[sir_richard] 45038: Trap handlers in C patch 7 of X: [NTOS]: Implement GPF handler (trap 13) in C. This was by far the most complex one of them, since it also servces two complex purposes: to handle V86 emulation since the real-mode code will generate GPFs during privileged instructions, and it will detect an illegal IRET, check if it's the known V8086 Exit IRET, and then jump to V86 exit code. [NTOS]: Get rid of even more V8086 assembly since the GPF handler is now C. Deleted the entire V8086
11 Jan
2010
11 Jan
'10
5:53 a.m.
Author: sir_richard
Date: Mon Jan 11 06:53:57 2010
New Revision: 45038
URL: http://svn.reactos.org/svn/reactos?rev=45038&view=rev
Log:
Trap handlers in C patch 7 of X:
[NTOS]: Implement GPF handler (trap 13) in C. This was by far the most complex one of
them, since it also servces two complex purposes: to handle V86 emulation since the
real-mode code will generate GPFs during privileged instructions, and it will detect an
illegal IRET, check if it's the known V8086 Exit IRET, and then jump to V86 exit
code.
[NTOS]: Get rid of even more V8086 assembly since the GPF handler is now C. Deleted
the entire V8086 assembly file.
[NTOS]: Get rid of a bunch of helper ASM functions that nobody is using anymore since
almost all the trap handlers are in C.
Removed:
trunk/reactos/ntoskrnl/ke/i386/v86m_sup.S
Modified:
trunk/reactos/ntoskrnl/include/internal/i386/ke.h
trunk/reactos/ntoskrnl/ke/i386/ctxswitch.S
trunk/reactos/ntoskrnl/ke/i386/trap.s
trunk/reactos/ntoskrnl/ke/i386/traphdlr.c
trunk/reactos/ntoskrnl/ke/i386/v86vdm.c
trunk/reactos/ntoskrnl/ntoskrnl-generic.rbuild
Modified: trunk/reactos/ntoskrnl/include/internal/i386/ke.h
URL:
http://svn.reactos.org/svn/reactos/trunk/reactos/ntoskrnl/include/internal/…
==============================================================================
--- trunk/reactos/ntoskrnl/include/internal/i386/ke.h [iso-8859-1] (original)
+++ trunk/reactos/ntoskrnl/include/internal/i386/ke.h [iso-8859-1] Mon Jan 11 06:53:57
2010
@@ -406,6 +406,12 @@
VOID
FASTCALL
KiEoiHelper(
+ IN PKTRAP_FRAME TrapFrame
+);
+
+VOID
+FASTCALL
+KiExitV86Mode(
IN PKTRAP_FRAME TrapFrame
);
@@ -518,5 +524,20 @@
(DrAddress <= MM_HIGHEST_USER_ADDRESS) ? DrAddress : 0);
}
+FORCEINLINE
+VOID
+KiV86TrapReturn(IN ULONG_PTR Stack)
+{
+ /* Restore volatiles and stack */
+ __asm__ __volatile__
+ (
+ "movl %0, %%esp\n"
+ "popa\n"
+ "ret\n"
+ :
+ : "r"(Stack)
+ : "%esp"
+ );
+}
#endif
#endif /* __NTOSKRNL_INCLUDE_INTERNAL_I386_KE_H */
Modified: trunk/reactos/ntoskrnl/ke/i386/ctxswitch.S
URL:
http://svn.reactos.org/svn/reactos/trunk/reactos/ntoskrnl/ke/i386/ctxswitch…
==============================================================================
--- trunk/reactos/ntoskrnl/ke/i386/ctxswitch.S [iso-8859-1] (original)
+++ trunk/reactos/ntoskrnl/ke/i386/ctxswitch.S [iso-8859-1] Mon Jan 11 06:53:57 2010
@@ -864,3 +864,13 @@
int 3
#endif
.endfunc
+
+.globl _Ki386SetupAndExitToV86Mode@4
+.func Ki386SetupAndExitToV86Mode@4
+_Ki386SetupAndExitToV86Mode@4:
+
+ /* Enter V8086 mode */
+ pushad
+ call @KiEnterV86Mode@0
+.endfunc
+
Modified: trunk/reactos/ntoskrnl/ke/i386/trap.s
URL:
http://svn.reactos.org/svn/reactos/trunk/reactos/ntoskrnl/ke/i386/trap.s?re…
==============================================================================
--- trunk/reactos/ntoskrnl/ke/i386/trap.s [iso-8859-1] (original)
+++ trunk/reactos/ntoskrnl/ke/i386/trap.s [iso-8859-1] Mon Jan 11 06:53:57 2010
