i think it works

code/kernel/ke_syscall.asm

@@ -0,0 +1,140 @@
+; ke_syscall.asm - INT 0x2E kernel entry (MASM64)
+;
+; On entry the CPU has pushed (ring-3 -> ring-0 transition):
+;   SS, RSP, RFLAGS, CS, RIP    (on the kernel stack via TSS.RSP0)
+; RAX = syscall number
+; RCX, RDX, R8, R9              = args 0-3  (MS x64)
+; R10, R11                      = args 4-5  (our extension)
+
+EXTERN KeSyscallDispatch:PROC
+
+.CODE
+
+KeSyscallEntry PROC
+    sub     rsp, 8              ; 16-byte align the stack frame
+
+    ; We need to allocate 32 bytes for shadow space, plus 24 bytes for 
+    ; the 3 stack arguments (a3, a4, a5), plus 8 bytes of padding to keep 
+    ; the stack 16-byte aligned. Total = 64.
+    sub     rsp, 64
+
+    ; Place the 5th, 6th, and 7th arguments onto the stack for KeSyscallDispatch
+    mov     [rsp + 32], r9      ; a3
+    mov     [rsp + 40], r10     ; a4
+    mov     [rsp + 48], r11     ; a5
+
+    ; Shift the first 4 registers down one slot
+    mov     r9, r8              ; a2
+    mov     r8, rdx             ; a1
+    mov     rdx, rcx            ; a0
+    mov     rcx, rax            ; nr (syscall number)
+
+    ; Call the C dispatcher
+    call    KeSyscallDispatch
+
+    add     rsp, 72             ; Clean up (64 + 8)
+    iretq
+KeSyscallEntry ENDP
+
+; ---------------------------------------------------------------------------
+; Fault stubs - print a message and halt.  A real kernel would do a bugcheck.
+; ---------------------------------------------------------------------------
+EXTERN DbgPrint:PROC
+
+FaultMsg DB "KERNEL FAULT: vector %d at RIP %016llx", 0Ah, 0
+
+KeFaultDE PROC
+    sub  rsp, 28h
+    lea  rcx, FaultMsg
+    mov  rdx, 0
+    pop  r8                     ; RIP from the fault frame
+    call DbgPrint
+    add  rsp, 28h
+@@: hlt
+    jmp @B
+KeFaultDE ENDP
+
+KeFaultGP PROC
+    sub  rsp, 28h
+    lea  rcx, FaultMsg
+    mov  rdx, 13
+    pop  rax                    ; error code
+    pop  r8                     ; RIP
+    call DbgPrint
+    add  rsp, 28h
+@@: hlt
+    jmp @B
+KeFaultGP ENDP
+
+KeFaultPF PROC
+    sub  rsp, 28h
+    lea  rcx, FaultMsg
+    mov  rdx, 14
+    pop  rax                    ; error code
+    pop  r8                     ; RIP
+    call DbgPrint
+    add  rsp, 28h
+@@: hlt
+    jmp @B
+KeFaultPF ENDP
+
+EXTERN KeIrqDispatch:PROC
+
+IrqStub MACRO num
+PUBLIC KeIrqStub&num
+KeIrqStub&num PROC
+    push    rax
+    mov     al, num
+    jmp     KeIrqCommon
+KeIrqStub&num ENDP
+ENDM
+
+IrqStub 0
+IrqStub 1
+IrqStub 2
+IrqStub 3
+IrqStub 4
+IrqStub 5
+IrqStub 6
+IrqStub 7
+IrqStub 8
+IrqStub 9
+IrqStub 10
+IrqStub 11
+IrqStub 12
+IrqStub 13
+IrqStub 14
+IrqStub 15
+IrqStub 16
+IrqStub 17
+IrqStub 18
+IrqStub 19
+IrqStub 20
+IrqStub 21
+IrqStub 22
+IrqStub 23
+
+KeIrqCommon PROC
+    ; al = irq number, rax saved on stack
+    ; Build a minimal calling-convention-safe frame
+    push    rcx
+    push    rdx
+    push    r8
+    push    r9
+    push    r10
+    push    r11
+    movzx   ecx, al         ; first arg = irq number (rcx, Win64 ABI)
+    sub     rsp, 32         ; shadow space
+    call    KeIrqDispatch
+    add     rsp, 32
+    pop     r11
+    pop     r10
+    pop     r9
+    pop     r8
+    pop     rdx
+    pop     rcx
+    pop     rax
+    iretq
+KeIrqCommon ENDP
+
+END