bs3-cpu-basic-2-template.c@ 93115

Last change on this file since 93115 was 93115, checked in by vboxsync, 3 years ago
scm --update-copyright-year
Property svn:eol-style set to `native` Property svn:keywords set to `Author Date Id Revision`
File size: 65.4 KB

Line
1	/* $Id: bs3-cpu-basic-2-template.c 93115 2022-01-01 11:31:46Z vboxsync $ */
2	/** @file
3	* BS3Kit - bs3-cpu-basic-2, C code template.
4	*/
5
6	/*
7	* Copyright (C) 2007-2022 Oracle Corporation
8	*
9	* This file is part of VirtualBox Open Source Edition (OSE), as
10	* available from http://www.virtualbox.org. This file is free software;
11	* you can redistribute it and/or modify it under the terms of the GNU
12	* General Public License (GPL) as published by the Free Software
13	* Foundation, in version 2 as it comes in the "COPYING" file of the
14	* VirtualBox OSE distribution. VirtualBox OSE is distributed in the
15	* hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
16	*
17	* The contents of this file may alternatively be used under the terms
18	* of the Common Development and Distribution License Version 1.0
19	* (CDDL) only, as it comes in the "COPYING.CDDL" file of the
20	* VirtualBox OSE distribution, in which case the provisions of the
21	* CDDL are applicable instead of those of the GPL.
22	*
23	* You may elect to license modified versions of this file under the
24	* terms and conditions of either the GPL or the CDDL or both.
25	*/
26
27
28	/*********************************************************************************************************************************
29	* Header Files *
30	*********************************************************************************************************************************/
31	#include <iprt/asm.h>
32	#include <iprt/asm-amd64-x86.h>
33
34
35	/*********************************************************************************************************************************
36	* Defined Constants And Macros *
37	*********************************************************************************************************************************/
38	#undef CHECK_MEMBER
39	#define CHECK_MEMBER(a_szName, a_szFmt, a_Actual, a_Expected) \
40	do \
41	{ \
42	if ((a_Actual) == (a_Expected)) { /* likely */ } \
43	else bs3CpuBasic2_FailedF(a_szName "=" a_szFmt " expected " a_szFmt, (a_Actual), (a_Expected)); \
44	} while (0)
45
46
47	#ifdef BS3_INSTANTIATING_MODE
48	# undef MyBs3Idt
49	# undef MY_SYS_SEL_R0_CS
50	# undef MY_SYS_SEL_R0_CS_CNF
51	# undef MY_SYS_SEL_R0_DS
52	# undef MY_SYS_SEL_R0_SS
53	# if BS3_MODE_IS_16BIT_SYS(TMPL_MODE)
54	# define MyBs3Idt Bs3Idt16
55	# define MY_SYS_SEL_R0_CS BS3_SEL_R0_CS16
56	# define MY_SYS_SEL_R0_CS_CNF BS3_SEL_R0_CS16_CNF
57	# define MY_SYS_SEL_R0_DS BS3_SEL_R0_DS16
58	# define MY_SYS_SEL_R0_SS BS3_SEL_R0_SS16
59	# elif BS3_MODE_IS_32BIT_SYS(TMPL_MODE)
60	# define MyBs3Idt Bs3Idt32
61	# define MY_SYS_SEL_R0_CS BS3_SEL_R0_CS32
62	# define MY_SYS_SEL_R0_CS_CNF BS3_SEL_R0_CS32_CNF
63	# define MY_SYS_SEL_R0_DS BS3_SEL_R0_DS32
64	# define MY_SYS_SEL_R0_SS BS3_SEL_R0_SS32
65	# elif BS3_MODE_IS_64BIT_SYS(TMPL_MODE)
66	# define MyBs3Idt Bs3Idt64
67	# define MY_SYS_SEL_R0_CS BS3_SEL_R0_CS64
68	# define MY_SYS_SEL_R0_CS_CNF BS3_SEL_R0_CS64_CNF
69	# define MY_SYS_SEL_R0_DS BS3_SEL_R0_DS64
70	# define MY_SYS_SEL_R0_SS BS3_SEL_R0_DS64
71	# else
72	# error "TMPL_MODE"
73	# endif
74	#endif
75
76
77	/*********************************************************************************************************************************
78	* Structures and Typedefs *
79	*********************************************************************************************************************************/
80	#ifdef BS3_INSTANTIATING_CMN
81	typedef struct BS3CB2INVLDESCTYPE
82	{
83	uint8_t u4Type;
84	uint8_t u1DescType;
85	} BS3CB2INVLDESCTYPE;
86	#endif
87
88
89	/*********************************************************************************************************************************
90	* External Symbols *
91	*********************************************************************************************************************************/
92	#ifdef BS3_INSTANTIATING_CMN
93	extern FNBS3FAR bs3CpuBasic2_Int80;
94	extern FNBS3FAR bs3CpuBasic2_Int81;
95	extern FNBS3FAR bs3CpuBasic2_Int82;
96	extern FNBS3FAR bs3CpuBasic2_Int83;
97	extern FNBS3FAR bs3CpuBasic2_ud2;
98	# define g_bs3CpuBasic2_ud2_FlatAddr BS3_DATA_NM(g_bs3CpuBasic2_ud2_FlatAddr)
99	extern uint32_t g_bs3CpuBasic2_ud2_FlatAddr;
100	#endif
101
102
103	/*********************************************************************************************************************************
104	* Global Variables *
105	*********************************************************************************************************************************/
106	#ifdef BS3_INSTANTIATING_CMN
107	# define g_pszTestMode BS3_CMN_NM(g_pszTestMode)
108	static const char BS3_FAR g_pszTestMode = (const char )1;
109	# define g_bTestMode BS3_CMN_NM(g_bTestMode)
110	static uint8_t g_bTestMode = 1;
111	# define g_f16BitSys BS3_CMN_NM(g_f16BitSys)
112	static bool g_f16BitSys = 1;
113
114
115	/** Table containing invalid CS selector types. */
116	static const BS3CB2INVLDESCTYPE g_aInvalidCsTypes[] =
117	{
118	{ X86_SEL_TYPE_RO, 1 },
119	{ X86_SEL_TYPE_RO_ACC, 1 },
120	{ X86_SEL_TYPE_RW, 1 },
121	{ X86_SEL_TYPE_RW_ACC, 1 },
122	{ X86_SEL_TYPE_RO_DOWN, 1 },
123	{ X86_SEL_TYPE_RO_DOWN_ACC, 1 },
124	{ X86_SEL_TYPE_RW_DOWN, 1 },
125	{ X86_SEL_TYPE_RW_DOWN_ACC, 1 },
126	{ 0, 0 },
127	{ 1, 0 },
128	{ 2, 0 },
129	{ 3, 0 },
130	{ 4, 0 },
131	{ 5, 0 },
132	{ 6, 0 },
133	{ 7, 0 },
134	{ 8, 0 },
135	{ 9, 0 },
136	{ 10, 0 },
137	{ 11, 0 },
138	{ 12, 0 },
139	{ 13, 0 },
140	{ 14, 0 },
141	{ 15, 0 },
142	};
143
144	/** Table containing invalid SS selector types. */
145	static const BS3CB2INVLDESCTYPE g_aInvalidSsTypes[] =
146	{
147	{ X86_SEL_TYPE_EO, 1 },
148	{ X86_SEL_TYPE_EO_ACC, 1 },
149	{ X86_SEL_TYPE_ER, 1 },
150	{ X86_SEL_TYPE_ER_ACC, 1 },
151	{ X86_SEL_TYPE_EO_CONF, 1 },
152	{ X86_SEL_TYPE_EO_CONF_ACC, 1 },
153	{ X86_SEL_TYPE_ER_CONF, 1 },
154	{ X86_SEL_TYPE_ER_CONF_ACC, 1 },
155	{ 0, 0 },
156	{ 1, 0 },
157	{ 2, 0 },
158	{ 3, 0 },
159	{ 4, 0 },
160	{ 5, 0 },
161	{ 6, 0 },
162	{ 7, 0 },
163	{ 8, 0 },
164	{ 9, 0 },
165	{ 10, 0 },
166	{ 11, 0 },
167	{ 12, 0 },
168	{ 13, 0 },
169	{ 14, 0 },
170	{ 15, 0 },
171	};
172
173	#endif /* BS3_INSTANTIATING_CMN - global */
174
175	#ifdef BS3_INSTANTIATING_CMN
176
177	/**
178	* Wrapper around Bs3TestFailedF that prefixes the error with g_usBs3TestStep
179	* and g_pszTestMode.
180	*/
181	# define bs3CpuBasic2_FailedF BS3_CMN_NM(bs3CpuBasic2_FailedF)
182	BS3_DECL_NEAR(void) bs3CpuBasic2_FailedF(const char *pszFormat, ...)
183	{
184	va_list va;
185
186	char szTmp[168];
187	va_start(va, pszFormat);
188	Bs3StrPrintfV(szTmp, sizeof(szTmp), pszFormat, va);
189	va_end(va);
190
191	Bs3TestFailedF("%u - %s: %s", g_usBs3TestStep, g_pszTestMode, szTmp);
192	}
193
194
195	/**
196	* Compares trap stuff.
197	*/
198	# define bs3CpuBasic2_CompareIntCtx1 BS3_CMN_NM(bs3CpuBasic2_CompareIntCtx1)
199	BS3_DECL_NEAR(void) bs3CpuBasic2_CompareIntCtx1(PCBS3TRAPFRAME pTrapCtx, PCBS3REGCTX pStartCtx, uint8_t bXcpt)
200	{
201	uint16_t const cErrorsBefore = Bs3TestSubErrorCount();
202	CHECK_MEMBER("bXcpt", "%#04x", pTrapCtx->bXcpt, bXcpt);
203	CHECK_MEMBER("bErrCd", "%#06RX64", pTrapCtx->uErrCd, 0);
204	Bs3TestCheckRegCtxEx(&pTrapCtx->Ctx, pStartCtx, 2 /int xx/, 0 /cbSpAdjust/, 0 /fExtraEfl/, g_pszTestMode, g_usBs3TestStep);
205	if (Bs3TestSubErrorCount() != cErrorsBefore)
206	{
207	Bs3TrapPrintFrame(pTrapCtx);
208	#if 1
209	Bs3TestPrintf("Halting: g_uBs3CpuDetected=%#x\n", g_uBs3CpuDetected);
210	Bs3TestPrintf("Halting in CompareTrapCtx1: bXcpt=%#x\n", bXcpt);
211	ASMHalt();
212	#endif
213	}
214	}
215
216
217	/**
218	* Compares trap stuff.
219	*/
220	# define bs3CpuBasic2_CompareTrapCtx2 BS3_CMN_NM(bs3CpuBasic2_CompareTrapCtx2)
221	BS3_DECL_NEAR(void) bs3CpuBasic2_CompareTrapCtx2(PCBS3TRAPFRAME pTrapCtx, PCBS3REGCTX pStartCtx, uint16_t cbIpAdjust,
222	uint8_t bXcpt, uint16_t uHandlerCs)
223	{
224	uint16_t const cErrorsBefore = Bs3TestSubErrorCount();
225	CHECK_MEMBER("bXcpt", "%#04x", pTrapCtx->bXcpt, bXcpt);
226	CHECK_MEMBER("bErrCd", "%#06RX64", pTrapCtx->uErrCd, 0);
227	CHECK_MEMBER("uHandlerCs", "%#06x", pTrapCtx->uHandlerCs, uHandlerCs);
228	Bs3TestCheckRegCtxEx(&pTrapCtx->Ctx, pStartCtx, cbIpAdjust, 0 /cbSpAdjust/, 0 /fExtraEfl/, g_pszTestMode, g_usBs3TestStep);
229	if (Bs3TestSubErrorCount() != cErrorsBefore)
230	{
231	Bs3TrapPrintFrame(pTrapCtx);
232	#if 1
233	Bs3TestPrintf("Halting: g_uBs3CpuDetected=%#x\n", g_uBs3CpuDetected);
234	Bs3TestPrintf("Halting in CompareTrapCtx2: bXcpt=%#x\n", bXcpt);
235	ASMHalt();
236	#endif
237	}
238	}
239
240	/**
241	* Compares a CPU trap.
