Index: /trunk/src/VBox/ValidationKit/bootsectors/bs3kit/Makefile.kmk
===================================================================
--- /trunk/src/VBox/ValidationKit/bootsectors/bs3kit/Makefile.kmk	(revision 59933)
+++ /trunk/src/VBox/ValidationKit/bootsectors/bs3kit/Makefile.kmk	(revision 59934)
@@ -198,8 +198,18 @@
 	bs3-mode-SwitchToPE16_V86.asm \
 	bs3-mode-SwitchToPE32.asm \
+	bs3-mode-SwitchToPE32_16.asm \
+	bs3-mode-SwitchToPEV86.asm \
 	bs3-mode-SwitchToPP16.asm \
+	bs3-mode-SwitchToPP16_32.asm \
+	bs3-mode-SwitchToPP16_V86.asm \
 	bs3-mode-SwitchToPP32.asm \
+	bs3-mode-SwitchToPP32_16.asm \
+	bs3-mode-SwitchToPPV86.asm \
 	bs3-mode-SwitchToPAE16.asm \
+	bs3-mode-SwitchToPAE16_32.asm \
+	bs3-mode-SwitchToPAE16_V86.asm \
 	bs3-mode-SwitchToPAE32.asm \
+	bs3-mode-SwitchToPAE32_16.asm \
+	bs3-mode-SwitchToPAEV86.asm \
 	bs3-mode-SwitchToLM64.asm \
 	bs3-mode-SwitchToLM32.asm \
Index: /trunk/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-cmn-SwitchTo16Bit.asm
===================================================================
--- /trunk/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-cmn-SwitchTo16Bit.asm	(revision 59933)
+++ /trunk/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-cmn-SwitchTo16Bit.asm	(revision 59934)
@@ -59,4 +59,5 @@
 %else
         push    xAX
+        push    xBX
         xPUSHF
         cli
@@ -77,5 +78,4 @@
 
         ; Load 16-bit segment registers.
-        ;; @todo support non-standard stacks?
         add     ax, BS3_SEL_R0_SS16 - BS3_SEL_R0_CS16
         mov     ss, ax
@@ -84,4 +84,17 @@
         mov     ds, ax
         mov     es, ax
+
+        ; Thunk the stack if necessary.
+        mov     ebx, esp
+        shr     ebx, 16
+        jz      .stack_ok
+int3 ; This is for later, just remove this int3 once needed.
+        test    ax, X86_SEL_RPL
+        jnz     .stack_rpl_must_be_0_for_custom_stacks
+        shl     bx, X86_SEL_SHIFT
+        add     bx, BS3_SEL_TILED
+        mov     ss, bx
+        movzx   esp, sp
+.stack_ok:
 
         ; Update globals.
@@ -93,9 +106,17 @@
         add     sp, 4
  %endif
+        pop     ebx
+ %if TMPL_BITS == 64
+        add     sp, 4
+ %endif
         pop     eax
  %if TMPL_BITS == 64
         add     sp, 4
  %endif
-        ret     sCB - 2                 ; Return and pop 2 or 6 bytes of "parameters" (unused return value)
+        ret     (TMPL_BITS - 16) / 8    ; Return and pop 2 or 6 bytes of "parameters" (unused return value)
+
+.stack_rpl_must_be_0_for_custom_stacks:
+        int3
+        jmp     .stack_rpl_must_be_0_for_custom_stacks
 TMPL_BEGIN_TEXT
 %endif
Index: /trunk/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-cmn-SwitchTo16BitV86.asm
===================================================================
--- /trunk/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-cmn-SwitchTo16BitV86.asm	(revision 59933)
+++ /trunk/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-cmn-SwitchTo16BitV86.asm	(revision 59934)
@@ -63,5 +63,5 @@
         push    ecx
         push    ebx
-%if TMPL_BITS == 16
+ %if TMPL_BITS == 16
         push    ds
 
Index: /trunk/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-cmn-SwitchTo32Bit.asm
===================================================================
--- /trunk/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-cmn-SwitchTo32Bit.asm	(revision 59933)
+++ /trunk/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-cmn-SwitchTo32Bit.asm	(revision 59934)
@@ -28,4 +28,7 @@
 
 
+%if TMPL_BITS == 16
+BS3_EXTERN_CMN Bs3SelProtFar32ToFlat32
+%endif
 %if TMPL_BITS != 32
 BS3_EXTERN_DATA16 g_bBs3CurrentMode
@@ -47,4 +50,5 @@
         push    eax
         pushfd
+        push    edx
  %else
         pushfq
@@ -53,5 +57,5 @@
         cli
 
-%if TMPL_BITS == 16
+ %if TMPL_BITS == 16
         ; Check for v8086 mode, we need to exit it to enter 32-bit mode.
         mov     ax, seg g_bBs3CurrentMode
@@ -62,4 +66,12 @@
         jne     .not_v8086
 
+        ; Calc flat stack into edx.
+        mov     dx, ss
+        movzx   edx, dx
+        shl     edx, 4
+        add     dx, sp
+        adc     edx, 0                  ; edx = flat stack address corresponding to ss:sp
+
+        ; Switch to 16-bit ring0 and go on to do the far jump to 32-bit code.
         mov     ax, BS3_SYSCALL_TO_RING0
         int     BS3_TRAP_SYSCALL
@@ -67,7 +79,22 @@
         mov     xAX, BS3_SEL_R0_CS32
         jmp     .do_far_jump
-%endif
+ %endif
 
