Ros-diffs October 2020

ros-diffs@reactos.org

22 participants
156 discussions

[reactos] 12/19: [NTOS:KE:X64] Simplify KiInitializeUserApc

by Timo Kreuzer

https://git.reactos.org/?p=reactos.git;a=commitdiff;h=52d1bb5ec978184473b25… commit 52d1bb5ec978184473b259e1973a7fa33ab9ba69 Author: Timo Kreuzer <timo.kreuzer(a)reactos.org> AuthorDate: Sat Feb 10 19:52:46 2018 +0100 Commit: Timo Kreuzer <timo.kreuzer(a)reactos.org> CommitDate: Sat Oct 31 14:23:16 2020 +0100 [NTOS:KE:X64] Simplify KiInitializeUserApc --- ntoskrnl/ke/amd64/usercall.c | 136 +++++++++++++++++++++---------------------- 1 file changed, 65 insertions(+), 71 deletions(-) diff --git a/ntoskrnl/ke/amd64/usercall.c b/ntoskrnl/ke/amd64/usercall.c index 61861d521b7..38517cb58fc 100644 --- a/ntoskrnl/ke/amd64/usercall.c +++ b/ntoskrnl/ke/amd64/usercall.c @@ -11,32 +11,37 @@ #define NDEBUG #include <debug.h> -/*! \name KiInitializeUserApc -* -* \brief -* Prepares the current trap frame (which must have come from user mode) -* with the ntdll.KiUserApcDispatcher entrypoint, copying a CONTEXT -* record with the context from the old trap frame to the threads user -* mode stack. -* -* \param ExceptionFrame -* \param TrapFrame -* \param NormalRoutine -* \param NormalContext -* \param SystemArgument1 -* \param SystemArgument2 -* -* \remarks -* This function is called from KiDeliverApc, when the trap frame came -* from user mode. This happens before a systemcall or interrupt exits back -* to usermode or when a thread is started from PspUserThreadstartup. -* The trap exit code will then leave to KiUserApcDispatcher which in turn -* calls the NormalRoutine, passing NormalContext, SystemArgument1 and -* SystemArgument2 as parameters. When that function returns, it calls -* NtContinue to return back to the kernel, where the old context that was -* saved on the usermode stack is restored and execution is transferred -* back to usermode, where the original trap originated from. -* +/*! + * \name KiInitializeUserApc + * + * \brief + * Prepares the current trap frame (which must have come from user mode) + * with the ntdll.KiUserApcDispatcher entrypoint, copying a CONTEXT + * record with the context from the old trap frame to the threads user + * mode stack. + * + * \param ExceptionFrame - Pointer to the Exception Frame + * + * \param TrapFrame Pointer to the Trap Frame. + * + * \param NormalRoutine - Pointer to the NormalRoutine to call. + * + * \param NormalContext - Pointer to the context to send to the Normal Routine. + * + * \param SystemArgument[1-2] + * Pointer to a set of two parameters that contain untyped data. + * + * \remarks + * This function is called from KiDeliverApc, when the trap frame came + * from user mode. This happens before a systemcall or interrupt exits back + * to usermode or when a thread is started from PspUserThreadstartup. + * The trap exit code will then leave to KiUserApcDispatcher which in turn + * calls the NormalRoutine, passing NormalContext, SystemArgument1 and + * SystemArgument2 as parameters. When that function returns, it calls + * NtContinue to return back to the kernel, where the old context that was + * saved on the usermode stack is restored and execution is transferred + * back to usermode, where the original trap originated from. + * *--*/ VOID NTAPI @@ -48,67 +53,56 @@ KiInitializeUserApc( _In_ PVOID SystemArgument1, _In_ PVOID SystemArgument2) { - CONTEXT Context; - ULONG64 AlignedRsp, Stack; - EXCEPTION_RECORD SehExceptRecord; + PCONTEXT Context; + EXCEPTION_RECORD ExceptionRecord; /* Sanity check, that the trap frame is from user mode */ ASSERT((TrapFrame->SegCs & MODE_MASK) != KernelMode); - /* Convert the current trap frame to a context */ - Context.ContextFlags = CONTEXT_FULL | CONTEXT_DEBUG_REGISTERS; - KeTrapFrameToContext(TrapFrame, ExceptionFrame, &Context); - - /* We jump to KiUserApcDispatcher in ntdll */ - TrapFrame->Rip = (ULONG64)KeUserApcDispatcher; - - /* Setup Ring 3 segments */ - TrapFrame->SegCs = KGDT64_R3_CODE | RPL_MASK; - TrapFrame->SegDs = KGDT64_R3_DATA | RPL_MASK; - TrapFrame->SegEs = KGDT64_R3_DATA | RPL_MASK; - TrapFrame->SegFs = KGDT64_R3_CMTEB | RPL_MASK; - TrapFrame->SegGs = KGDT64_R3_DATA | RPL_MASK; - TrapFrame->SegSs = KGDT64_R3_DATA | RPL_MASK; - - /* Sanitize EFLAGS, enable interrupts */ - TrapFrame->EFlags = (Context.EFlags & EFLAGS_USER_SANITIZE); - TrapFrame->EFlags |= EFLAGS_INTERRUPT_MASK; - - /* Set parameters for KiUserApcDispatcher */ - Context.P1Home = (ULONG64)NormalContext; - Context.P2Home = (ULONG64)SystemArgument1; - Context.P3Home = (ULONG64)SystemArgument2; - Context.P4Home = (ULONG64)NormalRoutine; - - /* Check if thread has IOPL and force it enabled if so */ - //if (KeGetCurrentThread()->Iopl) TrapFrame->EFlags |= EFLAGS_IOPL; - - /* Align Stack to 16 bytes and allocate space */ - AlignedRsp = Context.Rsp & ~15; - Stack = AlignedRsp - sizeof(CONTEXT); - TrapFrame->Rsp = Stack; - - /* The stack must be 16 byte aligned for KiUserApcDispatcher */ - ASSERT((Stack & 15) == 0); + /* Align the user tack to 16 bytes and allocate space for a CONTEXT structure */ + Context = (PCONTEXT)ALIGN_DOWN_POINTER_BY(TrapFrame->Rsp, 16) - 1; /* Protect with SEH */ _SEH2_TRY { - /* Probe the stack */ - ProbeForWrite((PCONTEXT)Stack, sizeof(CONTEXT), 8); + /* Probe the context */ + ProbeForWrite(Context, sizeof(CONTEXT), 16); + + /* Convert the current trap frame to a context */ + Context->ContextFlags = CONTEXT_FULL | CONTEXT_DEBUG_REGISTERS; + KeTrapFrameToContext(TrapFrame, ExceptionFrame, Context); - /* Copy the context */ - RtlCopyMemory((PCONTEXT)Stack, &Context, sizeof(CONTEXT)); + /* Set parameters for KiUserApcDispatcher */ + Context->P1Home = (ULONG64)NormalContext; + Context->P2Home = (ULONG64)SystemArgument1; + Context->P3Home = (ULONG64)SystemArgument2; + Context->P4Home = (ULONG64)NormalRoutine; } - _SEH2_EXCEPT((RtlCopyMemory(&SehExceptRecord, _SEH2_GetExceptionInformation()->ExceptionRecord, sizeof(EXCEPTION_RECORD)), EXCEPTION_EXECUTE_HANDLER)) + _SEH2_EXCEPT(ExceptionRecord = *_SEH2_GetExceptionInformation()->ExceptionRecord, EXCEPTION_EXECUTE_HANDLER) { /* Dispatch the exception */ - SehExceptRecord.ExceptionAddress = (PVOID)TrapFrame->Rip; - KiDispatchException(&SehExceptRecord, + ExceptionRecord.ExceptionAddress = (PVOID)TrapFrame->Rip; + KiDispatchException(&ExceptionRecord, ExceptionFrame, TrapFrame, UserMode, TRUE); } _SEH2_END; + + /* Set the stack pointer to the context record */ + TrapFrame->Rsp = (ULONG64)Context; + + /* We jump to KiUserApcDispatcher in ntdll */ + TrapFrame->Rip = (ULONG64)KeUserApcDispatcher; + + /* Setup Ring 3 segments */ + TrapFrame->SegCs = KGDT64_R3_CODE | RPL_MASK; + TrapFrame->SegFs = KGDT64_R3_CMTEB | RPL_MASK; + TrapFrame->SegGs = KGDT64_R3_DATA | RPL_MASK; + TrapFrame->SegSs = KGDT64_R3_DATA | RPL_MASK; + + /* Sanitize EFLAGS, enable interrupts */ + TrapFrame->EFlags &= EFLAGS_USER_SANITIZE; + TrapFrame->EFlags |= EFLAGS_INTERRUPT_MASK; }

