reactos/ntoskrnl/ke/i386/syscall.S

   1 /*
   2  * FILE:            ntoskrnl/ke/i386/syscall.S
   3  * COPYRIGHT:       See COPYING in the top level directory
   4  * PURPOSE:         System Call Handler
   5  * PROGRAMMER:      Alex Ionescu (alex@relsoft.net)
   6  */
   7
   8 #include <roscfg.h>
   9 #include <internal/i386/ke.h>
  10 #include <ndk/asm.h>
  11
  12 #define UserMode  (1)
  13 #define STATUS_INVALID_SYSTEM_SERVICE 0xC000001C
  14
  15 .globl _KiServiceExit
  16 .globl _KiServiceExit2
  17 .globl _KiFastCallEntry
  18 .globl _KiSystemService
  19 .globl _KiDebugService
  20 .intel_syntax noprefix
  21
  22 /*
  23  * NOTE: I will create some macros for trap entry and exit,
  24  * DR* register restoration, modified frame exit, etc, if GAS
  25  * allows it/I find a way how. This would remove a lot of
  26  * duplicated code in this file plus the other irq/trap asm files.
  27  * I think this is similar to what NT does, if you look at teh
  28  * Dr_kit*_a functions which look auto-generated.
  29  */
  30
  31 /*
  32  * There are 3 main types of Trap Exits:
  33  *
  34  * - KiServiceExit
  35  *     - Clear interrupt flag
  36  *     - Common User APC Dispatching
  37  *     - Common exit code; segments and volatiles are not restored
  38  * You use this for System Call return, when volatiles are irrelevant.
  39  * (NtContinue, NtRaiseException, KiCallUserMode and all System Call returns)
  40  *
  41  * - KiServiceExit2
  42  *     - Clear interrupt flag
  43  *     - Common User APC Dispatching
  44  *     - Common exit code; the entire frame is restored.
  45  * You use this when volatiles and other registers need to be restored.
  46  * For example, if debugging is active (NtContinue, NtRaiseException).
  47  *
  48  * - Kei386EoiHelper
  49  *     - Clear interrupt flag
  50  *     - Common User APC Dispatching
  51  *     - Common exit code; the entire frame is restored but *NOT* the Previous Mode
  52  * You use this in the same context as KiServiceExit2, but when the Previous Mode
  53  * should be tampered with. Clearly, as its name suggests, this routine is mostly
  54  * useful for End Of Interrupts.
  55  * Note that this routine is EXPORTED.
  56  * Note that this routine must called by a JMP, not a CALL.
  57  */
  58
  59 /*
  60  * The common exit code has 3 modes of operation:
  61  *    - Whether or not to restore segments
  62  *    - Whether or not to restore volatiles
  63  *    - Whether or not to restore the previous mode
  64  * All these are exemplified by the 3 trap exits shown above
  65  */
  66
  67 /*
  68  * There is also common Debug Code present in the common exit code, which
  69  * in turn calls common code to save the debug registers
  70  */
  71
  72  /*
  73   * FIXMEs:
  74   *         - Dig in trap code and see why we need to push/pop the segments,
  75   *           which -shouldn't- be needed on syscalls; one of the things
  76   *           missing for this to work is lazy loading in the GPF handler,
  77   *           but there are other things to consider.
  78   *         - Use macros and merge with trap.s nicely
  79   */
  80
  81 /*
  82  * Entries will be discussed later.
  83  */
  84
  85  /*** This file is a mess; it is being worked on. Please contact Alex:
  86   *** alex@relsoft.net if you want to make any changes to it before this
  87   *** message goes away
  88   */
  89
  90 /* FUNCTIONS ***************************************************************/
  91
  92 BadStack:
  93
  94     /* Restore ESP0 stack */
  95     mov ecx, [fs:KPCR_TSS]
  96     mov esp, ss:[ecx+KTSS_ESP0]
  97
  98     /* Generate V86M Stack for Trap 6 */
  99     push 0
 100     push 0
 101     push 0
 102     push 0
 103
 104     /* Generate interrupt stack for Trap 6 */
 105     push KGDT_R3_DATA + RPL_MASK
 106     push 0
 107     push 0x20202
 108     push KGDT_R3_CODE + RPL_MASK
 109     push 0
 110     jmp _KiTrap6
 111
 112 _KiFastCallEntry:
 113
 114 // ==================== UNIQUE SYSENTER STUB. DO NOT DUPLICATE ============//
 115     /* Set FS to PCR */
 116     mov ecx, KGDT_R0_PCR
 117     mov fs, cx
 118
 119     /* Set DS/ES to Kernel Selector */
 120     mov ecx, KGDT_R0_DATA
 121     mov ds, cx
 122     mov es, cx
 123
 124     /* Set the current stack to Kernel Stack */
 125     mov ecx, [fs:KPCR_TSS]
 126     mov esp, ss:[ecx+KTSS_ESP0]
 127
 128     /* Set up a fake INT Stack. */
 129     push KGDT_R3_DATA + RPL_MASK
 130     push edx                            /* Ring 3 SS:ESP */
 131     pushf                               /* Ring 3 EFLAGS */