242	*/
243	# define bs3CpuBasic2_CompareCpuTrapCtx BS3_CMN_NM(bs3CpuBasic2_CompareCpuTrapCtx)
244	BS3_DECL_NEAR(void) bs3CpuBasic2_CompareCpuTrapCtx(PCBS3TRAPFRAME pTrapCtx, PCBS3REGCTX pStartCtx, uint16_t uErrCd,
245	uint8_t bXcpt, bool f486ResumeFlagHint)
246	{
247	uint16_t const cErrorsBefore = Bs3TestSubErrorCount();
248	uint32_t fExtraEfl;
249
250	CHECK_MEMBER("bXcpt", "%#04x", pTrapCtx->bXcpt, bXcpt);
251	CHECK_MEMBER("bErrCd", "%#06RX16", (uint16_t)pTrapCtx->uErrCd, (uint16_t)uErrCd); /* 486 only writes a word */
252
253	fExtraEfl = X86_EFL_RF;
254	if ( g_f16BitSys
255	\|\| ( !f486ResumeFlagHint
256	&& (g_uBs3CpuDetected & BS3CPU_TYPE_MASK) <= BS3CPU_80486 ) )
257	fExtraEfl = 0;
258	else
259	fExtraEfl = X86_EFL_RF;
260	#if 0 /** @todo Running on an AMD Phenom II X6 1100T under AMD-V I'm not getting good X86_EFL_RF results. Enable this to get on with other work. */
261	fExtraEfl = pTrapCtx->Ctx.rflags.u32 & X86_EFL_RF;
262	#endif
263	Bs3TestCheckRegCtxEx(&pTrapCtx->Ctx, pStartCtx, 0 /cbIpAdjust/, 0 /cbSpAdjust/, fExtraEfl, g_pszTestMode, g_usBs3TestStep);
264	if (Bs3TestSubErrorCount() != cErrorsBefore)
265	{
266	Bs3TrapPrintFrame(pTrapCtx);
267	#if 1
268	Bs3TestPrintf("Halting: g_uBs3CpuDetected=%#x\n", g_uBs3CpuDetected);
269	Bs3TestPrintf("Halting: bXcpt=%#x uErrCd=%#x\n", bXcpt, uErrCd);
270	ASMHalt();
271	#endif
272	}
273	}
274
275
276	/**
277	* Compares \#GP trap.
278	*/
279	# define bs3CpuBasic2_CompareGpCtx BS3_CMN_NM(bs3CpuBasic2_CompareGpCtx)
280	BS3_DECL_NEAR(void) bs3CpuBasic2_CompareGpCtx(PCBS3TRAPFRAME pTrapCtx, PCBS3REGCTX pStartCtx, uint16_t uErrCd)
281	{
282	bs3CpuBasic2_CompareCpuTrapCtx(pTrapCtx, pStartCtx, uErrCd, X86_XCPT_GP, true /f486ResumeFlagHint/);
283	}
284
285	/**
286	* Compares \#NP trap.
287	*/
288	# define bs3CpuBasic2_CompareNpCtx BS3_CMN_NM(bs3CpuBasic2_CompareNpCtx)
289	BS3_DECL_NEAR(void) bs3CpuBasic2_CompareNpCtx(PCBS3TRAPFRAME pTrapCtx, PCBS3REGCTX pStartCtx, uint16_t uErrCd)
290	{
291	bs3CpuBasic2_CompareCpuTrapCtx(pTrapCtx, pStartCtx, uErrCd, X86_XCPT_NP, true /f486ResumeFlagHint/);
292	}
293
294	/**
295	* Compares \#SS trap.
296	*/
297	# define bs3CpuBasic2_CompareSsCtx BS3_CMN_NM(bs3CpuBasic2_CompareSsCtx)
298	BS3_DECL_NEAR(void) bs3CpuBasic2_CompareSsCtx(PCBS3TRAPFRAME pTrapCtx, PCBS3REGCTX pStartCtx, uint16_t uErrCd, bool f486ResumeFlagHint)
299	{
300	bs3CpuBasic2_CompareCpuTrapCtx(pTrapCtx, pStartCtx, uErrCd, X86_XCPT_SS, f486ResumeFlagHint);
301	}
302
303	/**
304	* Compares \#TS trap.
305	*/
306	# define bs3CpuBasic2_CompareTsCtx BS3_CMN_NM(bs3CpuBasic2_CompareTsCtx)
307	BS3_DECL_NEAR(void) bs3CpuBasic2_CompareTsCtx(PCBS3TRAPFRAME pTrapCtx, PCBS3REGCTX pStartCtx, uint16_t uErrCd)
308	{
309	bs3CpuBasic2_CompareCpuTrapCtx(pTrapCtx, pStartCtx, uErrCd, X86_XCPT_TS, false /f486ResumeFlagHint/);
310	}
311
312	/**
313	* Compares \#PF trap.
314	*/
315	# define bs3CpuBasic2_ComparePfCtx BS3_CMN_NM(bs3CpuBasic2_ComparePfCtx)
316	BS3_DECL_NEAR(void) bs3CpuBasic2_ComparePfCtx(PCBS3TRAPFRAME pTrapCtx, PBS3REGCTX pStartCtx, uint16_t uErrCd, uint64_t uCr2Expected)
317	{
318	uint64_t const uCr2Saved = pStartCtx->cr2.u;
319	pStartCtx->cr2.u = uCr2Expected;
320	bs3CpuBasic2_CompareCpuTrapCtx(pTrapCtx, pStartCtx, uErrCd, X86_XCPT_PF, true /f486ResumeFlagHint/);
321	pStartCtx->cr2.u = uCr2Saved;
322	}
323
324	/**
325	* Compares \#UD trap.
326	*/
327	# define bs3CpuBasic2_CompareUdCtx BS3_CMN_NM(bs3CpuBasic2_CompareUdCtx)
328	BS3_DECL_NEAR(void) bs3CpuBasic2_CompareUdCtx(PCBS3TRAPFRAME pTrapCtx, PCBS3REGCTX pStartCtx)
329	{
330	bs3CpuBasic2_CompareCpuTrapCtx(pTrapCtx, pStartCtx, 0 /no error code/, X86_XCPT_UD, true /f486ResumeFlagHint/);
331	}
332
333
334	# define bs3CpuBasic2_RaiseXcpt1Common BS3_CMN_NM(bs3CpuBasic2_RaiseXcpt1Common)
335	BS3_DECL_NEAR(void) bs3CpuBasic2_RaiseXcpt1Common(uint16_t const uSysR0Cs, uint16_t const uSysR0CsConf, uint16_t const uSysR0Ss,
336	PX86DESC const paIdt, unsigned const cIdteShift)
337	{
338	BS3TRAPFRAME TrapCtx;
339	BS3REGCTX Ctx80;
340	BS3REGCTX Ctx81;
341	BS3REGCTX Ctx82;
342	BS3REGCTX Ctx83;
343	BS3REGCTX CtxTmp;
344	BS3REGCTX CtxTmp2;
345	PBS3REGCTX apCtx8x[4];
346	unsigned iCtx;
347	unsigned iRing;
348	unsigned iDpl;
349	unsigned iRpl;
350	unsigned i, j, k;
351	uint32_t uExpected;
352	bool const f486Plus = (g_uBs3CpuDetected & BS3CPU_TYPE_MASK) >= BS3CPU_80486;
353	# if TMPL_BITS == 16
354	bool const f386Plus = (g_uBs3CpuDetected & BS3CPU_TYPE_MASK) >= BS3CPU_80386;
355	bool const f286 = (g_uBs3CpuDetected & BS3CPU_TYPE_MASK) == BS3CPU_80286;
356	# else
357	bool const f286 = false;
358	bool const f386Plus = true;
359	int rc;
360	uint8_t *pbIdtCopyAlloc;
361	PX86DESC pIdtCopy;
362	const unsigned cbIdte = 1 << (3 + cIdteShift);
363	RTCCUINTXREG uCr0Saved = ASMGetCR0();
364	RTGDTR GdtrSaved;
365	# endif
366	RTIDTR IdtrSaved;
367	RTIDTR Idtr;
368
369	ASMGetIDTR(&IdtrSaved);
370	# if TMPL_BITS != 16
371	ASMGetGDTR(&GdtrSaved);
372	# endif
373
374	/* make sure they're allocated */
375	Bs3MemZero(&TrapCtx, sizeof(TrapCtx));
376	Bs3MemZero(&Ctx80, sizeof(Ctx80));
377	Bs3MemZero(&Ctx81, sizeof(Ctx81));
378	Bs3MemZero(&Ctx82, sizeof(Ctx82));
379	Bs3MemZero(&Ctx83, sizeof(Ctx83));
380	Bs3MemZero(&CtxTmp, sizeof(CtxTmp));
381	Bs3MemZero(&CtxTmp2, sizeof(CtxTmp2));
382
383	/* Context array. */
384	apCtx8x[0] = &Ctx80;
385	apCtx8x[1] = &Ctx81;
386	apCtx8x[2] = &Ctx82;
387	apCtx8x[3] = &Ctx83;
388
389	# if TMPL_BITS != 16
390	/* Allocate memory for playing around with the IDT. */
391	pbIdtCopyAlloc = NULL;
392	if (BS3_MODE_IS_PAGED(g_bTestMode))
393	pbIdtCopyAlloc = Bs3MemAlloc(BS3MEMKIND_FLAT32, 12*_1K);
394	# endif
395
396	/*
397	* IDT entry 80 thru 83 are assigned DPLs according to the number.
398	* (We'll be useing more, but this'll do for now.)
399	*/
400	paIdt[0x80 << cIdteShift].Gate.u2Dpl = 0;
401	paIdt[0x81 << cIdteShift].Gate.u2Dpl = 1;
402	paIdt[0x82 << cIdteShift].Gate.u2Dpl = 2;
403	paIdt[0x83 << cIdteShift].Gate.u2Dpl = 3;
404
405	Bs3RegCtxSave(&Ctx80);
406	Ctx80.rsp.u -= 0x300;
407	Ctx80.rip.u = (uintptr_t)BS3_FP_OFF(&bs3CpuBasic2_Int80);
408	# if TMPL_BITS == 16
409	Ctx80.cs = BS3_MODE_IS_RM_OR_V86(g_bTestMode) ? BS3_SEL_TEXT16 : BS3_SEL_R0_CS16;
410	# elif TMPL_BITS == 32
411	g_uBs3TrapEipHint = Ctx80.rip.u32;
412	# endif
413	Bs3MemCpy(&Ctx81, &Ctx80, sizeof(Ctx80));
414	Ctx81.rip.u = (uintptr_t)BS3_FP_OFF(&bs3CpuBasic2_Int81);
415	Bs3MemCpy(&Ctx82, &Ctx80, sizeof(Ctx80));
416	Ctx82.rip.u = (uintptr_t)BS3_FP_OFF(&bs3CpuBasic2_Int82);
417	Bs3MemCpy(&Ctx83, &Ctx80, sizeof(Ctx80));
418	Ctx83.rip.u = (uintptr_t)BS3_FP_OFF(&bs3CpuBasic2_Int83);
419
420	/*
421	* Check that all the above gates work from ring-0.
