bs3-cpu-basic-2-x0.c@ 88216

Last change on this file since 88216 was 82968, checked in by vboxsync, 5 years ago
Copyright year updates by scm.
Property svn:eol-style set to `native` Property svn:keywords set to `Author Date Id Revision`
File size: 148.9 KB

Line
1	/* $Id: bs3-cpu-basic-2-x0.c 82968 2020-02-04 10:35:17Z vboxsync $ */
2	/** @file
3	* BS3Kit - bs3-cpu-basic-2, C test driver code (16-bit).
4	*/
5
6	/*
7	* Copyright (C) 2007-2020 Oracle Corporation
8	*
9	* This file is part of VirtualBox Open Source Edition (OSE), as
10	* available from http://www.virtualbox.org. This file is free software;
11	* you can redistribute it and/or modify it under the terms of the GNU
12	* General Public License (GPL) as published by the Free Software
13	* Foundation, in version 2 as it comes in the "COPYING" file of the
14	* VirtualBox OSE distribution. VirtualBox OSE is distributed in the
15	* hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
16	*
17	* The contents of this file may alternatively be used under the terms
18	* of the Common Development and Distribution License Version 1.0
19	* (CDDL) only, as it comes in the "COPYING.CDDL" file of the
20	* VirtualBox OSE distribution, in which case the provisions of the
21	* CDDL are applicable instead of those of the GPL.
22	*
23	* You may elect to license modified versions of this file under the
24	* terms and conditions of either the GPL or the CDDL or both.
25	*/
26
27
28	/*********************************************************************************************************************************
29	* Header Files *
30	*********************************************************************************************************************************/
31	#define BS3_USE_X0_TEXT_SEG
32	#include <bs3kit.h>
33	#include <iprt/asm.h>
34	#include <iprt/asm-amd64-x86.h>
35
36
37	/*********************************************************************************************************************************
38	* Defined Constants And Macros *
39	*********************************************************************************************************************************/
40	#undef CHECK_MEMBER
41	#define CHECK_MEMBER(a_szName, a_szFmt, a_Actual, a_Expected) \
42	do \
43	{ \
44	if ((a_Actual) == (a_Expected)) { /* likely */ } \
45	else bs3CpuBasic2_FailedF(a_szName "=" a_szFmt " expected " a_szFmt, (a_Actual), (a_Expected)); \
46	} while (0)
47
48
49	/** Indicating that we've got operand size prefix and that it matters. */
50	#define BS3CB2SIDTSGDT_F_OPSIZE UINT8_C(0x01)
51	/** Worker requires 386 or later. */
52	#define BS3CB2SIDTSGDT_F_386PLUS UINT8_C(0x02)
53
54
55	/*********************************************************************************************************************************
56	* Structures and Typedefs *
57	*********************************************************************************************************************************/
58	typedef struct BS3CB2INVLDESCTYPE
59	{
60	uint8_t u4Type;
61	uint8_t u1DescType;
62	} BS3CB2INVLDESCTYPE;
63
64	typedef struct BS3CB2SIDTSGDT
65	{
66	const char *pszDesc;
67	FPFNBS3FAR fpfnWorker;
68	uint8_t cbInstr;
69	bool fSs;
70	uint8_t bMode;
71	uint8_t fFlags;
72	} BS3CB2SIDTSGDT;
73
74
75	/*********************************************************************************************************************************
76	* External Symbols *
77	*********************************************************************************************************************************/
78	extern FNBS3FAR bs3CpuBasic2_Int80;
79	extern FNBS3FAR bs3CpuBasic2_Int81;
80	extern FNBS3FAR bs3CpuBasic2_Int82;
81	extern FNBS3FAR bs3CpuBasic2_Int83;
82
83	extern FNBS3FAR bs3CpuBasic2_ud2;
84	#define g_bs3CpuBasic2_ud2_FlatAddr BS3_DATA_NM(g_bs3CpuBasic2_ud2_FlatAddr)
85	extern uint32_t g_bs3CpuBasic2_ud2_FlatAddr;
86
87	extern FNBS3FAR bs3CpuBasic2_iret;
88	extern FNBS3FAR bs3CpuBasic2_iret_opsize;
89	extern FNBS3FAR bs3CpuBasic2_iret_rexw;
90
91	extern FNBS3FAR bs3CpuBasic2_sidt_bx_ud2_c16;
92	extern FNBS3FAR bs3CpuBasic2_sidt_bx_ud2_c32;
93	extern FNBS3FAR bs3CpuBasic2_sidt_bx_ud2_c64;
94	extern FNBS3FAR bs3CpuBasic2_sidt_ss_bx_ud2_c16;
95	extern FNBS3FAR bs3CpuBasic2_sidt_ss_bx_ud2_c32;
96	extern FNBS3FAR bs3CpuBasic2_sidt_rexw_bx_ud2_c64;
97	extern FNBS3FAR bs3CpuBasic2_sidt_opsize_bx_ud2_c16;
98	extern FNBS3FAR bs3CpuBasic2_sidt_opsize_bx_ud2_c32;
99	extern FNBS3FAR bs3CpuBasic2_sidt_opsize_bx_ud2_c64;
100	extern FNBS3FAR bs3CpuBasic2_sidt_opsize_ss_bx_ud2_c16;
101	extern FNBS3FAR bs3CpuBasic2_sidt_opsize_ss_bx_ud2_c32;
102	extern FNBS3FAR bs3CpuBasic2_sidt_opsize_rexw_bx_ud2_c64;
103
104	extern FNBS3FAR bs3CpuBasic2_sgdt_bx_ud2_c16;
105	extern FNBS3FAR bs3CpuBasic2_sgdt_bx_ud2_c32;
106	extern FNBS3FAR bs3CpuBasic2_sgdt_bx_ud2_c64;
107	extern FNBS3FAR bs3CpuBasic2_sgdt_ss_bx_ud2_c16;
108	extern FNBS3FAR bs3CpuBasic2_sgdt_ss_bx_ud2_c32;
109	extern FNBS3FAR bs3CpuBasic2_sgdt_rexw_bx_ud2_c64;
110	extern FNBS3FAR bs3CpuBasic2_sgdt_opsize_bx_ud2_c16;
111	extern FNBS3FAR bs3CpuBasic2_sgdt_opsize_bx_ud2_c32;
112	extern FNBS3FAR bs3CpuBasic2_sgdt_opsize_bx_ud2_c64;
113	extern FNBS3FAR bs3CpuBasic2_sgdt_opsize_ss_bx_ud2_c16;
114	extern FNBS3FAR bs3CpuBasic2_sgdt_opsize_ss_bx_ud2_c32;
115	extern FNBS3FAR bs3CpuBasic2_sgdt_opsize_rexw_bx_ud2_c64;
116
117	extern FNBS3FAR bs3CpuBasic2_lidt_bx__sidt_es_di__lidt_es_si__ud2_c16;
118	extern FNBS3FAR bs3CpuBasic2_lidt_bx__sidt_es_di__lidt_es_si__ud2_c32;
119	extern FNBS3FAR bs3CpuBasic2_lidt_bx__sidt_es_di__lidt_es_si__ud2_c64;
120	extern FNBS3FAR bs3CpuBasic2_lidt_ss_bx__sidt_es_di__lidt_es_si__ud2_c16;
121	extern FNBS3FAR bs3CpuBasic2_lidt_ss_bx__sidt_es_di__lidt_es_si__ud2_c32;
122	extern FNBS3FAR bs3CpuBasic2_lidt_rexw_bx__sidt_es_di__lidt_es_si__ud2_c64;
123	extern FNBS3FAR bs3CpuBasic2_lidt_opsize_bx__sidt_es_di__lidt_es_si__ud2_c16;
124	extern FNBS3FAR bs3CpuBasic2_lidt_opsize_bx__sidt32_es_di__lidt_es_si__ud2_c16;
125	extern FNBS3FAR bs3CpuBasic2_lidt_opsize_bx__sidt_es_di__lidt_es_si__ud2_c32;
126	extern FNBS3FAR bs3CpuBasic2_lidt_opsize_bx__sidt_es_di__lidt_es_si__ud2_c64;
127	extern FNBS3FAR bs3CpuBasic2_lidt_opsize_ss_bx__sidt_es_di__lidt_es_si__ud2_c16;
128	extern FNBS3FAR bs3CpuBasic2_lidt_opsize_ss_bx__sidt_es_di__lidt_es_si__ud2_c32;
129	extern FNBS3FAR bs3CpuBasic2_lidt_opsize_rexw_bx__sidt_es_di__lidt_es_si__ud2_c64;
130
131	extern FNBS3FAR bs3CpuBasic2_lgdt_bx__sgdt_es_di__lgdt_es_si__ud2_c16;
132	extern FNBS3FAR bs3CpuBasic2_lgdt_bx__sgdt_es_di__lgdt_es_si__ud2_c32;
133	extern FNBS3FAR bs3CpuBasic2_lgdt_bx__sgdt_es_di__lgdt_es_si__ud2_c64;
134	extern FNBS3FAR bs3CpuBasic2_lgdt_ss_bx__sgdt_es_di__lgdt_es_si__ud2_c16;
135	extern FNBS3FAR bs3CpuBasic2_lgdt_ss_bx__sgdt_es_di__lgdt_es_si__ud2_c32;
136	extern FNBS3FAR bs3CpuBasic2_lgdt_rexw_bx__sgdt_es_di__lgdt_es_si__ud2_c64;
137	extern FNBS3FAR bs3CpuBasic2_lgdt_opsize_bx__sgdt_es_di__lgdt_es_si__ud2_c16;
138	extern FNBS3FAR bs3CpuBasic2_lgdt_opsize_bx__sgdt_es_di__lgdt_es_si__ud2_c32;
139	extern FNBS3FAR bs3CpuBasic2_lgdt_opsize_bx__sgdt_es_di__lgdt_es_si__ud2_c64;
140	extern FNBS3FAR bs3CpuBasic2_lgdt_opsize_ss_bx__sgdt_es_di__lgdt_es_si__ud2_c16;
141	extern FNBS3FAR bs3CpuBasic2_lgdt_opsize_ss_bx__sgdt_es_di__lgdt_es_si__ud2_c32;
142	extern FNBS3FAR bs3CpuBasic2_lgdt_opsize_rexw_bx__sgdt_es_di__lgdt_es_si__ud2_c64;
143
144
145
146	/*********************************************************************************************************************************
147	* Global Variables *
148	*********************************************************************************************************************************/
149	static const char BS3_FAR g_pszTestMode = (const char )1;
150	static uint8_t g_bTestMode = 1;
151	static bool g_f16BitSys = 1;
152
153
154	/** SIDT test workers. */
155	static BS3CB2SIDTSGDT const g_aSidtWorkers[] =
156	{
157	{ "sidt [bx]", bs3CpuBasic2_sidt_bx_ud2_c16, 3, false, BS3_MODE_CODE_16 \| BS3_MODE_CODE_V86, 0 },
158	{ "sidt [ss:bx]", bs3CpuBasic2_sidt_ss_bx_ud2_c16, 4, true, BS3_MODE_CODE_16 \| BS3_MODE_CODE_V86, 0 },
159	{ "o32 sidt [bx]", bs3CpuBasic2_sidt_opsize_bx_ud2_c16, 4, false, BS3_MODE_CODE_16 \| BS3_MODE_CODE_V86, BS3CB2SIDTSGDT_F_386PLUS },
160	{ "o32 sidt [ss:bx]", bs3CpuBasic2_sidt_opsize_ss_bx_ud2_c16, 5, true, BS3_MODE_CODE_16 \| BS3_MODE_CODE_V86, BS3CB2SIDTSGDT_F_386PLUS },
161	{ "sidt [ebx]", bs3CpuBasic2_sidt_bx_ud2_c32, 3, false, BS3_MODE_CODE_32, 0 },
162	{ "sidt [ss:ebx]", bs3CpuBasic2_sidt_ss_bx_ud2_c32, 4, true, BS3_MODE_CODE_32, 0 },
163	{ "o16 sidt [ebx]", bs3CpuBasic2_sidt_opsize_bx_ud2_c32, 4, false, BS3_MODE_CODE_32, 0 },
164	{ "o16 sidt [ss:ebx]", bs3CpuBasic2_sidt_opsize_ss_bx_ud2_c32, 5, true, BS3_MODE_CODE_32, 0 },
165	{ "sidt [rbx]", bs3CpuBasic2_sidt_bx_ud2_c64, 3, false, BS3_MODE_CODE_64, 0 },
166	{ "o64 sidt [rbx]", bs3CpuBasic2_sidt_rexw_bx_ud2_c64, 4, false, BS3_MODE_CODE_64, 0 },
167	{ "o32 sidt [rbx]", bs3CpuBasic2_sidt_opsize_bx_ud2_c64, 4, false, BS3_MODE_CODE_64, 0 },
168	{ "o32 o64 sidt [rbx]", bs3CpuBasic2_sidt_opsize_rexw_bx_ud2_c64, 5, false, BS3_MODE_CODE_64, 0 },
169	};
170
171	/** SGDT test workers. */
172	static BS3CB2SIDTSGDT const g_aSgdtWorkers[] =
173	{
174	{ "sgdt [bx]", bs3CpuBasic2_sgdt_bx_ud2_c16, 3, false, BS3_MODE_CODE_16 \| BS3_MODE_CODE_V86, 0 },
175	{ "sgdt [ss:bx]", bs3CpuBasic2_sgdt_ss_bx_ud2_c16, 4, true, BS3_MODE_CODE_16 \| BS3_MODE_CODE_V86, 0 },
176	{ "o32 sgdt [bx]", bs3CpuBasic2_sgdt_opsize_bx_ud2_c16, 4, false, BS3_MODE_CODE_16 \| BS3_MODE_CODE_V86, BS3CB2SIDTSGDT_F_386PLUS },
177	{ "o32 sgdt [ss:bx]", bs3CpuBasic2_sgdt_opsize_ss_bx_ud2_c16, 5, true, BS3_MODE_CODE_16 \| BS3_MODE_CODE_V86, BS3CB2SIDTSGDT_F_386PLUS },
178	{ "sgdt [ebx]", bs3CpuBasic2_sgdt_bx_ud2_c32, 3, false, BS3_MODE_CODE_32, 0 },
179	{ "sgdt [ss:ebx]", bs3CpuBasic2_sgdt_ss_bx_ud2_c32, 4, true, BS3_MODE_CODE_32, 0 },
180	{ "o16 sgdt [ebx]", bs3CpuBasic2_sgdt_opsize_bx_ud2_c32, 4, false, BS3_MODE_CODE_32, 0 },
181	{ "o16 sgdt [ss:ebx]", bs3CpuBasic2_sgdt_opsize_ss_bx_ud2_c32, 5, true, BS3_MODE_CODE_32, 0 },
182	{ "sgdt [rbx]", bs3CpuBasic2_sgdt_bx_ud2_c64, 3, false, BS3_MODE_CODE_64, 0 },
183	{ "o64 sgdt [rbx]", bs3CpuBasic2_sgdt_rexw_bx_ud2_c64, 4, false, BS3_MODE_CODE_64, 0 },
184	{ "o32 sgdt [rbx]", bs3CpuBasic2_sgdt_opsize_bx_ud2_c64, 4, false, BS3_MODE_CODE_64, 0 },
185	{ "o32 o64 sgdt [rbx]", bs3CpuBasic2_sgdt_opsize_rexw_bx_ud2_c64, 5, false, BS3_MODE_CODE_64, 0 },
186	};
187
188	/** LIDT test workers. */
189	static BS3CB2SIDTSGDT const g_aLidtWorkers[] =
190	{
191	{ "lidt [bx]", bs3CpuBasic2_lidt_bx__sidt_es_di__lidt_es_si__ud2_c16, 11, false, BS3_MODE_CODE_16 \| BS3_MODE_CODE_V86, 0 },
192	{ "lidt [ss:bx]", bs3CpuBasic2_lidt_ss_bx__sidt_es_di__lidt_es_si__ud2_c16, 12, true, BS3_MODE_CODE_16 \| BS3_MODE_CODE_V86, 0 },
193	{ "o32 lidt [bx]", bs3CpuBasic2_lidt_opsize_bx__sidt_es_di__lidt_es_si__ud2_c16, 12, false, BS3_MODE_CODE_16 \| BS3_MODE_CODE_V86, BS3CB2SIDTSGDT_F_OPSIZE \| BS3CB2SIDTSGDT_F_386PLUS },
194	{ "o32 lidt [bx]; sidt32", bs3CpuBasic2_lidt_opsize_bx__sidt32_es_di__lidt_es_si__ud2_c16, 27, false, BS3_MODE_CODE_16 \| BS3_MODE_CODE_V86, BS3CB2SIDTSGDT_F_OPSIZE \| BS3CB2SIDTSGDT_F_386PLUS },
195	{ "o32 lidt [ss:bx]", bs3CpuBasic2_lidt_opsize_ss_bx__sidt_es_di__lidt_es_si__ud2_c16, 13, true, BS3_MODE_CODE_16 \| BS3_MODE_CODE_V86, BS3CB2SIDTSGDT_F_OPSIZE \| BS3CB2SIDTSGDT_F_386PLUS },
196	{ "lidt [ebx]", bs3CpuBasic2_lidt_bx__sidt_es_di__lidt_es_si__ud2_c32, 11, false, BS3_MODE_CODE_32, 0 },
197	{ "lidt [ss:ebx]", bs3CpuBasic2_lidt_ss_bx__sidt_es_di__lidt_es_si__ud2_c32, 12, true, BS3_MODE_CODE_32, 0 },
198	{ "o16 lidt [ebx]", bs3CpuBasic2_lidt_opsize_bx__sidt_es_di__lidt_es_si__ud2_c32, 12, false, BS3_MODE_CODE_32, BS3CB2SIDTSGDT_F_OPSIZE },
199	{ "o16 lidt [ss:ebx]", bs3CpuBasic2_lidt_opsize_ss_bx__sidt_es_di__lidt_es_si__ud2_c32, 13, true, BS3_MODE_CODE_32, BS3CB2SIDTSGDT_F_OPSIZE },
200	{ "lidt [rbx]", bs3CpuBasic2_lidt_bx__sidt_es_di__lidt_es_si__ud2_c64, 9, false, BS3_MODE_CODE_64, 0 },
201	{ "o64 lidt [rbx]", bs3CpuBasic2_lidt_rexw_bx__sidt_es_di__lidt_es_si__ud2_c64, 10, false, BS3_MODE_CODE_64, 0 },
202	{ "o32 lidt [rbx]", bs3CpuBasic2_lidt_opsize_bx__sidt_es_di__lidt_es_si__ud2_c64, 10, false, BS3_MODE_CODE_64, 0 },
203	{ "o32 o64 lidt [rbx]", bs3CpuBasic2_lidt_opsize_rexw_bx__sidt_es_di__lidt_es_si__ud2_c64, 11, false, BS3_MODE_CODE_64, 0 },
204	};
205
206	/** LGDT test workers. */
207	static BS3CB2SIDTSGDT const g_aLgdtWorkers[] =
208	{
209	{ "lgdt [bx]", bs3CpuBasic2_lgdt_bx__sgdt_es_di__lgdt_es_si__ud2_c16, 11, false, BS3_MODE_CODE_16 \| BS3_MODE_CODE_V86, 0 },
210	{ "lgdt [ss:bx]", bs3CpuBasic2_lgdt_ss_bx__sgdt_es_di__lgdt_es_si__ud2_c16, 12, true, BS3_MODE_CODE_16 \| BS3_MODE_CODE_V86, 0 },
211	{ "o32 lgdt [bx]", bs3CpuBasic2_lgdt_opsize_bx__sgdt_es_di__lgdt_es_si__ud2_c16, 12, false, BS3_MODE_CODE_16 \| BS3_MODE_CODE_V86, BS3CB2SIDTSGDT_F_OPSIZE \| BS3CB2SIDTSGDT_F_386PLUS },
212	{ "o32 lgdt [ss:bx]", bs3CpuBasic2_lgdt_opsize_ss_bx__sgdt_es_di__lgdt_es_si__ud2_c16, 13, true, BS3_MODE_CODE_16 \| BS3_MODE_CODE_V86, BS3CB2SIDTSGDT_F_OPSIZE \| BS3CB2SIDTSGDT_F_386PLUS },
213	{ "lgdt [ebx]", bs3CpuBasic2_lgdt_bx__sgdt_es_di__lgdt_es_si__ud2_c32, 11, false, BS3_MODE_CODE_32, 0 },
214	{ "lgdt [ss:ebx]", bs3CpuBasic2_lgdt_ss_bx__sgdt_es_di__lgdt_es_si__ud2_c32, 12, true, BS3_MODE_CODE_32, 0 },
215	{ "o16 lgdt [ebx]", bs3CpuBasic2_lgdt_opsize_bx__sgdt_es_di__lgdt_es_si__ud2_c32, 12, false, BS3_MODE_CODE_32, BS3CB2SIDTSGDT_F_OPSIZE },
216	{ "o16 lgdt [ss:ebx]", bs3CpuBasic2_lgdt_opsize_ss_bx__sgdt_es_di__lgdt_es_si__ud2_c32, 13, true, BS3_MODE_CODE_32, BS3CB2SIDTSGDT_F_OPSIZE },
217	{ "lgdt [rbx]", bs3CpuBasic2_lgdt_bx__sgdt_es_di__lgdt_es_si__ud2_c64, 9, false, BS3_MODE_CODE_64, 0 },
218	{ "o64 lgdt [rbx]", bs3CpuBasic2_lgdt_rexw_bx__sgdt_es_di__lgdt_es_si__ud2_c64, 10, false, BS3_MODE_CODE_64, 0 },
219	{ "o32 lgdt [rbx]", bs3CpuBasic2_lgdt_opsize_bx__sgdt_es_di__lgdt_es_si__ud2_c64, 10, false, BS3_MODE_CODE_64, 0 },
220	{ "o32 o64 lgdt [rbx]", bs3CpuBasic2_lgdt_opsize_rexw_bx__sgdt_es_di__lgdt_es_si__ud2_c64, 11, false, BS3_MODE_CODE_64, 0 },
221	};
222
223
224
225	#if 0
226	/** Table containing invalid CS selector types. */
227	static const BS3CB2INVLDESCTYPE g_aInvalidCsTypes[] =
228	{
229	{ X86_SEL_TYPE_RO, 1 },
230	{ X86_SEL_TYPE_RO_ACC, 1 },
231	{ X86_SEL_TYPE_RW, 1 },
232	{ X86_SEL_TYPE_RW_ACC, 1 },
233	{ X86_SEL_TYPE_RO_DOWN, 1 },
234	{ X86_SEL_TYPE_RO_DOWN_ACC, 1 },
235	{ X86_SEL_TYPE_RW_DOWN, 1 },
236	{ X86_SEL_TYPE_RW_DOWN_ACC, 1 },
237	{ 0, 0 },
238	{ 1, 0 },
239	{ 2, 0 },
240	{ 3, 0 },
241	{ 4, 0 },
242	{ 5, 0 },
243	{ 6, 0 },
244	{ 7, 0 },
245	{ 8, 0 },
246	{ 9, 0 },
247	{ 10, 0 },
248	{ 11, 0 },
249	{ 12, 0 },
250	{ 13, 0 },
251	{ 14, 0 },
252	{ 15, 0 },
253	};
254
255	/** Table containing invalid SS selector types. */
256	static const BS3CB2INVLDESCTYPE g_aInvalidSsTypes[] =
257	{
258	{ X86_SEL_TYPE_EO, 1 },
259	{ X86_SEL_TYPE_EO_ACC, 1 },
260	{ X86_SEL_TYPE_ER, 1 },
261	{ X86_SEL_TYPE_ER_ACC, 1 },
262	{ X86_SEL_TYPE_EO_CONF, 1 },
263	{ X86_SEL_TYPE_EO_CONF_ACC, 1 },
264	{ X86_SEL_TYPE_ER_CONF, 1 },
265	{ X86_SEL_TYPE_ER_CONF_ACC, 1 },
266	{ 0, 0 },
267	{ 1, 0 },
268	{ 2, 0 },
269	{ 3, 0 },
270	{ 4, 0 },
271	{ 5, 0 },
272	{ 6, 0 },
273	{ 7, 0 },
274	{ 8, 0 },
275	{ 9, 0 },
276	{ 10, 0 },
277	{ 11, 0 },
278	{ 12, 0 },
279	{ 13, 0 },
280	{ 14, 0 },
281	{ 15, 0 },
282	};
283	#endif
284
285
286	/**
287	* Sets globals according to the mode.
288	*
289	* @param bTestMode The test mode.
290	*/
291	static void bs3CpuBasic2_SetGlobals(uint8_t bTestMode)
292	{
293	g_bTestMode = bTestMode;
294	g_pszTestMode = Bs3GetModeName(bTestMode);
295	g_f16BitSys = BS3_MODE_IS_16BIT_SYS(bTestMode);
296	g_usBs3TestStep = 0;
297	}
298
299
300	/**
301	* Wrapper around Bs3TestFailedF that prefixes the error with g_usBs3TestStep
302	* and g_pszTestMode.
303	*/
304	static void bs3CpuBasic2_FailedF(const char *pszFormat, ...)
305	{
306	va_list va;
307
308	char szTmp[168];
309	va_start(va, pszFormat);
310	Bs3StrPrintfV(szTmp, sizeof(szTmp), pszFormat, va);
311	va_end(va);
312
313	Bs3TestFailedF("%u - %s: %s", g_usBs3TestStep, g_pszTestMode, szTmp);
314	}
315
316
317	#if 0
318	/**
319	* Compares trap stuff.
320	*/
321	static void bs3CpuBasic2_CompareIntCtx1(PCBS3TRAPFRAME pTrapCtx, PCBS3REGCTX pStartCtx, uint8_t bXcpt)
322	{
323	uint16_t const cErrorsBefore = Bs3TestSubErrorCount();
324	CHECK_MEMBER("bXcpt", "%#04x", pTrapCtx->bXcpt, bXcpt);
325	CHECK_MEMBER("bErrCd", "%#06RX64", pTrapCtx->uErrCd, 0);
326	Bs3TestCheckRegCtxEx(&pTrapCtx->Ctx, pStartCtx, 2 /int xx/, 0 /cbSpAdjust/, 0 /fExtraEfl/, g_pszTestMode, g_usBs3TestStep);
327	if (Bs3TestSubErrorCount() != cErrorsBefore)
328	{
329	Bs3TrapPrintFrame(pTrapCtx);
330	#if 1
331	Bs3TestPrintf("Halting: g_uBs3CpuDetected=%#x\n", g_uBs3CpuDetected);
332	Bs3TestPrintf("Halting in CompareTrapCtx1: bXcpt=%#x\n", bXcpt);
333	ASMHalt();
334	#endif
335	}
336	}
337	#endif
338
339
340	#if 0
341	/**
342	* Compares trap stuff.