 132     push 2                              /* Ring 0 EFLAGS */
 133     add edx, 8                          /* Skip user parameter list */
 134     popf                                /* Set our EFLAGS */
 135     or dword ptr [esp], X86_EFLAGS_IF   /* Re-enable IRQs in EFLAGS, to fake INT */
 136     push KGDT_R3_CODE + RPL_MASK
 137     push KUSER_SHARED_SYSCALL_RET
 138
 139     /* Setup the Trap Frame stack */
 140     push 0
 141     push ebp
 142     push ebx
 143     push esi
 144     push edi
 145     push KGDT_R3_TEB + RPL_MASK
 146
 147     /* Save pointer to our PCR */
 148     mov ebx, [fs:KPCR_SELF]
 149
 150     /* Get a pointer to the current thread */
 151     mov esi, [ebx+KPCR_CURRENT_THREAD]
 152
 153     /* Set the exception handler chain terminator */
 154     push [ebx+KPCR_EXCEPTION_LIST]
 155     mov dword ptr [ebx+KPCR_EXCEPTION_LIST], -1
 156
 157     /* Use the thread's stack */
 158     mov ebp, [esi+KTHREAD_INITIAL_STACK]
 159
 160     /* Push previous mode */
 161     push UserMode
 162
 163 .att_syntax
 164     /* Save other registers */
 165     sub $0xC, %esp                                                    // + 0x70
 166     pushl $KGDT_R3_DATA + RPL_MASK                                    // + 0x40
 167     pushl $KGDT_R3_DATA + RPL_MASK                                    // + 0x44
 168     pushl $0                                                          // + 0x48
 169     sub $0x30, %esp                                                   // + 0x70
 170 .intel_syntax noprefix
 171
 172     /* Make space for us on the stack */
 173     sub ebp, 0x29C
 174
 175     /* Write the previous mode */
 176     mov byte ptr [esi+KTHREAD_PREVIOUS_MODE], UserMode
 177
 178     /* Sanity check */
 179     cmp ebp, esp
 180     jnz BadStack
 181
 182     /* Flush DR7 */
 183     and dword ptr [ebp+KTRAP_FRAME_DR7], 0
 184
 185     /* Check if the thread was being debugged */
 186     test byte ptr [esi+KTHREAD_DEBUG_ACTIVE], 0xFF
 187
 188     /* Jump to shared code or DR Save */
 189     //jnz Dr_FastCallDrSave
 190     jmp SharedCode
 191
 192 _KiSystemService:
 193
 194 // ==================== UNIQUE SYSCALL TRAP ENTRY DO NOT DUPLICATE ============//
 195     /* Create a trap frame */
 196     push 0
 197     push ebp
 198     push ebx
 199     push esi
 200     push edi
 201     push fs
 202
 203     /* Load PCR Selector into fs */
 204     mov ebx, KGDT_R0_PCR
 205     mov fs, bx
 206
 207     /* Get a pointer to the current thread */
 208     mov esi, [fs:KPCR_CURRENT_THREAD]
 209
 210     /* Save the previous exception list */
 211     push [fs:KPCR_EXCEPTION_LIST]
 212
 213     /* Set the exception handler chain terminator */
 214     mov dword ptr [fs:KPCR_EXCEPTION_LIST], -1
 215
 216     /* Save the old previous mode */
 217     push ss:[esi+KTHREAD_PREVIOUS_MODE]
 218
 219 .att_syntax
 220     /* Save other registers */
 221     sub $0xC, %esp                                                    // + 0x70
 222     pushl %ds                                                          // + 0x40
 223     pushl %es                                                          // + 0x44
 224     pushl %gs                                                          // + 0x48
 225     sub $0x30, %esp                                                    // + 0x70
 226 .intel_syntax noprefix
 227
 228     /* Set the new previous mode based on the saved CS selector */
 229     mov ebx, [esp+0x6C]
 230     and ebx, 1
 231     mov byte ptr ss:[esi+KTHREAD_PREVIOUS_MODE], bl
 232
 233     /* Go on the Kernel stack frame */
 234     mov ebp, esp
 235
 236     /* Save the old trap frame pointer where EDX would be saved */
 237     mov ebx, [esi+KTHREAD_TRAP_FRAME]
 238     mov [ebp+KTRAP_FRAME_EDX], ebx
 239
 240 // ==================== COMMON DR SAVE CHECK.AND DEBUG FRAME SETUP ============//
 241     /* Flush DR7 */
 242     and dword ptr [ebp+KTRAP_FRAME_DR7], 0
 243
 244     /* Check if the thread was being debugged */
 245     test byte ptr [esi+KTHREAD_DEBUG_ACTIVE], 0xFF
 246     cld
 247     //jnz Dr_kss_a
 248
 249     /* Save a pointer to the trap frame in the TCB */
 250 SharedCode:
 251     mov [esi+KTHREAD_TRAP_FRAME], ebp
 252
 253     /* Get the Debug Trap Frame EBP/EIP */
 254     mov ebx, [ebp+KTRAP_FRAME_EBP]
 255     mov edi, [ebp+KTRAP_FRAME_EIP]
 256
 257 #ifdef DBG
 258     /*
 259      * We want to know the address from where the syscall stub was called.
 260      * If PrevMode is KernelMode, that address is stored in our own (kernel)
 261      * stack, at location KTRAP_FRAME_ESP.
