bs3-cpu-basic-2-template.c@ 60682

Last change on this file since 60682 was 60682, checked in by vboxsync, 9 years ago
bs3kit: Can finally check for non-canonical address #GP(0).
Property svn:eol-style set to `native` Property svn:keywords set to `Author Date Id Revision`
File size: 102.5 KB

Line
1	/* $Id: bs3-cpu-basic-2-template.c 60682 2016-04-24 18:56:17Z vboxsync $ */
2	/** @file
3	* BS3Kit - bs3-cpu-basic-2, C code template.
4	*/
5
6	/*
7	* Copyright (C) 2007-2016 Oracle Corporation
8	*
9	* This file is part of VirtualBox Open Source Edition (OSE), as
10	* available from http://www.virtualbox.org. This file is free software;
11	* you can redistribute it and/or modify it under the terms of the GNU
12	* General Public License (GPL) as published by the Free Software
13	* Foundation, in version 2 as it comes in the "COPYING" file of the
14	* VirtualBox OSE distribution. VirtualBox OSE is distributed in the
15	* hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
16	*
17	* The contents of this file may alternatively be used under the terms
18	* of the Common Development and Distribution License Version 1.0
19	* (CDDL) only, as it comes in the "COPYING.CDDL" file of the
20	* VirtualBox OSE distribution, in which case the provisions of the
21	* CDDL are applicable instead of those of the GPL.
22	*
23	* You may elect to license modified versions of this file under the
24	* terms and conditions of either the GPL or the CDDL or both.
25	*/
26
27
28	/*********************************************************************************************************************************
29	* Header Files *
30	*********************************************************************************************************************************/
31	#include <iprt/asm.h>
32	#include <iprt/asm-amd64-x86.h>
33
34
35	/*********************************************************************************************************************************
36	* Defined Constants And Macros *
37	*********************************************************************************************************************************/
38	#undef CHECK_MEMBER
39	#define CHECK_MEMBER(a_szName, a_szFmt, a_Actual, a_Expected) \
40	do \
41	{ \
42	if ((a_Actual) == (a_Expected)) { /* likely */ } \
43	else bs3CpuBasic2_FailedF(a_szName "=" a_szFmt " expected " a_szFmt, (a_Actual), (a_Expected)); \
44	} while (0)
45
46	#ifdef BS3_INSTANTIATING_MODE
47	# undef MyBs3Idt
48	# undef MY_SYS_SEL_R0_CS
49	# undef MY_SYS_SEL_R0_CS_CNF
50	# undef MY_SYS_SEL_R0_DS
51	# undef MY_SYS_SEL_R0_SS
52	# if BS3_MODE_IS_16BIT_SYS(TMPL_MODE)
53	# define MyBs3Idt Bs3Idt16
54	# define MY_SYS_SEL_R0_CS BS3_SEL_R0_CS16
55	# define MY_SYS_SEL_R0_CS_CNF BS3_SEL_R0_CS16_CNF
56	# define MY_SYS_SEL_R0_DS BS3_SEL_R0_DS16
57	# define MY_SYS_SEL_R0_SS BS3_SEL_R0_SS16
58	# elif BS3_MODE_IS_32BIT_SYS(TMPL_MODE)
59	# define MyBs3Idt Bs3Idt32
60	# define MY_SYS_SEL_R0_CS BS3_SEL_R0_CS32
61	# define MY_SYS_SEL_R0_CS_CNF BS3_SEL_R0_CS32_CNF
62	# define MY_SYS_SEL_R0_DS BS3_SEL_R0_DS32
63	# define MY_SYS_SEL_R0_SS BS3_SEL_R0_SS32
64	# elif BS3_MODE_IS_64BIT_SYS(TMPL_MODE)
65	# define MyBs3Idt Bs3Idt64
66	# define MY_SYS_SEL_R0_CS BS3_SEL_R0_CS64
67	# define MY_SYS_SEL_R0_CS_CNF BS3_SEL_R0_CS64_CNF
68	# define MY_SYS_SEL_R0_DS BS3_SEL_R0_DS64
69	# define MY_SYS_SEL_R0_SS BS3_SEL_R0_DS64
70	# else
71	# error "TMPL_MODE"
72	# endif
73	#endif
74
75
76	/*********************************************************************************************************************************
77	* Structures and Typedefs *
78	*********************************************************************************************************************************/
79	#ifdef BS3_INSTANTIATING_CMN
80	typedef struct BS3CB2INVLDESCTYPE
81	{
82	uint8_t u4Type;
83	uint8_t u1DescType;
84	} BS3CB2INVLDESCTYPE;
85
86	typedef struct BS3CB2SIDTSGDT
87	{
88	FPFNBS3FAR fpfnWorker;
89	uint8_t cbInstr;
90	bool fSs;
91	uint8_t bMode;
92	} BS3CB2SIDTSGDT;
93	#endif
94
95
96	/*********************************************************************************************************************************
97	* External Symbols *
98	*********************************************************************************************************************************/
99	#ifdef BS3_INSTANTIATING_CMN
100	extern FNBS3FAR bs3CpuBasic2_Int80;
101	extern FNBS3FAR bs3CpuBasic2_Int81;
102	extern FNBS3FAR bs3CpuBasic2_Int82;
103	extern FNBS3FAR bs3CpuBasic2_Int83;
104	extern FNBS3FAR bs3CpuBasic2_ud2;
105	# define g_bs3CpuBasic2_ud2_FlatAddr BS3_DATA_NM(g_bs3CpuBasic2_ud2_FlatAddr)
106	extern uint32_t g_bs3CpuBasic2_ud2_FlatAddr;
107
108	extern FNBS3FAR bs3CpuBasic2_sidt_bx_ud2_c16;
109	extern FNBS3FAR bs3CpuBasic2_sidt_bx_ud2_c32;
110	extern FNBS3FAR bs3CpuBasic2_sidt_bx_ud2_c64;
111	extern FNBS3FAR bs3CpuBasic2_sidt_ss_bx_ud2_c16;
112	extern FNBS3FAR bs3CpuBasic2_sidt_ss_bx_ud2_c32;
113	extern FNBS3FAR bs3CpuBasic2_sidt_rexw_bx_ud2_c64;
114	extern FNBS3FAR bs3CpuBasic2_sidt_opsize_bx_ud2_c16;
115	extern FNBS3FAR bs3CpuBasic2_sidt_opsize_bx_ud2_c32;
116	extern FNBS3FAR bs3CpuBasic2_sidt_opsize_bx_ud2_c64;
117	extern FNBS3FAR bs3CpuBasic2_sidt_opsize_ss_bx_ud2_c16;
118	extern FNBS3FAR bs3CpuBasic2_sidt_opsize_ss_bx_ud2_c32;
119	extern FNBS3FAR bs3CpuBasic2_sidt_opsize_rexw_bx_ud2_c64;
120
121	extern FNBS3FAR bs3CpuBasic2_sgdt_bx_ud2_c16;
122	extern FNBS3FAR bs3CpuBasic2_sgdt_bx_ud2_c32;
123	extern FNBS3FAR bs3CpuBasic2_sgdt_bx_ud2_c64;
124	extern FNBS3FAR bs3CpuBasic2_sgdt_ss_bx_ud2_c16;
125	extern FNBS3FAR bs3CpuBasic2_sgdt_ss_bx_ud2_c32;
126	extern FNBS3FAR bs3CpuBasic2_sgdt_rexw_bx_ud2_c64;
127	extern FNBS3FAR bs3CpuBasic2_sgdt_opsize_bx_ud2_c16;
128	extern FNBS3FAR bs3CpuBasic2_sgdt_opsize_bx_ud2_c32;
129	extern FNBS3FAR bs3CpuBasic2_sgdt_opsize_bx_ud2_c64;
130	extern FNBS3FAR bs3CpuBasic2_sgdt_opsize_ss_bx_ud2_c16;
131	extern FNBS3FAR bs3CpuBasic2_sgdt_opsize_ss_bx_ud2_c32;
132	extern FNBS3FAR bs3CpuBasic2_sgdt_opsize_rexw_bx_ud2_c64;
133	#endif
134
135
136	/*********************************************************************************************************************************
137	* Global Variables *
138	*********************************************************************************************************************************/
139	#ifdef BS3_INSTANTIATING_CMN
140	# define g_pszTestMode BS3_CMN_NM(g_pszTestMode)
141	static const char BS3_FAR g_pszTestMode = (const char )1;
142	# define g_bTestMode BS3_CMN_NM(g_bTestMode)
143	static uint8_t g_bTestMode = 1;
144	# define g_f16BitSys BS3_CMN_NM(g_f16BitSys)
145	static bool g_f16BitSys = 1;
146
147
148	static BS3CB2SIDTSGDT const g_aSidtWorkers[] =
149	{
150	{ bs3CpuBasic2_sidt_bx_ud2_c16, 3, false, BS3_MODE_CODE_16 \| BS3_MODE_CODE_V86 },
151	{ bs3CpuBasic2_sidt_ss_bx_ud2_c16, 4, true, BS3_MODE_CODE_16 \| BS3_MODE_CODE_V86 },
152	{ bs3CpuBasic2_sidt_opsize_bx_ud2_c16, 4, false, BS3_MODE_CODE_16 \| BS3_MODE_CODE_V86 },
153	{ bs3CpuBasic2_sidt_opsize_ss_bx_ud2_c16, 5, true, BS3_MODE_CODE_16 \| BS3_MODE_CODE_V86 },
154	{ bs3CpuBasic2_sidt_bx_ud2_c32, 3, false, BS3_MODE_CODE_32 },
155	{ bs3CpuBasic2_sidt_ss_bx_ud2_c32, 4, true, BS3_MODE_CODE_32 },
156	{ bs3CpuBasic2_sidt_opsize_bx_ud2_c32, 4, false, BS3_MODE_CODE_32 },
157	{ bs3CpuBasic2_sidt_opsize_ss_bx_ud2_c32, 5, true, BS3_MODE_CODE_32 },
158	{ bs3CpuBasic2_sidt_bx_ud2_c64, 3, false, BS3_MODE_CODE_64 },
159	{ bs3CpuBasic2_sidt_rexw_bx_ud2_c64, 4, false, BS3_MODE_CODE_64 },
160	{ bs3CpuBasic2_sidt_opsize_bx_ud2_c64, 4, false, BS3_MODE_CODE_64 },
161	{ bs3CpuBasic2_sidt_opsize_rexw_bx_ud2_c64, 5, false, BS3_MODE_CODE_64 },
162	};
163
164
165	static BS3CB2SIDTSGDT const g_aSgdtWorkers[] =
166	{
167	{ bs3CpuBasic2_sgdt_bx_ud2_c16, 3, false, BS3_MODE_CODE_16 \| BS3_MODE_CODE_V86 },
168	{ bs3CpuBasic2_sgdt_ss_bx_ud2_c16, 4, true, BS3_MODE_CODE_16 \| BS3_MODE_CODE_V86 },
169	{ bs3CpuBasic2_sgdt_opsize_bx_ud2_c16, 4, false, BS3_MODE_CODE_16 \| BS3_MODE_CODE_V86 },
170	{ bs3CpuBasic2_sgdt_opsize_ss_bx_ud2_c16, 5, true, BS3_MODE_CODE_16 \| BS3_MODE_CODE_V86 },
171	{ bs3CpuBasic2_sgdt_bx_ud2_c32, 3, false, BS3_MODE_CODE_32 },
172	{ bs3CpuBasic2_sgdt_ss_bx_ud2_c32, 4, true, BS3_MODE_CODE_32 },
173	{ bs3CpuBasic2_sgdt_opsize_bx_ud2_c32, 4, false, BS3_MODE_CODE_32 },
174	{ bs3CpuBasic2_sgdt_opsize_ss_bx_ud2_c32, 5, true, BS3_MODE_CODE_32 },
175	{ bs3CpuBasic2_sgdt_bx_ud2_c64, 3, false, BS3_MODE_CODE_64 },
176	{ bs3CpuBasic2_sgdt_rexw_bx_ud2_c64, 4, false, BS3_MODE_CODE_64 },
177	{ bs3CpuBasic2_sgdt_opsize_bx_ud2_c64, 4, false, BS3_MODE_CODE_64 },
178	{ bs3CpuBasic2_sgdt_opsize_rexw_bx_ud2_c64, 5, false, BS3_MODE_CODE_64 },
179	};
180
181
182	/** Table containing invalid CS selector types. */
183	static const BS3CB2INVLDESCTYPE g_aInvalidCsTypes[] =
184	{
185	{ X86_SEL_TYPE_RO, 1 },
186	{ X86_SEL_TYPE_RO_ACC, 1 },
187	{ X86_SEL_TYPE_RW, 1 },
188	{ X86_SEL_TYPE_RW_ACC, 1 },
189	{ X86_SEL_TYPE_RO_DOWN, 1 },
190	{ X86_SEL_TYPE_RO_DOWN_ACC, 1 },
191	{ X86_SEL_TYPE_RW_DOWN, 1 },
192	{ X86_SEL_TYPE_RW_DOWN_ACC, 1 },
193	{ 0, 0 },
194	{ 1, 0 },
195	{ 2, 0 },
196	{ 3, 0 },
197	{ 4, 0 },
198	{ 5, 0 },
199	{ 6, 0 },
200	{ 7, 0 },
201	{ 8, 0 },
202	{ 9, 0 },
203	{ 10, 0 },
204	{ 11, 0 },
205	{ 12, 0 },
206	{ 13, 0 },
207	{ 14, 0 },
208	{ 15, 0 },
209	};
210
211	/** Table containing invalid SS selector types. */
212	static const BS3CB2INVLDESCTYPE g_aInvalidSsTypes[] =
213	{
214	{ X86_SEL_TYPE_EO, 1 },
215	{ X86_SEL_TYPE_EO_ACC, 1 },
216	{ X86_SEL_TYPE_ER, 1 },
217	{ X86_SEL_TYPE_ER_ACC, 1 },
218	{ X86_SEL_TYPE_EO_CONF, 1 },
219	{ X86_SEL_TYPE_EO_CONF_ACC, 1 },
220	{ X86_SEL_TYPE_ER_CONF, 1 },
221	{ X86_SEL_TYPE_ER_CONF_ACC, 1 },
222	{ 0, 0 },
223	{ 1, 0 },
224	{ 2, 0 },
225	{ 3, 0 },
226	{ 4, 0 },
227	{ 5, 0 },
228	{ 6, 0 },
229	{ 7, 0 },
230	{ 8, 0 },
231	{ 9, 0 },
232	{ 10, 0 },
233	{ 11, 0 },
234	{ 12, 0 },
235	{ 13, 0 },
236	{ 14, 0 },
237	{ 15, 0 },
238	};
239
240	#endif /* BS3_INSTANTIATING_CMN - global */
241
242	#ifdef BS3_INSTANTIATING_CMN
243
244	/**
245	* Wrapper around Bs3TestFailedF that prefixes the error with g_usBs3TestStep
246	* and g_pszTestMode.
247	*/
248	# define bs3CpuBasic2_FailedF BS3_CMN_NM(bs3CpuBasic2_FailedF)
249	BS3_DECL_NEAR(void) bs3CpuBasic2_FailedF(const char *pszFormat, ...)
250	{
251	va_list va;
252
253	char szTmp[168];
254	va_start(va, pszFormat);
255	Bs3StrPrintfV(szTmp, sizeof(szTmp), pszFormat, va);
256	va_end(va);
257
258	Bs3TestFailedF("%u - %s: %s", g_usBs3TestStep, g_pszTestMode, szTmp);
259	}
260
261
262	/**
263	* Compares trap stuff.
264	*/
265	# define bs3CpuBasic2_CompareIntCtx1 BS3_CMN_NM(bs3CpuBasic2_CompareIntCtx1)
266	BS3_DECL_NEAR(void) bs3CpuBasic2_CompareIntCtx1(PCBS3TRAPFRAME pTrapCtx, PCBS3REGCTX pStartCtx, uint8_t bXcpt)
267	{
268	uint16_t const cErrorsBefore = Bs3TestSubErrorCount();
269	CHECK_MEMBER("bXcpt", "%#04x", pTrapCtx->bXcpt, bXcpt);
270	CHECK_MEMBER("bErrCd", "%#06RX64", pTrapCtx->uErrCd, 0);
271	Bs3TestCheckRegCtxEx(&pTrapCtx->Ctx, pStartCtx, 2 /int xx/, 0 /cbSpAdjust/, 0 /fExtraEfl/, g_pszTestMode, g_usBs3TestStep);
272	if (Bs3TestSubErrorCount() != cErrorsBefore)
273	{
274	Bs3TrapPrintFrame(pTrapCtx);
275	#if 1
276	Bs3TestPrintf("Halting: g_uBs3CpuDetected=%#x\n", g_uBs3CpuDetected);
277	Bs3TestPrintf("Halting in CompareTrapCtx1: bXcpt=%#x\n", bXcpt);
278	ASMHalt();
279	#endif
280	}
281	}
282
283
284	/**
285	* Compares trap stuff.
286	*/
287	# define bs3CpuBasic2_CompareTrapCtx2 BS3_CMN_NM(bs3CpuBasic2_CompareTrapCtx2)
288	BS3_DECL_NEAR(void) bs3CpuBasic2_CompareTrapCtx2(PCBS3TRAPFRAME pTrapCtx, PCBS3REGCTX pStartCtx, uint16_t cbIpAdjust,
289	uint8_t bXcpt, uint16_t uHandlerCs)
290	{
291	uint16_t const cErrorsBefore = Bs3TestSubErrorCount();
292	CHECK_MEMBER("bXcpt", "%#04x", pTrapCtx->bXcpt, bXcpt);
293	CHECK_MEMBER("bErrCd", "%#06RX64", pTrapCtx->uErrCd, 0);
294	CHECK_MEMBER("uHandlerCs", "%#06x", pTrapCtx->uHandlerCs, uHandlerCs);
295	Bs3TestCheckRegCtxEx(&pTrapCtx->Ctx, pStartCtx, cbIpAdjust, 0 /cbSpAdjust/, 0 /fExtraEfl/, g_pszTestMode, g_usBs3TestStep);
296	if (Bs3TestSubErrorCount() != cErrorsBefore)
297	{
298	Bs3TrapPrintFrame(pTrapCtx);
299	#if 1
300	Bs3TestPrintf("Halting: g_uBs3CpuDetected=%#x\n", g_uBs3CpuDetected);
301	Bs3TestPrintf("Halting in CompareTrapCtx2: bXcpt=%#x\n", bXcpt);
302	ASMHalt();
303	#endif
304	}
305	}
306
307	/**
308	* Compares a CPU trap.
