Changeset 5224 for trunk/src/win32k/dev32
- Timestamp:
- Feb 21, 2001, 8:47:59 AM (25 years ago)
- Location:
- trunk/src/win32k/dev32
- Files:
-
- 4 edited
Legend:
- Unmodified
- Added
- Removed
-
trunk/src/win32k/dev32/d32CallGate.asm
r5203 r5224 1 ; $Id: d32CallGate.asm,v 1. 1 2001-02-20 05:00:13bird Exp $1 ; $Id: d32CallGate.asm,v 1.2 2001-02-21 07:44:57 bird Exp $ 2 2 ; 3 3 ; 32-bit CallGate used to communitcate fast between Ring-3 and Ring-0. … … 11 11 .386p 12 12 13 ; 14 ; Defined Constants And Macros 15 ; 16 INCL_ERRORS EQU 1 17 13 18 14 19 ; 15 20 ; Header Files 16 21 ; 22 include bseerr.inc 17 23 include devsegdf.inc 18 24 include devhlp.inc 25 include win32k.inc 19 26 20 27 … … 22 29 ; Exported symbols 23 30 ; 31 public CallGateGDT 32 24 33 public InitCallGate 25 26 27 ; 28 ; extrns 29 ; 30 extrn _Device_Help:dword 34 public Win32kAPIRouter 35 36 37 ; 38 ; External symbols 39 ; 40 extrn _Device_Help:dword 41 extrn pulTKSSBase32:dword 42 31 43 extrn KMEnterKmodeSEF:near 32 44 extrn KMExitKmodeSEF8:near 33 extrn Win32kAPIRouter:near 45 extrn _TKFuBuff@16:near 46 47 extrn k32AllocMemEx:near 48 extrn k32QueryOTEs:near 49 extrn k32QueryOptionsStatus:near 50 extrn k32SetOptions:near 51 extrn k32ProcessReadWrite:near 52 ;extrn k32HandleSystemEvent:near 53 extrn k32QuerySystemMemInfo:near 54 extrn k32QueryCallGate:near 34 55 35 56 … … 44 65 GDTR_limit dw ? ; The limit field of the GDTR. 45 66 GDTR_base dd ? ; The base field of the GDTR. (linear flat address) 67 68 69 ; 70 ; Structure containing the K32 API parameter packet size. 71 ; 72 ; Used for parameter packet validation, and for copying the parameter 73 ; packet from user address space into system address space (the stack). 74 ; 75 acbK32Params: 76 dd 0 ; Not used - ie. invalid 77 dd SIZE K32ALLOCMEMEX ; K32_ALLOCMEMEX 0x01 78 dd SIZE K32QUERYOTES ; K32_QUERYOTES 0x02 79 dd SIZE K32QUERYOPTIONSSTATUS ; K32_QUERYOPTIONSSTATUS 0x03 80 dd SIZE K32SETOPTIONS ; K32_SETOPTIONS 0x04 81 dd SIZE K32PROCESSREADWRITE ; K32_PROCESSREADWRITE 0x05 82 dd SIZE K32HANDLESYSTEMEVENT ; K32_HANDLESYSTEMEVENT 0x06 83 dd SIZE K32QUERYSYSTEMMEMINFO ; K32_QUERYSYSTEMMEMINFO 0x07 84 dd SIZE K32QUERYCALLGATE ; K32_QUERYCALLGATE 0x08 85 86 ; 87 ; Structure containing the offsets of K32 API worker routines. 88 ; 89 ; Used for calling the workers indirectly. 90 ; 91 apfnK32APIs: 92 dd FLAT:k32APIStub ; Not used - ie. invalid 93 dd FLAT:k32AllocMemEx ; K32_ALLOCMEMEX 0x01 94 dd FLAT:k32QueryOTEs ; K32_QUERYOTES 0x02 95 dd FLAT:k32QueryOptionsStatus ; K32_QUERYOPTIONSSTATUS 0x03 96 dd FLAT:k32SetOptions ; K32_SETOPTIONS 0x04 97 dd FLAT:k32ProcessReadWrite ; K32_PROCESSREADWRITE 0x05 98 ;dd FLAT:k32HandleSystemEvent ; K32_HANDLESYSTEMEVENT 0x06 99 dd FLAT:k32APIStub 100 dd FLAT:k32QuerySystemMemInfo ; K32_QUERYSYSTEMMEMINFO 0x07 101 dd FLAT:k32QueryCallGate ; K32_QUERYCALLGATE 0x08 46 102 DATA32 