 262      * If we're coming from UserMode, we load the usermode stack pointer
 263      * and go back two frames (first frame is the syscall stub, second call
 264      * is the caller of the stub).
 265      */
 266     mov edi, [ebp+KTRAP_FRAME_ESP]
 267     test byte ptr [esi+KTHREAD_PREVIOUS_MODE], 0x01
 268     jz PrevWasKernelMode
 269     mov edi, [edi+4]
 270 PrevWasKernelMode:
 271 #endif
 272
 273     /* Write the debug data */
 274     mov [ebp+KTRAP_FRAME_DEBUGPOINTER], edx
 275     mov dword ptr [ebp+KTRAP_FRAME_DEBUGARGMARK], 0xBADB0D00
 276     mov [ebp+KTRAP_FRAME_DEBUGEBP], ebx
 277     mov [ebp+KTRAP_FRAME_DEBUGEIP], edi
 278
 279 // ============= END OF COMMON DR SAVE CHECK.AND DEBUG FRAME SETUP ============//
 280     /* Enable interrupts */
 281     sti
 282
 283 CheckValidCall:
 284
 285     /*
 286      * Find out which table offset to use. Converts 0x1124 into 0x10.
 287      * The offset is related to the Table Index as such: Offset = TableIndex x 10
 288      */
 289     mov edi, eax
 290     shr edi, 8
 291     and edi, 0x10
 292     mov ecx, edi
 293
 294     /* Now add the thread's base system table to the offset */
 295     add edi, [esi+KTHREAD_SERVICE_TABLE]
 296
 297     /* Get the true syscall ID and check it */
 298     mov ebx, eax
 299     and eax, 0xFFF
 300     cmp eax, [edi+8]
 301
 302     /* Invalid ID, try to load Win32K Table */
 303     jnb KiBBTUnexpectedRange
 304
 305 #if 0 // <== Disabled for two reasons: We don't save TEB in 0x18, but KPCR.
 306       // <== We don't have a KeGdiFlushUserBatch callback yet (needs to be
 307       //     sent through the PsInitializeWin32Callouts structure)
 308     /* Check if this was Win32K */
 309     cmp ecx, 0x10
 310     jnz NotWin32K
 311
 312     /* Get the TEB */
 313     mov ecx, [fs:KPCR_TEB]
 314
 315     /* Check if we should flush the User Batch */
 316     xor ebx, ebx
 317     or ebx, [ecx+TEB_GDI_BATCH_COUNT]
 318     jz NoWin32K
 319
 320     /* Flush it */
 321     push edx
 322     push eax
 323     call [_KeGdiFlushUserBatch]
 324     pop eax
 325     pop edx
 326 #endif
 327
 328 NotWin32K:
 329     /* Users's current stack frame pointer is source */
 330     mov esi, edx
 331
 332     /* Allocate room for argument list from kernel stack */
 333     mov ebx, [edi+12]
 334     xor ecx, ecx
 335     mov cl, [eax+ebx]
 336
 337     /* Get pointer to function */
 338     mov edi, [edi]
 339     mov ebx, [edi+eax*4]
 340
 341     /* Allocate space on our stack */
 342     sub esp, ecx
 343
 344     /*
 345      * Copy the arguments from the user stack to our stack
 346      * FIXME: This needs to be probed with MmSystemRangeStart
 347      */
 348     shr ecx, 2
 349     mov edi, esp
 350     rep movsd
 351
 352 #ifdef DBG
 353     /*
 354      * The following lines are for the benefit of GDB. It will see the return
 355      * address of the "call ebx" below, find the last label before it and
 356      * thinks that that's the start of the function. It will then check to see
 357      * if it starts with a standard function prolog (push ebp, mov ebp,esp).
 358      * When that standard function prolog is not found, it will stop the
 359      * stack backtrace. Since we do want to backtrace into usermode, let's
 360      * make GDB happy and create a standard prolog.
