1

I have been trying to experiment with the Intel Debug Registers however I seem to be doing something incorrectly. I have created a very simple Linux LKM and tried to use inline assembly to perform trivial manipulation of the registers. e.g:

 __asm__ ("movl %eax, %db0");

The error messages I get suggest I'm doing something fundamentally incorrect. e.g:

Error: unsupported for `mov'

Does anyone have any insight into how to work with these registers?

JOgden
  • 316
  • 1
  • 7
  • Is this for an x86 or x86-64 system? If it is 64-bit, then you need to move from a 64-bit register (`rax`). Otherwise, please remove that tag to prevent confusion. – ughoavgfhw Aug 03 '12 at 22:04
  • This holds true for both x86-64 (rax) and x86 (eax). This is just an example, I've also tried xoring various debug registers with themselves. The tags were chosen as I associated them with low level topics. – JOgden Aug 03 '12 at 22:33
  • Xoring would never work, since the debug registers can only be accessed through `mov` instructions. The problem is that the debug registers are `drN`, not `dbN`. I almost missed that while looking directly at the documentation. – ughoavgfhw Aug 03 '12 at 22:44
  • @ughoavgfhw, yes, the registers are DRN but `as` allows to use `dbN` as their names as it is indicated in the [manual](http://web.mit.edu/gnu/doc/html/as_18.html#SEC204). On my 32-bit OpenSUSE 12.1 box, GNU As 2.21.1 accepts both `drN` and `dbN` as the names of these registers. – Eugene Aug 06 '12 at 06:45

2 Answers2

5

That's a syntax error - gcc's inline assembler uses % as operand identifier, and to explicitly use it in register names for x86 you'll have to write:

__asm__ ("movl %%eax, %%db0\n\t");

That'll make it compile.

Correction:
There's multiple issues here:

  1. __asm__ statements without clobbers are highly unusual (and rarely do what you're expecting because there's very few things one can do in assembly that have no side effects). Nonetheless, if and only if the instruction is actually both side-effect-free and has no inputs, it looks to be possible to omit the clobber list.
    One consequence of that is that escaping % is no longer necessary; the compiler for this simple example creates the same opcode for __asm__("movl %eax, %db0\n\t"); as it does for the fully-specified __asm__("movl %%eax, %%db0\n\t":::);. This is not necessarily an advantage though, because ...
  2. The second problem is portability; x86_64 and i386 are similar but not identical, and one of the differences is the register width for the debug regs. This alone is a particularly good reason to actually use inline assembly operands instead of register names directly, because the following code:
    __asm__("mov %0, %%db0\n\t" : : "a"((uintptr_t)0) : );
    compiles both on 64bit (gcc -m64 ...) and 32bit (gcc -m32 ...) - it creates the same instruction, but the registers used when writing this in assembly are different for 64bit:
    208: 0f 23 c0 mov %rax,%db0
    while in 32bit, it does:
    269: 0f 23 c0 mov %eax,%db0
    The use of an input operand here provides the ability to abstract the register width away (uintptr_t comes from <inttypes.h> and is guaranteed to always be full general-purpose register width), so the same inline assembly can be used for 32bit and 64bit compiles.

I admit I had no idea the compiler treats clobber-list-less __asm__ differently from "normal" such statements.

In any case, in reality you will definitely need an argument/clobber list when modifying debug registers, because access to these are serializing instructions which should be implicitly made known to the compiler as memory clobber. Besides, the value you're reading from them / writing to them must go to / come from somewhere ... hence input/output.

FrankH.
  • 17,675
  • 3
  • 44
  • 63
  • Thanks for the quick response. I'm afraid it doesn't seem to work. The result is "Error: bad register name `%%eax'" - I'll look into inline assembly a little further as I may be undertaking something a little ambitious as a relative newcomer! – JOgden Aug 03 '12 at 21:04
  • 2
    This is only true if there are operands to the assembly. Without them, only one `%` is used for registers. – ughoavgfhw Aug 03 '12 at 22:02
  • Thanks for the clarification. It was suggested to me to investigate the TRESOR project (http://www1.informatik.uni-erlangen.de/tresor/) as a real world implementation of reading and writing the elusive debug registers. I'll review the source and report back if/when I can determine their approach. – JOgden Aug 03 '12 at 22:27
  • 1
    @JOgden, interesting: when I use the full form of that inline assembly statement (`__asm__ ("movl %%eax, %%db0\n\t" : : : );`), it compiles fine on my 32-bit machine. The instruction in the resulting binary code of the kernel module seems to be correct: `0f 23 c0`. Not sure why the full form if the inline assembly statement matters here. – Eugene Aug 06 '12 at 06:50
1

FrankH's answer doesn't work in x64 mode. What could probably be used is:

inline void setDebugReg( long v )
{
   __asm__ __volatile__ ("mov %0, %%db0\n\t" : : "r"(v) : ) ;
}

(you'll need a similar asm for db7 to set the flags for the watchpoint).

However setting these registers can't be done in userspace, so other methods are required. Here is sample code to do this using ptrace, where a process is forked to ptrace attach, change the registers, ptrace detach and then exit.

Community
  • 1
  • 1
Peeter Joot
  • 7,848
  • 7
  • 48
  • 82