Re: memory range R/W triggered breakpoints in kernel ?

[Benjamin LaHaise <bcrl@kvack.org>]

On Sun, Mar 05, 2006 at 06:00:34PM +0100, Mateusz Berezecki wrote:
> I was thinking about writing some memory R/W access monitor. The only
> concern I'm
> having is whether it is doable, or are there any already existing and
> working solutions like
> that for Linux?

Most CPUs implement memory breakpoints of some sort, although they're 
usually limited to specific address instead of ranges.  See gdb's 
watch/awatch/rwatch commands.

> which was read/written from certain address. Afterwards the whole page 
> would be marked as non present again.

Use mprotect() and do it in userspace by catching SIGSEGV.  Doing it for 
the kernel is non-trivial and will hit upon arch specific issues like 
double fault handlers.  Given that the same sort of debugging can be done 
in userspace with UML and gdb, there isn't terribly much incentive to do 
the work to make something like this happen.

		-ben
-- 
"Time is of no importance, Mr. President, only life is important."
Don't Email: <dont@kvack.org>.