 361      */
 362 KiSystemService:
 363     push ebp
 364     mov ebp,esp
 365     pop ebp
 366 #endif
 367
 368     /* Do the System Call */
 369     call ebx
 370
 371     /* Deallocate the kernel stack frame  */
 372     mov esp, ebp
 373
 374 KeReturnFromSystemCall:
 375
 376     /* Get the Current Thread */
 377     mov ecx, [fs:KPCR_CURRENT_THREAD]
 378
 379     /* Restore the old trap frame pointer */
 380     mov edx, [ebp+KTRAP_FRAME_EDX]
 381     mov [ecx+KTHREAD_TRAP_FRAME], edx
 382
 383 _KiServiceExit:
 384     /* Disable interrupts */
 385     cli
 386
 387 // ================= COMMON USER-MODE APC DELIVERY CHECK ============//
 388     /* Check for V86 mode */
 389     test dword ptr [ebp+KTRAP_FRAME_EFLAGS], X86_EFLAGS_VM
 390     jnz ApcLoop
 391
 392     /* Deliver APCs only if we were called from user mode */
 393     test byte ptr [ebp+KTRAP_FRAME_CS], 1
 394     je KiRosTrapReturn
 395
 396     /* Get the current thread */
 397 ApcLoop:
 398     mov ebx, [fs:KPCR_CURRENT_THREAD]
 399
 400     /* Make it non-alerted */
 401     mov byte ptr [ebx+KTHREAD_ALERTED], 0
 402
 403     /* And only if any are actually pending */
 404     cmp byte ptr [ebx+KTHREAD_PENDING_USER_APC], 0
 405     je KiRosTrapReturn
 406
 407     /* Save pointer to Trap Frame */
 408     mov ebx, ebp
 409
 410 // ================= PRESENT ONLY IF VOLATILES NEEDED ============//
 411     /* Save some stuff that raising IRQL will kill */
 412     mov [ebx+KTRAP_FRAME_EAX], eax
 413     mov dword ptr [ebx+KTRAP_FRAME_FS], KGDT_R3_TEB + RPL_MASK
 414     mov dword ptr [ebx+KTRAP_FRAME_DS], KGDT_R3_DATA + RPL_MASK
 415     mov dword ptr [ebx+KTRAP_FRAME_ES], KGDT_R3_DATA + RPL_MASK
 416     mov dword ptr [ebx+KTRAP_FRAME_GS], 0
 417 // ============= END PRESENT ONLY IF VOLATILES NEEDED ============//
 418
 419     /* Raise IRQL to APC_LEVEL */
 420     mov ecx, 1
 421     call @KfRaiseIrql@4
 422
 423     /* Save old IRQL */
 424     push eax
 425
 426     /* Deliver APCs */
 427     sti
 428     push ebx
 429     push 0
 430     push UserMode
 431     call _KiDeliverApc@12
 432
 433     /* Return to old IRQL */
 434     pop ecx
 435     call @KfLowerIrql@4
 436
 437     /* Restore EAX (only in volatile case) */
 438     mov eax, [ebx+KTRAP_FRAME_EAX]
 439     cli
 440     jmp ApcLoop
 441 // ============== END COMMON USER-MODE APC DELIVERY CHECK ============//
 442
 443 KiRosTrapReturn:
 444 // ========================= COMMON TRAP EXIT CODE ===================//
 445     /* Restore exception list */
 446     mov edx, [esp+KTRAP_FRAME_EXCEPTION_LIST]
 447     mov [fs:KPCR_EXCEPTION_LIST], edx
 448
 449 // ==================== ONLY IF PREVIOUS MODE NEEDED ==================//
 450     /* Restore previous mode */
 451     mov ecx, [esp+KTRAP_FRAME_PREVIOUS_MODE]
 452     mov esi, [fs:KPCR_CURRENT_THREAD]
 453     mov byte ptr [esi+KTHREAD_PREVIOUS_MODE], cl
 454 // ==================== END IF PREVIOUS MODE NEEDED ===================//
 455
 456     /* Check for V86 */
 457     test dword ptr [esp+KTRAP_FRAME_EFLAGS], X86_EFLAGS_VM
 458     jnz V86_Exit
 459
 460     /* Check if the frame was edited */
 461 V86_Exit_Return:
 462     test word ptr [esp+KTRAP_FRAME_CS], FRAME_EDITED
 463     jz EditedFrame
 464
 465 // ==================== ONLY IF FULL RESTORE NEEDED ===================//
 466     /* Check the old mode */
 467     cmp word ptr [esp+KTRAP_FRAME_CS], KGDT_R3_CODE + RPL_MASK
 468     bt word ptr [esp+KTRAP_FRAME_CS], 0
 469     cmc
 470     ja RestoreAll
 471 // ==================== END IF FULL RESTORE NEEDED ====================//
 472
 473  /* Skip debug information and unsaved registers */
 474  //badbadbad
 475     add esp, 0x30
 476     pop gs
 477     pop es
 478     pop ds
 479     add esp, 0x14
 480 //badbadbad
 481
 482     /* Restore FS */
 483 RestoreFs:
 484     //lea esp, [ebp+KTRAP_FRAME_FS] <= BUG IN WIN32K CALLBACKS! STACK GETS SMASHED
 485     pop fs
 486
 487 CommonStackClean:
 488     /* Skip debug information and unsaved registers */
 489     //lea esp, [ebp+KTRAP_FRAME_EDI] <= BUG IN WIN32K CALLBACKS! STACK GETS SMASHED
 490     pop edi
 491     pop esi
 492     pop ebx
 493     pop ebp
 494
 495     /* Check for ABIOS */
 496     cmp word ptr [esp+8], 0x80
 497     ja AbiosExit
 498
 499 AbiosReturn:
 500     /* Pop error code */
 501     add esp, 4
 502
 503     /* Check if previous CS is from user-mode */
 504     test dword ptr [esp+4], 1
 505
 506     /* It is, so use Fast Exit */
 507     jnz FastRet
 508
 509     /* Jump back to stub */
 510     pop edx
 511     pop ecx
 512     popf
 513     jmp edx
 514
 515 IntRet:
 516
 517     iret
 518
 519 FastRet:
 520     /* Is SYSEXIT Supported/Wanted? */
 521     cmp dword ptr ss:[_KiFastSystemCallDisable], 0
 522     jnz IntRet
 523     test dword ptr [esp+8], X86_EFLAGS_TF
 524     jnz IntRet
 525
 526     /* Restore FS to TIB */
 527     mov ecx, KGDT_R3_TEB + RPL_MASK
 528     mov fs, ecx
 529
 530     /* We will be cleaning up the stack ourselves */
 531     pop edx                                 /* New Ring 3 EIP */
 532     add esp, 4                              /* Skip Ring 3 DS */
 533 /*  and dword ptr [esp], ~X86_EFLAGS_IF        Line below is equivalent to this,
 534                                                but older binutils versions don't understand ~ */
 535     and dword ptr [esp], 0xfffffdff         /* Remove IRQ hack from EFLAGS */
 536     popf                                    /* Restore old EFLAGS */
 537     pop ecx                                 /* Old Ring 3 SS:ESP */
 538
 539     /*
 540      * At this point:
 541      *     ECX points to the old User Stack.