4 years, 1 month

[reactos] 11/19: [NTOS:KE:X64] Move KiInitializeUserApc to usercall.c

by Timo Kreuzer

https://git.reactos.org/?p=reactos.git;a=commitdiff;h=aaa86d078e7519a7eba45… commit aaa86d078e7519a7eba4592eed08a82848bd6065 Author: Timo Kreuzer <timo.kreuzer(a)reactos.org> AuthorDate: Sat Feb 10 18:47:29 2018 +0100 Commit: Timo Kreuzer <timo.kreuzer(a)reactos.org> CommitDate: Sat Oct 31 14:23:16 2020 +0100 [NTOS:KE:X64] Move KiInitializeUserApc to usercall.c --- ntoskrnl/ke/amd64/stubs.c | 102 -------------------------------------- ntoskrnl/ke/amd64/usercall.c | 114 +++++++++++++++++++++++++++++++++++++++++++ ntoskrnl/ntos.cmake | 5 +- 3 files changed, 117 insertions(+), 104 deletions(-) diff --git a/ntoskrnl/ke/amd64/stubs.c b/ntoskrnl/ke/amd64/stubs.c index fee659737b9..185d68988de 100644 --- a/ntoskrnl/ke/amd64/stubs.c +++ b/ntoskrnl/ke/amd64/stubs.c @@ -243,108 +243,6 @@ KiIdleLoop(VOID) } } - -/*! \name KiInitializeUserApc - * - * \brief - * Prepares the current trap frame (which must have come from user mode) - * with the ntdll.KiUserApcDispatcher entrypoint, copying a CONTEXT - * record with the context from the old trap frame to the threads user - * mode stack. - * - * \param ExceptionFrame - * \param TrapFrame - * \param NormalRoutine - * \param NormalContext - * \param SystemArgument1 - * \param SystemArgument2 - * - * \remarks - * This function is called from KiDeliverApc, when the trap frame came - * from user mode. This happens before a systemcall or interrupt exits back - * to usermode or when a thread is started from PspUserThreadstartup. - * The trap exit code will then leave to KiUserApcDispatcher which in turn - * calls the NormalRoutine, passing NormalContext, SystemArgument1 and - * SystemArgument2 as parameters. When that function returns, it calls - * NtContinue to return back to the kernel, where the old context that was - * saved on the usermode stack is restored and execution is transferred - * back to usermode, where the original trap originated from. - * - *--*/ -VOID -NTAPI -KiInitializeUserApc(IN PKEXCEPTION_FRAME ExceptionFrame, - IN PKTRAP_FRAME TrapFrame, - IN PKNORMAL_ROUTINE NormalRoutine, - IN PVOID NormalContext, - IN PVOID SystemArgument1, - IN PVOID SystemArgument2) -{ - CONTEXT Context = { 0 }; - ULONG64 AlignedRsp, Stack; - EXCEPTION_RECORD SehExceptRecord; - - /* Sanity check, that the trap frame is from user mode */ - ASSERT((TrapFrame->SegCs & MODE_MASK) != KernelMode); - - /* Convert the current trap frame to a context */ - Context.ContextFlags = CONTEXT_FULL | CONTEXT_DEBUG_REGISTERS; - KeTrapFrameToContext(TrapFrame, ExceptionFrame, &Context); - - /* We jump to KiUserApcDispatcher in ntdll */ - TrapFrame->Rip = (ULONG64)KeUserApcDispatcher; - - /* Setup Ring 3 segments */ - TrapFrame->SegCs = KGDT64_R3_CODE | RPL_MASK; - TrapFrame->SegDs = KGDT64_R3_DATA | RPL_MASK; - TrapFrame->SegEs = KGDT64_R3_DATA | RPL_MASK; - TrapFrame->SegFs = KGDT64_R3_CMTEB | RPL_MASK; - TrapFrame->SegGs = KGDT64_R3_DATA | RPL_MASK; - TrapFrame->SegSs = KGDT64_R3_DATA | RPL_MASK; - - /* Sanitize EFLAGS, enable interrupts */ - TrapFrame->EFlags = (Context.EFlags & EFLAGS_USER_SANITIZE); - TrapFrame->EFlags |= EFLAGS_INTERRUPT_MASK; - - /* Set parameters for KiUserApcDispatcher */ - Context.P1Home = (ULONG64)NormalContext; - Context.P2Home = (ULONG64)SystemArgument1; - Context.P3Home = (ULONG64)SystemArgument2; - Context.P4Home = (ULONG64)NormalRoutine; - - /* Check if thread has IOPL and force it enabled if so */ - //if (KeGetCurrentThread()->Iopl) TrapFrame->EFlags |= EFLAGS_IOPL; - - /* Align Stack to 16 bytes and allocate space */ - AlignedRsp = Context.Rsp & ~15; - Stack = AlignedRsp - sizeof(CONTEXT); - TrapFrame->Rsp = Stack; - - /* The stack must be 16 byte aligned for KiUserApcDispatcher */ - ASSERT((Stack & 15) == 0); - - /* Protect with SEH */ - _SEH2_TRY - { - /* Probe the stack */ - ProbeForWrite((PCONTEXT)Stack, sizeof(CONTEXT), 8); - - /* Copy the context */ - RtlCopyMemory((PCONTEXT)Stack, &Context, sizeof(CONTEXT)); - } - _SEH2_EXCEPT((RtlCopyMemory(&SehExceptRecord, _SEH2_GetExceptionInformation()->ExceptionRecord, sizeof(EXCEPTION_RECORD)), EXCEPTION_EXECUTE_HANDLER)) - { - /* Dispatch the exception */ - SehExceptRecord.ExceptionAddress = (PVOID)TrapFrame->Rip; - KiDispatchException(&SehExceptRecord, - ExceptionFrame, - TrapFrame, - UserMode, - TRUE); - } - _SEH2_END; -} - VOID NTAPI KiSwapProcess(IN PKPROCESS NewProcess, diff --git a/ntoskrnl/ke/amd64/usercall.c b/ntoskrnl/ke/amd64/usercall.c new file mode 100644 index 00000000000..61861d521b7 --- /dev/null +++ b/ntoskrnl/ke/amd64/usercall.c @@ -0,0 +1,114 @@ +/* + * PROJECT: ReactOS Kernel + * LICENSE: GPL - 2.0 + (https ://spdx.org/licenses/GPL-2.0+) + * PURPOSE: AMD64 User-mode Callout Mechanisms (APC and Win32K Callbacks) + * COPYRIGHT: Timo Kreuzer(timo.kreuzer(a)reactos.org) + */ + +/* INCLUDES ******************************************************************/ + +#include <ntoskrnl.h> +#define NDEBUG +#include <debug.h> + +/*! \name KiInitializeUserApc +* +* \brief +* Prepares the current trap frame (which must have come from user mode) +* with the ntdll.KiUserApcDispatcher entrypoint, copying a CONTEXT +* record with the context from the old trap frame to the threads user +* mode stack. +* +* \param ExceptionFrame +* \param TrapFrame +* \param