpected buffer bytes set before (#3): cbIdtr=%u off=%u abBuf=%.*Rhxs\n",
1804	cbIdtr, off, off + cbBuf, abBuf);
1805	if (!ASMMemIsZero(&abBuf[off + cbIdtr], sizeof(abBuf) - cbIdtr - off))
1806	Bs3TestFailedF("Unexpected buffer bytes set after (#3): cbIdtr=%u off=%u abBuf=%.*Rhxs\n",
1807	cbIdtr, off, off + cbBuf, abBuf);
1808	if (f286 && abBuf[off + cbIdtr - 1] != 0xff)
1809	Bs3TestFailedF("286: Top base byte isn't 0xff (#3): %#x\n", abBuf[off + cbIdtr - 1]);
1810	if (Bs3MemCmp(&abBuf[off], pbExpected, cbIdtr) != 0)
1811	Bs3TestFailedF("Mismatch (#3): expected %.Rhxs, got %.Rhxs\n", cbIdtr, pbExpected, cbIdtr, &abBuf[off]);
1812	g_usBs3TestStep++;
1813
1814	/* Again with a buffer filled with a byte not occuring in the previous result. */
1815	Bs3MemSet(abBuf, bFiller, sizeof(abBuf));
1816	Bs3TrapSetJmpAndRestore(&Ctx, &TrapCtx);
1817	bs3CpuBasic2_CompareUdCtx(&TrapCtx, &CtxUdExpected);
1818	if (off > 0 && !ASMMemIsAllU8(abBuf, off, bFiller))
1819	Bs3TestFailedF("Unexpected buffer bytes set before (#4): cbIdtr=%u off=%u bFiller=%#x abBuf=%.*Rhxs\n",
1820	cbIdtr, off, bFiller, off + cbBuf, abBuf);
1821	if (!ASMMemIsAllU8(&abBuf[off + cbIdtr], sizeof(abBuf) - cbIdtr - off, bFiller))
1822	Bs3TestFailedF("Unexpected buffer bytes set after (#4): cbIdtr=%u off=%u bFiller=%#x abBuf=%.*Rhxs\n",
1823	cbIdtr, off, bFiller, off + cbBuf, abBuf);
1824	if (Bs3MemChr(&abBuf[off], bFiller, cbIdtr) != NULL)
1825	Bs3TestFailedF("Not all bytes touched (#4): cbIdtr=%u off=%u bFiller=%#x abBuf=%.*Rhxs\n",
1826	cbIdtr, off, bFiller, off + cbBuf, abBuf);
1827	if (f286 && abBuf[off + cbIdtr - 1] != 0xff)
1828	Bs3TestFailedF("286: Top base byte isn't 0xff (#4): %#x\n", abBuf[off + cbIdtr - 1]);
1829	if (Bs3MemCmp(&abBuf[off], pbExpected, cbIdtr) != 0)
1830	Bs3TestFailedF("Mismatch (#4): expected %.Rhxs, got %.Rhxs\n", cbIdtr, pbExpected, cbIdtr, &abBuf[off]);
1831	g_usBs3TestStep++;
1832	}
1833	pbBuf = abBuf;
1834	Bs3RegCtxSetGrpSegFromCurPtr(&Ctx, &Ctx.rbx, pWorker->fSs ? &Ctx.ss : &Ctx.ds, abBuf);
1835	CtxUdExpected.rbx.u = Ctx.rbx.u;
1836
1837	/*
1838	* Play with the selector limit if the target mode supports limit checking
1839	* We use BS3_SEL_TEST_PAGE_00 for this
1840	*/
1841	if ( !BS3_MODE_IS_RM_OR_V86(bTestMode)
1842	&& !BS3_MODE_IS_64BIT_CODE(bTestMode))
1843	{
1844	uint16_t cbLimit;
1845	uint32_t uFlatBuf = Bs3SelPtrToFlat(abBuf);
1846	Bs3GdteTestPage00 = Bs3Gdte_DATA16;
1847	Bs3GdteTestPage00.Gen.u2Dpl = bRing;
1848	Bs3GdteTestPage00.Gen.u16BaseLow = (uint16_t)uFlatBuf;
1849	Bs3GdteTestPage00.Gen.u8BaseHigh1 = (uint8_t)(uFlatBuf >> 16);
1850	Bs3GdteTestPage00.Gen.u8BaseHigh2 = (uint8_t)(uFlatBuf >> 24);
1851
1852	if (pWorker->fSs)
1853	CtxUdExpected.ss = Ctx.ss = BS3_SEL_TEST_PAGE_00 \| bRing;
1854	else
1855	CtxUdExpected.ds = Ctx.ds = BS3_SEL_TEST_PAGE_00 \| bRing;
1856
1857	/* Expand up (normal). */
1858	for (off = 0; off < 8; off++)
1859	{
1860	CtxUdExpected.rbx.u = Ctx.rbx.u = off;
1861	for (cbLimit = 0; cbLimit < cbIdtr*2; cbLimit++)
1862	{
1863	Bs3GdteTestPage00.Gen.u16LimitLow = cbLimit;
1864	Bs3MemSet(abBuf, bFiller, sizeof(abBuf));
1865	Bs3TrapSetJmpAndRestore(&Ctx, &TrapCtx);
1866	if (off + cbIdtr <= cbLimit + 1)
1867	{
1868	bs3CpuBasic2_CompareUdCtx(&TrapCtx, &CtxUdExpected);
1869	if (Bs3MemChr(&abBuf[off], bFiller, cbIdtr) != NULL)
1870	Bs3TestFailedF("Not all bytes touched (#5): cbIdtr=%u off=%u cbLimit=%u bFiller=%#x abBuf=%.*Rhxs\n",
1871	cbIdtr, off, cbLimit, bFiller, off + cbBuf, abBuf);
1872	if (Bs3MemCmp(&abBuf[off], pbExpected, cbIdtr) != 0)
1873	Bs3TestFailedF("Mismatch (#5): expected %.Rhxs, got %.Rhxs\n", cbIdtr, pbExpected, cbIdtr, &abBuf[off]);
1874	if (f286 && abBuf[off + cbIdtr - 1] != 0xff)
1875	Bs3TestFailedF("286: Top base byte isn't 0xff (#5): %#x\n", abBuf[off + cbIdtr - 1]);
1876	}
1877	else
1878	{
1879	if (pWorker->fSs)
1880	bs3CpuBasic2_CompareSsCtx(&TrapCtx, &Ctx, 0, false /f486ResumeFlagHint/);
1881	else
1882	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &Ctx, 0);
1883	if (off + 2 <= cbLimit + 1)
1884	{
1885	if (Bs3MemChr(&abBuf[off], bFiller, 2) != NULL)
1886	Bs3TestFailedF("Limit bytes not touched (#6): cbIdtr=%u off=%u cbLimit=%u bFiller=%#x abBuf=%.*Rhxs\n",
1887	cbIdtr, off, cbLimit, bFiller, off + cbBuf, abBuf);
1888	if (Bs3MemCmp(&abBuf[off], pbExpected, 2) != 0)
1889	Bs3TestFailedF("Mismatch (#6): expected %.2Rhxs, got %.2Rhxs\n", pbExpected, &abBuf[off]);
1890	if (!ASMMemIsAllU8(&abBuf[off + 2], cbIdtr - 2, bFiller))
1891	Bs3TestFailedF("Base bytes touched on #GP (#6): cbIdtr=%u off=%u cbLimit=%u bFiller=%#x abBuf=%.*Rhxs\n",
1892	cbIdtr, off, cbLimit, bFiller, off + cbBuf, abBuf);
1893	}
1894	else if (!ASMMemIsAllU8(abBuf, sizeof(abBuf), bFiller))
1895	Bs3TestFailedF("Bytes touched on #GP: cbIdtr=%u off=%u cbLimit=%u bFiller=%#x abBuf=%.*Rhxs\n",
1896	cbIdtr, off, cbLimit, bFiller, off + cbBuf, abBuf);
1897	}
1898
1899	if (off > 0 && !ASMMemIsAllU8(abBuf, off, bFiller))
1900	Bs3TestFailedF("Leading bytes touched (#7): cbIdtr=%u off=%u cbLimit=%u bFiller=%#x abBuf=%.*Rhxs\n",
1901	cbIdtr, off, cbLimit, bFiller, off + cbBuf, abBuf);
1902	if (!ASMMemIsAllU8(&abBuf[off + cbIdtr], sizeof(abBuf) - off - cbIdtr, bFiller))
1903	Bs3TestFailedF("Trailing bytes touched (#7): cbIdtr=%u off=%u cbLimit=%u bFiller=%#x abBuf=%.*Rhxs\n",
1904	cbIdtr, off, cbLimit, bFiller, off + cbBuf, abBuf);
1905
1906	g_usBs3TestStep++;
1907	}
1908	}
1909
1910	/* Expand down (weird). Inverted valid area compared to expand up,
1911	so a limit of zero give us a valid range for 0001..0ffffh (instead of
1912	a segment with one valid byte at 0000h). Whereas a limit of 0fffeh
1913	means one valid byte at 0ffffh, and a limit of 0ffffh means none
1914	(because in a normal expand up the 0ffffh means all 64KB are
1915	accessible). */
1916	Bs3GdteTestPage00.Gen.u4Type = X86_SEL_TYPE_RW_DOWN_ACC;
1917	for (off = 0; off < 8; off++)
1918	{
1919	CtxUdExpected.rbx.u = Ctx.rbx.u = off;
1920	for (cbLimit = 0; cbLimit < cbIdtr*2; cbLimit++)
1921	{
1922	Bs3GdteTestPage00.Gen.u16LimitLow = cbLimit;
1923	Bs3MemSet(abBuf, bFiller, sizeof(abBuf));
1924	Bs3TrapSetJmpAndRestore(&Ctx, &TrapCtx);
1925
1926	if (off > cbLimit)
1927	{
1928	bs3CpuBasic2_CompareUdCtx(&TrapCtx, &CtxUdExpected);
1929	if (Bs3MemChr(&abBuf[off], bFiller, cbIdtr) != NULL)
1930	Bs3TestFailedF("Not all bytes touched (#8): cbIdtr=%u off=%u cbLimit=%u bFiller=%#x abBuf=%.*Rhxs\n",
1931	cbIdtr, off, cbLimit, bFiller, off + cbBuf, abBuf);
1932	if (Bs3MemCmp(&abBuf[off], pbExpected, cbIdtr) != 0)
1933	Bs3TestFailedF("Mismatch (#8): expected %.Rhxs, got %.Rhxs\n", cbIdtr, pbExpected, cbIdtr, &abBuf[off]);
1934	if (f286 && abBuf[off + cbIdtr - 1] != 0xff)
1935	Bs3TestFailedF("286: Top base byte isn't 0xff (#8): %#x\n", abBuf[off + cbIdtr - 1]);
1936	}
1937	else
1938	{
1939	if (pWorker->fSs)
1940	bs3CpuBasic2_CompareSsCtx(&TrapCtx, &Ctx, 0, false /f486ResumeFlagHint/);
1941	else
1942	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &Ctx, 0);
1943	if (!ASMMemIsAllU8(abBuf, sizeof(abBuf), bFiller))
1944	Bs3TestFailedF("Bytes touched on #GP: cbIdtr=%u off=%u cbLimit=%u bFiller=%#x abBuf=%.*Rhxs\n",
1945	cbIdtr, off, cbLimit, bFiller, off + cbBuf, abBuf);
1946	}
1947
1948	if (off > 0 && !ASMMemIsAllU8(abBuf, off, bFiller))
1949	Bs3TestFailedF("Leading bytes touched (#9): cbIdtr=%u off=%u cbLimit=%u bFiller=%#x abBuf=%.*Rhxs\n",
1950	cbIdtr, off, cbLimit, bFiller, off + cbBuf, abBuf);
1951	if (!ASMMemIsAllU8(&abBuf[off + cbIdtr], sizeof(abBuf) - off - cbIdtr, bFiller))
1952	Bs3TestFailedF("Trailing bytes touched (#9): cbIdtr=%u off=%u cbLimit=%u bFiller=%#x abBuf=%.*Rhxs\n",
1953	cbIdtr, off, cbLimit, bFiller, off + cbBuf, abBuf);
1954
1955	g_usBs3TestStep++;
1956	}
1957	}
1958
1959	Bs3RegCtxSetGrpSegFromCurPtr(&Ctx, &Ctx.rbx, pWorker->fSs ? &Ctx.ss : &Ctx.ds, abBuf);
1960	CtxUdExpected.rbx.u = Ctx.rbx.u;
1961	CtxUdExpected.ss = Ctx.ss;
1962	CtxUdExpected.ds = Ctx.ds;
1963	}
1964
1965	/*
1966	* Play with the paging.
1967	*/
1968	if ( BS3_MODE_IS_PAGED(bTestMode)
1969	&& (!pWorker->fSs \|\| bRing == 3) /* SS.DPL == CPL, we'll get some tiled ring-3 selector here. */
1970	&& (pbTest = (uint8_t BS3_FAR *)Bs3MemGuardedTestPageAlloc(BS3MEMKIND_TILED)) != NULL)
1971	{
1972	RTCCUINTXREG uFlatTest = Bs3SelPtrToFlat(pbTest);
1973
1974	/*
1975	* Slide the buffer towards the trailing guard page. We'll observe the
1976	* first word being written entirely separately from the 2nd dword/qword.