309	*/
310	# define bs3CpuBasic2_CompareCpuTrapCtx BS3_CMN_NM(bs3CpuBasic2_CompareCpuTrapCtx)
311	BS3_DECL_NEAR(void) bs3CpuBasic2_CompareCpuTrapCtx(PCBS3TRAPFRAME pTrapCtx, PCBS3REGCTX pStartCtx, uint16_t uErrCd,
312	uint8_t bXcpt, bool f486ResumeFlagHint)
313	{
314	uint16_t const cErrorsBefore = Bs3TestSubErrorCount();
315	uint32_t fExtraEfl;
316
317	CHECK_MEMBER("bXcpt", "%#04x", pTrapCtx->bXcpt, bXcpt);
318	CHECK_MEMBER("bErrCd", "%#06RX16", (uint16_t)pTrapCtx->uErrCd, (uint16_t)uErrCd); /* 486 only writes a word */
319
320	fExtraEfl = X86_EFL_RF;
321	if ( g_f16BitSys
322	\|\| ( !f486ResumeFlagHint
323	&& (g_uBs3CpuDetected & BS3CPU_TYPE_MASK) <= BS3CPU_80486 ) )
324	fExtraEfl = 0;
325	else
326	fExtraEfl = X86_EFL_RF;
327	#if 0 /** @todo Running on an AMD Phenom II X6 1100T under AMD-V I'm not getting good X86_EFL_RF results. Enable this to get on with other work. */
328	fExtraEfl = pTrapCtx->Ctx.rflags.u32 & X86_EFL_RF;
329	#endif
330	Bs3TestCheckRegCtxEx(&pTrapCtx->Ctx, pStartCtx, 0 /cbIpAdjust/, 0 /cbSpAdjust/, fExtraEfl, g_pszTestMode, g_usBs3TestStep);
331	if (Bs3TestSubErrorCount() != cErrorsBefore)
332	{
333	Bs3TrapPrintFrame(pTrapCtx);
334	#if 1
335	Bs3TestPrintf("Halting: g_uBs3CpuDetected=%#x\n", g_uBs3CpuDetected);
336	Bs3TestPrintf("Halting: bXcpt=%#x uErrCd=%#x\n", bXcpt, uErrCd);
337	ASMHalt();
338	#endif
339	}
340	}
341
342
343	/**
344	* Compares \#GP trap.
345	*/
346	# define bs3CpuBasic2_CompareGpCtx BS3_CMN_NM(bs3CpuBasic2_CompareGpCtx)
347	BS3_DECL_NEAR(void) bs3CpuBasic2_CompareGpCtx(PCBS3TRAPFRAME pTrapCtx, PCBS3REGCTX pStartCtx, uint16_t uErrCd)
348	{
349	bs3CpuBasic2_CompareCpuTrapCtx(pTrapCtx, pStartCtx, uErrCd, X86_XCPT_GP, true /f486ResumeFlagHint/);
350	}
351
352	/**
353	* Compares \#NP trap.
354	*/
355	# define bs3CpuBasic2_CompareNpCtx BS3_CMN_NM(bs3CpuBasic2_CompareNpCtx)
356	BS3_DECL_NEAR(void) bs3CpuBasic2_CompareNpCtx(PCBS3TRAPFRAME pTrapCtx, PCBS3REGCTX pStartCtx, uint16_t uErrCd)
357	{
358	bs3CpuBasic2_CompareCpuTrapCtx(pTrapCtx, pStartCtx, uErrCd, X86_XCPT_NP, true /f486ResumeFlagHint/);
359	}
360
361	/**
362	* Compares \#SS trap.
363	*/
364	# define bs3CpuBasic2_CompareSsCtx BS3_CMN_NM(bs3CpuBasic2_CompareSsCtx)
365	BS3_DECL_NEAR(void) bs3CpuBasic2_CompareSsCtx(PCBS3TRAPFRAME pTrapCtx, PCBS3REGCTX pStartCtx, uint16_t uErrCd, bool f486ResumeFlagHint)
366	{
367	bs3CpuBasic2_CompareCpuTrapCtx(pTrapCtx, pStartCtx, uErrCd, X86_XCPT_SS, f486ResumeFlagHint);
368	}
369
370	/**
371	* Compares \#TS trap.
372	*/
373	# define bs3CpuBasic2_CompareTsCtx BS3_CMN_NM(bs3CpuBasic2_CompareTsCtx)
374	BS3_DECL_NEAR(void) bs3CpuBasic2_CompareTsCtx(PCBS3TRAPFRAME pTrapCtx, PCBS3REGCTX pStartCtx, uint16_t uErrCd)
375	{
376	bs3CpuBasic2_CompareCpuTrapCtx(pTrapCtx, pStartCtx, uErrCd, X86_XCPT_TS, false /f486ResumeFlagHint/);
377	}
378
379	/**
380	* Compares \#PF trap.
381	*/
382	# define bs3CpuBasic2_ComparePfCtx BS3_CMN_NM(bs3CpuBasic2_ComparePfCtx)
383	BS3_DECL_NEAR(void) bs3CpuBasic2_ComparePfCtx(PCBS3TRAPFRAME pTrapCtx, PBS3REGCTX pStartCtx, uint16_t uErrCd, uint64_t uCr2Expected)
384	{
385	uint64_t const uCr2Saved = pStartCtx->cr2.u;
386	pStartCtx->cr2.u = uCr2Expected;
387	bs3CpuBasic2_CompareCpuTrapCtx(pTrapCtx, pStartCtx, uErrCd, X86_XCPT_PF, true /f486ResumeFlagHint/);
388	pStartCtx->cr2.u = uCr2Saved;
389	}
390
391	/**
392	* Compares \#UD trap.
393	*/
394	# define bs3CpuBasic2_CompareUdCtx BS3_CMN_NM(bs3CpuBasic2_CompareUdCtx)
395	BS3_DECL_NEAR(void) bs3CpuBasic2_CompareUdCtx(PCBS3TRAPFRAME pTrapCtx, PCBS3REGCTX pStartCtx)
396	{
397	bs3CpuBasic2_CompareCpuTrapCtx(pTrapCtx, pStartCtx, 0 /no error code/, X86_XCPT_UD, true /f486ResumeFlagHint/);
398	}
399
400
401	# define bs3CpuBasic2_RaiseXcpt1Common BS3_CMN_NM(bs3CpuBasic2_RaiseXcpt1Common)
402	BS3_DECL_NEAR(void) bs3CpuBasic2_RaiseXcpt1Common(uint16_t const uSysR0Cs, uint16_t const uSysR0CsConf, uint16_t const uSysR0Ss,
403	PX86DESC const paIdt, unsigned const cIdteShift)
404	{
405	BS3TRAPFRAME TrapCtx;
406	BS3REGCTX Ctx80;
407	BS3REGCTX Ctx81;
408	BS3REGCTX Ctx82;
409	BS3REGCTX Ctx83;
410	BS3REGCTX CtxTmp;
411	BS3REGCTX CtxTmp2;
412	PBS3REGCTX apCtx8x[4];
413	unsigned iCtx;
414	unsigned iRing;
415	unsigned iDpl;
416	unsigned iRpl;
417	unsigned i, j, k;
418	uint32_t uExpected;
419	bool const f486Plus = (g_uBs3CpuDetected & BS3CPU_TYPE_MASK) >= BS3CPU_80486;
420	# if TMPL_BITS == 16
421	bool const f386Plus = (g_uBs3CpuDetected & BS3CPU_TYPE_MASK) >= BS3CPU_80386;
422	bool const f286 = (g_uBs3CpuDetected & BS3CPU_TYPE_MASK) == BS3CPU_80286;
423	# else
424	bool const f286 = false;
425	bool const f386Plus = true;
426	int rc;
427	uint8_t *pbIdtCopyAlloc;
428	PX86DESC pIdtCopy;
429	const unsigned cbIdte = 1 << (3 + cIdteShift);
430	RTCCUINTXREG uCr0Saved = ASMGetCR0();
431	RTGDTR GdtrSaved;
432	# endif
433	RTIDTR IdtrSaved;
434	RTIDTR Idtr;
435
436	ASMGetIDTR(&IdtrSaved);
437	# if TMPL_BITS != 16
438	ASMGetGDTR(&GdtrSaved);
439	# endif
440
441	/* make sure they're allocated */
442	Bs3MemZero(&TrapCtx, sizeof(TrapCtx));
443	Bs3MemZero(&Ctx80, sizeof(Ctx80));
444	Bs3MemZero(&Ctx81, sizeof(Ctx81));
445	Bs3MemZero(&Ctx82, sizeof(Ctx82));
446	Bs3MemZero(&Ctx83, sizeof(Ctx83));
447	Bs3MemZero(&CtxTmp, sizeof(CtxTmp));
448	Bs3MemZero(&CtxTmp2, sizeof(CtxTmp2));
449
450	/* Context array. */
451	apCtx8x[0] = &Ctx80;
452	apCtx8x[1] = &Ctx81;
453	apCtx8x[2] = &Ctx82;
454	apCtx8x[3] = &Ctx83;
455
456	# if TMPL_BITS != 16
457	/* Allocate memory for playing around with the IDT. */
458	pbIdtCopyAlloc = NULL;
459	if (BS3_MODE_IS_PAGED(g_bTestMode))
460	pbIdtCopyAlloc = Bs3MemAlloc(BS3MEMKIND_FLAT32, 12*_1K);
461	# endif
462
463	/*
464	* IDT entry 80 thru 83 are assigned DPLs according to the number.
465	* (We'll be useing more, but this'll do for now.)
466	*/
467	paIdt[0x80 << cIdteShift].Gate.u2Dpl = 0;
468	paIdt[0x81 << cIdteShift].Gate.u2Dpl = 1;
469	paIdt[0x82 << cIdteShift].Gate.u2Dpl = 2;
470	paIdt[0x83 << cIdteShift].Gate.u2Dpl = 3;
471
472	Bs3RegCtxSave(&Ctx80);
473	Ctx80.rsp.u -= 0x300;
474	Ctx80.rip.u = (uintptr_t)BS3_FP_OFF(&bs3CpuBasic2_Int80);
475	# if TMPL_BITS == 16
476	Ctx80.cs = BS3_MODE_IS_RM_OR_V86(g_bTestMode) ? BS3_SEL_TEXT16 : BS3_SEL_R0_CS16;
477	# elif TMPL_BITS == 32
478	g_uBs3TrapEipHint = Ctx80.rip.u32;
479	# endif
480	Bs3MemCpy(&Ctx81, &Ctx80, sizeof(Ctx80));
481	Ctx81.rip.u = (uintptr_t)BS3_FP_OFF(&bs3CpuBasic2_Int81);
482	Bs3MemCpy(&Ctx82, &Ctx80, sizeof(Ctx80));
483	Ctx82.rip.u = (uintptr_t)BS3_FP_OFF(&bs3CpuBasic2_Int82);
484	Bs3MemCpy(&Ctx83, &Ctx80, sizeof(Ctx80));
485	Ctx83.rip.u = (uintptr_t)BS3_FP_OFF(&bs3CpuBasic2_Int83);
486
487	/*
488	* Check that all the above gates work from ring-0.
489	*/
490	for (iCtx = 0; iCtx < RT_ELEMENTS(apCtx8x); iCtx++)
491	{
492	g_usBs3TestStep = iCtx;
493	# if TMPL_BITS == 32
494	g_uBs3TrapEipHint = apCtx8x[iCtx]->rip.u32;
495	# endif
496	Bs3TrapSetJmpAndRestore(apCtx8x[iCtx], &TrapCtx);
497	bs3CpuBasic2_CompareIntCtx1(&TrapCtx, apCtx8x[iCtx], 0x80+iCtx /bXcpt/);
498	}
499
500	/*
501	* Check that the gate DPL checks works.
502	*/
503	g_usBs3TestStep = 100;
504	for (iRing = 0; iRing <= 3; iRing++)
505	{
506	for (iCtx = 0; iCtx < RT_ELEMENTS(apCtx8x); iCtx++)
507	{
508	Bs3MemCpy(&CtxTmp, apCtx8x[iCtx], sizeof(CtxTmp));
509	Bs3RegCtxConvertToRingX(&CtxTmp, iRing);
510	# if TMPL_BITS == 32
511	g_uBs3TrapEipHint = CtxTmp.rip.u32;
512	# endif
513	Bs3TrapSetJmpAndRestore(&CtxTmp, &TrapCtx);
514	if (iCtx < iRing)
515	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &CtxTmp, ((0x80 + iCtx) << X86_TRAP_ERR_SEL_SHIFT) \| X86_TRAP_ERR_IDT);
516	else
517	bs3CpuBasic2_CompareIntCtx1(&TrapCtx, &CtxTmp, 0x80 + iCtx /bXcpt/);
518	g_usBs3TestStep++;
519	}
520	}
521
522	/*
523	* Modify the gate CS value and run the handler at a different CPL.
524	* Throw RPL variations into the mix (completely ignored) together
525	* with gate presence.
526	* 1. CPL <= GATE.DPL
527	* 2. GATE.P
528	* 3. GATE.CS.DPL <= CPL (non-conforming segments)
529	*/
530	g_usBs3TestStep = 1000;
531	for (i = 0; i <= 3; i++)
532	{
533	for (iRing = 0; iRing <= 3; iRing++)
534	{
535	for (iCtx = 0; iCtx < RT_ELEMENTS(apCtx8x); iCtx++)
536	{
537	# if TMPL_BITS == 32
538	g_uBs3TrapEipHint = apCtx8x[iCtx]->rip.u32;
539	# endif
540	Bs3MemCpy(&CtxTmp, apCtx8x[iCtx], sizeof(CtxTmp));
541	Bs3RegCtxConvertToRingX(&CtxTmp, iRing);
542
543	for (j = 0; j <= 3; j++)
544	{
545	uint16_t const uCs = (uSysR0Cs \| j) + (i << BS3_SEL_RING_SHIFT);
546	for (k = 0; k < 2; k++)
547	{
548	g_usBs3TestStep++;
549	/Bs3TestPrintf("g_usBs3TestStep=%u iCtx=%u iRing=%u i=%u uCs=%04x\n", g_usBs3TestStep, iCtx, iRing, i, uCs);/
550	paIdt[(0x80 + iCtx) << cIdteShift].Gate.u16Sel = uCs;
551	paIdt[(0x80 + iCtx) << cIdteShift].Gate.u1Present = k;
552	Bs3TrapSetJmpAndRestore(&CtxTmp, &TrapCtx);
553	/Bs3TrapPrintFrame(&TrapCtx);/
554	if (iCtx < iRing)
555	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &CtxTmp, ((0x80 + iCtx) << X86_TRAP_ERR_SEL_SHIFT) \| X86_TRAP_ERR_IDT);
556	else if (k == 0)
557	bs3CpuBasic2_CompareNpCtx(&TrapCtx, &CtxTmp, ((0x80 + iCtx) << X86_TRAP_ERR_SEL_SHIFT) \| X86_TRAP_ERR_IDT);
558	else if (i > iRing)
559	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &CtxTmp, uCs & X86_SEL_MASK_OFF_RPL);
560	else
561	{
562	uint16_t uExpectedCs = uCs & X86_SEL_MASK_OFF_RPL;
563	if (i <= iCtx && i <= iRing)
564	uExpectedCs \|= i;
565	bs3CpuBasic2_CompareTrapCtx2(&TrapCtx, &CtxTmp, 2 /int 8xh/, 0x80 + iCtx /bXcpt/, uExpectedCs);
566	}
567	}
568	}
569
570	paIdt[(0x80 + iCtx) << cIdteShift].Gate.u16Sel = uSysR0Cs;
571	paIdt[(0x80 + iCtx) << cIdteShift].Gate.u1Present = 1;
572	}
573	}
574	}
575	BS3_ASSERT(g_usBs3TestStep < 1600);
576
577	/*
578	* Various CS and SS related faults
579	*
580	* We temporarily reconfigure gate 80 and 83 with new CS selectors, the
581	* latter have a CS.DPL of 2 for testing ring transisions and SS loading
582	* without making it impossible to handle faults.