422	*/
423	for (iCtx = 0; iCtx < RT_ELEMENTS(apCtx8x); iCtx++)
424	{
425	g_usBs3TestStep = iCtx;
426	# if TMPL_BITS == 32
427	g_uBs3TrapEipHint = apCtx8x[iCtx]->rip.u32;
428	# endif
429	Bs3TrapSetJmpAndRestore(apCtx8x[iCtx], &TrapCtx);
430	bs3CpuBasic2_CompareIntCtx1(&TrapCtx, apCtx8x[iCtx], 0x80+iCtx /bXcpt/);
431	}
432
433	/*
434	* Check that the gate DPL checks works.
435	*/
436	g_usBs3TestStep = 100;
437	for (iRing = 0; iRing <= 3; iRing++)
438	{
439	for (iCtx = 0; iCtx < RT_ELEMENTS(apCtx8x); iCtx++)
440	{
441	Bs3MemCpy(&CtxTmp, apCtx8x[iCtx], sizeof(CtxTmp));
442	Bs3RegCtxConvertToRingX(&CtxTmp, iRing);
443	# if TMPL_BITS == 32
444	g_uBs3TrapEipHint = CtxTmp.rip.u32;
445	# endif
446	Bs3TrapSetJmpAndRestore(&CtxTmp, &TrapCtx);
447	if (iCtx < iRing)
448	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &CtxTmp, ((0x80 + iCtx) << X86_TRAP_ERR_SEL_SHIFT) \| X86_TRAP_ERR_IDT);
449	else
450	bs3CpuBasic2_CompareIntCtx1(&TrapCtx, &CtxTmp, 0x80 + iCtx /bXcpt/);
451	g_usBs3TestStep++;
452	}
453	}
454
455	/*
456	* Modify the gate CS value and run the handler at a different CPL.
457	* Throw RPL variations into the mix (completely ignored) together
458	* with gate presence.
459	* 1. CPL <= GATE.DPL
460	* 2. GATE.P
461	* 3. GATE.CS.DPL <= CPL (non-conforming segments)
462	*/
463	g_usBs3TestStep = 1000;
464	for (i = 0; i <= 3; i++)
465	{
466	for (iRing = 0; iRing <= 3; iRing++)
467	{
468	for (iCtx = 0; iCtx < RT_ELEMENTS(apCtx8x); iCtx++)
469	{
470	# if TMPL_BITS == 32
471	g_uBs3TrapEipHint = apCtx8x[iCtx]->rip.u32;
472	# endif
473	Bs3MemCpy(&CtxTmp, apCtx8x[iCtx], sizeof(CtxTmp));
474	Bs3RegCtxConvertToRingX(&CtxTmp, iRing);
475
476	for (j = 0; j <= 3; j++)
477	{
478	uint16_t const uCs = (uSysR0Cs \| j) + (i << BS3_SEL_RING_SHIFT);
479	for (k = 0; k < 2; k++)
480	{
481	g_usBs3TestStep++;
482	/Bs3TestPrintf("g_usBs3TestStep=%u iCtx=%u iRing=%u i=%u uCs=%04x\n", g_usBs3TestStep, iCtx, iRing, i, uCs);/
483	paIdt[(0x80 + iCtx) << cIdteShift].Gate.u16Sel = uCs;
484	paIdt[(0x80 + iCtx) << cIdteShift].Gate.u1Present = k;
485	Bs3TrapSetJmpAndRestore(&CtxTmp, &TrapCtx);
486	/Bs3TrapPrintFrame(&TrapCtx);/
487	if (iCtx < iRing)
488	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &CtxTmp, ((0x80 + iCtx) << X86_TRAP_ERR_SEL_SHIFT) \| X86_TRAP_ERR_IDT);
489	else if (k == 0)
490	bs3CpuBasic2_CompareNpCtx(&TrapCtx, &CtxTmp, ((0x80 + iCtx) << X86_TRAP_ERR_SEL_SHIFT) \| X86_TRAP_ERR_IDT);
491	else if (i > iRing)
492	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &CtxTmp, uCs & X86_SEL_MASK_OFF_RPL);
493	else
494	{
495	uint16_t uExpectedCs = uCs & X86_SEL_MASK_OFF_RPL;
496	if (i <= iCtx && i <= iRing)
497	uExpectedCs \|= i;
498	bs3CpuBasic2_CompareTrapCtx2(&TrapCtx, &CtxTmp, 2 /int 8xh/, 0x80 + iCtx /bXcpt/, uExpectedCs);
499	}
500	}
501	}
502
503	paIdt[(0x80 + iCtx) << cIdteShift].Gate.u16Sel = uSysR0Cs;
504	paIdt[(0x80 + iCtx) << cIdteShift].Gate.u1Present = 1;
505	}
506	}
507	}
508	BS3_ASSERT(g_usBs3TestStep < 1600);
509
510	/*
511	* Various CS and SS related faults
512	*
513	* We temporarily reconfigure gate 80 and 83 with new CS selectors, the
514	* latter have a CS.DPL of 2 for testing ring transisions and SS loading
515	* without making it impossible to handle faults.
516	*/
517	g_usBs3TestStep = 1600;
518	Bs3GdteTestPage00 = Bs3Gdt[uSysR0Cs >> X86_SEL_SHIFT];
519	Bs3GdteTestPage00.Gen.u1Present = 0;
520	Bs3GdteTestPage00.Gen.u4Type &= ~X86_SEL_TYPE_ACCESSED;
521	paIdt[0x80 << cIdteShift].Gate.u16Sel = BS3_SEL_TEST_PAGE_00;
522
523	/* CS.PRESENT = 0 */
524	Bs3TrapSetJmpAndRestore(&Ctx80, &TrapCtx);
525	bs3CpuBasic2_CompareNpCtx(&TrapCtx, &Ctx80, BS3_SEL_TEST_PAGE_00);
526	if (Bs3GdteTestPage00.Gen.u4Type & X86_SEL_TYPE_ACCESSED)
527	bs3CpuBasic2_FailedF("selector was accessed");
528	g_usBs3TestStep++;
529
530	/* Check that GATE.DPL is checked before CS.PRESENT. */
531	for (iRing = 1; iRing < 4; iRing++)
532	{
533	Bs3MemCpy(&CtxTmp, &Ctx80, sizeof(CtxTmp));
534	Bs3RegCtxConvertToRingX(&CtxTmp, iRing);
535	Bs3TrapSetJmpAndRestore(&CtxTmp, &TrapCtx);
536	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &CtxTmp, (0x80 << X86_TRAP_ERR_SEL_SHIFT) \| X86_TRAP_ERR_IDT);
537	if (Bs3GdteTestPage00.Gen.u4Type & X86_SEL_TYPE_ACCESSED)
538	bs3CpuBasic2_FailedF("selector was accessed");
539	g_usBs3TestStep++;
540	}
541
542	/* CS.DPL mismatch takes precedence over CS.PRESENT = 0. */
543	Bs3GdteTestPage00.Gen.u4Type &= ~X86_SEL_TYPE_ACCESSED;
544	Bs3TrapSetJmpAndRestore(&Ctx80, &TrapCtx);
545	bs3CpuBasic2_CompareNpCtx(&TrapCtx, &Ctx80, BS3_SEL_TEST_PAGE_00);
546	if (Bs3GdteTestPage00.Gen.u4Type & X86_SEL_TYPE_ACCESSED)
547	bs3CpuBasic2_FailedF("CS selector was accessed");
548	g_usBs3TestStep++;
549	for (iDpl = 1; iDpl < 4; iDpl++)
550	{
551	Bs3GdteTestPage00.Gen.u2Dpl = iDpl;
552	Bs3TrapSetJmpAndRestore(&Ctx80, &TrapCtx);
553	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &Ctx80, BS3_SEL_TEST_PAGE_00);
554	if (Bs3GdteTestPage00.Gen.u4Type & X86_SEL_TYPE_ACCESSED)
555	bs3CpuBasic2_FailedF("CS selector was accessed");
556	g_usBs3TestStep++;
557	}
558
559	/* 1608: Check all the invalid CS selector types alone. */
560	Bs3GdteTestPage00 = Bs3Gdt[uSysR0Cs >> X86_SEL_SHIFT];
561	for (i = 0; i < RT_ELEMENTS(g_aInvalidCsTypes); i++)
562	{
563	Bs3GdteTestPage00.Gen.u4Type = g_aInvalidCsTypes[i].u4Type;
564	Bs3GdteTestPage00.Gen.u1DescType = g_aInvalidCsTypes[i].u1DescType;
565	Bs3TrapSetJmpAndRestore(&Ctx80, &TrapCtx);
566	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &Ctx80, BS3_SEL_TEST_PAGE_00);
567	if (Bs3GdteTestPage00.Gen.u4Type != g_aInvalidCsTypes[i].u4Type)
568	bs3CpuBasic2_FailedF("Invalid CS type %#x/%u -> %#x/%u\n",
569	g_aInvalidCsTypes[i].u4Type, g_aInvalidCsTypes[i].u1DescType,
570	Bs3GdteTestPage00.Gen.u4Type, Bs3GdteTestPage00.Gen.u1DescType);
571	g_usBs3TestStep++;
572
573	/* Incorrect CS.TYPE takes precedence over CS.PRESENT = 0. */
574	Bs3GdteTestPage00.Gen.u1Present = 0;
575	Bs3TrapSetJmpAndRestore(&Ctx80, &TrapCtx);
576	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &Ctx80, BS3_SEL_TEST_PAGE_00);
577	Bs3GdteTestPage00.Gen.u1Present = 1;
578	g_usBs3TestStep++;
579	}
580
581	/* Fix CS again. */
582	Bs3GdteTestPage00 = Bs3Gdt[uSysR0Cs >> X86_SEL_SHIFT];
583
584	/* 1632: Test SS. */
585	if (!BS3_MODE_IS_64BIT_SYS(g_bTestMode))
586	{
587	uint16_t BS3_FAR *puTssSs2 = BS3_MODE_IS_16BIT_SYS(g_bTestMode) ? &Bs3Tss16.ss2 : &Bs3Tss32.ss2;
588	uint16_t const uSavedSs2 = *puTssSs2;
589	X86DESC const SavedGate83 = paIdt[0x83 << cIdteShift];
590
591	/* Make the handler execute in ring-2. */
592	Bs3GdteTestPage02 = Bs3Gdt[(uSysR0Cs + (2 << BS3_SEL_RING_SHIFT)) >> X86_SEL_SHIFT];
593	Bs3GdteTestPage02.Gen.u4Type &= ~X86_SEL_TYPE_ACCESSED;
594	paIdt[0x83 << cIdteShift].Gate.u16Sel = BS3_SEL_TEST_PAGE_02 \| 2;
595
596	Bs3MemCpy(&CtxTmp, &Ctx83, sizeof(CtxTmp));
597	Bs3RegCtxConvertToRingX(&CtxTmp, 3); /* yeah, from 3 so SS:xSP is reloaded. */
598	Bs3TrapSetJmpAndRestore(&CtxTmp, &TrapCtx);
599	bs3CpuBasic2_CompareIntCtx1(&TrapCtx, &CtxTmp, 0x83);
600	if (!(Bs3GdteTestPage02.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
601	bs3CpuBasic2_FailedF("CS selector was not access");
602	g_usBs3TestStep++;
603
604	/* Create a SS.DPL=2 stack segment and check that SS2.RPL matters and
605	that we get #SS if the selector isn't present. */
606	i = 0; /* used for cycling thru invalid CS types */
607	for (k = 0; k < 10; k++)
608	{
609	/* k=0: present,
610	k=1: not-present,
611	k=2: present but very low limit,
612	k=3: not-present, low limit.
613	k=4: present, read-only.
614	k=5: not-present, read-only.
615	k=6: present, code-selector.
616	k=7: not-present, code-selector.
617	k=8: present, read-write / no access + system (=LDT).
618	k=9: not-present, read-write / no access + system (=LDT).