1977	*/
1978	for (off = X86_PAGE_SIZE - cbIdtr - 4; off < X86_PAGE_SIZE + 4; off++)
1979	{
1980	Bs3MemSet(&pbTest[X86_PAGE_SIZE - cbIdtr * 2], bFiller, cbIdtr * 2);
1981	Bs3RegCtxSetGrpSegFromCurPtr(&Ctx, &Ctx.rbx, pWorker->fSs ? &Ctx.ss : &Ctx.ds, &pbTest[off]);
1982	Bs3TrapSetJmpAndRestore(&Ctx, &TrapCtx);
1983	if (off + cbIdtr <= X86_PAGE_SIZE)
1984	{
1985	CtxUdExpected.rbx = Ctx.rbx;
1986	CtxUdExpected.ss = Ctx.ss;
1987	CtxUdExpected.ds = Ctx.ds;
1988	bs3CpuBasic2_CompareUdCtx(&TrapCtx, &CtxUdExpected);
1989	if (Bs3MemCmp(&pbTest[off], pbExpected, cbIdtr) != 0)
1990	Bs3TestFailedF("Mismatch (#9): expected %.Rhxs, got %.Rhxs\n", cbIdtr, pbExpected, cbIdtr, &pbTest[off]);
1991	}
1992	else
1993	{
1994	bs3CpuBasic2_ComparePfCtx(&TrapCtx, &Ctx, X86_TRAP_PF_RW \| (Ctx.bCpl == 3 ? X86_TRAP_PF_US : 0),
1995	uFlatTest + RT_MAX(off, X86_PAGE_SIZE));
1996	if ( off <= X86_PAGE_SIZE - 2
1997	&& Bs3MemCmp(&pbTest[off], pbExpected, 2) != 0)
1998	Bs3TestFailedF("Mismatch (#10): Expected limit %.2Rhxs, got %.2Rhxs; off=%#x\n",
1999	pbExpected, &pbTest[off], off);
2000	if ( off < X86_PAGE_SIZE - 2
2001	&& !ASMMemIsAllU8(&pbTest[off + 2], X86_PAGE_SIZE - off - 2, bFiller))
2002	Bs3TestFailedF("Wrote partial base on #PF (#10): bFiller=%#x, got %.*Rhxs; off=%#x\n",
2003	bFiller, X86_PAGE_SIZE - off - 2, &pbTest[off + 2], off);
2004	if (off == X86_PAGE_SIZE - 1 && pbTest[off] != bFiller)
2005	Bs3TestFailedF("Wrote partial limit on #PF (#10): Expected %02x, got %02x\n", bFiller, pbTest[off]);
2006	}
2007	g_usBs3TestStep++;
2008	}
2009
2010	/*
2011	* Now, do it the other way around. It should look normal now since writing
2012	* the limit will #PF first and nothing should be written.
2013	*/
2014	for (off = cbIdtr + 4; off >= -cbIdtr - 4; off--)
2015	{
2016	Bs3MemSet(pbTest, bFiller, 48);
2017	Bs3RegCtxSetGrpSegFromCurPtr(&Ctx, &Ctx.rbx, pWorker->fSs ? &Ctx.ss : &Ctx.ds, &pbTest[off]);
2018	Bs3TrapSetJmpAndRestore(&Ctx, &TrapCtx);
2019	if (off >= 0)
2020	{
2021	CtxUdExpected.rbx = Ctx.rbx;
2022	CtxUdExpected.ss = Ctx.ss;
2023	CtxUdExpected.ds = Ctx.ds;
2024	bs3CpuBasic2_CompareUdCtx(&TrapCtx, &CtxUdExpected);
2025	if (Bs3MemCmp(&pbTest[off], pbExpected, cbIdtr) != 0)
2026	Bs3TestFailedF("Mismatch (#11): expected %.Rhxs, got %.Rhxs\n", cbIdtr, pbExpected, cbIdtr, &pbTest[off]);
2027	}
2028	else
2029	{
2030	bs3CpuBasic2_ComparePfCtx(&TrapCtx, &Ctx, X86_TRAP_PF_RW \| (Ctx.bCpl == 3 ? X86_TRAP_PF_US : 0), uFlatTest + off);
2031	if ( -off < cbIdtr
2032	&& !ASMMemIsAllU8(pbTest, cbIdtr + off, bFiller))
2033	Bs3TestFailedF("Wrote partial content on #PF (#12): bFiller=%#x, found %.*Rhxs; off=%d\n",
2034	bFiller, cbIdtr + off, pbTest, off);
2035	}
2036	if (!ASMMemIsAllU8(&pbTest[RT_MAX(cbIdtr + off, 0)], 16, bFiller))
2037	Bs3TestFailedF("Wrote beyond expected area (#13): bFiller=%#x, found %.16Rhxs; off=%d\n",
2038	bFiller, &pbTest[RT_MAX(cbIdtr + off, 0)], off);
2039	g_usBs3TestStep++;
2040	}
2041
2042	/*
2043	* Combine paging and segment limit and check ordering.
2044	* This is kind of interesting here since it the instruction seems to
2045	* be doing two separate writes.
2046	*/
2047	if ( !BS3_MODE_IS_RM_OR_V86(bTestMode)
2048	&& !BS3_MODE_IS_64BIT_CODE(bTestMode))
2049	{
2050	uint16_t cbLimit;
2051
2052	Bs3GdteTestPage00 = Bs3Gdte_DATA16;
2053	Bs3GdteTestPage00.Gen.u2Dpl = bRing;
2054	Bs3GdteTestPage00.Gen.u16BaseLow = (uint16_t)uFlatTest;
2055	Bs3GdteTestPage00.Gen.u8BaseHigh1 = (uint8_t)(uFlatTest >> 16);
2056	Bs3GdteTestPage00.Gen.u8BaseHigh2 = (uint8_t)(uFlatTest >> 24);
2057
2058	if (pWorker->fSs)
2059	CtxUdExpected.ss = Ctx.ss = BS3_SEL_TEST_PAGE_00 \| bRing;
2060	else
2061	CtxUdExpected.ds = Ctx.ds = BS3_SEL_TEST_PAGE_00 \| bRing;
2062
2063	/* Expand up (normal), approaching tail guard page. */
2064	for (off = X86_PAGE_SIZE - cbIdtr - 4; off < X86_PAGE_SIZE + 4; off++)
2065	{
2066	CtxUdExpected.rbx.u = Ctx.rbx.u = off;
2067	for (cbLimit = X86_PAGE_SIZE - cbIdtr2; cbLimit < X86_PAGE_SIZE + cbIdtr2; cbLimit++)
2068	{
2069	Bs3GdteTestPage00.Gen.u16LimitLow = cbLimit;
2070	Bs3MemSet(&pbTest[X86_PAGE_SIZE - cbIdtr * 2], bFiller, cbIdtr * 2);
2071	Bs3TrapSetJmpAndRestore(&Ctx, &TrapCtx);
2072	if (off + cbIdtr <= cbLimit + 1)
2073	{
2074	/* No #GP, but maybe #PF. */
2075	if (off + cbIdtr <= X86_PAGE_SIZE)
2076	{
2077	bs3CpuBasic2_CompareUdCtx(&TrapCtx, &CtxUdExpected);
2078	if (Bs3MemCmp(&pbTest[off], pbExpected, cbIdtr) != 0)
2079	Bs3TestFailedF("Mismatch (#14): expected %.Rhxs, got %.Rhxs\n",
2080	cbIdtr, pbExpected, cbIdtr, &pbTest[off]);
2081	}
2082	else
2083	{
2084	bs3CpuBasic2_ComparePfCtx(&TrapCtx, &Ctx, X86_TRAP_PF_RW \| (Ctx.bCpl == 3 ? X86_TRAP_PF_US : 0),
2085	uFlatTest + RT_MAX(off, X86_PAGE_SIZE));
2086	if ( off <= X86_PAGE_SIZE - 2
2087	&& Bs3MemCmp(&pbTest[off], pbExpected, 2) != 0)
2088	Bs3TestFailedF("Mismatch (#15): Expected limit %.2Rhxs, got %.2Rhxs; off=%#x\n",
2089	pbExpected, &pbTest[off], off);
2090	cb = X86_PAGE_SIZE - off - 2;
2091	if ( off < X86_PAGE_SIZE - 2
2092	&& !ASMMemIsAllU8(&pbTest[off + 2], cb, bFiller))
2093	Bs3TestFailedF("Wrote partial base on #PF (#15): bFiller=%#x, got %.*Rhxs; off=%#x\n",
2094	bFiller, cb, &pbTest[off + 2], off);
2095	if (off == X86_PAGE_SIZE - 1 && pbTest[off] != bFiller)
2096	Bs3TestFailedF("Wrote partial limit on #PF (#15): Expected %02x, got %02x\n", bFiller, pbTest[off]);
2097	}
2098	}
2099	else if (off + 2 <= cbLimit + 1)
2100	{
2101	/* [ig]tr.limit writing does not cause #GP, but may cause #PG, if not writing the base causes #GP. */
2102	if (off <= X86_PAGE_SIZE - 2)
2103	{
2104	if (pWorker->fSs)
2105	bs3CpuBasic2_CompareSsCtx(&TrapCtx, &Ctx, 0, false /f486ResumeFlagHint/);
2106	else
2107	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &Ctx, 0);
2108	if (Bs3MemCmp(&pbTest[off], pbExpected, 2) != 0)
2109	Bs3TestFailedF("Mismatch (#16): Expected limit %.2Rhxs, got %.2Rhxs; off=%#x\n",
2110	pbExpected, &pbTest[off], off);
2111	cb = X86_PAGE_SIZE - off - 2;
2112	if ( off < X86_PAGE_SIZE - 2
2113	&& !ASMMemIsAllU8(&pbTest[off + 2], cb, bFiller))
2114	Bs3TestFailedF("Wrote partial base with limit (#16): bFiller=%#x, got %.*Rhxs; off=%#x\n",
2115	bFiller, cb, &pbTest[off + 2], off);
2116	}
2117	else
2118	{
2119	bs3CpuBasic2_ComparePfCtx(&TrapCtx, &Ctx, X86_TRAP_PF_RW \| (Ctx.bCpl == 3 ? X86_TRAP_PF_US : 0),
2120	uFlatTest + RT_MAX(off, X86_PAGE_SIZE));
2121	if ( off < X86_PAGE_SIZE
2122	&& !ASMMemIsAllU8(&pbTest[off], X86_PAGE_SIZE - off, bFiller))
2123	Bs3TestFailedF("Mismatch (#16): Partial limit write on #PF: bFiller=%#x, got %.*Rhxs\n",
2124	bFiller, X86_PAGE_SIZE - off, &pbTest[off]);
2125	}
2126	}
2127	else
2128	{
2129	/* #GP/#SS on limit. */
2130	if (pWorker->fSs)
2131	bs3CpuBasic2_CompareSsCtx(&TrapCtx, &Ctx, 0, false /f486ResumeFlagHint/);
2132	else
2133	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &Ctx, 0);
2134	if ( off < X86_PAGE_SIZE
2135	&& !ASMMemIsAllU8(&pbTest[off], X86_PAGE_SIZE - off, bFiller))
2136	Bs3TestFailedF("Mismatch (#17): Partial write on #GP: bFiller=%#x, got %.*Rhxs\n",
2137	bFiller, X86_PAGE_SIZE - off, &pbTest[off]);
2138	}
2139
2140	cb = RT_MIN(cbIdtr * 2, off - (X86_PAGE_SIZE - cbIdtr*2));
2141	if (!ASMMemIsAllU8(&pbTest[X86_PAGE_SIZE - cbIdtr * 2], cb, bFiller))
2142	Bs3TestFailedF("Leading bytes touched (#18): cbIdtr=%u off=%u cbLimit=%u bFiller=%#x pbTest=%.*Rhxs\n",
2143	cbIdtr, off, cbLimit, bFiller, cb, pbTest[X86_PAGE_SIZE - cbIdtr * 2]);
2144
2145	g_usBs3TestStep++;
2146
2147	/* Set DS to 0 and check that we get #GP(0). */
2148	if (!pWorker->fSs)
2149	{
2150	Ctx.ds = 0;
2151	Bs3TrapSetJmpAndRestore(&Ctx, &TrapCtx);
2152	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &Ctx, 0);
2153	Ctx.ds = BS3_SEL_TEST_PAGE_00 \| bRing;
2154	g_usBs3TestStep++;
2155	}
2156	}
2157	}
2158
2159	/* Expand down. */
2160	pbTest -= X86_PAGE_SIZE; /* Note! we're backing up a page to simplify things */
2161	uFlatTest -= X86_PAGE_SIZE;
2162
2163	Bs3GdteTestPage00.Gen.u4Type = X86_SEL_TYPE_RW_DOWN_ACC;
2164	Bs3GdteTestPage00.Gen.u16BaseLow = (uint16_t)uFlatTest;
2165	Bs3GdteTestPage00.Gen.u8BaseHigh1 = (uint8_t)(uFlatTest >> 16);
2166	Bs3GdteTestPage00.Gen.u8BaseHigh2 = (uint8_t)(uFlatTest >> 24);
2167
2168	for (off = X86_PAGE_SIZE - cbIdtr - 4; off < X86_PAGE_SIZE + 4; off++)
2169	{
2170	CtxUdExpected.rbx.u = Ctx.rbx.u = off;
2171	for (cbLimit = X86_PAGE_SIZE - cbIdtr2; cbLimit < X86_PAGE_SIZE + cbIdtr2; cbLimit++)
2172	{
2173	Bs3GdteTestPage00.Gen.u16LimitLow = cbLimit;
2174	Bs3MemSet(&pbTest[X86_PAGE_SIZE], bFiller, cbIdtr * 2);
2175	Bs3TrapSetJmpAndRestore(&Ctx, &TrapCtx);
2176	if (cbLimit < off && off >= X86_PAGE_SIZE)
2177	{
2178	bs3CpuBasic2_CompareUdCtx(&TrapCtx, &CtxUdExpected);
2179	if (Bs3MemCmp(&pbTest[off], pbExpected, cbIdtr) != 0)
2180	Bs3TestFailedF("Mismatch (#19): expected %.Rhxs, got %.Rhxs\n",
2181	cbIdtr, pbExpected, cbIdtr, &pbTest[off]);
2182	cb = X86_PAGE_SIZE + cbIdtr*2 - off;
2183	if (!ASMMemIsAllU8(&pbTest[off + cbIdtr], cb, bFiller))
2184	Bs3TestFailedF("Trailing bytes touched (#20): cbIdtr=%u off=%u cbLimit=%u bFiller=%#x pbTest=%.*Rhxs\n",
2185	cbIdtr, off, cbLimit, bFiller, cb, pbTest[off + cbIdtr]);
2186	}
2187	else
2188	{
2189	if (cbLimit < off && off < X86_PAGE_SIZE)
2190	bs3CpuBasic2_ComparePfCtx(&TrapCtx, &Ctx, X86_TRAP_PF_RW \| (Ctx.bCpl == 3 ? X86_TRAP_PF_US : 0),
2191	uFlatTest + off);
2192	else if (pWorker->fSs)
2193	bs3CpuBasic2_CompareSsCtx(&TrapCtx, &Ctx, 0, false /f486ResumeFlagHint/);
2194	else
2195	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &Ctx, 0);
2196	cb = cbIdtr*2;
2197	if (!ASMMemIsAllU8(&pbTest[X86_PAGE_SIZE], cb, bFiller))
2198	Bs3TestFailedF("Trailing bytes touched (#20): cbIdtr=%u off=%u cbLimit=%u bFiller=%#x pbTest=%.*Rhxs\n",
2199	cbIdtr, off, cbLimit, bFiller, cb, pbTest[X86_PAGE_SIZE]);
2200	}
2201	g_usBs3TestStep++;
2202	}
2203	}
2204
2205	pbTest += X86_PAGE_SIZE;
2206	uFlatTest += X86_PAGE_SIZE;
2207	}
2208
2209	Bs3MemGuardedTestPageFree(pbTest);
2210	}
2211
2212	/*
2213	* Check non-canonical 64-bit space.