343	*/
344	static void bs3CpuBasic2_CompareTrapCtx2(PCBS3TRAPFRAME pTrapCtx, PCBS3REGCTX pStartCtx, uint16_t cbIpAdjust,
345	uint8_t bXcpt, uint16_t uHandlerCs)
346	{
347	uint16_t const cErrorsBefore = Bs3TestSubErrorCount();
348	CHECK_MEMBER("bXcpt", "%#04x", pTrapCtx->bXcpt, bXcpt);
349	CHECK_MEMBER("bErrCd", "%#06RX64", pTrapCtx->uErrCd, 0);
350	CHECK_MEMBER("uHandlerCs", "%#06x", pTrapCtx->uHandlerCs, uHandlerCs);
351	Bs3TestCheckRegCtxEx(&pTrapCtx->Ctx, pStartCtx, cbIpAdjust, 0 /cbSpAdjust/, 0 /fExtraEfl/, g_pszTestMode, g_usBs3TestStep);
352	if (Bs3TestSubErrorCount() != cErrorsBefore)
353	{
354	Bs3TrapPrintFrame(pTrapCtx);
355	#if 1
356	Bs3TestPrintf("Halting: g_uBs3CpuDetected=%#x\n", g_uBs3CpuDetected);
357	Bs3TestPrintf("Halting in CompareTrapCtx2: bXcpt=%#x\n", bXcpt);
358	ASMHalt();
359	#endif
360	}
361	}
362	#endif
363
364	/**
365	* Compares a CPU trap.
366	*/
367	static void bs3CpuBasic2_CompareCpuTrapCtx(PCBS3TRAPFRAME pTrapCtx, PCBS3REGCTX pStartCtx, uint16_t uErrCd,
368	uint8_t bXcpt, bool f486ResumeFlagHint)
369	{
370	uint16_t const cErrorsBefore = Bs3TestSubErrorCount();
371	uint32_t fExtraEfl;
372
373	CHECK_MEMBER("bXcpt", "%#04x", pTrapCtx->bXcpt, bXcpt);
374	CHECK_MEMBER("bErrCd", "%#06RX16", (uint16_t)pTrapCtx->uErrCd, (uint16_t)uErrCd); /* 486 only writes a word */
375
376	fExtraEfl = X86_EFL_RF;
377	if ( g_f16BitSys
378	\|\| ( !f486ResumeFlagHint
379	&& (g_uBs3CpuDetected & BS3CPU_TYPE_MASK) <= BS3CPU_80486 ) )
380	fExtraEfl = 0;
381	else
382	fExtraEfl = X86_EFL_RF;
383	#if 0 /** @todo Running on an AMD Phenom II X6 1100T under AMD-V I'm not getting good X86_EFL_RF results. Enable this to get on with other work. */
384	fExtraEfl = pTrapCtx->Ctx.rflags.u32 & X86_EFL_RF;
385	#endif
386	Bs3TestCheckRegCtxEx(&pTrapCtx->Ctx, pStartCtx, 0 /cbIpAdjust/, 0 /cbSpAdjust/, fExtraEfl, g_pszTestMode, g_usBs3TestStep);
387	if (Bs3TestSubErrorCount() != cErrorsBefore)
388	{
389	Bs3TrapPrintFrame(pTrapCtx);
390	#if 1
391	Bs3TestPrintf("Halting: g_uBs3CpuDetected=%#x\n", g_uBs3CpuDetected);
392	Bs3TestPrintf("Halting: bXcpt=%#x uErrCd=%#x\n", bXcpt, uErrCd);
393	ASMHalt();
394	#endif
395	}
396	}
397
398
399	/**
400	* Compares \#GP trap.
401	*/
402	static void bs3CpuBasic2_CompareGpCtx(PCBS3TRAPFRAME pTrapCtx, PCBS3REGCTX pStartCtx, uint16_t uErrCd)
403	{
404	bs3CpuBasic2_CompareCpuTrapCtx(pTrapCtx, pStartCtx, uErrCd, X86_XCPT_GP, true /f486ResumeFlagHint/);
405	}
406
407	#if 0
408	/**
409	* Compares \#NP trap.
410	*/
411	static void bs3CpuBasic2_CompareNpCtx(PCBS3TRAPFRAME pTrapCtx, PCBS3REGCTX pStartCtx, uint16_t uErrCd)
412	{
413	bs3CpuBasic2_CompareCpuTrapCtx(pTrapCtx, pStartCtx, uErrCd, X86_XCPT_NP, true /f486ResumeFlagHint/);
414	}
415	#endif
416
417	/**
418	* Compares \#SS trap.
419	*/
420	static void bs3CpuBasic2_CompareSsCtx(PCBS3TRAPFRAME pTrapCtx, PCBS3REGCTX pStartCtx, uint16_t uErrCd, bool f486ResumeFlagHint)
421	{
422	bs3CpuBasic2_CompareCpuTrapCtx(pTrapCtx, pStartCtx, uErrCd, X86_XCPT_SS, f486ResumeFlagHint);
423	}
424
425	#if 0
426	/**
427	* Compares \#TS trap.
428	*/
429	static void bs3CpuBasic2_CompareTsCtx(PCBS3TRAPFRAME pTrapCtx, PCBS3REGCTX pStartCtx, uint16_t uErrCd)
430	{
431	bs3CpuBasic2_CompareCpuTrapCtx(pTrapCtx, pStartCtx, uErrCd, X86_XCPT_TS, false /f486ResumeFlagHint/);
432	}
433	#endif
434
435	/**
436	* Compares \#PF trap.
437	*/
438	static void bs3CpuBasic2_ComparePfCtx(PCBS3TRAPFRAME pTrapCtx, PBS3REGCTX pStartCtx, uint16_t uErrCd, uint64_t uCr2Expected)
439	{
440	uint64_t const uCr2Saved = pStartCtx->cr2.u;
441	pStartCtx->cr2.u = uCr2Expected;
442	bs3CpuBasic2_CompareCpuTrapCtx(pTrapCtx, pStartCtx, uErrCd, X86_XCPT_PF, true /f486ResumeFlagHint/);
443	pStartCtx->cr2.u = uCr2Saved;
444	}
445
446	/**
447	* Compares \#UD trap.
448	*/
449	static void bs3CpuBasic2_CompareUdCtx(PCBS3TRAPFRAME pTrapCtx, PCBS3REGCTX pStartCtx)
450	{
451	bs3CpuBasic2_CompareCpuTrapCtx(pTrapCtx, pStartCtx, 0 /no error code/, X86_XCPT_UD, true /f486ResumeFlagHint/);
452	}
453
454
455	#if 0 /* convert me */
456	static void bs3CpuBasic2_RaiseXcpt1Common(uint16_t const uSysR0Cs, uint16_t const uSysR0CsConf, uint16_t const uSysR0Ss,
457	PX86DESC const paIdt, unsigned const cIdteShift)
458	{
459	BS3TRAPFRAME TrapCtx;
460	BS3REGCTX Ctx80;
461	BS3REGCTX Ctx81;
462	BS3REGCTX Ctx82;
463	BS3REGCTX Ctx83;
464	BS3REGCTX CtxTmp;
465	BS3REGCTX CtxTmp2;
466	PBS3REGCTX apCtx8x[4];
467	unsigned iCtx;
468	unsigned iRing;
469	unsigned iDpl;
470	unsigned iRpl;
471	unsigned i, j, k;
472	uint32_t uExpected;
473	bool const f486Plus = (g_uBs3CpuDetected & BS3CPU_TYPE_MASK) >= BS3CPU_80486;
474	# if TMPL_BITS == 16
475	bool const f386Plus = (g_uBs3CpuDetected & BS3CPU_TYPE_MASK) >= BS3CPU_80386;
476	bool const f286 = (g_uBs3CpuDetected & BS3CPU_TYPE_MASK) == BS3CPU_80286;
477	# else
478	bool const f286 = false;
479	bool const f386Plus = true;
480	int rc;
481	uint8_t *pbIdtCopyAlloc;
482	PX86DESC pIdtCopy;
483	const unsigned cbIdte = 1 << (3 + cIdteShift);
484	RTCCUINTXREG uCr0Saved = ASMGetCR0();
485	RTGDTR GdtrSaved;
486	# endif
487	RTIDTR IdtrSaved;
488	RTIDTR Idtr;
489
490	ASMGetIDTR(&IdtrSaved);
491	# if TMPL_BITS != 16
492	ASMGetGDTR(&GdtrSaved);
493	# endif
494
495	/* make sure they're allocated */
496	Bs3MemZero(&TrapCtx, sizeof(TrapCtx));
497	Bs3MemZero(&Ctx80, sizeof(Ctx80));
498	Bs3MemZero(&Ctx81, sizeof(Ctx81));
499	Bs3MemZero(&Ctx82, sizeof(Ctx82));
500	Bs3MemZero(&Ctx83, sizeof(Ctx83));
501	Bs3MemZero(&CtxTmp, sizeof(CtxTmp));
502	Bs3MemZero(&CtxTmp2, sizeof(CtxTmp2));
503
504	/* Context array. */
505	apCtx8x[0] = &Ctx80;
506	apCtx8x[1] = &Ctx81;
507	apCtx8x[2] = &Ctx82;
508	apCtx8x[3] = &Ctx83;
509
510	# if TMPL_BITS != 16
511	/* Allocate memory for playing around with the IDT. */
512	pbIdtCopyAlloc = NULL;
513	if (BS3_MODE_IS_PAGED(g_bTestMode))
514	pbIdtCopyAlloc = Bs3MemAlloc(BS3MEMKIND_FLAT32, 12*_1K);
515	# endif
516
517	/*
518	* IDT entry 80 thru 83 are assigned DPLs according to the number.
519	* (We'll be useing more, but this'll do for now.)
520	*/
521	paIdt[0x80 << cIdteShift].Gate.u2Dpl = 0;
522	paIdt[0x81 << cIdteShift].Gate.u2Dpl = 1;
523	paIdt[0x82 << cIdteShift].Gate.u2Dpl = 2;
524	paIdt[0x83 << cIdteShift].Gate.u2Dpl = 3;
525
526	Bs3RegCtxSave(&Ctx80);
527	Ctx80.rsp.u -= 0x300;
528	Ctx80.rip.u = (uintptr_t)BS3_FP_OFF(&bs3CpuBasic2_Int80);
529	# if TMPL_BITS == 16
530	Ctx80.cs = BS3_MODE_IS_RM_OR_V86(g_bTestMode) ? BS3_SEL_TEXT16 : BS3_SEL_R0_CS16;
531	# elif TMPL_BITS == 32
532	g_uBs3TrapEipHint = Ctx80.rip.u32;
533	# endif
534	Bs3MemCpy(&Ctx81, &Ctx80, sizeof(Ctx80));
535	Ctx81.rip.u = (uintptr_t)BS3_FP_OFF(&bs3CpuBasic2_Int81);
536	Bs3MemCpy(&Ctx82, &Ctx80, sizeof(Ctx80));
537	Ctx82.rip.u = (uintptr_t)BS3_FP_OFF(&bs3CpuBasic2_Int82);
538	Bs3MemCpy(&Ctx83, &Ctx80, sizeof(Ctx80));
539	Ctx83.rip.u = (uintptr_t)BS3_FP_OFF(&bs3CpuBasic2_Int83);
540
541	/*
542	* Check that all the above gates work from ring-0.
543	*/
544	for (iCtx = 0; iCtx < RT_ELEMENTS(apCtx8x); iCtx++)
545	{
546	g_usBs3TestStep = iCtx;
547	# if TMPL_BITS == 32
548	g_uBs3TrapEipHint = apCtx8x[iCtx]->rip.u32;
549	# endif
550	Bs3TrapSetJmpAndRestore(apCtx8x[iCtx], &TrapCtx);
551	bs3CpuBasic2_CompareIntCtx1(&TrapCtx, apCtx8x[iCtx], 0x80+iCtx /bXcpt/);
552	}
553
554	/*
555	* Check that the gate DPL checks works.
556	*/
557	g_usBs3TestStep = 100;
558	for (iRing = 0; iRing <= 3; iRing++)
559	{
560	for (iCtx = 0; iCtx < RT_ELEMENTS(apCtx8x); iCtx++)
561	{
562	Bs3MemCpy(&CtxTmp, apCtx8x[iCtx], sizeof(CtxTmp));
563	Bs3RegCtxConvertToRingX(&CtxTmp, iRing);
564	# if TMPL_BITS == 32
565	g_uBs3TrapEipHint = CtxTmp.rip.u32;
566	# endif
567	Bs3TrapSetJmpAndRestore(&CtxTmp, &TrapCtx);
568	if (iCtx < iRing)
569	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &CtxTmp, ((0x80 + iCtx) << X86_TRAP_ERR_SEL_SHIFT) \| X86_TRAP_ERR_IDT);
570	else
571	bs3CpuBasic2_CompareIntCtx1(&TrapCtx, &CtxTmp, 0x80 + iCtx /bXcpt/);
572	g_usBs3TestStep++;
573	}
574	}
575
576	/*
577	* Modify the gate CS value and run the handler at a different CPL.
578	* Throw RPL variations into the mix (completely ignored) together
579	* with gate presence.
580	* 1. CPL <= GATE.DPL
581	* 2. GATE.P
582	* 3. GATE.CS.DPL <= CPL (non-conforming segments)
583	*/
584	g_usBs3TestStep = 1000;
585	for (i = 0; i <= 3; i++)
586	{
587	for (iRing = 0; iRing <= 3; iRing++)
588	{
589	for (iCtx = 0; iCtx < RT_ELEMENTS(apCtx8x); iCtx++)
590	{
591	# if TMPL_BITS == 32
592	g_uBs3TrapEipHint = apCtx8x[iCtx]->rip.u32;
593	# endif
594	Bs3MemCpy(&CtxTmp, apCtx8x[iCtx], sizeof(CtxTmp));
595	Bs3RegCtxConvertToRingX(&CtxTmp, iRing);
596
597	for (j = 0; j <= 3; j++)
598	{
599	uint16_t const uCs = (uSysR0Cs \| j) + (i << BS3_SEL_RING_SHIFT);
600	for (k = 0; k < 2; k++)
601	{
602	g_usBs3TestStep++;
603	/Bs3TestPrintf("g_usBs3TestStep=%u iCtx=%u iRing=%u i=%u uCs=%04x\n", g_usBs3TestStep, iCtx, iRing, i, uCs);/
604	paIdt[(0x80 + iCtx) << cIdteShift].Gate.u16Sel = uCs;
605	paIdt[(0x80 + iCtx) << cIdteShift].Gate.u1Present = k;
606	Bs3TrapSetJmpAndRestore(&CtxTmp, &TrapCtx);
607	/Bs3TrapPrintFrame(&TrapCtx);/
608	if (iCtx < iRing)
609	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &CtxTmp, ((0x80 + iCtx) << X86_TRAP_ERR_SEL_SHIFT) \| X86_TRAP_ERR_IDT);
610	else if (k == 0)
611	bs3CpuBasic2_CompareNpCtx(&TrapCtx, &CtxTmp, ((0x80 + iCtx) << X86_TRAP_ERR_SEL_SHIFT) \| X86_TRAP_ERR_IDT);
612	else if (i > iRing)
613	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &CtxTmp, uCs & X86_SEL_MASK_OFF_RPL);
614	else
615	{
616	uint16_t uExpectedCs = uCs & X86_SEL_MASK_OFF_RPL;
617	if (i <= iCtx && i <= iRing)
618	uExpectedCs \|= i;
619	bs3CpuBasic2_CompareTrapCtx2(&TrapCtx, &CtxTmp, 2 /int 8xh/, 0x80 + iCtx /bXcpt/, uExpectedCs);
620	}
621	}
622	}
623
624	paIdt[(0x80 + iCtx) << cIdteShift].Gate.u16Sel = uSysR0Cs;
625	paIdt[(0x80 + iCtx) << cIdteShift].Gate.u1Present = 1;
626	}
627	}
628	}
629	BS3_ASSERT(g_usBs3TestStep < 1600);
630
631	/*
632	* Various CS and SS related faults
633	*
634	* We temporarily reconfigure gate 80 and 83 with new CS selectors, the
635	* latter have a CS.DPL of 2 for testing ring transisions and SS loading
636	* without making it impossible to handle faults.
637	*/
638	g_usBs3TestStep = 1600;
639	Bs3GdteTestPage00 = Bs3Gdt[uSysR0Cs >> X86_SEL_SHIFT];
640	Bs3GdteTestPage00.Gen.u1Present = 0;
641	Bs3GdteTestPage00.Gen.u4Type &= ~X86_SEL_TYPE_ACCESSED;
642	paIdt[0x80 << cIdteShift].Gate.u16Sel = BS3_SEL_TEST_PAGE_00;
643
644	/* CS.PRESENT = 0 */
645	Bs3TrapSetJmpAndRestore(&Ctx80, &TrapCtx);
646	bs3CpuBasic2_CompareNpCtx(&TrapCtx, &Ctx80, BS3_SEL_TEST_PAGE_00);
647	if (Bs3GdteTestPage00.Gen.u4Type & X86_SEL_TYPE_ACCESSED)
648	bs3CpuBasic2_FailedF("selector was accessed");
649	g_usBs3TestStep++;
650
651	/* Check that GATE.DPL is checked before CS.PRESENT. */
652	for (iRing = 1; iRing < 4; iRing++)
653	{
654	Bs3MemCpy(&CtxTmp, &Ctx80, sizeof(CtxTmp));
655	Bs3RegCtxConvertToRingX(&CtxTmp, iRing);
656	Bs3TrapSetJmpAndRestore(&CtxTmp, &TrapCtx);
657	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &CtxTmp, (0x80 << X86_TRAP_ERR_SEL_SHIFT) \| X86_TRAP_ERR_IDT);
658	if (Bs3GdteTestPage00.Gen.u4Type & X86_SEL_TYPE_ACCESSED)
659	bs3CpuBasic2_FailedF("selector was accessed");
660	g_usBs3TestStep++;
661	}
662
663	/* CS.DPL mismatch takes precedence over CS.PRESENT = 0. */
664	Bs3GdteTestPage00.Gen.u4Type &= ~X86_SEL_TYPE_ACCESSED;
665	Bs3TrapSetJmpAndRestore(&Ctx80, &TrapCtx);
666	bs3CpuBasic2_CompareNpCtx(&TrapCtx, &Ctx80, BS3_SEL_TEST_PAGE_00);
667	if (Bs3GdteTestPage00.Gen.u4Type & X86_SEL_TYPE_ACCESSED)
668	bs3CpuBasic2_FailedF("CS selector was accessed");
669	g_usBs3TestStep++;
670	for (iDpl = 1; iDpl < 4; iDpl++)
671	{
672	Bs3GdteTestPage00.Gen.u2Dpl = iDpl;
673	Bs3TrapSetJmpAndRestore(&Ctx80, &TrapCtx);
674	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &Ctx80, BS3_SEL_TEST_PAGE_00);
675	if (Bs3GdteTestPage00.Gen.u4Type & X86_SEL_TYPE_ACCESSED)
676	bs3CpuBasic2_FailedF("CS selector was accessed");
677	g_usBs3TestStep++;
678	}
679
680	/* 1608: Check all the invalid CS selector types alone. */
681	Bs3GdteTestPage00 = Bs3Gdt[uSysR0Cs >> X86_SEL_SHIFT];
682	for (i = 0; i < RT_ELEMENTS(g_aInvalidCsTypes); i++)
683	{
684	Bs3GdteTestPage00.Gen.u4Type = g_aInvalidCsTypes[i].u4Type;
685	Bs3GdteTestPage00.Gen.u1DescType = g_aInvalidCsTypes[i].u1DescType;
686	Bs3TrapSetJmpAndRestore(&Ctx80, &TrapCtx);
687	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &Ctx80, BS3_SEL_TEST_PAGE_00);
688	if (Bs3GdteTestPage00.Gen.u4Type != g_aInvalidCsTypes[i].u4Type)
689	bs3CpuBasic2_FailedF("Invalid CS type %#x/%u -> %#x/%u\n",
690	g_aInvalidCsTypes[i].u4Type, g_aInvalidCsTypes[i].u1DescType,
691	Bs3GdteTestPage00.Gen.u4Type, Bs3GdteTestPage00.Gen.u1DescType);
692	g_usBs3TestStep++;
693
694	/* Incorrect CS.TYPE takes precedence over CS.PRESENT = 0. */
695	Bs3GdteTestPage00.Gen.u1Present = 0;
696	Bs3TrapSetJmpAndRestore(&Ctx80, &TrapCtx);
697	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &Ctx80, BS3_SEL_TEST_PAGE_00);
698	Bs3GdteTestPage00.Gen.u1Present = 1;
699	g_usBs3TestStep++;
700	}
701
702	/* Fix CS again. */
703	Bs3GdteTestPage00 = Bs3Gdt[uSysR0Cs >> X86_SEL_SHIFT];
704
705	/* 1632: Test SS. */
706	if (!BS3_MODE_IS_64BIT_SYS(g_bTestMode))
707	{
708	uint16_t BS3_FAR *puTssSs2 = BS3_MODE_IS_16BIT_SYS(g_bTestMode) ? &Bs3Tss16.ss2 : &Bs3Tss32.ss2;
709	uint16_t const uSavedSs2 = *puTssSs2;
710	X86DESC const SavedGate83 = paIdt[0x83 << cIdteShift];
711
712	/* Make the handler execute in ring-2. */
713	Bs3GdteTestPage02 = Bs3Gdt[(uSysR0Cs + (2 << BS3_SEL_RING_SHIFT)) >> X86_SEL_SHIFT];
714	Bs3GdteTestPage02.Gen.u4Type &= ~X86_SEL_TYPE_ACCESSED;
715	paIdt[0x83 << cIdteShift].Gate.u16Sel = BS3_SEL_TEST_PAGE_02 \| 2;
716
717	Bs3MemCpy(&CtxTmp, &Ctx83, sizeof(CtxTmp));
718	Bs3RegCtxConvertToRingX(&CtxTmp, 3); /* yeah, from 3 so SS:xSP is reloaded. */
719	Bs3TrapSetJmpAndRestore(&CtxTmp, &TrapCtx);
720	bs3CpuBasic2_CompareIntCtx1(&TrapCtx, &CtxTmp, 0x83);
721	if (!(Bs3GdteTestPage02.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
722	bs3CpuBasic2_FailedF("CS selector was not access");
723	g_usBs3TestStep++;
724
725	/* Create a SS.DPL=2 stack segment and check that SS2.RPL matters and
726	that we get #SS if the selector isn't present. */
727	i = 0; /* used for cycling thru invalid CS types */
728	for (k = 0; k < 10; k++)
729	{
730	/* k=0: present,
731	k=1: not-present,
732	k=2: present but very low limit,
733	k=3: not-present, low limit.
734	k=4: present, read-only.
735	k=5: not-present, read-only.
736	k=6: present, code-selector.
737	k=7: not-present, code-selector.
738	k=8: present, read-write / no access + system (=LDT).
739	k=9: not-present, read-write / no access + system (=LDT).
