register_wide_hw_breakpoint实现分析

原创 于 2025-06-19 21:45:22 发布 · 312 阅读 · 4 ·
CC 4.0 BY-SA版权
版权声明：本文为博主原创文章，遵循 CC 4.0 BY-SA 版权协议，转载请附上原文出处链接和本声明。
文章标签：

#linux

以下是对register_wide_hw_breakpoint内核函数的详细分析：

 

1. 功能说明

该函数用于在全CPU核心上注册硬件断点，属于Linux内核的调试基础设施。核心功能：

 

为每个在线CPU创建硬件断点（通过perf_event子系统）

返回一组per-CPU的perf_event指针（用于后续管理）

2. 关键代码逻辑

(1) 内存分配

cpu_events = alloc_percpu(typeof(*cpu_events));

使用alloc_percpu分配per-CPU内存，每个CPU核心会有独立副本

失败时返回ENOMEM错误（强制类型转换为ERR_PTR）

(2) 断点注册循环

for_each_online_cpu(cpu) {

    bp = perf_event_create_kernel_counter(attr, cpu, NULL, triggered, context);

    per_cpu(*cpu_events, cpu) = bp;

}

for_each_online_cpu：遍历所有在线CPU

perf_event_create_kernel_counter：核心操作，实际创建硬件断点

attr：指定断点属性（地址、类型等）

triggered：断点触发时的回调函数

结果存储到per-CPU变量中

(3) 错误处理

if (IS_ERR(bp)) {

    err = PTR_ERR(bp);

    break; // 任一CPU失败则终止

}

...

if (likely(!err)) return cpu_events;

使用IS_ERR/PTR_ERR处理内核错误码

likely()优化分支预测，假设成功是常见路径

失败时调用unregister_wide_hw_breakpoint清理已注册断点

3. 技术亮点

CPU热插拔安全

get_online_cpus()/put_online_cpus()：防止操作期间CPU状态变化

硬件断点管理

通过perf_event子系统抽象不同架构的硬件断点（x86/ARM等）

内存模型

__percpu标注显式声明per-CPU内存语义

使用per_cpu()宏安全访问per-CPU变量

 

 

Linux内核中通过perf_event监控内存访问的硬件断点触发流程
peterhunter0320的博客
06-19 570
├─ perf_sample_data_init(&sample, bp->attr.bp_addr) // 记录断点地址。起始点：监控流程从event_sched_in()调用hw_breakpoint_add()开始激活硬件断点。// 或 HW_BREAKPOINT_W (仅写), HW_BREAKPOINT_R (仅读)arch_trigger_dpft_handler() // 架构相关处理。
踩内存问题分析工具
cocoti的博客
06-23 3776
踩内存问题，大家都知道，是一个比较难分析的问题。踩内存问题被发现，通常是程序崩溃的时候，能够生成coredump分析，知道是哪个内存被踩了，但通常是很难分析出是哪段代码出现了踩内存的问题。本文会介绍几种分析踩内存问题的工具，有些工具是最近发现的，我还没有大量使用过，所以只是个简单的介绍，各位看官自行判断是否实用。文章写的比较匆忙，内容可能会不太完整，请各位见谅。发现踩内存问题后，我们可以通过gdb来起出现问题的应用程序，然后对出现问题的变量进行watch，每次这个变量被读取/修改时，程序都会暂停，我们就可以
Linux 监测内存访问的方法汇总
dianzichongchong的博客
09-06 2920
1. hw break point hw break point 是 linux kernel 监测内存访问信息的方法。它可以检测一块内存是否被读或写。 具体可见 linux 自带例子：linux/samples/hw_breakpoint/data_breakpoint.c static void sample_hbp_handler(struct perf_event *bp, struct perf_sample_data *data, struct p
ARM硬件断点
qq_42693685的博客
10-08 2970
文档可以在这个网站下载。hw_breakpoint 是由处理器提供专门断点寄存器来保存一个地址，是需要处理器支持的。处理器在执行过程中会不断去匹配，当匹配上后则会产生中断。可以看到应该是每个cpu都注册了一个。感觉应该是在一个cpu上注册，所有cpu都会去检查（原理不清楚，上面的文档没有看明白，猜测的）内核自带了硬件断点的样例linux-3.16\samples\hw_breakpoint\data_breakpoint.c。
内核模块踩内存问题定位利器- hardware breakpoint
faxiang1230的专栏
06-24 2976
转发自:https://blog.youkuaiyun.com/phenix_lord/article/details/41415559 内核由于共享内存地址空间，如果没有合适的工具，很多踩内存的问题即使复现，也无法快速定位； 在新的内核版本中引入了一个新工具hardware breakpoint,其能够监视对指定的地址的特定类型(读/写)的数据访问,有利于该类问题的定位； 以下是一个使用该工具的例子(来...
gdb 系列(1) (hwbreakpoint\watchpoint)
green的专栏
02-18 8342
1. 软硬件环境android 7.0(n) QCOM 骁龙8202. 背景我最初是因为要做一件类似这样的事情的时候才研究这个的 art debug过程中我们发现 经常有SIGSEGV的问题,而且是死在java 代码里(art 已经使用dexoat把java code compile 成了机器码) 几经分析发现是在对象的method里执行的时候this指针被改了,导致了取对象的一些成员的时候出
// SPDX-License-Identifier: GPL-2.0 #include <linux/syscalls.h> #include <linux/pid.h> #include <linux/perf_event.h> #include <linux/hw_breakpoint.h> #include <linux/sched.h> #include <linux/slab.h> #include <asm/fpsimd.h> #include <linux/thread_info.h> #include <linux/uaccess.h> // 新增用户态访问头文件 static struct perf_event *bp; static void hit_handler(struct perf_event *bp, struct perf_sample_data *data, struct pt_regs *regs) { int i; struct user_fpsimd_state fp; struct task_struct *current_task = current; pr_info("=== HWBP hit @%p ===\n", (void *)regs->pc); /* 通用寄存器 */ for (i = 0; i < 31; ++i) pr_info("X%-2d = 0x%016llx\n", i, regs->regs[i]); pr_info("SP = 0x%016llx\n", regs->sp); pr_info("PC = 0x%016llx\n", regs->pc); pr_info("LR = 0x%016llx\n", regs->regs[30]); /* 浮点寄存器：5.15+ 正确方式 */ if (!user_mode(regs)) { fpsimd_save_state(&fp); // 内核态直接保存 } else { // 用户态需通过线程信息访问 memcpy(&fp, &current_task->thread.uw.fpsimd_state, sizeof(fp)); } pr_info("【浮点寄存器 S0-S31 (32-bit)】\n"); for (i = 0; i < 32; ++i) pr_info("S%-2d = 0x%08x\n", i, (u32)(fp.vregs[i] & 0xFFFFFFFF)); pr_info("【浮点寄存器 D0-D31 (64-bit)】\n"); for (i = 0; i < 32; ++i) pr_info("D%-2d = 0x%016llx\n", i, fp.vregs[i]); pr_info("【命中地址】PC = 0x%016llx\n", regs->pc); pr_info("【返回地址】LR = 0x%016llx\n", regs->regs[30]); } SYSCALL_DEFINE4(process_vm_writev, int, pid, unsigned long long, addr, int, len, int, type) { struct perf_event_attr attr = {}; struct pid *pid_struct; struct task_struct *tsk; if (bp && !IS_ERR(bp)) { unregister_hw_breakpoint(bp); bp = NULL; } pid_struct = find_get_pid(pid); if (!pid_struct) return -ESRCH; tsk = get_pid_task(pid_struct, PIDTYPE_PID); put_pid(pid_struct); if (!tsk) return -ESRCH; attr.type = PERF_TYPE_BREAKPOINT; attr.size = sizeof(attr); attr.bp_addr = addr; attr.bp_len = (len == 8) ? HW_BREAKPOINT_LEN_8 : HW_BREAKPOINT_LEN_4; switch (type) { case 0: attr.bp_type = HW_BREAKPOINT_R; break; case 1: attr.bp_type = HW_BREAKPOINT_W; break; case 2: attr.bp_type = HW_BREAKPOINT_RW; break; case 3: attr.bp_type = HW_BREAKPOINT_X; break; default: return -EINVAL; } // 5.15+ 正确参数顺序（新增 group 参数） bp = register_wide_hw_breakpoint(&attr, hit_handler, NULL, tsk, NULL); return IS_ERR(bp) ? PTR_ERR(bp) : 0; }报错:root@localhost:~/5.15-13# tools/bazel run //common:kernel_aarch64_dist --config=fast INFO: Analyzed target //common:kernel_aarch64_dist (0 packages loaded, 0 targets configured). INFO: Found 1 target... ERROR: /root/5.15-13/common/BUILD.bazel:52:22: Building kernel kernel_aarch64 failed: (Exit 2): bash failed: error executing command (from target //common:kernel_aarch64) /bin/bash -c ... (remaining 1 argument skipped) /root/5.15-13/common/kernel/sys.c:3032:60: error: too many arguments to function call, expected 3, have 5 bp = register_wide_hw_breakpoint(&attr, hit_handler, NULL, tsk, NULL); ~~~~~~~~~~~~~~~~~~~~~~~~~~~ ^~~~~~~~~ /root/5.15-13/common/include/linux/hw_breakpoint.h:70:1: note: 'register_wide_hw_breakpoint' declared here register_wide_hw_breakpoint(struct perf_event_attr *attr, ^ 1 error generated. make[2]: *** [/root/5.15-13/common/scripts/Makefile.build:287: kernel/sys.o] Error 1 make[1]: *** [/root/5.15-13/common/Makefile:1953: kernel] Error 2 make: *** [Makefile:244: __sub-make] Error 2 Target //common:kernel_aarch64_dist failed to build Use --verbose_failures to see the command lines of failed build steps. ERROR: /root/5.15-13/common/BUILD.bazel:52:22 Middleman _middlemen/common_Skernel_Uaarch64_Udist-runfiles failed: (Exit 2): bash failed: error executing command (from target //common:kernel_aarch64) /bin/bash -c ... (remaining 1 argument skipped) INFO: Elapsed time: 39.149s, Critical Path: 38.07s INFO: 4 processes: 4 internal. FAILED: Build did NOT complete successfully FAILED: Build did NOT complete successfully root@localhost:~/5.15-13# 修复好完整发给我 要求可以给任意进程硬件断点 中文注释
07-20
attr.bp_len = HW_BREAKPOINT_LEN_4; attr.bp_type = HW_BREAKPOINT_RW; attr.pid = target_pid; // 设置目标进程的PID sample_hbp = register_wide_hw_breakpoint(&attr, sample_hbp_handler, NULL); if (IS_...
root@localhost:~/5.15-13# tools/bazel run //common:kernel_aarch64_dist --config=fast INFO: Analyzed target //common:kernel_aarch64_dist (0 packages loaded, 0 targets configured). INFO: Found 1 target... ERROR: /root/5.15-13/common/BUILD.bazel:52:22: Building kernel kernel_aarch64 failed: (Exit 2): bash failed: error executing command (from target //common:kernel_aarch64) /bin/bash -c ... (remaining 1 argument skipped) /root/5.15-13/common/kernel/sys.c:3099:20: error: initializing 'struct perf_event *' with an expression of incompatible type 'typeof (*(*bp_ptr))' (aka 'struct perf_event'); remove * struct perf_event *cpu_event = *this_cpu_ptr(*bp_ptr); ^ ~~~~~~~~~~~~~~~~~~~~~~ /root/5.15-13/common/kernel/sys.c:3124:8: error: incompatible pointer types assigning to 'struct perf_event *' from 'struct perf_event **'; dereference with * [-Werror,-Wincompatible-pointer-types] new_bp = register_wide_hw_breakpoint(&new_attr, hwbp_handler, current); ^ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ * /root/5.15-13/common/kernel/sys.c:3131:31: error: incompatible pointer types passing 'struct perf_event *' to parameter of type 'struct perf_event **'; remove * [-Werror,-Wincompatible-pointer-types] unregister_wide_hw_breakpoint(*bp_ptr); ^~~~~~~ /root/5.15-13/common/include/linux/hw_breakpoint.h:76:73: note: passing argument to parameter 'cpu_events' here extern void unregister_wide_hw_breakpoint(struct perf_event * __percpu *cpu_events); ^ /root/5.15-13/common/kernel/sys.c:3137:18: error: assigning to 'struct perf_event *' from incompatible type 'typeof (*(new_bp))' (aka 'struct perf_event'); remove * info->sample_hbp = *this_cpu_ptr(new_bp); ^ ~~~~~~~~~~~~~~~~~~~~~ /root/5.15-13/common/kernel/sys.c:3099:20: error: mixing declarations and code is a C99 extension [-Werror,-Wdeclaration-after-statement] struct perf_event *cpu_event = *this_cpu_ptr(*bp_ptr); ^ /root/5.15-13/common/kernel/sys.c:3161:9: error: incompatible pointer types assigning to 'struct perf_event *' from 'struct perf_event **'; dereference with * [-Werror,-Wincompatible-pointer-types] orig_bp = register_wide_hw_breakpoint(&orig_attr, hwbp_handler, current); ^ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ * /root/5.15-13/common/kernel/sys.c:3168:31: error: incompatible pointer types passing 'struct perf_event *' to parameter of type 'struct perf_event **'; remove * [-Werror,-Wincompatible-pointer-types] unregister_wide_hw_breakpoint(*bp_ptr); ^~~~~~~ /root/5.15-13/common/include/linux/hw_breakpoint.h:76:73: note: passing argument to parameter 'cpu_events' here extern void unregister_wide_hw_breakpoint(struct perf_event * __percpu *cpu_events); ^ /root/5.15-13/common/kernel/sys.c:3174:18: error: assigning to 'struct perf_event *' from incompatible type 'typeof (*(orig_bp))' (aka 'struct perf_event'); remove * info->sample_hbp = *this_cpu_ptr(orig_bp); ^ ~~~~~~~~~~~~~~~~~~~~~~ /root/5.15-13/common/kernel/sys.c:3334:31: error: incompatible pointer types passing 'struct perf_event *' to parameter of type 'struct perf_event **'; take the address with & [-Werror,-Wincompatible-pointer-types] unregister_wide_hw_breakpoint(bp); ^~ & /root/5.15-13/common/include/linux/hw_breakpoint.h:76:73: note: passing argument to parameter 'cpu_events' here extern void unregister_wide_hw_breakpoint(struct perf_event * __percpu *cpu_events); ^ /root/5.15-13/common/kernel/sys.c:3423:31: error: incompatible pointer types passing 'struct perf_event *' to parameter of type 'struct perf_event **'; take the address with & [-Werror,-Wincompatible-pointer-types] unregister_wide_hw_breakpoint(bp); ^~ & /root/5.15-13/common/include/linux/hw_breakpoint.h:76:73: note: passing argument to parameter 'cpu_events' here extern void unregister_wide_hw_breakpoint(struct perf_event * __percpu *cpu_events); ^ /root/5.15-13/common/kernel/sys.c:3499:4: error: incompatible pointer types assigning to 'struct perf_event *' from 'struct perf_event **'; dereference with * [-Werror,-Wincompatible-pointer-types] bp = register_wide_hw_breakpoint(&attr, hwbp_handler, tsk); ^ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ * /root/5.15-13/common/kernel/sys.c:3507:22: error: assigning to 'struct perf_event *' from incompatible type 'typeof (*(bp))' (aka 'struct perf_event'); remove * new_info->sample_hbp = *this_cpu_ptr(bp); // 关联断点句柄 ^ ~~~~~~~~~~~~~~~~~ 12 errors generated. make[2]: *** [/root/5.15-13/common/scripts/Makefile.build:287: kernel/sys.o] Error 1 make[1]: *** [/root/5.15-13/common/Makefile:1953: kernel] Error 2 make: *** [Makefile:244: __sub-make] Error 2 仔细检查问题修复好 5.15内核 安卓14 确保所有逻辑正常使用无任何编译报错后 完整发给我代码
最新发布
07-23
但是，在函数 `register_wide_hw_breakpoint` 返回的是 `struct perf_event __percpu *`（一个 per-CPU 的指针数组），而 `unregister_wide_hw_breakpoint` 需要传入的也是 `struct perf_event __percpu *`。...
root@localhost:~/5.15-13# tools/bazel run //common:kernel_aarch64_dist --config=fast INFO: Analyzed target //common:kernel_aarch64_dist (0 packages loaded, 0 targets configured). INFO: Found 1 target... ERROR: /root/5.15-13/common/BUILD.bazel:52:22: Building kernel kernel_aarch64 failed: (Exit 2): bash failed: error executing command (from target //common:kernel_aarch64) /bin/bash -c ... (remaining 1 argument skipped) /root/5.15-13/common/kernel/sys.c:3009:31: error: incompatible pointer types passing 'struct perf_event *' to parameter of type 'struct perf_event **'; take the address with & [-Werror,-Wincompatible-pointer-types] unregister_wide_hw_breakpoint(bp); ^~ & /root/5.15-13/common/include/linux/hw_breakpoint.h:76:73: note: passing argument to parameter 'cpu_events' here extern void unregister_wide_hw_breakpoint(struct perf_event * __percpu *cpu_events); ^ /root/5.15-13/common/kernel/sys.c:3039:4: error: incompatible pointer types assigning to 'struct perf_event *' from 'struct perf_event **'; dereference with * [-Werror,-Wincompatible-pointer-types] bp = register_wide_hw_breakpoint(&attr, hit_handler, NULL); ^ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ * /root/5.15-13/common/kernel/sys.c:3049:9: error: implicit declaration of function 'perf_event_set_target' [-Werror,-Wimplicit-function-declaration] perf_event_set_target(event, tsk); // 关联到目标进程 ^ 3 errors generated. make[2]: *** [/root/5.15-13/common/scripts/Makefile.build:287: kernel/sys.o] Error 1 make[1]: *** [/root/5.15-13/common/Makefile:1953: kernel] Error 2 make: *** [Makefile:244: __sub-make] Error 2 Target //common:kernel_aarch64_dist failed to build Use --verbose_failures to see the command lines of failed build steps. ERROR: /root/5.15-13/common/BUILD.bazel:52:22 Middleman _middlemen/common_Skernel_Uaarch64_Udist-runfiles failed: (Exit 2): bash failed: error executing command (from target //common:kernel_aarch64) /bin/bash -c ... (remaining 1 argument skipped) INFO: Elapsed time: 45.356s, Critical Path: 44.43s INFO: 4 processes: 4 internal. FAILED: Build did NOT complete successfully FAILED: Build did NOT complete successfully root@localhost:~/5.15-13# 继续仔细修复 完整发给我代码
07-20
bp = register_wide_hw_breakpoint(&attr, breakpoint_handler, NULL); if (IS_ERR(bp)) { int ret = PTR_ERR(bp); pr_err("Registration failed: %d\n", ret); return ret; } return 0; } void cleanup_...
hw_breakpoint :watchpointhandler
yydfjt的专栏
11-16 902
static void watchpoint_handler(unsigned long addr, unsigned int fsr,                                struct pt_regs *regs) {         int i, access;         u32 val, ctrl_reg, alignment_mask;
使用data breakpoint 追踪地址寄存器被修改的问题
u012787604的博客
06-22 1485
一. 介绍 data breakpoint是一种特殊的断电，在处理检查到预设地址的值发生R/W操作时，发生断点中断。 二. 使用方法1 kernel有示例代码，在data_breakpoint.c中，在这里，kernel检查的是symbol的值发生变化，但是实际上测试发现直接使用寄存器地址也是可以的。 　　 　　看看.config里面，CONFIG_SAMPLES是否选中。 位置在Kernel Hacking/Sample kernel code。 samples目录好像不在缺省编译的范围内，自己手动编译就
linux 内核笔记之watchdog
zz460833359的博客
02-14 2069
watchdog 简而言之，watchdog是为了保证系统正常运行，或者从死循环，死锁等一场状态退出的一种机制。 看门狗分硬件看门狗和软件看门狗。硬件看门狗是利用一个定时器电路，其定时输出连接到电路的复位端，程序在一定时间范围内对定时器清零(俗称“喂狗”)，因此程序正常工作时，定时器总不能溢出，也就不能产生复位信号。如果程序出现故障，不在定时周期内复位看门狗，就使得看门狗定时器溢出产生复位信号并重启系统。软件看门狗原理上一样，只是将硬件电路上的定时器用处理器的内部定时器代替，这样可以简化硬件电路设计，但在
如何在ARM Linux内核中使用硬件断点
lingxf的专栏
03-27 7560
欢迎使用Markdown编辑器写博客本Markdown编辑器使用StackEdit修改而来，用它写博客，将会带来全新的体验哦： Markdown和扩展Markdown简洁的语法 代码块高亮 图片链接和图片上传 LaTex数学公式 UML序列图和流程图 离线写博客 导入导出Markdown文件 丰富的快捷键 快捷键 加粗 Ctrl + B 斜体 Ctrl + I 引用 Ctrl
Linux内核中的Watchdog
weixin_44376670的博客
10-09 6322
linux /dev/watchdog softlockup hardlockup 看门狗 kvm watchdog i6300esb
arm hardware breakpoint 与 watchpoint 原理
shenhuxi_yu的专栏
10-18 5041
aarch32 linux4.9 kernel 有breakpoint的编码实例data_breakpoint.c 相关函数: register_wide_hw_breakpoint //kernel space 地址 register_user_hw_breakpoint //user space 地址 breakpoint 与watchpoint的原理需要查阅armv7_arch...
在wsl下开发T113的主线linux（5）-构建ubi文件系统
Dommsday的博客
01-01 2394
这篇文章记录了在wsl系统下编译调试awboot和linux的全过程
Linux 性能检测/调优之Perf_Event
He11o_Liu的专栏
05-18 8501
引言 Linux性能检测/调优是一个很大的话题，涉及的内容也非常广泛。目前，从硬件层面到系统层面都提供了一系列硬件支持/软件工具给开发者来检测系统性能以针对具体问题进行调优。 本文主要关注其中的利用性能计数器（Performance Counter）进行性能检测的linux工具Perf，介绍了其强大的能力以及部分使用方法。本文主要部分参考了Brendan D. Gregg的博客，在该博客的Pe...
评论
添加红包

请填写红包祝福语或标题

个

红包个数最小为10个

元

红包金额最低5元

当前余额3.43元 前往充值 >
需支付：10.00元
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付元
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明：

1.余额是钱包充值的虚拟货币，按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载，可以购买VIP、付费专栏及课程。

余额充值