619	*/
620	Bs3GdteTestPage03 = Bs3Gdt[(uSysR0Ss + (2 << BS3_SEL_RING_SHIFT)) >> X86_SEL_SHIFT];
621	Bs3GdteTestPage03.Gen.u1Present = !(k & 1);
622	if (k >= 8)
623	{
624	Bs3GdteTestPage03.Gen.u1DescType = 0; /* system */
625	Bs3GdteTestPage03.Gen.u4Type = X86_SEL_TYPE_RW; /* = LDT */
626	}
627	else if (k >= 6)
628	Bs3GdteTestPage03.Gen.u4Type = X86_SEL_TYPE_ER;
629	else if (k >= 4)
630	Bs3GdteTestPage03.Gen.u4Type = X86_SEL_TYPE_RO;
631	else if (k >= 2)
632	{
633	Bs3GdteTestPage03.Gen.u16LimitLow = 0x400;
634	Bs3GdteTestPage03.Gen.u4LimitHigh = 0;
635	Bs3GdteTestPage03.Gen.u1Granularity = 0;
636	}
637
638	for (iDpl = 0; iDpl < 4; iDpl++)
639	{
640	Bs3GdteTestPage03.Gen.u2Dpl = iDpl;
641
642	for (iRpl = 0; iRpl < 4; iRpl++)
643	{
644	*puTssSs2 = BS3_SEL_TEST_PAGE_03 \| iRpl;
645	//Bs3TestPrintf("k=%u iDpl=%u iRpl=%u step=%u\n", k, iDpl, iRpl, g_usBs3TestStep);
646	Bs3GdteTestPage02.Gen.u4Type &= ~X86_SEL_TYPE_ACCESSED;
647	Bs3GdteTestPage03.Gen.u4Type &= ~X86_SEL_TYPE_ACCESSED;
648	Bs3TrapSetJmpAndRestore(&CtxTmp, &TrapCtx);
649	if (iRpl != 2 \|\| iRpl != iDpl \|\| k >= 4)
650	bs3CpuBasic2_CompareTsCtx(&TrapCtx, &CtxTmp, BS3_SEL_TEST_PAGE_03);
651	else if (k != 0)
652	bs3CpuBasic2_CompareSsCtx(&TrapCtx, &CtxTmp, BS3_SEL_TEST_PAGE_03,
653	k == 2 /f486ResumeFlagHint/);
654	else
655	{
656	bs3CpuBasic2_CompareIntCtx1(&TrapCtx, &CtxTmp, 0x83);
657	if (TrapCtx.uHandlerSs != (BS3_SEL_TEST_PAGE_03 \| 2))
658	bs3CpuBasic2_FailedF("uHandlerSs=%#x expected %#x\n", TrapCtx.uHandlerSs, BS3_SEL_TEST_PAGE_03 \| 2);
659	}
660	if (!(Bs3GdteTestPage02.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
661	bs3CpuBasic2_FailedF("CS selector was not access");
662	if ( TrapCtx.bXcpt == 0x83
663	\|\| (TrapCtx.bXcpt == X86_XCPT_SS && k == 2) )
664	{
665	if (!(Bs3GdteTestPage03.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
666	bs3CpuBasic2_FailedF("SS selector was not accessed");
667	}
668	else if (Bs3GdteTestPage03.Gen.u4Type & X86_SEL_TYPE_ACCESSED)
669	bs3CpuBasic2_FailedF("SS selector was accessed");
670	g_usBs3TestStep++;
671
672	/* +1: Modify the gate DPL to check that this is checked before SS.DPL and SS.PRESENT. */
673	paIdt[0x83 << cIdteShift].Gate.u2Dpl = 2;
674	Bs3TrapSetJmpAndRestore(&CtxTmp, &TrapCtx);
675	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &CtxTmp, (0x83 << X86_TRAP_ERR_SEL_SHIFT) \| X86_TRAP_ERR_IDT);
676	paIdt[0x83 << cIdteShift].Gate.u2Dpl = 3;
677	g_usBs3TestStep++;
678
679	/* +2: Check the CS.DPL check is done before the SS ones. Restoring the
680	ring-0 INT 83 context triggers the CS.DPL < CPL check. */
681	Bs3TrapSetJmpAndRestore(&Ctx83, &TrapCtx);
682	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &Ctx83, BS3_SEL_TEST_PAGE_02);
683	g_usBs3TestStep++;
684
685	/* +3: Now mark the CS selector not present and check that that also triggers before SS stuff. */
686	Bs3GdteTestPage02.Gen.u1Present = 0;
687	Bs3TrapSetJmpAndRestore(&CtxTmp, &TrapCtx);
688	bs3CpuBasic2_CompareNpCtx(&TrapCtx, &CtxTmp, BS3_SEL_TEST_PAGE_02);
689	Bs3GdteTestPage02.Gen.u1Present = 1;
690	g_usBs3TestStep++;
691
692	/* +4: Make the CS selector some invalid type and check it triggers before SS stuff. */
693	Bs3GdteTestPage02.Gen.u4Type = g_aInvalidCsTypes[i].u4Type;
694	Bs3GdteTestPage02.Gen.u1DescType = g_aInvalidCsTypes[i].u1DescType;
695	Bs3TrapSetJmpAndRestore(&CtxTmp, &TrapCtx);
696	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &CtxTmp, BS3_SEL_TEST_PAGE_02);
697	Bs3GdteTestPage02.Gen.u4Type = X86_SEL_TYPE_ER_ACC;
698	Bs3GdteTestPage02.Gen.u1DescType = 1;
699	g_usBs3TestStep++;
700
701	/* +5: Now, make the CS selector limit too small and that it triggers after SS trouble.
702	The 286 had a simpler approach to these GP(0). */
703	Bs3GdteTestPage02.Gen.u16LimitLow = 0;
704	Bs3GdteTestPage02.Gen.u4LimitHigh = 0;
705	Bs3GdteTestPage02.Gen.u1Granularity = 0;
706	Bs3TrapSetJmpAndRestore(&CtxTmp, &TrapCtx);
707	if (f286)
708	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &CtxTmp, 0 /uErrCd/);
709	else if (iRpl != 2 \|\| iRpl != iDpl \|\| k >= 4)
710	bs3CpuBasic2_CompareTsCtx(&TrapCtx, &CtxTmp, BS3_SEL_TEST_PAGE_03);
711	else if (k != 0)
712	bs3CpuBasic2_CompareSsCtx(&TrapCtx, &CtxTmp, BS3_SEL_TEST_PAGE_03, k == 2 /f486ResumeFlagHint/);
713	else
714	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &CtxTmp, 0 /uErrCd/);
715	Bs3GdteTestPage02 = Bs3Gdt[(uSysR0Cs + (2 << BS3_SEL_RING_SHIFT)) >> X86_SEL_SHIFT];
716	g_usBs3TestStep++;
717	}
718	}
719	}
720
721	/* Check all the invalid SS selector types alone. */
722	Bs3GdteTestPage02 = Bs3Gdt[(uSysR0Cs + (2 << BS3_SEL_RING_SHIFT)) >> X86_SEL_SHIFT];
723	Bs3GdteTestPage03 = Bs3Gdt[(uSysR0Ss + (2 << BS3_SEL_RING_SHIFT)) >> X86_SEL_SHIFT];
724	*puTssSs2 = BS3_SEL_TEST_PAGE_03 \| 2;
725	Bs3TrapSetJmpAndRestore(&CtxTmp, &TrapCtx);
726	bs3CpuBasic2_CompareIntCtx1(&TrapCtx, &CtxTmp, 0x83);
727	g_usBs3TestStep++;
728	for (i = 0; i < RT_ELEMENTS(g_aInvalidSsTypes); i++)
729	{
730	Bs3GdteTestPage03.Gen.u4Type = g_aInvalidSsTypes[i].u4Type;
731	Bs3GdteTestPage03.Gen.u1DescType = g_aInvalidSsTypes[i].u1DescType;
732	Bs3TrapSetJmpAndRestore(&CtxTmp, &TrapCtx);
733	bs3CpuBasic2_CompareTsCtx(&TrapCtx, &CtxTmp, BS3_SEL_TEST_PAGE_03);
734	if (Bs3GdteTestPage03.Gen.u4Type != g_aInvalidSsTypes[i].u4Type)
735	bs3CpuBasic2_FailedF("Invalid SS type %#x/%u -> %#x/%u\n",
736	g_aInvalidSsTypes[i].u4Type, g_aInvalidSsTypes[i].u1DescType,
737	Bs3GdteTestPage03.Gen.u4Type, Bs3GdteTestPage03.Gen.u1DescType);
738	g_usBs3TestStep++;
739	}
740
741	/*
742	* Continue the SS experiments with a expand down segment. We'll use
743	* the same setup as we already have with gate 83h being DPL and
744	* having CS.DPL=2.
745	*
746	* Expand down segments are weird. The valid area is practically speaking
747	* reversed. So, a 16-bit segment with a limit of 0x6000 will have valid
748	* addresses from 0xffff thru 0x6001.
749	*
750	* So, with expand down segments we can more easily cut partially into the
751	* pushing of the iret frame and trigger more interesting behavior than
752	* with regular "expand up" segments where the whole pushing area is either
753	* all fine or not not fine.
