2 * FILE: ntoskrnl/ke/i386/trap.S
3 * COPYRIGHT: See COPYING in the top level directory
4 * PURPOSE: System Traps, Entrypoints and Exitpoints
5 * PROGRAMMER: Alex Ionescu (alex@relsoft.net)
6 * NOTE: See asmmacro.S for the shared entry/exit code.
9 /* INCLUDES ******************************************************************/
12 #include <internal/i386/asmmacro.S>
13 .intel_syntax noprefix
16 #define WrDispatchInt 0x1F
18 /* GLOBALS *******************************************************************/
23 /* This is the Software Interrupt Table that we handle in this file: */
24 idt _KiTrap0, INT_32_DPL0 /* INT 00: Divide Error (#DE) */
25 idt _KiTrap1, INT_32_DPL0 /* INT 01: Debug Exception (#DB) */
26 idt _KiTrap2, INT_32_DPL0 /* INT 02: NMI Interrupt */
27 idt _KiTrap3, INT_32_DPL3 /* INT 03: Breakpoint Exception (#BP) */
28 idt _KiTrap4, INT_32_DPL3 /* INT 04: Overflow Exception (#OF) */
29 idt _KiTrap5, INT_32_DPL0 /* INT 05: BOUND Range Exceeded (#BR) */
30 idt _KiTrap6, INT_32_DPL0 /* INT 06: Invalid Opcode Code (#UD) */
31 idt _KiTrap7, INT_32_DPL0 /* INT 07: Device Not Available (#NM) */
32 idt _KiTrap8, INT_32_DPL0 /* INT 08: Double Fault Exception (#DF) */
33 idt _KiTrap9, INT_32_DPL0 /* INT 09: RESERVED */
34 idt _KiTrap10, INT_32_DPL0 /* INT 0A: Invalid TSS Exception (#TS) */
35 idt _KiTrap11, INT_32_DPL0 /* INT 0B: Segment Not Present (#NP) */
36 idt _KiTrap12, INT_32_DPL0 /* INT 0C: Stack Fault Exception (#SS) */
37 idt _KiTrap13, INT_32_DPL0 /* INT 0D: General Protection (#GP) */
38 idt _KiTrap14, INT_32_DPL0 /* INT 0E: Page-Fault Exception (#PF) */
39 idt _KiTrap0F, INT_32_DPL0 /* INT 0F: RESERVED */
40 idt _KiTrap16, INT_32_DPL0 /* INT 10: x87 FPU Error (#MF) */
41 idt _KiTrap17, INT_32_DPL0 /* INT 11: Align Check Exception (#AC) */
42 idt _KiTrap0F, INT_32_DPL0 /* INT 12: Machine Check Exception (#MC)*/
43 idt _KiTrap0F, INT_32_DPL0 /* INT 13: SIMD FPU Exception (#XF) */
45 idt _KiTrap0F, INT_32_DPL0 /* INT 14-29: UNDEFINED INTERRUPTS */
47 idt _KiGetTickCount, INT_32_DPL3 /* INT 2A: Get Tick Count Handler */
48 idt _KiCallbackReturn, INT_32_DPL3 /* INT 2B: User-Mode Callback Return */
49 idt _KiRaiseAssertion, INT_32_DPL3 /* INT 2C: Debug Assertion Handler */
50 idt _KiDebugService, INT_32_DPL3 /* INT 2D: Debug Service Handler */
51 idt _KiSystemService, INT_32_DPL3 /* INT 2E: System Call Service Handler */
52 idt _KiTrap0F, INT_32_DPL0 /* INT 2F: RESERVED */
53 GENERATE_IDT_STUBS /* INT 30-FF: UNEXPECTED INTERRUPTS */
55 /* System call entrypoints: */
56 .globl _KiFastCallEntry
57 .globl _KiSystemService
59 /* And special system-defined software traps: */
60 .globl _NtRaiseException@12
62 .globl _KiCoprocessorError@0
63 .globl _KiDispatchInterrupt@0
65 /* Interrupt template entrypoints */
66 .globl _KiInterruptTemplate
67 .globl _KiInterruptTemplateObject
68 .globl _KiInterruptTemplateDispatch
70 /* Chained and Normal generic interrupt handlers for 1st and 2nd level entry*/
71 .globl _KiChainedDispatch2ndLvl@0
72 .globl _KiInterruptDispatch@0
73 .globl _KiChainedDispatch@0
75 /* We implement the following trap exit points: */
76 .globl _KiServiceExit /* Exit from syscall */
77 .globl _KiServiceExit2 /* Exit from syscall with complete frame*/
78 .globl _Kei386EoiHelper@0 /* Exit from interrupt or H/W trap */
79 .globl _Kei386EoiHelper2ndEntry /* Exit from unexpected interrupt */
81 .globl _KiIdtDescriptor
86 .globl _KiUnexpectedEntrySize
87 _KiUnexpectedEntrySize:
88 .long _KiUnexpectedInterrupt1 - _KiUnexpectedInterrupt0
91 .asciz "\n\x7\x7!!! Unexpected Interrupt %02lx !!!\n"
94 .asciz "\n\x7\x7!!! Unhandled or Unexpected Code at line: %lx!!!\n"
98 .byte 0xF3 /* REP INS/OUTS */
100 .byte 0xF0 /* LOCK */
120 .byte 0x6E /* OUTS */
121 .byte 0x6F /* OUTS */
123 /* SOFTWARE INTERRUPT SERVICES ***********************************************/
132 .func KiSystemService
133 Dr_kss: DR_TRAP_FIXUP
136 /* Enter the shared system call prolog */
139 /* Jump to the actual handler */
143 .func KiFastCallEntry
144 Dr_FastCallDrSave: DR_TRAP_FIXUP
147 /* Enter the fast system call prolog */
148 FASTCALL_PROLOG FastCallDrSave
153 * Find out which table offset to use. Converts 0x1124 into 0x10.
