ARM硬件断点

hw_breakpoint 是由处理器提供专门断点寄存器来保存一个地址，是需要处理器支持的。处理器在执行过程中会不断去匹配，当匹配上后则会产生中断。

内核自带了硬件断点的样例linux-3.16\samples\hw_breakpoint\data_breakpoint.c

static void sample_hbp_handler(struct perf_event *bp,
			       struct perf_sample_data *data,
			       struct pt_regs *regs)
{
	printk(KERN_INFO "%s value is changed\n", ksym_name);
	dump_stack();
	printk(KERN_INFO "Dump stack from sample_hbp_handler\n");
}

static int __init hw_break_module_init(void* addr)
{
	int ret;
	struct perf_event_attr attr;

	hw_breakpoint_init(&attr);
	attr.bp_addr = addr;
	attr.bp_len = HW_BREAKPOINT_LEN_4;//监控addr开始的4字节
	attr.bp_type = HW_BREAKPOINT_W | HW_BREAKPOINT_R;//读写该地址都能触发

	sample_hbp = register_wide_hw_breakpoint(&attr, sample_hbp_handler, NULL);
	if (IS_ERR((void __force *)sample_hbp)) {
		ret = PTR_ERR((void __force *)sample_hbp);
		goto fail;
	}

	printk(KERN_INFO "HW Breakpoint for write installed\n");

	return 0;

fail:
	printk(KERN_INFO "Breakpoint registration failed\n");

	return ret;

 看网上说ARM Architecture Reference Manual Supplement ARMv8.1, for ARMv8-A architecture profile这些文档的degug register里面有。文档可以在这个网站下载

https://developer.arm.com/documentation

Documentation – Arm Developer

样例代码

#include <linux/perf_event.h>
#include <linux/hw_breakpoint.h>

struct perf_event * __percpu *sample_hbp;

static void sample_hbp_handler(struct perf_event *bp,
			       struct perf_sample_data *data,
			       struct pt_regs *regs)
{
	printk(KERN_INFO "value is changed\n");
	dump_stack();
	printk(KERN_INFO "Dump stack from sample_hbp_handler\n");
	unregister_wide_hw_breakpoint(sample_hbp);
}

static int hw_break_module_init(void* addr)
{
	int ret;
	struct perf_event_attr attr;

	hw_breakpoint_init(&attr);
	attr.bp_addr = addr;
	attr.bp_len = HW_BREAKPOINT_LEN_4;
	attr.bp_type = HW_BREAKPOINT_W;

	sample_hbp = register_wide_hw_breakpoint(&attr, sample_hbp_handler, NULL);
	if (IS_ERR((void __force *)sample_hbp)) {
		ret = PTR_ERR((void __force *)sample_hbp);
		goto fail;
	}

	printk(KERN_INFO "HW Breakpoint for write installed\n");

	return 0;

fail:
	printk(KERN_INFO "Breakpoint registration failed\n");

	return ret;
}

int arr[10] = {0};
int hw_bp_test = 0;
static int __init msm_serial_init(void)
{
	..............................
	pr_info("xxx msm_serial: driver initialized\n");
	//arr[10] = local_var_test[5];
	hw_break_module_init(&hw_bp_test);
	hw_bp_test = 1;
	return ret;
}

实际效果展示

此次实验是用qemu模拟一个aarm64环境，可以看到支持6个断点 

可以看到应该是每个cpu都注册了一个。感觉应该是在一个cpu上注册，所有cpu都会去检查（原理不清楚，上面的文档没有看明白，猜测的）

struct perf_event * __percpu *
register_wide_hw_breakpoint(struct perf_event_attr *attr,
			    perf_overflow_handler_t triggered,
			    void *context)
{
	struct perf_event * __percpu *cpu_events, *bp;
........................................
	for_each_online_cpu(cpu) {
		bp = perf_event_create_kernel_counter(attr, cpu, NULL,
						      triggered, context);
...................................................
}

暂时不写了