NormalRoutine +* \param NormalContext +* \param SystemArgument1 +* \param SystemArgument2 +* +* \remarks +* This function is called from KiDeliverApc, when the trap frame came +* from user mode. This happens before a systemcall or interrupt exits back +* to usermode or when a thread is started from PspUserThreadstartup. +* The trap exit code will then leave to KiUserApcDispatcher which in turn +* calls the NormalRoutine, passing NormalContext, SystemArgument1 and +* SystemArgument2 as parameters. When that function returns, it calls +* NtContinue to return back to the kernel, where the old context that was +* saved on the usermode stack is restored and execution is transferred +* back to usermode, where the original trap originated from. +* +*--*/ +VOID +NTAPI +KiInitializeUserApc( + _In_ PKEXCEPTION_FRAME ExceptionFrame, + _Inout_ PKTRAP_FRAME TrapFrame, + _In_ PKNORMAL_ROUTINE NormalRoutine, + _In_ PVOID NormalContext, + _In_ PVOID SystemArgument1, + _In_ PVOID SystemArgument2) +{ + CONTEXT Context; + ULONG64 AlignedRsp, Stack; + EXCEPTION_RECORD SehExceptRecord; + + /* Sanity check, that the trap frame is from user mode */ + ASSERT((TrapFrame->SegCs & MODE_MASK) != KernelMode); + + /* Convert the current trap frame to a context */ + Context.ContextFlags = CONTEXT_FULL | CONTEXT_DEBUG_REGISTERS; + KeTrapFrameToContext(TrapFrame, ExceptionFrame, &Context); + + /* We jump to KiUserApcDispatcher in ntdll */ + TrapFrame->Rip = (ULONG64)KeUserApcDispatcher; + + /* Setup Ring 3 segments */ + TrapFrame->SegCs = KGDT64_R3_CODE | RPL_MASK; + TrapFrame->SegDs = KGDT64_R3_DATA | RPL_MASK; + TrapFrame->SegEs = KGDT64_R3_DATA | RPL_MASK; + TrapFrame->SegFs = KGDT64_R3_CMTEB | RPL_MASK; + TrapFrame->SegGs = KGDT64_R3_DATA | RPL_MASK; + TrapFrame->SegSs = KGDT64_R3_DATA | RPL_MASK; + + /* Sanitize EFLAGS, enable interrupts */ + TrapFrame->EFlags = (Context.EFlags & EFLAGS_USER_SANITIZE); + TrapFrame->EFlags |= EFLAGS_INTERRUPT_MASK; + + /* Set parameters for KiUserApcDispatcher */ + Context.P1Home = (ULONG64)NormalContext; + Context.P2Home = (ULONG64)SystemArgument1; + Context.P3Home = (ULONG64)SystemArgument2; + Context.P4Home = (ULONG64)NormalRoutine; + + /* Check if thread has IOPL and force it enabled if so */ + //if (KeGetCurrentThread()->Iopl) TrapFrame->EFlags |= EFLAGS_IOPL; + + /* Align Stack to 16 bytes and allocate space */ + AlignedRsp = Context.Rsp & ~15; + Stack = AlignedRsp - sizeof(CONTEXT); + TrapFrame->Rsp = Stack; + + /* The stack must be 16 byte aligned for KiUserApcDispatcher */ + ASSERT((Stack & 15) == 0); + + /* Protect with SEH */ + _SEH2_TRY + { + /* Probe the stack */ + ProbeForWrite((PCONTEXT)Stack, sizeof(CONTEXT), 8); + + /* Copy the context */ + RtlCopyMemory((PCONTEXT)Stack, &Context, sizeof(CONTEXT)); + } + _SEH2_EXCEPT((RtlCopyMemory(&SehExceptRecord, _SEH2_GetExceptionInformation()->ExceptionRecord, sizeof(EXCEPTION_RECORD)), EXCEPTION_EXECUTE_HANDLER)) + { + /* Dispatch the exception */ + SehExceptRecord.ExceptionAddress = (PVOID)TrapFrame->Rip; + KiDispatchException(&SehExceptRecord, + ExceptionFrame, + TrapFrame, + UserMode, + TRUE); + } + _SEH2_END; +} diff --git a/ntoskrnl/ntos.cmake b/ntoskrnl/ntos.cmake index e6c059fdb49..c69c284cdf2 100644 --- a/ntoskrnl/ntos.cmake +++ b/ntoskrnl/ntos.cmake @@ -325,11 +325,12 @@ elseif(ARCH STREQUAL "amd64") ${REACTOS_SOURCE_DIR}/ntoskrnl/ke/amd64/kiinit.c ${REACTOS_SOURCE_DIR}/ntoskrnl/ke/amd64/krnlinit.c ${REACTOS_SOURCE_DIR}/ntoskrnl/ke/amd64/spinlock.c - ${REACTOS_SOURCE_DIR}/ntoskrnl/ke/amd64/stubs.c ${REACTOS_SOURCE_DIR}/ntoskrnl/ke/amd64/thrdini.c ${REACTOS_SOURCE_DIR}/ntoskrnl/mm/amd64/init.c ${REACTOS_SOURCE_DIR}/ntoskrnl/mm/amd64/page.c - ${REACTOS_SOURCE_DIR}/ntoskrnl/ps/amd64/psctx.c) + ${REACTOS_SOURCE_DIR}/ntoskrnl/ps/amd64/psctx.c + ${REACTOS_SOURCE_DIR}/ntoskrnl/ke/amd64/stubs.c + ${REACTOS_SOURCE_DIR}/ntoskrnl/ke/amd64/usercall.c) elseif(ARCH STREQUAL "arm") list(APPEND ASM_SOURCE ${REACTOS_SOURCE_DIR}/ntoskrnl/ex/arm/ioport.s

4 years, 1 month

[reactos] 10/19: [NTOS:KE:X64] Implement flushing the GDI batch

by Timo Kreuzer

https://git.reactos.org/?p=reactos.git;a=commitdiff;h=fbdff437fd072429a9738… commit fbdff437fd072429a9738eddc27f21242cdca0c8 Author: Timo Kreuzer <timo.kreuzer(a)reactos.org> AuthorDate: Tue May 28 11:06:56 2019 +0200 Commit: Timo Kreuzer <timo.kreuzer(a)reactos.org> CommitDate: Sat Oct 31 14:23:16 2020 +0100 [NTOS:KE:X64] Implement flushing the GDI batch --- ntoskrnl/ke/amd64/stubs.c | 22 ++++++++++++++++++++++ 1 file changed, 22 insertions(+) diff --git a/ntoskrnl/ke/amd64/stubs.c b/ntoskrnl/ke/amd64/stubs.c index c23c02b0849..fee659737b9 100644 --- a/ntoskrnl/ke/amd64/stubs.c +++ b/ntoskrnl/ke/amd64/stubs.c @@ -432,6 +432,28 @@ KiSystemCallHandler( Offset = (ServiceNumber >> SERVICE_TABLE_SHIFT) & SERVICE_TABLE_MASK; ServiceNumber &= SERVICE_NUMBER_MASK; + /* Check for win32k system calls */ + if (Offset & SERVICE_TABLE_TEST) + { + ULONG GdiBatchCount; + + /* Read the GDI batch count from the TEB */ + _SEH2_TRY + { + GdiBatchCount = NtCurrentTeb()->GdiBatchCount; + } + _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER) + { + GdiBatchCount = 0; + } + + /* Flush batch, if there are entries */ + if (GdiBatchCount != 0) + { + KeGdiFlushUserBatch(); + } + } + /* Get descriptor table */ DescriptorTable = (PVOID)((ULONG_PTR)Thread->ServiceTable + Offset);