154 * The offset is related to the Table Index as such: Offset = TableIndex x 10
157 shr edi, SERVICE_TABLE_SHIFT
158 and edi, SERVICE_TABLE_MASK
161 /* Now add the thread's base system table to the offset */
162 add edi, [esi+KTHREAD_SERVICE_TABLE]
164 /* Get the true syscall ID and check it */
166 and eax, SERVICE_NUMBER_MASK
167 cmp eax, [edi+SERVICE_DESCRIPTOR_LIMIT]
169 /* Invalid ID, try to load Win32K Table */
170 jnb KiBBTUnexpectedRange
172 /* Check if this was Win32K */
173 cmp ecx, SERVICE_TABLE_TEST
177 mov ecx, [fs:KPCR_TEB]
179 /* Check if we should flush the User Batch */
182 or ebx, [ecx+TEB_GDI_BATCH_COUNT]
188 //call [_KeGdiFlushUserBatch]
193 /* Increase total syscall count */
194 inc dword ptr fs:[KPCR_SYSTEM_CALLS]
197 /* Increase per-syscall count */
198 mov ecx, [edi+SERVICE_DESCRIPTOR_COUNT]
200 inc dword ptr [ecx+eax*4]
203 /* Users's current stack frame pointer is source */
207 /* Allocate room for argument list from kernel stack */
208 mov ebx, [edi+SERVICE_DESCRIPTOR_NUMBER]
212 /* Get pointer to function */
213 mov edi, [edi+SERVICE_DESCRIPTOR_BASE]
216 /* Allocate space on our stack */
219 /* Set the size of the arguments and the destination */
223 /* Make sure we're within the User Probe Address */
224 cmp esi, _MmUserProbeAddress
228 /* Copy the parameters */
231 /* Do the System Call */
236 /* Make sure the user-mode call didn't return at elevated IRQL */
237 test byte ptr [ebp+KTRAP_FRAME_CS], MODE_MASK
239 mov esi, eax /* We need to save the syscall's return val */
240 call _KeGetCurrentIrql@0
243 mov eax, esi /* Restore it */
245 /* Get our temporary current thread pointer for sanity check */
246 mov ecx, fs:[KPCR_CURRENT_THREAD]
248 /* Make sure that we are not attached and that APCs are not disabled */
249 mov dl, [ecx+KTHREAD_APC_STATE_INDEX]
252 mov edx, [ecx+KTHREAD_COMBINED_APC_DISABLE]
259 /* Deallocate the kernel stack frame */
262 KeReturnFromSystemCall:
264 /* Get the Current Thread */
265 mov ecx, [fs:KPCR_CURRENT_THREAD]
267 /* Restore the old trap frame pointer */
268 mov edx, [ebp+KTRAP_FRAME_EDX]
269 mov [ecx+KTHREAD_TRAP_FRAME], edx
274 /* Disable interrupts */
277 /* Check for, and deliver, User-Mode APCs if needed */
278 CHECK_FOR_APC_DELIVER 1
280 /* Exit and cleanup */
281 TRAP_EPILOG FromSystemCall, DoRestorePreviousMode, DoNotRestoreSegments, DoNotRestoreVolatiles, DoRestoreEverything
284 KiBBTUnexpectedRange:
286 /* If this isn't a Win32K call, fail */
287 cmp ecx, SERVICE_TABLE_TEST
290 /* Set up Win32K Table */
293 call _PsConvertToGuiThread@0
295 /* Check return code */
298 /* Restore registers */
302 /* Reset trap frame address */
304 mov [esi+KTHREAD_TRAP_FRAME], ebp
306 /* Try the Call again, if we suceeded */
310 * The Shadow Table should have a special byte table which tells us
311 * whether we should return FALSE, -1 or STATUS_INVALID_SYSTEM_SERVICE.
314 /* Get the table limit and base */
315 lea edx, _KeServiceDescriptorTableShadow + SERVICE_TABLE_TEST
316 mov ecx, [edx+SERVICE_DESCRIPTOR_LIMIT]
317 mov edx, [edx+SERVICE_DESCRIPTOR_BASE]
319 /* Get the table address and add our index into the array */
321 and eax, SERVICE_NUMBER_MASK
324 /* Find out what we should return */
325 movsx eax, byte ptr [edx]
328 /* Return either 0 or -1, we've set it in EAX */
329 jle KeReturnFromSystemCall
331 /* Set STATUS_INVALID_SYSTEM_SERVICE */
332 mov eax, STATUS_INVALID_SYSTEM_SERVICE
333 jmp KeReturnFromSystemCall
337 /* Invalid System Call */
338 mov eax, STATUS_INVALID_SYSTEM_SERVICE
339 jmp KeReturnFromSystemCall
343 /* Check if this came from kernel-mode */
344 test byte ptr [ebp+KTRAP_FRAME_CS], MODE_MASK
346 /* It's fine, go ahead with it */
349 /* Caller sent invalid parameters, fail here */
350 mov eax, STATUS_ACCESS_VIOLATION
355 /* Restore ESP0 stack */
356 mov ecx, [fs:KPCR_TSS]
357 mov esp, ss:[ecx+KTSS_ESP0]
359 /* Generate V86M Stack for Trap 6 */
365 /* Generate interrupt stack for Trap 6 */
366 push KGDT_R3_DATA + RPL_MASK
369 push KGDT_R3_CODE + RPL_MASK
375 /* Save current IRQL */
378 /* Set us at passive */
379 mov dword ptr fs:[KPCR_IRQL], 0
387 push IRQL_GT_ZERO_AT_SYSTEM_SERVICE
388 call _KeBugCheckEx@20
392 /* Get the index and APC state */
393 movzx eax, byte ptr [ecx+KTHREAD_APC_STATE_INDEX]
394 mov edx, [ecx+KTHREAD_COMBINED_APC_DISABLE]
401 push APC_INDEX_MISMATCH
402 call _KeBugCheckEx@20
409 /* Disable interrupts */
412 /* Check for, and deliver, User-Mode APCs if needed */
413 CHECK_FOR_APC_DELIVER 0
415 /* Exit and cleanup */
416 TRAP_EPILOG NotFromSystemCall, DoRestorePreviousMode, DoRestoreSegments, DoRestoreVolatiles, DoNotRestoreEverything
419 .func Kei386EoiHelper@0
422 /* Disable interrupts */
425 /* Check for, and deliver, User-Mode APCs if needed */
426 CHECK_FOR_APC_DELIVER 0
428 /* Exit and cleanup */
429 _Kei386EoiHelper2ndEntry:
430 TRAP_EPILOG NotFromSystemCall, DoNotRestorePreviousMode, DoRestoreSegments, DoRestoreVolatiles, DoNotRestoreEverything
434 /* Move to EDX position */
435 add esp, KTRAP_FRAME_EDX
437 /* Restore volatiles */
442 /* Move to non-volatiles */
443 lea esp, [ebp+KTRAP_FRAME_EDI]
449 /* Skip error code and return */