2214	*/
2215	if ( BS3_MODE_IS_64BIT_CODE(bTestMode)
2216	&& (pbTest = (uint8_t BS3_FAR *)Bs3PagingSetupCanonicalTraps()) != NULL)
2217	{
2218	/* Make our references relative to the gap. */
2219	pbTest += g_cbBs3PagingOneCanonicalTrap;
2220
2221	/* Hit it from below. */
2222	for (off = -cbIdtr - 8; off < cbIdtr + 8; off++)
2223	{
2224	Ctx.rbx.u = CtxUdExpected.rbx.u = UINT64_C(0x0000800000000000) + off;
2225	Bs3MemSet(&pbTest[-64], bFiller, 64*2);
2226	Bs3TrapSetJmpAndRestore(&Ctx, &TrapCtx);
2227	if (off + cbIdtr <= 0)
2228	{
2229	bs3CpuBasic2_CompareUdCtx(&TrapCtx, &CtxUdExpected);
2230	if (Bs3MemCmp(&pbTest[off], pbExpected, cbIdtr) != 0)
2231	Bs3TestFailedF("Mismatch (#21): expected %.Rhxs, got %.Rhxs\n", cbIdtr, pbExpected, cbIdtr, &pbTest[off]);
2232	}
2233	else
2234	{
2235	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &Ctx, 0);
2236	if (off <= -2 && Bs3MemCmp(&pbTest[off], pbExpected, 2) != 0)
2237	Bs3TestFailedF("Mismatch (#21): expected limit %.2Rhxs, got %.2Rhxs\n", pbExpected, &pbTest[off]);
2238	off2 = off <= -2 ? 2 : 0;
2239	cb = cbIdtr - off2;
2240	if (!ASMMemIsAllU8(&pbTest[off + off2], cb, bFiller))
2241	Bs3TestFailedF("Mismatch (#21): touched base %.Rhxs, got %.Rhxs\n",
2242	cb, &pbExpected[off], cb, &pbTest[off + off2]);
2243	}
2244	if (!ASMMemIsAllU8(&pbTest[off - 16], 16, bFiller))
2245	Bs3TestFailedF("Leading bytes touched (#21): bFiller=%#x, got %.16Rhxs\n", bFiller, &pbTest[off]);
2246	if (!ASMMemIsAllU8(&pbTest[off + cbIdtr], 16, bFiller))
2247	Bs3TestFailedF("Trailing bytes touched (#21): bFiller=%#x, got %.16Rhxs\n", bFiller, &pbTest[off + cbIdtr]);
2248	}
2249
2250	/* Hit it from above. */
2251	for (off = -cbIdtr - 8; off < cbIdtr + 8; off++)
2252	{
2253	Ctx.rbx.u = CtxUdExpected.rbx.u = UINT64_C(0xffff800000000000) + off;
2254	Bs3MemSet(&pbTest[-64], bFiller, 64*2);
2255	Bs3TrapSetJmpAndRestore(&Ctx, &TrapCtx);
2256	if (off >= 0)
2257	{
2258	bs3CpuBasic2_CompareUdCtx(&TrapCtx, &CtxUdExpected);
2259	if (Bs3MemCmp(&pbTest[off], pbExpected, cbIdtr) != 0)
2260	Bs3TestFailedF("Mismatch (#22): expected %.Rhxs, got %.Rhxs\n", cbIdtr, pbExpected, cbIdtr, &pbTest[off]);
2261	}
2262	else
2263	{
2264	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &Ctx, 0);
2265	if (!ASMMemIsAllU8(&pbTest[off], cbIdtr, bFiller))
2266	Bs3TestFailedF("Mismatch (#22): touched base %.Rhxs, got %.Rhxs\n",
2267	cbIdtr, &pbExpected[off], cbIdtr, &pbTest[off]);
2268	}
2269	if (!ASMMemIsAllU8(&pbTest[off - 16], 16, bFiller))
2270	Bs3TestFailedF("Leading bytes touched (#22): bFiller=%#x, got %.16Rhxs\n", bFiller, &pbTest[off]);
2271	if (!ASMMemIsAllU8(&pbTest[off + cbIdtr], 16, bFiller))
2272	Bs3TestFailedF("Trailing bytes touched (#22): bFiller=%#x, got %.16Rhxs\n", bFiller, &pbTest[off + cbIdtr]);
2273	}
2274
2275	}
2276	}
2277
2278
2279	static void bs3CpuBasic2_sidt_sgdt_Common(uint8_t bTestMode, BS3CB2SIDTSGDT const BS3_FAR *paWorkers, unsigned cWorkers,
2280	uint8_t const *pbExpected)
2281	{
2282	unsigned idx;
2283	unsigned bRing;
2284	unsigned iStep = 0;
2285
2286	/* Note! We skip the SS checks for ring-0 since we badly mess up SS in the
2287	test and don't want to bother with double faults. */
2288	for (bRing = 0; bRing <= 3; bRing++)
2289	{
2290	for (idx = 0; idx < cWorkers; idx++)
2291	if ( (paWorkers[idx].bMode & (bTestMode & BS3_MODE_CODE_MASK))
2292	&& (!paWorkers[idx].fSs \|\| bRing != 0 /** @todo \|\| BS3_MODE_IS_64BIT_SYS(bTestMode)*/ ))
2293	{
2294	g_usBs3TestStep = iStep;
2295	bs3CpuBasic2_sidt_sgdt_One(&paWorkers[idx], bTestMode, bRing, pbExpected);
2296	iStep += 1000;
2297	}
2298	if (BS3_MODE_IS_RM_OR_V86(bTestMode))
2299	break;
2300	}
2301	}
2302
2303
2304	BS3_DECL_FAR(uint8_t) BS3_CMN_FAR_NM(bs3CpuBasic2_sidt)(uint8_t bMode)
2305	{
2306	union
2307	{
2308	RTIDTR Idtr;
2309	uint8_t ab[16];
2310	} Expected;
2311
2312	//if (bMode != BS3_MODE_LM64) return BS3TESTDOMODE_SKIPPED;
2313	bs3CpuBasic2_SetGlobals(bMode);
2314
2315	/*
2316	* Pass to common worker which is only compiled once per mode.
2317	*/
2318	Bs3MemZero(&Expected, sizeof(Expected));
2319	ASMGetIDTR(&Expected.Idtr);
2320	bs3CpuBasic2_sidt_sgdt_Common(bMode, g_aSidtWorkers, RT_ELEMENTS(g_aSidtWorkers), Expected.ab);
2321
2322	/*
2323	* Re-initialize the IDT.
2324	*/
2325	Bs3TrapReInit();
2326	return 0;
2327	}
2328
2329
2330	BS3_DECL_FAR(uint8_t) BS3_CMN_FAR_NM(bs3CpuBasic2_sgdt)(uint8_t bMode)
2331	{
2332	uint64_t const uOrgAddr = Bs3Lgdt_Gdt.uAddr;
2333	uint64_t uNew = 0;
2334	union
2335	{
2336	RTGDTR Gdtr;
2337	uint8_t ab[16];
2338	} Expected;
2339
2340	//if (bMode != BS3_MODE_LM64) return BS3TESTDOMODE_SKIPPED;
2341	bs3CpuBasic2_SetGlobals(bMode);
2342
2343	/*
2344	* If paged mode, try push the GDT way up.
2345	*/
2346	Bs3MemZero(&Expected, sizeof(Expected));
2347	ASMGetGDTR(&Expected.Gdtr);
2348	if (BS3_MODE_IS_PAGED(bMode))
2349	{
2350	/** @todo loading non-canonical base addresses. */
2351	int rc;
2352	uNew = BS3_MODE_IS_64BIT_SYS(bMode) ? UINT64_C(0xffff80fedcb70000) : UINT64_C(0xc2d28000);
2353	uNew \|= uOrgAddr & X86_PAGE_OFFSET_MASK;
2354	rc = Bs3PagingAlias(uNew, uOrgAddr, Bs3Lgdt_Gdt.cb, X86_PTE_P \| X86_PTE_RW \| X86_PTE_US \| X86_PTE_D \| X86_PTE_A);
2355	if (RT_SUCCESS(rc))
2356	{
2357	Bs3Lgdt_Gdt.uAddr = uNew;
2358	Bs3UtilSetFullGdtr(Bs3Lgdt_Gdt.cb, uNew);
2359	ASMGetGDTR(&Expected.Gdtr);
2360	if (BS3_MODE_IS_64BIT_SYS(bMode) && ARCH_BITS != 64)
2361	(uint32_t )&Expected.ab[6] = (uint32_t)(uNew >> 32);
2362	}
2363	}
2364
2365	/*
2366	* Pass to common worker which is only compiled once per mode.
2367	*/
2368	bs3CpuBasic2_sidt_sgdt_Common(bMode, g_aSgdtWorkers, RT_ELEMENTS(g_aSgdtWorkers), Expected.ab);
2369
2370	/*
2371	* Unalias the GDT.
2372	*/
2373	if (uNew != 0)
2374	{
2375	Bs3Lgdt_Gdt.uAddr = uOrgAddr;
2376	Bs3UtilSetFullGdtr(Bs3Lgdt_Gdt.cb, uOrgAddr);
2377	Bs3PagingUnalias(uNew, Bs3Lgdt_Gdt.cb);
2378	}
2379
2380	/*
2381	* Re-initialize the IDT.
2382	*/
2383	Bs3TrapReInit();
2384	return 0;
2385	}
2386
2387
2388
2389	/*
2390	* LIDT & LGDT
2391	*/
2392
2393	/**
2394	* Executes one round of LIDT and LGDT tests using one assembly worker.
2395	*
2396	* This is written with driving everything from the 16-bit or 32-bit worker in
2397	* mind, i.e. not assuming the test bitcount is the same as the current.