583	*/
584	g_usBs3TestStep = 1600;
585	Bs3GdteTestPage00 = Bs3Gdt[uSysR0Cs >> X86_SEL_SHIFT];
586	Bs3GdteTestPage00.Gen.u1Present = 0;
587	Bs3GdteTestPage00.Gen.u4Type &= ~X86_SEL_TYPE_ACCESSED;
588	paIdt[0x80 << cIdteShift].Gate.u16Sel = BS3_SEL_TEST_PAGE_00;
589
590	/* CS.PRESENT = 0 */
591	Bs3TrapSetJmpAndRestore(&Ctx80, &TrapCtx);
592	bs3CpuBasic2_CompareNpCtx(&TrapCtx, &Ctx80, BS3_SEL_TEST_PAGE_00);
593	if (Bs3GdteTestPage00.Gen.u4Type & X86_SEL_TYPE_ACCESSED)
594	bs3CpuBasic2_FailedF("selector was accessed");
595	g_usBs3TestStep++;
596
597	/* Check that GATE.DPL is checked before CS.PRESENT. */
598	for (iRing = 1; iRing < 4; iRing++)
599	{
600	Bs3MemCpy(&CtxTmp, &Ctx80, sizeof(CtxTmp));
601	Bs3RegCtxConvertToRingX(&CtxTmp, iRing);
602	Bs3TrapSetJmpAndRestore(&CtxTmp, &TrapCtx);
603	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &CtxTmp, (0x80 << X86_TRAP_ERR_SEL_SHIFT) \| X86_TRAP_ERR_IDT);
604	if (Bs3GdteTestPage00.Gen.u4Type & X86_SEL_TYPE_ACCESSED)
605	bs3CpuBasic2_FailedF("selector was accessed");
606	g_usBs3TestStep++;
607	}
608
609	/* CS.DPL mismatch takes precedence over CS.PRESENT = 0. */
610	Bs3GdteTestPage00.Gen.u4Type &= ~X86_SEL_TYPE_ACCESSED;
611	Bs3TrapSetJmpAndRestore(&Ctx80, &TrapCtx);
612	bs3CpuBasic2_CompareNpCtx(&TrapCtx, &Ctx80, BS3_SEL_TEST_PAGE_00);
613	if (Bs3GdteTestPage00.Gen.u4Type & X86_SEL_TYPE_ACCESSED)
614	bs3CpuBasic2_FailedF("CS selector was accessed");
615	g_usBs3TestStep++;
616	for (iDpl = 1; iDpl < 4; iDpl++)
617	{
618	Bs3GdteTestPage00.Gen.u2Dpl = iDpl;
619	Bs3TrapSetJmpAndRestore(&Ctx80, &TrapCtx);
620	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &Ctx80, BS3_SEL_TEST_PAGE_00);
621	if (Bs3GdteTestPage00.Gen.u4Type & X86_SEL_TYPE_ACCESSED)
622	bs3CpuBasic2_FailedF("CS selector was accessed");
623	g_usBs3TestStep++;
624	}
625
626	/* 1608: Check all the invalid CS selector types alone. */
627	Bs3GdteTestPage00 = Bs3Gdt[uSysR0Cs >> X86_SEL_SHIFT];
628	for (i = 0; i < RT_ELEMENTS(g_aInvalidCsTypes); i++)
629	{
630	Bs3GdteTestPage00.Gen.u4Type = g_aInvalidCsTypes[i].u4Type;
631	Bs3GdteTestPage00.Gen.u1DescType = g_aInvalidCsTypes[i].u1DescType;
632	Bs3TrapSetJmpAndRestore(&Ctx80, &TrapCtx);
633	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &Ctx80, BS3_SEL_TEST_PAGE_00);
634	if (Bs3GdteTestPage00.Gen.u4Type != g_aInvalidCsTypes[i].u4Type)
635	bs3CpuBasic2_FailedF("Invalid CS type %#x/%u -> %#x/%u\n",
636	g_aInvalidCsTypes[i].u4Type, g_aInvalidCsTypes[i].u1DescType,
637	Bs3GdteTestPage00.Gen.u4Type, Bs3GdteTestPage00.Gen.u1DescType);
638	g_usBs3TestStep++;
639
640	/* Incorrect CS.TYPE takes precedence over CS.PRESENT = 0. */
641	Bs3GdteTestPage00.Gen.u1Present = 0;
642	Bs3TrapSetJmpAndRestore(&Ctx80, &TrapCtx);
643	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &Ctx80, BS3_SEL_TEST_PAGE_00);
644	Bs3GdteTestPage00.Gen.u1Present = 1;
645	g_usBs3TestStep++;
646	}
647
648	/* Fix CS again. */
649	Bs3GdteTestPage00 = Bs3Gdt[uSysR0Cs >> X86_SEL_SHIFT];
650
651	/* 1632: Test SS. */
652	if (!BS3_MODE_IS_64BIT_SYS(g_bTestMode))
653	{
654	uint16_t BS3_FAR *puTssSs2 = BS3_MODE_IS_16BIT_SYS(g_bTestMode) ? &Bs3Tss16.ss2 : &Bs3Tss32.ss2;
655	uint16_t const uSavedSs2 = *puTssSs2;
656	X86DESC const SavedGate83 = paIdt[0x83 << cIdteShift];
657
658	/* Make the handler execute in ring-2. */
659	Bs3GdteTestPage02 = Bs3Gdt[(uSysR0Cs + (2 << BS3_SEL_RING_SHIFT)) >> X86_SEL_SHIFT];
660	Bs3GdteTestPage02.Gen.u4Type &= ~X86_SEL_TYPE_ACCESSED;
661	paIdt[0x83 << cIdteShift].Gate.u16Sel = BS3_SEL_TEST_PAGE_02 \| 2;
662
663	Bs3MemCpy(&CtxTmp, &Ctx83, sizeof(CtxTmp));
664	Bs3RegCtxConvertToRingX(&CtxTmp, 3); /* yeah, from 3 so SS:xSP is reloaded. */
665	Bs3TrapSetJmpAndRestore(&CtxTmp, &TrapCtx);
666	bs3CpuBasic2_CompareIntCtx1(&TrapCtx, &CtxTmp, 0x83);
667	if (!(Bs3GdteTestPage02.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
668	bs3CpuBasic2_FailedF("CS selector was not access");
669	g_usBs3TestStep++;
670
671	/* Create a SS.DPL=2 stack segment and check that SS2.RPL matters and
672	that we get #SS if the selector isn't present. */
673	i = 0; /* used for cycling thru invalid CS types */
674	for (k = 0; k < 10; k++)
675	{
676	/* k=0: present,
677	k=1: not-present,
678	k=2: present but very low limit,
679	k=3: not-present, low limit.
680	k=4: present, read-only.
681	k=5: not-present, read-only.
682	k=6: present, code-selector.
683	k=7: not-present, code-selector.
684	k=8: present, read-write / no access + system (=LDT).
685	k=9: not-present, read-write / no access + system (=LDT).
686	*/
687	Bs3GdteTestPage03 = Bs3Gdt[(uSysR0Ss + (2 << BS3_SEL_RING_SHIFT)) >> X86_SEL_SHIFT];
688	Bs3GdteTestPage03.Gen.u1Present = !(k & 1);
689	if (k >= 8)
690	{
691	Bs3GdteTestPage03.Gen.u1DescType = 0; /* system */
692	Bs3GdteTestPage03.Gen.u4Type = X86_SEL_TYPE_RW; /* = LDT */
693	}
694	else if (k >= 6)
695	Bs3GdteTestPage03.Gen.u4Type = X86_SEL_TYPE_ER;
696	else if (k >= 4)
697	Bs3GdteTestPage03.Gen.u4Type = X86_SEL_TYPE_RO;
698	else if (k >= 2)
699	{
700	Bs3GdteTestPage03.Gen.u16LimitLow = 0x400;
701	Bs3GdteTestPage03.Gen.u4LimitHigh = 0;
702	Bs3GdteTestPage03.Gen.u1Granularity = 0;
703	}
704
705	for (iDpl = 0; iDpl < 4; iDpl++)
706	{
707	Bs3GdteTestPage03.Gen.u2Dpl = iDpl;
708
709	for (iRpl = 0; iRpl < 4; iRpl++)
710	{
711	*puTssSs2 = BS3_SEL_TEST_PAGE_03 \| iRpl;
712	//Bs3TestPrintf("k=%u iDpl=%u iRpl=%u step=%u\n", k, iDpl, iRpl, g_usBs3TestStep);
713	Bs3GdteTestPage02.Gen.u4Type &= ~X86_SEL_TYPE_ACCESSED;
714	Bs3GdteTestPage03.Gen.u4Type &= ~X86_SEL_TYPE_ACCESSED;
715	Bs3TrapSetJmpAndRestore(&CtxTmp, &TrapCtx);
716	if (iRpl != 2 \|\| iRpl != iDpl \|\| k >= 4)
717	bs3CpuBasic2_CompareTsCtx(&TrapCtx, &CtxTmp, BS3_SEL_TEST_PAGE_03);
718	else if (k != 0)
719	bs3CpuBasic2_CompareSsCtx(&TrapCtx, &CtxTmp, BS3_SEL_TEST_PAGE_03,
720	k == 2 /f486ResumeFlagHint/);
721	else
722	{
723	bs3CpuBasic2_CompareIntCtx1(&TrapCtx, &CtxTmp, 0x83);
724	if (TrapCtx.uHandlerSs != (BS3_SEL_TEST_PAGE_03 \| 2))
725	bs3CpuBasic2_FailedF("uHandlerSs=%#x expected %#x\n", TrapCtx.uHandlerSs, BS3_SEL_TEST_PAGE_03 \| 2);
726	}
727	if (!(Bs3GdteTestPage02.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
728	bs3CpuBasic2_FailedF("CS selector was not access");
729	if ( TrapCtx.bXcpt == 0x83
730	\|\| (TrapCtx.bXcpt == X86_XCPT_SS && k == 2) )
731	{
732	if (!(Bs3GdteTestPage03.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
733	bs3CpuBasic2_FailedF("SS selector was not accessed");
734	}
735	else if (Bs3GdteTestPage03.Gen.u4Type & X86_SEL_TYPE_ACCESSED)
736	bs3CpuBasic2_FailedF("SS selector was accessed");
737	g_usBs3TestStep++;
738
739	/* +1: Modify the gate DPL to check that this is checked before SS.DPL and SS.PRESENT. */
740	paIdt[0x83 << cIdteShift].Gate.u2Dpl = 2;
741	Bs3TrapSetJmpAndRestore(&CtxTmp, &TrapCtx);
742	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &CtxTmp, (0x83 << X86_TRAP_ERR_SEL_SHIFT) \| X86_TRAP_ERR_IDT);
743	paIdt[0x83 << cIdteShift].Gate.u2Dpl = 3;
744	g_usBs3TestStep++;
745
746	/* +2: Check the the CS.DPL check is done before the SS ones. Restoring the
747	ring-0 INT 83 context triggers the CS.DPL < CPL check. */
748	Bs3TrapSetJmpAndRestore(&Ctx83, &TrapCtx);
749	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &Ctx83, BS3_SEL_TEST_PAGE_02);
750	g_usBs3TestStep++;
751
752	/* +3: Now mark the CS selector not present and check that that also triggers before SS stuff. */
753	Bs3GdteTestPage02.Gen.u1Present = 0;
754	Bs3TrapSetJmpAndRestore(&CtxTmp, &TrapCtx);
755	bs3CpuBasic2_CompareNpCtx(&TrapCtx, &CtxTmp, BS3_SEL_TEST_PAGE_02);
756	Bs3GdteTestPage02.Gen.u1Present = 1;
757	g_usBs3TestStep++;
758
759	/* +4: Make the CS selector some invalid type and check it triggers before SS stuff. */
760	Bs3GdteTestPage02.Gen.u4Type = g_aInvalidCsTypes[i].u4Type;
761	Bs3GdteTestPage02.Gen.u1DescType = g_aInvalidCsTypes[i].u1DescType;
762	Bs3TrapSetJmpAndRestore(&CtxTmp, &TrapCtx);
763	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &CtxTmp, BS3_SEL_TEST_PAGE_02);
764	Bs3GdteTestPage02.Gen.u4Type = X86_SEL_TYPE_ER_ACC;
765	Bs3GdteTestPage02.Gen.u1DescType = 1;
766	g_usBs3TestStep++;
767
768	/* +5: Now, make the CS selector limit too small and that it triggers after SS trouble.
769	The 286 had a simpler approach to these GP(0). */
770	Bs3GdteTestPage02.Gen.u16LimitLow = 0;
771	Bs3GdteTestPage02.Gen.u4LimitHigh = 0;
772	Bs3GdteTestPage02.Gen.u1Granularity = 0;
773	Bs3TrapSetJmpAndRestore(&CtxTmp, &TrapCtx);
774	if (f286)
775	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &CtxTmp, 0 /uErrCd/);
776	else if (iRpl != 2 \|\| iRpl != iDpl \|\| k >= 4)
777	bs3CpuBasic2_CompareTsCtx(&TrapCtx, &CtxTmp, BS3_SEL_TEST_PAGE_03);
778	else if (k != 0)
779	bs3CpuBasic2_CompareSsCtx(&TrapCtx, &CtxTmp, BS3_SEL_TEST_PAGE_03, k == 2 /f486ResumeFlagHint/);
780	else
781	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &CtxTmp, 0 /uErrCd/);
782	Bs3GdteTestPage02 = Bs3Gdt[(uSysR0Cs + (2 << BS3_SEL_RING_SHIFT)) >> X86_SEL_SHIFT];
783	g_usBs3TestStep++;
784	}
785	}
786	}
787
788	/* Check all the invalid SS selector types alone. */
789	Bs3GdteTestPage02 = Bs3Gdt[(uSysR0Cs + (2 << BS3_SEL_RING_SHIFT)) >> X86_SEL_SHIFT];
790	Bs3GdteTestPage03 = Bs3Gdt[(uSysR0Ss + (2 << BS3_SEL_RING_SHIFT)) >> X86_SEL_SHIFT];
791	*puTssSs2 = BS3_SEL_TEST_PAGE_03 \| 2;
792	Bs3TrapSetJmpAndRestore(&CtxTmp, &TrapCtx);
793	bs3CpuBasic2_CompareIntCtx1(&TrapCtx, &CtxTmp, 0x83);
794	g_usBs3TestStep++;
795	for (i = 0; i < RT_ELEMENTS(g_aInvalidSsTypes); i++)
796	{
797	Bs3GdteTestPage03.Gen.u4Type = g_aInvalidSsTypes[i].u4Type;
798	Bs3GdteTestPage03.Gen.u1DescType = g_aInvalidSsTypes[i].u1DescType;
799	Bs3TrapSetJmpAndRestore(&CtxTmp, &TrapCtx);
800	bs3CpuBasic2_CompareTsCtx(&TrapCtx, &CtxTmp, BS3_SEL_TEST_PAGE_03);
801	if (Bs3GdteTestPage03.Gen.u4Type != g_aInvalidSsTypes[i].u4Type)
802	bs3CpuBasic2_FailedF("Invalid SS type %#x/%u -> %#x/%u\n",
803	g_aInvalidSsTypes[i].u4Type, g_aInvalidSsTypes[i].u1DescType,
804	Bs3GdteTestPage03.Gen.u4Type, Bs3GdteTestPage03.Gen.u1DescType);
805	g_usBs3TestStep++;
806	}
807
808	/*
809	* Continue the SS experiments with a expand down segment. We'll use
810	* the same setup as we already have with gate 83h being DPL and
811	* having CS.DPL=2.
812	*
813	* Expand down segments are weird. The valid area is practically speaking
814	* reversed. So, a 16-bit segment with a limit of 0x6000 will have valid
815	* addresses from 0xffff thru 0x6001.
816	*
817	* So, with expand down segments we can more easily cut partially into the
818	* pushing of the iret frame and trigger more interesting behavior than
819	* with regular "expand up" segments where the whole pushing area is either
820	* all fine or not not fine.
821	*/
822	Bs3GdteTestPage02 = Bs3Gdt[(uSysR0Cs + (2 << BS3_SEL_RING_SHIFT)) >> X86_SEL_SHIFT];
823	Bs3GdteTestPage03 = Bs3Gdt[(uSysR0Ss + (2 << BS3_SEL_RING_SHIFT)) >> X86_SEL_SHIFT];
824	Bs3GdteTestPage03.Gen.u2Dpl = 2;
825	Bs3GdteTestPage03.Gen.u4Type = X86_SEL_TYPE_RW_DOWN;
826	*puTssSs2 = BS3_SEL_TEST_PAGE_03 \| 2;
827
828	/* First test, limit = max --> no bytes accessible --> #GP */
829	Bs3TrapSetJmpAndRestore(&CtxTmp, &TrapCtx);
830	bs3CpuBasic2_CompareSsCtx(&TrapCtx, &CtxTmp, BS3_SEL_TEST_PAGE_03, true /f486ResumeFlagHint/);
831
832	/* Second test, limit = 0 --> all by zero byte accessible --> works */
833	Bs3GdteTestPage03.Gen.u16LimitLow = 0;
834	Bs3GdteTestPage03.Gen.u4LimitHigh = 0;
835	Bs3TrapSetJmpAndRestore(&CtxTmp, &TrapCtx);
836	bs3CpuBasic2_CompareIntCtx1(&TrapCtx, &CtxTmp, 0x83);
837
838	/* Modify the gate handler to be a dummy that immediately does UD2
839	and triggers #UD, then advance the limit down till we get the #UD. */
840	Bs3GdteTestPage03.Gen.u1Granularity = 0;
841
842	Bs3MemCpy(&CtxTmp2, &CtxTmp, sizeof(CtxTmp2)); /* #UD result context */
843	if (g_f16BitSys)
844	{
845	CtxTmp2.rip.u = g_bs3CpuBasic2_ud2_FlatAddr - BS3_ADDR_BS3TEXT16;
846	Bs3Trap16SetGate(0x83, X86_SEL_TYPE_SYS_286_INT_GATE, 3, BS3_SEL_TEST_PAGE_02, CtxTmp2.rip.u16, 0 /cParams/);
847	CtxTmp2.rsp.u = Bs3Tss16.sp2 - 2*5;
848	}
849	else
850	{
851	CtxTmp2.rip.u = g_bs3CpuBasic2_ud2_FlatAddr;
852	Bs3Trap32SetGate(0x83, X86_SEL_TYPE_SYS_386_INT_GATE, 3, BS3_SEL_TEST_PAGE_02, CtxTmp2.rip.u32, 0 /cParams/);
853	CtxTmp2.rsp.u = Bs3Tss32.esp2 - 4*5;
854	}
855	CtxTmp2.bMode = g_bTestMode; /* g_bBs3CurrentMode not changed by the UD2 handler. */
856	CtxTmp2.cs = BS3_SEL_TEST_PAGE_02 \| 2;
857	CtxTmp2.ss = BS3_SEL_TEST_PAGE_03 \| 2;
858	CtxTmp2.bCpl = 2;
859
860	/* test run. */
861	Bs3TrapSetJmpAndRestore(&CtxTmp, &TrapCtx);
862	bs3CpuBasic2_CompareUdCtx(&TrapCtx, &CtxTmp2);
863	g_usBs3TestStep++;
864
865	/* Real run. */
866	i = (g_f16BitSys ? 2 : 4) * 6 + 1;
867	while (i-- > 0)
868	{
869	Bs3GdteTestPage03.Gen.u16LimitLow = CtxTmp2.rsp.u16 + i - 1;
870	Bs3TrapSetJmpAndRestore(&CtxTmp, &TrapCtx);
871	if (i > 0)
872	bs3CpuBasic2_CompareSsCtx(&TrapCtx, &CtxTmp, BS3_SEL_TEST_PAGE_03, true /f486ResumeFlagHint/);
873	else
874	bs3CpuBasic2_CompareUdCtx(&TrapCtx, &CtxTmp2);
875	g_usBs3TestStep++;
876	}
877
878	/* Do a run where we do the same-ring kind of access. */
879	Bs3RegCtxConvertToRingX(&CtxTmp, 2);
880	if (g_f16BitSys)
881	{
882	CtxTmp2.rsp.u32 = CtxTmp.rsp.u32 - 2*3;
883	i = 2*3 - 1;
884	}
885	else
886	{
887	CtxTmp2.rsp.u32 = CtxTmp.rsp.u32 - 4*3;
888	i = 4*3 - 1;
889	}
890	CtxTmp.ss = BS3_SEL_TEST_PAGE_03 \| 2;
891	CtxTmp2.ds = CtxTmp.ds;
892	CtxTmp2.es = CtxTmp.es;
893	CtxTmp2.fs = CtxTmp.fs;
894	CtxTmp2.gs = CtxTmp.gs;
895	while (i-- > 0)
896	{
897	Bs3GdteTestPage03.Gen.u16LimitLow = CtxTmp2.rsp.u16 + i - 1;
898	Bs3TrapSetJmpAndRestore(&CtxTmp, &TrapCtx);
899	if (i > 0)
900	bs3CpuBasic2_CompareSsCtx(&TrapCtx, &CtxTmp, 0 /BS3_SEL_TEST_PAGE_03/, true /f486ResumeFlagHint/);
901	else
902	bs3CpuBasic2_CompareUdCtx(&TrapCtx, &CtxTmp2);
903	g_usBs3TestStep++;
904	}
905
906	*puTssSs2 = uSavedSs2;
907	paIdt[0x83 << cIdteShift] = SavedGate83;
908	}
909	paIdt[0x80 << cIdteShift].Gate.u16Sel = uSysR0Cs;
910	BS3_ASSERT(g_usBs3TestStep < 3000);
911
912	/*
913	* Modify the gate CS value with a conforming segment.