 542      *     EDX points to the instruction to execute in usermode after the sysenter
 543      */
 544     sti
 545     sysexit
 546
 547 V86_Exit:
 548     /* Move to EDX position */
 549     add esp, KTRAP_FRAME_EDX
 550
 551     /* Restore volatiles */
 552     pop edx
 553     pop ecx
 554     pop eax
 555     jmp V86_Exit_Return
 556
 557 AbiosExit:
 558     /* Not yet supported */
 559     int 3
 560
 561 RestoreAll:
 562     /* Restore EAX */
 563     mov eax, [esp+KTRAP_FRAME_EAX]
 564
 565     /* Skip registers */
 566     add esp, 0x30
 567
 568     /* Restore segments and volatiles */
 569     pop gs
 570     pop es
 571     pop ds
 572     pop edx
 573     pop ecx
 574
 575     /* Jump back to mainline code */
 576     jmp RestoreFs
 577
 578 EditedFrame:
 579      /* Restore real CS value */
 580      mov ebx, [esp+KTRAP_FRAME_TEMPCS]
 581      mov [esp+KTRAP_FRAME_CS], ebx
 582
 583     /*
 584      * If ESP was modified, then a special interrupt exit stack
 585      * must be created to "update" ESP's value in a legal manner
 586      */
 587     mov ebx, [esp+KTRAP_FRAME_TEMPESP]
 588     sub ebx, 0xC
 589     mov [esp+KTRAP_FRAME_ERROR_CODE], ebx
 590
 591     /* Copy Interrupt Stack */
 592     mov esi, [esp+KTRAP_FRAME_EFLAGS]
 593     mov [ebx+8], esi
 594     mov esi, [esp+KTRAP_FRAME_CS]
 595     mov [ebx+4], esi
 596     mov esi, [esp+KTRAP_FRAME_EIP]
 597     mov [ebx], esi
 598
 599     /* Return */
 600     add esp, KTRAP_FRAME_EDI
 601     pop edi
 602     pop esi
 603     pop ebx
 604     pop ebp
 605     mov esp, [esp]
 606     iret
 607
 608 KiBBTUnexpectedRange:
 609
 610     /* If this isn't a Win32K call, fail */
 611     cmp ecx, 0x10
 612     jne InvalidCall
 613
 614     /* Set up Win32K Table */
 615     push edx
 616     push ebx
 617     call _KiServiceCheck
 618
 619     /* FIXME: Handle failure */
 620     pop eax
 621     pop edx
 622
 623     /* Try the Call again */
 624     jmp CheckValidCall
 625
 626 InvalidCall:
 627
 628     /* Invalid System Call */
 629     mov eax, STATUS_INVALID_SYSTEM_SERVICE
 630     jmp KeReturnFromSystemCall
 631
 632 _KiServiceExit2:
 633
 634     /* Disable interrupts */
 635     cli
 636
 637     /* Check for V86 mode */
 638     test dword ptr [ebp+KTRAP_FRAME_EFLAGS], X86_EFLAGS_VM
 639     jnz ApcLoop2
 640
 641     /* Deliver APCs only if we were called from user mode */
 642     test byte ptr [ebp+KTRAP_FRAME_CS], 1
 643     je KiRosTrapReturn2
 644
 645     /* Get the current thread */
 646 ApcLoop2:
 647     mov ebx, [fs:KPCR_CURRENT_THREAD]
 648
 649     /* Make it non-alerted */
 650     mov byte ptr [ebx+KTHREAD_ALERTED], 0
 651
 652     /* And only if any are actually pending */
 653     cmp byte ptr [ebx+KTHREAD_PENDING_USER_APC], 0
 654     je KiRosTrapReturn2
 655
 656     /* Save pointer to Trap Frame */
 657     mov ebx, ebp
 658
 659     /* Raise IRQL to APC_LEVEL */
 660     mov ecx, 1
 661     call @KfRaiseIrql@4
 662
 663     /* Save old IRQL */
 664     push eax
 665
 666     /* Deliver APCs */
 667     sti
 668     push ebx
 669     push 0
 670     push UserMode
 671     call _KiDeliverApc@12
 672
 673     /* Return to old IRQL */
 674     pop ecx
 675     call @KfLowerIrql@4
 676     cli
 677     jmp ApcLoop2
 678
 679 KiRosTrapReturn2:
 680
 681     /* Restore exception list */
 682     mov edx, [esp+KTRAP_FRAME_EXCEPTION_LIST]
 683     mov [fs:KPCR_EXCEPTION_LIST], edx
 684
 685     /* Restore previous mode */
 686     mov ecx, [esp+KTRAP_FRAME_PREVIOUS_MODE]
 687     mov esi, [fs:KPCR_CURRENT_THREAD]
 688     mov byte ptr [esi+KTHREAD_PREVIOUS_MODE], cl
 689
 690     /* Check for V86 */
 691     test dword ptr [esp+KTRAP_FRAME_EFLAGS], X86_EFLAGS_VM
 692     jnz V86_Exit2
 693