@@ -573,95 +573,6 @@
jmp _KiServiceExit
.endfunc
-/* EXCEPTION DISPATCHERS *****************************************************/
-
-.func CommonDispatchException
-_CommonDispatchException:
-
- /* Make space for an exception record */
- sub esp, EXCEPTION_RECORD_LENGTH
-
- /* Set it up */
- mov [esp+EXCEPTION_RECORD_EXCEPTION_CODE], eax
- xor eax, eax
- mov [esp+EXCEPTION_RECORD_EXCEPTION_FLAGS], eax
- mov [esp+EXCEPTION_RECORD_EXCEPTION_RECORD], eax
- mov [esp+EXCEPTION_RECORD_EXCEPTION_ADDRESS], ebx
- mov [esp+EXCEPTION_RECORD_NUMBER_PARAMETERS], ecx
-
- /* Check parameter count */
- cmp ecx, 0
- jz NoParams
-
- /* Get information */
- lea ebx, [esp+SIZEOF_EXCEPTION_RECORD]
- mov [ebx], edx
- mov [ebx+4], esi
- mov [ebx+8], edi
-
-NoParams:
-
- /* Set the record in ECX and check if this was V86 */
- mov ecx, esp
- test dword ptr [ebp+KTRAP_FRAME_EFLAGS], EFLAGS_V86_MASK
- jz SetPreviousMode
-
- /* Set V86 mode */
- mov eax, 0xFFFF
- jmp MaskMode
-
-SetPreviousMode:
-
- /* Get the caller's CS */
- mov eax, [ebp+KTRAP_FRAME_CS]
-
-MaskMode:
- /* Check if it was user-mode or kernel-mode */
- and eax, MODE_MASK
-
- /* Dispatch the exception */
- push 1
- push eax
- push ebp
- push 0
- push ecx
- call _KiDispatchException@20
-
- /* End the trap */
- mov esp, ebp
- jmp _Kei386EoiHelper@0
-.endfunc
-
-.func DispatchNoParam
-_DispatchNoParam:
- /* Call the common dispatcher */
- xor ecx, ecx
- call _CommonDispatchException
-.endfunc
-
-.func DispatchOneParamZero
-_DispatchOneParamZero:
- /* Call the common dispatcher */
- xor edx, edx
- mov ecx, 1
- call _CommonDispatchException
-.endfunc
-
-.func DispatchTwoParamZero
-_DispatchTwoParamZero:
- /* Call the common dispatcher */
- xor edx, edx
- mov ecx, 2
- call _CommonDispatchException
-.endfunc
-
-.func DispatchTwoParam
-_DispatchTwoParam:
- /* Call the common dispatcher */
- mov ecx, 2
- call _CommonDispatchException
-.endfunc
-
/* HARDWARE TRAP HANDLERS ****************************************************/
GENERATE_TRAP_HANDLER KiTrap0, 1
@@ -699,492 +610,7 @@
GENERATE_TRAP_HANDLER KiTrap10, 0
GENERATE_TRAP_HANDLER KiTrap11, 0
GENERATE_TRAP_HANDLER KiTrap12, 0
-
-.func KiTrapExceptHandler
-_KiTrapExceptHandler:
-
- /* Setup SEH handler frame */
- mov esp, [esp+8]
- pop PCR[KPCR_EXCEPTION_LIST]
- add esp, 4
- pop ebp
-
- /* Check if the fault came from user mode */
- test dword ptr [ebp+KTRAP_FRAME_CS], MODE_MASK
- jnz SetException
-
- /* Kernel fault, bugcheck */
- push ebp
- push 0
- push 0
- push 0
- push 0
- push KMODE_EXCEPTION_NOT_HANDLED
- call _KeBugCheckWithTf@24
-.endfunc
-
-.func KiTrap13
-TRAP_FIXUPS kitd_a, kitd_t, DoFixupV86, DoNotFixupAbios
-_KiTrap13:
-
- /* It this a V86 GPF? */
- test dword ptr [esp+12], EFLAGS_V86_MASK
- jz NotV86
-
- /* Enter V86 Trap */
- V86_TRAP_PROLOG kitd_a, kitd_v
-
- /* Make sure that this is a V86 process */
- mov ecx, PCR[KPCR_CURRENT_THREAD]
- mov ecx, [ecx+KTHREAD_APCSTATE_PROCESS]
- cmp dword ptr [ecx+EPROCESS_VDM_OBJECTS], 0
- jnz RaiseIrql
-
- /* Otherwise, something is very wrong, raise an exception */
- sti
- jmp SetException
-
-RaiseIrql:
-
- /* Go to APC level */
- mov ecx, APC_LEVEL
- call @KfRaiseIrql@4
-
- /* Save old IRQL and enable interrupts */
- push eax
- sti
-
- /* Handle the opcode */
- mov ecx, ebp
- call @Ki386HandleOpcodeV86@4
-
- /* Check if this was VDM */
- test al, 0xFF
- jnz NoReflect
