Join the discussion
Write your take first — we'll ask for email only when you're ready to publish.
- Hacker News
- It's like why the first (hard) drive letter is C.by qbane
- A: drive is 3.5; B: drive is 5.25; C: drive is hard diskby cyanydeez
- Is this just his speculation? Or is there evidence for it?by dataflow
- This is a first hand account of somebody very knowledgeable and respected in the industry at the time of the events. I would say he is the evidence.by alt227
- What the instruction does is well documented, and the history of other invalid instructions being used for the same purpose in the past I'm guessing there is also well known, though a quick search doesn't turn up any official Intel documentation on the matter.
Given who this is and the overall quality of his output over the years, I'm willing to trust it isn't pure guesswork - and anyway, I'd trust his guesswork over many other people's absolute facts.
by dspillett - I recently had to debug builds that failed randomly and a ud2 from V8 was there waiting for me.by gtirloni
- Hyrum’s Law reaching all the way down to the instruction decoder. And for those who care the ud2 opcode is 0F 0Bby arkj
- I'm not much of an x86 person but on other architectures you can raise software interrupts/exceptions. Does x86 not have this or did those facilities not cover enough use cases?by Neywiny
- x86 has...
INT Ib INT1 INT3 INTO BOUND
by 349ru3h4f03 - It's common to use int3 for some of the scenarios mentioned in the article. (Like non-reachable code) This instruction is often used to trigger a break in the debugger.by asveikau
- I expect that UD2 stops instruction fetching (beyond the current block) and conversion to µops. A software interrupt or supervisor call should probably do neither because most of the time, these instructions eventually return and continue executing the next instruction.by fweimer
- >you can raise software interrupts/exceptions
exception handling requires that some unrelated region of memory is initialized and intact and ready to do the right thing, whatever that is, and that region is outside the scope of your control, it belongs to the operating system or the the embedded ROM, and it may not have been laid out to take care of your case.
assembly/machine code is operating at a lower layer: "I don't know what larger thing I'm a part of, but I know I need to stop."
by fsckboy - Already since Intel 8086, x86 has the instruction "INT vector_number", whose purpose is to allow software to invoke directly any of the many kinds of exception handlers or hardware interrupt handlers that are specified by the ISA or implemented by the hardware designer, which are normally invoked when various conditions arise, as determined by software execution or by I/O events.
So you can invoke the handler of the invalid instruction exception with the INT instruction, but as another poster mentioned, the INT instruction alone is not enough for this, but you need to setup the stack in such a way so that it will contain the information expected by the exception handler, which requires multiple instructions.
This kind of invocation may be acceptable when you write a test program for the invalid instruction exception handler, but it is not acceptable when you want to initialize some guard memory with values that will trigger the exception, to signal that your program has attempted to execute instructions from an area that should not be executable. Setting a memory area as non-executable through the access rights has only page granularity, so it is not useful when a page must contain both some executable code and some non-executable data.
If Intel had not defined an official opcode that is guaranteed to remain unused forever, to be able to reliably trigger the invalid instruction exception, the workaround would have been for the user to reserve one of the 256 interrupt vectors for the invocation through software of the invalid instruction exception. For that vector, a simple handler could have been used, which would have setup the stack in the right way, before jumping to the invalid instruction handler.
But this workaround would have had the disadvantage that any chosen interrupt vector could have conflicted with some choice made by the hardware designers of some computers, so it would have been required for it to be a configurable parameter of the operating system kernel, and also of the user applications that need it, like compilers, unless it would have been standardized by some organization.
Just reserving an opcode at Intel and AMD was simpler, with no other requirements for standardization or changes in the existing software.
by adrian_b - It's basically a convention. The alternative is to raise interrupts of course, but that might be application specific, or use other invalid instructions than the designated one, but they might work differently on other processor types.by js8
- Maybe because if the code wants to call the invalid opcode interrupt handler (INT6), it needs extra code to populate the flags and registers expected by that handler, whereas actually triggering an invalid opcode exception will get all those parameters populated automatically.by omoikane
- Though, for whatever reason, the instruction internally decoded as if it took two parameters, a register destination and a register-or-memory source.
Because the rest of the 0F Fx line also has a ModRM. Ditto for 0F Bx.
So if your 0F FF is at the end of a page, and the next page is not present, you sometimes got an invalid opcode exception and you sometimes got an access violation.
This reminds me of some related information on instruction length and decoding of "undefined" instructions I have filed away from a long time ago; sadly this stuff is disappearing from the Internet, but both the Archive and I still remember:
https://web.archive.org/web/20160721202526/http://pferrie.ho...
Such information is very important for emulation accuracy and some security contexts.
by userbinator - Tangential, but I almost never read assembly [1], but I do read Java bytecode pretty frequently, primarily because doing that can sometimes be a good substitute for benchmarking [2], which I do not enjoy.
The thing that never seems to stop tripping me up is the different “dup” codes that compile. At some point I really need to properly learn the difference between dup_x2 and dup2_x1 and dup2_x2.
[1] not out of like an ethical objection, just my career has involved almost no reverse engineering and it’s also never been a path I have been super interested in to pursue on my own.
[2] e.g. if two competing chunks of code emit the same bytecode, you don’t need to pull out JMH. My go to example for this is using if statements vs switches, which will usually emit the same code so performance arguments are moot.
by tombert - Java has bytecode instructions for switches. You're saying the compiler doesn't use them?by mitxela
- It's sad that this is probably going to become canon, now, Raymon Chen being as influential as xe is, when what actually happened was that in 1998 H. Peter Anvin saw UD2 in Intel's doco, and that there was a second opcode that was just described by Intel as merely undefined, so gave it the mnemonic UD1 in the 0.98p3-hpa version of NASM because 'calling it UD1 seemed to make sense'.
* https://groups.google.com/g/comp.lang.asm.x86/c/ErG5TJEDjiw/...
* https://github.com/netwide-assembler/nasm/blob/nasm-0.98.x/C...
by JdeBP - Nowadays UD0 UD1 UD2 are in the SDM and APM.
We also got UDB (D6), the one-byte variant that arrived with x86-64 for 64-bit mode.
And we have always had UDW (FF FF), aka group #5 (1st FF) with a modrm byte of mod=11b r/m=111b (/7) reg=111b (2nd FF) -- that one matters for memory with all bits set to 1, or for buses terminated to all 1 when no device claims an access.
by 349ru3h4f03 - I've always remembered FF FF as "??? DI", because that's what DEBUG's disassembler would render it as.by userbinator
- Couldn't find UDW in the intel docs - https://intel.github.io/SDM/sdm.html
But found it in wikipedia which is well structured and has detailed notes/comments on all instructions - https://en.wikipedia.org/wiki/List_of_x86_instructions
There is also UD2A and UD2B which just seem to be synonyms for UD2 and UD1 respectively? Google tells me that they are legacy tool specific mnemonics used in older GNU GCC/Binutils.
by rramadass - Sorry y'all. In a thread about encodings whose only spec is that they mean nothing (UD0/UD1/UD2, FF /7), "349ru3h4f03" is the most thematically correct username possible, it really does "check out" dang it. It even looks like hex right up until it #UDs on the r, u, and h. Invalid encoding; faults on interpretation. Tough crowd tonite.-by Bluestein
- Thus finally the 0F FF believers were rewarded by being give the honor of op code UD0 making it the one and true original invalid opcode permanently disgracing the 0F B9 adherents with the shame of UD1.by hacker_homie
- That will show'em.
- 0 undoubtedly comes first, but we all know 1 == true...by randomblock1
- > Better to stick with ud2. Its behavior is consistent and architecturally guaranteed.
Ah, finally an undefined instruction whose behaviour is consistent and architecturally guaranteed!
by boramalper - Schrodinger's instruction: simultaneously defined and undefinedby randomblock1