4 years, 1 month

[reactos] 09/19: [NTOS:KE:X64] Change the logic of KeSwitchKernelStack and friends to be standards conforming

by Timo Kreuzer

https://git.reactos.org/?p=reactos.git;a=commitdiff;h=c86c55ace74345d8ad917… commit c86c55ace74345d8ad91763b803579bd034fd6eb Author: Timo Kreuzer <timo.kreuzer(a)reactos.org> AuthorDate: Fri Feb 9 20:59:33 2018 +0100 Commit: Timo Kreuzer <timo.kreuzer(a)reactos.org> CommitDate: Sat Oct 31 14:23:16 2020 +0100 [NTOS:KE:X64] Change the logic of KeSwitchKernelStack and friends to be standards conforming The previous version (like the x86 one) used a combination of C and asm code, called from C code to switch the stack. This is problematic, since there is no guarantee what assumptions C code makes about the stack (i.e. it can place any kind of stack pointers into registers or on the stack itself.) The new algorithm returns back to the systemcall entry point in asm, which then calls KiConvertToGuiThread, which is also asm and calls KeSwitchKernelStack ... --- ntoskrnl/ke/amd64/stubs.c | 35 +++++++++++++++++++++++++---------- ntoskrnl/ke/amd64/trap.S | 34 ++++++++++++++++++++++++++++++++-- 2 files changed, 57 insertions(+), 12 deletions(-) diff --git a/ntoskrnl/ke/amd64/stubs.c b/ntoskrnl/ke/amd64/stubs.c index 9e3624d792f..c23c02b0849 100644 --- a/ntoskrnl/ke/amd64/stubs.c +++ b/ntoskrnl/ke/amd64/stubs.c @@ -13,6 +13,10 @@ #define NDEBUG #include <debug.h> +ULONG ProcessCount; +BOOLEAN CcPfEnablePrefetcher; +SIZE_T KeXStateLength = sizeof(XSAVE_FORMAT); + VOID KiRetireDpcListInDpcStack( PKPRCB Prcb, @@ -96,14 +100,28 @@ KiSwitchKernelStackHelper( LONG_PTR StackOffset, PVOID OldStackBase); +/* + * Kernel stack layout (example pointers): + * 0xFFFFFC0F'2D008000 KTHREAD::StackBase + * [XSAVE_AREA size == KeXStateLength = 0x440] + * 0xFFFFFC0F'2D007BC0 KTHREAD::StateSaveArea _XSAVE_FORMAT + * 0xFFFFFC0F'2D007B90 KTHREAD::InitialStack + * [0x190 bytes KTRAP_FRAME] + * 0xFFFFFC0F'2D007A00 KTHREAD::TrapFrame + * [KSTART_FRAME] or ... + * [KSWITCH_FRAME] + * 0xFFFFFC0F'2D007230 KTHREAD::KernelStack + */ + PVOID NTAPI -KeSwitchKernelStack(PVOID StackBase, PVOID StackLimit) +KiSwitchKernelStack(PVOID StackBase, PVOID StackLimit) { PKTHREAD CurrentThread; PVOID OldStackBase; LONG_PTR StackOffset; SIZE_T StackSize; + PKIPCR Pcr; /* Get the current thread */ CurrentThread = KeGetCurrentThread(); @@ -139,20 +157,17 @@ KeSwitchKernelStack(PVOID StackBase, PVOID StackLimit) CurrentThread->StackLimit = (ULONG_PTR)StackLimit; CurrentThread->LargeStack = TRUE; - /* Adjust the PCR fields */ - __addgsqword(FIELD_OFFSET(KPCR, NtTib.StackBase), StackOffset); - __addgsqword(FIELD_OFFSET(KIPCR, Prcb.RspBase), StackOffset); - - /* Finally switch RSP to the new stack. - We pass OldStackBase to make sure it is not lost. */ - OldStackBase = KiSwitchKernelStackHelper(StackOffset, OldStackBase); + /* Adjust RspBase in the PCR */ + Pcr = (PKIPCR)KeGetPcr(); + Pcr->Prcb.RspBase += StackOffset; - /* Reenable interrupts */ - _enable(); + /* Adjust Rsp0 in the TSS */ + Pcr->TssBase->Rsp0 += StackOffset; return OldStackBase; } + NTSTATUS NTAPI KeUserModeCallback(IN ULONG RoutineIndex, diff --git a/ntoskrnl/ke/amd64/trap.S b/ntoskrnl/ke/amd64/trap.S index a5ba4998745..d361acb1fb1 100644 --- a/ntoskrnl/ke/amd64/trap.S +++ b/ntoskrnl/ke/amd64/trap.S @@ -22,7 +22,6 @@ EXTERN KiDeliverApc:PROC EXTERN KiDpcInterruptHandler:PROC EXTERN PsConvertToGuiThread:PROC EXTERN MmCreateKernelStack:PROC -EXTERN KeSwitchKernelStack:PROC EXTERN MmDeleteKernelStack:PROC #ifdef _WINKD_ @@ -774,7 +773,7 @@ PUBLIC KiSystemCallEntry64 .PROC KiSystemCall64Again - /* Old stack pointer is in rcx, lie and say we saved it in rbp */ + /* Old stack pointer is in rcx, lie and say we saved it in rbp */ .setframe rbp, 0 .endprolog @@ -1023,6 +1022,37 @@ KiSwitchKernelStackHelper: mov rax, rdx ret +EXTERN KiSwitchKernelStack:PROC + +PUBLIC KeSwitchKernelStack +FUNC KeSwitchKernelStack + + sub rsp, 40 + .allocstack 40 + + ; Save rcx + mov [rsp], rcx + .savereg rcx, 0 + .endprolog + + ; Call the C handler, which returns the old stack in rax + call KiSwitchKernelStack + + ; Restore rcx (StackBase) + mov rcx, [rsp] + + ; Switch to new stack: RSP += (StackBase - OldStackBase) + sub rcx, rax + add rsp, rcx + + ; Deallocate the home frame + add rsp, 40 + ret + +ENDFUNC + + + #ifdef _MSC_VER #undef lgdt