2398	*/
2399	static void bs3CpuBasic2_lidt_lgdt_One(BS3CB2SIDTSGDT const BS3_FAR *pWorker, uint8_t bTestMode, uint8_t bRing,
2400	uint8_t const pbRestore, size_t cbRestore, uint8_t const pbExpected)
2401	{
2402	static const struct
2403	{
2404	bool fGP;
2405	uint16_t cbLimit;
2406	uint64_t u64Base;
2407	} s_aValues64[] =
2408	{
2409	{ false, 0x0000, UINT64_C(0x0000000000000000) },
2410	{ false, 0x0001, UINT64_C(0x0000000000000001) },
2411	{ false, 0x0002, UINT64_C(0x0000000000000010) },
2412	{ false, 0x0003, UINT64_C(0x0000000000000123) },
2413	{ false, 0x0004, UINT64_C(0x0000000000001234) },
2414	{ false, 0x0005, UINT64_C(0x0000000000012345) },
2415	{ false, 0x0006, UINT64_C(0x0000000000123456) },
2416	{ false, 0x0007, UINT64_C(0x0000000001234567) },
2417	{ false, 0x0008, UINT64_C(0x0000000012345678) },
2418	{ false, 0x0009, UINT64_C(0x0000000123456789) },
2419	{ false, 0x000a, UINT64_C(0x000000123456789a) },
2420	{ false, 0x000b, UINT64_C(0x00000123456789ab) },
2421	{ false, 0x000c, UINT64_C(0x0000123456789abc) },
2422	{ false, 0x001c, UINT64_C(0x00007ffffeefefef) },
2423	{ false, 0xffff, UINT64_C(0x00007fffffffffff) },
2424	{ true, 0xf3f1, UINT64_C(0x0000800000000000) },
2425	{ true, 0x0000, UINT64_C(0x0000800000000000) },
2426	{ true, 0x0000, UINT64_C(0x0000800000000333) },
2427	{ true, 0x00f0, UINT64_C(0x0001000000000000) },
2428	{ true, 0x0ff0, UINT64_C(0x0012000000000000) },
2429	{ true, 0x0eff, UINT64_C(0x0123000000000000) },
2430	{ true, 0xe0fe, UINT64_C(0x1234000000000000) },
2431	{ true, 0x00ad, UINT64_C(0xffff300000000000) },
2432	{ true, 0x0000, UINT64_C(0xffff7fffffffffff) },
2433	{ true, 0x00f0, UINT64_C(0xffff7fffffffffff) },
2434	{ false, 0x5678, UINT64_C(0xffff800000000000) },
2435	{ false, 0x2969, UINT64_C(0xffffffffffeefefe) },
2436	{ false, 0x1221, UINT64_C(0xffffffffffffffff) },
2437	{ false, 0x1221, UINT64_C(0xffffffffffffffff) },
2438	};
2439	static const struct
2440	{
2441	uint16_t cbLimit;
2442	uint32_t u32Base;
2443	} s_aValues32[] =
2444	{
2445	{ 0xdfdf, UINT32_C(0xefefefef) },
2446	{ 0x0000, UINT32_C(0x00000000) },
2447	{ 0x0001, UINT32_C(0x00000001) },
2448	{ 0x0002, UINT32_C(0x00000012) },
2449	{ 0x0003, UINT32_C(0x00000123) },
2450	{ 0x0004, UINT32_C(0x00001234) },
2451	{ 0x0005, UINT32_C(0x00012345) },
2452	{ 0x0006, UINT32_C(0x00123456) },
2453	{ 0x0007, UINT32_C(0x01234567) },
2454	{ 0x0008, UINT32_C(0x12345678) },
2455	{ 0x0009, UINT32_C(0x80204060) },
2456	{ 0x000a, UINT32_C(0xddeeffaa) },
2457	{ 0x000b, UINT32_C(0xfdecdbca) },
2458	{ 0x000c, UINT32_C(0x6098456b) },
2459	{ 0x000d, UINT32_C(0x98506099) },
2460	{ 0x000e, UINT32_C(0x206950bc) },
2461	{ 0x000f, UINT32_C(0x9740395d) },
2462	{ 0x0334, UINT32_C(0x64a9455e) },
2463	{ 0xb423, UINT32_C(0xd20b6eff) },
2464	{ 0x4955, UINT32_C(0x85296d46) },
2465	{ 0xffff, UINT32_C(0x07000039) },
2466	{ 0xefe1, UINT32_C(0x0007fe00) },
2467	};
2468
2469	BS3TRAPFRAME TrapCtx;
2470	BS3REGCTX Ctx;
2471	BS3REGCTX CtxUdExpected;
2472	BS3REGCTX TmpCtx;
2473	uint8_t abBufLoad[40]; /* Test buffer w/ misalignment test space and some (cbIdtr) extra guard. */
2474	uint8_t abBufSave[32]; /* For saving the result after loading. */
2475	uint8_t abBufRestore[24]; /* For restoring sane value (same seg as abBufSave!). */
2476	uint8_t abExpectedFilled[32]; /* Same as pbExpected, except it's filled with bFiller2 instead of zeros. */
2477	uint8_t BS3_FAR pbBufSave; / Correctly aligned pointer into abBufSave. */
2478	uint8_t BS3_FAR pbBufRestore; / Correctly aligned pointer into abBufRestore. */
2479	uint8_t const cbIdtr = BS3_MODE_IS_64BIT_CODE(bTestMode) ? 2+8 : 2+4;
2480	uint8_t const cbBaseLoaded = BS3_MODE_IS_64BIT_CODE(bTestMode) ? 8
2481	: BS3_MODE_IS_16BIT_CODE(bTestMode) == !(pWorker->fFlags & BS3CB2SIDTSGDT_F_OPSIZE)
2482	? 3 : 4;
2483	bool const f286 = (g_uBs3CpuDetected & BS3CPU_TYPE_MASK) == BS3CPU_80286;
2484	uint8_t const bTop16BitBase = f286 ? 0xff : 0x00;
2485	uint8_t bFiller1; /* For filling abBufLoad. */
2486	uint8_t bFiller2; /* For filling abBufSave and expectations. */
2487	int off;
2488	uint8_t BS3_FAR *pbTest;
2489	unsigned i;
2490
2491	/* make sure they're allocated */
2492	Bs3MemZero(&Ctx, sizeof(Ctx));
2493	Bs3MemZero(&CtxUdExpected, sizeof(CtxUdExpected));
2494	Bs3MemZero(&TmpCtx, sizeof(TmpCtx));
2495	Bs3MemZero(&TrapCtx, sizeof(TrapCtx));
2496	Bs3MemZero(abBufSave, sizeof(abBufSave));
2497	Bs3MemZero(abBufLoad, sizeof(abBufLoad));
2498	Bs3MemZero(abBufRestore, sizeof(abBufRestore));
2499
2500	/*
2501	* Create a context, giving this routine some more stack space.
2502	* - Point the context at our LIDT [xBX] + SIDT [xDI] + LIDT [xSI] + UD2 combo.
2503	* - Point DS/SS:xBX at abBufLoad.
2504	* - Point ES:xDI at abBufSave.
2505	* - Point ES:xSI at abBufRestore.
2506	*/
2507	Bs3RegCtxSaveEx(&Ctx, bTestMode, 256 /cbExtraStack/);
2508	Bs3RegCtxSetRipCsFromLnkPtr(&Ctx, pWorker->fpfnWorker);
2509	if (BS3_MODE_IS_16BIT_SYS(bTestMode))
2510	g_uBs3TrapEipHint = Ctx.rip.u32;
2511	Ctx.rflags.u16 &= ~X86_EFL_IF;
2512	Bs3RegCtxSetGrpSegFromCurPtr(&Ctx, &Ctx.rbx, pWorker->fSs ? &Ctx.ss : &Ctx.ds, abBufLoad);
2513
2514	pbBufSave = abBufSave;
2515	if ((BS3_FP_OFF(pbBufSave) + 2) & 7)
2516	pbBufSave += 8 - ((BS3_FP_OFF(pbBufSave) + 2) & 7);
2517	Bs3RegCtxSetGrpSegFromCurPtr(&Ctx, &Ctx.rdi, &Ctx.es, pbBufSave);
2518
2519	pbBufRestore = abBufRestore;
2520	if ((BS3_FP_OFF(pbBufRestore) + 2) & 7)
2521	pbBufRestore += 8 - ((BS3_FP_OFF(pbBufRestore) + 2) & 7);
2522	Bs3RegCtxSetGrpSegFromCurPtr(&Ctx, &Ctx.rsi, &Ctx.es, pbBufRestore);
2523	Bs3MemCpy(pbBufRestore, pbRestore, cbRestore);
2524
2525	if (!BS3_MODE_IS_RM_OR_V86(bTestMode))
2526	Bs3RegCtxConvertToRingX(&Ctx, bRing);
2527
2528	/* For successful SIDT attempts, we'll stop at the UD2. */
2529	Bs3MemCpy(&CtxUdExpected, &Ctx, sizeof(Ctx));
2530	CtxUdExpected.rip.u += pWorker->cbInstr;
2531
2532	/*
2533	* Check that it works at all.
2534	*/
2535	Bs3MemZero(abBufLoad, sizeof(abBufLoad));
2536	Bs3MemCpy(abBufLoad, pbBufRestore, cbIdtr);
2537	Bs3MemZero(abBufSave, sizeof(abBufSave));
2538	Bs3TrapSetJmpAndRestore(&Ctx, &TrapCtx);
2539	if (bRing != 0)
2540	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &Ctx, 0);
2541	else
2542	{
2543	bs3CpuBasic2_CompareUdCtx(&TrapCtx, &CtxUdExpected);
2544	if (Bs3MemCmp(pbBufSave, pbExpected, cbIdtr * 2) != 0)
2545	Bs3TestFailedF("Mismatch (%s, #1): expected %.Rhxs, got %.Rhxs\n",
2546	pWorker->pszDesc, cbIdtr2, pbExpected, cbIdtr2, pbBufSave);
2547	}
2548	g_usBs3TestStep++;
2549
2550	/* Determine two filler bytes that doesn't appear in the previous result or our expectations. */
2551	bFiller1 = ~0x55;
2552	while ( Bs3MemChr(pbBufSave, bFiller1, cbIdtr) != NULL
2553	\|\| Bs3MemChr(pbRestore, bFiller1, cbRestore) != NULL
2554	\|\| bFiller1 == 0xff)
2555	bFiller1++;
2556	bFiller2 = 0x33;
2557	while ( Bs3MemChr(pbBufSave, bFiller2, cbIdtr) != NULL
2558	\|\| Bs3MemChr(pbRestore, bFiller2, cbRestore) != NULL
2559	\|\| bFiller2 == 0xff
2560	\|\| bFiller2 == bFiller1)
2561	bFiller2++;
2562	Bs3MemSet(abExpectedFilled, bFiller2, sizeof(abExpectedFilled));
2563	Bs3MemCpy(abExpectedFilled, pbExpected, cbIdtr);
2564
2565	/* Again with a buffer filled with a byte not occuring in the previous result. */
2566	Bs3MemSet(abBufLoad, bFiller1, sizeof(abBufLoad));
2567	Bs3MemCpy(abBufLoad, pbBufRestore, cbIdtr);
2568	Bs3MemSet(abBufSave, bFiller2, sizeof(abBufSave));
2569	Bs3TrapSetJmpAndRestore(&Ctx, &TrapCtx);
2570	if (bRing != 0)
2571	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &Ctx, 0);
2572	else
2573	{
2574	bs3CpuBasic2_CompareUdCtx(&TrapCtx, &CtxUdExpected);
2575	if (Bs3MemCmp(pbBufSave, abExpectedFilled, cbIdtr * 2) != 0)
2576	Bs3TestFailedF("Mismatch (%s, #2): expected %.Rhxs, got %.Rhxs\n",
2577	pWorker->pszDesc, cbIdtr2, abExpectedFilled, cbIdtr2, pbBufSave);
2578	}
2579	g_usBs3TestStep++;
2580
2581	/*
2582	* Try loading a bunch of different limit+base value to check what happens,
2583	* especially what happens wrt the top part of the base in 16-bit mode.
2584	*/
2585	if (BS3_MODE_IS_64BIT_CODE(bTestMode))
2586	{
2587	for (i = 0; i < RT_ELEMENTS(s_aValues64); i++)
2588	{
2589	Bs3MemSet(abBufLoad, bFiller1, sizeof(abBufLoad));
2590	Bs3MemCpy(&abBufLoad[0], &s_aValues64[i].cbLimit, 2);
2591	Bs3MemCpy(&abBufLoad[2], &s_aValues64[i].u64Base, 8);
2592	Bs3MemSet(abBufSave, bFiller2, sizeof(abBufSave));
2593	Bs3TrapSetJmpAndRestore(&Ctx, &TrapCtx);
2594	if (bRing != 0 \|\| s_aValues64[i].fGP)
2595	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &Ctx, 0);
2596	else
2597	{
2598	bs3CpuBasic2_CompareUdCtx(&TrapCtx, &CtxUdExpected);
2599	if ( Bs3MemCmp(&pbBufSave[0], &s_aValues64[i].cbLimit, 2) != 0
2600	\|\| Bs3MemCmp(&pbBufSave[2], &s_aValues64[i].u64Base, 8) != 0
2601	\|\| !ASMMemIsAllU8(&pbBufSave[10], cbIdtr, bFiller2))
2602	Bs3TestFailedF("Mismatch (%s, #2): expected %04RX16:%016RX64, fillers %#x %#x, got %.*Rhxs\n",
2603	pWorker->pszDesc, s_aValues64[i].cbLimit, s_aValues64[i].u64Base,
2604	bFiller1, bFiller2, cbIdtr*2, pbBufSave);
2605	}
2606	g_usBs3TestStep++;
2607	}
2608	}
2609	else
2610	{
2611	for (i = 0; i < RT_ELEMENTS(s_aValues32); i++)
2612	{
2613	Bs3MemSet(abBufLoad, bFiller1, sizeof(abBufLoad));
2614	Bs3MemCpy(&abBufLoad[0], &s_aValues32[i].cbLimit, 2);
2615	Bs3MemCpy(&abBufLoad[2], &s_aValues32[i].u32Base, cbBaseLoaded);
2616	Bs3MemSet(abBufSave, bFiller2, sizeof(abBufSave));
2617	Bs3TrapSetJmpAndRestore(&Ctx, &TrapCtx);
2618	if (bRing != 0)
2619	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &Ctx, 0);
2620	else
2621	{
2622	bs3CpuBasic2_CompareUdCtx(&TrapCtx, &CtxUdExpected);
2623	if ( Bs3MemCmp(&pbBufSave[0], &s_aValues32[i].cbLimit, 2) != 0
2624	\|\| Bs3MemCmp(&pbBufSave[2], &s_aValues32[i].u32Base, cbBaseLoaded) != 0
2625	\|\| ( cbBaseLoaded != 4
2626	&& pbBufSave[2+3] != bTop16BitBase)
2627	\|\| !ASMMemIsAllU8(&pbBufSave[8], cbIdtr, bFiller2))
2628	Bs3TestFailedF("Mismatch (%s,#3): loaded %04RX16:%08RX32, fillers %#x %#x%s, got %.*Rhxs\n",
2629	pWorker->pszDesc, s_aValues32[i].cbLimit, s_aValues32[i].u32Base, bFiller1, bFiller2,
2630	f286 ? ", 286" : "", cbIdtr*2, pbBufSave);
2631	}
2632	g_usBs3TestStep++;
2633	}
2634	}
2635
2636	/*
2637	* Slide the buffer along 8 bytes to cover misalignment.