754	*/
755	Bs3GdteTestPage02 = Bs3Gdt[(uSysR0Cs + (2 << BS3_SEL_RING_SHIFT)) >> X86_SEL_SHIFT];
756	Bs3GdteTestPage03 = Bs3Gdt[(uSysR0Ss + (2 << BS3_SEL_RING_SHIFT)) >> X86_SEL_SHIFT];
757	Bs3GdteTestPage03.Gen.u2Dpl = 2;
758	Bs3GdteTestPage03.Gen.u4Type = X86_SEL_TYPE_RW_DOWN;
759	*puTssSs2 = BS3_SEL_TEST_PAGE_03 \| 2;
760
761	/* First test, limit = max --> no bytes accessible --> #GP */
762	Bs3TrapSetJmpAndRestore(&CtxTmp, &TrapCtx);
763	bs3CpuBasic2_CompareSsCtx(&TrapCtx, &CtxTmp, BS3_SEL_TEST_PAGE_03, true /f486ResumeFlagHint/);
764
765	/* Second test, limit = 0 --> all by zero byte accessible --> works */
766	Bs3GdteTestPage03.Gen.u16LimitLow = 0;
767	Bs3GdteTestPage03.Gen.u4LimitHigh = 0;
768	Bs3TrapSetJmpAndRestore(&CtxTmp, &TrapCtx);
769	bs3CpuBasic2_CompareIntCtx1(&TrapCtx, &CtxTmp, 0x83);
770
771	/* Modify the gate handler to be a dummy that immediately does UD2
772	and triggers #UD, then advance the limit down till we get the #UD. */
773	Bs3GdteTestPage03.Gen.u1Granularity = 0;
774
775	Bs3MemCpy(&CtxTmp2, &CtxTmp, sizeof(CtxTmp2)); /* #UD result context */
776	if (g_f16BitSys)
777	{
778	CtxTmp2.rip.u = g_bs3CpuBasic2_ud2_FlatAddr - BS3_ADDR_BS3TEXT16;
779	Bs3Trap16SetGate(0x83, X86_SEL_TYPE_SYS_286_INT_GATE, 3, BS3_SEL_TEST_PAGE_02, CtxTmp2.rip.u16, 0 /cParams/);
780	CtxTmp2.rsp.u = Bs3Tss16.sp2 - 2*5;
781	}
782	else
783	{
784	CtxTmp2.rip.u = g_bs3CpuBasic2_ud2_FlatAddr;
785	Bs3Trap32SetGate(0x83, X86_SEL_TYPE_SYS_386_INT_GATE, 3, BS3_SEL_TEST_PAGE_02, CtxTmp2.rip.u32, 0 /cParams/);
786	CtxTmp2.rsp.u = Bs3Tss32.esp2 - 4*5;
787	}
788	CtxTmp2.bMode = g_bTestMode; /* g_bBs3CurrentMode not changed by the UD2 handler. */
789	CtxTmp2.cs = BS3_SEL_TEST_PAGE_02 \| 2;
790	CtxTmp2.ss = BS3_SEL_TEST_PAGE_03 \| 2;
791	CtxTmp2.bCpl = 2;
792
793	/* test run. */
794	Bs3TrapSetJmpAndRestore(&CtxTmp, &TrapCtx);
795	bs3CpuBasic2_CompareUdCtx(&TrapCtx, &CtxTmp2);
796	g_usBs3TestStep++;
797
798	/* Real run. */
799	i = (g_f16BitSys ? 2 : 4) * 6 + 1;
800	while (i-- > 0)
801	{
802	Bs3GdteTestPage03.Gen.u16LimitLow = CtxTmp2.rsp.u16 + i - 1;
803	Bs3TrapSetJmpAndRestore(&CtxTmp, &TrapCtx);
804	if (i > 0)
805	bs3CpuBasic2_CompareSsCtx(&TrapCtx, &CtxTmp, BS3_SEL_TEST_PAGE_03, true /f486ResumeFlagHint/);
806	else
807	bs3CpuBasic2_CompareUdCtx(&TrapCtx, &CtxTmp2);
808	g_usBs3TestStep++;
809	}
810
811	/* Do a run where we do the same-ring kind of access. */
812	Bs3RegCtxConvertToRingX(&CtxTmp, 2);
813	if (g_f16BitSys)
814	{
815	CtxTmp2.rsp.u32 = CtxTmp.rsp.u32 - 2*3;
816	i = 2*3 - 1;
817	}
818	else
819	{
820	CtxTmp2.rsp.u32 = CtxTmp.rsp.u32 - 4*3;
821	i = 4*3 - 1;
822	}
823	CtxTmp.ss = BS3_SEL_TEST_PAGE_03 \| 2;
824	CtxTmp2.ds = CtxTmp.ds;
825	CtxTmp2.es = CtxTmp.es;
826	CtxTmp2.fs = CtxTmp.fs;
827	CtxTmp2.gs = CtxTmp.gs;
828	while (i-- > 0)
829	{
830	Bs3GdteTestPage03.Gen.u16LimitLow = CtxTmp2.rsp.u16 + i - 1;
831	Bs3TrapSetJmpAndRestore(&CtxTmp, &TrapCtx);
832	if (i > 0)
833	bs3CpuBasic2_CompareSsCtx(&TrapCtx, &CtxTmp, 0 /BS3_SEL_TEST_PAGE_03/, true /f486ResumeFlagHint/);
834	else
835	bs3CpuBasic2_CompareUdCtx(&TrapCtx, &CtxTmp2);
836	g_usBs3TestStep++;
837	}
838
839	*puTssSs2 = uSavedSs2;
840	paIdt[0x83 << cIdteShift] = SavedGate83;
841	}
842	paIdt[0x80 << cIdteShift].Gate.u16Sel = uSysR0Cs;
843	BS3_ASSERT(g_usBs3TestStep < 3000);
844
845	/*
846	* Modify the gate CS value with a conforming segment.
847	*/
848	g_usBs3TestStep = 3000;
849	for (i = 0; i <= 3; i++) /* cs.dpl */
850	{
851	for (iRing = 0; iRing <= 3; iRing++)
852	{
853	for (iCtx = 0; iCtx < RT_ELEMENTS(apCtx8x); iCtx++)
854	{
855	Bs3MemCpy(&CtxTmp, apCtx8x[iCtx], sizeof(CtxTmp));
856	Bs3RegCtxConvertToRingX(&CtxTmp, iRing);
857	# if TMPL_BITS == 32
858	g_uBs3TrapEipHint = CtxTmp.rip.u32;
859	# endif
860
861	for (j = 0; j <= 3; j++) /* rpl */
862	{
863	uint16_t const uCs = (uSysR0CsConf \| j) + (i << BS3_SEL_RING_SHIFT);
864	/Bs3TestPrintf("g_usBs3TestStep=%u iCtx=%u iRing=%u i=%u uCs=%04x\n", g_usBs3TestStep, iCtx, iRing, i, uCs);/
865	paIdt[(0x80 + iCtx) << cIdteShift].Gate.u16Sel = uCs;
866	Bs3TrapSetJmpAndRestore(&CtxTmp, &TrapCtx);
867	//Bs3TestPrintf("%u/%u/%u/%u: cs=%04x hcs=%04x xcpt=%02x\n", i, iRing, iCtx, j, uCs, TrapCtx.uHandlerCs, TrapCtx.bXcpt);
868	/Bs3TrapPrintFrame(&TrapCtx);/
869	g_usBs3TestStep++;
870	if (iCtx < iRing)
871	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &CtxTmp, ((0x80 + iCtx) << X86_TRAP_ERR_SEL_SHIFT) \| X86_TRAP_ERR_IDT);
872	else if (i > iRing)
873	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &CtxTmp, uCs & X86_SEL_MASK_OFF_RPL);
874	else
875	bs3CpuBasic2_CompareIntCtx1(&TrapCtx, &CtxTmp, 0x80 + iCtx /bXcpt/);
876	}
877	paIdt[(0x80 + iCtx) << cIdteShift].Gate.u16Sel = uSysR0Cs;
878	}
879	}
880	}
881	BS3_ASSERT(g_usBs3TestStep < 3500);
882
883	/*
884	* The gates must be 64-bit in long mode.
885	*/
886	if (cIdteShift != 0)
887	{
888	g_usBs3TestStep = 3500;
889	for (i = 0; i <= 3; i++)
890	{
891	for (iRing = 0; iRing <= 3; iRing++)
892	{
893	for (iCtx = 0; iCtx < RT_ELEMENTS(apCtx8x); iCtx++)
894	{
895	Bs3MemCpy(&CtxTmp, apCtx8x[iCtx], sizeof(CtxTmp));
896	Bs3RegCtxConvertToRingX(&CtxTmp, iRing);
897
898	for (j = 0; j < 2; j++)
899	{
900	static const uint16_t s_auCSes[2] = { BS3_SEL_R0_CS16, BS3_SEL_R0_CS32 };
901	uint16_t uCs = (s_auCSes[j] \| i) + (i << BS3_SEL_RING_SHIFT);
902	g_usBs3TestStep++;
903	/Bs3TestPrintf("g_usBs3TestStep=%u iCtx=%u iRing=%u i=%u uCs=%04x\n", g_usBs3TestStep, iCtx, iRing, i, uCs);/
904	paIdt[(0x80 + iCtx) << cIdteShift].Gate.u16Sel = uCs;
905	Bs3TrapSetJmpAndRestore(&CtxTmp, &TrapCtx);
906	/Bs3TrapPrintFrame(&TrapCtx);/
907	if (iCtx < iRing)
908	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &CtxTmp, ((0x80 + iCtx) << X86_TRAP_ERR_SEL_SHIFT) \| X86_TRAP_ERR_IDT);
909	else
910	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &CtxTmp, uCs & X86_SEL_MASK_OFF_RPL);
911	}
912	paIdt[(0x80 + iCtx) << cIdteShift].Gate.u16Sel = uSysR0Cs;
913	}
914	}
915	}
916	BS3_ASSERT(g_usBs3TestStep < 4000);
917	}
918
919	/*
920	* IDT limit check. The 286 does not access X86DESCGATE::u16OffsetHigh.
921	*/
922	g_usBs3TestStep = 5000;
923	i = (0x80 << (cIdteShift + 3)) - 1;
924	j = (0x82 << (cIdteShift + 3)) - (!f286 ? 1 : 3);
925	k = (0x83 << (cIdteShift + 3)) - 1;
926	for (; i <= k; i++, g_usBs3TestStep++)
927	{
928	Idtr = IdtrSaved;
929	Idtr.cbIdt = i;
930	ASMSetIDTR(&Idtr);
931	Bs3TrapSetJmpAndRestore(&Ctx81, &TrapCtx);
932	if (i < j)
933	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &Ctx81, (0x81 << X86_TRAP_ERR_SEL_SHIFT) \| X86_TRAP_ERR_IDT);
934	else
935	bs3CpuBasic2_CompareIntCtx1(&TrapCtx, &Ctx81, 0x81 /bXcpt/);
936	}
937	ASMSetIDTR(&IdtrSaved);
938	BS3_ASSERT(g_usBs3TestStep < 5100);
939
940	# if TMPL_BITS != 16 /* Only do the paging related stuff in 32-bit and 64-bit modes. */
941
942	/*
943	* IDT page not present. Placing the IDT copy such that 0x80 is on the
944	* first page and 0x81 is on the second page. We need proceed to move
945	* it down byte by byte to check that any inaccessible byte means #PF.
946	*
947	* Note! We must reload the alternative IDTR for each run as any kind of
948	* printing to the string (like error reporting) will cause a switch
949	* to real mode and back, reloading the default IDTR.
950	*/
951	g_usBs3TestStep = 5200;
952	if (BS3_MODE_IS_PAGED(g_bTestMode) && pbIdtCopyAlloc)
953	{
954	uint32_t const uCr2Expected = Bs3SelPtrToFlat(pbIdtCopyAlloc) + _4K;
955	for (j = 0; j < cbIdte; j++)
956	{
957	pIdtCopy = (PX86DESC)&pbIdtCopyAlloc[_4K - cbIdte * 0x81 - j];
958	Bs3MemCpy(pIdtCopy, paIdt, cbIdte * 256);
959
960	Idtr.cbIdt = IdtrSaved.cbIdt;
961	Idtr.pIdt = Bs3SelPtrToFlat(pIdtCopy);
962
963	ASMSetIDTR(&Idtr);
964	Bs3TrapSetJmpAndRestore(&Ctx81, &TrapCtx);
965	bs3CpuBasic2_CompareIntCtx1(&TrapCtx, &Ctx81, 0x81 /bXcpt/);
966	g_usBs3TestStep++;
967
968	ASMSetIDTR(&Idtr);
969	Bs3TrapSetJmpAndRestore(&Ctx80, &TrapCtx);
970	bs3CpuBasic2_CompareIntCtx1(&TrapCtx, &Ctx80, 0x80 /bXcpt/);
971	g_usBs3TestStep++;
972
973	rc = Bs3PagingProtect(uCr2Expected, _4K, 0 /fSet/, X86_PTE_P /fClear/);
974	if (RT_SUCCESS(rc))
975	{
976	ASMSetIDTR(&Idtr);
977	Bs3TrapSetJmpAndRestore(&Ctx80, &TrapCtx);
978	bs3CpuBasic2_CompareIntCtx1(&TrapCtx, &Ctx80, 0x80 /bXcpt/);
979	g_usBs3TestStep++;
980
981	ASMSetIDTR(&Idtr);
982	Bs3TrapSetJmpAndRestore(&Ctx81, &TrapCtx);
983	if (f486Plus)
984	bs3CpuBasic2_ComparePfCtx(&TrapCtx, &Ctx81, 0 /uErrCd/, uCr2Expected);
985	else
986	bs3CpuBasic2_ComparePfCtx(&TrapCtx, &Ctx81, X86_TRAP_PF_RW /uErrCd/, uCr2Expected + 4 - RT_MIN(j, 4));
987	g_usBs3TestStep++;
988
989	Bs3PagingProtect(uCr2Expected, _4K, X86_PTE_P /fSet/, 0 /fClear/);
990
991	/* Check if that the entry type is checked after the whole IDTE has been cleared for #PF. */
992	pIdtCopy[0x80 << cIdteShift].Gate.u4Type = 0;
993	rc = Bs3PagingProtect(uCr2Expected, _4K, 0 /fSet/, X86_PTE_P /fClear/);
994	if (RT_SUCCESS(rc))
995	{
996	ASMSetIDTR(&Idtr);
997	Bs3TrapSetJmpAndRestore(&Ctx81, &TrapCtx);
998	if (f486Plus)
999	bs3CpuBasic2_ComparePfCtx(&TrapCtx, &Ctx81, 0 /uErrCd/, uCr2Expected);
1000	else
1001	bs3CpuBasic2_ComparePfCtx(&TrapCtx, &Ctx81, X86_TRAP_PF_RW /uErrCd/, uCr2Expected + 4 - RT_MIN(j, 4));
1002	g_usBs3TestStep++;
1003
1004	Bs3PagingProtect(uCr2Expected, _4K, X86_PTE_P /fSet/, 0 /fClear/);
1005	}
1006	}
1007	else
1008	Bs3TestPrintf("Bs3PagingProtectPtr: %d\n", i);
1009
1010	ASMSetIDTR(&IdtrSaved);
1011	}
1012	}
1013
1014	/*
1015	* The read/write and user/supervisor bits the IDT PTEs are irrelevant.
