|
|
|---|---|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
“陷阱栈”是我自己编造的词，刚才看了一下WRK的文件，人家说那叫DPC堆栈，代码是这样写的（引用自WRK-v1.2\base\ntos\ke\i386\trap.asm）：
...
align 16
PUBLIC _KiFastCallEntry
_KiFastCallEntry proc
;
; Sanitize the segment registers
;
mov ecx, KGDT_R3_DATA OR RPL_MASK
push KGDT_R0_PCR
pop fs
mov ds, ecx
mov es, ecx
[COLOR="Red"];
; When we trap into the kernel via fast system call we start on the DPC stack. We need
; shift to the threads stack before enabling interrupts.
;[/COLOR]
mov ecx, PCR[PcTss] ;
mov esp, [ecx]+TssEsp0
push KGDT_R3_DATA OR RPL_MASK ; Push user SS
push edx ; Push ESP
pushfd
...从这段代码来看，NT内核确实是使用TSS来存放当前线程的内核栈地址的。经过查看ContextSwitch函数，证实了这一点，内核在线程切换时将新线程的内核栈地址写入TSS中的RING0栈指针相关域的。代码如下（WRK-v1.2\base\ntos\ke\i386\ctxswap.asm）：
...
[COLOR="Red"];
; Adjust the initial stack address, if necessary, and store in the TSS so V86
; mode threads and 32 bit threads can share a common trapframe structure and
; the NPX save area will be accessible in the same manner on all threads.
;[/COLOR]
mov eax, [esi].ThInitialStack ; get initial stack address
sub eax, NPX_FRAME_LENGTH
.errnz (EFLAGS_V86_MASK AND 0FF00FFFFh)
test byte ptr [eax] - KTRAP_FRAME_LENGTH + TsEFlags + 2, EFLAGS_V86_MASK / 10000h
jnz short sc24 ; if nz, V86 frame, no adjustment
sub eax, TsV86Gs - TsHardwareSegSs ; bias for missing fields
sc24: mov ecx, [ebx]+PcTssCopy ; get TSS address
mov [ecx]+TssEsp0, eax ; set initial kernel stack address
...没仔细看WRK的LICENSE，这样引用WRK中的代码片段，应该没什么吧。 
|
|
|
看了一下LICENSE，找到依据了，呵呵。
 You may distribute snippets of this software in research papers, books or |
|
|
|
