UDB instruction (General-purpose)

UDB is the byte D6 in 64-bit mode, where it raises #UD and does nothing else: no register, flag or memory changes, and the saved RIP points at the UDB itself. Outside 64-bit mode the same byte is SALC, which sets AL from CF. Intel’s opcode map reserves UDB, with UD0, UD1 and UD2, for code that wants an invalid-opcode exception on purpose, and a hypervisor sees it as any other #UD, through bit 6 of the exception bitmap. Unlike the others it is a single byte with no ModRM, so it fits where a two-byte trap does not.

Hidden inside other instructions

Linux 7.3 uses that size for control-flow integrity. Its FineIBT preamble at the start of a function ends with nopl -42(%rax), encoded 0F 1F 40 D6: run from its start it is a 4-byte NOP, but the displacement byte is D6, and the preamble’s JNE, taken when the caller’s type hash does not match, targets that byte, which then runs as UDB. The kCFI caller check the kernel patches in does the same with jne . + 3 and test $0xd6, %al, bytes 75 01 A8 D6: when the hash differs, the jump lands on the D6 inside the TEST. Its #UD handler reads the byte at the saved RIP, recognizes D6, and reports a CFI failure.

Recorded on Zen 5

Both cases raised #UD with RFLAGS as it was. GNU as 2.44 has no mnemonic for it and objdump 2.44 prints D6 as “(bad)”; code writes it as .byte 0xd6, as the kernel’s ASM_UDB does.

Forms

Every encoding of UDB that Intel XED knows, one row per XED instruction form (iform). How to read the notation.

Instruction	Encoding	Requires
`UDB` 64-bit mode only UDB	`D6`	Base instruction set

Operation

What the forms do, in pseudocode that our tests run against results recorded on real processors. How to read.

fault(UD)                        # D6, one byte, in 64-bit mode; outside
                                 # it, D6 is SALC, which sets AL from CF

Run on AMD Zen 5 (EPYC 9645): 2 cases. Every one raised an exception, at CPL 3, where the probe runs.

Operands

None: XED lists no operands for this form.

Flags

None: XED records no flag that the forms test or change.

Attributes

What else XED records about the forms. How to read.

All forms: may abort a TSX transaction

CPUID and processors

Each form belongs to an XED ISA set. A form can be used when the processor reports every CPUID bit of one of its ISA set's alternatives.

CPUID requirements and processors of the XED ISA sets above. Alternatives are separated by “or”; processors follow XED’s chip model, whose AMD processors end with Zen 2, and the CPU data of this site for Zen 3 to Zen 6.

ISA set	CPUID	Processors
`I86` General-purpose System	No CPUID bit: part of the base instruction set.	Every x86-64 processor in XED’s model and Zen 3 to Zen 6

More General-purpose instructions

All 109 General-purpose instructions

Hidden inside other instructions#

Recorded on Zen 5#