914	*/
915	g_usBs3TestStep = 3000;
916	for (i = 0; i <= 3; i++) /* cs.dpl */
917	{
918	for (iRing = 0; iRing <= 3; iRing++)
919	{
920	for (iCtx = 0; iCtx < RT_ELEMENTS(apCtx8x); iCtx++)
921	{
922	Bs3MemCpy(&CtxTmp, apCtx8x[iCtx], sizeof(CtxTmp));
923	Bs3RegCtxConvertToRingX(&CtxTmp, iRing);
924	# if TMPL_BITS == 32
925	g_uBs3TrapEipHint = CtxTmp.rip.u32;
926	# endif
927
928	for (j = 0; j <= 3; j++) /* rpl */
929	{
930	uint16_t const uCs = (uSysR0CsConf \| j) + (i << BS3_SEL_RING_SHIFT);
931	/Bs3TestPrintf("g_usBs3TestStep=%u iCtx=%u iRing=%u i=%u uCs=%04x\n", g_usBs3TestStep, iCtx, iRing, i, uCs);/
932	paIdt[(0x80 + iCtx) << cIdteShift].Gate.u16Sel = uCs;
933	Bs3TrapSetJmpAndRestore(&CtxTmp, &TrapCtx);
934	//Bs3TestPrintf("%u/%u/%u/%u: cs=%04x hcs=%04x xcpt=%02x\n", i, iRing, iCtx, j, uCs, TrapCtx.uHandlerCs, TrapCtx.bXcpt);
935	/Bs3TrapPrintFrame(&TrapCtx);/
936	g_usBs3TestStep++;
937	if (iCtx < iRing)
938	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &CtxTmp, ((0x80 + iCtx) << X86_TRAP_ERR_SEL_SHIFT) \| X86_TRAP_ERR_IDT);
939	else if (i > iRing)
940	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &CtxTmp, uCs & X86_SEL_MASK_OFF_RPL);
941	else
942	bs3CpuBasic2_CompareIntCtx1(&TrapCtx, &CtxTmp, 0x80 + iCtx /bXcpt/);
943	}
944	paIdt[(0x80 + iCtx) << cIdteShift].Gate.u16Sel = uSysR0Cs;
945	}
946	}
947	}
948	BS3_ASSERT(g_usBs3TestStep < 3500);
949
950	/*
951	* The gates must be 64-bit in long mode.
952	*/
953	if (cIdteShift != 0)
954	{
955	g_usBs3TestStep = 3500;
956	for (i = 0; i <= 3; i++)
957	{
958	for (iRing = 0; iRing <= 3; iRing++)
959	{
960	for (iCtx = 0; iCtx < RT_ELEMENTS(apCtx8x); iCtx++)
961	{
962	Bs3MemCpy(&CtxTmp, apCtx8x[iCtx], sizeof(CtxTmp));
963	Bs3RegCtxConvertToRingX(&CtxTmp, iRing);
964
965	for (j = 0; j < 2; j++)
966	{
967	static const uint16_t s_auCSes[2] = { BS3_SEL_R0_CS16, BS3_SEL_R0_CS32 };
968	uint16_t uCs = (s_auCSes[j] \| i) + (i << BS3_SEL_RING_SHIFT);
969	g_usBs3TestStep++;
970	/Bs3TestPrintf("g_usBs3TestStep=%u iCtx=%u iRing=%u i=%u uCs=%04x\n", g_usBs3TestStep, iCtx, iRing, i, uCs);/
971	paIdt[(0x80 + iCtx) << cIdteShift].Gate.u16Sel = uCs;
972	Bs3TrapSetJmpAndRestore(&CtxTmp, &TrapCtx);
973	/Bs3TrapPrintFrame(&TrapCtx);/
974	if (iCtx < iRing)
975	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &CtxTmp, ((0x80 + iCtx) << X86_TRAP_ERR_SEL_SHIFT) \| X86_TRAP_ERR_IDT);
976	else
977	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &CtxTmp, uCs & X86_SEL_MASK_OFF_RPL);
978	}
979	paIdt[(0x80 + iCtx) << cIdteShift].Gate.u16Sel = uSysR0Cs;
980	}
981	}
982	}
983	BS3_ASSERT(g_usBs3TestStep < 4000);
984	}
985
986	/*
987	* IDT limit check. The 286 does not access X86DESCGATE::u16OffsetHigh.
988	*/
989	g_usBs3TestStep = 5000;
990	i = (0x80 << (cIdteShift + 3)) - 1;
991	j = (0x82 << (cIdteShift + 3)) - (!f286 ? 1 : 3);
992	k = (0x83 << (cIdteShift + 3)) - 1;
993	for (; i <= k; i++, g_usBs3TestStep++)
994	{
995	Idtr = IdtrSaved;
996	Idtr.cbIdt = i;
997	ASMSetIDTR(&Idtr);
998	Bs3TrapSetJmpAndRestore(&Ctx81, &TrapCtx);
999	if (i < j)
1000	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &Ctx81, (0x81 << X86_TRAP_ERR_SEL_SHIFT) \| X86_TRAP_ERR_IDT);
1001	else
1002	bs3CpuBasic2_CompareIntCtx1(&TrapCtx, &Ctx81, 0x81 /bXcpt/);
1003	}
1004	ASMSetIDTR(&IdtrSaved);
1005	BS3_ASSERT(g_usBs3TestStep < 5100);
1006
1007	# if TMPL_BITS != 16 /* Only do the paging related stuff in 32-bit and 64-bit modes. */
1008
1009	/*
1010	* IDT page not present. Placing the IDT copy such that 0x80 is on the
1011	* first page and 0x81 is on the second page. We need proceed to move
1012	* it down byte by byte to check that any inaccessible byte means #PF.
1013	*
1014	* Note! We must reload the alternative IDTR for each run as any kind of
1015	* printing to the string (like error reporting) will cause a switch
1016	* to real mode and back, reloading the default IDTR.
1017	*/
1018	g_usBs3TestStep = 5200;
1019	if (BS3_MODE_IS_PAGED(g_bTestMode) && pbIdtCopyAlloc)
1020	{
1021	uint32_t const uCr2Expected = Bs3SelPtrToFlat(pbIdtCopyAlloc) + _4K;
1022	for (j = 0; j < cbIdte; j++)
1023	{
1024	pIdtCopy = (PX86DESC)&pbIdtCopyAlloc[_4K - cbIdte * 0x81 - j];
1025	Bs3MemCpy(pIdtCopy, paIdt, cbIdte * 256);
1026
1027	Idtr.cbIdt = IdtrSaved.cbIdt;
1028	Idtr.pIdt = Bs3SelPtrToFlat(pIdtCopy);
1029
1030	ASMSetIDTR(&Idtr);
1031	Bs3TrapSetJmpAndRestore(&Ctx81, &TrapCtx);
1032	bs3CpuBasic2_CompareIntCtx1(&TrapCtx, &Ctx81, 0x81 /bXcpt/);
1033	g_usBs3TestStep++;
1034
1035	ASMSetIDTR(&Idtr);
1036	Bs3TrapSetJmpAndRestore(&Ctx80, &TrapCtx);
1037	bs3CpuBasic2_CompareIntCtx1(&TrapCtx, &Ctx80, 0x80 /bXcpt/);
1038	g_usBs3TestStep++;
1039
1040	rc = Bs3PagingProtect(uCr2Expected, _4K, 0 /fSet/, X86_PTE_P /fClear/);
1041	if (RT_SUCCESS(rc))
1042	{
1043	ASMSetIDTR(&Idtr);
1044	Bs3TrapSetJmpAndRestore(&Ctx80, &TrapCtx);
1045	bs3CpuBasic2_CompareIntCtx1(&TrapCtx, &Ctx80, 0x80 /bXcpt/);
1046	g_usBs3TestStep++;
1047
1048	ASMSetIDTR(&Idtr);
1049	Bs3TrapSetJmpAndRestore(&Ctx81, &TrapCtx);
1050	if (f486Plus)
1051	bs3CpuBasic2_ComparePfCtx(&TrapCtx, &Ctx81, 0 /uErrCd/, uCr2Expected);
1052	else
1053	bs3CpuBasic2_ComparePfCtx(&TrapCtx, &Ctx81, X86_TRAP_PF_RW /uErrCd/, uCr2Expected + 4 - RT_MIN(j, 4));
1054	g_usBs3TestStep++;
1055
1056	Bs3PagingProtect(uCr2Expected, _4K, X86_PTE_P /fSet/, 0 /fClear/);
1057
1058	/* Check if that the entry type is checked after the whole IDTE has been cleared for #PF. */
1059	pIdtCopy[0x80 << cIdteShift].Gate.u4Type = 0;
1060	rc = Bs3PagingProtect(uCr2Expected, _4K, 0 /fSet/, X86_PTE_P /fClear/);
1061	if (RT_SUCCESS(rc))
1062	{
1063	ASMSetIDTR(&Idtr);
1064	Bs3TrapSetJmpAndRestore(&Ctx81, &TrapCtx);
1065	if (f486Plus)
1066	bs3CpuBasic2_ComparePfCtx(&TrapCtx, &Ctx81, 0 /uErrCd/, uCr2Expected);
1067	else
1068	bs3CpuBasic2_ComparePfCtx(&TrapCtx, &Ctx81, X86_TRAP_PF_RW /uErrCd/, uCr2Expected + 4 - RT_MIN(j, 4));
1069	g_usBs3TestStep++;
1070
1071	Bs3PagingProtect(uCr2Expected, _4K, X86_PTE_P /fSet/, 0 /fClear/);
1072	}
1073	}
1074	else
1075	Bs3TestPrintf("Bs3PagingProtectPtr: %d\n", i);
1076
1077	ASMSetIDTR(&IdtrSaved);
1078	}
1079	}
1080
1081	/*
1082	* The read/write and user/supervisor bits the IDT PTEs are irrelevant.
1083	*/
1084	g_usBs3TestStep = 5300;
1085	if (BS3_MODE_IS_PAGED(g_bTestMode) && pbIdtCopyAlloc)
1086	{
1087	Bs3MemCpy(pbIdtCopyAlloc, paIdt, cbIdte * 256);
1088	Idtr.cbIdt = IdtrSaved.cbIdt;
1089	Idtr.pIdt = Bs3SelPtrToFlat(pbIdtCopyAlloc);
1090
1091	ASMSetIDTR(&Idtr);
1092	Bs3TrapSetJmpAndRestore(&Ctx81, &TrapCtx);
1093	bs3CpuBasic2_CompareIntCtx1(&TrapCtx, &Ctx81, 0x81 /bXcpt/);
1094	g_usBs3TestStep++;
1095
1096	rc = Bs3PagingProtect(Idtr.pIdt, _4K, 0 /fSet/, X86_PTE_RW \| X86_PTE_US /fClear/);
1097	if (RT_SUCCESS(rc))
1098	{
1099	ASMSetIDTR(&Idtr);
1100	Bs3TrapSetJmpAndRestore(&Ctx81, &TrapCtx);
1101	bs3CpuBasic2_CompareIntCtx1(&TrapCtx, &Ctx81, 0x81 /bXcpt/);
1102	g_usBs3TestStep++;
1103
1104	Bs3PagingProtect(Idtr.pIdt, _4K, X86_PTE_RW \| X86_PTE_US /fSet/, 0 /fClear/);
1105	}
1106	ASMSetIDTR(&IdtrSaved);
1107	}
1108
1109	/*
1110	* Check that CS.u1Accessed is set to 1. Use the test page selector #0 and #3 together
1111	* with interrupt gates 80h and 83h, respectively.
1112	*/
1113	/** @todo Throw in SS.u1Accessed too. */
1114	g_usBs3TestStep = 5400;
1115	if (BS3_MODE_IS_PAGED(g_bTestMode) && pbIdtCopyAlloc)
1116	{
1117	Bs3GdteTestPage00 = Bs3Gdt[uSysR0Cs >> X86_SEL_SHIFT];
1118	Bs3GdteTestPage00.Gen.u4Type &= ~X86_SEL_TYPE_ACCESSED;
1119	paIdt[0x80 << cIdteShift].Gate.u16Sel = BS3_SEL_TEST_PAGE_00;
1120
1121	Bs3GdteTestPage03 = Bs3Gdt[(uSysR0Cs + (3 << BS3_SEL_RING_SHIFT)) >> X86_SEL_SHIFT];
1122	Bs3GdteTestPage03.Gen.u4Type &= ~X86_SEL_TYPE_ACCESSED;
1123	paIdt[0x83 << cIdteShift].Gate.u16Sel = BS3_SEL_TEST_PAGE_03; /* rpl is ignored, so leave it as zero. */
1124
1125	/* Check that the CS.A bit is being set on a general basis and that
1126	the special CS values work with out generic handler code. */
1127	Bs3TrapSetJmpAndRestore(&Ctx80, &TrapCtx);
1128	bs3CpuBasic2_CompareIntCtx1(&TrapCtx, &Ctx80, 0x80 /bXcpt/);
1129	if (!(Bs3GdteTestPage00.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
1130	bs3CpuBasic2_FailedF("u4Type=%#x, not accessed", Bs3GdteTestPage00.Gen.u4Type);
1131	g_usBs3TestStep++;
1132
1133	Bs3MemCpy(&CtxTmp, &Ctx83, sizeof(CtxTmp));
1134	Bs3RegCtxConvertToRingX(&CtxTmp, 3);
1135	Bs3TrapSetJmpAndRestore(&CtxTmp, &TrapCtx);
1136	bs3CpuBasic2_CompareIntCtx1(&TrapCtx, &CtxTmp, 0x83 /bXcpt/);
1137	if (!(Bs3GdteTestPage03.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
1138	bs3CpuBasic2_FailedF("u4Type=%#x, not accessed!", Bs3GdteTestPage00.Gen.u4Type);
1139	if (TrapCtx.uHandlerCs != (BS3_SEL_TEST_PAGE_03 \| 3))
1140	bs3CpuBasic2_FailedF("uHandlerCs=%#x, expected %#x", TrapCtx.uHandlerCs, (BS3_SEL_TEST_PAGE_03 \| 3));
1141	g_usBs3TestStep++;
1142
1143	/*
1144	* Now check that setting CS.u1Access to 1 does __NOT__ trigger a page
1145	* fault due to the RW bit being zero.
1146	* (We check both with with and without the WP bit if 80486.)
1147	*/
1148	if ((g_uBs3CpuDetected & BS3CPU_TYPE_MASK) >= BS3CPU_80486)
1149	ASMSetCR0(uCr0Saved \| X86_CR0_WP);
1150
1151	Bs3GdteTestPage00.Gen.u4Type &= ~X86_SEL_TYPE_ACCESSED;
1152	Bs3GdteTestPage03.Gen.u4Type &= ~X86_SEL_TYPE_ACCESSED;
1153	rc = Bs3PagingProtect(GdtrSaved.pGdt + BS3_SEL_TEST_PAGE_00, 8, 0 /fSet/, X86_PTE_RW /fClear/);
1154	if (RT_SUCCESS(rc))
1155	{
1156	/* ring-0 handler */
1157	Bs3TrapSetJmpAndRestore(&Ctx80, &TrapCtx);
1158	bs3CpuBasic2_CompareIntCtx1(&TrapCtx, &Ctx80, 0x80 /bXcpt/);
1159	if (!(Bs3GdteTestPage00.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
1160	bs3CpuBasic2_FailedF("u4Type=%#x, not accessed!", Bs3GdteTestPage00.Gen.u4Type);
1161	g_usBs3TestStep++;
1162
1163	/* ring-3 handler */
1164	Bs3MemCpy(&CtxTmp, &Ctx83, sizeof(CtxTmp));
1165	Bs3RegCtxConvertToRingX(&CtxTmp, 3);
1166	Bs3TrapSetJmpAndRestore(&CtxTmp, &TrapCtx);
1167	bs3CpuBasic2_CompareIntCtx1(&TrapCtx, &CtxTmp, 0x83 /bXcpt/);
1168	if (!(Bs3GdteTestPage03.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
1169	bs3CpuBasic2_FailedF("u4Type=%#x, not accessed!", Bs3GdteTestPage00.Gen.u4Type);
1170	g_usBs3TestStep++;
1171
1172	/* clear WP and repeat the above. */
1173	if ((g_uBs3CpuDetected & BS3CPU_TYPE_MASK) >= BS3CPU_80486)
1174	ASMSetCR0(uCr0Saved & ~X86_CR0_WP);
1175	Bs3GdteTestPage00.Gen.u4Type &= ~X86_SEL_TYPE_ACCESSED; /* (No need to RW the page - ring-0, WP=0.) */
1176	Bs3GdteTestPage03.Gen.u4Type &= ~X86_SEL_TYPE_ACCESSED; /* (No need to RW the page - ring-0, WP=0.) */
1177
1178	Bs3TrapSetJmpAndRestore(&Ctx80, &TrapCtx);
1179	bs3CpuBasic2_CompareIntCtx1(&TrapCtx, &Ctx80, 0x80 /bXcpt/);
1180	if (!(Bs3GdteTestPage00.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
1181	bs3CpuBasic2_FailedF("u4Type=%#x, not accessed!", Bs3GdteTestPage00.Gen.u4Type);
1182	g_usBs3TestStep++;
1183
1184	Bs3TrapSetJmpAndRestore(&CtxTmp, &TrapCtx);
1185	bs3CpuBasic2_CompareIntCtx1(&TrapCtx, &CtxTmp, 0x83 /bXcpt/);
1186	if (!(Bs3GdteTestPage03.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
1187	bs3CpuBasic2_FailedF("u4Type=%#x, not accessed!n", Bs3GdteTestPage03.Gen.u4Type);
1188	g_usBs3TestStep++;
1189
1190	Bs3PagingProtect(GdtrSaved.pGdt + BS3_SEL_TEST_PAGE_00, 8, X86_PTE_RW /fSet/, 0 /fClear/);
1191	}
1192
1193	ASMSetCR0(uCr0Saved);
1194
1195	/*
1196	* While we're here, check that if the CS GDT entry is a non-present
1197	* page we do get a #PF with the rigth error code and CR2.
