[ros-diffs] [ion] 20911: - Fix some nasty context switch bugs:

- Fix some nasty context switch bugs:
  * We did not update the KPCR's stacklimit/initialstack with the new
thread's stacklimit/initialstack.
  * We always assumed V86 frame bias in KeInitializeThreadContext.
  * We did not properly update ESP0 during context switch, to make space
for the NPX frame and V86 bias.
  * We did not update fs:18h to point to the new TEB.
  * We did not clear out GS when switching processes, nor update the
TSS's cr3.
  * If a new LDT was being updated, we over-wrote EBP (which was
supposed to point to the TSS) by the GDT pointer.
  * We used a push/pop esp0 hack which hid the fact we never updated
esp0.
Modified: trunk/reactos/ntoskrnl/ke/i386/ctxswitch.S
Modified: trunk/reactos/ntoskrnl/ke/i386/thread.c
  _____  

Modified: trunk/reactos/ntoskrnl/ke/i386/ctxswitch.S
--- trunk/reactos/ntoskrnl/ke/i386/ctxswitch.S	2006-01-15 22:26:10 UTC
(rev 20910)
+++ trunk/reactos/ntoskrnl/ke/i386/ctxswitch.S	2006-01-16 02:21:22 UTC
(rev 20911)
@@ -57,7 +57,7 @@

 .globl _KiThreadStartup@156
 _KiThreadStartup@156:
 
-    /* 
+    /*
      * Clear all the non-volatile registers, so the thread won't be
tempted to
      * expect any static data (like some badly coded usermode/win9x
apps do)
      */
@@ -65,11 +65,11 @@
     xor esi, esi
     xor edi, edi
     xor ebp, ebp
-    
+
     /* It's now safe to go to APC */
     mov ecx, APC_LEVEL
     call @KfLowerIrql@4
-    
+
     /* 
      * Call the System Routine which is right on our stack now.
      * After we pop the pointer, the Start Routine/Context will be on
the 
@@ -77,18 +77,18 @@
      */
     pop eax
     call eax
-    
+
     /* The thread returned... was it a user-thread? */
     pop ecx
     or ecx, ecx
     jz BadThread
-    
+
     /* Yes it was, set our trapframe for the System Call Exit
Dispatcher */
     mov ebp, esp
-    
+
     /* Exit back to user-mode */
     jmp _KiServiceExit2
-    
+
 BadThread:
 
     /* A system thread returned...this is very bad! */
@@ -114,10 +114,6 @@
  *--*/
 .globl @KiSwapContextInternal@0
 @KiSwapContextInternal@0:
-#ifdef KDBG
-    //jmp SaveTrapFrameForKDB
-SaveTrapFrameForKDB_Return:
-#endif
 
     /* Get the PCR. It's faster to use ebx+offset then fs:offset */
     mov ebx, [fs:KPCR_SELF]
@@ -132,24 +128,36 @@
     cli
 
     /* Save the initial stack in EAX */
-    mov eax, [edi+KTHREAD_INITIAL_STACK]
+    mov eax, [esi+KTHREAD_INITIAL_STACK]
 
+    /* Save the stack limit in ecx */
+    mov ecx, [esi+KTHREAD_STACK_LIMIT]
+
+    /* Make space for the NPX Frame */
+    sub eax, NPX_FRAME_LENGTH
+
+    /* Set the KPCR stack values */
+    mov [ebx+KPCR_INITIAL_STACK], eax
+    mov [ebx+KPCR_STACK_LIMIT], ecx
+
 #ifdef CONFIG_SMP
     /* Save FPU state if the thread has used it. */
+    mov ecx, [edi+KTHREAD_INITIAL_STACK]
+    sub ecx, NPX_FRAME_LENGTH
     mov dword ptr [ebx+KPCR_NPX_THREAD], 0
     test byte ptr [edi+KTHREAD_NPX_STATE], NPX_STATE_DIRTY
     jz 3f
     cmp dword ptr _KeI386FxsrPresent, 0
     je 1f
-    fxsave [eax-SIZEOF_FX_SAVE_AREA]
+    fxsave [ecx]
     jmp 2f
 1:
-    fnsave [eax-SIZEOF_FX_SAVE_AREA]
+    fnsave [ecx]
 2:
     mov byte ptr [edi+KTHREAD_NPX_STATE], NPX_STATE_VALID
 3:
 #endif /* CONFIG_SMP */
-    
+
     /* Save the stack pointer in this processors TSS */
     mov ebp, [ebx+KPCR_TSS]
 
@@ -158,12 +166,17 @@
     jnz NoAdjust
 
     /* Bias esp */
-    //sub dword ptr ss:[ebp+KTSS_ESP0], KTRAP_FRAME_V86_GS -
KTRAP_FRAME_SS
+    sub eax, KTRAP_FRAME_V86_GS - KTRAP_FRAME_SS
 
 NoAdjust:
-    /* Push ESP0 Value */
-    push ss:[ebp+KTSS_ESP0]
 
+    /* Set new ESP0 */
+    mov [ebp+KTSS_ESP0], eax
+
+    /* Set TEB pointer */
+    mov eax, [esi+KTHREAD_TEB]
+    mov [ebx+KPCR_TEB], eax
+
     /* Check if address space switch is needed */
     mov eax, [esi+KTHREAD_APCSTATE_PROCESS]
     cmp eax, [edi+KTHREAD_APCSTATE_PROCESS]
@@ -172,52 +185,57 @@
     /* Switch stacks */
     mov [edi+KTHREAD_KERNEL_STACK], esp
     mov esp, [esi+KTHREAD_KERNEL_STACK]
-    
+
     jz	NoAddressSpaceSwitch
-    
+
+    /* Clear gs */
+    xor ecx, ecx
+    mov gs, cx
+
     /* Switch address space */
     mov cr3, eax
-   
-NoAddressSpaceSwitch:   
-   
+    mov [ebp+KTSS_CR3], eax
+
+NoAddressSpaceSwitch:
+
     /* Stack is OK, safe to enable interrupts now */
-    sti 
+    sti
 
     /* Check if address space switch is needed (the result from above
is valid) */
     /* If they match, then use the fast-path and skip all this */
     jz SameProcess
-    
+
     /* Get the new Process. */
     mov edi, [esi+KTHREAD_APCSTATE_PROCESS]
-    
+
     /* Check if we need an LDT */
     xor eax, eax
     cmp [edi+KPROCESS_LDT_DESCRIPTOR0], eax
     jz NoLdt
-    
+
     /* Write the LDT Selector */
-    mov ebp, [ebx+KPCR_GDT]
+    mov ecx, [ebx+KPCR_GDT]
     mov eax, [edi+KPROCESS_LDT_DESCRIPTOR0]
-    mov [ebp+KGDT_LDT], eax
+    mov [ecx+KGDT_LDT], eax
     mov eax, [edi+KPROCESS_LDT_DESCRIPTOR1]
-    mov [ebp+KGDT_LDT+4], eax
-    
+    mov [ecx+KGDT_LDT+4], eax
+
     /* Save LDT Selector */
     mov eax, KGDT_LDT
-        
+
 NoLdt:
-    
+
     /* Load LDT */
     lldt ax
-  
+
     /* Get the IOPM */
     mov ecx, [edi+KPROCESS_IOPM_OFFSET]
 
     /* Set current IOPM offset in the TSS */
     mov [ebp+KTSS_IOMAPBASE], cx
-    
+
 SameProcess:
-    
+
     /* Set the TEB */
     mov eax, [esi+KTHREAD_TEB]
     mov ecx, [ebx+KPCR_GDT]
@@ -225,10 +243,10 @@
     shr eax, 16
     mov [ecx+0x3C], al
     mov [ecx+0x3F], ah
-    
+
     /* Increase context switches */
     inc dword ptr [esi+KTHREAD_CONTEXT_SWITCHES]
-    
+
     /* Set TS in cr0 to catch FPU code and load the FPU state when
needed */
 #ifndef CONFIG_SMP
     cmp [ebx+KPCR_NPX_THREAD], esi
@@ -238,10 +256,7 @@
     or eax, X86_CR0_TS
     mov cr0, eax
 4:
-    
-    /* Restore the stack pointer in this processors TSS */
-    pop ss:[ebp+KTSS_ESP0]
-    
+
     /* Restore exception list */
     pop [ebx+KPCR_EXCEPTION_LIST]
 
@@ -307,106 +322,4 @@
     /* Clean stack */
     add esp, 4 * 4
     ret
-    
-#ifdef KDBG
 
-SaveTrapFrameForKDB:
-    /* Set up a trap frame */
-    pushf                                        // 0x70
-    push cs                                      // 0x6C
-    push 0             /* Error Code */          // 0x64
-    push ebp                                     // 0x60
-    push ebx
-    
-    /* Fake Interrupt Stack */
-    mov ebp, [esp+20]  /* Eip */
-    mov ebx, [esp+16]  /* Eflags */
-    mov [esp+20], ebx
-    mov ebx, [esp+12]  /* Cs */
-    mov [esp+16], ebx
-    mov [esp+12], ebp
-    
-    push esi
-    push edi
-    push fs
-    push -1            /* Exception List */      // 0x4C
-    push 0             /* Previous Mode */       // 0x48
-    push eax
-    push ecx
-    push edx
-    push ds
-    push es
-    push gs                                      // 0x30
-
-    mov eax, dr7
-    push eax           /* Dr7 */
-    /* Clear breakpoint enables in dr7. */
-    and eax, 0xffff0000
-    mov dr7, eax
-    mov eax, dr6
-    push eax           /* Dr6 */
-    mov eax, dr3
-    push eax           /* Dr3 */
-    mov eax, dr2
-    push eax           /* Dr2 */
-    mov eax, dr1
-    push eax           /* Dr1 */
-    mov eax, dr0
-    push eax           /* Dr0 */
-        
-    lea eax, [esp+0x58]
-    push eax           /* TempEsp */
-    push ss            /* TempSegSs */
-    push 0             /* DebugPointer */
-    push -1            /* DebugArgMark */
-    push [esp+60]      /* Debug EIP */           // 0x4
-    push ebp           /* Debug EBP */           // 0x0
-    
-    /* Set Stack */
-    mov ebp, esp
-    
-    /* Push old Trap Frame */
-    push [edi+KTHREAD_TRAP_FRAME]
-    
-    /* Save new one */
-    mov [edi+KTHREAD_TRAP_FRAME], ebp
-    
-    /* Restore EBP, EBX and EAX */
-    mov ebp, [ebp+KTRAP_FRAME_EBP]
-    mov ebx, [ebp+KTRAP_FRAME_EBX]
-    mov eax, [ebp+KTRAP_FRAME_EAX]
-    
-    /* Return EIP */
-    push offset RestoreTrapFrameForKDB
-        
-    /* Jump to normal code */
-    jmp SaveTrapFrameForKDB_Return
-
-RestoreTrapFrameForKDB:
-  
-    /* Restore the old trapframe */
-    pop [esi+KTHREAD_TRAP_FRAME]
-        
-    /* Pop unused portions of the trap frame */
-    add esp, 0x30
-
-    /* Restore registers from Trap frame */
-    pop gs
-    pop es
-    pop ds
-    pop edx
-    pop ecx
-    pop eax
-    add esp, 8           /* ExceptionList and PreviousMode */
-    pop fs
-    pop edi
-    pop esi
-    pop ebx
-    pop ebp
-    add esp, 4           /* ErrorCode */
-
-    /* Return to the caller. */
-    iret
-#endif /* KDBG */
-
-
  _____  

Modified: trunk/reactos/ntoskrnl/ke/i386/thread.c
--- trunk/reactos/ntoskrnl/ke/i386/thread.c	2006-01-15 22:26:10 UTC
(rev 20910)
+++ trunk/reactos/ntoskrnl/ke/i386/thread.c	2006-01-16 02:21:22 UTC
(rev 20911)
@@ -14,7 +14,6 @@

 
 typedef struct _KSHARED_CTXSWITCH_FRAME
 {
-    ULONG Esp0;
     PVOID ExceptionList;
     PVOID RetEip;
 } KSHARED_CTXSWITCH_FRAME, *PKSHARED_CTXSWITCH_FRAME;
@@ -232,9 +231,6 @@
 
     /* And set up the Context Switch Frame */
     CtxSwitchFrame->RetEip = KiThreadStartup;
-    CtxSwitchFrame->Esp0 = (ULONG_PTR)Thread->InitialStack -
-                                      sizeof(FX_SAVE_AREA) -
-                                      0x10;
     CtxSwitchFrame->ExceptionList = (PVOID)0xFFFFFFFF;
 
     /* Save back the new value of the kernel stack. */