1
static int func_name (const uint8_t * address)
{
    int result;
    asm ("movl $1f, %0; movzbl %1, %0; 1:"
   : "=&a" (result) : "m" (*address));

    return result;
}

I have gone through inline assembly references over internet. But i am unable to figure out what this code is doing, eg. what is $1f ? And what does "m" means? Isn't the normal inline convention to use "=r" and "r" ?

2
  • I'm curious where you found this piece of code. See my answer below - this is actually useful ...
    – FrankH.
    Feb 19, 2013 at 10:34
  • 1
    @FrankH.: Found this code (similar to this) in PIOS OS, while doing some Kernel Hacking. Mar 1, 2013 at 10:42

4 Answers 4

5

The code is functionally identical to return *address but not absolutely equivalent to this wrt. to the generated binary / object file.

In ELF, the usage of the forward reference (i.e. the mov $1f, ... to retrieve the address of the assembly local label) results in the creation of what's called a relocation. A relocation is an instruction to the linker (either at executable creation or later to the dynamic linker at executable/library loading) to insert a value only known at link/load time. In the object code, this looks like:

Disassembly of section .text:

0000000000000000 :
   0:   b8 00 00 00 00          mov    $0x0,%eax
   5:   0f b6 07                movzbl (%rdi),%eax
   8:   c3                      retq

Notice the value (at offset 1 into the .text section) is zero here even though that's actually not correct - it depends on where in the running code the function will end up. Only the (dynamic) linker can ultimately know this, and the information that this piece of memory needs to be updated as it is loaded is actually placed into the object file:

$ readelf -a xqf.o
ELF Header:
[ ... ]
Section Headers:
  [Nr] Name              Type             Address           Offset
       Size              EntSize          Flags  Link  Info  Align
  [ 0]                   NULL             0000000000000000  00000000
       0000000000000000  0000000000000000           0     0     0
  [ 1] .text             PROGBITS         0000000000000000  00000040
       0000000000000009  0000000000000000  AX       0     0     16
  [ 2] .rela.text        RELA             0000000000000000  000004e0
       0000000000000018  0000000000000018          10     1     8
[ ... ]
Relocation section '.rela.text' at offset 0x4e0 contains 1 entries:
  Offset          Info           Type           Sym. Value    Sym. Name + Addend
000000000001  00020000000a R_X86_64_32       0000000000000000 .text + 8
[ ... ]

This ELF section entry says:

  • look at offset 1 into the .text section
  • there's a 32bit value that will be zero-extended to 64-bit (R_X86_64_32). This may have been intended for use in 32-bit code, but in a 64-bit non-PIE executable that's still the most efficient way to put an address into a register; smaller than lea 1f(%rip), %0 for a R_X86_64_PC32 RIP-relative relocation. And yes a RIP-relative LEA into a 32-bit register is legal, and saves a byte of machine code if you don't care about truncating the address.
  • the value you (as the linker) need to put there is that of .text + 8 (which will have to be computed at link / load time)

This entry is created thanks to the mov $1f, %0 instruction. If you leave that out (or just write return *address), it won't be there.

I've forced code generation for the above by removing the static qualifier; without doing so, a simple compile actually creates no code at all (static code gets eliminated if not used, and, a lot of the time, inlined if used).

Due to the fact that the function is static, as said, it'll normally be inlined at the call site by the compiler. The information where it's used therefore usually gets lost, as does the ability of a debugger to instrument it. But the trick shown here can recover this (indirectly), because there will be one relocation entry created per use of the function. In addition to that, methods like this can be used to establish instrumentation points within the binary; insert well-known/strictly-defined but functionally-meaningless small assembly statements at locations recoverable through the object file format, and then let e.g. the debugger / tracing utilities replace them with "more useful" things when needed.

2
  • I have read your answer but still don't understand why "movl $1f, %0" is needed in OP's example. Can you offer some more materials?
    – StrikeW
    Nov 9, 2015 at 2:58
  • @StrikeW: It isn't needed at all, unless you care about the metadata / symbol table entry it creates for the locations where this function gets inlined. (As discussed in the last paragraph). It's a mov-immediate to EAX which gets overwritten by the next instruction. Apr 11, 2022 at 17:23
4

$1f is the address of the 1 label. The f specifies to look for the first label named 1 in the forward direction. "m" is an input operand that is in memory. "=&a" is an output operand that uses the eax register. a specifies the register to use, = makes it an output operand, and & guarantees that other operands will not share the same register.

Here, %0 will be replaced with the first operand (the eax register) and %1 by the second operand (The address pointed to by address).

All these and more are explained in the GCC documentation on Inline assembly and asm contraints.

3
  • 3
    $1f is the forward label address, not a hex 0x1f constant. Feb 17, 2013 at 14:46
  • what are %1 and %2 here ? i mean which variables ? Feb 17, 2013 at 14:52
  • See the links provided by @interjay and my answer. Feb 17, 2013 at 14:52
2

This piece of code (apart from being non-compilable due to two typos) is hardly useful.

This is what it turns into (use the -S switch):

_func_name:
        movl 4(%esp), %edx ; edx = the "address" parameter
        movl $1f, %eax ; eax = the address of the "1" label
        movzbl (%edx), %eax; eax = byte from address in edx, IOW, "*address"
     1:
        ret

So the entire body of the function can be replaced with just

return *address;
1
  • 2
    That it can be completely replaced by return *address is not correct; there's a slight, functionally meaningless but nonetheless for certain purposes inevitable difference ... and that is the creation of a relocation at a rather known address within the function. Such things are useful for debugging and/or runtime tracing, particular in a situation like the above where the code is declared static and therefore will, at higher optimization levels, usually be inlined at the call site; the reloc sections in the ELF file can then be used to track where the code got inlined, for example.
    – FrankH.
    Feb 19, 2013 at 10:11
2

This is a code snippet from the PintOS project.

The function here is used by the OS kernel to read a byte at address from the user address space. That is done by movzbl %1, %0 where 0% is result and 1% is address. But before that, the kernel has to move the address of $1f(which is the address of the instruction right after movzbl %1, %0) to the eax register. This move seems useless because some context information is missing. The kernel does that for the page fault interrupt handler to use it. Because address could be an invalid one offered by the user, and it might cause a page fault. When that happened, the interrupt handler would take over, set eip equal to eax(which is the memory address of $1f), and also set eax to -1 to indicate that the read failed. After that, the kernel was able to return from the handler to $1f and move on. Without saving the address of $1f, the handler would have no idea where it should return to, and could only go back to movzbl %1, %0 again and again.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.