458 Dr_kids: DR_TRAP_FIXUP
459 V86_kids: V86_TRAP_FIXUP
462 /* Push error code */
468 /* Increase EIP so we skip the INT3 */
469 inc dword ptr [ebp+KTRAP_FRAME_EIP]
471 /* Call debug service dispatcher */
472 mov eax, [ebp+KTRAP_FRAME_EAX]
473 mov ecx, [ebp+KTRAP_FRAME_ECX]
474 mov edx, [ebp+KTRAP_FRAME_EDX]
476 /* Jump to INT3 handler */
480 .func NtRaiseException@12
481 _NtRaiseException@12:
483 /* NOTE: We -must- be called by Zw* to have the right frame! */
484 /* Push the stack frame */
487 /* Get the current thread and restore its trap frame */
488 mov ebx, [fs:KPCR_CURRENT_THREAD]
489 mov edx, [ebp+KTRAP_FRAME_EDX]
490 mov [ebx+KTHREAD_TRAP_FRAME], edx
492 /* Set up stack frame */
495 /* Get the Trap Frame in EBX */
498 /* Get the exception list and restore */
499 mov eax, [ebx+KTRAP_FRAME_EXCEPTION_LIST]
500 mov [fs:KPCR_EXCEPTION_LIST], eax
502 /* Get the parameters */
503 mov edx, [ebp+16] /* Search frames */
504 mov ecx, [ebp+12] /* Context */
505 mov eax, [ebp+8] /* Exception Record */
507 /* Raise the exception */
513 call _KiRaiseException@20
515 /* Restore trap frame in EBP */
519 /* Check the result */
523 /* Restore debug registers too */
530 /* NOTE: We -must- be called by Zw* to have the right frame! */
531 /* Push the stack frame */
534 /* Get the current thread and restore its trap frame */
535 mov ebx, [fs:KPCR_CURRENT_THREAD]
536 mov edx, [ebp+KTRAP_FRAME_EDX]
537 mov [ebx+KTHREAD_TRAP_FRAME], edx
539 /* Set up stack frame */
542 /* Save the parameters */
546 /* Call KiContinue */
552 /* Check if we failed (bad context record) */
556 /* Check if test alert was requested */
557 cmp dword ptr [ebp+12], 0
560 /* Test alert for the thread */
561 mov al, [ebx+KTHREAD_PREVIOUS_MODE]
563 call _KeTestAlertThread@4
566 /* Return to previous context */
577 /* EXCEPTION DISPATCHERS *****************************************************/
579 .func CommonDispatchException
580 _CommonDispatchException:
582 /* Make space for an exception record */
583 sub esp, EXCEPTION_RECORD_LENGTH
586 mov [esp+EXCEPTION_RECORD_EXCEPTION_CODE], eax
588 mov [esp+EXCEPTION_RECORD_EXCEPTION_FLAGS], eax
589 mov [esp+EXCEPTION_RECORD_EXCEPTION_RECORD], eax
590 mov [esp+EXCEPTION_RECORD_EXCEPTION_ADDRESS], ebx
591 mov [esp+EXCEPTION_RECORD_NUMBER_PARAMETERS], ecx
593 /* Check parameter count */
597 /* Get information */
598 lea ebx, [esp+SIZEOF_EXCEPTION_RECORD]
605 /* Set the record in ECX and check if this was V86 */
607 test dword ptr [esp+KTRAP_FRAME_EFLAGS], EFLAGS_V86_MASK
616 /* Get the caller's CS */
617 mov eax, [ebp+KTRAP_FRAME_CS]
620 /* Check if it was user-mode or kernel-mode */
623 /* Dispatch the exception */
629 call _KiDispatchException@20
633 jmp _Kei386EoiHelper@0
636 .func DispatchNoParam
638 /* Call the common dispatcher */
640 call _CommonDispatchException
643 .func DispatchOneParam
645 /* Call the common dispatcher */
648 call _CommonDispatchException
651 .func DispatchTwoParam
653 /* Call the common dispatcher */
656 call _CommonDispatchException
659 /* HARDWARE TRAP HANDLERS ****************************************************/
664 /* TODO: Routine to fixup a KTRAP_FRAME when faulting from a syscall. */
669 Dr_kit0: DR_TRAP_FIXUP
670 V86_kit0: V86_TRAP_FIXUP
672 /* Push error code */
679 test dword ptr [ebp+KTRAP_FRAME_EFLAGS], EFLAGS_V86_MASK
682 /* Check if the frame was from kernelmode */
683 test word ptr [ebp+KTRAP_FRAME_CS], MODE_MASK
686 /* Check the old mode */
687 cmp word ptr [ebp+KTRAP_FRAME_CS], KGDT_R3_CODE + RPL_MASK
691 /* Re-enable interrupts for user-mode and send the exception */
693 mov eax, STATUS_INTEGER_DIVIDE_BY_ZERO
694 mov ebx, [ebp+KTRAP_FRAME_EIP]
698 /* Check if this is a VDM process */
699 mov ebx, [fs:KPCR_CURRENT_THREAD]
700 mov ebx, [ebx+KTHREAD_APCSTATE_PROCESS]
701 cmp dword ptr [ebx+EPROCESS_VDM_OBJECTS], 0
704 /* We don't support this yet! */
711 Dr_kit1: DR_TRAP_FIXUP
712 V86_kit1: V86_TRAP_FIXUP
714 /* Push error code */
721 test dword ptr [ebp+KTRAP_FRAME_EFLAGS], EFLAGS_V86_MASK
724 /* Check if the frame was from kernelmode */
725 test word ptr [ebp+KTRAP_FRAME_CS], MODE_MASK
728 /* Check the old mode */
729 cmp word ptr [ebp+KTRAP_FRAME_CS], KGDT_R3_CODE + RPL_MASK
733 /* Enable interrupts for user-mode */
737 /* Prepare the exception */
738 and dword ptr [ebp+KTRAP_FRAME_EFLAGS], ~EFLAGS_TF
739 mov ebx, [ebp+KTRAP_FRAME_EIP]
740 mov eax, STATUS_SINGLE_STEP
744 /* Check if this is a VDM process */
745 mov ebx, [fs:KPCR_CURRENT_THREAD]
746 mov ebx, [ebx+KTHREAD_APCSTATE_PROCESS]
747 cmp dword ptr [ebx+EPROCESS_VDM_OBJECTS], 0
750 /* We don't support VDM! */
758 /* FIXME: This is an NMI, nothing like a normal exception */
760 jmp _KiSystemFatalException
764 Dr_kit3: DR_TRAP_FIXUP
765 V86_kit3: V86_TRAP_FIXUP
767 /* Push error code */
773 /* Set status code */
774 mov eax, 0 //STATUS_SUCCESS
778 test dword ptr [ebp+KTRAP_FRAME_EFLAGS], EFLAGS_V86_MASK
781 /* Check if the frame was from kernelmode */
782 test word ptr [ebp+KTRAP_FRAME_CS], MODE_MASK
785 /* Check the old mode */
786 cmp word ptr [ebp+KTRAP_FRAME_CS], KGDT_R3_CODE + RPL_MASK
790 /* Enable interrupts for user-mode */
794 /* Prepare the exception */