 .not_v8086:
+ %if TMPL_BITS == 16
+        ; Calc flat stack into edx.
+        push    ecx
+        push    ebx
+        push    ss
+        push    word 0
+        push    sp
+        call    Bs3SelProtFar32ToFlat32
+        add     sp, 6
+        shl     edx, 16
+        mov     dx, ax                  ; edx = flat stack address corresponding to ss:sp
+        pop     ebx
+        pop     ecx
+ %endif
+
         ; Calc ring addend.
         mov     ax, cs
@@ -92,4 +119,7 @@
         add     eax, BS3_SEL_R0_SS32 - BS3_SEL_R0_CS32
         mov     ss, ax
+ %if TMPL_BITS == 16
+        mov     esp, edx                ; Load flat stack address.
+ %endif
 
         add     eax, BS3_SEL_R0_DS32 - BS3_SEL_R0_SS32
@@ -103,10 +133,11 @@
  %if TMPL_BITS == 16
         ; Adjust the return address.
-        movsx   eax, word [esp + 4*2 + 2]
+        movsx   eax, word [esp + 4*3 + 2]
         add     eax, BS3_ADDR_BS3TEXT16
-        mov     [esp + 4*2], eax
+        mov     [esp + 4*3], eax
  %endif
 
         ; Restore and return.
+        BS3_ONLY_16BIT_STMT pop     edx
         popfd
         pop     eax
Index: /trunk/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-cmn-SwitchTo64Bit.asm
===================================================================
--- /trunk/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-cmn-SwitchTo64Bit.asm	(revision 59933)
+++ /trunk/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-cmn-SwitchTo64Bit.asm	(revision 59934)
@@ -5,5 +5,5 @@
 
 ;
-; Copyright (C) 2007-2015 Oracle Corporation
+; Copyright (C) 2007-2016 Oracle Corporation
 ;
 ; This file is part of VirtualBox Open Source Edition (OSE), as
@@ -42,8 +42,4 @@
         ret
 
-%elif BS3_MODE_IS_RM_OR_V86(TMPL_MODE)
-.again: int3                            ; Makes no sense to go to 64-bit mode from real or v8086 mode.
-        jmp     .again
-
 %else
  %if TMPL_BITS == 16
@@ -59,4 +55,13 @@
         cli
 
+ %if TMPL_BITS == 16
+        ; Check that this is LM16
+        mov     ax, seg g_bBs3CurrentMode
+        cmp     byte [g_bBs3CurrentMode], BS3_MODE_LM16
+        je      .ok_lm16
+        int3
+ .ok_lm16:
+ %endif
+
         ; Calc ring addend.
         mov     ax, cs
@@ -67,11 +72,11 @@
         ; setup far return.
         push    sAX
-%if TMPL_BITS == 16
+ %if TMPL_BITS == 16
         push    dword .sixty_four_bit
         o32 retf
-%else
+ %else
         push    .sixty_four_bit
         retf
-%endif
+ %endif
 
