bs3-cpu-basic-2-x0.c@ 97477

Last change on this file since 97477 was 97477, checked in by vboxsync, 2 years ago
ValKit/bs3-cpu-basic-2: Added tests for the relative call instruction. bugref:9898
Property svn:eol-style set to `native` Property svn:keywords set to `Author Date Id Revision`
File size: 188.1 KB

Line
1	/* $Id: bs3-cpu-basic-2-x0.c 97477 2022-11-09 10:37:00Z vboxsync $ */
2	/** @file
3	* BS3Kit - bs3-cpu-basic-2, C test driver code (16-bit).
4	*/
5
6	/*
7	* Copyright (C) 2007-2022 Oracle and/or its affiliates.
8	*
9	* This file is part of VirtualBox base platform packages, as
10	* available from https://www.virtualbox.org.
11	*
12	* This program is free software; you can redistribute it and/or
13	* modify it under the terms of the GNU General Public License
14	* as published by the Free Software Foundation, in version 3 of the
15	* License.
16	*
17	* This program is distributed in the hope that it will be useful, but
18	* WITHOUT ANY WARRANTY; without even the implied warranty of
19	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
20	* General Public License for more details.
21	*
22	* You should have received a copy of the GNU General Public License
23	* along with this program; if not, see <https://www.gnu.org/licenses>.
24	*
25	* The contents of this file may alternatively be used under the terms
26	* of the Common Development and Distribution License Version 1.0
27	* (CDDL), a copy of it is provided in the "COPYING.CDDL" file included
28	* in the VirtualBox distribution, in which case the provisions of the
29	* CDDL are applicable instead of those of the GPL.
30	*
31	* You may elect to license modified versions of this file under the
32	* terms and conditions of either the GPL or the CDDL or both.
33	*
34	* SPDX-License-Identifier: GPL-3.0-only OR CDDL-1.0
35	*/
36
37
38	/*********************************************************************************************************************************
39	* Header Files *
40	*********************************************************************************************************************************/
41	#define BS3_USE_X0_TEXT_SEG
42	#include <bs3kit.h>
43	#include <iprt/asm.h>
44	#include <iprt/asm-amd64-x86.h>
45
46
47	/*********************************************************************************************************************************
48	* Defined Constants And Macros *
49	*********************************************************************************************************************************/
50	#undef CHECK_MEMBER
51	#define CHECK_MEMBER(a_szName, a_szFmt, a_Actual, a_Expected) \
52	do \
53	{ \
54	if ((a_Actual) == (a_Expected)) { /* likely */ } \
55	else bs3CpuBasic2_FailedF(a_szName "=" a_szFmt " expected " a_szFmt, (a_Actual), (a_Expected)); \
56	} while (0)
57
58
59	/** Indicating that we've got operand size prefix and that it matters. */
60	#define BS3CB2SIDTSGDT_F_OPSIZE UINT8_C(0x01)
61	/** Worker requires 386 or later. */
62	#define BS3CB2SIDTSGDT_F_386PLUS UINT8_C(0x02)
63
64
65	/** @name MYOP_XXX - Values for FNBS3CPUBASIC2ACTSTCODE::fOp.
66	*
67	* These are flags, though we've precombined a few shortening things down.
68	*
69	* @{ */
70	#define MYOP_LD 0x1 /*< The instruction loads. /
71	#define MYOP_ST 0x2 /*< The instruction stores /
72	#define MYOP_EFL 0x4 /*< The instruction modifies EFLAGS. /
73	#define MYOP_AC_GP 0x8 /*< The instruction may cause either \#AC or \#GP (FXSAVE). /
74
75	#define MYOP_LD_ST 0x3 /*< Convenience: The instruction both loads and stores. /
76	#define MYOP_LD_DIV 0x5 /*< Convenience: DIV instruction - loading and modifying flags. /
77	/** @} */
78
79
80	/*********************************************************************************************************************************
81	* Structures and Typedefs *
82	*********************************************************************************************************************************/
83	typedef struct BS3CB2INVLDESCTYPE
84	{
85	uint8_t u4Type;
86	uint8_t u1DescType;
87	} BS3CB2INVLDESCTYPE;
88
89	typedef struct BS3CB2SIDTSGDT
90	{
91	const char *pszDesc;
92	FPFNBS3FAR fpfnWorker;
93	uint8_t cbInstr;
94	bool fSs;
95	uint8_t bMode;
96	uint8_t fFlags;
97	} BS3CB2SIDTSGDT;
98
99
100	typedef void BS3_CALL FNBS3CPUBASIC2ACSNIPPET(void);
101
102	typedef struct FNBS3CPUBASIC2ACTSTCODE
103	{
104	FNBS3CPUBASIC2ACSNIPPET BS3_FAR *pfn;
105	uint8_t fOp;
106	uint16_t cbMem;
107	uint8_t cbAlign;
108	uint8_t offFaultInstr; /*< For skipping fninit with the fld test. /
109	} FNBS3CPUBASIC2ACTSTCODE;
110	typedef FNBS3CPUBASIC2ACTSTCODE const *PCFNBS3CPUBASIC2ACTSTCODE;
111
112	typedef struct BS3CPUBASIC2ACTTSTCMNMODE
113	{
114	uint8_t bMode;
115	uint16_t cEntries;
116	PCFNBS3CPUBASIC2ACTSTCODE paEntries;
117	} BS3CPUBASIC2PFTTSTCMNMODE;
118	typedef BS3CPUBASIC2PFTTSTCMNMODE const *PCBS3CPUBASIC2PFTTSTCMNMODE;
119
120
121	/*********************************************************************************************************************************
122	* External Symbols *
123	*********************************************************************************************************************************/
124	extern FNBS3FAR bs3CpuBasic2_Int80;
125	extern FNBS3FAR bs3CpuBasic2_Int81;
126	extern FNBS3FAR bs3CpuBasic2_Int82;
127	extern FNBS3FAR bs3CpuBasic2_Int83;
128
129	extern FNBS3FAR bs3CpuBasic2_ud2;
130	#define g_bs3CpuBasic2_ud2_FlatAddr BS3_DATA_NM(g_bs3CpuBasic2_ud2_FlatAddr)
131	extern uint32_t g_bs3CpuBasic2_ud2_FlatAddr;
132
133	extern FNBS3FAR bs3CpuBasic2_iret;
134	extern FNBS3FAR bs3CpuBasic2_iret_opsize;
135	extern FNBS3FAR bs3CpuBasic2_iret_rexw;
136
137	extern FNBS3FAR bs3CpuBasic2_sidt_bx_ud2_c16;
138	extern FNBS3FAR bs3CpuBasic2_sidt_bx_ud2_c32;
139	extern FNBS3FAR bs3CpuBasic2_sidt_bx_ud2_c64;
140	extern FNBS3FAR bs3CpuBasic2_sidt_ss_bx_ud2_c16;
141	extern FNBS3FAR bs3CpuBasic2_sidt_ss_bx_ud2_c32;
142	extern FNBS3FAR bs3CpuBasic2_sidt_rexw_bx_ud2_c64;
143	extern FNBS3FAR bs3CpuBasic2_sidt_opsize_bx_ud2_c16;
144	extern FNBS3FAR bs3CpuBasic2_sidt_opsize_bx_ud2_c32;
145	extern FNBS3FAR bs3CpuBasic2_sidt_opsize_bx_ud2_c64;
146	extern FNBS3FAR bs3CpuBasic2_sidt_opsize_ss_bx_ud2_c16;
147	extern FNBS3FAR bs3CpuBasic2_sidt_opsize_ss_bx_ud2_c32;
148	extern FNBS3FAR bs3CpuBasic2_sidt_opsize_rexw_bx_ud2_c64;
149
150	extern FNBS3FAR bs3CpuBasic2_sgdt_bx_ud2_c16;
151	extern FNBS3FAR bs3CpuBasic2_sgdt_bx_ud2_c32;
152	extern FNBS3FAR bs3CpuBasic2_sgdt_bx_ud2_c64;
153	extern FNBS3FAR bs3CpuBasic2_sgdt_ss_bx_ud2_c16;
154	extern FNBS3FAR bs3CpuBasic2_sgdt_ss_bx_ud2_c32;
155	extern FNBS3FAR bs3CpuBasic2_sgdt_rexw_bx_ud2_c64;
156	extern FNBS3FAR bs3CpuBasic2_sgdt_opsize_bx_ud2_c16;
157	extern FNBS3FAR bs3CpuBasic2_sgdt_opsize_bx_ud2_c32;
158	extern FNBS3FAR bs3CpuBasic2_sgdt_opsize_bx_ud2_c64;
159	extern FNBS3FAR bs3CpuBasic2_sgdt_opsize_ss_bx_ud2_c16;
160	extern FNBS3FAR bs3CpuBasic2_sgdt_opsize_ss_bx_ud2_c32;
161	extern FNBS3FAR bs3CpuBasic2_sgdt_opsize_rexw_bx_ud2_c64;
162
163	extern FNBS3FAR bs3CpuBasic2_lidt_bx__sidt_es_di__lidt_es_si__ud2_c16;
164	extern FNBS3FAR bs3CpuBasic2_lidt_bx__sidt_es_di__lidt_es_si__ud2_c32;
165	extern FNBS3FAR bs3CpuBasic2_lidt_bx__sidt_es_di__lidt_es_si__ud2_c64;
166	extern FNBS3FAR bs3CpuBasic2_lidt_ss_bx__sidt_es_di__lidt_es_si__ud2_c16;
167	extern FNBS3FAR bs3CpuBasic2_lidt_ss_bx__sidt_es_di__lidt_es_si__ud2_c32;
168	extern FNBS3FAR bs3CpuBasic2_lidt_rexw_bx__sidt_es_di__lidt_es_si__ud2_c64;
169	extern FNBS3FAR bs3CpuBasic2_lidt_opsize_bx__sidt_es_di__lidt_es_si__ud2_c16;
170	extern FNBS3FAR bs3CpuBasic2_lidt_opsize_bx__sidt32_es_di__lidt_es_si__ud2_c16;
171	extern FNBS3FAR bs3CpuBasic2_lidt_opsize_bx__sidt_es_di__lidt_es_si__ud2_c32;
172	extern FNBS3FAR bs3CpuBasic2_lidt_opsize_bx__sidt_es_di__lidt_es_si__ud2_c64;
173	extern FNBS3FAR bs3CpuBasic2_lidt_opsize_ss_bx__sidt_es_di__lidt_es_si__ud2_c16;
174	extern FNBS3FAR bs3CpuBasic2_lidt_opsize_ss_bx__sidt_es_di__lidt_es_si__ud2_c32;
175	extern FNBS3FAR bs3CpuBasic2_lidt_opsize_rexw_bx__sidt_es_di__lidt_es_si__ud2_c64;
176
177	extern FNBS3FAR bs3CpuBasic2_lgdt_bx__sgdt_es_di__lgdt_es_si__ud2_c16;
178	extern FNBS3FAR bs3CpuBasic2_lgdt_bx__sgdt_es_di__lgdt_es_si__ud2_c32;
179	extern FNBS3FAR bs3CpuBasic2_lgdt_bx__sgdt_es_di__lgdt_es_si__ud2_c64;
180	extern FNBS3FAR bs3CpuBasic2_lgdt_ss_bx__sgdt_es_di__lgdt_es_si__ud2_c16;
181	extern FNBS3FAR bs3CpuBasic2_lgdt_ss_bx__sgdt_es_di__lgdt_es_si__ud2_c32;
182	extern FNBS3FAR bs3CpuBasic2_lgdt_rexw_bx__sgdt_es_di__lgdt_es_si__ud2_c64;
183	extern FNBS3FAR bs3CpuBasic2_lgdt_opsize_bx__sgdt_es_di__lgdt_es_si__ud2_c16;
184	extern FNBS3FAR bs3CpuBasic2_lgdt_opsize_bx__sgdt_es_di__lgdt_es_si__ud2_c32;
185	extern FNBS3FAR bs3CpuBasic2_lgdt_opsize_bx__sgdt_es_di__lgdt_es_si__ud2_c64;
186	extern FNBS3FAR bs3CpuBasic2_lgdt_opsize_ss_bx__sgdt_es_di__lgdt_es_si__ud2_c16;
187	extern FNBS3FAR bs3CpuBasic2_lgdt_opsize_ss_bx__sgdt_es_di__lgdt_es_si__ud2_c32;
188	extern FNBS3FAR bs3CpuBasic2_lgdt_opsize_rexw_bx__sgdt_es_di__lgdt_es_si__ud2_c64;
189
190
191	/* bs3-cpu-basic-2-template.mac: */
192	FNBS3CPUBASIC2ACSNIPPET bs3CpuBasic2_mov_ax_ds_bx__ud2_c16;
193	FNBS3CPUBASIC2ACSNIPPET bs3CpuBasic2_mov_ds_bx_ax__ud2_c16;
194	FNBS3CPUBASIC2ACSNIPPET bs3CpuBasic2_xchg_ds_bx_ax__ud2_c16;
195	FNBS3CPUBASIC2ACSNIPPET bs3CpuBasic2_cmpxchg_ds_bx_cx__ud2_c16;
196	FNBS3CPUBASIC2ACSNIPPET bs3CpuBasic2_div_ds_bx__ud2_c16;
197	FNBS3CPUBASIC2ACSNIPPET bs3CpuBasic2_fninit_fld_ds_bx__ud2_c16;
198	FNBS3CPUBASIC2ACSNIPPET bs3CpuBasic2_fninit_fbld_ds_bx__ud2_c16;
199	FNBS3CPUBASIC2ACSNIPPET bs3CpuBasic2_fninit_fldz_fstp_ds_bx__ud2_c16;
200	FNBS3CPUBASIC2ACSNIPPET bs3CpuBasic2_fxsave_ds_bx__ud2_c16;
201
202	FNBS3CPUBASIC2ACSNIPPET bs3CpuBasic2_mov_ax_ds_bx__ud2_c32;
203	FNBS3CPUBASIC2ACSNIPPET bs3CpuBasic2_mov_ds_bx_ax__ud2_c32;
204	FNBS3CPUBASIC2ACSNIPPET bs3CpuBasic2_xchg_ds_bx_ax__ud2_c32;
205	FNBS3CPUBASIC2ACSNIPPET bs3CpuBasic2_cmpxchg_ds_bx_cx__ud2_c32;
206	FNBS3CPUBASIC2ACSNIPPET bs3CpuBasic2_div_ds_bx__ud2_c32;
207	FNBS3CPUBASIC2ACSNIPPET bs3CpuBasic2_fninit_fld_ds_bx__ud2_c32;
208	FNBS3CPUBASIC2ACSNIPPET bs3CpuBasic2_fninit_fbld_ds_bx__ud2_c32;
209	FNBS3CPUBASIC2ACSNIPPET bs3CpuBasic2_fninit_fldz_fstp_ds_bx__ud2_c32;
210	FNBS3CPUBASIC2ACSNIPPET bs3CpuBasic2_fxsave_ds_bx__ud2_c32;
211
212	FNBS3CPUBASIC2ACSNIPPET bs3CpuBasic2_mov_ax_ds_bx__ud2_c64;
213	FNBS3CPUBASIC2ACSNIPPET bs3CpuBasic2_mov_ds_bx_ax__ud2_c64;
214	FNBS3CPUBASIC2ACSNIPPET bs3CpuBasic2_xchg_ds_bx_ax__ud2_c64;
215	FNBS3CPUBASIC2ACSNIPPET bs3CpuBasic2_cmpxchg_ds_bx_cx__ud2_c64;
216	FNBS3CPUBASIC2ACSNIPPET bs3CpuBasic2_div_ds_bx__ud2_c64;
217	FNBS3CPUBASIC2ACSNIPPET bs3CpuBasic2_fninit_fld_ds_bx__ud2_c64;
218	FNBS3CPUBASIC2ACSNIPPET bs3CpuBasic2_fninit_fbld_ds_bx__ud2_c64;
219	FNBS3CPUBASIC2ACSNIPPET bs3CpuBasic2_fninit_fldz_fstp_ds_bx__ud2_c64;
220	FNBS3CPUBASIC2ACSNIPPET bs3CpuBasic2_fxsave_ds_bx__ud2_c64;
221
222
223	/*********************************************************************************************************************************
224	* Global Variables *
225	*********************************************************************************************************************************/
226	static const char BS3_FAR g_pszTestMode = (const char )1;
227	static uint8_t g_bTestMode = 1;
228	static bool g_f16BitSys = 1;
229
230
231	/** SIDT test workers. */
232	static BS3CB2SIDTSGDT const g_aSidtWorkers[] =
233	{
234	{ "sidt [bx]", bs3CpuBasic2_sidt_bx_ud2_c16, 3, false, BS3_MODE_CODE_16 \| BS3_MODE_CODE_V86, 0 },
235	{ "sidt [ss:bx]", bs3CpuBasic2_sidt_ss_bx_ud2_c16, 4, true, BS3_MODE_CODE_16 \| BS3_MODE_CODE_V86, 0 },
236	{ "o32 sidt [bx]", bs3CpuBasic2_sidt_opsize_bx_ud2_c16, 4, false, BS3_MODE_CODE_16 \| BS3_MODE_CODE_V86, BS3CB2SIDTSGDT_F_386PLUS },
237	{ "o32 sidt [ss:bx]", bs3CpuBasic2_sidt_opsize_ss_bx_ud2_c16, 5, true, BS3_MODE_CODE_16 \| BS3_MODE_CODE_V86, BS3CB2SIDTSGDT_F_386PLUS },
238	{ "sidt [ebx]", bs3CpuBasic2_sidt_bx_ud2_c32, 3, false, BS3_MODE_CODE_32, 0 },
239	{ "sidt [ss:ebx]", bs3CpuBasic2_sidt_ss_bx_ud2_c32, 4, true, BS3_MODE_CODE_32, 0 },
240	{ "o16 sidt [ebx]", bs3CpuBasic2_sidt_opsize_bx_ud2_c32, 4, false, BS3_MODE_CODE_32, 0 },
241	{ "o16 sidt [ss:ebx]", bs3CpuBasic2_sidt_opsize_ss_bx_ud2_c32, 5, true, BS3_MODE_CODE_32, 0 },
242	{ "sidt [rbx]", bs3CpuBasic2_sidt_bx_ud2_c64, 3, false, BS3_MODE_CODE_64, 0 },
243	{ "o64 sidt [rbx]", bs3CpuBasic2_sidt_rexw_bx_ud2_c64, 4, false, BS3_MODE_CODE_64, 0 },
244	{ "o32 sidt [rbx]", bs3CpuBasic2_sidt_opsize_bx_ud2_c64, 4, false, BS3_MODE_CODE_64, 0 },
245	{ "o32 o64 sidt [rbx]", bs3CpuBasic2_sidt_opsize_rexw_bx_ud2_c64, 5, false, BS3_MODE_CODE_64, 0 },
246	};
247
248	/** SGDT test workers. */
249	static BS3CB2SIDTSGDT const g_aSgdtWorkers[] =
250	{
251	{ "sgdt [bx]", bs3CpuBasic2_sgdt_bx_ud2_c16, 3, false, BS3_MODE_CODE_16 \| BS3_MODE_CODE_V86, 0 },
252	{ "sgdt [ss:bx]", bs3CpuBasic2_sgdt_ss_bx_ud2_c16, 4, true, BS3_MODE_CODE_16 \| BS3_MODE_CODE_V86, 0 },
253	{ "o32 sgdt [bx]", bs3CpuBasic2_sgdt_opsize_bx_ud2_c16, 4, false, BS3_MODE_CODE_16 \| BS3_MODE_CODE_V86, BS3CB2SIDTSGDT_F_386PLUS },
254	{ "o32 sgdt [ss:bx]", bs3CpuBasic2_sgdt_opsize_ss_bx_ud2_c16, 5, true, BS3_MODE_CODE_16 \| BS3_MODE_CODE_V86, BS3CB2SIDTSGDT_F_386PLUS },
255	{ "sgdt [ebx]", bs3CpuBasic2_sgdt_bx_ud2_c32, 3, false, BS3_MODE_CODE_32, 0 },
256	{ "sgdt [ss:ebx]", bs3CpuBasic2_sgdt_ss_bx_ud2_c32, 4, true, BS3_MODE_CODE_32, 0 },
257	{ "o16 sgdt [ebx]", bs3CpuBasic2_sgdt_opsize_bx_ud2_c32, 4, false, BS3_MODE_CODE_32, 0 },
258	{ "o16 sgdt [ss:ebx]", bs3CpuBasic2_sgdt_opsize_ss_bx_ud2_c32, 5, true, BS3_MODE_CODE_32, 0 },
259	{ "sgdt [rbx]", bs3CpuBasic2_sgdt_bx_ud2_c64, 3, false, BS3_MODE_CODE_64, 0 },
260	{ "o64 sgdt [rbx]", bs3CpuBasic2_sgdt_rexw_bx_ud2_c64, 4, false, BS3_MODE_CODE_64, 0 },
261	{ "o32 sgdt [rbx]", bs3CpuBasic2_sgdt_opsize_bx_ud2_c64, 4, false, BS3_MODE_CODE_64, 0 },
262	{ "o32 o64 sgdt [rbx]", bs3CpuBasic2_sgdt_opsize_rexw_bx_ud2_c64, 5, false, BS3_MODE_CODE_64, 0 },
263	};
264
265	/** LIDT test workers. */
266	static BS3CB2SIDTSGDT const g_aLidtWorkers[] =
267	{
268	{ "lidt [bx]", bs3CpuBasic2_lidt_bx__sidt_es_di__lidt_es_si__ud2_c16, 11, false, BS3_MODE_CODE_16 \| BS3_MODE_CODE_V86, 0 },
269	{ "lidt [ss:bx]", bs3CpuBasic2_lidt_ss_bx__sidt_es_di__lidt_es_si__ud2_c16, 12, true, BS3_MODE_CODE_16 \| BS3_MODE_CODE_V86, 0 },
270	{ "o32 lidt [bx]", bs3CpuBasic2_lidt_opsize_bx__sidt_es_di__lidt_es_si__ud2_c16, 12, false, BS3_MODE_CODE_16 \| BS3_MODE_CODE_V86, BS3CB2SIDTSGDT_F_OPSIZE \| BS3CB2SIDTSGDT_F_386PLUS },
271	{ "o32 lidt [bx]; sidt32", bs3CpuBasic2_lidt_opsize_bx__sidt32_es_di__lidt_es_si__ud2_c16, 27, false, BS3_MODE_CODE_16 \| BS3_MODE_CODE_V86, BS3CB2SIDTSGDT_F_OPSIZE \| BS3CB2SIDTSGDT_F_386PLUS },
272	{ "o32 lidt [ss:bx]", bs3CpuBasic2_lidt_opsize_ss_bx__sidt_es_di__lidt_es_si__ud2_c16, 13, true, BS3_MODE_CODE_16 \| BS3_MODE_CODE_V86, BS3CB2SIDTSGDT_F_OPSIZE \| BS3CB2SIDTSGDT_F_386PLUS },
273	{ "lidt [ebx]", bs3CpuBasic2_lidt_bx__sidt_es_di__lidt_es_si__ud2_c32, 11, false, BS3_MODE_CODE_32, 0 },
274	{ "lidt [ss:ebx]", bs3CpuBasic2_lidt_ss_bx__sidt_es_di__lidt_es_si__ud2_c32, 12, true, BS3_MODE_CODE_32, 0 },
275	{ "o16 lidt [ebx]", bs3CpuBasic2_lidt_opsize_bx__sidt_es_di__lidt_es_si__ud2_c32, 12, false, BS3_MODE_CODE_32, BS3CB2SIDTSGDT_F_OPSIZE },
276	{ "o16 lidt [ss:ebx]", bs3CpuBasic2_lidt_opsize_ss_bx__sidt_es_di__lidt_es_si__ud2_c32, 13, true, BS3_MODE_CODE_32, BS3CB2SIDTSGDT_F_OPSIZE },
277	{ "lidt [rbx]", bs3CpuBasic2_lidt_bx__sidt_es_di__lidt_es_si__ud2_c64, 9, false, BS3_MODE_CODE_64, 0 },
278	{ "o64 lidt [rbx]", bs3CpuBasic2_lidt_rexw_bx__sidt_es_di__lidt_es_si__ud2_c64, 10, false, BS3_MODE_CODE_64, 0 },
279	{ "o32 lidt [rbx]", bs3CpuBasic2_lidt_opsize_bx__sidt_es_di__lidt_es_si__ud2_c64, 10, false, BS3_MODE_CODE_64, 0 },
280	{ "o32 o64 lidt [rbx]", bs3CpuBasic2_lidt_opsize_rexw_bx__sidt_es_di__lidt_es_si__ud2_c64, 11, false, BS3_MODE_CODE_64, 0 },
281	};
282
283	/** LGDT test workers. */
284	static BS3CB2SIDTSGDT const g_aLgdtWorkers[] =
285	{
286	{ "lgdt [bx]", bs3CpuBasic2_lgdt_bx__sgdt_es_di__lgdt_es_si__ud2_c16, 11, false, BS3_MODE_CODE_16 \| BS3_MODE_CODE_V86, 0 },
287	{ "lgdt [ss:bx]", bs3CpuBasic2_lgdt_ss_bx__sgdt_es_di__lgdt_es_si__ud2_c16, 12, true, BS3_MODE_CODE_16 \| BS3_MODE_CODE_V86, 0 },
288	{ "o32 lgdt [bx]", bs3CpuBasic2_lgdt_opsize_bx__sgdt_es_di__lgdt_es_si__ud2_c16, 12, false, BS3_MODE_CODE_16 \| BS3_MODE_CODE_V86, BS3CB2SIDTSGDT_F_OPSIZE \| BS3CB2SIDTSGDT_F_386PLUS },
289	{ "o32 lgdt [ss:bx]", bs3CpuBasic2_lgdt_opsize_ss_bx__sgdt_es_di__lgdt_es_si__ud2_c16, 13, true, BS3_MODE_CODE_16 \| BS3_MODE_CODE_V86, BS3CB2SIDTSGDT_F_OPSIZE \| BS3CB2SIDTSGDT_F_386PLUS },
290	{ "lgdt [ebx]", bs3CpuBasic2_lgdt_bx__sgdt_es_di__lgdt_es_si__ud2_c32, 11, false, BS3_MODE_CODE_32, 0 },
291	{ "lgdt [ss:ebx]", bs3CpuBasic2_lgdt_ss_bx__sgdt_es_di__lgdt_es_si__ud2_c32, 12, true, BS3_MODE_CODE_32, 0 },
292	{ "o16 lgdt [ebx]", bs3CpuBasic2_lgdt_opsize_bx__sgdt_es_di__lgdt_es_si__ud2_c32, 12, false, BS3_MODE_CODE_32, BS3CB2SIDTSGDT_F_OPSIZE },
293	{ "o16 lgdt [ss:ebx]", bs3CpuBasic2_lgdt_opsize_ss_bx__sgdt_es_di__lgdt_es_si__ud2_c32, 13, true, BS3_MODE_CODE_32, BS3CB2SIDTSGDT_F_OPSIZE },
294	{ "lgdt [rbx]", bs3CpuBasic2_lgdt_bx__sgdt_es_di__lgdt_es_si__ud2_c64, 9, false, BS3_MODE_CODE_64, 0 },
295	{ "o64 lgdt [rbx]", bs3CpuBasic2_lgdt_rexw_bx__sgdt_es_di__lgdt_es_si__ud2_c64, 10, false, BS3_MODE_CODE_64, 0 },
296	{ "o32 lgdt [rbx]", bs3CpuBasic2_lgdt_opsize_bx__sgdt_es_di__lgdt_es_si__ud2_c64, 10, false, BS3_MODE_CODE_64, 0 },
297	{ "o32 o64 lgdt [rbx]", bs3CpuBasic2_lgdt_opsize_rexw_bx__sgdt_es_di__lgdt_es_si__ud2_c64, 11, false, BS3_MODE_CODE_64, 0 },
298	};
299
300
301
302	#if 0
303	/** Table containing invalid CS selector types. */
304	static const BS3CB2INVLDESCTYPE g_aInvalidCsTypes[] =
305	{
306	{ X86_SEL_TYPE_RO, 1 },
307	{ X86_SEL_TYPE_RO_ACC, 1 },
308	{ X86_SEL_TYPE_RW, 1 },
309	{ X86_SEL_TYPE_RW_ACC, 1 },
310	{ X86_SEL_TYPE_RO_DOWN, 1 },
311	{ X86_SEL_TYPE_RO_DOWN_ACC, 1 },
312	{ X86_SEL_TYPE_RW_DOWN, 1 },
313	{ X86_SEL_TYPE_RW_DOWN_ACC, 1 },
314	{ 0, 0 },
315	{ 1, 0 },
316	{ 2, 0 },
317	{ 3, 0 },
318	{ 4, 0 },
319	{ 5, 0 },
320	{ 6, 0 },
321	{ 7, 0 },
322	{ 8, 0 },
323	{ 9, 0 },
324	{ 10, 0 },
325	{ 11, 0 },
326	{ 12, 0 },
327	{ 13, 0 },
328	{ 14, 0 },
329	{ 15, 0 },
330	};
331
332	/** Table containing invalid SS selector types. */
333	static const BS3CB2INVLDESCTYPE g_aInvalidSsTypes[] =
334	{
335	{ X86_SEL_TYPE_EO, 1 },
336	{ X86_SEL_TYPE_EO_ACC, 1 },
337	{ X86_SEL_TYPE_ER, 1 },
338	{ X86_SEL_TYPE_ER_ACC, 1 },
339	{ X86_SEL_TYPE_EO_CONF, 1 },
340	{ X86_SEL_TYPE_EO_CONF_ACC, 1 },
341	{ X86_SEL_TYPE_ER_CONF, 1 },
342	{ X86_SEL_TYPE_ER_CONF_ACC, 1 },
343	{ 0, 0 },
344	{ 1, 0 },
345	{ 2, 0 },
346	{ 3, 0 },
347	{ 4, 0 },
348	{ 5, 0 },
349	{ 6, 0 },
350	{ 7, 0 },
351	{ 8, 0 },
352	{ 9, 0 },
353	{ 10, 0 },
354	{ 11, 0 },
355	{ 12, 0 },
356	{ 13, 0 },
357	{ 14, 0 },
358	{ 15, 0 },
359	};
360	#endif
361
362
363	static const FNBS3CPUBASIC2ACTSTCODE g_aCmn16[] =
364	{
365	{ bs3CpuBasic2_mov_ax_ds_bx__ud2_c16, MYOP_LD, 2, 2 },
366	{ bs3CpuBasic2_mov_ds_bx_ax__ud2_c16, MYOP_ST, 2, 2 },
367	{ bs3CpuBasic2_xchg_ds_bx_ax__ud2_c16, MYOP_LD_ST, 2, 2 },
368	{ bs3CpuBasic2_cmpxchg_ds_bx_cx__ud2_c16, MYOP_LD_ST \| MYOP_EFL, 2, 2 },
369	{ bs3CpuBasic2_div_ds_bx__ud2_c16, MYOP_LD_DIV, 2, 2 },
370	{ bs3CpuBasic2_fninit_fld_ds_bx__ud2_c16, MYOP_LD, 10, 8, 2 /fninit/ },
371	{ bs3CpuBasic2_fninit_fbld_ds_bx__ud2_c16, MYOP_LD, 10, 8, 2 /fninit/ },
372	{ bs3CpuBasic2_fninit_fldz_fstp_ds_bx__ud2_c16, MYOP_ST, 10, 8, 4 /fninit+fldz/ },
373	{ bs3CpuBasic2_fxsave_ds_bx__ud2_c16, MYOP_ST \| MYOP_AC_GP, 512, 16 },
374	};
375
376	static const FNBS3CPUBASIC2ACTSTCODE g_aCmn32[] =
377	{
378	{ bs3CpuBasic2_mov_ax_ds_bx__ud2_c32, MYOP_LD, 4, 4 },
379	{ bs3CpuBasic2_mov_ds_bx_ax__ud2_c32, MYOP_ST, 4, 4 },
380	{ bs3CpuBasic2_xchg_ds_bx_ax__ud2_c32, MYOP_LD_ST, 4, 4 },
381	{ bs3CpuBasic2_cmpxchg_ds_bx_cx__ud2_c32, MYOP_LD_ST \| MYOP_EFL, 4, 4 },
382	{ bs3CpuBasic2_div_ds_bx__ud2_c32, MYOP_LD_DIV, 4, 4 },
383	{ bs3CpuBasic2_fninit_fld_ds_bx__ud2_c32, MYOP_LD, 10, 8, 2 /fninit/ },
384	{ bs3CpuBasic2_fninit_fbld_ds_bx__ud2_c32, MYOP_LD, 10, 8, 2 /fninit/ },
385	{ bs3CpuBasic2_fninit_fldz_fstp_ds_bx__ud2_c32, MYOP_ST, 10, 8, 4 /fninit+fldz/ },
386	{ bs3CpuBasic2_fxsave_ds_bx__ud2_c32, MYOP_ST \| MYOP_AC_GP, 512, 16 },
387	};
388
389	static const FNBS3CPUBASIC2ACTSTCODE g_aCmn64[] =
390	{
391	{ bs3CpuBasic2_mov_ax_ds_bx__ud2_c64, MYOP_LD, 8, 8 },
392	{ bs3CpuBasic2_mov_ds_bx_ax__ud2_c64, MYOP_ST, 8, 8 },
393	{ bs3CpuBasic2_xchg_ds_bx_ax__ud2_c64, MYOP_LD_ST, 8, 8 },
394	{ bs3CpuBasic2_cmpxchg_ds_bx_cx__ud2_c64, MYOP_LD_ST \| MYOP_EFL, 8, 8 },
395	{ bs3CpuBasic2_div_ds_bx__ud2_c64, MYOP_LD_DIV, 8, 8 },
396	{ bs3CpuBasic2_fninit_fld_ds_bx__ud2_c64, MYOP_LD, 10, 8, 2 /fninit/ },
397	{ bs3CpuBasic2_fninit_fbld_ds_bx__ud2_c64, MYOP_LD, 10, 8, 2 /fninit/ },
398	{ bs3CpuBasic2_fninit_fldz_fstp_ds_bx__ud2_c64, MYOP_ST, 10, 8, 4 /fninit+fldz/ },
399	{ bs3CpuBasic2_fxsave_ds_bx__ud2_c64, MYOP_ST \| MYOP_AC_GP, 512, 16 },
400	};
401
402	static const BS3CPUBASIC2PFTTSTCMNMODE g_aCmnModes[] =
403	{
404	{ BS3_MODE_CODE_16, RT_ELEMENTS(g_aCmn16), g_aCmn16 },
405	{ BS3_MODE_CODE_V86, RT_ELEMENTS(g_aCmn16), g_aCmn16 },
406	{ BS3_MODE_CODE_32, RT_ELEMENTS(g_aCmn32), g_aCmn32 },
407	{ BS3_MODE_CODE_64, RT_ELEMENTS(g_aCmn64), g_aCmn64 },
408	};
409
410
411	/**
412	* Sets globals according to the mode.