ends 47 48 49 103 50 104 … … 66 120 push ebp 67 121 mov ebp, esp 68 sub esp, 10h69 122 push edi 70 123 push esi … … 75 128 ; 76 129 ; Allocate GDT selector for the call gate. 77 ; ( seems like this call also allocates 68kb of virtual memory which i don't need.)130 ; (URG! This call also allocates 68kb of virtual memory which i don't need!) 78 131 ; 79 132 mov di, seg DATA16:CallGateGDT … … 93 146 ; 94 147 ICG_allocok: 95 pop ds96 push ds ; restore ds (make sure it's flat)97 148 ASSUME ds:FLAT 98 149 sgdt GDTR_limit ; Get the GDTR content. … … 100 151 mov ebx, GDTR_base 101 152 movzx ecx, CallGateGDT 102 and cx, 0fff8h ; clear the dpl bits and descriptor type bit. 153 and cx, 0fff8h ; clear the dpl bits and descriptor type bit. (paranoia!) 103 154 cmp cx, ax ; check limit. (paranoia!!!) 104 155 jl ICG_limitok … … 138 189 139 190 ICG_end: 191 pop es 140 192 pop ds 141 pop es142 193 pop ebx 143 194 pop esi … … 159 210 ; @author knut st. osmundsen (knut.stange.osmundsen@mynd.no) 160 211 ; @remark 161 ; stack frame :162 ; -- -topof stack---212 ; stack frame - before KMEnterKmodeSEF: 213 ; --bottom of stack--- 163 214 ; calling ss 1ch 164 215 ; calling esp 18h … … 170 221 ; flags (pushf) 4h 171 222 ; parameter size (push 8h) 0h 172 ; ---I start repushing parameters here. 173 ; 223 ; 224 ; After the call to KMEnterKmodeSEF: 225 ; --bottom of stack--- 226 ; calling ss 50 227 ; calling esp 4c 228 ; pParameter (parameter 1) 48 229 ; ulFunctionCode (parameter 0) 44 230 ; sef_cs 40 231 ; sef_eip 3c 232 ; sef_eflag 38 233 ; sef_cbargs 34 234 ; sef_retaddr 30 235 ; sef_ds 2c 236 ; sef_es 28 237 ; sef_fs 24 238 ; sef_gs 20 239 ; sef_eax 1c 240 ; sef_ecx 18 241 ; sef_edx 14 242 ; sef_ebx 10 243 ; sef_padesp c 244 ; sef_ebp 8 245 ; sef_esi 4h 246 ; sef_edi 0h 174 247 ; 175 248 Win32kCallGate proc near 176 pushf ; Push all flags 249 ASSUME ds:nothing, ss:nothing 250 pushfd ; Push all flags (eflags) 177 251 push 8h ; Size of parameters. 178 252 … … 180 254 ; kernel entry housekeeping. 181 255 182 mov edx, [esp + 14h] ; pParameter (parameter 1)183 mov eax, [esp + 10h] ; ulFunctionCode (parameter 2)256 mov edx, [esp + 48h] ; pParameter (parameter 1) 257 mov eax, [esp + 44h] ; ulFunctionCode (parameter 2) 184 258 sub esp, 8h ; (Even when using _Oplink we have to reserve space for parameters.) 185 259 call Win32kAPIRouter ; This is my Ring-0 api. (d32Win32kIOCtl.c) … … 191 265 192 266 267 ;; 268 ; Internal function router which calls the correct function. 269 ; Called from IOCtl worker in d32Win32kIOCtl.c and callgate. 270 ; @cproto APIRET _Optlink Win32kAPIRouter(ULONG ulFunction, PVOID pvParam); 271 ; @returns function return code. 272 ; 0xdeadbeef if invalid function number. 273 ; @param eax - ulFunction Function number to call. 274 ; @param edx - pvParam Parameter packet for that function. 