 BS3_SET_BITS 64
Index: unk/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-cmn-SwitchToV86.asm
===================================================================
--- /trunk/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-cmn-SwitchToV86.asm	(revision 59933)
+++ 	(revision )
@@ -1,96 +1,0 @@
-; $Id$
-;; @file
-; BS3Kit - Bs3SwitchTo16Bit
-;
-
-;
-; Copyright (C) 2007-2015 Oracle Corporation
-;
-; This file is part of VirtualBox Open Source Edition (OSE), as
-; available from http://www.virtualbox.org. This file is free software;
-; you can redistribute it and/or modify it under the terms of the GNU
-; General Public License (GPL) as published by the Free Software
-; Foundation, in version 2 as it comes in the "COPYING" file of the
-; VirtualBox OSE distribution. VirtualBox OSE is distributed in the
-; hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
-;
-; The contents of this file may alternatively be used under the terms
-; of the Common Development and Distribution License Version 1.0
-; (CDDL) only, as it comes in the "COPYING.CDDL" file of the
-; VirtualBox OSE distribution, in which case the provisions of the
-; CDDL are applicable instead of those of the GPL.
-;
-; You may elect to license modified versions of this file under the
-; terms and conditions of either the GPL or the CDDL or both.
-;
-
-%include "bs3kit-template-header.mac"
-
-%if TMPL_BITS != 16
-BS3_EXTERN_DATA16 g_bBs3CurrentMode
-TMPL_BEGIN_TEXT
-%endif
-
-
-;;
-; @cproto   BS3_DECL(void) Bs3SwitchTo16Bit(void);
-; @remarks  Does not require 20h of parameter scratch space in 64-bit mode.
-;
-BS3_PROC_BEGIN_CMN Bs3SwitchTo16Bit
-%if BS3_MODE_IS_16BIT_CODE_NO_V86(TMPL_MODE)
-        ret
-%else
-        push    xAX
-        xPUSHF
-        cli
-
-%if BS3_MODE_IS_V86(TMPL_MODE)
-        ; Switch to ring-0 if v8086 mode.
-        mov     ax, BS3_SYSCALL_TO_RING0
-        int     BS3_TRAP_SYSCALL
-%endif
-
-        ; Calc new CS.
-%if BS3_MODE_IS_RM_OR_V86(TMPL_MODE)
-        mov     xAX, BS3_SEL_R0_CS16
-%else
-        mov     ax, cs
-        and     xAX, 3
-        shl     xAX, BS3_SEL_RING_SHIFT  ; ring addend.
-        add     xAX, BS3_SEL_R0_CS16
-%endif
-
-        ; Construct a far return for switching to 16-bit code.
-        push    xAX
-        push    .sixteen_bit
-        xRETF
-
-BS3_BEGIN_TEXT16
-.sixteen_bit:
-
-        ; Load 16-bit segment registers.
-        ;; @todo support non-standard stacks?
-        add     ax, BS3_SEL_R0_SS16 - BS3_SEL_R0_CS16
-        mov     ss, ax
-
-        add     ax, BS3_SEL_R0_DS16 - BS3_SEL_R0_SS16
-        mov     ds, ax
-        mov     es, ax
-
-        ; Update globals.
-        and     byte [g_bBs3CurrentMode], ~BS3_MODE_CODE_MASK
-        or      byte [g_bBs3CurrentMode], BS3_MODE_CODE_16
-
-        popfd
- %if TMPL_BITS == 64
-        add     sp, 4
- %endif
-        pop     eax
- %if TMPL_BITS == 64
-        add     sp, 4
- %endif
-        ret     sCB - 2                 ; Return and pop 2 or 6 bytes of "parameters" (unused return value)
-TMPL_BEGIN_TEXT
-%endif
-BS3_PROC_END_CMN   Bs3SwitchTo16Bit
-
Index: /trunk/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-SwitchToPAE16_32.asm
===================================================================
--- /trunk/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-SwitchToPAE16_32.asm	(revision 59934)
+++ /trunk/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-SwitchToPAE16_32.asm	(revision 59934)
@@ -0,0 +1,77 @@
+; $Id$
+;; @file
+; BS3Kit - Bs3SwitchToPAE16_32
+;
+
+;
+; Copyright (C) 2007-2016 Oracle Corporation
+;
+; This file is part of VirtualBox Open Source Edition (OSE), as
+; available from http://www.virtualbox.org. This file is free software;
+; you can redistribute it and/or modify it under the terms of the GNU
+; General Public License (GPL) as published by the Free Software
+; Foundation, in version 2 as it comes in the "COPYING" file of the
+; VirtualBox OSE distribution. VirtualBox OSE is distributed in the
+; hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
+;
+; The contents of this file may alternatively be used under the terms
+; of the Common Development and Distribution License Version 1.0
+; (CDDL) only, as it comes in the "COPYING.CDDL" file of the
+; VirtualBox OSE distribution, in which case the provisions of the
+; CDDL are applicable instead of those of the GPL.
+;
+; You may elect to license modified versions of this file under the
+; terms and conditions of either the GPL or the CDDL or both.
+;
+
+%include "bs3kit-template-header.mac"
+
+
+;;
+; Switch to 32-bit code under 16-bit PAE paged protected mode sys/tss from any other mode.
+;
+; @cproto   BS3_DECL(void) Bs3SwitchToPE16_32(void);
+;
+; @uses     Nothing (except high 32-bit register parts).
+;
+; @remarks  Obviously returns to 32-bit mode, even if the caller was
+;           in 16-bit or 64-bit mode.
+;
+; @remarks  Does not require 20h of parameter scratch space in 64-bit mode.
+;
+BS3_PROC_BEGIN_MODE Bs3SwitchToPAE16_32
+%ifdef TMPL_PAE16_32
+        ret
+
+%else
+        ;
+        ; Make sure we're in the 16-bit segment and then call Bs3SwitchToPAE16.
+        ;
+ %if TMPL_BITS != 16
+        jmp     .sixteen_bit_segment
+BS3_BEGIN_TEXT16
+        BS3_SET_BITS TMPL_BITS
+.sixteen_bit_segment:
+ %endif