1016	*/
1017	g_usBs3TestStep = 5300;
1018	if (BS3_MODE_IS_PAGED(g_bTestMode) && pbIdtCopyAlloc)
1019	{
1020	Bs3MemCpy(pbIdtCopyAlloc, paIdt, cbIdte * 256);
1021	Idtr.cbIdt = IdtrSaved.cbIdt;
1022	Idtr.pIdt = Bs3SelPtrToFlat(pbIdtCopyAlloc);
1023
1024	ASMSetIDTR(&Idtr);
1025	Bs3TrapSetJmpAndRestore(&Ctx81, &TrapCtx);
1026	bs3CpuBasic2_CompareIntCtx1(&TrapCtx, &Ctx81, 0x81 /bXcpt/);
1027	g_usBs3TestStep++;
1028
1029	rc = Bs3PagingProtect(Idtr.pIdt, _4K, 0 /fSet/, X86_PTE_RW \| X86_PTE_US /fClear/);
1030	if (RT_SUCCESS(rc))
1031	{
1032	ASMSetIDTR(&Idtr);
1033	Bs3TrapSetJmpAndRestore(&Ctx81, &TrapCtx);
1034	bs3CpuBasic2_CompareIntCtx1(&TrapCtx, &Ctx81, 0x81 /bXcpt/);
1035	g_usBs3TestStep++;
1036
1037	Bs3PagingProtect(Idtr.pIdt, _4K, X86_PTE_RW \| X86_PTE_US /fSet/, 0 /fClear/);
1038	}
1039	ASMSetIDTR(&IdtrSaved);
1040	}
1041
1042	/*
1043	* Check that CS.u1Accessed is set to 1. Use the test page selector #0 and #3 together
1044	* with interrupt gates 80h and 83h, respectively.
1045	*/
1046	/** @todo Throw in SS.u1Accessed too. */
1047	g_usBs3TestStep = 5400;
1048	if (BS3_MODE_IS_PAGED(g_bTestMode) && pbIdtCopyAlloc)
1049	{
1050	Bs3GdteTestPage00 = Bs3Gdt[uSysR0Cs >> X86_SEL_SHIFT];
1051	Bs3GdteTestPage00.Gen.u4Type &= ~X86_SEL_TYPE_ACCESSED;
1052	paIdt[0x80 << cIdteShift].Gate.u16Sel = BS3_SEL_TEST_PAGE_00;
1053
1054	Bs3GdteTestPage03 = Bs3Gdt[(uSysR0Cs + (3 << BS3_SEL_RING_SHIFT)) >> X86_SEL_SHIFT];
1055	Bs3GdteTestPage03.Gen.u4Type &= ~X86_SEL_TYPE_ACCESSED;
1056	paIdt[0x83 << cIdteShift].Gate.u16Sel = BS3_SEL_TEST_PAGE_03; /* rpl is ignored, so leave it as zero. */
1057
1058	/* Check that the CS.A bit is being set on a general basis and that
1059	the special CS values work with out generic handler code. */
1060	Bs3TrapSetJmpAndRestore(&Ctx80, &TrapCtx);
1061	bs3CpuBasic2_CompareIntCtx1(&TrapCtx, &Ctx80, 0x80 /bXcpt/);
1062	if (!(Bs3GdteTestPage00.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
1063	bs3CpuBasic2_FailedF("u4Type=%#x, not accessed", Bs3GdteTestPage00.Gen.u4Type);
1064	g_usBs3TestStep++;
1065
1066	Bs3MemCpy(&CtxTmp, &Ctx83, sizeof(CtxTmp));
1067	Bs3RegCtxConvertToRingX(&CtxTmp, 3);
1068	Bs3TrapSetJmpAndRestore(&CtxTmp, &TrapCtx);
1069	bs3CpuBasic2_CompareIntCtx1(&TrapCtx, &CtxTmp, 0x83 /bXcpt/);
1070	if (!(Bs3GdteTestPage03.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
1071	bs3CpuBasic2_FailedF("u4Type=%#x, not accessed!", Bs3GdteTestPage00.Gen.u4Type);
1072	if (TrapCtx.uHandlerCs != (BS3_SEL_TEST_PAGE_03 \| 3))
1073	bs3CpuBasic2_FailedF("uHandlerCs=%#x, expected %#x", TrapCtx.uHandlerCs, (BS3_SEL_TEST_PAGE_03 \| 3));
1074	g_usBs3TestStep++;
1075
1076	/*
1077	* Now check that setting CS.u1Access to 1 does __NOT__ trigger a page
1078	* fault due to the RW bit being zero.
1079	* (We check both with with and without the WP bit if 80486.)
1080	*/
1081	if ((g_uBs3CpuDetected & BS3CPU_TYPE_MASK) >= BS3CPU_80486)
1082	ASMSetCR0(uCr0Saved \| X86_CR0_WP);
1083
1084	Bs3GdteTestPage00.Gen.u4Type &= ~X86_SEL_TYPE_ACCESSED;
1085	Bs3GdteTestPage03.Gen.u4Type &= ~X86_SEL_TYPE_ACCESSED;
1086	rc = Bs3PagingProtect(GdtrSaved.pGdt + BS3_SEL_TEST_PAGE_00, 8, 0 /fSet/, X86_PTE_RW /fClear/);
1087	if (RT_SUCCESS(rc))
1088	{
1089	/* ring-0 handler */
1090	Bs3TrapSetJmpAndRestore(&Ctx80, &TrapCtx);
1091	bs3CpuBasic2_CompareIntCtx1(&TrapCtx, &Ctx80, 0x80 /bXcpt/);
1092	if (!(Bs3GdteTestPage00.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
1093	bs3CpuBasic2_FailedF("u4Type=%#x, not accessed!", Bs3GdteTestPage00.Gen.u4Type);
1094	g_usBs3TestStep++;
1095
1096	/* ring-3 handler */
1097	Bs3MemCpy(&CtxTmp, &Ctx83, sizeof(CtxTmp));
1098	Bs3RegCtxConvertToRingX(&CtxTmp, 3);
1099	Bs3TrapSetJmpAndRestore(&CtxTmp, &TrapCtx);
1100	bs3CpuBasic2_CompareIntCtx1(&TrapCtx, &CtxTmp, 0x83 /bXcpt/);
1101	if (!(Bs3GdteTestPage03.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
1102	bs3CpuBasic2_FailedF("u4Type=%#x, not accessed!", Bs3GdteTestPage00.Gen.u4Type);
1103	g_usBs3TestStep++;
1104
1105	/* clear WP and repeat the above. */
1106	if ((g_uBs3CpuDetected & BS3CPU_TYPE_MASK) >= BS3CPU_80486)
1107	ASMSetCR0(uCr0Saved & ~X86_CR0_WP);
1108	Bs3GdteTestPage00.Gen.u4Type &= ~X86_SEL_TYPE_ACCESSED; /* (No need to RW the page - ring-0, WP=0.) */
1109	Bs3GdteTestPage03.Gen.u4Type &= ~X86_SEL_TYPE_ACCESSED; /* (No need to RW the page - ring-0, WP=0.) */
1110
1111	Bs3TrapSetJmpAndRestore(&Ctx80, &TrapCtx);
1112	bs3CpuBasic2_CompareIntCtx1(&TrapCtx, &Ctx80, 0x80 /bXcpt/);
1113	if (!(Bs3GdteTestPage00.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
1114	bs3CpuBasic2_FailedF("u4Type=%#x, not accessed!", Bs3GdteTestPage00.Gen.u4Type);
1115	g_usBs3TestStep++;
1116
1117	Bs3TrapSetJmpAndRestore(&CtxTmp, &TrapCtx);
1118	bs3CpuBasic2_CompareIntCtx1(&TrapCtx, &CtxTmp, 0x83 /bXcpt/);
1119	if (!(Bs3GdteTestPage03.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
1120	bs3CpuBasic2_FailedF("u4Type=%#x, not accessed!n", Bs3GdteTestPage03.Gen.u4Type);
1121	g_usBs3TestStep++;
1122
1123	Bs3PagingProtect(GdtrSaved.pGdt + BS3_SEL_TEST_PAGE_00, 8, X86_PTE_RW /fSet/, 0 /fClear/);
1124	}
1125
1126	ASMSetCR0(uCr0Saved);
1127
1128	/*
1129	* While we're here, check that if the CS GDT entry is a non-present
1130	* page we do get a #PF with the rigth error code and CR2.
1131	*/
1132	Bs3GdteTestPage00.Gen.u4Type &= ~X86_SEL_TYPE_ACCESSED; /* Just for fun, really a pointless gesture. */
1133	Bs3GdteTestPage03.Gen.u4Type &= ~X86_SEL_TYPE_ACCESSED;
1134	rc = Bs3PagingProtect(GdtrSaved.pGdt + BS3_SEL_TEST_PAGE_00, 8, 0 /fSet/, X86_PTE_P /fClear/);
1135	if (RT_SUCCESS(rc))
1136	{
1137	Bs3TrapSetJmpAndRestore(&Ctx80, &TrapCtx);
1138	if (f486Plus)
1139	bs3CpuBasic2_ComparePfCtx(&TrapCtx, &Ctx80, 0 /uErrCd/, GdtrSaved.pGdt + BS3_SEL_TEST_PAGE_00);
1140	else
1141	bs3CpuBasic2_ComparePfCtx(&TrapCtx, &Ctx80, X86_TRAP_PF_RW, GdtrSaved.pGdt + BS3_SEL_TEST_PAGE_00 + 4);
1142	g_usBs3TestStep++;
1143
1144	/* Do it from ring-3 to check ErrCd, which doesn't set X86_TRAP_PF_US it turns out. */
1145	Bs3MemCpy(&CtxTmp, &Ctx83, sizeof(CtxTmp));
1146	Bs3RegCtxConvertToRingX(&CtxTmp, 3);
1147	Bs3TrapSetJmpAndRestore(&CtxTmp, &TrapCtx);
1148
1149	if (f486Plus)
1150	bs3CpuBasic2_ComparePfCtx(&TrapCtx, &CtxTmp, 0 /uErrCd/, GdtrSaved.pGdt + BS3_SEL_TEST_PAGE_03);
1151	else
1152	bs3CpuBasic2_ComparePfCtx(&TrapCtx, &CtxTmp, X86_TRAP_PF_RW, GdtrSaved.pGdt + BS3_SEL_TEST_PAGE_03 + 4);
1153	g_usBs3TestStep++;
1154
1155	Bs3PagingProtect(GdtrSaved.pGdt + BS3_SEL_TEST_PAGE_00, 8, X86_PTE_P /fSet/, 0 /fClear/);
1156	if (Bs3GdteTestPage00.Gen.u4Type & X86_SEL_TYPE_ACCESSED)
1157	bs3CpuBasic2_FailedF("u4Type=%#x, accessed! #1", Bs3GdteTestPage00.Gen.u4Type);
1158	if (Bs3GdteTestPage03.Gen.u4Type & X86_SEL_TYPE_ACCESSED)
1159	bs3CpuBasic2_FailedF("u4Type=%#x, accessed! #2", Bs3GdteTestPage03.Gen.u4Type);
1160	}
1161
1162	/* restore */
1163	paIdt[0x80 << cIdteShift].Gate.u16Sel = uSysR0Cs;
1164	paIdt[0x83 << cIdteShift].Gate.u16Sel = uSysR0Cs;// + (3 << BS3_SEL_RING_SHIFT) + 3;
1165	}
1166
1167	# endif /* 32 \|\| 64*/
1168
1169	/*
1170	* Check broad EFLAGS effects.
