December 2023 - Wine-Commits

Alexandre Julliard : ntdll: Fix stack layout for KiUserCallbackDispatcher on i386.
by Alexandre Julliard Dec. 1, 2023

Dec. 1, 2023

Module: wine Branch: master Commit: e60a97c1b45a4b2a15077feb36b1e16abf2d8ef4 URL: https://gitlab.winehq.org/wine/wine/-/commit/e60a97c1b45a4b2a15077feb36b1e1… Author: Alexandre Julliard <julliard(a)winehq.org> Date: Thu Nov 30 17:43:14 2023 +0100 ntdll: Fix stack layout for KiUserCallbackDispatcher on i386. --- dlls/ntdll/tests/exception.c | 56 +++++++++++++++++++++++++++++++++++++++++++ dlls/ntdll/unix/signal_i386.c | 45 +++++++++++++++++++++------------- dlls/wow64/syscall.c | 29 +++++++++++++++------- 3 files changed, 105 insertions(+), 25 deletions(-) diff --git a/dlls/ntdll/tests/exception.c b/dlls/ntdll/tests/exception.c index a1dade5bc28..c8647e7e9fa 100644 --- a/dlls/ntdll/tests/exception.c +++ b/dlls/ntdll/tests/exception.c @@ -2175,6 +2175,61 @@ static void test_KiUserApcDispatcher(void) VirtualProtect( pKiUserApcDispatcher, sizeof(saved_KiUserApcDispatcher), old_protect, &old_protect ); } +static void CDECL hook_KiUserCallbackDispatcher( void *eip, ULONG id, ULONG *args, ULONG len, + ULONG unk1, ULONG unk2, ULONG arg0, ULONG arg1 ) +{ + NTSTATUS (WINAPI *func)(void *, ULONG) = ((void **)NtCurrentTeb()->Peb->KernelCallbackTable)[id]; + + trace( "eip %p id %lx args %p (%x) len %lx unk1 %lx unk2 %lx args %lx,%lx\n", + eip, id, args, (char *)args - (char *)&eip, len, unk1, unk2, arg0, arg1 ); + + if (args[0] != arg0) /* new style with extra esp */ + { + void *esp = (void *)arg0; + + ok( args[0] == arg1, "wrong arg1 %lx / %lx\n", args[0], arg1 ); + ok( (char *)esp - ((char *)args + len) < 0x10, "wrong esp offset %p / %p\n", esp, args ); + } + + if (eip && pRtlPcToFileHeader) + { + void *mod, *win32u = GetModuleHandleA("win32u.dll"); + + pRtlPcToFileHeader( eip, &mod ); + if (win32u) ok( mod == win32u, "ret address %p not in win32u %p\n", eip, win32u ); + else trace( "ret address %p in %p\n", eip, mod ); + } + NtCallbackReturn( NULL, 0, func( args, len )); +} + +static void test_KiUserCallbackDispatcher(void) +{ + BYTE saved_code[7], patched_code[7]; + DWORD old_protect; + BYTE *ptr; + BOOL ret; + + ret = VirtualProtect( pKiUserCallbackDispatcher, sizeof(saved_code), + PAGE_EXECUTE_READWRITE, &old_protect ); + ok( ret, "Got unexpected ret %#x, GetLastError() %lu.\n", ret, GetLastError() ); + + memcpy( saved_code, pKiUserCallbackDispatcher, sizeof(saved_code) ); + ptr = patched_code; + /* mov $hook_trampoline, %eax */ + *ptr++ = 0xb8; + *(void **)ptr = hook_KiUserCallbackDispatcher; + ptr += sizeof(void *); + /* call *eax */ + *ptr++ = 0xff; + *ptr++ = 0xd0; + memcpy( pKiUserCallbackDispatcher, patched_code, sizeof(patched_code) ); + + DestroyWindow( CreateWindowA( "Static", "test", 0, 0, 0, 0, 0, 0, 0, 0, 0 )); + + memcpy( pKiUserCallbackDispatcher, saved_code, sizeof(saved_code)); + VirtualProtect( pKiUserCallbackDispatcher, sizeof(saved_code), old_protect, &old_protect ); +} + #elif defined(__x86_64__) #define UNW_FLAG_NHANDLER 0 @@ -12121,6 +12176,7 @@ START_TEST(exception) test_prot_fault(); test_KiUserExceptionDispatcher(); test_KiUserApcDispatcher(); + test_KiUserCallbackDispatcher(); test_extended_context(); test_copy_context(); test_set_live_context(); diff --git a/dlls/ntdll/unix/signal_i386.c b/dlls/ntdll/unix/signal_i386.c index ebb529116a3..751b0081534 100644 --- a/dlls/ntdll/unix/signal_i386.c +++ b/dlls/ntdll/unix/signal_i386.c @@ -465,6 +465,19 @@ struct apc_stack_layout C_ASSERT( offsetof(struct apc_stack_layout, context) == 0x14 ); C_ASSERT( sizeof(struct apc_stack_layout) == 0x308 ); +/* stack layout when calling KiUserCallbackDispatcher */ +struct callback_stack_layout +{ + ULONG eip; /* 000 */ + ULONG id; /* 004 */ + void *args; /* 008 */ + ULONG len; /* 00c */ + ULONG unk[2]; /* 010 */ + ULONG esp; /* 018 */ + BYTE args_data[0]; /* 01c */ +}; +C_ASSERT( sizeof(struct callback_stack_layout) == 0x1c ); + struct syscall_frame { WORD syscall_flags; /* 000 */ @@ -1595,8 +1608,8 @@ NTSTATUS call_user_exception_dispatcher( EXCEPTION_RECORD *rec, CONTEXT *context /*********************************************************************** * call_user_mode_callback */ -extern NTSTATUS call_user_mode_callback( ULONG id, void *args, ULONG len, void **ret_ptr, - ULONG *ret_len, void *func, TEB *teb ); +extern NTSTATUS call_user_mode_callback( ULONG user_esp, void **ret_ptr, ULONG *ret_len, + void *func, TEB *teb ); __ASM_GLOBAL_FUNC( call_user_mode_callback, "pushl %ebp\n\t" __ASM_CFI(".cfi_adjust_cfa_offset 4\n\t") @@ -1609,7 +1622,7 @@ __ASM_GLOBAL_FUNC( call_user_mode_callback, __ASM_CFI(".cfi_rel_offset %esi,-8\n\t") "pushl %edi\n\t" __ASM_CFI(".cfi_rel_offset %edi,-12\n\t") - "movl 0x20(%ebp),%edx\n\t" /* teb */ + "movl 0x18(%ebp),%edx\n\t" /* teb */ "pushl 0(%edx)\n\t" /* teb->Tib.ExceptionList */ "subl $0x380,%esp\n\t" /* sizeof(struct syscall_frame) */ "andl $~63,%esp\n\t" @@ -1620,14 +1633,9 @@ __ASM_GLOBAL_FUNC( call_user_mode_callback, "movl %eax,(%esp)\n\t" "movl %ecx,0x3c(%esp)\n\t" /* frame->prev_frame */ "movl %esp,0x1f8(%edx)\n\t" /* x86_thread_data()->syscall_frame */ - "movl 0x1c(%ebp),%ecx\n\t" /* func */ - "movl 0x0c(%ebp),%edx\n\t" /* args */ + "movl 0x14(%ebp),%ecx\n\t" /* func */ /* switch to user stack */ - "leal -4(%edx),%esp\n\t" - "pushl 0x10(%ebp)\n\t" /* len */ - "pushl %edx\n\t" /* args */ - "pushl 0x08(%ebp)\n\t" /* id */ - "pushl $0\n\t" + "movl 8(%ebp),%esp\n\t" "xorl %ebp,%ebp\n\t" "jmpl *%ecx" ) @@ -1654,9 +1662,9 @@ __ASM_GLOBAL_FUNC( user_mode_callback_return, "movl 8(%esp),%edi\n\t" /* ret_len */ "movl 12(%esp),%eax\n\t" /* status */ "leal -16(%ebp),%esp\n\t" - "movl 0x14(%ebp),%ecx\n\t" /* ret_ptr */ + "movl 0x0c(%ebp),%ecx\n\t" /* ret_ptr */ "movl %esi,(%ecx)\n\t" - "movl 0x18(%ebp),%ecx\n\t" /* ret_len */ + "movl 0x10(%ebp),%ecx\n\t" /* ret_len */ "movl %edi,(%ecx)\n\t" "popl 0(%edx)\n\t" /* teb->Tib.ExceptionList */ "popl %edi\n\t" @@ -1698,14 +1706,19 @@ __ASM_GLOBAL_FUNC( user_mode_abort_thread, NTSTATUS KeUserModeCallback( ULONG id, const void *args, ULONG len, void **ret_ptr, ULONG *ret_len ) { struct syscall_frame *frame = x86_thread_data()->syscall_frame; - void *args_data = (void *)((frame->esp - len) & ~15); + ULONG esp = (frame->esp - offsetof(struct callback_stack_layout, args_data[len])) & ~3; + struct callback_stack_layout *stack = (struct callback_stack_layout *)esp; if ((char *)ntdll_get_thread_data()->kernel_stack + min_kernel_stack > (char *)&frame) return STATUS_STACK_OVERFLOW; - memcpy( args_data, args, len ); - return call_user_mode_callback( id, args_data, len, ret_ptr, ret_len, - pKiUserCallbackDispatcher, NtCurrentTeb() ); + stack->eip = frame->eip; + stack->id = id; + stack->args = stack->args_data; + stack->len = len; + stack->esp = frame->esp; + memcpy( stack->args_data, args, len ); + return call_user_mode_callback( esp, ret_ptr, ret_len, pKiUserCallbackDispatcher, NtCurrentTeb() ); } diff --git a/dlls/wow64/syscall.c b/dlls/wow64/syscall.c index 3c247d62e0b..2af7bf75de2 100644 --- a/dlls/wow64/syscall.c +++ b/dlls/wow64/syscall.c @@ -1095,20 +1095,31 @@ NTSTATUS WINAPI Wow64KiUserCallbackDispatcher( ULONG id, void *args, ULONG len, { case IMAGE_FILE_MACHINE_I386: { + /* stack layout when calling 32-bit KiUserCallbackDispatcher */ + struct callback_stack_layout32 + { + ULONG eip; /* 000 */ + ULONG id; /* 004 */ + ULONG args; /* 008 */ + ULONG len; /* 00c */ + ULONG unk[2]; /* 010 */ + ULONG esp; /* 018 */ + BYTE args_data[0]; /* 01c */ + } *stack; I386_CONTEXT orig_ctx, ctx = { CONTEXT_I386_FULL }; - void *args_data; - ULONG *stack; + + C_ASSERT( sizeof(struct callback_stack_layout32) == 0x1c ); pBTCpuGetContext( GetCurrentThread(), GetCurrentProcess(), NULL, &ctx ); orig_ctx = ctx; - stack = args_data = ULongToPtr( (ctx.Esp - len) & ~15 ); - memcpy( args_data, args, len ); - *(--stack) = 0; - *(--stack) = len; - *(--stack) = PtrToUlong( args_data ); - *(--stack) = id; - *(--stack) = 0xdeadbabe; + stack = ULongToPtr( (ctx.Esp - offsetof(struct callback_stack_layout32,args_data[len])) & ~15 ); + stack->eip = ctx.Eip; + stack->id = id; + stack->args = PtrToUlong( stack->args_data ); + stack->len = len; + stack->esp = ctx.Esp; + memcpy( stack->args_data, args, len ); ctx.Esp = PtrToUlong( stack ); ctx.Eip = pLdrSystemDllInitBlock->pKiUserCallbackDispatcher;

