site_archiver@lists.apple.com Delivered-To: darwin-dev@lists.apple.com On Oct 7, 2010, at 12:58 AM, Dave Keck wrote:
Alternately, you could use hardware breakpoints; see the gdb sources for details.
I'll have to add support for those too. Looking at the GDB sources it looks like it might be simpler than the INT3-replacement technique too.
The typical way gdb deals with this is by being privileged due to code signing with regard to taskgated, such that taskgated permits it to do a task_for_pid() call on the process, get the task port, and handle the event as a Mach exception, rather than trying to handle it as a signal. This assumes it's either running under the same credential as the target process, or is running as a privileged used (e.g. via sudo).
I should have mentioned that the breakpoint functionality is built on Mach exceptions as you explain. It seems to work fine, but I must admit that I'm confused by your mentioning of Dtrace and recompiling the kernel to implement my own trap handler. Does that still apply with breakpoints implemented using INT3-replacement and Mach exceptions?
Yes. INT3 causes software traps. That's how it works. Since dtrace uses INT3, if you use INT3, you will need to cooperate with dtrace or prohibit simultaneous execution. Since there's no way to enforce such an execution prohibition programmatically, you can either do it by administrative fiat ("documentation says 'don't do that'", trust people to read your documentation), or you can simply break when it happens. The only way to cooperate would be to hook where dtrace hooks, which is in the kernel trap handler, and since there's no way to do that programmatically either, you'd have to compile your own kernel to do it. Personally, I'd just use hardware breakpoints. -- Terry _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev@lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.appl... This email sent to site_archiver@lists.apple.com