Re: x86 CPL when entering protected mode(setting PE bit in CR0)?

Posted on 2018-04-06, 02:38

by

by crazyc

in PC Emulation

in PC Emulation

Again, I don't think it's possible to predict what that will do because it's a configuration that can't happen outside of smm or loadall and I'd expect different cpu models to behave differently.

---

Re: x86 CPL when entering protected mode(setting PE bit in CR0)?

Posted on 2018-04-04, 13:56

by

by crazyc

in PC Emulation

in PC Emulation

I wouldn't really expect any consistent behavior between different cpu models since it's very undefined. Maybe some world do a real mode short circuit of all the privilege checks. Others might attempt a privilege level change and try to load the ring 0 stack from wherever the tr points at the moment …

---

Re: x86 CPL when entering protected mode(setting PE bit in CR0)?

Posted on 2018-04-03, 19:35

by

by crazyc

in PC Emulation

in PC Emulation

You're probably right though I doubt anyone's actually tested it. You'd get a quick triple fault the moment you tried anything that required a privilege check unless you set up a vaild idt, gdt and tss (what would happen in real mode? maybe just a int Dh? would the ss dpl be reset then?). This guy …

---

Re: test386.asm CPU tester

Posted on 2017-10-17, 14:54

by

by crazyc

in PC Emulation

in PC Emulation

Thanks, it found one bug in MAMEs 386 cpu device where the wrong esp size was used in a retf if the operand size is different from the stack size.

---

Re: PIC's IMR vs IRR vs IR?

Posted on 2017-09-25, 14:06

by

by crazyc

in PC Emulation

in PC Emulation

If an IRQ line is raised, the bit is set in the IRR whether the line is masked or not. The IRQ will then fire when unmasked if the line is still high. If the line is lowered before unmasking the IRR bit will be cleared and no IRQ will fire. The only time you get a spurious IRQ is if the line is …

---

Re: Finding bugs in 8086-80386 emulation core?

Posted on 2017-08-18, 02:58

by

by crazyc

in PC Emulation

in PC Emulation

You can tell it's in Standard mode by just looking at CR0. In Enhanced mode, paging would be enabled. As for why the IDT is mostly zero, that's probably impossible to tell with the information available. I can tell you that when run in a different emulator, descriptor 0x0008 points to the GDT and …

---

Re: x86 cycle accurate Paging lookups vs segment descriptor fetching vs faults on accurate CPU emulation?

Posted on 2017-08-08, 22:48

by

by crazyc

in PC Emulation

in PC Emulation

vladstamate wrote: It seems to expect to behave differently. PCEm also has a special 8255 emulation for PCJr. Port 62h seems to return different values and it works a bit different than on an PC XT. The PCJR has a real 8255. It's wired up almost entirely differently than a 5150.

---

Re: CAPE - multi monitor and multi adapter support

Posted on 2017-03-15, 18:30

by

by crazyc

in PC Emulation

in PC Emulation

vladstamate wrote: (does anyone know of any app that would use 2 adapters at once?) Turbo debugger for windows and SoftICE too. Not sure what is available that works on an XT though.

---

Re: Intel Inboard 386 XT/AT 386 emulation help?

Posted on 2017-03-09, 15:28

by

by crazyc

in PC Emulation

in PC Emulation

I'm struggling with something: What is the effective operand/address size when CS is reloaded? So during extra push/pop operations(different kind of gates), how does the CPU determine to push/pop 16/32-bit address/data? The D/B bit in the descriptor sets the operand size. So if B is set in SS, it …

---

Re: x86 segment base vs expand down segments?

Posted on 2017-02-17, 23:01

by

by crazyc

in PC Emulation

in PC Emulation

What happens when a stack(or any expand-down data) segment (descriptor) is indexed with a register while using a expand-down segment? Say ESP=0, it gets decreased to 0xFFFFFFC for a dword write, then writing a value to SS:FFFFFFFC. The SS segment descriptor base pointing to 0x400, what memory …

---

Re: Double fault or double faults?