413	*
414	* @param bTestMode The test mode.
415	*/
416	static void bs3CpuBasic2_SetGlobals(uint8_t bTestMode)
417	{
418	g_bTestMode = bTestMode;
419	g_pszTestMode = Bs3GetModeName(bTestMode);
420	g_f16BitSys = BS3_MODE_IS_16BIT_SYS(bTestMode);
421	g_usBs3TestStep = 0;
422	}
423
424
425	uint32_t ASMGetESP(void);
426	#pragma aux ASMGetESP = \
427	".386" \
428	"mov ax, sp" \
429	"mov edx, esp" \
430	"shr edx, 16" \
431	value [ax dx] \
432	modify exact [ax dx];
433
434
435	/**
436	* Wrapper around Bs3TestFailedF that prefixes the error with g_usBs3TestStep
437	* and g_pszTestMode.
438	*/
439	static void bs3CpuBasic2_FailedF(const char *pszFormat, ...)
440	{
441	va_list va;
442
443	char szTmp[168];
444	va_start(va, pszFormat);
445	Bs3StrPrintfV(szTmp, sizeof(szTmp), pszFormat, va);
446	va_end(va);
447
448	Bs3TestFailedF("%u - %s: %s", g_usBs3TestStep, g_pszTestMode, szTmp);
449	}
450
451
452	#if 0
453	/**
454	* Compares trap stuff.
455	*/
456	static void bs3CpuBasic2_CompareIntCtx1(PCBS3TRAPFRAME pTrapCtx, PCBS3REGCTX pStartCtx, uint8_t bXcpt)
457	{
458	uint16_t const cErrorsBefore = Bs3TestSubErrorCount();
459	CHECK_MEMBER("bXcpt", "%#04x", pTrapCtx->bXcpt, bXcpt);
460	CHECK_MEMBER("bErrCd", "%#06RX64", pTrapCtx->uErrCd, 0);
461	Bs3TestCheckRegCtxEx(&pTrapCtx->Ctx, pStartCtx, 2 /int xx/, 0 /cbSpAdjust/, 0 /fExtraEfl/, g_pszTestMode, g_usBs3TestStep);
462	if (Bs3TestSubErrorCount() != cErrorsBefore)
463	{
464	Bs3TrapPrintFrame(pTrapCtx);
465	#if 1
466	Bs3TestPrintf("Halting: g_uBs3CpuDetected=%#x\n", g_uBs3CpuDetected);
467	Bs3TestPrintf("Halting in CompareTrapCtx1: bXcpt=%#x\n", bXcpt);
468	ASMHalt();
469	#endif
470	}
471	}
472	#endif
473
474
475	#if 0
476	/**
477	* Compares trap stuff.
478	*/
479	static void bs3CpuBasic2_CompareTrapCtx2(PCBS3TRAPFRAME pTrapCtx, PCBS3REGCTX pStartCtx, uint16_t cbIpAdjust,
480	uint8_t bXcpt, uint16_t uHandlerCs)
481	{
482	uint16_t const cErrorsBefore = Bs3TestSubErrorCount();
483	CHECK_MEMBER("bXcpt", "%#04x", pTrapCtx->bXcpt, bXcpt);
484	CHECK_MEMBER("bErrCd", "%#06RX64", pTrapCtx->uErrCd, 0);
485	CHECK_MEMBER("uHandlerCs", "%#06x", pTrapCtx->uHandlerCs, uHandlerCs);
486	Bs3TestCheckRegCtxEx(&pTrapCtx->Ctx, pStartCtx, cbIpAdjust, 0 /cbSpAdjust/, 0 /fExtraEfl/, g_pszTestMode, g_usBs3TestStep);
487	if (Bs3TestSubErrorCount() != cErrorsBefore)
488	{
489	Bs3TrapPrintFrame(pTrapCtx);
490	#if 1
491	Bs3TestPrintf("Halting: g_uBs3CpuDetected=%#x\n", g_uBs3CpuDetected);
492	Bs3TestPrintf("Halting in CompareTrapCtx2: bXcpt=%#x\n", bXcpt);
493	ASMHalt();
494	#endif
495	}
496	}
497	#endif
498
499	/**
500	* Compares a CPU trap.
501	*/
502	static void bs3CpuBasic2_CompareCpuTrapCtx(PCBS3TRAPFRAME pTrapCtx, PCBS3REGCTX pStartCtx, uint16_t uErrCd,
503	uint8_t bXcpt, bool f486ResumeFlagHint, uint8_t cbIpAdjust)
504	{
505	uint16_t const cErrorsBefore = Bs3TestSubErrorCount();
506	uint32_t fExtraEfl;
507
508	CHECK_MEMBER("bXcpt", "%#04x", pTrapCtx->bXcpt, bXcpt);
509	CHECK_MEMBER("bErrCd", "%#06RX16", (uint16_t)pTrapCtx->uErrCd, (uint16_t)uErrCd); /* 486 only writes a word */
510
511	if ( g_f16BitSys
512	\|\| bXcpt == X86_XCPT_DB /* hack (10980xe)... */
513	\|\| ( !f486ResumeFlagHint
514	&& (g_uBs3CpuDetected & BS3CPU_TYPE_MASK) <= BS3CPU_80486 ) )
515	fExtraEfl = 0;
516	else
517	fExtraEfl = X86_EFL_RF;
518	#if 0 /** @todo Running on an AMD Phenom II X6 1100T under AMD-V I'm not getting good X86_EFL_RF results. Enable this to get on with other work. */
519	fExtraEfl = pTrapCtx->Ctx.rflags.u32 & X86_EFL_RF;
520	#endif
521	Bs3TestCheckRegCtxEx(&pTrapCtx->Ctx, pStartCtx, cbIpAdjust, 0 /cbSpAdjust/, fExtraEfl, g_pszTestMode, g_usBs3TestStep);
522	if (Bs3TestSubErrorCount() != cErrorsBefore)
523	{
524	Bs3TrapPrintFrame(pTrapCtx);
525	#if 1
526	Bs3TestPrintf("Halting: g_uBs3CpuDetected=%#x\n", g_uBs3CpuDetected);
527	Bs3TestPrintf("Halting: bXcpt=%#x uErrCd=%#x\n", bXcpt, uErrCd);
528	ASMHalt();
529	#endif
530	}
531	}
532
533
534	/**
535	* Compares \#GP trap.
536	*/
537	static void bs3CpuBasic2_CompareGpCtx(PCBS3TRAPFRAME pTrapCtx, PCBS3REGCTX pStartCtx, uint16_t uErrCd)
538	{
539	bs3CpuBasic2_CompareCpuTrapCtx(pTrapCtx, pStartCtx, uErrCd, X86_XCPT_GP, true /f486ResumeFlagHint/, 0 /cbIpAdjust/);
540	}
541
542	#if 0
543	/**
544	* Compares \#NP trap.
545	*/
546	static void bs3CpuBasic2_CompareNpCtx(PCBS3TRAPFRAME pTrapCtx, PCBS3REGCTX pStartCtx, uint16_t uErrCd)
547	{
548	bs3CpuBasic2_CompareCpuTrapCtx(pTrapCtx, pStartCtx, uErrCd, X86_XCPT_NP, true /f486ResumeFlagHint/, 0 /cbIpAdjust/);
549	}
550	#endif
551
552	/**
553	* Compares \#SS trap.
554	*/
555	static void bs3CpuBasic2_CompareSsCtx(PCBS3TRAPFRAME pTrapCtx, PCBS3REGCTX pStartCtx, uint16_t uErrCd, bool f486ResumeFlagHint)
556	{
557	bs3CpuBasic2_CompareCpuTrapCtx(pTrapCtx, pStartCtx, uErrCd, X86_XCPT_SS, f486ResumeFlagHint, 0 /cbIpAdjust/);
558	}
559
560	#if 0
561	/**
562	* Compares \#TS trap.
563	*/
564	static void bs3CpuBasic2_CompareTsCtx(PCBS3TRAPFRAME pTrapCtx, PCBS3REGCTX pStartCtx, uint16_t uErrCd)
565	{
566	bs3CpuBasic2_CompareCpuTrapCtx(pTrapCtx, pStartCtx, uErrCd, X86_XCPT_TS, false /f486ResumeFlagHint/, 0 /cbIpAdjust/);
567	}
568	#endif
569
570	/**
571	* Compares \#PF trap.
572	*/
573	static void bs3CpuBasic2_ComparePfCtx(PCBS3TRAPFRAME pTrapCtx, PBS3REGCTX pStartCtx, uint16_t uErrCd,
574	uint64_t uCr2Expected, uint8_t cbIpAdjust)
575	{
576	uint64_t const uCr2Saved = pStartCtx->cr2.u;
577	pStartCtx->cr2.u = uCr2Expected;
578	bs3CpuBasic2_CompareCpuTrapCtx(pTrapCtx, pStartCtx, uErrCd, X86_XCPT_PF, true /f486ResumeFlagHint/, cbIpAdjust);
579	pStartCtx->cr2.u = uCr2Saved;
580	}
581
582	/**
583	* Compares \#UD trap.
584	*/
585	static void bs3CpuBasic2_CompareUdCtx(PCBS3TRAPFRAME pTrapCtx, PCBS3REGCTX pStartCtx)
586	{
587	bs3CpuBasic2_CompareCpuTrapCtx(pTrapCtx, pStartCtx, 0 /no error code/, X86_XCPT_UD,
588	true /f486ResumeFlagHint/, 0 /cbIpAdjust/);
589	}
590
591	/**
592	* Compares \#AC trap.
593	*/
594	static void bs3CpuBasic2_CompareAcCtx(PCBS3TRAPFRAME pTrapCtx, PCBS3REGCTX pStartCtx, uint8_t cbIpAdjust)
595	{
596	bs3CpuBasic2_CompareCpuTrapCtx(pTrapCtx, pStartCtx, 0 /always zero/, X86_XCPT_AC, true /f486ResumeFlagHint/, cbIpAdjust);
597	}
598
599	/**
600	* Compares \#DB trap.
601	*/
602	static void bs3CpuBasic2_CompareDbCtx(PCBS3TRAPFRAME pTrapCtx, PCBS3REGCTX pStartCtx)
603	{
604	bs3CpuBasic2_CompareCpuTrapCtx(pTrapCtx, pStartCtx, 0 /always zero/, X86_XCPT_DB, false /f486ResumeFlagHint?/, 0 /cbIpAdjust/);
605	}
606
607
608	#if 0 /* convert me */
609	static void bs3CpuBasic2_RaiseXcpt1Common(uint16_t const uSysR0Cs, uint16_t const uSysR0CsConf, uint16_t const uSysR0Ss,
610	PX86DESC const paIdt, unsigned const cIdteShift)
611	{
612	BS3TRAPFRAME TrapCtx;
613	BS3REGCTX Ctx80;
614	BS3REGCTX Ctx81;
615	BS3REGCTX Ctx82;
616	BS3REGCTX Ctx83;
617	BS3REGCTX CtxTmp;
618	BS3REGCTX CtxTmp2;
619	PBS3REGCTX apCtx8x[4];
620	unsigned iCtx;
621	unsigned iRing;
622	unsigned iDpl;
623	unsigned iRpl;
624	unsigned i, j, k;
625	uint32_t uExpected;
626	bool const f486Plus = (g_uBs3CpuDetected & BS3CPU_TYPE_MASK) >= BS3CPU_80486;
627	# if TMPL_BITS == 16
628	bool const f386Plus = (g_uBs3CpuDetected & BS3CPU_TYPE_MASK) >= BS3CPU_80386;
629	bool const f286 = (g_uBs3CpuDetected & BS3CPU_TYPE_MASK) == BS3CPU_80286;
630	# else
631	bool const f286 = false;
632	bool const f386Plus = true;
633	int rc;
634	uint8_t *pbIdtCopyAlloc;
635	PX86DESC pIdtCopy;
636	const unsigned cbIdte = 1 << (3 + cIdteShift);
637	RTCCUINTXREG uCr0Saved = ASMGetCR0();
638	RTGDTR GdtrSaved;
639	# endif
640	RTIDTR IdtrSaved;
641	RTIDTR Idtr;
642
643	ASMGetIDTR(&IdtrSaved);
644	# if TMPL_BITS != 16
645	ASMGetGDTR(&GdtrSaved);
646	# endif
647
648	/* make sure they're allocated */
649	Bs3MemZero(&TrapCtx, sizeof(TrapCtx));
650	Bs3MemZero(&Ctx80, sizeof(Ctx80));
651	Bs3MemZero(&Ctx81, sizeof(Ctx81));
652	Bs3MemZero(&Ctx82, sizeof(Ctx82));
653	Bs3MemZero(&Ctx83, sizeof(Ctx83));
654	Bs3MemZero(&CtxTmp, sizeof(CtxTmp));
655	Bs3MemZero(&CtxTmp2, sizeof(CtxTmp2));
656
657	/* Context array. */
658	apCtx8x[0] = &Ctx80;
659	apCtx8x[1] = &Ctx81;
660	apCtx8x[2] = &Ctx82;
661	apCtx8x[3] = &Ctx83;
662
663	# if TMPL_BITS != 16
664	/* Allocate memory for playing around with the IDT. */
665	pbIdtCopyAlloc = NULL;
666	if (BS3_MODE_IS_PAGED(g_bTestMode))
667	pbIdtCopyAlloc = Bs3MemAlloc(BS3MEMKIND_FLAT32, 12*_1K);
668	# endif
669
670	/*
671	* IDT entry 80 thru 83 are assigned DPLs according to the number.
672	* (We'll be useing more, but this'll do for now.)
673	*/
674	paIdt[0x80 << cIdteShift].Gate.u2Dpl = 0;
675	paIdt[0x81 << cIdteShift].Gate.u2Dpl = 1;
676	paIdt[0x82 << cIdteShift].Gate.u2Dpl = 2;
677	paIdt[0x83 << cIdteShift].Gate.u2Dpl = 3;
678
679	Bs3RegCtxSave(&Ctx80);
680	Ctx80.rsp.u -= 0x300;
681	Ctx80.rip.u = (uintptr_t)BS3_FP_OFF(&bs3CpuBasic2_Int80);
682	# if TMPL_BITS == 16
683	Ctx80.cs = BS3_MODE_IS_RM_OR_V86(g_bTestMode) ? BS3_SEL_TEXT16 : BS3_SEL_R0_CS16;
684	# elif TMPL_BITS == 32
685	g_uBs3TrapEipHint = Ctx80.rip.u32;
686	# endif
687	Bs3MemCpy(&Ctx81, &Ctx80, sizeof(Ctx80));
688	Ctx81.rip.u = (uintptr_t)BS3_FP_OFF(&bs3CpuBasic2_Int81);
689	Bs3MemCpy(&Ctx82, &Ctx80, sizeof(Ctx80));
690	Ctx82.rip.u = (uintptr_t)BS3_FP_OFF(&bs3CpuBasic2_Int82);
691	Bs3MemCpy(&Ctx83, &Ctx80, sizeof(Ctx80));
692	Ctx83.rip.u = (uintptr_t)BS3_FP_OFF(&bs3CpuBasic2_Int83);
693
694	/*
695	* Check that all the above gates work from ring-0.
696	*/
697	for (iCtx = 0; iCtx < RT_ELEMENTS(apCtx8x); iCtx++)
698	{
699	g_usBs3TestStep = iCtx;
700	# if TMPL_BITS == 32
701	g_uBs3TrapEipHint = apCtx8x[iCtx]->rip.u32;
702	# endif
703	Bs3TrapSetJmpAndRestore(apCtx8x[iCtx], &TrapCtx);
704	bs3CpuBasic2_CompareIntCtx1(&TrapCtx, apCtx8x[iCtx], 0x80+iCtx /bXcpt/);
705	}
706
707	/*
708	* Check that the gate DPL checks works.
709	*/
710	g_usBs3TestStep = 100;
711	for (iRing = 0; iRing <= 3; iRing++)
712	{
713	for (iCtx = 0; iCtx < RT_ELEMENTS(apCtx8x); iCtx++)
714	{
715	Bs3MemCpy(&CtxTmp, apCtx8x[iCtx], sizeof(CtxTmp));
716	Bs3RegCtxConvertToRingX(&CtxTmp, iRing);
717	# if TMPL_BITS == 32
718	g_uBs3TrapEipHint = CtxTmp.rip.u32;
719	# endif
720	Bs3TrapSetJmpAndRestore(&CtxTmp, &TrapCtx);
721	if (iCtx < iRing)
722	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &CtxTmp, ((0x80 + iCtx) << X86_TRAP_ERR_SEL_SHIFT) \| X86_TRAP_ERR_IDT);
723	else
724	bs3CpuBasic2_CompareIntCtx1(&TrapCtx, &CtxTmp, 0x80 + iCtx /bXcpt/);
725	g_usBs3TestStep++;
726	}
727	}
728
729	/*
730	* Modify the gate CS value and run the handler at a different CPL.
731	* Throw RPL variations into the mix (completely ignored) together
732	* with gate presence.
733	* 1. CPL <= GATE.DPL
734	* 2. GATE.P
735	* 3. GATE.CS.DPL <= CPL (non-conforming segments)
736	*/
737	g_usBs3TestStep = 1000;
738	for (i = 0; i <= 3; i++)
739	{
740	for (iRing = 0; iRing <= 3; iRing++)
741	{
742	for (iCtx = 0; iCtx < RT_ELEMENTS(apCtx8x); iCtx++)
743	{
744	# if TMPL_BITS == 32
745	g_uBs3TrapEipHint = apCtx8x[iCtx]->rip.u32;
746	# endif
747	Bs3MemCpy(&CtxTmp, apCtx8x[iCtx], sizeof(CtxTmp));
748	Bs3RegCtxConvertToRingX(&CtxTmp, iRing);
749
750	for (j = 0; j <= 3; j++)
751	{
752	uint16_t const uCs = (uSysR0Cs \| j) + (i << BS3_SEL_RING_SHIFT);
753	for (k = 0; k < 2; k++)
754	{
755	g_usBs3TestStep++;
756	/Bs3TestPrintf("g_usBs3TestStep=%u iCtx=%u iRing=%u i=%u uCs=%04x\n", g_usBs3TestStep, iCtx, iRing, i, uCs);/
757	paIdt[(0x80 + iCtx) << cIdteShift].Gate.u16Sel = uCs;
758	paIdt[(0x80 + iCtx) << cIdteShift].Gate.u1Present = k;
759	Bs3TrapSetJmpAndRestore(&CtxTmp, &TrapCtx);
760	/Bs3TrapPrintFrame(&TrapCtx);/
761	if (iCtx < iRing)
762	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &CtxTmp, ((0x80 + iCtx) << X86_TRAP_ERR_SEL_SHIFT) \| X86_TRAP_ERR_IDT);
763	else if (k == 0)
764	bs3CpuBasic2_CompareNpCtx(&TrapCtx, &CtxTmp, ((0x80 + iCtx) << X86_TRAP_ERR_SEL_SHIFT) \| X86_TRAP_ERR_IDT);
765	else if (i > iRing)
766	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &CtxTmp, uCs & X86_SEL_MASK_OFF_RPL);
767	else
768	{
769	uint16_t uExpectedCs = uCs & X86_SEL_MASK_OFF_RPL;
770	if (i <= iCtx && i <= iRing)
771	uExpectedCs \|= i;
772	bs3CpuBasic2_CompareTrapCtx2(&TrapCtx, &CtxTmp, 2 /int 8xh/, 0x80 + iCtx /bXcpt/, uExpectedCs);
773	}
774	}
775	}
776
777	paIdt[(0x80 + iCtx) << cIdteShift].Gate.u16Sel = uSysR0Cs;
778	paIdt[(0x80 + iCtx) << cIdteShift].Gate.u1Present = 1;
779	}
780	}
781	}
782	BS3_ASSERT(g_usBs3TestStep < 1600);
783
784	/*
785	* Various CS and SS related faults
786	*
787	* We temporarily reconfigure gate 80 and 83 with new CS selectors, the
788	* latter have a CS.DPL of 2 for testing ring transisions and SS loading
789	* without making it impossible to handle faults.
790	*/
791	g_usBs3TestStep = 1600;
792	Bs3GdteTestPage00 = Bs3Gdt[uSysR0Cs >> X86_SEL_SHIFT];
793	Bs3GdteTestPage00.Gen.u1Present = 0;
794	Bs3GdteTestPage00.Gen.u4Type &= ~X86_SEL_TYPE_ACCESSED;
795	paIdt[0x80 << cIdteShift].Gate.u16Sel = BS3_SEL_TEST_PAGE_00;
796
797	/* CS.PRESENT = 0 */
798	Bs3TrapSetJmpAndRestore(&Ctx80, &TrapCtx);
799	bs3CpuBasic2_CompareNpCtx(&TrapCtx, &Ctx80, BS3_SEL_TEST_PAGE_00);
800	if (Bs3GdteTestPage00.Gen.u4Type & X86_SEL_TYPE_ACCESSED)
801	bs3CpuBasic2_FailedF("selector was accessed");
802	g_usBs3TestStep++;
803
804	/* Check that GATE.DPL is checked before CS.PRESENT. */
805	for (iRing = 1; iRing < 4; iRing++)
806	{
807	Bs3MemCpy(&CtxTmp, &Ctx80, sizeof(CtxTmp));
808	Bs3RegCtxConvertToRingX(&CtxTmp, iRing);
809	Bs3TrapSetJmpAndRestore(&CtxTmp, &TrapCtx);
810	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &CtxTmp, (0x80 << X86_TRAP_ERR_SEL_SHIFT) \| X86_TRAP_ERR_IDT);
811	if (Bs3GdteTestPage00.Gen.u4Type & X86_SEL_TYPE_ACCESSED)
812	bs3CpuBasic2_FailedF("selector was accessed");
813	g_usBs3TestStep++;
814	}
815
816	/* CS.DPL mismatch takes precedence over CS.PRESENT = 0. */
817	Bs3GdteTestPage00.Gen.u4Type &= ~X86_SEL_TYPE_ACCESSED;
818	Bs3TrapSetJmpAndRestore(&Ctx80, &TrapCtx);
819	bs3CpuBasic2_CompareNpCtx(&TrapCtx, &Ctx80, BS3_SEL_TEST_PAGE_00);
820	if (Bs3GdteTestPage00.Gen.u4Type & X86_SEL_TYPE_ACCESSED)
821	bs3CpuBasic2_FailedF("CS selector was accessed");
822	g_usBs3TestStep++;
823	for (iDpl = 1; iDpl < 4; iDpl++)
824	{
825	Bs3GdteTestPage00.Gen.u2Dpl = iDpl;
826	Bs3TrapSetJmpAndRestore(&Ctx80, &TrapCtx);
827	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &Ctx80, BS3_SEL_TEST_PAGE_00);
828	if (Bs3GdteTestPage00.Gen.u4Type & X86_SEL_TYPE_ACCESSED)
829	bs3CpuBasic2_FailedF("CS selector was accessed");
830	g_usBs3TestStep++;
831	}
832
833	/* 1608: Check all the invalid CS selector types alone. */
834	Bs3GdteTestPage00 = Bs3Gdt[uSysR0Cs >> X86_SEL_SHIFT];
835	for (i = 0; i < RT_ELEMENTS(g_aInvalidCsTypes); i++)
836	{
837	Bs3GdteTestPage00.Gen.u4Type = g_aInvalidCsTypes[i].u4Type;
838	Bs3GdteTestPage00.Gen.u1DescType = g_aInvalidCsTypes[i].u1DescType;
839	Bs3TrapSetJmpAndRestore(&Ctx80, &TrapCtx);
840	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &Ctx80, BS3_SEL_TEST_PAGE_00);
841	if (Bs3GdteTestPage00.Gen.u4Type != g_aInvalidCsTypes[i].u4Type)
842	bs3CpuBasic2_FailedF("Invalid CS type %#x/%u -> %#x/%u\n",
843	g_aInvalidCsTypes[i].u4Type, g_aInvalidCsTypes[i].u1DescType,
844	Bs3GdteTestPage00.Gen.u4Type, Bs3GdteTestPage00.Gen.u1DescType);
845	g_usBs3TestStep++;
846
847	/* Incorrect CS.TYPE takes precedence over CS.PRESENT = 0. */
848	Bs3GdteTestPage00.Gen.u1Present = 0;
849	Bs3TrapSetJmpAndRestore(&Ctx80, &TrapCtx);
850	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &Ctx80, BS3_SEL_TEST_PAGE_00);
851	Bs3GdteTestPage00.Gen.u1Present = 1;
852	g_usBs3TestStep++;
853	}
854
855	/* Fix CS again. */
856	Bs3GdteTestPage00 = Bs3Gdt[uSysR0Cs >> X86_SEL_SHIFT];
857
858	/* 1632: Test SS. */
859	if (!BS3_MODE_IS_64BIT_SYS(g_bTestMode))
860	{
861	uint16_t BS3_FAR *puTssSs2 = BS3_MODE_IS_16BIT_SYS(g_bTestMode) ? &Bs3Tss16.ss2 : &Bs3Tss32.ss2;
862	uint16_t const uSavedSs2 = *puTssSs2;
863	X86DESC const SavedGate83 = paIdt[0x83 << cIdteShift];
864
865	/* Make the handler execute in ring-2. */
866	Bs3GdteTestPage02 = Bs3Gdt[(uSysR0Cs + (2 << BS3_SEL_RING_SHIFT)) >> X86_SEL_SHIFT];
867	Bs3GdteTestPage02.Gen.u4Type &= ~X86_SEL_TYPE_ACCESSED;
868	paIdt[0x83 << cIdteShift].Gate.u16Sel = BS3_SEL_TEST_PAGE_02 \| 2;
869
870	Bs3MemCpy(&CtxTmp, &Ctx83, sizeof(CtxTmp));
871	Bs3RegCtxConvertToRingX(&CtxTmp, 3); /* yeah, from 3 so SS:xSP is reloaded. */
872	Bs3TrapSetJmpAndRestore(&CtxTmp, &TrapCtx);
873	bs3CpuBasic2_CompareIntCtx1(&TrapCtx, &CtxTmp, 0x83);
874	if (!(Bs3GdteTestPage02.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
875	bs3CpuBasic2_FailedF("CS selector was not access");
876	g_usBs3TestStep++;
877
878	/* Create a SS.DPL=2 stack segment and check that SS2.RPL matters and
879	that we get #SS if the selector isn't present. */
880	i = 0; /* used for cycling thru invalid CS types */
881	for (k = 0; k < 10; k++)
882	{
883	/* k=0: present,
884	k=1: not-present,
885	k=2: present but very low limit,
886	k=3: not-present, low limit.
887	k=4: present, read-only.
888	k=5: not-present, read-only.
889	k=6: present, code-selector.
890	k=7: not-present, code-selector.
891	k=8: present, read-write / no access + system (=LDT).
892	k=9: not-present, read-write / no access + system (=LDT).
893	*/
894	Bs3GdteTestPage03 = Bs3Gdt[(uSysR0Ss + (2 << BS3_SEL_RING_SHIFT)) >> X86_SEL_SHIFT];
895	Bs3GdteTestPage03.Gen.u1Present = !(k & 1);
896	if (k >= 8)
897	{
898	Bs3GdteTestPage03.Gen.u1DescType = 0; /* system */
899	Bs3GdteTestPage03.Gen.u4Type = X86_SEL_TYPE_RW; /* = LDT */
900	}
901	else if (k >= 6)
902	Bs3GdteTestPage03.Gen.u4Type = X86_SEL_TYPE_ER;
903	else if (k >= 4)
904	Bs3GdteTestPage03.Gen.u4Type = X86_SEL_TYPE_RO;
905	else if (k >= 2)
906	{
907	Bs3GdteTestPage03.Gen.u16LimitLow = 0x400;
908	Bs3GdteTestPage03.Gen.u4LimitHigh = 0;
909	Bs3GdteTestPage03.Gen.u1Granularity = 0;
910	}
911
912	for (iDpl = 0; iDpl < 4; iDpl++)
913	{
914	Bs3GdteTestPage03.Gen.u2Dpl = iDpl;
915
916	for (iRpl = 0; iRpl < 4; iRpl++)
917	{
918	*puTssSs2 = BS3_SEL_TEST_PAGE_03 \| iRpl;
919	//Bs3TestPrintf("k=%u iDpl=%u iRpl=%u step=%u\n", k, iDpl, iRpl, g_usBs3TestStep);
920	Bs3GdteTestPage02.Gen.u4Type &= ~X86_SEL_TYPE_ACCESSED;
921	Bs3GdteTestPage03.Gen.u4Type &= ~X86_SEL_TYPE_ACCESSED;
922	Bs3TrapSetJmpAndRestore(&CtxTmp, &TrapCtx);
923	if (iRpl != 2 \|\| iRpl != iDpl \|\| k >= 4)
924	bs3CpuBasic2_CompareTsCtx(&TrapCtx, &CtxTmp, BS3_SEL_TEST_PAGE_03);
925	else if (k != 0)
926	bs3CpuBasic2_CompareSsCtx(&TrapCtx, &CtxTmp, BS3_SEL_TEST_PAGE_03,
927	k == 2 /f486ResumeFlagHint/);
928	else
929	{
930	bs3CpuBasic2_CompareIntCtx1(&TrapCtx, &CtxTmp, 0x83);
931	if (TrapCtx.uHandlerSs != (BS3_SEL_TEST_PAGE_03 \| 2))
932	bs3CpuBasic2_FailedF("uHandlerSs=%#x expected %#x\n", TrapCtx.uHandlerSs, BS3_SEL_TEST_PAGE_03 \| 2);
933	}
934	if (!(Bs3GdteTestPage02.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
935	bs3CpuBasic2_FailedF("CS selector was not access");
936	if ( TrapCtx.bXcpt == 0x83
937	\|\| (TrapCtx.bXcpt == X86_XCPT_SS && k == 2) )
938	{
939	if (!(Bs3GdteTestPage03.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
940	bs3CpuBasic2_FailedF("SS selector was not accessed");
941	}
942	else if (Bs3GdteTestPage03.Gen.u4Type & X86_SEL_TYPE_ACCESSED)
943	bs3CpuBasic2_FailedF("SS selector was accessed");
944	g_usBs3TestStep++;
945
946	/* +1: Modify the gate DPL to check that this is checked before SS.DPL and SS.PRESENT. */
947	paIdt[0x83 << cIdteShift].Gate.u2Dpl = 2;
948	Bs3TrapSetJmpAndRestore(&CtxTmp, &TrapCtx);
949	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &CtxTmp, (0x83 << X86_TRAP_ERR_SEL_SHIFT) \| X86_TRAP_ERR_IDT);
950	paIdt[0x83 << cIdteShift].Gate.u2Dpl = 3;
951	g_usBs3TestStep++;
952
953	/* +2: Check the CS.DPL check is done before the SS ones. Restoring the
954	ring-0 INT 83 context triggers the CS.DPL < CPL check. */
955	Bs3TrapSetJmpAndRestore(&Ctx83, &TrapCtx);
956	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &Ctx83, BS3_SEL_TEST_PAGE_02);
957	g_usBs3TestStep++;
958
959	/* +3: Now mark the CS selector not present and check that that also triggers before SS stuff. */
960	Bs3GdteTestPage02.Gen.u1Present = 0;
961	Bs3TrapSetJmpAndRestore(&CtxTmp, &TrapCtx);
962	bs3CpuBasic2_CompareNpCtx(&TrapCtx, &CtxTmp, BS3_SEL_TEST_PAGE_02);
963	Bs3GdteTestPage02.Gen.u1Present = 1;
964	g_usBs3TestStep++;
965
966	/* +4: Make the CS selector some invalid type and check it triggers before SS stuff. */
967	Bs3GdteTestPage02.Gen.u4Type = g_aInvalidCsTypes[i].u4Type;
968	Bs3GdteTestPage02.Gen.u1DescType = g_aInvalidCsTypes[i].u1DescType;
969	Bs3TrapSetJmpAndRestore(&CtxTmp, &TrapCtx);
970	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &CtxTmp, BS3_SEL_TEST_PAGE_02);
971	Bs3GdteTestPage02.Gen.u4Type = X86_SEL_TYPE_ER_ACC;
972	Bs3GdteTestPage02.Gen.u1DescType = 1;
973	g_usBs3TestStep++;
974
975	/* +5: Now, make the CS selector limit too small and that it triggers after SS trouble.