+        extern  TMPL_NM(Bs3SwitchToPAE16)
+        call    TMPL_NM(Bs3SwitchToPAE16)
+        BS3_SET_BITS 16
+
+        ;
+        ; Switch to 32-bit mode.
+        ;
+        extern  _Bs3SwitchTo32Bit_c16
+ %if TMPL_BITS == 16
+        jmp     _Bs3SwitchTo32Bit_c16
+ %else
+        call    _Bs3SwitchTo32Bit_c16
+        BS3_SET_BITS 32
+  %if TMPL_BITS == 32
+        ret
+  %else
+        ret     4                       ; Return and pop 4 bytes of "parameters" (unused return address).
+  %endif
+ %endif
+%endif
+BS3_PROC_END_MODE   Bs3SwitchToPAE16_32
+
Index: /trunk/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-SwitchToPAE16_V86.asm
===================================================================
--- /trunk/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-SwitchToPAE16_V86.asm	(revision 59934)
+++ /trunk/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-SwitchToPAE16_V86.asm	(revision 59934)
@@ -0,0 +1,73 @@
+; $Id$
+;; @file
+; BS3Kit - Bs3SwitchToPAE16_V86
+;
+
+;
+; Copyright (C) 2007-2016 Oracle Corporation
+;
+; This file is part of VirtualBox Open Source Edition (OSE), as
+; available from http://www.virtualbox.org. This file is free software;
+; you can redistribute it and/or modify it under the terms of the GNU
+; General Public License (GPL) as published by the Free Software
+; Foundation, in version 2 as it comes in the "COPYING" file of the
+; VirtualBox OSE distribution. VirtualBox OSE is distributed in the
+; hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
+;
+; The contents of this file may alternatively be used under the terms
+; of the Common Development and Distribution License Version 1.0
+; (CDDL) only, as it comes in the "COPYING.CDDL" file of the
+; VirtualBox OSE distribution, in which case the provisions of the
+; CDDL are applicable instead of those of the GPL.
+;
+; You may elect to license modified versions of this file under the
+; terms and conditions of either the GPL or the CDDL or both.
+;
+
+%include "bs3kit-template-header.mac"
+
+
+;;
+; Switch to 16-bit PAE paged protected mode with 16-bit sys+tss from any other mode.
+;
+; @cproto   BS3_DECL(void) Bs3SwitchToPAE16(void);
+;
+; @uses     Nothing (except high 32-bit register parts).
+;
+; @remarks  Obviously returns to v8086 16-bit mode, even if the caller was
+;           in 16-bit, 32-bit or 64-bit mode.
+;
+; @remarks  Does not require 20h of parameter scratch space in 64-bit mode.
+;
+BS3_PROC_BEGIN_MODE Bs3SwitchToPAE16_V86
+%ifdef TMPL_PAE16_V86
+        ret
+
+%else
+        ;
+        ; Convert the return address and jump to the 16-bit code segment.
+        ;
+ %if TMPL_BITS != 16
+        shl     xPRE [xSP], TMPL_BITS - 16
+        add     xSP, (TMPL_BITS - 16) / 8
+        jmp     .sixteen_bit_segment
+BS3_BEGIN_TEXT16
+        BS3_SET_BITS TMPL_BITS
+.sixteen_bit_segment:
+ %endif
+
+        ;
+        ; Switch to 16-bit PAE16 and from there to V8086.
+        ;
+        extern  TMPL_NM(Bs3SwitchToPAE16)
+        call    TMPL_NM(Bs3SwitchToPAE16)
+        BS3_SET_BITS 16
+
+        ;
+        ; Switch to v8086 mode (return address is already 16-bit).
+        ;
+        extern  _Bs3SwitchToV86_pae16
+        jmp     _Bs3SwitchToV86_pae16
+%endif
+BS3_PROC_END_MODE   Bs3SwitchToPAE16_V86
+
Index: /trunk/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-SwitchToPAE32_16.asm
===================================================================
--- /trunk/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-SwitchToPAE32_16.asm	(revision 59934)
+++ /trunk/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-SwitchToPAE32_16.asm	(revision 59934)
@@ -0,0 +1,81 @@
+; $Id$
+;; @file
+; BS3Kit - Bs3SwitchToPAE32_16
+;
+
+;
+; Copyright (C) 2007-2016 Oracle Corporation
+;
+; This file is part of VirtualBox Open Source Edition (OSE), as
+; available from http://www.virtualbox.org. This file is free software;
+; you can redistribute it and/or modify it under the terms of the GNU
+; General Public License (GPL) as published by the Free Software
+; Foundation, in version 2 as it comes in the "COPYING" file of the
+; VirtualBox OSE distribution. VirtualBox OSE is distributed in the
+; hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
+;
+; The contents of this file may alternatively be used under the terms
+; of the Common Development and Distribution License Version 1.0
+; (CDDL) only, as it comes in the "COPYING.CDDL" file of the
+; VirtualBox OSE distribution, in which case the provisions of the
+; CDDL are applicable instead of those of the GPL.
+;
+; You may elect to license modified versions of this file under the
+; terms and conditions of either the GPL or the CDDL or both.
+;
+
+%include "bs3kit-template-header.mac"
+
+
+;;
+; Switch to 16-bit code under 32-bit PAE paged protected mode sys/tss from any other mode.
+;
+; @cproto   BS3_DECL(void) Bs3SwitchToPAE32_16(void);
+;
+; @uses     Nothing (except high 32-bit register parts).
+;
+; @remarks  Obviously returns to 16-bit mode, even if the caller was
+;           in 32-bit or 64-bit mode.
+;
+; @remarks  Does not require 20h of parameter scratch space in 64-bit mode.
+;
+BS3_PROC_BEGIN_MODE Bs3SwitchToPAE32_16
+%if TMPL_MODE == BS3_MODE_PAE32_16
+        ret
+
+%elif TMPL_MODE == BS3_MODE_PAE32