-
- /* FIXME: TODO */
- UNHANDLED_V86_PATH
-
-NoReflect:
-
- /* Lower IRQL and disable interrupts */
- pop ecx
- call @KfLowerIrql@4
- cli
-
- /* Check if this was a V86 trap */
- test dword ptr [ebp+KTRAP_FRAME_EFLAGS], EFLAGS_V86_MASK
- jz NotV86Trap
-
- /* Exit the V86 Trap */
- V86_TRAP_EPILOG
-
-NotV86Trap:
-
- /* Either this wasn't V86, or it was, but an APC interrupted us */
- jmp _Kei386EoiHelper@0
-
-NotV86:
- /* Enter trap */
- TRAP_PROLOG kitd_a, kitd_t
-
- /* Check if this was from kernel-mode */
- test dword ptr [ebp+KTRAP_FRAME_CS], MODE_MASK
- jnz UserModeGpf
-
- ///* Check if we have a VDM alert */
- //cmp dword ptr PCR[KPCR_VDM_ALERT], 0 // BUGBUG: Add this back later
- //jnz VdmAlertGpf
-
- /* Check for GPF during GPF */
- mov eax, [ebp+KTRAP_FRAME_EIP]
- cmp eax, offset CheckPrivilegedInstruction
- jbe KmodeGpf
- cmp eax, offset CheckPrivilegedInstruction2
- jae KmodeGpf
-
- /* FIXME: TODO */
- UNHANDLED_PATH "Double GPF"
-
- /* Get the opcode and trap frame */
-KmodeGpf:
- mov eax, [ebp+KTRAP_FRAME_EIP]
- mov eax, [eax]
- mov edx, [ebp+KTRAP_FRAME_EBP]
-
- /* We want to check if this was POP [DS/ES/FS/GS] */
- add edx, KTRAP_FRAME_DS
- cmp al, 0x1F
- jz SegPopGpf
- add edx, KTRAP_FRAME_ES - KTRAP_FRAME_DS
- cmp al, 7
- jz SegPopGpf
- add edx, KTRAP_FRAME_FS - KTRAP_FRAME_ES
- cmp ax, 0xA10F
- jz SegPopGpf
- add edx, KTRAP_FRAME_GS - KTRAP_FRAME_FS
- cmp ax, 0xA90F
- jz SegPopGpf
-
- /* It isn't, was it IRETD? */
- cmp al, 0xCF
- jne NotIretGpf
-
- /* Get error code */
- lea edx, [ebp+KTRAP_FRAME_ESP]
- mov ax, [ebp+KTRAP_FRAME_ERROR_CODE]
- and ax, ~RPL_MASK
-
- /* Get CS */
- mov cx, word ptr [edx+4]
- and cx, ~RPL_MASK
- cmp cx, ax
- jnz NotCsGpf
-
- /* This should be a Ki386CallBios return */
- mov eax, offset _Ki386BiosCallReturnAddress
- cmp eax, [edx]
- jne NotBiosGpf
- mov eax, [edx+4]
- cmp ax, KGDT_R0_CODE + RPL_MASK
- jne NotBiosGpf
-
- /* Jump to return address */
- jmp _Ki386BiosCallReturnAddress
-
-NotBiosGpf:
- /* Check if the thread was in kernel mode */
- mov ebx, PCR[KPCR_CURRENT_THREAD]
- test byte ptr [ebx+KTHREAD_PREVIOUS_MODE], 0xFF
- jz UserModeGpf
-
- /* Set RPL_MASK for check below */
- or word ptr [edx+4], RPL_MASK
-
-NotCsGpf:
- /* Check if the IRET goes to user-mode */
- test dword ptr [edx+4], RPL_MASK
- jz UserModeGpf
-
- /* Setup trap frame to copy */
- mov ecx, (KTRAP_FRAME_LENGTH - 12) / 4
- lea edx, [ebp+KTRAP_FRAME_ERROR_CODE]
-
-TrapCopy:
-
- /* Copy each field */
- mov eax, [edx]
- mov [edx+12], eax
- sub edx, 4
- loop TrapCopy
-
- /* Enable interrupts and adjust stack */
- sti
- add esp, 12
- add ebp, 12
-
- /* Setup exception record */
- mov ebx, [ebp+KTRAP_FRAME_EIP]
- mov esi, [ebp+KTRAP_FRAME_ERROR_CODE]
- and esi, 0xFFFF
- mov eax, STATUS_ACCESS_VIOLATION
- jmp _DispatchTwoParamZero
-
-MsrCheck:
-
- /* FIXME: Handle RDMSR/WRMSR */
- UNHANDLED_PATH "RDMSR/WRMSR"
-
-NotIretGpf:
-
- /* Check if this was an MSR opcode */
- cmp al, 0xF
- jz MsrCheck
-
- /* Check if DS is Ring 3 */
- cmp word ptr [ebp+KTRAP_FRAME_DS], KGDT_R3_DATA + RPL_MASK
- jz CheckEs
-
- /* Otherwise, fix it up */
- mov dword ptr [ebp+KTRAP_FRAME_DS], KGDT_R3_DATA + RPL_MASK
- jmp ExitGpfTrap
-
-CheckEs:
-
- /* Check if ES is Ring 3 */
- cmp word ptr [ebp+KTRAP_FRAME_ES], KGDT_R3_DATA + RPL_MASK
- jz UserModeGpf
-
- /* Otherwise, fix it up */
- mov dword ptr [ebp+KTRAP_FRAME_ES], KGDT_R3_DATA + RPL_MASK