2638	*/
2639	for (off = 0; off < 8; off++)
2640	{
2641	Bs3RegCtxSetGrpSegFromCurPtr(&Ctx, &Ctx.rbx, pWorker->fSs ? &Ctx.ss : &Ctx.ds, &abBufLoad[off]);
2642	CtxUdExpected.rbx.u = Ctx.rbx.u;
2643
2644	Bs3MemSet(abBufLoad, bFiller1, sizeof(abBufLoad));
2645	Bs3MemCpy(&abBufLoad[off], pbBufRestore, cbIdtr);
2646	Bs3MemSet(abBufSave, bFiller2, sizeof(abBufSave));
2647	Bs3TrapSetJmpAndRestore(&Ctx, &TrapCtx);
2648	if (bRing != 0)
2649	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &Ctx, 0);
2650	else
2651	{
2652	bs3CpuBasic2_CompareUdCtx(&TrapCtx, &CtxUdExpected);
2653	if (Bs3MemCmp(pbBufSave, abExpectedFilled, cbIdtr * 2) != 0)
2654	Bs3TestFailedF("Mismatch (%s, #4): expected %.Rhxs, got %.Rhxs\n",
2655	pWorker->pszDesc, cbIdtr2, abExpectedFilled, cbIdtr2, pbBufSave);
2656	}
2657	g_usBs3TestStep++;
2658	}
2659	Bs3RegCtxSetGrpSegFromCurPtr(&Ctx, &Ctx.rbx, pWorker->fSs ? &Ctx.ss : &Ctx.ds, abBufLoad);
2660	CtxUdExpected.rbx.u = Ctx.rbx.u;
2661
2662	/*
2663	* Play with the selector limit if the target mode supports limit checking
2664	* We use BS3_SEL_TEST_PAGE_00 for this
2665	*/
2666	if ( !BS3_MODE_IS_RM_OR_V86(bTestMode)
2667	&& !BS3_MODE_IS_64BIT_CODE(bTestMode))
2668	{
2669	uint16_t cbLimit;
2670	uint32_t uFlatBuf = Bs3SelPtrToFlat(abBufLoad);
2671	Bs3GdteTestPage00 = Bs3Gdte_DATA16;
2672	Bs3GdteTestPage00.Gen.u2Dpl = bRing;
2673	Bs3GdteTestPage00.Gen.u16BaseLow = (uint16_t)uFlatBuf;
2674	Bs3GdteTestPage00.Gen.u8BaseHigh1 = (uint8_t)(uFlatBuf >> 16);
2675	Bs3GdteTestPage00.Gen.u8BaseHigh2 = (uint8_t)(uFlatBuf >> 24);
2676
2677	if (pWorker->fSs)
2678	CtxUdExpected.ss = Ctx.ss = BS3_SEL_TEST_PAGE_00 \| bRing;
2679	else
2680	CtxUdExpected.ds = Ctx.ds = BS3_SEL_TEST_PAGE_00 \| bRing;
2681
2682	/* Expand up (normal). */
2683	for (off = 0; off < 8; off++)
2684	{
2685	CtxUdExpected.rbx.u = Ctx.rbx.u = off;
2686	for (cbLimit = 0; cbLimit < cbIdtr*2; cbLimit++)
2687	{
2688	Bs3GdteTestPage00.Gen.u16LimitLow = cbLimit;
2689
2690	Bs3MemSet(abBufLoad, bFiller1, sizeof(abBufLoad));
2691	Bs3MemCpy(&abBufLoad[off], pbBufRestore, cbIdtr);
2692	Bs3MemSet(abBufSave, bFiller2, sizeof(abBufSave));
2693	Bs3TrapSetJmpAndRestore(&Ctx, &TrapCtx);
2694	if (bRing != 0)
2695	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &Ctx, 0);
2696	else if (off + cbIdtr <= cbLimit + 1)
2697	{
2698	bs3CpuBasic2_CompareUdCtx(&TrapCtx, &CtxUdExpected);
2699	if (Bs3MemCmp(pbBufSave, abExpectedFilled, cbIdtr * 2) != 0)
2700	Bs3TestFailedF("Mismatch (%s, #5): expected %.Rhxs, got %.Rhxs\n",
2701	pWorker->pszDesc, cbIdtr2, abExpectedFilled, cbIdtr2, pbBufSave);
2702	}
2703	else if (pWorker->fSs)
2704	bs3CpuBasic2_CompareSsCtx(&TrapCtx, &Ctx, 0, false /f486ResumeFlagHint/);
2705	else
2706	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &Ctx, 0);
2707	g_usBs3TestStep++;
2708
2709	/* Again with zero limit and messed up base (should trigger tripple fault if partially loaded). */
2710	abBufLoad[off] = abBufLoad[off + 1] = 0;
2711	abBufLoad[off + 2] \|= 1;
2712	abBufLoad[off + cbIdtr - 2] ^= 0x5a;
2713	abBufLoad[off + cbIdtr - 1] ^= 0xa5;
2714	Bs3TrapSetJmpAndRestore(&Ctx, &TrapCtx);
2715	if (bRing != 0)
2716	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &Ctx, 0);
2717	else if (off + cbIdtr <= cbLimit + 1)
2718	bs3CpuBasic2_CompareUdCtx(&TrapCtx, &CtxUdExpected);
2719	else if (pWorker->fSs)
2720	bs3CpuBasic2_CompareSsCtx(&TrapCtx, &Ctx, 0, false /f486ResumeFlagHint/);
2721	else
2722	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &Ctx, 0);
2723	}
2724	}
2725
2726	/* Expand down (weird). Inverted valid area compared to expand up,
2727	so a limit of zero give us a valid range for 0001..0ffffh (instead of
2728	a segment with one valid byte at 0000h). Whereas a limit of 0fffeh
2729	means one valid byte at 0ffffh, and a limit of 0ffffh means none
2730	(because in a normal expand up the 0ffffh means all 64KB are
2731	accessible). */
2732	Bs3GdteTestPage00.Gen.u4Type = X86_SEL_TYPE_RW_DOWN_ACC;
2733	for (off = 0; off < 8; off++)
2734	{
2735	CtxUdExpected.rbx.u = Ctx.rbx.u = off;
2736	for (cbLimit = 0; cbLimit < cbIdtr*2; cbLimit++)
2737	{
2738	Bs3GdteTestPage00.Gen.u16LimitLow = cbLimit;
2739
2740	Bs3MemSet(abBufLoad, bFiller1, sizeof(abBufLoad));
2741	Bs3MemCpy(&abBufLoad[off], pbBufRestore, cbIdtr);
2742	Bs3MemSet(abBufSave, bFiller2, sizeof(abBufSave));
2743	Bs3TrapSetJmpAndRestore(&Ctx, &TrapCtx);
2744	if (bRing != 0)
2745	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &Ctx, 0);
2746	else if (off > cbLimit)
2747	{
2748	bs3CpuBasic2_CompareUdCtx(&TrapCtx, &CtxUdExpected);
2749	if (Bs3MemCmp(pbBufSave, abExpectedFilled, cbIdtr * 2) != 0)
2750	Bs3TestFailedF("Mismatch (%s, #6): expected %.Rhxs, got %.Rhxs\n",
2751	pWorker->pszDesc, cbIdtr2, abExpectedFilled, cbIdtr2, pbBufSave);
2752	}
2753	else if (pWorker->fSs)
2754	bs3CpuBasic2_CompareSsCtx(&TrapCtx, &Ctx, 0, false /f486ResumeFlagHint/);
2755	else
2756	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &Ctx, 0);
2757	g_usBs3TestStep++;
2758
2759	/* Again with zero limit and messed up base (should trigger triple fault if partially loaded). */
2760	abBufLoad[off] = abBufLoad[off + 1] = 0;
2761	abBufLoad[off + 2] \|= 3;
2762	abBufLoad[off + cbIdtr - 2] ^= 0x55;
2763	abBufLoad[off + cbIdtr - 1] ^= 0xaa;
2764	Bs3TrapSetJmpAndRestore(&Ctx, &TrapCtx);
2765	if (bRing != 0)
2766	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &Ctx, 0);
2767	else if (off > cbLimit)
2768	bs3CpuBasic2_CompareUdCtx(&TrapCtx, &CtxUdExpected);
2769	else if (pWorker->fSs)
2770	bs3CpuBasic2_CompareSsCtx(&TrapCtx, &Ctx, 0, false /f486ResumeFlagHint/);
2771	else
2772	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &Ctx, 0);
2773	}
2774	}
2775
2776	Bs3RegCtxSetGrpSegFromCurPtr(&Ctx, &Ctx.rbx, pWorker->fSs ? &Ctx.ss : &Ctx.ds, abBufLoad);
2777	CtxUdExpected.rbx.u = Ctx.rbx.u;
2778	CtxUdExpected.ss = Ctx.ss;
2779	CtxUdExpected.ds = Ctx.ds;
2780	}
2781
2782	/*
2783	* Play with the paging.
2784	*/
2785	if ( BS3_MODE_IS_PAGED(bTestMode)
2786	&& (!pWorker->fSs \|\| bRing == 3) /* SS.DPL == CPL, we'll get some tiled ring-3 selector here. */
2787	&& (pbTest = (uint8_t BS3_FAR *)Bs3MemGuardedTestPageAlloc(BS3MEMKIND_TILED)) != NULL)
2788	{
2789	RTCCUINTXREG uFlatTest = Bs3SelPtrToFlat(pbTest);
2790
2791	/*
2792	* Slide the load buffer towards the trailing guard page.
2793	*/
2794	Bs3RegCtxSetGrpSegFromCurPtr(&Ctx, &Ctx.rbx, pWorker->fSs ? &Ctx.ss : &Ctx.ds, &pbTest[X86_PAGE_SIZE]);
2795	CtxUdExpected.ss = Ctx.ss;
2796	CtxUdExpected.ds = Ctx.ds;
2797	for (off = X86_PAGE_SIZE - cbIdtr - 4; off < X86_PAGE_SIZE + 4; off++)
2798	{
2799	Bs3MemSet(&pbTest[X86_PAGE_SIZE - cbIdtr * 2], bFiller1, cbIdtr*2);
2800	if (off < X86_PAGE_SIZE)
2801	Bs3MemCpy(&pbTest[off], pbBufRestore, RT_MIN(X86_PAGE_SIZE - off, cbIdtr));
2802	Bs3RegCtxSetGrpSegFromCurPtr(&Ctx, &Ctx.rbx, pWorker->fSs ? &Ctx.ss : &Ctx.ds, &pbTest[off]);
2803	Bs3MemSet(abBufSave, bFiller2, sizeof(abBufSave));
2804	Bs3TrapSetJmpAndRestore(&Ctx, &TrapCtx);
2805	if (bRing != 0)
2806	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &Ctx, 0);
2807	else if (off + cbIdtr <= X86_PAGE_SIZE)
2808	{
2809	CtxUdExpected.rbx = Ctx.rbx;
2810	bs3CpuBasic2_CompareUdCtx(&TrapCtx, &CtxUdExpected);
2811	if (Bs3MemCmp(pbBufSave, abExpectedFilled, cbIdtr*2) != 0)
2812	Bs3TestFailedF("Mismatch (%s, #7): expected %.Rhxs, got %.Rhxs\n",
2813	pWorker->pszDesc, cbIdtr2, abExpectedFilled, cbIdtr2, pbBufSave);
2814	}
2815	else
2816	bs3CpuBasic2_ComparePfCtx(&TrapCtx, &Ctx, 0, uFlatTest + RT_MAX(off, X86_PAGE_SIZE));
2817	g_usBs3TestStep++;
2818
2819	/* Again with zero limit and maybe messed up base as well (triple fault if buggy).
2820	The 386DX-40 here triple faults (or something) with off == 0xffe, nothing else. */
2821	if ( off < X86_PAGE_SIZE && off + cbIdtr > X86_PAGE_SIZE
2822	&& ( off != X86_PAGE_SIZE - 2
2823	\|\| (g_uBs3CpuDetected & BS3CPU_TYPE_MASK) != BS3CPU_80386)
2824	)
2825	{
2826	pbTest[off] = 0;
2827	if (off + 1 < X86_PAGE_SIZE)
2828	pbTest[off + 1] = 0;
2829	if (off + 2 < X86_PAGE_SIZE)
2830	pbTest[off + 2] \|= 7;
2831	Bs3TrapSetJmpAndRestore(&Ctx, &TrapCtx);
2832	if (bRing != 0)
2833	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &Ctx, 0);
2834	else
2835	bs3CpuBasic2_ComparePfCtx(&TrapCtx, &Ctx, 0, uFlatTest + RT_MAX(off, X86_PAGE_SIZE));
2836	g_usBs3TestStep++;
2837	}
2838	}
2839
2840	/*
2841	* Now, do it the other way around. It should look normal now since writing
2842	* the limit will #PF first and nothing should be written.