976	The 286 had a simpler approach to these GP(0). */
977	Bs3GdteTestPage02.Gen.u16LimitLow = 0;
978	Bs3GdteTestPage02.Gen.u4LimitHigh = 0;
979	Bs3GdteTestPage02.Gen.u1Granularity = 0;
980	Bs3TrapSetJmpAndRestore(&CtxTmp, &TrapCtx);
981	if (f286)
982	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &CtxTmp, 0 /uErrCd/);
983	else if (iRpl != 2 \|\| iRpl != iDpl \|\| k >= 4)
984	bs3CpuBasic2_CompareTsCtx(&TrapCtx, &CtxTmp, BS3_SEL_TEST_PAGE_03);
985	else if (k != 0)
986	bs3CpuBasic2_CompareSsCtx(&TrapCtx, &CtxTmp, BS3_SEL_TEST_PAGE_03, k == 2 /f486ResumeFlagHint/);
987	else
988	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &CtxTmp, 0 /uErrCd/);
989	Bs3GdteTestPage02 = Bs3Gdt[(uSysR0Cs + (2 << BS3_SEL_RING_SHIFT)) >> X86_SEL_SHIFT];
990	g_usBs3TestStep++;
991	}
992	}
993	}
994
995	/* Check all the invalid SS selector types alone. */
996	Bs3GdteTestPage02 = Bs3Gdt[(uSysR0Cs + (2 << BS3_SEL_RING_SHIFT)) >> X86_SEL_SHIFT];
997	Bs3GdteTestPage03 = Bs3Gdt[(uSysR0Ss + (2 << BS3_SEL_RING_SHIFT)) >> X86_SEL_SHIFT];
998	*puTssSs2 = BS3_SEL_TEST_PAGE_03 \| 2;
999	Bs3TrapSetJmpAndRestore(&CtxTmp, &TrapCtx);
1000	bs3CpuBasic2_CompareIntCtx1(&TrapCtx, &CtxTmp, 0x83);
1001	g_usBs3TestStep++;
1002	for (i = 0; i < RT_ELEMENTS(g_aInvalidSsTypes); i++)
1003	{
1004	Bs3GdteTestPage03.Gen.u4Type = g_aInvalidSsTypes[i].u4Type;
1005	Bs3GdteTestPage03.Gen.u1DescType = g_aInvalidSsTypes[i].u1DescType;
1006	Bs3TrapSetJmpAndRestore(&CtxTmp, &TrapCtx);
1007	bs3CpuBasic2_CompareTsCtx(&TrapCtx, &CtxTmp, BS3_SEL_TEST_PAGE_03);
1008	if (Bs3GdteTestPage03.Gen.u4Type != g_aInvalidSsTypes[i].u4Type)
1009	bs3CpuBasic2_FailedF("Invalid SS type %#x/%u -> %#x/%u\n",
1010	g_aInvalidSsTypes[i].u4Type, g_aInvalidSsTypes[i].u1DescType,
1011	Bs3GdteTestPage03.Gen.u4Type, Bs3GdteTestPage03.Gen.u1DescType);
1012	g_usBs3TestStep++;
1013	}
1014
1015	/*
1016	* Continue the SS experiments with a expand down segment. We'll use
1017	* the same setup as we already have with gate 83h being DPL and
1018	* having CS.DPL=2.
1019	*
1020	* Expand down segments are weird. The valid area is practically speaking
1021	* reversed. So, a 16-bit segment with a limit of 0x6000 will have valid
1022	* addresses from 0xffff thru 0x6001.
1023	*
1024	* So, with expand down segments we can more easily cut partially into the
1025	* pushing of the iret frame and trigger more interesting behavior than
1026	* with regular "expand up" segments where the whole pushing area is either
1027	* all fine or not not fine.
1028	*/
1029	Bs3GdteTestPage02 = Bs3Gdt[(uSysR0Cs + (2 << BS3_SEL_RING_SHIFT)) >> X86_SEL_SHIFT];
1030	Bs3GdteTestPage03 = Bs3Gdt[(uSysR0Ss + (2 << BS3_SEL_RING_SHIFT)) >> X86_SEL_SHIFT];
1031	Bs3GdteTestPage03.Gen.u2Dpl = 2;
1032	Bs3GdteTestPage03.Gen.u4Type = X86_SEL_TYPE_RW_DOWN;
1033	*puTssSs2 = BS3_SEL_TEST_PAGE_03 \| 2;
1034
1035	/* First test, limit = max --> no bytes accessible --> #GP */
1036	Bs3TrapSetJmpAndRestore(&CtxTmp, &TrapCtx);
1037	bs3CpuBasic2_CompareSsCtx(&TrapCtx, &CtxTmp, BS3_SEL_TEST_PAGE_03, true /f486ResumeFlagHint/);
1038
1039	/* Second test, limit = 0 --> all by zero byte accessible --> works */
1040	Bs3GdteTestPage03.Gen.u16LimitLow = 0;
1041	Bs3GdteTestPage03.Gen.u4LimitHigh = 0;
1042	Bs3TrapSetJmpAndRestore(&CtxTmp, &TrapCtx);
1043	bs3CpuBasic2_CompareIntCtx1(&TrapCtx, &CtxTmp, 0x83);
1044
1045	/* Modify the gate handler to be a dummy that immediately does UD2
1046	and triggers #UD, then advance the limit down till we get the #UD. */
1047	Bs3GdteTestPage03.Gen.u1Granularity = 0;
1048
1049	Bs3MemCpy(&CtxTmp2, &CtxTmp, sizeof(CtxTmp2)); /* #UD result context */
1050	if (g_f16BitSys)
1051	{
1052	CtxTmp2.rip.u = g_bs3CpuBasic2_ud2_FlatAddr - BS3_ADDR_BS3TEXT16;
1053	Bs3Trap16SetGate(0x83, X86_SEL_TYPE_SYS_286_INT_GATE, 3, BS3_SEL_TEST_PAGE_02, CtxTmp2.rip.u16, 0 /cParams/);
1054	CtxTmp2.rsp.u = Bs3Tss16.sp2 - 2*5;
1055	}
1056	else
1057	{
1058	CtxTmp2.rip.u = g_bs3CpuBasic2_ud2_FlatAddr;
1059	Bs3Trap32SetGate(0x83, X86_SEL_TYPE_SYS_386_INT_GATE, 3, BS3_SEL_TEST_PAGE_02, CtxTmp2.rip.u32, 0 /cParams/);
1060	CtxTmp2.rsp.u = Bs3Tss32.esp2 - 4*5;
1061	}
1062	CtxTmp2.bMode = g_bTestMode; /* g_bBs3CurrentMode not changed by the UD2 handler. */
1063	CtxTmp2.cs = BS3_SEL_TEST_PAGE_02 \| 2;
1064	CtxTmp2.ss = BS3_SEL_TEST_PAGE_03 \| 2;
1065	CtxTmp2.bCpl = 2;
1066
1067	/* test run. */
1068	Bs3TrapSetJmpAndRestore(&CtxTmp, &TrapCtx);
1069	bs3CpuBasic2_CompareUdCtx(&TrapCtx, &CtxTmp2);
1070	g_usBs3TestStep++;
1071
1072	/* Real run. */
1073	i = (g_f16BitSys ? 2 : 4) * 6 + 1;
1074	while (i-- > 0)
1075	{
1076	Bs3GdteTestPage03.Gen.u16LimitLow = CtxTmp2.rsp.u16 + i - 1;
1077	Bs3TrapSetJmpAndRestore(&CtxTmp, &TrapCtx);
1078	if (i > 0)
1079	bs3CpuBasic2_CompareSsCtx(&TrapCtx, &CtxTmp, BS3_SEL_TEST_PAGE_03, true /f486ResumeFlagHint/);
1080	else
1081	bs3CpuBasic2_CompareUdCtx(&TrapCtx, &CtxTmp2);
1082	g_usBs3TestStep++;
1083	}
1084
1085	/* Do a run where we do the same-ring kind of access. */
1086	Bs3RegCtxConvertToRingX(&CtxTmp, 2);
1087	if (g_f16BitSys)
1088	{
1089	CtxTmp2.rsp.u32 = CtxTmp.rsp.u32 - 2*3;
1090	i = 2*3 - 1;
1091	}
1092	else
1093	{
1094	CtxTmp2.rsp.u32 = CtxTmp.rsp.u32 - 4*3;
1095	i = 4*3 - 1;
1096	}
1097	CtxTmp.ss = BS3_SEL_TEST_PAGE_03 \| 2;
1098	CtxTmp2.ds = CtxTmp.ds;
1099	CtxTmp2.es = CtxTmp.es;
1100	CtxTmp2.fs = CtxTmp.fs;
1101	CtxTmp2.gs = CtxTmp.gs;
1102	while (i-- > 0)
1103	{
1104	Bs3GdteTestPage03.Gen.u16LimitLow = CtxTmp2.rsp.u16 + i - 1;
1105	Bs3TrapSetJmpAndRestore(&CtxTmp, &TrapCtx);
1106	if (i > 0)
1107	bs3CpuBasic2_CompareSsCtx(&TrapCtx, &CtxTmp, 0 /BS3_SEL_TEST_PAGE_03/, true /f486ResumeFlagHint/);
1108	else
1109	bs3CpuBasic2_CompareUdCtx(&TrapCtx, &CtxTmp2);
1110	g_usBs3TestStep++;
1111	}
1112
1113	*puTssSs2 = uSavedSs2;
1114	paIdt[0x83 << cIdteShift] = SavedGate83;
1115	}
1116	paIdt[0x80 << cIdteShift].Gate.u16Sel = uSysR0Cs;
1117	BS3_ASSERT(g_usBs3TestStep < 3000);
1118
1119	/*
1120	* Modify the gate CS value with a conforming segment.
1121	*/
1122	g_usBs3TestStep = 3000;
1123	for (i = 0; i <= 3; i++) /* cs.dpl */
1124	{
1125	for (iRing = 0; iRing <= 3; iRing++)
1126	{
1127	for (iCtx = 0; iCtx < RT_ELEMENTS(apCtx8x); iCtx++)
1128	{
1129	Bs3MemCpy(&CtxTmp, apCtx8x[iCtx], sizeof(CtxTmp));
1130	Bs3RegCtxConvertToRingX(&CtxTmp, iRing);
1131	# if TMPL_BITS == 32
1132	g_uBs3TrapEipHint = CtxTmp.rip.u32;
1133	# endif
1134
1135	for (j = 0; j <= 3; j++) /* rpl */
1136	{
1137	uint16_t const uCs = (uSysR0CsConf \| j) + (i << BS3_SEL_RING_SHIFT);
1138	/Bs3TestPrintf("g_usBs3TestStep=%u iCtx=%u iRing=%u i=%u uCs=%04x\n", g_usBs3TestStep, iCtx, iRing, i, uCs);/
1139	paIdt[(0x80 + iCtx) << cIdteShift].Gate.u16Sel = uCs;
1140	Bs3TrapSetJmpAndRestore(&CtxTmp, &TrapCtx);
1141	//Bs3TestPrintf("%u/%u/%u/%u: cs=%04x hcs=%04x xcpt=%02x\n", i, iRing, iCtx, j, uCs, TrapCtx.uHandlerCs, TrapCtx.bXcpt);
1142	/Bs3TrapPrintFrame(&TrapCtx);/
1143	g_usBs3TestStep++;
1144	if (iCtx < iRing)
1145	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &CtxTmp, ((0x80 + iCtx) << X86_TRAP_ERR_SEL_SHIFT) \| X86_TRAP_ERR_IDT);
1146	else if (i > iRing)
1147	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &CtxTmp, uCs & X86_SEL_MASK_OFF_RPL);
1148	else
1149	bs3CpuBasic2_CompareIntCtx1(&TrapCtx, &CtxTmp, 0x80 + iCtx /bXcpt/);
1150	}
1151	paIdt[(0x80 + iCtx) << cIdteShift].Gate.u16Sel = uSysR0Cs;
1152	}
1153	}
1154	}
1155	BS3_ASSERT(g_usBs3TestStep < 3500);
1156
1157	/*
1158	* The gates must be 64-bit in long mode.
1159	*/
1160	if (cIdteShift != 0)
1161	{
1162	g_usBs3TestStep = 3500;
1163	for (i = 0; i <= 3; i++)
1164	{
1165	for (iRing = 0; iRing <= 3; iRing++)
1166	{
1167	for (iCtx = 0; iCtx < RT_ELEMENTS(apCtx8x); iCtx++)
1168	{
1169	Bs3MemCpy(&CtxTmp, apCtx8x[iCtx], sizeof(CtxTmp));
1170	Bs3RegCtxConvertToRingX(&CtxTmp, iRing);
1171
1172	for (j = 0; j < 2; j++)
1173	{
1174	static const uint16_t s_auCSes[2] = { BS3_SEL_R0_CS16, BS3_SEL_R0_CS32 };
1175	uint16_t uCs = (s_auCSes[j] \| i) + (i << BS3_SEL_RING_SHIFT);
1176	g_usBs3TestStep++;
1177	/Bs3TestPrintf("g_usBs3TestStep=%u iCtx=%u iRing=%u i=%u uCs=%04x\n", g_usBs3TestStep, iCtx, iRing, i, uCs);/
1178	paIdt[(0x80 + iCtx) << cIdteShift].Gate.u16Sel = uCs;
1179	Bs3TrapSetJmpAndRestore(&CtxTmp, &TrapCtx);
1180	/Bs3TrapPrintFrame(&TrapCtx);/
1181	if (iCtx < iRing)
1182	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &CtxTmp, ((0x80 + iCtx) << X86_TRAP_ERR_SEL_SHIFT) \| X86_TRAP_ERR_IDT);
1183	else
1184	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &CtxTmp, uCs & X86_SEL_MASK_OFF_RPL);
1185	}
1186	paIdt[(0x80 + iCtx) << cIdteShift].Gate.u16Sel = uSysR0Cs;
1187	}
1188	}
1189	}
1190	BS3_ASSERT(g_usBs3TestStep < 4000);
1191	}
1192
1193	/*
1194	* IDT limit check. The 286 does not access X86DESCGATE::u16OffsetHigh.
1195	*/
1196	g_usBs3TestStep = 5000;
1197	i = (0x80 << (cIdteShift + 3)) - 1;
1198	j = (0x82 << (cIdteShift + 3)) - (!f286 ? 1 : 3);
1199	k = (0x83 << (cIdteShift + 3)) - 1;
1200	for (; i <= k; i++, g_usBs3TestStep++)
1201	{
1202	Idtr = IdtrSaved;
1203	Idtr.cbIdt = i;
1204	ASMSetIDTR(&Idtr);
1205	Bs3TrapSetJmpAndRestore(&Ctx81, &TrapCtx);
1206	if (i < j)
1207	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &Ctx81, (0x81 << X86_TRAP_ERR_SEL_SHIFT) \| X86_TRAP_ERR_IDT);
1208	else
1209	bs3CpuBasic2_CompareIntCtx1(&TrapCtx, &Ctx81, 0x81 /bXcpt/);
1210	}
1211	ASMSetIDTR(&IdtrSaved);
1212	BS3_ASSERT(g_usBs3TestStep < 5100);
1213
1214	# if TMPL_BITS != 16 /* Only do the paging related stuff in 32-bit and 64-bit modes. */
1215
1216	/*
1217	* IDT page not present. Placing the IDT copy such that 0x80 is on the
1218	* first page and 0x81 is on the second page. We need proceed to move
1219	* it down byte by byte to check that any inaccessible byte means #PF.
1220	*
1221	* Note! We must reload the alternative IDTR for each run as any kind of
1222	* printing to the string (like error reporting) will cause a switch
1223	* to real mode and back, reloading the default IDTR.
1224	*/
1225	g_usBs3TestStep = 5200;
1226	if (BS3_MODE_IS_PAGED(g_bTestMode) && pbIdtCopyAlloc)
1227	{
1228	uint32_t const uCr2Expected = Bs3SelPtrToFlat(pbIdtCopyAlloc) + _4K;
1229	for (j = 0; j < cbIdte; j++)
1230	{
1231	pIdtCopy = (PX86DESC)&pbIdtCopyAlloc[_4K - cbIdte * 0x81 - j];
1232	Bs3MemCpy(pIdtCopy, paIdt, cbIdte * 256);
1233
1234	Idtr.cbIdt = IdtrSaved.cbIdt;
1235	Idtr.pIdt = Bs3SelPtrToFlat(pIdtCopy);
1236
1237	ASMSetIDTR(&Idtr);
1238	Bs3TrapSetJmpAndRestore(&Ctx81, &TrapCtx);
1239	bs3CpuBasic2_CompareIntCtx1(&TrapCtx, &Ctx81, 0x81 /bXcpt/);
1240	g_usBs3TestStep++;
1241
1242	ASMSetIDTR(&Idtr);
1243	Bs3TrapSetJmpAndRestore(&Ctx80, &TrapCtx);
1244	bs3CpuBasic2_CompareIntCtx1(&TrapCtx, &Ctx80, 0x80 /bXcpt/);
1245	g_usBs3TestStep++;
1246
1247	rc = Bs3PagingProtect(uCr2Expected, _4K, 0 /fSet/, X86_PTE_P /fClear/);
1248	if (RT_SUCCESS(rc))
1249	{
1250	ASMSetIDTR(&Idtr);
1251	Bs3TrapSetJmpAndRestore(&Ctx80, &TrapCtx);
1252	bs3CpuBasic2_CompareIntCtx1(&TrapCtx, &Ctx80, 0x80 /bXcpt/);
1253	g_usBs3TestStep++;
1254
1255	ASMSetIDTR(&Idtr);
1256	Bs3TrapSetJmpAndRestore(&Ctx81, &TrapCtx);
1257	if (f486Plus)
1258	bs3CpuBasic2_ComparePfCtx(&TrapCtx, &Ctx81, 0 /uErrCd/, uCr2Expected);
1259	else
1260	bs3CpuBasic2_ComparePfCtx(&TrapCtx, &Ctx81, X86_TRAP_PF_RW /uErrCd/, uCr2Expected + 4 - RT_MIN(j, 4));
1261	g_usBs3TestStep++;
1262
1263	Bs3PagingProtect(uCr2Expected, _4K, X86_PTE_P /fSet/, 0 /fClear/);
1264
1265	/* Check if that the entry type is checked after the whole IDTE has been cleared for #PF. */
1266	pIdtCopy[0x80 << cIdteShift].Gate.u4Type = 0;
1267	rc = Bs3PagingProtect(uCr2Expected, _4K, 0 /fSet/, X86_PTE_P /fClear/);
1268	if (RT_SUCCESS(rc))
1269	{
1270	ASMSetIDTR(&Idtr);
1271	Bs3TrapSetJmpAndRestore(&Ctx81, &TrapCtx);
1272	if (f486Plus)
1273	bs3CpuBasic2_ComparePfCtx(&TrapCtx, &Ctx81, 0 /uErrCd/, uCr2Expected);
1274	else
1275	bs3CpuBasic2_ComparePfCtx(&TrapCtx, &Ctx81, X86_TRAP_PF_RW /uErrCd/, uCr2Expected + 4 - RT_MIN(j, 4));
1276	g_usBs3TestStep++;
1277
1278	Bs3PagingProtect(uCr2Expected, _4K, X86_PTE_P /fSet/, 0 /fClear/);
1279	}
1280	}
1281	else
1282	Bs3TestPrintf("Bs3PagingProtectPtr: %d\n", i);
1283
1284	ASMSetIDTR(&IdtrSaved);
1285	}
1286	}
1287
1288	/*
1289	* The read/write and user/supervisor bits the IDT PTEs are irrelevant.
1290	*/
1291	g_usBs3TestStep = 5300;
1292	if (BS3_MODE_IS_PAGED(g_bTestMode) && pbIdtCopyAlloc)
1293	{
1294	Bs3MemCpy(pbIdtCopyAlloc, paIdt, cbIdte * 256);
1295	Idtr.cbIdt = IdtrSaved.cbIdt;
1296	Idtr.pIdt = Bs3SelPtrToFlat(pbIdtCopyAlloc);
1297
1298	ASMSetIDTR(&Idtr);
1299	Bs3TrapSetJmpAndRestore(&Ctx81, &TrapCtx);
1300	bs3CpuBasic2_CompareIntCtx1(&TrapCtx, &Ctx81, 0x81 /bXcpt/);
1301	g_usBs3TestStep++;
1302
1303	rc = Bs3PagingProtect(Idtr.pIdt, _4K, 0 /fSet/, X86_PTE_RW \| X86_PTE_US /fClear/);
1304	if (RT_SUCCESS(rc))
1305	{
1306	ASMSetIDTR(&Idtr);
1307	Bs3TrapSetJmpAndRestore(&Ctx81, &TrapCtx);
1308	bs3CpuBasic2_CompareIntCtx1(&TrapCtx, &Ctx81, 0x81 /bXcpt/);
1309	g_usBs3TestStep++;
1310
1311	Bs3PagingProtect(Idtr.pIdt, _4K, X86_PTE_RW \| X86_PTE_US /fSet/, 0 /fClear/);
1312	}
1313	ASMSetIDTR(&IdtrSaved);
1314	}
1315
1316	/*
1317	* Check that CS.u1Accessed is set to 1. Use the test page selector #0 and #3 together
1318	* with interrupt gates 80h and 83h, respectively.
1319	*/
1320	/** @todo Throw in SS.u1Accessed too. */
1321	g_usBs3TestStep = 5400;
1322	if (BS3_MODE_IS_PAGED(g_bTestMode) && pbIdtCopyAlloc)
1323	{
1324	Bs3GdteTestPage00 = Bs3Gdt[uSysR0Cs >> X86_SEL_SHIFT];
1325	Bs3GdteTestPage00.Gen.u4Type &= ~X86_SEL_TYPE_ACCESSED;
1326	paIdt[0x80 << cIdteShift].Gate.u16Sel = BS3_SEL_TEST_PAGE_00;
1327
1328	Bs3GdteTestPage03 = Bs3Gdt[(uSysR0Cs + (3 << BS3_SEL_RING_SHIFT)) >> X86_SEL_SHIFT];
1329	Bs3GdteTestPage03.Gen.u4Type &= ~X86_SEL_TYPE_ACCESSED;
1330	paIdt[0x83 << cIdteShift].Gate.u16Sel = BS3_SEL_TEST_PAGE_03; /* rpl is ignored, so leave it as zero. */
1331
1332	/* Check that the CS.A bit is being set on a general basis and that
1333	the special CS values work with out generic handler code. */
1334	Bs3TrapSetJmpAndRestore(&Ctx80, &TrapCtx);
1335	bs3CpuBasic2_CompareIntCtx1(&TrapCtx, &Ctx80, 0x80 /bXcpt/);
1336	if (!(Bs3GdteTestPage00.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
1337	bs3CpuBasic2_FailedF("u4Type=%#x, not accessed", Bs3GdteTestPage00.Gen.u4Type);
1338	g_usBs3TestStep++;
1339
1340	Bs3MemCpy(&CtxTmp, &Ctx83, sizeof(CtxTmp));
1341	Bs3RegCtxConvertToRingX(&CtxTmp, 3);
1342	Bs3TrapSetJmpAndRestore(&CtxTmp, &TrapCtx);
1343	bs3CpuBasic2_CompareIntCtx1(&TrapCtx, &CtxTmp, 0x83 /bXcpt/);
1344	if (!(Bs3GdteTestPage03.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
1345	bs3CpuBasic2_FailedF("u4Type=%#x, not accessed!", Bs3GdteTestPage00.Gen.u4Type);
1346	if (TrapCtx.uHandlerCs != (BS3_SEL_TEST_PAGE_03 \| 3))
1347	bs3CpuBasic2_FailedF("uHandlerCs=%#x, expected %#x", TrapCtx.uHandlerCs, (BS3_SEL_TEST_PAGE_03 \| 3));
1348	g_usBs3TestStep++;
1349
1350	/*
1351	* Now check that setting CS.u1Access to 1 does __NOT__ trigger a page
1352	* fault due to the RW bit being zero.
1353	* (We check both with with and without the WP bit if 80486.)
1354	*/
1355	if ((g_uBs3CpuDetected & BS3CPU_TYPE_MASK) >= BS3CPU_80486)
1356	ASMSetCR0(uCr0Saved \| X86_CR0_WP);
1357
1358	Bs3GdteTestPage00.Gen.u4Type &= ~X86_SEL_TYPE_ACCESSED;
1359	Bs3GdteTestPage03.Gen.u4Type &= ~X86_SEL_TYPE_ACCESSED;
1360	rc = Bs3PagingProtect(GdtrSaved.pGdt + BS3_SEL_TEST_PAGE_00, 8, 0 /fSet/, X86_PTE_RW /fClear/);
1361	if (RT_SUCCESS(rc))
1362	{
1363	/* ring-0 handler */
1364	Bs3TrapSetJmpAndRestore(&Ctx80, &TrapCtx);
1365	bs3CpuBasic2_CompareIntCtx1(&TrapCtx, &Ctx80, 0x80 /bXcpt/);
1366	if (!(Bs3GdteTestPage00.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
1367	bs3CpuBasic2_FailedF("u4Type=%#x, not accessed!", Bs3GdteTestPage00.Gen.u4Type);
1368	g_usBs3TestStep++;
1369
1370	/* ring-3 handler */
1371	Bs3MemCpy(&CtxTmp, &Ctx83, sizeof(CtxTmp));
1372	Bs3RegCtxConvertToRingX(&CtxTmp, 3);
1373	Bs3TrapSetJmpAndRestore(&CtxTmp, &TrapCtx);
1374	bs3CpuBasic2_CompareIntCtx1(&TrapCtx, &CtxTmp, 0x83 /bXcpt/);
1375	if (!(Bs3GdteTestPage03.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
1376	bs3CpuBasic2_FailedF("u4Type=%#x, not accessed!", Bs3GdteTestPage00.Gen.u4Type);
1377	g_usBs3TestStep++;
1378
1379	/* clear WP and repeat the above. */
1380	if ((g_uBs3CpuDetected & BS3CPU_TYPE_MASK) >= BS3CPU_80486)
1381	ASMSetCR0(uCr0Saved & ~X86_CR0_WP);
1382	Bs3GdteTestPage00.Gen.u4Type &= ~X86_SEL_TYPE_ACCESSED; /* (No need to RW the page - ring-0, WP=0.) */
1383	Bs3GdteTestPage03.Gen.u4Type &= ~X86_SEL_TYPE_ACCESSED; /* (No need to RW the page - ring-0, WP=0.) */
1384
1385	Bs3TrapSetJmpAndRestore(&Ctx80, &TrapCtx);
1386	bs3CpuBasic2_CompareIntCtx1(&TrapCtx, &Ctx80, 0x80 /bXcpt/);
1387	if (!(Bs3GdteTestPage00.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
1388	bs3CpuBasic2_FailedF("u4Type=%#x, not accessed!", Bs3GdteTestPage00.Gen.u4Type);
1389	g_usBs3TestStep++;
1390
1391	Bs3TrapSetJmpAndRestore(&CtxTmp, &TrapCtx);
1392	bs3CpuBasic2_CompareIntCtx1(&TrapCtx, &CtxTmp, 0x83 /bXcpt/);
1393	if (!(Bs3GdteTestPage03.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
1394	bs3CpuBasic2_FailedF("u4Type=%#x, not accessed!n", Bs3GdteTestPage03.Gen.u4Type);
1395	g_usBs3TestStep++;
1396
1397	Bs3PagingProtect(GdtrSaved.pGdt + BS3_SEL_TEST_PAGE_00, 8, X86_PTE_RW /fSet/, 0 /fClear/);
1398	}
1399
1400	ASMSetCR0(uCr0Saved);
1401
1402	/*
1403	* While we're here, check that if the CS GDT entry is a non-present
1404	* page we do get a #PF with the rigth error code and CR2.
1405	*/
1406	Bs3GdteTestPage00.Gen.u4Type &= ~X86_SEL_TYPE_ACCESSED; /* Just for fun, really a pointless gesture. */
1407	Bs3GdteTestPage03.Gen.u4Type &= ~X86_SEL_TYPE_ACCESSED;
1408	rc = Bs3PagingProtect(GdtrSaved.pGdt + BS3_SEL_TEST_PAGE_00, 8, 0 /fSet/, X86_PTE_P /fClear/);
1409	if (RT_SUCCESS(rc))
1410	{
1411	Bs3TrapSetJmpAndRestore(&Ctx80, &TrapCtx);
1412	if (f486Plus)
1413	bs3CpuBasic2_ComparePfCtx(&TrapCtx, &Ctx80, 0 /uErrCd/, GdtrSaved.pGdt + BS3_SEL_TEST_PAGE_00);
1414	else
1415	bs3CpuBasic2_ComparePfCtx(&TrapCtx, &Ctx80, X86_TRAP_PF_RW, GdtrSaved.pGdt + BS3_SEL_TEST_PAGE_00 + 4);
1416	g_usBs3TestStep++;
1417
1418	/* Do it from ring-3 to check ErrCd, which doesn't set X86_TRAP_PF_US it turns out. */
1419	Bs3MemCpy(&CtxTmp, &Ctx83, sizeof(CtxTmp));
1420	Bs3RegCtxConvertToRingX(&CtxTmp, 3);
1421	Bs3TrapSetJmpAndRestore(&CtxTmp, &TrapCtx);
1422
1423	if (f486Plus)
1424	bs3CpuBasic2_ComparePfCtx(&TrapCtx, &CtxTmp, 0 /uErrCd/, GdtrSaved.pGdt + BS3_SEL_TEST_PAGE_03);
1425	else
1426	bs3CpuBasic2_ComparePfCtx(&TrapCtx, &CtxTmp, X86_TRAP_PF_RW, GdtrSaved.pGdt + BS3_SEL_TEST_PAGE_03 + 4);
1427	g_usBs3TestStep++;
1428
1429	Bs3PagingProtect(GdtrSaved.pGdt + BS3_SEL_TEST_PAGE_00, 8, X86_PTE_P /fSet/, 0 /fClear/);
1430	if (Bs3GdteTestPage00.Gen.u4Type & X86_SEL_TYPE_ACCESSED)
1431	bs3CpuBasic2_FailedF("u4Type=%#x, accessed! #1", Bs3GdteTestPage00.Gen.u4Type);
1432	if (Bs3GdteTestPage03.Gen.u4Type & X86_SEL_TYPE_ACCESSED)
1433	bs3CpuBasic2_FailedF("u4Type=%#x, accessed! #2", Bs3GdteTestPage03.Gen.u4Type);
1434	}
1435
1436	/* restore */
1437	paIdt[0x80 << cIdteShift].Gate.u16Sel = uSysR0Cs;
1438	paIdt[0x83 << cIdteShift].Gate.u16Sel = uSysR0Cs;// + (3 << BS3_SEL_RING_SHIFT) + 3;
1439	}
1440
1441	# endif /* 32 \|\| 64*/
1442
1443	/*
1444	* Check broad EFLAGS effects.
