memory range R/W triggered breakpoints in kernel ?

["Mateusz Berezecki" <mateuszb@gmail.com>]

Hello List,

I was thinking about writing some memory R/W access monitor. The only
concern I'm
having is whether it is doable, or are there any already existing and
working solutions like
that for Linux?

The initial concept was to set up some special page fault handler and
mark monitored
memory pages as non present. The monitor pagefault handler would check
if the page
is within monitored location and if yes it would switch to
singlestepping mode and
step the instruction which invoked the pagefault and log the value
which was read/written from
certain address. Afterwards the whole page would be marked as non present again.

Is it possible to succeed with such an approach? Would it work for
memory range mapped to some devices?



kind regards,
Mateusz Berezecki