Does anyone know I can detect which CPU instructions are being executed?

I am especially interested in detecting AES instructions implemented by recent Intel and AMD CPUs. Would it f.e. be possible to write a kernel module that detects these instructions? Or are the specific CPU instructions that are sent to the CPU not even known by the kernel?

  • It may be possible, either through processor configuration features or through debugging features, and it may require the cooperation of the kernel. This requires low-level programming knowledge, so this question would be better asked on Stack Overflow. – Gilles 'SO- stop being evil' Apr 30 '17 at 22:15

Most of the time, CPUs execute processes’ instructions without involving the kernel; the kernel only has to step in if a user-level process causes a trap, either by attemptung to execute an invalid instruction (invalid here covering a variety of reasons) or by invoking a software interrupt. AES instructions are executed directly and the kernel doesn’t know that they’re being executed.

I don’t think there are any related performance counters you could use either. The AES instructions have an unusual execution pattern which may be identifiable statistically, but I’ve never tried that... And that’s not applicable generally anyway.

You could try using an appropriately-instrumented emulator such as Bochs, or analyse binaries to determine the instructions they use — Debian: what instructions do x86-64 binaries use? has more information on the latter.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.