740	*/
741	Bs3GdteTestPage03 = Bs3Gdt[(uSysR0Ss + (2 << BS3_SEL_RING_SHIFT)) >> X86_SEL_SHIFT];
742	Bs3GdteTestPage03.Gen.u1Present = !(k & 1);
743	if (k >= 8)
744	{
745	Bs3GdteTestPage03.Gen.u1DescType = 0; /* system */
746	Bs3GdteTestPage03.Gen.u4Type = X86_SEL_TYPE_RW; /* = LDT */
747	}
748	else if (k >= 6)
749	Bs3GdteTestPage03.Gen.u4Type = X86_SEL_TYPE_ER;
750	else if (k >= 4)
751	Bs3GdteTestPage03.Gen.u4Type = X86_SEL_TYPE_RO;
752	else if (k >= 2)
753	{
754	Bs3GdteTestPage03.Gen.u16LimitLow = 0x400;
755	Bs3GdteTestPage03.Gen.u4LimitHigh = 0;
756	Bs3GdteTestPage03.Gen.u1Granularity = 0;
757	}
758
759	for (iDpl = 0; iDpl < 4; iDpl++)
760	{
761	Bs3GdteTestPage03.Gen.u2Dpl = iDpl;
762
763	for (iRpl = 0; iRpl < 4; iRpl++)
764	{
765	*puTssSs2 = BS3_SEL_TEST_PAGE_03 \| iRpl;
766	//Bs3TestPrintf("k=%u iDpl=%u iRpl=%u step=%u\n", k, iDpl, iRpl, g_usBs3TestStep);
767	Bs3GdteTestPage02.Gen.u4Type &= ~X86_SEL_TYPE_ACCESSED;
768	Bs3GdteTestPage03.Gen.u4Type &= ~X86_SEL_TYPE_ACCESSED;
769	Bs3TrapSetJmpAndRestore(&CtxTmp, &TrapCtx);
770	if (iRpl != 2 \|\| iRpl != iDpl \|\| k >= 4)
771	bs3CpuBasic2_CompareTsCtx(&TrapCtx, &CtxTmp, BS3_SEL_TEST_PAGE_03);
772	else if (k != 0)
773	bs3CpuBasic2_CompareSsCtx(&TrapCtx, &CtxTmp, BS3_SEL_TEST_PAGE_03,
774	k == 2 /f486ResumeFlagHint/);
775	else
776	{
777	bs3CpuBasic2_CompareIntCtx1(&TrapCtx, &CtxTmp, 0x83);
778	if (TrapCtx.uHandlerSs != (BS3_SEL_TEST_PAGE_03 \| 2))
779	bs3CpuBasic2_FailedF("uHandlerSs=%#x expected %#x\n", TrapCtx.uHandlerSs, BS3_SEL_TEST_PAGE_03 \| 2);
780	}
781	if (!(Bs3GdteTestPage02.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
782	bs3CpuBasic2_FailedF("CS selector was not access");
783	if ( TrapCtx.bXcpt == 0x83
784	\|\| (TrapCtx.bXcpt == X86_XCPT_SS && k == 2) )
785	{
786	if (!(Bs3GdteTestPage03.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
787	bs3CpuBasic2_FailedF("SS selector was not accessed");
788	}
789	else if (Bs3GdteTestPage03.Gen.u4Type & X86_SEL_TYPE_ACCESSED)
790	bs3CpuBasic2_FailedF("SS selector was accessed");
791	g_usBs3TestStep++;
792
793	/* +1: Modify the gate DPL to check that this is checked before SS.DPL and SS.PRESENT. */
794	paIdt[0x83 << cIdteShift].Gate.u2Dpl = 2;
795	Bs3TrapSetJmpAndRestore(&CtxTmp, &TrapCtx);
796	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &CtxTmp, (0x83 << X86_TRAP_ERR_SEL_SHIFT) \| X86_TRAP_ERR_IDT);
797	paIdt[0x83 << cIdteShift].Gate.u2Dpl = 3;
798	g_usBs3TestStep++;
799
800	/* +2: Check the CS.DPL check is done before the SS ones. Restoring the
801	ring-0 INT 83 context triggers the CS.DPL < CPL check. */
802	Bs3TrapSetJmpAndRestore(&Ctx83, &TrapCtx);
803	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &Ctx83, BS3_SEL_TEST_PAGE_02);
804	g_usBs3TestStep++;
805
806	/* +3: Now mark the CS selector not present and check that that also triggers before SS stuff. */
807	Bs3GdteTestPage02.Gen.u1Present = 0;
808	Bs3TrapSetJmpAndRestore(&CtxTmp, &TrapCtx);
809	bs3CpuBasic2_CompareNpCtx(&TrapCtx, &CtxTmp, BS3_SEL_TEST_PAGE_02);
810	Bs3GdteTestPage02.Gen.u1Present = 1;
811	g_usBs3TestStep++;
812
813	/* +4: Make the CS selector some invalid type and check it triggers before SS stuff. */
814	Bs3GdteTestPage02.Gen.u4Type = g_aInvalidCsTypes[i].u4Type;
815	Bs3GdteTestPage02.Gen.u1DescType = g_aInvalidCsTypes[i].u1DescType;
816	Bs3TrapSetJmpAndRestore(&CtxTmp, &TrapCtx);
817	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &CtxTmp, BS3_SEL_TEST_PAGE_02);
818	Bs3GdteTestPage02.Gen.u4Type = X86_SEL_TYPE_ER_ACC;
819	Bs3GdteTestPage02.Gen.u1DescType = 1;
820	g_usBs3TestStep++;
821
822	/* +5: Now, make the CS selector limit too small and that it triggers after SS trouble.
823	The 286 had a simpler approach to these GP(0). */
824	Bs3GdteTestPage02.Gen.u16LimitLow = 0;
825	Bs3GdteTestPage02.Gen.u4LimitHigh = 0;
826	Bs3GdteTestPage02.Gen.u1Granularity = 0;
827	Bs3TrapSetJmpAndRestore(&CtxTmp, &TrapCtx);
828	if (f286)
829	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &CtxTmp, 0 /uErrCd/);
830	else if (iRpl != 2 \|\| iRpl != iDpl \|\| k >= 4)
831	bs3CpuBasic2_CompareTsCtx(&TrapCtx, &CtxTmp, BS3_SEL_TEST_PAGE_03);
832	else if (k != 0)
833	bs3CpuBasic2_CompareSsCtx(&TrapCtx, &CtxTmp, BS3_SEL_TEST_PAGE_03, k == 2 /f486ResumeFlagHint/);
834	else
835	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &CtxTmp, 0 /uErrCd/);
836	Bs3GdteTestPage02 = Bs3Gdt[(uSysR0Cs + (2 << BS3_SEL_RING_SHIFT)) >> X86_SEL_SHIFT];
837	g_usBs3TestStep++;
838	}
839	}
840	}
841
842	/* Check all the invalid SS selector types alone. */
843	Bs3GdteTestPage02 = Bs3Gdt[(uSysR0Cs + (2 << BS3_SEL_RING_SHIFT)) >> X86_SEL_SHIFT];
844	Bs3GdteTestPage03 = Bs3Gdt[(uSysR0Ss + (2 << BS3_SEL_RING_SHIFT)) >> X86_SEL_SHIFT];
845	*puTssSs2 = BS3_SEL_TEST_PAGE_03 \| 2;
846	Bs3TrapSetJmpAndRestore(&CtxTmp, &TrapCtx);
847	bs3CpuBasic2_CompareIntCtx1(&TrapCtx, &CtxTmp, 0x83);
848	g_usBs3TestStep++;
849	for (i = 0; i < RT_ELEMENTS(g_aInvalidSsTypes); i++)
850	{
851	Bs3GdteTestPage03.Gen.u4Type = g_aInvalidSsTypes[i].u4Type;
852	Bs3GdteTestPage03.Gen.u1DescType = g_aInvalidSsTypes[i].u1DescType;
853	Bs3TrapSetJmpAndRestore(&CtxTmp, &TrapCtx);
854	bs3CpuBasic2_CompareTsCtx(&TrapCtx, &CtxTmp, BS3_SEL_TEST_PAGE_03);
855	if (Bs3GdteTestPage03.Gen.u4Type != g_aInvalidSsTypes[i].u4Type)
856	bs3CpuBasic2_FailedF("Invalid SS type %#x/%u -> %#x/%u\n",
857	g_aInvalidSsTypes[i].u4Type, g_aInvalidSsTypes[i].u1DescType,
858	Bs3GdteTestPage03.Gen.u4Type, Bs3GdteTestPage03.Gen.u1DescType);
859	g_usBs3TestStep++;
860	}
861
862	/*
863	* Continue the SS experiments with a expand down segment. We'll use
864	* the same setup as we already have with gate 83h being DPL and
865	* having CS.DPL=2.
866	*
867	* Expand down segments are weird. The valid area is practically speaking
868	* reversed. So, a 16-bit segment with a limit of 0x6000 will have valid
869	* addresses from 0xffff thru 0x6001.
870	*
871	* So, with expand down segments we can more easily cut partially into the
872	* pushing of the iret frame and trigger more interesting behavior than
873	* with regular "expand up" segments where the whole pushing area is either
874	* all fine or not not fine.
875	*/
876	Bs3GdteTestPage02 = Bs3Gdt[(uSysR0Cs + (2 << BS3_SEL_RING_SHIFT)) >> X86_SEL_SHIFT];
877	Bs3GdteTestPage03 = Bs3Gdt[(uSysR0Ss + (2 << BS3_SEL_RING_SHIFT)) >> X86_SEL_SHIFT];
878	Bs3GdteTestPage03.Gen.u2Dpl = 2;
879	Bs3GdteTestPage03.Gen.u4Type = X86_SEL_TYPE_RW_DOWN;
880	*puTssSs2 = BS3_SEL_TEST_PAGE_03 \| 2;
881
882	/* First test, limit = max --> no bytes accessible --> #GP */
883	Bs3TrapSetJmpAndRestore(&CtxTmp, &TrapCtx);
884	bs3CpuBasic2_CompareSsCtx(&TrapCtx, &CtxTmp, BS3_SEL_TEST_PAGE_03, true /f486ResumeFlagHint/);
885
886	/* Second test, limit = 0 --> all by zero byte accessible --> works */
887	Bs3GdteTestPage03.Gen.u16LimitLow = 0;
888	Bs3GdteTestPage03.Gen.u4LimitHigh = 0;
889	Bs3TrapSetJmpAndRestore(&CtxTmp, &TrapCtx);
890	bs3CpuBasic2_CompareIntCtx1(&TrapCtx, &CtxTmp, 0x83);
891
892	/* Modify the gate handler to be a dummy that immediately does UD2
893	and triggers #UD, then advance the limit down till we get the #UD. */
894	Bs3GdteTestPage03.Gen.u1Granularity = 0;
895
896	Bs3MemCpy(&CtxTmp2, &CtxTmp, sizeof(CtxTmp2)); /* #UD result context */
897	if (g_f16BitSys)
898	{
899	CtxTmp2.rip.u = g_bs3CpuBasic2_ud2_FlatAddr - BS3_ADDR_BS3TEXT16;
900	Bs3Trap16SetGate(0x83, X86_SEL_TYPE_SYS_286_INT_GATE, 3, BS3_SEL_TEST_PAGE_02, CtxTmp2.rip.u16, 0 /cParams/);
901	CtxTmp2.rsp.u = Bs3Tss16.sp2 - 2*5;
902	}
903	else
904	{
905	CtxTmp2.rip.u = g_bs3CpuBasic2_ud2_FlatAddr;
906	Bs3Trap32SetGate(0x83, X86_SEL_TYPE_SYS_386_INT_GATE, 3, BS3_SEL_TEST_PAGE_02, CtxTmp2.rip.u32, 0 /cParams/);
907	CtxTmp2.rsp.u = Bs3Tss32.esp2 - 4*5;
908	}
909	CtxTmp2.bMode = g_bTestMode; /* g_bBs3CurrentMode not changed by the UD2 handler. */
910	CtxTmp2.cs = BS3_SEL_TEST_PAGE_02 \| 2;
911	CtxTmp2.ss = BS3_SEL_TEST_PAGE_03 \| 2;
912	CtxTmp2.bCpl = 2;
913
914	/* test run. */
915	Bs3TrapSetJmpAndRestore(&CtxTmp, &TrapCtx);
916	bs3CpuBasic2_CompareUdCtx(&TrapCtx, &CtxTmp2);
917	g_usBs3TestStep++;
918
919	/* Real run. */
920	i = (g_f16BitSys ? 2 : 4) * 6 + 1;
921	while (i-- > 0)
922	{
923	Bs3GdteTestPage03.Gen.u16LimitLow = CtxTmp2.rsp.u16 + i - 1;
924	Bs3TrapSetJmpAndRestore(&CtxTmp, &TrapCtx);
925	if (i > 0)
926	bs3CpuBasic2_CompareSsCtx(&TrapCtx, &CtxTmp, BS3_SEL_TEST_PAGE_03, true /f486ResumeFlagHint/);
927	else
928	bs3CpuBasic2_CompareUdCtx(&TrapCtx, &CtxTmp2);
929	g_usBs3TestStep++;
930	}
931
932	/* Do a run where we do the same-ring kind of access. */
933	Bs3RegCtxConvertToRingX(&CtxTmp, 2);
934	if (g_f16BitSys)
935	{
936	CtxTmp2.rsp.u32 = CtxTmp.rsp.u32 - 2*3;
937	i = 2*3 - 1;
938	}
939	else
940	{
941	CtxTmp2.rsp.u32 = CtxTmp.rsp.u32 - 4*3;
942	i = 4*3 - 1;
943	}
944	CtxTmp.ss = BS3_SEL_TEST_PAGE_03 \| 2;
945	CtxTmp2.ds = CtxTmp.ds;
946	CtxTmp2.es = CtxTmp.es;
947	CtxTmp2.fs = CtxTmp.fs;
948	CtxTmp2.gs = CtxTmp.gs;
949	while (i-- > 0)
950	{
951	Bs3GdteTestPage03.Gen.u16LimitLow = CtxTmp2.rsp.u16 + i - 1;
952	Bs3TrapSetJmpAndRestore(&CtxTmp, &TrapCtx);
953	if (i > 0)
954	bs3CpuBasic2_CompareSsCtx(&TrapCtx, &CtxTmp, 0 /BS3_SEL_TEST_PAGE_03/, true /f486ResumeFlagHint/);
955	else
956	bs3CpuBasic2_CompareUdCtx(&TrapCtx, &CtxTmp2);
957	g_usBs3TestStep++;
958	}
959
960	*puTssSs2 = uSavedSs2;
961	paIdt[0x83 << cIdteShift] = SavedGate83;
962	}
963	paIdt[0x80 << cIdteShift].Gate.u16Sel = uSysR0Cs;
964	BS3_ASSERT(g_usBs3TestStep < 3000);
965
966	/*
967	* Modify the gate CS value with a conforming segment.
968	*/
969	g_usBs3TestStep = 3000;
970	for (i = 0; i <= 3; i++) /* cs.dpl */
971	{
972	for (iRing = 0; iRing <= 3; iRing++)
973	{
974	for (iCtx = 0; iCtx < RT_ELEMENTS(apCtx8x); iCtx++)
975	{
976	Bs3MemCpy(&CtxTmp, apCtx8x[iCtx], sizeof(CtxTmp));
977	Bs3RegCtxConvertToRingX(&CtxTmp, iRing);
978	# if TMPL_BITS == 32
979	g_uBs3TrapEipHint = CtxTmp.rip.u32;
980	# endif
981
982	for (j = 0; j <= 3; j++) /* rpl */
983	{
984	uint16_t const uCs = (uSysR0CsConf \| j) + (i << BS3_SEL_RING_SHIFT);
985	/Bs3TestPrintf("g_usBs3TestStep=%u iCtx=%u iRing=%u i=%u uCs=%04x\n", g_usBs3TestStep, iCtx, iRing, i, uCs);/
986	paIdt[(0x80 + iCtx) << cIdteShift].Gate.u16Sel = uCs;
987	Bs3TrapSetJmpAndRestore(&CtxTmp, &TrapCtx);
988	//Bs3TestPrintf("%u/%u/%u/%u: cs=%04x hcs=%04x xcpt=%02x\n", i, iRing, iCtx, j, uCs, TrapCtx.uHandlerCs, TrapCtx.bXcpt);
989	/Bs3TrapPrintFrame(&TrapCtx);/
990	g_usBs3TestStep++;
991	if (iCtx < iRing)
992	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &CtxTmp, ((0x80 + iCtx) << X86_TRAP_ERR_SEL_SHIFT) \| X86_TRAP_ERR_IDT);
993	else if (i > iRing)
994	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &CtxTmp, uCs & X86_SEL_MASK_OFF_RPL);
995	else
996	bs3CpuBasic2_CompareIntCtx1(&TrapCtx, &CtxTmp, 0x80 + iCtx /bXcpt/);
997	}
998	paIdt[(0x80 + iCtx) << cIdteShift].Gate.u16Sel = uSysR0Cs;
999	}
1000	}
1001	}
1002	BS3_ASSERT(g_usBs3TestStep < 3500);
1003
1004	/*
1005	* The gates must be 64-bit in long mode.
1006	*/
1007	if (cIdteShift != 0)
1008	{
1009	g_usBs3TestStep = 3500;
1010	for (i = 0; i <= 3; i++)
1011	{
1012	for (iRing = 0; iRing <= 3; iRing++)
1013	{
1014	for (iCtx = 0; iCtx < RT_ELEMENTS(apCtx8x); iCtx++)
1015	{
1016	Bs3MemCpy(&CtxTmp, apCtx8x[iCtx], sizeof(CtxTmp));
1017	Bs3RegCtxConvertToRingX(&CtxTmp, iRing);
1018
1019	for (j = 0; j < 2; j++)
1020	{
1021	static const uint16_t s_auCSes[2] = { BS3_SEL_R0_CS16, BS3_SEL_R0_CS32 };
1022	uint16_t uCs = (s_auCSes[j] \| i) + (i << BS3_SEL_RING_SHIFT);
1023	g_usBs3TestStep++;
1024	/Bs3TestPrintf("g_usBs3TestStep=%u iCtx=%u iRing=%u i=%u uCs=%04x\n", g_usBs3TestStep, iCtx, iRing, i, uCs);/
1025	paIdt[(0x80 + iCtx) << cIdteShift].Gate.u16Sel = uCs;
1026	Bs3TrapSetJmpAndRestore(&CtxTmp, &TrapCtx);
1027	/Bs3TrapPrintFrame(&TrapCtx);/
1028	if (iCtx < iRing)
1029	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &CtxTmp, ((0x80 + iCtx) << X86_TRAP_ERR_SEL_SHIFT) \| X86_TRAP_ERR_IDT);
1030	else
1031	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &CtxTmp, uCs & X86_SEL_MASK_OFF_RPL);
1032	}
1033	paIdt[(0x80 + iCtx) << cIdteShift].Gate.u16Sel = uSysR0Cs;
1034	}
1035	}
1036	}
1037	BS3_ASSERT(g_usBs3TestStep < 4000);
1038	}
1039
1040	/*
1041	* IDT limit check. The 286 does not access X86DESCGATE::u16OffsetHigh.
1042	*/
1043	g_usBs3TestStep = 5000;
1044	i = (0x80 << (cIdteShift + 3)) - 1;
1045	j = (0x82 << (cIdteShift + 3)) - (!f286 ? 1 : 3);
1046	k = (0x83 << (cIdteShift + 3)) - 1;
1047	for (; i <= k; i++, g_usBs3TestStep++)
1048	{
1049	Idtr = IdtrSaved;
1050	Idtr.cbIdt = i;
1051	ASMSetIDTR(&Idtr);
1052	Bs3TrapSetJmpAndRestore(&Ctx81, &TrapCtx);
1053	if (i < j)
1054	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &Ctx81, (0x81 << X86_TRAP_ERR_SEL_SHIFT) \| X86_TRAP_ERR_IDT);
1055	else
1056	bs3CpuBasic2_CompareIntCtx1(&TrapCtx, &Ctx81, 0x81 /bXcpt/);
1057	}
1058	ASMSetIDTR(&IdtrSaved);
1059	BS3_ASSERT(g_usBs3TestStep < 5100);
1060
1061	# if TMPL_BITS != 16 /* Only do the paging related stuff in 32-bit and 64-bit modes. */
1062
1063	/*
1064	* IDT page not present. Placing the IDT copy such that 0x80 is on the
1065	* first page and 0x81 is on the second page. We need proceed to move
1066	* it down byte by byte to check that any inaccessible byte means #PF.
1067	*
1068	* Note! We must reload the alternative IDTR for each run as any kind of
1069	* printing to the string (like error reporting) will cause a switch
1070	* to real mode and back, reloading the default IDTR.
1071	*/
1072	g_usBs3TestStep = 5200;
1073	if (BS3_MODE_IS_PAGED(g_bTestMode) && pbIdtCopyAlloc)
1074	{
1075	uint32_t const uCr2Expected = Bs3SelPtrToFlat(pbIdtCopyAlloc) + _4K;
1076	for (j = 0; j < cbIdte; j++)
1077	{
1078	pIdtCopy = (PX86DESC)&pbIdtCopyAlloc[_4K - cbIdte * 0x81 - j];
1079	Bs3MemCpy(pIdtCopy, paIdt, cbIdte * 256);
1080
1081	Idtr.cbIdt = IdtrSaved.cbIdt;
1082	Idtr.pIdt = Bs3SelPtrToFlat(pIdtCopy);
1083
1084	ASMSetIDTR(&Idtr);
1085	Bs3TrapSetJmpAndRestore(&Ctx81, &TrapCtx);
1086	bs3CpuBasic2_CompareIntCtx1(&TrapCtx, &Ctx81, 0x81 /bXcpt/);
1087	g_usBs3TestStep++;
1088
1089	ASMSetIDTR(&Idtr);
1090	Bs3TrapSetJmpAndRestore(&Ctx80, &TrapCtx);
1091	bs3CpuBasic2_CompareIntCtx1(&TrapCtx, &Ctx80, 0x80 /bXcpt/);
1092	g_usBs3TestStep++;
1093
1094	rc = Bs3PagingProtect(uCr2Expected, _4K, 0 /fSet/, X86_PTE_P /fClear/);
1095	if (RT_SUCCESS(rc))
1096	{
1097	ASMSetIDTR(&Idtr);
1098	Bs3TrapSetJmpAndRestore(&Ctx80, &TrapCtx);
1099	bs3CpuBasic2_CompareIntCtx1(&TrapCtx, &Ctx80, 0x80 /bXcpt/);
1100	g_usBs3TestStep++;
1101
1102	ASMSetIDTR(&Idtr);
1103	Bs3TrapSetJmpAndRestore(&Ctx81, &TrapCtx);
1104	if (f486Plus)
1105	bs3CpuBasic2_ComparePfCtx(&TrapCtx, &Ctx81, 0 /uErrCd/, uCr2Expected);
1106	else
1107	bs3CpuBasic2_ComparePfCtx(&TrapCtx, &Ctx81, X86_TRAP_PF_RW /uErrCd/, uCr2Expected + 4 - RT_MIN(j, 4));
1108	g_usBs3TestStep++;
1109
1110	Bs3PagingProtect(uCr2Expected, _4K, X86_PTE_P /fSet/, 0 /fClear/);
1111
1112	/* Check if that the entry type is checked after the whole IDTE has been cleared for #PF. */
1113	pIdtCopy[0x80 << cIdteShift].Gate.u4Type = 0;
1114	rc = Bs3PagingProtect(uCr2Expected, _4K, 0 /fSet/, X86_PTE_P /fClear/);
1115	if (RT_SUCCESS(rc))
1116	{
1117	ASMSetIDTR(&Idtr);
1118	Bs3TrapSetJmpAndRestore(&Ctx81, &TrapCtx);
1119	if (f486Plus)
1120	bs3CpuBasic2_ComparePfCtx(&TrapCtx, &Ctx81, 0 /uErrCd/, uCr2Expected);
1121	else
1122	bs3CpuBasic2_ComparePfCtx(&TrapCtx, &Ctx81, X86_TRAP_PF_RW /uErrCd/, uCr2Expected + 4 - RT_MIN(j, 4));
1123	g_usBs3TestStep++;
1124
1125	Bs3PagingProtect(uCr2Expected, _4K, X86_PTE_P /fSet/, 0 /fClear/);
1126	}
1127	}
1128	else
1129	Bs3TestPrintf("Bs3PagingProtectPtr: %d\n", i);
1130
1131	ASMSetIDTR(&IdtrSaved);
1132	}
1133	}
1134
1135	/*
1136	* The read/write and user/supervisor bits the IDT PTEs are irrelevant.
1137	*/
1138	g_usBs3TestStep = 5300;
1139	if (BS3_MODE_IS_PAGED(g_bTestMode) && pbIdtCopyAlloc)
1140	{
1141	Bs3MemCpy(pbIdtCopyAlloc, paIdt, cbIdte * 256);
1142	Idtr.cbIdt = IdtrSaved.cbIdt;
1143	Idtr.pIdt = Bs3SelPtrToFlat(pbIdtCopyAlloc);
1144
1145	ASMSetIDTR(&Idtr);
1146	Bs3TrapSetJmpAndRestore(&Ctx81, &TrapCtx);
1147	bs3CpuBasic2_CompareIntCtx1(&TrapCtx, &Ctx81, 0x81 /bXcpt/);
1148	g_usBs3TestStep++;
1149
1150	rc = Bs3PagingProtect(Idtr.pIdt, _4K, 0 /fSet/, X86_PTE_RW \| X86_PTE_US /fClear/);
1151	if (RT_SUCCESS(rc))
1152	{
1153	ASMSetIDTR(&Idtr);
1154	Bs3TrapSetJmpAndRestore(&Ctx81, &TrapCtx);
1155	bs3CpuBasic2_CompareIntCtx1(&TrapCtx, &Ctx81, 0x81 /bXcpt/);
1156	g_usBs3TestStep++;
1157
1158	Bs3PagingProtect(Idtr.pIdt, _4K, X86_PTE_RW \| X86_PTE_US /fSet/, 0 /fClear/);
1159	}
1160	ASMSetIDTR(&IdtrSaved);
1161	}
1162
1163	/*
1164	* Check that CS.u1Accessed is set to 1. Use the test page selector #0 and #3 together
1165	* with interrupt gates 80h and 83h, respectively.
1166	*/
1167	/** @todo Throw in SS.u1Accessed too. */
1168	g_usBs3TestStep = 5400;
1169	if (BS3_MODE_IS_PAGED(g_bTestMode) && pbIdtCopyAlloc)
1170	{
1171	Bs3GdteTestPage00 = Bs3Gdt[uSysR0Cs >> X86_SEL_SHIFT];
1172	Bs3GdteTestPage00.Gen.u4Type &= ~X86_SEL_TYPE_ACCESSED;
1173	paIdt[0x80 << cIdteShift].Gate.u16Sel = BS3_SEL_TEST_PAGE_00;
1174
1175	Bs3GdteTestPage03 = Bs3Gdt[(uSysR0Cs + (3 << BS3_SEL_RING_SHIFT)) >> X86_SEL_SHIFT];
1176	Bs3GdteTestPage03.Gen.u4Type &= ~X86_SEL_TYPE_ACCESSED;
1177	paIdt[0x83 << cIdteShift].Gate.u16Sel = BS3_SEL_TEST_PAGE_03; /* rpl is ignored, so leave it as zero. */
1178
1179	/* Check that the CS.A bit is being set on a general basis and that
1180	the special CS values work with out generic handler code. */
1181	Bs3TrapSetJmpAndRestore(&Ctx80, &TrapCtx);
1182	bs3CpuBasic2_CompareIntCtx1(&TrapCtx, &Ctx80, 0x80 /bXcpt/);
1183	if (!(Bs3GdteTestPage00.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
1184	bs3CpuBasic2_FailedF("u4Type=%#x, not accessed", Bs3GdteTestPage00.Gen.u4Type);
1185	g_usBs3TestStep++;
1186
1187	Bs3MemCpy(&CtxTmp, &Ctx83, sizeof(CtxTmp));
1188	Bs3RegCtxConvertToRingX(&CtxTmp, 3);
1189	Bs3TrapSetJmpAndRestore(&CtxTmp, &TrapCtx);
1190	bs3CpuBasic2_CompareIntCtx1(&TrapCtx, &CtxTmp, 0x83 /bXcpt/);
1191	if (!(Bs3GdteTestPage03.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
1192	bs3CpuBasic2_FailedF("u4Type=%#x, not accessed!", Bs3GdteTestPage00.Gen.u4Type);
1193	if (TrapCtx.uHandlerCs != (BS3_SEL_TEST_PAGE_03 \| 3))
1194	bs3CpuBasic2_FailedF("uHandlerCs=%#x, expected %#x", TrapCtx.uHandlerCs, (BS3_SEL_TEST_PAGE_03 \| 3));
1195	g_usBs3TestStep++;
1196
1197	/*
1198	* Now check that setting CS.u1Access to 1 does __NOT__ trigger a page
1199	* fault due to the RW bit being zero.