+        extern  BS3_CMN_NM(Bs3SwitchTo32Bit)
+        jmp     BS3_CMN_NM(Bs3SwitchTo32Bit)
+
+%else
+        ;
+        ; Switch to PAE32.
+        ;
+        extern  TMPL_NM(Bs3SwitchToPAE32)
+        call    TMPL_NM(Bs3SwitchToPAE32)
+        BS3_SET_BITS 32
+
+        ;
+        ; Make sure we're in the 16-bit segment and then do the switch to 16-bit.
+        ;
+ %if TMPL_BITS != 16
+        jmp     .sixteen_bit_segment
+BS3_BEGIN_TEXT16
+        BS3_SET_BITS TMPL_BITS
+.sixteen_bit_segment:
+ %endif
+        extern  _Bs3SwitchTo16Bit_c32
+ %if TMPL_BITS == 32
+        jmp     _Bs3SwitchTo16Bit_c32
+ %else
+        call    _Bs3SwitchTo16Bit_c32
+        BS3_SET_BITS 16
+  %if TMPL_BITS == 16
+        ret
+  %else
+        ret     6                       ; Return and pop 6 bytes of "parameters" (unused return address).
+  %endif
+ %endif
+%endif
+BS3_PROC_END_MODE   Bs3SwitchToPAE32_16
+
Index: /trunk/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-SwitchToPAEV86.asm
===================================================================
--- /trunk/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-SwitchToPAEV86.asm	(revision 59934)
+++ /trunk/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-SwitchToPAEV86.asm	(revision 59934)
@@ -0,0 +1,73 @@
+; $Id$
+;; @file
+; BS3Kit - Bs3SwitchToPAEV86
+;
+
+;
+; Copyright (C) 2007-2016 Oracle Corporation
+;
+; This file is part of VirtualBox Open Source Edition (OSE), as
+; available from http://www.virtualbox.org. This file is free software;
+; you can redistribute it and/or modify it under the terms of the GNU
+; General Public License (GPL) as published by the Free Software
+; Foundation, in version 2 as it comes in the "COPYING" file of the
+; VirtualBox OSE distribution. VirtualBox OSE is distributed in the
+; hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
+;
+; The contents of this file may alternatively be used under the terms
+; of the Common Development and Distribution License Version 1.0
+; (CDDL) only, as it comes in the "COPYING.CDDL" file of the
+; VirtualBox OSE distribution, in which case the provisions of the
+; CDDL are applicable instead of those of the GPL.
+;
+; You may elect to license modified versions of this file under the
+; terms and conditions of either the GPL or the CDDL or both.
+;
+
+%include "bs3kit-template-header.mac"
+
+
+;;
+; Switch to 16-bit v8086 PAE paged protected mode with 32-bit sys+tss from any other mode.
+;
+; @cproto   BS3_DECL(void) Bs3SwitchToPAEV86(void);
+;
+; @uses     Nothing (except high 32-bit register parts).
+;
+; @remarks  Obviously returns to 16-bit v8086 mode, even if the caller was
+;           in 32-bit or 64-bit mode.
+;
+; @remarks  Does not require 20h of parameter scratch space in 64-bit mode.
+;
+BS3_PROC_BEGIN_MODE Bs3SwitchToPAEV86
+%if TMPL_MODE == BS3_MODE_PAEV86
+        ret
+
+%else
+        ;
+        ; Convert the return address and jump to the 16-bit code segment.
+        ;
+ %if TMPL_BITS != 16
+        shl     xPRE [xSP], TMPL_BITS - 16
+        add     xSP, (TMPL_BITS - 16) / 8
+        jmp     .sixteen_bit_segment
+BS3_BEGIN_TEXT16
+        BS3_SET_BITS TMPL_BITS
+.sixteen_bit_segment:
+ %endif
+
+        ;
+        ; Switch to 32-bit PAE32 and from there to V8086.
+        ;
+        extern  TMPL_NM(Bs3SwitchToPAE32)
+        call    TMPL_NM(Bs3SwitchToPAE32)
+        BS3_SET_BITS 32
+
+        ;
+        ; Switch to v8086 mode (return address is already 16-bit).
+        ;
+        extern  _Bs3SwitchToV86_pae32
+        jmp     _Bs3SwitchToV86_pae32
+%endif
+BS3_PROC_END_MODE   Bs3SwitchToPAEV86
+
Index: /trunk/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-SwitchToPE16_32.asm
===================================================================
--- /trunk/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-SwitchToPE16_32.asm	(revision 59933)
+++ /trunk/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-SwitchToPE16_32.asm	(revision 59934)
@@ -46,5 +46,5 @@
 %else
         ;
-        ; Make sure we're the 16-bit segment and then call Bs3SwitchToPE16.
+        ; Make sure we're in the 16-bit segment and then call Bs3SwitchToPE16.
         ;
  %if TMPL_BITS != 16
@@ -61,17 +61,16 @@
         ; Switch to 32-bit mode.
         ;
-        extern  TMPL_NM(Bs3SwitchTo32Bit)
-        call    TMPL_NM(Bs3SwitchTo32Bit)
+        extern  _Bs3SwitchTo32Bit_c16
+ %if TMPL_BITS == 16
+        jmp     _Bs3SwitchTo32Bit_c16
+ %else
+        call    _Bs3SwitchTo32Bit_c16
         BS3_SET_BITS 32
-
-        ;
-        ; Fix the return address and return.
-        ;
- %if TMPL_BITS == 16
-        push    word [esp]
- %elif TMPL_BITS == 64
-        pop     dword [esp + 4]
+  %if TMPL_BITS == 32
+        ret
+  %else
+        ret     4                       ; Return and pop 4 bytes of "parameters" (unused return address).
+  %endif
  %endif
-        ret
 %endif
 BS3_PROC_END_MODE   Bs3SwitchToPE16_32
Index: /trunk/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-SwitchToPE16_V86.asm
===================================================================
--- /trunk/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-SwitchToPE16_V86.asm	(revision 59933)
+++ /trunk/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-SwitchToPE16_V86.asm	(revision 59934)
@@ -29,5 +29,5 @@
 
