#pragma once // ke_trap.h - trap-frame metadata for syscall/interrupt return paths // // KTRAP_FRAME is built by ke_syscall.asm on kernel entry. It is intentionally // an editable return frame: future user APC delivery can rewrite Rip/Rsp in the // frame, and KiExitTrapFrame will commit those values back to the hardware IRET // slots before returning to user mode. #include #include #define KTRAP_FRAME_MAGIC 0x4650545241544B31ULL #define KTRAP_KIND_NONE 0u #define KTRAP_KIND_SYSCALL 1u #define KTRAP_KIND_INTERRUPT 2u #define KTRAP_MODE_KERNEL 0u #define KTRAP_MODE_USER 1u typedef struct KTRAP_FRAME { uint64_t Magic; uint32_t Kind; uint32_t Vector; uint32_t PreviousMode; uint32_t Reserved; uint64_t Rax; uint64_t Rcx; uint64_t Rdx; uint64_t Rbx; uint64_t Rbp; uint64_t Rsi; uint64_t Rdi; uint64_t R8; uint64_t R9; uint64_t R10; uint64_t R11; uint64_t R12; uint64_t R13; uint64_t R14; uint64_t R15; uint64_t Rip; uint64_t Cs; uint64_t Rflags; uint64_t Rsp; uint64_t Ss; uint64_t* RipSlot; uint64_t* CsSlot; uint64_t* RflagsSlot; uint64_t* RspSlot; uint64_t* SsSlot; struct KTRAP_FRAME* PreviousFrame; uint64_t Reserved2; } KTRAP_FRAME; typedef struct SYS_TRAP_FRAME_INFO_K { uint32_t Size; uint32_t Kind; uint32_t Vector; uint32_t PreviousMode; uint64_t Rip; uint64_t Cs; uint64_t Rflags; uint64_t Rsp; uint64_t Ss; uint64_t Rax; uint64_t Rcx; uint64_t Rdx; uint64_t R8; uint64_t R9; uint64_t R10; uint64_t R11; } SYS_TRAP_FRAME_INFO_K; void KiEnterTrapFrame(KTRAP_FRAME* frame); void KiExitTrapFrame(KTRAP_FRAME* frame); KTRAP_FRAME* KeGetCurrentTrapFrame(void); int KeTrapFrameFromUser(const KTRAP_FRAME* frame); void KiValidateSyscallTrapFrame(uint64_t nr, uint64_t a0, uint64_t a1, uint64_t a2, uint64_t a3, uint64_t a4, uint64_t a5); KSTATUS KeQueryCurrentTrapFrame(SYS_TRAP_FRAME_INFO_K* out);