1200	* (We check both with with and without the WP bit if 80486.)
1201	*/
1202	if ((g_uBs3CpuDetected & BS3CPU_TYPE_MASK) >= BS3CPU_80486)
1203	ASMSetCR0(uCr0Saved \| X86_CR0_WP);
1204
1205	Bs3GdteTestPage00.Gen.u4Type &= ~X86_SEL_TYPE_ACCESSED;
1206	Bs3GdteTestPage03.Gen.u4Type &= ~X86_SEL_TYPE_ACCESSED;
1207	rc = Bs3PagingProtect(GdtrSaved.pGdt + BS3_SEL_TEST_PAGE_00, 8, 0 /fSet/, X86_PTE_RW /fClear/);
1208	if (RT_SUCCESS(rc))
1209	{
1210	/* ring-0 handler */
1211	Bs3TrapSetJmpAndRestore(&Ctx80, &TrapCtx);
1212	bs3CpuBasic2_CompareIntCtx1(&TrapCtx, &Ctx80, 0x80 /bXcpt/);
1213	if (!(Bs3GdteTestPage00.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
1214	bs3CpuBasic2_FailedF("u4Type=%#x, not accessed!", Bs3GdteTestPage00.Gen.u4Type);
1215	g_usBs3TestStep++;
1216
1217	/* ring-3 handler */
1218	Bs3MemCpy(&CtxTmp, &Ctx83, sizeof(CtxTmp));
1219	Bs3RegCtxConvertToRingX(&CtxTmp, 3);
1220	Bs3TrapSetJmpAndRestore(&CtxTmp, &TrapCtx);
1221	bs3CpuBasic2_CompareIntCtx1(&TrapCtx, &CtxTmp, 0x83 /bXcpt/);
1222	if (!(Bs3GdteTestPage03.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
1223	bs3CpuBasic2_FailedF("u4Type=%#x, not accessed!", Bs3GdteTestPage00.Gen.u4Type);
1224	g_usBs3TestStep++;
1225
1226	/* clear WP and repeat the above. */
1227	if ((g_uBs3CpuDetected & BS3CPU_TYPE_MASK) >= BS3CPU_80486)
1228	ASMSetCR0(uCr0Saved & ~X86_CR0_WP);
1229	Bs3GdteTestPage00.Gen.u4Type &= ~X86_SEL_TYPE_ACCESSED; /* (No need to RW the page - ring-0, WP=0.) */
1230	Bs3GdteTestPage03.Gen.u4Type &= ~X86_SEL_TYPE_ACCESSED; /* (No need to RW the page - ring-0, WP=0.) */
1231
1232	Bs3TrapSetJmpAndRestore(&Ctx80, &TrapCtx);
1233	bs3CpuBasic2_CompareIntCtx1(&TrapCtx, &Ctx80, 0x80 /bXcpt/);
1234	if (!(Bs3GdteTestPage00.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
1235	bs3CpuBasic2_FailedF("u4Type=%#x, not accessed!", Bs3GdteTestPage00.Gen.u4Type);
1236	g_usBs3TestStep++;
1237
1238	Bs3TrapSetJmpAndRestore(&CtxTmp, &TrapCtx);
1239	bs3CpuBasic2_CompareIntCtx1(&TrapCtx, &CtxTmp, 0x83 /bXcpt/);
1240	if (!(Bs3GdteTestPage03.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
1241	bs3CpuBasic2_FailedF("u4Type=%#x, not accessed!n", Bs3GdteTestPage03.Gen.u4Type);
1242	g_usBs3TestStep++;
1243
1244	Bs3PagingProtect(GdtrSaved.pGdt + BS3_SEL_TEST_PAGE_00, 8, X86_PTE_RW /fSet/, 0 /fClear/);
1245	}
1246
1247	ASMSetCR0(uCr0Saved);
1248
1249	/*
1250	* While we're here, check that if the CS GDT entry is a non-present
1251	* page we do get a #PF with the rigth error code and CR2.
1252	*/
1253	Bs3GdteTestPage00.Gen.u4Type &= ~X86_SEL_TYPE_ACCESSED; /* Just for fun, really a pointless gesture. */
1254	Bs3GdteTestPage03.Gen.u4Type &= ~X86_SEL_TYPE_ACCESSED;
1255	rc = Bs3PagingProtect(GdtrSaved.pGdt + BS3_SEL_TEST_PAGE_00, 8, 0 /fSet/, X86_PTE_P /fClear/);
1256	if (RT_SUCCESS(rc))
1257	{
1258	Bs3TrapSetJmpAndRestore(&Ctx80, &TrapCtx);
1259	if (f486Plus)
1260	bs3CpuBasic2_ComparePfCtx(&TrapCtx, &Ctx80, 0 /uErrCd/, GdtrSaved.pGdt + BS3_SEL_TEST_PAGE_00);
1261	else
1262	bs3CpuBasic2_ComparePfCtx(&TrapCtx, &Ctx80, X86_TRAP_PF_RW, GdtrSaved.pGdt + BS3_SEL_TEST_PAGE_00 + 4);
1263	g_usBs3TestStep++;
1264
1265	/* Do it from ring-3 to check ErrCd, which doesn't set X86_TRAP_PF_US it turns out. */
1266	Bs3MemCpy(&CtxTmp, &Ctx83, sizeof(CtxTmp));
1267	Bs3RegCtxConvertToRingX(&CtxTmp, 3);
1268	Bs3TrapSetJmpAndRestore(&CtxTmp, &TrapCtx);
1269
1270	if (f486Plus)
1271	bs3CpuBasic2_ComparePfCtx(&TrapCtx, &CtxTmp, 0 /uErrCd/, GdtrSaved.pGdt + BS3_SEL_TEST_PAGE_03);
1272	else
1273	bs3CpuBasic2_ComparePfCtx(&TrapCtx, &CtxTmp, X86_TRAP_PF_RW, GdtrSaved.pGdt + BS3_SEL_TEST_PAGE_03 + 4);
1274	g_usBs3TestStep++;
1275
1276	Bs3PagingProtect(GdtrSaved.pGdt + BS3_SEL_TEST_PAGE_00, 8, X86_PTE_P /fSet/, 0 /fClear/);
1277	if (Bs3GdteTestPage00.Gen.u4Type & X86_SEL_TYPE_ACCESSED)
1278	bs3CpuBasic2_FailedF("u4Type=%#x, accessed! #1", Bs3GdteTestPage00.Gen.u4Type);
1279	if (Bs3GdteTestPage03.Gen.u4Type & X86_SEL_TYPE_ACCESSED)
1280	bs3CpuBasic2_FailedF("u4Type=%#x, accessed! #2", Bs3GdteTestPage03.Gen.u4Type);
1281	}
1282
1283	/* restore */
1284	paIdt[0x80 << cIdteShift].Gate.u16Sel = uSysR0Cs;
1285	paIdt[0x83 << cIdteShift].Gate.u16Sel = uSysR0Cs;// + (3 << BS3_SEL_RING_SHIFT) + 3;
1286	}
1287
1288	# endif /* 32 \|\| 64*/
1289
1290	/*
1291	* Check broad EFLAGS effects.
1292	*/
1293	g_usBs3TestStep = 5600;
1294	for (iCtx = 0; iCtx < RT_ELEMENTS(apCtx8x); iCtx++)
1295	{
1296	for (iRing = 0; iRing < 4; iRing++)
1297	{
1298	Bs3MemCpy(&CtxTmp, apCtx8x[iCtx], sizeof(CtxTmp));
1299	Bs3RegCtxConvertToRingX(&CtxTmp, iRing);
1300
1301	/* all set */
1302	CtxTmp.rflags.u32 &= X86_EFL_VM \| X86_EFL_1;
1303	CtxTmp.rflags.u32 \|= X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF /* \| X86_EFL_TF / /\| X86_EFL_IF*/
1304	\| X86_EFL_DF \| X86_EFL_OF \| X86_EFL_IOPL /* \| X86_EFL_NT*/;
1305	if (f486Plus)
1306	CtxTmp.rflags.u32 \|= X86_EFL_AC;
1307	if (f486Plus && !g_f16BitSys)
1308	CtxTmp.rflags.u32 \|= X86_EFL_RF;
1309	if (g_uBs3CpuDetected & BS3CPU_F_CPUID)
1310	CtxTmp.rflags.u32 \|= X86_EFL_VIF \| X86_EFL_VIP;
1311	Bs3TrapSetJmpAndRestore(&CtxTmp, &TrapCtx);
1312	CtxTmp.rflags.u32 &= ~X86_EFL_RF;
1313
1314	if (iCtx >= iRing)
1315	bs3CpuBasic2_CompareIntCtx1(&TrapCtx, &CtxTmp, 0x80 + iCtx /bXcpt/);
1316	else
1317	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &CtxTmp, ((0x80 + iCtx) << X86_TRAP_ERR_SEL_SHIFT) \| X86_TRAP_ERR_IDT);
1318	uExpected = CtxTmp.rflags.u32
1319	& ( X86_EFL_1 \| X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_DF
1320	\| X86_EFL_OF \| X86_EFL_IOPL \| X86_EFL_NT \| X86_EFL_VM \| X86_EFL_AC \| X86_EFL_VIF \| X86_EFL_VIP
1321	\| X86_EFL_ID /\| X86_EFL_TF/ /\| X86_EFL_IF/ /\| X86_EFL_RF/ );
1322	if (TrapCtx.fHandlerRfl != uExpected)
1323	bs3CpuBasic2_FailedF("unexpected handler rflags value: %RX64 expected %RX32; CtxTmp.rflags=%RX64 Ctx.rflags=%RX64\n",
1324	TrapCtx.fHandlerRfl, uExpected, CtxTmp.rflags.u, TrapCtx.Ctx.rflags.u);
1325	g_usBs3TestStep++;
1326
1327	/* all cleared */
1328	if ((g_uBs3CpuDetected & BS3CPU_TYPE_MASK) < BS3CPU_80286)
1329	CtxTmp.rflags.u32 = apCtx8x[iCtx]->rflags.u32 & (X86_EFL_RA1_MASK \| UINT16_C(0xf000));
1330	else
1331	CtxTmp.rflags.u32 = apCtx8x[iCtx]->rflags.u32 & (X86_EFL_VM \| X86_EFL_RA1_MASK);
1332	Bs3TrapSetJmpAndRestore(&CtxTmp, &TrapCtx);
1333	if (iCtx >= iRing)
1334	bs3CpuBasic2_CompareIntCtx1(&TrapCtx, &CtxTmp, 0x80 + iCtx /bXcpt/);
1335	else
1336	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &CtxTmp, ((0x80 + iCtx) << X86_TRAP_ERR_SEL_SHIFT) \| X86_TRAP_ERR_IDT);
1337	uExpected = CtxTmp.rflags.u32;
1338	if (TrapCtx.fHandlerRfl != uExpected)
1339	bs3CpuBasic2_FailedF("unexpected handler rflags value: %RX64 expected %RX32; CtxTmp.rflags=%RX64 Ctx.rflags=%RX64\n",
1340	TrapCtx.fHandlerRfl, uExpected, CtxTmp.rflags.u, TrapCtx.Ctx.rflags.u);
1341	g_usBs3TestStep++;
1342	}
1343	}
1344
1345	/** @todo CS.LIMIT / canonical(CS) */
1346
1347
1348	/*
1349	* Check invalid gate types.
1350	*/
1351	g_usBs3TestStep = 32000;
1352	for (iRing = 0; iRing <= 3; iRing++)
1353	{
1354	static const uint16_t s_auCSes[] = { BS3_SEL_R0_CS16, BS3_SEL_R0_CS32, BS3_SEL_R0_CS64,
1355	BS3_SEL_TSS16, BS3_SEL_TSS32, BS3_SEL_TSS64, 0, BS3_SEL_SPARE_1f };
1356	static uint16_t const s_auInvlTypes64[] = { 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 13,
1357	0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17,
1358	0x18, 0x19, 0x1a, 0x1b, 0x1c, 0x1d, 0x1e, 0x1f };
1359	static uint16_t const s_auInvlTypes32[] = { 0, 1, 2, 3, 8, 9, 10, 11, 13,
1360	0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17,
1361	0x18, 0x19, 0x1a, 0x1b, 0x1c, 0x1d, 0x1e, 0x1f,
1362	/286:/ 12, 14, 15 };
1363	uint16_t const * const pauInvTypes = cIdteShift != 0 ? s_auInvlTypes64 : s_auInvlTypes32;
1364	uint16_t const cInvTypes = cIdteShift != 0 ? RT_ELEMENTS(s_auInvlTypes64)
1365	: f386Plus ? RT_ELEMENTS(s_auInvlTypes32) - 3 : RT_ELEMENTS(s_auInvlTypes32);
1366
1367
1368	for (iCtx = 0; iCtx < RT_ELEMENTS(apCtx8x); iCtx++)
1369	{
1370	unsigned iType;
1371
1372	Bs3MemCpy(&CtxTmp, apCtx8x[iCtx], sizeof(CtxTmp));
1373	Bs3RegCtxConvertToRingX(&CtxTmp, iRing);
1374	# if TMPL_BITS == 32
1375	g_uBs3TrapEipHint = CtxTmp.rip.u32;
1376	# endif
1377	for (iType = 0; iType < cInvTypes; iType++)
1378	{
1379	uint8_t const bSavedType = paIdt[(0x80 + iCtx) << cIdteShift].Gate.u4Type;
1380	paIdt[(0x80 + iCtx) << cIdteShift].Gate.u1DescType = pauInvTypes[iType] >> 4;
1381	paIdt[(0x80 + iCtx) << cIdteShift].Gate.u4Type = pauInvTypes[iType] & 0xf;
1382
1383	for (i = 0; i < 4; i++)
1384	{
1385	for (j = 0; j < RT_ELEMENTS(s_auCSes); j++)
1386	{
1387	uint16_t uCs = (unsigned)(s_auCSes[j] - BS3_SEL_R0_FIRST) < (unsigned)(4 << BS3_SEL_RING_SHIFT)
1388	? (s_auCSes[j] \| i) + (i << BS3_SEL_RING_SHIFT)
1389	: s_auCSes[j] \| i;
1390	/Bs3TestPrintf("g_usBs3TestStep=%u iCtx=%u iRing=%u i=%u uCs=%04x type=%#x\n", g_usBs3TestStep, iCtx, iRing, i, uCs, pauInvTypes[iType]);/
1391	paIdt[(0x80 + iCtx) << cIdteShift].Gate.u16Sel = uCs;
1392	Bs3TrapSetJmpAndRestore(&CtxTmp, &TrapCtx);
1393	g_usBs3TestStep++;
1394	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &CtxTmp, ((0x80 + iCtx) << X86_TRAP_ERR_SEL_SHIFT) \| X86_TRAP_ERR_IDT);
1395
1396	/* Mark it not-present to check that invalid type takes precedence. */
1397	paIdt[(0x80 + iCtx) << cIdteShift].Gate.u1Present = 0;
1398	Bs3TrapSetJmpAndRestore(&CtxTmp, &TrapCtx);
1399	g_usBs3TestStep++;
1400	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &CtxTmp, ((0x80 + iCtx) << X86_TRAP_ERR_SEL_SHIFT) \| X86_TRAP_ERR_IDT);
1401	paIdt[(0x80 + iCtx) << cIdteShift].Gate.u1Present = 1;
1402	}
1403	}
1404
1405	paIdt[(0x80 + iCtx) << cIdteShift].Gate.u16Sel = uSysR0Cs;
1406	paIdt[(0x80 + iCtx) << cIdteShift].Gate.u4Type = bSavedType;
1407	paIdt[(0x80 + iCtx) << cIdteShift].Gate.u1DescType = 0;
1408	paIdt[(0x80 + iCtx) << cIdteShift].Gate.u1Present = 1;
1409	}
1410	}
1411	}
1412	BS3_ASSERT(g_usBs3TestStep < 62000U && g_usBs3TestStep > 32000U);
1413
1414
1415	/** @todo
1416	* - Run \#PF and \#GP (and others?) at CPLs other than zero.
1417	* - Quickly generate all faults.
1418	* - All the peculiarities v8086.
1419	*/
1420
1421	# if TMPL_BITS != 16
1422	Bs3MemFree(pbIdtCopyAlloc, 12*_1K);
1423	# endif
1424	}
1425	#endif /* convert me */
1426
1427
1428	/**
1429	* Executes one round of SIDT and SGDT tests using one assembly worker.
1430	*
1431	* This is written with driving everything from the 16-bit or 32-bit worker in
1432	* mind, i.e. not assuming the test bitcount is the same as the current.
1433	*/
1434	static void bs3CpuBasic2_sidt_sgdt_One(BS3CB2SIDTSGDT const BS3_FAR *pWorker, uint8_t bTestMode, uint8_t bRing,
1435	uint8_t const *pbExpected)
1436	{
1437	BS3TRAPFRAME TrapCtx;
1438	BS3REGCTX Ctx;
1439	BS3REGCTX CtxUdExpected;
1440	BS3REGCTX TmpCtx;
1441	uint8_t const cbBuf = 82; / test buffer area */
1442	uint8_t abBuf[82 + 8 + 8]; / test buffer w/ misalignment test space and some extra guard. */
1443	uint8_t BS3_FAR *pbBuf = abBuf;
1444	uint8_t const cbIdtr = BS3_MODE_IS_64BIT_CODE(bTestMode) ? 2+8 : 2+4;
1445	bool const f286 = (g_uBs3CpuDetected & BS3CPU_TYPE_MASK) == BS3CPU_80286;
1446	uint8_t bFiller;
1447	int off;
1448	int off2;
1449	unsigned cb;
1450	uint8_t BS3_FAR *pbTest;
1451
1452	/* make sure they're allocated */
1453	Bs3MemZero(&Ctx, sizeof(Ctx));
1454	Bs3MemZero(&CtxUdExpected, sizeof(CtxUdExpected));
1455	Bs3MemZero(&TmpCtx, sizeof(TmpCtx));
1456	Bs3MemZero(&TrapCtx, sizeof(TrapCtx));
1457	Bs3MemZero(&abBuf, sizeof(abBuf));
1458
1459	/* Create a context, give this routine some more stack space, point the context
1460	at our SIDT [xBX] + UD2 combo, and point DS:xBX at abBuf. */
1461	Bs3RegCtxSaveEx(&Ctx, bTestMode, 256 /cbExtraStack/);
1462	Bs3RegCtxSetGrpSegFromCurPtr(&Ctx, &Ctx.rbx, pWorker->fSs ? &Ctx.ss : &Ctx.ds, abBuf);
1463	Bs3RegCtxSetRipCsFromLnkPtr(&Ctx, pWorker->fpfnWorker);
1464	if (BS3_MODE_IS_16BIT_SYS(bTestMode))
1465	g_uBs3TrapEipHint = Ctx.rip.u32;
1466	if (!BS3_MODE_IS_RM_OR_V86(bTestMode))
1467	Bs3RegCtxConvertToRingX(&Ctx, bRing);
1468
1469	/* For successful SIDT attempts, we'll stop at the UD2. */
1470	Bs3MemCpy(&CtxUdExpected, &Ctx, sizeof(Ctx));
1471	CtxUdExpected.rip.u += pWorker->cbInstr;
1472
1473	/*
1474	* Check that it works at all and that only bytes we expect gets written to.
1475	*/
1476	/* First with zero buffer. */
1477	Bs3MemZero(abBuf, sizeof(abBuf));
1478	if (!ASMMemIsAllU8(abBuf, sizeof(abBuf), 0))
1479	Bs3TestFailedF("ASMMemIsAllU8 or Bs3MemZero is busted: abBuf=%.*Rhxs\n", sizeof(abBuf), pbBuf);
1480	if (!ASMMemIsZero(abBuf, sizeof(abBuf)))
1481	Bs3TestFailedF("ASMMemIsZero or Bs3MemZero is busted: abBuf=%.*Rhxs\n", sizeof(abBuf), pbBuf);
1482	Bs3TrapSetJmpAndRestore(&Ctx, &TrapCtx);
1483	bs3CpuBasic2_CompareUdCtx(&TrapCtx, &CtxUdExpected);
1484	if (f286 && abBuf[cbIdtr - 1] != 0xff)
1485	Bs3TestFailedF("286: Top base byte isn't 0xff (#1): %#x\n", abBuf[cbIdtr - 1]);
1486	if (!ASMMemIsZero(&abBuf[cbIdtr], cbBuf - cbIdtr))
1487	Bs3TestFailedF("Unexpected buffer bytes set (#1): cbIdtr=%u abBuf=%.*Rhxs\n", cbIdtr, cbBuf, pbBuf);
1488	if (Bs3MemCmp(abBuf, pbExpected, cbIdtr) != 0)
1489	Bs3TestFailedF("Mismatch (%s,#1): expected %.Rhxs, got %.Rhxs\n", pWorker->pszDesc, cbIdtr, pbExpected, cbIdtr, abBuf);
1490	g_usBs3TestStep++;
1491
1492	/* Again with a buffer filled with a byte not occuring in the previous result. */
1493	bFiller = 0x55;
1494	while (Bs3MemChr(abBuf, bFiller, cbBuf) != NULL)
1495	bFiller++;
1496	Bs3MemSet(abBuf, bFiller, sizeof(abBuf));
1497	if (!ASMMemIsAllU8(abBuf, sizeof(abBuf), bFiller))
1498	Bs3TestFailedF("ASMMemIsAllU8 or Bs3MemSet is busted: bFiller=%#x abBuf=%.*Rhxs\n", bFiller, sizeof(abBuf), pbBuf);
1499
1500	Bs3TrapSetJmpAndRestore(&Ctx, &TrapCtx);
1501	bs3CpuBasic2_CompareUdCtx(&TrapCtx, &CtxUdExpected);
1502	if (f286 && abBuf[cbIdtr - 1] != 0xff)
1503	Bs3TestFailedF("286: Top base byte isn't 0xff (#2): %#x\n", abBuf[cbIdtr - 1]);
1504	if (!ASMMemIsAllU8(&abBuf[cbIdtr], cbBuf - cbIdtr, bFiller))
1505	Bs3TestFailedF("Unexpected buffer bytes set (#2): cbIdtr=%u bFiller=%#x abBuf=%.*Rhxs\n", cbIdtr, bFiller, cbBuf, pbBuf);
1506	if (Bs3MemChr(abBuf, bFiller, cbIdtr) != NULL)
1507	Bs3TestFailedF("Not all bytes touched: cbIdtr=%u bFiller=%#x abBuf=%.*Rhxs\n", cbIdtr, bFiller, cbBuf, pbBuf);
1508	if (Bs3MemCmp(abBuf, pbExpected, cbIdtr) != 0)
1509	Bs3TestFailedF("Mismatch (%s,#2): expected %.Rhxs, got %.Rhxs\n", pWorker->pszDesc, cbIdtr, pbExpected, cbIdtr, abBuf);
1510	g_usBs3TestStep++;
1511
1512	/*
1513	* Slide the buffer along 8 bytes to cover misalignment.