 ;;
-; Switch to 16-bit unpaged protected mode from any other mode.
+; Switch to 16-bit unpaged protected mode with 16-bit sys+tss from any other mode.
 ;
 ; @cproto   BS3_DECL(void) Bs3SwitchToPE16(void);
@@ -35,6 +35,6 @@
 ; @uses     Nothing (except high 32-bit register parts).
 ;
-; @remarks  Obviously returns to 16-bit mode, even if the caller was
-;           in 32-bit or 64-bit mode.
+; @remarks  Obviously returns to 16-bit v8086 mode, even if the caller was
+;           in 16-bit, 32-bit or 64-bit mode.
 ;
 ; @remarks  Does not require 20h of parameter scratch space in 64-bit mode.
@@ -65,8 +65,8 @@
 
         ;
-        ; Switch to v8086 mode.
+        ; Switch to v8086 mode (return address is already 16-bit).
         ;
-        extern  TMPL_NM(Bs3SwitchToV86)
-        jmp     TMPL_NM(Bs3SwitchToV86)
+        extern  _Bs3SwitchToV86_pe16
+        jmp     _Bs3SwitchToV86_pe16
 %endif
 BS3_PROC_END_MODE   Bs3SwitchToPE16_V86
Index: /trunk/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-SwitchToPE32_16.asm
===================================================================
--- /trunk/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-SwitchToPE32_16.asm	(revision 59934)
+++ /trunk/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-SwitchToPE32_16.asm	(revision 59934)
@@ -0,0 +1,81 @@
+; $Id$
+;; @file
+; BS3Kit - Bs3SwitchToPE32_16
+;
+
+;
+; Copyright (C) 2007-2016 Oracle Corporation
+;
+; This file is part of VirtualBox Open Source Edition (OSE), as
+; available from http://www.virtualbox.org. This file is free software;
+; you can redistribute it and/or modify it under the terms of the GNU
+; General Public License (GPL) as published by the Free Software
+; Foundation, in version 2 as it comes in the "COPYING" file of the
+; VirtualBox OSE distribution. VirtualBox OSE is distributed in the
+; hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
+;
+; The contents of this file may alternatively be used under the terms
+; of the Common Development and Distribution License Version 1.0
+; (CDDL) only, as it comes in the "COPYING.CDDL" file of the
+; VirtualBox OSE distribution, in which case the provisions of the
+; CDDL are applicable instead of those of the GPL.
+;
+; You may elect to license modified versions of this file under the
+; terms and conditions of either the GPL or the CDDL or both.
+;
+
+%include "bs3kit-template-header.mac"
+
+
+;;
+; Switch to 16-bit code under 32-bit unpaged protected mode sys/tss from any other mode.
+;
+; @cproto   BS3_DECL(void) Bs3SwitchToPE32_16(void);
+;
+; @uses     Nothing (except high 32-bit register parts).
+;
+; @remarks  Obviously returns to 16-bit mode, even if the caller was
+;           in 32-bit or 64-bit mode.
+;
+; @remarks  Does not require 20h of parameter scratch space in 64-bit mode.
+;
+BS3_PROC_BEGIN_MODE Bs3SwitchToPE32_16
+%if TMPL_MODE == BS3_MODE_PE32_16
+        ret
+
+%elif TMPL_MODE == BS3_MODE_PE32
+        extern  BS3_CMN_NM(Bs3SwitchTo32Bit)
+        jmp     BS3_CMN_NM(Bs3SwitchTo32Bit)
+
+%else
+        ;
+        ; Switch to PE32.
+        ;
+        extern  TMPL_NM(Bs3SwitchToPE32)
+        call    TMPL_NM(Bs3SwitchToPE32)
+        BS3_SET_BITS 32
+
+        ;
+        ; Make sure we're in the 16-bit segment and then do the switch to 16-bit.
+        ;
+ %if TMPL_BITS != 16
+        jmp     .sixteen_bit_segment
+BS3_BEGIN_TEXT16
+        BS3_SET_BITS TMPL_BITS
+.sixteen_bit_segment:
+ %endif
+        extern  _Bs3SwitchTo16Bit_c32
+ %if TMPL_BITS == 32
+        jmp     _Bs3SwitchTo16Bit_c32
+ %else
+        call    _Bs3SwitchTo16Bit_c32
+        BS3_SET_BITS 16
+  %if TMPL_BITS == 16
+        ret
+  %else
+        ret     6                       ; Return and pop 6 bytes of "parameters" (unused return address).
+  %endif
+ %endif
+%endif
+BS3_PROC_END_MODE   Bs3SwitchToPE32_16
+
Index: /trunk/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-SwitchToPEV86.asm
===================================================================
--- /trunk/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-SwitchToPEV86.asm	(revision 59934)
+++ /trunk/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-SwitchToPEV86.asm	(revision 59934)
@@ -0,0 +1,73 @@
+; $Id$
+;; @file
+; BS3Kit - Bs3SwitchToPEV86
+;
+
+;
+; Copyright (C) 2007-2016 Oracle Corporation
+;
+; This file is part of VirtualBox Open Source Edition (OSE), as
+; available from http://www.virtualbox.org. This file is free software;
+; you can redistribute it and/or modify it under the terms of the GNU
+; General Public License (GPL) as published by the Free Software
+; Foundation, in version 2 as it comes in the "COPYING" file of the
+; VirtualBox OSE distribution. VirtualBox OSE is distributed in the
+; hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
+;
+; The contents of this file may alternatively be used under the terms
+; of the Common Development and Distribution License Version 1.0
+; (CDDL) only, as it comes in the "COPYING.CDDL" file of the
+; VirtualBox OSE distribution, in which case the provisions of the
+; CDDL are applicable instead of those of the GPL.
+;
+; You may elect to license modified versions of this file under the
+; terms and conditions of either the GPL or the CDDL or both.
+;
+
+%include "bs3kit-template-header.mac"
+
+
+;;
+; Switch to 16-bit v8086 unpaged protected mode with 32-bit sys+tss from any other mode.
+;
+; @cproto   BS3_DECL(void) Bs3SwitchToPEV86(void);
+;
+; @uses     Nothing (except high 32-bit register parts).
+;
+; @remarks  Obviously returns to 16-bit v8086 mode, even if the caller was
+;           in 32-bit or 64-bit mode.
+;
+; @remarks  Does not require 20h of parameter scratch space in 64-bit mode.
+;
+BS3_PROC_BEGIN_MODE Bs3SwitchToPEV86
+%if TMPL_MODE == BS3_MODE_PEV86
+        ret
+
+%else
+        ;
+        ; Convert the return address and jump to the 16-bit code segment.
+        ;
+ %if TMPL_BITS != 16
+        shl     xPRE [xSP], TMPL_BITS - 16
+        add     xSP, (TMPL_BITS - 16) / 8
+        jmp     .sixteen_bit_segment
+BS3_BEGIN_TEXT16
+        BS3_SET_BITS TMPL_BITS
+.sixteen_bit_segment:
+ %endif
+
+        ;
+        ; Switch to 32-bit PE32 and from there to V8086.
+        ;
+        extern  TMPL_NM(Bs3SwitchToPE32)
+        call    TMPL_NM(Bs3SwitchToPE32)