 694     /* Check if the frame was edited */
 695 V86_Exit_Return2:
 696     test word ptr [esp+KTRAP_FRAME_CS], FRAME_EDITED
 697     jz EditedFrame2
 698
 699     /* Restore volatiles */
 700     mov edx, [esp+KTRAP_FRAME_EDX]
 701     mov ecx, [esp+KTRAP_FRAME_ECX]
 702     mov eax, [esp+KTRAP_FRAME_EAX]
 703
 704     /* Check if it was kernel */
 705     cmp word ptr [ebp+KTRAP_FRAME_CS], KGDT_R0_CODE
 706     jz CommonStackClean2
 707
 708     /* Skip registers */
 709     lea esp, [ebp+KTRAP_FRAME_GS]
 710
 711     /* Restore segments and volatiles */
 712     pop gs
 713     pop es
 714     pop ds
 715     lea esp, [ebp+KTRAP_FRAME_FS]
 716     pop fs
 717
 718 CommonStackClean2:
 719     /* Skip debug information and unsaved registers */
 720     lea esp, [ebp+KTRAP_FRAME_EDI]
 721     pop edi
 722     pop esi
 723     pop ebx
 724     pop ebp
 725
 726     /* Check for ABIOS */
 727     cmp word ptr [esp+8], 0x80
 728     ja AbiosExit
 729
 730     /* Pop error code and return */
 731     add esp, 4
 732     iret
 733
 734 V86_Exit2:
 735     /* Move to EDX position */
 736     add esp, KTRAP_FRAME_EDX
 737
 738     /* Restore volatiles */
 739     pop edx
 740     pop ecx
 741     pop eax
 742     jmp V86_Exit_Return
 743
 744 EditedFrame2:
 745     /* Restore real CS value */
 746     mov ebx, [esp+KTRAP_FRAME_TEMPCS]
 747     mov [esp+KTRAP_FRAME_CS], ebx
 748
 749     /*
 750      * If ESP was modified, then a special interrupt exit stack
 751      * must be created to "update" ESP's value in a legal manner
 752      */
 753     mov ebx, [esp+KTRAP_FRAME_TEMPESP]
 754     sub ebx, 0xC
 755     mov [esp+KTRAP_FRAME_ERROR_CODE], ebx
 756
 757     /* Copy Interrupt Stack */
 758     mov esi, [esp+KTRAP_FRAME_EFLAGS]
 759     mov [ebx+8], esi
 760     mov esi, [esp+KTRAP_FRAME_CS]
 761     mov [ebx+4], esi
 762     mov esi, [esp+KTRAP_FRAME_EIP]
 763     mov [ebx], esi
 764
 765     /* Restore volatiles */
 766     mov eax, [esp+KTRAP_FRAME_EAX]
 767     mov edx, [esp+KTRAP_FRAME_EDX]
 768     mov ecx, [esp+KTRAP_FRAME_ECX]
 769
 770     /* Return */
 771     add esp, KTRAP_FRAME_EDI
 772     pop edi
 773     pop esi
 774     pop ebx
 775     pop ebp
 776     mov esp, [esp]
 777     iret
 778
 779 _KiDebugService:
 780
 781     /* Create the Trap Frame */
 782     push 0
 783     push ebp
 784     push ebx
 785     push esi
 786     push edi
 787     push fs
 788
 789     /* Switch to correct FS */
 790     mov bx, KGDT_R0_PCR
 791     mov fs, bx
 792
 793     /* Save Exception List */
 794     push fs:[KPCR_EXCEPTION_LIST]
 795
 796     /* Traps don't need the previous mode */
 797     sub esp, 4
 798
 799     /* Continue building the Trap Frame */
 800     push eax
 801     push ecx
 802     push edx
 803     push ds
 804     push es
 805     push gs
 806     sub esp, 0x30
 807
 808     /* Switch Segments to Kernel */
 809     mov ax, KGDT_R0_DATA
 810     mov ds, ax
 811     mov es, ax
 812
 813     /* Set up frame */
 814     mov ebp, esp
 815
 816     /* Check if this was from V86 Mode */
 817     test dword ptr [ebp+KTRAP_FRAME_EFLAGS], X86_EFLAGS_VM
 818     //jnz V86_kids
 819
 820     /* Get current thread */
 821     mov ecx, [fs:KPCR_CURRENT_THREAD]
 822     cld
 823
 824     /* Flush DR7 */
 825     and dword ptr [ebp+KTRAP_FRAME_DR7], 0
 826
 827     /* Check if the thread was being debugged */
 828     test byte ptr [ecx+KTHREAD_DEBUG_ACTIVE], 0xFF
 829     //jnz Dr_kids
 830
 831     /* Get the Debug Trap Frame EBP/EIP */
 832     mov ebx, [ebp+KTRAP_FRAME_EBP]
 833     mov edi, [ebp+KTRAP_FRAME_EIP]
 834
 835     /* Write the debug data */
 836     mov [ebp+KTRAP_FRAME_DEBUGPOINTER], edx
 837     mov dword ptr [ebp+KTRAP_FRAME_DEBUGARGMARK], 0xBADB0D00
 838     mov [ebp+KTRAP_FRAME_DEBUGEBP], ebx