- jmp ExitGpfTrap
-
-SegPopGpf:
-
- /* Sanity check */
- lea eax, [ebp+KTRAP_FRAME_ESP]
- cmp edx, eax
- jz HandleSegPop
- int 3
-
- /* Handle segment POP fault by setting it to 0 */
-HandleSegPop:
- xor eax, eax
- mov dword ptr [edx], eax
-
-ExitGpfTrap:
-
- /* Do a trap exit */
- TRAP_EPILOG NotFromSystemCall, DoNotRestorePreviousMode, DoNotRestoreSegments,
DoRestoreVolatiles, DoRestoreEverything
-
-UserModeGpf:
-
- /* If the previous mode was kernel, raise a fatal exception */
- mov eax, 13
- test byte ptr [ebp+KTRAP_FRAME_CS], MODE_MASK
- jz _KiSystemFatalException
-
- /* Get the process and check which CS this came from */
- mov ebx, PCR[KPCR_CURRENT_THREAD]
- mov ebx, [ebx+KTHREAD_APCSTATE_PROCESS]
- cmp word ptr [ebp+KTRAP_FRAME_CS], KGDT_R3_CODE + RPL_MASK
- jz CheckVdmGpf
-
- /* Check if this is a VDM */
- cmp dword ptr [ebx+EPROCESS_VDM_OBJECTS], 0
- jnz DispatchV86Gpf
-
- /* Enable interrupts and check if we have an error code */
- sti
- cmp word ptr [ebp+KTRAP_FRAME_ERROR_CODE], 0
- jnz SetException
- jmp CheckPrivilegedInstruction
-
-HandleSegPop2:
- /* Update EIP (will be updated below again) */
- add dword ptr [ebp+KTRAP_FRAME_EIP], 1
-
-HandleEsPop:
- /* Clear the segment, update EIP and ESP */
- mov dword ptr [edx], 0
- add dword ptr [ebp+KTRAP_FRAME_EIP], 1
- add dword ptr [ebp+KTRAP_FRAME_ESP], 4
- jmp _Kei386EoiHelper@0
-
-CheckVdmGpf:
- /* Check if this is a VDM */
- cmp dword ptr [ebx+EPROCESS_VDM_OBJECTS], 0
- jz CheckPrivilegedInstruction
-
- /* Bring interrupts back */
- sti
-
- /* Check what kind of instruction this is */
- mov eax, [ebp+KTRAP_FRAME_EIP]
- mov eax, [eax]
-
- /* FIXME: Check for BOP4 */
-
- /* Check if this is POP ES */
- mov edx, ebp
- add edx, KTRAP_FRAME_ES
- cmp al, 0x07
- jz HandleEsPop
-
- /* Check if this is POP FS */
- add edx, KTRAP_FRAME_FS - KTRAP_FRAME_ES
- cmp ax, 0xA10F
- jz HandleSegPop2
-
- /* Check if this is POP GS */
- add edx, KTRAP_FRAME_GS - KTRAP_FRAME_FS
- cmp ax, 0xA90F
- jz HandleSegPop2
-
-CheckPrivilegedInstruction:
- /* Bring interrupts back */
- sti
-
- /* Setup a SEH handler */
- push ebp
- push offset _KiTrapExceptHandler
- push PCR[KPCR_EXCEPTION_LIST]
- mov PCR[KPCR_EXCEPTION_LIST], esp
-
- /* Get EIP */
- mov esi, [ebp+KTRAP_FRAME_EIP]
-
- /* Setup loop count */
- mov ecx, 15
-
-InstLoop:
- /* Save loop count */
- push ecx
-
- /* Get the instruction */
- lods byte ptr [esi]
-
- /* Now lookup in the prefix table */
- mov ecx, 11
- mov edi, offset _KiTrapPrefixTable
- repnz scasb
-
- /* Restore loop count */
- pop ecx
-
- /* If it's not a prefix byte, check other instructions */
- jnz NotPrefixByte
-
- /* Keep looping */
- loop InstLoop
-
- /* Fixup the stack */
- pop PCR[KPCR_EXCEPTION_LIST]
- add esp, 8
-
- /* Re-enable interrupts */
- sti
-
- /* Setup illegal instruction exception and dispatch it */
- mov ebx, [ebp+KTRAP_FRAME_EIP]
- mov eax, STATUS_ILLEGAL_INSTRUCTION
- jmp _DispatchNoParam
-
-NotPrefixByte:
- /* Check if it's a HLT */
- cmp al, 0x0F4
- je IsPrivInstruction
-
- /* Check if the instruction has two bytes */
- cmp al, 0xF
- jne CheckRing3Io
-
- /* Check if this is a LLDT or LTR */
- lods byte ptr [esi]
- cmp al, 0
- jne NotLldt
-
- /* Check if this is an LLDT */
- lods byte ptr [esi]
- and al, 0x38
- cmp al, 0x10
- je IsPrivInstruction
-
- /* Check if this is an LTR */
- cmp al, 0x18
- je IsPrivInstruction
-
- /* Otherwise, access violation */
