x86x86-64interruptwatchpoint

Is that possible to set interrupt that breaks when cpu write to an specific address?


Is it possible to make x86 cpu interrupt when specific address is being written?

I want a hardware mechanism to monitor some address's changing.


Solution

  • I would like to know if it is possible to make x86 cpu intrrupt when specific address is being written??

    It is possible.

    You'd set one of the debug registers (DR0 to DR4) to the address you want to monitor, then configure the corresponding flags in DR7 as "global breakpoint, break on data write only, 1-byte size". Once that's done, any normal data write done by that CPU will trigger a Debug Exception (interrupt 1), and the Debug Exception handler can figure out what happened and do whatever actions you wanted (e.g. report the write to the user?).

    However, there are restrictions - you can't just do this yourself in user-space and would need to rely on kernel's support; and kernel's support would want to include saving/restoring debug registers during task switches (so that your breakpoints don't stop working when your task is run on another CPU, and so that your breakpoints don't cause problems for other tasks). Because of that (unless you have full control of the computer/CPU - e.g. you're writing your own kernel) normally you'd have to rely on whatever API the OS provides.

    It also won't work if something else modifies the memory (e.g. a disk controller or network card).