+        BS3_SET_BITS 32
+
+        ;
+        ; Switch to v8086 mode (return address is already 16-bit).
+        ;
+        extern  _Bs3SwitchToV86_pe32
+        jmp     _Bs3SwitchToV86_pe32
+%endif
+BS3_PROC_END_MODE   Bs3SwitchToPEV86
+
Index: /trunk/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-SwitchToPP16_32.asm
===================================================================
--- /trunk/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-SwitchToPP16_32.asm	(revision 59934)
+++ /trunk/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-SwitchToPP16_32.asm	(revision 59934)
@@ -0,0 +1,77 @@
+; $Id$
+;; @file
+; BS3Kit - Bs3SwitchToPP16_32
+;
+
+;
+; Copyright (C) 2007-2016 Oracle Corporation
+;
+; This file is part of VirtualBox Open Source Edition (OSE), as
+; available from http://www.virtualbox.org. This file is free software;
+; you can redistribute it and/or modify it under the terms of the GNU
+; General Public License (GPL) as published by the Free Software
+; Foundation, in version 2 as it comes in the "COPYING" file of the
+; VirtualBox OSE distribution. VirtualBox OSE is distributed in the
+; hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
+;
+; The contents of this file may alternatively be used under the terms
+; of the Common Development and Distribution License Version 1.0
+; (CDDL) only, as it comes in the "COPYING.CDDL" file of the
+; VirtualBox OSE distribution, in which case the provisions of the
+; CDDL are applicable instead of those of the GPL.
+;
+; You may elect to license modified versions of this file under the
+; terms and conditions of either the GPL or the CDDL or both.
+;
+
+%include "bs3kit-template-header.mac"
+
+
+;;
+; Switch to 32-bit code under 16-bit paged protected mode sys/tss from any other mode.
+;
+; @cproto   BS3_DECL(void) Bs3SwitchToPP16_32(void);
+;
+; @uses     Nothing (except high 32-bit register parts).
+;
+; @remarks  Obviously returns to 32-bit mode, even if the caller was
+;           in 16-bit or 64-bit mode.
+;
+; @remarks  Does not require 20h of parameter scratch space in 64-bit mode.
+;
+BS3_PROC_BEGIN_MODE Bs3SwitchToPP16_32
+%ifdef TMPL_PP16_32
+        ret
+
+%else
+        ;
+        ; Make sure we're in the 16-bit segment and then call Bs3SwitchToPP16.
+        ;
+ %if TMPL_BITS != 16
+        jmp     .sixteen_bit_segment
+BS3_BEGIN_TEXT16
+        BS3_SET_BITS TMPL_BITS
+.sixteen_bit_segment:
+ %endif
+        extern  TMPL_NM(Bs3SwitchToPP16)
+        call    TMPL_NM(Bs3SwitchToPP16)
+        BS3_SET_BITS 16
+
+        ;
+        ; Switch to 32-bit mode.
+        ;
+        extern  _Bs3SwitchTo32Bit_c16
+ %if TMPL_BITS == 16
+        jmp     _Bs3SwitchTo32Bit_c16
+ %else
+        call    _Bs3SwitchTo32Bit_c16
+        BS3_SET_BITS 32
+  %if TMPL_BITS == 32
+        ret
+  %else
+        ret     4                       ; Return and pop 4 bytes of "parameters" (unused return address).
+  %endif
+ %endif
+%endif
+BS3_PROC_END_MODE   Bs3SwitchToPP16_32
+
Index: /trunk/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-SwitchToPP16_V86.asm
===================================================================
--- /trunk/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-SwitchToPP16_V86.asm	(revision 59934)
+++ /trunk/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-SwitchToPP16_V86.asm	(revision 59934)
@@ -0,0 +1,73 @@
+; $Id$
+;; @file
+; BS3Kit - Bs3SwitchToPP16_V86
+;
+
+;
+; Copyright (C) 2007-2016 Oracle Corporation
+;
+; This file is part of VirtualBox Open Source Edition (OSE), as
+; available from http://www.virtualbox.org. This file is free software;
+; you can redistribute it and/or modify it under the terms of the GNU
+; General Public License (GPL) as published by the Free Software
+; Foundation, in version 2 as it comes in the "COPYING" file of the
+; VirtualBox OSE distribution. VirtualBox OSE is distributed in the
+; hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
+;
+; The contents of this file may alternatively be used under the terms
+; of the Common Development and Distribution License Version 1.0
+; (CDDL) only, as it comes in the "COPYING.CDDL" file of the
+; VirtualBox OSE distribution, in which case the provisions of the
+; CDDL are applicable instead of those of the GPL.
+;
+; You may elect to license modified versions of this file under the
+; terms and conditions of either the GPL or the CDDL or both.
+;
+
+%include "bs3kit-template-header.mac"
+
+
+;;
+; Switch to 16-bit paged protected mode with 16-bit sys+tss from any other mode.
+;
+; @cproto   BS3_DECL(void) Bs3SwitchToPP16(void);
+;
+; @uses     Nothing (except high 32-bit register parts).
+;
+; @remarks  Obviously returns to v8086 16-bit mode, even if the caller was
+;           in 16-bit, 32-bit or 64-bit mode.
+;
+; @remarks  Does not require 20h of parameter scratch space in 64-bit mode.
+;
+BS3_PROC_BEGIN_MODE Bs3SwitchToPP16_V86
+%ifdef TMPL_PP16_V86
+        ret
+
+%else
+        ;
+        ; Convert the return address and jump to the 16-bit code segment.
+        ;
+ %if TMPL_BITS != 16
+        shl     xPRE [xSP], TMPL_BITS - 16
+        add     xSP, (TMPL_BITS - 16) / 8
+        jmp     .sixteen_bit_segment
+BS3_BEGIN_TEXT16
+        BS3_SET_BITS TMPL_BITS
+.sixteen_bit_segment:
+ %endif
+
+        ;
+        ; Switch to 16-bit PP16 and from there to V8086.
+        ;
+        extern  TMPL_NM(Bs3SwitchToPP16)
+        call    TMPL_NM(Bs3SwitchToPP16)
+        BS3_SET_BITS 16
+
+        ;
+        ; Switch to v8086 mode (return address is already 16-bit).
+        ;
+        extern  _Bs3SwitchToV86_pp16
+        jmp     _Bs3SwitchToV86_pp16
+%endif
+BS3_PROC_END_MODE   Bs3SwitchToPP16_V86
+
Index: /trunk/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-SwitchToPP32_16.asm
===================================================================
--- /trunk/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-SwitchToPP32_16.asm	(revision 59934)
+++ /trunk/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-SwitchToPP32_16.asm	(revision 59934)
@@ -0,0 +1,81 @@
+; $Id$
+;; @file
+; BS3Kit - Bs3SwitchToPP32_16
+;
+
+;
+; Copyright (C) 2007-2016 Oracle Corporation
+;
+; This file is part of VirtualBox Open Source Edition (OSE), as