1445	*/
1446	g_usBs3TestStep = 5600;
1447	for (iCtx = 0; iCtx < RT_ELEMENTS(apCtx8x); iCtx++)
1448	{
1449	for (iRing = 0; iRing < 4; iRing++)
1450	{
1451	Bs3MemCpy(&CtxTmp, apCtx8x[iCtx], sizeof(CtxTmp));
1452	Bs3RegCtxConvertToRingX(&CtxTmp, iRing);
1453
1454	/* all set */
1455	CtxTmp.rflags.u32 &= X86_EFL_VM \| X86_EFL_1;
1456	CtxTmp.rflags.u32 \|= X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF /* \| X86_EFL_TF / /\| X86_EFL_IF*/
1457	\| X86_EFL_DF \| X86_EFL_OF \| X86_EFL_IOPL /* \| X86_EFL_NT*/;
1458	if (f486Plus)
1459	CtxTmp.rflags.u32 \|= X86_EFL_AC;
1460	if (f486Plus && !g_f16BitSys)
1461	CtxTmp.rflags.u32 \|= X86_EFL_RF;
1462	if (g_uBs3CpuDetected & BS3CPU_F_CPUID)
1463	CtxTmp.rflags.u32 \|= X86_EFL_VIF \| X86_EFL_VIP;
1464	Bs3TrapSetJmpAndRestore(&CtxTmp, &TrapCtx);
1465	CtxTmp.rflags.u32 &= ~X86_EFL_RF;
1466
1467	if (iCtx >= iRing)
1468	bs3CpuBasic2_CompareIntCtx1(&TrapCtx, &CtxTmp, 0x80 + iCtx /bXcpt/);
1469	else
1470	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &CtxTmp, ((0x80 + iCtx) << X86_TRAP_ERR_SEL_SHIFT) \| X86_TRAP_ERR_IDT);
1471	uExpected = CtxTmp.rflags.u32
1472	& ( X86_EFL_1 \| X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_DF
1473	\| X86_EFL_OF \| X86_EFL_IOPL \| X86_EFL_NT \| X86_EFL_VM \| X86_EFL_AC \| X86_EFL_VIF \| X86_EFL_VIP
1474	\| X86_EFL_ID /\| X86_EFL_TF/ /\| X86_EFL_IF/ /\| X86_EFL_RF/ );
1475	if (TrapCtx.fHandlerRfl != uExpected)
1476	bs3CpuBasic2_FailedF("unexpected handler rflags value: %RX64 expected %RX32; CtxTmp.rflags=%RX64 Ctx.rflags=%RX64\n",
1477	TrapCtx.fHandlerRfl, uExpected, CtxTmp.rflags.u, TrapCtx.Ctx.rflags.u);
1478	g_usBs3TestStep++;
1479
1480	/* all cleared */
1481	if ((g_uBs3CpuDetected & BS3CPU_TYPE_MASK) < BS3CPU_80286)
1482	CtxTmp.rflags.u32 = apCtx8x[iCtx]->rflags.u32 & (X86_EFL_RA1_MASK \| UINT16_C(0xf000));
1483	else
1484	CtxTmp.rflags.u32 = apCtx8x[iCtx]->rflags.u32 & (X86_EFL_VM \| X86_EFL_RA1_MASK);
1485	Bs3TrapSetJmpAndRestore(&CtxTmp, &TrapCtx);
1486	if (iCtx >= iRing)
1487	bs3CpuBasic2_CompareIntCtx1(&TrapCtx, &CtxTmp, 0x80 + iCtx /bXcpt/);
1488	else
1489	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &CtxTmp, ((0x80 + iCtx) << X86_TRAP_ERR_SEL_SHIFT) \| X86_TRAP_ERR_IDT);
1490	uExpected = CtxTmp.rflags.u32;
1491	if (TrapCtx.fHandlerRfl != uExpected)
1492	bs3CpuBasic2_FailedF("unexpected handler rflags value: %RX64 expected %RX32; CtxTmp.rflags=%RX64 Ctx.rflags=%RX64\n",
1493	TrapCtx.fHandlerRfl, uExpected, CtxTmp.rflags.u, TrapCtx.Ctx.rflags.u);
1494	g_usBs3TestStep++;
1495	}
1496	}
1497
1498	/** @todo CS.LIMIT / canonical(CS) */
1499
1500
1501	/*
1502	* Check invalid gate types.
1503	*/
1504	g_usBs3TestStep = 32000;
1505	for (iRing = 0; iRing <= 3; iRing++)
1506	{
1507	static const uint16_t s_auCSes[] = { BS3_SEL_R0_CS16, BS3_SEL_R0_CS32, BS3_SEL_R0_CS64,
1508	BS3_SEL_TSS16, BS3_SEL_TSS32, BS3_SEL_TSS64, 0, BS3_SEL_SPARE_1f };
1509	static uint16_t const s_auInvlTypes64[] = { 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 13,
1510	0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17,
1511	0x18, 0x19, 0x1a, 0x1b, 0x1c, 0x1d, 0x1e, 0x1f };
1512	static uint16_t const s_auInvlTypes32[] = { 0, 1, 2, 3, 8, 9, 10, 11, 13,
1513	0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17,
1514	0x18, 0x19, 0x1a, 0x1b, 0x1c, 0x1d, 0x1e, 0x1f,
1515	/286:/ 12, 14, 15 };
1516	uint16_t const * const pauInvTypes = cIdteShift != 0 ? s_auInvlTypes64 : s_auInvlTypes32;
1517	uint16_t const cInvTypes = cIdteShift != 0 ? RT_ELEMENTS(s_auInvlTypes64)
1518	: f386Plus ? RT_ELEMENTS(s_auInvlTypes32) - 3 : RT_ELEMENTS(s_auInvlTypes32);
1519
1520
1521	for (iCtx = 0; iCtx < RT_ELEMENTS(apCtx8x); iCtx++)
1522	{
1523	unsigned iType;
1524
1525	Bs3MemCpy(&CtxTmp, apCtx8x[iCtx], sizeof(CtxTmp));
1526	Bs3RegCtxConvertToRingX(&CtxTmp, iRing);
1527	# if TMPL_BITS == 32
1528	g_uBs3TrapEipHint = CtxTmp.rip.u32;
1529	# endif
1530	for (iType = 0; iType < cInvTypes; iType++)
1531	{
1532	uint8_t const bSavedType = paIdt[(0x80 + iCtx) << cIdteShift].Gate.u4Type;
1533	paIdt[(0x80 + iCtx) << cIdteShift].Gate.u1DescType = pauInvTypes[iType] >> 4;
1534	paIdt[(0x80 + iCtx) << cIdteShift].Gate.u4Type = pauInvTypes[iType] & 0xf;
1535
1536	for (i = 0; i < 4; i++)
1537	{
1538	for (j = 0; j < RT_ELEMENTS(s_auCSes); j++)
1539	{
1540	uint16_t uCs = (unsigned)(s_auCSes[j] - BS3_SEL_R0_FIRST) < (unsigned)(4 << BS3_SEL_RING_SHIFT)
1541	? (s_auCSes[j] \| i) + (i << BS3_SEL_RING_SHIFT)
1542	: s_auCSes[j] \| i;
1543	/Bs3TestPrintf("g_usBs3TestStep=%u iCtx=%u iRing=%u i=%u uCs=%04x type=%#x\n", g_usBs3TestStep, iCtx, iRing, i, uCs, pauInvTypes[iType]);/
1544	paIdt[(0x80 + iCtx) << cIdteShift].Gate.u16Sel = uCs;
1545	Bs3TrapSetJmpAndRestore(&CtxTmp, &TrapCtx);
1546	g_usBs3TestStep++;
1547	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &CtxTmp, ((0x80 + iCtx) << X86_TRAP_ERR_SEL_SHIFT) \| X86_TRAP_ERR_IDT);
1548
1549	/* Mark it not-present to check that invalid type takes precedence. */
1550	paIdt[(0x80 + iCtx) << cIdteShift].Gate.u1Present = 0;
1551	Bs3TrapSetJmpAndRestore(&CtxTmp, &TrapCtx);
1552	g_usBs3TestStep++;
1553	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &CtxTmp, ((0x80 + iCtx) << X86_TRAP_ERR_SEL_SHIFT) \| X86_TRAP_ERR_IDT);
1554	paIdt[(0x80 + iCtx) << cIdteShift].Gate.u1Present = 1;
1555	}
1556	}
1557
1558	paIdt[(0x80 + iCtx) << cIdteShift].Gate.u16Sel = uSysR0Cs;
1559	paIdt[(0x80 + iCtx) << cIdteShift].Gate.u4Type = bSavedType;
1560	paIdt[(0x80 + iCtx) << cIdteShift].Gate.u1DescType = 0;
1561	paIdt[(0x80 + iCtx) << cIdteShift].Gate.u1Present = 1;
1562	}
1563	}
1564	}
1565	BS3_ASSERT(g_usBs3TestStep < 62000U && g_usBs3TestStep > 32000U);
1566
1567
1568	/** @todo
1569	* - Run \#PF and \#GP (and others?) at CPLs other than zero.
1570	* - Quickly generate all faults.
1571	* - All the peculiarities v8086.
1572	*/
1573
1574	# if TMPL_BITS != 16
1575	Bs3MemFree(pbIdtCopyAlloc, 12*_1K);
1576	# endif
1577	}
1578	#endif /* convert me */
1579
1580
1581	static void bs3CpuBasic2_RaiseXcpt11Worker(uint8_t bMode, uint8_t *pbBuf, unsigned cbCacheLine, bool fAm, bool fPf,
1582	RTCCUINTXREG uFlatBufPtr, BS3CPUBASIC2PFTTSTCMNMODE const BS3_FAR *pCmn)
1583	{
1584	BS3TRAPFRAME TrapCtx;
1585	BS3REGCTX Ctx;
1586	BS3REGCTX CtxUdExpected;
1587	uint8_t const cRings = bMode == BS3_MODE_RM ? 1 : 4;
1588	uint8_t iRing;
1589	uint16_t iTest;
1590
1591	/* make sure they're allocated */
1592	Bs3MemZero(&TrapCtx, sizeof(TrapCtx));
1593	Bs3MemZero(&Ctx, sizeof(Ctx));
1594	Bs3MemZero(&CtxUdExpected, sizeof(CtxUdExpected));
1595
1596	/*
1597	* Test all relevant rings.
1598	*
1599	* The memory operand is ds:xBX, so point it to pbBuf.
1600	* The test snippets mostly use xAX as operand, with the div
1601	* one also using xDX, so make sure they make some sense.
1602	*/
1603	Bs3RegCtxSaveEx(&Ctx, bMode, 512);
1604
1605	Ctx.cr0.u32 &= ~(X86_CR0_MP \| X86_CR0_EM \| X86_CR0_TS); /* so fninit + fld works */
1606
1607	for (iRing = BS3_MODE_IS_V86(bMode) ? 3 : 0; iRing < cRings; iRing++)
1608	{
1609	uint32_t uEbx;
1610	uint8_t fAc;
1611
1612	if (!BS3_MODE_IS_RM_OR_V86(bMode))
1613	Bs3RegCtxConvertToRingX(&Ctx, iRing);
1614
1615	if (!fPf \|\| BS3_MODE_IS_32BIT_CODE(bMode) \|\| BS3_MODE_IS_64BIT_CODE(bMode))
1616	Bs3RegCtxSetGrpDsFromCurPtr(&Ctx, &Ctx.rbx, pbBuf);
1617	else
1618	{
1619	/* Bs3RegCtxSetGrpDsFromCurPtr barfs when trying to output a sel:off address for the aliased buffer. */
1620	Ctx.ds = BS3_FP_SEG(pbBuf);
1621	Ctx.rbx.u32 = BS3_FP_OFF(pbBuf);
1622	}
1623	uEbx = Ctx.rbx.u32;
1624
1625	Ctx.rax.u = (bMode & BS3_MODE_CODE_MASK) == BS3_MODE_CODE_64
1626	? UINT64_C(0x80868028680386fe) : UINT32_C(0x65020686);
1627	Ctx.rdx.u = UINT32_C(0x00100100); /* careful with range due to div */
1628
1629	Bs3MemCpy(&CtxUdExpected, &Ctx, sizeof(Ctx));
1630
1631	/*
1632	* AC flag loop.
1633	*/
1634	for (fAc = 0; fAc < 2; fAc++)
1635	{
1636	if (fAc)
1637	Ctx.rflags.u32 \|= X86_EFL_AC;
1638	else
1639	Ctx.rflags.u32 &= ~X86_EFL_AC;
1640
1641	/*
1642	* Loop over the test snippets.
1643	*/
1644	for (iTest = 0; iTest < pCmn->cEntries; iTest++)
1645	{
1646	uint8_t const fOp = pCmn->paEntries[iTest].fOp;
1647	uint16_t const cbMem = pCmn->paEntries[iTest].cbMem;
1648	uint8_t const cbAlign = pCmn->paEntries[iTest].cbAlign;
1649	uint16_t const cbMax = cbCacheLine + cbMem;
1650	uint16_t offMem;
1651	uint8_t BS3_FAR poffUd = (uint8_t BS3_FAR )Bs3SelLnkPtrToCurPtr(pCmn->paEntries[iTest].pfn);
1652	Bs3RegCtxSetRipCsFromLnkPtr(&Ctx, pCmn->paEntries[iTest].pfn);
1653	CtxUdExpected.rip = Ctx.rip;
1654	CtxUdExpected.rip.u = Ctx.rip.u + poffUd[-1];
1655	CtxUdExpected.cs = Ctx.cs;
1656	CtxUdExpected.rflags = Ctx.rflags;
1657	if (bMode == BS3_MODE_RM)
1658	CtxUdExpected.rflags.u32 &= ~X86_EFL_AC; /** @todo investigate. automatically cleared, or is it just our code? Observed with bs3-cpu-instr-3 too (10980xe), seems to be the CPU doing it. */
1659	CtxUdExpected.rdx = Ctx.rdx;
1660	CtxUdExpected.rax = Ctx.rax;
1661	if (fOp & MYOP_LD)
1662	{
1663	switch (cbMem)
1664	{
1665	case 2:
1666	CtxUdExpected.rax.u16 = 0x0101;
1667	break;
1668	case 4:
1669	CtxUdExpected.rax.u32 = UINT32_C(0x01010101);
1670	break;
1671	case 8:
1672	CtxUdExpected.rax.u64 = UINT64_C(0x0101010101010101);
1673	break;
1674	}
1675	}
1676
1677	/*
1678	* Buffer misalignment loop.
1679	* Note! We must make sure to cross a cache line here to make sure
1680	* to cover the split-lock scenario. (The buffer is cache
1681	* line aligned.)
1682	*/
1683	for (offMem = 0; offMem < cbMax; offMem++)
1684	{
1685	bool const fMisaligned = (offMem & (cbAlign - 1)) != 0;
1686	unsigned offBuf = cbMax + cbMem * 2;
1687	while (offBuf-- > 0)
1688	pbBuf[offBuf] = 1; /* byte-by-byte to make sure it doesn't trigger AC. */
1689
1690	CtxUdExpected.rbx.u32 = Ctx.rbx.u32 = uEbx + offMem; /* ASSUMES memory in first 4GB. */
1691	if (BS3_MODE_IS_16BIT_SYS(bMode))
1692	g_uBs3TrapEipHint = Ctx.rip.u32;
1693
1694	//Bs3TestPrintf("iRing=%d iTest=%d cs:rip=%04RX16:%08RX32 ds:rbx=%04RX16:%08RX32 ss:esp=%04RX16:%08RX32 bXcpt=%#x errcd=%#x fAm=%d fAc=%d ESP=%#RX32\n",
1695	// iRing, iTest, Ctx.cs, Ctx.rip.u32, Ctx.ds, Ctx.rbx.u32, Ctx.ss, Ctx.rsp.u32, TrapCtx.bXcpt, (unsigned)TrapCtx.uErrCd, fAm, fAc, ASMGetESP());
1696
1697	Bs3TrapSetJmpAndRestore(&Ctx, &TrapCtx);
1698
1699	if ( (pCmn->paEntries[iTest].fOp & MYOP_AC_GP)
1700	&& fMisaligned
1701	&& (!fAm \|\| iRing != 3 \|\| !fAc \|\| (offMem & 3 /* 10980XE */) == 0) )
1702	{
1703	if (fAc && bMode == BS3_MODE_RM)
1704	TrapCtx.Ctx.rflags.u32 \|= X86_EFL_AC;
1705	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &Ctx, 0);
1706	}
1707	else if (fPf && iRing == 3 && (!fAm \|\| !fAc \|\| !fMisaligned)) /* #AC beats #PF */
1708	bs3CpuBasic2_ComparePfCtx(&TrapCtx, &Ctx,
1709	X86_TRAP_PF_P \| X86_TRAP_PF_US
1710	\| (pCmn->paEntries[iTest].fOp & MYOP_ST ? X86_TRAP_PF_RW : 0),
1711	uFlatBufPtr + offMem + (cbMem > 64 ? cbMem - 1 /FXSAVE/ : 0),
1712	pCmn->paEntries[iTest].offFaultInstr);
1713	else if (!fAm \|\| iRing != 3 \|\| !fAc \|\| !fMisaligned)
1714	{
1715	if (fOp & MYOP_EFL)
1716	{
1717	CtxUdExpected.rflags.u16 &= ~X86_EFL_STATUS_BITS;
1718	CtxUdExpected.rflags.u16 \|= TrapCtx.Ctx.rflags.u16 & X86_EFL_STATUS_BITS;
1719	}
1720	if (fOp == MYOP_LD_DIV)
1721	{
1722	CtxUdExpected.rax = TrapCtx.Ctx.rax;
1723	CtxUdExpected.rdx = TrapCtx.Ctx.rdx;
1724	}
1725	bs3CpuBasic2_CompareUdCtx(&TrapCtx, &CtxUdExpected);
1726	}
1727	else
1728	bs3CpuBasic2_CompareAcCtx(&TrapCtx, &Ctx, pCmn->paEntries[iTest].offFaultInstr);
1729
1730	g_usBs3TestStep++;
1731	}
1732	}
1733	}
1734	}
1735	}
1736
1737
1738	/**
1739	* Entrypoint for \#AC tests.
1740	*
1741	* @returns 0 or BS3TESTDOMODE_SKIPPED.
1742	* @param bMode The CPU mode we're testing.
1743	*
1744	* @note When testing v8086 code, we'll be running in v8086 mode. So, careful
1745	* with control registers and such.
1746	*/
1747	BS3_DECL_FAR(uint8_t) BS3_CMN_FAR_NM(bs3CpuBasic2_RaiseXcpt11)(uint8_t bMode)
1748	{
1749	unsigned cbCacheLine = 128; /** @todo detect */
1750	uint8_t BS3_FAR *pbBufAlloc;
1751	uint8_t BS3_FAR *pbBuf;
1752	unsigned idxCmnModes;
1753	uint32_t fCr0;
1754
1755	/*
1756	* Skip if 386 or older.
1757	*/
1758	if ((g_uBs3CpuDetected & BS3CPU_TYPE_MASK) < BS3CPU_80486)
1759	{
1760	Bs3TestSkipped("#AC test requires 486 or later");
1761	return BS3TESTDOMODE_SKIPPED;
1762	}
1763
1764	bs3CpuBasic2_SetGlobals(bMode);
1765
1766	/* Get us a 64-byte aligned buffer. */
1767	pbBufAlloc = pbBuf = Bs3MemAllocZ(BS3_MODE_IS_RM_OR_V86(bMode) ? BS3MEMKIND_REAL : BS3MEMKIND_TILED, X86_PAGE_SIZE * 2);
1768	if (!pbBufAlloc)
1769	return Bs3TestFailed("Failed to allocate 2 pages of real-mode memory");
1770	if (BS3_FP_OFF(pbBuf) & (X86_PAGE_SIZE - 1))
1771	pbBuf = &pbBufAlloc[X86_PAGE_SIZE - (BS3_FP_OFF(pbBuf) & X86_PAGE_OFFSET_MASK)];
1772	BS3_ASSERT(pbBuf - pbBufAlloc <= X86_PAGE_SIZE);
1773	//Bs3TestPrintf("pbBuf=%p\n", pbBuf);
1774
1775	/* Find the g_aCmnModes entry. */
1776	idxCmnModes = 0;
1777	while (g_aCmnModes[idxCmnModes].bMode != (bMode & BS3_MODE_CODE_MASK))
1778	idxCmnModes++;
1779	//Bs3TestPrintf("idxCmnModes=%d bMode=%#x\n", idxCmnModes, bMode);
1780
1781	/* First round is w/o alignment checks enabled. */
1782	//Bs3TestPrintf("round 1\n");
1783	fCr0 = Bs3RegGetCr0();
1784	BS3_ASSERT(!(fCr0 & X86_CR0_AM));
1785	Bs3RegSetCr0(fCr0 & ~X86_CR0_AM);
1786	#if 1
1787	bs3CpuBasic2_RaiseXcpt11Worker(bMode, pbBuf, cbCacheLine, false /fAm/, false /fPf/, 0, &g_aCmnModes[idxCmnModes]);
1788	#endif
1789
1790	/* The second round is with aligment checks enabled. */
1791	#if 1
1792	//Bs3TestPrintf("round 2\n");
1793	Bs3RegSetCr0(Bs3RegGetCr0() \| X86_CR0_AM);
1794	bs3CpuBasic2_RaiseXcpt11Worker(bMode, pbBuf, cbCacheLine, true /fAm/, false /fPf/, 0, &g_aCmnModes[idxCmnModes]);
1795	#endif
1796
1797	#if 1
1798	/* The third and fourth round access the buffer via a page alias that's not
1799	accessible from ring-3. The third round has ACs disabled and the fourth
1800	has them enabled. */
1801	if (BS3_MODE_IS_PAGED(bMode) && !BS3_MODE_IS_V86(bMode))
1802	{
1803	/* Alias the buffer as system memory so ring-3 access with AC+AM will cause #PF: */
1804	/** @todo the aliasing is not necessary any more... */
1805	int rc;
1806	RTCCUINTXREG uFlatBufPtr = Bs3SelPtrToFlat(pbBuf);
1807	uint64_t const uAliasPgPtr = bMode & BS3_MODE_CODE_64 ? UINT64_C(0x0000648680000000) : UINT32_C(0x80000000);
1808	rc = Bs3PagingAlias(uAliasPgPtr, uFlatBufPtr & ~(uint64_t)X86_PAGE_OFFSET_MASK, X86_PAGE_SIZE * 2,
1809	X86_PTE_P \| X86_PTE_RW);
1810	if (RT_SUCCESS(rc))
1811	{
1812	/* We 'misalign' the segment base here to make sure it's the final
1813	address that gets alignment checked and not just the operand value. */
1814	RTCCUINTXREG uAliasBufPtr = (RTCCUINTXREG)uAliasPgPtr + (uFlatBufPtr & X86_PAGE_OFFSET_MASK);
1815	uint8_t BS3_FAR *pbBufAlias = BS3_FP_MAKE(BS3_SEL_SPARE_00 \| 3, (uFlatBufPtr & X86_PAGE_OFFSET_MASK) + 1);
1816	Bs3SelSetup16BitData(&Bs3GdteSpare00, uAliasPgPtr - 1);
1817
1818	//Bs3TestPrintf("round 3 pbBufAlias=%p\n", pbBufAlias);
1819	Bs3RegSetCr0(Bs3RegGetCr0() & ~X86_CR0_AM);
1820	bs3CpuBasic2_RaiseXcpt11Worker(bMode, pbBufAlias, cbCacheLine, false /fAm/,
1821	true /fPf/, uAliasBufPtr, &g_aCmnModes[idxCmnModes]);
1822
1823	//Bs3TestPrintf("round 4\n");
1824	Bs3RegSetCr0(Bs3RegGetCr0() \| X86_CR0_AM);
1825	bs3CpuBasic2_RaiseXcpt11Worker(bMode, pbBufAlias, cbCacheLine, true /fAm/,
1826	true /fPf/, uAliasBufPtr, &g_aCmnModes[idxCmnModes]);
1827
1828	Bs3PagingUnalias(uAliasPgPtr, X86_PAGE_SIZE * 2);
1829	}
1830	else
1831	Bs3TestFailedF("Bs3PagingAlias failed with %Rrc", rc);
1832	}
1833	#endif
1834
1835	Bs3MemFree(pbBufAlloc, X86_PAGE_SIZE * 2);
1836	Bs3RegSetCr0(fCr0);
1837	return 0;
1838	}
1839
1840
1841	/**
1842	* Executes one round of SIDT and SGDT tests using one assembly worker.
1843	*
1844	* This is written with driving everything from the 16-bit or 32-bit worker in
1845	* mind, i.e. not assuming the test bitcount is the same as the current.
1846	*/
1847	static void bs3CpuBasic2_sidt_sgdt_One(BS3CB2SIDTSGDT const BS3_FAR *pWorker, uint8_t bTestMode, uint8_t bRing,
1848	uint8_t const *pbExpected)
1849	{
1850	BS3TRAPFRAME TrapCtx;
1851	BS3REGCTX Ctx;
1852	BS3REGCTX CtxUdExpected;
1853	BS3REGCTX TmpCtx;
1854	uint8_t const cbBuf = 82; / test buffer area */
1855	uint8_t abBuf[82 + 8 + 8]; / test buffer w/ misalignment test space and some extra guard. */
1856	uint8_t BS3_FAR *pbBuf = abBuf;
1857	uint8_t const cbIdtr = BS3_MODE_IS_64BIT_CODE(bTestMode) ? 2+8 : 2+4;
1858	bool const f286 = (g_uBs3CpuDetected & BS3CPU_TYPE_MASK) == BS3CPU_80286;
1859	uint8_t bFiller;
1860	int off;
1861	int off2;
1862	unsigned cb;
1863	uint8_t BS3_FAR *pbTest;
1864
1865	/* make sure they're allocated */
1866	Bs3MemZero(&Ctx, sizeof(Ctx));
1867	Bs3MemZero(&CtxUdExpected, sizeof(CtxUdExpected));
1868	Bs3MemZero(&TmpCtx, sizeof(TmpCtx));
1869	Bs3MemZero(&TrapCtx, sizeof(TrapCtx));
1870	Bs3MemZero(&abBuf, sizeof(abBuf));
1871
1872	/* Create a context, give this routine some more stack space, point the context
1873	at our SIDT [xBX] + UD2 combo, and point DS:xBX at abBuf. */
1874	Bs3RegCtxSaveEx(&Ctx, bTestMode, 256 /cbExtraStack/);
1875	Bs3RegCtxSetGrpSegFromCurPtr(&Ctx, &Ctx.rbx, pWorker->fSs ? &Ctx.ss : &Ctx.ds, abBuf);
1876	Bs3RegCtxSetRipCsFromLnkPtr(&Ctx, pWorker->fpfnWorker);
1877	if (BS3_MODE_IS_16BIT_SYS(bTestMode))
1878	g_uBs3TrapEipHint = Ctx.rip.u32;
1879	if (!BS3_MODE_IS_RM_OR_V86(bTestMode))
1880	Bs3RegCtxConvertToRingX(&Ctx, bRing);
1881
1882	/* For successful SIDT attempts, we'll stop at the UD2. */
1883	Bs3MemCpy(&CtxUdExpected, &Ctx, sizeof(Ctx));
1884	CtxUdExpected.rip.u += pWorker->cbInstr;
1885
1886	/*
1887	* Check that it works at all and that only bytes we expect gets written to.
1888	*/
1889	/* First with zero buffer. */
1890	Bs3MemZero(abBuf, sizeof(abBuf));
1891	if (!ASMMemIsAllU8(abBuf, sizeof(abBuf), 0))
1892	Bs3TestFailedF("ASMMemIsAllU8 or Bs3MemZero is busted: abBuf=%.*Rhxs\n", sizeof(abBuf), pbBuf);
1893	if (!ASMMemIsZero(abBuf, sizeof(abBuf)))
1894	Bs3TestFailedF("ASMMemIsZero or Bs3MemZero is busted: abBuf=%.*Rhxs\n", sizeof(abBuf), pbBuf);
1895	Bs3TrapSetJmpAndRestore(&Ctx, &TrapCtx);
1896	bs3CpuBasic2_CompareUdCtx(&TrapCtx, &CtxUdExpected);
1897	if (f286 && abBuf[cbIdtr - 1] != 0xff)
1898	Bs3TestFailedF("286: Top base byte isn't 0xff (#1): %#x\n", abBuf[cbIdtr - 1]);
1899	if (!ASMMemIsZero(&abBuf[cbIdtr], cbBuf - cbIdtr))
1900	Bs3TestFailedF("Unexpected buffer bytes set (#1): cbIdtr=%u abBuf=%.*Rhxs\n", cbIdtr, cbBuf, pbBuf);
1901	if (Bs3MemCmp(abBuf, pbExpected, cbIdtr) != 0)
1902	Bs3TestFailedF("Mismatch (%s,#1): expected %.Rhxs, got %.Rhxs\n", pWorker->pszDesc, cbIdtr, pbExpected, cbIdtr, abBuf);
1903	g_usBs3TestStep++;
1904
1905	/* Again with a buffer filled with a byte not occuring in the previous result. */
1906	bFiller = 0x55;
1907	while (Bs3MemChr(abBuf, bFiller, cbBuf) != NULL)
1908	bFiller++;
1909	Bs3MemSet(abBuf, bFiller, sizeof(abBuf));
1910	if (!ASMMemIsAllU8(abBuf, sizeof(abBuf), bFiller))
1911	Bs3TestFailedF("ASMMemIsAllU8 or Bs3MemSet is busted: bFiller=%#x abBuf=%.*Rhxs\n", bFiller, sizeof(abBuf), pbBuf);
1912
1913	Bs3TrapSetJmpAndRestore(&Ctx, &TrapCtx);
1914	bs3CpuBasic2_CompareUdCtx(&TrapCtx, &CtxUdExpected);
1915	if (f286 && abBuf[cbIdtr - 1] != 0xff)
1916	Bs3TestFailedF("286: Top base byte isn't 0xff (#2): %#x\n", abBuf[cbIdtr - 1]);
1917	if (!ASMMemIsAllU8(&abBuf[cbIdtr], cbBuf - cbIdtr, bFiller))
1918	Bs3TestFailedF("Unexpected buffer bytes set (#2): cbIdtr=%u bFiller=%#x abBuf=%.*Rhxs\n", cbIdtr, bFiller, cbBuf, pbBuf);
1919	if (Bs3MemChr(abBuf, bFiller, cbIdtr) != NULL)
1920	Bs3TestFailedF("Not all bytes touched: cbIdtr=%u bFiller=%#x abBuf=%.*Rhxs\n", cbIdtr, bFiller, cbBuf, pbBuf);
1921	if (Bs3MemCmp(abBuf, pbExpected, cbIdtr) != 0)
1922	Bs3TestFailedF("Mismatch (%s,#2): expected %.Rhxs, got %.Rhxs\n", pWorker->pszDesc, cbIdtr, pbExpected, cbIdtr, abBuf);
1923	g_usBs3TestStep++;
1924
1925	/*
1926	* Slide the buffer along 8 bytes to cover misalignment.