275 ; @uses eax, edx, ecx 276 ; @sketch Validate function number 277 ; Fetch the parameter pacted from user mode and place it on the stack. 278 ; Validate the size field of the parameter packet. 279 ; Remove the packet header from the stack => we have a callframe for the api. 280 ; Call the API worker. 281 ; Return. 282 ; @status Completely implemented. 283 ; @author knut st. osmundsen (knut.stange.osmundsen@mynd.no) 284 Win32kAPIRouter proc near 285 ASSUME ds:FLAT, es:nothing, ss:nothing 286 ; 287 ; Validate function number. 288 ; 289 cmp eax, 0 290 jne APIR_notnull ; This code should be faster (though it may look stupid to 291 ; jump around like this). IIRC branch prediction allways 292 ; takes a branch. And btw there are 4 NOPs after this jump! 293 jmp APIR_InvalidFunction 294 295 APIR_notnull: 296 cmp eax, K32_LASTIOCTLFUNCTION 297 jle APIR_ValidFunction 298 APIR_InvalidFunction: 299 mov eax, 0deadbeefh 300 ret 301 302 ; 303 ; We have a valid function number now. 304 ; Copy the parameter struct on to the stack. 305 ; 306 APIR_ValidFunction: 307 push ebp ; Make stack frame 308 mov ebp, esp 309 mov [ebp+8], eax ; Save eax on the stack (reserved by caller according to _Optlink) 310 mov ecx, acbK32Params[eax*4] ; ecx <- size of parameter packet. 311 sub esp, ecx ; Reserve stack space for the parameter packet. 312 mov eax, [pulTKSSBase32] 313 mov eax, [eax] 314 add eax, esp ; Calculate the FLAT address of esp. 315 push ecx ; Save the size. 316 ; TKFuBuff(pv, pvParam, acbParams[ulFunction], TK_FUSU_NONFATAL); 317 push 0 ; TK_FUSU_NOFATAL 318 push ecx ; Size of parameter packet 319 push edx ; Pointer to user memory to fetch 320 push eax ; Pointer to target memory. 321 call _TKFuBuff@16 ; __stdcall (cleanup done by the called function) 322 pop ecx ; Restore size 323 test eax, eax 324 jz APIR_FetchOK 325 jmp APIR_end 326 327 ; 328 ; Parameter packet is now read onto the stack. esp is pointing to it. 329 ; Check the size of the struct as the caller sees it. 330 ; 331 APIR_FetchOK: 332 cmp ecx, [esp] ; (esp now point at the parameter struct) 333 je APIR_sizeok 334 mov eax, ERROR_BAD_ARGUMENTS ; return code. 335 jmp APIR_end 336 337 ; 338 ; The size is correct. 339 ; Call the worker and return. 340 ; 341 APIR_sizeok: 342 add esp, SIZE K32HDR ; Skip the parameter header. 343 mov eax, [ebp + 8] ; Restore function number. 344 mov eax, apfnK32APIs[eax*4] ; eax <- address of the K32 API worker. 345 call eax ; Call the worker. 346 ; No cleanup needed as leave takes care of that 347 ; We're ready for returning. 348 APIR_end: 349 leave 350 ret 351 Win32kAPIRouter endp 352 353 354 ;; 355 ; This is a stub function which does nothing but returning an error code. 356 ; @return ERROR_NOT_SUPPORTED 357 k32APIStub proc near 358 mov eax, ERROR_NOT_SUPPORTED 359 ret 360 k32APIStub endp 361 193 362 CODE32 ends 194 363 … … 198 367 199 368 CODE16 segment 200 assume cs:CODE16, ds: nothing, ss:nothing, es:nothing369 assume cs:CODE16, ds:FLAT 201 370 202 371 ; -
trunk/src/win32k/dev32/d32Win32kIOCtl.c
r5205 r5224 1 /* $Id: d32Win32kIOCtl.c,v 1. 6 2001-02-20 05:02:40bird Exp $1 /* $Id: d32Win32kIOCtl.c,v 1.7 2001-02-21 07:44:57 bird Exp $ 2 2 * 3 3 * Win32k driver IOCtl handler function. … … 38 38 * Internal Functions * 39 39 *******************************************************************************/ 40 APIRET _Optlink Win32kAPIRouter(ULONG ulFunction, PVOID pvParam); /* called from d32CallGate.asm too. */ 41 40 APIRET _Optlink Win32kAPIRouter(ULONG ulFunction, PVOID pvParam); /* implemented in d32CallGate.asm. */ 42 41 43 42 … … 51 50 { 52 51 /* validate parameter pointer */ 53 if (pRpIOCtl == NULL || pRpIOCtl->ParmPacket == NULL || pRpIOCtl->Function == 0 || pRpIOCtl->Function > K32_LASTIOCTLFUNCTION) 52 if (pRpIOCtl == NULL || pRpIOCtl->ParmPacket == NULL 53 || pRpIOCtl->Function == 0 || pRpIOCtl->Function > K32_LASTIOCTLFUNCTION) 54 54 return STATUS_DONE | STERR | ERROR_I24_INVALID_PARAMETER; 55 55 … … 60 60 APIRET rc = Win32kAPIRouter(pRpIOCtl->Function, pRpIOCtl->ParmPacket); 61 61 if ( rc != 0xdeadbeefUL 62 && TKSuULongNF( pRpIOCtl->ParmPacket, SSToDS(&rc)) == NO_ERROR)62 && TKSuULongNF(&((PK32HDR)pRpIOCtl->ParmPacket)->rc, SSToDS(&rc)) == NO_ERROR) 63 63 return STATUS_DONE; /* Successfull return */ 64 64 break; … … 68 68 return STATUS_DONE | STERR | ERROR_I24_INVALID_PARAMETER; 69 69 } 70 71 72 /**73 * Internal function router which calls the correct function.74 * Called from IOCtl worker and callgate in d32CallGate.asm.75 * @returns function return code.76 * 0xdeadbeef if invalid function number.77 * @param ulFunction Function number to call.78 * @param pvParam Parameter package for that function.79 * @sketch80 * @status partially implemented.81 * @author knut st. osmundsen (knut.stange.osmundsen@mynd.no)82 * @remark This could be reimplemented in assembly.83 * Make generic parameter layout to limit amount of memory copied back.84 */85 APIRET _Optlink Win32kAPIRouter(ULONG ulFunction, PVOID pvParam)86 {87 static ULONG acbParams[] =88 {89 0, /* Not used - ie. invalid */90 sizeof(K32ALLOCMEMEX), /* K32_ALLOCMEMEX 0x01 */91 sizeof(K32QUERYOTES), /* K32_QUERYOTES 0x02 */92 sizeof(K32QUERYOPTIONSSTATUS), /* K32_QUERYOPTIONSSTATUS 0x03 */93 sizeof(K32SETOPTIONS), /* K32_SETOPTIONS 0x04 */94 sizeof(K32PROCESSREADWRITE), /* K32_PROCESSREADWRITE 0x05 */95 sizeof(K32HANDLESYSTEMEVENT), /* K32_HANDLESYSTEMEVENT 0x06 */96 sizeof(K32QUERYSYSTEMMEMINFO) /* K32_QUERYSYSTEMMEMINFO 0x07 */97 };98 APIRET rc;99 char achBuffer[MAX_PARAMSIZE];100 PVOID pv = SSToDS(&achBuffer[0]);101 102 /*103 * Validate the function number.104 * Fetch parameters from user buffer onto our Ring-0 stack.105 */106 if (ulFunction == 0 || ulFunction > sizeof(acbParams) / sizeof(acbParams[0]))107 return 0xdeadbeaf;108 rc = TKFuBuff(pv, pvParam, acbParams[ulFunction], TK_FUSU_NONFATAL);109 if (rc)110 {111 kprintf(("Win32kAPIRouter: Failed to fetch user parameters rc=%d.\n", rc));112 return rc; /* This can't happen when called from by IOCtl (I hope). */113 }114 115 116 /*117 * Call the actual function.118 */119 switch (ulFunction)120 {121 case K32_ALLOCMEMEX:122 {123 PK32ALLOCMEMEX pParm = (PK32ALLOCMEMEX)pv;124 return k32AllocMemEx(pParm->ppv, pParm->cb, pParm->flFlags, pParm->ulCS, pParm->ulEIP);125 }126 127 case K32_QUERYOTES:128 {129 PK32QUERYOTES pParm = (PK32QUERYOTES)pv;130 return k32QueryOTEs((HMTE)pParm->hMTE, pParm->pQOte, pParm->cbQOte);131 }132 133 case K32_QUERYOPTIONSSTATUS:134 {135 PK32QUERYOPTIONSSTATUS pParm = (PK32QUERYOPTIONSSTATUS)pv;136 return k32QueryOptionsStatus(pParm->pOptions, pParm->pStatus);137 }138 139 case K32_SETOPTIONS:140 {141 PK32SETOPTIONS pParm = (PK32SETOPTIONS)pv;142 return k32SetOptions(pParm->pOptions);143 }144 145 case K32_PROCESSREADWRITE:146 {147 PK32PROCESSREADWRITE pParm = (PK32PROCESSREADWRITE)pv;148 return k32ProcessReadWrite(pParm->pid, pParm->cb, pParm->pvSource, pParm->pvTarget, pParm->fRead);149 }150 151 case K32_HANDLESYSTEMEVENT:152 {153 //PK32HANDLESYSTEMEVENT pParm = (PK32HANDLESYSTEMEVENT)pv;154 //return k32HandleSystemEvent(pParm->ulEvent, pParm->hev, pParm->fHandle);155 return ERROR_NOT_SUPPORTED;156 }157 158 case K32_QUERYSYSTEMMEMINFO:159 {160 PK32QUERYSYSTEMMEMINFO pParm = (PK32QUERYSYSTEMMEMINFO)pv;161 return k32QuerySystemMemInfo(pParm->pMemInfo);162 }163 }164 165 166 /*167 * This will never happen.168 */169 kprintf(("Win32kAPIRouter: Internal processing error\n"));170 Int3();171 172 return 0xdeadbeaf;173 } -
trunk/src/win32k/dev32/d32globals.c
r2898 r5224 1 /* $Id: d32globals.c,v 1. 5 2000-02-25 18:15:03bird Exp $1 /* $Id: d32globals.c,v 1.6 2001-02-21 07:44:57 bird Exp $ 2 2 * 3 3 * d32globals - global data (32-bit) … … 22 22 * Global Variables * 23 23 *******************************************************************************/ 24 /* 25 * This is the pointer to the TK(TasK)SS(Stack Segment) FLAT Base address variable. 26 * It is used by the SSToDS macro to convert stack based addresses to FLAT ds 27 * based addressed. 28 */ 24 29 PULONG pulTKSSBase32; 25 30 -
trunk/src/win32k/dev32/d32init.c
r5202 r5224 1 /* $Id: d32init.c,v 1.3 6 2001-02-20 04:58:33bird Exp $1 /* $Id: d32init.c,v 1.37 2001-02-21 07:44:57 bird Exp $ 2 2 * 3 3 * d32init.c - 32-bits init routines. … … 175 175 case 'E':/* Elf or EXe */ 176 176 pszTmp2 = strpbrk(pszTmp, ":=/- "); 177 if (pszTmp[1] != 'x' && pszTmp != 'X')177 if (pszTmp[1] != 'x' && pszTmp[1] != 'X') 178 178 { 179 179 options.fElf = !(pszTmp2 != NULL … … 414 414 #endif 415 415 416 /* callgate */ 417 if ((rc = InitCallGate()) != NO_ERROR) 418 { 419 kprintf(("R0Init32: InitCallGate failed with rc=%d\n", rc)); 420 return (USHORT)rc; 421 } 422 416 423 417 424 /* … … 436 443 kprintf(("data segment lock failed with with rc=%d\n", rc)); 437 444 438 /* 16-bit data segment - is this really necessary? */ 445 /* 16-bit data segment - is this really necessary? - no!!! */ 446 #if 0 /* This should not be necessary!!! it's allocated from the kernel resident heap if I am not much mistaken. */ 439 447 memset(SSToDS(&lockhandle), 0, sizeof(lockhandle)); 440 448 rc = D32Hlp_VMLock2(&DATA16START, … … 444 452 if (rc != NO_ERROR) 445 453 kprintf(("16-bit data segment lock failed with with rc=%d\n", rc)); 454 #endif 446 455 447 456 return NO_ERROR; … … 592 601 if ((*psz >= 'A' && *psz <= 'E') || (*psz >= 'a' && *psz <= 'e')) 593 602 { 594 pKrnlInfo->fKernel = ( *psz - (*psz >= 'a' ? 'a'-1 : 'A'-1)) << KF_REV_SHIFT;603 pKrnlInfo->fKernel = (USHORT)((*psz - (*psz >= 'a' ? 'a'-1 : 'A'-1)) << KF_REV_SHIFT); 595 604 psz++; 596 605 } … … 904 913 /* fixed five byte instructions */ 905 914 case 0xe8: /* call imm32 */ 906 pach =+4;907 cb =+4;915 pach += 4; 916 cb += 4; 908 917 break; 909 918 … … 1273 1282 int cbmax; 1274 1283 char * pchCTEntry; /* Pointer to current calltab entry. */ 1284 ULONG flWP; /* CR0 WP flag restore value. */ 1275 1285 1276 1286 /* … … 1327 1337 */ 1328 1338 pchCTEntry = &callTab[0]; 1339 flWP = x86DisableWriteProtect(); 1329 1340 for (i = 0; i < NBR_OF_KRNLIMPORTS; i++) 1330 1341 { … … 1366 1377 kprintf(("ImportTabInit: FATAL verify failed for procedure no.%d when rehooking it!\n", i)); 1367 1378 Int3(); /* ipe - later! */ 1379 x86RestoreWriteProtect(flWP); 1368 1380 return ERROR_D32_IPE | (i << ERROR_D32_PROC_SHIFT) | ERROR_D32_PROC_FLAG; 1369 1381 } … … 1412 1424 kprintf(("ImportTabInit: FATAL verify failed for procedure no.%d when rehooking it!\n", i)); 1413 1425 Int3(); /* ipe - later! */ 1426 x86RestoreWriteProtect(flWP); 1414 1427 return ERROR_D32_IPE | (i << ERROR_D32_PROC_SHIFT) | ERROR_D32_PROC_FLAG; 1415 1428 } … … 1444 1457 kprintf(("ImportTabInit: FATAL verify failed for procedure no.%d when importing it!\n", i)); 1445 1458 Int3(); /* ipe - later! */ 1459 x86RestoreWriteProtect(flWP); 1446 1460 return ERROR_D32_IPE | (i << ERROR_D32_PROC_SHIFT) | ERROR_D32_PROC_FLAG; 1447 1461 } … … 1480 1494 kprintf(("ImportTabInit: FATAL verify failed for procedure no.%d when importing it!\n", i)); 1481 1495 Int3(); /* ipe - later! */ 1496 x86RestoreWriteProtect(flWP); 1482 1497 return ERROR_D32_IPE | (i << ERROR_D32_PROC_SHIFT) | ERROR_D32_PROC_FLAG; 1483 1498 } … … 1517 1532 kprintf(("ImportTabInit: unsupported type. (procedure no.%d, cb=%d)\n", i, cb)); 1518 1533 Int3(); /* ipe - later! */ 1534 x86RestoreWriteProtect(flWP); 1519 1535 return ERROR_D32_IPE | (i << ERROR_D32_PROC_SHIFT) | ERROR_D32_PROC_FLAG; 1520 1536 } /* switch - type */ 1521 1537 } /* for */ 1538 1539 x86RestoreWriteProtect(flWP); 1522 1540 1523 1541 return NO_ERROR;
Note:
See TracChangeset
for help on using the changeset viewer.