mirror of https://github.com/tongzx/nt5src
You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
597 lines
16 KiB
597 lines
16 KiB
//++
|
|
//
|
|
// Module Name:
|
|
//
|
|
// trampoln.s
|
|
//
|
|
// Abstract:
|
|
//
|
|
// This module implements the trampoline code necessary to dispatch user
|
|
// mode APCs.
|
|
//
|
|
// Author:
|
|
//
|
|
// William K. Cheung 25-Oct-1995
|
|
//
|
|
// Environment:
|
|
//
|
|
// User mode only.
|
|
//
|
|
// Revision History:
|
|
//
|
|
// 08-Feb-1996 Updated to EAS 2.1
|
|
//
|
|
//--
|
|
|
|
#include "ksia64.h"
|
|
|
|
.file "trampoln.s"
|
|
|
|
PublicFunction(RtlpCaptureRnats)
|
|
PublicFunction(RtlDispatchException)
|
|
PublicFunction(RtlRaiseException)
|
|
PublicFunction(RtlRaiseStatus)
|
|
PublicFunction(ZwContinue)
|
|
PublicFunction(ZwCallbackReturn)
|
|
PublicFunction(ZwRaiseException)
|
|
PublicFunction(ZwTestAlert)
|
|
.global Wow64PrepareForException
|
|
|
|
|
|
//++
|
|
//
|
|
// EXCEPTION_DISPOSITION
|
|
// KiUserApcHandler (
|
|
// IN PEXCEPTION_RECORD ExceptionRecord,
|
|
// IN ULONG EstablisherFrame,
|
|
// IN OUT PCONTEXT ContextRecord,
|
|
// IN OUT PDISPATCHER_CONTEXT DispatcherContext
|
|
//
|
|
// Routine Description:
|
|
//
|
|
// This function is called when an exception occurs in an APC routine
|
|
// or one of its dynamic descendents and when an unwind through the
|
|
// APC dispatcher is in progress. If an unwind is in progress, then test
|
|
// alert is called to ensure that all currently queued APCs are executed.
|
|
//
|
|
// Arguments:
|
|
//
|
|
// ExceptionRecord (a0) - Supplies a pointer to an exception record.
|
|
//
|
|
// EstablisherFrame (a1) - Supplies the frame pointer of the establisher
|
|
// of this exception handler.
|
|
//
|
|
// ContextRecord (a2) - Supplies a pointer to a context record.
|
|
//
|
|
// DispatcherContext (a3) - Supplies a pointer to the dispatcher context
|
|
// record.
|
|
//
|
|
// Return Value:
|
|
//
|
|
// ExceptionContinueSearch is returned as the function value.
|
|
//
|
|
//--
|
|
|
|
NESTED_ENTRY (KiUserApcHandler)
|
|
|
|
//
|
|
// register aliases
|
|
//
|
|
|
|
pUwnd = pt1
|
|
pNot = pt2
|
|
|
|
|
|
NESTED_SETUP(1, 2, 0, 0)
|
|
add t0 = ErExceptionFlags, a0
|
|
;;
|
|
|
|
PROLOGUE_END
|
|
|
|
ld4 t2 = [t0] // get exception flags
|
|
;;
|
|
and t2 = EXCEPTION_UNWIND, t2 // check if unwind in progress
|
|
;;
|
|
|
|
cmp4.ne pUwnd, pNot = zero, t2
|
|
;;
|
|
|
|
(pNot) add v0 = ExceptionContinueSearch, zero
|
|
(pNot) br.ret.sptk.clr brp // return
|
|
(pUwnd) br.call.spnt.many brp = ZwTestAlert
|
|
|
|
//
|
|
// restore preserved states and set the disposition value to continue search
|
|
//
|
|
|
|
add v0 = ExceptionContinueSearch, zero
|
|
mov brp = savedbrp // restore return link
|
|
nop.b 0
|
|
|
|
nop.m 0
|
|
mov ar.pfs = savedpfs // restore pfs
|
|
br.ret.sptk.clr brp // return
|
|
|
|
NESTED_EXIT (KiUserApcHandler)
|
|
|
|
//++
|
|
//
|
|
// VOID
|
|
// KiUserApcDispatcher (
|
|
// IN PVOID NormalContext,
|
|
// IN PVOID SystemArgument1,
|
|
// IN PVOID SystemArgument2,
|
|
// IN PKNORMAL_ROUTINE NormalRoutine
|
|
// )
|
|
//
|
|
// Routine Description:
|
|
//
|
|
// This routine is entered on return from kernel mode to deliver an APC
|
|
// in user mode. The stack frame for this routine was built when the
|
|
// APC interrupt was processed and contains the entire machine state of
|
|
// the current thread. The specified APC routine is called and then the
|
|
// machine state is restored and execution is continued.