1198	*/
1199	Bs3GdteTestPage00.Gen.u4Type &= ~X86_SEL_TYPE_ACCESSED; /* Just for fun, really a pointless gesture. */
1200	Bs3GdteTestPage03.Gen.u4Type &= ~X86_SEL_TYPE_ACCESSED;
1201	rc = Bs3PagingProtect(GdtrSaved.pGdt + BS3_SEL_TEST_PAGE_00, 8, 0 /fSet/, X86_PTE_P /fClear/);
1202	if (RT_SUCCESS(rc))
1203	{
1204	Bs3TrapSetJmpAndRestore(&Ctx80, &TrapCtx);
1205	if (f486Plus)
1206	bs3CpuBasic2_ComparePfCtx(&TrapCtx, &Ctx80, 0 /uErrCd/, GdtrSaved.pGdt + BS3_SEL_TEST_PAGE_00);
1207	else
1208	bs3CpuBasic2_ComparePfCtx(&TrapCtx, &Ctx80, X86_TRAP_PF_RW, GdtrSaved.pGdt + BS3_SEL_TEST_PAGE_00 + 4);
1209	g_usBs3TestStep++;
1210
1211	/* Do it from ring-3 to check ErrCd, which doesn't set X86_TRAP_PF_US it turns out. */
1212	Bs3MemCpy(&CtxTmp, &Ctx83, sizeof(CtxTmp));
1213	Bs3RegCtxConvertToRingX(&CtxTmp, 3);
1214	Bs3TrapSetJmpAndRestore(&CtxTmp, &TrapCtx);
1215
1216	if (f486Plus)
1217	bs3CpuBasic2_ComparePfCtx(&TrapCtx, &CtxTmp, 0 /uErrCd/, GdtrSaved.pGdt + BS3_SEL_TEST_PAGE_03);
1218	else
1219	bs3CpuBasic2_ComparePfCtx(&TrapCtx, &CtxTmp, X86_TRAP_PF_RW, GdtrSaved.pGdt + BS3_SEL_TEST_PAGE_03 + 4);
1220	g_usBs3TestStep++;
1221
1222	Bs3PagingProtect(GdtrSaved.pGdt + BS3_SEL_TEST_PAGE_00, 8, X86_PTE_P /fSet/, 0 /fClear/);
1223	if (Bs3GdteTestPage00.Gen.u4Type & X86_SEL_TYPE_ACCESSED)
1224	bs3CpuBasic2_FailedF("u4Type=%#x, accessed! #1", Bs3GdteTestPage00.Gen.u4Type);
1225	if (Bs3GdteTestPage03.Gen.u4Type & X86_SEL_TYPE_ACCESSED)
1226	bs3CpuBasic2_FailedF("u4Type=%#x, accessed! #2", Bs3GdteTestPage03.Gen.u4Type);
1227	}
1228
1229	/* restore */
1230	paIdt[0x80 << cIdteShift].Gate.u16Sel = uSysR0Cs;
1231	paIdt[0x83 << cIdteShift].Gate.u16Sel = uSysR0Cs;// + (3 << BS3_SEL_RING_SHIFT) + 3;
1232	}
1233
1234	# endif /* 32 \|\| 64*/
1235
1236	/*
1237	* Check broad EFLAGS effects.
1238	*/
1239	g_usBs3TestStep = 5600;
1240	for (iCtx = 0; iCtx < RT_ELEMENTS(apCtx8x); iCtx++)
1241	{
1242	for (iRing = 0; iRing < 4; iRing++)
1243	{
1244	Bs3MemCpy(&CtxTmp, apCtx8x[iCtx], sizeof(CtxTmp));
1245	Bs3RegCtxConvertToRingX(&CtxTmp, iRing);
1246
1247	/* all set */
1248	CtxTmp.rflags.u32 &= X86_EFL_VM \| X86_EFL_1;
1249	CtxTmp.rflags.u32 \|= X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF /* \| X86_EFL_TF / /\| X86_EFL_IF*/
1250	\| X86_EFL_DF \| X86_EFL_OF \| X86_EFL_IOPL /* \| X86_EFL_NT*/;
1251	if (f486Plus)
1252	CtxTmp.rflags.u32 \|= X86_EFL_AC;
1253	if (f486Plus && !g_f16BitSys)
1254	CtxTmp.rflags.u32 \|= X86_EFL_RF;
1255	if (g_uBs3CpuDetected & BS3CPU_F_CPUID)
1256	CtxTmp.rflags.u32 \|= X86_EFL_VIF \| X86_EFL_VIP;
1257	Bs3TrapSetJmpAndRestore(&CtxTmp, &TrapCtx);
1258	CtxTmp.rflags.u32 &= ~X86_EFL_RF;
1259
1260	if (iCtx >= iRing)
1261	bs3CpuBasic2_CompareIntCtx1(&TrapCtx, &CtxTmp, 0x80 + iCtx /bXcpt/);
1262	else
1263	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &CtxTmp, ((0x80 + iCtx) << X86_TRAP_ERR_SEL_SHIFT) \| X86_TRAP_ERR_IDT);
1264	uExpected = CtxTmp.rflags.u32
1265	& ( X86_EFL_1 \| X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_DF
1266	\| X86_EFL_OF \| X86_EFL_IOPL \| X86_EFL_NT \| X86_EFL_VM \| X86_EFL_AC \| X86_EFL_VIF \| X86_EFL_VIP
1267	\| X86_EFL_ID /\| X86_EFL_TF/ /\| X86_EFL_IF/ /\| X86_EFL_RF/ );
1268	if (TrapCtx.fHandlerRfl != uExpected)
1269	bs3CpuBasic2_FailedF("unexpected handler rflags value: %RX64 expected %RX32; CtxTmp.rflags=%RX64 Ctx.rflags=%RX64\n",
1270	TrapCtx.fHandlerRfl, uExpected, CtxTmp.rflags.u, TrapCtx.Ctx.rflags.u);
1271	g_usBs3TestStep++;
1272
1273	/* all cleared */
1274	if ((g_uBs3CpuDetected & BS3CPU_TYPE_MASK) < BS3CPU_80286)
1275	CtxTmp.rflags.u32 = apCtx8x[iCtx]->rflags.u32 & (X86_EFL_RA1_MASK \| UINT16_C(0xf000));
1276	else
1277	CtxTmp.rflags.u32 = apCtx8x[iCtx]->rflags.u32 & (X86_EFL_VM \| X86_EFL_RA1_MASK);
1278	Bs3TrapSetJmpAndRestore(&CtxTmp, &TrapCtx);
1279	if (iCtx >= iRing)
1280	bs3CpuBasic2_CompareIntCtx1(&TrapCtx, &CtxTmp, 0x80 + iCtx /bXcpt/);
1281	else
1282	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &CtxTmp, ((0x80 + iCtx) << X86_TRAP_ERR_SEL_SHIFT) \| X86_TRAP_ERR_IDT);
1283	uExpected = CtxTmp.rflags.u32;
1284	if (TrapCtx.fHandlerRfl != uExpected)
1285	bs3CpuBasic2_FailedF("unexpected handler rflags value: %RX64 expected %RX32; CtxTmp.rflags=%RX64 Ctx.rflags=%RX64\n",
1286	TrapCtx.fHandlerRfl, uExpected, CtxTmp.rflags.u, TrapCtx.Ctx.rflags.u);
1287	g_usBs3TestStep++;
1288	}
1289	}
1290
1291	/** @todo CS.LIMIT / canonical(CS) */
1292
1293
1294	/*
1295	* Check invalid gate types.
1296	*/
1297	g_usBs3TestStep = 32000;
1298	for (iRing = 0; iRing <= 3; iRing++)
1299	{
1300	static const uint16_t s_auCSes[] = { BS3_SEL_R0_CS16, BS3_SEL_R0_CS32, BS3_SEL_R0_CS64,
1301	BS3_SEL_TSS16, BS3_SEL_TSS32, BS3_SEL_TSS64, 0, BS3_SEL_SPARE_1f };
1302	static uint16_t const s_auInvlTypes64[] = { 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 13,
1303	0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17,
1304	0x18, 0x19, 0x1a, 0x1b, 0x1c, 0x1d, 0x1e, 0x1f };
1305	static uint16_t const s_auInvlTypes32[] = { 0, 1, 2, 3, 8, 9, 10, 11, 13,
1306	0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17,
1307	0x18, 0x19, 0x1a, 0x1b, 0x1c, 0x1d, 0x1e, 0x1f,
1308	/286:/ 12, 14, 15 };
1309	uint16_t const * const pauInvTypes = cIdteShift != 0 ? s_auInvlTypes64 : s_auInvlTypes32;
1310	uint16_t const cInvTypes = cIdteShift != 0 ? RT_ELEMENTS(s_auInvlTypes64)
1311	: f386Plus ? RT_ELEMENTS(s_auInvlTypes32) - 3 : RT_ELEMENTS(s_auInvlTypes32);
1312
1313
1314	for (iCtx = 0; iCtx < RT_ELEMENTS(apCtx8x); iCtx++)
1315	{
1316	unsigned iType;
1317
1318	Bs3MemCpy(&CtxTmp, apCtx8x[iCtx], sizeof(CtxTmp));
1319	Bs3RegCtxConvertToRingX(&CtxTmp, iRing);
1320	# if TMPL_BITS == 32
1321	g_uBs3TrapEipHint = CtxTmp.rip.u32;
1322	# endif
1323	for (iType = 0; iType < cInvTypes; iType++)
1324	{
1325	uint8_t const bSavedType = paIdt[(0x80 + iCtx) << cIdteShift].Gate.u4Type;
1326	paIdt[(0x80 + iCtx) << cIdteShift].Gate.u1DescType = pauInvTypes[iType] >> 4;
1327	paIdt[(0x80 + iCtx) << cIdteShift].Gate.u4Type = pauInvTypes[iType] & 0xf;
1328
1329	for (i = 0; i < 4; i++)
1330	{
1331	for (j = 0; j < RT_ELEMENTS(s_auCSes); j++)
1332	{
1333	uint16_t uCs = (unsigned)(s_auCSes[j] - BS3_SEL_R0_FIRST) < (unsigned)(4 << BS3_SEL_RING_SHIFT)
1334	? (s_auCSes[j] \| i) + (i << BS3_SEL_RING_SHIFT)
1335	: s_auCSes[j] \| i;
1336	/Bs3TestPrintf("g_usBs3TestStep=%u iCtx=%u iRing=%u i=%u uCs=%04x type=%#x\n", g_usBs3TestStep, iCtx, iRing, i, uCs, pauInvTypes[iType]);/
1337	paIdt[(0x80 + iCtx) << cIdteShift].Gate.u16Sel = uCs;
1338	Bs3TrapSetJmpAndRestore(&CtxTmp, &TrapCtx);
1339	g_usBs3TestStep++;
1340	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &CtxTmp, ((0x80 + iCtx) << X86_TRAP_ERR_SEL_SHIFT) \| X86_TRAP_ERR_IDT);
1341
1342	/* Mark it not-present to check that invalid type takes precedence. */
1343	paIdt[(0x80 + iCtx) << cIdteShift].Gate.u1Present = 0;
1344	Bs3TrapSetJmpAndRestore(&CtxTmp, &TrapCtx);
1345	g_usBs3TestStep++;
1346	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &CtxTmp, ((0x80 + iCtx) << X86_TRAP_ERR_SEL_SHIFT) \| X86_TRAP_ERR_IDT);
1347	paIdt[(0x80 + iCtx) << cIdteShift].Gate.u1Present = 1;
1348	}
1349	}
1350
1351	paIdt[(0x80 + iCtx) << cIdteShift].Gate.u16Sel = uSysR0Cs;
1352	paIdt[(0x80 + iCtx) << cIdteShift].Gate.u4Type = bSavedType;
1353	paIdt[(0x80 + iCtx) << cIdteShift].Gate.u1DescType = 0;
1354	paIdt[(0x80 + iCtx) << cIdteShift].Gate.u1Present = 1;
1355	}
1356	}
1357	}
1358	BS3_ASSERT(g_usBs3TestStep < 62000U && g_usBs3TestStep > 32000U);
1359
1360
1361	/** @todo
1362	* - Run \#PF and \#GP (and others?) at CPLs other than zero.
1363	* - Quickly generate all faults.
1364	* - All the peculiarities v8086.
1365	*/
1366
1367	# if TMPL_BITS != 16
1368	Bs3MemFree(pbIdtCopyAlloc, 12*_1K);
1369	# endif
1370	}
1371
1372
1373	/**
1374	* Executes one round of SIDT and SGDT tests using one assembly worker.
1375	*
1376	* This is written with driving everything from the 16-bit or 32-bit worker in
1377	* mind, i.e. not assuming the test bitcount is the same as the current.
1378	*/
1379	# define bs3CpuBasic2_sidt_sgdt_One BS3_CMN_NM(bs3CpuBasic2_sidt_sgdt_One)
1380	BS3_DECL_NEAR(void) bs3CpuBasic2_sidt_sgdt_One(BS3CB2SIDTSGDT const BS3_FAR *pWorker, uint8_t bTestMode, uint8_t bRing,
1381	uint8_t const *pabExpected)
1382	{
1383	BS3TRAPFRAME TrapCtx;
1384	BS3REGCTX Ctx;
1385	BS3REGCTX CtxUdExpected;
1386	BS3REGCTX TmpCtx;
1387	uint8_t const cbBuf = 82; / test buffer area */
1388	uint8_t abBuf[82 + 8 + 8]; / test buffer w/ misalignment test space and some extra guard. */
1389	uint8_t BS3_FAR *pbBuf = abBuf;
1390	uint8_t const cbIdtr = BS3_MODE_IS_64BIT_CODE(bTestMode) ? 2+8 : 2+4;
1391	bool const f286 = (g_uBs3CpuDetected & BS3CPU_TYPE_MASK) == BS3CPU_80286;
1392	uint8_t bFiller;
1393	int off;
1394	int off2;
1395	unsigned cb;
1396	uint8_t BS3_FAR *pbTest;
1397
1398	/* make sure they're allocated */
1399	Bs3MemZero(&Ctx, sizeof(Ctx));
1400	Bs3MemZero(&CtxUdExpected, sizeof(CtxUdExpected));
1401	Bs3MemZero(&TmpCtx, sizeof(TmpCtx));
1402	Bs3MemZero(&TrapCtx, sizeof(TrapCtx));
1403	Bs3MemZero(&abBuf, sizeof(abBuf));
1404
1405	/* Create a context, give this routine some more stack space, point the context
1406	at our SIDT [xBX] + UD2 combo, and point DS:xBX at abBuf. */
1407	Bs3RegCtxSaveEx(&Ctx, bTestMode, 256 /cbExtraStack/);
1408	Bs3RegCtxSetGrpSegFromCurPtr(&Ctx, &Ctx.rbx, pWorker->fSs ? &Ctx.ss : &Ctx.ds, abBuf);
1409	Bs3RegCtxSetRipCsFromLnkPtr(&Ctx, pWorker->fpfnWorker);
1410	if (BS3_MODE_IS_16BIT_SYS(bTestMode))
1411	g_uBs3TrapEipHint = Ctx.rip.u32;
1412	if (!BS3_MODE_IS_RM_OR_V86(bTestMode))
1413	Bs3RegCtxConvertToRingX(&Ctx, bRing);
1414
1415	/* For successful SIDT attempts, we'll stop at the UD2. */
1416	Bs3MemCpy(&CtxUdExpected, &Ctx, sizeof(Ctx));
1417	CtxUdExpected.rip.u += pWorker->cbInstr;
1418
1419	/*
1420	* Check that it works at all and that only bytes we expect gets written to.
