SVN Trunk Dead

[Alex Ionescu]

Hi,

Booting ROS doesn't work lately...... I've debugged the problem and 
found two likely causes:

1) RtlFormatCurrentUserKeyPath calls NtQueryInformationToken with a 
Kernel Mode address while in user-mode
2) Something is wrong with setting the current mode (in syscall.S), and 
so MmCopySafe... thinks that teh current mode is user while the buffer 
is kernel:

(mm/mm.c:60) 1, de1c7cf8

Note that 1 == UserMode while the buffer is kernel-mode.

It's late here so I don't have time to look into it with more detail.

Best regards,
Alex Ionescu

[Alex Ionescu]

Alex Ionescu wrote:
> Hi,
>
> Booting ROS doesn't work lately...... I've debugged the problem and 
> found two likely causes:
> RtlFormatCurrentUserKeyPath calls NtQueryInformationToken with a
>
> Kernel Mode address while in user-mode
> 2) Something is wrong with setting the current mode (in syscall.S), 
> and so MmCopySafe... thinks that teh current mode is user while the 
> buffer is kernel:
>
> (mm/mm.c:60) 1, de1c7cf8
>
> Note that 1 == UserMode while the buffer is kernel-mode.
>
> It's late here so I don't have time to look into it with more detail.
>
> Best regards,
> Alex Ionescu
> _______________________________________________

/* Restore the old previous mode */
    popl %ebx                                                          
// + 0x2C
    int $3
    movb %bl, %ss:KTHREAD_PREVIOUS_MODE(%esi)

ebx = 0x300.
Nuff said, something is wrong when popping from the stack. It's 2AM so 
time to sleep, but this should take a second to fix for anyone.

bEst regards,
Alex Ionescu

[Alex Ionescu]

Alex Ionescu wrote:
> Alex Ionescu wrote:
> a bunch of crap

Well, the problem was actually Thomas' PSEH frenzy. Our kernel is all 
wrong (again) so I'm fixing everything that we messed up.

This is actually a 3-tier problem:

1) We call Nt* from inside the kernel. NEVER DO THIS!!! (If you don't 
know why, you better not commit a single line in ROS until you find out...)

2) We create Object Attributes in K-Mode code, but then sent 
ExPreviousMode as ObjectAttributeAccessMode to ObCreateObject. Not very 
smart, considering the previous mode might be user-mode.

3) Thomas's code had bugs.

Best regards,
Alex Ionescu

[Casper Hornstrup]

> -----Original Message-----
> From: [e-mail] 
> [mailto:[e-mail]] On Behalf Of Alex Ionescu
> Sent: 22. januar 2005 00:45
> To: ReactOS Development List
> Subject: Re: [ros-dev] SVN Trunk Dead
> We call Nt* from inside the kernel. NEVER DO THIS!!! (If
>
> you don't know why, you better not commit a single line in 
> ROS until you find out...)

It would be much better for the project if you shared that
knowledge instead of keeping it a secret. Not every community
member is experienced in kernel-mode programming and many are
trying to learn.

Casper

[Joseph Galbraith]

Casper Hornstrup wrote:
> > -----Original Message-----
> > From: [e-mail] 
> > [mailto:[e-mail]] On Behalf Of Alex Ionescu
> > Sent: 22. januar 2005 00:45
> > To: ReactOS Development List
> > Subject: Re: [ros-dev] SVN Trunk Dead
> > We call Nt* from inside the kernel. NEVER DO THIS!!! (If
> >
> > you don't know why, you better not commit a single line in 
> > ROS until you find out...)
>
> It would be much better for the project if you shared that
> knowledge instead of keeping it a secret. Not every community
> member is experienced in kernel-mode programming and many are
> trying to learn.

According to "Native Api Reference", call NtXxx from kernel mode
calls the implementation directly, with no control over
the previous mode.

Calling the ZwXxx entry goes back through the system service
dispatch, which sets previous mode to kernel mode.

When previous mode is kernel, all buffer checks and
ACLs are bypassed (perhaps among other things, I'm
not sure.)

So if you call the NtXxx version, you may not know whether
the previous mode is user or kernel, and therefore whether
or not you'll get checks.  (I.e., you don't know if someone
in your call stack already went through a ZwXXX and got
previous mode set to kernel, or whether your coming in from
a device driver in kernel mode, or whether previous mode
is still user.)

Thanks,

Joseph

[Alex Ionescu]

Casper Hornstrup wrote:
> > -----Original Message-----
> > From: [e-mail] 
> > [mailto:[e-mail]] On Behalf Of Alex Ionescu
> > Sent: 22. januar 2005 00:45
> > To: ReactOS Development List
> > Subject: Re: [ros-dev] SVN Trunk Dead
> > We call Nt* from inside the kernel. NEVER DO THIS!!! (If
> >
> > you don't know why, you better not commit a single line in 
> > ROS until you find out...)
>
> It would be much better for the project if you shared that
> knowledge instead of keeping it a secret. Not every community
> member is experienced in kernel-mode programming and many are
> trying to learn.
>
> Casper

Community members != Developers. And it's not a secret. But you don't 
let someone who doesn't know road signs drive a car. I apologize if I 
sounded arrogant.

Best regards,
Alex Ionescu

[Casper Hornstrup]

> Community members != Developers. And it's not a secret. But 
> you don't let someone who doesn't know road signs drive a 
> car. I apologize if I sounded arrogant.
>
> Best regards,
> Alex Ionescu

Are you saying that only experienced kernel-mode developers
should contribute? That's how I read it, but maybe it's just
me that is reading it wrong.

Casper