2843	*/
2844	for (off = cbIdtr + 4; off >= -cbIdtr - 4; off--)
2845	{
2846	Bs3MemSet(pbTest, bFiller1, 48);
2847	if (off >= 0)
2848	Bs3MemCpy(&pbTest[off], pbBufRestore, cbIdtr);
2849	else if (off + cbIdtr > 0)
2850	Bs3MemCpy(pbTest, &pbBufRestore[-off], cbIdtr + off);
2851	Bs3RegCtxSetGrpSegFromCurPtr(&Ctx, &Ctx.rbx, pWorker->fSs ? &Ctx.ss : &Ctx.ds, &pbTest[off]);
2852	Bs3MemSet(abBufSave, bFiller2, sizeof(abBufSave));
2853	Bs3TrapSetJmpAndRestore(&Ctx, &TrapCtx);
2854	if (bRing != 0)
2855	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &Ctx, 0);
2856	else if (off >= 0)
2857	{
2858	CtxUdExpected.rbx = Ctx.rbx;
2859	bs3CpuBasic2_CompareUdCtx(&TrapCtx, &CtxUdExpected);
2860	if (Bs3MemCmp(pbBufSave, abExpectedFilled, cbIdtr*2) != 0)
2861	Bs3TestFailedF("Mismatch (%s, #8): expected %.Rhxs, got %.Rhxs\n",
2862	pWorker->pszDesc, cbIdtr2, abExpectedFilled, cbIdtr2, pbBufSave);
2863	}
2864	else
2865	bs3CpuBasic2_ComparePfCtx(&TrapCtx, &Ctx, 0, uFlatTest + off);
2866	g_usBs3TestStep++;
2867
2868	/* Again with messed up base as well (triple fault if buggy). */
2869	if (off < 0 && off > -cbIdtr)
2870	{
2871	if (off + 2 >= 0)
2872	pbTest[off + 2] \|= 15;
2873	pbTest[off + cbIdtr - 1] ^= 0xaa;
2874	Bs3TrapSetJmpAndRestore(&Ctx, &TrapCtx);
2875	if (bRing != 0)
2876	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &Ctx, 0);
2877	else
2878	bs3CpuBasic2_ComparePfCtx(&TrapCtx, &Ctx, 0, uFlatTest + off);
2879	g_usBs3TestStep++;
2880	}
2881	}
2882
2883	/*
2884	* Combine paging and segment limit and check ordering.
2885	* This is kind of interesting here since it the instruction seems to
2886	* actually be doing two separate read, just like it's S[IG]DT counterpart.
2887	*
2888	* Note! My 486DX4 does a DWORD limit read when the operand size is 32-bit,
2889	* that's what f486Weirdness deals with.
2890	*/
2891	if ( !BS3_MODE_IS_RM_OR_V86(bTestMode)
2892	&& !BS3_MODE_IS_64BIT_CODE(bTestMode))
2893	{
2894	bool const f486Weirdness = (g_uBs3CpuDetected & BS3CPU_TYPE_MASK) == BS3CPU_80486
2895	&& BS3_MODE_IS_32BIT_CODE(bTestMode) == !(pWorker->fFlags & BS3CB2SIDTSGDT_F_OPSIZE);
2896	uint16_t cbLimit;
2897
2898	Bs3GdteTestPage00 = Bs3Gdte_DATA16;
2899	Bs3GdteTestPage00.Gen.u2Dpl = bRing;
2900	Bs3GdteTestPage00.Gen.u16BaseLow = (uint16_t)uFlatTest;
2901	Bs3GdteTestPage00.Gen.u8BaseHigh1 = (uint8_t)(uFlatTest >> 16);
2902	Bs3GdteTestPage00.Gen.u8BaseHigh2 = (uint8_t)(uFlatTest >> 24);
2903
2904	if (pWorker->fSs)
2905	CtxUdExpected.ss = Ctx.ss = BS3_SEL_TEST_PAGE_00 \| bRing;
2906	else
2907	CtxUdExpected.ds = Ctx.ds = BS3_SEL_TEST_PAGE_00 \| bRing;
2908
2909	/* Expand up (normal), approaching tail guard page. */
2910	for (off = X86_PAGE_SIZE - cbIdtr - 4; off < X86_PAGE_SIZE + 4; off++)
2911	{
2912	CtxUdExpected.rbx.u = Ctx.rbx.u = off;
2913	for (cbLimit = X86_PAGE_SIZE - cbIdtr2; cbLimit < X86_PAGE_SIZE + cbIdtr2; cbLimit++)
2914	{
2915	Bs3GdteTestPage00.Gen.u16LimitLow = cbLimit;
2916	Bs3MemSet(&pbTest[X86_PAGE_SIZE - cbIdtr * 2], bFiller1, cbIdtr * 2);
2917	if (off < X86_PAGE_SIZE)
2918	Bs3MemCpy(&pbTest[off], pbBufRestore, RT_MIN(cbIdtr, X86_PAGE_SIZE - off));
2919	Bs3MemSet(abBufSave, bFiller2, sizeof(abBufSave));
2920	Bs3TrapSetJmpAndRestore(&Ctx, &TrapCtx);
2921	if (bRing != 0)
2922	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &Ctx, 0);
2923	else if (off + cbIdtr <= cbLimit + 1)
2924	{
2925	/* No #GP, but maybe #PF. */
2926	if (off + cbIdtr <= X86_PAGE_SIZE)
2927	{
2928	bs3CpuBasic2_CompareUdCtx(&TrapCtx, &CtxUdExpected);
2929	if (Bs3MemCmp(pbBufSave, abExpectedFilled, cbIdtr * 2) != 0)
2930	Bs3TestFailedF("Mismatch (%s, #9): expected %.Rhxs, got %.Rhxs\n",
2931	pWorker->pszDesc, cbIdtr2, abExpectedFilled, cbIdtr2, pbBufSave);
2932	}
2933	else
2934	bs3CpuBasic2_ComparePfCtx(&TrapCtx, &Ctx, 0, uFlatTest + RT_MAX(off, X86_PAGE_SIZE));
2935	}
2936	/* No #GP/#SS on limit, but instead #PF? */
2937	else if ( !f486Weirdness
2938	? off < cbLimit && off >= 0xfff
2939	: off + 2 < cbLimit && off >= 0xffd)
2940	bs3CpuBasic2_ComparePfCtx(&TrapCtx, &Ctx, 0, uFlatTest + RT_MAX(off, X86_PAGE_SIZE));
2941	/* #GP/#SS on limit or base. */
2942	else if (pWorker->fSs)
2943	bs3CpuBasic2_CompareSsCtx(&TrapCtx, &Ctx, 0, false /f486ResumeFlagHint/);
2944	else
2945	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &Ctx, 0);
2946
2947	g_usBs3TestStep++;
2948
2949	/* Set DS to 0 and check that we get #GP(0). */
2950	if (!pWorker->fSs)
2951	{
2952	Ctx.ds = 0;
2953	Bs3TrapSetJmpAndRestore(&Ctx, &TrapCtx);
2954	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &Ctx, 0);
2955	Ctx.ds = BS3_SEL_TEST_PAGE_00 \| bRing;
2956	g_usBs3TestStep++;
2957	}
2958	}
2959	}
2960
2961	/* Expand down. */
2962	pbTest -= X86_PAGE_SIZE; /* Note! we're backing up a page to simplify things */
2963	uFlatTest -= X86_PAGE_SIZE;
2964
2965	Bs3GdteTestPage00.Gen.u4Type = X86_SEL_TYPE_RW_DOWN_ACC;
2966	Bs3GdteTestPage00.Gen.u16BaseLow = (uint16_t)uFlatTest;
2967	Bs3GdteTestPage00.Gen.u8BaseHigh1 = (uint8_t)(uFlatTest >> 16);
2968	Bs3GdteTestPage00.Gen.u8BaseHigh2 = (uint8_t)(uFlatTest >> 24);
2969
2970	for (off = X86_PAGE_SIZE - cbIdtr - 4; off < X86_PAGE_SIZE + 4; off++)
2971	{
2972	CtxUdExpected.rbx.u = Ctx.rbx.u = off;
2973	for (cbLimit = X86_PAGE_SIZE - cbIdtr2; cbLimit < X86_PAGE_SIZE + cbIdtr2; cbLimit++)
2974	{
2975	Bs3GdteTestPage00.Gen.u16LimitLow = cbLimit;
2976	Bs3MemSet(&pbTest[X86_PAGE_SIZE], bFiller1, cbIdtr * 2);
2977	if (off >= X86_PAGE_SIZE)
2978	Bs3MemCpy(&pbTest[off], pbBufRestore, cbIdtr);
2979	else if (off > X86_PAGE_SIZE - cbIdtr)
2980	Bs3MemCpy(&pbTest[X86_PAGE_SIZE], &pbBufRestore[X86_PAGE_SIZE - off], cbIdtr - (X86_PAGE_SIZE - off));
2981	Bs3MemSet(abBufSave, bFiller2, sizeof(abBufSave));
2982	Bs3TrapSetJmpAndRestore(&Ctx, &TrapCtx);
2983	if (bRing != 0)
2984	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &Ctx, 0);
2985	else if (cbLimit < off && off >= X86_PAGE_SIZE)
2986	{
2987	bs3CpuBasic2_CompareUdCtx(&TrapCtx, &CtxUdExpected);
2988	if (Bs3MemCmp(pbBufSave, abExpectedFilled, cbIdtr * 2) != 0)
2989	Bs3TestFailedF("Mismatch (%s, #10): expected %.Rhxs, got %.Rhxs\n",
2990	pWorker->pszDesc, cbIdtr2, abExpectedFilled, cbIdtr2, pbBufSave);
2991	}
2992	else if (cbLimit < off && off < X86_PAGE_SIZE)
2993	bs3CpuBasic2_ComparePfCtx(&TrapCtx, &Ctx, 0, uFlatTest + off);
2994	else if (pWorker->fSs)
2995	bs3CpuBasic2_CompareSsCtx(&TrapCtx, &Ctx, 0, false /f486ResumeFlagHint/);
2996	else
2997	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &Ctx, 0);
2998	g_usBs3TestStep++;
2999	}
3000	}
3001
3002	pbTest += X86_PAGE_SIZE;
3003	uFlatTest += X86_PAGE_SIZE;
3004	}
3005
3006	Bs3MemGuardedTestPageFree(pbTest);
3007	}
3008
3009	/*
3010	* Check non-canonical 64-bit space.
3011	*/
3012	if ( BS3_MODE_IS_64BIT_CODE(bTestMode)
3013	&& (pbTest = (uint8_t BS3_FAR *)Bs3PagingSetupCanonicalTraps()) != NULL)
3014	{
3015	/* Make our references relative to the gap. */
3016	pbTest += g_cbBs3PagingOneCanonicalTrap;
3017
3018	/* Hit it from below. */
3019	for (off = -cbIdtr - 8; off < cbIdtr + 8; off++)
3020	{
3021	Ctx.rbx.u = CtxUdExpected.rbx.u = UINT64_C(0x0000800000000000) + off;
3022	Bs3MemSet(&pbTest[-64], bFiller1, 64*2);
3023	Bs3MemCpy(&pbTest[off], pbBufRestore, cbIdtr);
3024	Bs3MemSet(abBufSave, bFiller2, sizeof(abBufSave));
3025	Bs3TrapSetJmpAndRestore(&Ctx, &TrapCtx);
3026	if (off + cbIdtr > 0 \|\| bRing != 0)
3027	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &Ctx, 0);
3028	else
3029	{
3030	bs3CpuBasic2_CompareUdCtx(&TrapCtx, &CtxUdExpected);
3031	if (Bs3MemCmp(pbBufSave, abExpectedFilled, cbIdtr * 2) != 0)
3032	Bs3TestFailedF("Mismatch (%s, #11): expected %.Rhxs, got %.Rhxs\n",
3033	pWorker->pszDesc, cbIdtr2, abExpectedFilled, cbIdtr2, pbBufSave);
3034	}
3035	}
3036
3037	/* Hit it from above. */
3038	for (off = -cbIdtr - 8; off < cbIdtr + 8; off++)
3039	{
3040	Ctx.rbx.u = CtxUdExpected.rbx.u = UINT64_C(0xffff800000000000) + off;
3041	Bs3MemSet(&pbTest[-64], bFiller1, 64*2);
3042	Bs3MemCpy(&pbTest[off], pbBufRestore, cbIdtr);
3043	Bs3MemSet(abBufSave, bFiller2, sizeof(abBufSave));
3044	Bs3TrapSetJmpAndRestore(&Ctx, &TrapCtx);
3045	if (off < 0 \|\| bRing != 0)
3046	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &Ctx, 0);
3047	else
3048	{
3049	bs3CpuBasic2_CompareUdCtx(&TrapCtx, &CtxUdExpected);
3050	if (Bs3MemCmp(pbBufSave, abExpectedFilled, cbIdtr * 2) != 0)
3051	Bs3TestFailedF("Mismatch (%s, #19): expected %.Rhxs, got %.Rhxs\n",
3052	pWorker->pszDesc, cbIdtr2, abExpectedFilled, cbIdtr2, pbBufSave);
3053	}
3054	}
3055
3056	}
3057	}
3058
3059
3060	static void bs3CpuBasic2_lidt_lgdt_Common(uint8_t bTestMode, BS3CB2SIDTSGDT const BS3_FAR *paWorkers, unsigned cWorkers,
3061	void const pvRestore, size_t cbRestore, uint8_t const pbExpected)
3062	{
3063	unsigned idx;
3064	unsigned bRing;
3065	unsigned iStep = 0;
3066
3067	/* Note! We skip the SS checks for ring-0 since we badly mess up SS in the
3068	test and don't want to bother with double faults. */
3069	for (bRing = BS3_MODE_IS_V86(bTestMode) ? 3 : 0; bRing <= 3; bRing++)
3070	{
3071	for (idx = 0; idx < cWorkers; idx++)
3072	if ( (paWorkers[idx].bMode & (bTestMode & BS3_MODE_CODE_MASK))
3073	&& (!paWorkers[idx].fSs \|\| bRing != 0 /** @todo \|\| BS3_MODE_IS_64BIT_SYS(bTestMode)*/ )
3074	&& ( !(paWorkers[idx].fFlags & BS3CB2SIDTSGDT_F_386PLUS)
3075	\|\| ( bTestMode > BS3_MODE_PE16
3076	\|\| ( bTestMode == BS3_MODE_PE16
3077	&& (g_uBs3CpuDetected & BS3CPU_TYPE_MASK) >= BS3CPU_80386)) ) )
3078	{
3079	//Bs3TestPrintf("idx=%-2d fpfnWorker=%p fSs=%d cbInstr=%d\n",
3080	// idx, paWorkers[idx].fpfnWorker, paWorkers[idx].fSs, paWorkers[idx].cbInstr);
3081	g_usBs3TestStep = iStep;
3082	bs3CpuBasic2_lidt_lgdt_One(&paWorkers[idx], bTestMode, bRing, pvRestore, cbRestore, pbExpected);
3083	iStep += 1000;
3084	}
3085	if (BS3_MODE_IS_RM_SYS(bTestMode))
3086	break;
3087	}
3088	}
3089
3090
3091	BS3_DECL_FAR(uint8_t) BS3_CMN_FAR_NM(bs3CpuBasic2_lidt)(uint8_t bMode)
3092	{
3093	union
3094	{
3095	RTIDTR Idtr;
3096	uint8_t ab[32]; /* At least cbIdtr2! /
3097	} Expected;
3098
3099	//if (bMode != BS3_MODE_LM64) return 0;
3100	bs3CpuBasic2_SetGlobals(bMode);
3101
3102	/*
3103	* Pass to common worker which is only compiled once per mode.