1421	*/
1422	/* First with zero buffer. */
1423	Bs3MemZero(abBuf, sizeof(abBuf));
1424	if (!ASMMemIsAllU8(abBuf, sizeof(abBuf), 0))
1425	Bs3TestFailedF("ASMMemIsAllU8 or Bs3MemZero is busted: abBuf=%.*Rhxs\n", sizeof(abBuf), pbBuf);
1426	if (!ASMMemIsZero(abBuf, sizeof(abBuf)))
1427	Bs3TestFailedF("ASMMemIsZero or Bs3MemZero is busted: abBuf=%.*Rhxs\n", sizeof(abBuf), pbBuf);
1428	Bs3TrapSetJmpAndRestore(&Ctx, &TrapCtx);
1429	bs3CpuBasic2_CompareUdCtx(&TrapCtx, &CtxUdExpected);
1430	if (f286 && abBuf[cbIdtr - 1] != 0xff)
1431	Bs3TestFailedF("286: Top base byte isn't 0xff (#1): %#x\n", abBuf[cbIdtr - 1]);
1432	if (!ASMMemIsZero(&abBuf[cbIdtr], cbBuf - cbIdtr))
1433	Bs3TestFailedF("Unexpected buffer bytes set (#1): cbIdtr=%u abBuf=%.*Rhxs\n", cbIdtr, cbBuf, pbBuf);
1434	if (Bs3MemCmp(abBuf, pabExpected, cbIdtr) != 0)
1435	Bs3TestFailedF("Mismatch (#1): expected %.Rhxs, got %.Rhxs\n", cbIdtr, pabExpected, cbIdtr, abBuf);
1436	g_usBs3TestStep++;
1437
1438	/* Again with buffer filled a byte not occuring in the previous result. */
1439	bFiller = 0x55;
1440	while (Bs3MemChr(abBuf, bFiller, cbBuf) != NULL)
1441	bFiller++;
1442	Bs3MemSet(abBuf, bFiller, sizeof(abBuf));
1443	if (!ASMMemIsAllU8(abBuf, sizeof(abBuf), bFiller))
1444	Bs3TestFailedF("ASMMemIsAllU8 or Bs3MemSet is busted: bFiller=%#x abBuf=%.*Rhxs\n", bFiller, sizeof(abBuf), pbBuf);
1445
1446	Bs3TrapSetJmpAndRestore(&Ctx, &TrapCtx);
1447	bs3CpuBasic2_CompareUdCtx(&TrapCtx, &CtxUdExpected);
1448	if (f286 && abBuf[cbIdtr - 1] != 0xff)
1449	Bs3TestFailedF("286: Top base byte isn't 0xff (#2): %#x\n", abBuf[cbIdtr - 1]);
1450	if (!ASMMemIsAllU8(&abBuf[cbIdtr], cbBuf - cbIdtr, bFiller))
1451	Bs3TestFailedF("Unexpected buffer bytes set (#2): cbIdtr=%u bFiller=%#x abBuf=%.*Rhxs\n", cbIdtr, bFiller, cbBuf, pbBuf);
1452	if (Bs3MemChr(abBuf, bFiller, cbIdtr) != NULL)
1453	Bs3TestFailedF("Not all bytes touched: cbIdtr=%u bFiller=%#x abBuf=%.*Rhxs\n", cbIdtr, bFiller, cbBuf, pbBuf);
1454	if (Bs3MemCmp(abBuf, pabExpected, cbIdtr) != 0)
1455	Bs3TestFailedF("Mismatch (#2): expected %.Rhxs, got %.Rhxs\n", cbIdtr, pabExpected, cbIdtr, abBuf);
1456	g_usBs3TestStep++;
1457
1458	/*
1459	* Slide the buffer along 8 bytes to cover misalignment.
1460	*/
1461	for (off = 0; off < 8; off++)
1462	{
1463	pbBuf = &abBuf[off];
1464	Bs3RegCtxSetGrpSegFromCurPtr(&Ctx, &Ctx.rbx, pWorker->fSs ? &Ctx.ss : &Ctx.ds, &abBuf[off]);
1465	CtxUdExpected.rbx.u = Ctx.rbx.u;
1466
1467	/* First with zero buffer. */
1468	Bs3MemZero(abBuf, sizeof(abBuf));
1469	Bs3TrapSetJmpAndRestore(&Ctx, &TrapCtx);
1470	bs3CpuBasic2_CompareUdCtx(&TrapCtx, &CtxUdExpected);
1471	if (off > 0 && !ASMMemIsZero(abBuf, off))
1472	Bs3TestFailedF("Unexpected buffer bytes set before (#3): cbIdtr=%u off=%u abBuf=%.*Rhxs\n",
1473	cbIdtr, off, off + cbBuf, abBuf);
1474	if (!ASMMemIsZero(&abBuf[off + cbIdtr], sizeof(abBuf) - cbIdtr - off))
1475	Bs3TestFailedF("Unexpected buffer bytes set after (#3): cbIdtr=%u off=%u abBuf=%.*Rhxs\n",
1476	cbIdtr, off, off + cbBuf, abBuf);
1477	if (f286 && abBuf[off + cbIdtr - 1] != 0xff)
1478	Bs3TestFailedF("286: Top base byte isn't 0xff (#3): %#x\n", abBuf[off + cbIdtr - 1]);
1479	if (Bs3MemCmp(&abBuf[off], pabExpected, cbIdtr) != 0)
1480	Bs3TestFailedF("Mismatch (#3): expected %.Rhxs, got %.Rhxs\n", cbIdtr, pabExpected, cbIdtr, &abBuf[off]);
1481	g_usBs3TestStep++;
1482
1483	/* Again with buffer filled a byte not occuring in the previous result. */
1484	Bs3MemSet(abBuf, bFiller, sizeof(abBuf));
1485	Bs3TrapSetJmpAndRestore(&Ctx, &TrapCtx);
1486	bs3CpuBasic2_CompareUdCtx(&TrapCtx, &CtxUdExpected);
1487	if (off > 0 && !ASMMemIsAllU8(abBuf, off, bFiller))
1488	Bs3TestFailedF("Unexpected buffer bytes set before (#4): cbIdtr=%u off=%u bFiller=%#x abBuf=%.*Rhxs\n",
1489	cbIdtr, off, bFiller, off + cbBuf, abBuf);
1490	if (!ASMMemIsAllU8(&abBuf[off + cbIdtr], sizeof(abBuf) - cbIdtr - off, bFiller))
1491	Bs3TestFailedF("Unexpected buffer bytes set after (#4): cbIdtr=%u off=%u bFiller=%#x abBuf=%.*Rhxs\n",
1492	cbIdtr, off, bFiller, off + cbBuf, abBuf);
1493	if (Bs3MemChr(&abBuf[off], bFiller, cbIdtr) != NULL)
1494	Bs3TestFailedF("Not all bytes touched (#4): cbIdtr=%u off=%u bFiller=%#x abBuf=%.*Rhxs\n",
1495	cbIdtr, off, bFiller, off + cbBuf, abBuf);
1496	if (f286 && abBuf[off + cbIdtr - 1] != 0xff)
1497	Bs3TestFailedF("286: Top base byte isn't 0xff (#4): %#x\n", abBuf[off + cbIdtr - 1]);
1498	if (Bs3MemCmp(&abBuf[off], pabExpected, cbIdtr) != 0)
1499	Bs3TestFailedF("Mismatch (#4): expected %.Rhxs, got %.Rhxs\n", cbIdtr, pabExpected, cbIdtr, &abBuf[off]);
1500	g_usBs3TestStep++;
1501	}
1502	pbBuf = abBuf;
1503	Bs3RegCtxSetGrpSegFromCurPtr(&Ctx, &Ctx.rbx, pWorker->fSs ? &Ctx.ss : &Ctx.ds, abBuf);
1504	CtxUdExpected.rbx.u = Ctx.rbx.u;
1505
1506	/*
1507	* Play with the selector limit if the target mode supports limit checking
1508	* We use BS3_SEL_TEST_PAGE_00 for this
1509	*/
1510	if ( !BS3_MODE_IS_RM_OR_V86(bTestMode)
1511	&& !BS3_MODE_IS_64BIT_CODE(bTestMode))
1512	{
1513	uint16_t cbLimit;
1514	uint32_t uFlatBuf = Bs3SelPtrToFlat(abBuf);
1515	Bs3GdteTestPage00 = Bs3Gdte_DATA16;
1516	Bs3GdteTestPage00.Gen.u2Dpl = bRing;
1517	Bs3GdteTestPage00.Gen.u16BaseLow = (uint16_t)uFlatBuf;
1518	Bs3GdteTestPage00.Gen.u8BaseHigh1 = (uint8_t)(uFlatBuf >> 16);
1519	Bs3GdteTestPage00.Gen.u8BaseHigh2 = (uint8_t)(uFlatBuf >> 24);
1520
1521	if (pWorker->fSs)
1522	CtxUdExpected.ss = Ctx.ss = BS3_SEL_TEST_PAGE_00 \| bRing;
1523	else
1524	CtxUdExpected.ds = Ctx.ds = BS3_SEL_TEST_PAGE_00 \| bRing;
1525
1526	/* Expand up (normal). */
1527	for (off = 0; off < 8; off++)
1528	{
1529	CtxUdExpected.rbx.u = Ctx.rbx.u = off;
1530	for (cbLimit = 0; cbLimit < cbIdtr*2; cbLimit++)
1531	{
1532	Bs3GdteTestPage00.Gen.u16LimitLow = cbLimit;
1533	Bs3MemSet(abBuf, bFiller, sizeof(abBuf));
1534	Bs3TrapSetJmpAndRestore(&Ctx, &TrapCtx);
1535	if (off + cbIdtr <= cbLimit + 1)
1536	{
1537	bs3CpuBasic2_CompareUdCtx(&TrapCtx, &CtxUdExpected);
1538	if (Bs3MemChr(&abBuf[off], bFiller, cbIdtr) != NULL)
1539	Bs3TestFailedF("Not all bytes touched (#5): cbIdtr=%u off=%u cbLimit=%u bFiller=%#x abBuf=%.*Rhxs\n",
1540	cbIdtr, off, cbLimit, bFiller, off + cbBuf, abBuf);
1541	if (Bs3MemCmp(&abBuf[off], pabExpected, cbIdtr) != 0)
1542	Bs3TestFailedF("Mismatch (#5): expected %.Rhxs, got %.Rhxs\n", cbIdtr, pabExpected, cbIdtr, &abBuf[off]);
1543	if (f286 && abBuf[off + cbIdtr - 1] != 0xff)
1544	Bs3TestFailedF("286: Top base byte isn't 0xff (#5): %#x\n", abBuf[off + cbIdtr - 1]);
1545	}
1546	else
1547	{
1548	if (pWorker->fSs)
1549	bs3CpuBasic2_CompareSsCtx(&TrapCtx, &Ctx, 0, false /f486ResumeFlagHint/);
1550	else
1551	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &Ctx, 0);
1552	if (off + 2 <= cbLimit + 1)
1553	{
1554	if (Bs3MemChr(&abBuf[off], bFiller, 2) != NULL)
1555	Bs3TestFailedF("Limit bytes not touched (#6): cbIdtr=%u off=%u cbLimit=%u bFiller=%#x abBuf=%.*Rhxs\n",
1556	cbIdtr, off, cbLimit, bFiller, off + cbBuf, abBuf);
1557	if (Bs3MemCmp(&abBuf[off], pabExpected, 2) != 0)
1558	Bs3TestFailedF("Mismatch (#6): expected %.2Rhxs, got %.2Rhxs\n", pabExpected, &abBuf[off]);
1559	if (!ASMMemIsAllU8(&abBuf[off + 2], cbIdtr - 2, bFiller))
1560	Bs3TestFailedF("Base bytes touched on #GP (#6): cbIdtr=%u off=%u cbLimit=%u bFiller=%#x abBuf=%.*Rhxs\n",
1561	cbIdtr, off, cbLimit, bFiller, off + cbBuf, abBuf);
1562	}
1563	else if (!ASMMemIsAllU8(abBuf, sizeof(abBuf), bFiller))
1564	Bs3TestFailedF("Bytes touched on #GP: cbIdtr=%u off=%u cbLimit=%u bFiller=%#x abBuf=%.*Rhxs\n",
1565	cbIdtr, off, cbLimit, bFiller, off + cbBuf, abBuf);
1566	}
1567
1568	if (off > 0 && !ASMMemIsAllU8(abBuf, off, bFiller))
1569	Bs3TestFailedF("Leading bytes touched (#7): cbIdtr=%u off=%u cbLimit=%u bFiller=%#x abBuf=%.*Rhxs\n",
1570	cbIdtr, off, cbLimit, bFiller, off + cbBuf, abBuf);
1571	if (!ASMMemIsAllU8(&abBuf[off + cbIdtr], sizeof(abBuf) - off - cbIdtr, bFiller))
1572	Bs3TestFailedF("Trailing bytes touched (#7): cbIdtr=%u off=%u cbLimit=%u bFiller=%#x abBuf=%.*Rhxs\n",
1573	cbIdtr, off, cbLimit, bFiller, off + cbBuf, abBuf);
1574
1575	g_usBs3TestStep++;
1576	}
1577	}
1578
1579	/* Expand down (weird). Inverted valid area compared to expand up,
1580	so a limit of zero give us a valid range for 0001..0ffffh (instead of
1581	a segment with one valid byte at 0000h). Whereas a limit of 0fffeh
1582	means one valid byte at 0ffffh, and a limit of 0ffffh means none
1583	(because in a normal expand up the 0ffffh means all 64KB are
1584	accessible). */
1585	Bs3GdteTestPage00.Gen.u4Type = X86_SEL_TYPE_RW_DOWN_ACC;
1586	for (off = 0; off < 8; off++)
1587	{
1588	CtxUdExpected.rbx.u = Ctx.rbx.u = off;
1589	for (cbLimit = 0; cbLimit < cbIdtr*2; cbLimit++)
1590	{
1591	Bs3GdteTestPage00.Gen.u16LimitLow = cbLimit;
1592	Bs3MemSet(abBuf, bFiller, sizeof(abBuf));
1593	Bs3TrapSetJmpAndRestore(&Ctx, &TrapCtx);
1594
1595	if (off > cbLimit)
1596	{
1597	bs3CpuBasic2_CompareUdCtx(&TrapCtx, &CtxUdExpected);
1598	if (Bs3MemChr(&abBuf[off], bFiller, cbIdtr) != NULL)
1599	Bs3TestFailedF("Not all bytes touched (#8): cbIdtr=%u off=%u cbLimit=%u bFiller=%#x abBuf=%.*Rhxs\n",
1600	cbIdtr, off, cbLimit, bFiller, off + cbBuf, abBuf);
1601	if (Bs3MemCmp(&abBuf[off], pabExpected, cbIdtr) != 0)
1602	Bs3TestFailedF("Mismatch (#8): expected %.Rhxs, got %.Rhxs\n", cbIdtr, pabExpected, cbIdtr, &abBuf[off]);
1603	if (f286 && abBuf[off + cbIdtr - 1] != 0xff)
1604	Bs3TestFailedF("286: Top base byte isn't 0xff (#8): %#x\n", abBuf[off + cbIdtr - 1]);
1605	}
1606	else
1607	{
1608	if (pWorker->fSs)
1609	bs3CpuBasic2_CompareSsCtx(&TrapCtx, &Ctx, 0, false /f486ResumeFlagHint/);
1610	else
1611	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &Ctx, 0);
1612	if (!ASMMemIsAllU8(abBuf, sizeof(abBuf), bFiller))
1613	Bs3TestFailedF("Bytes touched on #GP: cbIdtr=%u off=%u cbLimit=%u bFiller=%#x abBuf=%.*Rhxs\n",
1614	cbIdtr, off, cbLimit, bFiller, off + cbBuf, abBuf);
1615	}
1616
1617	if (off > 0 && !ASMMemIsAllU8(abBuf, off, bFiller))
1618	Bs3TestFailedF("Leading bytes touched (#9): cbIdtr=%u off=%u cbLimit=%u bFiller=%#x abBuf=%.*Rhxs\n",
1619	cbIdtr, off, cbLimit, bFiller, off + cbBuf, abBuf);
1620	if (!ASMMemIsAllU8(&abBuf[off + cbIdtr], sizeof(abBuf) - off - cbIdtr, bFiller))
1621	Bs3TestFailedF("Trailing bytes touched (#9): cbIdtr=%u off=%u cbLimit=%u bFiller=%#x abBuf=%.*Rhxs\n",
1622	cbIdtr, off, cbLimit, bFiller, off + cbBuf, abBuf);
1623
1624	g_usBs3TestStep++;
1625	}
1626	}
1627
1628	Bs3RegCtxSetGrpSegFromCurPtr(&Ctx, &Ctx.rbx, pWorker->fSs ? &Ctx.ss : &Ctx.ds, abBuf);
1629	CtxUdExpected.rbx.u = Ctx.rbx.u;
1630	CtxUdExpected.ss = Ctx.ss;
1631	CtxUdExpected.ds = Ctx.ds;
1632	}
1633
1634	/*
1635	* Play with the paging.
1636	*/
1637	if ( BS3_MODE_IS_PAGED(bTestMode)
1638	&& (!pWorker->fSs \|\| bRing == 3) /* SS.DPL == CPL, we'll get some tiled ring-3 selector here. */
1639	&& (pbTest = (uint8_t BS3_FAR *)Bs3MemGuardedTestPageAlloc(BS3MEMKIND_TILED)) != NULL)
1640	{
1641	RTCCUINTXREG uFlatTest = Bs3SelPtrToFlat(pbTest);
1642
1643	/*
1644	* Slide the buffer towards the trailing guard page. We'll observe the
1645	* first word being written entirely separately from the 2nd dword/qword.
1646	*/
1647	for (off = X86_PAGE_SIZE - cbIdtr - 4; off < X86_PAGE_SIZE + 4; off++)
1648	{
1649	Bs3MemSet(&pbTest[X86_PAGE_SIZE - cbIdtr * 2], bFiller, cbIdtr * 2);
1650	Bs3RegCtxSetGrpSegFromCurPtr(&Ctx, &Ctx.rbx, pWorker->fSs ? &Ctx.ss : &Ctx.ds, &pbTest[off]);
1651	Bs3TrapSetJmpAndRestore(&Ctx, &TrapCtx);
1652	if (off + cbIdtr <= X86_PAGE_SIZE)
1653	{
1654	CtxUdExpected.rbx = Ctx.rbx;
1655	CtxUdExpected.ss = Ctx.ss;
1656	CtxUdExpected.ds = Ctx.ds;
1657	bs3CpuBasic2_CompareUdCtx(&TrapCtx, &CtxUdExpected);
1658	if (Bs3MemCmp(&pbTest[off], pabExpected, cbIdtr) != 0)
1659	Bs3TestFailedF("Mismatch (#9): expected %.Rhxs, got %.Rhxs\n", cbIdtr, pabExpected, cbIdtr, &pbTest[off]);
1660	}
1661	else
1662	{
1663	bs3CpuBasic2_ComparePfCtx(&TrapCtx, &Ctx, X86_TRAP_PF_RW \| (Ctx.bCpl == 3 ? X86_TRAP_PF_US : 0),
1664	uFlatTest + RT_MAX(off, X86_PAGE_SIZE));
1665	if ( off <= X86_PAGE_SIZE - 2
1666	&& Bs3MemCmp(&pbTest[off], pabExpected, 2) != 0)
1667	Bs3TestPrintf("Mismatch (#10): Expected limit %.2Rhxs, got %.2Rhxs; off=%#x\n",
1668	pabExpected, &pbTest[off], off);
1669	if ( off < X86_PAGE_SIZE - 2
1670	&& !ASMMemIsAllU8(&pbTest[off + 2], X86_PAGE_SIZE - off - 2, bFiller))
1671	Bs3TestPrintf("Wrote partial base on #PF (#10): bFiller=%#x, got %.*Rhxs; off=%#x\n",
1672	bFiller, X86_PAGE_SIZE - off - 2, &pbTest[off + 2], off);
1673	if (off == X86_PAGE_SIZE - 1 && pbTest[off] != bFiller)
1674	Bs3TestPrintf("Wrote partial limit on #PF (#10): Expected %02x, got %02x\n", bFiller, pbTest[off]);
1675	}
1676	g_usBs3TestStep++;
1677	}
1678
1679	/*
1680	* Now, do it the other way around. It should look normal now since writing
1681	* the limit will #PF first and nothing should be written.
