[lldb-dev] MacOSX attaching to process

[Filipe Cabecinhas]

Hi Benjamin,

On Thursday, July 26, 2012 at 11:54 AM, Benjamin Kemper wrote:

> Hi,
> 
> I've been trying to figure out how does the attaching to process works in OSX, and have some questions regarding it.
> 
> From what I've noticed, the two available "Process" classes are: 
> 1. ProcessGDBRemote
> 2. ProcessKDP (Which seems to be not supported)
> 
> It looks like that ProcessPOSIX isn't included anywhere in OSX classes, so I'm guessing it is not used in OSX. 
> 
Nope, it isn't.
ProcessKDP is for debugging the Mac OS X kernel extensions, AFAICT.
ProcessGDBRemote is what is used on Mac OS X for debugging right now. The lldb team wanted to be sure that remote debugging worked, so they focused on being able to do Mac-to-Mac and Mac-to-iPhone remote debugging. That way you can debug both ways: locally or remote.

> So from what I understand, if a user wants to debug a program locally on the host it goes like this:
> 1. LLDB creates the debugee using posix_spawn with flag that tells it to wait until attached.
> 2. A debug server is launched through an XPC process (to get privileges to use PTrace?)
> 3. The debug server attaches to the process that was launched in (1).
> 
> Is this scenario correct for "regular" debugging (not remote and attaching to an already running process)? 
> 
> Is the use of the debug server only because of the XPC limitiations and being able to use PTrace?
> 
> Thanks in advance,
> Benjamin.


XPC isn't involved for most cases.
In ProcessGDBRemote::StartDebugserverProcess you can see how debugserver gets spawned using Host::LaunchProcess.
That function will only use XPC to launch a process if you asked it to launch with a kid of 0. Otherwise, it will use posix_spawn.
After debugserver gets launched, the Process plugin connects to it and sends and receives commands.

The Linux and FreeBSD plugins don't do this (use debugserver). Actually, if it didn't change from the last time I saw it, debugserver isn't even portable and needs lots of changes to decouple it from Mac OS X.

Regards,

  Filipe