799 /* Setup EIP, NTSTATUS and parameter count, then dispatch */
800 mov ebx, [ebp+KTRAP_FRAME_EIP]
803 mov eax, STATUS_BREAKPOINT
804 call _CommonDispatchException
807 /* Check if this is a VDM process */
808 mov ebx, [fs:KPCR_CURRENT_THREAD]
809 mov ebx, [ebx+KTHREAD_APCSTATE_PROCESS]
810 cmp dword ptr [ebx+EPROCESS_VDM_OBJECTS], 0
813 /* We don't support VDM! */
818 Dr_kit4: DR_TRAP_FIXUP
819 V86_kit4: V86_TRAP_FIXUP
821 /* Push error code */
828 test dword ptr [ebp+KTRAP_FRAME_EFLAGS], EFLAGS_V86_MASK
831 /* Check if the frame was from kernelmode */
832 test word ptr [ebp+KTRAP_FRAME_CS], MODE_MASK
835 /* Check the old mode */
836 cmp word ptr [ebp+KTRAP_FRAME_CS], KGDT_R3_CODE + RPL_MASK
840 /* Re-enable interrupts for user-mode and send the exception */
842 mov eax, STATUS_INTEGER_OVERFLOW
843 mov ebx, [ebp+KTRAP_FRAME_EIP]
848 /* Check if this is a VDM process */
849 mov ebx, [fs:KPCR_CURRENT_THREAD]
850 mov ebx, [ebx+KTHREAD_APCSTATE_PROCESS]
851 cmp dword ptr [ebx+EPROCESS_VDM_OBJECTS], 0
854 /* We don't support this yet! */
860 Dr_kit5: DR_TRAP_FIXUP
861 V86_kit5: V86_TRAP_FIXUP
863 /* Push error code */
870 test dword ptr [ebp+KTRAP_FRAME_EFLAGS], EFLAGS_V86_MASK
873 /* Check if the frame was from kernelmode */
874 test word ptr [ebp+KTRAP_FRAME_CS], MODE_MASK
877 /* It did, and this should never happen */
879 jmp _KiSystemFatalException
881 /* Check the old mode */
883 cmp word ptr [ebp+KTRAP_FRAME_CS], KGDT_R3_CODE + RPL_MASK
886 /* Re-enable interrupts for user-mode and send the exception */
889 mov eax, STATUS_ARRAY_BOUNDS_EXCEEDED
890 mov ebx, [ebp+KTRAP_FRAME_EIP]
894 /* Check if this is a VDM process */
895 mov ebx, [fs:KPCR_CURRENT_THREAD]
896 mov ebx, [ebx+KTHREAD_APCSTATE_PROCESS]
897 cmp dword ptr [ebx+EPROCESS_VDM_OBJECTS], 0
900 /* We don't support this yet! */
906 Dr_kit6: DR_TRAP_FIXUP
907 V86_kit6: V86_TRAP_FIXUP
910 /* It this a V86 GPF? */
911 test dword ptr [esp+8], EFLAGS_V86_MASK
917 /* Not yet supported (Invalid OPCODE from V86) */
921 /* Push error code */
927 /* Check if this happened in kernel mode */
928 test byte ptr [ebp+KTRAP_FRAME_CS], MODE_MASK
932 cmp word ptr [ebp+KTRAP_FRAME_CS], KGDT_R3_CODE + RPL_MASK
935 /* Check if the process is vDM */
936 mov ebx, fs:[KPCR_CURRENT_THREAD]
937 mov ebx, [ebx+KTHREAD_APCSTATE_PROCESS]
938 cmp dword ptr [ebx+EPROCESS_VDM_OBJECTS], 0
942 /* Get EIP and enable interrupts at this point */
943 mov esi, [ebp+KTRAP_FRAME_EIP]
946 /* Set intruction prefix length */
949 /* Setup a SEH frame */
952 push fs:[KPCR_EXCEPTION_LIST]
953 mov fs:[KPCR_EXCEPTION_LIST], esp
956 /* Get the instruction and check if it's LOCK */
966 pop fs:[KPCR_EXCEPTION_LIST]
971 /* Re-enable interrupts */
974 /* Setup illegal instruction exception and dispatch it */
975 mov ebx, [ebp+KTRAP_FRAME_EIP]
976 mov eax, STATUS_ILLEGAL_INSTRUCTION
982 pop fs:[KPCR_EXCEPTION_LIST]
985 /* Setup invalid lock exception and dispatch it */
986 mov ebx, [ebp+KTRAP_FRAME_EIP]
987 mov eax, STATUS_INVALID_LOCK_SEQUENCE
995 /* Return to caller */
996 jmp _Kei386EoiHelper@0
1002 pop fs:[KPCR_EXCEPTION_LIST]
1006 /* Check if this was user mode */
1007 test dword ptr [ebp+KTRAP_FRAME_CS], MODE_MASK
1016 push KMODE_EXCEPTION_NOT_HANDLED
1017 call _KeBugCheckWithTf@24
1021 Dr_kit7: DR_TRAP_FIXUP
1022 V86_kit7: V86_TRAP_FIXUP
1024 /* Push error code */
1030 /* Get the current thread and stack */
1032 mov eax, [fs:KPCR_CURRENT_THREAD]
1033 mov ecx, [eax+KTHREAD_INITIAL_STACK]
1034 sub ecx, NPX_FRAME_LENGTH
1036 /* Check if emulation is enabled */
1037 test dword ptr [ecx+FN_CR0_NPX_STATE], CR0_EM
1038 jnz EmulationEnabled
1041 /* Check if the NPX state is loaded */
1042 cmp byte ptr [eax+KTHREAD_NPX_STATE], NPX_STATE_LOADED
1047 and ebx, ~(CR0_MP + CR0_TS + CR0_EM)
1050 /* Check the NPX thread */
1051 mov edx, [fs:KPCR_NPX_THREAD]
1055 /* Get the NPX Stack */
1056 mov esi, [edx+KTHREAD_INITIAL_STACK]
1057 sub esi, NPX_FRAME_LENGTH
1059 /* Check if we have FXSR and check which operand to use */
1060 test byte ptr _KeI386FxsrPresent, 1
1069 /* Set the thread's state to dirty */
1070 mov byte ptr [edx+KTHREAD_NPX_STATE], NPX_STATE_NOT_LOADED
1073 /* Check if we have FXSR and choose which operand to use */
1074 test byte ptr _KeI386FxsrPresent, 1
1083 /* Set state loaded */
1084 mov byte ptr [eax+KTHREAD_NPX_STATE], NPX_STATE_LOADED
1085 mov [fs:KPCR_NPX_THREAD], eax
1087 /* Enable interrupts to happen now */
1091 /* Check if CR0 needs to be reloaded due to a context switch */
1092 cmp dword ptr [ecx+FN_CR0_NPX_STATE], 0
1093 jz _Kei386EoiHelper@0
1095 /* We have to reload CR0... disable interrupts */
1098 /* Get CR0 and update it */
1100 or ebx, [ecx+FN_CR0_NPX_STATE]
1103 /* Restore interrupts and check if TS is back on */
1106 jz _Kei386EoiHelper@0
1108 /* Clear TS, and loop handling again */
1115 /* Set delayed error */
1116 or dword ptr [ecx+FN_CR0_NPX_STATE], CR0_TS
1118 /* Check if this happened during restore */
1119 cmp dword ptr [ebp+KTRAP_FRAME_EIP], offset FrRestore
1122 /* Skip instruction and dispatch the exception */
1123 add dword ptr [ebp+KTRAP_FRAME_EIP], 3
1124 jmp _Kei386EoiHelper@0