1682	*/
1683	for (off = cbIdtr + 4; off >= -cbIdtr - 4; off--)
1684	{
1685	Bs3MemSet(pbTest, bFiller, 48);
1686	Bs3RegCtxSetGrpSegFromCurPtr(&Ctx, &Ctx.rbx, pWorker->fSs ? &Ctx.ss : &Ctx.ds, &pbTest[off]);
1687	Bs3TrapSetJmpAndRestore(&Ctx, &TrapCtx);
1688	if (off >= 0)
1689	{
1690	CtxUdExpected.rbx = Ctx.rbx;
1691	CtxUdExpected.ss = Ctx.ss;
1692	CtxUdExpected.ds = Ctx.ds;
1693	bs3CpuBasic2_CompareUdCtx(&TrapCtx, &CtxUdExpected);
1694	if (Bs3MemCmp(&pbTest[off], pabExpected, cbIdtr) != 0)
1695	Bs3TestFailedF("Mismatch (#11): expected %.Rhxs, got %.Rhxs\n", cbIdtr, pabExpected, cbIdtr, &pbTest[off]);
1696	}
1697	else
1698	{
1699	bs3CpuBasic2_ComparePfCtx(&TrapCtx, &Ctx, X86_TRAP_PF_RW \| (Ctx.bCpl == 3 ? X86_TRAP_PF_US : 0), uFlatTest + off);
1700	if ( -off < cbIdtr
1701	&& !ASMMemIsAllU8(pbTest, cbIdtr + off, bFiller))
1702	Bs3TestPrintf("Wrote partial content on #PF (#12): bFiller=%#x, found %.*Rhxs; off=%d\n",
1703	bFiller, cbIdtr + off, pbTest, off);
1704	}
1705	if (!ASMMemIsAllU8(&pbTest[RT_MAX(cbIdtr + off, 0)], 16, bFiller))
1706	Bs3TestPrintf("Wrote beyond expected area (#13): bFiller=%#x, found %.16Rhxs; off=%d\n",
1707	bFiller, &pbTest[RT_MAX(cbIdtr + off, 0)], off);
1708	g_usBs3TestStep++;
1709	}
1710
1711	/*
1712	* Combine paging and segment limit and check ordering.
1713	* This is kind of interesting here since it the instruction seems to
1714	* be doing two separate writes.
1715	*/
1716	if ( !BS3_MODE_IS_RM_OR_V86(bTestMode)
1717	&& !BS3_MODE_IS_64BIT_CODE(bTestMode))
1718	{
1719	uint16_t cbLimit;
1720
1721	Bs3GdteTestPage00 = Bs3Gdte_DATA16;
1722	Bs3GdteTestPage00.Gen.u2Dpl = bRing;
1723	Bs3GdteTestPage00.Gen.u16BaseLow = (uint16_t)uFlatTest;
1724	Bs3GdteTestPage00.Gen.u8BaseHigh1 = (uint8_t)(uFlatTest >> 16);
1725	Bs3GdteTestPage00.Gen.u8BaseHigh2 = (uint8_t)(uFlatTest >> 24);
1726
1727	if (pWorker->fSs)
1728	CtxUdExpected.ss = Ctx.ss = BS3_SEL_TEST_PAGE_00 \| bRing;
1729	else
1730	CtxUdExpected.ds = Ctx.ds = BS3_SEL_TEST_PAGE_00 \| bRing;
1731
1732	/* Expand up (normal), approaching tail guard page. */
1733	for (off = X86_PAGE_SIZE - cbIdtr - 4; off < X86_PAGE_SIZE + 4; off++)
1734	{
1735	CtxUdExpected.rbx.u = Ctx.rbx.u = off;
1736	for (cbLimit = X86_PAGE_SIZE - cbIdtr2; cbLimit < X86_PAGE_SIZE + cbIdtr2; cbLimit++)
1737	{
1738	Bs3GdteTestPage00.Gen.u16LimitLow = cbLimit;
1739	Bs3MemSet(&pbTest[X86_PAGE_SIZE - cbIdtr * 2], bFiller, cbIdtr * 2);
1740	Bs3TrapSetJmpAndRestore(&Ctx, &TrapCtx);
1741	if (off + cbIdtr <= cbLimit + 1)
1742	{
1743	/* No #GP, but maybe #PF. */
1744	if (off + cbIdtr <= X86_PAGE_SIZE)
1745	{
1746	bs3CpuBasic2_CompareUdCtx(&TrapCtx, &CtxUdExpected);
1747	if (Bs3MemCmp(&pbTest[off], pabExpected, cbIdtr) != 0)
1748	Bs3TestFailedF("Mismatch (#14): expected %.Rhxs, got %.Rhxs\n",
1749	cbIdtr, pabExpected, cbIdtr, &pbTest[off]);
1750	}
1751	else
1752	{
1753	bs3CpuBasic2_ComparePfCtx(&TrapCtx, &Ctx, X86_TRAP_PF_RW \| (Ctx.bCpl == 3 ? X86_TRAP_PF_US : 0),
1754	uFlatTest + RT_MAX(off, X86_PAGE_SIZE));
1755	if ( off <= X86_PAGE_SIZE - 2
1756	&& Bs3MemCmp(&pbTest[off], pabExpected, 2) != 0)
1757	Bs3TestPrintf("Mismatch (#15): Expected limit %.2Rhxs, got %.2Rhxs; off=%#x\n",
1758	pabExpected, &pbTest[off], off);
1759	cb = X86_PAGE_SIZE - off - 2;
1760	if ( off < X86_PAGE_SIZE - 2
1761	&& !ASMMemIsAllU8(&pbTest[off + 2], cb, bFiller))
1762	Bs3TestPrintf("Wrote partial base on #PF (#15): bFiller=%#x, got %.*Rhxs; off=%#x\n",
1763	bFiller, cb, &pbTest[off + 2], off);
1764	if (off == X86_PAGE_SIZE - 1 && pbTest[off] != bFiller)
1765	Bs3TestPrintf("Wrote partial limit on #PF (#15): Expected %02x, got %02x\n", bFiller, pbTest[off]);
1766	}
1767	}
1768	else if (off + 2 <= cbLimit + 1)
1769	{
1770	/* [ig]tr.limit writing does not cause #GP, but may cause #PG, if not writing the base causes #GP. */
1771	if (off <= X86_PAGE_SIZE - 2)
1772	{
1773	if (pWorker->fSs)
1774	bs3CpuBasic2_CompareSsCtx(&TrapCtx, &Ctx, 0, false /f486ResumeFlagHint/);
1775	else
1776	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &Ctx, 0);
1777	if (Bs3MemCmp(&pbTest[off], pabExpected, 2) != 0)
1778	Bs3TestPrintf("Mismatch (#16): Expected limit %.2Rhxs, got %.2Rhxs; off=%#x\n",
1779	pabExpected, &pbTest[off], off);
1780	cb = X86_PAGE_SIZE - off - 2;
1781	if ( off < X86_PAGE_SIZE - 2
1782	&& !ASMMemIsAllU8(&pbTest[off + 2], cb, bFiller))
1783	Bs3TestPrintf("Wrote partial base with limit (#16): bFiller=%#x, got %.*Rhxs; off=%#x\n",
1784	bFiller, cb, &pbTest[off + 2], off);
1785	}
1786	else
1787	{
1788	bs3CpuBasic2_ComparePfCtx(&TrapCtx, &Ctx, X86_TRAP_PF_RW \| (Ctx.bCpl == 3 ? X86_TRAP_PF_US : 0),
1789	uFlatTest + RT_MAX(off, X86_PAGE_SIZE));
1790	if ( off < X86_PAGE_SIZE
1791	&& !ASMMemIsAllU8(&pbTest[off], X86_PAGE_SIZE - off, bFiller))
1792	Bs3TestPrintf("Mismatch (#16): Partial limit write on #PF: bFiller=%#x, got %.*Rhxs\n",
1793	bFiller, X86_PAGE_SIZE - off, &pbTest[off]);
1794	}
1795	}
1796	else
1797	{
1798	/* #GP/#SS on limit. */
1799	if (pWorker->fSs)
1800	bs3CpuBasic2_CompareSsCtx(&TrapCtx, &Ctx, 0, false /f486ResumeFlagHint/);
1801	else
1802	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &Ctx, 0);
1803	if ( off < X86_PAGE_SIZE
1804	&& !ASMMemIsAllU8(&pbTest[off], X86_PAGE_SIZE - off, bFiller))
1805	Bs3TestPrintf("Mismatch (#17): Partial write on #GP: bFiller=%#x, got %.*Rhxs\n",
1806	bFiller, X86_PAGE_SIZE - off, &pbTest[off]);
1807	}
1808
1809	cb = RT_MIN(cbIdtr * 2, off - (X86_PAGE_SIZE - cbIdtr*2));
1810	if (!ASMMemIsAllU8(&pbTest[X86_PAGE_SIZE - cbIdtr * 2], cb, bFiller))
1811	Bs3TestFailedF("Leading bytes touched (#18): cbIdtr=%u off=%u cbLimit=%u bFiller=%#x pbTest=%.*Rhxs\n",
1812	cbIdtr, off, cbLimit, bFiller, cb, pbTest[X86_PAGE_SIZE - cbIdtr * 2]);
1813
1814	g_usBs3TestStep++;
1815
1816	/* Set DS to 0 and check that we get #GP(0). */
1817	if (!pWorker->fSs)
1818	{
1819	Ctx.ds = 0;
1820	Bs3TrapSetJmpAndRestore(&Ctx, &TrapCtx);
1821	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &Ctx, 0);
1822	Ctx.ds = BS3_SEL_TEST_PAGE_00 \| bRing;
1823	g_usBs3TestStep++;
1824	}
1825	}
1826	}
1827
1828	/* Expand down. */
1829	pbTest -= X86_PAGE_SIZE; /* Note! we're backing up a page to simplify things */
1830	uFlatTest -= X86_PAGE_SIZE;
1831
1832	Bs3GdteTestPage00.Gen.u4Type = X86_SEL_TYPE_RW_DOWN_ACC;
1833	Bs3GdteTestPage00.Gen.u16BaseLow = (uint16_t)uFlatTest;
1834	Bs3GdteTestPage00.Gen.u8BaseHigh1 = (uint8_t)(uFlatTest >> 16);
1835	Bs3GdteTestPage00.Gen.u8BaseHigh2 = (uint8_t)(uFlatTest >> 24);
1836
1837	for (off = X86_PAGE_SIZE - cbIdtr - 4; off < X86_PAGE_SIZE + 4; off++)
1838	{
1839	CtxUdExpected.rbx.u = Ctx.rbx.u = off;
1840	for (cbLimit = X86_PAGE_SIZE - cbIdtr2; cbLimit < X86_PAGE_SIZE + cbIdtr2; cbLimit++)
1841	{
1842	Bs3GdteTestPage00.Gen.u16LimitLow = cbLimit;
1843	Bs3MemSet(&pbTest[X86_PAGE_SIZE], bFiller, cbIdtr * 2);
1844	Bs3TrapSetJmpAndRestore(&Ctx, &TrapCtx);
1845	if (cbLimit < off && off >= X86_PAGE_SIZE)
1846	{
1847	bs3CpuBasic2_CompareUdCtx(&TrapCtx, &CtxUdExpected);
1848	if (Bs3MemCmp(&pbTest[off], pabExpected, cbIdtr) != 0)
1849	Bs3TestFailedF("Mismatch (#19): expected %.Rhxs, got %.Rhxs\n",
1850	cbIdtr, pabExpected, cbIdtr, &pbTest[off]);
1851	cb = X86_PAGE_SIZE + cbIdtr*2 - off;
1852	if (!ASMMemIsAllU8(&pbTest[off + cbIdtr], cb, bFiller))
1853	Bs3TestFailedF("Trailing bytes touched (#20): cbIdtr=%u off=%u cbLimit=%u bFiller=%#x pbTest=%.*Rhxs\n",
1854	cbIdtr, off, cbLimit, bFiller, cb, pbTest[off + cbIdtr]);
1855	}
1856	else
1857	{
1858	if (cbLimit < off && off < X86_PAGE_SIZE)
1859	bs3CpuBasic2_ComparePfCtx(&TrapCtx, &Ctx, X86_TRAP_PF_RW \| (Ctx.bCpl == 3 ? X86_TRAP_PF_US : 0),
1860	uFlatTest + off);
1861	else if (pWorker->fSs)
1862	bs3CpuBasic2_CompareSsCtx(&TrapCtx, &Ctx, 0, false /f486ResumeFlagHint/);
1863	else
1864	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &Ctx, 0);
1865	cb = cbIdtr*2;
1866	if (!ASMMemIsAllU8(&pbTest[X86_PAGE_SIZE], cb, bFiller))
1867	Bs3TestFailedF("Trailing bytes touched (#20): cbIdtr=%u off=%u cbLimit=%u bFiller=%#x pbTest=%.*Rhxs\n",
1868	cbIdtr, off, cbLimit, bFiller, cb, pbTest[X86_PAGE_SIZE]);
1869	}
1870	g_usBs3TestStep++;
1871	}
1872	}
1873
1874	pbTest += X86_PAGE_SIZE;
1875	uFlatTest += X86_PAGE_SIZE;
1876	}
1877
1878	Bs3MemGuardedTestPageFree(pbTest);
1879	}
1880
1881	/*
1882	* Check non-canonical 64-bit space.
1883	*/
1884	if ( BS3_MODE_IS_64BIT_CODE(bTestMode)
1885	&& (pbTest = (uint8_t BS3_FAR *)Bs3PagingSetupCanonicalTraps()) != NULL)
1886	{
1887	/* Make our references relative to the gap. */
1888	pbTest += g_cbBs3PagingOneCanonicalTrap;
1889
1890	/* Hit it from below. */
1891	for (off = -cbIdtr - 8; off < cbIdtr + 8; off++)
1892	{
1893	Ctx.rbx.u = CtxUdExpected.rbx.u = UINT64_C(0x0000800000000000) + off;
1894	Bs3MemSet(&pbTest[-64], bFiller, 64*2);
1895	Bs3TrapSetJmpAndRestore(&Ctx, &TrapCtx);
1896	if (off + cbIdtr <= 0)
1897	{
1898	bs3CpuBasic2_CompareUdCtx(&TrapCtx, &CtxUdExpected);
1899	if (Bs3MemCmp(&pbTest[off], pabExpected, cbIdtr) != 0)
1900	Bs3TestFailedF("Mismatch (#21): expected %.Rhxs, got %.Rhxs\n", cbIdtr, pabExpected, cbIdtr, &pbTest[off]);
1901	}
1902	else
1903	{
1904	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &Ctx, 0);
1905	if (off <= -2 && Bs3MemCmp(&pbTest[off], pabExpected, 2) != 0)
1906	Bs3TestFailedF("Mismatch (#21): expected limit %.2Rhxs, got %.2Rhxs\n", pabExpected, &pbTest[off]);
1907	off2 = off <= -2 ? 2 : 0;
1908	cb = cbIdtr - off2;
1909	if (!ASMMemIsAllU8(&pbTest[off + off2], cb, bFiller))
1910	Bs3TestFailedF("Mismatch (#21): touched base %.Rhxs, got %.Rhxs\n",
1911	cb, &pabExpected[off], cb, &pbTest[off + off2]);
1912	}
1913	if (!ASMMemIsAllU8(&pbTest[off - 16], 16, bFiller))
1914	Bs3TestFailedF("Leading bytes touched (#21): bFiller=%#x, got %.16Rhxs\n", bFiller, &pbTest[off]);
1915	if (!ASMMemIsAllU8(&pbTest[off + cbIdtr], 16, bFiller))
1916	Bs3TestFailedF("Trailing bytes touched (#21): bFiller=%#x, got %.16Rhxs\n", bFiller, &pbTest[off + cbIdtr]);
1917	}
1918
1919	/* Hit it from above. */
1920	for (off = -cbIdtr - 8; off < cbIdtr + 8; off++)
1921	{
1922	Ctx.rbx.u = CtxUdExpected.rbx.u = UINT64_C(0xffff800000000000) + off;
1923	Bs3MemSet(&pbTest[-64], bFiller, 64*2);
1924	Bs3TrapSetJmpAndRestore(&Ctx, &TrapCtx);
1925	if (off >= 0)
1926	{
1927	bs3CpuBasic2_CompareUdCtx(&TrapCtx, &CtxUdExpected);
1928	if (Bs3MemCmp(&pbTest[off], pabExpected, cbIdtr) != 0)
1929	Bs3TestFailedF("Mismatch (#22): expected %.Rhxs, got %.Rhxs\n", cbIdtr, pabExpected, cbIdtr, &pbTest[off]);
1930	}
1931	else
1932	{
1933	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &Ctx, 0);
1934	if (!ASMMemIsAllU8(&pbTest[off], cbIdtr, bFiller))
1935	Bs3TestFailedF("Mismatch (#22): touched base %.Rhxs, got %.Rhxs\n",
1936	cbIdtr, &pabExpected[off], cbIdtr, &pbTest[off]);
1937	}
1938	if (!ASMMemIsAllU8(&pbTest[off - 16], 16, bFiller))
1939	Bs3TestFailedF("Leading bytes touched (#22): bFiller=%#x, got %.16Rhxs\n", bFiller, &pbTest[off]);
1940	if (!ASMMemIsAllU8(&pbTest[off + cbIdtr], 16, bFiller))
1941	Bs3TestFailedF("Trailing bytes touched (#22): bFiller=%#x, got %.16Rhxs\n", bFiller, &pbTest[off + cbIdtr]);
1942	}
1943
1944	}
1945
1946	}
1947
1948	# define bs3CpuBasic2_sidt_sgdt_Common BS3_CMN_NM(bs3CpuBasic2_sidt_sgdt_Common)
1949	BS3_DECL_NEAR(void) bs3CpuBasic2_sidt_sgdt_Common(uint8_t bTestMode, BS3CB2SIDTSGDT const BS3_FAR *paWorkers, unsigned cWorkers,
1950	uint8_t const *pabExpected)
1951	{
1952	unsigned idx;
1953	unsigned bRing;
1954	unsigned iStep = 0;
1955
1956	/* Note! We skip the SS checks for ring-0 since we badly mess up SS in the
1957	test and don't want to bother with double faults. */
1958	for (bRing = 0; bRing <= 3; bRing++)
1959	{
1960	for (idx = 0; idx < cWorkers; idx++)
1961	if ( (paWorkers[idx].bMode & (bTestMode & BS3_MODE_CODE_MASK))
1962	&& (!paWorkers[idx].fSs \|\| bRing != 0))
1963	{
1964	g_usBs3TestStep = iStep;
1965	bs3CpuBasic2_sidt_sgdt_One(&paWorkers[idx], bTestMode, bRing, pabExpected);
1966	iStep += 1000;
1967	}
1968	if (BS3_MODE_IS_RM_OR_V86(bTestMode))
1969	break;
1970	}
1971	}
1972
1973
1974	# if ARCH_BITS != 64
1975
1976	/**
1977	* Worker for bs3CpuBasic2_TssGateEsp that tests the INT 80 from outer rings.