3104	*/
3105	Bs3MemZero(&Expected, sizeof(Expected));
3106	ASMGetIDTR(&Expected.Idtr);
3107
3108	if (BS3_MODE_IS_RM_SYS(bMode))
3109	bs3CpuBasic2_lidt_lgdt_Common(bMode, g_aLidtWorkers, RT_ELEMENTS(g_aLidtWorkers),
3110	&Bs3Lidt_Ivt, sizeof(Bs3Lidt_Ivt), Expected.ab);
3111	else if (BS3_MODE_IS_16BIT_SYS(bMode))
3112	bs3CpuBasic2_lidt_lgdt_Common(bMode, g_aLidtWorkers, RT_ELEMENTS(g_aLidtWorkers),
3113	&Bs3Lidt_Idt16, sizeof(Bs3Lidt_Idt16), Expected.ab);
3114	else if (BS3_MODE_IS_32BIT_SYS(bMode))
3115	bs3CpuBasic2_lidt_lgdt_Common(bMode, g_aLidtWorkers, RT_ELEMENTS(g_aLidtWorkers),
3116	&Bs3Lidt_Idt32, sizeof(Bs3Lidt_Idt32), Expected.ab);
3117	else
3118	bs3CpuBasic2_lidt_lgdt_Common(bMode, g_aLidtWorkers, RT_ELEMENTS(g_aLidtWorkers),
3119	&Bs3Lidt_Idt64, sizeof(Bs3Lidt_Idt64), Expected.ab);
3120
3121	/*
3122	* Re-initialize the IDT.
3123	*/
3124	Bs3TrapReInit();
3125	return 0;
3126	}
3127
3128
3129	BS3_DECL_FAR(uint8_t) BS3_CMN_FAR_NM(bs3CpuBasic2_lgdt)(uint8_t bMode)
3130	{
3131	union
3132	{
3133	RTGDTR Gdtr;
3134	uint8_t ab[32]; /* At least cbIdtr2! /
3135	} Expected;
3136
3137	//if (!BS3_MODE_IS_64BIT_SYS(bMode)) return 0;
3138	bs3CpuBasic2_SetGlobals(bMode);
3139
3140	/*
3141	* Pass to common worker which is only compiled once per mode.
3142	*/
3143	if (BS3_MODE_IS_RM_SYS(bMode))
3144	ASMSetGDTR((PRTGDTR)&Bs3LgdtDef_Gdt);
3145	Bs3MemZero(&Expected, sizeof(Expected));
3146	ASMGetGDTR(&Expected.Gdtr);
3147
3148	bs3CpuBasic2_lidt_lgdt_Common(bMode, g_aLgdtWorkers, RT_ELEMENTS(g_aLgdtWorkers),
3149	&Bs3LgdtDef_Gdt, sizeof(Bs3LgdtDef_Gdt), Expected.ab);
3150
3151	/*
3152	* Re-initialize the IDT.
3153	*/
3154	Bs3TrapReInit();
3155	return 0;
3156	}
3157
3158	typedef union IRETBUF
3159	{
3160	uint64_t au64[6]; /* max req is 5 */
3161	uint32_t au32[12]; /* max req is 9 */
3162	uint16_t au16[24]; /* max req is 5 */
3163	uint8_t ab[48];
3164	} IRETBUF;
3165	typedef IRETBUF BS3_FAR *PIRETBUF;
3166
3167
3168	static void iretbuf_SetupFrame(PIRETBUF pIretBuf, unsigned const cbPop,
3169	uint16_t uCS, uint64_t uPC, uint32_t fEfl, uint16_t uSS, uint64_t uSP)
3170	{
3171	if (cbPop == 2)
3172	{
3173	pIretBuf->au16[0] = (uint16_t)uPC;
3174	pIretBuf->au16[1] = uCS;
3175	pIretBuf->au16[2] = (uint16_t)fEfl;
3176	pIretBuf->au16[3] = (uint16_t)uSP;
3177	pIretBuf->au16[4] = uSS;
3178	}
3179	else if (cbPop != 8)
3180	{
3181	pIretBuf->au32[0] = (uint32_t)uPC;
3182	pIretBuf->au16[1*2] = uCS;
3183	pIretBuf->au32[2] = (uint32_t)fEfl;
3184	pIretBuf->au32[3] = (uint32_t)uSP;
3185	pIretBuf->au16[4*2] = uSS;
3186	}
3187	else
3188	{
3189	pIretBuf->au64[0] = uPC;
3190	pIretBuf->au16[1*4] = uCS;
3191	pIretBuf->au64[2] = fEfl;
3192	pIretBuf->au64[3] = uSP;
3193	pIretBuf->au16[4*4] = uSS;
3194	}
3195	}
3196
3197	uint32_t ASMGetESP(void);
3198	#pragma aux ASMGetESP = \
3199	".386" \
3200	"mov ax, sp" \
3201	"mov edx, esp" \
3202	"shr edx, 16" \
3203	value [ax dx] \
3204	modify exact [ax dx];
3205
3206
3207	static void bs3CpuBasic2_iret_Worker(uint8_t bTestMode, FPFNBS3FAR pfnIret, unsigned const cbPop,
3208	PIRETBUF pIretBuf, const char BS3_FAR *pszDesc)
3209	{
3210	BS3TRAPFRAME TrapCtx;
3211	BS3REGCTX Ctx;
3212	BS3REGCTX CtxUdExpected;
3213	BS3REGCTX TmpCtx;
3214	BS3REGCTX TmpCtxExpected;
3215	uint8_t abLowUd[8];
3216	uint8_t abLowIret[8];
3217	FPFNBS3FAR pfnUdLow = (FPFNBS3FAR)abLowUd;
3218	FPFNBS3FAR pfnIretLow = (FPFNBS3FAR)abLowIret;
3219	unsigned const cbSameCplFrame = BS3_MODE_IS_64BIT_CODE(bTestMode) ? 5cbPop : 3cbPop;
3220	bool const fUseLowCode = cbPop == 2 && !BS3_MODE_IS_16BIT_CODE(bTestMode);
3221	int iRingDst;
3222	int iRingSrc;
3223	uint16_t uDplSs;
3224	uint16_t uRplCs;
3225	uint16_t uRplSs;
3226	// int i;
3227	uint8_t BS3_FAR *pbTest;
3228
3229	NOREF(abLowUd);
3230	#define IRETBUF_SET_SEL(a_idx, a_uValue) \
3231	do { (uint16_t)&pIretBuf->ab[a_idx cbPop] = (a_uValue); } while (0)
3232	#define IRETBUF_SET_REG(a_idx, a_uValue) \
3233	do { uint8_t const BS3_FAR pbTmp = &pIretBuf->ab[a_idx cbPop]; \
3234	if (cbPop == 2) *(uint16_t)pbTmp = (uint16_t)(a_uValue); \
3235	else if (cbPop != 8) *(uint32_t)pbTmp = (uint32_t)(a_uValue); \
3236	else *(uint64_t)pbTmp = (a_uValue); \
3237	} while (0)
3238
3239	/* make sure they're allocated */
3240	Bs3MemZero(&Ctx, sizeof(Ctx));
3241	Bs3MemZero(&CtxUdExpected, sizeof(CtxUdExpected));
3242	Bs3MemZero(&TmpCtx, sizeof(TmpCtx));
3243	Bs3MemZero(&TmpCtxExpected, sizeof(TmpCtxExpected));
3244	Bs3MemZero(&TrapCtx, sizeof(TrapCtx));
3245
3246	/*
3247	* When dealing with 16-bit irets in 32-bit or 64-bit mode, we must have
3248	* copies of both iret and ud in the first 64KB of memory. The stack is
3249	* below 64KB, so we'll just copy the instructions onto the stack.
3250	*/
3251	Bs3MemCpy(abLowUd, bs3CpuBasic2_ud2, 4);
3252	Bs3MemCpy(abLowIret, pfnIret, 4);
3253
3254	/*
3255	* Create a context (stack is irrelevant, we'll mainly be using pIretBuf).
3256	* - Point the context at our iret instruction.
3257	* - Point SS:xSP at pIretBuf.
3258	*/
3259	Bs3RegCtxSaveEx(&Ctx, bTestMode, 0);
3260	if (!fUseLowCode)
3261	Bs3RegCtxSetRipCsFromLnkPtr(&Ctx, pfnIret);
3262	else
3263	Bs3RegCtxSetRipCsFromCurPtr(&Ctx, pfnIretLow);
3264	if (BS3_MODE_IS_16BIT_SYS(bTestMode))
3265	g_uBs3TrapEipHint = Ctx.rip.u32;
3266	Bs3RegCtxSetGrpSegFromCurPtr(&Ctx, &Ctx.rsp, &Ctx.ss, pIretBuf);
3267
3268	/*
3269	* The first success (UD) context keeps the same code bit-count as the iret.
3270	*/
3271	Bs3MemCpy(&CtxUdExpected, &Ctx, sizeof(Ctx));
3272	if (!fUseLowCode)
3273	Bs3RegCtxSetRipCsFromLnkPtr(&CtxUdExpected, bs3CpuBasic2_ud2);
3274	else
3275	Bs3RegCtxSetRipCsFromCurPtr(&CtxUdExpected, pfnUdLow);
3276	CtxUdExpected.rsp.u += cbSameCplFrame;
3277
3278	/*
3279	* Check that it works at all.
3280	*/
3281	iretbuf_SetupFrame(pIretBuf, cbPop, CtxUdExpected.cs, CtxUdExpected.rip.u,
3282	CtxUdExpected.rflags.u32, CtxUdExpected.ss, CtxUdExpected.rsp.u);
3283
3284	Bs3TrapSetJmpAndRestore(&Ctx, &TrapCtx);
3285	bs3CpuBasic2_CompareUdCtx(&TrapCtx, &CtxUdExpected);
3286	g_usBs3TestStep++;
3287
3288	if (!BS3_MODE_IS_RM_OR_V86(bTestMode))
3289	{
3290	/* Selectors are modified when switching rings, so we need to know
3291	what we're dealing with there. */
3292	if ( !BS3_SEL_IS_IN_R0_RANGE(Ctx.cs) \|\| !BS3_SEL_IS_IN_R0_RANGE(Ctx.ss)
3293	\|\| !BS3_SEL_IS_IN_R0_RANGE(Ctx.ds) \|\| !BS3_SEL_IS_IN_R0_RANGE(Ctx.es))
3294	Bs3TestFailedF("Expected R0 CS, SS, DS and ES; not %#x, %#x, %#x and %#x\n", Ctx.cs, Ctx.ss, Ctx.ds, Ctx.es);
3295	if (Ctx.fs \|\| Ctx.gs)
3296	Bs3TestFailed("Expected R0 FS and GS to be 0!\n");
3297
3298	/*
3299	* Test returning to outer rings if protected mode.
