lkml.org 
[lkml]   [2006]   [Mar]   [15]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [RFC, PATCH 7/24] i386 Vmi memory hole
Chris Wright wrote:
> * Zachary Amsden (zach@vmware.com) wrote:
>
>> ENTRY(sysenter_entry)
>> movl TSS_sysenter_esp0(%esp),%esp
>> sysenter_past_esp:
>> STI
>> pushl $(__USER_DS)
>> pushl %ebp
>> pushfl
>> pushl $(__USER_CS)
>> pushl $SYSENTER_RETURN
>>
>> SYSENTER_RETURN is a link time constant that is defined based on the
>> location of the vsyscall page. If the vsyscall page can move, this can
>> not be a constant. The reason is, this "fake" exception frame is used
>> to return back to the EIP of the call site, and sysenter does not record
>> the EIP of the call site.
>>
>
> It's only real issue for something like execshield. For this it's easy
> to do the fixed math since it's still at fixed address.
>
> + DEFINE(VSYSCALL_BASE, (PAGE_OFFSET - 2*PAGE_SIZE));
>

Ok, I'm confused. What fixed math? The return EIP that is pushed here
is used when sysenter is active and you have to IRET back to userspace.
If that EIP is dynamically relocatable, you can't do fixed math unless
you patch the pushl site dynamically. Notable reasons for returning via
IRET on this fake exception frame were (until my recent submission) IOPL
changes, but I believe there were more. I will have to inspect the
source to determine if that is still the case.

Zach
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2006-03-15 10:21    [W:0.268 / U:0.044 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site