This is the mail archive of the libc-alpha@sourceware.org mailing list for the glibc project.


Index Nav: [Date Index] [Subject Index] [Author Index] [Thread Index]
Message Nav: [Date Prev] [Date Next] [Thread Prev] [Thread Next]
Other format: [Raw text]

Re: rseq/x86: choosing rseq code signature


----- On Apr 10, 2019, at 2:54 AM, Peter Zijlstra peterz@infradead.org wrote:

> On Tue, Apr 09, 2019 at 04:43:42PM -0400, Mathieu Desnoyers wrote:
>> +/*
>> + * RSEQ_SIG is used with the following privileged instructions, which trap in
>> user-space:
>> + * x86-32:    0f 01 3d 53 30 05 53      invlpg 0x53053053
>> + * x86-64:    0f 01 3d 53 30 05 53      invlpg 0x53053053(%rip)
>> + */
> 
> Right, and the alternative is: 0f b9 3d $SIG, which decodes to:
> 
>  UD1 $SIG(%rip),%edi
> 
> which will trap unconditionally. The only problem is that gas will not
> actually assemble it, but since we're .byte coding it, it doesn't
> matter.
> 
> UD1 is specified by both AMD and Intel to take a ModR/M, unlike UD0
> where they disagree on the ModR/M.

UD1 is even better from a code emulator perspective. It won't have to
try to emulate invlpg if it sees it.

Byte coding UD1 as your example above gives the following objdump output,
is it expected ?

objdump --version
GNU objdump (GNU Binutils for Debian) 2.28

x86-32:

  14:	0f b9                	ud1    
  16:	3d 53 30 05 53       	cmp    $0x53053053,%eax

x86-64:

   b:	0f b9                	ud1    
   d:	3d 53 30 05 53       	cmp    $0x53053053,%eax

Thanks!

Mathieu


-- 
Mathieu Desnoyers
EfficiOS Inc.
http://www.efficios.com


Index Nav: [Date Index] [Subject Index] [Author Index] [Thread Index]
Message Nav: [Date Prev] [Date Next] [Thread Prev] [Thread Next]