4 years, 1 month

[reactos] 08/19: [NTOS:KE:X64] Improve kernel stack switching on GUI system calls

by Timo Kreuzer

https://git.reactos.org/?p=reactos.git;a=commitdiff;h=18b1aafd824a8ab475ba2… commit 18b1aafd824a8ab475ba24da3f0b76e7f55409df Author: Timo Kreuzer <timo.kreuzer(a)reactos.org> AuthorDate: Tue Feb 6 20:52:16 2018 +0100 Commit: Timo Kreuzer <timo.kreuzer(a)reactos.org> CommitDate: Sat Oct 31 14:23:16 2020 +0100 [NTOS:KE:X64] Improve kernel stack switching on GUI system calls To be 100% correct and not rely on assumptions, stack switching can only be done when all previous code - starting with the syscall entry point - is pure asm code, since we can't rely on the C compiler to not use stack addresses in a way that is not transparent. Therefore the new code uses the same mechanism as for normal system calls, returning the address of the asm function KiConvertToGuiThread, which is then called like an Nt* function would be called normally. KiConvertToGuiThrea [...] Also simplify KiSystemCallEntry64 a bit by copying the first parameters into the trap frame, avoiding to allocate additional stack space for the call to KiSystemCallHandler, which now overlaps with the space that is allocated for the Nt* function. Finally fix the locations where r10 and r11 are stored, which is TrapFrame->Rcx and TrapFrame->EFlags, based on the situation in user mode. --- ntoskrnl/ke/amd64/stubs.c | 56 +++++++++++------------- ntoskrnl/ke/amd64/trap.S | 106 ++++++++++++++++++++++++++++++++-------------- 2 files changed, 100 insertions(+), 62 deletions(-) diff --git a/ntoskrnl/ke/amd64/stubs.c b/ntoskrnl/ke/amd64/stubs.c index 09d9e9ff1b0..9e3624d792f 100644 --- a/ntoskrnl/ke/amd64/stubs.c +++ b/ntoskrnl/ke/amd64/stubs.c @@ -356,22 +356,31 @@ NTSTATUS NtSyscallFailure(void) { /* This is the failure function */ - return STATUS_ACCESS_VIOLATION; + return (NTSTATUS)KeGetCurrentThread()->TrapFrame->Rax; } PVOID KiSystemCallHandler( - IN PKTRAP_FRAME TrapFrame, - IN ULONG64 P2, - IN ULONG64 P3, - IN ULONG64 P4) + _In_ ULONG64 ReturnAddress, + _In_ ULONG64 P2, + _In_ ULONG64 P3, + _In_ ULONG64 P4) { + PKTRAP_FRAME TrapFrame; PKSERVICE_TABLE_DESCRIPTOR DescriptorTable; PKTHREAD Thread; PULONG64 KernelParams, UserParams; ULONG ServiceNumber, Offset, Count; ULONG64 UserRsp; - NTSTATUS Status; + + /* Get a pointer to the trap frame */ + TrapFrame = (PKTRAP_FRAME)((PULONG64)_AddressOfReturnAddress() + 1 + MAX_SYSCALL_PARAMS); + + /* Save some values in the trap frame */ + TrapFrame->Rip = ReturnAddress; + TrapFrame->Rdx = P2; + TrapFrame->R8 = P3; + TrapFrame->R9 = P4; /* Increase system call count */ __addgsdword(FIELD_OFFSET(KIPCR, Prcb.KeSystemCalls), 1); @@ -422,27 +431,12 @@ KiSystemCallHandler( return (PVOID)NtSyscallFailure; } - /* Convert us to a GUI thread -- must wrap in ASM to get new EBP */ - Status = KiConvertToGuiThread(); - - /* Reload trap frame and descriptor table pointer from new stack */ - TrapFrame = *(volatile PVOID*)&Thread->TrapFrame; - DescriptorTable = (PVOID)(*(volatile ULONG_PTR*)&Thread->ServiceTable + Offset); - - if (!NT_SUCCESS(Status)) - { - /* Set the last error and fail */ - TrapFrame->Rax = Status; - return (PVOID)NtSyscallFailure; - } - - /* Validate the system call number again */ - if (ServiceNumber >= DescriptorTable->Limit) - { - /* Fail the call */ - TrapFrame->Rax = STATUS_INVALID_SYSTEM_SERVICE; - return (PVOID)NtSyscallFailure; - } + /* Convert us to a GUI thread + To be entirely correct. we return KiConvertToGuiThread, + which allocates a new stack, switches to it, calls + PsConvertToGuiThread and resumes in the middle of + KiSystemCallEntry64 to restart the system call handling. */ + return (PVOID)KiConvertToGuiThread; } /* Get stack bytes and calculate argument count */ @@ -464,10 +458,10 @@ KiSystemCallHandler( case 7: KernelParams[6] = UserParams[6]; case 6: KernelParams[5] = UserParams[5]; case 5: KernelParams[4] = UserParams[4]; - case 4: KernelParams[3] = P4; - case 3: KernelParams[2] = P3; - case 2: KernelParams[1] = P2; - case 1: KernelParams[0] = TrapFrame->R10; + case 4: + case 3: + case 2: + case 1: case 0: break; diff --git a/ntoskrnl/ke/amd64/trap.S b/ntoskrnl/ke/amd64/trap.S index 29f3e4b46e6..a5ba4998745 100644 --- a/ntoskrnl/ke/amd64/trap.S +++ b/ntoskrnl/ke/amd64/trap.S @@ -21,6 +21,9 @@ EXTERN KiXmmExceptionHandler:PROC EXTERN KiDeliverApc:PROC EXTERN KiDpcInterruptHandler:PROC EXTERN PsConvertToGuiThread:PROC +EXTERN MmCreateKernelStack:PROC +EXTERN KeSwitchKernelStack:PROC +EXTERN MmDeleteKernelStack:PROC #ifdef _WINKD_ EXTERN KdSetOwedBreakpoints:PROC @@ -720,8 +723,6 @@ ENDFUNC #define MAX_SYSCALL_PARAM_SIZE (16 * 8) -#define HOME_SIZE 6*8 -#define