raphiaura/KytyPS5
1
0
Fork 0
mirror of https://github.com/KytyPS5/KytyPS5.git synced 2026-10-24 04:46:56 +02:00
Code Issues Packages Projects Releases Wiki Activity

cross-vendor TLS fix: 0x66 prefixes are forced into 64bit call on AMD

Browse Source
This commit is contained in:
nmzik
2026-09-03 23:01:51 +02:00
parent f27a136430
commit 5b8e3b51b0
2 changed files with 16 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/loader/jit.h
+7 -6
View File
@@ -69,21 +69,22 @@ struct Call9 {
template <class Handler>
void SetFunc(Handler func) {
auto func_addr = reinterpret_cast<int64_t>(reinterpret_cast<void*>(func));
auto rip_addr = reinterpret_cast<int64_t>(&code[5]);
auto rip_addr = reinterpret_cast<int64_t>(&code[6]);
auto offset64 = func_addr - rip_addr;
auto offset32 = static_cast<uint32_t>(static_cast<uint64_t>(offset64) & 0xffffffffu);
*reinterpret_cast<uint32_t*>(&code[1]) = offset32;
*reinterpret_cast<uint32_t*>(&code[2]) = offset32;
}
void SetOutputReg(uint8_t reg) { code[7] = 0xc0u | (reg & 7u); }
void SetOutputReg(uint8_t reg) { code[8] = 0xc0u | (reg & 7u); }
static uint64_t GetSize() { return 9; }
// call func
// rex.w; call func
// mov rax,rax
// nop
uint8_t code[9] = {0xE8, 0x00, 0x00, 0x00, 0x00, 0x48, 0x89, 0xC0, 0x90};
// REX.W is required because AMD processors honor a retained 0x66 operand-size
// prefix on a near call and would otherwise execute callw.
uint8_t code[9] = {0x48, 0xE8, 0x00, 0x00, 0x00, 0x00, 0x48, 0x89, 0xC0};
};
struct TlsRegStub {
src/loader/runtimeLinker.cpp
+9 -6
View File
@@ -1143,7 +1143,8 @@ static void PatchProgram(Program* program, uint64_t address, uint64_t size) {
}
}
if (!program->elf->IsShared() && program->tls.handler_vaddr != 0) {
if (!program->elf->IsShared() && program->tls.handler_vaddr != 0 &&
size >= Jit::Call9::GetSize()) {
// Replace:
// 66 66 66
// mov <reg>, qword ptr fs:[0x00]
@@ -1151,7 +1152,8 @@ static void PatchProgram(Program* program, uint64_t address, uint64_t size) {
// call <handler>
// mov <reg>,rax
// nop ...
const uint8_t tls_pattern[5] = {0x64, 0x48, 0x8B, 0x00, 0x25};
const uint8_t tls_pattern[5] = {0x64, 0x48, 0x8B, 0x00, 0x25};
const uint8_t zero_displacement[4] = {};
EXIT_IF(Jit::Call9::GetSize() != 9);
@@ -1173,14 +1175,15 @@ static void PatchProgram(Program* program, uint64_t address, uint64_t size) {
const uint8_t modrm = inst_ptr[3];
if (memcmp(inst_ptr, tls_pattern, 3) == 0 && (modrm & 0xc7u) == 0x04u &&
inst_ptr[4] == tls_pattern[4] &&
*reinterpret_cast<const uint32_t*>(inst_ptr + 5) == 0) {
LOGF("Patch tls at addr: [%016" PRIx64 "]\n",
reinterpret_cast<uint64_t>(inst_ptr));
memcmp(inst_ptr + 5, zero_displacement, sizeof(zero_displacement)) == 0) {
LOGF("Patch tls at addr: [%016" PRIx64 "]\n", reinterpret_cast<uint64_t>(inst_ptr));
const auto reg = (modrm >> 3u) & 7u;
EXIT_NOT_IMPLEMENTED(reg == 4u);
// A raw scan can encounter a 0x66 in the preceding instruction.
// A raw scan can encounter a 0x66 in the preceding instruction, so do not
// overwrite it. Call9 starts with REX.W to neutralize genuine 0x66
// prefixes on AMD processors (before it could turn E8 into callw 16bit).
auto* code = new (inst_ptr) Jit::Call9;
code->SetFunc(reg == 0
? program->tls.handler_vaddr