1927	*/
1928	for (off = 0; off < 8; off++)
1929	{
1930	pbBuf = &abBuf[off];
1931	Bs3RegCtxSetGrpSegFromCurPtr(&Ctx, &Ctx.rbx, pWorker->fSs ? &Ctx.ss : &Ctx.ds, &abBuf[off]);
1932	CtxUdExpected.rbx.u = Ctx.rbx.u;
1933
1934	/* First with zero buffer. */
1935	Bs3MemZero(abBuf, sizeof(abBuf));
1936	Bs3TrapSetJmpAndRestore(&Ctx, &TrapCtx);
1937	bs3CpuBasic2_CompareUdCtx(&TrapCtx, &CtxUdExpected);
1938	if (off > 0 && !ASMMemIsZero(abBuf, off))
1939	Bs3TestFailedF("Unexpected buffer bytes set before (#3): cbIdtr=%u off=%u abBuf=%.*Rhxs\n",
1940	cbIdtr, off, off + cbBuf, abBuf);
1941	if (!ASMMemIsZero(&abBuf[off + cbIdtr], sizeof(abBuf) - cbIdtr - off))
1942	Bs3TestFailedF("Unexpected buffer bytes set after (#3): cbIdtr=%u off=%u abBuf=%.*Rhxs\n",
1943	cbIdtr, off, off + cbBuf, abBuf);
1944	if (f286 && abBuf[off + cbIdtr - 1] != 0xff)
1945	Bs3TestFailedF("286: Top base byte isn't 0xff (#3): %#x\n", abBuf[off + cbIdtr - 1]);
1946	if (Bs3MemCmp(&abBuf[off], pbExpected, cbIdtr) != 0)
1947	Bs3TestFailedF("Mismatch (#3): expected %.Rhxs, got %.Rhxs\n", cbIdtr, pbExpected, cbIdtr, &abBuf[off]);
1948	g_usBs3TestStep++;
1949
1950	/* Again with a buffer filled with a byte not occuring in the previous result. */
1951	Bs3MemSet(abBuf, bFiller, sizeof(abBuf));
1952	Bs3TrapSetJmpAndRestore(&Ctx, &TrapCtx);
1953	bs3CpuBasic2_CompareUdCtx(&TrapCtx, &CtxUdExpected);
1954	if (off > 0 && !ASMMemIsAllU8(abBuf, off, bFiller))
1955	Bs3TestFailedF("Unexpected buffer bytes set before (#4): cbIdtr=%u off=%u bFiller=%#x abBuf=%.*Rhxs\n",
1956	cbIdtr, off, bFiller, off + cbBuf, abBuf);
1957	if (!ASMMemIsAllU8(&abBuf[off + cbIdtr], sizeof(abBuf) - cbIdtr - off, bFiller))
1958	Bs3TestFailedF("Unexpected buffer bytes set after (#4): cbIdtr=%u off=%u bFiller=%#x abBuf=%.*Rhxs\n",
1959	cbIdtr, off, bFiller, off + cbBuf, abBuf);
1960	if (Bs3MemChr(&abBuf[off], bFiller, cbIdtr) != NULL)
1961	Bs3TestFailedF("Not all bytes touched (#4): cbIdtr=%u off=%u bFiller=%#x abBuf=%.*Rhxs\n",
1962	cbIdtr, off, bFiller, off + cbBuf, abBuf);
1963	if (f286 && abBuf[off + cbIdtr - 1] != 0xff)
1964	Bs3TestFailedF("286: Top base byte isn't 0xff (#4): %#x\n", abBuf[off + cbIdtr - 1]);
1965	if (Bs3MemCmp(&abBuf[off], pbExpected, cbIdtr) != 0)
1966	Bs3TestFailedF("Mismatch (#4): expected %.Rhxs, got %.Rhxs\n", cbIdtr, pbExpected, cbIdtr, &abBuf[off]);
1967	g_usBs3TestStep++;
1968	}
1969	pbBuf = abBuf;
1970	Bs3RegCtxSetGrpSegFromCurPtr(&Ctx, &Ctx.rbx, pWorker->fSs ? &Ctx.ss : &Ctx.ds, abBuf);
1971	CtxUdExpected.rbx.u = Ctx.rbx.u;
1972
1973	/*
1974	* Play with the selector limit if the target mode supports limit checking
1975	* We use BS3_SEL_TEST_PAGE_00 for this
1976	*/
1977	if ( !BS3_MODE_IS_RM_OR_V86(bTestMode)
1978	&& !BS3_MODE_IS_64BIT_CODE(bTestMode))
1979	{
1980	uint16_t cbLimit;
1981	uint32_t uFlatBuf = Bs3SelPtrToFlat(abBuf);
1982	Bs3GdteTestPage00 = Bs3Gdte_DATA16;
1983	Bs3GdteTestPage00.Gen.u2Dpl = bRing;
1984	Bs3GdteTestPage00.Gen.u16BaseLow = (uint16_t)uFlatBuf;
1985	Bs3GdteTestPage00.Gen.u8BaseHigh1 = (uint8_t)(uFlatBuf >> 16);
1986	Bs3GdteTestPage00.Gen.u8BaseHigh2 = (uint8_t)(uFlatBuf >> 24);
1987
1988	if (pWorker->fSs)
1989	CtxUdExpected.ss = Ctx.ss = BS3_SEL_TEST_PAGE_00 \| bRing;
1990	else
1991	CtxUdExpected.ds = Ctx.ds = BS3_SEL_TEST_PAGE_00 \| bRing;
1992
1993	/* Expand up (normal). */
1994	for (off = 0; off < 8; off++)
1995	{
1996	CtxUdExpected.rbx.u = Ctx.rbx.u = off;
1997	for (cbLimit = 0; cbLimit < cbIdtr*2; cbLimit++)
1998	{
1999	Bs3GdteTestPage00.Gen.u16LimitLow = cbLimit;
2000	Bs3MemSet(abBuf, bFiller, sizeof(abBuf));
2001	Bs3TrapSetJmpAndRestore(&Ctx, &TrapCtx);
2002	if (off + cbIdtr <= cbLimit + 1)
2003	{
2004	bs3CpuBasic2_CompareUdCtx(&TrapCtx, &CtxUdExpected);
2005	if (Bs3MemChr(&abBuf[off], bFiller, cbIdtr) != NULL)
2006	Bs3TestFailedF("Not all bytes touched (#5): cbIdtr=%u off=%u cbLimit=%u bFiller=%#x abBuf=%.*Rhxs\n",
2007	cbIdtr, off, cbLimit, bFiller, off + cbBuf, abBuf);
2008	if (Bs3MemCmp(&abBuf[off], pbExpected, cbIdtr) != 0)
2009	Bs3TestFailedF("Mismatch (#5): expected %.Rhxs, got %.Rhxs\n", cbIdtr, pbExpected, cbIdtr, &abBuf[off]);
2010	if (f286 && abBuf[off + cbIdtr - 1] != 0xff)
2011	Bs3TestFailedF("286: Top base byte isn't 0xff (#5): %#x\n", abBuf[off + cbIdtr - 1]);
2012	}
2013	else
2014	{
2015	if (pWorker->fSs)
2016	bs3CpuBasic2_CompareSsCtx(&TrapCtx, &Ctx, 0, false /f486ResumeFlagHint/);
2017	else
2018	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &Ctx, 0);
2019	if (off + 2 <= cbLimit + 1)
2020	{
2021	if (Bs3MemChr(&abBuf[off], bFiller, 2) != NULL)
2022	Bs3TestFailedF("Limit bytes not touched (#6): cbIdtr=%u off=%u cbLimit=%u bFiller=%#x abBuf=%.*Rhxs\n",
2023	cbIdtr, off, cbLimit, bFiller, off + cbBuf, abBuf);
2024	if (Bs3MemCmp(&abBuf[off], pbExpected, 2) != 0)
2025	Bs3TestFailedF("Mismatch (#6): expected %.2Rhxs, got %.2Rhxs\n", pbExpected, &abBuf[off]);
2026	if (!ASMMemIsAllU8(&abBuf[off + 2], cbIdtr - 2, bFiller))
2027	Bs3TestFailedF("Base bytes touched on #GP (#6): cbIdtr=%u off=%u cbLimit=%u bFiller=%#x abBuf=%.*Rhxs\n",
2028	cbIdtr, off, cbLimit, bFiller, off + cbBuf, abBuf);
2029	}
2030	else if (!ASMMemIsAllU8(abBuf, sizeof(abBuf), bFiller))
2031	Bs3TestFailedF("Bytes touched on #GP: cbIdtr=%u off=%u cbLimit=%u bFiller=%#x abBuf=%.*Rhxs\n",
2032	cbIdtr, off, cbLimit, bFiller, off + cbBuf, abBuf);
2033	}
2034
2035	if (off > 0 && !ASMMemIsAllU8(abBuf, off, bFiller))
2036	Bs3TestFailedF("Leading bytes touched (#7): cbIdtr=%u off=%u cbLimit=%u bFiller=%#x abBuf=%.*Rhxs\n",
2037	cbIdtr, off, cbLimit, bFiller, off + cbBuf, abBuf);
2038	if (!ASMMemIsAllU8(&abBuf[off + cbIdtr], sizeof(abBuf) - off - cbIdtr, bFiller))
2039	Bs3TestFailedF("Trailing bytes touched (#7): cbIdtr=%u off=%u cbLimit=%u bFiller=%#x abBuf=%.*Rhxs\n",
2040	cbIdtr, off, cbLimit, bFiller, off + cbBuf, abBuf);
2041
2042	g_usBs3TestStep++;
2043	}
2044	}
2045
2046	/* Expand down (weird). Inverted valid area compared to expand up,
2047	so a limit of zero give us a valid range for 0001..0ffffh (instead of
2048	a segment with one valid byte at 0000h). Whereas a limit of 0fffeh
2049	means one valid byte at 0ffffh, and a limit of 0ffffh means none
2050	(because in a normal expand up the 0ffffh means all 64KB are
2051	accessible). */
2052	Bs3GdteTestPage00.Gen.u4Type = X86_SEL_TYPE_RW_DOWN_ACC;
2053	for (off = 0; off < 8; off++)
2054	{
2055	CtxUdExpected.rbx.u = Ctx.rbx.u = off;
2056	for (cbLimit = 0; cbLimit < cbIdtr*2; cbLimit++)
2057	{
2058	Bs3GdteTestPage00.Gen.u16LimitLow = cbLimit;
2059	Bs3MemSet(abBuf, bFiller, sizeof(abBuf));
2060	Bs3TrapSetJmpAndRestore(&Ctx, &TrapCtx);
2061
2062	if (off > cbLimit)
2063	{
2064	bs3CpuBasic2_CompareUdCtx(&TrapCtx, &CtxUdExpected);
2065	if (Bs3MemChr(&abBuf[off], bFiller, cbIdtr) != NULL)
2066	Bs3TestFailedF("Not all bytes touched (#8): cbIdtr=%u off=%u cbLimit=%u bFiller=%#x abBuf=%.*Rhxs\n",
2067	cbIdtr, off, cbLimit, bFiller, off + cbBuf, abBuf);
2068	if (Bs3MemCmp(&abBuf[off], pbExpected, cbIdtr) != 0)
2069	Bs3TestFailedF("Mismatch (#8): expected %.Rhxs, got %.Rhxs\n", cbIdtr, pbExpected, cbIdtr, &abBuf[off]);
2070	if (f286 && abBuf[off + cbIdtr - 1] != 0xff)
2071	Bs3TestFailedF("286: Top base byte isn't 0xff (#8): %#x\n", abBuf[off + cbIdtr - 1]);
2072	}
2073	else
2074	{
2075	if (pWorker->fSs)
2076	bs3CpuBasic2_CompareSsCtx(&TrapCtx, &Ctx, 0, false /f486ResumeFlagHint/);
2077	else
2078	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &Ctx, 0);
2079	if (!ASMMemIsAllU8(abBuf, sizeof(abBuf), bFiller))
2080	Bs3TestFailedF("Bytes touched on #GP: cbIdtr=%u off=%u cbLimit=%u bFiller=%#x abBuf=%.*Rhxs\n",
2081	cbIdtr, off, cbLimit, bFiller, off + cbBuf, abBuf);
2082	}
2083
2084	if (off > 0 && !ASMMemIsAllU8(abBuf, off, bFiller))
2085	Bs3TestFailedF("Leading bytes touched (#9): cbIdtr=%u off=%u cbLimit=%u bFiller=%#x abBuf=%.*Rhxs\n",
2086	cbIdtr, off, cbLimit, bFiller, off + cbBuf, abBuf);
2087	if (!ASMMemIsAllU8(&abBuf[off + cbIdtr], sizeof(abBuf) - off - cbIdtr, bFiller))
2088	Bs3TestFailedF("Trailing bytes touched (#9): cbIdtr=%u off=%u cbLimit=%u bFiller=%#x abBuf=%.*Rhxs\n",
2089	cbIdtr, off, cbLimit, bFiller, off + cbBuf, abBuf);
2090
2091	g_usBs3TestStep++;
2092	}
2093	}
2094
2095	Bs3RegCtxSetGrpSegFromCurPtr(&Ctx, &Ctx.rbx, pWorker->fSs ? &Ctx.ss : &Ctx.ds, abBuf);
2096	CtxUdExpected.rbx.u = Ctx.rbx.u;
2097	CtxUdExpected.ss = Ctx.ss;
2098	CtxUdExpected.ds = Ctx.ds;
2099	}
2100
2101	/*
2102	* Play with the paging.
2103	*/
2104	if ( BS3_MODE_IS_PAGED(bTestMode)
2105	&& (!pWorker->fSs \|\| bRing == 3) /* SS.DPL == CPL, we'll get some tiled ring-3 selector here. */
2106	&& (pbTest = (uint8_t BS3_FAR *)Bs3MemGuardedTestPageAlloc(BS3MEMKIND_TILED)) != NULL)
2107	{
2108	RTCCUINTXREG uFlatTest = Bs3SelPtrToFlat(pbTest);
2109
2110	/*
2111	* Slide the buffer towards the trailing guard page. We'll observe the
2112	* first word being written entirely separately from the 2nd dword/qword.
2113	*/
2114	for (off = X86_PAGE_SIZE - cbIdtr - 4; off < X86_PAGE_SIZE + 4; off++)
2115	{
2116	Bs3MemSet(&pbTest[X86_PAGE_SIZE - cbIdtr * 2], bFiller, cbIdtr * 2);
2117	Bs3RegCtxSetGrpSegFromCurPtr(&Ctx, &Ctx.rbx, pWorker->fSs ? &Ctx.ss : &Ctx.ds, &pbTest[off]);
2118	Bs3TrapSetJmpAndRestore(&Ctx, &TrapCtx);
2119	if (off + cbIdtr <= X86_PAGE_SIZE)
2120	{
2121	CtxUdExpected.rbx = Ctx.rbx;
2122	CtxUdExpected.ss = Ctx.ss;
2123	CtxUdExpected.ds = Ctx.ds;
2124	bs3CpuBasic2_CompareUdCtx(&TrapCtx, &CtxUdExpected);
2125	if (Bs3MemCmp(&pbTest[off], pbExpected, cbIdtr) != 0)
2126	Bs3TestFailedF("Mismatch (#9): expected %.Rhxs, got %.Rhxs\n", cbIdtr, pbExpected, cbIdtr, &pbTest[off]);
2127	}
2128	else
2129	{
2130	bs3CpuBasic2_ComparePfCtx(&TrapCtx, &Ctx, X86_TRAP_PF_RW \| (Ctx.bCpl == 3 ? X86_TRAP_PF_US : 0),
2131	uFlatTest + RT_MAX(off, X86_PAGE_SIZE), 0 /cbIpAdjust/);
2132	if ( off <= X86_PAGE_SIZE - 2
2133	&& Bs3MemCmp(&pbTest[off], pbExpected, 2) != 0)
2134	Bs3TestFailedF("Mismatch (#10): Expected limit %.2Rhxs, got %.2Rhxs; off=%#x\n",
2135	pbExpected, &pbTest[off], off);
2136	if ( off < X86_PAGE_SIZE - 2
2137	&& !ASMMemIsAllU8(&pbTest[off + 2], X86_PAGE_SIZE - off - 2, bFiller))
2138	Bs3TestFailedF("Wrote partial base on #PF (#10): bFiller=%#x, got %.*Rhxs; off=%#x\n",
2139	bFiller, X86_PAGE_SIZE - off - 2, &pbTest[off + 2], off);
2140	if (off == X86_PAGE_SIZE - 1 && pbTest[off] != bFiller)
2141	Bs3TestFailedF("Wrote partial limit on #PF (#10): Expected %02x, got %02x\n", bFiller, pbTest[off]);
2142	}
2143	g_usBs3TestStep++;
2144	}
2145
2146	/*
2147	* Now, do it the other way around. It should look normal now since writing
2148	* the limit will #PF first and nothing should be written.
2149	*/
2150	for (off = cbIdtr + 4; off >= -cbIdtr - 4; off--)
2151	{
2152	Bs3MemSet(pbTest, bFiller, 48);
2153	Bs3RegCtxSetGrpSegFromCurPtr(&Ctx, &Ctx.rbx, pWorker->fSs ? &Ctx.ss : &Ctx.ds, &pbTest[off]);
2154	Bs3TrapSetJmpAndRestore(&Ctx, &TrapCtx);
2155	if (off >= 0)
2156	{
2157	CtxUdExpected.rbx = Ctx.rbx;
2158	CtxUdExpected.ss = Ctx.ss;
2159	CtxUdExpected.ds = Ctx.ds;
2160	bs3CpuBasic2_CompareUdCtx(&TrapCtx, &CtxUdExpected);
2161	if (Bs3MemCmp(&pbTest[off], pbExpected, cbIdtr) != 0)
2162	Bs3TestFailedF("Mismatch (#11): expected %.Rhxs, got %.Rhxs\n", cbIdtr, pbExpected, cbIdtr, &pbTest[off]);
2163	}
2164	else
2165	{
2166	bs3CpuBasic2_ComparePfCtx(&TrapCtx, &Ctx, X86_TRAP_PF_RW \| (Ctx.bCpl == 3 ? X86_TRAP_PF_US : 0),
2167	uFlatTest + off, 0 /cbIpAdjust/);
2168	if ( -off < cbIdtr
2169	&& !ASMMemIsAllU8(pbTest, cbIdtr + off, bFiller))
2170	Bs3TestFailedF("Wrote partial content on #PF (#12): bFiller=%#x, found %.*Rhxs; off=%d\n",
2171	bFiller, cbIdtr + off, pbTest, off);
2172	}
2173	if (!ASMMemIsAllU8(&pbTest[RT_MAX(cbIdtr + off, 0)], 16, bFiller))
2174	Bs3TestFailedF("Wrote beyond expected area (#13): bFiller=%#x, found %.16Rhxs; off=%d\n",
2175	bFiller, &pbTest[RT_MAX(cbIdtr + off, 0)], off);
2176	g_usBs3TestStep++;
2177	}
2178
2179	/*
2180	* Combine paging and segment limit and check ordering.
2181	* This is kind of interesting here since it the instruction seems to
2182	* be doing two separate writes.
2183	*/
2184	if ( !BS3_MODE_IS_RM_OR_V86(bTestMode)
2185	&& !BS3_MODE_IS_64BIT_CODE(bTestMode))
2186	{
2187	uint16_t cbLimit;
2188
2189	Bs3GdteTestPage00 = Bs3Gdte_DATA16;
2190	Bs3GdteTestPage00.Gen.u2Dpl = bRing;
2191	Bs3GdteTestPage00.Gen.u16BaseLow = (uint16_t)uFlatTest;
2192	Bs3GdteTestPage00.Gen.u8BaseHigh1 = (uint8_t)(uFlatTest >> 16);
2193	Bs3GdteTestPage00.Gen.u8BaseHigh2 = (uint8_t)(uFlatTest >> 24);
2194
2195	if (pWorker->fSs)
2196	CtxUdExpected.ss = Ctx.ss = BS3_SEL_TEST_PAGE_00 \| bRing;
2197	else
2198	CtxUdExpected.ds = Ctx.ds = BS3_SEL_TEST_PAGE_00 \| bRing;
2199
2200	/* Expand up (normal), approaching tail guard page. */
2201	for (off = X86_PAGE_SIZE - cbIdtr - 4; off < X86_PAGE_SIZE + 4; off++)
2202	{
2203	CtxUdExpected.rbx.u = Ctx.rbx.u = off;
2204	for (cbLimit = X86_PAGE_SIZE - cbIdtr2; cbLimit < X86_PAGE_SIZE + cbIdtr2; cbLimit++)
2205	{
2206	Bs3GdteTestPage00.Gen.u16LimitLow = cbLimit;
2207	Bs3MemSet(&pbTest[X86_PAGE_SIZE - cbIdtr * 2], bFiller, cbIdtr * 2);
2208	Bs3TrapSetJmpAndRestore(&Ctx, &TrapCtx);
2209	if (off + cbIdtr <= cbLimit + 1)
2210	{
2211	/* No #GP, but maybe #PF. */
2212	if (off + cbIdtr <= X86_PAGE_SIZE)
2213	{
2214	bs3CpuBasic2_CompareUdCtx(&TrapCtx, &CtxUdExpected);
2215	if (Bs3MemCmp(&pbTest[off], pbExpected, cbIdtr) != 0)
2216	Bs3TestFailedF("Mismatch (#14): expected %.Rhxs, got %.Rhxs\n",
2217	cbIdtr, pbExpected, cbIdtr, &pbTest[off]);
2218	}
2219	else
2220	{
2221	bs3CpuBasic2_ComparePfCtx(&TrapCtx, &Ctx, X86_TRAP_PF_RW \| (Ctx.bCpl == 3 ? X86_TRAP_PF_US : 0),
2222	uFlatTest + RT_MAX(off, X86_PAGE_SIZE), 0 /cbIpAdjust/);
2223	if ( off <= X86_PAGE_SIZE - 2
2224	&& Bs3MemCmp(&pbTest[off], pbExpected, 2) != 0)
2225	Bs3TestFailedF("Mismatch (#15): Expected limit %.2Rhxs, got %.2Rhxs; off=%#x\n",
2226	pbExpected, &pbTest[off], off);
2227	cb = X86_PAGE_SIZE - off - 2;
2228	if ( off < X86_PAGE_SIZE - 2
2229	&& !ASMMemIsAllU8(&pbTest[off + 2], cb, bFiller))
2230	Bs3TestFailedF("Wrote partial base on #PF (#15): bFiller=%#x, got %.*Rhxs; off=%#x\n",
2231	bFiller, cb, &pbTest[off + 2], off);
2232	if (off == X86_PAGE_SIZE - 1 && pbTest[off] != bFiller)
2233	Bs3TestFailedF("Wrote partial limit on #PF (#15): Expected %02x, got %02x\n", bFiller, pbTest[off]);
2234	}
2235	}
2236	else if (off + 2 <= cbLimit + 1)
2237	{
2238	/* [ig]tr.limit writing does not cause #GP, but may cause #PG, if not writing the base causes #GP. */
2239	if (off <= X86_PAGE_SIZE - 2)
2240	{
2241	if (pWorker->fSs)
2242	bs3CpuBasic2_CompareSsCtx(&TrapCtx, &Ctx, 0, false /f486ResumeFlagHint/);
2243	else
2244	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &Ctx, 0);
2245	if (Bs3MemCmp(&pbTest[off], pbExpected, 2) != 0)
2246	Bs3TestFailedF("Mismatch (#16): Expected limit %.2Rhxs, got %.2Rhxs; off=%#x\n",
2247	pbExpected, &pbTest[off], off);
2248	cb = X86_PAGE_SIZE - off - 2;
2249	if ( off < X86_PAGE_SIZE - 2
2250	&& !ASMMemIsAllU8(&pbTest[off + 2], cb, bFiller))
2251	Bs3TestFailedF("Wrote partial base with limit (#16): bFiller=%#x, got %.*Rhxs; off=%#x\n",
2252	bFiller, cb, &pbTest[off + 2], off);
2253	}
2254	else
2255	{
2256	bs3CpuBasic2_ComparePfCtx(&TrapCtx, &Ctx, X86_TRAP_PF_RW \| (Ctx.bCpl == 3 ? X86_TRAP_PF_US : 0),
2257	uFlatTest + RT_MAX(off, X86_PAGE_SIZE), 0 /cbIpAdjust/);
2258	if ( off < X86_PAGE_SIZE
2259	&& !ASMMemIsAllU8(&pbTest[off], X86_PAGE_SIZE - off, bFiller))
2260	Bs3TestFailedF("Mismatch (#16): Partial limit write on #PF: bFiller=%#x, got %.*Rhxs\n",
2261	bFiller, X86_PAGE_SIZE - off, &pbTest[off]);
2262	}
2263	}
2264	else
2265	{
2266	/* #GP/#SS on limit. */
2267	if (pWorker->fSs)
2268	bs3CpuBasic2_CompareSsCtx(&TrapCtx, &Ctx, 0, false /f486ResumeFlagHint/);
2269	else
2270	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &Ctx, 0);
2271	if ( off < X86_PAGE_SIZE
2272	&& !ASMMemIsAllU8(&pbTest[off], X86_PAGE_SIZE - off, bFiller))
2273	Bs3TestFailedF("Mismatch (#17): Partial write on #GP: bFiller=%#x, got %.*Rhxs\n",
2274	bFiller, X86_PAGE_SIZE - off, &pbTest[off]);
2275	}
2276
2277	cb = RT_MIN(cbIdtr * 2, off - (X86_PAGE_SIZE - cbIdtr*2));
2278	if (!ASMMemIsAllU8(&pbTest[X86_PAGE_SIZE - cbIdtr * 2], cb, bFiller))
2279	Bs3TestFailedF("Leading bytes touched (#18): cbIdtr=%u off=%u cbLimit=%u bFiller=%#x pbTest=%.*Rhxs\n",
2280	cbIdtr, off, cbLimit, bFiller, cb, pbTest[X86_PAGE_SIZE - cbIdtr * 2]);
2281
2282	g_usBs3TestStep++;
2283
2284	/* Set DS to 0 and check that we get #GP(0). */
2285	if (!pWorker->fSs)
2286	{
2287	Ctx.ds = 0;
2288	Bs3TrapSetJmpAndRestore(&Ctx, &TrapCtx);
2289	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &Ctx, 0);
2290	Ctx.ds = BS3_SEL_TEST_PAGE_00 \| bRing;
2291	g_usBs3TestStep++;
2292	}
2293	}
2294	}
2295
2296	/* Expand down. */
2297	pbTest -= X86_PAGE_SIZE; /* Note! we're backing up a page to simplify things */
2298	uFlatTest -= X86_PAGE_SIZE;
2299
2300	Bs3GdteTestPage00.Gen.u4Type = X86_SEL_TYPE_RW_DOWN_ACC;
2301	Bs3GdteTestPage00.Gen.u16BaseLow = (uint16_t)uFlatTest;
2302	Bs3GdteTestPage00.Gen.u8BaseHigh1 = (uint8_t)(uFlatTest >> 16);
2303	Bs3GdteTestPage00.Gen.u8BaseHigh2 = (uint8_t)(uFlatTest >> 24);
2304
2305	for (off = X86_PAGE_SIZE - cbIdtr - 4; off < X86_PAGE_SIZE + 4; off++)
2306	{
2307	CtxUdExpected.rbx.u = Ctx.rbx.u = off;
2308	for (cbLimit = X86_PAGE_SIZE - cbIdtr2; cbLimit < X86_PAGE_SIZE + cbIdtr2; cbLimit++)
2309	{
2310	Bs3GdteTestPage00.Gen.u16LimitLow = cbLimit;
2311	Bs3MemSet(&pbTest[X86_PAGE_SIZE], bFiller, cbIdtr * 2);
2312	Bs3TrapSetJmpAndRestore(&Ctx, &TrapCtx);
2313	if (cbLimit < off && off >= X86_PAGE_SIZE)
2314	{
2315	bs3CpuBasic2_CompareUdCtx(&TrapCtx, &CtxUdExpected);
2316	if (Bs3MemCmp(&pbTest[off], pbExpected, cbIdtr) != 0)
2317	Bs3TestFailedF("Mismatch (#19): expected %.Rhxs, got %.Rhxs\n",
2318	cbIdtr, pbExpected, cbIdtr, &pbTest[off]);
2319	cb = X86_PAGE_SIZE + cbIdtr*2 - off;
2320	if (!ASMMemIsAllU8(&pbTest[off + cbIdtr], cb, bFiller))
2321	Bs3TestFailedF("Trailing bytes touched (#20): cbIdtr=%u off=%u cbLimit=%u bFiller=%#x pbTest=%.*Rhxs\n",
2322	cbIdtr, off, cbLimit, bFiller, cb, pbTest[off + cbIdtr]);
2323	}
2324	else
2325	{
2326	if (cbLimit < off && off < X86_PAGE_SIZE)
2327	bs3CpuBasic2_ComparePfCtx(&TrapCtx, &Ctx, X86_TRAP_PF_RW \| (Ctx.bCpl == 3 ? X86_TRAP_PF_US : 0),
2328	uFlatTest + off, 0 /cbIpAdjust/);
2329	else if (pWorker->fSs)
2330	bs3CpuBasic2_CompareSsCtx(&TrapCtx, &Ctx, 0, false /f486ResumeFlagHint/);
2331	else
2332	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &Ctx, 0);
2333	cb = cbIdtr*2;
2334	if (!ASMMemIsAllU8(&pbTest[X86_PAGE_SIZE], cb, bFiller))
2335	Bs3TestFailedF("Trailing bytes touched (#20): cbIdtr=%u off=%u cbLimit=%u bFiller=%#x pbTest=%.*Rhxs\n",
2336	cbIdtr, off, cbLimit, bFiller, cb, pbTest[X86_PAGE_SIZE]);
2337	}
2338	g_usBs3TestStep++;
2339	}
2340	}
2341
2342	pbTest += X86_PAGE_SIZE;
2343	uFlatTest += X86_PAGE_SIZE;
2344	}
2345
2346	Bs3MemGuardedTestPageFree(pbTest);
2347	}
2348
2349	/*
2350	* Check non-canonical 64-bit space.
2351	*/
2352	if ( BS3_MODE_IS_64BIT_CODE(bTestMode)
2353	&& (pbTest = (uint8_t BS3_FAR *)Bs3PagingSetupCanonicalTraps()) != NULL)
2354	{
2355	/* Make our references relative to the gap. */
2356	pbTest += g_cbBs3PagingOneCanonicalTrap;
2357
2358	/* Hit it from below. */
2359	for (off = -cbIdtr - 8; off < cbIdtr + 8; off++)
2360	{
2361	Ctx.rbx.u = CtxUdExpected.rbx.u = UINT64_C(0x0000800000000000) + off;
2362	Bs3MemSet(&pbTest[-64], bFiller, 64*2);
2363	Bs3TrapSetJmpAndRestore(&Ctx, &TrapCtx);
2364	if (off + cbIdtr <= 0)
2365	{
2366	bs3CpuBasic2_CompareUdCtx(&TrapCtx, &CtxUdExpected);
2367	if (Bs3MemCmp(&pbTest[off], pbExpected, cbIdtr) != 0)
2368	Bs3TestFailedF("Mismatch (#21): expected %.Rhxs, got %.Rhxs\n", cbIdtr, pbExpected, cbIdtr, &pbTest[off]);
2369	}
2370	else
2371	{
2372	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &Ctx, 0);
2373	if (off <= -2 && Bs3MemCmp(&pbTest[off], pbExpected, 2) != 0)
2374	Bs3TestFailedF("Mismatch (#21): expected limit %.2Rhxs, got %.2Rhxs\n", pbExpected, &pbTest[off]);
2375	off2 = off <= -2 ? 2 : 0;
2376	cb = cbIdtr - off2;
2377	if (!ASMMemIsAllU8(&pbTest[off + off2], cb, bFiller))
2378	Bs3TestFailedF("Mismatch (#21): touched base %.Rhxs, got %.Rhxs\n",
2379	cb, &pbExpected[off], cb, &pbTest[off + off2]);
2380	}
2381	if (!ASMMemIsAllU8(&pbTest[off - 16], 16, bFiller))
2382	Bs3TestFailedF("Leading bytes touched (#21): bFiller=%#x, got %.16Rhxs\n", bFiller, &pbTest[off]);
2383	if (!ASMMemIsAllU8(&pbTest[off + cbIdtr], 16, bFiller))
2384	Bs3TestFailedF("Trailing bytes touched (#21): bFiller=%#x, got %.16Rhxs\n", bFiller, &pbTest[off + cbIdtr]);
2385	}
2386
2387	/* Hit it from above. */
2388	for (off = -cbIdtr - 8; off < cbIdtr + 8; off++)
2389	{
2390	Ctx.rbx.u = CtxUdExpected.rbx.u = UINT64_C(0xffff800000000000) + off;
2391	Bs3MemSet(&pbTest[-64], bFiller, 64*2);
2392	Bs3TrapSetJmpAndRestore(&Ctx, &TrapCtx);
2393	if (off >= 0)
2394	{
2395	bs3CpuBasic2_CompareUdCtx(&TrapCtx, &CtxUdExpected);
2396	if (Bs3MemCmp(&pbTest[off], pbExpected, cbIdtr) != 0)
2397	Bs3TestFailedF("Mismatch (#22): expected %.Rhxs, got %.Rhxs\n", cbIdtr, pbExpected, cbIdtr, &pbTest[off]);
2398	}
2399	else
2400	{
2401	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &Ctx, 0);
2402	if (!ASMMemIsAllU8(&pbTest[off], cbIdtr, bFiller))
2403	Bs3TestFailedF("Mismatch (#22): touched base %.Rhxs, got %.Rhxs\n",
2404	cbIdtr, &pbExpected[off], cbIdtr, &pbTest[off]);
2405	}
2406	if (!ASMMemIsAllU8(&pbTest[off - 16], 16, bFiller))
2407	Bs3TestFailedF("Leading bytes touched (#22): bFiller=%#x, got %.16Rhxs\n", bFiller, &pbTest[off]);
2408	if (!ASMMemIsAllU8(&pbTest[off + cbIdtr], 16, bFiller))
2409	Bs3TestFailedF("Trailing bytes touched (#22): bFiller=%#x, got %.16Rhxs\n", bFiller, &pbTest[off + cbIdtr]);
2410	}
2411
2412	}
2413	}
2414
2415
2416	static void bs3CpuBasic2_sidt_sgdt_Common(uint8_t bTestMode, BS3CB2SIDTSGDT const BS3_FAR *paWorkers, unsigned cWorkers,
2417	uint8_t const *pbExpected)
2418	{
2419	unsigned idx;
2420	unsigned bRing;
2421	unsigned iStep = 0;
2422
2423	/* Note! We skip the SS checks for ring-0 since we badly mess up SS in the
2424	test and don't want to bother with double faults. */
2425	for (bRing = 0; bRing <= 3; bRing++)
2426	{
2427	for (idx = 0; idx < cWorkers; idx++)
2428	if ( (paWorkers[idx].bMode & (bTestMode & BS3_MODE_CODE_MASK))
2429	&& (!paWorkers[idx].fSs \|\| bRing != 0 /** @todo \|\| BS3_MODE_IS_64BIT_SYS(bTestMode)*/ ))
2430	{
2431	g_usBs3TestStep = iStep;
2432	bs3CpuBasic2_sidt_sgdt_One(&paWorkers[idx], bTestMode, bRing, pbExpected);
2433	iStep += 1000;
2434	}
2435	if (BS3_MODE_IS_RM_OR_V86(bTestMode))
2436	break;
2437	}
2438	}
2439
2440
2441	BS3_DECL_FAR(uint8_t) BS3_CMN_FAR_NM(bs3CpuBasic2_sidt)(uint8_t bMode)
2442	{
2443	union
2444	{
2445	RTIDTR Idtr;
2446	uint8_t ab[16];
2447	} Expected;
2448
2449	//if (bMode != BS3_MODE_LM64) return BS3TESTDOMODE_SKIPPED;
2450	bs3CpuBasic2_SetGlobals(bMode);
2451
2452	/*
2453	* Pass to common worker which is only compiled once per mode.