1 0

Alexandre Julliard : ntdll: Fix stack layout for KiUserApcDispatcher on i386.
by Alexandre Julliard Dec. 1, 2023

Dec. 1, 2023

Module: wine Branch: master Commit: 3774b00f313be019f2525f23a0b668b53e82f30b URL: https://gitlab.winehq.org/wine/wine/-/commit/3774b00f313be019f2525f23a0b668… Author: Alexandre Julliard <julliard(a)winehq.org> Date: Thu Nov 30 17:40:57 2023 +0100 ntdll: Fix stack layout for KiUserApcDispatcher on i386. --- dlls/ntdll/signal_i386.c | 14 +++--- dlls/ntdll/tests/exception.c | 106 ++++++++++++++++++++++++++++++++++++++++++ dlls/ntdll/unix/signal_i386.c | 39 +++++++++------- dlls/wow64/syscall.c | 43 +++++++++++------ 4 files changed, 164 insertions(+), 38 deletions(-)

1 0

Alexandre Julliard : ntdll/tests: Remove some noisy traces.
by Alexandre Julliard Dec. 1, 2023

Dec. 1, 2023

Module: wine Branch: master Commit: effdb707b0587cba3dafb9ffb6be4927c322123b URL: https://gitlab.winehq.org/wine/wine/-/commit/effdb707b0587cba3dafb9ffb6be49… Author: Alexandre Julliard <julliard(a)winehq.org> Date: Fri Dec 1 09:55:02 2023 +0100 ntdll/tests: Remove some noisy traces. --- dlls/ntdll/tests/exception.c | 101 ++++++++++--------------------------------- 1 file changed, 22 insertions(+), 79 deletions(-)

1 0

Alexandre Julliard : ntdll: Fix stack layout for KiUserExceptionDispatcher on i386.
by Alexandre Julliard Dec. 1, 2023

Dec. 1, 2023

Module: wine Branch: master Commit: 58a00854c3c22708a0dda9ea9a9b167247b81bce URL: https://gitlab.winehq.org/wine/wine/-/commit/58a00854c3c22708a0dda9ea9a9b16… Author: Alexandre Julliard <julliard(a)winehq.org> Date: Thu Nov 30 17:39:08 2023 +0100 ntdll: Fix stack layout for KiUserExceptionDispatcher on i386. --- dlls/ntdll/tests/exception.c | 21 +++++++---- dlls/ntdll/unix/signal_i386.c | 82 ++++++++++++++++++++++++++----------------- dlls/wow64/struct32.h | 7 ++++ dlls/wow64/syscall.c | 38 +++++++++++--------- 4 files changed, 91 insertions(+), 57 deletions(-)

1 0

Alexandre Julliard : ntdll: Skip NtRaiseException() call on ARM64 when debugger is not present.
by Alexandre Julliard Dec. 1, 2023