|
|
//
|
|
// Arguments:
|
|
//
|
|
// t0 - Supplies the normal context parameter that was specified when the
|
|
// APC was initialized.
|
|
//
|
|
// t1 - Supplies the first argument that was provied by the executive when
|
|
// the APC was queued.
|
|
//
|
|
// t2 - Supplies the second argument that was provided by the executive
|
|
// when the APC was queued.
|
|
//
|
|
// t3 - Supplies the address of the plabel for the function
|
|
// that is to be called.
|
|
//
|
|
// Return Value:
|
|
//
|
|
// None.
|
|
//
|
|
//
|
|
// N.B. On entry, sp points to the stack scratch area at the top of the
|
|
// memory stack.
|
|
//
|
|
// N.B. The input arguments of this function are passed from the kernel
|
|
// in scratch registers t0, t1, t2, and t3.
|
|
//
|
|
//--
|
|
|
|
NESTED_ENTRY_EX (KiUserApcDispatch, KiUserApcHandler)
|
|
ALTERNATE_ENTRY (KiUserApcDispatcher)
|
|
|
|
.prologue
|
|
.unwabi @nt, CONTEXT_FRAME
|
|
|
|
.regstk 0, 0, 3, 0
|
|
|
|
rBsp = t10 // BspStore
|
|
rpCr = t11 // pointer to context record
|
|
rpT1 = t12 // temporary pointer
|
|
|
|
alloc t22 = ar.pfs, 0, 0, 3, 0 // 3 outputs
|
|
add t10 = STACK_SCRATCH_AREA+ContextFrameLength+24, sp
|
|
add t11 = STACK_SCRATCH_AREA+ContextFrameLength, sp
|
|
;;
|
|
|
|
PROLOGUE_END
|
|
|
|
ld8.nta t12 = [t10], -8
|
|
movl s1 = _gp
|
|
;;
|
|
|
|
ld8.nta out0 = [t11], 8
|
|
ld8.nta t13 = [t12], PlGlobalPointer-PlEntryPoint
|
|
;;
|
|
|
|
ld8.nta out1 = [t11], 8
|
|
ld8.nta out2 = [t10]
|
|
mov bt0 = t13
|
|
|
|
ld8.nta gp = [t12]
|
|
br.call.sptk.many brp = bt0 // call APC routine
|
|
;;
|
|
|
|
//
|
|
// On return, setup global pointer and branch register to call ZwContinue.
|
|
// Also, flush the RSE to sync up the bsp and bspstore pointers. The
|
|
// corresponding field in the context record is updated too.
|
|
//
|
|
|
|
flushrs
|
|
mov out1 = 1 // set TestAlert to TRUE
|
|
;;
|
|
|
|
add out0 = STACK_SCRATCH_AREA, sp // context record address
|
|
mov gp = s1 // restore gp
|
|
br.call.sptk.many brp = ZwContinue
|
|
;;
|
|
|
|
//
|
|
// if successful, ZwContinue does not return here;
|
|
// otherwise, error happened.
|
|
//
|
|
|
|
mov gp = s1 // restore gp
|
|
mov s0 = v0 // save the return status
|
|
;;
|
|
|
|
Kuad10:
|
|
mov out0 = s0 // setup 1st argument
|
|
br.call.sptk.many brp = RtlRaiseStatus
|
|
;;
|
|
|
|
nop.m 0
|
|
nop.i 0
|
|
br Kuad10 // loop on return
|
|
|
|
NESTED_EXIT(KiUserApcDispatch)
|
|
|
|
|
|
//++
|
|
//
|
|
// VOID
|
|
// KiUserCallbackDispatcher (
|
|
// VOID
|
|
// )
|
|
//
|
|
// Routine Description:
|
|
//
|
|
// This routine is entered on a callout from kernel mode to execute a
|
|
// user mode callback function. All arguments for this function have
|
|
// been placed on the stack.