 839     mov [ebp+KTRAP_FRAME_DEBUGEIP], edi
 840
 841     /* Increase EIP so we skip the INT3 */
 842     //inc dword ptr [ebp+KTRAP_FRAME_EIP]
 843
 844     /* Call debug service dispatcher */
 845     mov eax, [ebp+KTRAP_FRAME_EAX]
 846     mov ecx, [ebp+KTRAP_FRAME_ECX]
 847     mov edx, [ebp+KTRAP_FRAME_EAX]
 848
 849     /* Check for V86 mode */
 850     test dword ptr [ebp+KTRAP_FRAME_EFLAGS], X86_EFLAGS_VM
 851     jnz NotUserMode
 852
 853     /* Check if this is kernel or user-mode */
 854     test byte ptr [ebp+KTRAP_FRAME_CS], 1
 855     jz CallDispatch
 856     cmp word ptr [ebp+KTRAP_FRAME_CS], KGDT_R3_CODE + RPL_MASK
 857     jnz NotUserMode
 858
 859     /* Re-enable interrupts */
 860 VdmProc:
 861     sti
 862
 863     /* Call the debug routine */
 864 CallDispatch:
 865     mov esi, ecx
 866     mov edi, edx
 867     mov edx, eax
 868     mov ecx, 3
 869     push edi
 870     push esi
 871     push edx
 872     call _KdpServiceDispatcher@12
 873
 874 NotUserMode:
 875
 876     /* Get the current process */
 877     mov ebx, [fs:KPCR_CURRENT_THREAD]
 878     mov ebx, [ebx+KTHREAD_APCSTATE_PROCESS]
 879
 880     /* Check if this is a VDM Process */
 881     //cmp dword ptr [ebx+KPROCESS_VDM_OBJECTS], 0
 882     //jz VdmProc
 883
 884     /* Exit through common routine */
 885     jmp Kei386EoiHelper@0
 886
 887 Kei386EoiHelper@0:
 888
 889     /* Disable interrupts */
 890     cli
 891
 892     /* Check for V86 mode */
 893     test dword ptr [ebp+KTRAP_FRAME_EFLAGS], X86_EFLAGS_VM
 894     jnz ApcLoop3
 895
 896     /* Deliver APCs only if we were called from user mode */
 897     test byte ptr [ebp+KTRAP_FRAME_CS], 1
 898     je KiRosTrapReturn3
 899
 900     /* Get the current thread */
 901 ApcLoop3:
 902     mov ebx, [fs:KPCR_CURRENT_THREAD]
 903
 904     /* Make it non-alerted */
 905     mov byte ptr [ebx+KTHREAD_ALERTED], 0
 906
 907     /* And only if any are actually pending */
 908     cmp byte ptr [ebx+KTHREAD_PENDING_USER_APC], 0
 909     je KiRosTrapReturn3
 910
 911     /* Save pointer to Trap Frame */
 912     mov ebx, ebp
 913
 914     /* Raise IRQL to APC_LEVEL */
 915     mov ecx, 1
 916     call @KfRaiseIrql@4
 917
 918     /* Save old IRQL */
 919     push eax
 920
 921     /* Deliver APCs */
 922     sti
 923     push ebx
 924     push 0
 925     push UserMode
 926     call _KiDeliverApc@12
 927
 928     /* Return to old IRQL */
 929     pop ecx
 930     call @KfLowerIrql@4
 931     cli
 932     jmp ApcLoop3
 933
 934 KiRosTrapReturn3:
 935
 936     /* Restore exception list */
 937     mov edx, [esp+KTRAP_FRAME_EXCEPTION_LIST]
 938     mov [fs:KPCR_EXCEPTION_LIST], edx
 939
 940     /* Check for V86 */
 941     test dword ptr [esp+KTRAP_FRAME_EFLAGS], X86_EFLAGS_VM
 942     jnz V86_Exit3
 943
 944     /* Check if the frame was edited */
 945 V86_Exit_Return3:
 946     test word ptr [esp+KTRAP_FRAME_CS], FRAME_EDITED
 947     jz EditedFrame3
 948
 949     /* Restore volatiles */
 950     mov edx, [esp+KTRAP_FRAME_EDX]
 951     mov ecx, [esp+KTRAP_FRAME_ECX]
 952     mov eax, [esp+KTRAP_FRAME_EAX]
 953
 954     /* Check if it was kernel */
 955     cmp word ptr [ebp+KTRAP_FRAME_CS], KGDT_R0_CODE
 956     jz CommonStackClean3
 957
 958     /* Skip registers */
 959     lea esp, [ebp+KTRAP_FRAME_GS]
 960
 961     /* Restore segments and volatiles */
 962     pop gs
 963     pop es
 964     pop ds
 965     lea esp, [ebp+KTRAP_FRAME_FS]
 966     pop fs
 967
 968 CommonStackClean3:
 969     /* Skip debug information and unsaved registers */
 970     lea esp, [ebp+KTRAP_FRAME_EDI]
 971     pop edi
 972     pop esi
 973     pop ebx
 974     pop ebp
 975
 976     /* Check for ABIOS */
 977     cmp word ptr [esp+8], 0x80
 978     ja AbiosExit
