Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
Date:   Wed, 10 Apr 2019 14:05:50 -0400 (EDT)
From:   Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
To:     Peter Zijlstra <peterz@infradead.org>
Cc:     Thomas Gleixner <tglx@linutronix.de>,
        Andy Lutomirski <luto@amacapital.net>,
        "H. Peter Anvin" <hpa@zytor.com>, Andi Kleen <andi@firstfloor.org>,
        Ingo Molnar <mingo@redhat.com>, Borislav Petkov <bp@alien8.de>,
        libc-alpha <libc-alpha@sourceware.org>,
        linux-kernel <linux-kernel@vger.kernel.org>,
        carlos <carlos@redhat.com>, x86 <x86@kernel.org>
Message-ID: <1829916645.3219.1554919550686.JavaMail.zimbra@efficios.com>
In-Reply-To: <20190410175709.GW4038@hirez.programming.kicks-ass.net>
References: <11513896.2624.1554838336494.JavaMail.zimbra@efficios.com> <913288111.2663.1554842622822.JavaMail.zimbra@efficios.com> <20190410065417.GU11158@hirez.programming.kicks-ass.net> <608558890.3157.1554911260089.JavaMail.zimbra@efficios.com> <20190410175709.GW4038@hirez.programming.kicks-ass.net>
Subject: Re: rseq/x86: choosing rseq code signature
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 7bit
Thread-Topic: rseq/x86: choosing rseq code signature
Thread-Index: qfsDH9FH3unER4Ra7fJWzhZ0y+Uuaw==
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk

----- On Apr 10, 2019, at 1:57 PM, Peter Zijlstra peterz@infradead.org wrote:

> On Wed, Apr 10, 2019 at 11:47:40AM -0400, Mathieu Desnoyers wrote:
>> ----- On Apr 10, 2019, at 2:54 AM, Peter Zijlstra peterz@infradead.org wrote:
>> 
>> > On Tue, Apr 09, 2019 at 04:43:42PM -0400, Mathieu Desnoyers wrote:
>> >> +/*
>> >> + * RSEQ_SIG is used with the following privileged instructions, which trap in
>> >> user-space:
>> >> + * x86-32:    0f 01 3d 53 30 05 53      invlpg 0x53053053
>> >> + * x86-64:    0f 01 3d 53 30 05 53      invlpg 0x53053053(%rip)
>> >> + */
>> > 
>> > Right, and the alternative is: 0f b9 3d $SIG, which decodes to:
>> > 
>> >  UD1 $SIG(%rip),%edi
>> > 
>> > which will trap unconditionally. The only problem is that gas will not
>> > actually assemble it, but since we're .byte coding it, it doesn't
>> > matter.
>> > 
>> > UD1 is specified by both AMD and Intel to take a ModR/M, unlike UD0
>> > where they disagree on the ModR/M.
>> 
>> UD1 is even better from a code emulator perspective. It won't have to
>> try to emulate invlpg if it sees it.
> 
> Some emulators terminate on UD2, not aware of any special UD1 behaviour.
> 
>> Byte coding UD1 as your example above gives the following objdump output,
>> is it expected ?
>> 
>> objdump --version
>> GNU objdump (GNU Binutils for Debian) 2.28
>> 
>> x86-32:
>> 
>>   14:	0f b9                	ud1
>>   16:	3d 53 30 05 53       	cmp    $0x53053053,%eax
>> 
>> x86-64:
>> 
>>    b:	0f b9                	ud1
>>    d:	3d 53 30 05 53       	cmp    $0x53053053,%eax
> 
> GNU objdump (GNU Binutils for Debian) 2.31.1
> 
>     0f b9 3d 78 56 34 12    ud1    0x12345678(%rip),%edi
> 
> So I suppose your objdump is too old :/

Well at least it decodes _something_ which matches the overall instruction
length of 7 bytes, which I think should be OK. So let's use ud1 unless anyone
objects.

Thanks,

Mathieu


-- 
Mathieu Desnoyers
EfficiOS Inc.
http://www.efficios.com