1127 /* Check if TS is set */
1129 jnz TsSetOnLoadedState
1132 /* Check if the trap came from V86 mode */
1133 test dword ptr [ebp+KTRAP_FRAME_EFLAGS], EFLAGS_V86_MASK
1136 /* Check if it came from kernel mode */
1137 test byte ptr [ebp+KTRAP_FRAME_CS], MODE_MASK
1140 /* Check if it came from a VDM */
1141 cmp word ptr [ebp+KTRAP_FRAME_CS], KGDT_R3_CODE + RPL_MASK
1145 /* Get the current thread */
1146 mov eax, fs:[KPCR_CURRENT_THREAD]
1148 /* Check NPX state */
1149 cmp byte ptr [eax+KTHREAD_NPX_STATE], NPX_STATE_NOT_LOADED
1151 /* Get the NPX save area */
1152 mov ecx, [eax+KTHREAD_INITIAL_STACK]
1153 lea ecx, [ecx-NPX_FRAME_LENGTH]
1160 and ebx, ~(CR0_MP + CR0_EM + CR0_TS)
1163 /* Check if we have FX support */
1164 test byte ptr _KeI386FxsrPresent, 1
1167 /* Save the state */
1175 /* Make CR0 state not loaded */
1176 or ebx, NPX_STATE_NOT_LOADED
1177 or ebx, [ecx+FN_CR0_NPX_STATE]
1180 /* Update NPX state */
1181 mov byte ptr [eax+KTHREAD_NPX_STATE], NPX_STATE_NOT_LOADED
1182 mov dword ptr fs:[KPCR_NPX_THREAD], 0
1185 /* Clear the TS bit and re-enable interrupts */
1186 and dword ptr [ecx+FN_CR0_NPX_STATE], ~CR0_TS
1189 /* Check if we have FX support */
1190 test byte ptr _KeI386FxsrPresent, 1
1193 /* Get error offset, control and status words */
1194 mov ebx, [ecx+FX_ERROR_OFFSET]
1195 movzx eax, word ptr [ecx+FX_CONTROL_WORD]
1196 movzx edx, word ptr [ecx+FX_STATUS_WORD]
1198 /* Get the faulting opcode */
1199 mov esi, [ecx+FX_DATA_OFFSET]
1203 /* Get error offset, control and status words */
1204 mov ebx, [ecx+FP_ERROR_OFFSET]
1205 movzx eax, word ptr [ecx+FP_CONTROL_WORD]
1206 movzx edx, word ptr [ecx+FP_STATUS_WORD]
1208 /* Get the faulting opcode */
1209 mov esi, [ecx+FP_DATA_OFFSET]
1212 /* Mask exceptions */
1217 /* Check if what's left is invalid */
1221 /* Check if it was a stack fault */
1225 /* Raise exception */
1226 mov eax, STATUS_FLOAT_INVALID_OPERATION
1227 jmp _DispatchOneParam
1231 /* Raise exception */
1232 mov eax, STATUS_FLOAT_STACK_CHECK
1233 jmp _DispatchTwoParam
1237 /* Check for divide by 0 */
1241 /* Raise exception */
1242 mov eax, STATUS_FLOAT_DIVIDE_BY_ZERO
1243 jmp _DispatchOneParam
1246 /* Check for denormal */
1250 /* Raise exception */
1251 mov eax, STATUS_FLOAT_INVALID_OPERATION
1252 jmp _DispatchOneParam
1255 /* Check for overflow */
1259 /* Raise exception */
1260 mov eax, STATUS_FLOAT_OVERFLOW
1261 jmp _DispatchOneParam
1264 /* Check for underflow */
1268 /* Raise exception */
1269 mov eax, STATUS_FLOAT_UNDERFLOW
1270 jmp _DispatchOneParam
1273 /* Check for precision fault */
1277 /* Raise exception */
1278 mov eax, STATUS_FLOAT_INEXACT_RESULT
1279 jmp _DispatchOneParam
1283 /* Strange result, bugcheck the OS */
1290 push TRAP_CAUSE_UNKNOWN
1291 call _KeBugCheckWithTf@24
1294 /* Check if this is a VDM */
1295 mov eax, fs:[KPCR_CURRENT_THREAD]
1296 mov ebx, [eax+KTHREAD_APCSTATE_PROCESS]
1297 cmp dword ptr [ebx+EPROCESS_VDM_OBJECTS], 0
1300 /* V86 NPX not handled */
1304 /* Did this come from kernel-mode? */
1305 cmp word ptr [ebp+KTRAP_FRAME_CS], KGDT_R0_CODE
1308 /* It came from user-mode, so this would only be valid inside a VDM */
1309 /* Since we don't actually have VDMs in ROS, bugcheck. */
1313 /* TS shouldn't be set, unless this we don't have a Math Processor */
1317 /* Strange that we got a trap at all, but ignore and continue */
1319 jmp _Kei386EoiHelper@0
1322 /* Cause a bugcheck */
1327 push TRAP_CAUSE_UNKNOWN
1328 call _KeBugCheckEx@20
1335 /* Can't really do too much */
1337 jmp _KiSystemFatalException
1341 Dr_kit9: DR_TRAP_FIXUP
1342 V86_kit9: V86_TRAP_FIXUP
1344 /* Push error code */
1350 /* Enable interrupts and bugcheck */
1353 jmp _KiSystemFatalException
1357 Dr_kit10: DR_TRAP_FIXUP
1358 V86_kit10: V86_TRAP_FIXUP
1364 test dword ptr [ebp+KTRAP_FRAME_EFLAGS], EFLAGS_V86_MASK
1367 /* Check if the frame was from kernelmode */
1368 test word ptr [ebp+KTRAP_FRAME_CS], MODE_MASK
1372 /* Check if OF was set during iretd */
1373 test dword ptr [ebp+KTRAP_FRAME_EFLAGS], EFLAG_ZERO
1377 /* It was, just mask it out */
1378 and dword ptr [ebp+KTRAP_FRAME_EFLAGS], ~EFLAG_ZERO
1379 jmp _Kei386EoiHelper@0
1382 /* TSS failure for some other reason: crash */
1384 jmp _KiSystemFatalException
1388 Dr_kit11: DR_TRAP_FIXUP
1389 V86_kit11: V86_TRAP_FIXUP
1394 /* FIXME: ROS Doesn't handle segment faults yet */
1396 jmp _KiSystemFatalException
1400 Dr_kit12: DR_TRAP_FIXUP
1401 V86_kit12: V86_TRAP_FIXUP
1406 /* FIXME: ROS Doesn't handle stack faults yet */
1408 jmp _KiSystemFatalException
1411 .func KiTrapExceptHandler
1412 _KiTrapExceptHandler:
1414 /* Setup SEH handler frame */
1416 pop fs:[KPCR_EXCEPTION_LIST]
1420 /* Check if the fault came from user mode */
1421 test dword ptr [ebp+KTRAP_FRAME_CS], MODE_MASK
1424 /* Kernel fault, bugcheck */
1430 push KMODE_EXCEPTION_NOT_HANDLED
1431 call _KeBugCheckWithTf@24
1435 Dr_kitd: DR_TRAP_FIXUP
1436 V86_kitd: V86_TRAP_FIXUP
1439 /* It this a V86 GPF? */
1440 test dword ptr [esp+12], EFLAGS_V86_MASK
1443 /* Enter V86 Trap */
1444 V86_TRAP_PROLOG kitd
1446 /* Make sure that this is a V86 process */
1447 mov ecx, [fs:KPCR_CURRENT_THREAD]
1448 mov ecx, [ecx+KTHREAD_APCSTATE_PROCESS]