1171	*/
1172	g_usBs3TestStep = 5600;
1173	for (iCtx = 0; iCtx < RT_ELEMENTS(apCtx8x); iCtx++)
1174	{
1175	for (iRing = 0; iRing < 4; iRing++)
1176	{
1177	Bs3MemCpy(&CtxTmp, apCtx8x[iCtx], sizeof(CtxTmp));
1178	Bs3RegCtxConvertToRingX(&CtxTmp, iRing);
1179
1180	/* all set */
1181	CtxTmp.rflags.u32 &= X86_EFL_VM \| X86_EFL_1;
1182	CtxTmp.rflags.u32 \|= X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF /* \| X86_EFL_TF / /\| X86_EFL_IF*/
1183	\| X86_EFL_DF \| X86_EFL_OF \| X86_EFL_IOPL /* \| X86_EFL_NT*/;
1184	if (f486Plus)
1185	CtxTmp.rflags.u32 \|= X86_EFL_AC;
1186	if (f486Plus && !g_f16BitSys)
1187	CtxTmp.rflags.u32 \|= X86_EFL_RF;
1188	if (g_uBs3CpuDetected & BS3CPU_F_CPUID)
1189	CtxTmp.rflags.u32 \|= X86_EFL_VIF \| X86_EFL_VIP;
1190	Bs3TrapSetJmpAndRestore(&CtxTmp, &TrapCtx);
1191	CtxTmp.rflags.u32 &= ~X86_EFL_RF;
1192
1193	if (iCtx >= iRing)
1194	bs3CpuBasic2_CompareIntCtx1(&TrapCtx, &CtxTmp, 0x80 + iCtx /bXcpt/);
1195	else
1196	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &CtxTmp, ((0x80 + iCtx) << X86_TRAP_ERR_SEL_SHIFT) \| X86_TRAP_ERR_IDT);
1197	uExpected = CtxTmp.rflags.u32
1198	& ( X86_EFL_1 \| X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_DF
1199	\| X86_EFL_OF \| X86_EFL_IOPL \| X86_EFL_NT \| X86_EFL_VM \| X86_EFL_AC \| X86_EFL_VIF \| X86_EFL_VIP
1200	\| X86_EFL_ID /\| X86_EFL_TF/ /\| X86_EFL_IF/ /\| X86_EFL_RF/ );
1201	if (TrapCtx.fHandlerRfl != uExpected)
1202	bs3CpuBasic2_FailedF("unexpected handler rflags value: %RX64 expected %RX32; CtxTmp.rflags=%RX64 Ctx.rflags=%RX64\n",
1203	TrapCtx.fHandlerRfl, uExpected, CtxTmp.rflags.u, TrapCtx.Ctx.rflags.u);
1204	g_usBs3TestStep++;
1205
1206	/* all cleared */
1207	if ((g_uBs3CpuDetected & BS3CPU_TYPE_MASK) < BS3CPU_80286)
1208	CtxTmp.rflags.u32 = apCtx8x[iCtx]->rflags.u32 & (X86_EFL_RA1_MASK \| UINT16_C(0xf000));
1209	else
1210	CtxTmp.rflags.u32 = apCtx8x[iCtx]->rflags.u32 & (X86_EFL_VM \| X86_EFL_RA1_MASK);
1211	Bs3TrapSetJmpAndRestore(&CtxTmp, &TrapCtx);
1212	if (iCtx >= iRing)
1213	bs3CpuBasic2_CompareIntCtx1(&TrapCtx, &CtxTmp, 0x80 + iCtx /bXcpt/);
1214	else
1215	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &CtxTmp, ((0x80 + iCtx) << X86_TRAP_ERR_SEL_SHIFT) \| X86_TRAP_ERR_IDT);
1216	uExpected = CtxTmp.rflags.u32;
1217	if (TrapCtx.fHandlerRfl != uExpected)
1218	bs3CpuBasic2_FailedF("unexpected handler rflags value: %RX64 expected %RX32; CtxTmp.rflags=%RX64 Ctx.rflags=%RX64\n",
1219	TrapCtx.fHandlerRfl, uExpected, CtxTmp.rflags.u, TrapCtx.Ctx.rflags.u);
1220	g_usBs3TestStep++;
1221	}
1222	}
1223
1224	/** @todo CS.LIMIT / canonical(CS) */
1225
1226
1227	/*
1228	* Check invalid gate types.
1229	*/
1230	g_usBs3TestStep = 32000;
1231	for (iRing = 0; iRing <= 3; iRing++)
1232	{
1233	static const uint16_t s_auCSes[] = { BS3_SEL_R0_CS16, BS3_SEL_R0_CS32, BS3_SEL_R0_CS64,
1234	BS3_SEL_TSS16, BS3_SEL_TSS32, BS3_SEL_TSS64, 0, BS3_SEL_SPARE_1f };
1235	static uint16_t const s_auInvlTypes64[] = { 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 13,
1236	0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17,
1237	0x18, 0x19, 0x1a, 0x1b, 0x1c, 0x1d, 0x1e, 0x1f };
1238	static uint16_t const s_auInvlTypes32[] = { 0, 1, 2, 3, 8, 9, 10, 11, 13,
1239	0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17,
1240	0x18, 0x19, 0x1a, 0x1b, 0x1c, 0x1d, 0x1e, 0x1f,
1241	/286:/ 12, 14, 15 };
1242	uint16_t const * const pauInvTypes = cIdteShift != 0 ? s_auInvlTypes64 : s_auInvlTypes32;
1243	uint16_t const cInvTypes = cIdteShift != 0 ? RT_ELEMENTS(s_auInvlTypes64)
1244	: f386Plus ? RT_ELEMENTS(s_auInvlTypes32) - 3 : RT_ELEMENTS(s_auInvlTypes32);
1245
1246
1247	for (iCtx = 0; iCtx < RT_ELEMENTS(apCtx8x); iCtx++)
1248	{
1249	unsigned iType;
1250
1251	Bs3MemCpy(&CtxTmp, apCtx8x[iCtx], sizeof(CtxTmp));
1252	Bs3RegCtxConvertToRingX(&CtxTmp, iRing);
1253	# if TMPL_BITS == 32
1254	g_uBs3TrapEipHint = CtxTmp.rip.u32;
1255	# endif
1256	for (iType = 0; iType < cInvTypes; iType++)
1257	{
1258	uint8_t const bSavedType = paIdt[(0x80 + iCtx) << cIdteShift].Gate.u4Type;
1259	paIdt[(0x80 + iCtx) << cIdteShift].Gate.u1DescType = pauInvTypes[iType] >> 4;
1260	paIdt[(0x80 + iCtx) << cIdteShift].Gate.u4Type = pauInvTypes[iType] & 0xf;
1261
1262	for (i = 0; i < 4; i++)
1263	{
1264	for (j = 0; j < RT_ELEMENTS(s_auCSes); j++)
1265	{
1266	uint16_t uCs = (unsigned)(s_auCSes[j] - BS3_SEL_R0_FIRST) < (unsigned)(4 << BS3_SEL_RING_SHIFT)
1267	? (s_auCSes[j] \| i) + (i << BS3_SEL_RING_SHIFT)
1268	: s_auCSes[j] \| i;
1269	/Bs3TestPrintf("g_usBs3TestStep=%u iCtx=%u iRing=%u i=%u uCs=%04x type=%#x\n", g_usBs3TestStep, iCtx, iRing, i, uCs, pauInvTypes[iType]);/
1270	paIdt[(0x80 + iCtx) << cIdteShift].Gate.u16Sel = uCs;
1271	Bs3TrapSetJmpAndRestore(&CtxTmp, &TrapCtx);
1272	g_usBs3TestStep++;
1273	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &CtxTmp, ((0x80 + iCtx) << X86_TRAP_ERR_SEL_SHIFT) \| X86_TRAP_ERR_IDT);
1274
1275	/* Mark it not-present to check that invalid type takes precedence. */
1276	paIdt[(0x80 + iCtx) << cIdteShift].Gate.u1Present = 0;
1277	Bs3TrapSetJmpAndRestore(&CtxTmp, &TrapCtx);
1278	g_usBs3TestStep++;
1279	bs3CpuBasic2_CompareGpCtx(&TrapCtx, &CtxTmp, ((0x80 + iCtx) << X86_TRAP_ERR_SEL_SHIFT) \| X86_TRAP_ERR_IDT);
1280	paIdt[(0x80 + iCtx) << cIdteShift].Gate.u1Present = 1;
1281	}
1282	}
1283
1284	paIdt[(0x80 + iCtx) << cIdteShift].Gate.u16Sel = uSysR0Cs;
1285	paIdt[(0x80 + iCtx) << cIdteShift].Gate.u4Type = bSavedType;
1286	paIdt[(0x80 + iCtx) << cIdteShift].Gate.u1DescType = 0;
1287	paIdt[(0x80 + iCtx) << cIdteShift].Gate.u1Present = 1;
1288	}
1289	}
1290	}
1291	BS3_ASSERT(g_usBs3TestStep < 62000U && g_usBs3TestStep > 32000U);
1292
1293
1294	/** @todo
1295	* - Run \#PF and \#GP (and others?) at CPLs other than zero.
1296	* - Quickly generate all faults.
1297	* - All the peculiarities v8086.
1298	*/
1299
1300	# if TMPL_BITS != 16
1301	Bs3MemFree(pbIdtCopyAlloc, 12*_1K);
1302	# endif
1303	}
1304
1305	# if ARCH_BITS != 64
1306
1307	/**
1308	* Worker for bs3CpuBasic2_TssGateEsp that tests the INT 80 from outer rings.