Dec. 1, 2023

Module: wine Branch: master Commit: b5cd47f54156814437783ca0b89977849e0ab037 URL: https://gitlab.winehq.org/wine/wine/-/commit/b5cd47f54156814437783ca0b89977… Author: Alexandre Julliard <julliard(a)winehq.org> Date: Thu Nov 30 17:20:31 2023 +0100 ntdll: Skip NtRaiseException() call on ARM64 when debugger is not present. --- dlls/ntdll/signal_arm64.c | 6 +++++- dlls/ntdll/tests/exception.c | 1 - 2 files changed, 5 insertions(+), 2 deletions(-) diff --git a/dlls/ntdll/signal_arm64.c b/dlls/ntdll/signal_arm64.c index 08fde6ccf1e..0083f78412c 100644 --- a/dlls/ntdll/signal_arm64.c +++ b/dlls/ntdll/signal_arm64.c @@ -1550,7 +1550,11 @@ __ASM_GLOBAL_FUNC( RtlRaiseException, "stp x4, x5, [x1, #0xf0]\n\t" /* context->Fp, Lr */ "str x5, [x1, #0x108]\n\t" /* context->Pc */ "str x5, [x0, #0x10]\n\t" /* rec->ExceptionAddress */ - "mov x2, #1\n\t" + "ldr x3, [x18, #0x60]\n\t" /* peb */ + "ldrb w2, [x3, #2]\n\t" /* peb->BeingDebugged */ + "cbnz w2, 1f\n\t" + "bl " __ASM_NAME("dispatch_exception") "\n" + "1:\tmov x2, #1\n\t" "bl " __ASM_NAME("NtRaiseException") "\n\t" "bl " __ASM_NAME("RtlRaiseStatus") /* does not return */ ); diff --git a/dlls/ntdll/tests/exception.c b/dlls/ntdll/tests/exception.c index 792695869e2..3057ceb3f20 100644 --- a/dlls/ntdll/tests/exception.c +++ b/dlls/ntdll/tests/exception.c @@ -8646,7 +8646,6 @@ static void test_KiUserExceptionDispatcher(void) pRtlRaiseException(&record); ok(got_exception, "Handler was not called.\n"); - todo_wine ok(!hook_called, "Hook was called.\n"); memcpy( pKiUserExceptionDispatcher, patched_code, sizeof(patched_code) );

1 0

Alexandre Julliard : ntdll: Fix stack layout and unwind information for KiUserExceptionDispatcher on ARM64.
by Alexandre Julliard Dec. 1, 2023

Dec. 1, 2023

Module: wine Branch: master Commit: 9bbdf6c7b5fbe50c8f145aaaf2db889eb0baefa9 URL: https://gitlab.winehq.org/wine/wine/-/commit/9bbdf6c7b5fbe50c8f145aaaf2db88… Author: Alexandre Julliard <julliard(a)winehq.org> Date: Thu Nov 30 17:10:17 2023 +0100 ntdll: Fix stack layout and unwind information for KiUserExceptionDispatcher on ARM64. --- dlls/ntdll/signal_arm64.c | 25 +++++++--- dlls/ntdll/tests/exception.c | 101 ++++++++++++++++++++++++++++++++++++++ dlls/ntdll/unix/signal_arm64.c | 109 ++++++++--------------------------------- 3 files changed, 141 insertions(+), 94 deletions(-)

1 0

Alexandre Julliard : ntdll: Fix stack layout and unwind information for KiUserCallbackDispatcher on ARM64.
by Alexandre Julliard Dec. 1, 2023

Dec. 1, 2023

Module: wine Branch: master Commit: d6bd264460a3f211cce2d9396b039700ddc4064d URL: https://gitlab.winehq.org/wine/wine/-/commit/d6bd264460a3f211cce2d9396b0397… Author: Alexandre Julliard <julliard(a)winehq.org> Date: Thu Nov 30 17:18:13 2023 +0100 ntdll: Fix stack layout and unwind information for KiUserCallbackDispatcher on ARM64. --- dlls/ntdll/signal_arm64.c | 13 +++++++++- dlls/ntdll/tests/exception.c | 55 ++++++++++++++++++++++++++++++++++++++++ dlls/ntdll/unix/signal_arm64.c | 57 +++++++++++++++++++++++++++++------------- 3 files changed, 106 insertions(+), 19 deletions(-) diff --git a/dlls/ntdll/signal_arm64.c b/dlls/ntdll/signal_arm64.c index 34624f4aa0c..08fde6ccf1e 100644 --- a/dlls/ntdll/signal_arm64.c +++ b/dlls/ntdll/signal_arm64.c @@ -605,7 +605,7 @@ __ASM_GLOBAL_FUNC( KiUserApcDispatcher, /******************************************************************* * KiUserCallbackDispatcher (NTDLL.@) */ -void WINAPI KiUserCallbackDispatcher( ULONG id, void *args, ULONG len ) +void WINAPI dispatch_callback( void *args, ULONG len, ULONG id ) { NTSTATUS status; @@ -623,6 +623,17 @@ void WINAPI KiUserCallbackDispatcher( ULONG id, void *args, ULONG len ) RtlRaiseStatus( status ); } +__ASM_GLOBAL_FUNC( KiUserCallbackDispatcher, + __ASM_SEH(".seh_pushframe\n\t") + "nop\n\t" + __ASM_SEH(".seh_stackalloc 0x20\n\t") + "nop\n\t" + __ASM_SEH(".seh_save_reg lr, 0x18\n\t") + __ASM_SEH(".seh_endprologue\n\t") + "ldr x0, [sp]\n\t" /* args */ + "ldp w1, w2, [sp, #0x08]\n\t" /* len, id */ + "bl " __ASM_NAME("dispatch_callback") "\n\t" + "brk #1" ) /*********************************************************************** diff --git a/dlls/ntdll/tests/exception.c b/dlls/ntdll/tests/exception.c index 69bfbf0771d..792695869e2 100644 --- a/dlls/ntdll/tests/exception.c +++ b/dlls/ntdll/tests/exception.c @@ -8750,6 +8750,60 @@ static void test_KiUserApcDispatcher(void) VirtualProtect( pKiUserApcDispatcher, sizeof(saved_code), old_protect, &old_protect ); } +static void WINAPI hook_KiUserCallbackDispatcher(void *sp) +{ + struct + { + void *args; + ULONG len; + ULONG id; + ULONG64 unknown; + ULONG64 lr; + ULONG64 sp; + ULONG64 pc; + BYTE args_data[0]; + } *stack = sp; + ULONG_PTR redzone = (BYTE *)stack->sp - &stack->args_data[stack->len]; + NTSTATUS (WINAPI *func)(void *, ULONG) = ((void **)NtCurrentTeb()->Peb->KernelCallbackTable)[stack->id]; + + trace( "stack=%p len=%lx id=%lx unk=%Ix lr=%Ix sp=%Ix pc=%Ix\n", + stack, stack->len, stack->id, stack->unknown, stack->lr, stack->sp, stack->pc ); + + ok( stack->args == stack->args_data, "wrong args %p / %p\n", stack->args, stack->args_data ); + ok( redzone >= 16 && redzone <= 32, "wrong sp %p / %p (%Iu)\n", + (void *)stack->sp, stack->args_data, redzone ); + + if (pRtlPcToFileHeader) + { + void *mod, *win32u = GetModuleHandleA("win32u.dll"); + + pRtlPcToFileHeader( (void *)stack->pc, &mod ); + ok( mod == win32u, "pc %Ix not in win32u %p\n", stack->pc, win32u ); + } + NtCallbackReturn( NULL, 0, func( stack->args, stack->len )); +} + + void test_KiUserCallbackDispatcher(void) +{ + DWORD old_protect; + BOOL ret; + + ret = VirtualProtect( pKiUserCallbackDispatcher, sizeof(saved_code), + PAGE_EXECUTE_READWRITE, &old_protect ); + ok( ret, "Got unexpected ret %#x, GetLastError() %lu.\n", ret, GetLastError() ); + + memcpy( saved_code, pKiUserCallbackDispatcher, sizeof(saved_code)); + *(void **)&patched_code[3] = hook_KiUserCallbackDispatcher; + memcpy( pKiUserCallbackDispatcher, patched_code, sizeof(patched_code)); + FlushInstructionCache(GetCurrentProcess(), pKiUserCallbackDispatcher, sizeof(patched_code)); + + DestroyWindow( CreateWindowA( "Static", "test", 0, 0, 0, 0, 0, 0, 0, 0, 0 )); + + memcpy( pKiUserCallbackDispatcher, saved_code, sizeof(saved_code)); + FlushInstructionCache(GetCurrentProcess(), pKiUserCallbackDispatcher, sizeof(saved_code)); + VirtualProtect( pKiUserCallbackDispatcher, sizeof(saved_code), old_protect, &old_protect ); +} + #endif /* __aarch64__ */ #if defined(__i386__) || defined(__x86_64__) @@ -12014,6 +12068,7 @@ START_TEST(exception) test_virtual_unwind(); test_KiUserExceptionDispatcher(); test_KiUserApcDispatcher(); + test_KiUserCallbackDispatcher(); #elif defined(__arm__) diff --git a/dlls/ntdll/unix/signal_arm64.c b/dlls/ntdll/unix/signal_arm64.c index 86bf3c9e349..f96ec330796 100644 --- a/dlls/ntdll/unix/signal_arm64.c +++ b/dlls/ntdll/unix/signal_arm64.c @@ -151,6 +151,21 @@ struct apc_stack_layout C_ASSERT( offsetof(struct apc_stack_layout, context) == 0x30 ); C_ASSERT( sizeof(struct apc_stack_layout) == 0x3d0 ); +/* stack layout when calling KiUserCallbackDispatcher */ +struct callback_stack_layout +{ + void *args; /* 000 arguments */ + ULONG len; /* 008 arguments len */ + ULONG id; /* 00c function id */ + ULONG64 unknown; /* 010 */ + ULONG64 lr; /* 018 */ + ULONG64 sp; /* 020 sp+pc (machine frame) */ + ULONG64 pc; /* 028 */ + BYTE args_data[0]; /* 030 copied argument data*/ +}; +C_ASSERT( offsetof(struct callback_stack_layout, sp) == 0x20 ); +C_ASSERT( sizeof(struct callback_stack_layout) == 0x30 ); + struct syscall_frame { ULONG64 x[29]; /* 000 */ @@ -1053,8 +1068,8 @@ NTSTATUS call_user_exception_dispatcher( EXCEPTION_RECORD *rec, CONTEXT *context /*********************************************************************** * call_user_mode_callback */ -extern NTSTATUS call_user_mode_callback( ULONG id, void *args, ULONG len, void **ret_ptr, - ULONG *ret_len, void *func, TEB *teb ); +extern NTSTATUS call_user_mode_callback( ULONG64 user_sp, void **ret_ptr, ULONG *ret_len, + void *func, TEB *teb ); __ASM_GLOBAL_FUNC( call_user_mode_callback, "stp x29, x30, [sp,#-0xc0]!\n\t" __ASM_CFI(".cfi_def_cfa_offset 0xc0\n\t") @@ -1081,22 +1096,22 @@ __ASM_GLOBAL_FUNC( call_user_mode_callback, "stp d10, d11, [x29, #0x70]\n\t" "stp d12, d13, [x29, #0x80]\n\t" "stp d14, d15, [x29, #0x90]\n\t" - "stp x3, x4, [x29, #0xa0]\n\t" /* ret_ptr, ret_len */ - "mov x18, x6\n\t" /* teb */ - "mrs x3, fpcr\n\t" - "mrs x4, fpsr\n\t" - "bfi x3, x4, #0, #32\n\t" - "ldr x4, [x18]\n\t" /* teb->Tib.ExceptionList */ - "stp x3, x4, [x29, #0xb0]\n\t" + "stp x1, x2, [x29, #0xa0]\n\t" /* ret_ptr, ret_len */ + "mov x18, x4\n\t" /* teb */ + "mrs x1, fpcr\n\t" + "mrs x2, fpsr\n\t" + "bfi x1, x2, #0, #32\n\t" + "ldr x2, [x18]\n\t" /* teb->Tib.ExceptionList */ + "stp x1, x2, [x29, #0xb0]\n\t" "ldr x7, [x18, #0x2f0]\n\t" /* arm64_thread_data()->syscall_frame */ - "sub x3, sp, #0x330\n\t" /* sizeof(struct syscall_frame) */ - "str x3, [x18, #0x2f0]\n\t" /* arm64_thread_data()->syscall_frame */ + "sub x1, sp, #0x330\n\t" /* sizeof(struct syscall_frame) */ + "str x1, [x18, #0x2f0]\n\t" /* arm64_thread_data()->syscall_frame */ "add x8, x29, #0xc0\n\t" - "stp x7, x8, [x3, #0x110]\n\t" /* frame->prev_frame,syscall_cfa */ + "stp x7, x8, [x1, #0x110]\n\t" /* frame->prev_frame,syscall_cfa */ /* switch to user stack */ - "mov sp, x1\n\t" /* stack */ - "br x5" ) + "mov sp, x0\n\t" /* user_sp */ + "br x3" ) /*********************************************************************** @@ -1186,14 +1201,20 @@ __ASM_GLOBAL_FUNC( user_mode_abort_thread, NTSTATUS KeUserModeCallback( ULONG id, const void *args, ULONG len, void **ret_ptr, ULONG *ret_len ) { struct syscall_frame *frame = arm64_thread_data()->syscall_frame; - void *args_data = (void *)((frame->sp - len) & ~15); + ULONG64 sp = (frame->sp - offsetof( struct callback_stack_layout, args_data[len] ) - 16) & ~15; + struct callback_stack_layout *stack = (struct callback_stack_layout *)sp; if ((char *)ntdll_get_thread_data()->kernel_stack + min_kernel_stack > (char *)&frame) return STATUS_STACK_OVERFLOW; - memcpy( args_data, args, len ); - return call_user_mode_callback( id, args_data, len, ret_ptr, ret_len, - pKiUserCallbackDispatcher, NtCurrentTeb() ); + stack->args = stack->args_data; + stack->len = len; + stack->id = id; + stack->lr = frame->lr; + stack->sp = frame->sp; + stack->pc = frame->pc; + memcpy( stack->args_data, args, len ); + return call_user_mode_callback( sp, ret_ptr, ret_len, pKiUserCallbackDispatcher, NtCurrentTeb() ); }

1 0

Alexandre Julliard : ntdll: Fix stack layout and unwind information for KiUserApcDispatcher on ARM64.
by Alexandre Julliard Dec. 1, 2023

Dec. 1, 2023

Module: wine Branch: master Commit: 060a8b4af236b69d131ac49e8f32b9dea073ed9e URL: https://gitlab.winehq.org/wine/wine/-/commit/060a8b4af236b69d131ac49e8f32b9… Author: Alexandre Julliard <julliard(a)winehq.org> Date: Thu Nov 30 17:15:07 2023 +0100 ntdll: Fix stack layout and unwind information for KiUserApcDispatcher on ARM64. --- dlls/ntdll/signal_arm64.c | 20 ++++++---- dlls/ntdll/tests/exception.c | 85 ++++++++++++++++++++++++++++++++++++++++++ dlls/ntdll/unix/signal_arm64.c | 31 ++++++++++----- 3 files changed, 120 insertions(+), 16 deletions(-) diff --git a/dlls/ntdll/signal_arm64.c b/dlls/ntdll/signal_arm64.c index 985ee28a540..34624f4aa0c 100644 --- a/dlls/ntdll/signal_arm64.c +++ b/dlls/ntdll/signal_arm64.c @@ -587,13 +587,19 @@ __ASM_GLOBAL_FUNC( KiUserExceptionDispatcher, /******************************************************************* * KiUserApcDispatcher (NTDLL.@) */ -void WINAPI KiUserApcDispatcher( CONTEXT *context, ULONG_PTR arg1, ULONG_PTR arg2, ULONG_PTR arg3, - PNTAPCFUNC apc ) -{ - void (CALLBACK *func)(ULONG_PTR,ULONG_PTR,ULONG_PTR,CONTEXT*) = (void *)apc; - func( arg1, arg2, arg3, context ); - NtContinue( context, TRUE ); -} +__ASM_GLOBAL_FUNC( KiUserApcDispatcher, + __ASM_SEH(".seh_context\n\t") + "nop\n\t" + __ASM_SEH(".seh_stackalloc 0x30\n\t") + __ASM_SEH(".seh_endprologue\n\t") + "ldp x16, x0, [sp]\n\t" /* func, arg1 */ + "ldp x1, x2, [sp, #0x10]\n\t" /* arg2, arg3 */ + "add x3, sp, #0x30\n\t" /* context (FIXME) */ + "blr x16\n\t" + "add x0, sp, #0x30\n\t" /* context */ + "ldr w1, [sp, #0x20]\n\t" /* alertable */ + "bl " __ASM_NAME("NtContinue") "\n\t" + "brk #1" ) /******************************************************************* diff --git a/dlls/ntdll/tests/exception.c b/dlls/ntdll/tests/exception.c index 7a8090868b8..69bfbf0771d 100644 --- a/dlls/ntdll/tests/exception.c +++ b/dlls/ntdll/tests/exception.c @@ -8666,6 +8666,90 @@ static void test_KiUserExceptionDispatcher(void) VirtualProtect(pKiUserExceptionDispatcher, sizeof(saved_code), old_protect, &old_protect); } + +static UINT apc_count; + +static void CALLBACK apc_func( ULONG_PTR arg1, ULONG_PTR arg2, ULONG_PTR arg3 ) +{ + ok( arg1 == 0x1234 + apc_count, "wrong arg1 %Ix\n", arg1 ); + ok( arg2 == 0x5678, "wrong arg2 %Ix\n", arg2 ); + ok( arg3 == 0xdeadbeef, "wrong arg3 %Ix\n", arg3 ); + apc_count++; +} + +static void * WINAPI hook_KiUserApcDispatcher(void *stack) +{ + struct + { + void *func; + ULONG64 args[3]; + ULONG64 alertable; + ULONG64 align; + CONTEXT context; + } *args = stack; + + trace( "stack=%p func=%p args=%Ix,%Ix,%Ix alertable=%Ix context=%p pc=%Ix sp=%Ix (%Ix)\n", + args, args->func, args->args[0], args->args[1], args->args[2], + args->alertable, &args->context, args->context.Pc, args->context.Sp, + args->context.Sp - (ULONG_PTR)stack ); + + ok( args->func == apc_func, "wrong func %p / %p\n", args->func, apc_func ); + ok( args->args[0] == 0x1234 + apc_count, "wrong arg1 %Ix\n", args->args[0] ); + ok( args->args[1] == 0x5678, "wrong arg2 %Ix\n", args->args[1] ); + ok( args->args[2] == 0xdeadbeef, "wrong arg3 %Ix\n", args->args[2] ); + + if (apc_count) args->alertable = FALSE; + pNtQueueApcThread( GetCurrentThread(), apc_func, 0x1234 + apc_count + 1, 0x5678, 0xdeadbeef ); + + hook_called = TRUE; + memcpy( pKiUserApcDispatcher, saved_code, sizeof(saved_code)); + FlushInstructionCache( GetCurrentProcess(), pKiUserApcDispatcher, sizeof(saved_code)); + return pKiUserApcDispatcher; +} + +static void test_KiUserApcDispatcher(void) +{ + ULONG hook_trampoline[] = + { + 0x910003e0, /* mov x0, sp */ + 0x5800006f, /* ldr x15, 1f */ + 0xd63f01e0, /* blr x15 */ + 0xd61f0000, /* br x0 */ + 0, 0, /* 1: hook_KiUserApcDispatcher */ + }; + DWORD old_protect; + BOOL ret; + + *(void **)&hook_trampoline[4] = hook_KiUserApcDispatcher; + memcpy(code_mem, hook_trampoline, sizeof(hook_trampoline)); + + ret = VirtualProtect( pKiUserApcDispatcher, sizeof(saved_code), + PAGE_EXECUTE_READWRITE, &old_protect ); + ok( ret, "Got unexpected ret %#x, GetLastError() %lu.\n", ret, GetLastError() ); + + memcpy( saved_code, pKiUserApcDispatcher, sizeof(saved_code) ); + *(void **)&patched_code[3] = code_mem; + memcpy( pKiUserApcDispatcher, patched_code, sizeof(patched_code) ); + FlushInstructionCache( GetCurrentProcess(), pKiUserApcDispatcher, sizeof(patched_code)); + + hook_called = FALSE; + apc_count = 0; + pNtQueueApcThread( GetCurrentThread(), apc_func, 0x1234, 0x5678, 0xdeadbeef ); + SleepEx( 0, TRUE ); + ok( apc_count == 2, "APC count %u\n", apc_count ); + ok( hook_called, "hook was not called\n" ); + + memcpy( pKiUserApcDispatcher, patched_code, sizeof(patched_code) ); + FlushInstructionCache( GetCurrentProcess(), pKiUserApcDispatcher, sizeof(patched_code)); + pNtQueueApcThread( GetCurrentThread(), apc_func, 0x1234 + apc_count, 0x5678, 0xdeadbeef ); + SleepEx( 0, TRUE ); + ok( apc_count == 3, "APC count %u\n", apc_count ); + SleepEx( 0, TRUE ); + ok( apc_count == 4, "APC count %u\n", apc_count ); + + VirtualProtect( pKiUserApcDispatcher, sizeof(saved_code), old_protect, &old_protect ); +} + #endif /* __aarch64__ */ #if defined(__i386__) || defined(__x86_64__) @@ -11929,6 +12013,7 @@ START_TEST(exception) test_continue(); test_virtual_unwind(); test_KiUserExceptionDispatcher(); + test_KiUserApcDispatcher(); #elif defined(__arm__) diff --git a/dlls/ntdll/unix/signal_arm64.c b/dlls/ntdll/unix/signal_arm64.c index ab38d83477f..86bf3c9e349 100644 --- a/dlls/ntdll/unix/signal_arm64.c +++ b/dlls/ntdll/unix/signal_arm64.c @@ -138,6 +138,19 @@ struct exc_stack_layout C_ASSERT( offsetof(struct exc_stack_layout, rec) == 0x390 ); C_ASSERT( sizeof(struct exc_stack_layout) == 0x440 ); +/* stack layout when calling KiUserApcDispatcher */ +struct apc_stack_layout +{ + void *func; /* 000 APC to call*/ + ULONG64 args[3]; /* 008 function arguments */ + ULONG64 alertable; /* 020 */ + ULONG64 align; /* 028 */ + CONTEXT context; /* 030 */ + ULONG64 redzone[2]; /* 3c0 */ +}; +C_ASSERT( offsetof(struct apc_stack_layout, context) == 0x30 ); +C_ASSERT( sizeof(struct apc_stack_layout) == 0x3d0 ); + struct syscall_frame { ULONG64 x[29]; /* 000 */ @@ -979,7 +992,7 @@ NTSTATUS call_user_apc_dispatcher( CONTEXT *context, ULONG_PTR arg1, ULONG_PTR a { struct syscall_frame *frame = arm64_thread_data()->syscall_frame; ULONG64 sp = context ? context->Sp : frame->sp; - struct apc_stack_layout { CONTEXT context; } *stack; + struct apc_stack_layout *stack; sp &= ~15; stack = (struct apc_stack_layout *)sp - 1; @@ -994,14 +1007,14 @@ NTSTATUS call_user_apc_dispatcher( CONTEXT *context, ULONG_PTR arg1, ULONG_PTR a NtGetContextThread( GetCurrentThread(), &stack->context ); stack->context.X0 = status; } - frame->sp = (ULONG64)stack; - frame->pc = (ULONG64)pKiUserApcDispatcher; - frame->x[0] = (ULONG64)&stack->context; - frame->x[1] = arg1; - frame->x[2] = arg2; - frame->x[3] = arg3; - frame->x[4] = (ULONG64)func; - frame->restore_flags |= CONTEXT_CONTROL | CONTEXT_INTEGER; + stack->func = func; + stack->args[0] = arg1; + stack->args[1] = arg2; + stack->args[2] = arg3; + + frame->sp = (ULONG64)stack; + frame->pc = (ULONG64)pKiUserApcDispatcher; + frame->restore_flags |= CONTEXT_CONTROL; syscall_frame_fixup_for_fastpath( frame ); return status; }

1 0