1978	*/
1979	# define bs3CpuBasic2_TssGateEsp_AltStackOuterRing BS3_CMN_NM(bs3CpuBasic2_TssGateEsp_AltStackOuterRing)
1980	BS3_DECL_NEAR(void) bs3CpuBasic2_TssGateEsp_AltStackOuterRing(PCBS3REGCTX pCtx, uint8_t bRing, uint8_t *pbAltStack,
1981	size_t cbAltStack, bool f16BitStack, bool f16BitTss,
1982	bool f16BitHandler, unsigned uLine)
1983	{
1984	uint8_t const cbIretFrame = f16BitHandler ? 52 : 54;
1985	BS3REGCTX Ctx2;
1986	BS3TRAPFRAME TrapCtx;
1987	uint8_t *pbTmp;
1988	g_usBs3TestStep = uLine;
1989
1990	Bs3MemCpy(&Ctx2, pCtx, sizeof(Ctx2));
1991	Bs3RegCtxConvertToRingX(&Ctx2, bRing);
1992
1993	if (pbAltStack)
1994	{
1995	Ctx2.rsp.u = Bs3SelPtrToFlat(pbAltStack + 0x1980);
1996	Bs3MemZero(pbAltStack, cbAltStack);
1997	}
1998
1999	Bs3TrapSetJmpAndRestore(&Ctx2, &TrapCtx);
2000
2001	if (!f16BitStack && f16BitTss)
2002	Ctx2.rsp.u &= UINT16_MAX;
2003
2004	bs3CpuBasic2_CompareIntCtx1(&TrapCtx, &Ctx2, 0x80 /bXcpt/);
2005	CHECK_MEMBER("bCpl", "%u", TrapCtx.Ctx.bCpl, bRing);
2006	CHECK_MEMBER("cbIretFrame", "%#x", TrapCtx.cbIretFrame, cbIretFrame);
2007
2008	if (pbAltStack)
2009	{
2010	uint64_t uExpectedRsp = (f16BitTss ? Bs3Tss16.sp0 : Bs3Tss32.esp0) - cbIretFrame;
2011	if (f16BitStack)
2012	{
2013	uExpectedRsp &= UINT16_MAX;
2014	uExpectedRsp \|= Ctx2.rsp.u & ~(uint64_t)UINT16_MAX;
2015	}
2016	if ( TrapCtx.uHandlerRsp != uExpectedRsp
2017	\|\| TrapCtx.uHandlerSs != (f16BitTss ? Bs3Tss16.ss0 : Bs3Tss32.ss0))
2018	bs3CpuBasic2_FailedF("handler SS:ESP=%04x:%08RX64, expected %04x:%08RX16",
2019	TrapCtx.uHandlerSs, TrapCtx.uHandlerRsp, Bs3Tss16.ss0, uExpectedRsp);
2020
2021	pbTmp = (uint8_t *)ASMMemFirstNonZero(pbAltStack, cbAltStack);
2022	if ((f16BitStack \|\| TrapCtx.uHandlerRsp <= UINT16_MAX) && pbTmp != NULL)
2023	bs3CpuBasic2_FailedF("someone touched the alt stack (%p) with SS:ESP=%04x:%#RX32: %p=%02x",
2024	pbAltStack, Ctx2.ss, Ctx2.rsp.u32, pbTmp, *pbTmp);
2025	else if (!f16BitStack && TrapCtx.uHandlerRsp > UINT16_MAX && pbTmp == NULL)
2026	bs3CpuBasic2_FailedF("the alt stack (%p) was not used SS:ESP=%04x:%#RX32\n", pbAltStack, Ctx2.ss, Ctx2.rsp.u32);
2027	}
2028	}
2029
2030	# define bs3CpuBasic2_TssGateEspCommon BS3_CMN_NM(bs3CpuBasic2_TssGateEspCommon)
2031	BS3_DECL_NEAR(void) bs3CpuBasic2_TssGateEspCommon(bool const g_f16BitSys, PX86DESC const paIdt, unsigned const cIdteShift)
2032	{
2033	BS3TRAPFRAME TrapCtx;
2034	BS3REGCTX Ctx;
2035	BS3REGCTX Ctx2;
2036	# if TMPL_BITS == 16
2037	uint8_t *pbTmp;
2038	# endif
2039
2040	/* make sure they're allocated */
2041	Bs3MemZero(&Ctx, sizeof(Ctx));
2042	Bs3MemZero(&Ctx2, sizeof(Ctx2));
2043	Bs3MemZero(&TrapCtx, sizeof(TrapCtx));
2044
2045	Bs3RegCtxSave(&Ctx);
2046	Ctx.rsp.u -= 0x80;
2047	Ctx.rip.u = (uintptr_t)BS3_FP_OFF(&bs3CpuBasic2_Int80);
2048	# if TMPL_BITS == 32
2049	g_uBs3TrapEipHint = Ctx.rip.u32;
2050	# endif
2051
2052	/*
2053	* We'll be using IDT entry 80 and 81 here. The first one will be
2054	* accessible from all DPLs, the latter not. So, start with setting
2055	* the DPLs.
2056	*/
2057	paIdt[0x80 << cIdteShift].Gate.u2Dpl = 3;
2058	paIdt[0x81 << cIdteShift].Gate.u2Dpl = 0;
2059
2060	/*
2061	* Check that the basic stuff works first.
2062	*/
2063	Bs3TrapSetJmpAndRestore(&Ctx, &TrapCtx);
2064	g_usBs3TestStep = __LINE__;
2065	bs3CpuBasic2_CompareIntCtx1(&TrapCtx, &Ctx, 0x80 /bXcpt/);
2066
2067	bs3CpuBasic2_TssGateEsp_AltStackOuterRing(&Ctx, 1, NULL, 0, g_f16BitSys, g_f16BitSys, g_f16BitSys, __LINE__);
2068	bs3CpuBasic2_TssGateEsp_AltStackOuterRing(&Ctx, 2, NULL, 0, g_f16BitSys, g_f16BitSys, g_f16BitSys, __LINE__);
2069	bs3CpuBasic2_TssGateEsp_AltStackOuterRing(&Ctx, 3, NULL, 0, g_f16BitSys, g_f16BitSys, g_f16BitSys, __LINE__);
2070
2071	/*
2072	* Check that the upper part of ESP is preserved when doing .
2073	*/
2074	if ((g_uBs3CpuDetected & BS3CPU_TYPE_MASK) >= BS3CPU_80386)
2075	{
2076	size_t const cbAltStack = _8K;
2077	uint8_t *pbAltStack = Bs3MemAllocZ(BS3MEMKIND_TILED, cbAltStack);
2078	if (pbAltStack)
2079	{
2080	/* same ring */
2081	g_usBs3TestStep = __LINE__;
2082	Bs3MemCpy(&Ctx2, &Ctx, sizeof(Ctx2));
2083	Ctx2.rsp.u = Bs3SelPtrToFlat(pbAltStack + 0x1980);
2084	if (Bs3TrapSetJmp(&TrapCtx))
2085	Bs3RegCtxRestore(&Ctx2, 0); /* (does not return) */
2086	bs3CpuBasic2_CompareIntCtx1(&TrapCtx, &Ctx2, 0x80 /bXcpt/);
2087	# if TMPL_BITS == 16
2088	if ((pbTmp = (uint8_t *)ASMMemFirstNonZero(pbAltStack, cbAltStack)) != NULL)
2089	bs3CpuBasic2_FailedF("someone touched the alt stack (%p) with SS:ESP=%04x:%#RX32: %p=%02x\n",
2090	pbAltStack, Ctx2.ss, Ctx2.rsp.u32, pbTmp, *pbTmp);
2091	# else
2092	if (ASMMemIsZero(pbAltStack, cbAltStack))
2093	bs3CpuBasic2_FailedF("alt stack wasn't used despite SS:ESP=%04x:%#RX32\n", Ctx2.ss, Ctx2.rsp.u32);
2094	# endif
2095
2096	/* Different rings (load SS0:SP0 from TSS). */
2097	bs3CpuBasic2_TssGateEsp_AltStackOuterRing(&Ctx, 1, pbAltStack, cbAltStack,
2098	g_f16BitSys, g_f16BitSys, g_f16BitSys, __LINE__);
2099	bs3CpuBasic2_TssGateEsp_AltStackOuterRing(&Ctx, 2, pbAltStack, cbAltStack,
2100	g_f16BitSys, g_f16BitSys, g_f16BitSys, __LINE__);
2101	bs3CpuBasic2_TssGateEsp_AltStackOuterRing(&Ctx, 3, pbAltStack, cbAltStack,
2102	g_f16BitSys, g_f16BitSys, g_f16BitSys, __LINE__);
2103
2104	/* Different rings but switch the SS bitness in the TSS. */
2105	if (g_f16BitSys)
2106	{
2107	Bs3Tss16.ss0 = BS3_SEL_R0_SS32;
2108	bs3CpuBasic2_TssGateEsp_AltStackOuterRing(&Ctx, 1, pbAltStack, cbAltStack,
2109	false, g_f16BitSys, g_f16BitSys, __LINE__);
2110	Bs3Tss16.ss0 = BS3_SEL_R0_SS16;
2111	}
2112	else
2113	{
2114	Bs3Tss32.ss0 = BS3_SEL_R0_SS16;
2115	bs3CpuBasic2_TssGateEsp_AltStackOuterRing(&Ctx, 1, pbAltStack, cbAltStack,
2116	true, g_f16BitSys, g_f16BitSys, __LINE__);
2117	Bs3Tss32.ss0 = BS3_SEL_R0_SS32;
2118	}
2119
2120	Bs3MemFree(pbAltStack, cbAltStack);
2121	}
2122	else
2123	Bs3TestPrintf("%s: Skipping ESP check, alloc failed\n", g_pszTestMode);
2124	}
2125	else
2126	Bs3TestPrintf("%s: Skipping ESP check, CPU too old\n", g_pszTestMode);
2127	}
2128
2129	# endif /* ARCH_BITS != 64 */
2130	#endif /* BS3_INSTANTIATING_CMN */
2131
2132
2133	/*
2134	* Mode specific code.
2135	* Mode specific code.
2136	* Mode specific code.
2137	*/
2138	#ifdef BS3_INSTANTIATING_MODE
2139
2140	BS3_DECL_FAR(uint8_t) TMPL_NM(bs3CpuBasic2_TssGateEsp)(uint8_t bMode)
2141	{
2142	uint8_t bRet = 0;
2143
2144	g_pszTestMode = TMPL_NM(g_szBs3ModeName);
2145	g_bTestMode = bMode;
2146	g_f16BitSys = BS3_MODE_IS_16BIT_SYS(TMPL_MODE);
2147
2148	# if TMPL_MODE == BS3_MODE_PE16 \
2149	\|\| TMPL_MODE == BS3_MODE_PE16_32 \
2150	\|\| TMPL_MODE == BS3_MODE_PP16 \
2151	\|\| TMPL_MODE == BS3_MODE_PP16_32 \
2152	\|\| TMPL_MODE == BS3_MODE_PAE16 \
2153	\|\| TMPL_MODE == BS3_MODE_PAE16_32 \
2154	\|\| TMPL_MODE == BS3_MODE_PE32
2155	bs3CpuBasic2_TssGateEspCommon(BS3_MODE_IS_16BIT_SYS(TMPL_MODE),
2156	(PX86DESC)MyBs3Idt,
2157	BS3_MODE_IS_64BIT_SYS(TMPL_MODE) ? 1 : 0);
2158	# else
2159	bRet = BS3TESTDOMODE_SKIPPED;
2160	# endif
2161
2162	/*
2163	* Re-initialize the IDT.
2164	*/
2165	Bs3TrapInit();
2166	return bRet;
2167	}
2168
2169
2170	BS3_DECL_FAR(uint8_t) TMPL_NM(bs3CpuBasic2_RaiseXcpt1)(uint8_t bMode)
2171	{
2172	g_pszTestMode = TMPL_NM(g_szBs3ModeName);
2173	g_bTestMode = bMode;
2174	g_f16BitSys = BS3_MODE_IS_16BIT_SYS(TMPL_MODE);
2175
2176	# if !BS3_MODE_IS_RM_OR_V86(TMPL_MODE)
2177
2178	/*
2179	* Pass to common worker which is only compiled once per mode.
2180	*/
2181	bs3CpuBasic2_RaiseXcpt1Common(MY_SYS_SEL_R0_CS,
2182	MY_SYS_SEL_R0_CS_CNF,
2183	MY_SYS_SEL_R0_SS,
2184	(PX86DESC)MyBs3Idt,
2185	BS3_MODE_IS_64BIT_SYS(TMPL_MODE) ? 1 : 0);
2186
2187	/*
2188	* Re-initialize the IDT.
2189	*/
2190	Bs3TrapInit();
2191	return 0;
2192	# elif TMPL_MODE == BS3_MODE_RM
2193
2194	/*
2195	* Check
2196	*/
2197	/** @todo check */
2198	return BS3TESTDOMODE_SKIPPED;
2199
2200	# else
2201	return BS3TESTDOMODE_SKIPPED;
2202	# endif
2203	}
2204
2205
2206	BS3_DECL_FAR(uint8_t) TMPL_NM(bs3CpuBasic2_iret)(uint8_t bMode)
2207	{
2208	g_pszTestMode = TMPL_NM(g_szBs3ModeName);
2209	g_bTestMode = bMode;
2210	g_f16BitSys = BS3_MODE_IS_16BIT_SYS(TMPL_MODE);
2211
2212	Bs3PrintStrN(RT_STR_TUPLE("Hello world!\n"));
2213	# if !BS3_MODE_IS_V86(TMPL_MODE)
2214	Bs3TestPrintf(RT_STR_TUPLE("Hi there!\n"));
2215	# endif
2216	return BS3TESTDOMODE_SKIPPED;
2217	}
2218
2219
2220	BS3_DECL_FAR(uint8_t) TMPL_NM(bs3CpuBasic2_sidt)(uint8_t bMode)
2221	{
2222	//if (bMode == BS3_MODE_LM64)
2223	{
2224	union
2225	{
2226	RTIDTR Idtr;
2227	uint8_t ab[16];
2228	} Expected;
2229
2230	g_pszTestMode = TMPL_NM(g_szBs3ModeName);
2231	g_bTestMode = bMode;
2232	g_f16BitSys = BS3_MODE_IS_16BIT_SYS(TMPL_MODE);
2233
2234	BS3_ASSERT(bMode == TMPL_MODE);
2235
2236	/*
2237	* Pass to common worker which is only compiled once per mode.
2238	*/
2239	Bs3MemZero(&Expected, sizeof(Expected));
2240	ASMGetIDTR(&Expected.Idtr);
2241	bs3CpuBasic2_sidt_sgdt_Common(bMode, g_aSidtWorkers, RT_ELEMENTS(g_aSidtWorkers), Expected.ab);
2242
2243	/*
2244	* Re-initialize the IDT.
2245	*/
2246	Bs3TrapInit();
2247	}
2248
2249	return 0;
2250	}
2251
2252
2253	BS3_DECL_FAR(uint8_t) TMPL_NM(bs3CpuBasic2_sgdt)(uint8_t bMode)
2254	{
2255	//if (bMode == BS3_MODE_LM64)
2256	{
2257	union
2258	{
2259	RTGDTR Gdtr;
2260	uint8_t ab[16];
2261	} Expected;
2262
2263	g_pszTestMode = TMPL_NM(g_szBs3ModeName);
2264	g_bTestMode = bMode;
2265	g_f16BitSys = BS3_MODE_IS_16BIT_SYS(TMPL_MODE);
2266
2267	BS3_ASSERT(bMode == TMPL_MODE);
2268
2269	/*
2270	* Pass to common worker which is only compiled once per mode.
2271	*/
2272	Bs3MemZero(&Expected, sizeof(Expected));
2273	ASMGetGDTR(&Expected.Gdtr);
2274	bs3CpuBasic2_sidt_sgdt_Common(bMode, g_aSgdtWorkers, RT_ELEMENTS(g_aSgdtWorkers), Expected.ab);
2275
2276	/*
2277	* Re-initialize the IDT.
2278	*/
2279	Bs3TrapInit();
2280	}
2281	return 0;
2282	}
2283
2284	#endif /* BS3_INSTANTIATING_MODE */
2285

Note: See TracBrowser for help on using the repository browser.

source: vbox/trunk/src/VBox/ValidationKit/bootsectors/bs3-cpu-basic-2-template.c@ 60682

Download in other formats: