Messages in this thread | | | Date | Wed, 10 Apr 2019 11:47:40 -0400 (EDT) | From | Mathieu Desnoyers <> | Subject | Re: rseq/x86: choosing rseq code signature |
| |
----- On Apr 10, 2019, at 2:54 AM, Peter Zijlstra peterz@infradead.org wrote:
> On Tue, Apr 09, 2019 at 04:43:42PM -0400, Mathieu Desnoyers wrote: >> +/* >> + * RSEQ_SIG is used with the following privileged instructions, which trap in >> user-space: >> + * x86-32: 0f 01 3d 53 30 05 53 invlpg 0x53053053 >> + * x86-64: 0f 01 3d 53 30 05 53 invlpg 0x53053053(%rip) >> + */ > > Right, and the alternative is: 0f b9 3d $SIG, which decodes to: > > UD1 $SIG(%rip),%edi > > which will trap unconditionally. The only problem is that gas will not > actually assemble it, but since we're .byte coding it, it doesn't > matter. > > UD1 is specified by both AMD and Intel to take a ModR/M, unlike UD0 > where they disagree on the ModR/M.
UD1 is even better from a code emulator perspective. It won't have to try to emulate invlpg if it sees it.
Byte coding UD1 as your example above gives the following objdump output, is it expected ?
objdump --version GNU objdump (GNU Binutils for Debian) 2.28
x86-32:
14: 0f b9 ud1 16: 3d 53 30 05 53 cmp $0x53053053,%eax
x86-64:
b: 0f b9 ud1 d: 3d 53 30 05 53 cmp $0x53053053,%eax
Thanks!
Mathieu
-- Mathieu Desnoyers EfficiOS Inc. http://www.efficios.com
| |