- jmp NotIoViolation
-
-NotLldt:
- /* Check if this is LGDT or LIDT or LMSW */
- cmp al, 0x01
- jne NotGdt
-
- /* Check if this is an LGDT */
- lods byte ptr [esi]
- and al, 0x38
- cmp al, 0x10
- je IsPrivInstruction
-
- /* Check if this is an LIDT */
- cmp al, 0x18
- je IsPrivInstruction
-
- /* Check if this is an LMSW */
- cmp al, 0x30
- je IsPrivInstruction
-
- /* Otherwise, access violation */
- jmp NotIoViolation
-
-NotGdt:
- /* Check if it's INVD or WBINVD */
- cmp al, 0x8
- je IsPrivInstruction
- cmp al, 0x9
- je IsPrivInstruction
-
- /* Check if it's sysexit */
- cmp al, 0x35
- je IsPrivInstruction
-
- /* Check if it's a DR move */
- cmp al, 0x26
- je IsPrivInstruction
-
- /* Check if it's a CLTS */
- cmp al, 0x6
- je IsPrivInstruction
-
- /* Check if it's a CR move */
- cmp al, 0x20
- jb NotIoViolation
-
- /* Check if it's a DR move */
- cmp al, 0x24
- jbe IsPrivInstruction
-
- /* Everything else is an access violation */
- jmp NotIoViolation
-
-CheckRing3Io:
- /* Get EFLAGS and IOPL */
- mov ebx, [ebp+KTRAP_FRAME_EFLAGS]
- and ebx, EFLAGS_IOPL
- shr ebx, 12
-
- /* Check the CS's RPL mask */
- mov ecx, [ebp+KTRAP_FRAME_CS]
- and ecx, RPL_MASK
- cmp ebx, ecx
- jge NotIoViolation
-
-CheckPrivilegedInstruction2:
- /* Check if this is a CLI or STI */
- cmp al, 0xFA
- je IsPrivInstruction
- cmp al, 0xFB
- je IsPrivInstruction
-
- /* Setup I/O table lookup */
- mov ecx, 13
- mov edi, offset _KiTrapIoTable
-
- /* Loopup in the table */
- repnz scasb
- jnz NotIoViolation
-
- /* FIXME: Check IOPM!!! */
-
-IsPrivInstruction:
- /* Cleanup the SEH frame */
- pop PCR[KPCR_EXCEPTION_LIST]
- add esp, 8
-
- /* Setup the exception */
- mov ebx, [ebp+KTRAP_FRAME_EIP]
- mov eax, STATUS_PRIVILEGED_INSTRUCTION
- jmp _DispatchNoParam
-
-NotIoViolation:
- /* Cleanup the SEH frame */
- pop PCR[KPCR_EXCEPTION_LIST]
- add esp, 8
-
-SetException:
- /* Setup the exception */
- mov ebx, [ebp+KTRAP_FRAME_EIP]
- mov esi, -1
- mov eax, STATUS_ACCESS_VIOLATION
- jmp _DispatchTwoParamZero
-
-DispatchV86Gpf:
- /* FIXME */
- UNHANDLED_V86_PATH
-.endfunc
-
+GENERATE_TRAP_HANDLER KiTrap13, 0
GENERATE_TRAP_HANDLER KiTrap14, 0
GENERATE_TRAP_HANDLER KiTrap0F, 1
GENERATE_TRAP_HANDLER KiTrap16, 1
Modified: trunk/reactos/ntoskrnl/ke/i386/traphdlr.c
URL:
http://svn.reactos.org/svn/reactos/trunk/reactos/ntoskrnl/ke/i386/traphdlr.…
==============================================================================
--- trunk/reactos/ntoskrnl/ke/i386/traphdlr.c [iso-8859-1] (original)
+++ trunk/reactos/ntoskrnl/ke/i386/traphdlr.c [iso-8859-1] Mon Jan 11 06:53:57 2010
@@ -6,13 +6,46 @@
* PROGRAMMERS: ReactOS Portable Systems Group
*/
-/* INCLUDES *****************************************************************/
+/* INCLUDES *******************************************************************/
#include <ntoskrnl.h>
#define NDEBUG
#include <debug.h>
#include "internal/trap_x.h"
+/* GLOBALS ********************************************************************/
+
+UCHAR KiTrapPrefixTable[] =
+{
+ 0xF2, /* REP */
+ 0xF3, /* REP INS/OUTS */
+ 0x67, /* ADDR */
+ 0xF0, /* LOCK */
+ 0x66, /* OP */
+ 0x2E, /* SEG */
+ 0x3E, /* DS */
+ 0x26, /* ES */
+ 0x64, /* FS */
+ 0x65, /* GS */
+ 0x36, /* SS */
+};
+
+UCHAR KiTrapIoTable[] =
+{
+ 0xE4, /* IN */
+ 0xE5, /* IN */
+ 0xEC, /* IN */
+ 0xED, /* IN */
+ 0x6C, /* INS */
+ 0x6D, /* INS */
+ 0xE6, /* OUT */
+ 0xE7, /* OUT */
+ 0xEE, /* OUT */
+ 0xEF, /* OUT */
+ 0x6E, /* OUTS */
+ 0x6F, /* OUTS */
+};
+
/* TRAP EXIT CODE *************************************************************/
VOID
@@ -780,6 +813,288 @@
/* FIXME: Kill the system */
UNIMPLEMENTED;
KiSystemFatalException(EXCEPTION_STACK_FAULT, TrapFrame);
+}
+
+VOID
+FASTCALL
+KiTrap13Handler(IN PKTRAP_FRAME TrapFrame)
+{
+ ULONG i, j, Iopl;
+ BOOLEAN Privileged = FALSE;
+ PUCHAR Instructions;
+ UCHAR Instruction = 0;
+ KIRQL OldIrql;
+
+ /* Check for V86 GPF */
+ if (TrapFrame->EFlags & EFLAGS_V86_MASK)
+ {
+ /* Enter V86 trap */
+ KiEnterV86Trap(TrapFrame);
+
+ /* Must be a VDM process */
+ if (!PsGetCurrentProcess()->VdmObjects)
+ {
+ /* Enable interrupts */
+ _enable();
+
+ /* Setup illegal instruction fault */
+ KiDispatchException0Args(STATUS_ILLEGAL_INSTRUCTION,
+ TrapFrame->Eip,
+ TrapFrame);
+ }
+
+ /* Go to APC level */
+ OldIrql = KfRaiseIrql(APC_LEVEL);
+ _enable();
+
+ /* Handle the V86 opcode */
+ if (Ki386HandleOpcodeV86(TrapFrame) == 0xFF)
+ {
+ /* Should only happen in VDM mode */
+ UNIMPLEMENTED;
+ while (TRUE);
+ }
+
+ /* Bring IRQL back */
+ KfLowerIrql(OldIrql);
+ _disable();
+
+ /* Do a quick V86 exit if possible */
+ if (TrapFrame->EFlags & EFLAGS_V86_MASK) KiExitV86Trap(TrapFrame);
+
+ /* Exit trap the slow way */
+ KiEoiHelper(TrapFrame);
+ }
+
+ /* Save trap frame */
+ KiEnterTrap(TrapFrame);
+
+ /* Check for user-mode GPF */
+ if (KiUserTrap(TrapFrame))
+ {
+ /* Must be user-mode! */
+ if (!KiUserTrap(TrapFrame)) KiSystemFatalException(EXCEPTION_GP_FAULT,
TrapFrame);
+
+ /* Should not be VDM */
+ ASSERT(KiVdmTrap(TrapFrame) == FALSE);
+
+ /* Enable interrupts and check error code */
+ _enable();
+ if (!TrapFrame->ErrCode)
+ {
+ /* FIXME: Use SEH */
+ Instructions = (PUCHAR)TrapFrame->Eip;
+
+ /* Scan next 15 opcodes */
+ for (i = 0; i < 15; i++)
+ {
+ /* Skip prefix instructions */
+ for (j = 0; j < sizeof(KiTrapPrefixTable); j++)
+ {
+ /* Is this NOT a prefix instruction? */
+ if (Instructions[i] != KiTrapPrefixTable[j])
+ {
+ /* We can go ahead and handle the fault now */
+ Instruction = Instructions[i];
+ break;
+ }
+ }
+
+ /* Do we need to keep looking? */
+ if (Instruction) break;
+ }
+
+ /* If all we found was prefixes, then this instruction is too long */
+ if (!Instruction)
+ {
+ /* Setup illegal instruction fault */
+ KiDispatchException0Args(STATUS_ILLEGAL_INSTRUCTION,
+ TrapFrame->Eip,
+ TrapFrame);
+ }
+
+ /* Check for privileged instructions */
+ if (Instruction == 0xF4) // HLT
+ {
+ /* HLT is privileged */
+ Privileged = TRUE;
+ }
+ else if (Instruction == 0x0F)
+ {
+ /* Test if it's any of the privileged two-byte opcodes */
+ if (((Instructions[i + 1] == 0x00) && // LLDT or
LTR
+ (((Instructions[i + 2] & 0x38) == 0x10) || // LLDT
+ (Instructions[i + 2] == 0x18))) || // LTR
+ ((Instructions[i + 1] == 0x01) && // LGDT or
LIDT or LMSW
+ (((Instructions[i + 2] & 0x38) == 0x10) || // LLGT
+ (Instructions[i + 2] == 0x18) || // LIDT
+ (Instructions[i + 2] == 0x30))) || // LMSW
+ (Instructions[i + 1] == 0x08) || // INVD
+ (Instructions[i + 1] == 0x09) || // WBINVD
+ (Instructions[i + 1] == 0x35) || // SYSEXIT
+ (Instructions[i + 1] == 0x26) || // MOV DR, XXX
+ (Instructions[i + 1] == 0x06) || // CLTS
+ (Instructions[i + 1] == 0x20) || // MOV CR, XXX
+ (Instructions[i + 1] == 0x24) || // MOV YYY, DR
+ (Instructions[i + 1] == 0x30) || // WRMSR
+ (Instructions[i + 1] == 0x33)) // RDPMC
+ {
+ /* These are all privileged */
+ Privileged = TRUE;
+ }
+ }
+ else
+ {
+ /* Get the IOPL and compare with the RPL mask */
+ Iopl = (TrapFrame->EFlags & EFLAGS_IOPL) >> 12;
+ if ((TrapFrame->SegCs & RPL_MASK) == Iopl)
+ {
+ /* I/O privilege error -- check for known instructions */
+ if ((Instruction == 0xFA) || (Instruction == 0xFB)) // CLI or STI
+ {
+ /* These are privileged */
+ Privileged = TRUE;
+ }
+ else
+ {
+ /* Last hope: an IN/OUT instruction */
+ for (j = 0; j < sizeof(KiTrapIoTable); j++)
+ {
+ /* Is this an I/O instruction? */
+ if (Instruction == KiTrapIoTable[j])
+ {
+ /* Then it's privileged */
+ Privileged = TRUE;
+ break;
+ }
+ }
+ }
+ }
+ }
+
+ /* So now... was the instruction privileged or not? */
+ if (Privileged)
+ {
+ /* Whew! We have a privileged instruction, so dispatch the fault */
+ KiDispatchException0Args(STATUS_PRIVILEGED_INSTRUCTION,
+ TrapFrame->Eip,
+ TrapFrame);
+ }
+ }
+
+ /* If we got here, send an access violation */
+ KiDispatchException2Args(STATUS_ACCESS_VIOLATION,
+ TrapFrame->Eip,
+ 0,
+ 0xFFFFFFFF,
+ TrapFrame);
+ }
+
+ /* Check for custom VDM trap handler */
+ if (KeGetPcr()->VdmAlert)
+ {
+ /* Not implemented */
+ UNIMPLEMENTED;
+ while (TRUE);
+ }
+
+ /*
+ * Check for a fault during checking of the user instruction.
+ *
+ * Note that the SEH handler will catch invalid EIP, but we could be dealing
+ * with an invalid CS, which will generate another GPF instead.
+ *
+ */
+ if (((PVOID)TrapFrame->Eip >= (PVOID)KiTrap13Handler) &&
+ ((PVOID)TrapFrame->Eip < (PVOID)KiTrap13Handler))
+ {
+ /* Not implemented */
+ UNIMPLEMENTED;
+ while (TRUE);
+ }
+
+ /*
+ * NOTE: The ASM trap exit code would restore segment registers by doing
+ * a POP <SEG>, which could cause an invalid segment if someone had messed
+ * with the segment values.
+ *
+ * Another case is a bogus SS, which would hit a GPF when doing the ired.
+ * This could only be done through a buggy or malicious driver, or perhaps
+ * the kernel debugger.
+ *
+ * The kernel normally restores the "true" segment if this happens.
+ *
+ * However, since we're restoring in C, not ASM, we can't detect
+ * POP <SEG> since the actual instructions will be different.
+ *
+ * A better technique would be to check the EIP and somehow edit the
+ * trap frame before restarting the instruction -- but we would need to
+ * know the extract instruction that was used first.
+ *
+ * We could force a special instrinsic to use stack instructions, or write
+ * a simple instruction length checker.
+ *
+ * Nevertheless, this is a lot of work for the purpose of avoiding a crash
+ * when the user is purposedly trying to create one from kernel-mode, so
+ * we should probably table this for now since it's not a "real"
issue.
+ */
+
+ /*
+ * NOTE2: Another scenario is the IRET during a V8086 restore (BIOS Call)
+ * which will cause a GPF since the trap frame is a total mess (on purpose)
+ * as built in KiEnterV86Mode.
+ *
+ * The idea is to scan for IRET, scan for the known EIP adress, validate CS
+ * and then manually issue a jump to the V8086 return EIP.
+ */
+ Instructions = (PUCHAR)TrapFrame->Eip;
+ if (Instructions[0] == 0xCF)
+ {
+ /*
+ * Some evil shit is going on here -- this is not the SS:ESP you're
+ * looking for! Instead, this is actually CS:EIP you're looking at!
+ * Why? Because part of the trap frame actually corresponds to the IRET
+ * stack during the trap exit!
+ */
+ if ((TrapFrame->HardwareEsp == (ULONG)KiExitV86Mode) &&
+ (TrapFrame->HardwareSegSs == (KGDT_R0_CODE | RPL_MASK)))
+ {
+ /* Exit the V86 trap! */
+ KiExitV86Mode(TrapFrame);
+ }
+ else
+ {
+ /* Otherwise, this is another kind of IRET fault */
+ UNIMPLEMENTED;
+ while (TRUE);
+ }
+ }
+
+ /* So since we're not dealing with the above case, check for RDMSR/WRMSR */
+ if ((Instructions[0] == 0xF) && // 2-byte opcode
+ (((Instructions[1] >> 8) == 0x30) || // RDMSR
+ ((Instructions[2] >> 8) == 0x32))) // WRMSR
+ {
+ /* Unknown CPU MSR, so raise an access violation */
+ KiDispatchException0Args(STATUS_ACCESS_VIOLATION,
+ TrapFrame->Eip,
+ TrapFrame);
+ }
+
+ /* Check for lazy segment load */
+ if (TrapFrame->SegDs != (KGDT_R3_DATA | RPL_MASK))
+ {
+ /* Fix it */
+ TrapFrame->SegDs = (KGDT_R3_DATA | RPL_MASK);
+ }
+ else if (TrapFrame->SegEs != (KGDT_R3_DATA | RPL_MASK))
+ {
+ /* Fix it */
+ TrapFrame->SegEs = (KGDT_R3_DATA | RPL_MASK);
+ }
+
+ /* Do a direct trap exit: restore volatiles only */
+ KiExitTrap(TrapFrame, KTE_SKIP_PM_BIT | KTE_SKIP_SEG_BIT);
}
VOID
Removed: trunk/reactos/ntoskrnl/ke/i386/v86m_sup.S
URL:
http://svn.reactos.org/svn/reactos/trunk/reactos/ntoskrnl/ke/i386/v86m_sup.…
==============================================================================
--- trunk/reactos/ntoskrnl/ke/i386/v86m_sup.S [iso-8859-1] (original)
+++ trunk/reactos/ntoskrnl/ke/i386/v86m_sup.S (removed)
@@ -1,37 +1,0 @@
-/*
- * FILE: ntoskrnl/ke/i386/v86m_sup.S
- * COPYRIGHT: See COPYING in the top level directory
- * PURPOSE: Virtual 8086 (V86) Mode Support
- * PROGRAMMER: Alex Ionescu (alex(a)relsoft.net)
- * NOTE: See asmmacro.S for the V86 trap code.
- */
-
-/* INCLUDES ******************************************************************/
-
-#include <asm.h>
-#include <internal/i386/asmmacro.S>
-.intel_syntax noprefix
-
-/* FUNCTIONS *****************************************************************/
-
-.globl _Ki386SetupAndExitToV86Mode@4
-.func Ki386SetupAndExitToV86Mode@4
-_Ki386SetupAndExitToV86Mode@4:
-
- /* Enter V8086 mode */
- pushad
- call @KiEnterV86Mode@0
-.endfunc
-
-.globl _Ki386BiosCallReturnAddress
-.func Ki386BiosCallReturnAddress
-_Ki386BiosCallReturnAddress:
-
- /* Exit V8086 mode */
- mov ecx, ebp
- call @KiExitV86Mode@4
- mov esp, eax
- popad
-.endfunc
-
-
Modified: trunk/reactos/ntoskrnl/ke/i386/v86vdm.c
URL:
http://svn.reactos.org/svn/reactos/trunk/reactos/ntoskrnl/ke/i386/v86vdm.c?…
==============================================================================
--- trunk/reactos/ntoskrnl/ke/i386/v86vdm.c [iso-8859-1] (original)
+++ trunk/reactos/ntoskrnl/ke/i386/v86vdm.c [iso-8859-1] Mon Jan 11 06:53:57 2010
@@ -429,7 +429,7 @@
return KiVdmHandleOpcode(TrapFrame, 1);
}
-ULONG_PTR
+VOID
FASTCALL
KiExitV86Mode(IN PKTRAP_FRAME TrapFrame)
{
@@ -466,9 +466,9 @@
GdtEntry->HighWord.Bytes.BaseMid = (UCHAR)((ULONG_PTR)Thread->Teb >>
16);
GdtEntry->HighWord.Bytes.BaseHi = (UCHAR)((ULONG_PTR)Thread->Teb >> 24);
- /* Enable interrupts and pop back non-volatiles */
+ /* Enable interrupts and get back to protected mode */
_enable();
- return TrapFrame->Edi;
+ KiV86TrapReturn(TrapFrame->Edi);
}
VOID
@@ -497,7 +497,7 @@
V86Frame->PcrTeb = KeGetPcr()->Tib.Self;
/* Save return EIP */
- TrapFrame->Eip = (ULONG_PTR)Ki386BiosCallReturnAddress;
+ TrapFrame->Eip = (ULONG_PTR)KiExitV86Mode;
/* Save our stack (after the frames) */
TrapFrame->Esi = (ULONG_PTR)V86Frame;
Modified: trunk/reactos/ntoskrnl/ntoskrnl-generic.rbuild
URL:
http://svn.reactos.org/svn/reactos/trunk/reactos/ntoskrnl/ntoskrnl-generic.…
==============================================================================
--- trunk/reactos/ntoskrnl/ntoskrnl-generic.rbuild [iso-8859-1] (original)
+++ trunk/reactos/ntoskrnl/ntoskrnl-generic.rbuild [iso-8859-1] Mon Jan 11 06:53:57 2010
@@ -55,7 +55,6 @@
<file>usercall_asm.S</file>
<file>usercall.c</file>
<file>v86vdm.c</file>
- <file>v86m_sup.S</file>
</directory>
</if>
<if property="ARCH" value="arm">
5366
days inactive
5366
days old
0 comments
1 participants
participants (1)
-
sir_richard＠svn.reactos.org