 979
 980     /* Pop error code and return */
 981     add esp, 4
 982     iret
 983
 984 V86_Exit3:
 985     /* Move to EDX position */
 986     add esp, KTRAP_FRAME_EDX
 987
 988     /* Restore volatiles */
 989     pop edx
 990     pop ecx
 991     pop eax
 992     jmp V86_Exit_Return
 993
 994 EditedFrame3:
 995     /* Restore real CS value */
 996     mov ebx, [esp+KTRAP_FRAME_TEMPCS]
 997     mov [esp+KTRAP_FRAME_CS], ebx
 998
 999     /*
1000      * If ESP was modified, then a special interrupt exit stack
1001      * must be created to "update" ESP's value in a legal manner
1002      */
1003     mov ebx, [esp+KTRAP_FRAME_TEMPESP]
1004     sub ebx, 0xC
1005     mov [esp+KTRAP_FRAME_ERROR_CODE], ebx
1006
1007     /* Copy Interrupt Stack */
1008     mov esi, [esp+KTRAP_FRAME_EFLAGS]
1009     mov [ebx+8], esi
1010     mov esi, [esp+KTRAP_FRAME_CS]
1011     mov [ebx+4], esi
1012     mov esi, [esp+KTRAP_FRAME_EIP]
1013     mov [ebx], esi
1014
1015     /* Restore volatiles */
1016     mov eax, [esp+KTRAP_FRAME_EAX]
1017     mov edx, [esp+KTRAP_FRAME_EDX]
1018     mov ecx, [esp+KTRAP_FRAME_ECX]
1019
1020     /* Return */
1021     add esp, KTRAP_FRAME_EDI
1022     pop edi
1023     pop esi
1024     pop ebx
1025     pop ebp
1026     mov esp, [esp]
1027     iret
1028
1029 .globl _NtRaiseException@12
1030 _NtRaiseException@12:
1031
1032     /* NOTE: We -must- be called by Zw* to have the right frame! */
1033     /* Push the stack frame */
1034     push ebp
1035
1036     /* Get the current thread and restore its trap frame */
1037     mov ebx, [fs:KPCR_CURRENT_THREAD]
1038     mov edx, [ebp+KTRAP_FRAME_EDX]
1039     mov [ebx+KTHREAD_TRAP_FRAME], edx
1040
1041     /* Set up stack frame */
1042     mov ebp, esp
1043
1044     /* Get the Trap Frame in EBX */
1045     mov ebx, [ebp+0]
1046
1047     /* Get the exception list and restore */
1048     mov eax, [ebx+KTRAP_FRAME_EXCEPTION_LIST]
1049     mov [fs:KPCR_EXCEPTION_LIST], eax
1050
1051     /* Get the parameters */
1052     mov edx, [ebp+16] /* Search frames */
1053     mov ecx, [ebp+12] /* Context */
1054     mov eax, [ebp+8]  /* Exception Record */
1055
1056     /* Raise the exception */
1057     push edx
1058     push ebx
1059     push 0
1060     push ecx
1061     push eax
1062     call _KiRaiseException@20
1063
1064     /* Restore trap frame in EBP */
1065     pop ebp
1066     mov esp, ebp
1067
1068     /* Check the result */
1069     or eax, eax
1070     jz _KiServiceExit2
1071
1072     /* Restore debug registers too */
1073     jmp _KiServiceExit
1074
1075 .globl _NtContinue@8
1076 _NtContinue@8:
1077
1078     /* NOTE: We -must- be called by Zw* to have the right frame! */
1079     /* Push the stack frame */
1080     push ebp
1081
1082     /* Get the current thread and restore its trap frame */
1083     mov ebx, [fs:KPCR_CURRENT_THREAD]
1084     mov edx, [ebp+KTRAP_FRAME_EDX]
1085     mov [ebx+KTHREAD_TRAP_FRAME], edx
1086
1087     /* Set up stack frame */
1088     mov ebp, esp
1089
1090     /* Save the parameters */
1091     mov eax, [ebp+0]
1092     mov ecx, [ebp+8]
1093
1094     /* Call KiContinue */
1095     push eax
1096     push 0
1097     push ecx
1098     call _KiContinue@12
1099
1100     /* Check if we failed (bad context record) */
1101     or eax, eax
1102     jnz Error
1103
1104     /* Check if test alert was requested */
1105     cmp dword ptr [ebp+12], 0
1106     je DontTest
1107
1108     /* Test alert for the thread */
1109     mov al, [ebx+KTHREAD_PREVIOUS_MODE]
1110     push eax
1111     call _KeTestAlertThread@4
1112
1113 DontTest:
1114     /* Return to previous context */
1115     pop ebp
1116     mov esp, ebp
1117     jmp _KiServiceExit2
1118
1119 Error:
1120     pop ebp
1121     mov esp, ebp
1122     jmp _KiServiceExit
1123