Re: memory range R/W triggered breakpoints in kernel ?

From: Benjamin LaHaise
Date: Sun Mar 05 2006 - 18:19:39 EST


On Sun, Mar 05, 2006 at 06:00:34PM +0100, Mateusz Berezecki wrote:
> I was thinking about writing some memory R/W access monitor. The only
> concern I'm
> having is whether it is doable, or are there any already existing and
> working solutions like
> that for Linux?

Most CPUs implement memory breakpoints of some sort, although they're
usually limited to specific address instead of ranges. See gdb's
watch/awatch/rwatch commands.

> which was read/written from certain address. Afterwards the whole page
> would be marked as non present again.

Use mprotect() and do it in userspace by catching SIGSEGV. Doing it for
the kernel is non-trivial and will hit upon arch specific issues like
double fault handlers. Given that the same sort of debugging can be done
in userspace with UML and gdb, there isn't terribly much incentive to do
the work to make something like this happen.

-ben
--
"Time is of no importance, Mr. President, only life is important."
Don't Email: <dont@xxxxxxxxx>.
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/