1514	*/
1515	for (off = 0; off < 8; off++)
1516	{
1517	pbBuf = &abBuf[off];
1518	Bs3RegCtxSetGrpSegFromCurPtr(&Ctx, &Ctx.rbx, pWorker->fSs ? &Ctx.ss : &Ctx.ds, &abBuf[off]);
1519	CtxUdExpected.rbx.u = Ctx.rbx.u;
1520
1521	/* First with zero buffer. */
1522	Bs3MemZero(abBuf, sizeof(abBuf));
1523	Bs3TrapSetJmpAndRestore(&Ctx, &TrapCtx);
1524	bs3CpuBasic2_CompareUdCtx(&TrapCtx, &CtxUdExpected);
1525	if (off > 0 && !ASMMemIsZero(abBuf, off))
1526	Bs3TestFailedF("Unexpected buffer bytes set before (#3): cbIdtr=%u off=%u abBuf=%.*Rhxs\n",
1527	cbIdtr, off, off + cbBuf, abBuf);
1528	if (!ASMMemIsZero(&abBuf[off + cbIdtr], sizeof(abBuf) - cbIdtr - off))
1529	Bs3TestFailedF("Unexpected buffer bytes set after (#3): cbIdtr=%u off=%u abBuf=%.*Rhxs\n",
1530	cbIdtr, off, off + cbBuf, abBuf);
1531	if (f286 && abBuf[off + cbIdtr - 1] != 0xff)
1532	Bs3TestFailedF("286: Top base byte isn't 0xff (#3): %#x\n", abBuf[off + cbIdtr - 1]);
1533	if (Bs3MemCmp(&abBuf[off], pbExpected, cbIdtr) != 0)
1534	Bs3TestFailedF("Mismatch (#3): expected %.Rhxs, got %.Rhxs\n", cbIdtr, pbExpected, cbIdtr, &abBuf[off]);
1535	g_usBs3TestStep++;
1536
1537	/* Again with a buffer filled with a byte not occuring in the previous result. */
1538	Bs3MemSet(abBuf, bFiller, sizeof(abBuf));
1539	Bs3TrapSetJmpAndRestore(&Ctx, &TrapCtx);
1540	bs3CpuBasic2_CompareUdCtx(&TrapCtx, &CtxUdExpected);
1541	if (off > 0 && !ASMMemIsAllU8(abBuf, off, bFiller))
1542	Bs3TestFailedF("Unexpected buffer bytes set before (#4): cbIdtr=%u off=%u bFiller=%#x abBuf=%.*Rhxs\n",
1543	cbIdtr, off, bFiller, off + cbBuf, abBuf);
1544	if (!ASMMemIsAllU8(&abBuf[off + cbIdtr], sizeof(abBuf) - cbIdtr - off, bFiller))
1545	Bs3TestFailedF("Unexpected buffer bytes set after (#4): cbIdtr=%u off=%u bFiller=%#x abBuf=%.*Rhxs\n",
1546	cbIdtr, off, bFiller, off + cbBuf, abBuf);
1547	if (Bs3MemChr(&abBuf[off], bFiller, cbIdtr) != NULL)
1548	Bs3TestFailedF("Not all bytes touched (#4): cbIdtr=%u off=%u bFiller=%#x abBuf=%.*Rhxs\n",
1549	cbIdtr, off, bFiller, off + cbBuf, abBuf);
1550	if (f286 && abBuf[off + cbIdtr - 1] != 0xff)
1551	Bs3TestFailedF("286: Top base byte isn't 0xff (#4): %#x\n", abBuf[off + cbIdtr - 1]);
1552	if (Bs3MemCmp(&abBuf[off], pbExpected, cbIdtr) != 0)
1553	Bs3TestFailedF("Mismatch (#4): expected %.Rhxs, got %.Rhxs\n", cbIdtr, pbExpected, cbIdtr, &abBuf[off]);
1554	g_usBs3TestStep++;
1555	}
1556	pbBuf = abBuf;
1557	Bs3RegCtxSetGrpSegFromCurPtr(&Ctx, &Ctx.rbx, pWorker->fSs ? &Ctx.ss : &Ctx.ds, abBuf);
1558	CtxUdExpected.rbx.u = Ctx.rbx.u;
1559
1560	/*
1561	* Play with the selector limit if the target mode supports limit checking
1562	* We use BS3_SEL_TEST_PAGE_00 for this
1563	*/
1564	if ( !BS3_MODE_IS_RM_OR_V86(bTestMode)
1565	&& !BS3_MODE_IS_64BIT_CODE(bTestMode))
1566	{
1567	uint16_t cbLimit;
1568	uint32_t uFlatBuf = Bs3SelPtrToFlat(abBuf);
1569	Bs3GdteTestPage00 = Bs3Gdte_DATA16;
1570	Bs3GdteTestPage00.Gen.u2Dpl = bRing;
1571	Bs3GdteTestPage00.Gen.u16BaseLow = (uint16_t)uFlatBuf;
1572	Bs3GdteTestPage00.Gen.u8BaseHigh1 = (uint8_t)(uFlatBuf >> 16);
1573	Bs3GdteTestPage00.Gen.u8BaseHigh2 = (uint8_t)(uFlatBuf >> 24);
1574
1575	if (pWorker->fSs)
1576	CtxUdExpected.ss = Ctx.ss = BS3_SEL_TEST_PAGE_00 \| bRing;
1577	else
1578	CtxUdExpected.ds = Ctx.ds = BS3_SEL_TEST_PAGE_00 \| bRing;
1579
1580	/* Expand up (normal). */
1581	for (off = 0; off < 8; off++)
1582	{
1583	CtxUdExpected.rbx.u = Ctx.rbx.u = off;
1584	for (cbLimit = 0; cbLimit < cbIdtr*2; cbLimit++)
1585	{
1586	Bs3GdteTestPage00.Gen.u16LimitLow = cbLimit;
1587	Bs3MemSet(abBuf, bFiller, sizeof(abBuf));
1588	Bs3TrapSetJmpAndRestore(&Ctx, &TrapCtx);
1589	if (off + cbIdtr <= cbLimit + 1)
1590	{
1591	bs3CpuBasic2_CompareUdCtx(&TrapCtx, &CtxUdExpected);
1592	if (Bs3MemChr(&abBuf[off], bFiller, cbIdtr) != NULL)
1593	Bs3TestFailedF("Not all bytes touched (#5): cbIdtr=%u off=%u cbLimit=%u bFiller=%#x abBuf=%.*Rhxs\n",
1594	cbIdtr, off, cbLimit, bFiller, off + cbBuf, abBuf);
1595	if (Bs3MemCmp(&abBuf[off], pbExpected, cbIdtr) != 0)
1596	Bs3TestFailedF("Mismatch (#5): expected %.Rhxs, got %.Rhxs\n", cbIdtr, pbExpected, cbIdtr, &abBuf[off]);
1597	if (f286 && abBuf[off + cbIdtr - 1] != 0xff)
1598	Bs3TestFailedF("286: Top base byte isn't 0xff (#5): %#x\n", abBuf[off + cbIdtr - 1]);
1599	}
1600	else
1601	{
1602	if (pWorker->fSs)
1603	bs3CpuBasic2_CompareSsCtx(&TrapCtx, &Ctx, 0, false /f486ResumeFlagHint/);
1604	else
1605	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &Ctx, 0);
1606	if (off + 2 <= cbLimit + 1)
1607	{
1608	if (Bs3MemChr(&abBuf[off], bFiller, 2) != NULL)
1609	Bs3TestFailedF("Limit bytes not touched (#6): cbIdtr=%u off=%u cbLimit=%u bFiller=%#x abBuf=%.*Rhxs\n",
1610	cbIdtr, off, cbLimit, bFiller, off + cbBuf, abBuf);
1611	if (Bs3MemCmp(&abBuf[off], pbExpected, 2) != 0)
1612	Bs3TestFailedF("Mismatch (#6): expected %.2Rhxs, got %.2Rhxs\n", pbExpected, &abBuf[off]);
1613	if (!ASMMemIsAllU8(&abBuf[off + 2], cbIdtr - 2, bFiller))
1614	Bs3TestFailedF("Base bytes touched on #GP (#6): cbIdtr=%u off=%u cbLimit=%u bFiller=%#x abBuf=%.*Rhxs\n",
1615	cbIdtr, off, cbLimit, bFiller, off + cbBuf, abBuf);
1616	}
1617	else if (!ASMMemIsAllU8(abBuf, sizeof(abBuf), bFiller))
1618	Bs3TestFailedF("Bytes touched on #GP: cbIdtr=%u off=%u cbLimit=%u bFiller=%#x abBuf=%.*Rhxs\n",
1619	cbIdtr, off, cbLimit, bFiller, off + cbBuf, abBuf);
1620	}
1621
1622	if (off > 0 && !ASMMemIsAllU8(abBuf, off, bFiller))
1623	Bs3TestFailedF("Leading bytes touched (#7): cbIdtr=%u off=%u cbLimit=%u bFiller=%#x abBuf=%.*Rhxs\n",
1624	cbIdtr, off, cbLimit, bFiller, off + cbBuf, abBuf);
1625	if (!ASMMemIsAllU8(&abBuf[off + cbIdtr], sizeof(abBuf) - off - cbIdtr, bFiller))
1626	Bs3TestFailedF("Trailing bytes touched (#7): cbIdtr=%u off=%u cbLimit=%u bFiller=%#x abBuf=%.*Rhxs\n",
1627	cbIdtr, off, cbLimit, bFiller, off + cbBuf, abBuf);
1628
1629	g_usBs3TestStep++;
1630	}
1631	}
1632
1633	/* Expand down (weird). Inverted valid area compared to expand up,
1634	so a limit of zero give us a valid range for 0001..0ffffh (instead of
1635	a segment with one valid byte at 0000h). Whereas a limit of 0fffeh
1636	means one valid byte at 0ffffh, and a limit of 0ffffh means none
1637	(because in a normal expand up the 0ffffh means all 64KB are
1638	accessible). */
1639	Bs3GdteTestPage00.Gen.u4Type = X86_SEL_TYPE_RW_DOWN_ACC;
1640	for (off = 0; off < 8; off++)
1641	{
1642	CtxUdExpected.rbx.u = Ctx.rbx.u = off;
1643	for (cbLimit = 0; cbLimit < cbIdtr*2; cbLimit++)
1644	{
1645	Bs3GdteTestPage00.Gen.u16LimitLow = cbLimit;
1646	Bs3MemSet(abBuf, bFiller, sizeof(abBuf));
1647	Bs3TrapSetJmpAndRestore(&Ctx, &TrapCtx);
1648
1649	if (off > cbLimit)
1650	{
1651	bs3CpuBasic2_CompareUdCtx(&TrapCtx, &CtxUdExpected);
1652	if (Bs3MemChr(&abBuf[off], bFiller, cbIdtr) != NULL)
1653	Bs3TestFailedF("Not all bytes touched (#8): cbIdtr=%u off=%u cbLimit=%u bFiller=%#x abBuf=%.*Rhxs\n",
1654	cbIdtr, off, cbLimit, bFiller, off + cbBuf, abBuf);
1655	if (Bs3MemCmp(&abBuf[off], pbExpected, cbIdtr) != 0)
1656	Bs3TestFailedF("Mismatch (#8): expected %.Rhxs, got %.Rhxs\n", cbIdtr, pbExpected, cbIdtr, &abBuf[off]);
1657	if (f286 && abBuf[off + cbIdtr - 1] != 0xff)
1658	Bs3TestFailedF("286: Top base byte isn't 0xff (#8): %#x\n", abBuf[off + cbIdtr - 1]);
1659	}
1660	else
1661	{
1662	if (pWorker->fSs)
1663	bs3CpuBasic2_CompareSsCtx(&TrapCtx, &Ctx, 0, false /f486ResumeFlagHint/);
1664	else
1665	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &Ctx, 0);
1666	if (!ASMMemIsAllU8(abBuf, sizeof(abBuf), bFiller))
1667	Bs3TestFailedF("Bytes touched on #GP: cbIdtr=%u off=%u cbLimit=%u bFiller=%#x abBuf=%.*Rhxs\n",
1668	cbIdtr, off, cbLimit, bFiller, off + cbBuf, abBuf);
1669	}
1670
1671	if (off > 0 && !ASMMemIsAllU8(abBuf, off, bFiller))
1672	Bs3TestFailedF("Leading bytes touched (#9): cbIdtr=%u off=%u cbLimit=%u bFiller=%#x abBuf=%.*Rhxs\n",
1673	cbIdtr, off, cbLimit, bFiller, off + cbBuf, abBuf);
1674	if (!ASMMemIsAllU8(&abBuf[off + cbIdtr], sizeof(abBuf) - off - cbIdtr, bFiller))
1675	Bs3TestFailedF("Trailing bytes touched (#9): cbIdtr=%u off=%u cbLimit=%u bFiller=%#x abBuf=%.*Rhxs\n",
1676	cbIdtr, off, cbLimit, bFiller, off + cbBuf, abBuf);
1677
1678	g_usBs3TestStep++;
1679	}
1680	}
1681
1682	Bs3RegCtxSetGrpSegFromCurPtr(&Ctx, &Ctx.rbx, pWorker->fSs ? &Ctx.ss : &Ctx.ds, abBuf);
1683	CtxUdExpected.rbx.u = Ctx.rbx.u;
1684	CtxUdExpected.ss = Ctx.ss;
1685	CtxUdExpected.ds = Ctx.ds;
1686	}
1687
1688	/*
1689	* Play with the paging.
1690	*/
1691	if ( BS3_MODE_IS_PAGED(bTestMode)
1692	&& (!pWorker->fSs \|\| bRing == 3) /* SS.DPL == CPL, we'll get some tiled ring-3 selector here. */
1693	&& (pbTest = (uint8_t BS3_FAR *)Bs3MemGuardedTestPageAlloc(BS3MEMKIND_TILED)) != NULL)
1694	{
1695	RTCCUINTXREG uFlatTest = Bs3SelPtrToFlat(pbTest);
1696
1697	/*
1698	* Slide the buffer towards the trailing guard page. We'll observe the
1699	* first word being written entirely separately from the 2nd dword/qword.
1700	*/
1701	for (off = X86_PAGE_SIZE - cbIdtr - 4; off < X86_PAGE_SIZE + 4; off++)
1702	{
1703	Bs3MemSet(&pbTest[X86_PAGE_SIZE - cbIdtr * 2], bFiller, cbIdtr * 2);
1704	Bs3RegCtxSetGrpSegFromCurPtr(&Ctx, &Ctx.rbx, pWorker->fSs ? &Ctx.ss : &Ctx.ds, &pbTest[off]);
1705	Bs3TrapSetJmpAndRestore(&Ctx, &TrapCtx);
1706	if (off + cbIdtr <= X86_PAGE_SIZE)
1707	{
1708	CtxUdExpected.rbx = Ctx.rbx;
1709	CtxUdExpected.ss = Ctx.ss;
1710	CtxUdExpected.ds = Ctx.ds;
1711	bs3CpuBasic2_CompareUdCtx(&TrapCtx, &CtxUdExpected);
1712	if (Bs3MemCmp(&pbTest[off], pbExpected, cbIdtr) != 0)
1713	Bs3TestFailedF("Mismatch (#9): expected %.Rhxs, got %.Rhxs\n", cbIdtr, pbExpected, cbIdtr, &pbTest[off]);
1714	}
1715	else
1716	{
1717	bs3CpuBasic2_ComparePfCtx(&TrapCtx, &Ctx, X86_TRAP_PF_RW \| (Ctx.bCpl == 3 ? X86_TRAP_PF_US : 0),
1718	uFlatTest + RT_MAX(off, X86_PAGE_SIZE));
1719	if ( off <= X86_PAGE_SIZE - 2
1720	&& Bs3MemCmp(&pbTest[off], pbExpected, 2) != 0)
1721	Bs3TestFailedF("Mismatch (#10): Expected limit %.2Rhxs, got %.2Rhxs; off=%#x\n",
1722	pbExpected, &pbTest[off], off);
1723	if ( off < X86_PAGE_SIZE - 2
1724	&& !ASMMemIsAllU8(&pbTest[off + 2], X86_PAGE_SIZE - off - 2, bFiller))
1725	Bs3TestFailedF("Wrote partial base on #PF (#10): bFiller=%#x, got %.*Rhxs; off=%#x\n",
1726	bFiller, X86_PAGE_SIZE - off - 2, &pbTest[off + 2], off);
1727	if (off == X86_PAGE_SIZE - 1 && pbTest[off] != bFiller)
1728	Bs3TestFailedF("Wrote partial limit on #PF (#10): Expected %02x, got %02x\n", bFiller, pbTest[off]);
1729	}
1730	g_usBs3TestStep++;
1731	}
1732
1733	/*
1734	* Now, do it the other way around. It should look normal now since writing
1735	* the limit will #PF first and nothing should be written.
1736	*/
1737	for (off = cbIdtr + 4; off >= -cbIdtr - 4; off--)
1738	{
1739	Bs3MemSet(pbTest, bFiller, 48);
1740	Bs3RegCtxSetGrpSegFromCurPtr(&Ctx, &Ctx.rbx, pWorker->fSs ? &Ctx.ss : &Ctx.ds, &pbTest[off]);
1741	Bs3TrapSetJmpAndRestore(&Ctx, &TrapCtx);
1742	if (off >= 0)
1743	{
1744	CtxUdExpected.rbx = Ctx.rbx;
1745	CtxUdExpected.ss = Ctx.ss;
1746	CtxUdExpected.ds = Ctx.ds;
1747	bs3CpuBasic2_CompareUdCtx(&TrapCtx, &CtxUdExpected);
1748	if (Bs3MemCmp(&pbTest[off], pbExpected, cbIdtr) != 0)
1749	Bs3TestFailedF("Mismatch (#11): expected %.Rhxs, got %.Rhxs\n", cbIdtr, pbExpected, cbIdtr, &pbTest[off]);
1750	}
1751	else
1752	{
1753	bs3CpuBasic2_ComparePfCtx(&TrapCtx, &Ctx, X86_TRAP_PF_RW \| (Ctx.bCpl == 3 ? X86_TRAP_PF_US : 0), uFlatTest + off);
1754	if ( -off < cbIdtr
1755	&& !ASMMemIsAllU8(pbTest, cbIdtr + off, bFiller))
1756	Bs3TestFailedF("Wrote partial content on #PF (#12): bFiller=%#x, found %.*Rhxs; off=%d\n",
1757	bFiller, cbIdtr + off, pbTest, off);
1758	}
1759	if (!ASMMemIsAllU8(&pbTest[RT_MAX(cbIdtr + off, 0)], 16, bFiller))
1760	Bs3TestFailedF("Wrote beyond expected area (#13): bFiller=%#x, found %.16Rhxs; off=%d\n",
1761	bFiller, &pbTest[RT_MAX(cbIdtr + off, 0)], off);
1762	g_usBs3TestStep++;
1763	}
1764
1765	/*
1766	* Combine paging and segment limit and check ordering.
1767	* This is kind of interesting here since it the instruction seems to
1768	* be doing two separate writes.
1769	*/
1770	if ( !BS3_MODE_IS_RM_OR_V86(bTestMode)
1771	&& !BS3_MODE_IS_64BIT_CODE(bTestMode))
1772	{
1773	uint16_t cbLimit;
1774
1775	Bs3GdteTestPage00 = Bs3Gdte_DATA16;
1776	Bs3GdteTestPage00.Gen.u2Dpl = bRing;
1777	Bs3GdteTestPage00.Gen.u16BaseLow = (uint16_t)uFlatTest;
1778	Bs3GdteTestPage00.Gen.u8BaseHigh1 = (uint8_t)(uFlatTest >> 16);
1779	Bs3GdteTestPage00.Gen.u8BaseHigh2 = (uint8_t)(uFlatTest >> 24);
1780
1781	if (pWorker->fSs)
1782	CtxUdExpected.ss = Ctx.ss = BS3_SEL_TEST_PAGE_00 \| bRing;
1783	else
1784	CtxUdExpected.ds = Ctx.ds = BS3_SEL_TEST_PAGE_00 \| bRing;
1785
1786	/* Expand up (normal), approaching tail guard page. */
1787	for (off = X86_PAGE_SIZE - cbIdtr - 4; off < X86_PAGE_SIZE + 4; off++)
1788	{
1789	CtxUdExpected.rbx.u = Ctx.rbx.u = off;
1790	for (cbLimit = X86_PAGE_SIZE - cbIdtr2; cbLimit < X86_PAGE_SIZE + cbIdtr2; cbLimit++)
1791	{
1792	Bs3GdteTestPage00.Gen.u16LimitLow = cbLimit;
1793	Bs3MemSet(&pbTest[X86_PAGE_SIZE - cbIdtr * 2], bFiller, cbIdtr * 2);
1794	Bs3TrapSetJmpAndRestore(&Ctx, &TrapCtx);
1795	if (off + cbIdtr <= cbLimit + 1)
1796	{
1797	/* No #GP, but maybe #PF. */
1798	if (off + cbIdtr <= X86_PAGE_SIZE)
1799	{
1800	bs3CpuBasic2_CompareUdCtx(&TrapCtx, &CtxUdExpected);
1801	if (Bs3MemCmp(&pbTest[off], pbExpected, cbIdtr) != 0)
1802	Bs3TestFailedF("Mismatch (#14): expected %.Rhxs, got %.Rhxs\n",
1803	cbIdtr, pbExpected, cbIdtr, &pbTest[off]);
1804	}
1805	else
1806	{
1807	bs3CpuBasic2_ComparePfCtx(&TrapCtx, &Ctx, X86_TRAP_PF_RW \| (Ctx.bCpl == 3 ? X86_TRAP_PF_US : 0),
1808	uFlatTest + RT_MAX(off, X86_PAGE_SIZE));
1809	if ( off <= X86_PAGE_SIZE - 2
1810	&& Bs3MemCmp(&pbTest[off], pbExpected, 2) != 0)
1811	Bs3TestFailedF("Mismatch (#15): Expected limit %.2Rhxs, got %.2Rhxs; off=%#x\n",
1812	pbExpected, &pbTest[off], off);
1813	cb = X86_PAGE_SIZE - off - 2;
1814	if ( off < X86_PAGE_SIZE - 2
1815	&& !ASMMemIsAllU8(&pbTest[off + 2], cb, bFiller))
1816	Bs3TestFailedF("Wrote partial base on #PF (#15): bFiller=%#x, got %.*Rhxs; off=%#x\n",
1817	bFiller, cb, &pbTest[off + 2], off);
1818	if (off == X86_PAGE_SIZE - 1 && pbTest[off] != bFiller)
1819	Bs3TestFailedF("Wrote partial limit on #PF (#15): Expected %02x, got %02x\n", bFiller, pbTest[off]);
1820	}
1821	}
1822	else if (off + 2 <= cbLimit + 1)
1823	{
1824	/* [ig]tr.limit writing does not cause #GP, but may cause #PG, if not writing the base causes #GP. */
1825	if (off <= X86_PAGE_SIZE - 2)
1826	{
1827	if (pWorker->fSs)
1828	bs3CpuBasic2_CompareSsCtx(&TrapCtx, &Ctx, 0, false /f486ResumeFlagHint/);
1829	else
1830	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &Ctx, 0);
1831	if (Bs3MemCmp(&pbTest[off], pbExpected, 2) != 0)
1832	Bs3TestFailedF("Mismatch (#16): Expected limit %.2Rhxs, got %.2Rhxs; off=%#x\n",
1833	pbExpected, &pbTest[off], off);
1834	cb = X86_PAGE_SIZE - off - 2;
1835	if ( off < X86_PAGE_SIZE - 2
1836	&& !ASMMemIsAllU8(&pbTest[off + 2], cb, bFiller))
1837	Bs3TestFailedF("Wrote partial base with limit (#16): bFiller=%#x, got %.*Rhxs; off=%#x\n",
1838	bFiller, cb, &pbTest[off + 2], off);
1839	}
1840	else
1841	{
1842	bs3CpuBasic2_ComparePfCtx(&TrapCtx, &Ctx, X86_TRAP_PF_RW \| (Ctx.bCpl == 3 ? X86_TRAP_PF_US : 0),
1843	uFlatTest + RT_MAX(off, X86_PAGE_SIZE));
1844	if ( off < X86_PAGE_SIZE
1845	&& !ASMMemIsAllU8(&pbTest[off], X86_PAGE_SIZE - off, bFiller))
1846	Bs3TestFailedF("Mismatch (#16): Partial limit write on #PF: bFiller=%#x, got %.*Rhxs\n",
1847	bFiller, X86_PAGE_SIZE - off, &pbTest[off]);
1848	}
1849	}
1850	else
1851	{
1852	/* #GP/#SS on limit. */
1853	if (pWorker->fSs)
1854	bs3CpuBasic2_CompareSsCtx(&TrapCtx, &Ctx, 0, false /f486ResumeFlagHint/);
1855	else
1856	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &Ctx, 0);
1857	if ( off < X86_PAGE_SIZE
1858	&& !ASMMemIsAllU8(&pbTest[off], X86_PAGE_SIZE - off, bFiller))
1859	Bs3TestFailedF("Mismatch (#17): Partial write on #GP: bFiller=%#x, got %.*Rhxs\n",
1860	bFiller, X86_PAGE_SIZE - off, &pbTest[off]);
1861	}
1862
1863	cb = RT_MIN(cbIdtr * 2, off - (X86_PAGE_SIZE - cbIdtr*2));
1864	if (!ASMMemIsAllU8(&pbTest[X86_PAGE_SIZE - cbIdtr * 2], cb, bFiller))
1865	Bs3TestFailedF("Leading bytes touched (#18): cbIdtr=%u off=%u cbLimit=%u bFiller=%#x pbTest=%.*Rhxs\n",
1866	cbIdtr, off, cbLimit, bFiller, cb, pbTest[X86_PAGE_SIZE - cbIdtr * 2]);
1867
1868	g_usBs3TestStep++;
1869
1870	/* Set DS to 0 and check that we get #GP(0). */
1871	if (!pWorker->fSs)
1872	{
1873	Ctx.ds = 0;
1874	Bs3TrapSetJmpAndRestore(&Ctx, &TrapCtx);
1875	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &Ctx, 0);
1876	Ctx.ds = BS3_SEL_TEST_PAGE_00 \| bRing;
1877	g_usBs3TestStep++;
1878	}
1879	}
1880	}
1881
1882	/* Expand down. */
1883	pbTest -= X86_PAGE_SIZE; /* Note! we're backing up a page to simplify things */
1884	uFlatTest -= X86_PAGE_SIZE;
1885
1886	Bs3GdteTestPage00.Gen.u4Type = X86_SEL_TYPE_RW_DOWN_ACC;
1887	Bs3GdteTestPage00.Gen.u16BaseLow = (uint16_t)uFlatTest;
1888	Bs3GdteTestPage00.Gen.u8BaseHigh1 = (uint8_t)(uFlatTest >> 16);
1889	Bs3GdteTestPage00.Gen.u8BaseHigh2 = (uint8_t)(uFlatTest >> 24);
1890
1891	for (off = X86_PAGE_SIZE - cbIdtr - 4; off < X86_PAGE_SIZE + 4; off++)
1892	{
1893	CtxUdExpected.rbx.u = Ctx.rbx.u = off;
1894	for (cbLimit = X86_PAGE_SIZE - cbIdtr2; cbLimit < X86_PAGE_SIZE + cbIdtr2; cbLimit++)
1895	{
1896	Bs3GdteTestPage00.Gen.u16LimitLow = cbLimit;
1897	Bs3MemSet(&pbTest[X86_PAGE_SIZE], bFiller, cbIdtr * 2);
1898	Bs3TrapSetJmpAndRestore(&Ctx, &TrapCtx);
1899	if (cbLimit < off && off >= X86_PAGE_SIZE)
1900	{
1901	bs3CpuBasic2_CompareUdCtx(&TrapCtx, &CtxUdExpected);
1902	if (Bs3MemCmp(&pbTest[off], pbExpected, cbIdtr) != 0)
1903	Bs3TestFailedF("Mismatch (#19): expected %.Rhxs, got %.Rhxs\n",
1904	cbIdtr, pbExpected, cbIdtr, &pbTest[off]);
1905	cb = X86_PAGE_SIZE + cbIdtr*2 - off;
1906	if (!ASMMemIsAllU8(&pbTest[off + cbIdtr], cb, bFiller))
1907	Bs3TestFailedF("Trailing bytes touched (#20): cbIdtr=%u off=%u cbLimit=%u bFiller=%#x pbTest=%.*Rhxs\n",
1908	cbIdtr, off, cbLimit, bFiller, cb, pbTest[off + cbIdtr]);
1909	}
1910	else
1911	{
1912	if (cbLimit < off && off < X86_PAGE_SIZE)
1913	bs3CpuBasic2_ComparePfCtx(&TrapCtx, &Ctx, X86_TRAP_PF_RW \| (Ctx.bCpl == 3 ? X86_TRAP_PF_US : 0),
1914	uFlatTest + off);
1915	else if (pWorker->fSs)
1916	bs3CpuBasic2_CompareSsCtx(&TrapCtx, &Ctx, 0, false /f486ResumeFlagHint/);
1917	else
1918	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &Ctx, 0);
1919	cb = cbIdtr*2;
1920	if (!ASMMemIsAllU8(&pbTest[X86_PAGE_SIZE], cb, bFiller))
1921	Bs3TestFailedF("Trailing bytes touched (#20): cbIdtr=%u off=%u cbLimit=%u bFiller=%#x pbTest=%.*Rhxs\n",
1922	cbIdtr, off, cbLimit, bFiller, cb, pbTest[X86_PAGE_SIZE]);
1923	}
1924	g_usBs3TestStep++;
1925	}
1926	}
1927
1928	pbTest += X86_PAGE_SIZE;
1929	uFlatTest += X86_PAGE_SIZE;
1930	}
1931
1932	Bs3MemGuardedTestPageFree(pbTest);
1933	}
1934
1935	/*
1936	* Check non-canonical 64-bit space.
