Breakpointing the commpage crashes kernel: vm_protect, submaps, ...
site_archiver@lists.apple.com Delivered-To: darwin-kernel@lists.apple.com Domainkey-signature: a=rsa-sha1; q=dns; c=nofws; s=beta; d=gmail.com; h=received:message-id:date:from:reply-to:to:subject:mime-version:content-type:content-transfer-encoding; b=peIxTwDAZb159OAv2LigEfUJYw4l+B+frIrCbSXMH8Tsajh5aRnMSiQ9pxVwQtc7ikgxcWpjTMTb6dHSMXp0k9f1YMSULPWeJiWumZe1bE/0tPZ78C75+S727U7p2GHPpz6vb15QM5XeNzoLlenUGH83bxTOLC3ZBvND9nt0KOQ= Hi I have a need to momentarily modify instructions [from within a process's context in kernel space] in that process's address space. gdb does similar things when setting up breakpoints in gdb/src/gdb/macosx/macosx-nat-mutils.c:mach_xfer_memory() In my experiment, writing bytes in the 0xffff8000-0xffffefff (commpage) range ostensibly works, except that the vm maps of *other* processes somehow seems affected after my experiment. The symptom is that ntpd crashes the kernel, soon after I run my experiment, trying to update some timer value which resides in the commpage. Disabling ntpd allows me to run my experiment and do a vmmap on a boring unrelated pid, such as the login shell. Here are the results: Submap ffff8000-ffffefff r--/r-- process-only submap ffff8000 [ 4K] r--/r-- SM=COW commpage ffff9000 [ 4K] r--/r-- SM=SHM commpage I don't understand this -- using gdb to set up breakpoints on a PID X doesn't change the vmmap on some other PID Y. Why does doing it from the kernel have different effects? The calls I use from the process's kernel context are: vm_region(..., &info, ...) vm_protect(current_map(), user_addr, size, FALSE, // change "current", not "max" protection VM_PROT_READ | VM_PROT_WRITE | VM_PROT_COPY) followed by a copyout(), a pmap_sync_caches_phys(), and then a protection restoration: vm_protect(current_map(), user_addr, size, FALSE, // change "current", not "max" protection info.protection) In my effort at debugging this, I got lost trying to understand some submap nesting code. Oh, and I'm new to the whole Mach/Darwin/Xnu game. Any help is appreciated, Thanks, Chandra _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel@lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.a... This email sent to site_archiver@lists.apple.com
participants (1)
-
Chandra Khan