1449 cmp dword ptr [ecx+EPROCESS_VDM_OBJECTS], 0
1452 /* Otherwise, something is very wrong, raise an exception */
1454 mov ebx, [ebp+KTRAP_FRAME_EIP]
1456 mov eax, STATUS_ACCESS_VIOLATION
1457 jmp _DispatchTwoParam
1461 /* Go to APC level */
1465 /* Save old IRQL and enable interrupts */
1469 /* Handle the opcode */
1470 call _Ki386HandleOpcodeV86@0
1472 /* Check if this was VDM */
1481 /* Lower IRQL and disable interrupts */
1486 /* Check if this was a V86 trap */
1487 test dword ptr [ebp+KTRAP_FRAME_EFLAGS], EFLAGS_V86_MASK
1490 /* Exit the V86 Trap */
1495 /* Either this wasn't V86, or it was, but an APC interrupted us */
1496 jmp _Kei386EoiHelper@0
1502 /* Check if this was from kernel-mode */
1503 test dword ptr [ebp+KTRAP_FRAME_CS], MODE_MASK
1506 /* Check if we have a VDM alert */
1507 cmp dword ptr fs:[KPCR_VDM_ALERT], 0
1510 /* Check for GPF during GPF */
1511 mov eax, [ebp+KTRAP_FRAME_EIP]
1512 cmp eax, offset CheckPrivilegedInstruction
1514 cmp eax, offset CheckPrivilegedInstruction2
1519 /* Get the opcode and trap frame */
1521 mov eax, [ebp+KTRAP_FRAME_EIP]
1523 mov edx, [ebp+KTRAP_FRAME_EBP]
1525 /* We want to check if this was POP [DS/ES/FS/GS] */
1526 add edx, KTRAP_FRAME_DS
1529 add edx, KTRAP_FRAME_ES - KTRAP_FRAME_DS
1532 add edx, KTRAP_FRAME_FS - KTRAP_FRAME_ES
1535 add edx, KTRAP_FRAME_GS - KTRAP_FRAME_FS
1539 /* It isn't, was it IRETD? */
1543 /* Get error code */
1544 lea edx, [ebp+KTRAP_FRAME_ESP]
1545 mov ax, [ebp+KTRAP_FRAME_ERROR_CODE]
1549 mov cx, word ptr [edx+4]
1554 /* This should be a Ki386CallBios return */
1555 mov eax, offset _Ki386BiosCallReturnAddress
1559 cmp ax, KGDT_R0_CODE + RPL_MASK
1562 /* Jump to return address */
1563 jmp _Ki386BiosCallReturnAddress
1566 /* Check if the thread was in kernel mode */
1567 mov ebx, [fs:KPCR_CURRENT_THREAD]
1568 test byte ptr [ebx+KTHREAD_PREVIOUS_MODE], 0xFF
1571 /* Set RPL_MASK for check below */
1572 or word ptr [edx+4], RPL_MASK
1575 /* Check if the IRET goes to user-mode */
1576 test dword ptr [edx+4], RPL_MASK
1579 /* Setup trap frame to copy */
1580 mov ecx, (KTRAP_FRAME_LENGTH - 12) / 4
1581 lea edx, [ebp+KTRAP_FRAME_ERROR_CODE]
1585 /* Copy each field */
1591 /* Enable interrupts and adjust stack */
1596 /* Setup exception record */
1597 mov ebx, [ebp+KTRAP_FRAME_EIP]
1598 mov esi, [ebp+KTRAP_FRAME_ERROR_CODE]
1600 mov eax, STATUS_ACCESS_VIOLATION
1601 jmp _DispatchTwoParam
1605 /* FIXME: Handle RDMSR/WRMSR */
1610 /* Check if this was an MSR opcode */
1614 /* Check if DS is Ring 3 */
1615 cmp word ptr [ebp+KTRAP_FRAME_DS], KGDT_R3_DATA + RPL_MASK
1618 /* Otherwise, fix it up */
1619 mov dword ptr [ebp+KTRAP_FRAME_DS], KGDT_R3_DATA + RPL_MASK
1624 /* Check if ES is Ring 3 */
1625 cmp word ptr [ebp+KTRAP_FRAME_ES], KGDT_R3_DATA + RPL_MASK
1628 /* Otherwise, fix it up */
1629 mov dword ptr [ebp+KTRAP_FRAME_ES], KGDT_R3_DATA + RPL_MASK
1635 lea eax, [ebp+KTRAP_FRAME_ESP]
1640 /* Handle segment POP fault by setting it to 0 */
1643 mov dword ptr [edx], eax
1647 /* Do a trap exit */
1648 TRAP_EPILOG NotFromSystemCall, DoNotRestorePreviousMode, DoNotRestoreSegments, DoRestoreVolatiles, DoRestoreEverything
1652 /* If the previous mode was kernel, raise a fatal exception */
1654 test byte ptr [ebp+KTRAP_FRAME_CS], MODE_MASK
1655 jz _KiSystemFatalException
1657 /* Get the process and check which CS this came from */
1658 mov ebx, fs:[KPCR_CURRENT_THREAD]
1659 mov ebx, [ebx+KTHREAD_APCSTATE_PROCESS]
1660 cmp word ptr [ebp+KTRAP_FRAME_CS], KGDT_R3_CODE + RPL_MASK
1663 /* Check if this is a VDM */
1664 cmp dword ptr [ebx+EPROCESS_VDM_OBJECTS], 0
1667 /* Enable interrupts and check if we have an error code */
1669 cmp word ptr [ebp+KTRAP_FRAME_ERROR_CODE], 0
1671 jmp CheckPrivilegedInstruction
1674 /* Update EIP (will be updated below again) */
1675 add dword ptr [ebp+KTRAP_FRAME_EIP], 1
1678 /* Clear the segment, update EIP and ESP */
1679 mov dword ptr [edx], 0
1680 add dword ptr [ebp+KTRAP_FRAME_EIP], 1
1681 add dword ptr [ebp+KTRAP_FRAME_ESP], 4
1682 jmp _Kei386EoiHelper@0
1685 /* Check if this is a VDM */
1686 cmp dword ptr [ebx+EPROCESS_VDM_OBJECTS], 0
1687 jz CheckPrivilegedInstruction
1689 /* Bring interrupts back */
1692 /* Check what kind of instruction this is */
1693 mov eax, [ebp+KTRAP_FRAME_EIP]
1696 /* FIXME: Check for BOP4 */
1698 /* Check if this is POP ES */
1700 add edx, KTRAP_FRAME_ES
1704 /* Check if this is POP FS */
1705 add edx, KTRAP_FRAME_FS - KTRAP_FRAME_ES
1709 /* Check if this is POP GS */
1710 add edx, KTRAP_FRAME_GS - KTRAP_FRAME_FS
1714 CheckPrivilegedInstruction:
1715 /* Bring interrupts back */
1718 /* Setup a SEH handler */
1720 push offset _KiTrapExceptHandler
1721 push fs:[KPCR_EXCEPTION_LIST]
1722 mov fs:[KPCR_EXCEPTION_LIST], esp
1725 mov esi, [ebp+KTRAP_FRAME_EIP]
1727 /* Setup loop count */
1731 /* Save loop count */
1734 /* Get the instruction */
1737 /* Now lookup in the prefix table */
1739 mov edi, offset _KiTrapPrefixTable
1742 /* Restore loop count */
1745 /* If it's not a prefix byte, check other instructions */
1752 /* FIXME: Check if it's a HLT */
1754 /* Check if the instruction has two bytes */
1762 /* Get EFLAGS and IOPL */
1763 mov ebx, [ebp+KTRAP_FRAME_EFLAGS]
1767 /* Check the CS's RPL mask */
1768 mov ecx, [ebp+KTRAP_FRAME_CS]
1773 CheckPrivilegedInstruction2:
1774 /* Check if this is a CLI or STI */
1776 je IsPrivInstruction
1778 je IsPrivInstruction
1780 /* Setup I/O table lookup */
1782 mov edi, offset _KiTrapIoTable
1784 /* Loopup in the table */
1788 /* FIXME: Check IOPM!!! */
1791 /* Cleanup the SEH frame */
1792 pop fs:[KPCR_EXCEPTION_LIST]
1795 /* Setup the exception */
1796 mov ebx, [ebp+KTRAP_FRAME_EIP]
1797 mov eax, STATUS_PRIVILEGED_INSTRUCTION
1798 jmp _DispatchNoParam
1801 /* Cleanup the SEH frame */
1802 pop fs:[KPCR_EXCEPTION_LIST]
1806 /* Setup the exception */
1807 mov ebx, [ebp+KTRAP_FRAME_EIP]
1809 mov eax, STATUS_ACCESS_VIOLATION
1810 jmp _DispatchTwoParam
1818 Dr_kit14: DR_TRAP_FIXUP
1819 V86_kit14: V86_TRAP_FIXUP
1825 /* Check if we have a VDM alert */
1826 cmp dword ptr fs:[KPCR_VDM_ALERT], 0
1829 /* Get the current thread */
1830 mov edi, fs:[KPCR_CURRENT_THREAD]
1832 /* Get the stack address of the frame */
1833 lea eax, [esp+KTRAP_FRAME_LENGTH+NPX_FRAME_LENGTH]
1834 sub eax, [edi+KTHREAD_INITIAL_STACK]
1837 /* This isn't the base frame, check if it's the second */
1838 cmp eax, -KTRAP_FRAME_EFLAGS
1841 /* Check if we have a TEB */
1842 mov eax, fs:[KPCR_TEB]
1846 /* Fixup the frame */
1853 /* ROS HACK: Sometimes we get called with INTS DISABLED! WTF? */
1854 test dword ptr [ebp+KTRAP_FRAME_EFLAGS], EFLAGS_INTERRUPT_MASK
1857 /* Enable interrupts and check if we got here with interrupts disabled */
1859 test dword ptr [ebp+KTRAP_FRAME_EFLAGS], EFLAGS_INTERRUPT_MASK
1863 /* Send trap frame and check if this is kernel-mode or usermode */
1865 mov eax, [ebp+KTRAP_FRAME_CS]
1869 /* Send faulting address and check if this is read or write */
1871 mov eax, [ebp+KTRAP_FRAME_ERROR_CODE]
1875 /* Call the access fault handler */
1876 call _MmAccessFault@16
1880 /* Access fault handled, return to caller */
1881 jmp _Kei386EoiHelper@0
1884 /* First check if this is a fault in the S-LIST functions */
1885 mov ecx, offset _ExpInterlockedPopEntrySListFault@0
1886 cmp [ebp+KTRAP_FRAME_EIP], ecx
1889 /* Check if this is a fault in the syscall handler */
1890 mov ecx, offset CopyParams
1891 cmp [ebp+KTRAP_FRAME_EIP], ecx
1893 mov ecx, offset ReadBatch
1894 cmp [ebp+KTRAP_FRAME_EIP], ecx
1899 jmp _Kei386EoiHelper@0
1904 jmp _Kei386EoiHelper@0
1906 /* Check if the fault occured in a V86 mode */
1908 mov ecx, [ebp+KTRAP_FRAME_ERROR_CODE]
1911 test dword ptr [ebp+KTRAP_FRAME_EFLAGS], EFLAGS_V86_MASK
1914 /* Check if the fault occured in a VDM */
1915 mov esi, fs:[KPCR_CURRENT_THREAD]
1916 mov esi, [esi+KTHREAD_APCSTATE_PROCESS]
1917 cmp dword ptr [esi+EPROCESS_VDM_OBJECTS], 0
1920 /* Check if we this was in kernel-mode */
1921 test byte ptr [ebp+KTRAP_FRAME_CS], MODE_MASK
1923 cmp word ptr [ebp+KTRAP_FRAME_CS], KGDT_R3_CODE + RPL_MASK
1930 /* Save EIP and check what kind of status failure we got */
1932 mov esi, [ebp+KTRAP_FRAME_EIP]
1933 cmp eax, STATUS_ACCESS_VIOLATION
1935 cmp eax, STATUS_GUARD_PAGE_VIOLATION
1937 cmp eax, STATUS_STACK_OVERFLOW
1940 /* Setup an in-page exception to dispatch */
1946 mov eax, STATUS_IN_PAGE_ERROR
1947 call _CommonDispatchException
1950 /* Use more proper status code */
1951 mov eax, KI_EXCEPTION_ACCESS_VIOLATION
1954 /* Setup a normal page fault exception */
1958 jmp _DispatchTwoParam
1966 /* This is completely illegal, bugcheck the system */
1972 push IRQL_NOT_LESS_OR_EQUAL
1973 call _KeBugCheckWithTf@24
1977 /* FIXME: NOT SUPPORTED */
1982 Dr_kit15: DR_TRAP_FIXUP
1983 V86_kit15: V86_TRAP_FIXUP
1985 /* Push error code */
1992 /* Raise a fatal exception */
1994 jmp _KiSystemFatalException
1998 Dr_kit16: DR_TRAP_FIXUP
1999 V86_kit16: V86_TRAP_FIXUP
2001 /* Push error code */
2007 /* Check if this is the NPX Thread */
2008 mov eax, fs:[KPCR_CURRENT_THREAD]
2009 cmp eax, fs:[KPCR_NPX_THREAD]
2011 /* Get the initial stack and NPX frame */
2012 mov ecx, [eax+KTHREAD_INITIAL_STACK]
2013 lea ecx, [ecx-NPX_FRAME_LENGTH]
2015 /* If this is a valid fault, handle it */
2018 /* Otherwise, re-enable interrupts and set delayed error */
2020 or dword ptr [ecx+FN_CR0_NPX_STATE], CR0_TS
2021 jmp _Kei386EoiHelper@0
2025 Dr_kit17: DR_TRAP_FIXUP
2026 V86_kit17: V86_TRAP_FIXUP
2028 /* Push error code */
2034 /* FIXME: ROS Doesn't handle alignment faults yet */
2036 jmp _KiSystemFatalException
2039 .func KiSystemFatalException
2040 _KiSystemFatalException:
2042 /* Push the trap frame */
2045 /* Push empty parameters */
2050 /* Push trap number and bugcheck code */
2052 push UNEXPECTED_KERNEL_MODE_TRAP
2053 call _KeBugCheckWithTf@24
2057 .func KiCoprocessorError@0
2058 _KiCoprocessorError@0:
2060 /* Get the NPX Thread's Initial stack */
2061 mov eax, [fs:KPCR_NPX_THREAD]
2062 mov eax, [eax+KTHREAD_INITIAL_STACK]
2064 /* Make space for the FPU Save area */
2065 sub eax, SIZEOF_FX_SAVE_AREA
2067 /* Set the CR0 State */
2068 mov dword ptr [eax+FN_CR0_NPX_STATE], 8
2075 /* Return to caller */
2079 .func Ki16BitStackException
2080 _Ki16BitStackException:
2086 /* Go to kernel mode thread stack */
2087 mov eax, fs:[KPCR_CURRENT_THREAD]