+; available from http://www.virtualbox.org. This file is free software;
+; you can redistribute it and/or modify it under the terms of the GNU
+; General Public License (GPL) as published by the Free Software
+; Foundation, in version 2 as it comes in the "COPYING" file of the
+; VirtualBox OSE distribution. VirtualBox OSE is distributed in the
+; hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
+;
+; The contents of this file may alternatively be used under the terms
+; of the Common Development and Distribution License Version 1.0
+; (CDDL) only, as it comes in the "COPYING.CDDL" file of the
+; VirtualBox OSE distribution, in which case the provisions of the
+; CDDL are applicable instead of those of the GPL.
+;
+; You may elect to license modified versions of this file under the
+; terms and conditions of either the GPL or the CDDL or both.
+;
+
+%include "bs3kit-template-header.mac"
+
+
+;;
+; Switch to 16-bit code under 32-bit paged protected mode sys/tss from any other mode.
+;
+; @cproto   BS3_DECL(void) Bs3SwitchToPP32_16(void);
+;
+; @uses     Nothing (except high 32-bit register parts).
+;
+; @remarks  Obviously returns to 16-bit mode, even if the caller was
+;           in 32-bit or 64-bit mode.
+;
+; @remarks  Does not require 20h of parameter scratch space in 64-bit mode.
+;
+BS3_PROC_BEGIN_MODE Bs3SwitchToPP32_16
+%if TMPL_MODE == BS3_MODE_PP32_16
+        ret
+
+%elif TMPL_MODE == BS3_MODE_PP32
+        extern  BS3_CMN_NM(Bs3SwitchTo32Bit)
+        jmp     BS3_CMN_NM(Bs3SwitchTo32Bit)
+
+%else
+        ;
+        ; Switch to PP32.
+        ;
+        extern  TMPL_NM(Bs3SwitchToPP32)
+        call    TMPL_NM(Bs3SwitchToPP32)
+        BS3_SET_BITS 32
+
+        ;
+        ; Make sure we're in the 16-bit segment and then do the switch to 16-bit.
+        ;
+ %if TMPL_BITS != 16
+        jmp     .sixteen_bit_segment
+BS3_BEGIN_TEXT16
+        BS3_SET_BITS TMPL_BITS
+.sixteen_bit_segment:
+ %endif
+        extern  _Bs3SwitchTo16Bit_c32
+ %if TMPL_BITS == 32
+        jmp     _Bs3SwitchTo16Bit_c32
+ %else
+        call    _Bs3SwitchTo16Bit_c32
+        BS3_SET_BITS 16
+  %if TMPL_BITS == 16
+        ret
+  %else
+        ret     6                       ; Return and pop 6 bytes of "parameters" (unused return address).
+  %endif
+ %endif
+%endif
+BS3_PROC_END_MODE   Bs3SwitchToPP32_16
+
Index: /trunk/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-SwitchToPPV86.asm
===================================================================
--- /trunk/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-SwitchToPPV86.asm	(revision 59934)
+++ /trunk/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-SwitchToPPV86.asm	(revision 59934)
@@ -0,0 +1,73 @@
+; $Id$
+;; @file
+; BS3Kit - Bs3SwitchToPPV86
+;
+
+;
+; Copyright (C) 2007-2016 Oracle Corporation
+;
+; This file is part of VirtualBox Open Source Edition (OSE), as
+; available from http://www.virtualbox.org. This file is free software;
+; you can redistribute it and/or modify it under the terms of the GNU
+; General Public License (GPL) as published by the Free Software
+; Foundation, in version 2 as it comes in the "COPYING" file of the
+; VirtualBox OSE distribution. VirtualBox OSE is distributed in the
+; hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
+;
+; The contents of this file may alternatively be used under the terms
+; of the Common Development and Distribution License Version 1.0
+; (CDDL) only, as it comes in the "COPYING.CDDL" file of the
+; VirtualBox OSE distribution, in which case the provisions of the
+; CDDL are applicable instead of those of the GPL.
+;
+; You may elect to license modified versions of this file under the
+; terms and conditions of either the GPL or the CDDL or both.
+;
+
+%include "bs3kit-template-header.mac"
+
+
+;;
+; Switch to 16-bit v8086 paged protected mode with 32-bit sys+tss from any other mode.
+;
+; @cproto   BS3_DECL(void) Bs3SwitchToPPV86(void);
+;
+; @uses     Nothing (except high 32-bit register parts).
+;
+; @remarks  Obviously returns to 16-bit v8086 mode, even if the caller was
+;           in 32-bit or 64-bit mode.
+;
+; @remarks  Does not require 20h of parameter scratch space in 64-bit mode.
+;
+BS3_PROC_BEGIN_MODE Bs3SwitchToPPV86
+%if TMPL_MODE == BS3_MODE_PPV86
+        ret
+
+%else
+        ;
+        ; Convert the return address and jump to the 16-bit code segment.
+        ;
+ %if TMPL_BITS != 16
+        shl     xPRE [xSP], TMPL_BITS - 16
+        add     xSP, (TMPL_BITS - 16) / 8
+        jmp     .sixteen_bit_segment
+BS3_BEGIN_TEXT16
+        BS3_SET_BITS TMPL_BITS
+.sixteen_bit_segment:
+ %endif
+
+        ;
+        ; Switch to 32-bit PP32 and from there to V8086.
+        ;
+        extern  TMPL_NM(Bs3SwitchToPP32)
+        call    TMPL_NM(Bs3SwitchToPP32)
+        BS3_SET_BITS 32
+
+        ;
+        ; Switch to v8086 mode (return address is already 16-bit).
+        ;
+        extern  _Bs3SwitchToV86_pp32
+        jmp     _Bs3SwitchToV86_pp32
+%endif
+BS3_PROC_END_MODE   Bs3SwitchToPPV86
+
Index: /trunk/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-SwitchToRM.asm
===================================================================
--- /trunk/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-SwitchToRM.asm	(revision 59933)
+++ /trunk/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-SwitchToRM.asm	(revision 59934)
@@ -28,4 +28,7 @@
 
 BS3_EXTERN_SYSTEM16 Bs3Gdt
+%if TMPL_MODE == BS3_MODE_PE16
+BS3_EXTERN_DATA16 g_uBs3CpuDetected
+%endif
 TMPL_BEGIN_TEXT
 
@@ -60,6 +63,22 @@
         cli
 
- %if TMPL_BITS != 16
+ %if TMPL_MODE == BS3_MODE_PE16
+        ;
+        ; On 80286 we must reset the CPU to get back to real mode.
+        ;
+        mov     ax, seg g_uBs3CpuDetected
+        mov     ds, ax
+        cmp     byte [g_uBs3CpuDetected], BS3CPU_80286
+        jne     .is_386_or_better
+.implement_this_later:
+        int3
+        jmp     .implement_this_later
+
+        jmp     .reload_cs
+
+ %elif TMPL_BITS != 16
+        ;
         ; Must be in 16-bit segment when calling Bs3SwitchTo16Bit.
+        ;
         jmp     .sixteen_bit_segment wrt FLAT
 BS3_BEGIN_TEXT16
@@ -75,4 +94,5 @@
         ; Exit to real mode.
         ;
+.is_386_or_better:
         mov     eax, cr0
         and     eax, X86_CR0_NO_PE_NO_PG