SYSCALL_ALLOCATION (MAX_SYSCALL_PARAM_SIZE + HOME_SIZE) EXTERN KiSystemCallHandler:PROC @@ -752,41 +753,44 @@ PUBLIC KiSystemCallEntry64 mov rsp, gs:[PcRspBase] /* Allocate a TRAP_FRAME and space for parameters */ - sub rsp, (KTRAP_FRAME_LENGTH + MAX_SYSCALL_PARAM_SIZE + HOME_SIZE) + sub rsp, (KTRAP_FRAME_LENGTH + MAX_SYSCALL_PARAM_SIZE) #if DBG /* Save rbp and load it with the old stack pointer */ - mov [rsp + HOME_SIZE + MAX_SYSCALL_PARAM_SIZE + HOME_SIZE + KTRAP_FRAME_Rbp], rbp + mov [rsp + MAX_SYSCALL_PARAM_SIZE + KTRAP_FRAME_Rbp], rbp mov rbp, gs:[PcUserRsp] #endif - /* Save important volatiles in the trap frame */ - mov [rsp + HOME_SIZE + MAX_SYSCALL_PARAM_SIZE + KTRAP_FRAME_Rax], rax - mov [rsp + HOME_SIZE + MAX_SYSCALL_PARAM_SIZE + KTRAP_FRAME_Rcx], rcx - mov [rsp + HOME_SIZE + MAX_SYSCALL_PARAM_SIZE + KTRAP_FRAME_R10], r10 - mov [rsp + HOME_SIZE + MAX_SYSCALL_PARAM_SIZE + KTRAP_FRAME_R11], r11 + /* Save important registers in the trap frame */ + mov [rsp + MAX_SYSCALL_PARAM_SIZE + KTRAP_FRAME_Rax], rax + mov [rsp + MAX_SYSCALL_PARAM_SIZE + KTRAP_FRAME_Rcx], r10 + mov [rsp + MAX_SYSCALL_PARAM_SIZE + KTRAP_FRAME_EFlags], r11 /* Set sane segments */ mov ax, (KGDT64_R3_DATA or RPL_MASK) mov ds, ax mov es, ax +.ENDP + +.PROC KiSystemCall64Again + + /* Old stack pointer is in rcx, lie and say we saved it in rbp */ + .setframe rbp, 0 + .endprolog + /* Call the C-handler (will enable interrupts) */ - lea rcx, [rsp + SYSCALL_ALLOCATION] call KiSystemCallHandler - /* Deallocate the handlers home stack frame */ - add rsp, HOME_SIZE - - /* The return value is the address of the Nt-function */ - mov rcx, [rsp + 0] - mov rdx, [rsp + 8] - mov r8, [rsp + 16] - mov r9, [rsp + 24] + /* The return value from KiSystemCallHandler is the address of the Nt-function */ + mov rcx, [rsp + MAX_SYSCALL_PARAM_SIZE + KTRAP_FRAME_Rcx] + mov rdx, [rsp + MAX_SYSCALL_PARAM_SIZE + KTRAP_FRAME_Rdx] + mov r8, [rsp + MAX_SYSCALL_PARAM_SIZE + KTRAP_FRAME_R8] + mov r9, [rsp + MAX_SYSCALL_PARAM_SIZE + KTRAP_FRAME_R9] call rax #if DBG /* Restore rbp */ - mov rbp, [rsp + SYSCALL_ALLOCATION + KTRAP_FRAME_Rbp] + mov rbp, [rsp + MAX_SYSCALL_PARAM_SIZE + KTRAP_FRAME_Rbp] test dword ptr [rsp + MAX_SYSCALL_PARAM_SIZE + KTRAP_FRAME_EFlags], HEX(200) jnz IntsEnabled @@ -803,8 +807,8 @@ IntsEnabled: mov [rcx + KTHREAD_TrapFrame], rdx /* Prepare user mode return address (rcx) and eflags (r11) for sysret */ - mov rcx, [rsp + MAX_SYSCALL_PARAM_SIZE + KTRAP_FRAME_Rcx] - mov r11, [rsp + MAX_SYSCALL_PARAM_SIZE + KTRAP_FRAME_R11] + mov rcx, [rsp + MAX_SYSCALL_PARAM_SIZE + KTRAP_FRAME_Rip] + mov r11, [rsp + MAX_SYSCALL_PARAM_SIZE + KTRAP_FRAME_EFlags] /* Load user mode stack (It was copied to the trap frame) */ mov rsp, [rsp + MAX_SYSCALL_PARAM_SIZE + KTRAP_FRAME_Rsp] @@ -815,6 +819,7 @@ IntsEnabled: /* return to user mode */ .byte HEX(48) // REX prefix to return to long mode sysret + .ENDP @@ -896,22 +901,61 @@ ENDFUNC PUBLIC KiConvertToGuiThread FUNC KiConvertToGuiThread - push rbp - .pushreg rbp - sub rsp, 32 - .allocstack 32 + sub rsp, 40 + .allocstack 40 .endprolog + // NewStack = (ULONG_PTR)MmCreateKernelStack(TRUE, 0); + mov cl, 1 + xor rdx, rdx + call MmCreateKernelStack + + /* Check for failure */ + test rax, rax + jz KiConvertToGuiThreadFailed + + ; OldStack = KeSwitchKernelStack((PVOID)NewStack, (PVOID)(NewStack - KERNEL_STACK_SIZE)); + mov rcx, rax + mov rdx, rax + sub rdx, KERNEL_STACK_SIZE + call KeSwitchKernelStack + + // MmDeleteKernelStack(OldStack, FALSE); + mov rcx, rax + xor rdx, rdx + call MmDeleteKernelStack + /* Call the worker function */ call PsConvertToGuiThread - /* Adjust rsp */ - add rsp, 32 + /* Check for failure */ + test rax, rax + js KiConvertToGuiThreadFailed - /* Restore rbp */ - pop rbp + /* Disable interrupts for return */ + cli + + // FIXME: should just do the trap frame switch in KiSystemCallHandler64 + /* Restore old trap frame */ + mov rcx, gs:[PcCurrentThread] + mov rdx, [rsp + 48 + MAX_SYSCALL_PARAM_SIZE + KTRAP_FRAME_TrapFrame] + mov [rcx + KTHREAD_TrapFrame], rdx + + // Restore register parameters + mov rcx, [rsp + 48 + MAX_SYSCALL_PARAM_SIZE + KTRAP_FRAME_Rip] + mov rdx, [rsp + 48 + MAX_SYSCALL_PARAM_SIZE + KTRAP_FRAME_Rdx] + mov r8, [rsp + 48 + MAX_SYSCALL_PARAM_SIZE + KTRAP_FRAME_R8] + mov r9, [rsp + 48 + MAX_SYSCALL_PARAM_SIZE + KTRAP_FRAME_R9] - /* return to the caller */ + /* Run KiSystemCallHandler again */ + add rsp, 48 + jmp KiSystemCall64Again + +KiConvertToGuiThreadFailed: + + /* Clean up the stack and return failure */ + add rsp, 40 + mov eax, HEX(C0000017) // STATUS_NO_MEMORY ret ENDFUNC @@ -977,7 +1021,7 @@ KiSwitchKernelStackHelper: /* Return on new stack */ mov rax, rdx - ret; + ret #ifdef _MSC_VER

4 years, 1 month

[reactos] 07/19: [NTOS:KE:X64] Implement KiConvertToGuiThread, KeSwitchKernelStack and support for win32k syscalls in KiSystemCallHandler

by Timo Kreuzer

https://git.reactos.org/?p=reactos.git;a=commitdiff;h=a6732905b81bc6c3a3086… commit a6732905b81bc6c3a3086cd90f493515d2b93486 Author: Timo Kreuzer <timo.kreuzer(a)reactos.org> AuthorDate: Sun Feb 4 23:44:43 2018 +0100 Commit: Timo Kreuzer <timo.kreuzer(a)reactos.org> CommitDate: Sat Oct 31 14:23:16 2020 +0100 [NTOS:KE:X64] Implement KiConvertToGuiThread, KeSwitchKernelStack and support for win32k syscalls in KiSystemCallHandler --- ntoskrnl/ke/amd64/stubs.c | 102 +++++++++++++++++++++++++++++++++++++++++++--- ntoskrnl/ke/amd64/trap.S | 45 ++++++++++++++++++++ 2 files changed, 141 insertions(+), 6 deletions(-) diff --git a/ntoskrnl/ke/amd64/stubs.c b/ntoskrnl/ke/amd64/stubs.c index b5ae60a550d..09d9e9ff1b0 100644 --- a/ntoskrnl/ke/amd64/stubs.c +++ b/ntoskrnl/ke/amd64/stubs.c @@ -8,6 +8,7 @@ /* INCLUDES ******************************************************************/ #include <ntoskrnl.h> +#include <fltkernel.h> #define NDEBUG #include <debug.h> @@ -17,6 +18,10 @@ KiRetireDpcListInDpcStack( PKPRCB Prcb, PVOID DpcStack); +NTSTATUS +KiConvertToGuiThread( + VOID); + VOID NTAPI KiDpcInterruptHandler(VOID) @@ -86,13 +91,66 @@ KeZeroPages(IN PVOID Address, RtlZeroMemory(Address, Size); } +PVOID +KiSwitchKernelStackHelper( + LONG_PTR StackOffset, + PVOID OldStackBase); + PVOID NTAPI KeSwitchKernelStack(PVOID StackBase, PVOID StackLimit) { - UNIMPLEMENTED; - __debugbreak(); - return NULL; + PKTHREAD CurrentThread; + PVOID OldStackBase; + LONG_PTR StackOffset; + SIZE_T StackSize; + + /* Get the current thread */ + CurrentThread = KeGetCurrentThread(); + + /* Save the old stack base */ + OldStackBase = CurrentThread->StackBase; + + /* Get the size of the current stack */ + StackSize = (ULONG_PTR)CurrentThread->StackBase - CurrentThread->StackLimit; + ASSERT(StackSize <= (ULONG_PTR)StackBase - (ULONG_PTR)StackLimit); + + /* Copy the current stack contents to the new stack */ + RtlCopyMemory((PUCHAR)StackBase - StackSize, + (PVOID)CurrentThread->StackLimit, + StackSize); + + /* Calculate the offset between the old and the new stack */ + StackOffset = (PUCHAR)StackBase - (PUCHAR)CurrentThread->StackBase; + + /* Disable interrupts while messing with the stack */ + _disable(); + + /* Set the new trap frame */ + CurrentThread->TrapFrame = (PKTRAP_FRAME)Add2Ptr(CurrentThread->TrapFrame, + StackOffset); + + /* Set the new initial stack */ + CurrentThread->InitialStack = Add2Ptr(CurrentThread->InitialStack, + StackOffset); + + /* Set the new stack limits */ + CurrentThread->StackBase = StackBase; + CurrentThread->StackLimit = (ULONG_PTR)StackLimit; + CurrentThread->LargeStack = TRUE; + + /* Adjust the PCR fields */ + __addgsqword(FIELD_OFFSET(KPCR, NtTib.StackBase), StackOffset); + __addgsqword(FIELD_OFFSET(KIPCR, Prcb.RspBase), StackOffset); + + /* Finally switch RSP to the new stack. + We pass OldStackBase to make sure it is not lost. */ + OldStackBase = KiSwitchKernelStackHelper(StackOffset, OldStackBase); + + /* Reenable interrupts */ + _enable(); + + return OldStackBase; } NTSTATUS @@ -313,9 +371,7 @@ KiSystemCallHandler( PULONG64 KernelParams, UserParams; ULONG ServiceNumber, Offset, Count; ULONG64 UserRsp; - - DPRINT("Syscall #%ld\n", TrapFrame->Rax); - //__debugbreak(); + NTSTATUS Status; /* Increase system call count */ __addgsdword(FIELD_OFFSET(KIPCR, Prcb.KeSystemCalls), 1); @@ -355,6 +411,40 @@ KiSystemCallHandler( /* Get descriptor table */ DescriptorTable = (PVOID)((ULONG_PTR)Thread->ServiceTable + Offset); + /* Validate the system call number */ + if (ServiceNumber >= DescriptorTable->Limit) + { + /* Check if this is a GUI call */ + if (!(Offset & SERVICE_TABLE_TEST)) + { + /* Fail the call */ + TrapFrame->Rax = STATUS_INVALID_SYSTEM_SERVICE; + return (PVOID)NtSyscallFailure; + } + + /* Convert us to a GUI thread -- must wrap in ASM to get new EBP */ + Status = KiConvertToGuiThread(); + + /* Reload trap frame and descriptor table pointer from new stack */ + TrapFrame = *(volatile PVOID*)&Thread->TrapFrame; + DescriptorTable = (PVOID)(*(volatile ULONG_PTR*)&Thread->ServiceTable + Offset); + + if (!NT_SUCCESS(Status)) + { + /* Set the last error and fail */ + TrapFrame->Rax = Status; + return (PVOID)NtSyscallFailure; + } + + /* Validate the system call number again */ + if (ServiceNumber >= DescriptorTable->Limit) + { + /* Fail the call */ + TrapFrame->Rax = STATUS_INVALID_SYSTEM_SERVICE; + return (PVOID)NtSyscallFailure; + } + } + /* Get stack bytes and calculate argument count */ Count = DescriptorTable->Number[ServiceNumber] / 8; diff --git a/ntoskrnl/ke/amd64/trap.S b/ntoskrnl/ke/amd64/trap.S index 75707e1d72d..29f3e4b46e6 100644 --- a/ntoskrnl/ke/amd64/trap.S +++ b/ntoskrnl/ke/amd64/trap.S @@ -20,6 +20,7 @@ EXTERN KiGeneralProtectionFaultHandler:PROC EXTERN KiXmmExceptionHandler:PROC EXTERN KiDeliverApc:PROC EXTERN KiDpcInterruptHandler:PROC +EXTERN PsConvertToGuiThread:PROC #ifdef _WINKD_ EXTERN KdSetOwedBreakpoints:PROC @@ -892,6 +893,28 @@ FUNC KiZwSystemService ENDFUNC +PUBLIC KiConvertToGuiThread +FUNC KiConvertToGuiThread + + push rbp + .pushreg rbp + sub rsp, 32 + .allocstack 32 + .endprolog + + /* Call the worker function */ + call PsConvertToGuiThread + + /* Adjust rsp */ + add rsp, 32 + + /* Restore rbp */ + pop rbp + + /* return to the caller */ + ret + +ENDFUNC KiExitToUserApc: int 3 @@ -934,6 +957,28 @@ KiInitializeSegments: mov gs, ax ret +/*! + * VOID + * KiSwitchKernelStackHelper( + * LONG_PTR StackOffset, + * PVOID OldStackBase); + */ +PUBLIC KiSwitchKernelStackHelper +KiSwitchKernelStackHelper: + + /* Pop return address from the current stack */ + pop rax + + /* Switch to new stack */ + lea rsp, [rsp + rcx] + + /* Push return address on the new stack */ + push rax + + /* Return on new stack */ + mov rax, rdx + ret; + #ifdef _MSC_VER #undef lgdt

4 years, 1 month

[reactos] 06/19: [NTOS:KE:X64] Fix bugs in KeContextToTrapFrame and KeTrapFrameToContext

by Timo Kreuzer

https://git.reactos.org/?p=reactos.git;a=commitdiff;h=fe6752f852ab1d8af90a7… commit fe6752f852ab1d8af90a726092879273c31b4c15 Author: Timo Kreuzer <timo.kreuzer(a)reactos.org> AuthorDate: Mon Feb 12 19:21:50 2018 +0100 Commit: Timo Kreuzer <timo.kreuzer(a)reactos.org> CommitDate: Sat Oct 31 14:23:16 2020 +0100 [NTOS:KE:X64] Fix bugs in KeContextToTrapFrame and KeTrapFrameToContext Set valid EFlags, the non-volatiles need to be taken from the exception frame, because the ones from the trap frame might not be set. --- ntoskrnl/ke/amd64/context.c | 44 +++++++++++++++++++++++++++++++++----------- 1 file changed, 33 insertions(+), 11 deletions(-) diff --git a/ntoskrnl/ke/amd64/context.c b/ntoskrnl/ke/amd64/context.c index 3e21cae3197..61c286cd69d 100644 --- a/ntoskrnl/ke/amd64/context.c +++ b/ntoskrnl/ke/amd64/context.c @@ -56,8 +56,7 @@ KeContextToTrapFrame(IN PCONTEXT Context, } /* Handle floating point registers */ - if ((ContextFlags & CONTEXT_FLOATING_POINT) && - ((Context->SegCs & MODE_MASK) != KernelMode)) + if ((ContextFlags & CONTEXT_FLOATING_POINT)) { TrapFrame->MxCsr = Context->MxCsr; TrapFrame->Xmm0 = Context->Xmm0; @@ -84,24 +83,35 @@ KeContextToTrapFrame(IN PCONTEXT Context, /* Handle control registers */ if (ContextFlags & CONTEXT_CONTROL) { - /* Check if this was a Kernel Trap */ + /* RIP, RSP, EFLAGS */ + TrapFrame->Rip = Context->Rip; + TrapFrame->Rsp = Context->Rsp; + TrapFrame->EFlags = Context->EFlags; + if ((Context->SegCs & MODE_MASK) == KernelMode) { /* Set valid selectors */ TrapFrame->SegCs = KGDT64_R0_CODE; TrapFrame->SegSs = KGDT64_R0_DATA; + + /* Set valid EFLAGS */ + TrapFrame->EFlags &= (EFLAGS_USER_SANITIZE | EFLAGS_INTERRUPT_MASK); } else { /* Copy selectors */ TrapFrame->SegCs = Context->SegCs; + if (TrapFrame->SegCs != (KGDT64_R3_CODE | RPL_MASK)) + { + TrapFrame->SegCs = (KGDT64_R3_CMCODE | RPL_MASK); + } + TrapFrame->SegSs = Context->SegSs; - } - /* RIP, RSP, EFLAGS */ - TrapFrame->Rip = Context->Rip; - TrapFrame->Rsp = Context->Rsp; - TrapFrame->EFlags = Context->EFlags; + /* Set valid EFLAGS */ + TrapFrame->EFlags &= EFLAGS_USER_SANITIZE; + TrapFrame->EFlags |= EFLAGS_INTERRUPT_MASK; + } } /* Handle segment selectors */ @@ -136,6 +146,18 @@ KeContextToTrapFrame(IN PCONTEXT Context, TrapFrame->Dr3 = Context->Dr3; TrapFrame->Dr6 = Context->Dr6; TrapFrame->Dr7 = Context->Dr7; + + if ((Context->SegCs & MODE_MASK) != KernelMode) + { + if (TrapFrame->Dr0 > (ULONG64)MmHighestUserAddress) + TrapFrame->Dr0 = 0; + if (TrapFrame->Dr1 > (ULONG64)MmHighestUserAddress) + TrapFrame->Dr1 = 0; + if (TrapFrame->Dr2 > (ULONG64)MmHighestUserAddress) + TrapFrame->Dr2 = 0; + if (TrapFrame->Dr3 > (ULONG64)MmHighestUserAddress) + TrapFrame->Dr3 = 0; + } } /* Restore IRQL */ @@ -164,11 +186,8 @@ KeTrapFrameToContext(IN PKTRAP_FRAME TrapFrame, if (ContextFlags & CONTEXT_INTEGER) { Context->Rax = TrapFrame->Rax; - Context->Rbx = TrapFrame->Rbx; Context->Rcx = TrapFrame->Rcx; Context->Rdx = TrapFrame->Rdx; - Context->Rsi = TrapFrame->Rsi; - Context->Rdi = TrapFrame->Rdi; Context->Rbp = TrapFrame->Rbp; Context->R8 = TrapFrame->R8; Context->R9 = TrapFrame->R9; @@ -177,6 +196,9 @@ KeTrapFrameToContext(IN PKTRAP_FRAME TrapFrame, if (ExceptionFrame) { + Context->Rbx = ExceptionFrame->Rbx; + Context->Rsi = ExceptionFrame->Rsi; + Context->Rdi = ExceptionFrame->Rdi; Context->R12 = ExceptionFrame->R12; Context->R13 = ExceptionFrame->R13; Context->R14 = ExceptionFrame->R14;

4 years, 1 month

[reactos] 05/19: [NTOS:KE:X64] Silence KiRundownThread, it has nothing to do

by Timo Kreuzer

https://git.reactos.org/?p=reactos.git;a=commitdiff;h=a662c6f180c278f11b0a1… commit a662c6f180c278f11b0a1a289daa67918d2fac8e Author: Timo Kreuzer <timo.kreuzer(a)reactos.org> AuthorDate: Sun Feb 11 12:12:26 2018 +0100 Commit: Timo Kreuzer <timo.kreuzer(a)reactos.org> CommitDate: Sat Oct 31 14:23:16 2020 +0100 [NTOS:KE:X64] Silence KiRundownThread, it has nothing to do --- ntoskrnl/include/internal/amd64/ke.h | 4 ---- 1 file changed, 4 deletions(-) diff --git a/ntoskrnl/include/internal/amd64/ke.h b/ntoskrnl/include/internal/amd64/ke.h index 85001d22745..21a2c66a4f2 100644 --- a/ntoskrnl/include/internal/amd64/ke.h +++ b/ntoskrnl/include/internal/amd64/ke.h @@ -229,11 +229,7 @@ FORCEINLINE VOID KiRundownThread(IN PKTHREAD Thread) { -#ifndef CONFIG_SMP - DbgPrint("KiRundownThread is unimplemented\n"); -#else /* Nothing to do */ -#endif } /* Registers an interrupt handler with an IDT vector */

4 years, 1 month

[reactos] 04/19: [NTOS:KE:X64] Fix KiWriteSystemTime

by Timo Kreuzer

https://git.reactos.org/?p=reactos.git;a=commitdiff;h=eda01e5be7ed7ec8d3bc7… commit eda01e5be7ed7ec8d3bc7f1bcc1a82243ceffd3b Author: Timo Kreuzer <timo.kreuzer(a)reactos.org> AuthorDate: Tue Dec 31 09:04:11 2019 +0100 Commit: Timo Kreuzer <timo.kreuzer(a)reactos.org> CommitDate: Sat Oct 31 14:23:16 2020 +0100 [NTOS:KE:X64] Fix KiWriteSystemTime --- ntoskrnl/ke/time.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ntoskrnl/ke/time.c b/ntoskrnl/ke/time.c index ef92051f143..09b61f0007d 100644 --- a/ntoskrnl/ke/time.c +++ b/ntoskrnl/ke/time.c @@ -31,8 +31,8 @@ KiWriteSystemTime(volatile KSYSTEM_TIME *SystemTime, ULARGE_INTEGER NewTime) /* Update in 3 steps, so that a reader can recognize partial updates */ SystemTime->High1Time = NewTime.HighPart; SystemTime->LowPart = NewTime.LowPart; - SystemTime->High2Time = NewTime.HighPart; #endif + SystemTime->High2Time = NewTime.HighPart; } FORCEINLINE

4 years, 1 month

[reactos] 03/19: [ASM:X64] Save GS base MSR in trap frame

by Timo Kreuzer

https://git.reactos.org/?p=reactos.git;a=commitdiff;h=7e6dce6aa147a980614b0… commit 7e6dce6aa147a980614b0863b9654427996774c0 Author: Timo Kreuzer <timo.kreuzer(a)reactos.org> AuthorDate: Sun Apr 14 19:18:38 2019 +0200 Commit: Timo Kreuzer <timo.kreuzer(a)reactos.org> CommitDate: Sat Oct 31 14:23:16 2020 +0100 [ASM:X64] Save GS base MSR in trap frame --- sdk/include/asm/trapamd64.inc | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/sdk/include/asm/trapamd64.inc b/sdk/include/asm/trapamd64.inc index 74209493d90..f5ae982a380 100644 --- a/sdk/include/asm/trapamd64.inc +++ b/sdk/include/asm/trapamd64.inc @@ -97,6 +97,13 @@ MACRO(EnterTrap, Flags) mov [rbp + KTRAP_FRAME_SegGs], gs endif +#if DBG + mov ecx, MSR_GS_BASE + rdmsr + mov [rbp + KTRAP_FRAME_GsBase], eax + mov [rbp + KTRAP_FRAME_GsBase + 4], edx +#endif + /* Save previous mode and check if it was user mode */ mov ax, [rbp + KTRAP_FRAME_SegCs] and al, 1

4 years, 1 month

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Ros-diffs October 2020