2088 add esp, [eax+KTHREAD_INITIAL_STACK]
2090 /* Switch to good stack segment */
2094 /* UNEXPECTED INTERRUPT HANDLERS **********************************************/
2096 .globl _KiStartUnexpectedRange@0
2097 _KiStartUnexpectedRange@0:
2099 GENERATE_INT_HANDLERS
2101 .globl _KiEndUnexpectedRange@0
2102 _KiEndUnexpectedRange@0:
2103 jmp _KiUnexpectedInterruptTail
2105 .func KiUnexpectedInterruptTail
2106 V86_kui: V86_TRAP_FIXUP
2107 Dr_kui: DR_TRAP_FIXUP
2108 _KiUnexpectedInterruptTail:
2110 /* Enter interrupt trap */
2111 INT_PROLOG kui, DoNotPushFakeErrorCode
2113 /* Increase interrupt count */
2114 inc dword ptr [fs:KPCR_PRCB_INTERRUPT_COUNT]
2116 /* Put vector in EBX and make space for KIRQL */
2120 /* Begin interrupt */
2124 call _HalBeginSystemInterrupt@12
2126 /* Check if it was spurious or not */
2130 /* Spurious, ignore it */
2132 jmp _Kei386EoiHelper2ndEntry
2135 /* Unexpected interrupt, print a message on debug builds */
2138 push offset _UnexpectedMsg
2143 /* Exit the interrupt */
2146 call _HalEndSystemInterrupt@8
2147 jmp _Kei386EoiHelper@0
2150 .globl _KiUnexpectedInterrupt
2151 _KiUnexpectedInterrupt:
2153 /* Bugcheck with invalid interrupt code */
2154 push TRAP_CAUSE_UNKNOWN
2157 /* INTERRUPT HANDLERS ********************************************************/
2159 .func KiDispatchInterrupt@0
2160 _KiDispatchInterrupt@0:
2162 /* Get the PCR and disable interrupts */
2163 mov ebx, [fs:KPCR_SELF]
2166 /* Check if we have to deliver DPCs, timers, or deferred threads */
2167 mov eax, [ebx+KPCR_PRCB_DPC_QUEUE_DEPTH]
2168 or eax, [ebx+KPCR_PRCB_TIMER_REQUEST]
2169 or eax, [ebx+KPCR_PRCB_DEFERRED_READY_LIST_HEAD]
2172 /* Save stack pointer and exception list, then clear it */
2174 push dword ptr [ebx+KPCR_EXCEPTION_LIST]
2175 mov dword ptr [ebx+KPCR_EXCEPTION_LIST], -1
2177 /* Save the stack and switch to the DPC Stack */
2179 //mov esp, [ebx+KPCR_PRCB_DPC_STACK]
2183 mov ecx, [ebx+KPCR_PRCB]
2184 call @KiRetireDpcList@4
2186 /* Restore stack and exception list */
2188 pop dword ptr [ebx+KPCR_EXCEPTION_LIST]
2193 /* Re-enable interrupts */
2196 /* Check if we have quantum end */
2197 cmp byte ptr [ebx+KPCR_PRCB_QUANTUM_END], 0
2200 /* Check if we have a thread to swap to */
2201 cmp byte ptr [ebx+KPCR_PRCB_NEXT_THREAD], 0
2204 /* Make space on the stack to save registers */
2210 /* Get the current thread */
2211 mov edi, [ebx+KPCR_CURRENT_THREAD]
2214 #error SMP Interrupt not handled!
2217 /* Get the next thread and clear it */
2218 mov esi, [ebx+KPCR_PRCB_NEXT_THREAD]
2219 and dword ptr [ebx+KPCR_PRCB_NEXT_THREAD], 0
2221 /* Set us as the current running thread */
2222 mov [ebx+KPCR_CURRENT_THREAD], esi
2223 mov byte ptr [esi+KTHREAD_STATE], Running
2224 mov byte ptr [edi+KTHREAD_WAIT_REASON], WrDispatchInt
2226 /* Put thread in ECX and get the PRCB in EDX */
2228 lea edx, [ebx+KPCR_PRCB_DATA]
2229 call @KiQueueReadyThread@8
2231 /* Set APC_LEVEL and do the swap */
2233 call @KiSwapContextInternal@0
2235 /* Restore registers */
2246 /* Disable quantum end and process it */
2247 mov byte ptr [ebx+KPCR_PRCB_QUANTUM_END], 0
2248 call _KiQuantumEnd@0
2252 .func KiInterruptTemplate
2253 V86_kit: V86_TRAP_FIXUP
2254 Dr_kit: DR_TRAP_FIXUP
2255 _KiInterruptTemplate:
2257 /* Enter interrupt trap */
2258 INT_PROLOG kit, DoPushFakeErrorCode
2261 _KiInterruptTemplate2ndDispatch:
2262 /* Dummy code, will be replaced by the address of the KINTERRUPT */
2265 _KiInterruptTemplateObject:
2266 /* Dummy jump, will be replaced by the actual jump */
2267 jmp _KeSynchronizeExecution@12
2269 _KiInterruptTemplateDispatch:
2270 /* Marks the end of the template so that the jump above can be edited */
2272 .func KiChainedDispatch2ndLvl@0
2273 _KiChainedDispatch2ndLvl@0:
2275 /* Not yet supported */
2279 .func KiChainedDispatch@0
2280 _KiChainedDispatch@0:
2282 /* Increase interrupt count */
2283 inc dword ptr [fs:KPCR_PRCB_INTERRUPT_COUNT]
2285 /* Save trap frame */
2288 /* Save vector and IRQL */
2289 mov eax, [edi+KINTERRUPT_VECTOR]
2290 mov ecx, [edi+KINTERRUPT_IRQL]
2296 /* Begin interrupt */
2300 call _HalBeginSystemInterrupt@12
2302 /* Check if it was handled */
2306 /* Call the 2nd-level handler */
2307 call _KiChainedDispatch2ndLvl@0
2309 /* Exit the interrupt */
2312 call _HalEndSystemInterrupt@8
2313 jmp _Kei386EoiHelper@0
2316 .func KiInterruptDispatch@0
2317 _KiInterruptDispatch@0:
2319 /* Increase interrupt count */
2320 inc dword ptr [fs:KPCR_PRCB_INTERRUPT_COUNT]
2322 /* Save trap frame */
2325 /* Save vector and IRQL */
2326 mov eax, [edi+KINTERRUPT_VECTOR]
2327 mov ecx, [edi+KINTERRUPT_SYNCHRONIZE_IRQL]
2333 /* Begin interrupt */
2337 call _HalBeginSystemInterrupt@12
2339 /* Check if it was handled */
2343 /* Acquire the lock */
2345 mov esi, [edi+KINTERRUPT_ACTUAL_LOCK]
2346 ACQUIRE_SPINLOCK(esi, IntSpin)
2349 mov eax, [edi+KINTERRUPT_SERVICE_CONTEXT]
2352 call [edi+KINTERRUPT_SERVICE_ROUTINE]
2354 /* Release the lock */
2355 RELEASE_SPINLOCK(esi)
2357 /* Exit the interrupt */
2359 call _HalEndSystemInterrupt@8
2360 jmp _Kei386EoiHelper@0
2363 /* Exit the interrupt */
2365 jmp _Kei386EoiHelper@0
2369 SPIN_ON_LOCK esi, GetIntLock