1937	*/
1938	if ( BS3_MODE_IS_64BIT_CODE(bTestMode)
1939	&& (pbTest = (uint8_t BS3_FAR *)Bs3PagingSetupCanonicalTraps()) != NULL)
1940	{
1941	/* Make our references relative to the gap. */
1942	pbTest += g_cbBs3PagingOneCanonicalTrap;
1943
1944	/* Hit it from below. */
1945	for (off = -cbIdtr - 8; off < cbIdtr + 8; off++)
1946	{
1947	Ctx.rbx.u = CtxUdExpected.rbx.u = UINT64_C(0x0000800000000000) + off;
1948	Bs3MemSet(&pbTest[-64], bFiller, 64*2);
1949	Bs3TrapSetJmpAndRestore(&Ctx, &TrapCtx);
1950	if (off + cbIdtr <= 0)
1951	{
1952	bs3CpuBasic2_CompareUdCtx(&TrapCtx, &CtxUdExpected);
1953	if (Bs3MemCmp(&pbTest[off], pbExpected, cbIdtr) != 0)
1954	Bs3TestFailedF("Mismatch (#21): expected %.Rhxs, got %.Rhxs\n", cbIdtr, pbExpected, cbIdtr, &pbTest[off]);
1955	}
1956	else
1957	{
1958	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &Ctx, 0);
1959	if (off <= -2 && Bs3MemCmp(&pbTest[off], pbExpected, 2) != 0)
1960	Bs3TestFailedF("Mismatch (#21): expected limit %.2Rhxs, got %.2Rhxs\n", pbExpected, &pbTest[off]);
1961	off2 = off <= -2 ? 2 : 0;
1962	cb = cbIdtr - off2;
1963	if (!ASMMemIsAllU8(&pbTest[off + off2], cb, bFiller))
1964	Bs3TestFailedF("Mismatch (#21): touched base %.Rhxs, got %.Rhxs\n",
1965	cb, &pbExpected[off], cb, &pbTest[off + off2]);
1966	}
1967	if (!ASMMemIsAllU8(&pbTest[off - 16], 16, bFiller))
1968	Bs3TestFailedF("Leading bytes touched (#21): bFiller=%#x, got %.16Rhxs\n", bFiller, &pbTest[off]);
1969	if (!ASMMemIsAllU8(&pbTest[off + cbIdtr], 16, bFiller))
1970	Bs3TestFailedF("Trailing bytes touched (#21): bFiller=%#x, got %.16Rhxs\n", bFiller, &pbTest[off + cbIdtr]);
1971	}
1972
1973	/* Hit it from above. */
1974	for (off = -cbIdtr - 8; off < cbIdtr + 8; off++)
1975	{
1976	Ctx.rbx.u = CtxUdExpected.rbx.u = UINT64_C(0xffff800000000000) + off;
1977	Bs3MemSet(&pbTest[-64], bFiller, 64*2);
1978	Bs3TrapSetJmpAndRestore(&Ctx, &TrapCtx);
1979	if (off >= 0)
1980	{
1981	bs3CpuBasic2_CompareUdCtx(&TrapCtx, &CtxUdExpected);
1982	if (Bs3MemCmp(&pbTest[off], pbExpected, cbIdtr) != 0)
1983	Bs3TestFailedF("Mismatch (#22): expected %.Rhxs, got %.Rhxs\n", cbIdtr, pbExpected, cbIdtr, &pbTest[off]);
1984	}
1985	else
1986	{
1987	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &Ctx, 0);
1988	if (!ASMMemIsAllU8(&pbTest[off], cbIdtr, bFiller))
1989	Bs3TestFailedF("Mismatch (#22): touched base %.Rhxs, got %.Rhxs\n",
1990	cbIdtr, &pbExpected[off], cbIdtr, &pbTest[off]);
1991	}
1992	if (!ASMMemIsAllU8(&pbTest[off - 16], 16, bFiller))
1993	Bs3TestFailedF("Leading bytes touched (#22): bFiller=%#x, got %.16Rhxs\n", bFiller, &pbTest[off]);
1994	if (!ASMMemIsAllU8(&pbTest[off + cbIdtr], 16, bFiller))
1995	Bs3TestFailedF("Trailing bytes touched (#22): bFiller=%#x, got %.16Rhxs\n", bFiller, &pbTest[off + cbIdtr]);
1996	}
1997
1998	}
1999	}
2000
2001
2002	static void bs3CpuBasic2_sidt_sgdt_Common(uint8_t bTestMode, BS3CB2SIDTSGDT const BS3_FAR *paWorkers, unsigned cWorkers,
2003	uint8_t const *pbExpected)
2004	{
2005	unsigned idx;
2006	unsigned bRing;
2007	unsigned iStep = 0;
2008
2009	/* Note! We skip the SS checks for ring-0 since we badly mess up SS in the
2010	test and don't want to bother with double faults. */
2011	for (bRing = 0; bRing <= 3; bRing++)
2012	{
2013	for (idx = 0; idx < cWorkers; idx++)
2014	if ( (paWorkers[idx].bMode & (bTestMode & BS3_MODE_CODE_MASK))
2015	&& (!paWorkers[idx].fSs \|\| bRing != 0 /** @todo \|\| BS3_MODE_IS_64BIT_SYS(bTestMode)*/ ))
2016	{
2017	g_usBs3TestStep = iStep;
2018	bs3CpuBasic2_sidt_sgdt_One(&paWorkers[idx], bTestMode, bRing, pbExpected);
2019	iStep += 1000;
2020	}
2021	if (BS3_MODE_IS_RM_OR_V86(bTestMode))
2022	break;
2023	}
2024	}
2025
2026
2027	BS3_DECL_FAR(uint8_t) BS3_CMN_FAR_NM(bs3CpuBasic2_sidt)(uint8_t bMode)
2028	{
2029	union
2030	{
2031	RTIDTR Idtr;
2032	uint8_t ab[16];
2033	} Expected;
2034
2035	//if (bMode != BS3_MODE_LM64) return BS3TESTDOMODE_SKIPPED;
2036	bs3CpuBasic2_SetGlobals(bMode);
2037
2038	/*
2039	* Pass to common worker which is only compiled once per mode.
2040	*/
2041	Bs3MemZero(&Expected, sizeof(Expected));
2042	ASMGetIDTR(&Expected.Idtr);
2043	bs3CpuBasic2_sidt_sgdt_Common(bMode, g_aSidtWorkers, RT_ELEMENTS(g_aSidtWorkers), Expected.ab);
2044
2045	/*
2046	* Re-initialize the IDT.
2047	*/
2048	Bs3TrapReInit();
2049	return 0;
2050	}
2051
2052
2053	BS3_DECL_FAR(uint8_t) BS3_CMN_FAR_NM(bs3CpuBasic2_sgdt)(uint8_t bMode)
2054	{
2055	uint64_t const uOrgAddr = Bs3Lgdt_Gdt.uAddr;
2056	uint64_t uNew = 0;
2057	union
2058	{
2059	RTGDTR Gdtr;
2060	uint8_t ab[16];
2061	} Expected;
2062
2063	//if (bMode != BS3_MODE_LM64) return BS3TESTDOMODE_SKIPPED;
2064	bs3CpuBasic2_SetGlobals(bMode);
2065
2066	/*
2067	* If paged mode, try push the GDT way up.
2068	*/
2069	Bs3MemZero(&Expected, sizeof(Expected));
2070	ASMGetGDTR(&Expected.Gdtr);
2071	if (BS3_MODE_IS_PAGED(bMode))
2072	{
2073	/** @todo loading non-canonical base addresses. */
2074	int rc;
2075	uNew = BS3_MODE_IS_64BIT_SYS(bMode) ? UINT64_C(0xffff80fedcb70000) : UINT64_C(0xc2d28000);
2076	uNew \|= uOrgAddr & X86_PAGE_OFFSET_MASK;
2077	rc = Bs3PagingAlias(uNew, uOrgAddr, Bs3Lgdt_Gdt.cb, X86_PTE_P \| X86_PTE_RW \| X86_PTE_US \| X86_PTE_D \| X86_PTE_A);
2078	if (RT_SUCCESS(rc))
2079	{
2080	Bs3Lgdt_Gdt.uAddr = uNew;
2081	Bs3UtilSetFullGdtr(Bs3Lgdt_Gdt.cb, uNew);
2082	ASMGetGDTR(&Expected.Gdtr);
2083	if (BS3_MODE_IS_64BIT_SYS(bMode) && ARCH_BITS != 64)
2084	(uint32_t )&Expected.ab[6] = (uint32_t)(uNew >> 32);
2085	}
2086	}
2087
2088	/*
2089	* Pass to common worker which is only compiled once per mode.
2090	*/
2091	bs3CpuBasic2_sidt_sgdt_Common(bMode, g_aSgdtWorkers, RT_ELEMENTS(g_aSgdtWorkers), Expected.ab);
2092
2093	/*
2094	* Unalias the GDT.
2095	*/
2096	if (uNew != 0)
2097	{
2098	Bs3Lgdt_Gdt.uAddr = uOrgAddr;
2099	Bs3UtilSetFullGdtr(Bs3Lgdt_Gdt.cb, uOrgAddr);
2100	Bs3PagingUnalias(uNew, Bs3Lgdt_Gdt.cb);
2101	}
2102
2103	/*
2104	* Re-initialize the IDT.
2105	*/
2106	Bs3TrapReInit();
2107	return 0;
2108	}
2109
2110
2111
2112	/*
2113	* LIDT & LGDT
2114	*/
2115
2116	/**
2117	* Executes one round of LIDT and LGDT tests using one assembly worker.
2118	*
2119	* This is written with driving everything from the 16-bit or 32-bit worker in
2120	* mind, i.e. not assuming the test bitcount is the same as the current.
2121	*/
2122	static void bs3CpuBasic2_lidt_lgdt_One(BS3CB2SIDTSGDT const BS3_FAR *pWorker, uint8_t bTestMode, uint8_t bRing,
2123	uint8_t const pbRestore, size_t cbRestore, uint8_t const pbExpected)
2124	{
2125	static const struct
2126	{
2127	bool fGP;
2128	uint16_t cbLimit;
2129	uint64_t u64Base;
2130	} s_aValues64[] =
2131	{
2132	{ false, 0x0000, UINT64_C(0x0000000000000000) },
2133	{ false, 0x0001, UINT64_C(0x0000000000000001) },
2134	{ false, 0x0002, UINT64_C(0x0000000000000010) },
2135	{ false, 0x0003, UINT64_C(0x0000000000000123) },
2136	{ false, 0x0004, UINT64_C(0x0000000000001234) },
2137	{ false, 0x0005, UINT64_C(0x0000000000012345) },
2138	{ false, 0x0006, UINT64_C(0x0000000000123456) },
2139	{ false, 0x0007, UINT64_C(0x0000000001234567) },
2140	{ false, 0x0008, UINT64_C(0x0000000012345678) },
2141	{ false, 0x0009, UINT64_C(0x0000000123456789) },
2142	{ false, 0x000a, UINT64_C(0x000000123456789a) },
2143	{ false, 0x000b, UINT64_C(0x00000123456789ab) },
2144	{ false, 0x000c, UINT64_C(0x0000123456789abc) },
2145	{ false, 0x001c, UINT64_C(0x00007ffffeefefef) },
2146	{ false, 0xffff, UINT64_C(0x00007fffffffffff) },
2147	{ true, 0xf3f1, UINT64_C(0x0000800000000000) },
2148	{ true, 0x0000, UINT64_C(0x0000800000000000) },
2149	{ true, 0x0000, UINT64_C(0x0000800000000333) },
2150	{ true, 0x00f0, UINT64_C(0x0001000000000000) },
2151	{ true, 0x0ff0, UINT64_C(0x0012000000000000) },
2152	{ true, 0x0eff, UINT64_C(0x0123000000000000) },
2153	{ true, 0xe0fe, UINT64_C(0x1234000000000000) },
2154	{ true, 0x00ad, UINT64_C(0xffff300000000000) },
2155	{ true, 0x0000, UINT64_C(0xffff7fffffffffff) },
2156	{ true, 0x00f0, UINT64_C(0xffff7fffffffffff) },
2157	{ false, 0x5678, UINT64_C(0xffff800000000000) },
2158	{ false, 0x2969, UINT64_C(0xffffffffffeefefe) },
2159	{ false, 0x1221, UINT64_C(0xffffffffffffffff) },
2160	{ false, 0x1221, UINT64_C(0xffffffffffffffff) },
2161	};
2162	static const struct
2163	{
2164	uint16_t cbLimit;
2165	uint32_t u32Base;
2166	} s_aValues32[] =
2167	{
2168	{ 0xdfdf, UINT32_C(0xefefefef) },
2169	{ 0x0000, UINT32_C(0x00000000) },
2170	{ 0x0001, UINT32_C(0x00000001) },
2171	{ 0x0002, UINT32_C(0x00000012) },
2172	{ 0x0003, UINT32_C(0x00000123) },
2173	{ 0x0004, UINT32_C(0x00001234) },
2174	{ 0x0005, UINT32_C(0x00012345) },
2175	{ 0x0006, UINT32_C(0x00123456) },
2176	{ 0x0007, UINT32_C(0x01234567) },
2177	{ 0x0008, UINT32_C(0x12345678) },
2178	{ 0x0009, UINT32_C(0x80204060) },
2179	{ 0x000a, UINT32_C(0xddeeffaa) },
2180	{ 0x000b, UINT32_C(0xfdecdbca) },
2181	{ 0x000c, UINT32_C(0x6098456b) },
2182	{ 0x000d, UINT32_C(0x98506099) },
2183	{ 0x000e, UINT32_C(0x206950bc) },
2184	{ 0x000f, UINT32_C(0x9740395d) },
2185	{ 0x0334, UINT32_C(0x64a9455e) },
2186	{ 0xb423, UINT32_C(0xd20b6eff) },
2187	{ 0x4955, UINT32_C(0x85296d46) },
2188	{ 0xffff, UINT32_C(0x07000039) },
2189	{ 0xefe1, UINT32_C(0x0007fe00) },
2190	};
2191
2192	BS3TRAPFRAME TrapCtx;
2193	BS3REGCTX Ctx;
2194	BS3REGCTX CtxUdExpected;
2195	BS3REGCTX TmpCtx;
2196	uint8_t abBufLoad[40]; /* Test buffer w/ misalignment test space and some (cbIdtr) extra guard. */
2197	uint8_t abBufSave[32]; /* For saving the result after loading. */
2198	uint8_t abBufRestore[24]; /* For restoring sane value (same seg as abBufSave!). */
2199	uint8_t abExpectedFilled[32]; /* Same as pbExpected, except it's filled with bFiller2 instead of zeros. */
2200	uint8_t BS3_FAR pbBufSave; / Correctly aligned pointer into abBufSave. */
2201	uint8_t BS3_FAR pbBufRestore; / Correctly aligned pointer into abBufRestore. */
2202	uint8_t const cbIdtr = BS3_MODE_IS_64BIT_CODE(bTestMode) ? 2+8 : 2+4;
2203	uint8_t const cbBaseLoaded = BS3_MODE_IS_64BIT_CODE(bTestMode) ? 8
2204	: BS3_MODE_IS_16BIT_CODE(bTestMode) == !(pWorker->fFlags & BS3CB2SIDTSGDT_F_OPSIZE)
2205	? 3 : 4;
2206	bool const f286 = (g_uBs3CpuDetected & BS3CPU_TYPE_MASK) == BS3CPU_80286;
2207	uint8_t const bTop16BitBase = f286 ? 0xff : 0x00;
2208	uint8_t bFiller1; /* For filling abBufLoad. */
2209	uint8_t bFiller2; /* For filling abBufSave and expectations. */
2210	int off;
2211	uint8_t BS3_FAR *pbTest;
2212	unsigned i;
2213
2214	/* make sure they're allocated */
2215	Bs3MemZero(&Ctx, sizeof(Ctx));
2216	Bs3MemZero(&CtxUdExpected, sizeof(CtxUdExpected));
2217	Bs3MemZero(&TmpCtx, sizeof(TmpCtx));
2218	Bs3MemZero(&TrapCtx, sizeof(TrapCtx));
2219	Bs3MemZero(abBufSave, sizeof(abBufSave));
2220	Bs3MemZero(abBufLoad, sizeof(abBufLoad));
2221	Bs3MemZero(abBufRestore, sizeof(abBufRestore));
2222
2223	/*
2224	* Create a context, giving this routine some more stack space.
2225	* - Point the context at our LIDT [xBX] + SIDT [xDI] + LIDT [xSI] + UD2 combo.
2226	* - Point DS/SS:xBX at abBufLoad.
2227	* - Point ES:xDI at abBufSave.
2228	* - Point ES:xSI at abBufRestore.
2229	*/
2230	Bs3RegCtxSaveEx(&Ctx, bTestMode, 256 /cbExtraStack/);
2231	Bs3RegCtxSetRipCsFromLnkPtr(&Ctx, pWorker->fpfnWorker);
2232	if (BS3_MODE_IS_16BIT_SYS(bTestMode))
2233	g_uBs3TrapEipHint = Ctx.rip.u32;
2234	Ctx.rflags.u16 &= ~X86_EFL_IF;
2235	Bs3RegCtxSetGrpSegFromCurPtr(&Ctx, &Ctx.rbx, pWorker->fSs ? &Ctx.ss : &Ctx.ds, abBufLoad);
2236
2237	pbBufSave = abBufSave;
2238	if ((BS3_FP_OFF(pbBufSave) + 2) & 7)
2239	pbBufSave += 8 - ((BS3_FP_OFF(pbBufSave) + 2) & 7);
2240	Bs3RegCtxSetGrpSegFromCurPtr(&Ctx, &Ctx.rdi, &Ctx.es, pbBufSave);
2241
2242	pbBufRestore = abBufRestore;
2243	if ((BS3_FP_OFF(pbBufRestore) + 2) & 7)
2244	pbBufRestore += 8 - ((BS3_FP_OFF(pbBufRestore) + 2) & 7);
2245	Bs3RegCtxSetGrpSegFromCurPtr(&Ctx, &Ctx.rsi, &Ctx.es, pbBufRestore);
2246	Bs3MemCpy(pbBufRestore, pbRestore, cbRestore);
2247
2248	if (!BS3_MODE_IS_RM_OR_V86(bTestMode))
2249	Bs3RegCtxConvertToRingX(&Ctx, bRing);
2250
2251	/* For successful SIDT attempts, we'll stop at the UD2. */
2252	Bs3MemCpy(&CtxUdExpected, &Ctx, sizeof(Ctx));
2253	CtxUdExpected.rip.u += pWorker->cbInstr;
2254
2255	/*
2256	* Check that it works at all.
2257	*/
2258	Bs3MemZero(abBufLoad, sizeof(abBufLoad));
2259	Bs3MemCpy(abBufLoad, pbBufRestore, cbIdtr);
2260	Bs3MemZero(abBufSave, sizeof(abBufSave));
2261	Bs3TrapSetJmpAndRestore(&Ctx, &TrapCtx);
2262	if (bRing != 0)
2263	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &Ctx, 0);
2264	else
2265	{
2266	bs3CpuBasic2_CompareUdCtx(&TrapCtx, &CtxUdExpected);
2267	if (Bs3MemCmp(pbBufSave, pbExpected, cbIdtr * 2) != 0)
2268	Bs3TestFailedF("Mismatch (%s, #1): expected %.Rhxs, got %.Rhxs\n",
2269	pWorker->pszDesc, cbIdtr2, pbExpected, cbIdtr2, pbBufSave);
2270	}
2271	g_usBs3TestStep++;
2272
2273	/* Determine two filler bytes that doesn't appear in the previous result or our expectations. */
2274	bFiller1 = ~0x55;
2275	while ( Bs3MemChr(pbBufSave, bFiller1, cbIdtr) != NULL
2276	\|\| Bs3MemChr(pbRestore, bFiller1, cbRestore) != NULL
2277	\|\| bFiller1 == 0xff)
2278	bFiller1++;
2279	bFiller2 = 0x33;
2280	while ( Bs3MemChr(pbBufSave, bFiller2, cbIdtr) != NULL
2281	\|\| Bs3MemChr(pbRestore, bFiller2, cbRestore) != NULL
2282	\|\| bFiller2 == 0xff
2283	\|\| bFiller2 == bFiller1)
2284	bFiller2++;
2285	Bs3MemSet(abExpectedFilled, bFiller2, sizeof(abExpectedFilled));
2286	Bs3MemCpy(abExpectedFilled, pbExpected, cbIdtr);
2287
2288	/* Again with a buffer filled with a byte not occuring in the previous result. */
2289	Bs3MemSet(abBufLoad, bFiller1, sizeof(abBufLoad));
2290	Bs3MemCpy(abBufLoad, pbBufRestore, cbIdtr);
2291	Bs3MemSet(abBufSave, bFiller2, sizeof(abBufSave));
2292	Bs3TrapSetJmpAndRestore(&Ctx, &TrapCtx);
2293	if (bRing != 0)
2294	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &Ctx, 0);
2295	else
2296	{
2297	bs3CpuBasic2_CompareUdCtx(&TrapCtx, &CtxUdExpected);
2298	if (Bs3MemCmp(pbBufSave, abExpectedFilled, cbIdtr * 2) != 0)
2299	Bs3TestFailedF("Mismatch (%s, #2): expected %.Rhxs, got %.Rhxs\n",
2300	pWorker->pszDesc, cbIdtr2, abExpectedFilled, cbIdtr2, pbBufSave);
2301	}
2302	g_usBs3TestStep++;
2303
2304	/*
2305	* Try loading a bunch of different limit+base value to check what happens,
2306	* especially what happens wrt the top part of the base in 16-bit mode.
2307	*/
2308	if (BS3_MODE_IS_64BIT_CODE(bTestMode))
2309	{
2310	for (i = 0; i < RT_ELEMENTS(s_aValues64); i++)
2311	{
2312	Bs3MemSet(abBufLoad, bFiller1, sizeof(abBufLoad));
2313	Bs3MemCpy(&abBufLoad[0], &s_aValues64[i].cbLimit, 2);
2314	Bs3MemCpy(&abBufLoad[2], &s_aValues64[i].u64Base, 8);
2315	Bs3MemSet(abBufSave, bFiller2, sizeof(abBufSave));
2316	Bs3TrapSetJmpAndRestore(&Ctx, &TrapCtx);
2317	if (bRing != 0 \|\| s_aValues64[i].fGP)
2318	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &Ctx, 0);
2319	else
2320	{
2321	bs3CpuBasic2_CompareUdCtx(&TrapCtx, &CtxUdExpected);
2322	if ( Bs3MemCmp(&pbBufSave[0], &s_aValues64[i].cbLimit, 2) != 0
2323	\|\| Bs3MemCmp(&pbBufSave[2], &s_aValues64[i].u64Base, 8) != 0
2324	\|\| !ASMMemIsAllU8(&pbBufSave[10], cbIdtr, bFiller2))
2325	Bs3TestFailedF("Mismatch (%s, #2): expected %04RX16:%016RX64, fillers %#x %#x, got %.*Rhxs\n",
2326	pWorker->pszDesc, s_aValues64[i].cbLimit, s_aValues64[i].u64Base,
2327	bFiller1, bFiller2, cbIdtr*2, pbBufSave);
2328	}
2329	g_usBs3TestStep++;
2330	}
2331	}
2332	else
2333	{
2334	for (i = 0; i < RT_ELEMENTS(s_aValues32); i++)
2335	{
2336	Bs3MemSet(abBufLoad, bFiller1, sizeof(abBufLoad));
2337	Bs3MemCpy(&abBufLoad[0], &s_aValues32[i].cbLimit, 2);
2338	Bs3MemCpy(&abBufLoad[2], &s_aValues32[i].u32Base, cbBaseLoaded);
2339	Bs3MemSet(abBufSave, bFiller2, sizeof(abBufSave));
2340	Bs3TrapSetJmpAndRestore(&Ctx, &TrapCtx);
2341	if (bRing != 0)
2342	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &Ctx, 0);
2343	else
2344	{
2345	bs3CpuBasic2_CompareUdCtx(&TrapCtx, &CtxUdExpected);
2346	if ( Bs3MemCmp(&pbBufSave[0], &s_aValues32[i].cbLimit, 2) != 0
2347	\|\| Bs3MemCmp(&pbBufSave[2], &s_aValues32[i].u32Base, cbBaseLoaded) != 0
2348	\|\| ( cbBaseLoaded != 4
2349	&& pbBufSave[2+3] != bTop16BitBase)
2350	\|\| !ASMMemIsAllU8(&pbBufSave[8], cbIdtr, bFiller2))
2351	Bs3TestFailedF("Mismatch (%s,#3): loaded %04RX16:%08RX32, fillers %#x %#x%s, got %.*Rhxs\n",
2352	pWorker->pszDesc, s_aValues32[i].cbLimit, s_aValues32[i].u32Base, bFiller1, bFiller2,
2353	f286 ? ", 286" : "", cbIdtr*2, pbBufSave);
2354	}
2355	g_usBs3TestStep++;
2356	}
2357	}
2358
2359	/*
2360	* Slide the buffer along 8 bytes to cover misalignment.