3300	*/
3301	Bs3MemCpy(&TmpCtx, &Ctx, sizeof(TmpCtx));
3302	Bs3MemCpy(&TmpCtxExpected, &CtxUdExpected, sizeof(TmpCtxExpected));
3303	for (iRingDst = 3; iRingDst >= 0; iRingDst--)
3304	{
3305	Bs3RegCtxConvertToRingX(&TmpCtxExpected, iRingDst);
3306	TmpCtxExpected.ds = iRingDst ? 0 : TmpCtx.ds;
3307	TmpCtx.es = TmpCtxExpected.es;
3308	iretbuf_SetupFrame(pIretBuf, cbPop, TmpCtxExpected.cs, TmpCtxExpected.rip.u,
3309	TmpCtxExpected.rflags.u32, TmpCtxExpected.ss, TmpCtxExpected.rsp.u);
3310	Bs3TrapSetJmpAndRestore(&TmpCtx, &TrapCtx);
3311	bs3CpuBasic2_CompareUdCtx(&TrapCtx, &TmpCtxExpected);
3312	g_usBs3TestStep++;
3313	}
3314
3315	/*
3316	* Check CS.RPL and SS.RPL.
3317	*/
3318	for (iRingDst = 3; iRingDst >= 0; iRingDst--)
3319	{
3320	uint16_t const uDstSsR0 = (CtxUdExpected.ss & BS3_SEL_RING_SUB_MASK) + BS3_SEL_R0_FIRST;
3321	Bs3MemCpy(&TmpCtxExpected, &CtxUdExpected, sizeof(TmpCtxExpected));
3322	Bs3RegCtxConvertToRingX(&TmpCtxExpected, iRingDst);
3323	for (iRingSrc = 3; iRingSrc >= 0; iRingSrc--)
3324	{
3325	Bs3MemCpy(&TmpCtx, &Ctx, sizeof(TmpCtx));
3326	Bs3RegCtxConvertToRingX(&TmpCtx, iRingSrc);
3327	TmpCtx.es = TmpCtxExpected.es;
3328	TmpCtxExpected.ds = iRingDst != iRingSrc ? 0 : TmpCtx.ds;
3329	for (uRplCs = 0; uRplCs <= 3; uRplCs++)
3330	{
3331	uint16_t const uSrcEs = TmpCtx.es;
3332	uint16_t const uDstCs = (TmpCtxExpected.cs & X86_SEL_MASK_OFF_RPL) \| uRplCs;
3333	//Bs3TestPrintf("dst=%d src=%d rplCS=%d\n", iRingDst, iRingSrc, uRplCs);
3334
3335	/* CS.RPL */
3336	iretbuf_SetupFrame(pIretBuf, cbPop, uDstCs, TmpCtxExpected.rip.u, TmpCtxExpected.rflags.u32,
3337	TmpCtxExpected.ss, TmpCtxExpected.rsp.u);
3338	Bs3TrapSetJmpAndRestore(&TmpCtx, &TrapCtx);
3339	if (uRplCs == iRingDst && iRingDst >= iRingSrc)
3340	bs3CpuBasic2_CompareUdCtx(&TrapCtx, &TmpCtxExpected);
3341	else
3342	{
3343	if (iRingDst < iRingSrc)
3344	TmpCtx.es = 0;
3345	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &TmpCtx, uDstCs & X86_SEL_MASK_OFF_RPL);
3346	TmpCtx.es = uSrcEs;
3347	}
3348	g_usBs3TestStep++;
3349
3350	/* SS.RPL */
3351	if (iRingDst != iRingSrc \|\| BS3_MODE_IS_64BIT_CODE(bTestMode))
3352	{
3353	uint16_t uSavedDstSs = TmpCtxExpected.ss;
3354	for (uRplSs = 0; uRplSs <= 3; uRplSs++)
3355	{
3356	/* SS.DPL (iRingDst == CS.DPL) */
3357	for (uDplSs = 0; uDplSs <= 3; uDplSs++)
3358	{
3359	uint16_t const uDstSs = ((uDplSs << BS3_SEL_RING_SHIFT) \| uRplSs) + uDstSsR0;
3360	//Bs3TestPrintf("dst=%d src=%d rplCS=%d rplSS=%d dplSS=%d dst %04x:%08RX64 %08RX32 %04x:%08RX64\n",
3361	// iRingDst, iRingSrc, uRplCs, uRplSs, uDplSs, uDstCs, TmpCtxExpected.rip.u,
3362	// TmpCtxExpected.rflags.u32, uDstSs, TmpCtxExpected.rsp.u);
3363
3364	iretbuf_SetupFrame(pIretBuf, cbPop, uDstCs, TmpCtxExpected.rip.u,
3365	TmpCtxExpected.rflags.u32, uDstSs, TmpCtxExpected.rsp.u);
3366	Bs3TrapSetJmpAndRestore(&TmpCtx, &TrapCtx);
3367	if (uRplCs != iRingDst \|\| iRingDst < iRingSrc)
3368	{
3369	if (iRingDst < iRingSrc)
3370	TmpCtx.es = 0;
3371	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &TmpCtx, uDstCs & X86_SEL_MASK_OFF_RPL);
3372	}
3373	else if (uRplSs != iRingDst \|\| uDplSs != iRingDst)
3374	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &TmpCtx, uDstSs & X86_SEL_MASK_OFF_RPL);
3375	else
3376	bs3CpuBasic2_CompareUdCtx(&TrapCtx, &TmpCtxExpected);
3377	TmpCtx.es = uSrcEs;
3378	g_usBs3TestStep++;
3379	}
3380	}
3381
3382	TmpCtxExpected.ss = uSavedDstSs;
3383	}
3384	}
3385	}
3386	}
3387	}
3388
3389	/*
3390	* Special 64-bit checks.
3391	*/
3392	if (BS3_MODE_IS_64BIT_CODE(bTestMode))
3393	{
3394	/* The VM flag is completely ignored. */
3395	iretbuf_SetupFrame(pIretBuf, cbPop, CtxUdExpected.cs, CtxUdExpected.rip.u,
3396	CtxUdExpected.rflags.u32 \| X86_EFL_VM, CtxUdExpected.ss, CtxUdExpected.rsp.u);
3397	Bs3TrapSetJmpAndRestore(&Ctx, &TrapCtx);
3398	bs3CpuBasic2_CompareUdCtx(&TrapCtx, &CtxUdExpected);
3399	g_usBs3TestStep++;
3400
3401	/* The NT flag can be loaded just fine. */
3402	CtxUdExpected.rflags.u32 \|= X86_EFL_NT;
3403	iretbuf_SetupFrame(pIretBuf, cbPop, CtxUdExpected.cs, CtxUdExpected.rip.u,
3404	CtxUdExpected.rflags.u32, CtxUdExpected.ss, CtxUdExpected.rsp.u);
3405	Bs3TrapSetJmpAndRestore(&Ctx, &TrapCtx);
3406	bs3CpuBasic2_CompareUdCtx(&TrapCtx, &CtxUdExpected);
3407	CtxUdExpected.rflags.u32 &= ~X86_EFL_NT;
3408	g_usBs3TestStep++;
3409
3410	/* However, we'll #GP(0) if it's already set (in RFLAGS) when executing IRET. */
3411	Ctx.rflags.u32 \|= X86_EFL_NT;
3412	iretbuf_SetupFrame(pIretBuf, cbPop, CtxUdExpected.cs, CtxUdExpected.rip.u,
3413	CtxUdExpected.rflags.u32, CtxUdExpected.ss, CtxUdExpected.rsp.u);
3414	Bs3TrapSetJmpAndRestore(&Ctx, &TrapCtx);
3415	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &Ctx, 0);
3416	g_usBs3TestStep++;
3417
3418	/* The NT flag #GP(0) should trump all other exceptions - pit it against #PF. */
3419	pbTest = (uint8_t BS3_FAR *)Bs3MemGuardedTestPageAlloc(BS3MEMKIND_TILED);
3420	if (pbTest != NULL)
3421	{
3422	Bs3RegCtxSetGrpSegFromCurPtr(&Ctx, &Ctx.rsp, &Ctx.ss, &pbTest[X86_PAGE_SIZE]);
3423	iretbuf_SetupFrame(pIretBuf, cbPop, CtxUdExpected.cs, CtxUdExpected.rip.u,
3424	CtxUdExpected.rflags.u32, CtxUdExpected.ss, CtxUdExpected.rsp.u);
3425	Bs3TrapSetJmpAndRestore(&Ctx, &TrapCtx);
3426	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &Ctx, 0);
3427	g_usBs3TestStep++;
3428
3429	Bs3RegCtxSetGrpSegFromCurPtr(&Ctx, &Ctx.rsp, &Ctx.ss, pIretBuf);
3430	Bs3MemGuardedTestPageFree(pbTest);
3431	}
3432	Ctx.rflags.u32 &= ~X86_EFL_NT;
3433	}
3434	}
3435
3436
3437	BS3_DECL_FAR(uint8_t) BS3_CMN_FAR_NM(bs3CpuBasic2_iret)(uint8_t bMode)
3438	{
3439	struct
3440	{
3441	uint8_t abExtraStack[4096]; /*< we've got ~30KB of stack, so 4KB for the trap handlers++ is not a problem. /
3442	IRETBUF IRetBuf;
3443	uint8_t abGuard[32];
3444	} uBuf;
3445	size_t cbUnused;
3446
3447	//if (bMode != BS3_MODE_LM64) return BS3TESTDOMODE_SKIPPED;
3448	bs3CpuBasic2_SetGlobals(bMode);
3449
3450	/*
3451	* Primary instruction form.
3452	*/
3453	Bs3MemSet(&uBuf, 0xaa, sizeof(uBuf));
3454	Bs3MemSet(uBuf.abGuard, 0x88, sizeof(uBuf.abGuard));
3455	if (BS3_MODE_IS_16BIT_CODE(bMode))
3456	bs3CpuBasic2_iret_Worker(bMode, bs3CpuBasic2_iret, 2, &uBuf.IRetBuf, "iret");
3457	else if (BS3_MODE_IS_32BIT_CODE(bMode))
3458	bs3CpuBasic2_iret_Worker(bMode, bs3CpuBasic2_iret, 4, &uBuf.IRetBuf, "iretd");
3459	else
3460	bs3CpuBasic2_iret_Worker(bMode, bs3CpuBasic2_iret_rexw, 8, &uBuf.IRetBuf, "o64 iret");
3461
3462	BS3_ASSERT(ASMMemIsAllU8(uBuf.abGuard, sizeof(uBuf.abGuard), 0x88));
3463	cbUnused = (uintptr_t)ASMMemFirstMismatchingU8(uBuf.abExtraStack, sizeof(uBuf.abExtraStack) + sizeof(uBuf.IRetBuf), 0xaa)
3464	- (uintptr_t)uBuf.abExtraStack;
3465	if (cbUnused < 2048)
3466	Bs3TestFailedF("cbUnused=%u #%u\n", cbUnused, 1);
3467
3468	/*
3469	* Secondary variation: opsize prefixed.
3470	*/
3471	Bs3MemSet(&uBuf, 0xaa, sizeof(uBuf));
3472	Bs3MemSet(uBuf.abGuard, 0x88, sizeof(uBuf.abGuard));
3473	if (BS3_MODE_IS_16BIT_CODE(bMode) && (g_uBs3CpuDetected & BS3CPU_TYPE_MASK) >= BS3CPU_80386)
3474	bs3CpuBasic2_iret_Worker(bMode, bs3CpuBasic2_iret_opsize, 4, &uBuf.IRetBuf, "o32 iret");
3475	else if (BS3_MODE_IS_32BIT_CODE(bMode))
3476	bs3CpuBasic2_iret_Worker(bMode, bs3CpuBasic2_iret_opsize, 2, &uBuf.IRetBuf, "o16 iret");
3477	else if (BS3_MODE_IS_64BIT_CODE(bMode))
3478	bs3CpuBasic2_iret_Worker(bMode, bs3CpuBasic2_iret, 4, &uBuf.IRetBuf, "iretd");
3479	BS3_ASSERT(ASMMemIsAllU8(uBuf.abGuard, sizeof(uBuf.abGuard), 0x88));
3480	cbUnused = (uintptr_t)ASMMemFirstMismatchingU8(uBuf.abExtraStack, sizeof(uBuf.abExtraStack) + sizeof(uBuf.IRetBuf), 0xaa)
3481	- (uintptr_t)uBuf.abExtraStack;
3482	if (cbUnused < 2048)
3483	Bs3TestFailedF("cbUnused=%u #%u\n", cbUnused, 2);
3484
3485	/*
3486	* Third variation: 16-bit in 64-bit mode (truly unlikely)
3487	*/
3488	if (BS3_MODE_IS_64BIT_CODE(bMode))
3489	{
3490	Bs3MemSet(&uBuf, 0xaa, sizeof(uBuf));
3491	Bs3MemSet(uBuf.abGuard, 0x88, sizeof(uBuf.abGuard));
3492	bs3CpuBasic2_iret_Worker(bMode, bs3CpuBasic2_iret_opsize, 2, &uBuf.IRetBuf, "o16 iret");
3493	BS3_ASSERT(ASMMemIsAllU8(uBuf.abGuard, sizeof(uBuf.abGuard), 0x88));
3494	cbUnused = (uintptr_t)ASMMemFirstMismatchingU8(uBuf.abExtraStack, sizeof(uBuf.abExtraStack) + sizeof(uBuf.IRetBuf), 0xaa)
3495	- (uintptr_t)uBuf.abExtraStack;
3496	if (cbUnused < 2048)
3497	Bs3TestFailedF("cbUnused=%u #%u\n", cbUnused, 3);
3498	}
3499
3500	return 0;
3501	}
3502

Note: See TracBrowser for help on using the repository browser.

source: vbox/trunk/src/VBox/ValidationKit/bootsectors/bs3-cpu-basic-2-x0.c@ 89932

Download in other formats: