reactos/ntoskrnl/ke/i386/trap.s

   1 /*
   2  * FILE:            ntoskrnl/ke/i386/trap.S
   3  * COPYRIGHT:       See COPYING in the top level directory
   4  * PURPOSE:         System Traps, Entrypoints and Exitpoints
   5  * PROGRAMMER:      Alex Ionescu (alex@relsoft.net)
   6  * NOTE:            See asmmacro.S for the shared entry/exit code.
   7  */
   8
   9 /* INCLUDES ******************************************************************/
  10
  11 #include <asm.h>
  12 #include <internal/i386/asmmacro.S>
  13 .intel_syntax noprefix
  14
  15 /* GLOBALS ******************************************************************/
  16
  17 .globl _KiIdt
  18 _KiIdt:
  19 /* This is the Software Interrupt Table that we handle in this file:        */
  20 idt _KiTrap0,          INT_32_DPL0  /* INT 00: Divide Error (#DE)           */
  21 idt _KiTrap1,          INT_32_DPL0  /* INT 01: Debug Exception (#DB)        */
  22 idt _KiTrap2,          INT_32_DPL0  /* INT 02: NMI Interrupt                */
  23 idt _KiTrap3,          INT_32_DPL3  /* INT 03: Breakpoint Exception (#BP)   */
  24 idt _KiTrap4,          INT_32_DPL3  /* INT 04: Overflow Exception (#OF)     */
  25 idt _KiTrap5,          INT_32_DPL0  /* INT 05: BOUND Range Exceeded (#BR)   */
  26 idt _KiTrap6,          INT_32_DPL0  /* INT 06: Invalid Opcode Code (#UD)    */
  27 idt _KiTrap7,          INT_32_DPL0  /* INT 07: Device Not Available (#NM)   */
  28 idt _KiTrap8,          INT_32_DPL0  /* INT 08: Double Fault Exception (#DF) */
  29 idt _KiTrap9,          INT_32_DPL0  /* INT 09: RESERVED                     */
  30 idt _KiTrap10,         INT_32_DPL0  /* INT 0A: Invalid TSS Exception (#TS)  */
  31 idt _KiTrap11,         INT_32_DPL0  /* INT 0B: Segment Not Present (#NP)    */
  32 idt _KiTrap12,         INT_32_DPL0  /* INT 0C: Stack Fault Exception (#SS)  */
  33 idt _KiTrap13,         INT_32_DPL0  /* INT 0D: General Protection (#GP)     */
  34 idt _KiTrap14,         INT_32_DPL0  /* INT 0E: Page-Fault Exception (#PF)   */
  35 idt _KiTrap0F,         INT_32_DPL0  /* INT 0F: RESERVED                     */
  36 idt _KiTrap16,         INT_32_DPL0  /* INT 10: x87 FPU Error (#MF)          */
  37 idt _KiTrap17,         INT_32_DPL0  /* INT 11: Align Check Exception (#AC)  */
  38 idt _KiTrap0F,         INT_32_DPL0  /* INT 12: Machine Check Exception (#MC)*/
  39 idt _KiTrap0F,         INT_32_DPL0  /* INT 13: SIMD FPU Exception (#XF)     */
  40 .rept 22
  41 idt _KiTrap0F,         INT_32_DPL0  /* INT 14-29: UNDEFINED INTERRUPTS      */
  42 .endr
  43 idt _KiGetTickCount,   INT_32_DPL3  /* INT 2A: Get Tick Count Handler       */
  44 idt _KiCallbackReturn, INT_32_DPL3  /* INT 2B: User-Mode Callback Return    */
  45 idt _KiRaiseAssertion, INT_32_DPL3  /* INT 2C: Debug Assertion Handler      */
  46 idt _KiDebugService,   INT_32_DPL3  /* INT 2D: Debug Service Handler        */
  47 idt _KiSystemService,  INT_32_DPL3  /* INT 2E: System Call Service Handler  */
  48 idt _KiTrap0F,         INT_32_DPL0  /* INT 2F: RESERVED                     */
  49 GENERATE_IDT_STUBS                  /* INT 30-FF: UNEXPECTED INTERRUPTS     */
  50
  51 /* System call entrypoints:                                                 */
  52 .globl _KiFastCallEntry
  53 .globl _KiSystemService
  54
  55 /* And special system-defined software traps:                               */
  56 .globl _NtRaiseException@12
  57 .globl _NtContinue@8
  58
  59 /* We implement the following trap exit points:                             */
  60 .globl _KiServiceExit               /* Exit from syscall                    */
  61 .globl _KiServiceExit2              /* Exit from syscall with complete frame*/
  62 .globl _Kei386EoiHelper@0           /* Exit from interrupt or H/W trap      */
  63 .globl _Kei386EoiHelper2ndEntry     /* Exit from unexpected interrupt       */
  64
  65 .globl _KiIdtDescriptor
  66 _KiIdtDescriptor:
  67     .short 0x800
  68     .long _KiIdt
  69
  70 /* SOFTWARE INTERRUPT SERVICES ***********************************************/
  71
  72 _KiGetTickCount:
  73 _KiCallbackReturn:
  74 _KiRaiseAssertion:
  75     int 3
  76
  77 .func KiSystemService
  78 _KiSystemService:
  79
  80     /* Enter the shared system call prolog */
  81     SYSCALL_PROLOG
  82
  83     /* Jump to the actual handler */
  84     jmp SharedCode
  85 .endfunc
  86
  87 .func KiFastCallEntry
  88 _KiFastCallEntry:
  89
  90     /* Set FS to PCR */
  91     mov ecx, KGDT_R0_PCR
  92     mov fs, cx
  93
  94     /* Set DS/ES to Kernel Selector */
  95     mov ecx, KGDT_R0_DATA
  96     mov ds, cx
  97     mov es, cx
  98
  99     /* Set the current stack to Kernel Stack */
 100     mov ecx, [fs:KPCR_TSS]
 101     mov esp, ss:[ecx+KTSS_ESP0]
 102
 103     /* Set up a fake INT Stack. */
 104     push KGDT_R3_DATA + RPL_MASK
 105     push edx                            /* Ring 3 SS:ESP */
 106     pushf                               /* Ring 3 EFLAGS */
 107     push 2                              /* Ring 0 EFLAGS */
 108     add edx, 8                          /* Skip user parameter list */
 109     popf                                /* Set our EFLAGS */
 110     or dword ptr [esp], EFLAGS_INTERRUPT_MASK   /* Re-enable IRQs in EFLAGS, to fake INT */
 111     push KGDT_R3_CODE + RPL_MASK
 112     push KUSER_SHARED_SYSCALL_RET
 113
 114     /* Setup the Trap Frame stack */
 115     push 0
 116     push ebp
 117     push ebx
 118     push esi
 119     push edi
 120     push KGDT_R3_TEB + RPL_MASK
 121
 122     /* Save pointer to our PCR */
 123     mov ebx, [fs:KPCR_SELF]
 124
 125     /* Get a pointer to the current thread */
 126     mov esi, [ebx+KPCR_CURRENT_THREAD]
 127
 128     /* Set the exception handler chain terminator */
 129     push [ebx+KPCR_EXCEPTION_LIST]
 130     mov dword ptr [ebx+KPCR_EXCEPTION_LIST], -1
 131
 132     /* Use the thread's stack */
 133     mov ebp, [esi+KTHREAD_INITIAL_STACK]
 134
 135     /* Push previous mode */
 136     push UserMode
 137
 138     /* Skip the other registers */
 139     sub esp, 0x48
 140
 141     /* Hack: it seems that on VMWare someone damages ES/DS on exit. Investigate! */
 142     mov dword ptr [esp+KTRAP_FRAME_DS], KGDT_R3_DATA + RPL_MASK
 143     mov dword ptr [esp+KTRAP_FRAME_ES], KGDT_R3_DATA + RPL_MASK
 144
 145     /* Make space for us on the stack */
 146     sub ebp, 0x29C
 147
 148     /* Write the previous mode */
 149     mov byte ptr [esi+KTHREAD_PREVIOUS_MODE], UserMode
 150
 151     /* Sanity check */
 152     cmp ebp, esp
 153     jnz BadStack
 154
 155     /* Flush DR7 */
 156     and dword ptr [ebp+KTRAP_FRAME_DR7], 0
 157
 158     /* Check if the thread was being debugged */
 159     test byte ptr [esi+KTHREAD_DEBUG_ACTIVE], 0xFF
 160
 161     /* Set the thread's trap frame */
 162     mov [esi+KTHREAD_TRAP_FRAME], ebp
 163
 164     /* Save DR registers if needed */
 165     //jnz Dr_FastCallDrSave
 166
 167     /* Set the trap frame debug header */
 168     SET_TF_DEBUG_HEADER
 169
 170 #ifdef DBG // FIXME: Is this for GDB? Can it be moved in the stub?
 171     /*
 172      * We want to know the address from where the syscall stub was called.
 173      * If PrevMode is KernelMode, that address is stored in our own (kernel)
 174      * stack, at location KTRAP_FRAME_ESP.
 175      * If we're coming from UserMode, we load the usermode stack pointer
 176      * and go back two frames (first frame is the syscall stub, second call
 177      * is the caller of the stub).
 178      */
 179     mov edi, [ebp+KTRAP_FRAME_ESP]
 180     test byte ptr [esi+KTHREAD_PREVIOUS_MODE], 0x01
 181     jz PrevWasKernelMode
 182     mov edi, [edi+4]
 183 PrevWasKernelMode:
 184     mov [ebp+KTRAP_FRAME_DEBUGEIP], edi
 185 #endif
 186
 187     /* Enable interrupts */
 188     sti
 189
 190 SharedCode:
 191
 192     /*
 193      * Find out which table offset to use. Converts 0x1124 into 0x10.
 194      * The offset is related to the Table Index as such: Offset = TableIndex x 10
 195      */
 196     mov edi, eax
 197     shr edi, SERVICE_TABLE_SHIFT
 198     and edi, SERVICE_TABLE_MASK
 199     mov ecx, edi
 200
 201     /* Now add the thread's base system table to the offset */
 202     add edi, [esi+KTHREAD_SERVICE_TABLE]
 203
 204     /* Get the true syscall ID and check it */
 205     mov ebx, eax
 206     and eax, SERVICE_NUMBER_MASK
 207     cmp eax, [edi+SERVICE_DESCRIPTOR_LIMIT]
 208
 209     /* Invalid ID, try to load Win32K Table */
 210     jnb KiBBTUnexpectedRange
 211
 212 #if 0 // <== Disabled for two reasons: We don't save TEB in 0x18, but KPCR.
 213       // <== We don't have a KeGdiFlushUserBatch callback yet (needs to be
 214       //     sent through the PsInitializeWin32Callouts structure)
 215     /* Check if this was Win32K */
 216     cmp ecx, SERVICE_TABLE_TEST
 217     jnz NotWin32K
 218
 219     /* Get the TEB */
 220     mov ecx, [fs:KPCR_TEB]
 221
 222     /* Check if we should flush the User Batch */
 223     xor ebx, ebx
 224     or ebx, [ecx+TEB_GDI_BATCH_COUNT]
 225     jz NoWin32K
 226
 227     /* Flush it */
 228     push edx
 229     push eax
 230     call [_KeGdiFlushUserBatch]
 231     pop eax
 232     pop edx
 233 #endif
 234
 235 NotWin32K:
 236     /* Increase total syscall count */
 237     inc dword ptr fs:[KPCR_SYSTEM_CALLS]
 238
 239 #ifdef DBG
 240     /* Increase per-syscall count */
 241     mov ecx, [edi+SERVICE_DESCRIPTOR_COUNT]
 242     jecxz NoCountTable
 243     inc dword ptr [ecx+eax*4]
 244 #endif
 245
 246     /* Users's current stack frame pointer is source */
 247 NoCountTable:
 248     mov esi, edx
 249
 250     /* Allocate room for argument list from kernel stack */
 251     mov ebx, [edi+SERVICE_DESCRIPTOR_NUMBER]
 252     xor ecx, ecx
 253     mov cl, [eax+ebx]
 254
 255     /* Get pointer to function */
 256     mov edi, [edi+SERVICE_DESCRIPTOR_BASE]
 257     mov ebx, [edi+eax*4]
 258
 259     /* Allocate space on our stack */
 260     sub esp, ecx
 261
 262     /* Set the size of the arguments and the destination */
 263     shr ecx, 2
 264     mov edi, esp
 265
 266     /* Make sure we're within the User Probe Address */
 267     cmp esi, _MmUserProbeAddress
 268     jnb AccessViolation
 269
 270 CopyParams:
 271     /* Copy the parameters */
 272     rep movsd
 273
 274 #ifdef DBG
 275     /*
 276      * The following lines are for the benefit of GDB. It will see the return
 277      * address of the "call ebx" below, find the last label before it and
 278      * thinks that that's the start of the function. It will then check to see
 279      * if it starts with a standard function prolog (push ebp, mov ebp,esp1).
 280      * When that standard function prolog is not found, it will stop the
 281      * stack backtrace. Since we do want to backtrace into usermode, let's
 282      * make GDB happy and create a standard prolog.
 283      */
 284 KiSystemService:
 285     push ebp
 286     mov ebp,esp
 287     pop ebp
 288 #endif
 289
 290     /* Do the System Call */
 291     call ebx
 292
 293 AfterSysCall:
 294 #ifdef DBG
 295     /* Make sure the user-mode call didn't return at elevated IRQL */
 296     test byte ptr [ebp+KTRAP_FRAME_CS], MODE_MASK
 297     jz SkipCheck
 298     mov esi, eax                /* We need to save the syscall's return val */
 299     call _KeGetCurrentIrql@0
 300     or al, al
 301     jnz InvalidIrql
 302     mov eax, esi                /* Restore it */
 303
 304     /* Get our temporary current thread pointer for sanity check */
 305     mov ecx, fs:[KPCR_CURRENT_THREAD]
 306
 307     /* Make sure that we are not attached and that APCs are not disabled */
 308     mov dl, [ecx+KTHREAD_APC_STATE_INDEX]
 309     or dl, dl
 310     jnz InvalidIndex
 311     mov edx, [ecx+KTHREAD_COMBINED_APC_DISABLE]
 312     or edx, edx
 313     jnz InvalidIndex
 314 #endif
 315
 316 SkipCheck:
 317
 318     /* Deallocate the kernel stack frame  */
 319     mov esp, ebp
 320
 321 KeReturnFromSystemCall:
 322
 323     /* Get the Current Thread */
 324     mov ecx, [fs:KPCR_CURRENT_THREAD]
 325
 326     /* Restore the old trap frame pointer */
 327     mov edx, [ebp+KTRAP_FRAME_EDX]
 328     mov [ecx+KTHREAD_TRAP_FRAME], edx
 329 .endfunc
 330
 331 .func KiServiceExit
 332 _KiServiceExit:
 333     /* Disable interrupts */
 334     cli
 335
 336     /* Check for, and deliver, User-Mode APCs if needed */
 337     CHECK_FOR_APC_DELIVER 1
 338
 339     /* Hack for VMWare: Sometimes ES/DS seem to be invalid when returning to user-mode. Investigate! */
 340     mov es, [ebp+KTRAP_FRAME_ES]
 341     mov ds, [ebp+KTRAP_FRAME_DS]
 342
 343     /* Exit and cleanup */
 344     TRAP_EPILOG FromSystemCall, DoRestorePreviousMode, DoNotRestoreSegments, DoNotRestoreVolatiles, DoRestoreEverything
 345 .endfunc
 346
 347 KiBBTUnexpectedRange:
 348
 349     /* If this isn't a Win32K call, fail */
 350     cmp ecx, SERVICE_TABLE_TEST
 351     jne InvalidCall
 352
 353     /* Set up Win32K Table */
 354     push edx
 355     push ebx
 356     call _PsConvertToGuiThread@0
 357
 358     /* Check return code */
 359     or eax, eax
 360
 361     /* Restore registers */
 362     pop eax
 363     pop edx
 364
 365     /* Reset trap frame address */
 366     mov ebp, esp
 367     mov [esi+KTHREAD_TRAP_FRAME], ebp
 368
 369     /* Try the Call again, if we suceeded */
 370     jz SharedCode
 371
 372     /*
 373      * The Shadow Table should have a special byte table which tells us
 374      * whether we should return FALSE, -1 or STATUS_INVALID_SYSTEM_SERVICE.
 375      */
 376
 377     /* Get the table limit and base */
 378     lea edx, _KeServiceDescriptorTableShadow + SERVICE_TABLE_TEST
 379     mov ecx, [edx+SERVICE_DESCRIPTOR_LIMIT]
 380     mov edx, [edx+SERVICE_DESCRIPTOR_BASE]
 381
 382     /* Get the table address and add our index into the array */
 383     lea edx, [edx+ecx*4]
 384     and eax, SERVICE_NUMBER_MASK
 385     add edx, eax
 386
 387     /* Find out what we should return */
 388     movsx eax, byte ptr [edx]
 389     or eax, eax
 390
 391     /* Return either 0 or -1, we've set it in EAX */
 392     jle KeReturnFromSystemCall
 393
 394     /* Set STATUS_INVALID_SYSTEM_SERVICE */
 395     mov eax, STATUS_INVALID_SYSTEM_SERVICE
 396     jmp KeReturnFromSystemCall
 397
 398 InvalidCall:
 399
 400     /* Invalid System Call */
 401     mov eax, STATUS_INVALID_SYSTEM_SERVICE
 402     jmp KeReturnFromSystemCall
 403
 404 AccessViolation:
 405
 406     /* Check if this came from kernel-mode */
 407     test byte ptr [ebp+KTRAP_FRAME_CS], MODE_MASK
 408
 409     /* It's fine, go ahead with it */
 410     jz CopyParams
 411
 412     /* Caller sent invalid parameters, fail here */
 413     mov eax, STATUS_ACCESS_VIOLATION
 414     jmp AfterSysCall
 415
 416 BadStack:
 417
 418     /* Restore ESP0 stack */
 419     mov ecx, [fs:KPCR_TSS]
 420     mov esp, ss:[ecx+KTSS_ESP0]
 421
 422     /* Generate V86M Stack for Trap 6 */
 423     push 0
 424     push 0
 425     push 0
 426     push 0
 427
 428     /* Generate interrupt stack for Trap 6 */
 429     push KGDT_R3_DATA + RPL_MASK
 430     push 0
 431     push 0x20202
 432     push KGDT_R3_CODE + RPL_MASK
 433     push 0
 434     jmp _KiTrap6
 435
 436 #ifdef DBG
 437 InvalidIrql:
 438     /* Save current IRQL */
 439     push fs:[KPCR_IRQL]
 440
 441     /* Set us at passive */
 442     mov dword ptr fs:[KPCR_IRQL], 0
 443     cli
 444
 445     /* Bugcheck */
 446     push 0
 447     push 0
 448     push eax
 449     push ebx
 450     push IRQL_GT_ZERO_AT_SYSTEM_SERVICE
 451     call _KeBugCheckEx@20
 452
 453 InvalidIndex:
 454
 455     /* Get the index and APC state */
 456     movzx eax, byte ptr [ecx+KTHREAD_APC_STATE_INDEX]
 457     mov edx, [ecx+KTHREAD_COMBINED_APC_DISABLE]
 458
 459     /* Bugcheck */
 460     push 0
 461     push edx
 462     push eax
 463     push ebx
 464     push APC_INDEX_MISMATCH
 465     call _KeBugCheckEx@20
 466     ret
 467 #endif
 468
 469 .func KiServiceExit2
 470 _KiServiceExit2:
 471
 472     /* Disable interrupts */
 473     cli
 474
 475     /* Check for, and deliver, User-Mode APCs if needed */
 476     CHECK_FOR_APC_DELIVER 0
 477
 478     /* Exit and cleanup */
 479     TRAP_EPILOG NotFromSystemCall, DoRestorePreviousMode, DoRestoreSegments, DoRestoreVolatiles, DoNotRestoreEverything
 480 .endfunc
 481
 482 .func Kei386EoiHelper@0
 483 _Kei386EoiHelper@0:
 484
 485     /* Disable interrupts */
 486     cli
 487
 488     /* Check for, and deliver, User-Mode APCs if needed */
 489     CHECK_FOR_APC_DELIVER 0
 490
 491     /* Exit and cleanup */
 492 _Kei386EoiHelper2ndEntry:
 493     TRAP_EPILOG NotFromSystemCall, DoNotRestorePreviousMode, DoRestoreSegments, DoRestoreVolatiles, DoNotRestoreEverything
 494 .endfunc
 495
 496 V86_Exit:
 497     /* Move to EDX position */
 498     add esp, KTRAP_FRAME_EDX
 499
 500     /* Restore volatiles */
 501     pop edx
 502     pop ecx
 503     pop eax
 504
 505     /* Move to non-volatiles */
 506     lea esp, [ebp+KTRAP_FRAME_EDI]
 507     pop edi
 508     pop esi
 509     pop ebx
 510     pop ebp
 511
 512     /* Skip error code and return */
 513     add esp, 4
 514     iret
 515
 516 AbiosExit:
 517     /* Not yet supported */
 518     int 3
 519
 520 .func KiDebugService
 521 _KiDebugService:
 522
 523     /* Push error code */
 524     push 0
 525
 526     /* Enter trap */
 527     TRAP_PROLOG(kids)
 528
 529     /* Increase EIP so we skip the INT3 */
 530     //inc dword ptr [ebp+KTRAP_FRAME_EIP]
 531
 532     /* Call debug service dispatcher */
 533     mov eax, [ebp+KTRAP_FRAME_EAX]
 534     mov ecx, [ebp+KTRAP_FRAME_ECX]
 535     mov edx, [ebp+KTRAP_FRAME_EAX]
 536
 537     /* Check for V86 mode */
 538     test dword ptr [ebp+KTRAP_FRAME_EFLAGS], EFLAGS_V86_MASK
 539     jnz NotUserMode
 540
 541     /* Check if this is kernel or user-mode */
 542     test byte ptr [ebp+KTRAP_FRAME_CS], 1
 543     jz CallDispatch
 544     cmp word ptr [ebp+KTRAP_FRAME_CS], KGDT_R3_CODE + RPL_MASK
 545     jnz NotUserMode
 546
 547     /* Re-enable interrupts */
 548 VdmProc:
 549     sti
 550
 551     /* Call the debug routine */
 552 CallDispatch:
 553     mov esi, ecx
 554     mov edi, edx
 555     mov edx, eax
 556     mov ecx, 3
 557     push edi
 558     push esi
 559     push edx
 560     call _KdpServiceDispatcher@12
 561
 562 NotUserMode:
 563
 564     /* Get the current process */
 565     mov ebx, [fs:KPCR_CURRENT_THREAD]
 566     mov ebx, [ebx+KTHREAD_APCSTATE_PROCESS]
 567
 568     /* Check if this is a VDM Process */
 569     //cmp dword ptr [ebx+KPROCESS_VDM_OBJECTS], 0
 570     //jz VdmProc
 571
 572     /* Exit through common routine */
 573     jmp _Kei386EoiHelper@0
 574 .endfunc
 575
 576 .func NtRaiseException@12
 577 _NtRaiseException@12:
 578
 579     /* NOTE: We -must- be called by Zw* to have the right frame! */
 580     /* Push the stack frame */
 581     push ebp
 582
 583     /* Get the current thread and restore its trap frame */
 584     mov ebx, [fs:KPCR_CURRENT_THREAD]
 585     mov edx, [ebp+KTRAP_FRAME_EDX]
 586     mov [ebx+KTHREAD_TRAP_FRAME], edx
 587
 588     /* Set up stack frame */
 589     mov ebp, esp
 590
 591     /* Get the Trap Frame in EBX */
 592     mov ebx, [ebp+0]
 593
 594     /* Get the exception list and restore */
 595     mov eax, [ebx+KTRAP_FRAME_EXCEPTION_LIST]
 596     mov [fs:KPCR_EXCEPTION_LIST], eax
 597
 598     /* Get the parameters */
 599     mov edx, [ebp+16] /* Search frames */
 600     mov ecx, [ebp+12] /* Context */
 601     mov eax, [ebp+8]  /* Exception Record */
 602
 603     /* Raise the exception */
 604     push edx
 605     push ebx
 606     push 0
 607     push ecx
 608     push eax
 609     call _KiRaiseException@20
 610
 611     /* Restore trap frame in EBP */
 612     pop ebp
 613     mov esp, ebp
 614
 615     /* Check the result */
 616     or eax, eax
 617     jz _KiServiceExit2
 618
 619     /* Restore debug registers too */
 620     jmp _KiServiceExit
 621 .endfunc
 622
 623 .func NtContinue@8
 624 _NtContinue@8:
 625
 626     /* NOTE: We -must- be called by Zw* to have the right frame! */
 627     /* Push the stack frame */
 628     push ebp
 629
 630     /* Get the current thread and restore its trap frame */
 631     mov ebx, [fs:KPCR_CURRENT_THREAD]
 632     mov edx, [ebp+KTRAP_FRAME_EDX]
 633     mov [ebx+KTHREAD_TRAP_FRAME], edx
 634
 635     /* Set up stack frame */
 636     mov ebp, esp
 637
 638     /* Save the parameters */
 639     mov eax, [ebp+0]
 640     mov ecx, [ebp+8]
 641
 642     /* Call KiContinue */
 643     push eax
 644     push 0
 645     push ecx
 646     call _KiContinue@12
 647
 648     /* Check if we failed (bad context record) */
 649     or eax, eax
 650     jnz Error
 651
 652     /* Check if test alert was requested */
 653     cmp dword ptr [ebp+12], 0
 654     je DontTest
 655
 656     /* Test alert for the thread */
 657     mov al, [ebx+KTHREAD_PREVIOUS_MODE]
 658     push eax
 659     call _KeTestAlertThread@4
 660
 661 DontTest:
 662     /* Return to previous context */
 663     pop ebp
 664     mov esp, ebp
 665     jmp _KiServiceExit2
 666
 667 Error:
 668     pop ebp
 669     mov esp, ebp
 670     jmp _KiServiceExit
 671 .endfunc
 672
 673 /* EXCEPTION DISPATCHERS *****************************************************/
 674
 675 .func CommonDispatchException
 676 _CommonDispatchException:
 677
 678     /* Make space for an exception record */
 679     sub esp, EXCEPTION_RECORD_LENGTH
 680
 681     /* Set it up */
 682     mov [esp+EXCEPTION_RECORD_EXCEPTION_CODE], eax
 683     xor eax, eax
 684     mov [esp+EXCEPTION_RECORD_EXCEPTION_FLAGS], eax
 685     mov [esp+EXCEPTION_RECORD_EXCEPTION_RECORD], eax
 686     mov [esp+EXCEPTION_RECORD_EXCEPTION_ADDRESS], ebx
 687     mov [esp+EXCEPTION_RECORD_NUMBER_PARAMETERS], ecx
 688
 689     /* Check parameter count */
 690     cmp eax, 0
 691     jz NoParams
 692
 693     /* Get information */
 694     lea ebx, [esp+SIZEOF_EXCEPTION_RECORD]
 695     mov [ebx], edx
 696     mov [ebx+4], esi
 697     mov [ebx+8], edi
 698
 699 NoParams:
 700
 701     /* Set the record in ECX and check if this was V86 */
 702     mov ecx, esp
 703     test dword ptr [esp+KTRAP_FRAME_EFLAGS], EFLAGS_V86_MASK
 704     jz SetPreviousMode
 705
 706     /* Set V86 mode */
 707     mov eax, 0xFFFF
 708     jmp MaskMode
 709
 710 SetPreviousMode:
 711
 712     /* Calculate the previous mode */
 713     mov eax, [ebp+KTRAP_FRAME_CS]
 714 MaskMode:
 715     and eax, MODE_MASK
 716
 717     /* Dispatch the exception */
 718     push 1
 719     push eax
 720     push ebp
 721     push 0
 722     push ecx
 723     call _KiDispatchException@20
 724
 725     /* End the trap */
 726     jmp _Kei386EoiHelper@0
 727 .endfunc
 728
 729 .func DispatchNoParam
 730 _DispatchNoParam:
 731     /* Call the common dispatcher */
 732     xor ecx, ecx
 733     call _CommonDispatchException
 734 .endfunc
 735
 736 .func DispatchOneParam
 737 _DispatchOneParam:
 738     /* Call the common dispatcher */
 739     xor edx, edx
 740     mov ecx, 1
 741     call _CommonDispatchException
 742 .endfunc
 743
 744 .func DispatchTwoParam
 745 _DispatchTwoParam:
 746     /* Call the common dispatcher */
 747     xor edx, edx
 748     mov ecx, 2
 749     call _CommonDispatchException
 750 .endfunc
 751
 752 /* HARDWARE TRAP HANDLERS ****************************************************/
 753
 754 .func KiTrap0
 755 _KiTrap0:
 756     /* Push error code */
 757     push 0
 758
 759     /* Enter trap */
 760     TRAP_PROLOG(0)
 761
 762     /* Check for V86 */
 763     test dword ptr [ebp+KTRAP_FRAME_EFLAGS], EFLAGS_V86_MASK
 764     jnz V86Int0
 765
 766     /* Check if the frame was from kernelmode */
 767     test word ptr [ebp+KTRAP_FRAME_CS], MODE_MASK
 768     jz SendException
 769
 770     /* Check the old mode */
 771     cmp word ptr [ebp+KTRAP_FRAME_CS], KGDT_R3_CODE + RPL_MASK
 772     jne VdmCheck
 773
 774 SendException:
 775     /* Re-enable interrupts for user-mode and send the exception */
 776     sti
 777     mov eax, STATUS_INTEGER_DIVIDE_BY_ZERO
 778     mov ebx, [ebp+KTRAP_FRAME_EIP]
 779     jmp _DispatchNoParam
 780
 781 VdmCheck:
 782     /* Check if this is a VDM process */
 783     mov ebx, [fs:KPCR_CURRENT_THREAD]
 784     mov ebx, [ebx+KTHREAD_APCSTATE_PROCESS]
 785     cmp dword ptr [ebx+EPROCESS_VDM_OBJECTS], 0
 786     jz SendException
 787
 788     /* We don't support this yet! */
 789 V86Int0:
 790     int 3
 791 .endfunc
 792
 793 .func KiTrap1
 794 _KiTrap1:
 795     /* Push error code */
 796     push 0
 797
 798     /* Enter trap */
 799     TRAP_PROLOG(1)
 800
 801     /* Check for V86 */
 802     test dword ptr [ebp+KTRAP_FRAME_EFLAGS], EFLAGS_V86_MASK
 803     jnz V86Int1
 804
 805     /* Check if the frame was from kernelmode */
 806     test word ptr [ebp+KTRAP_FRAME_CS], MODE_MASK
 807     jz PrepInt1
 808
 809     /* Check the old mode */
 810     cmp word ptr [ebp+KTRAP_FRAME_CS], KGDT_R3_CODE + RPL_MASK
 811     jne V86Int1
 812
 813 EnableInterrupts:
 814     /* Enable interrupts for user-mode */
 815     sti
 816
 817 PrepInt1:
 818     /* Prepare the exception */
 819     and dword ptr [ebp+KTRAP_FRAME_EFLAGS], ~EFLAGS_TF
 820     mov ebx, [ebp+KTRAP_FRAME_EIP]
 821     mov eax, STATUS_SINGLE_STEP
 822     jmp _DispatchNoParam
 823
 824 V86Int1:
 825     /* Check if this is a VDM process */
 826     mov ebx, [fs:KPCR_CURRENT_THREAD]
 827     mov ebx, [ebx+KTHREAD_APCSTATE_PROCESS]
 828     cmp dword ptr [ebx+EPROCESS_VDM_OBJECTS], 0
 829     jz EnableInterrupts
 830
 831     /* We don't support VDM! */
 832     int 3
 833 .endfunc
 834
 835 .func KiTrap2
 836 _KiTrap2:
 837
 838     /* FIXME: This is an NMI, nothing like a normal exception */
 839     mov eax, 2
 840     jmp _KiSystemFatalException
 841 .endfunc
 842
 843 .func KiTrap3
 844 _KiTrap3:
 845     /* Push error code */
 846     push 0
 847
 848     /* Enter trap */
 849     TRAP_PROLOG(3)
 850
 851     /* Check for V86 */
 852     test dword ptr [ebp+KTRAP_FRAME_EFLAGS], EFLAGS_V86_MASK
 853     jnz V86Int3
 854
 855     /* Check if the frame was from kernelmode */
 856     test word ptr [ebp+KTRAP_FRAME_CS], MODE_MASK
 857     jz PrepInt3
 858
 859     /* Check the old mode */
 860     cmp word ptr [ebp+KTRAP_FRAME_CS], KGDT_R3_CODE + RPL_MASK
 861     jne V86Int3
 862
 863 EnableInterrupts3:
 864     /* Enable interrupts for user-mode */
 865     sti
 866
 867 PrepInt3:
 868     /* Prepare the exception */
 869     mov esi, ecx
 870     mov edi, edx
 871     mov edx, eax
 872
 873     /* Setup EIP, NTSTATUS and parameter count, then dispatch */
 874     mov ebx, [ebp+KTRAP_FRAME_EIP]
 875     dec ebx
 876     mov eax, STATUS_BREAKPOINT
 877     mov ecx, 3
 878     call _CommonDispatchException
 879
 880 V86Int3:
 881     /* Check if this is a VDM process */
 882     mov ebx, [fs:KPCR_CURRENT_THREAD]
 883     mov ebx, [ebx+KTHREAD_APCSTATE_PROCESS]
 884     cmp dword ptr [ebx+EPROCESS_VDM_OBJECTS], 0
 885     jz EnableInterrupts3
 886
 887     /* We don't support VDM! */
 888     int 3
 889 .endfunc
 890
 891 .func KiTrap4
 892 _KiTrap4:
 893     /* Push error code */
 894     push 0
 895
 896     /* Enter trap */
 897     TRAP_PROLOG(4)
 898
 899     /* Check for V86 */
 900     test dword ptr [ebp+KTRAP_FRAME_EFLAGS], EFLAGS_V86_MASK
 901     jnz V86Int4
 902
 903     /* Check if the frame was from kernelmode */
 904     test word ptr [ebp+KTRAP_FRAME_CS], MODE_MASK
 905     jz SendException4
 906
 907     /* Check the old mode */
 908     cmp word ptr [ebp+KTRAP_FRAME_CS], KGDT_R3_CODE + RPL_MASK
 909     jne VdmCheck4
 910
 911 SendException4:
 912     /* Re-enable interrupts for user-mode and send the exception */
 913     sti
 914     mov eax, STATUS_INTEGER_OVERFLOW
 915     mov ebx, [ebp+KTRAP_FRAME_EIP]
 916     dec ebx
 917     jmp _DispatchNoParam
 918
 919 VdmCheck4:
 920     /* Check if this is a VDM process */
 921     mov ebx, [fs:KPCR_CURRENT_THREAD]
 922     mov ebx, [ebx+KTHREAD_APCSTATE_PROCESS]
 923     cmp dword ptr [ebx+EPROCESS_VDM_OBJECTS], 0
 924     jz SendException4
 925
 926     /* We don't support this yet! */
 927 V86Int4:
 928     int 3
 929 .endfunc
 930
 931 .func KiTrap5
 932 _KiTrap5:
 933     /* Push error code */
 934     push 0
 935
 936     /* Enter trap */
 937     TRAP_PROLOG(5)
 938
 939     /* Check for V86 */
 940     test dword ptr [ebp+KTRAP_FRAME_EFLAGS], EFLAGS_V86_MASK
 941     jnz V86Int5
 942
 943     /* Check if the frame was from kernelmode */
 944     test word ptr [ebp+KTRAP_FRAME_CS], MODE_MASK
 945     jnz CheckMode
 946
 947     /* It did, and this should never happen */
 948     mov eax, 5
 949     jmp _KiSystemFatalException
 950
 951     /* Check the old mode */
 952 CheckMode:
 953     cmp word ptr [ebp+KTRAP_FRAME_CS], KGDT_R3_CODE + RPL_MASK
 954     jne VdmCheck5
 955
 956     /* Re-enable interrupts for user-mode and send the exception */
 957 SendException5:
 958     sti
 959     mov eax, STATUS_ARRAY_BOUNDS_EXCEEDED
 960     mov ebx, [ebp+KTRAP_FRAME_EIP]
 961     jmp _DispatchNoParam
 962
 963 VdmCheck5:
 964     /* Check if this is a VDM process */
 965     mov ebx, [fs:KPCR_CURRENT_THREAD]
 966     mov ebx, [ebx+KTHREAD_APCSTATE_PROCESS]
 967     cmp dword ptr [ebx+EPROCESS_VDM_OBJECTS], 0
 968     jz SendException5
 969
 970     /* We don't support this yet! */
 971 V86Int5:
 972     int 3
 973 .endfunc
 974
 975 .func KiTrap6
 976 _KiTrap6:
 977     /* Push error code */
 978     push 0
 979
 980     /* Enter trap */
 981     TRAP_PROLOG(6)
 982
 983     /* Call the C exception handler */
 984     push 6
 985     push ebp
 986     call _KiTrapHandler
 987     add esp, 8
 988
 989     /* Check for v86 recovery */
 990     cmp eax, 1
 991
 992     /* Return to caller */
 993     jne _Kei386EoiHelper@0
 994     jmp _KiV86Complete
 995 .endfunc
 996
 997 .func KiTrap7
 998 _KiTrap7:
 999     /* Push error code */
1000     push 0
1001
1002     /* Enter trap */
1003     TRAP_PROLOG(7)
1004
1005     /* Get the current thread and stack */
1006 StartTrapHandle:
1007     mov eax, [fs:KPCR_CURRENT_THREAD]
1008     mov ecx, [eax+KTHREAD_INITIAL_STACK]
1009     sub ecx, NPX_FRAME_LENGTH
1010
1011     /* Check if emulation is enabled */
1012     test dword ptr [ecx+FN_CR0_NPX_STATE], CR0_EM
1013     jnz EmulationEnabled
1014
1015 CheckState:
1016     /* Check if the NPX state is loaded */
1017     cmp byte ptr [eax+KTHREAD_NPX_STATE], NPX_STATE_LOADED
1018     mov ebx, cr0
1019     jz IsLoaded
1020
1021     /* Remove flags */
1022     and ebx, ~(CR0_MP + CR0_TS + CR0_EM)
1023     mov cr0, ebx
1024
1025     /* Check the NPX thread */
1026     mov edx, [fs:KPCR_NPX_THREAD]
1027     or edx, edx
1028     jz NoNpxThread
1029
1030     /* Get the NPX Stack */
1031     mov esi, [edx+KTHREAD_INITIAL_STACK]
1032     sub esi, NPX_FRAME_LENGTH
1033
1034     /* Check if we have FXSR and check which operand to use */
1035     test byte ptr _KeI386FxsrPresent, 1
1036     jz FnSave
1037     fxsave [esi]
1038     jmp AfterSave
1039
1040 FnSave:
1041     fnsave [esi]
1042
1043 AfterSave:
1044     /* Set the thread's state to dirty */
1045     mov byte ptr [edx+KTHREAD_NPX_STATE], NPX_STATE_NOT_LOADED
1046
1047 NoNpxThread:
1048     /* Check if we have FXSR and choose which operand to use */
1049     test byte ptr _KeI386FxsrPresent, 1
1050     jz FrRestore
1051     fxrstor [ecx]
1052     jmp AfterRestore
1053
1054 FrRestore:
1055     frstor [esi]
1056
1057 AfterRestore:
1058     /* Set state loaded */
1059     mov byte ptr [eax+KTHREAD_NPX_STATE], NPX_STATE_LOADED
1060     mov [fs:KPCR_NPX_THREAD], eax
1061
1062     /* Enable interrupts to happen now */
1063     sti
1064     nop
1065
1066     /* Check if CR0 needs to be reloaded due to a context switch */
1067     cmp dword ptr [ecx+FN_CR0_NPX_STATE], 0
1068     jz _Kei386EoiHelper@0
1069
1070     /* We have to reload CR0... disable interrupts */
1071     cli
1072
1073     /* Get CR0 and update it */
1074     mov ebx, cr0
1075     or ebx, [ecx+FN_CR0_NPX_STATE]
1076     mov cr0, ebx
1077
1078     /* Restore interrupts and check if TS is back on */
1079     sti
1080     test bl, CR0_TS
1081     jz _Kei386EoiHelper@0
1082
1083     /* Clear TS, and loop handling again */
1084     clts
1085     cli
1086     jmp StartTrapHandle
1087
1088 IsLoaded:
1089     /* Check if TS is set */
1090     test bl, CR0_TS
1091     jnz TsSetOnLoadedState
1092
1093     /* Check if the trap came from user-mode */
1094     int 3
1095
1096 EmulationEnabled:
1097     /* Did this come from kernel-mode? */
1098     cmp word ptr [ebp+KTRAP_FRAME_CS], KGDT_R0_CODE
1099     jz CheckState
1100
1101     /* It came from user-mode, so this would only be valid inside a VDM */
1102     /* Since we don't actually have VDMs in ROS, bugcheck. */
1103     jmp BogusTrap2
1104
1105 TsSetOnLoadedState:
1106     /* TS shouldn't be set, unless this we don't have a Math Processor */
1107     test bl, CR0_MP
1108     jnz BogusTrap
1109
1110     /* Strange that we got a trap at all, but ignore and continue */
1111     clts
1112     jmp _Kei386EoiHelper@0
1113
1114 BogusTrap2:
1115     /* Cause a bugcheck */
1116     sti
1117     push 0
1118     push 0
1119     push eax
1120     push 1
1121     push TRAP_CAUSE_UNKNOWN
1122     call _KeBugCheckEx@20
1123
1124 BogusTrap:
1125     /* Cause a bugcheck */
1126     push 0
1127     push 0
1128     push ebx
1129     push 2
1130     push TRAP_CAUSE_UNKNOWN
1131     call _KeBugCheckEx@20
1132 .endfunc
1133
1134 .globl _KiTrap8
1135 .func KiTrap8
1136 _KiTrap8:
1137
1138     /* Can't really do too much */
1139     mov eax, 8
1140     jmp _KiSystemFatalException
1141 .endfunc
1142
1143 .func KiTrap9
1144 _KiTrap9:
1145     /* Push error code */
1146     push 0
1147
1148     /* Enter trap */
1149     TRAP_PROLOG(9)