2361	*/
2362	for (off = 0; off < 8; off++)
2363	{
2364	Bs3RegCtxSetGrpSegFromCurPtr(&Ctx, &Ctx.rbx, pWorker->fSs ? &Ctx.ss : &Ctx.ds, &abBufLoad[off]);
2365	CtxUdExpected.rbx.u = Ctx.rbx.u;
2366
2367	Bs3MemSet(abBufLoad, bFiller1, sizeof(abBufLoad));
2368	Bs3MemCpy(&abBufLoad[off], pbBufRestore, cbIdtr);
2369	Bs3MemSet(abBufSave, bFiller2, sizeof(abBufSave));
2370	Bs3TrapSetJmpAndRestore(&Ctx, &TrapCtx);
2371	if (bRing != 0)
2372	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &Ctx, 0);
2373	else
2374	{
2375	bs3CpuBasic2_CompareUdCtx(&TrapCtx, &CtxUdExpected);
2376	if (Bs3MemCmp(pbBufSave, abExpectedFilled, cbIdtr * 2) != 0)
2377	Bs3TestFailedF("Mismatch (%s, #4): expected %.Rhxs, got %.Rhxs\n",
2378	pWorker->pszDesc, cbIdtr2, abExpectedFilled, cbIdtr2, pbBufSave);
2379	}
2380	g_usBs3TestStep++;
2381	}
2382	Bs3RegCtxSetGrpSegFromCurPtr(&Ctx, &Ctx.rbx, pWorker->fSs ? &Ctx.ss : &Ctx.ds, abBufLoad);
2383	CtxUdExpected.rbx.u = Ctx.rbx.u;
2384
2385	/*
2386	* Play with the selector limit if the target mode supports limit checking
2387	* We use BS3_SEL_TEST_PAGE_00 for this
2388	*/
2389	if ( !BS3_MODE_IS_RM_OR_V86(bTestMode)
2390	&& !BS3_MODE_IS_64BIT_CODE(bTestMode))
2391	{
2392	uint16_t cbLimit;
2393	uint32_t uFlatBuf = Bs3SelPtrToFlat(abBufLoad);
2394	Bs3GdteTestPage00 = Bs3Gdte_DATA16;
2395	Bs3GdteTestPage00.Gen.u2Dpl = bRing;
2396	Bs3GdteTestPage00.Gen.u16BaseLow = (uint16_t)uFlatBuf;
2397	Bs3GdteTestPage00.Gen.u8BaseHigh1 = (uint8_t)(uFlatBuf >> 16);
2398	Bs3GdteTestPage00.Gen.u8BaseHigh2 = (uint8_t)(uFlatBuf >> 24);
2399
2400	if (pWorker->fSs)
2401	CtxUdExpected.ss = Ctx.ss = BS3_SEL_TEST_PAGE_00 \| bRing;
2402	else
2403	CtxUdExpected.ds = Ctx.ds = BS3_SEL_TEST_PAGE_00 \| bRing;
2404
2405	/* Expand up (normal). */
2406	for (off = 0; off < 8; off++)
2407	{
2408	CtxUdExpected.rbx.u = Ctx.rbx.u = off;
2409	for (cbLimit = 0; cbLimit < cbIdtr*2; cbLimit++)
2410	{
2411	Bs3GdteTestPage00.Gen.u16LimitLow = cbLimit;
2412
2413	Bs3MemSet(abBufLoad, bFiller1, sizeof(abBufLoad));
2414	Bs3MemCpy(&abBufLoad[off], pbBufRestore, cbIdtr);
2415	Bs3MemSet(abBufSave, bFiller2, sizeof(abBufSave));
2416	Bs3TrapSetJmpAndRestore(&Ctx, &TrapCtx);
2417	if (bRing != 0)
2418	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &Ctx, 0);
2419	else if (off + cbIdtr <= cbLimit + 1)
2420	{
2421	bs3CpuBasic2_CompareUdCtx(&TrapCtx, &CtxUdExpected);
2422	if (Bs3MemCmp(pbBufSave, abExpectedFilled, cbIdtr * 2) != 0)
2423	Bs3TestFailedF("Mismatch (%s, #5): expected %.Rhxs, got %.Rhxs\n",
2424	pWorker->pszDesc, cbIdtr2, abExpectedFilled, cbIdtr2, pbBufSave);
2425	}
2426	else if (pWorker->fSs)
2427	bs3CpuBasic2_CompareSsCtx(&TrapCtx, &Ctx, 0, false /f486ResumeFlagHint/);
2428	else
2429	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &Ctx, 0);
2430	g_usBs3TestStep++;
2431
2432	/* Again with zero limit and messed up base (should trigger tripple fault if partially loaded). */
2433	abBufLoad[off] = abBufLoad[off + 1] = 0;
2434	abBufLoad[off + 2] \|= 1;
2435	abBufLoad[off + cbIdtr - 2] ^= 0x5a;
2436	abBufLoad[off + cbIdtr - 1] ^= 0xa5;
2437	Bs3TrapSetJmpAndRestore(&Ctx, &TrapCtx);
2438	if (bRing != 0)
2439	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &Ctx, 0);
2440	else if (off + cbIdtr <= cbLimit + 1)
2441	bs3CpuBasic2_CompareUdCtx(&TrapCtx, &CtxUdExpected);
2442	else if (pWorker->fSs)
2443	bs3CpuBasic2_CompareSsCtx(&TrapCtx, &Ctx, 0, false /f486ResumeFlagHint/);
2444	else
2445	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &Ctx, 0);
2446	}
2447	}
2448
2449	/* Expand down (weird). Inverted valid area compared to expand up,
2450	so a limit of zero give us a valid range for 0001..0ffffh (instead of
2451	a segment with one valid byte at 0000h). Whereas a limit of 0fffeh
2452	means one valid byte at 0ffffh, and a limit of 0ffffh means none
2453	(because in a normal expand up the 0ffffh means all 64KB are
2454	accessible). */
2455	Bs3GdteTestPage00.Gen.u4Type = X86_SEL_TYPE_RW_DOWN_ACC;
2456	for (off = 0; off < 8; off++)
2457	{
2458	CtxUdExpected.rbx.u = Ctx.rbx.u = off;
2459	for (cbLimit = 0; cbLimit < cbIdtr*2; cbLimit++)
2460	{
2461	Bs3GdteTestPage00.Gen.u16LimitLow = cbLimit;
2462
2463	Bs3MemSet(abBufLoad, bFiller1, sizeof(abBufLoad));
2464	Bs3MemCpy(&abBufLoad[off], pbBufRestore, cbIdtr);
2465	Bs3MemSet(abBufSave, bFiller2, sizeof(abBufSave));
2466	Bs3TrapSetJmpAndRestore(&Ctx, &TrapCtx);
2467	if (bRing != 0)
2468	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &Ctx, 0);
2469	else if (off > cbLimit)
2470	{
2471	bs3CpuBasic2_CompareUdCtx(&TrapCtx, &CtxUdExpected);
2472	if (Bs3MemCmp(pbBufSave, abExpectedFilled, cbIdtr * 2) != 0)
2473	Bs3TestFailedF("Mismatch (%s, #6): expected %.Rhxs, got %.Rhxs\n",
2474	pWorker->pszDesc, cbIdtr2, abExpectedFilled, cbIdtr2, pbBufSave);
2475	}
2476	else if (pWorker->fSs)
2477	bs3CpuBasic2_CompareSsCtx(&TrapCtx, &Ctx, 0, false /f486ResumeFlagHint/);
2478	else
2479	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &Ctx, 0);
2480	g_usBs3TestStep++;
2481
2482	/* Again with zero limit and messed up base (should trigger triple fault if partially loaded). */
2483	abBufLoad[off] = abBufLoad[off + 1] = 0;
2484	abBufLoad[off + 2] \|= 3;
2485	abBufLoad[off + cbIdtr - 2] ^= 0x55;
2486	abBufLoad[off + cbIdtr - 1] ^= 0xaa;
2487	Bs3TrapSetJmpAndRestore(&Ctx, &TrapCtx);
2488	if (bRing != 0)
2489	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &Ctx, 0);
2490	else if (off > cbLimit)
2491	bs3CpuBasic2_CompareUdCtx(&TrapCtx, &CtxUdExpected);
2492	else if (pWorker->fSs)
2493	bs3CpuBasic2_CompareSsCtx(&TrapCtx, &Ctx, 0, false /f486ResumeFlagHint/);
2494	else
2495	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &Ctx, 0);
2496	}
2497	}
2498
2499	Bs3RegCtxSetGrpSegFromCurPtr(&Ctx, &Ctx.rbx, pWorker->fSs ? &Ctx.ss : &Ctx.ds, abBufLoad);
2500	CtxUdExpected.rbx.u = Ctx.rbx.u;
2501	CtxUdExpected.ss = Ctx.ss;
2502	CtxUdExpected.ds = Ctx.ds;
2503	}
2504
2505	/*
2506	* Play with the paging.
2507	*/
2508	if ( BS3_MODE_IS_PAGED(bTestMode)
2509	&& (!pWorker->fSs \|\| bRing == 3) /* SS.DPL == CPL, we'll get some tiled ring-3 selector here. */
2510	&& (pbTest = (uint8_t BS3_FAR *)Bs3MemGuardedTestPageAlloc(BS3MEMKIND_TILED)) != NULL)
2511	{
2512	RTCCUINTXREG uFlatTest = Bs3SelPtrToFlat(pbTest);
2513
2514	/*
2515	* Slide the load buffer towards the trailing guard page.
2516	*/
2517	Bs3RegCtxSetGrpSegFromCurPtr(&Ctx, &Ctx.rbx, pWorker->fSs ? &Ctx.ss : &Ctx.ds, &pbTest[X86_PAGE_SIZE]);
2518	CtxUdExpected.ss = Ctx.ss;
2519	CtxUdExpected.ds = Ctx.ds;
2520	for (off = X86_PAGE_SIZE - cbIdtr - 4; off < X86_PAGE_SIZE + 4; off++)
2521	{
2522	Bs3MemSet(&pbTest[X86_PAGE_SIZE - cbIdtr * 2], bFiller1, cbIdtr*2);
2523	if (off < X86_PAGE_SIZE)
2524	Bs3MemCpy(&pbTest[off], pbBufRestore, RT_MIN(X86_PAGE_SIZE - off, cbIdtr));
2525	Bs3RegCtxSetGrpSegFromCurPtr(&Ctx, &Ctx.rbx, pWorker->fSs ? &Ctx.ss : &Ctx.ds, &pbTest[off]);
2526	Bs3MemSet(abBufSave, bFiller2, sizeof(abBufSave));
2527	Bs3TrapSetJmpAndRestore(&Ctx, &TrapCtx);
2528	if (bRing != 0)
2529	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &Ctx, 0);
2530	else if (off + cbIdtr <= X86_PAGE_SIZE)
2531	{
2532	CtxUdExpected.rbx = Ctx.rbx;
2533	bs3CpuBasic2_CompareUdCtx(&TrapCtx, &CtxUdExpected);
2534	if (Bs3MemCmp(pbBufSave, abExpectedFilled, cbIdtr*2) != 0)
2535	Bs3TestFailedF("Mismatch (%s, #7): expected %.Rhxs, got %.Rhxs\n",
2536	pWorker->pszDesc, cbIdtr2, abExpectedFilled, cbIdtr2, pbBufSave);
2537	}
2538	else
2539	bs3CpuBasic2_ComparePfCtx(&TrapCtx, &Ctx, 0, uFlatTest + RT_MAX(off, X86_PAGE_SIZE));
2540	g_usBs3TestStep++;
2541
2542	/* Again with zero limit and maybe messed up base as well (triple fault if buggy).
2543	The 386DX-40 here triple faults (or something) with off == 0xffe, nothing else. */
2544	if ( off < X86_PAGE_SIZE && off + cbIdtr > X86_PAGE_SIZE
2545	&& ( off != X86_PAGE_SIZE - 2
2546	\|\| (g_uBs3CpuDetected & BS3CPU_TYPE_MASK) != BS3CPU_80386)
2547	)
2548	{
2549	pbTest[off] = 0;
2550	if (off + 1 < X86_PAGE_SIZE)
2551	pbTest[off + 1] = 0;
2552	if (off + 2 < X86_PAGE_SIZE)
2553	pbTest[off + 2] \|= 7;
2554	Bs3TrapSetJmpAndRestore(&Ctx, &TrapCtx);
2555	if (bRing != 0)
2556	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &Ctx, 0);
2557	else
2558	bs3CpuBasic2_ComparePfCtx(&TrapCtx, &Ctx, 0, uFlatTest + RT_MAX(off, X86_PAGE_SIZE));
2559	g_usBs3TestStep++;
2560	}
2561	}
2562
2563	/*
2564	* Now, do it the other way around. It should look normal now since writing
2565	* the limit will #PF first and nothing should be written.
2566	*/
2567	for (off = cbIdtr + 4; off >= -cbIdtr - 4; off--)
2568	{
2569	Bs3MemSet(pbTest, bFiller1, 48);
2570	if (off >= 0)
2571	Bs3MemCpy(&pbTest[off], pbBufRestore, cbIdtr);
2572	else if (off + cbIdtr > 0)
2573	Bs3MemCpy(pbTest, &pbBufRestore[-off], cbIdtr + off);
2574	Bs3RegCtxSetGrpSegFromCurPtr(&Ctx, &Ctx.rbx, pWorker->fSs ? &Ctx.ss : &Ctx.ds, &pbTest[off]);
2575	Bs3MemSet(abBufSave, bFiller2, sizeof(abBufSave));
2576	Bs3TrapSetJmpAndRestore(&Ctx, &TrapCtx);
2577	if (bRing != 0)
2578	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &Ctx, 0);
2579	else if (off >= 0)
2580	{
2581	CtxUdExpected.rbx = Ctx.rbx;
2582	bs3CpuBasic2_CompareUdCtx(&TrapCtx, &CtxUdExpected);
2583	if (Bs3MemCmp(pbBufSave, abExpectedFilled, cbIdtr*2) != 0)
2584	Bs3TestFailedF("Mismatch (%s, #8): expected %.Rhxs, got %.Rhxs\n",
2585	pWorker->pszDesc, cbIdtr2, abExpectedFilled, cbIdtr2, pbBufSave);
2586	}
2587	else
2588	bs3CpuBasic2_ComparePfCtx(&TrapCtx, &Ctx, 0, uFlatTest + off);
2589	g_usBs3TestStep++;
2590
2591	/* Again with messed up base as well (triple fault if buggy). */
2592	if (off < 0 && off > -cbIdtr)
2593	{
2594	if (off + 2 >= 0)
2595	pbTest[off + 2] \|= 15;
2596	pbTest[off + cbIdtr - 1] ^= 0xaa;
2597	Bs3TrapSetJmpAndRestore(&Ctx, &TrapCtx);
2598	if (bRing != 0)
2599	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &Ctx, 0);
2600	else
2601	bs3CpuBasic2_ComparePfCtx(&TrapCtx, &Ctx, 0, uFlatTest + off);
2602	g_usBs3TestStep++;
2603	}
2604	}
2605
2606	/*
2607	* Combine paging and segment limit and check ordering.
2608	* This is kind of interesting here since it the instruction seems to
2609	* actually be doing two separate read, just like it's S[IG]DT counterpart.
2610	*
2611	* Note! My 486DX4 does a DWORD limit read when the operand size is 32-bit,
2612	* that's what f486Weirdness deals with.
2613	*/
2614	if ( !BS3_MODE_IS_RM_OR_V86(bTestMode)
2615	&& !BS3_MODE_IS_64BIT_CODE(bTestMode))
2616	{
2617	bool const f486Weirdness = (g_uBs3CpuDetected & BS3CPU_TYPE_MASK) == BS3CPU_80486
2618	&& BS3_MODE_IS_32BIT_CODE(bTestMode) == !(pWorker->fFlags & BS3CB2SIDTSGDT_F_OPSIZE);
2619	uint16_t cbLimit;
2620
2621	Bs3GdteTestPage00 = Bs3Gdte_DATA16;
2622	Bs3GdteTestPage00.Gen.u2Dpl = bRing;
2623	Bs3GdteTestPage00.Gen.u16BaseLow = (uint16_t)uFlatTest;
2624	Bs3GdteTestPage00.Gen.u8BaseHigh1 = (uint8_t)(uFlatTest >> 16);
2625	Bs3GdteTestPage00.Gen.u8BaseHigh2 = (uint8_t)(uFlatTest >> 24);
2626
2627	if (pWorker->fSs)
2628	CtxUdExpected.ss = Ctx.ss = BS3_SEL_TEST_PAGE_00 \| bRing;
2629	else
2630	CtxUdExpected.ds = Ctx.ds = BS3_SEL_TEST_PAGE_00 \| bRing;
2631
2632	/* Expand up (normal), approaching tail guard page. */
2633	for (off = X86_PAGE_SIZE - cbIdtr - 4; off < X86_PAGE_SIZE + 4; off++)
2634	{
2635	CtxUdExpected.rbx.u = Ctx.rbx.u = off;
2636	for (cbLimit = X86_PAGE_SIZE - cbIdtr2; cbLimit < X86_PAGE_SIZE + cbIdtr2; cbLimit++)
2637	{
2638	Bs3GdteTestPage00.Gen.u16LimitLow = cbLimit;
2639	Bs3MemSet(&pbTest[X86_PAGE_SIZE - cbIdtr * 2], bFiller1, cbIdtr * 2);
2640	if (off < X86_PAGE_SIZE)
2641	Bs3MemCpy(&pbTest[off], pbBufRestore, RT_MIN(cbIdtr, X86_PAGE_SIZE - off));
2642	Bs3MemSet(abBufSave, bFiller2, sizeof(abBufSave));
2643	Bs3TrapSetJmpAndRestore(&Ctx, &TrapCtx);
2644	if (bRing != 0)
2645	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &Ctx, 0);
2646	else if (off + cbIdtr <= cbLimit + 1)
2647	{
2648	/* No #GP, but maybe #PF. */
2649	if (off + cbIdtr <= X86_PAGE_SIZE)
2650	{
2651	bs3CpuBasic2_CompareUdCtx(&TrapCtx, &CtxUdExpected);
2652	if (Bs3MemCmp(pbBufSave, abExpectedFilled, cbIdtr * 2) != 0)
2653	Bs3TestFailedF("Mismatch (%s, #9): expected %.Rhxs, got %.Rhxs\n",
2654	pWorker->pszDesc, cbIdtr2, abExpectedFilled, cbIdtr2, pbBufSave);
2655	}
2656	else
2657	bs3CpuBasic2_ComparePfCtx(&TrapCtx, &Ctx, 0, uFlatTest + RT_MAX(off, X86_PAGE_SIZE));
2658	}
2659	/* No #GP/#SS on limit, but instead #PF? */
2660	else if ( !f486Weirdness
2661	? off < cbLimit && off >= 0xfff
2662	: off + 2 < cbLimit && off >= 0xffd)
2663	bs3CpuBasic2_ComparePfCtx(&TrapCtx, &Ctx, 0, uFlatTest + RT_MAX(off, X86_PAGE_SIZE));
2664	/* #GP/#SS on limit or base. */
2665	else if (pWorker->fSs)
2666	bs3CpuBasic2_CompareSsCtx(&TrapCtx, &Ctx, 0, false /f486ResumeFlagHint/);
2667	else
2668	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &Ctx, 0);
2669
2670	g_usBs3TestStep++;
2671
2672	/* Set DS to 0 and check that we get #GP(0). */
2673	if (!pWorker->fSs)
2674	{
2675	Ctx.ds = 0;
2676	Bs3TrapSetJmpAndRestore(&Ctx, &TrapCtx);
2677	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &Ctx, 0);
2678	Ctx.ds = BS3_SEL_TEST_PAGE_00 \| bRing;
2679	g_usBs3TestStep++;
2680	}
2681	}
2682	}
2683
2684	/* Expand down. */
2685	pbTest -= X86_PAGE_SIZE; /* Note! we're backing up a page to simplify things */
2686	uFlatTest -= X86_PAGE_SIZE;
2687
2688	Bs3GdteTestPage00.Gen.u4Type = X86_SEL_TYPE_RW_DOWN_ACC;
2689	Bs3GdteTestPage00.Gen.u16BaseLow = (uint16_t)uFlatTest;
2690	Bs3GdteTestPage00.Gen.u8BaseHigh1 = (uint8_t)(uFlatTest >> 16);
2691	Bs3GdteTestPage00.Gen.u8BaseHigh2 = (uint8_t)(uFlatTest >> 24);
2692
2693	for (off = X86_PAGE_SIZE - cbIdtr - 4; off < X86_PAGE_SIZE + 4; off++)
2694	{
2695	CtxUdExpected.rbx.u = Ctx.rbx.u = off;
2696	for (cbLimit = X86_PAGE_SIZE - cbIdtr2; cbLimit < X86_PAGE_SIZE + cbIdtr2; cbLimit++)
2697	{
2698	Bs3GdteTestPage00.Gen.u16LimitLow = cbLimit;
2699	Bs3MemSet(&pbTest[X86_PAGE_SIZE], bFiller1, cbIdtr * 2);
2700	if (off >= X86_PAGE_SIZE)
2701	Bs3MemCpy(&pbTest[off], pbBufRestore, cbIdtr);
2702	else if (off > X86_PAGE_SIZE - cbIdtr)
2703	Bs3MemCpy(&pbTest[X86_PAGE_SIZE], &pbBufRestore[X86_PAGE_SIZE - off], cbIdtr - (X86_PAGE_SIZE - off));
2704	Bs3MemSet(abBufSave, bFiller2, sizeof(abBufSave));
2705	Bs3TrapSetJmpAndRestore(&Ctx, &TrapCtx);
2706	if (bRing != 0)
2707	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &Ctx, 0);
2708	else if (cbLimit < off && off >= X86_PAGE_SIZE)
2709	{
2710	bs3CpuBasic2_CompareUdCtx(&TrapCtx, &CtxUdExpected);
2711	if (Bs3MemCmp(pbBufSave, abExpectedFilled, cbIdtr * 2) != 0)
2712	Bs3TestFailedF("Mismatch (%s, #10): expected %.Rhxs, got %.Rhxs\n",
2713	pWorker->pszDesc, cbIdtr2, abExpectedFilled, cbIdtr2, pbBufSave);
2714	}
2715	else if (cbLimit < off && off < X86_PAGE_SIZE)
2716	bs3CpuBasic2_ComparePfCtx(&TrapCtx, &Ctx, 0, uFlatTest + off);
2717	else if (pWorker->fSs)
2718	bs3CpuBasic2_CompareSsCtx(&TrapCtx, &Ctx, 0, false /f486ResumeFlagHint/);
2719	else
2720	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &Ctx, 0);
2721	g_usBs3TestStep++;
2722	}
2723	}
2724
2725	pbTest += X86_PAGE_SIZE;
2726	uFlatTest += X86_PAGE_SIZE;
2727	}
2728
2729	Bs3MemGuardedTestPageFree(pbTest);
2730	}
2731
2732	/*
2733	* Check non-canonical 64-bit space.
2734	*/
2735	if ( BS3_MODE_IS_64BIT_CODE(bTestMode)
2736	&& (pbTest = (uint8_t BS3_FAR *)Bs3PagingSetupCanonicalTraps()) != NULL)
2737	{
2738	/* Make our references relative to the gap. */
2739	pbTest += g_cbBs3PagingOneCanonicalTrap;
2740
2741	/* Hit it from below. */
2742	for (off = -cbIdtr - 8; off < cbIdtr + 8; off++)
2743	{
2744	Ctx.rbx.u = CtxUdExpected.rbx.u = UINT64_C(0x0000800000000000) + off;
2745	Bs3MemSet(&pbTest[-64], bFiller1, 64*2);
2746	Bs3MemCpy(&pbTest[off], pbBufRestore, cbIdtr);
2747	Bs3MemSet(abBufSave, bFiller2, sizeof(abBufSave));
2748	Bs3TrapSetJmpAndRestore(&Ctx, &TrapCtx);
2749	if (off + cbIdtr > 0 \|\| bRing != 0)
2750	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &Ctx, 0);
2751	else
2752	{
2753	bs3CpuBasic2_CompareUdCtx(&TrapCtx, &CtxUdExpected);
2754	if (Bs3MemCmp(pbBufSave, abExpectedFilled, cbIdtr * 2) != 0)
2755	Bs3TestFailedF("Mismatch (%s, #11): expected %.Rhxs, got %.Rhxs\n",
2756	pWorker->pszDesc, cbIdtr2, abExpectedFilled, cbIdtr2, pbBufSave);
2757	}
2758	}
2759
2760	/* Hit it from above. */
2761	for (off = -cbIdtr - 8; off < cbIdtr + 8; off++)
2762	{
2763	Ctx.rbx.u = CtxUdExpected.rbx.u = UINT64_C(0xffff800000000000) + off;
2764	Bs3MemSet(&pbTest[-64], bFiller1, 64*2);
2765	Bs3MemCpy(&pbTest[off], pbBufRestore, cbIdtr);
2766	Bs3MemSet(abBufSave, bFiller2, sizeof(abBufSave));
2767	Bs3TrapSetJmpAndRestore(&Ctx, &TrapCtx);
2768	if (off < 0 \|\| bRing != 0)
2769	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &Ctx, 0);
2770	else
2771	{
2772	bs3CpuBasic2_CompareUdCtx(&TrapCtx, &CtxUdExpected);
2773	if (Bs3MemCmp(pbBufSave, abExpectedFilled, cbIdtr * 2) != 0)
2774	Bs3TestFailedF("Mismatch (%s, #19): expected %.Rhxs, got %.Rhxs\n",
2775	pWorker->pszDesc, cbIdtr2, abExpectedFilled, cbIdtr2, pbBufSave);
2776	}
2777	}
2778
2779	}
2780	}
2781
2782
2783	static void bs3CpuBasic2_lidt_lgdt_Common(uint8_t bTestMode, BS3CB2SIDTSGDT const BS3_FAR *paWorkers, unsigned cWorkers,
2784	void const pvRestore, size_t cbRestore, uint8_t const pbExpected)
2785	{
2786	unsigned idx;
2787	unsigned bRing;
2788	unsigned iStep = 0;
2789
2790	/* Note! We skip the SS checks for ring-0 since we badly mess up SS in the
2791	test and don't want to bother with double faults. */
2792	for (bRing = BS3_MODE_IS_V86(bTestMode) ? 3 : 0; bRing <= 3; bRing++)
2793	{
2794	for (idx = 0; idx < cWorkers; idx++)
2795	if ( (paWorkers[idx].bMode & (bTestMode & BS3_MODE_CODE_MASK))
2796	&& (!paWorkers[idx].fSs \|\| bRing != 0 /** @todo \|\| BS3_MODE_IS_64BIT_SYS(bTestMode)*/ )
2797	&& ( !(paWorkers[idx].fFlags & BS3CB2SIDTSGDT_F_386PLUS)
2798	\|\| ( bTestMode > BS3_MODE_PE16
2799	\|\| ( bTestMode == BS3_MODE_PE16
2800	&& (g_uBs3CpuDetected & BS3CPU_TYPE_MASK) >= BS3CPU_80386)) ) )
2801	{
2802	//Bs3TestPrintf("idx=%-2d fpfnWorker=%p fSs=%d cbInstr=%d\n",
2803	// idx, paWorkers[idx].fpfnWorker, paWorkers[idx].fSs, paWorkers[idx].cbInstr);
2804	g_usBs3TestStep = iStep;
2805	bs3CpuBasic2_lidt_lgdt_One(&paWorkers[idx], bTestMode, bRing, pvRestore, cbRestore, pbExpected);
2806	iStep += 1000;
2807	}
2808	if (BS3_MODE_IS_RM_SYS(bTestMode))
2809	break;
2810	}
2811	}
2812
2813
2814	BS3_DECL_FAR(uint8_t) BS3_CMN_FAR_NM(bs3CpuBasic2_lidt)(uint8_t bMode)
2815	{
2816	union
2817	{
2818	RTIDTR Idtr;
2819	uint8_t ab[32]; /* At least cbIdtr2! /
2820	} Expected;
2821
2822	//if (bMode != BS3_MODE_LM64) return 0;
2823	bs3CpuBasic2_SetGlobals(bMode);
2824
2825	/*
2826	* Pass to common worker which is only compiled once per mode.
2827	*/
2828	Bs3MemZero(&Expected, sizeof(Expected));
2829	ASMGetIDTR(&Expected.Idtr);
2830
2831	if (BS3_MODE_IS_RM_SYS(bMode))
2832	bs3CpuBasic2_lidt_lgdt_Common(bMode, g_aLidtWorkers, RT_ELEMENTS(g_aLidtWorkers),
2833	&Bs3Lidt_Ivt, sizeof(Bs3Lidt_Ivt), Expected.ab);
2834	else if (BS3_MODE_IS_16BIT_SYS(bMode))
2835	bs3CpuBasic2_lidt_lgdt_Common(bMode, g_aLidtWorkers, RT_ELEMENTS(g_aLidtWorkers),
2836	&Bs3Lidt_Idt16, sizeof(Bs3Lidt_Idt16), Expected.ab);
2837	else if (BS3_MODE_IS_32BIT_SYS(bMode))
2838	bs3CpuBasic2_lidt_lgdt_Common(bMode, g_aLidtWorkers, RT_ELEMENTS(g_aLidtWorkers),
2839	&Bs3Lidt_Idt32, sizeof(Bs3Lidt_Idt32), Expected.ab);
2840	else
2841	bs3CpuBasic2_lidt_lgdt_Common(bMode, g_aLidtWorkers, RT_ELEMENTS(g_aLidtWorkers),
2842	&Bs3Lidt_Idt64, sizeof(Bs3Lidt_Idt64), Expected.ab);
2843
2844	/*
2845	* Re-initialize the IDT.
2846	*/
2847	Bs3TrapReInit();
2848	return 0;
2849	}
2850
2851
2852	BS3_DECL_FAR(uint8_t) BS3_CMN_FAR_NM(bs3CpuBasic2_lgdt)(uint8_t bMode)
2853	{
2854	union
2855	{
2856	RTGDTR Gdtr;
2857	uint8_t ab[32]; /* At least cbIdtr2! /
2858	} Expected;
2859
2860	//if (!BS3_MODE_IS_64BIT_SYS(bMode)) return 0;
2861	bs3CpuBasic2_SetGlobals(bMode);
2862
2863	/*
2864	* Pass to common worker which is only compiled once per mode.
2865	*/
2866	if (BS3_MODE_IS_RM_SYS(bMode))
2867	ASMSetGDTR((PRTGDTR)&Bs3LgdtDef_Gdt);
2868	Bs3MemZero(&Expected, sizeof(Expected));
2869	ASMGetGDTR(&Expected.Gdtr);
2870
2871	bs3CpuBasic2_lidt_lgdt_Common(bMode, g_aLgdtWorkers, RT_ELEMENTS(g_aLgdtWorkers),
2872	&Bs3LgdtDef_Gdt, sizeof(Bs3LgdtDef_Gdt), Expected.ab);
2873
2874	/*
2875	* Re-initialize the IDT.
2876	*/
2877	Bs3TrapReInit();
2878	return 0;
2879	}
2880
2881	typedef union IRETBUF
2882	{
2883	uint64_t au64[6]; /* max req is 5 */
2884	uint32_t au32[12]; /* max req is 9 */
2885	uint16_t au16[24]; /* max req is 5 */
2886	uint8_t ab[48];
2887	} IRETBUF;
2888	typedef IRETBUF BS3_FAR *PIRETBUF;
2889
2890
2891	static void iretbuf_SetupFrame(PIRETBUF pIretBuf, unsigned const cbPop,
2892	uint16_t uCS, uint64_t uPC, uint32_t fEfl, uint16_t uSS, uint64_t uSP)
2893	{
2894	if (cbPop == 2)
2895	{
2896	pIretBuf->au16[0] = (uint16_t)uPC;
2897	pIretBuf->au16[1] = uCS;
2898	pIretBuf->au16[2] = (uint16_t)fEfl;
2899	pIretBuf->au16[3] = (uint16_t)uSP;
2900	pIretBuf->au16[4] = uSS;
2901	}
2902	else if (cbPop != 8)
2903	{
2904	pIretBuf->au32[0] = (uint32_t)uPC;
2905	pIretBuf->au16[1*2] = uCS;
2906	pIretBuf->au32[2] = (uint32_t)fEfl;
2907	pIretBuf->au32[3] = (uint32_t)uSP;
2908	pIretBuf->au16[4*2] = uSS;
2909	}
2910	else
2911	{
2912	pIretBuf->au64[0] = uPC;
2913	pIretBuf->au16[1*4] = uCS;
2914	pIretBuf->au64[2] = fEfl;
2915	pIretBuf->au64[3] = uSP;
2916	pIretBuf->au16[4*4] = uSS;
2917	}
2918	}
2919
2920	uint32_t ASMGetESP(void);
2921	#pragma aux ASMGetESP = \
2922	".386" \
2923	"mov ax, sp" \
2924	"mov edx, esp" \
2925	"shr edx, 16" \
2926	value [ax dx] \
2927	modify exact [ax dx];
2928
2929
2930	static void bs3CpuBasic2_iret_Worker(uint8_t bTestMode, FPFNBS3FAR pfnIret, unsigned const cbPop,
2931	PIRETBUF pIretBuf, const char BS3_FAR *pszDesc)
2932	{
2933	BS3TRAPFRAME TrapCtx;
2934	BS3REGCTX Ctx;
2935	BS3REGCTX CtxUdExpected;
2936	BS3REGCTX TmpCtx;
2937	BS3REGCTX TmpCtxExpected;
2938	uint8_t abLowUd[8];
2939	uint8_t abLowIret[8];
2940	FPFNBS3FAR pfnUdLow = (FPFNBS3FAR)abLowUd;
2941	FPFNBS3FAR pfnIretLow = (FPFNBS3FAR)abLowIret;
2942	unsigned const cbSameCplFrame = BS3_MODE_IS_64BIT_CODE(bTestMode) ? 5cbPop : 3cbPop;
2943	bool const fUseLowCode = cbPop == 2 && !BS3_MODE_IS_16BIT_CODE(bTestMode);
2944	int iRingDst;
2945	int iRingSrc;
2946	uint16_t uDplSs;
2947	uint16_t uRplCs;
2948	uint16_t uRplSs;
2949	// int i;
2950	uint8_t BS3_FAR *pbTest;
2951
2952	NOREF(abLowUd);
2953	#define IRETBUF_SET_SEL(a_idx, a_uValue) \
2954	do { (uint16_t)&pIretBuf->ab[a_idx cbPop] = (a_uValue); } while (0)
2955	#define IRETBUF_SET_REG(a_idx, a_uValue) \
2956	do { uint8_t const BS3_FAR pbTmp = &pIretBuf->ab[a_idx cbPop]; \
2957	if (cbPop == 2) *(uint16_t)pbTmp = (uint16_t)(a_uValue); \
2958	else if (cbPop != 8) *(uint32_t)pbTmp = (uint32_t)(a_uValue); \
2959	else *(uint64_t)pbTmp = (a_uValue); \
2960	} while (0)
2961
2962	/* make sure they're allocated */
2963	Bs3MemZero(&Ctx, sizeof(Ctx));
2964	Bs3MemZero(&CtxUdExpected, sizeof(CtxUdExpected));
2965	Bs3MemZero(&TmpCtx, sizeof(TmpCtx));
2966	Bs3MemZero(&TmpCtxExpected, sizeof(TmpCtxExpected));
2967	Bs3MemZero(&TrapCtx, sizeof(TrapCtx));
2968
2969	/*
2970	* When dealing with 16-bit irets in 32-bit or 64-bit mode, we must have
2971	* copies of both iret and ud in the first 64KB of memory. The stack is
2972	* below 64KB, so we'll just copy the instructions onto the stack.
2973	*/
2974	Bs3MemCpy(abLowUd, bs3CpuBasic2_ud2, 4);
2975	Bs3MemCpy(abLowIret, pfnIret, 4);
2976
2977	/*
2978	* Create a context (stack is irrelevant, we'll mainly be using pIretBuf).
2979	* - Point the context at our iret instruction.
2980	* - Point SS:xSP at pIretBuf.
2981	*/
2982	Bs3RegCtxSaveEx(&Ctx, bTestMode, 0);
2983	if (!fUseLowCode)
2984	Bs3RegCtxSetRipCsFromLnkPtr(&Ctx, pfnIret);
2985	else
2986	Bs3RegCtxSetRipCsFromCurPtr(&Ctx, pfnIretLow);
2987	if (BS3_MODE_IS_16BIT_SYS(bTestMode))
2988	g_uBs3TrapEipHint = Ctx.rip.u32;
2989	Bs3RegCtxSetGrpSegFromCurPtr(&Ctx, &Ctx.rsp, &Ctx.ss, pIretBuf);
2990
2991	/*
2992	* The first success (UD) context keeps the same code bit-count as the iret.
2993	*/
2994	Bs3MemCpy(&CtxUdExpected, &Ctx, sizeof(Ctx));
2995	if (!fUseLowCode)
2996	Bs3RegCtxSetRipCsFromLnkPtr(&CtxUdExpected, bs3CpuBasic2_ud2);
2997	else
2998	Bs3RegCtxSetRipCsFromCurPtr(&CtxUdExpected, pfnUdLow);
2999	CtxUdExpected.rsp.u += cbSameCplFrame;
3000
3001	/*
3002	* Check that it works at all.
3003	*/
3004	iretbuf_SetupFrame(pIretBuf, cbPop, CtxUdExpected.cs, CtxUdExpected.rip.u,
3005	CtxUdExpected.rflags.u32, CtxUdExpected.ss, CtxUdExpected.rsp.u);
3006
3007	Bs3TrapSetJmpAndRestore(&Ctx, &TrapCtx);
3008	bs3CpuBasic2_CompareUdCtx(&TrapCtx, &CtxUdExpected);
3009	g_usBs3TestStep++;
3010
3011	if (!BS3_MODE_IS_RM_OR_V86(bTestMode))
3012	{
3013	/* Selectors are modified when switching rings, so we need to know
3014	what we're dealing with there. */
3015	if ( !BS3_SEL_IS_IN_R0_RANGE(Ctx.cs) \|\| !BS3_SEL_IS_IN_R0_RANGE(Ctx.ss)
3016	\|\| !BS3_SEL_IS_IN_R0_RANGE(Ctx.ds) \|\| !BS3_SEL_IS_IN_R0_RANGE(Ctx.es))
3017	Bs3TestFailedF("Expected R0 CS, SS, DS and ES; not %#x, %#x, %#x and %#x\n", Ctx.cs, Ctx.ss, Ctx.ds, Ctx.es);
3018	if (Ctx.fs \|\| Ctx.gs)
3019	Bs3TestFailed("Expected R0 FS and GS to be 0!\n");
3020
3021	/*
3022	* Test returning to outer rings if protected mode.
3023	*/
3024	Bs3MemCpy(&TmpCtx, &Ctx, sizeof(TmpCtx));
3025	Bs3MemCpy(&TmpCtxExpected, &CtxUdExpected, sizeof(TmpCtxExpected));
3026	for (iRingDst = 3; iRingDst >= 0; iRingDst--)
3027	{
3028	Bs3RegCtxConvertToRingX(&TmpCtxExpected, iRingDst);
3029	TmpCtxExpected.ds = iRingDst ? 0 : TmpCtx.ds;
3030	TmpCtx.es = TmpCtxExpected.es;
3031	iretbuf_SetupFrame(pIretBuf, cbPop, TmpCtxExpected.cs, TmpCtxExpected.rip.u,
3032	TmpCtxExpected.rflags.u32, TmpCtxExpected.ss, TmpCtxExpected.rsp.u);
3033	Bs3TrapSetJmpAndRestore(&TmpCtx, &TrapCtx);
3034	bs3CpuBasic2_CompareUdCtx(&TrapCtx, &TmpCtxExpected);
3035	g_usBs3TestStep++;
3036	}
3037
3038	/*
3039	* Check CS.RPL and SS.RPL.
3040	*/
3041	for (iRingDst = 3; iRingDst >= 0; iRingDst--)
3042	{
3043	uint16_t const uDstSsR0 = (CtxUdExpected.ss & BS3_SEL_RING_SUB_MASK) + BS3_SEL_R0_FIRST;
3044	Bs3MemCpy(&TmpCtxExpected, &CtxUdExpected, sizeof(TmpCtxExpected));
3045	Bs3RegCtxConvertToRingX(&TmpCtxExpected, iRingDst);
3046	for (iRingSrc = 3; iRingSrc >= 0; iRingSrc--)
3047	{
3048	Bs3MemCpy(&TmpCtx, &Ctx, sizeof(TmpCtx));
3049	Bs3RegCtxConvertToRingX(&TmpCtx, iRingSrc);
3050	TmpCtx.es = TmpCtxExpected.es;
3051	TmpCtxExpected.ds = iRingDst != iRingSrc ? 0 : TmpCtx.ds;
3052	for (uRplCs = 0; uRplCs <= 3; uRplCs++)
3053	{
3054	uint16_t const uSrcEs = TmpCtx.es;
3055	uint16_t const uDstCs = (TmpCtxExpected.cs & X86_SEL_MASK_OFF_RPL) \| uRplCs;
3056	//Bs3TestPrintf("dst=%d src=%d rplCS=%d\n", iRingDst, iRingSrc, uRplCs);
3057
3058	/* CS.RPL */
3059	iretbuf_SetupFrame(pIretBuf, cbPop, uDstCs, TmpCtxExpected.rip.u, TmpCtxExpected.rflags.u32,
3060	TmpCtxExpected.ss, TmpCtxExpected.rsp.u);
3061	Bs3TrapSetJmpAndRestore(&TmpCtx, &TrapCtx);
3062	if (uRplCs == iRingDst && iRingDst >= iRingSrc)
3063	bs3CpuBasic2_CompareUdCtx(&TrapCtx, &TmpCtxExpected);
3064	else
3065	{
3066	if (iRingDst < iRingSrc)
3067	TmpCtx.es = 0;
3068	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &TmpCtx, uDstCs & X86_SEL_MASK_OFF_RPL);
3069	TmpCtx.es = uSrcEs;
3070	}
3071	g_usBs3TestStep++;
3072
3073	/* SS.RPL */
3074	if (iRingDst != iRingSrc \|\| BS3_MODE_IS_64BIT_CODE(bTestMode))
3075	{
3076	uint16_t uSavedDstSs = TmpCtxExpected.ss;
3077	for (uRplSs = 0; uRplSs <= 3; uRplSs++)
3078	{
3079	/* SS.DPL (iRingDst == CS.DPL) */
3080	for (uDplSs = 0; uDplSs <= 3; uDplSs++)
3081	{
3082	uint16_t const uDstSs = ((uDplSs << BS3_SEL_RING_SHIFT) \| uRplSs) + uDstSsR0;
3083	//Bs3TestPrintf("dst=%d src=%d rplCS=%d rplSS=%d dplSS=%d dst %04x:%08RX64 %08RX32 %04x:%08RX64\n",
3084	// iRingDst, iRingSrc, uRplCs, uRplSs, uDplSs, uDstCs, TmpCtxExpected.rip.u,
3085	// TmpCtxExpected.rflags.u32, uDstSs, TmpCtxExpected.rsp.u);
3086
3087	iretbuf_SetupFrame(pIretBuf, cbPop, uDstCs, TmpCtxExpected.rip.u,
3088	TmpCtxExpected.rflags.u32, uDstSs, TmpCtxExpected.rsp.u);
3089	Bs3TrapSetJmpAndRestore(&TmpCtx, &TrapCtx);
3090	if (uRplCs != iRingDst \|\| iRingDst < iRingSrc)
3091	{
3092	if (iRingDst < iRingSrc)
3093	TmpCtx.es = 0;
3094	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &TmpCtx, uDstCs & X86_SEL_MASK_OFF_RPL);
3095	}
3096	else if (uRplSs != iRingDst \|\| uDplSs != iRingDst)
3097	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &TmpCtx, uDstSs & X86_SEL_MASK_OFF_RPL);
3098	else
3099	bs3CpuBasic2_CompareUdCtx(&TrapCtx, &TmpCtxExpected);
3100	TmpCtx.es = uSrcEs;
3101	g_usBs3TestStep++;
3102	}
3103	}
3104
3105	TmpCtxExpected.ss = uSavedDstSs;
3106	}
3107	}
3108	}
3109	}
3110	}
3111
3112	/*
3113	* Special 64-bit checks.
3114	*/
3115	if (BS3_MODE_IS_64BIT_CODE(bTestMode))
3116	{
3117	/* The VM flag is completely ignored. */
3118	iretbuf_SetupFrame(pIretBuf, cbPop, CtxUdExpected.cs, CtxUdExpected.rip.u,
3119	CtxUdExpected.rflags.u32 \| X86_EFL_VM, CtxUdExpected.ss, CtxUdExpected.rsp.u);
3120	Bs3TrapSetJmpAndRestore(&Ctx, &TrapCtx);
3121	bs3CpuBasic2_CompareUdCtx(&TrapCtx, &CtxUdExpected);
3122	g_usBs3TestStep++;
3123
3124	/* The NT flag can be loaded just fine. */
3125	CtxUdExpected.rflags.u32 \|= X86_EFL_NT;
3126	iretbuf_SetupFrame(pIretBuf, cbPop, CtxUdExpected.cs, CtxUdExpected.rip.u,
3127	CtxUdExpected.rflags.u32, CtxUdExpected.ss, CtxUdExpected.rsp.u);
3128	Bs3TrapSetJmpAndRestore(&Ctx, &TrapCtx);
3129	bs3CpuBasic2_CompareUdCtx(&TrapCtx, &CtxUdExpected);
3130	CtxUdExpected.rflags.u32 &= ~X86_EFL_NT;
3131	g_usBs3TestStep++;
3132
3133	/* However, we'll #GP(0) if it's already set (in RFLAGS) when executing IRET. */
3134	Ctx.rflags.u32 \|= X86_EFL_NT;
3135	iretbuf_SetupFrame(pIretBuf, cbPop, CtxUdExpected.cs, CtxUdExpected.rip.u,
3136	CtxUdExpected.rflags.u32, CtxUdExpected.ss, CtxUdExpected.rsp.u);
3137	Bs3TrapSetJmpAndRestore(&Ctx, &TrapCtx);
3138	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &Ctx, 0);
3139	g_usBs3TestStep++;
3140
3141	/* The NT flag #GP(0) should trump all other exceptions - pit it against #PF. */
3142	pbTest = (uint8_t BS3_FAR *)Bs3MemGuardedTestPageAlloc(BS3MEMKIND_TILED);
3143	if (pbTest != NULL)
3144	{
3145	Bs3RegCtxSetGrpSegFromCurPtr(&Ctx, &Ctx.rsp, &Ctx.ss, &pbTest[X86_PAGE_SIZE]);
3146	iretbuf_SetupFrame(pIretBuf, cbPop, CtxUdExpected.cs, CtxUdExpected.rip.u,
3147	CtxUdExpected.rflags.u32, CtxUdExpected.ss, CtxUdExpected.rsp.u);
3148	Bs3TrapSetJmpAndRestore(&Ctx, &TrapCtx);
3149	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &Ctx, 0);
3150	g_usBs3TestStep++;
3151
3152	Bs3RegCtxSetGrpSegFromCurPtr(&Ctx, &Ctx.rsp, &Ctx.ss, pIretBuf);
3153	Bs3MemGuardedTestPageFree(pbTest);
3154	}
3155	Ctx.rflags.u32 &= ~X86_EFL_NT;
3156	}
3157	}
3158
3159
3160	BS3_DECL_FAR(uint8_t) BS3_CMN_FAR_NM(bs3CpuBasic2_iret)(uint8_t bMode)
3161	{
3162	struct
3163	{
3164	uint8_t abExtraStack[4096]; /*< we've got ~30KB of stack, so 4KB for the trap handlers++ is not a problem. /
3165	IRETBUF IRetBuf;
3166	uint8_t abGuard[32];
3167	} uBuf;
3168	size_t cbUnused;
3169
3170	//if (bMode != BS3_MODE_LM64) return BS3TESTDOMODE_SKIPPED;
3171	bs3CpuBasic2_SetGlobals(bMode);
3172
3173	/*
3174	* Primary instruction form.
3175	*/
3176	Bs3MemSet(&uBuf, 0xaa, sizeof(uBuf));
3177	Bs3MemSet(uBuf.abGuard, 0x88, sizeof(uBuf.abGuard));
3178	if (BS3_MODE_IS_16BIT_CODE(bMode))
3179	bs3CpuBasic2_iret_Worker(bMode, bs3CpuBasic2_iret, 2, &uBuf.IRetBuf, "iret");
3180	else if (BS3_MODE_IS_32BIT_CODE(bMode))
3181	bs3CpuBasic2_iret_Worker(bMode, bs3CpuBasic2_iret, 4, &uBuf.IRetBuf, "iretd");
3182	else
3183	bs3CpuBasic2_iret_Worker(bMode, bs3CpuBasic2_iret_rexw, 8, &uBuf.IRetBuf, "o64 iret");
3184
3185	BS3_ASSERT(ASMMemIsAllU8(uBuf.abGuard, sizeof(uBuf.abGuard), 0x88));
3186	cbUnused = (uintptr_t)ASMMemFirstMismatchingU8(uBuf.abExtraStack, sizeof(uBuf.abExtraStack) + sizeof(uBuf.IRetBuf), 0xaa)
3187	- (uintptr_t)uBuf.abExtraStack;
3188	if (cbUnused < 2048)
3189	Bs3TestFailedF("cbUnused=%u #%u\n", cbUnused, 1);
3190
3191	/*
3192	* Secondary variation: opsize prefixed.
3193	*/
3194	Bs3MemSet(&uBuf, 0xaa, sizeof(uBuf));
3195	Bs3MemSet(uBuf.abGuard, 0x88, sizeof(uBuf.abGuard));
3196	if (BS3_MODE_IS_16BIT_CODE(bMode) && (g_uBs3CpuDetected & BS3CPU_TYPE_MASK) >= BS3CPU_80386)
3197	bs3CpuBasic2_iret_Worker(bMode, bs3CpuBasic2_iret_opsize, 4, &uBuf.IRetBuf, "o32 iret");
3198	else if (BS3_MODE_IS_32BIT_CODE(bMode))
3199	bs3CpuBasic2_iret_Worker(bMode, bs3CpuBasic2_iret_opsize, 2, &uBuf.IRetBuf, "o16 iret");
3200	else if (BS3_MODE_IS_64BIT_CODE(bMode))
3201	bs3CpuBasic2_iret_Worker(bMode, bs3CpuBasic2_iret, 4, &uBuf.IRetBuf, "iretd");
3202	BS3_ASSERT(ASMMemIsAllU8(uBuf.abGuard, sizeof(uBuf.abGuard), 0x88));
3203	cbUnused = (uintptr_t)ASMMemFirstMismatchingU8(uBuf.abExtraStack, sizeof(uBuf.abExtraStack) + sizeof(uBuf.IRetBuf), 0xaa)
3204	- (uintptr_t)uBuf.abExtraStack;
3205	if (cbUnused < 2048)
3206	Bs3TestFailedF("cbUnused=%u #%u\n", cbUnused, 2);
3207
3208	/*
3209	* Third variation: 16-bit in 64-bit mode (truly unlikely)
3210	*/
3211	if (BS3_MODE_IS_64BIT_CODE(bMode))
3212	{
3213	Bs3MemSet(&uBuf, 0xaa, sizeof(uBuf));
3214	Bs3MemSet(uBuf.abGuard, 0x88, sizeof(uBuf.abGuard));
3215	bs3CpuBasic2_iret_Worker(bMode, bs3CpuBasic2_iret_opsize, 2, &uBuf.IRetBuf, "o16 iret");
3216	BS3_ASSERT(ASMMemIsAllU8(uBuf.abGuard, sizeof(uBuf.abGuard), 0x88));
3217	cbUnused = (uintptr_t)ASMMemFirstMismatchingU8(uBuf.abExtraStack, sizeof(uBuf.abExtraStack) + sizeof(uBuf.IRetBuf), 0xaa)
3218	- (uintptr_t)uBuf.abExtraStack;
3219	if (cbUnused < 2048)
3220	Bs3TestFailedF("cbUnused=%u #%u\n", cbUnused, 3);
3221	}
3222
3223	return 0;
3224	}
3225

Note: See TracBrowser for help on using the repository browser.

source: vbox/trunk/src/VBox/ValidationKit/bootsectors/bs3-cpu-basic-2-x0.c@ 88216

Download in other formats: