Question

How is a breakpoint implemented on PPC (On OS X, to be specific)?

For example, on x86 it's typically done with the INT 3 instruction (0xCC) -- is there an instruction comparable to this for ppc? Or is there some other way they're set/implemented?

Was it helpful?

Solution

I'm told by a reliable (but currently inebriated, so take it with a grain of salt) source that it's a zero instruction which is illegal and causes some sort of system trap.

EDIT: Made into community wiki in case my friend is so drunk that he's talking absolute rubbish :-)

OTHER TIPS

With gdb and a function that hexdumps itself, I get 0x7fe00008. This appears to be the tw instruction:

0b01111111111000000000000000001000
  011111                           31
        11111                      condition flags: lt, gt, ge, logical lt, logical gt
             00000                 rA
                  00000            rB
                       0000000100  constant 4
                                 0 reserved

i.e. compare r0 to r0 and trap on any result.

The GDB disassembly is simply the extended mnemonic trap

EDIT: I'm using "GNU gdb 6.3.50-20050815 (Apple version gdb-696) (Sat Oct 20 18:20:28 GMT 2007)"

EDIT 2: It's also possible that conditional breakpoints will use other forms of tw or twi if the required values are already in registers and the debugger doesn't need to keep track of the hit count.

Besides software breakpoints, PPC also supports hardware breakpoints, implemented via IABR (and possibly IABR2, depending on the core version) registers. These are instructions breakpoints, but there are also data breakpoints (implemented with DABR and, possibly, DABR2). If your core supports two sets of hardware breakpoint registers (i.e. IABR2 and DABR2 are present), you can do more than just trigger on a specific address: you can specify a whole contiguous range of addresses as a breakpoint target. For data breakpoints, you can also specify whether you want them to trigger on write, or read, or any access.

Best guess is a 'tw' or 'twi' instruction.

You could dig into the source code of PPC gdb, OS X probably uses the same functionality as its FreeBSD roots.

Instruction breakpoints are typically realised with the TRAP instruction or with the IABR debug hardware register.

Example implementations: ArchLinux, Apple, Wii and Wii U.

Licensed under: CC-BY-SA with attribution
Not affiliated with StackOverflow
scroll top