|
|
//
|
|
// Arguments:
|
|
//
|
|
// (sp + 32 + CkApiNumber) - Supplies the API number of the callback
|
|
// function that is to be executed.
|
|
//
|
|
// (sp + 32 + CkBuffer) - Supplies a pointer to the input buffer.
|
|
//
|
|
// (sp + 32 + CkLength) - Supplies the input buffer length.
|
|
//
|
|
// Return Value:
|
|
//
|
|
// This function returns to kernel mode.
|
|
//
|
|
// N.B. Preserved register s1 is used to save ZwCallbackReturn plabel address.
|
|
// On entry, gp is set to the global pointer value of NTDLL
|
|
//
|
|
//--
|
|
|
|
NESTED_ENTRY(KiUserCallbackDispatch)
|
|
|
|
.prologue
|
|
.savesp rp, STACK_SCRATCH_AREA+CkBrRp
|
|
.savesp ar.pfs, STACK_SCRATCH_AREA+CkRsPFS
|
|
.vframesp STACK_SCRATCH_AREA+CkIntSp
|
|
|
|
nop.m 0
|
|
nop.m 0
|
|
nop.i 0
|
|
;;
|
|
|
|
PROLOGUE_END
|
|
|
|
ALTERNATE_ENTRY(KiUserCallbackDispatcher)
|
|
|
|
|
|
//
|
|
// register aliases
|
|
//
|
|
|
|
rpT0 = t0 // temporary pointer
|
|
rpT1 = t1 // temporary pointer
|
|
rT0 = t2 // temporary value
|
|
rFunc = t3 // callback function entry
|
|
rApi = t4
|
|
|
|
|
|
alloc t22 = ar.pfs, 0, 0, 3, 0 // 3 outputs max.
|
|
mov teb = kteb // sanitize teb
|
|
add rpT0 = STACK_SCRATCH_AREA + CkApiNumber, sp
|
|
movl gp = _gp
|
|
;;
|
|
|
|
ld4 rApi = [rpT0], CkBuffer - CkApiNumber // get API number
|
|
add rpT1 = TePeb, teb
|
|
mov s0 = gp
|
|
;;
|
|
|
|
//
|
|
// load both input buffer address and length into scratch register t2
|
|
// and then deposit them into registers out0 & out1 respectively.
|
|
//
|
|
// N.B. t0 is 8-byte aligned.
|
|
//
|
|
|
|
LDPTRINC(out0, rpT0, CkLength-CkBuffer) // input buffer address
|
|
LDPTR(t11, rpT1) // get address of PEB
|
|
#if defined(_WIN64)
|
|
shl rApi = rApi, 3 // compute offset to table entry
|
|
#else
|
|
shl rApi = rApi, 2 // compute offset to table entry
|
|
#endif
|
|
;;
|
|
|
|
ld4 out1 = [rpT0] // get input buffer length
|
|
add t5 = PeKernelCallbackTable, t11
|
|
;;
|
|
LDPTR(rFunc, t5) // address of callback table
|
|
;;
|
|
|
|
add rFunc = rApi, rFunc // compute addr of table entry
|
|
;;
|
|
LDPTR(t6, rFunc) // get plabel's address
|
|
;;
|
|
|
|
ld8.nt1 t9 = [t6], PlGlobalPointer-PlEntryPoint // load entry point address
|
|
;;
|
|
|
|
ld8.nt1 gp = [t6] // load callee's GP
|
|
mov bt0 = t9
|
|
br.call.sptk.many brp = bt0 // invoke the callback func
|
|
|
|
//
|
|
// If a return from the callback function occurs, then the output buffer
|
|
// address and length are returned as NULL.
|
|
//
|
|
|
|
mov out0 = zero // NULL output buffer addr
|
|
mov out1 = zero // zero output buffer len
|
|
|
|
mov out2 = v0 // set completion status
|
|
mov gp = s0
|
|
br.call.sptk.many brp = ZwCallbackReturn
|
|
|
|
//
|
|
// Unsuccessful completion after attempting to return to kernel mode. Use
|
|
// the return status as the exception code, set noncontinuable exception and
|
|
// attempt to raise another exception. Note there is no return from raise
|
|
// status.
|
|
//
|
|
|
|
nop.m 0
|
|
mov gp = s0 // restore our own GP
|
|
mov s0 = v0 // save status value
|
|
;;
|
|
|
|
Kucd10:
|
|
mov out0 = s0 // set status value
|
|
br.call.sptk.many brp = RtlRaiseStatus
|
|
|
|
nop.m 0
|
|
nop.m 0
|
|
br Kucd10 // jump back to Kucd10
|
|
|
|
NESTED_EXIT(KiUserCallbackDispatch)
|
|
|
|
//++
|
|
//
|
|
// VOID
|
|
// KiUserExceptionDispatcher (
|
|
// IN PEXCEPTION_RECORD ExceptionRecord,
|
|
// IN PCONTEXT ContextRecord
|
|
// )
|
|
//
|
|
// Routine Description:
|
|
//
|
|
// This routine is entered on return from kernel mode to dispatch a user
|
|
// mode exception. If a frame based handler handles the exception, then
|
|
// the execution is continued. Else last chance processing is performed.
|
|
//
|
|
// Arguments:
|
|
//
|
|
// s0 - Supplies a pointer to an exception record.
|
|
//
|
|
// s1 - Supplies a pointer to a context record.
|
|
//
|
|
// Return Value:
|
|
//
|
|
// None.
|
|
//
|
|
// N.B. preserved register s3 is used to save the current global pointer.
|
|
//
|
|
//--
|
|
|
|
NESTED_ENTRY (KiUserExceptionDispatch)
|
|
ALTERNATE_ENTRY(KiUserExceptionDispatcher)
|
|
|
|
.prologue
|
|
.unwabi @nt, CONTEXT_FRAME
|
|
|
|
alloc t0 = ar.pfs, 0, 1, 3, 0
|
|
mov teb = kteb // sanitize teb
|
|
mov s3 = gp // save global pointer
|
|
;;
|
|
|
|
PROLOGUE_END
|
|
|
|
flushrs // flush the RSE
|
|
;;
|
|
mov out0 = s1
|
|
br.call.sptk.many brp = RtlpCaptureRnats
|
|
;;
|
|
|
|
add t1 = @gprel(Wow64PrepareForException), gp
|
|
;;
|
|
ld8 t1 = [t1]
|
|
;;
|
|
cmp.ne pt1, pt0 = zero, t1 // Wow64PrepareForException != NULL?
|
|
;;
|
|
(pt1) ld8 t2 = [t1], PlGlobalPointer - PlEntryPoint
|
|
;;
|
|
(pt1) ld8 gp = [t1]
|
|
(pt1) mov bt0 = t2
|
|
(pt1) br.call.spnt.few brp = bt0
|
|
;;
|
|
|
|
mov gp = s3
|
|
|
|
mov out0 = s0
|
|
mov out1 = s1
|
|
br.call.sptk.many brp = RtlDispatchException
|
|
|
|
cmp4.eq pt1, pt0 = zero, v0 // result is FALSE ?
|
|
;;
|
|
(pt1) mov out2 = zero
|
|
mov gp = s3
|
|
|
|
(pt0) add out0 = 0, s1
|
|
(pt0) mov out1 = zero // set test alert to FALSE.
|
|
(pt0) br.call.sptk.many brp = ZwContinue
|
|
;;
|
|
|
|
(pt1) add out0 = 0, s0
|
|
(pt1) mov out1 = s1
|
|
(pt1) br.call.sptk.many brp = ZwRaiseException
|
|
;;
|
|
|
|
//
|
|
// Common code for nonsuccessful completion of the continue or last chance
|
|
// processing service. Use the return status as the exception code, set
|
|
// noncontinuable exception and attempt to raise another exception. Note
|
|
// that the stack grows and eventually this loop will end.
|
|
//
|
|
|
|
Kued10:
|
|
|
|
//
|
|
// allocate space for exception record
|
|
//
|
|
|
|
nop.m 0
|
|
movl s2 = EXCEPTION_NONCONTINUABLE // set noncontinuable flag.
|
|
|
|
add sp = -ExceptionRecordLength, sp
|
|
nop.f 0
|
|
mov gp = s3 // restore gp
|
|
;;
|
|
|
|
add out0 = STACK_SCRATCH_AREA, sp // get except record addr
|
|
add t2 = ErExceptionFlags+STACK_SCRATCH_AREA, sp
|
|
add t3 = ErExceptionCode+STACK_SCRATCH_AREA, sp
|
|
;;
|
|
|
|
//
|
|
// Set exception flags and exception code.
|
|
//
|
|
|
|
st4 [t2] = s2, ErExceptionRecord - ErExceptionFlags
|
|
st4 [t3] = v0, ErNumberParameters - ErExceptionCode
|
|
;;
|
|
|
|
//
|
|
// Set exception record and number of parameters.
|
|
// Then call RtlRaiseException
|
|
//
|
|
|
|
st4 [t2] = s0
|
|
st4 [t3] = zero
|
|
br.call.sptk.many brp = RtlRaiseException
|
|
|
|
nop.m 0
|
|
nop.m 0
|
|
br Kued10 // loop on return
|
|
|
|
NESTED_EXIT(KiUserExceptionDispatch)
|
|
|
|
|
|
//++
|
|
//
|
|
// NTSTATUS
|
|
// KiRaiseUserExceptionDispatcher (
|
|
// IN NTSTATUS ExceptionCode
|
|
// )
|
|
//
|
|
// Routine Description:
|
|
//
|
|
// This routine is entered on return from kernel mode to raise a user
|
|
// mode exception.
|
|
//
|
|
// Arguments:
|
|
//
|
|
// v0 - Supplies the status code to be raised.
|
|
//
|
|
// Return Value:
|
|
//
|
|
// ExceptionCode
|
|
//
|
|
//--
|
|
|
|
//
|
|
// N.B. This function is not called in the typical way. Instead of a normal
|
|
// subroutine call to the nested entry point above, the alternate entry point
|
|
// address below is stuffed into the Fir address of the trap frame. Thus when
|
|
// the kernel returns from the trap, the following code is executed directly.
|
|
//
|
|
|
|
|
|
NESTED_ENTRY(KiRaiseUserExceptionDispatch)
|
|
|
|
.prologue
|
|
.savepsp ar.pfs, -8
|
|
nop.m 0
|
|
.savepsp rp, 0
|
|
nop.m 0
|
|
nop.i 0
|
|
;;
|
|
|
|
ALTERNATE_ENTRY(KiRaiseUserExceptionDispatcher)
|
|
|
|
//
|
|
// ar.pfs and brp have been saved on the stack in the scratch area.
|
|
//
|
|
|
|
alloc t22 = ar.pfs, 8, 1, 1, 0
|
|
ld8.nta t3 = [sp]
|
|
.fframe ExceptionRecordLength+STACK_SCRATCH_AREA, tg10
|
|
[tg10:] add sp = -ExceptionRecordLength-STACK_SCRATCH_AREA, sp
|
|
;;
|
|
|
|
PROLOGUE_END
|
|
|
|
add t1 = STACK_SCRATCH_AREA+ErExceptionCode, sp
|
|
add t2 = STACK_SCRATCH_AREA+ErExceptionFlags, sp
|
|
mov loc0 = v0
|
|
;;
|
|
|
|
//
|
|
// set exception code and exception flags
|
|
//
|
|
|
|
st4 [t1] = v0, ErExceptionRecord - ErExceptionCode
|
|
movl gp = _gp // setup gp to ntdll's
|
|
|
|
st4 [t2] = zero, ErExceptionAddress - ErExceptionFlags
|
|
;;
|
|
st4 [t1] = zero, ErNumberParameters - ErExceptionRecord
|
|
add out0 = STACK_SCRATCH_AREA, sp
|
|
;;
|
|
|
|
//
|
|
// set exception record and exception address
|
|
//
|
|
|
|
st4 [t1] = zero // set number of parameters
|
|
STPTR(t2, t3)
|
|
br.call.sptk.many brp = RtlRaiseException
|
|
|
|
add t1 = ExceptionRecordLength+STACK_SCRATCH_AREA, sp
|
|
add t2 = ExceptionRecordLength+STACK_SCRATCH_AREA+8, sp
|
|
mov v0 = loc0
|
|
;;
|
|
|
|
ld8.nta t3 = [t1]
|
|
ld8.nta t4 = [t2]
|
|
;;
|
|
mov brp = t3
|
|
|
|
.restore tg20
|
|
[tg20:] add sp = ExceptionRecordLength, sp
|
|
mov ar.pfs = t4
|
|
br.ret.sptk.clr brp
|
|
|
|
NESTED_EXIT(KiRaiseUserExceptionDispatcher)
|