mirrors/Astral
1
0
Fork 0
mirror of https://github.com/Mathewnd/Astral.git synced 2026-11-01 23:18:21 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #40 from primeseven1/rewrite

Browse Source 
Fix sysret with a non-canonical return RIP
This commit is contained in:
Matheus
2026-09-22 17:51:42 -03:00
committed by GitHub
parent 0a21f7c852 a6fd10c211
commit c337f763ae
1 changed files with 44 additions and 26 deletions
Download Patch File Download Diff File Expand all files Collapse all files
kernel-src/arch/x86-64/syscall.asm
+44 -26
View File
@@ -217,6 +217,32 @@ dq syscall_eventfd
syscallcount equ 107 syscallcount equ 107
section .text section .text
global arch_syscall_entry global arch_syscall_entry
%macro restore_context 0
add rsp, 32 ; r9 argument, cr2, gs, and fs are not popped.
pop rbx
mov es,rbx
pop rbx
mov ds,rbx
pop rax
pop rbx
pop rcx
pop rdx
pop r8
pop r9
pop r10
pop r11
pop r12
pop r13
pop r14
pop r15
pop rdi
pop rsi
add rsp, 8 ; remove irq
pop rbp
add rsp, 8 ; remove error code
%endmacro
; on entry: ; on entry:
; rcx has the return address ; rcx has the return address
; r11 has the old rflags ; r11 has the old rflags
@@ -292,7 +318,7 @@ arch_syscall_entry:
sti sti
mov rdi, rax mov rdi, rax
extern arch_syscall_log extern arch_syscall_log
call arch_syscall_log ; compiled with __attribute__((no_caller_saved_registers)) call arch_syscall_log ; compiled with __attribute__((no_caller_saved_registers))
; prepare context argument ; prepare context argument
mov rdi, rsp mov rdi, rsp
@@ -317,7 +343,7 @@ arch_syscall_entry:
mov rdi, rax mov rdi, rax
mov rsi, rdx mov rsi, rdx
extern arch_syscall_log_return extern arch_syscall_log_return
call arch_syscall_log_return ; compiled with __attribute__((no_caller_saved_registers)) call arch_syscall_log_return ; compiled with __attribute__((no_caller_saved_registers))
mov rdi, rsp mov rdi, rsp
add rdi, 8 ; context pointer is after r9 argument add rdi, 8 ; context pointer is after r9 argument
@@ -329,32 +355,24 @@ arch_syscall_entry:
call sched_userspacecheck ; compiled with __attribute__((no_caller_saved_registers)) call sched_userspacecheck ; compiled with __attribute__((no_caller_saved_registers))
cli cli
; restore context ; on intel cpu's, a non-canonical rip will cause a #GP in ring 0 on the user stack when sysret is used
add rsp, 32 ; r9 argument, cr2, gs, and fs are not popped. mov rax, [rdi + 176] ; context->rip
pop rbx mov rbx, rax
mov es,rbx shl rax, 64 - 48 ; this breaks if LA57 is enabled (it's not)
pop rbx sar rax, 64 - 48
mov ds,rbx cmp rax, rbx
pop rax jne .gpf
pop rbx
pop rcx restore_context
pop rdx
pop r8
pop r9
pop r10
pop r11
pop r12
pop r13
pop r14
pop r15
pop rdi
pop rsi
add rsp, 8 ; remove irq
pop rbp
add rsp, 8 ; remove error code
pop rcx pop rcx
add rsp, 8 ; user CS add rsp, 8 ; user CS
pop r11 ; rflags pop r11 ; rflags
pop rsp pop rsp
swapgs swapgs
o64 sysret o64 sysret
.gpf:
restore_context
push 0 ; error code
swapgs
extern isr_table
jmp [isr_table + 13 * 8] ; jump to the #GP handler with the user interrupt frame