1150
1151     /* Enable interrupts and bugcheck */
1152     sti
1153     mov eax, 9
1154     jmp _KiSystemFatalException
1155 .endfunc
1156
1157 .func KiTrap10
1158 _KiTrap10:
1159     /* Enter trap */
1160     TRAP_PROLOG(10)
1161
1162     /* Check for V86 */
1163     test dword ptr [ebp+KTRAP_FRAME_EFLAGS], EFLAGS_V86_MASK
1164     jnz V86IntA
1165
1166     /* Check if the frame was from kernelmode */
1167     test word ptr [ebp+KTRAP_FRAME_CS], MODE_MASK
1168     jz Fatal
1169
1170 V86IntA:
1171     /* Check if OF was set during iretd */
1172     test dword ptr [ebp+KTRAP_FRAME_EFLAGS], EFLAG_ZERO
1173     sti
1174     jz Fatal
1175
1176     /* It was, just mask it out */
1177     and dword ptr [ebp+KTRAP_FRAME_EFLAGS], ~EFLAG_ZERO
1178     jmp _Kei386EoiHelper@0
1179
1180 Fatal:
1181     /* TSS failure for some other reason: crash */
1182     mov eax, 10
1183     jmp _KiSystemFatalException
1184 .endfunc
1185
1186 .func KiTrap11
1187 _KiTrap11:
1188     /* Enter trap */
1189     TRAP_PROLOG(11)
1190
1191     /* FIXME: ROS Doesn't handle segment faults yet */
1192     mov eax, 11
1193     jmp _KiSystemFatalException
1194 .endfunc
1195
1196 .func KiTrap12
1197 _KiTrap12:
1198     /* Enter trap */
1199     TRAP_PROLOG(12)
1200
1201     /* FIXME: ROS Doesn't handle stack faults yet */
1202     mov eax, 12
1203     jmp _KiSystemFatalException
1204 .endfunc
1205
1206 .func KiTrap13
1207 _KiTrap13:
1208     /* Enter trap */
1209     TRAP_PROLOG(13)
1210
1211     /* Call the C exception handler */
1212     push 13
1213     push ebp
1214     call _KiTrapHandler
1215     add esp, 8
1216
1217     /* Check for v86 recovery */
1218     cmp eax, 1
1219
1220     /* Return to caller */
1221     jne _Kei386EoiHelper@0
1222     jmp _KiV86Complete
1223 .endfunc
1224
1225 .func KiTrap14
1226 _KiTrap14:
1227     /* Enter trap */
1228     TRAP_PROLOG(14)
1229
1230     /* Call the C exception handler */
1231     push 14
1232     push ebp
1233     call _KiPageFaultHandler
1234     add esp, 8
1235
1236     /* Return to caller */
1237     jmp _Kei386EoiHelper@0
1238 .endfunc
1239
1240 .func KiTrap0F
1241 _KiTrap0F:
1242     /* Push error code */
1243     push 0
1244
1245     /* Enter trap */
1246     TRAP_PROLOG(15)
1247     sti
1248
1249     /* Raise a fatal exception */
1250     mov eax, 15
1251     jmp _KiSystemFatalException
1252 .endfunc
1253
1254 .func KiTrap16
1255 _KiTrap16:
1256     /* Push error code */
1257     push 0
1258
1259     /* Enter trap */
1260     TRAP_PROLOG(16)
1261
1262     /* FIXME: ROS Doesn't handle FPU faults yet */
1263     mov eax, 16
1264     jmp _KiSystemFatalException
1265 .endfunc
1266
1267 .func KiTrap17
1268 _KiTrap17:
1269     /* Push error code */
1270     push 0
1271
1272     /* Enter trap */
1273     TRAP_PROLOG(17)
1274
1275     /* FIXME: ROS Doesn't handle alignment faults yet */
1276     mov eax, 17
1277     jmp _KiSystemFatalException
1278 .endfunc
1279
1280 .func KiSystemFatalException
1281 _KiSystemFatalException:
1282
1283     /* Push the trap frame */
1284     push ebp
1285
1286     /* Push empty parameters */
1287     push 0
1288     push 0
1289     push 0
1290
1291     /* Push trap number and bugcheck code */
1292     push eax
1293     push UNEXPECTED_KERNEL_MODE_TRAP
1294     call _KeBugCheckWithTf@24
1295     ret
1296 .endfunc
1297
1298 /* INTERRUPT HANDLERS ********************************************************/
1299
1300 .globl _KiStartUnexpected
1301 _KiStartUnexpected:
1302
1303 GENERATE_INT_HANDLERS
1304
1305 _KiEndUnexpected:
1306     jmp _KiUnexpectedInterruptTail
1307
1308 .func KiUnexpectedInterruptTail
1309 _KiUnexpectedInterruptTail:
1310
1311     /* Enter interrupt trap */
1312     INT_PROLOG kui, DoNotPushFakeErrorCode
1313
1314     /* Increase interrupt count */
1315     inc dword ptr [fs:KPCR_PRCB_INTERRUPT_COUNT]
1316
1317     /* Put vector in EBX and make space for KIRQL */
1318     mov ebx, [esp]
1319     sub esp, 4
1320
1321     /* Begin interrupt */
1322     push esp
1323     push ebx
1324     push HIGH_LEVEL
1325     call _HalBeginSystemInterrupt@12
1326
1327     /* Check if it was spurious or not */
1328     or eax, eax
1329     jnz Handled
1330
1331     /* Spurious, ignore it */
1332     add esp, 8
1333     jmp _Kei386EoiHelper2ndEntry
1334
1335 Handled:
1336     /* Unexpected, exit the interrupt */
1337     mov esi, $
1338     cli
1339     call _HalEndSystemInterrupt@8
1340     jmp _Kei386EoiHelper@0
1341 .endfunc
1342
1343 .globl _KiUnexpectedInterrupt
1344 _KiUnexpectedInterrupt:
1345
1346     /* Bugcheck with invalid interrupt code */
1347     push 0x12
1348     call _KeBugCheck@4