Posted on 2017-02-06, 19:38

by

by crazyc

in PC Emulation

in PC Emulation

The descriptor cache isn't reloaded until a new selector is loaded into the segment register. So if SS was 0 in real mode the descriptor cache will contain Base: 0x000000 Limit:0xffff Flags: 0x93 and it will stay that, even after a switch to pmode, until a new selector is loaded when the descriptor …

---

Re: Double fault or double faults?

Posted on 2017-02-06, 18:38

by

by crazyc

in PC Emulation

in PC Emulation

Has a new value been loaded into SS after the switch to pmode? If not the real mode stack is still valid.

---

Re: UniPCemu's 80286 emulation bug help?

Posted on 2017-01-25, 18:45

by

by crazyc

in PC Emulation

in PC Emulation

What program was it that used 80286-style "Task State Segment" descriptors? Was it an operating system running in Virtual 8086 Mode or Protected Mode (such as Windows/386 and higher or OS/2), or was it something else (such as a debugger)? The Ergo 286 DOS extender used in Turbo Debugger 286 (TD286. …

---

Re: UniPCemu's 80286 emulation bug help?

Posted on 2017-01-24, 22:38

by

by crazyc

in PC Emulation

in PC Emulation

Edit: Hmmm... https://lists.ubuntu.com/archives/kernel-team/2014-November/049401.html So CPL is CS.RPL until the stack is valid. Then CPL is set to SS.DPL? Is that correct? So it's a hidden 2-bit 'register'? That's how I did it in the MAME 286 emulation (other than the hidden register part) and it …

---

Re: UniPCemu's 80286 emulation bug help?

Posted on 2017-01-24, 22:06

by

by crazyc

in PC Emulation

in PC Emulation

Look at the list from the Pentium manual above, or the 486 manual , SS is checked before CS. I believe the 80386 manual you linked is wrong and they corrected it in the 80486 manual and there more more mistakes than that. Look at https://pdos.csail.mit.edu/6.828/2014/readings/i386/IRET.htm under " …

---

Re: UniPCemu's 80286 emulation bug help?

Posted on 2017-01-24, 19:34

by

by crazyc

in PC Emulation

in PC Emulation

OK. But isn't the CPL the lowest 2 bits of the CS segment selector? Or is it the currently loaded CS DPL in the descriptor cache? Since any app can simply load CS with a different CPL by means of a JMP instruction to it's own segment selector? (CS&0xFFFC) The RPL of CS should always be equal to CPL …

---

Re: UniPCemu's 80286 emulation bug help?

Posted on 2017-01-23, 14:40

by

by crazyc

in PC Emulation

in PC Emulation

- What does it mean with the segments being readable? That it's not paged out of RAM? Segments are always readable? Also, it can't check, since each segment can use different limit configurations combined with paging? Readability here just means they aren't execute only code segments. - Are the …

---

Re: Emulating NE2000 network card using SDL(2)_net in pure C?

Posted on 2016-12-22, 13:36

by

by crazyc

in PC Emulation

in PC Emulation

With android pcap and tap may be available but likely only for rooted devices. Although, with pcap i believe, on wireless devices, you'd have to translate your ethernet frames to 802.11 manually. On the psp only slirp would work (unless you want to complete the reverse engineering of the wireless …

---

Re: Emulating NE2000 network card using SDL(2)_net in pure C?

Posted on 2016-12-21, 14:15

by

by crazyc

in PC Emulation

in PC Emulation

Only if you are tunnelling, sdl_net can't send raw ethernet frames, they're going to have an IP and ethernet header prepended (and probably a TCP or UDP header too as it doesn't seem to do raw IP either). That's why winpcap or slirp is used by emulators (or tun/tap on linux).

---

Re: Cycle-accurate Floppy Disk emulation(82077AA)?

Posted on 2016-11-29, 13:33

by

by crazyc

in PC Emulation

in PC Emulation

What happens when a MT read on side 1 is issued? Does it read side 0 of the same track after it and finish, giving the result of side 1, next track? Multitrack reads end at eot on side 1. Btw, when is the head reloaded during implicit seek and read/write sectors? Is it first loaded, then seeking, …

---