2454	*/
2455	Bs3MemZero(&Expected, sizeof(Expected));
2456	ASMGetIDTR(&Expected.Idtr);
2457	bs3CpuBasic2_sidt_sgdt_Common(bMode, g_aSidtWorkers, RT_ELEMENTS(g_aSidtWorkers), Expected.ab);
2458
2459	/*
2460	* Re-initialize the IDT.
2461	*/
2462	Bs3TrapReInit();
2463	return 0;
2464	}
2465
2466
2467	BS3_DECL_FAR(uint8_t) BS3_CMN_FAR_NM(bs3CpuBasic2_sgdt)(uint8_t bMode)
2468	{
2469	uint64_t const uOrgAddr = Bs3Lgdt_Gdt.uAddr;
2470	uint64_t uNew = 0;
2471	union
2472	{
2473	RTGDTR Gdtr;
2474	uint8_t ab[16];
2475	} Expected;
2476
2477	//if (bMode != BS3_MODE_LM64) return BS3TESTDOMODE_SKIPPED;
2478	bs3CpuBasic2_SetGlobals(bMode);
2479
2480	/*
2481	* If paged mode, try push the GDT way up.
2482	*/
2483	Bs3MemZero(&Expected, sizeof(Expected));
2484	ASMGetGDTR(&Expected.Gdtr);
2485	if (BS3_MODE_IS_PAGED(bMode))
2486	{
2487	/** @todo loading non-canonical base addresses. */
2488	int rc;
2489	uNew = BS3_MODE_IS_64BIT_SYS(bMode) ? UINT64_C(0xffff80fedcb70000) : UINT64_C(0xc2d28000);
2490	uNew \|= uOrgAddr & X86_PAGE_OFFSET_MASK;
2491	rc = Bs3PagingAlias(uNew, uOrgAddr, Bs3Lgdt_Gdt.cb, X86_PTE_P \| X86_PTE_RW \| X86_PTE_US \| X86_PTE_D \| X86_PTE_A);
2492	if (RT_SUCCESS(rc))
2493	{
2494	Bs3Lgdt_Gdt.uAddr = uNew;
2495	Bs3UtilSetFullGdtr(Bs3Lgdt_Gdt.cb, uNew);
2496	ASMGetGDTR(&Expected.Gdtr);
2497	if (BS3_MODE_IS_64BIT_SYS(bMode) && ARCH_BITS != 64)
2498	(uint32_t )&Expected.ab[6] = (uint32_t)(uNew >> 32);
2499	}
2500	}
2501
2502	/*
2503	* Pass to common worker which is only compiled once per mode.
2504	*/
2505	bs3CpuBasic2_sidt_sgdt_Common(bMode, g_aSgdtWorkers, RT_ELEMENTS(g_aSgdtWorkers), Expected.ab);
2506
2507	/*
2508	* Unalias the GDT.
2509	*/
2510	if (uNew != 0)
2511	{
2512	Bs3Lgdt_Gdt.uAddr = uOrgAddr;
2513	Bs3UtilSetFullGdtr(Bs3Lgdt_Gdt.cb, uOrgAddr);
2514	Bs3PagingUnalias(uNew, Bs3Lgdt_Gdt.cb);
2515	}
2516
2517	/*
2518	* Re-initialize the IDT.
2519	*/
2520	Bs3TrapReInit();
2521	return 0;
2522	}
2523
2524
2525
2526	/*
2527	* LIDT & LGDT
2528	*/
2529
2530	/**
2531	* Executes one round of LIDT and LGDT tests using one assembly worker.
2532	*
2533	* This is written with driving everything from the 16-bit or 32-bit worker in
2534	* mind, i.e. not assuming the test bitcount is the same as the current.
2535	*/
2536	static void bs3CpuBasic2_lidt_lgdt_One(BS3CB2SIDTSGDT const BS3_FAR *pWorker, uint8_t bTestMode, uint8_t bRing,
2537	uint8_t const pbRestore, size_t cbRestore, uint8_t const pbExpected)
2538	{
2539	static const struct
2540	{
2541	bool fGP;
2542	uint16_t cbLimit;
2543	uint64_t u64Base;
2544	} s_aValues64[] =
2545	{
2546	{ false, 0x0000, UINT64_C(0x0000000000000000) },
2547	{ false, 0x0001, UINT64_C(0x0000000000000001) },
2548	{ false, 0x0002, UINT64_C(0x0000000000000010) },
2549	{ false, 0x0003, UINT64_C(0x0000000000000123) },
2550	{ false, 0x0004, UINT64_C(0x0000000000001234) },
2551	{ false, 0x0005, UINT64_C(0x0000000000012345) },
2552	{ false, 0x0006, UINT64_C(0x0000000000123456) },
2553	{ false, 0x0007, UINT64_C(0x0000000001234567) },
2554	{ false, 0x0008, UINT64_C(0x0000000012345678) },
2555	{ false, 0x0009, UINT64_C(0x0000000123456789) },
2556	{ false, 0x000a, UINT64_C(0x000000123456789a) },
2557	{ false, 0x000b, UINT64_C(0x00000123456789ab) },
2558	{ false, 0x000c, UINT64_C(0x0000123456789abc) },
2559	{ false, 0x001c, UINT64_C(0x00007ffffeefefef) },
2560	{ false, 0xffff, UINT64_C(0x00007fffffffffff) },
2561	{ true, 0xf3f1, UINT64_C(0x0000800000000000) },
2562	{ true, 0x0000, UINT64_C(0x0000800000000000) },
2563	{ true, 0x0000, UINT64_C(0x0000800000000333) },
2564	{ true, 0x00f0, UINT64_C(0x0001000000000000) },
2565	{ true, 0x0ff0, UINT64_C(0x0012000000000000) },
2566	{ true, 0x0eff, UINT64_C(0x0123000000000000) },
2567	{ true, 0xe0fe, UINT64_C(0x1234000000000000) },
2568	{ true, 0x00ad, UINT64_C(0xffff300000000000) },
2569	{ true, 0x0000, UINT64_C(0xffff7fffffffffff) },
2570	{ true, 0x00f0, UINT64_C(0xffff7fffffffffff) },
2571	{ false, 0x5678, UINT64_C(0xffff800000000000) },
2572	{ false, 0x2969, UINT64_C(0xffffffffffeefefe) },
2573	{ false, 0x1221, UINT64_C(0xffffffffffffffff) },
2574	{ false, 0x1221, UINT64_C(0xffffffffffffffff) },
2575	};
2576	static const struct
2577	{
2578	uint16_t cbLimit;
2579	uint32_t u32Base;
2580	} s_aValues32[] =
2581	{
2582	{ 0xdfdf, UINT32_C(0xefefefef) },
2583	{ 0x0000, UINT32_C(0x00000000) },
2584	{ 0x0001, UINT32_C(0x00000001) },
2585	{ 0x0002, UINT32_C(0x00000012) },
2586	{ 0x0003, UINT32_C(0x00000123) },
2587	{ 0x0004, UINT32_C(0x00001234) },
2588	{ 0x0005, UINT32_C(0x00012345) },
2589	{ 0x0006, UINT32_C(0x00123456) },
2590	{ 0x0007, UINT32_C(0x01234567) },
2591	{ 0x0008, UINT32_C(0x12345678) },
2592	{ 0x0009, UINT32_C(0x80204060) },
2593	{ 0x000a, UINT32_C(0xddeeffaa) },
2594	{ 0x000b, UINT32_C(0xfdecdbca) },
2595	{ 0x000c, UINT32_C(0x6098456b) },
2596	{ 0x000d, UINT32_C(0x98506099) },
2597	{ 0x000e, UINT32_C(0x206950bc) },
2598	{ 0x000f, UINT32_C(0x9740395d) },
2599	{ 0x0334, UINT32_C(0x64a9455e) },
2600	{ 0xb423, UINT32_C(0xd20b6eff) },
2601	{ 0x4955, UINT32_C(0x85296d46) },
2602	{ 0xffff, UINT32_C(0x07000039) },
2603	{ 0xefe1, UINT32_C(0x0007fe00) },
2604	};
2605
2606	BS3TRAPFRAME TrapCtx;
2607	BS3REGCTX Ctx;
2608	BS3REGCTX CtxUdExpected;
2609	BS3REGCTX TmpCtx;
2610	uint8_t abBufLoad[40]; /* Test buffer w/ misalignment test space and some (cbIdtr) extra guard. */
2611	uint8_t abBufSave[32]; /* For saving the result after loading. */
2612	uint8_t abBufRestore[24]; /* For restoring sane value (same seg as abBufSave!). */
2613	uint8_t abExpectedFilled[32]; /* Same as pbExpected, except it's filled with bFiller2 instead of zeros. */
2614	uint8_t BS3_FAR pbBufSave; / Correctly aligned pointer into abBufSave. */
2615	uint8_t BS3_FAR pbBufRestore; / Correctly aligned pointer into abBufRestore. */
2616	uint8_t const cbIdtr = BS3_MODE_IS_64BIT_CODE(bTestMode) ? 2+8 : 2+4;
2617	uint8_t const cbBaseLoaded = BS3_MODE_IS_64BIT_CODE(bTestMode) ? 8
2618	: BS3_MODE_IS_16BIT_CODE(bTestMode) == !(pWorker->fFlags & BS3CB2SIDTSGDT_F_OPSIZE)
2619	? 3 : 4;
2620	bool const f286 = (g_uBs3CpuDetected & BS3CPU_TYPE_MASK) == BS3CPU_80286;
2621	uint8_t const bTop16BitBase = f286 ? 0xff : 0x00;
2622	uint8_t bFiller1; /* For filling abBufLoad. */
2623	uint8_t bFiller2; /* For filling abBufSave and expectations. */
2624	int off;
2625	uint8_t BS3_FAR *pbTest;
2626	unsigned i;
2627
2628	/* make sure they're allocated */
2629	Bs3MemZero(&Ctx, sizeof(Ctx));
2630	Bs3MemZero(&CtxUdExpected, sizeof(CtxUdExpected));
2631	Bs3MemZero(&TmpCtx, sizeof(TmpCtx));
2632	Bs3MemZero(&TrapCtx, sizeof(TrapCtx));
2633	Bs3MemZero(abBufSave, sizeof(abBufSave));
2634	Bs3MemZero(abBufLoad, sizeof(abBufLoad));
2635	Bs3MemZero(abBufRestore, sizeof(abBufRestore));
2636
2637	/*
2638	* Create a context, giving this routine some more stack space.
2639	* - Point the context at our LIDT [xBX] + SIDT [xDI] + LIDT [xSI] + UD2 combo.
2640	* - Point DS/SS:xBX at abBufLoad.
2641	* - Point ES:xDI at abBufSave.
2642	* - Point ES:xSI at abBufRestore.
2643	*/
2644	Bs3RegCtxSaveEx(&Ctx, bTestMode, 256 /cbExtraStack/);
2645	Bs3RegCtxSetRipCsFromLnkPtr(&Ctx, pWorker->fpfnWorker);
2646	if (BS3_MODE_IS_16BIT_SYS(bTestMode))
2647	g_uBs3TrapEipHint = Ctx.rip.u32;
2648	Ctx.rflags.u16 &= ~X86_EFL_IF;
2649	Bs3RegCtxSetGrpSegFromCurPtr(&Ctx, &Ctx.rbx, pWorker->fSs ? &Ctx.ss : &Ctx.ds, abBufLoad);
2650
2651	pbBufSave = abBufSave;
2652	if ((BS3_FP_OFF(pbBufSave) + 2) & 7)
2653	pbBufSave += 8 - ((BS3_FP_OFF(pbBufSave) + 2) & 7);
2654	Bs3RegCtxSetGrpSegFromCurPtr(&Ctx, &Ctx.rdi, &Ctx.es, pbBufSave);
2655
2656	pbBufRestore = abBufRestore;
2657	if ((BS3_FP_OFF(pbBufRestore) + 2) & 7)
2658	pbBufRestore += 8 - ((BS3_FP_OFF(pbBufRestore) + 2) & 7);
2659	Bs3RegCtxSetGrpSegFromCurPtr(&Ctx, &Ctx.rsi, &Ctx.es, pbBufRestore);
2660	Bs3MemCpy(pbBufRestore, pbRestore, cbRestore);
2661
2662	if (!BS3_MODE_IS_RM_OR_V86(bTestMode))
2663	Bs3RegCtxConvertToRingX(&Ctx, bRing);
2664
2665	/* For successful SIDT attempts, we'll stop at the UD2. */
2666	Bs3MemCpy(&CtxUdExpected, &Ctx, sizeof(Ctx));
2667	CtxUdExpected.rip.u += pWorker->cbInstr;
2668
2669	/*
2670	* Check that it works at all.
2671	*/
2672	Bs3MemZero(abBufLoad, sizeof(abBufLoad));
2673	Bs3MemCpy(abBufLoad, pbBufRestore, cbIdtr);
2674	Bs3MemZero(abBufSave, sizeof(abBufSave));
2675	Bs3TrapSetJmpAndRestore(&Ctx, &TrapCtx);
2676	if (bRing != 0)
2677	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &Ctx, 0);
2678	else
2679	{
2680	bs3CpuBasic2_CompareUdCtx(&TrapCtx, &CtxUdExpected);
2681	if (Bs3MemCmp(pbBufSave, pbExpected, cbIdtr * 2) != 0)
2682	Bs3TestFailedF("Mismatch (%s, #1): expected %.Rhxs, got %.Rhxs\n",
2683	pWorker->pszDesc, cbIdtr2, pbExpected, cbIdtr2, pbBufSave);
2684	}
2685	g_usBs3TestStep++;
2686
2687	/* Determine two filler bytes that doesn't appear in the previous result or our expectations. */
2688	bFiller1 = ~0x55;
2689	while ( Bs3MemChr(pbBufSave, bFiller1, cbIdtr) != NULL
2690	\|\| Bs3MemChr(pbRestore, bFiller1, cbRestore) != NULL
2691	\|\| bFiller1 == 0xff)
2692	bFiller1++;
2693	bFiller2 = 0x33;
2694	while ( Bs3MemChr(pbBufSave, bFiller2, cbIdtr) != NULL
2695	\|\| Bs3MemChr(pbRestore, bFiller2, cbRestore) != NULL
2696	\|\| bFiller2 == 0xff
2697	\|\| bFiller2 == bFiller1)
2698	bFiller2++;
2699	Bs3MemSet(abExpectedFilled, bFiller2, sizeof(abExpectedFilled));
2700	Bs3MemCpy(abExpectedFilled, pbExpected, cbIdtr);
2701
2702	/* Again with a buffer filled with a byte not occuring in the previous result. */
2703	Bs3MemSet(abBufLoad, bFiller1, sizeof(abBufLoad));
2704	Bs3MemCpy(abBufLoad, pbBufRestore, cbIdtr);
2705	Bs3MemSet(abBufSave, bFiller2, sizeof(abBufSave));
2706	Bs3TrapSetJmpAndRestore(&Ctx, &TrapCtx);
2707	if (bRing != 0)
2708	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &Ctx, 0);
2709	else
2710	{
2711	bs3CpuBasic2_CompareUdCtx(&TrapCtx, &CtxUdExpected);
2712	if (Bs3MemCmp(pbBufSave, abExpectedFilled, cbIdtr * 2) != 0)
2713	Bs3TestFailedF("Mismatch (%s, #2): expected %.Rhxs, got %.Rhxs\n",
2714	pWorker->pszDesc, cbIdtr2, abExpectedFilled, cbIdtr2, pbBufSave);
2715	}
2716	g_usBs3TestStep++;
2717
2718	/*
2719	* Try loading a bunch of different limit+base value to check what happens,
2720	* especially what happens wrt the top part of the base in 16-bit mode.
2721	*/
2722	if (BS3_MODE_IS_64BIT_CODE(bTestMode))
2723	{
2724	for (i = 0; i < RT_ELEMENTS(s_aValues64); i++)
2725	{
2726	Bs3MemSet(abBufLoad, bFiller1, sizeof(abBufLoad));
2727	Bs3MemCpy(&abBufLoad[0], &s_aValues64[i].cbLimit, 2);
2728	Bs3MemCpy(&abBufLoad[2], &s_aValues64[i].u64Base, 8);
2729	Bs3MemSet(abBufSave, bFiller2, sizeof(abBufSave));
2730	Bs3TrapSetJmpAndRestore(&Ctx, &TrapCtx);
2731	if (bRing != 0 \|\| s_aValues64[i].fGP)
2732	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &Ctx, 0);
2733	else
2734	{
2735	bs3CpuBasic2_CompareUdCtx(&TrapCtx, &CtxUdExpected);
2736	if ( Bs3MemCmp(&pbBufSave[0], &s_aValues64[i].cbLimit, 2) != 0
2737	\|\| Bs3MemCmp(&pbBufSave[2], &s_aValues64[i].u64Base, 8) != 0
2738	\|\| !ASMMemIsAllU8(&pbBufSave[10], cbIdtr, bFiller2))
2739	Bs3TestFailedF("Mismatch (%s, #2): expected %04RX16:%016RX64, fillers %#x %#x, got %.*Rhxs\n",
2740	pWorker->pszDesc, s_aValues64[i].cbLimit, s_aValues64[i].u64Base,
2741	bFiller1, bFiller2, cbIdtr*2, pbBufSave);
2742	}
2743	g_usBs3TestStep++;
2744	}
2745	}
2746	else
2747	{
2748	for (i = 0; i < RT_ELEMENTS(s_aValues32); i++)
2749	{
2750	Bs3MemSet(abBufLoad, bFiller1, sizeof(abBufLoad));
2751	Bs3MemCpy(&abBufLoad[0], &s_aValues32[i].cbLimit, 2);
2752	Bs3MemCpy(&abBufLoad[2], &s_aValues32[i].u32Base, cbBaseLoaded);
2753	Bs3MemSet(abBufSave, bFiller2, sizeof(abBufSave));
2754	Bs3TrapSetJmpAndRestore(&Ctx, &TrapCtx);
2755	if (bRing != 0)
2756	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &Ctx, 0);
2757	else
2758	{
2759	bs3CpuBasic2_CompareUdCtx(&TrapCtx, &CtxUdExpected);
2760	if ( Bs3MemCmp(&pbBufSave[0], &s_aValues32[i].cbLimit, 2) != 0
2761	\|\| Bs3MemCmp(&pbBufSave[2], &s_aValues32[i].u32Base, cbBaseLoaded) != 0
2762	\|\| ( cbBaseLoaded != 4
2763	&& pbBufSave[2+3] != bTop16BitBase)
2764	\|\| !ASMMemIsAllU8(&pbBufSave[8], cbIdtr, bFiller2))
2765	Bs3TestFailedF("Mismatch (%s,#3): loaded %04RX16:%08RX32, fillers %#x %#x%s, got %.*Rhxs\n",
2766	pWorker->pszDesc, s_aValues32[i].cbLimit, s_aValues32[i].u32Base, bFiller1, bFiller2,
2767	f286 ? ", 286" : "", cbIdtr*2, pbBufSave);
2768	}
2769	g_usBs3TestStep++;
2770	}
2771	}
2772
2773	/*
2774	* Slide the buffer along 8 bytes to cover misalignment.
2775	*/
2776	for (off = 0; off < 8; off++)
2777	{
2778	Bs3RegCtxSetGrpSegFromCurPtr(&Ctx, &Ctx.rbx, pWorker->fSs ? &Ctx.ss : &Ctx.ds, &abBufLoad[off]);
2779	CtxUdExpected.rbx.u = Ctx.rbx.u;
2780
2781	Bs3MemSet(abBufLoad, bFiller1, sizeof(abBufLoad));
2782	Bs3MemCpy(&abBufLoad[off], pbBufRestore, cbIdtr);
2783	Bs3MemSet(abBufSave, bFiller2, sizeof(abBufSave));
2784	Bs3TrapSetJmpAndRestore(&Ctx, &TrapCtx);
2785	if (bRing != 0)
2786	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &Ctx, 0);
2787	else
2788	{
2789	bs3CpuBasic2_CompareUdCtx(&TrapCtx, &CtxUdExpected);
2790	if (Bs3MemCmp(pbBufSave, abExpectedFilled, cbIdtr * 2) != 0)
2791	Bs3TestFailedF("Mismatch (%s, #4): expected %.Rhxs, got %.Rhxs\n",
2792	pWorker->pszDesc, cbIdtr2, abExpectedFilled, cbIdtr2, pbBufSave);
2793	}
2794	g_usBs3TestStep++;
2795	}
2796	Bs3RegCtxSetGrpSegFromCurPtr(&Ctx, &Ctx.rbx, pWorker->fSs ? &Ctx.ss : &Ctx.ds, abBufLoad);
2797	CtxUdExpected.rbx.u = Ctx.rbx.u;
2798
2799	/*
2800	* Play with the selector limit if the target mode supports limit checking
2801	* We use BS3_SEL_TEST_PAGE_00 for this
2802	*/
2803	if ( !BS3_MODE_IS_RM_OR_V86(bTestMode)
2804	&& !BS3_MODE_IS_64BIT_CODE(bTestMode))
2805	{
2806	uint16_t cbLimit;
2807	uint32_t uFlatBuf = Bs3SelPtrToFlat(abBufLoad);
2808	Bs3GdteTestPage00 = Bs3Gdte_DATA16;
2809	Bs3GdteTestPage00.Gen.u2Dpl = bRing;
2810	Bs3GdteTestPage00.Gen.u16BaseLow = (uint16_t)uFlatBuf;
2811	Bs3GdteTestPage00.Gen.u8BaseHigh1 = (uint8_t)(uFlatBuf >> 16);
2812	Bs3GdteTestPage00.Gen.u8BaseHigh2 = (uint8_t)(uFlatBuf >> 24);
2813
2814	if (pWorker->fSs)
2815	CtxUdExpected.ss = Ctx.ss = BS3_SEL_TEST_PAGE_00 \| bRing;
2816	else
2817	CtxUdExpected.ds = Ctx.ds = BS3_SEL_TEST_PAGE_00 \| bRing;
2818
2819	/* Expand up (normal). */
2820	for (off = 0; off < 8; off++)
2821	{
2822	CtxUdExpected.rbx.u = Ctx.rbx.u = off;
2823	for (cbLimit = 0; cbLimit < cbIdtr*2; cbLimit++)
2824	{
2825	Bs3GdteTestPage00.Gen.u16LimitLow = cbLimit;
2826
2827	Bs3MemSet(abBufLoad, bFiller1, sizeof(abBufLoad));
2828	Bs3MemCpy(&abBufLoad[off], pbBufRestore, cbIdtr);
2829	Bs3MemSet(abBufSave, bFiller2, sizeof(abBufSave));
2830	Bs3TrapSetJmpAndRestore(&Ctx, &TrapCtx);
2831	if (bRing != 0)
2832	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &Ctx, 0);
2833	else if (off + cbIdtr <= cbLimit + 1)
2834	{
2835	bs3CpuBasic2_CompareUdCtx(&TrapCtx, &CtxUdExpected);
2836	if (Bs3MemCmp(pbBufSave, abExpectedFilled, cbIdtr * 2) != 0)
2837	Bs3TestFailedF("Mismatch (%s, #5): expected %.Rhxs, got %.Rhxs\n",
2838	pWorker->pszDesc, cbIdtr2, abExpectedFilled, cbIdtr2, pbBufSave);
2839	}
2840	else if (pWorker->fSs)
2841	bs3CpuBasic2_CompareSsCtx(&TrapCtx, &Ctx, 0, false /f486ResumeFlagHint/);
2842	else
2843	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &Ctx, 0);
2844	g_usBs3TestStep++;
2845
2846	/* Again with zero limit and messed up base (should trigger tripple fault if partially loaded). */
2847	abBufLoad[off] = abBufLoad[off + 1] = 0;
2848	abBufLoad[off + 2] \|= 1;
2849	abBufLoad[off + cbIdtr - 2] ^= 0x5a;
2850	abBufLoad[off + cbIdtr - 1] ^= 0xa5;
2851	Bs3TrapSetJmpAndRestore(&Ctx, &TrapCtx);
2852	if (bRing != 0)
2853	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &Ctx, 0);
2854	else if (off + cbIdtr <= cbLimit + 1)
2855	bs3CpuBasic2_CompareUdCtx(&TrapCtx, &CtxUdExpected);
2856	else if (pWorker->fSs)
2857	bs3CpuBasic2_CompareSsCtx(&TrapCtx, &Ctx, 0, false /f486ResumeFlagHint/);
2858	else
2859	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &Ctx, 0);
2860	}
2861	}
2862
2863	/* Expand down (weird). Inverted valid area compared to expand up,
2864	so a limit of zero give us a valid range for 0001..0ffffh (instead of
2865	a segment with one valid byte at 0000h). Whereas a limit of 0fffeh
2866	means one valid byte at 0ffffh, and a limit of 0ffffh means none
2867	(because in a normal expand up the 0ffffh means all 64KB are
2868	accessible). */
2869	Bs3GdteTestPage00.Gen.u4Type = X86_SEL_TYPE_RW_DOWN_ACC;
2870	for (off = 0; off < 8; off++)
2871	{
2872	CtxUdExpected.rbx.u = Ctx.rbx.u = off;
2873	for (cbLimit = 0; cbLimit < cbIdtr*2; cbLimit++)
2874	{
2875	Bs3GdteTestPage00.Gen.u16LimitLow = cbLimit;
2876
2877	Bs3MemSet(abBufLoad, bFiller1, sizeof(abBufLoad));
2878	Bs3MemCpy(&abBufLoad[off], pbBufRestore, cbIdtr);
2879	Bs3MemSet(abBufSave, bFiller2, sizeof(abBufSave));
2880	Bs3TrapSetJmpAndRestore(&Ctx, &TrapCtx);
2881	if (bRing != 0)
2882	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &Ctx, 0);
2883	else if (off > cbLimit)
2884	{
2885	bs3CpuBasic2_CompareUdCtx(&TrapCtx, &CtxUdExpected);
2886	if (Bs3MemCmp(pbBufSave, abExpectedFilled, cbIdtr * 2) != 0)
2887	Bs3TestFailedF("Mismatch (%s, #6): expected %.Rhxs, got %.Rhxs\n",
2888	pWorker->pszDesc, cbIdtr2, abExpectedFilled, cbIdtr2, pbBufSave);
2889	}
2890	else if (pWorker->fSs)
2891	bs3CpuBasic2_CompareSsCtx(&TrapCtx, &Ctx, 0, false /f486ResumeFlagHint/);
2892	else
2893	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &Ctx, 0);
2894	g_usBs3TestStep++;
2895
2896	/* Again with zero limit and messed up base (should trigger triple fault if partially loaded). */
2897	abBufLoad[off] = abBufLoad[off + 1] = 0;
2898	abBufLoad[off + 2] \|= 3;
2899	abBufLoad[off + cbIdtr - 2] ^= 0x55;
2900	abBufLoad[off + cbIdtr - 1] ^= 0xaa;
2901	Bs3TrapSetJmpAndRestore(&Ctx, &TrapCtx);
2902	if (bRing != 0)
2903	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &Ctx, 0);
2904	else if (off > cbLimit)
2905	bs3CpuBasic2_CompareUdCtx(&TrapCtx, &CtxUdExpected);
2906	else if (pWorker->fSs)
2907	bs3CpuBasic2_CompareSsCtx(&TrapCtx, &Ctx, 0, false /f486ResumeFlagHint/);
2908	else
2909	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &Ctx, 0);
2910	}
2911	}
2912
2913	Bs3RegCtxSetGrpSegFromCurPtr(&Ctx, &Ctx.rbx, pWorker->fSs ? &Ctx.ss : &Ctx.ds, abBufLoad);
2914	CtxUdExpected.rbx.u = Ctx.rbx.u;
2915	CtxUdExpected.ss = Ctx.ss;
2916	CtxUdExpected.ds = Ctx.ds;
2917	}
2918
2919	/*
2920	* Play with the paging.
2921	*/
2922	if ( BS3_MODE_IS_PAGED(bTestMode)
2923	&& (!pWorker->fSs \|\| bRing == 3) /* SS.DPL == CPL, we'll get some tiled ring-3 selector here. */
2924	&& (pbTest = (uint8_t BS3_FAR *)Bs3MemGuardedTestPageAlloc(BS3MEMKIND_TILED)) != NULL)
2925	{
2926	RTCCUINTXREG uFlatTest = Bs3SelPtrToFlat(pbTest);
2927
2928	/*
2929	* Slide the load buffer towards the trailing guard page.
2930	*/
2931	Bs3RegCtxSetGrpSegFromCurPtr(&Ctx, &Ctx.rbx, pWorker->fSs ? &Ctx.ss : &Ctx.ds, &pbTest[X86_PAGE_SIZE]);
2932	CtxUdExpected.ss = Ctx.ss;
2933	CtxUdExpected.ds = Ctx.ds;
2934	for (off = X86_PAGE_SIZE - cbIdtr - 4; off < X86_PAGE_SIZE + 4; off++)
2935	{
2936	Bs3MemSet(&pbTest[X86_PAGE_SIZE - cbIdtr * 2], bFiller1, cbIdtr*2);
2937	if (off < X86_PAGE_SIZE)
2938	Bs3MemCpy(&pbTest[off], pbBufRestore, RT_MIN(X86_PAGE_SIZE - off, cbIdtr));
2939	Bs3RegCtxSetGrpSegFromCurPtr(&Ctx, &Ctx.rbx, pWorker->fSs ? &Ctx.ss : &Ctx.ds, &pbTest[off]);
2940	Bs3MemSet(abBufSave, bFiller2, sizeof(abBufSave));
2941	Bs3TrapSetJmpAndRestore(&Ctx, &TrapCtx);
2942	if (bRing != 0)
2943	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &Ctx, 0);
2944	else if (off + cbIdtr <= X86_PAGE_SIZE)
2945	{
2946	CtxUdExpected.rbx = Ctx.rbx;
2947	bs3CpuBasic2_CompareUdCtx(&TrapCtx, &CtxUdExpected);
2948	if (Bs3MemCmp(pbBufSave, abExpectedFilled, cbIdtr*2) != 0)
2949	Bs3TestFailedF("Mismatch (%s, #7): expected %.Rhxs, got %.Rhxs\n",
2950	pWorker->pszDesc, cbIdtr2, abExpectedFilled, cbIdtr2, pbBufSave);
2951	}
2952	else
2953	bs3CpuBasic2_ComparePfCtx(&TrapCtx, &Ctx, 0, uFlatTest + RT_MAX(off, X86_PAGE_SIZE), 0 /cbIpAdjust/);
2954	g_usBs3TestStep++;
2955
2956	/* Again with zero limit and maybe messed up base as well (triple fault if buggy).
2957	The 386DX-40 here triple faults (or something) with off == 0xffe, nothing else. */
2958	if ( off < X86_PAGE_SIZE && off + cbIdtr > X86_PAGE_SIZE
2959	&& ( off != X86_PAGE_SIZE - 2
2960	\|\| (g_uBs3CpuDetected & BS3CPU_TYPE_MASK) != BS3CPU_80386)
2961	)
2962	{
2963	pbTest[off] = 0;
2964	if (off + 1 < X86_PAGE_SIZE)
2965	pbTest[off + 1] = 0;
2966	if (off + 2 < X86_PAGE_SIZE)
2967	pbTest[off + 2] \|= 7;
2968	Bs3TrapSetJmpAndRestore(&Ctx, &TrapCtx);
2969	if (bRing != 0)
2970	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &Ctx, 0);
2971	else
2972	bs3CpuBasic2_ComparePfCtx(&TrapCtx, &Ctx, 0, uFlatTest + RT_MAX(off, X86_PAGE_SIZE), 0 /cbIpAdjust/);
2973	g_usBs3TestStep++;
2974	}
2975	}
2976
2977	/*
2978	* Now, do it the other way around. It should look normal now since writing
2979	* the limit will #PF first and nothing should be written.
2980	*/
2981	for (off = cbIdtr + 4; off >= -cbIdtr - 4; off--)
2982	{
2983	Bs3MemSet(pbTest, bFiller1, 48);
2984	if (off >= 0)
2985	Bs3MemCpy(&pbTest[off], pbBufRestore, cbIdtr);
2986	else if (off + cbIdtr > 0)
2987	Bs3MemCpy(pbTest, &pbBufRestore[-off], cbIdtr + off);
2988	Bs3RegCtxSetGrpSegFromCurPtr(&Ctx, &Ctx.rbx, pWorker->fSs ? &Ctx.ss : &Ctx.ds, &pbTest[off]);
2989	Bs3MemSet(abBufSave, bFiller2, sizeof(abBufSave));
2990	Bs3TrapSetJmpAndRestore(&Ctx, &TrapCtx);
2991	if (bRing != 0)
2992	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &Ctx, 0);
2993	else if (off >= 0)
2994	{
2995	CtxUdExpected.rbx = Ctx.rbx;
2996	bs3CpuBasic2_CompareUdCtx(&TrapCtx, &CtxUdExpected);
2997	if (Bs3MemCmp(pbBufSave, abExpectedFilled, cbIdtr*2) != 0)
2998	Bs3TestFailedF("Mismatch (%s, #8): expected %.Rhxs, got %.Rhxs\n",
2999	pWorker->pszDesc, cbIdtr2, abExpectedFilled, cbIdtr2, pbBufSave);
3000	}
3001	else
3002	bs3CpuBasic2_ComparePfCtx(&TrapCtx, &Ctx, 0, uFlatTest + off, 0 /cbIpAdjust/);
3003	g_usBs3TestStep++;
3004
3005	/* Again with messed up base as well (triple fault if buggy). */
3006	if (off < 0 && off > -cbIdtr)
3007	{
3008	if (off + 2 >= 0)
3009	pbTest[off + 2] \|= 15;
3010	pbTest[off + cbIdtr - 1] ^= 0xaa;
3011	Bs3TrapSetJmpAndRestore(&Ctx, &TrapCtx);
3012	if (bRing != 0)
3013	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &Ctx, 0);
3014	else
3015	bs3CpuBasic2_ComparePfCtx(&TrapCtx, &Ctx, 0, uFlatTest + off, 0 /cbIpAdjust/);
3016	g_usBs3TestStep++;
3017	}
3018	}
3019
3020	/*
3021	* Combine paging and segment limit and check ordering.
3022	* This is kind of interesting here since it the instruction seems to
3023	* actually be doing two separate read, just like it's S[IG]DT counterpart.
3024	*
3025	* Note! My 486DX4 does a DWORD limit read when the operand size is 32-bit,
3026	* that's what f486Weirdness deals with.
3027	*/
3028	if ( !BS3_MODE_IS_RM_OR_V86(bTestMode)
3029	&& !BS3_MODE_IS_64BIT_CODE(bTestMode))
3030	{
3031	bool const f486Weirdness = (g_uBs3CpuDetected & BS3CPU_TYPE_MASK) == BS3CPU_80486
3032	&& BS3_MODE_IS_32BIT_CODE(bTestMode) == !(pWorker->fFlags & BS3CB2SIDTSGDT_F_OPSIZE);
3033	uint16_t cbLimit;
3034
3035	Bs3GdteTestPage00 = Bs3Gdte_DATA16;
3036	Bs3GdteTestPage00.Gen.u2Dpl = bRing;
3037	Bs3GdteTestPage00.Gen.u16BaseLow = (uint16_t)uFlatTest;
3038	Bs3GdteTestPage00.Gen.u8BaseHigh1 = (uint8_t)(uFlatTest >> 16);
3039	Bs3GdteTestPage00.Gen.u8BaseHigh2 = (uint8_t)(uFlatTest >> 24);
3040
3041	if (pWorker->fSs)
3042	CtxUdExpected.ss = Ctx.ss = BS3_SEL_TEST_PAGE_00 \| bRing;
3043	else
3044	CtxUdExpected.ds = Ctx.ds = BS3_SEL_TEST_PAGE_00 \| bRing;
3045
3046	/* Expand up (normal), approaching tail guard page. */
3047	for (off = X86_PAGE_SIZE - cbIdtr - 4; off < X86_PAGE_SIZE + 4; off++)
3048	{
3049	CtxUdExpected.rbx.u = Ctx.rbx.u = off;
3050	for (cbLimit = X86_PAGE_SIZE - cbIdtr2; cbLimit < X86_PAGE_SIZE + cbIdtr2; cbLimit++)
3051	{
3052	Bs3GdteTestPage00.Gen.u16LimitLow = cbLimit;
3053	Bs3MemSet(&pbTest[X86_PAGE_SIZE - cbIdtr * 2], bFiller1, cbIdtr * 2);
3054	if (off < X86_PAGE_SIZE)
3055	Bs3MemCpy(&pbTest[off], pbBufRestore, RT_MIN(cbIdtr, X86_PAGE_SIZE - off));
3056	Bs3MemSet(abBufSave, bFiller2, sizeof(abBufSave));
3057	Bs3TrapSetJmpAndRestore(&Ctx, &TrapCtx);
3058	if (bRing != 0)
3059	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &Ctx, 0);
3060	else if (off + cbIdtr <= cbLimit + 1)
3061	{
3062	/* No #GP, but maybe #PF. */
3063	if (off + cbIdtr <= X86_PAGE_SIZE)
3064	{
3065	bs3CpuBasic2_CompareUdCtx(&TrapCtx, &CtxUdExpected);
3066	if (Bs3MemCmp(pbBufSave, abExpectedFilled, cbIdtr * 2) != 0)
3067	Bs3TestFailedF("Mismatch (%s, #9): expected %.Rhxs, got %.Rhxs\n",
3068	pWorker->pszDesc, cbIdtr2, abExpectedFilled, cbIdtr2, pbBufSave);
3069	}
3070	else
3071	bs3CpuBasic2_ComparePfCtx(&TrapCtx, &Ctx, 0, uFlatTest + RT_MAX(off, X86_PAGE_SIZE), 0 /cbIpAdjust/);
3072	}
3073	/* No #GP/#SS on limit, but instead #PF? */
3074	else if ( !f486Weirdness
3075	? off < cbLimit && off >= 0xfff
3076	: off + 2 < cbLimit && off >= 0xffd)
3077	bs3CpuBasic2_ComparePfCtx(&TrapCtx, &Ctx, 0, uFlatTest + RT_MAX(off, X86_PAGE_SIZE), 0 /cbIpAdjust/);
3078	/* #GP/#SS on limit or base. */
3079	else if (pWorker->fSs)
3080	bs3CpuBasic2_CompareSsCtx(&TrapCtx, &Ctx, 0, false /f486ResumeFlagHint/);
3081	else
3082	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &Ctx, 0);
3083
3084	g_usBs3TestStep++;
3085
3086	/* Set DS to 0 and check that we get #GP(0). */
3087	if (!pWorker->fSs)
3088	{
3089	Ctx.ds = 0;
3090	Bs3TrapSetJmpAndRestore(&Ctx, &TrapCtx);
3091	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &Ctx, 0);
3092	Ctx.ds = BS3_SEL_TEST_PAGE_00 \| bRing;
3093	g_usBs3TestStep++;
3094	}
3095	}
3096	}
3097
3098	/* Expand down. */
3099	pbTest -= X86_PAGE_SIZE; /* Note! we're backing up a page to simplify things */
3100	uFlatTest -= X86_PAGE_SIZE;
3101
3102	Bs3GdteTestPage00.Gen.u4Type = X86_SEL_TYPE_RW_DOWN_ACC;
3103	Bs3GdteTestPage00.Gen.u16BaseLow = (uint16_t)uFlatTest;
3104	Bs3GdteTestPage00.Gen.u8BaseHigh1 = (uint8_t)(uFlatTest >> 16);
3105	Bs3GdteTestPage00.Gen.u8BaseHigh2 = (uint8_t)(uFlatTest >> 24);
3106
3107	for (off = X86_PAGE_SIZE - cbIdtr - 4; off < X86_PAGE_SIZE + 4; off++)
3108	{
3109	CtxUdExpected.rbx.u = Ctx.rbx.u = off;
3110	for (cbLimit = X86_PAGE_SIZE - cbIdtr2; cbLimit < X86_PAGE_SIZE + cbIdtr2; cbLimit++)
3111	{
3112	Bs3GdteTestPage00.Gen.u16LimitLow = cbLimit;
3113	Bs3MemSet(&pbTest[X86_PAGE_SIZE], bFiller1, cbIdtr * 2);
3114	if (off >= X86_PAGE_SIZE)
3115	Bs3MemCpy(&pbTest[off], pbBufRestore, cbIdtr);
3116	else if (off > X86_PAGE_SIZE - cbIdtr)
3117	Bs3MemCpy(&pbTest[X86_PAGE_SIZE], &pbBufRestore[X86_PAGE_SIZE - off], cbIdtr - (X86_PAGE_SIZE - off));
3118	Bs3MemSet(abBufSave, bFiller2, sizeof(abBufSave));
3119	Bs3TrapSetJmpAndRestore(&Ctx, &TrapCtx);
3120	if (bRing != 0)
3121	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &Ctx, 0);
3122	else if (cbLimit < off && off >= X86_PAGE_SIZE)
3123	{
3124	bs3CpuBasic2_CompareUdCtx(&TrapCtx, &CtxUdExpected);
3125	if (Bs3MemCmp(pbBufSave, abExpectedFilled, cbIdtr * 2) != 0)
3126	Bs3TestFailedF("Mismatch (%s, #10): expected %.Rhxs, got %.Rhxs\n",
3127	pWorker->pszDesc, cbIdtr2, abExpectedFilled, cbIdtr2, pbBufSave);
3128	}
3129	else if (cbLimit < off && off < X86_PAGE_SIZE)
3130	bs3CpuBasic2_ComparePfCtx(&TrapCtx, &Ctx, 0, uFlatTest + off, 0 /cbIpAdjust/);
3131	else if (pWorker->fSs)
3132	bs3CpuBasic2_CompareSsCtx(&TrapCtx, &Ctx, 0, false /f486ResumeFlagHint/);
3133	else
3134	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &Ctx, 0);
3135	g_usBs3TestStep++;
3136	}
3137	}
3138
3139	pbTest += X86_PAGE_SIZE;
3140	uFlatTest += X86_PAGE_SIZE;
3141	}
3142
3143	Bs3MemGuardedTestPageFree(pbTest);
3144	}
3145
3146	/*
3147	* Check non-canonical 64-bit space.
3148	*/
3149	if ( BS3_MODE_IS_64BIT_CODE(bTestMode)
3150	&& (pbTest = (uint8_t BS3_FAR *)Bs3PagingSetupCanonicalTraps()) != NULL)
3151	{
3152	/* Make our references relative to the gap. */
3153	pbTest += g_cbBs3PagingOneCanonicalTrap;
3154
3155	/* Hit it from below. */
3156	for (off = -cbIdtr - 8; off < cbIdtr + 8; off++)
3157	{
3158	Ctx.rbx.u = CtxUdExpected.rbx.u = UINT64_C(0x0000800000000000) + off;
3159	Bs3MemSet(&pbTest[-64], bFiller1, 64*2);
3160	Bs3MemCpy(&pbTest[off], pbBufRestore, cbIdtr);
3161	Bs3MemSet(abBufSave, bFiller2, sizeof(abBufSave));
3162	Bs3TrapSetJmpAndRestore(&Ctx, &TrapCtx);
3163	if (off + cbIdtr > 0 \|\| bRing != 0)
3164	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &Ctx, 0);
3165	else
3166	{
3167	bs3CpuBasic2_CompareUdCtx(&TrapCtx, &CtxUdExpected);
3168	if (Bs3MemCmp(pbBufSave, abExpectedFilled, cbIdtr * 2) != 0)
3169	Bs3TestFailedF("Mismatch (%s, #11): expected %.Rhxs, got %.Rhxs\n",
3170	pWorker->pszDesc, cbIdtr2, abExpectedFilled, cbIdtr2, pbBufSave);
3171	}
3172	}
3173
3174	/* Hit it from above. */
3175	for (off = -cbIdtr - 8; off < cbIdtr + 8; off++)
3176	{
3177	Ctx.rbx.u = CtxUdExpected.rbx.u = UINT64_C(0xffff800000000000) + off;
3178	Bs3MemSet(&pbTest[-64], bFiller1, 64*2);
3179	Bs3MemCpy(&pbTest[off], pbBufRestore, cbIdtr);
3180	Bs3MemSet(abBufSave, bFiller2, sizeof(abBufSave));
3181	Bs3TrapSetJmpAndRestore(&Ctx, &TrapCtx);
3182	if (off < 0 \|\| bRing != 0)
3183	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &Ctx, 0);
3184	else
3185	{
3186	bs3CpuBasic2_CompareUdCtx(&TrapCtx, &CtxUdExpected);
3187	if (Bs3MemCmp(pbBufSave, abExpectedFilled, cbIdtr * 2) != 0)
3188	Bs3TestFailedF("Mismatch (%s, #19): expected %.Rhxs, got %.Rhxs\n",
3189	pWorker->pszDesc, cbIdtr2, abExpectedFilled, cbIdtr2, pbBufSave);
3190	}
3191	}
3192
3193	}
3194	}
3195
3196
3197	static void bs3CpuBasic2_lidt_lgdt_Common(uint8_t bTestMode, BS3CB2SIDTSGDT const BS3_FAR *paWorkers, unsigned cWorkers,
3198	void const pvRestore, size_t cbRestore, uint8_t const pbExpected)
3199	{
3200	unsigned idx;
3201	unsigned bRing;
3202	unsigned iStep = 0;
3203
3204	/* Note! We skip the SS checks for ring-0 since we badly mess up SS in the
3205	test and don't want to bother with double faults. */
3206	for (bRing = BS3_MODE_IS_V86(bTestMode) ? 3 : 0; bRing <= 3; bRing++)
3207	{
3208	for (idx = 0; idx < cWorkers; idx++)
3209	if ( (paWorkers[idx].bMode & (bTestMode & BS3_MODE_CODE_MASK))
3210	&& (!paWorkers[idx].fSs \|\| bRing != 0 /** @todo \|\| BS3_MODE_IS_64BIT_SYS(bTestMode)*/ )
3211	&& ( !(paWorkers[idx].fFlags & BS3CB2SIDTSGDT_F_386PLUS)
3212	\|\| ( bTestMode > BS3_MODE_PE16
3213	\|\| ( bTestMode == BS3_MODE_PE16
3214	&& (g_uBs3CpuDetected & BS3CPU_TYPE_MASK) >= BS3CPU_80386)) ) )
3215	{
3216	//Bs3TestPrintf("idx=%-2d fpfnWorker=%p fSs=%d cbInstr=%d\n",
3217	// idx, paWorkers[idx].fpfnWorker, paWorkers[idx].fSs, paWorkers[idx].cbInstr);
3218	g_usBs3TestStep = iStep;
3219	bs3CpuBasic2_lidt_lgdt_One(&paWorkers[idx], bTestMode, bRing, pvRestore, cbRestore, pbExpected);
3220	iStep += 1000;
3221	}
3222	if (BS3_MODE_IS_RM_SYS(bTestMode))
3223	break;
3224	}
3225	}
3226
3227
3228	BS3_DECL_FAR(uint8_t) BS3_CMN_FAR_NM(bs3CpuBasic2_lidt)(uint8_t bMode)
3229	{
3230	union
3231	{
3232	RTIDTR Idtr;
3233	uint8_t ab[32]; /* At least cbIdtr2! /
3234	} Expected;
3235
3236	//if (bMode != BS3_MODE_LM64) return 0;
3237	bs3CpuBasic2_SetGlobals(bMode);
3238
3239	/*
3240	* Pass to common worker which is only compiled once per mode.
3241	*/
3242	Bs3MemZero(&Expected, sizeof(Expected));
3243	ASMGetIDTR(&Expected.Idtr);
3244
3245	if (BS3_MODE_IS_RM_SYS(bMode))
3246	bs3CpuBasic2_lidt_lgdt_Common(bMode, g_aLidtWorkers, RT_ELEMENTS(g_aLidtWorkers),
3247	&Bs3Lidt_Ivt, sizeof(Bs3Lidt_Ivt), Expected.ab);
3248	else if (BS3_MODE_IS_16BIT_SYS(bMode))
3249	bs3CpuBasic2_lidt_lgdt_Common(bMode, g_aLidtWorkers, RT_ELEMENTS(g_aLidtWorkers),
3250	&Bs3Lidt_Idt16, sizeof(Bs3Lidt_Idt16), Expected.ab);
3251	else if (BS3_MODE_IS_32BIT_SYS(bMode))
3252	bs3CpuBasic2_lidt_lgdt_Common(bMode, g_aLidtWorkers, RT_ELEMENTS(g_aLidtWorkers),
3253	&Bs3Lidt_Idt32, sizeof(Bs3Lidt_Idt32), Expected.ab);
3254	else
3255	bs3CpuBasic2_lidt_lgdt_Common(bMode, g_aLidtWorkers, RT_ELEMENTS(g_aLidtWorkers),
3256	&Bs3Lidt_Idt64, sizeof(Bs3Lidt_Idt64), Expected.ab);
3257
3258	/*
3259	* Re-initialize the IDT.
3260	*/
3261	Bs3TrapReInit();
3262	return 0;
3263	}
3264
3265
3266	BS3_DECL_FAR(uint8_t) BS3_CMN_FAR_NM(bs3CpuBasic2_lgdt)(uint8_t bMode)
3267	{
3268	union
3269	{
3270	RTGDTR Gdtr;
3271	uint8_t ab[32]; /* At least cbIdtr2! /
3272	} Expected;
3273
3274	//if (!BS3_MODE_IS_64BIT_SYS(bMode)) return 0;
3275	bs3CpuBasic2_SetGlobals(bMode);
3276
3277	/*
3278	* Pass to common worker which is only compiled once per mode.
3279	*/
3280	if (BS3_MODE_IS_RM_SYS(bMode))
3281	ASMSetGDTR((PRTGDTR)&Bs3LgdtDef_Gdt);
3282	Bs3MemZero(&Expected, sizeof(Expected));
3283	ASMGetGDTR(&Expected.Gdtr);
3284
3285	bs3CpuBasic2_lidt_lgdt_Common(bMode, g_aLgdtWorkers, RT_ELEMENTS(g_aLgdtWorkers),
3286	&Bs3LgdtDef_Gdt, sizeof(Bs3LgdtDef_Gdt), Expected.ab);
3287
3288	/*
3289	* Re-initialize the IDT.
3290	*/
3291	Bs3TrapReInit();
3292	return 0;
3293	}
3294
3295	typedef union IRETBUF
3296	{
3297	uint64_t au64[6]; /* max req is 5 */
3298	uint32_t au32[12]; /* max req is 9 */
3299	uint16_t au16[24]; /* max req is 5 */
3300	uint8_t ab[48];
3301	} IRETBUF;
3302	typedef IRETBUF BS3_FAR *PIRETBUF;
3303
3304
3305	static void iretbuf_SetupFrame(PIRETBUF pIretBuf, unsigned const cbPop,
3306	uint16_t uCS, uint64_t uPC, uint32_t fEfl, uint16_t uSS, uint64_t uSP)
3307	{
3308	if (cbPop == 2)
3309	{
3310	pIretBuf->au16[0] = (uint16_t)uPC;
3311	pIretBuf->au16[1] = uCS;
3312	pIretBuf->au16[2] = (uint16_t)fEfl;
3313	pIretBuf->au16[3] = (uint16_t)uSP;
3314	pIretBuf->au16[4] = uSS;
3315	}
3316	else if (cbPop != 8)
3317	{
3318	pIretBuf->au32[0] = (uint32_t)uPC;
3319	pIretBuf->au16[1*2] = uCS;
3320	pIretBuf->au32[2] = (uint32_t)fEfl;
3321	pIretBuf->au32[3] = (uint32_t)uSP;
3322	pIretBuf->au16[4*2] = uSS;
3323	}
3324	else
3325	{
3326	pIretBuf->au64[0] = uPC;
3327	pIretBuf->au16[1*4] = uCS;
3328	pIretBuf->au64[2] = fEfl;
3329	pIretBuf->au64[3] = uSP;
3330	pIretBuf->au16[4*4] = uSS;
3331	}
3332	}
3333
3334
3335	static void bs3CpuBasic2_iret_Worker(uint8_t bTestMode, FPFNBS3FAR pfnIret, unsigned const cbPop,
3336	PIRETBUF pIretBuf, const char BS3_FAR *pszDesc)
3337	{
3338	BS3TRAPFRAME TrapCtx;
3339	BS3REGCTX Ctx;
3340	BS3REGCTX CtxUdExpected;
3341	BS3REGCTX TmpCtx;
3342	BS3REGCTX TmpCtxExpected;
3343	uint8_t abLowUd[8];
3344	uint8_t abLowIret[8];
3345	FPFNBS3FAR pfnUdLow = (FPFNBS3FAR)abLowUd;
3346	FPFNBS3FAR pfnIretLow = (FPFNBS3FAR)abLowIret;
3347	unsigned const cbSameCplFrame = BS3_MODE_IS_64BIT_CODE(bTestMode) ? 5cbPop : 3cbPop;
3348	bool const fUseLowCode = cbPop == 2 && !BS3_MODE_IS_16BIT_CODE(bTestMode);
3349	int iRingDst;
3350	int iRingSrc;
3351	uint16_t uDplSs;
3352	uint16_t uRplCs;
3353	uint16_t uRplSs;
3354	// int i;
3355	uint8_t BS3_FAR *pbTest;
3356
3357	NOREF(abLowUd);
3358	#define IRETBUF_SET_SEL(a_idx, a_uValue) \
3359	do { (uint16_t)&pIretBuf->ab[a_idx cbPop] = (a_uValue); } while (0)
3360	#define IRETBUF_SET_REG(a_idx, a_uValue) \
3361	do { uint8_t const BS3_FAR pbTmp = &pIretBuf->ab[a_idx cbPop]; \
3362	if (cbPop == 2) *(uint16_t)pbTmp = (uint16_t)(a_uValue); \
3363	else if (cbPop != 8) *(uint32_t)pbTmp = (uint32_t)(a_uValue); \
3364	else *(uint64_t)pbTmp = (a_uValue); \
3365	} while (0)
3366
3367	/* make sure they're allocated */
3368	Bs3MemZero(&Ctx, sizeof(Ctx));
3369	Bs3MemZero(&CtxUdExpected, sizeof(CtxUdExpected));
3370	Bs3MemZero(&TmpCtx, sizeof(TmpCtx));
3371	Bs3MemZero(&TmpCtxExpected, sizeof(TmpCtxExpected));
3372	Bs3MemZero(&TrapCtx, sizeof(TrapCtx));
3373
3374	/*
3375	* When dealing with 16-bit irets in 32-bit or 64-bit mode, we must have
3376	* copies of both iret and ud in the first 64KB of memory. The stack is
3377	* below 64KB, so we'll just copy the instructions onto the stack.
3378	*/
3379	Bs3MemCpy(abLowUd, bs3CpuBasic2_ud2, 4);
3380	Bs3MemCpy(abLowIret, pfnIret, 4);
3381
3382	/*
3383	* Create a context (stack is irrelevant, we'll mainly be using pIretBuf).
3384	* - Point the context at our iret instruction.
3385	* - Point SS:xSP at pIretBuf.
3386	*/
3387	Bs3RegCtxSaveEx(&Ctx, bTestMode, 0);
3388	if (!fUseLowCode)
3389	Bs3RegCtxSetRipCsFromLnkPtr(&Ctx, pfnIret);
3390	else
3391	Bs3RegCtxSetRipCsFromCurPtr(&Ctx, pfnIretLow);
3392	if (BS3_MODE_IS_16BIT_SYS(bTestMode))
3393	g_uBs3TrapEipHint = Ctx.rip.u32;
3394	Bs3RegCtxSetGrpSegFromCurPtr(&Ctx, &Ctx.rsp, &Ctx.ss, pIretBuf);
3395
3396	/*
3397	* The first success (UD) context keeps the same code bit-count as the iret.
3398	*/
3399	Bs3MemCpy(&CtxUdExpected, &Ctx, sizeof(Ctx));
3400	if (!fUseLowCode)
3401	Bs3RegCtxSetRipCsFromLnkPtr(&CtxUdExpected, bs3CpuBasic2_ud2);
3402	else
3403	Bs3RegCtxSetRipCsFromCurPtr(&CtxUdExpected, pfnUdLow);
3404	CtxUdExpected.rsp.u += cbSameCplFrame;
3405
3406	/*
3407	* Check that it works at all.
3408	*/
3409	iretbuf_SetupFrame(pIretBuf, cbPop, CtxUdExpected.cs, CtxUdExpected.rip.u,
3410	CtxUdExpected.rflags.u32, CtxUdExpected.ss, CtxUdExpected.rsp.u);
3411
3412	Bs3TrapSetJmpAndRestore(&Ctx, &TrapCtx);
3413	bs3CpuBasic2_CompareUdCtx(&TrapCtx, &CtxUdExpected);
3414	g_usBs3TestStep++;
3415
3416	if (!BS3_MODE_IS_RM_OR_V86(bTestMode))
3417	{
3418	/* Selectors are modified when switching rings, so we need to know
3419	what we're dealing with there. */
3420	if ( !BS3_SEL_IS_IN_R0_RANGE(Ctx.cs) \|\| !BS3_SEL_IS_IN_R0_RANGE(Ctx.ss)
3421	\|\| !BS3_SEL_IS_IN_R0_RANGE(Ctx.ds) \|\| !BS3_SEL_IS_IN_R0_RANGE(Ctx.es))
3422	Bs3TestFailedF("Expected R0 CS, SS, DS and ES; not %#x, %#x, %#x and %#x\n", Ctx.cs, Ctx.ss, Ctx.ds, Ctx.es);
3423	if (Ctx.fs \|\| Ctx.gs)
3424	Bs3TestFailed("Expected R0 FS and GS to be 0!\n");
3425
3426	/*
3427	* Test returning to outer rings if protected mode.
3428	*/
3429	Bs3MemCpy(&TmpCtx, &Ctx, sizeof(TmpCtx));
3430	Bs3MemCpy(&TmpCtxExpected, &CtxUdExpected, sizeof(TmpCtxExpected));
3431	for (iRingDst = 3; iRingDst >= 0; iRingDst--)
3432	{
3433	Bs3RegCtxConvertToRingX(&TmpCtxExpected, iRingDst);
3434	TmpCtxExpected.ds = iRingDst ? 0 : TmpCtx.ds;
3435	TmpCtx.es = TmpCtxExpected.es;
3436	iretbuf_SetupFrame(pIretBuf, cbPop, TmpCtxExpected.cs, TmpCtxExpected.rip.u,
3437	TmpCtxExpected.rflags.u32, TmpCtxExpected.ss, TmpCtxExpected.rsp.u);
3438	Bs3TrapSetJmpAndRestore(&TmpCtx, &TrapCtx);
3439	bs3CpuBasic2_CompareUdCtx(&TrapCtx, &TmpCtxExpected);
3440	g_usBs3TestStep++;
3441	}
3442
3443	/*
3444	* Check CS.RPL and SS.RPL.
3445	*/
3446	for (iRingDst = 3; iRingDst >= 0; iRingDst--)
3447	{
3448	uint16_t const uDstSsR0 = (CtxUdExpected.ss & BS3_SEL_RING_SUB_MASK) + BS3_SEL_R0_FIRST;
3449	Bs3MemCpy(&TmpCtxExpected, &CtxUdExpected, sizeof(TmpCtxExpected));
3450	Bs3RegCtxConvertToRingX(&TmpCtxExpected, iRingDst);
3451	for (iRingSrc = 3; iRingSrc >= 0; iRingSrc--)
3452	{
3453	Bs3MemCpy(&TmpCtx, &Ctx, sizeof(TmpCtx));
3454	Bs3RegCtxConvertToRingX(&TmpCtx, iRingSrc);
3455	TmpCtx.es = TmpCtxExpected.es;
3456	TmpCtxExpected.ds = iRingDst != iRingSrc ? 0 : TmpCtx.ds;
3457	for (uRplCs = 0; uRplCs <= 3; uRplCs++)
3458	{
3459	uint16_t const uSrcEs = TmpCtx.es;
3460	uint16_t const uDstCs = (TmpCtxExpected.cs & X86_SEL_MASK_OFF_RPL) \| uRplCs;
3461	//Bs3TestPrintf("dst=%d src=%d rplCS=%d\n", iRingDst, iRingSrc, uRplCs);
3462
3463	/* CS.RPL */
3464	iretbuf_SetupFrame(pIretBuf, cbPop, uDstCs, TmpCtxExpected.rip.u, TmpCtxExpected.rflags.u32,
3465	TmpCtxExpected.ss, TmpCtxExpected.rsp.u);
3466	Bs3TrapSetJmpAndRestore(&TmpCtx, &TrapCtx);
3467	if (uRplCs == iRingDst && iRingDst >= iRingSrc)
3468	bs3CpuBasic2_CompareUdCtx(&TrapCtx, &TmpCtxExpected);
3469	else
3470	{
3471	if (iRingDst < iRingSrc)
3472	TmpCtx.es = 0;
3473	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &TmpCtx, uDstCs & X86_SEL_MASK_OFF_RPL);
3474	TmpCtx.es = uSrcEs;
3475	}
3476	g_usBs3TestStep++;
3477
3478	/* SS.RPL */
3479	if (iRingDst != iRingSrc \|\| BS3_MODE_IS_64BIT_CODE(bTestMode))
3480	{
3481	uint16_t uSavedDstSs = TmpCtxExpected.ss;
3482	for (uRplSs = 0; uRplSs <= 3; uRplSs++)
3483	{
3484	/* SS.DPL (iRingDst == CS.DPL) */
3485	for (uDplSs = 0; uDplSs <= 3; uDplSs++)
3486	{
3487	uint16_t const uDstSs = ((uDplSs << BS3_SEL_RING_SHIFT) \| uRplSs) + uDstSsR0;
3488	//Bs3TestPrintf("dst=%d src=%d rplCS=%d rplSS=%d dplSS=%d dst %04x:%08RX64 %08RX32 %04x:%08RX64\n",
3489	// iRingDst, iRingSrc, uRplCs, uRplSs, uDplSs, uDstCs, TmpCtxExpected.rip.u,
3490	// TmpCtxExpected.rflags.u32, uDstSs, TmpCtxExpected.rsp.u);
3491
3492	iretbuf_SetupFrame(pIretBuf, cbPop, uDstCs, TmpCtxExpected.rip.u,
3493	TmpCtxExpected.rflags.u32, uDstSs, TmpCtxExpected.rsp.u);
3494	Bs3TrapSetJmpAndRestore(&TmpCtx, &TrapCtx);
3495	if (uRplCs != iRingDst \|\| iRingDst < iRingSrc)
3496	{
3497	if (iRingDst < iRingSrc)
3498	TmpCtx.es = 0;
3499	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &TmpCtx, uDstCs & X86_SEL_MASK_OFF_RPL);
3500	}
3501	else if (uRplSs != iRingDst \|\| uDplSs != iRingDst)
3502	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &TmpCtx, uDstSs & X86_SEL_MASK_OFF_RPL);
3503	else
3504	bs3CpuBasic2_CompareUdCtx(&TrapCtx, &TmpCtxExpected);
3505	TmpCtx.es = uSrcEs;
3506	g_usBs3TestStep++;
3507	}
3508	}
3509
3510	TmpCtxExpected.ss = uSavedDstSs;
3511	}
3512	}
3513	}
3514	}
3515	}
3516
3517	/*
3518	* Special 64-bit checks.
3519	*/
3520	if (BS3_MODE_IS_64BIT_CODE(bTestMode))
3521	{
3522	/* The VM flag is completely ignored. */
3523	iretbuf_SetupFrame(pIretBuf, cbPop, CtxUdExpected.cs, CtxUdExpected.rip.u,
3524	CtxUdExpected.rflags.u32 \| X86_EFL_VM, CtxUdExpected.ss, CtxUdExpected.rsp.u);
3525	Bs3TrapSetJmpAndRestore(&Ctx, &TrapCtx);
3526	bs3CpuBasic2_CompareUdCtx(&TrapCtx, &CtxUdExpected);
3527	g_usBs3TestStep++;
3528
3529	/* The NT flag can be loaded just fine. */
3530	CtxUdExpected.rflags.u32 \|= X86_EFL_NT;
3531	iretbuf_SetupFrame(pIretBuf, cbPop, CtxUdExpected.cs, CtxUdExpected.rip.u,
3532	CtxUdExpected.rflags.u32, CtxUdExpected.ss, CtxUdExpected.rsp.u);
3533	Bs3TrapSetJmpAndRestore(&Ctx, &TrapCtx);
3534	bs3CpuBasic2_CompareUdCtx(&TrapCtx, &CtxUdExpected);
3535	CtxUdExpected.rflags.u32 &= ~X86_EFL_NT;
3536	g_usBs3TestStep++;
3537
3538	/* However, we'll #GP(0) if it's already set (in RFLAGS) when executing IRET. */
3539	Ctx.rflags.u32 \|= X86_EFL_NT;
3540	iretbuf_SetupFrame(pIretBuf, cbPop, CtxUdExpected.cs, CtxUdExpected.rip.u,
3541	CtxUdExpected.rflags.u32, CtxUdExpected.ss, CtxUdExpected.rsp.u);
3542	Bs3TrapSetJmpAndRestore(&Ctx, &TrapCtx);
3543	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &Ctx, 0);
3544	g_usBs3TestStep++;
3545
3546	/* The NT flag #GP(0) should trump all other exceptions - pit it against #PF. */
3547	pbTest = (uint8_t BS3_FAR *)Bs3MemGuardedTestPageAlloc(BS3MEMKIND_TILED);
3548	if (pbTest != NULL)
3549	{
3550	Bs3RegCtxSetGrpSegFromCurPtr(&Ctx, &Ctx.rsp, &Ctx.ss, &pbTest[X86_PAGE_SIZE]);
3551	iretbuf_SetupFrame(pIretBuf, cbPop, CtxUdExpected.cs, CtxUdExpected.rip.u,
3552	CtxUdExpected.rflags.u32, CtxUdExpected.ss, CtxUdExpected.rsp.u);
3553	Bs3TrapSetJmpAndRestore(&Ctx, &TrapCtx);
3554	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &Ctx, 0);
3555	g_usBs3TestStep++;
3556
3557	Bs3RegCtxSetGrpSegFromCurPtr(&Ctx, &Ctx.rsp, &Ctx.ss, pIretBuf);
3558	Bs3MemGuardedTestPageFree(pbTest);
3559	}
3560	Ctx.rflags.u32 &= ~X86_EFL_NT;
3561	}
3562	}
3563
3564
3565	BS3_DECL_FAR(uint8_t) BS3_CMN_FAR_NM(bs3CpuBasic2_iret)(uint8_t bMode)
3566	{
3567	struct
3568	{
3569	uint8_t abExtraStack[4096]; /*< we've got ~30KB of stack, so 4KB for the trap handlers++ is not a problem. /
3570	IRETBUF IRetBuf;
3571	uint8_t abGuard[32];
3572	} uBuf;
3573	size_t cbUnused;
3574
3575	//if (bMode != BS3_MODE_LM64) return BS3TESTDOMODE_SKIPPED;
3576	bs3CpuBasic2_SetGlobals(bMode);
3577
3578	/*
3579	* Primary instruction form.
3580	*/
3581	Bs3MemSet(&uBuf, 0xaa, sizeof(uBuf));
3582	Bs3MemSet(uBuf.abGuard, 0x88, sizeof(uBuf.abGuard));
3583	if (BS3_MODE_IS_16BIT_CODE(bMode))
3584	bs3CpuBasic2_iret_Worker(bMode, bs3CpuBasic2_iret, 2, &uBuf.IRetBuf, "iret");
3585	else if (BS3_MODE_IS_32BIT_CODE(bMode))
3586	bs3CpuBasic2_iret_Worker(bMode, bs3CpuBasic2_iret, 4, &uBuf.IRetBuf, "iretd");
3587	else
3588	bs3CpuBasic2_iret_Worker(bMode, bs3CpuBasic2_iret_rexw, 8, &uBuf.IRetBuf, "o64 iret");
3589
3590	BS3_ASSERT(ASMMemIsAllU8(uBuf.abGuard, sizeof(uBuf.abGuard), 0x88));
3591	cbUnused = (uintptr_t)ASMMemFirstMismatchingU8(uBuf.abExtraStack, sizeof(uBuf.abExtraStack) + sizeof(uBuf.IRetBuf), 0xaa)
3592	- (uintptr_t)uBuf.abExtraStack;
3593	if (cbUnused < 2048)
3594	Bs3TestFailedF("cbUnused=%u #%u\n", cbUnused, 1);
3595
3596	/*
3597	* Secondary variation: opsize prefixed.
3598	*/
3599	Bs3MemSet(&uBuf, 0xaa, sizeof(uBuf));
3600	Bs3MemSet(uBuf.abGuard, 0x88, sizeof(uBuf.abGuard));
3601	if (BS3_MODE_IS_16BIT_CODE(bMode) && (g_uBs3CpuDetected & BS3CPU_TYPE_MASK) >= BS3CPU_80386)
3602	bs3CpuBasic2_iret_Worker(bMode, bs3CpuBasic2_iret_opsize, 4, &uBuf.IRetBuf, "o32 iret");
3603	else if (BS3_MODE_IS_32BIT_CODE(bMode))
3604	bs3CpuBasic2_iret_Worker(bMode, bs3CpuBasic2_iret_opsize, 2, &uBuf.IRetBuf, "o16 iret");
3605	else if (BS3_MODE_IS_64BIT_CODE(bMode))
3606	bs3CpuBasic2_iret_Worker(bMode, bs3CpuBasic2_iret, 4, &uBuf.IRetBuf, "iretd");
3607	BS3_ASSERT(ASMMemIsAllU8(uBuf.abGuard, sizeof(uBuf.abGuard), 0x88));
3608	cbUnused = (uintptr_t)ASMMemFirstMismatchingU8(uBuf.abExtraStack, sizeof(uBuf.abExtraStack) + sizeof(uBuf.IRetBuf), 0xaa)
3609	- (uintptr_t)uBuf.abExtraStack;
3610	if (cbUnused < 2048)
3611	Bs3TestFailedF("cbUnused=%u #%u\n", cbUnused, 2);
3612
3613	/*
3614	* Third variation: 16-bit in 64-bit mode (truly unlikely)
3615	*/
3616	if (BS3_MODE_IS_64BIT_CODE(bMode))
3617	{
3618	Bs3MemSet(&uBuf, 0xaa, sizeof(uBuf));
3619	Bs3MemSet(uBuf.abGuard, 0x88, sizeof(uBuf.abGuard));
3620	bs3CpuBasic2_iret_Worker(bMode, bs3CpuBasic2_iret_opsize, 2, &uBuf.IRetBuf, "o16 iret");
3621	BS3_ASSERT(ASMMemIsAllU8(uBuf.abGuard, sizeof(uBuf.abGuard), 0x88));
3622	cbUnused = (uintptr_t)ASMMemFirstMismatchingU8(uBuf.abExtraStack, sizeof(uBuf.abExtraStack) + sizeof(uBuf.IRetBuf), 0xaa)
3623	- (uintptr_t)uBuf.abExtraStack;
3624	if (cbUnused < 2048)
3625	Bs3TestFailedF("cbUnused=%u #%u\n", cbUnused, 3);
3626	}
3627
3628	return 0;
3629	}
3630
3631
3632
3633	/*********************************************************************************************************************************
3634	* JMP & CALL Tests *
3635	*********************************************************************************************************************************/
3636	#define PROTO_ALL(a_Template) \
3637	FNBS3FAR a_Template ## _c16, \
3638	a_Template ## _c32, \
3639	a_Template ## _c64
3640	PROTO_ALL(bs3CpuBasic2_jmp_jb__ud2);
3641	PROTO_ALL(bs3CpuBasic2_jmp_jb_back__ud2);
3642	PROTO_ALL(bs3CpuBasic2_jmp_jv__ud2);
3643	PROTO_ALL(bs3CpuBasic2_jmp_jv_back__ud2);
3644	PROTO_ALL(bs3CpuBasic2_jmp_ind_mem__ud2);
3645	PROTO_ALL(bs3CpuBasic2_jmp_ind_xAX__ud2);
3646	PROTO_ALL(bs3CpuBasic2_jmp_ind_xDI__ud2);
3647	FNBS3FAR bs3CpuBasic2_jmp_ind_r9__ud2_c64;
3648	PROTO_ALL(bs3CpuBasic2_call_jv__ud2);
3649	PROTO_ALL(bs3CpuBasic2_call_jv_back__ud2);
3650
3651	PROTO_ALL(bs3CpuBasic2_jmp_opsize_begin);
3652	PROTO_ALL(bs3CpuBasic2_jmp_jb_opsize__ud2);
3653	PROTO_ALL(bs3CpuBasic2_jmp_jb_opsize_back__ud2);
3654	PROTO_ALL(bs3CpuBasic2_jmp_jv_opsize__ud2);
3655	PROTO_ALL(bs3CpuBasic2_jmp_jv_opsize_back__ud2);
3656	PROTO_ALL(bs3CpuBasic2_jmp_ind_mem_opsize__ud2);
3657	FNBS3FAR bs3CpuBasic2_jmp_ind_mem_opsize__ud2__intel_c64;
3658	PROTO_ALL(bs3CpuBasic2_jmp_ind_xAX_opsize__ud2);
3659	PROTO_ALL(bs3CpuBasic2_call_jv_opsize__ud2);
3660	PROTO_ALL(bs3CpuBasic2_call_jv_opsize_back__ud2);
3661	PROTO_ALL(bs3CpuBasic2_jmp_opsize_end);
3662	#undef PROTO_ALL
3663
3664	FNBS3FAR bs3CpuBasic2_jmptext16_start;
3665
3666	FNBS3FAR bs3CpuBasic2_jmp_target_wrap_forward;
3667	FNBS3FAR bs3CpuBasic2_jmp_jb_wrap_forward__ud2;
3668	FNBS3FAR bs3CpuBasic2_jmp_jb_opsize_wrap_forward__ud2;
3669	FNBS3FAR bs3CpuBasic2_jmp_jv16_wrap_forward__ud2;
3670	FNBS3FAR bs3CpuBasic2_jmp_jv16_opsize_wrap_forward__ud2;
3671
3672	FNBS3FAR bs3CpuBasic2_jmp_target_wrap_backward;
3673	FNBS3FAR bs3CpuBasic2_jmp_jb_wrap_backward__ud2;
3674	FNBS3FAR bs3CpuBasic2_jmp_jb_opsize_wrap_backward__ud2;
3675	FNBS3FAR bs3CpuBasic2_jmp_jv16_wrap_backward__ud2;
3676	FNBS3FAR bs3CpuBasic2_jmp_jv16_opsize_wrap_backward__ud2;
3677
3678
3679
3680	/**
3681	* Entrypoint for JMP tests.
3682	*
3683	* @returns 0 or BS3TESTDOMODE_SKIPPED.
3684	* @param bMode The CPU mode we're testing.
3685	*
3686	* @note When testing v8086 code, we'll be running in v8086 mode. So, careful
3687	* with control registers and such.
3688	*/
3689	BS3_DECL_FAR(uint8_t) BS3_CMN_FAR_NM(bs3CpuBasic2_jmp_rel)(uint8_t bMode)
3690	{
3691	BS3TRAPFRAME TrapCtx;
3692	BS3REGCTX Ctx;
3693	BS3REGCTX CtxExpected;
3694	unsigned iTest;
3695
3696	/* make sure they're allocated */
3697	Bs3MemZero(&Ctx, sizeof(Ctx));
3698	Bs3MemZero(&CtxExpected, sizeof(Ctx));
3699	Bs3MemZero(&TrapCtx, sizeof(TrapCtx));
3700
3701	bs3CpuBasic2_SetGlobals(bMode);
3702
3703	/*
3704	* Create a context.
3705	*/
3706	Bs3RegCtxSaveEx(&Ctx, bMode, 768);
3707	Bs3MemCpy(&CtxExpected, &Ctx, sizeof(CtxExpected));
3708
3709	/*
3710	* 16-bit tests.
3711	*
3712	* When opsize is 16-bit relative jumps will do 16-bit calculations and
3713	* modify IP. This means that it is not possible to trigger a segment
3714	* limit #GP(0) when the limit is set to 0xffff.
3715	*/
3716	if (BS3_MODE_IS_16BIT_CODE(bMode))
3717	{
3718	static struct
3719	{
3720	int8_t iWrap;
3721	bool fOpSizePfx;
3722	int8_t iGprIndirect;
3723	bool fCall;
3724	FPFNBS3FAR pfnTest;
3725	}
3726	const s_aTests[] =
3727	{
3728	{ 0, false, -1, false, bs3CpuBasic2_jmp_jb__ud2_c16, },
3729	{ 0, false, -1, false, bs3CpuBasic2_jmp_jb_back__ud2_c16, },
3730	{ 0, true, -1, false, bs3CpuBasic2_jmp_jb_opsize__ud2_c16, },
3731	{ 0, true, -1, false, bs3CpuBasic2_jmp_jb_opsize_back__ud2_c16, },
3732	{ 0, false, -1, false, bs3CpuBasic2_jmp_jv__ud2_c16, },
3733	{ 0, false, -1, false, bs3CpuBasic2_jmp_jv_back__ud2_c16, },
3734	{ 0, true, -1, false, bs3CpuBasic2_jmp_jv_opsize__ud2_c16, },
3735	{ 0, true, -1, false, bs3CpuBasic2_jmp_jv_opsize_back__ud2_c16, },
3736	{ 0, false, -1, false, bs3CpuBasic2_jmp_ind_mem__ud2_c16, },
3737	{ 0, true, -1, false, bs3CpuBasic2_jmp_ind_mem_opsize__ud2_c16, },
3738	{ 0, false, X86_GREG_xAX, false, bs3CpuBasic2_jmp_ind_xAX__ud2_c16, },
3739	{ 0, false, X86_GREG_xDI, false, bs3CpuBasic2_jmp_ind_xDI__ud2_c16, },
3740	{ 0, true, X86_GREG_xAX, false, bs3CpuBasic2_jmp_ind_xAX_opsize__ud2_c16, },
3741	{ 0, false, -1, true, bs3CpuBasic2_call_jv__ud2_c16, },
3742	{ 0, false, -1, true, bs3CpuBasic2_call_jv_back__ud2_c16, },
3743	{ 0, true, -1, true, bs3CpuBasic2_call_jv_opsize__ud2_c16, },
3744	{ 0, true, -1, true, bs3CpuBasic2_call_jv_opsize_back__ud2_c16, },
3745
3746	{ -1, false, -1, false, bs3CpuBasic2_jmp_jb_wrap_backward__ud2, },
3747	{ +1, false, -1, false, bs3CpuBasic2_jmp_jb_wrap_forward__ud2, },
3748	{ -1, true, -1, false, bs3CpuBasic2_jmp_jb_opsize_wrap_backward__ud2, },
3749	{ +1, true, -1, false, bs3CpuBasic2_jmp_jb_opsize_wrap_forward__ud2, },
3750
3751	{ -1, false, -1, false, bs3CpuBasic2_jmp_jv16_wrap_backward__ud2, },
3752	{ +1, false, -1, false, bs3CpuBasic2_jmp_jv16_wrap_forward__ud2, },
3753	{ -1, true, -1, false, bs3CpuBasic2_jmp_jv16_opsize_wrap_backward__ud2, },
3754	{ +1, true, -1, false, bs3CpuBasic2_jmp_jv16_opsize_wrap_forward__ud2, },
3755	};
3756
3757	if (!BS3_MODE_IS_RM_OR_V86(bMode))
3758	Bs3SelSetup16BitCode(&Bs3GdteSpare03, Bs3SelLnkPtrToFlat(bs3CpuBasic2_jmptext16_start), 0);
3759
3760	for (iTest = 0; iTest < RT_ELEMENTS(s_aTests); iTest++)
3761	{
3762	uint64_t uGprSaved;
3763	if (s_aTests[iTest].iWrap == 0)
3764	{
3765	uint8_t const BS3_FAR *fpbCode;
3766	Bs3RegCtxSetRipCsFromLnkPtr(&Ctx, s_aTests[iTest].pfnTest);
3767	fpbCode = (uint8_t const BS3_FAR *)BS3_FP_MAKE(Ctx.cs, Ctx.rip.u16);
3768	CtxExpected.rip.u = Ctx.rip.u + (int64_t)(int8_t)fpbCode[-1];
3769	}
3770	else
3771	{
3772	if (BS3_MODE_IS_RM_OR_V86(bMode))
3773	Ctx.cs = BS3_FP_SEG(s_aTests[iTest].pfnTest);
3774	else
3775	Ctx.cs = BS3_SEL_SPARE_03;
3776	Ctx.rip.u = BS3_FP_OFF(s_aTests[iTest].pfnTest);
3777	if (s_aTests[iTest].fOpSizePfx)
3778	CtxExpected.rip.u = Ctx.rip.u;
3779	else if (s_aTests[iTest].iWrap < 0)
3780	CtxExpected.rip.u = BS3_FP_OFF(bs3CpuBasic2_jmp_target_wrap_backward);
3781	else
3782	CtxExpected.rip.u = BS3_FP_OFF(bs3CpuBasic2_jmp_target_wrap_forward);
3783	}
3784	CtxExpected.cs = Ctx.cs;
3785	if (s_aTests[iTest].iGprIndirect >= 0)
3786	{
3787	uGprSaved = (&Ctx.rax)[s_aTests[iTest].iGprIndirect].u;
3788	(&Ctx.rax)[s_aTests[iTest].iGprIndirect].u
3789	= (&CtxExpected.rax)[s_aTests[iTest].iGprIndirect].u = CtxExpected.rip.u;
3790	}
3791	CtxExpected.rsp.u = Ctx.rsp.u;
3792	if (s_aTests[iTest].fCall && (s_aTests[iTest].iWrap == 0 \|\| !s_aTests[iTest].fOpSizePfx))
3793	CtxExpected.rsp.u -= s_aTests[iTest].fOpSizePfx ? 4 : 2;
3794	//Bs3TestPrintf("cs:rip=%04RX16:%04RX64\n", Ctx.cs, Ctx.rip.u);
3795
3796	Bs3TrapSetJmpAndRestore(&Ctx, &TrapCtx);
3797	if (s_aTests[iTest].iWrap == 0 \|\| !s_aTests[iTest].fOpSizePfx)
3798	bs3CpuBasic2_CompareUdCtx(&TrapCtx, &CtxExpected);
3799	else
3800	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &CtxExpected, 0);
3801	g_usBs3TestStep++;
3802
3803	/* Again single stepping: */
3804	//Bs3TestPrintf("stepping...\n");
3805	Ctx.rflags.u16 \|= X86_EFL_TF;
3806	CtxExpected.rflags.u16 = Ctx.rflags.u16;
3807	Bs3TrapSetJmpAndRestore(&Ctx, &TrapCtx);
3808	if (s_aTests[iTest].iWrap == 0 \|\| !s_aTests[iTest].fOpSizePfx)
3809	{
3810	/** @todo check DR6.BS. */
3811	bs3CpuBasic2_CompareDbCtx(&TrapCtx, &CtxExpected);
3812	}
3813	else
3814	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &CtxExpected, 0);
3815	Ctx.rflags.u16 &= ~X86_EFL_TF;
3816	CtxExpected.rflags.u16 = Ctx.rflags.u16;
3817	g_usBs3TestStep++;
3818
3819	if (s_aTests[iTest].iGprIndirect >= 0)
3820	(&Ctx.rax)[s_aTests[iTest].iGprIndirect].u = (&CtxExpected.rax)[s_aTests[iTest].iGprIndirect].u = uGprSaved;
3821	}
3822
3823	/* Limit the wraparound CS segment to exlcude bs3CpuBasic2_jmp_target_wrap_backward
3824	and run the backward wrapping tests. */
3825	if (!BS3_MODE_IS_RM_OR_V86(bMode))
3826	{
3827	Bs3GdteSpare03.Gen.u16LimitLow = BS3_FP_OFF(bs3CpuBasic2_jmp_target_wrap_backward) - 1;
3828	CtxExpected.cs = Ctx.cs = BS3_SEL_SPARE_03;
3829	for (iTest = 0; iTest < RT_ELEMENTS(s_aTests); iTest++)
3830	if (s_aTests[iTest].iWrap < 0)
3831	{
3832	CtxExpected.rip.u = Ctx.rip.u = BS3_FP_OFF(s_aTests[iTest].pfnTest);
3833	//Bs3TestPrintf("cs:rip=%04RX16:%04RX64 v1\n", Ctx.cs, Ctx.rip.u);
3834	Bs3TrapSetJmpAndRestore(&Ctx, &TrapCtx);
3835	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &CtxExpected, 0);
3836	g_usBs3TestStep++;
3837	}
3838
3839	/* Do another round where we put the limit in the middle of the UD2
3840	instruction we're jumping to: */
3841	Bs3GdteSpare03.Gen.u16LimitLow = BS3_FP_OFF(bs3CpuBasic2_jmp_target_wrap_backward);
3842	for (iTest = 0; iTest < RT_ELEMENTS(s_aTests); iTest++)
3843	if (s_aTests[iTest].iWrap < 0)
3844	{
3845	Ctx.rip.u = BS3_FP_OFF(s_aTests[iTest].pfnTest);
3846	if (s_aTests[iTest].fOpSizePfx)
3847	CtxExpected.rip.u = Ctx.rip.u;
3848	else
3849	CtxExpected.rip.u = BS3_FP_OFF(bs3CpuBasic2_jmp_target_wrap_backward);
3850	//Bs3TestPrintf("cs:rip=%04RX16:%04RX64 v2\n", Ctx.cs, Ctx.rip.u);
3851	Bs3TrapSetJmpAndRestore(&Ctx, &TrapCtx);
3852	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &CtxExpected, 0);
3853	g_usBs3TestStep++;
3854	}
3855	}
3856
3857	}
3858	/*
3859	* 32-bit & 64-bit tests.
3860	*
3861	* When the opsize prefix is applied here, IP is updated and bits 63:16
3862	* cleared. However in 64-bit mode, Intel ignores the opsize prefix
3863	* whereas AMD doesn't and it works like you expect.
3864	*/
3865	else
3866	{
3867	static struct
3868	{
3869	uint8_t cBits;
3870	bool fOpSizePfx;
3871	bool fIgnPfx;
3872	int8_t iGprIndirect;
3873	bool fCall;
3874	FPFNBS3FAR pfnTest;
3875	}
3876	const s_aTests[] =
3877	{
3878	{ 32, false, false, -1, false, bs3CpuBasic2_jmp_jb__ud2_c32, },
3879	{ 32, false, false, -1, false, bs3CpuBasic2_jmp_jb_back__ud2_c32, },
3880	{ 32, true, false, -1, false, bs3CpuBasic2_jmp_jb_opsize__ud2_c32, },
3881	{ 32, true, false, -1, false, bs3CpuBasic2_jmp_jb_opsize_back__ud2_c32, },
3882	{ 32, false, false, -1, false, bs3CpuBasic2_jmp_jv__ud2_c32, },
3883	{ 32, false, false, -1, false, bs3CpuBasic2_jmp_jv_back__ud2_c32, },
3884	{ 32, true, false, -1, false, bs3CpuBasic2_jmp_jv_opsize__ud2_c32, },
3885	{ 32, true, false, -1, false, bs3CpuBasic2_jmp_jv_opsize_back__ud2_c32, },
3886	{ 32, false, false, -1, false, bs3CpuBasic2_jmp_ind_mem__ud2_c32, },
3887	{ 32, true, false, -1, false, bs3CpuBasic2_jmp_ind_mem_opsize__ud2_c32, },
3888	{ 32, false, false, X86_GREG_xAX, false, bs3CpuBasic2_jmp_ind_xAX__ud2_c32, },
3889	{ 32, false, false, X86_GREG_xDI, false, bs3CpuBasic2_jmp_ind_xDI__ud2_c32, },
3890	{ 32, true, false, X86_GREG_xAX, false, bs3CpuBasic2_jmp_ind_xAX_opsize__ud2_c32, },
3891	{ 32, false, false, -1, true, bs3CpuBasic2_call_jv__ud2_c32, },
3892	{ 32, false, false, -1, true, bs3CpuBasic2_call_jv_back__ud2_c32, },
3893	{ 32, true, false, -1, true, bs3CpuBasic2_call_jv_opsize__ud2_c32, },
3894	{ 32, true, false, -1, true, bs3CpuBasic2_call_jv_opsize_back__ud2_c32, },
3895	/* 64bit/Intel: Use the _c64 tests, which are written to ignore the o16 prefix. */
3896	{ 64, false, true, -1, false, bs3CpuBasic2_jmp_jb__ud2_c64, },
3897	{ 64, false, true, -1, false, bs3CpuBasic2_jmp_jb_back__ud2_c64, },
3898	{ 64, true, true, -1, false, bs3CpuBasic2_jmp_jb_opsize__ud2_c64, },
3899	{ 64, true, true, -1, false, bs3CpuBasic2_jmp_jb_opsize_back__ud2_c64, },
3900	{ 64, false, true, -1, false, bs3CpuBasic2_jmp_jv__ud2_c64, },
3901	{ 64, false, true, -1, false, bs3CpuBasic2_jmp_jv_back__ud2_c64, },
3902	{ 64, true, true, -1, false, bs3CpuBasic2_jmp_jv_opsize__ud2_c64, },
3903	{ 64, true, true, -1, false, bs3CpuBasic2_jmp_jv_opsize_back__ud2_c64, },
3904	{ 64, false, true, -1, false, bs3CpuBasic2_jmp_ind_mem__ud2_c64, },
3905	{ 64, true, true, -1, false, bs3CpuBasic2_jmp_ind_mem_opsize__ud2__intel_c64, },
3906	{ 64, false, true, X86_GREG_xAX, false, bs3CpuBasic2_jmp_ind_xAX__ud2_c64, },
3907	{ 64, false, true, X86_GREG_xDI, false, bs3CpuBasic2_jmp_ind_xDI__ud2_c64, },
3908	{ 64, false, true, X86_GREG_x9, false, bs3CpuBasic2_jmp_ind_r9__ud2_c64, },
3909	{ 64, true, true, X86_GREG_xAX, false, bs3CpuBasic2_jmp_ind_xAX_opsize__ud2_c64, }, /* no intel version needed */
3910	{ 64, false, true, -1, true, bs3CpuBasic2_call_jv__ud2_c64, },
3911	{ 64, false, true, -1, true, bs3CpuBasic2_call_jv_back__ud2_c64, },
3912	{ 64, true, true, -1, true, bs3CpuBasic2_call_jv_opsize__ud2_c64, },
3913	{ 64, true, true, -1, true, bs3CpuBasic2_call_jv_opsize_back__ud2_c64, },
3914	/* 64bit/AMD: Use the _c32 tests. */
3915	{ 64, false, false, -1, false, bs3CpuBasic2_jmp_jb__ud2_c32, },
3916	{ 64, false, false, -1, false, bs3CpuBasic2_jmp_jb_back__ud2_c32, },
3917	{ 64, true, false, -1, false, bs3CpuBasic2_jmp_jb_opsize__ud2_c32, },
3918	{ 64, true, false, -1, false, bs3CpuBasic2_jmp_jb_opsize_back__ud2_c32, },
3919	{ 64, false, false, -1, false, bs3CpuBasic2_jmp_jv__ud2_c32, },
3920	{ 64, false, false, -1, false, bs3CpuBasic2_jmp_jv_back__ud2_c32, },
3921	{ 64, true, false, -1, false, bs3CpuBasic2_jmp_jv_opsize__ud2_c32, },
3922	{ 64, true, false, -1, false, bs3CpuBasic2_jmp_jv_opsize_back__ud2_c32, },
3923	{ 64, false, false, -1, false, bs3CpuBasic2_jmp_ind_mem__ud2_c64, }, /* using c64 here */
3924	{ 64, true, false, -1, false, bs3CpuBasic2_jmp_ind_mem_opsize__ud2_c64, }, /* using c64 here */
3925	{ 64, false, false, X86_GREG_xAX, false, bs3CpuBasic2_jmp_ind_xAX__ud2_c64, }, /* ditto */
3926	{ 64, false, false, X86_GREG_xDI, false, bs3CpuBasic2_jmp_ind_xDI__ud2_c64, }, /* ditto */
3927	{ 64, false, false, X86_GREG_x9, false, bs3CpuBasic2_jmp_ind_r9__ud2_c64, }, /* ditto */
3928	{ 64, true, false, X86_GREG_xAX, false, bs3CpuBasic2_jmp_ind_xAX_opsize__ud2_c64, }, /* ditto */
3929	{ 64, false, false, -1, true, bs3CpuBasic2_call_jv__ud2_c32, }, /* using c32 again */
3930	{ 64, false, false, -1, true, bs3CpuBasic2_call_jv_back__ud2_c32, },
3931	{ 64, true, false, -1, true, bs3CpuBasic2_call_jv_opsize__ud2_c32, },
3932	{ 64, true, false, -1, true, bs3CpuBasic2_call_jv_opsize_back__ud2_c32, },
3933	};
3934	uint8_t const cBits = BS3_MODE_IS_64BIT_CODE(bMode) ? 64 : 32;
3935	BS3CPUVENDOR const enmCpuVendor = Bs3GetCpuVendor();
3936	bool const fIgnPfx = cBits == 64 && enmCpuVendor == BS3CPUVENDOR_INTEL; /** @todo what does VIA do? */
3937
3938	/* Prepare a copy of the UD2 instructions in low memory for opsize prefixed tests. */
3939	uint16_t const offLow = BS3_FP_OFF(bs3CpuBasic2_jmp_opsize_begin_c32);
3940	uint16_t const cbLow = BS3_FP_OFF(bs3CpuBasic2_jmp_opsize_end_c64) - offLow;
3941	uint8_t BS3_FAR * const pbCode16 = BS3_MAKE_PROT_R0PTR_FROM_FLAT(BS3_ADDR_BS3TEXT16);
3942	uint8_t BS3_FAR * const pbLow = BS3_FP_MAKE(BS3_SEL_TILED_R0, 0);
3943	if (offLow < 0x600 \|\| offLow + cbLow >= BS3_ADDR_STACK_R2)
3944	Bs3TestFailedF("Opsize overriden jumps are out of place: %#x LB %#z\n", offLow, cbLow);
3945	Bs3MemSet(&pbLow[offLow], 0xcc /int3/, cbLow);
3946	if (!fIgnPfx)
3947	{
3948	for (iTest = 0; iTest < RT_ELEMENTS(s_aTests); iTest++)
3949	if (s_aTests[iTest].fOpSizePfx && s_aTests[iTest].cBits == cBits && s_aTests[iTest].fIgnPfx == fIgnPfx)
3950	{
3951	uint16_t const offFn = BS3_FP_OFF(s_aTests[iTest].pfnTest);
3952	uint16_t const offUd = offFn + (int16_t)(int8_t)pbCode16[offFn - 1];
3953	pbCode16[offUd] = 0xf1; /* replace original ud2 with icebp */
3954	pbCode16[offUd + 1] = 0xf1;
3955	pbLow[offUd] = 0x0f; /* plant ud2 in low memory */
3956	pbLow[offUd + 1] = 0x0b;
3957	}
3958	}
3959
3960	/* Run the tests. */
3961	for (iTest = 0; iTest < RT_ELEMENTS(s_aTests); iTest++)
3962	{
3963	if (s_aTests[iTest].cBits == cBits && s_aTests[iTest].fIgnPfx == fIgnPfx)
3964	{
3965	uint64_t uGprSaved;
3966	uint8_t const BS3_FAR *fpbCode = Bs3SelLnkPtrToCurPtr(s_aTests[iTest].pfnTest);
3967	Ctx.rip.u = Bs3SelLnkPtrToFlat(s_aTests[iTest].pfnTest);
3968	CtxExpected.rip.u = Ctx.rip.u + (int64_t)(int8_t)fpbCode[-1];
3969	if (s_aTests[iTest].iGprIndirect >= 0)
3970	{
3971	uGprSaved = (&Ctx.rax)[s_aTests[iTest].iGprIndirect].u;
3972	(&Ctx.rax)[s_aTests[iTest].iGprIndirect].u
3973	= (&CtxExpected.rax)[s_aTests[iTest].iGprIndirect].u = CtxExpected.rip.u;
3974	}
3975	if (s_aTests[iTest].fOpSizePfx && !fIgnPfx)
3976	CtxExpected.rip.u &= UINT16_MAX;
3977	CtxExpected.rsp.u = Ctx.rsp.u;
3978	if (s_aTests[iTest].fCall)
3979	CtxExpected.rsp.u -= s_aTests[iTest].cBits == 64 ? 8
3980	: !s_aTests[iTest].fOpSizePfx ? 4 : 2;
3981
3982	//Bs3TestPrintf("cs:rip=%04RX16:%08RX64\n", Ctx.cs, Ctx.rip.u);
3983
3984	if (BS3_MODE_IS_16BIT_SYS(bMode))
3985	g_uBs3TrapEipHint = s_aTests[iTest].fOpSizePfx ? 0 : Ctx.rip.u32;
3986	Bs3TrapSetJmpAndRestore(&Ctx, &TrapCtx);
3987
3988	bs3CpuBasic2_CompareUdCtx(&TrapCtx, &CtxExpected);
3989	g_usBs3TestStep++;
3990
3991	/* Again single stepping: */
3992	//Bs3TestPrintf("stepping...\n");
3993	Ctx.rflags.u16 \|= X86_EFL_TF;
3994	CtxExpected.rflags.u16 = Ctx.rflags.u16;
3995	Bs3TrapSetJmpAndRestore(&Ctx, &TrapCtx);
3996	/** @todo check DR6.BS. */
3997	bs3CpuBasic2_CompareDbCtx(&TrapCtx, &CtxExpected);
3998	Ctx.rflags.u16 &= ~X86_EFL_TF;
3999	CtxExpected.rflags.u16 = Ctx.rflags.u16;
4000	g_usBs3TestStep++;
4001
4002	if (s_aTests[iTest].iGprIndirect >= 0)
4003	(&Ctx.rax)[s_aTests[iTest].iGprIndirect].u = (&CtxExpected.rax)[s_aTests[iTest].iGprIndirect].u = uGprSaved;
4004	}
4005	}
4006
4007	Bs3MemSet(&pbLow[offLow], 0xcc /int3/, cbLow);
4008	}
4009
4010	return 0;
4011	}
4012

Note: See TracBrowser for help on using the repository browser.

source: vbox/trunk/src/VBox/ValidationKit/bootsectors/bs3-cpu-basic-2-x0.c@ 97477

Download in other formats: