; ke_syscall.asm - INT 0x40 kernel entry (MASM64) ; ; On entry the CPU has pushed (ring-3 -> ring-0 transition): ; SS, RSP, RFLAGS, CS, RIP (on the kernel stack via TSS.RSP0) ; RAX = syscall number ; RCX, RDX, R8, R9 = args 0-3 (MS x64) ; R10, R11 = args 4-5 (our extension) EXTERN KeSyscallDispatch:PROC .CODE KeSyscallEntry PROC sub rsp, 8 ; 16-byte align the stack frame ; We need to allocate 32 bytes for shadow space, plus 24 bytes for ; the 3 stack arguments (a3, a4, a5), plus 8 bytes of padding to keep ; the stack 16-byte aligned. Total = 64. sub rsp, 64 ; Place the 5th, 6th, and 7th arguments onto the stack for KeSyscallDispatch mov [rsp + 32], r9 ; a3 mov [rsp + 40], r10 ; a4 mov [rsp + 48], r11 ; a5 ; Shift the first 4 registers down one slot mov r9, r8 ; a2 mov r8, rdx ; a1 mov rdx, rcx ; a0 mov rcx, rax ; nr (syscall number) ; Call the C dispatcher call KeSyscallDispatch add rsp, 72 ; Clean up (64 + 8) iretq KeSyscallEntry ENDP ; --------------------------------------------------------------------------- ; Fault stubs - print a message and halt. A real kernel would do a bugcheck. ; --------------------------------------------------------------------------- EXTERN KePanic:PROC FaultMsg DB "KERNEL FAULT: vector %d at RIP %016llx", 0Ah, 0 KeFaultDE PROC sub rsp, 28h lea rcx, FaultMsg mov rdx, 0 pop r8 ; RIP from the fault frame call KePanic KeFaultDE ENDP KeFaultGP PROC sub rsp, 28h lea rcx, FaultMsg mov rdx, 13 pop rax ; error code pop r8 ; RIP call KePanic KeFaultGP ENDP KeFaultPF PROC sub rsp, 28h lea rcx, FaultMsg mov rdx, 14 pop rax ; error code pop r8 ; RIP call KePanic KeFaultPF ENDP EXTERN KeIrqDispatch:PROC IrqStub MACRO num PUBLIC KeIrqStub&num KeIrqStub&num PROC push rax mov al, num jmp KeIrqCommon KeIrqStub&num ENDP ENDM IrqStub 0 IrqStub 1 IrqStub 2 IrqStub 3 IrqStub 4 IrqStub 5 IrqStub 6 IrqStub 7 IrqStub 8 IrqStub 9 IrqStub 10 IrqStub 11 IrqStub 12 IrqStub 13 IrqStub 14 IrqStub 15 IrqStub 16 IrqStub 17 IrqStub 18 IrqStub 19 IrqStub 20 IrqStub 21 IrqStub 22 IrqStub 23 KeIrqCommon PROC ; al = irq number, rax saved on stack ; Build a minimal calling-convention-safe frame push rcx push rdx push r8 push r9 push r10 push r11 movzx ecx, al ; first arg = irq number (rcx, Win64 ABI) sub rsp, 32 ; shadow space call KeIrqDispatch add rsp, 32 pop r11 pop r10 pop r9 pop r8 pop rdx pop rcx pop rax iretq KeIrqCommon ENDP END