1309	*/
1310	# define bs3CpuBasic2_TssGateEsp_AltStackOuterRing BS3_CMN_NM(bs3CpuBasic2_TssGateEsp_AltStackOuterRing)
1311	BS3_DECL_NEAR(void) bs3CpuBasic2_TssGateEsp_AltStackOuterRing(PCBS3REGCTX pCtx, uint8_t bRing, uint8_t *pbAltStack,
1312	size_t cbAltStack, bool f16BitStack, bool f16BitTss,
1313	bool f16BitHandler, unsigned uLine)
1314	{
1315	uint8_t const cbIretFrame = f16BitHandler ? 52 : 54;
1316	BS3REGCTX Ctx2;
1317	BS3TRAPFRAME TrapCtx;
1318	uint8_t *pbTmp;
1319	g_usBs3TestStep = uLine;
1320
1321	Bs3MemCpy(&Ctx2, pCtx, sizeof(Ctx2));
1322	Bs3RegCtxConvertToRingX(&Ctx2, bRing);
1323
1324	if (pbAltStack)
1325	{
1326	Ctx2.rsp.u = Bs3SelPtrToFlat(pbAltStack + 0x1980);
1327	Bs3MemZero(pbAltStack, cbAltStack);
1328	}
1329
1330	Bs3TrapSetJmpAndRestore(&Ctx2, &TrapCtx);
1331
1332	if (!f16BitStack && f16BitTss)
1333	Ctx2.rsp.u &= UINT16_MAX;
1334
1335	bs3CpuBasic2_CompareIntCtx1(&TrapCtx, &Ctx2, 0x80 /bXcpt/);
1336	CHECK_MEMBER("bCpl", "%u", TrapCtx.Ctx.bCpl, bRing);
1337	CHECK_MEMBER("cbIretFrame", "%#x", TrapCtx.cbIretFrame, cbIretFrame);
1338
1339	if (pbAltStack)
1340	{
1341	uint64_t uExpectedRsp = (f16BitTss ? Bs3Tss16.sp0 : Bs3Tss32.esp0) - cbIretFrame;
1342	if (f16BitStack)
1343	{
1344	uExpectedRsp &= UINT16_MAX;
1345	uExpectedRsp \|= Ctx2.rsp.u & ~(uint64_t)UINT16_MAX;
1346	}
1347	if ( TrapCtx.uHandlerRsp != uExpectedRsp
1348	\|\| TrapCtx.uHandlerSs != (f16BitTss ? Bs3Tss16.ss0 : Bs3Tss32.ss0))
1349	bs3CpuBasic2_FailedF("handler SS:ESP=%04x:%08RX64, expected %04x:%08RX16",
1350	TrapCtx.uHandlerSs, TrapCtx.uHandlerRsp, Bs3Tss16.ss0, uExpectedRsp);
1351
1352	pbTmp = (uint8_t *)ASMMemFirstNonZero(pbAltStack, cbAltStack);
1353	if ((f16BitStack \|\| TrapCtx.uHandlerRsp <= UINT16_MAX) && pbTmp != NULL)
1354	bs3CpuBasic2_FailedF("someone touched the alt stack (%p) with SS:ESP=%04x:%#RX32: %p=%02x",
1355	pbAltStack, Ctx2.ss, Ctx2.rsp.u32, pbTmp, *pbTmp);
1356	else if (!f16BitStack && TrapCtx.uHandlerRsp > UINT16_MAX && pbTmp == NULL)
1357	bs3CpuBasic2_FailedF("the alt stack (%p) was not used SS:ESP=%04x:%#RX32\n", pbAltStack, Ctx2.ss, Ctx2.rsp.u32);
1358	}
1359	}
1360
1361	# define bs3CpuBasic2_TssGateEspCommon BS3_CMN_NM(bs3CpuBasic2_TssGateEspCommon)
1362	BS3_DECL_NEAR(void) bs3CpuBasic2_TssGateEspCommon(bool const g_f16BitSys, PX86DESC const paIdt, unsigned const cIdteShift)
1363	{
1364	BS3TRAPFRAME TrapCtx;
1365	BS3REGCTX Ctx;
1366	BS3REGCTX Ctx2;
1367	# if TMPL_BITS == 16
1368	uint8_t *pbTmp;
1369	# endif
1370
1371	/* make sure they're allocated */
1372	Bs3MemZero(&Ctx, sizeof(Ctx));
1373	Bs3MemZero(&Ctx2, sizeof(Ctx2));
1374	Bs3MemZero(&TrapCtx, sizeof(TrapCtx));
1375
1376	Bs3RegCtxSave(&Ctx);
1377	Ctx.rsp.u -= 0x80;
1378
1379	Bs3RegCtxSetRipCsFromLnkPtr(&Ctx, bs3CpuBasic2_Int80);
1380	# if TMPL_BITS == 32
1381	g_uBs3TrapEipHint = Ctx.rip.u32;
1382	# endif
1383
1384	/*
1385	* We'll be using IDT entry 80 and 81 here. The first one will be
1386	* accessible from all DPLs, the latter not. So, start with setting
1387	* the DPLs.
1388	*/
1389	paIdt[0x80 << cIdteShift].Gate.u2Dpl = 3;
1390	paIdt[0x81 << cIdteShift].Gate.u2Dpl = 0;
1391
1392	/*
1393	* Check that the basic stuff works first.
1394	*/
1395	Bs3TrapSetJmpAndRestore(&Ctx, &TrapCtx);
1396	g_usBs3TestStep = __LINE__;
1397	bs3CpuBasic2_CompareIntCtx1(&TrapCtx, &Ctx, 0x80 /bXcpt/);
1398
1399	bs3CpuBasic2_TssGateEsp_AltStackOuterRing(&Ctx, 1, NULL, 0, g_f16BitSys, g_f16BitSys, g_f16BitSys, __LINE__);
1400	bs3CpuBasic2_TssGateEsp_AltStackOuterRing(&Ctx, 2, NULL, 0, g_f16BitSys, g_f16BitSys, g_f16BitSys, __LINE__);
1401	bs3CpuBasic2_TssGateEsp_AltStackOuterRing(&Ctx, 3, NULL, 0, g_f16BitSys, g_f16BitSys, g_f16BitSys, __LINE__);
1402
1403	/*
1404	* Check that the upper part of ESP is preserved when doing .
1405	*/
1406	if ((g_uBs3CpuDetected & BS3CPU_TYPE_MASK) >= BS3CPU_80386)
1407	{
1408	size_t const cbAltStack = _8K;
1409	uint8_t *pbAltStack = Bs3MemAllocZ(BS3MEMKIND_TILED, cbAltStack);
1410	if (pbAltStack)
1411	{
1412	/* same ring */
1413	g_usBs3TestStep = __LINE__;
1414	Bs3MemCpy(&Ctx2, &Ctx, sizeof(Ctx2));
1415	Ctx2.rsp.u = Bs3SelPtrToFlat(pbAltStack + 0x1980);
1416	if (Bs3TrapSetJmp(&TrapCtx))
1417	Bs3RegCtxRestore(&Ctx2, 0); /* (does not return) */
1418	bs3CpuBasic2_CompareIntCtx1(&TrapCtx, &Ctx2, 0x80 /bXcpt/);
1419	# if TMPL_BITS == 16
1420	if ((pbTmp = (uint8_t *)ASMMemFirstNonZero(pbAltStack, cbAltStack)) != NULL)
1421	bs3CpuBasic2_FailedF("someone touched the alt stack (%p) with SS:ESP=%04x:%#RX32: %p=%02x\n",
1422	pbAltStack, Ctx2.ss, Ctx2.rsp.u32, pbTmp, *pbTmp);
1423	# else
1424	if (ASMMemIsZero(pbAltStack, cbAltStack))
1425	bs3CpuBasic2_FailedF("alt stack wasn't used despite SS:ESP=%04x:%#RX32\n", Ctx2.ss, Ctx2.rsp.u32);
1426	# endif
1427
1428	/* Different rings (load SS0:SP0 from TSS). */
1429	bs3CpuBasic2_TssGateEsp_AltStackOuterRing(&Ctx, 1, pbAltStack, cbAltStack,
1430	g_f16BitSys, g_f16BitSys, g_f16BitSys, __LINE__);
1431	bs3CpuBasic2_TssGateEsp_AltStackOuterRing(&Ctx, 2, pbAltStack, cbAltStack,
1432	g_f16BitSys, g_f16BitSys, g_f16BitSys, __LINE__);
1433	bs3CpuBasic2_TssGateEsp_AltStackOuterRing(&Ctx, 3, pbAltStack, cbAltStack,
1434	g_f16BitSys, g_f16BitSys, g_f16BitSys, __LINE__);
1435
1436	/* Different rings but switch the SS bitness in the TSS. */
1437	if (g_f16BitSys)
1438	{
1439	Bs3Tss16.ss0 = BS3_SEL_R0_SS32;
1440	bs3CpuBasic2_TssGateEsp_AltStackOuterRing(&Ctx, 1, pbAltStack, cbAltStack,
1441	false, g_f16BitSys, g_f16BitSys, __LINE__);
1442	Bs3Tss16.ss0 = BS3_SEL_R0_SS16;
1443	}
1444	else
1445	{
1446	Bs3Tss32.ss0 = BS3_SEL_R0_SS16;
1447	bs3CpuBasic2_TssGateEsp_AltStackOuterRing(&Ctx, 1, pbAltStack, cbAltStack,
1448	true, g_f16BitSys, g_f16BitSys, __LINE__);
1449	Bs3Tss32.ss0 = BS3_SEL_R0_SS32;
1450	}
1451
1452	Bs3MemFree(pbAltStack, cbAltStack);
1453	}
1454	else
1455	Bs3TestPrintf("%s: Skipping ESP check, alloc failed\n", g_pszTestMode);
1456	}
1457	else
1458	Bs3TestPrintf("%s: Skipping ESP check, CPU too old\n", g_pszTestMode);
1459	}
1460
1461	# endif /* ARCH_BITS != 64 */
1462	#endif /* BS3_INSTANTIATING_CMN */
1463
1464
1465	/*
1466	* Mode specific code.
1467	* Mode specific code.
1468	* Mode specific code.
1469	*/
1470	#ifdef BS3_INSTANTIATING_MODE
1471
1472	BS3_DECL_FAR(uint8_t) TMPL_NM(bs3CpuBasic2_TssGateEsp)(uint8_t bMode)
1473	{
1474	uint8_t bRet = 0;
1475
1476	g_pszTestMode = TMPL_NM(g_szBs3ModeName);
1477	g_bTestMode = bMode;
1478	g_f16BitSys = BS3_MODE_IS_16BIT_SYS(TMPL_MODE);
1479
1480	# if TMPL_MODE == BS3_MODE_PE16 \
1481	\|\| TMPL_MODE == BS3_MODE_PE16_32 \
1482	\|\| TMPL_MODE == BS3_MODE_PP16 \
1483	\|\| TMPL_MODE == BS3_MODE_PP16_32 \
1484	\|\| TMPL_MODE == BS3_MODE_PAE16 \
1485	\|\| TMPL_MODE == BS3_MODE_PAE16_32 \
1486	\|\| TMPL_MODE == BS3_MODE_PE32
1487	bs3CpuBasic2_TssGateEspCommon(BS3_MODE_IS_16BIT_SYS(TMPL_MODE),
1488	(PX86DESC)MyBs3Idt,
1489	BS3_MODE_IS_64BIT_SYS(TMPL_MODE) ? 1 : 0);
1490	# else
1491	bRet = BS3TESTDOMODE_SKIPPED;
1492	# endif
1493
1494	/*
1495	* Re-initialize the IDT.
1496	*/
1497	Bs3TrapInit();
1498	return bRet;
1499	}
1500
1501
1502	BS3_DECL_FAR(uint8_t) TMPL_NM(bs3CpuBasic2_RaiseXcpt1)(uint8_t bMode)
1503	{
1504	g_pszTestMode = TMPL_NM(g_szBs3ModeName);
1505	g_bTestMode = bMode;
1506	g_f16BitSys = BS3_MODE_IS_16BIT_SYS(TMPL_MODE);
1507
1508	# if !BS3_MODE_IS_RM_OR_V86(TMPL_MODE)
1509
1510	/*
1511	* Pass to common worker which is only compiled once per mode.
1512	*/
1513	bs3CpuBasic2_RaiseXcpt1Common(MY_SYS_SEL_R0_CS,
1514	MY_SYS_SEL_R0_CS_CNF,
1515	MY_SYS_SEL_R0_SS,
1516	(PX86DESC)MyBs3Idt,
1517	BS3_MODE_IS_64BIT_SYS(TMPL_MODE) ? 1 : 0);
1518
1519	/*
1520	* Re-initialize the IDT.
1521	*/
1522	Bs3TrapInit();
1523	return 0;
1524	# elif TMPL_MODE == BS3_MODE_RM
1525
1526	/*
1527	* Check
1528	*/
1529	/** @todo check */
1530	return BS3TESTDOMODE_SKIPPED;
1531
1532	# else
1533	return BS3TESTDOMODE_SKIPPED;
1534	# endif
1535	}
1536
1537	#endif /* BS3_INSTANTIATING_MODE */
1538

Note: See TracBrowser for help on using the repository browser.

source: vbox/trunk/src/VBox/ValidationKit/bootsectors/bs3-cpu-basic-2-template.c@ 93115

Download in other formats: