x86 debug registers (dr0 to dr3) allow to break on a specific address when software attempts to read/write in (intel doc). And this configured address must be a linear address.
The problem is that when paging is enabled, the same physical address may be mapped to by several different linear addresses from different task.
So, how to break on access to a specific physical address when we do not know all its possible linear alias addresses?
Without modifying the underlying kernel, you can only do that with virtualization extensions. When you are a guest OS, what you think of as physical addresses are virtual to the next layer down; so it can use the debug registers to achieve the desired effect.
If you are willing to modify the kernel, one avenue is to refuse to map a ‘page of interest’, then redirect all faults on this page to the appropriate debuggers. It is trickier than I am stating, you may have to emulate/singlestep some code and keep some intricate state.